npm - @daloyjs/core - Versions diffs - 1.0.0-beta.3 → 1.0.0-beta.5 - Mend

@daloyjs/core 1.0.0-beta.3 → 1.0.0-beta.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (13) hide show

package/dist/docs.d.ts CHANGED Viewed

@@ -254,6 +254,42 @@ export interface DocsAssetOptions {
      */
     crossOrigin?: "anonymous" | "use-credentials";
 }
+/**
+ * Provider-neutral login launcher rendered into generated docs pages.
+ *
+ * Use this when the OpenAPI docs should expose a visible authorization control
+ * that sends developers to a local login form or to an external identity
+ * provider such as Entra ID, Auth0, Better Auth, Clerk, Okta, Keycloak, or any
+ * other OAuth2/OIDC front end. The launcher only opens the configured URL; it
+ * never stores tokens or bypasses the OpenAPI UI's normal security-scheme
+ * handling.
+ *
+ * @since 0.43.0
+ */
+export interface DocsAuthLauncherOptions {
+    /**
+     * Absolute `http(s)` URL or same-origin/relative URL for the login or
+     * authorization entry point. `javascript:`, `data:`, and other executable
+     * schemes are refused when the HTML is generated.
+     */
+    loginUrl: string;
+    /** Button text. Defaults to `"Authorize"`. */
+    label?: string;
+    /**
+     * Accessible helper text shown as the button title and screen-reader label.
+     * Defaults to `"Open login or identity provider"`.
+     */
+    description?: string;
+    /**
+     * How to open {@link DocsAuthLauncherOptions.loginUrl}. Defaults to
+     * `"popup"` so docs remain open while the provider flow runs.
+     */
+    target?: "popup" | "_blank" | "_self";
+    /** Popup width in CSS/device pixels. Defaults to `520`. */
+    popupWidth?: number;
+    /** Popup height in CSS/device pixels. Defaults to `720`. */
+    popupHeight?: number;
+}
 /** Shared options for {@link scalarHtml}, {@link swaggerUiHtml}, and {@link redocHtml}. */
 export interface DocsOptions {
     /** Absolute or relative URL of the OpenAPI document to render. */
@@ -267,6 +303,14 @@ export interface DocsOptions {
     assets?: DocsAssetOptions;
     /** CSP `nonce` to apply to inline/script tags; must match the response CSP. */
     scriptNonce?: string;
+    /**
+     * Optional authorization launcher rendered into the docs page. It gives
+     * Scalar, Swagger UI, and Redoc a consistent visible button that opens a
+     * local login form or third-party identity-provider authorization URL.
+     *
+     * @since 0.43.0
+     */
+    auth?: DocsAuthLauncherOptions;
 }
 /** Options for {@link scalarHtml}; adds Scalar-specific UI configuration. */
 export interface ScalarHtmlOptions extends DocsOptions {

