@daloyjs/core 1.0.0-rc.0 → 1.0.0-rc.1

package/README.md

@@ -509,7 +509,7 @@ The core only ever sees `Request → Response`. Adapters live at the edge.
 
 ## Status
 
-DaloyJS is now at its **first `1.0.0` release candidate** (`1.0.0-rc.0`). The public API is frozen for the 1.0 line: only bug fixes and documentation land between RC and GA, and from `1.0.0` onward breaking changes follow SemVer with deprecations getting at least one minor cycle. The framework is already in use for production trials.
+DaloyJS is at **`1.0.0-rc.1`**, a security-hardening release candidate. Because the framework has no external users yet, this RC ships a few intentional breaking changes (see the [CHANGELOG](CHANGELOG.md)) to get the secure-by-default posture right before GA rather than deferring them; the generated OpenAPI contract is unchanged. From `1.0.0` GA onward, breaking changes follow SemVer with deprecations getting at least one minor cycle. The framework is already in use for production trials.
 
 **Release quality bar.** Every release ships with **≥90% line + function coverage and ≥90% branch coverage**, strict TypeScript, OpenSSF Scorecard, CodeQL + Opengrep dual SAST, zizmor workflow linting, and npm provenance. Coverage was relaxed from a former 100% gate so complex security work isn't blocked chasing throwaway tests for unreachable defensive branches or tsx source-map phantoms; see [AGENTS.md](AGENTS.md) for the policy.
 
@@ -520,7 +520,7 @@ DaloyJS is now at its **first `1.0.0` release candidate** (`1.0.0-rc.0`). The pu
 - Zero-config OpenAPI `info` autofill from `package.json` (Node / Bun) or `deno.json` / `deno.jsonc` (Deno); explicit `openapi.info` values always win.
 - RFC 7231 + RFC 5789 HTTP-method allowlist enforced inside `app.route()` (WebDAV, `TRACE`, `CONNECT` rejected at the framework boundary).
 - AI-friendly route metadata via optional `meta: { examples, extensions, summary, description, tags }`; examples are validated against your schemas at build time, surfaced as OpenAPI `examples` + `x-daloy-*` extensions, and dumped as `routes.json` / `routes.yaml` via `daloy inspect --ai`.
-- Dependency-free MCP Streamable HTTP server helpers at `@daloyjs/core/mcp`: `createMcpHandler()` exposes tools (with `outputSchema`, `annotations`, and icons), resources, RFC 6570 resource templates, and prompts (with required-argument enforcement) over JSON-RPC 2.0 and validates `Origin` against DNS rebinding (with an `allowedOrigins` allowlist), while `mcpRoutes("/mcp", handler)` mounts the POST / GET / OPTIONS Daloy routes — with the JSON-RPC envelope schema surfaced in OpenAPI — for a dedicated MCP service with the same auth, rate-limit, body-limit, and timeout middleware as any other app.
+- Dependency-free MCP Streamable HTTP server helpers at `@daloyjs/core/mcp`: `createMcpHandler()` exposes tools (with `outputSchema`, `annotations`, and icons), resources, RFC 6570 resource templates, and prompts (with required-argument enforcement) over JSON-RPC 2.0 and validates `Origin` against DNS rebinding (with an `allowedOrigins` allowlist), while `mcpRoutes("/mcp", handler)` mounts the POST / GET / OPTIONS Daloy routes — with the JSON-RPC envelope schema surfaced in OpenAPI — for a dedicated MCP service with the same auth, rate-limit, body-limit, and timeout middleware as any other app. Every `tools/call` argument is validated server-side against the tool's `inputSchema` (a dependency-free JSON-Schema subset — `type`/`required`/`properties`/`additionalProperties`/`enum`/`const`/bounds; exposed as `validateMcpInput()`) before the handler runs, rejecting a mismatch with JSON-RPC `-32602`; the JSON-RPC body is parsed with prototype-pollution-safe `safeJsonParse`; and an unauthenticated `mcpRoutes()` endpoint refuses to boot in production unless opted out with `mcpRoutes(path, handler, { public: true })`.
 - API lifecycle and breaking-change detection: mark routes `deprecated` or give them a `sunset` date to emit RFC 8594 `Deprecation` / `Sunset` headers and an `x-sunset` OpenAPI extension, then gate CI with `diffOpenAPI()` / the `daloy diff` command, which fail on a breaking change versus the last published spec.
 - In-process test client (`app.request()`), contract-test runner (gated in CI via `daloy inspect --check` and shipped as a default test in every `create-daloy` template), in-process typed client, and Hey API codegen via `pnpm gen`.
 
@@ -549,7 +549,9 @@ DaloyJS is now at its **first `1.0.0` release candidate** (`1.0.0-rc.0`). The pu
 
 The framework refuses to start (or to construct) when configuration is unsafe:
 
