@daloyjs/core 1.0.0-beta.7 → 1.0.0-rc.1

package/dist/middleware.js

@@ -447,6 +447,47 @@ export const CORS_WILDCARD_ORIGIN_MARKER = Symbol.for("daloyjs.middleware.cors.w
  * @since 0.17.0
  */
 export const CSRF_HOOK_MARKER = Symbol.for("daloyjs.middleware.csrf");
+/**
+ * Marker stamped on a {@link Hooks} bundle that authenticates the request —
+ * i.e. rejects callers without valid credentials. Built-in auth middlewares
+ * (`bearerAuth`, `basicAuth`, `jwk`, `httpSignatureAuth`, `clientCertAuth`)
+ * stamp it so the framework's route-auth boot guard can confirm that any route
+ * declaring an `auth:` requirement is actually enforced by a hook rather than
+ * being silently public (a `security` entry in the OpenAPI doc with no runtime
+ * check). Wrap a custom authentication hook with {@link markAuthHook} to opt it
+ * into the same guard.
+ *
+ * @since 1.0.0
+ */
+export const AUTH_HOOK_MARKER = Symbol.for("daloyjs.auth.hook");
+/**
+ * Mark a custom {@link Hooks} bundle as performing request authentication.
+ *
+ * Use this when you authenticate with your own hook (not one of the built-in
+ * auth middlewares) but still declare `auth:` on the protected routes: it
+ * stamps {@link AUTH_HOOK_MARKER} so the production route-auth boot guard treats
+ * those routes as enforced. It is also the correct escape hatch when
+ * authentication is performed by an upstream gateway/mesh and the in-app hook
+ * is intentionally a pass-through.
+ *
+ * @param hooks - The hook bundle to mark (mutated in place and returned).
+ * @returns The same `hooks` object, now stamped as an auth hook.
+ *
+ * @example
+ * ```ts
+ * app.use(markAuthHook({
+ *   async beforeHandle(ctx) {
+ *     if (!(await myVerify(ctx.request))) throw new UnauthorizedError();
+ *   },
+ * }));
+ * ```
+ *
+ * @since 1.0.0
+ */
+export function markAuthHook(hooks) {
+    hooks[AUTH_HOOK_MARKER] = true;
+    return hooks;
+}
 /**
  * Cross-Origin Resource Sharing (CORS) middleware. Handles both preflight
  * (`OPTIONS`) and actual requests, attaching the correct
@@ -838,7 +879,7 @@ export function bearerAuth(opts) {
     if (/["\r\n\0]/.test(realm)) {
         throw new Error("bearerAuth(): realm must not contain quotes, CR, LF, or NUL bytes.");
     }
-    return {
+    return markAuthHook({
         async beforeHandle(ctx) {
             const h = ctx.request.headers.get("authorization") ?? "";
             const m = /^Bearer\s+(.+)$/i.exec(h);
@@ -866,7 +907,7 @@ export function bearerAuth(opts) {
             }
             return undefined;
         },
-    };
+    });
 }
 const CSRF_STATE_TOKEN = "csrfToken";
 const CSRF_STATE_ISSUED = "__csrfIssued";
@@ -1115,7 +1156,7 @@ export function basicAuth(opts) {
     if (!Number.isInteger(maxBytes) || maxBytes < 1) {
         throw new Error("basicAuth(): maxCredentialBytes must be a positive integer.");
     }
-    return {
+    return markAuthHook({
         async beforeHandle(ctx) {
             const header = ctx.request.headers.get("authorization") ?? "";
             const match = BASIC_AUTH_TOKEN_RE.exec(header);
@@ -1134,7 +1175,7 @@ export function basicAuth(opts) {
             }
             return undefined;
         },
-    };
+    });
 }
 // ---------- requireScopes ----------
 /**

package/dist/mtls.js

@@ -347,7 +347,7 @@ export function clientCertAuth(opts = {}) {
                 return certFromHeaders(ctx.request, headerConfig);
             return undefined;
         });
-    return {
+    const authHooks = {
         async beforeHandle(ctx) {
             const cert = resolve(ctx);
             if (!cert) {
@@ -386,6 +386,11 @@ export function clientCertAuth(opts = {}) {
             return undefined;
         },
     };
+    // Same global symbol as middleware's AUTH_HOOK_MARKER (stamped inline to keep
+    // the middleware module out of this bundle): lets the route-auth boot guard
+    // recognize that a route declaring `auth:` is actually enforced here.
+    authHooks[Symbol.for("daloyjs.auth.hook")] = true;
+    return authHooks;
 }
 function assertHeaderConfig(cfg) {
     if (cfg.format === "xfcc")

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:b5480fcc-c870-525f-bf19-08a30ac9e3d6",
+  "serialNumber": "urn:uuid:63bae5ad-16c4-5db2-9929-3188903cb4f9",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-02T15:07:00.378Z",
+    "timestamp": "2026-07-04T14:31:15.314Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "1.0.0-beta.7"
+        "version": "1.0.0-rc.1"
       }
     ],
     "authors": [
@@ -19,11 +19,11 @@
     ],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/@daloyjs/core@1.0.0-beta.7",
+      "bom-ref": "pkg:npm/@daloyjs/core@1.0.0-rc.1",
       "name": "@daloyjs/core",
-      "version": "1.0.0-beta.7",
+      "version": "1.0.0-rc.1",
       "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
-      "purl": "pkg:npm/@daloyjs/core@1.0.0-beta.7",
+      "purl": "pkg:npm/@daloyjs/core@1.0.0-rc.1",
       "licenses": [
         {
           "license": {
@@ -46,9 +46,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag--daloyjs-core-1.0.0-beta.7",
+        "tagId": "swidtag--daloyjs-core-1.0.0-rc.1",
         "name": "@daloyjs/core",
-        "version": "1.0.0-beta.7",
+        "version": "1.0.0-rc.1",
         "tagVersion": 0,
         "patch": false
       }
@@ -57,7 +57,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/@daloyjs/core@1.0.0-beta.7",
+      "ref": "pkg:npm/@daloyjs/core@1.0.0-rc.1",
       "dependsOn": []
     }
   ]

package/dist/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@daloyjs/core-1.0.0-beta.7",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.0.0-beta.7-b5480fcc-c870-525f-bf19-08a30ac9e3d6",
+  "name": "@daloyjs/core-1.0.0-rc.1",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.0.0-rc.1-63bae5ad-16c4-5db2-9929-3188903cb4f9",
   "creationInfo": {
-    "created": "2026-07-02T15:07:00.378Z",
+    "created": "2026-07-04T14:31:15.314Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package--daloyjs-core",
       "name": "@daloyjs/core",
-      "versionInfo": "1.0.0-beta.7",
+      "versionInfo": "1.0.0-rc.1",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/@daloyjs/core@1.0.0-beta.7"
+          "referenceLocator": "pkg:npm/@daloyjs/core@1.0.0-rc.1"
         }
       ]
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daloyjs/core",
-  "version": "1.0.0-beta.7",
+  "version": "1.0.0-rc.1",
   "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
   "type": "module",
   "publishConfig": {