package/dist/docs.js CHANGED Viewed

@@ -49,8 +49,7 @@ function integrityAttr(integrity, crossOrigin) {
 export function scalarHtml(opts) {
     const title = escapeHtml(opts.title ?? "API Reference");
     const url = escapeHtml(opts.specUrl);
-    const scriptUrl = escapeHtml(opts.assets?.scalarScriptUrl ??
-        `${JSDELIVR_ORIGIN}/npm/@scalar/api-reference`);
+    const scriptUrl = escapeHtml(opts.assets?.scalarScriptUrl ?? `${JSDELIVR_ORIGIN}/npm/@scalar/api-reference`);
     const scriptSri = integrityAttr(opts.assets?.scalarScriptIntegrity, opts.assets?.crossOrigin);
     const nonce = nonceAttr(opts.scriptNonce);
     const configuration = scalarConfigurationAttr(opts.specUrl, opts.configuration);
@@ -62,6 +61,7 @@ export function scalarHtml(opts) {
 </head><body>
 <script id="api-reference" data-url="${url}"${configuration}${nonce}></script>
 <script src="${scriptUrl}"${scriptSri}${nonce}></script>
+${docsAuthLauncherHtml(opts.auth, opts.scriptNonce)}
 </body></html>`;
 }
 /**
@@ -74,10 +74,8 @@ export function scalarHtml(opts) {
  */
 export function swaggerUiHtml(opts) {
     const title = escapeHtml(opts.title ?? "API Docs");
-    const cssUrl = escapeHtml(opts.assets?.swaggerUiCssUrl ??
-        `${JSDELIVR_ORIGIN}/npm/swagger-ui-dist/swagger-ui.css`);
-    const bundleUrl = escapeHtml(opts.assets?.swaggerUiBundleUrl ??
-        `${JSDELIVR_ORIGIN}/npm/swagger-ui-dist/swagger-ui-bundle.js`);
+    const cssUrl = escapeHtml(opts.assets?.swaggerUiCssUrl ?? `${JSDELIVR_ORIGIN}/npm/swagger-ui-dist/swagger-ui.css`);
+    const bundleUrl = escapeHtml(opts.assets?.swaggerUiBundleUrl ?? `${JSDELIVR_ORIGIN}/npm/swagger-ui-dist/swagger-ui-bundle.js`);
     const cssSri = integrityAttr(opts.assets?.swaggerUiCssIntegrity, opts.assets?.crossOrigin);
     const bundleSri = integrityAttr(opts.assets?.swaggerUiBundleIntegrity, opts.assets?.crossOrigin);
     const nonce = nonceAttr(opts.scriptNonce);
@@ -97,6 +95,7 @@ export function swaggerUiHtml(opts) {
 <div id="swagger"></div>
 <script src="${bundleUrl}"${bundleSri}${nonce}></script>
 <script${nonce}>window.onload=()=>SwaggerUIBundle(${configuration});</script>
+${docsAuthLauncherHtml(opts.auth, opts.scriptNonce)}
 </body></html>`;
 }
 /**
@@ -115,8 +114,7 @@ export function swaggerUiHtml(opts) {
  */
 export function redocHtml(opts) {
     const title = escapeHtml(opts.title ?? "API Docs");
-    const scriptUrl = escapeHtml(opts.assets?.redocScriptUrl ??
-        `${JSDELIVR_ORIGIN}/npm/redoc/bundles/redoc.standalone.js`);
+    const scriptUrl = escapeHtml(opts.assets?.redocScriptUrl ?? `${JSDELIVR_ORIGIN}/npm/redoc/bundles/redoc.standalone.js`);
     const scriptSri = integrityAttr(opts.assets?.redocScriptIntegrity, opts.assets?.crossOrigin);
     const nonce = nonceAttr(opts.scriptNonce);
     const specArg = jsonForScript(opts.specUrl);
@@ -130,6 +128,7 @@ export function redocHtml(opts) {
 <div id="redoc"></div>
 <script src="${scriptUrl}"${scriptSri}${nonce}></script>
 <script${nonce}>Redoc.init(${specArg},${optionsArg},document.getElementById("redoc"));</script>
+${docsAuthLauncherHtml(opts.auth, opts.scriptNonce)}
 </body></html>`;
 }
 /**
@@ -238,6 +237,46 @@ function escapeHtml(s) {
 function jsonForScript(value) {
     return JSON.stringify(value).replace(/[<\u2028\u2029]/g, (c) => ({ "<": "\\u003c", "\u2028": "\\u2028", "\u2029": "\\u2029" })[c]);
 }
+function docsAuthLauncherHtml(auth, scriptNonce) {
+    if (!auth)
+        return "";
+    const loginUrl = normalizeDocsAuthLoginUrl(auth.loginUrl);
+    const label = auth.label ?? "Authorize";
+    const description = auth.description ?? "Open login or identity provider";
+    const target = auth.target ?? "popup";
+    const popupWidth = positiveIntegerOrDefault(auth.popupWidth, 520);
+    const popupHeight = positiveIntegerOrDefault(auth.popupHeight, 720);
+    const payload = jsonForScript({
+        loginUrl,
+        target,
+        popupWidth,
+        popupHeight,
+    });
+    const nonce = nonceAttr(scriptNonce);
+    return `<style>
+.daloy-docs-auth{position:fixed;right:16px;top:16px;z-index:2147483647;display:inline-flex;align-items:center;gap:8px;border:1px solid #1d4ed8;border-radius:6px;background:#2563eb;color:#fff;font:600 14px/1.2 system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;padding:10px 14px;box-shadow:0 8px 24px rgba(15,23,42,.18);cursor:pointer}
+.daloy-docs-auth:focus{outline:3px solid rgba(37,99,235,.35);outline-offset:2px}
+</style>
+<button type="button" class="daloy-docs-auth" data-daloy-docs-auth title="${escapeHtml(description)}" aria-label="${escapeHtml(description)}">${escapeHtml(label)}</button>
+<script${nonce}>(()=>{const o=${payload};const b=document.querySelector("[data-daloy-docs-auth]");if(!b)return;b.addEventListener("click",()=>{if(o.target==="_self"){window.location.assign(o.loginUrl);return;}if(o.target==="_blank"){window.open(o.loginUrl,"_blank","noopener,noreferrer");return;}const left=Math.max(0,Math.round((window.screenX||0)+((window.outerWidth||o.popupWidth)-o.popupWidth)/2));const top=Math.max(0,Math.round((window.screenY||0)+((window.outerHeight||o.popupHeight)-o.popupHeight)/2));const features="popup=yes,width="+o.popupWidth+",height="+o.popupHeight+",left="+left+",top="+top+",noopener,noreferrer";window.open(o.loginUrl,"daloy_docs_auth",features);});})();</script>`;
+}
+function normalizeDocsAuthLoginUrl(loginUrl) {
+    if (typeof loginUrl !== "string" || loginUrl.trim() === "") {
+        throw new TypeError("docs auth loginUrl must be a non-empty string");
+    }
+    const trimmed = loginUrl.trim();
+    const parsed = new URL(trimmed, "https://daloyjs.local");
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        throw new TypeError(`docs auth loginUrl must be an http(s) or relative URL; got ${JSON.stringify(loginUrl)}`);
+    }
+    return trimmed;
+}
+function positiveIntegerOrDefault(value, fallback) {
+    if (typeof value === "number" && Number.isInteger(value) && value > 0) {
+        return value;
+    }
+    return fallback;
+}
 function scalarConfigurationAttr(specUrl, configuration) {
     if (!configuration)
         return "";