-- Weak session secrets, `cors({ origin: "*" })` with credentials, `session()` + state-changing route without `csrf()`, and unconfigured `X-Forwarded-*` in production.
+- Weak session secrets, `cors({ origin: "*" })` with credentials, `session()` + state-changing route without `csrf()`, and unconfigured forwarded / client-IP headers (`X-Forwarded-*`, `X-Real-IP`, and vendor headers `CF-Connecting-IP` / `Fly-Client-IP` / `True-Client-IP`) in production.
+- **Shadow auth**: a route that declares an `auth:` requirement (advertised as protected in the OpenAPI `security` list) but installs no authentication hook to enforce it. Built-in auth middlewares (`bearerAuth` / `basicAuth` / `jwk` / `httpSignatureAuth` / `clientCertAuth`) satisfy the guard automatically; mark a custom auth hook (or upstream-gateway-enforced auth) with `markAuthHook()`.
+- **Unauthenticated MCP**: an `mcpRoutes()` endpoint with no auth hook — MCP tools are model-controlled and side-effecting. Opt out for a genuinely public server with `mcpRoutes(path, handler, { public: true })`.
 - `secureDefaults: false` in production unless `acknowledgeInsecureDefaults: true` is set, plus a once-per-process `error` log naming every disabled default.
 - `preset: "internal-service"` topology preset for service-to-service deployments behind a mesh / sidecar / private network: turns OFF the browser-only guards (auto `secureHeaders`, `corsCrossOriginGuard`, `csrf` boot guard, unconfigured `X-Forwarded-*` guard) while keeping every input, parser, credential, SSRF, weak-secret, and refuse-to-boot guard ON. Per-knob options still win, the choice is logged at boot under `event: "security.preset.applied"`, and the live posture is auditable via `app.getSecurityPosture()`.
 - `createJwtSigner()` / `createJwtVerifier()` refuse `alg: "none"`, accept only an explicit allowlist, refuse HS + JWK combinations, refuse to sign without `exp`, and refuse HS-shaped secrets under 32 bytes (RFC 7518 §3.2).
@@ -587,13 +589,13 @@ The framework refuses to start (or to construct) when configuration is unsafe:
 - `clientCertAuth()` mTLS / client-certificate auth at `@daloyjs/core/mtls`: authenticate zero-trust / service-to-service callers by their TLS client certificate from two sources — **native TLS** (the Node adapter lazily reads the peer cert off the socket; plain requests pay nothing) or a **TLS-terminating proxy** (Envoy `X-Forwarded-Client-Cert` and nginx/HAProxy-style structured headers). `requireVerified` by default, exact `allowSubjectCNs` / `allowIssuerCNs`, **constant-time** `allowFingerprints`, `allowSANs` (SPIFFE/DNS/URI/IP, `TYPE:value` or bare), validity-window enforcement, and a custom async `verify()` hook. Missing cert → `401` problem+json with `Cache-Control: no-store`; any failed check → `403` (never echoes cert details). The accepted `ClientCertificate` is stamped on `ctx.state`. `parseForwardedClientCert()` / `normalizePeerCertificate()` exported standalone. Zero runtime dependencies.
 - `autoBan()` adaptive auto-ban (fail2ban-style) at `@daloyjs/core/auto-ban`: temporarily ban abusive clients after repeated suspicious responses (default `401` / `403` / `429`, configurable `watchStatuses`) within a rolling `windowMs`. Bans **escalate** exponentially for repeat offenders (`banMs` → `2×` → `4×`, capped at `maxBanMs`) and **decay** once the client goes quiet. Observes the outgoing status via `onSend` (counts failures from any downstream middleware/handler), enforces in `beforeHandle`. Secure-by-default identity attribution — refuses to construct without `keyGenerator` or `trustProxyHeaders` so one offender can never ban everyone; unattributable requests are skipped. Pluggable `AutoBanStore` (mirrors the `rateLimit()` store; in-memory default, Redis-able for multi-instance), `groupId` sharing across route groups, `429`/`403` ban response with `Retry-After`, and `onBan` / `onStrike` hooks. Zero runtime dependencies.
 - `botGuard()` bot / User-Agent management at `@daloyjs/core/bot-guard`: the in-app equivalent of Nginx/WAF bot rules. Blocks empty/missing `User-Agent` (default on) and known-abusive `User-Agent` strings / `RegExp`s, and **verifies declared crawlers** — a request claiming to be Googlebot/Bingbot is confirmed via reverse-DNS + forward-confirm (the method Google and Bing document), so a spoofed `User-Agent` can't impersonate a trusted crawler. Ships `GOOGLEBOT` / `BINGBOT` / `WELL_KNOWN_BOTS` presets and accepts custom `VerifiedBotRule`s. Allowlist-first (`allowUserAgents` bypasses every rule), secure-by-default (`verifiedBots` refuses to construct without an IP source; unverifiable crawlers blocked unless `blockUnverifiableBots: false`), subdomain-boundary-safe domain matching, per-IP verification cache to keep DNS off the hot path, `mode: "log"` monitor mode, `onBlock` callback, and a pluggable `BotResolver` (default lazy `node:dns/promises`). Zero runtime dependencies.
-- `ipReputation()` IP reputation / dynamic denylist feed at `@daloyjs/core/ip-reputation`: wires pluggable, periodically-refreshed abuse feeds (Tor exit lists, Spamhaus DROP, cloud-abuse ranges, or your own threat intel) into the request path without a redeploy, reusing the same SSRF-grade CIDR matcher as `ipRestriction()`. Ships `urlFeed()` (fetches newline / Spamhaus-DROP-style lists, skips comment lines, keeps good rows from a partially-malformed feed) plus a custom `IpReputationFeed` interface. **Fail-open by design** — a feed that can't be loaded (initial or refresh) never blocks traffic; the last-known-good list is retained per feed. Periodic `unref`'d refresh, `mode: "log"` monitor mode, `onMatch` / `onError` callbacks, manual `refresh()` / `stop()` / `has()` / `size` controller, and pluggable IP resolution (`trustProxyHeaders` / `resolveIp`). Zero runtime dependencies.
+- `ipReputation()` IP reputation / dynamic denylist feed at `@daloyjs/core/ip-reputation`: wires pluggable, periodically-refreshed abuse feeds (Tor exit lists, Spamhaus DROP, cloud-abuse ranges, or your own threat intel) into the request path without a redeploy, reusing the same SSRF-grade CIDR matcher as `ipRestriction()`. Ships `urlFeed()` (fetches newline / Spamhaus-DROP-style lists, skips comment lines, keeps good rows from a partially-malformed feed; **SSRF-hardened by default** — the outbound fetch runs through `fetchGuard()`, so a compromised feed host can't redirect it into cloud-metadata / internal space; override via `fetchImpl`) plus a custom `IpReputationFeed` interface. **Fail-open by design** — a feed that can't be loaded (initial or refresh) never blocks traffic; the last-known-good list is retained per feed. Periodic `unref`'d refresh, `mode: "log"` monitor mode, `onMatch` / `onError` callbacks, manual `refresh()` / `stop()` / `has()` / `size` controller, and pluggable IP resolution (`trustProxyHeaders` / `resolveIp`). Zero runtime dependencies.
 - `geoBlock()` GeoIP / geo-blocking at `@daloyjs/core/geo-block`: country allow/deny middleware that maps the client IP to an ISO 3166-1 alpha-2 country and rejects (or logs) traffic from countries you don't serve. **No bundled GeoIP database and no runtime dependency** — supply either an operator-owned `lookupCountry(ip)` (a MaxMind / `ip2location` reader, or your own table, reusing the trusted-proxy `X-Forwarded-For` / `X-Real-IP` IP resolution) or a `resolveCountry(ctx)` that reads an edge-injected header (`CF-IPCountry`, `CloudFront-Viewer-Country`, `x-vercel-ip-country`). Deny wins over allow (least privilege); **allow-lists fail closed** on an unknown country while deny-only fails open (overridable via `allowUnknownCountry`). Country codes are validated at construction so typos throw instead of silently never matching. `mode: "log"` monitor mode with an `onBlock` decision hook (`denied_country` / `not_in_allowlist` / `unknown_country`), the resolved country stamped on `ctx.state.geo` for allowed requests, and a `403` problem+json rejection that never echoes the country/IP. Zero runtime dependencies.
 - `concurrencyLimit()` per-route / per-client concurrency limits + queueing at `@daloyjs/core/concurrency-limit`: HAProxy `maxconn`/queue parity at the app layer. Bounds in-flight requests through a surface with a per-bucket semaphore (`maxConcurrent`), a bounded FIFO queue (`maxQueue`) with an optional `queueTimeoutMs`, and a fast `503` + `Retry-After` once the queue is full or the wait times out. Partition the budget with `scope`: `"global"` (default), `"route"` (per `method + path`), `"client"` (per identity, needs `trustProxyHeaders`/`keyGenerator`), or a custom function (`undefined` skips limiting, fail-open). Acquires in `beforeHandle` and releases in `onSend`, so slots are freed on success, error, and short-circuit paths alike — never leaked. `onReject` observability hook, configurable `retryAfterSeconds`/`message`. Complements the `maxConnections` socket cap and `loadShedding()`. Zero runtime dependencies. HAProxy `maxconn`/queue parity at the app layer. Bounds in-flight requests through a surface with a per-bucket semaphore (`maxConcurrent`), a bounded FIFO queue (`maxQueue`) with an optional `queueTimeoutMs`, and a fast `503` + `Retry-After` once the queue is full or the wait times out. Partition the budget with `scope`: `"global"` (default), `"route"` (per `method + path`), `"client"` (per identity, needs `trustProxyHeaders`/`keyGenerator`), or a custom function (`undefined` skips limiting, fail-open). Acquires in `beforeHandle` and releases in `onSend`, so slots are freed on success, error, and short-circuit paths alike — never leaked. `onReject` observability hook, configurable `retryAfterSeconds`/`message`. Complements the `maxConnections` socket cap and `loadShedding()`. Zero runtime dependencies.
 - `requestDecompression()` inbound decompression-bomb guard at `@daloyjs/core/request-decompression`: core is safe by omission (it never decompresses request bodies), so this is the opt-in middleware for services that must accept compressed uploads. Inflates `gzip` / `deflate` bodies behind two caps enforced **during** inflation so a zip bomb is aborted before it is fully materialised: an absolute `maxDecompressedBytes` (required) and an expansion-ratio `maxRatio` (default `100`), both rejecting with `413`. The compressed upload itself is bounded by `maxCompressedBytes` (default 1 MiB) before a byte is inflated. Unknown, non-allowlisted, runtime-unsupported, or **layered** (`gzip, gzip`) encodings are refused `415`; malformed streams `400`; bodyless / uncompressed / `identity` / `GET` / `HEAD` traffic passes through untouched. Runs in `onRequest` and stashes the inflated bytes so schema-validated bodies and raw-body handlers both see the decompressed payload. `onBomb` observability hook, exported `decompressRequestBody()` for custom flows. Built on web-standard `DecompressionStream` (brotli excluded — not in the spec). Zero runtime dependencies.
 - `waf()` opt-in WAF-lite signature/anomaly inbound-inspection middleware at `@daloyjs/core/waf`: a first-party defense-in-depth layer for teams without an edge WAF (it does **not** replace ModSecurity / a CDN WAF). Wires DaloyJS' high-confidence injection signatures — SQLi, XSS, NoSQL-operator injection (reusing `hasMongoOperatorKeys` for a structural body check), and command injection — into a single scored inbound-inspection pass over the decoded path, the raw + decoded query string, an opt-in header allowlist, and the validated body. Each rule that fires adds an anomaly `score`; reaching `blockThreshold` (default `5`) rejects with a generic `403` (block mode) or merely reports via `onMatch` (log mode) so operators can tune against real traffic first. Per-rule enable/disable + score overrides, inspection-surface toggles, control-character-stripped log samples, and bounded scanning (`maxValueLength` / `maxBodyNodes`) keep a hostile payload from becoming CPU-DoS. The `403` body never names the rule that fired. Zero runtime dependencies.
 - Built-in docs UI Subresource Integrity (SRI): `DocsAssetOptions` lets `scalarHtml()` / `swaggerUiHtml()` / `redocHtml()` and the `docs: { assets }` auto-mount pin version-exact `*Integrity` hashes (`sha256`/`sha384`/`sha512`) plus a `crossOrigin` value (default `"anonymous"`) on the CDN-loaded Scalar / Swagger UI / Redoc `<script>` / `<link>` tags, so a poisoned jsDelivr asset can't execute. Malformed SRI values throw a `TypeError` at startup (browsers ignore unparseable `integrity`, so failing loud avoids a false sense of protection); self-hosting the assets via the same `assets` URLs stays supported. Zero runtime dependencies.
-- HTTP Message Signatures (RFC 9421) at `@daloyjs/core/http-signatures`: first-party sign/verify for server-to-server request authentication via the standard `Signature` / `Signature-Input` headers — complements the inbound-only webhook HMAC and `clientCertAuth()` mTLS. `signMessage()` / `signRequest()` build an RFC 9421 signature base over derived components (`@method`, `@target-uri`, `@authority`, `@scheme`, `@request-target`, `@path`, `@query`, `@query-param`, `@status`) and HTTP fields with Structured-Fields header serialization; `verifyMessage()` / `verifyRequest()` and the `httpSignatureAuth()` middleware check them. Algorithms `hmac-sha256` / `ed25519` / `ecdsa-p256-sha256` / `ecdsa-p384-sha384` / `rsa-pss-sha512` / `rsa-v1_5-sha256` via WebCrypto (no `node:` imports). Secure-by-default verify: a **mandatory `algorithms` allowlist** (no implicit "any alg"), optional per-key alg pinning to defeat algorithm-confusion, a required `created` timestamp with a 300s freshness window, `created`-in-future / `expires` skew rejection, configurable `requiredComponents`, a 32-byte raw-HMAC floor, and `nonce` replay defense; the middleware answers a missing/invalid signature with `401` + `Cache-Control: no-store` and stamps the verified result on `ctx.state.httpSignature`. Ships RFC 9530 `contentDigest()` / `verifyContentDigest()` to bind the request body. Zero runtime dependencies.
+- HTTP Message Signatures (RFC 9421) at `@daloyjs/core/http-signatures`: first-party sign/verify for server-to-server request authentication via the standard `Signature` / `Signature-Input` headers — complements the inbound-only webhook HMAC and `clientCertAuth()` mTLS. `signMessage()` / `signRequest()` build an RFC 9421 signature base over derived components (`@method`, `@target-uri`, `@authority`, `@scheme`, `@request-target`, `@path`, `@query`, `@query-param`, `@status`) and HTTP fields with Structured-Fields header serialization; `verifyMessage()` / `verifyRequest()` and the `httpSignatureAuth()` middleware check them. Algorithms `hmac-sha256` / `ed25519` / `ecdsa-p256-sha256` / `ecdsa-p384-sha384` / `rsa-pss-sha512` / `rsa-v1_5-sha256` via WebCrypto (no `node:` imports). Secure-by-default verify: a **mandatory `algorithms` allowlist** (no implicit "any alg"), optional per-key alg pinning to defeat algorithm-confusion, a required `created` timestamp with a 300s freshness window, `created`-in-future / `expires` skew rejection, configurable `requiredComponents`, a 32-byte raw-HMAC floor, a 2048-bit RSA modulus floor (NIST SP 800-131A, parity with the JWT verifier), and `nonce` replay defense; the middleware answers a missing/invalid signature with `401` + `Cache-Control: no-store` and stamps the verified result on `ctx.state.httpSignature`. Ships RFC 9530 `contentDigest()` / `verifyContentDigest()` to bind the request body. Zero runtime dependencies.
 - `compression()` built on web-standard `CompressionStream` (prefers `br` > `gzip` > `deflate`), with BREACH-aware always-on guards (skips `Set-Cookie`, `Authorization`, session / CSRF cookies, already-compressed content types), `minimumSize: 1024`, negative-compression-ratio post-check, no configurable `compressLevel` knob (CPU-DoS defense — `level: 9` is refused at construction), always-on `Vary: Accept-Encoding`, and strong → weak ETag downgrade per RFC 9110 §8.8.3.
 - `etag()` helper auto-skips on `Set-Cookie` and private / no-store / no-cache `Cache-Control` (cross-tenant fingerprinting defense).
 - `timing` / `timingSafeEqual` helpers.