package/dist/index.d.ts CHANGED Viewed

@@ -11,28 +11,28 @@ export type { BehindProxyConfig, ConnInfo } from "./conn-info.js";
 export { subdomains, PSL_SNAPSHOT_DATE, PSL_PUBLIC_SUFFIXES, MAX_SNAPSHOT_AGE_DAYS, } from "./subdomains.js";
 export type { SubdomainsOptions, SubdomainsResult } from "./subdomains.js";
 export { defineDependency, DEPENDENCY_MARKER } from "./dependency.js";
-export type { DependencyHooks, DependencyOptions, } from "./dependency.js";
+export type { DependencyHooks, DependencyOptions } from "./dependency.js";
 export type { RouteDefinition, HttpMethod, PathString, RequestSchemas, ResponsesMap, ResponseSpec, AuthSpec, Hooks, BaseContext, AppState, AuthScheme, AuthContext, HandlerReturn, InferRequest, ParamsOf, PathParams, CallbackDefinition, CallbackMap, CallbackOperation, RouteExample, RouteMeta, } from "./types.js";
 export { HttpError, BadRequestError, ValidationError, NotFoundError, ConflictError, UnauthorizedError, ForbiddenError, MethodNotAllowedError, PayloadTooLargeError, RequestHeaderFieldsTooLargeError, UnsupportedMediaTypeError, TooManyRequestsError, RequestTimeoutError, InternalError, MessageLeakError, httpError, SAFE_CUSTOM_ERROR_RESPONSE_HEADERS, checkCustomErrorResponseHeaders, } from "./errors.js";
 export type { ProblemDetails, ProblemRenderOptions, HttpErrorOptions } from "./errors.js";
 export type { StandardSchemaV1 } from "./schema.js";
 export { validate, isStandardSchema } from "./schema.js";
 export { diffOpenAPI, hasBreakingChanges } from "./openapi-diff.js";
-export type { ChangeSeverity, OpenAPIChange, OpenAPIDiffResult, } from "./openapi-diff.js";
+export type { ChangeSeverity, OpenAPIChange, OpenAPIDiffResult } from "./openapi-diff.js";
 export { readBodyLimited, safeJsonParse, isForbiddenObjectKey, sanitizeHeaderName, sanitizeHeaderValue, timingSafeEqual, randomId, assertNoDuplicateSingletonHeaders, assertNoReservedInternalHeaders, assertHeaderCountWithinLimit, DEFAULT_MAX_HEADER_COUNT, RESERVED_INBOUND_HEADER_PREFIXES, SMUGGLING_SINGLETON_HEADERS, verifyWebhookSignature, signWebhookPayload, WEBHOOK_DEFAULT_TOLERANCE_SECONDS, assertStrongSecret, MIN_PROD_SECRET_BYTES, WEAK_SECRET_STRINGS, sanitizeFilename, assertSafeRelativePath, hasMongoOperatorKeys, assertNoMongoOperators, } from "./security.js";
 export type { WebhookHmacAlgorithm } from "./security.js";
 export { requestId, secureHeaders, SECURE_HEADERS_MARKER, cors, CORS_HOOK_MARKER, CORS_ORIGIN_ALLOW_MARKER, CORS_WILDCARD_ORIGIN_MARKER, rateLimit, loginThrottle, timing, bearerAuth, basicAuth, csrf, CSRF_HOOK_MARKER, fetchMetadata, requireScopes, REQUIRE_SCOPES_AGGREGATE_KEY, REQUIRE_SCOPES_HOOK_MARKER, _resetSharedRateLimitStoresForTests, } from "./middleware.js";
 export { etag } from "./etag.js";
 export type { ETagOptions } from "./etag.js";
 export { compression, COMPRESSION_HOOK_MARKER, _resetCompressionRuntimeProbeForTests, } from "./compression.js";
-export type { CompressionEncoding, CompressionOptions, } from "./compression.js";
+export type { CompressionEncoding, CompressionOptions } from "./compression.js";
 export { createJwtSigner, createJwtVerifier, JwtError, DEFAULT_JWT_MAX_LIFETIME_SECONDS, } from "./jwt.js";
 export type { JwtAlgorithm, JwtKeyMaterial, JwtSignerOptions, JwtVerifierOptions, JwtVerified, } from "./jwt.js";
 export { jwk } from "./jwk.js";
-export type { JwkAlgorithm, JwkOptions, JwkSet, JwkSource, JwkVerifyHook, } from "./jwk.js";
+export type { JwkAlgorithm, JwkOptions, JwkSet, JwkSource, JwkVerifyHook } from "./jwk.js";
 export { serializeCookie, serializeClearCookie, assertCookieAttributes, readRequestCookie, } from "./cookie.js";
 export type { CookieAttributes, CookieSameSite } from "./cookie.js";
-export { assertTemporalClaims, TemporalClaimError, } from "./time-claims.js";
+export { assertTemporalClaims, TemporalClaimError } from "./time-claims.js";
 export type { TemporalClaims, TemporalClaimErrorCode, AssertTemporalClaimsOptions, } from "./time-claims.js";
 export { every, some, except } from "./combine.js";
 export type { ExceptPredicate } from "./combine.js";
@@ -42,24 +42,24 @@ export { fetchGuard, SsrfBlockedError } from "./fetch-guard.js";
 export type { FetchGuardOptions, SsrfBlockReason } from "./fetch-guard.js";
 export { resilientFetch, CircuitBreaker, CircuitOpenError, FetchTimeoutError, } from "./fetch-resilience.js";
 export type { ResilientFetchOptions, CircuitBreakerOptions, CircuitState, RetryContext, } from "./fetch-resilience.js";
-export { createWebhookSender, MemoryWebhookDeadLetterSink, } from "./webhook-delivery.js";
+export { createWebhookSender, MemoryWebhookDeadLetterSink } from "./webhook-delivery.js";
 export type { WebhookEvent, WebhookSenderOptions, WebhookDeliveryResult, WebhookDeadLetter, WebhookDeadLetterSink, WebhookAttempt, } from "./webhook-delivery.js";
-export { Scheduler, CronParseError, parseCron, nextCronRun, } from "./scheduler.js";
+export { Scheduler, CronParseError, parseCron, nextCronRun } from "./scheduler.js";
 export type { SchedulerOptions, SchedulerLogger, TimerFns, TaskDefinition, TaskHandler, TaskRunContext, TaskErrorInfo, TaskState, CronFields, } from "./scheduler.js";
 export { clientCertAuth, setClientCertificate, getClientCertificate, normalizePeerCertificate, parseForwardedClientCert, } from "./mtls.js";
 export type { ClientCertificate, ClientCertificateSource, ClientCertAuthOptions, ClientCertHeaderConfig, PeerCertificateLike, } from "./mtls.js";
 export { signMessage, signRequest, verifyMessage, verifyRequest, httpSignatureAuth, contentDigest, verifyContentDigest, DEFAULT_SIGNATURE_LABEL, DEFAULT_MAX_SIGNATURE_AGE_SECONDS, DEFAULT_SIGNATURE_CLOCK_SKEW_SECONDS, } from "./http-signatures.js";
 export type { HttpSignatureAlgorithm, HttpSignatureKeyMaterial, HttpSignatureKey, SignMessageOptions, SignRequestOptions, MessageSignature, VerifyMessageOptions, VerifyResult, VerifySuccess, VerifyFailure, KeyResolutionInfo, HttpSignatureAuthOptions, ContentDigestAlgorithm, } from "./http-signatures.js";
-export { autoBan, MemoryAutoBanStore, _resetAutoBanStoresForTests, } from "./auto-ban.js";
+export { autoBan, MemoryAutoBanStore, _resetAutoBanStoresForTests } from "./auto-ban.js";
 export type { AutoBanOptions, AutoBanStore, AutoBanRecord, AutoBanEvent, AutoBanStrikeEvent, } from "./auto-ban.js";
 export { botGuard, GOOGLEBOT, BINGBOT, WELL_KNOWN_BOTS } from "./bot-guard.js";
-export type { BotGuardOptions, BotGuardEvent, BotResolver, VerifiedBotRule, } from "./bot-guard.js";
+export type { BotGuardOptions, BotGuardEvent, BotResolver, VerifiedBotRule } from "./bot-guard.js";
 export { ipReputation, urlFeed } from "./ip-reputation.js";
 export type { IpReputationOptions, IpReputationFeed, IpReputationMatch, IpReputationController, UrlFeedOptions, } from "./ip-reputation.js";
 export { geoBlock } from "./geo-block.js";
 export type { GeoBlockOptions, GeoBlockDecision, GeoBlockReason, GeoState, CountryFromIp, CountryFromContext, } from "./geo-block.js";
 export { concurrencyLimit } from "./concurrency-limit.js";
-export type { ConcurrencyLimitOptions, ConcurrencyRejection, } from "./concurrency-limit.js";
+export type { ConcurrencyLimitOptions, ConcurrencyRejection } from "./concurrency-limit.js";
 export { requestDecompression, decompressRequestBody, DecompressionBombError, UnsupportedContentEncodingError, MalformedCompressedBodyError, _resetRequestDecompressionProbeForTests, } from "./request-decompression.js";
 export type { RequestDecompressionOptions, RequestDecompressionEncoding, DecompressionBombInfo, } from "./request-decompression.js";
 export { waf } from "./waf.js";
@@ -67,17 +67,17 @@ export type { WafOptions, WafMode, WafRuleId, WafRuleConfig, WafInspectConfig, W
 export { safeRedirect, OpenRedirectBlockedError } from "./safe-redirect.js";
 export type { SafeRedirectOptions, SafeRedirectStatus, SafeRedirectBlockReason, } from "./safe-redirect.js";
 export { loadShedding, LOAD_SHEDDING_MARKER } from "./load-shedding.js";
-export type { LoadSheddingOptions, LoadSheddingSnapshot, } from "./load-shedding.js";
+export type { LoadSheddingOptions, LoadSheddingSnapshot } from "./load-shedding.js";
 export { defineConfig, ConfigValidationError } from "./config.js";