package/dist/app.d.ts

@@ -1107,19 +1107,32 @@ export declare class App<Routes extends readonly RouteDefinition<any, any, any,
     /**
      * First-request boot guard. Verifies that the assembled hook
      * chain + route table is internally consistent before any user handler
-     * runs. Currently checks: when `session()` is installed and any route
-     * accepts a state-changing method (`POST` / `PUT` / `PATCH` / `DELETE`),
-     * a `csrf()` hook (or third-party equivalent stamped with
-     * {@link CSRF_HOOK_MARKER}) must also be present in that route's effective
-     * hook chain. Opt out with `app({ csrf: "off" })` or
-     * `app({ secureDefaults: false })`. Runs once per App between registration
-     * changes; the result is cached so the fast path is a single boolean check.
+     * runs. Currently checks (production + `secureDefaults` only):
+     *
+     * 1. **Shadow auth** — a route that declares an `auth:` requirement (so it is
+     *    advertised as protected in the OpenAPI `security` list) must have an
+     *    authentication hook ({@link AUTH_HOOK_MARKER}) in its effective chain.
+     *    Otherwise it accepts unauthenticated requests while claiming protection.
+     * 2. **Unauthenticated MCP** — a route from {@link mcpRoutes} must have an
+     *    auth hook unless it opted out with `mcpRoutes(path, handler, { public: true })`.
+     *    MCP tools are model-controlled and side-effecting, so a public one is a
+     *    high-impact default.
+     * 3. **Missing CSRF** — when `session()` is installed and any route accepts a
+     *    state-changing method (`POST`/`PUT`/`PATCH`/`DELETE`), a `csrf()` hook
+     *    (or third-party equivalent stamped with {@link CSRF_HOOK_MARKER}) must
+     *    also be present. Skipped when `app({ csrf: "off" })`.
+     *
+     * Opt out of all guards with `app({ secureDefaults: false })`. Runs once per
+     * App between registration changes; the result is cached so the fast path is a
+     * single boolean check.
      */
     private assertBootGuards;
     /**
      * Per-request guard for spoofed proxy headers. When the App was
      * constructed without an explicit {@link AppOptions.trustProxy} value
-     * and a request arrives carrying an `X-Forwarded-*` header, refuse to
+     * and a request arrives carrying a spoofable forwarded / client-IP header
+     * (`X-Forwarded-*`, `X-Real-IP`, or a vendor header like `CF-Connecting-IP`,
+     * `Fly-Client-IP`, `True-Client-IP`), refuse to
      * dispatch it: the rate limiter, audit log, and request-id propagation
      * would otherwise honour the attacker-supplied IP. Returns a structured
      * `500 problem+json` so the failure is loud at the network boundary.

package/dist/app.js

@@ -6,7 +6,7 @@ import { createLogger, noopLogger } from "./logger.js";
 import { generateOpenAPI, openapiToYAML, } from "./openapi.js";
 import { asyncapiHtml, docsContentSecurityPolicy, redocHtml, scalarHtml, swaggerUiHtml, } from "./docs.js";
 import { generateAsyncAPI, asyncapiToYAML, } from "./asyncapi.js";
-import { secureHeaders as secureHeadersMiddleware, CORS_HOOK_MARKER, CORS_ORIGIN_ALLOW_MARKER, CORS_WILDCARD_ORIGIN_MARKER, CSRF_HOOK_MARKER, REQUIRE_SCOPES_AGGREGATE_KEY, REQUIRE_SCOPES_HOOK_MARKER, SECURE_HEADERS_MARKER, } from "./middleware.js";
+import { secureHeaders as secureHeadersMiddleware, AUTH_HOOK_MARKER, CORS_HOOK_MARKER, CORS_ORIGIN_ALLOW_MARKER, CORS_WILDCARD_ORIGIN_MARKER, CSRF_HOOK_MARKER, REQUIRE_SCOPES_AGGREGATE_KEY, REQUIRE_SCOPES_HOOK_MARKER, SECURE_HEADERS_MARKER, } from "./middleware.js";
 import { COMPRESSION_HOOK_MARKER } from "./compression.js";
 import { SESSION_HOOK_MARKER, SESSION_SECRETS_MARKER } from "./session.js";
 import { loadShedding as loadSheddingMiddleware, } from "./load-shedding.js";
@@ -118,6 +118,13 @@ const CANONICAL_HTTP_METHODS = new Set([
     "HEAD",
     "OPTIONS",
 ]);
+/**
+ * Global-registry symbol stamped by `mcpRoutes()` on the route definitions it
+ * produces (unless the caller opts out with `public: true`). Read here — rather
+ * than importing from `mcp.ts` — so the MCP module is never pulled into the core
+ * `App` bundle. Must match the string used in `mcpRoutes`.
+ */
+const MCP_ROUTE_MARKER = Symbol.for("daloyjs.mcp.route");
 /**
  * Apply a topology-aware security preset on top of caller-supplied
  * options. Returns a new options object where preset defaults fill in
@@ -906,13 +913,24 @@ export class App {
     /**
      * First-request boot guard. Verifies that the assembled hook
      * chain + route table is internally consistent before any user handler
-     * runs. Currently checks: when `session()` is installed and any route
-     * accepts a state-changing method (`POST` / `PUT` / `PATCH` / `DELETE`),
-     * a `csrf()` hook (or third-party equivalent stamped with
-     * {@link CSRF_HOOK_MARKER}) must also be present in that route's effective
-     * hook chain. Opt out with `app({ csrf: "off" })` or
-     * `app({ secureDefaults: false })`. Runs once per App between registration
-     * changes; the result is cached so the fast path is a single boolean check.
+     * runs. Currently checks (production + `secureDefaults` only):
+     *
+     * 1. **Shadow auth** — a route that declares an `auth:` requirement (so it is
+     *    advertised as protected in the OpenAPI `security` list) must have an
+     *    authentication hook ({@link AUTH_HOOK_MARKER}) in its effective chain.
+     *    Otherwise it accepts unauthenticated requests while claiming protection.
+     * 2. **Unauthenticated MCP** — a route from {@link mcpRoutes} must have an
+     *    auth hook unless it opted out with `mcpRoutes(path, handler, { public: true })`.
+     *    MCP tools are model-controlled and side-effecting, so a public one is a
+     *    high-impact default.
+     * 3. **Missing CSRF** — when `session()` is installed and any route accepts a
+     *    state-changing method (`POST`/`PUT`/`PATCH`/`DELETE`), a `csrf()` hook
+     *    (or third-party equivalent stamped with {@link CSRF_HOOK_MARKER}) must
+     *    also be present. Skipped when `app({ csrf: "off" })`.
+     *
+     * Opt out of all guards with `app({ secureDefaults: false })`. Runs once per
+     * App between registration changes; the result is cached so the fast path is a
+     * single boolean check.
      */
     assertBootGuards() {
         if (this.bootGuard.checked) {
@@ -923,13 +941,40 @@ export class App {
         this.bootGuard.checked = true;
         if (this.options.secureDefaults === false)
             return;
-        if (this.options.csrf === "off")
-            return;
         // Per the risk register: boot guards only fire in production so CI /
         // staging surfaces that ship sample secrets / no CSRF token while
         // iterating do not pay the refuse-to-boot cost.
         if (!this.isProduction())
             return;
+        // Guard 1: shadow auth — declared `auth:` with nothing enforcing it.
+        const shadowAuth = this.routeSecurityMarkers.find((r) => r.declaresAuth && !r.hasAuth);
+        if (shadowAuth) {
+            const err = new Error(`Route ${shadowAuth.method} ${shadowAuth.path} declares an auth requirement (auth: ...) ` +
+                `but no authentication hook is installed in its effective hook chain, so it is advertised ` +
+                `as protected while accepting unauthenticated requests. ` +
+                `Install an auth middleware (bearerAuth/basicAuth/jwk/httpSignatureAuth/clientCertAuth), ` +
+                `wrap a custom auth hook with markAuthHook(...), remove the route's auth: declaration, ` +
+                `or pass app({ secureDefaults: false }) to disable this guard. ` +
+                `See https://daloyjs.dev/docs/security/boot-guards.`);
+            this.bootGuard.error = err;
+            throw err;
+        }
+        // Guard 2: unauthenticated MCP tool endpoint.
+        const mcpNoAuth = this.routeSecurityMarkers.find((r) => r.isMcp && !r.hasAuth);
+        if (mcpNoAuth) {
+            const err = new Error(`MCP route ${mcpNoAuth.method} ${mcpNoAuth.path} (from mcpRoutes()) has no authentication ` +
+                `hook in its effective hook chain. MCP tools are model-controlled and can trigger side ` +
+                `effects, so an unauthenticated endpoint is a high-impact default. ` +
+                `Install an auth middleware covering the MCP route (e.g. app.use(bearerAuth({ ... }))), ` +
+                `wrap a custom auth hook with markAuthHook(...), pass mcpRoutes(path, handler, { public: true }) ` +
+                `to intentionally expose it, or pass app({ secureDefaults: false }) to disable this guard. ` +
+                `See https://daloyjs.dev/docs/security/boot-guards.`);
+            this.bootGuard.error = err;
+            throw err;
+        }
+        // Guard 3: session() + state-changing route without csrf().
+        if (this.options.csrf === "off")
+            return;
         const stateChanging = this.routeSecurityMarkers.find((r) => isStateChangingMethod(r.method) && r.hasSession && !r.hasCsrf);
         if (!stateChanging)
             return;
@@ -946,7 +991,9 @@ export class App {
     /**
      * Per-request guard for spoofed proxy headers. When the App was
      * constructed without an explicit {@link AppOptions.trustProxy} value
-     * and a request arrives carrying an `X-Forwarded-*` header, refuse to
+     * and a request arrives carrying a spoofable forwarded / client-IP header
+     * (`X-Forwarded-*`, `X-Real-IP`, or a vendor header like `CF-Connecting-IP`,
+     * `Fly-Client-IP`, `True-Client-IP`), refuse to
      * dispatch it: the rate limiter, audit log, and request-id propagation
      * would otherwise honour the attacker-supplied IP. Returns a structured
      * `500 problem+json` so the failure is loud at the network boundary.
@@ -976,6 +1023,13 @@ export class App {
             "x-forwarded-proto",
             "x-forwarded-port",
             "x-real-ip",
+            // Platform-specific client-IP headers are just as spoofable as
+            // X-Forwarded-* when the app is not actually behind that platform's
+            // proxy. Refuse them too so a client cannot forge its source IP via a
+            // vendor header the operator never configured trust for.
+            "cf-connecting-ip",
+            "fly-client-ip",
+            "true-client-ip",
         ]) {
             if (headers.has(name)) {
                 found = name;
@@ -1388,6 +1442,8 @@ export class App {
             method: merged.method,
             path: merged.path,
             ...securityMarkers,
+            declaresAuth: merged.auth !== undefined && merged.auth !== null,
+            isMcp: merged[MCP_ROUTE_MARKER] === true,
         });
         this.resetBootGuardCache();
         return this;
@@ -2887,14 +2943,17 @@ export function topoSortExtensions(exts) {
 function securityMarkersFromHooks(layers) {
     let hasSession = false;
     let hasCsrf = false;
+    let hasAuth = false;
     for (const hooks of layers) {
         const record = hooks;
         if (record[SESSION_HOOK_MARKER] === true)
             hasSession = true;
         if (record[CSRF_HOOK_MARKER] === true)
             hasCsrf = true;
+        if (record[AUTH_HOOK_MARKER] === true)
+            hasAuth = true;
     }
-    return { hasSession, hasCsrf };
+    return { hasSession, hasCsrf, hasAuth };
 }
 function isStateChangingMethod(method) {
     return method === "POST" || method === "PUT" || method === "PATCH" || method === "DELETE";