-export type { ConfigSource, DefineConfigOptions, } from "./config.js";
+export type { ConfigSource, DefineConfigOptions } from "./config.js";
 export type { RequestIdOptions, SecureHeadersOptions, CspDirectivesOptions, CorsOptions, CorsOriginAllow, RateLimitOptions, RateLimitStore, LoginThrottleOptions, CsrfOptions, CsrfCookieOptions, FetchMetadataOptions, BasicAuthOptions, } from "./middleware.js";
 export type { BearerAuthOptions, BearerAuthVerifyHook } from "./middleware.js";
 export { createLogger, noopLogger, DEFAULT_REDACT_KEYS } from "./logger.js";
-export type { Logger, LogLevel, ConsoleLoggerOptions, LoggerRedactionOptions, } from "./logger.js";
-export type { ScalarJsonPrimitive, ScalarJsonValue, ScalarReferenceConfiguration, ScalarTheme, RedocConfiguration, RedocHtmlOptions, SwaggerUiConfiguration, SwaggerUiHtmlOptions, AsyncApiHtmlOptions, DocsAssetOptions, } from "./docs.js";
+export type { Logger, LogLevel, ConsoleLoggerOptions, LoggerRedactionOptions } from "./logger.js";
+export type { ScalarJsonPrimitive, ScalarJsonValue, ScalarReferenceConfiguration, ScalarTheme, RedocConfiguration, RedocHtmlOptions, SwaggerUiConfiguration, SwaggerUiHtmlOptions, AsyncApiHtmlOptions, DocsAssetOptions, DocsAuthLauncherOptions, } from "./docs.js";
 export { formatStartupBanner, printStartupBanner } from "./banner.js";
 export type { StartupBannerLink, StartupBannerOptions } from "./banner.js";
-export { sseStream, sseResponse, ndjsonStream, ndjsonResponse, } from "./streaming.js";
+export { sseStream, sseResponse, ndjsonStream, ndjsonResponse } from "./streaming.js";
 export type { SSEMessage, StreamOptions, SSEStreamOptions, SSEResponseOptions, NDJSONResponseOptions, } from "./streaming.js";
 export { httpBearerScheme, httpBasicScheme, apiKeyScheme, oauth2Scheme, openIdConnectScheme, REQUIRE_PAYLOAD_AUTH_EXTENSION, securitySchemeRequiresPayloadAuth, toOpenAPISecurityScheme, } from "./security-schemes.js";
 export type { ApiKeyLocation, ApiKeyScheme, ApiKeySchemeOptions, HttpBasicScheme, HttpBasicSchemeOptions, HttpBearerScheme, HttpBearerSchemeOptions, OAuth2AuthorizationCodeFlow, OAuth2ClientCredentialsFlow, OAuth2Flows, OAuth2ImplicitFlow, OAuth2PasswordFlow, OAuth2Scheme, OAuth2SchemeOptions, OpenIdConnectScheme, OpenIdConnectSchemeOptions, SecurityScheme, RequirePayloadAuthExtension, } from "./security-schemes.js";
@@ -88,11 +88,11 @@ export type { SessionOptions, SessionCookieOptions, SessionContext, SessionRecor
 export { idempotency, MemoryIdempotencyStore, _resetSharedIdempotencyStoresForTests, } from "./idempotency.js";
 export type { IdempotencyOptions, IdempotencyStore, IdempotencyRecord, StoredIdempotentResponse, } from "./idempotency.js";
 export { responseCache, MemoryResponseCacheStore, _resetSharedResponseCacheStoresForTests, } from "./response-cache.js";
-export type { ResponseCacheOptions, ResponseCacheStore, CachedResponse, } from "./response-cache.js";
+export type { ResponseCacheOptions, ResponseCacheStore, CachedResponse } from "./response-cache.js";
 export { encodeCursor, decodeCursor, buildLinkHeader, buildPageLinks, paginationQuery, MAX_CURSOR_LENGTH, } from "./pagination.js";
 export type { PaginationLink, PageLinkOptions, PageLinks, PaginationQueryOptions, PaginationParams, PaginationQuerySchema, } from "./pagination.js";
 export { MetricsRegistry, Counter, Gauge, Histogram, httpMetrics, DEFAULT_DURATION_BUCKETS, PROMETHEUS_CONTENT_TYPE, } from "./metrics.js";
-export type { MetricLabels, MetricsRegistryOptions, HttpMetricsOptions, } from "./metrics.js";
+export type { MetricLabels, MetricsRegistryOptions, HttpMetricsOptions } from "./metrics.js";
 export { fileField, multipartObject, isFileFieldSchema, isMultipartObjectSchema, } from "./multipart.js";
 export type { FileFieldSchema, FileFieldOptions, FileMagicBytesOption, FileMagicBytesSignature, MultipartObjectOptions, MultipartShape, UploadedFile, } from "./multipart.js";
 export { otelTracing, TRACING_SPAN_KIND_SERVER, TRACING_SPAN_STATUS_UNSET, TRACING_SPAN_STATUS_OK, TRACING_SPAN_STATUS_ERROR, } from "./tracing.js";