package/dist/http-signatures.js

@@ -48,6 +48,14 @@ export const DEFAULT_SIGNATURE_CLOCK_SKEW_SECONDS = 60;
 const MAX_HEADER_LENGTH = 8192;
 /** Minimum byte length for a raw HMAC secret (RFC 7518 §3.2). */
 const MIN_HMAC_KEY_BYTES = 32;
+/**
+ * Minimum RSA modulus size accepted for `rsa-*` signature algorithms. NIST
+ * SP 800-131A has disallowed RSA keys shorter than 2048 bits since 2014; the
+ * JWT verifier ({@link file://./jwt.ts}) enforces the same floor, so the HTTP
+ * Message Signatures path holds the parity to keep undersized (crackable) RSA
+ * keys out of every signature-verification surface in the framework.
+ */
+const MIN_RSA_KEY_BITS = 2048;
 const ENC = new TextEncoder();
 // ---------------------------------------------------------------------------
 // WebCrypto + encoding helpers
@@ -132,11 +140,37 @@ function algSpec(alg) {
             };
     }
 }
+/**
+ * Refuse RSA keys whose modulus is shorter than {@link MIN_RSA_KEY_BITS}.
+ *
+ * Only applies to the `rsa-*` algorithms — non-RSA keys are ignored. Every RSA
+ * `CryptoKey` carries a numeric `algorithm.modulusLength`; when WebCrypto
+ * reports a length below the floor the key is refused for both signing and
+ * verification. Mirrors the JWT verifier's `assertRsaModulusFloor` so no
+ * signature surface in the framework accepts an undersized RSA key.
+ *
+ * @param alg - The HTTP signature algorithm the key will be used with.
+ * @param key - The imported (or caller-supplied) `CryptoKey`.
+ * @throws {TypeError} When `alg` is RSA and the modulus is under the floor.
+ */
+function assertRsaModulusFloor(alg, key) {
+    if (alg !== "rsa-pss-sha512" && alg !== "rsa-v1_5-sha256")
+        return;
+    const algorithm = key.algorithm;
+    const modulusLength = algorithm?.modulusLength;
+    if (typeof modulusLength !== "number" || !Number.isFinite(modulusLength))
+        return;
+    if (modulusLength < MIN_RSA_KEY_BITS) {
+        throw new TypeError(`http-signatures: ${alg} key modulus must be at least ${MIN_RSA_KEY_BITS} bits (NIST SP 800-131A); got ${modulusLength}.`);
+    }
+}
 async function importKey(alg, material, usage) {
     const spec = algSpec(alg);
     const c = getCrypto();
-    if (isCryptoKey(material))
+    if (isCryptoKey(material)) {
+        assertRsaModulusFloor(alg, material);
         return material;
+    }
     if (material instanceof Uint8Array) {
         if (!spec.symmetric) {
             throw new TypeError(`http-signatures: raw byte keys are only supported for hmac-sha256; got ${alg}.`);
@@ -147,9 +181,11 @@ async function importKey(alg, material, usage) {
         return c.subtle.importKey("raw", material, spec.importParams, false, [usage]);
     }
     if (isJsonWebKey(material)) {
-        return c.subtle.importKey("jwk", material, spec.importParams, false, [
+        const key = await c.subtle.importKey("jwk", material, spec.importParams, false, [
             usage,
         ]);
+        assertRsaModulusFloor(alg, key);
+        return key;
     }
     throw new TypeError("http-signatures: unsupported key material.");
 }
@@ -731,7 +767,7 @@ export function verifyRequest(request, opts) {
 export function httpSignatureAuth(opts) {
     const stateKey = opts.stateKey ?? "httpSignature";
     const message = opts.message ?? "Valid HTTP message signature required";
-    return {
+    const authHooks = {
         async beforeHandle(ctx) {
             const headers = ctx.request.headers;
             if (opts.optional && !headers.has("signature"))
@@ -744,6 +780,11 @@ export function httpSignatureAuth(opts) {
             return undefined;
         },
     };
+    // Same global symbol as middleware's AUTH_HOOK_MARKER (stamped inline to keep
+    // the middleware module out of this bundle): lets the route-auth boot guard
+    // recognize that a route declaring `auth:` is actually enforced here.
+    authHooks[Symbol.for("daloyjs.auth.hook")] = true;
+    return authHooks;
 }
 const CONTENT_DIGEST_HASH = {
     "sha-256": "SHA-256",

package/dist/index.d.ts

@@ -19,11 +19,11 @@ export type { StandardSchemaV1 } from "./schema.js";
 export { validate, isStandardSchema } from "./schema.js";
 export { diffOpenAPI, hasBreakingChanges } from "./openapi-diff.js";
 export type { ChangeSeverity, OpenAPIChange, OpenAPIDiffResult } from "./openapi-diff.js";
-export { MCP_DEFAULT_MAX_BODY_BYTES, MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSIONS, McpToolError, createMcpHandler, mcpRoutes, } from "./mcp.js";
-export type { McpContent, McpEmbeddedResourceContent, McpHandler, McpHandlerOptions, McpIcon, McpImageContent, McpJsonObject, McpJsonRpcId, McpJsonSchema, McpJsonValue, McpPrompt, McpPromptArgument, McpPromptDefinition, McpPromptMessage, McpPromptResult, McpRequestContext, McpResource, McpResourceContents, McpResourceDefinition, McpResourceTemplate, McpResourceTemplateDefinition, McpServerInfo, McpTextContent, McpTool, McpToolAnnotations, McpToolHandler, McpToolResult, } from "./mcp.js";
+export { MCP_DEFAULT_MAX_BODY_BYTES, MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSIONS, McpToolError, createMcpHandler, mcpRoutes, validateMcpInput, } from "./mcp.js";
+export type { McpContent, McpEmbeddedResourceContent, McpHandler, McpHandlerOptions, McpIcon, McpImageContent, McpJsonObject, McpJsonRpcId, McpJsonSchema, McpJsonValue, McpPrompt, McpPromptArgument, McpPromptDefinition, McpPromptMessage, McpPromptResult, McpRequestContext, McpResource, McpResourceContents, McpResourceDefinition, McpResourceTemplate, McpResourceTemplateDefinition, McpRoutesOptions, McpServerInfo, McpTextContent, McpTool, McpToolAnnotations, McpToolHandler, McpToolResult, } from "./mcp.js";
 export { readBodyLimited, safeJsonParse, isForbiddenObjectKey, sanitizeHeaderName, sanitizeHeaderValue, timingSafeEqual, randomId, assertNoDuplicateSingletonHeaders, assertNoReservedInternalHeaders, assertHeaderCountWithinLimit, DEFAULT_MAX_HEADER_COUNT, RESERVED_INBOUND_HEADER_PREFIXES, SMUGGLING_SINGLETON_HEADERS, verifyWebhookSignature, signWebhookPayload, WEBHOOK_DEFAULT_TOLERANCE_SECONDS, assertStrongSecret, MIN_PROD_SECRET_BYTES, WEAK_SECRET_STRINGS, sanitizeFilename, assertSafeRelativePath, hasMongoOperatorKeys, assertNoMongoOperators, } from "./security.js";
 export type { WebhookHmacAlgorithm } from "./security.js";
-export { requestId, secureHeaders, SECURE_HEADERS_MARKER, cors, CORS_HOOK_MARKER, CORS_ORIGIN_ALLOW_MARKER, CORS_WILDCARD_ORIGIN_MARKER, rateLimit, loginThrottle, timing, bearerAuth, basicAuth, csrf, CSRF_HOOK_MARKER, fetchMetadata, requireScopes, REQUIRE_SCOPES_AGGREGATE_KEY, REQUIRE_SCOPES_HOOK_MARKER, _resetSharedRateLimitStoresForTests, } from "./middleware.js";
+export { requestId, secureHeaders, SECURE_HEADERS_MARKER, cors, CORS_HOOK_MARKER, CORS_ORIGIN_ALLOW_MARKER, CORS_WILDCARD_ORIGIN_MARKER, rateLimit, loginThrottle, timing, bearerAuth, basicAuth, markAuthHook, AUTH_HOOK_MARKER, csrf, CSRF_HOOK_MARKER, fetchMetadata, requireScopes, REQUIRE_SCOPES_AGGREGATE_KEY, REQUIRE_SCOPES_HOOK_MARKER, _resetSharedRateLimitStoresForTests, } from "./middleware.js";
 export { etag } from "./etag.js";
 export type { ETagOptions } from "./etag.js";
 export { compression, COMPRESSION_HOOK_MARKER, _resetCompressionRuntimeProbeForTests, } from "./compression.js";

package/dist/index.js

@@ -11,9 +11,9 @@ export { defineDependency, DEPENDENCY_MARKER } from "./dependency.js";
 export { HttpError, BadRequestError, ValidationError, NotFoundError, ConflictError, UnauthorizedError, ForbiddenError, MethodNotAllowedError, PayloadTooLargeError, RequestHeaderFieldsTooLargeError, UnsupportedMediaTypeError, TooManyRequestsError, RequestTimeoutError, InternalError, MessageLeakError, httpError, SAFE_CUSTOM_ERROR_RESPONSE_HEADERS, checkCustomErrorResponseHeaders, } from "./errors.js";
 export { validate, isStandardSchema } from "./schema.js";
 export { diffOpenAPI, hasBreakingChanges } from "./openapi-diff.js";
-export { MCP_DEFAULT_MAX_BODY_BYTES, MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSIONS, McpToolError, createMcpHandler, mcpRoutes, } from "./mcp.js";
+export { MCP_DEFAULT_MAX_BODY_BYTES, MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSIONS, McpToolError, createMcpHandler, mcpRoutes, validateMcpInput, } from "./mcp.js";
 export { readBodyLimited, safeJsonParse, isForbiddenObjectKey, sanitizeHeaderName, sanitizeHeaderValue, timingSafeEqual, randomId, assertNoDuplicateSingletonHeaders, assertNoReservedInternalHeaders, assertHeaderCountWithinLimit, DEFAULT_MAX_HEADER_COUNT, RESERVED_INBOUND_HEADER_PREFIXES, SMUGGLING_SINGLETON_HEADERS, verifyWebhookSignature, signWebhookPayload, WEBHOOK_DEFAULT_TOLERANCE_SECONDS, assertStrongSecret, MIN_PROD_SECRET_BYTES, WEAK_SECRET_STRINGS, sanitizeFilename, assertSafeRelativePath, hasMongoOperatorKeys, assertNoMongoOperators, } from "./security.js";
-export { requestId, secureHeaders, SECURE_HEADERS_MARKER, cors, CORS_HOOK_MARKER, CORS_ORIGIN_ALLOW_MARKER, CORS_WILDCARD_ORIGIN_MARKER, rateLimit, loginThrottle, timing, bearerAuth, basicAuth, csrf, CSRF_HOOK_MARKER, fetchMetadata, requireScopes, REQUIRE_SCOPES_AGGREGATE_KEY, REQUIRE_SCOPES_HOOK_MARKER, _resetSharedRateLimitStoresForTests, } from "./middleware.js";
+export { requestId, secureHeaders, SECURE_HEADERS_MARKER, cors, CORS_HOOK_MARKER, CORS_ORIGIN_ALLOW_MARKER, CORS_WILDCARD_ORIGIN_MARKER, rateLimit, loginThrottle, timing, bearerAuth, basicAuth, markAuthHook, AUTH_HOOK_MARKER, csrf, CSRF_HOOK_MARKER, fetchMetadata, requireScopes, REQUIRE_SCOPES_AGGREGATE_KEY, REQUIRE_SCOPES_HOOK_MARKER, _resetSharedRateLimitStoresForTests, } from "./middleware.js";
 export { etag } from "./etag.js";
 export { compression, COMPRESSION_HOOK_MARKER, _resetCompressionRuntimeProbeForTests, } from "./compression.js";
 export { createJwtSigner, createJwtVerifier, JwtError, DEFAULT_JWT_MAX_LIFETIME_SECONDS, } from "./jwt.js";

package/dist/ip-reputation.d.ts

@@ -160,8 +160,12 @@ export interface UrlFeedOptions {
     /** Feed name. Defaults to the URL. */
     name?: string;
     /**
-     * Custom `fetch` implementation. Defaults to the platform `fetch`. Provide an
-     * SSRF-guarded fetch or a non-standard-runtime client here.
+     * Custom `fetch` implementation. Defaults to an SSRF-hardened
+     * {@link fetchGuard} instance so a compromised or malicious feed host cannot
+     * redirect the request into internal/link-local space (cloud metadata, etc.).
+     * Override with your own client for a non-standard runtime, or with
+     * `fetchGuard({ allowPrivate: true })` for an intentionally internal feed
+     * mirror.
      */
     fetchImpl?: typeof fetch;
     /** Extra request headers (e.g. an API token for a commercial feed). */
@@ -174,6 +178,8 @@ export interface UrlFeedOptions {
  * are skipped by {@link ipReputation}, so a partially-malformed feed still loads
  * its good entries.
  *
+ * The outbound fetch is SSRF-hardened by default (see {@link UrlFeedOptions.fetchImpl}).
+ *
  * @param url - The feed URL.
  * @param opts - Optional feed name, custom `fetch`, and request headers.
  * @returns A feed ready to pass to {@link IpReputationOptions.feeds}.

package/dist/ip-reputation.js

@@ -45,6 +45,7 @@
  * @since 0.37.0
  */
 import { ForbiddenError } from "./errors.js";
+import { fetchGuard } from "./fetch-guard.js";
 import { compileCidrMatcher, matchesMatcher, parseIp, } from "./ip-restriction.js";
 const DEFAULT_REFRESH_MS = 60 * 60_000;
 const DEFAULT_FETCH_TIMEOUT_MS = 30_000;
@@ -74,6 +75,8 @@ function parseFeedLine(line) {
  * are skipped by {@link ipReputation}, so a partially-malformed feed still loads
  * its good entries.
  *
+ * The outbound fetch is SSRF-hardened by default (see {@link UrlFeedOptions.fetchImpl}).
+ *
  * @param url - The feed URL.
  * @param opts - Optional feed name, custom `fetch`, and request headers.
  * @returns A feed ready to pass to {@link IpReputationOptions.feeds}.
@@ -81,7 +84,10 @@ function parseFeedLine(line) {
  */
 export function urlFeed(url, opts = {}) {
     const name = opts.name ?? url;
-    const doFetch = opts.fetchImpl ?? globalThis.fetch;
+    // Secure-by-default: route the outbound feed fetch through fetchGuard() so
+    // redirects are re-validated per hop and internal/metadata targets are
+    // refused, matching createWebhookSender's posture. Callers can override.
+    const doFetch = opts.fetchImpl ?? fetchGuard();
     return {
         name,
         async fetch(signal) {

package/dist/jwk.js

@@ -235,7 +235,7 @@ export function jwk(opts) {
         });
         return cachedVerifier;
     }
-    return {
+    const authHooks = {
         async beforeHandle(ctx) {
             const header = ctx.request.headers.get("authorization") ?? "";
             const match = /^Bearer\s+(.+)$/i.exec(header);
@@ -268,6 +268,11 @@ export function jwk(opts) {
             return undefined;
         },
     };
+    // Same global symbol as middleware's AUTH_HOOK_MARKER (stamped inline to keep
+    // the middleware module out of jwk's bundle): lets the route-auth boot guard
+    // recognize that a route declaring `auth:` is actually enforced here.
+    authHooks[Symbol.for("daloyjs.auth.hook")] = true;
+    return authHooks;
 }
 function extractScopes(payload) {
     // RFC 8693 / OAuth2: `scope` is a space-delimited string; some IdPs emit