package/dist/index.js CHANGED Viewed

@@ -18,16 +18,16 @@ export { compression, COMPRESSION_HOOK_MARKER, _resetCompressionRuntimeProbeForT
 export { createJwtSigner, createJwtVerifier, JwtError, DEFAULT_JWT_MAX_LIFETIME_SECONDS, } from "./jwt.js";
 export { jwk } from "./jwk.js";
 export { serializeCookie, serializeClearCookie, assertCookieAttributes, readRequestCookie, } from "./cookie.js";
-export { assertTemporalClaims, TemporalClaimError, } from "./time-claims.js";
+export { assertTemporalClaims, TemporalClaimError } from "./time-claims.js";
 export { every, some, except } from "./combine.js";
 export { ipRestriction } from "./ip-restriction.js";
 export { fetchGuard, SsrfBlockedError } from "./fetch-guard.js";
 export { resilientFetch, CircuitBreaker, CircuitOpenError, FetchTimeoutError, } from "./fetch-resilience.js";
-export { createWebhookSender, MemoryWebhookDeadLetterSink, } from "./webhook-delivery.js";
-export { Scheduler, CronParseError, parseCron, nextCronRun, } from "./scheduler.js";
+export { createWebhookSender, MemoryWebhookDeadLetterSink } from "./webhook-delivery.js";
+export { Scheduler, CronParseError, parseCron, nextCronRun } from "./scheduler.js";
 export { clientCertAuth, setClientCertificate, getClientCertificate, normalizePeerCertificate, parseForwardedClientCert, } from "./mtls.js";
 export { signMessage, signRequest, verifyMessage, verifyRequest, httpSignatureAuth, contentDigest, verifyContentDigest, DEFAULT_SIGNATURE_LABEL, DEFAULT_MAX_SIGNATURE_AGE_SECONDS, DEFAULT_SIGNATURE_CLOCK_SKEW_SECONDS, } from "./http-signatures.js";
-export { autoBan, MemoryAutoBanStore, _resetAutoBanStoresForTests, } from "./auto-ban.js";
+export { autoBan, MemoryAutoBanStore, _resetAutoBanStoresForTests } from "./auto-ban.js";
 export { botGuard, GOOGLEBOT, BINGBOT, WELL_KNOWN_BOTS } from "./bot-guard.js";
 export { ipReputation, urlFeed } from "./ip-reputation.js";
 export { geoBlock } from "./geo-block.js";
@@ -39,7 +39,7 @@ export { loadShedding, LOAD_SHEDDING_MARKER } from "./load-shedding.js";
 export { defineConfig, ConfigValidationError } from "./config.js";
 export { createLogger, noopLogger, DEFAULT_REDACT_KEYS } from "./logger.js";
 export { formatStartupBanner, printStartupBanner } from "./banner.js";
-export { sseStream, sseResponse, ndjsonStream, ndjsonResponse, } from "./streaming.js";
+export { sseStream, sseResponse, ndjsonStream, ndjsonResponse } from "./streaming.js";
 export { httpBearerScheme, httpBasicScheme, apiKeyScheme, oauth2Scheme, openIdConnectScheme, REQUIRE_PAYLOAD_AUTH_EXTENSION, securitySchemeRequiresPayloadAuth, toOpenAPISecurityScheme, } from "./security-schemes.js";
 export { discriminator, discriminatedUnion } from "./discriminator.js";
 export { session, rotateSession, signValue, verifySignedValue, MemorySessionStore, SESSION_HOOK_MARKER, SESSION_SECRETS_MARKER, } from "./session.js";