package/dist/mcp.d.ts

@@ -39,9 +39,16 @@ export type McpJsonObject = {
 };
 /**
  * JSON Schema fragment advertised to MCP clients for a tool or prompt
- * argument object. DaloyJS does not bundle a schema validator here, so the
- * schema is documentation and client-side guidance. Validate sensitive inputs
- * inside your handler before touching databases, files, or remote services.
+ * argument object.
+ *
+ * For a tool's `inputSchema`, DaloyJS enforces the commonly-used,
+ * security-relevant subset of JSON Schema server-side (see
+ * {@link validateMcpInput}) BEFORE the tool handler runs, rejecting a
+ * `tools/call` whose arguments violate it with JSON-RPC `-32602`. Keywords
+ * outside that subset (`pattern`, `format`, `$ref`,
+ * `anyOf`/`oneOf`/`allOf`, …) are advertised to clients but NOT enforced —
+ * validate any constraint expressed only through those keywords inside your
+ * handler before touching databases, files, or remote services.
  *
  * @since 1.0.0
  */
@@ -195,8 +202,11 @@ export interface McpToolAnnotations {
  * Handler for a single MCP tool.
  *
  * @typeParam TArgs - Type expected in `params.arguments` for this tool.
- * @param args - Tool arguments supplied by the MCP client. They are typed for
- *   developer experience but are still untrusted JSON at runtime.
+ * @param args - Tool arguments supplied by the MCP client. They have already
+ *   been validated against this tool's `inputSchema` (enforced subset — see
+ *   {@link validateMcpInput}) and had prototype-pollution keys stripped, so the
+ *   declared shape holds at runtime. Constraints expressed only through
+ *   unsupported schema keywords (e.g. `pattern`) remain the handler's job.
  * @param ctx - Request metadata and the original HTTP request.
  * @returns Text shorthand or a full {@link McpToolResult}.
  * @throws {McpToolError} for caller-correctable failures that should be
@@ -209,9 +219,11 @@ export type McpToolHandler<TArgs extends Record<string, unknown> = Record<string
  * Definition of a callable MCP tool.
  *
  * Tools are model-controlled in MCP: clients may let the language model decide
- * when to call them. Treat every tool as a public API operation and enforce
- * authentication, authorization, rate limits, and validation before side
- * effects.
+ * when to call them. Treat every tool as a public API operation. DaloyJS
+ * enforces the tool's `inputSchema` (enforced subset — see
+ * {@link validateMcpInput}) before the handler runs; you remain responsible for
+ * authentication, authorization, rate limits, and any validation beyond that
+ * subset before side effects.
  *
  * @typeParam TArgs - Type expected by this tool's handler.
  * @since 1.0.0
@@ -492,6 +504,31 @@ export interface McpHandlerOptions {
  * @since 1.0.0
  */
 export type McpHandler = (request: Request) => Promise<Response>;
+/**
+ * Minimal, dependency-free JSON Schema validator for MCP tool arguments.
+ *
+ * DaloyJS core bundles no third-party schema library, so this implements the
+ * commonly-used, security-relevant subset of JSON Schema — enough to reject the
+ * untrusted `tools/call` argument shapes that matter before a tool handler
+ * runs: wrong `type` (including `integer`), missing `required` properties,
+ * unexpected keys under `additionalProperties: false`, `enum`/`const`
+ * violations, and basic string/number/array bounds (`minLength`/`maxLength`,
+ * `minimum`/`maximum`, `minItems`/`maxItems`). Nested `properties`, `items`,
+ * and object-form `additionalProperties` are validated recursively.
+ *
+ * Keywords outside this subset (`pattern`, `format`, `$ref`,
+ * `anyOf`/`oneOf`/`allOf`, etc.) are intentionally NOT enforced — notably
+ * `pattern` is skipped so a developer-authored regex can never become a ReDoS
+ * sink against attacker-controlled input. Handlers must still validate any
+ * constraint expressed only through those keywords.
+ *
+ * @param schema - The tool's advertised `inputSchema`.
+ * @param value - The untrusted `params.arguments` value from the client.
+ * @returns A list of human-readable validation errors; empty when the value
+ *   satisfies the enforced subset of the schema.
+ * @since 1.0.0
+ */
+export declare function validateMcpInput(schema: McpJsonSchema, value: unknown): string[];
 /**
  * Create a dependency-free MCP Streamable HTTP endpoint handler.
  *
@@ -544,6 +581,25 @@ export type McpHandler = (request: Request) => Promise<Response>;
  * @since 1.0.0
  */
 export declare function createMcpHandler(options: McpHandlerOptions): McpHandler;
+/**
+ * Options for {@link mcpRoutes}.
+ *
+ * @since 1.0.0
+ */
+export interface McpRoutesOptions {
+    /**
+     * Set `true` to intentionally expose the MCP endpoint WITHOUT authentication,
+     * opting the `POST` transport out of the App's production route-auth boot
+     * guard. Only do this for a genuinely public MCP server — MCP tools are
+     * model-controlled and can trigger side effects, so an unauthenticated
+     * endpoint is a high-impact default. When left `false` (the default), a
+     * production `secureDefaults` App refuses to boot unless an authentication
+     * hook covers the MCP route.
+     *
+     * @defaultValue false
+     */
+    public?: boolean;
+}
 /**
  * Build the Daloy route definitions for a Streamable HTTP MCP endpoint.
  *
@@ -552,8 +608,16 @@ export declare function createMcpHandler(options: McpHandlerOptions): McpHandler
  * its public contract and auth policy, while the MCP server can use its own
  * bearer token, rate limit, network allowlist, and tool set.
  *
+ * By default the `POST` transport route is stamped so that a production
+ * `secureDefaults` App **refuses to boot** unless an authentication hook covers
+ * it — MCP tools are model-controlled and side-effecting. Cover the route with
+ * an auth middleware (e.g. `app.use(bearerAuth({ ... }))`), or pass
+ * `{ public: true }` to intentionally expose a public MCP server.
+ *
  * @param path - Public MCP endpoint path, usually `"/mcp"`.
  * @param handler - Handler returned by {@link createMcpHandler}.
+ * @param options - See {@link McpRoutesOptions}; pass `{ public: true }` to opt
+ *   out of the auth boot guard.
  * @returns Route definitions for `POST`, `GET`, and `OPTIONS` on the same
  *   path. `POST` is the actual MCP transport; `GET` gives a human-readable
  *   405 hint because this helper does not open server-initiated SSE streams;
@@ -564,11 +628,18 @@ export declare function createMcpHandler(options: McpHandlerOptions): McpHandler
  * const app = new App();
  * const mcp = createMcpHandler({ serverInfo, tools });
  *
+ * // Authenticated MCP server (satisfies the production boot guard):
+ * app.use(bearerAuth({ validate: (t) => timingSafeEqual(t, process.env.MCP_TOKEN!) }));
  * for (const route of mcpRoutes("/mcp", mcp)) {
  *   app.route(route);
  * }
+ *
+ * // ...or an intentionally public MCP server:
+ * for (const route of mcpRoutes("/mcp", mcp, { public: true })) {
+ *   app.route(route);
+ * }
  * ```
  *
  * @since 1.0.0
  */
-export declare function mcpRoutes(path: PathString, handler: McpHandler): RouteDefinition<PathString, "GET" | "POST" | "OPTIONS">[];
+export declare function mcpRoutes(path: PathString, handler: McpHandler, options?: McpRoutesOptions): RouteDefinition<PathString, "GET" | "POST" | "OPTIONS">[];

package/dist/mcp.js

@@ -1,3 +1,4 @@
+import { safeJsonParse } from "./security.js";
 /**
  * Latest MCP protocol version DaloyJS negotiates by default.
  *
@@ -125,6 +126,165 @@ function asRecord(value) {
         ? value
         : {};
 }
+/** Hard cap on reported validation errors so a hostile payload can't inflate the response. */
+const MAX_MCP_VALIDATION_ERRORS = 20;
+/** Recursion-depth cap so a deeply-nested payload can't exhaust the stack. */
+const MAX_MCP_SCHEMA_DEPTH = 64;
+/** Narrow an arbitrary JSON value to a schema object (`{}`), excluding arrays/null. */
+function isSchemaObject(v) {
+    return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+/** Report the JSON type of a value using JSON Schema's type names. */
+function jsonTypeOf(v) {
+    if (v === null)
+        return "null";
+    if (Array.isArray(v))
+        return "array";
+    return typeof v;
+}
+/** Test a value against a single JSON Schema `type` keyword. */
+function matchesJsonType(type, value) {
+    switch (type) {
+        case "integer":
+            return typeof value === "number" && Number.isInteger(value);
+        case "number":
+            return typeof value === "number" && Number.isFinite(value);
+        case "string":
+            return typeof value === "string";
+        case "boolean":
+            return typeof value === "boolean";
+        case "null":
+            return value === null;
+        case "object":
+            return value !== null && typeof value === "object" && !Array.isArray(value);
+        case "array":
+            return Array.isArray(value);
+        default:
+            // Unknown type keyword — do not reject; treat as unconstrained.
+            return true;
+    }
+}
+/** Structural equality for `enum`/`const` comparison (sufficient for JSON scalars/objects). */
+function deepEqualJson(a, b) {
+    return JSON.stringify(a) === JSON.stringify(b);
+}
+/** Recursive worker for {@link validateMcpInput}. Pushes human-readable errors into `errors`. */
+function validateSchemaNode(schema, value, path, errors, depth) {
+    if (errors.length >= MAX_MCP_VALIDATION_ERRORS)
+        return;
+    if (depth > MAX_MCP_SCHEMA_DEPTH) {
+        errors.push(`${path}: exceeds maximum validation depth`);
+        return;
+    }
+    // type (string or array-of-strings). A type mismatch stops deeper,
+    // type-dependent checks for this node to avoid a cascade of noise.
+    const typeKw = schema.type;
+    if (typeof typeKw === "string") {
+        if (!matchesJsonType(typeKw, value)) {
+            errors.push(`${path}: expected ${typeKw}, got ${jsonTypeOf(value)}`);
+            return;
+        }
+    }
+    else if (Array.isArray(typeKw)) {
+        const types = typeKw.filter((t) => typeof t === "string");
+        if (types.length > 0 && !types.some((t) => matchesJsonType(t, value))) {