package/dist/sbom.cdx.json CHANGED Viewed

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:6e9958fe-26f1-5084-94ea-5ff9bfb68412",
+  "serialNumber": "urn:uuid:448a4447-0b88-5512-8ce5-485b6688ff4c",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-24T05:34:04.875Z",
+    "timestamp": "2026-07-01T13:38:31.674Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "1.0.0-beta.3"
+        "version": "1.0.0-beta.5"
       }
     ],
     "authors": [
@@ -19,11 +19,11 @@
     ],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/@daloyjs/core@1.0.0-beta.3",
+      "bom-ref": "pkg:npm/@daloyjs/core@1.0.0-beta.5",
       "name": "@daloyjs/core",
-      "version": "1.0.0-beta.3",
+      "version": "1.0.0-beta.5",
       "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
-      "purl": "pkg:npm/@daloyjs/core@1.0.0-beta.3",
+      "purl": "pkg:npm/@daloyjs/core@1.0.0-beta.5",
       "licenses": [
         {
           "license": {
@@ -46,9 +46,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag--daloyjs-core-1.0.0-beta.3",
+        "tagId": "swidtag--daloyjs-core-1.0.0-beta.5",
         "name": "@daloyjs/core",
-        "version": "1.0.0-beta.3",
+        "version": "1.0.0-beta.5",
         "tagVersion": 0,
         "patch": false
       }
@@ -57,7 +57,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/@daloyjs/core@1.0.0-beta.3",
+      "ref": "pkg:npm/@daloyjs/core@1.0.0-beta.5",
       "dependsOn": []
     }
   ]

package/dist/sbom.spdx.json CHANGED Viewed

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@daloyjs/core-1.0.0-beta.3",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.0.0-beta.3-6e9958fe-26f1-5084-94ea-5ff9bfb68412",
+  "name": "@daloyjs/core-1.0.0-beta.5",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.0.0-beta.5-448a4447-0b88-5512-8ce5-485b6688ff4c",
   "creationInfo": {
-    "created": "2026-06-24T05:34:04.875Z",
+    "created": "2026-07-01T13:38:31.674Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package--daloyjs-core",
       "name": "@daloyjs/core",
-      "versionInfo": "1.0.0-beta.3",
+      "versionInfo": "1.0.0-beta.5",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/@daloyjs/core@1.0.0-beta.3"
+          "referenceLocator": "pkg:npm/@daloyjs/core@1.0.0-beta.5"
         }
       ]
     }

package/dist/tenancy.d.ts CHANGED Viewed

@@ -5,9 +5,9 @@
  * once per request, validates and normalizes it, and exposes it on
  * `ctx.state.tenant` for handlers and downstream middleware. It is the
  * single source of truth for "who is this request for" so the per-tenant
- * isolation knobs on the rest of the framework (`rateLimit` `keyGenerator`,
- * `concurrencyLimit` / `idempotency` / `responseCache` `scope`) can all key
- * off the same resolved value via {@link tenantScope}.
+ * isolation knobs on the rest of the framework (`rateLimit` /
+ * `responseCache` `keyGenerator`, `concurrencyLimit` / `idempotency` `scope`)
+ * can all key off the same resolved value via {@link tenantScope}.
  *
  * Secure-by-default posture:
  *
@@ -227,10 +227,19 @@ export interface TenantScopeOptions {
  * or poison another tenant's:
  *
  * ```ts
- * rateLimit({ windowMs: 60_000, max: 100, keyGenerator: tenantScope() });
- * concurrencyLimit({ maxConcurrent: 20, scope: tenantScope() });
- * idempotency({ scope: tenantScope() });    // CWE-524 cross-tenant cache defense
- * responseCache({ ttlMs: 30_000, scope: tenantScope() });
+ * const scope = tenantScope();
+ * rateLimit({ windowMs: 60_000, max: 100, keyGenerator: scope });
+ * concurrencyLimit({ maxConcurrent: 20, scope });
+ * idempotency({ scope });    // CWE-524 cross-tenant cache defense
+ * // responseCache's keyGenerator REPLACES the whole key and it takes
+ * // ttlSeconds, so fold the tenant in alongside the path yourself:
+ * responseCache({
+ *   ttlSeconds: 30,
+ *   keyGenerator: (ctx) => {
+ *     const u = new URL(ctx.request.url);
+ *     return `${scope(ctx)}:${ctx.request.method} ${u.pathname}${u.search}`;
+ *   },
+ * });
  * ```
  *
  * The `tenant:` prefix keeps these keys from colliding with other key spaces

package/dist/tenancy.js CHANGED Viewed

@@ -5,9 +5,9 @@
  * once per request, validates and normalizes it, and exposes it on
  * `ctx.state.tenant` for handlers and downstream middleware. It is the
  * single source of truth for "who is this request for" so the per-tenant
- * isolation knobs on the rest of the framework (`rateLimit` `keyGenerator`,
- * `concurrencyLimit` / `idempotency` / `responseCache` `scope`) can all key
- * off the same resolved value via {@link tenantScope}.
+ * isolation knobs on the rest of the framework (`rateLimit` /
+ * `responseCache` `keyGenerator`, `concurrencyLimit` / `idempotency` `scope`)
+ * can all key off the same resolved value via {@link tenantScope}.
  *
  * Secure-by-default posture:
  *
@@ -270,10 +270,19 @@ export function tenancy(opts) {
  * or poison another tenant's:
  *
  * ```ts
- * rateLimit({ windowMs: 60_000, max: 100, keyGenerator: tenantScope() });
- * concurrencyLimit({ maxConcurrent: 20, scope: tenantScope() });
- * idempotency({ scope: tenantScope() });    // CWE-524 cross-tenant cache defense
- * responseCache({ ttlMs: 30_000, scope: tenantScope() });
+ * const scope = tenantScope();
+ * rateLimit({ windowMs: 60_000, max: 100, keyGenerator: scope });
+ * concurrencyLimit({ maxConcurrent: 20, scope });
+ * idempotency({ scope });    // CWE-524 cross-tenant cache defense
+ * // responseCache's keyGenerator REPLACES the whole key and it takes
+ * // ttlSeconds, so fold the tenant in alongside the path yourself:
+ * responseCache({
+ *   ttlSeconds: 30,
+ *   keyGenerator: (ctx) => {
+ *     const u = new URL(ctx.request.url);
+ *     return `${scope(ctx)}:${ctx.request.method} ${u.pathname}${u.search}`;
+ *   },
+ * });
  * ```
  *
  * The `tenant:` prefix keeps these keys from colliding with other key spaces

package/dist/types.d.ts CHANGED Viewed

@@ -422,7 +422,32 @@ export interface RouteDefinition<P extends PathString = PathString, M extends Ht
      */
     meta?: RouteMeta;
     hooks?: Hooks;
-    handler: (ctx: BaseContext<P, Req>) => HandlerReturn<Res> | Promise<HandlerReturn<Res>>;
+    /**
+     * The route handler. Receives the typed, validated {@link BaseContext} and
+     * returns either:
+     *
+     * - a structured result `{ status, body, headers? }` whose `body` is
+     *   validated against the route's response schema and typed end-to-end into
+     *   the OpenAPI document and generated client (the common case), or
+     * - a raw web-standard {@link Response} as an escape hatch for streaming,
+     *   proxying, or pre-built bodies (for example an AI SDK
+     *   `result.toUIMessageStreamResponse()`, or an upstream `fetch()` response
+     *   forwarded verbatim).
+     *
+     * A returned `Response` **bypasses response-schema validation and the
+     * typed-client body type by design** — there is no schema that can describe
+     * an opaque stream. It is still finalized exactly like every other response,
+     * so no security control is skipped: headers set via `ctx.set` (including
+     * `secureHeaders()` and CORS) are copied onto it, `x-request-id` is added
+     * when absent, any `onSend` / `onResponse` hooks run, server-fingerprint
+     * headers (`server`, `x-powered-by`) are stripped, and a `HEAD` request still
+     * yields an empty body. This mirrors the existing `beforeHandle` `Response`
+     * passthrough. Prefer the structured result whenever a schema can describe
+     * the payload; reach for `Response` only when it genuinely cannot.
+     *
+     * @since 0.1.0
+     */
+    handler: (ctx: BaseContext<P, Req>) => HandlerReturn<Res> | Response | Promise<HandlerReturn<Res> | Response>;
 }
 /**
  * One operation inside an OpenAPI Callback Object. Mirrors a route minus

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@daloyjs/core",
-  "version": "1.0.0-beta.3",
+  "version": "1.0.0-beta.5",
   "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
   "type": "module",
   "publishConfig": {
@@ -37,7 +37,7 @@
     "daloy": "bin/daloy.mjs"
   },
   "engines": {
-    "node": ">=24.0.0",
+    "node": "^24.0.0 || >=26.0.0",
     "pnpm": ">=11.0.0"
   },
   "exports": {
@@ -227,9 +227,9 @@
     }
   },
   "devDependencies": {
-    "@hey-api/openapi-ts": "^0.97.1",
-    "@types/node": "^25.7.0",
-    "fast-check": "^3.23.2",
+    "@hey-api/openapi-ts": "^0.99.0",
+    "@types/node": "^26.0.1",
+    "fast-check": "^4.8.0",
     "prettier": "^3.8.3",
     "tsx": "^4.22.3",
     "typescript": "^6.0.3",
@@ -240,6 +240,7 @@
     "dev": "tsc -w -p tsconfig.json",
     "example": "node --import tsx examples/basic.ts",
     "bench": "node --import tsx bench/router.bench.ts",
+    "bench:serverless": "node --import tsx bench/serverless-cold-path.bench.ts",
     "test": "node --import tsx --test tests/**/*.test.ts",
     "test:red-team": "node --import tsx --test tests/red-team-attacks.test.ts tests/red-team-attacks-2.test.ts tests/red-team-attacks-3.test.ts tests/red-team-attacks-4.test.ts tests/red-team-attacks-5.test.ts tests/red-team-attacks-6.test.ts tests/red-team-attacks-7.test.ts tests/red-team-attacks-8.test.ts tests/red-team-attacks-9.test.ts tests/red-team-attacks-10.test.ts",
     "red-team:live": "node --import tsx red-team-live/run.ts",