+            errors.push(`${path}: expected one of [${types.join(", ")}], got ${jsonTypeOf(value)}`);
+            return;
+        }
+    }
+    if (Array.isArray(schema.enum) && !schema.enum.some((e) => deepEqualJson(e, value))) {
+        errors.push(`${path}: value is not one of the allowed enum values`);
+    }
+    if ("const" in schema && !deepEqualJson(schema.const, value)) {
+        errors.push(`${path}: value does not equal the required constant`);
+    }
+    if (typeof value === "string") {
+        if (typeof schema.minLength === "number" && value.length < schema.minLength) {
+            errors.push(`${path}: string shorter than minLength ${schema.minLength}`);
+        }
+        if (typeof schema.maxLength === "number" && value.length > schema.maxLength) {
+            errors.push(`${path}: string longer than maxLength ${schema.maxLength}`);
+        }
+    }
+    if (typeof value === "number") {
+        if (typeof schema.minimum === "number" && value < schema.minimum) {
+            errors.push(`${path}: number below minimum ${schema.minimum}`);
+        }
+        if (typeof schema.maximum === "number" && value > schema.maximum) {
+            errors.push(`${path}: number above maximum ${schema.maximum}`);
+        }
+    }
+    if (Array.isArray(value)) {
+        if (typeof schema.minItems === "number" && value.length < schema.minItems) {
+            errors.push(`${path}: array has fewer than minItems ${schema.minItems}`);
+        }
+        if (typeof schema.maxItems === "number" && value.length > schema.maxItems) {
+            errors.push(`${path}: array has more than maxItems ${schema.maxItems}`);
+        }
+        if (isSchemaObject(schema.items)) {
+            for (let i = 0; i < value.length; i++) {
+                validateSchemaNode(schema.items, value[i], `${path}[${i}]`, errors, depth + 1);
+                if (errors.length >= MAX_MCP_VALIDATION_ERRORS)
+                    return;
+            }
+        }
+    }
+    if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+        const obj = value;
+        const props = isSchemaObject(schema.properties) ? schema.properties : undefined;
+        if (Array.isArray(schema.required)) {
+            for (const req of schema.required) {
+                if (typeof req === "string" && !Object.prototype.hasOwnProperty.call(obj, req)) {
+                    errors.push(`${path}.${req}: required property is missing`);
+                }
+            }
+        }
+        const addl = schema.additionalProperties;
+        for (const key of Object.keys(obj)) {
+            const sub = props && isSchemaObject(props[key]) ? props[key] : undefined;
+            if (sub) {
+                validateSchemaNode(sub, obj[key], `${path}.${key}`, errors, depth + 1);
+            }
+            else if (addl === false) {
+                errors.push(`${path}.${key}: unexpected property (additionalProperties is false)`);
+            }
+            else if (isSchemaObject(addl)) {
+                validateSchemaNode(addl, obj[key], `${path}.${key}`, errors, depth + 1);
+            }
+            if (errors.length >= MAX_MCP_VALIDATION_ERRORS)
+                return;
+        }
+    }
+}
+/**
+ * Minimal, dependency-free JSON Schema validator for MCP tool arguments.
+ *
+ * DaloyJS core bundles no third-party schema library, so this implements the
+ * commonly-used, security-relevant subset of JSON Schema — enough to reject the
+ * untrusted `tools/call` argument shapes that matter before a tool handler
+ * runs: wrong `type` (including `integer`), missing `required` properties,
+ * unexpected keys under `additionalProperties: false`, `enum`/`const`
+ * violations, and basic string/number/array bounds (`minLength`/`maxLength`,
+ * `minimum`/`maximum`, `minItems`/`maxItems`). Nested `properties`, `items`,
+ * and object-form `additionalProperties` are validated recursively.
+ *
+ * Keywords outside this subset (`pattern`, `format`, `$ref`,
+ * `anyOf`/`oneOf`/`allOf`, etc.) are intentionally NOT enforced — notably
+ * `pattern` is skipped so a developer-authored regex can never become a ReDoS
+ * sink against attacker-controlled input. Handlers must still validate any
+ * constraint expressed only through those keywords.
+ *
+ * @param schema - The tool's advertised `inputSchema`.
+ * @param value - The untrusted `params.arguments` value from the client.
+ * @returns A list of human-readable validation errors; empty when the value
+ *   satisfies the enforced subset of the schema.
+ * @since 1.0.0
+ */
+export function validateMcpInput(schema, value) {
+    const errors = [];
+    validateSchemaNode(schema, value, "arguments", errors, 0);
+    return errors;
+}
 function publicTool(tool) {
     const { handler: _handler, ...rest } = tool;
     return rest;
@@ -382,8 +542,18 @@ export function createMcpHandler(options) {
                 if (!tool) {
                     return rpcError(id, INVALID_PARAMS, `Unknown tool: ${name || "<missing>"}`, undefined, 200, headers);
                 }
+                // Enforce the tool's advertised inputSchema on the untrusted client
+                // arguments BEFORE the handler runs, so a handler is never handed a
+                // payload that violates its own contract (wrong types, missing required
+                // fields, unexpected keys). Protocol-level validation failures map to
+                // JSON-RPC -32602 (Invalid params).
+                const rawArgs = params.arguments === undefined ? {} : params.arguments;
+                const validationErrors = validateMcpInput(tool.inputSchema, rawArgs);
+                if (validationErrors.length > 0) {
+                    return rpcError(id, INVALID_PARAMS, `Invalid arguments for tool "${name}": ${validationErrors[0]}`, { validationErrors }, 200, headers);
+                }
                 try {
-                    const result = await tool.handler(asRecord(params.arguments), ctx);
+                    const result = await tool.handler(asRecord(rawArgs), ctx);
                     return rpcResult(id, normalizeToolResult(result), headers);
                 }
                 catch (error) {
@@ -523,7 +693,11 @@ export function createMcpHandler(options) {
         }
         let message;
         try {
-            message = JSON.parse(raw);
+            // `safeJsonParse` strips `__proto__` / `constructor` / `prototype` keys so
+            // an untrusted MCP client cannot smuggle prototype-pollution-shaped keys
+            // into a tool handler's arguments — matching the REST body parsers'
+            // secure-by-default posture (see `safeJsonParse` in security.ts).
+            message = safeJsonParse(raw);
         }
         catch {
             return rpcError(null, PARSE_ERROR, "Invalid JSON in request body.", undefined, 400, headers);
@@ -565,8 +739,16 @@ export function createMcpHandler(options) {
  * its public contract and auth policy, while the MCP server can use its own
  * bearer token, rate limit, network allowlist, and tool set.
  *
+ * By default the `POST` transport route is stamped so that a production
+ * `secureDefaults` App **refuses to boot** unless an authentication hook covers
+ * it — MCP tools are model-controlled and side-effecting. Cover the route with
+ * an auth middleware (e.g. `app.use(bearerAuth({ ... }))`), or pass
+ * `{ public: true }` to intentionally expose a public MCP server.
+ *
  * @param path - Public MCP endpoint path, usually `"/mcp"`.
  * @param handler - Handler returned by {@link createMcpHandler}.
+ * @param options - See {@link McpRoutesOptions}; pass `{ public: true }` to opt
+ *   out of the auth boot guard.
  * @returns Route definitions for `POST`, `GET`, and `OPTIONS` on the same
  *   path. `POST` is the actual MCP transport; `GET` gives a human-readable
  *   405 hint because this helper does not open server-initiated SSE streams;
@@ -577,14 +759,21 @@ export function createMcpHandler(options) {
  * const app = new App();
  * const mcp = createMcpHandler({ serverInfo, tools });
  *
+ * // Authenticated MCP server (satisfies the production boot guard):
+ * app.use(bearerAuth({ validate: (t) => timingSafeEqual(t, process.env.MCP_TOKEN!) }));
  * for (const route of mcpRoutes("/mcp", mcp)) {
  *   app.route(route);
  * }
+ *
+ * // ...or an intentionally public MCP server:
+ * for (const route of mcpRoutes("/mcp", mcp, { public: true })) {
+ *   app.route(route);
+ * }
  * ```
  *
  * @since 1.0.0
  */
-export function mcpRoutes(path, handler) {
+export function mcpRoutes(path, handler, options = {}) {
     const responses = {
         200: { description: "MCP JSON-RPC response", body: MCP_JSON_RESPONSE_SCHEMA },
         202: { description: "MCP notification accepted", body: MCP_JSON_RESPONSE_SCHEMA },
@@ -594,7 +783,7 @@ export function mcpRoutes(path, handler) {
         405: { description: "Unsupported MCP transport method" },
         413: { description: "MCP request body too large" },
     };
-    return [
+    const routes = [
         {
             method: "POST",
             path,
@@ -620,4 +809,17 @@ export function mcpRoutes(path, handler) {
             handler: ({ request }) => handler(request),
         },
     ];
+    // Unless explicitly public, stamp the POST transport (the route that executes
+    // tools/call) with the global-registry marker the App boot guard reads. GET
+    // (405 hint) and OPTIONS (preflight) are not marked: preflight must stay
+    // credential-free. Uses the same string as app.ts's MCP_ROUTE_MARKER; kept as
+    // a bare Symbol.for so the App core never imports this module.
+    if (options.public !== true) {
+        for (const route of routes) {
+            if (route.method === "POST") {
+                route[Symbol.for("daloyjs.mcp.route")] = true;
+            }
+        }
+    }
+    return routes;
 }

package/dist/middleware.d.ts

@@ -314,6 +314,44 @@ export declare const CORS_WILDCARD_ORIGIN_MARKER: unique symbol;
  * @since 0.17.0
  */
 export declare const CSRF_HOOK_MARKER: unique symbol;
+/**
+ * Marker stamped on a {@link Hooks} bundle that authenticates the request —
+ * i.e. rejects callers without valid credentials. Built-in auth middlewares
+ * (`bearerAuth`, `basicAuth`, `jwk`, `httpSignatureAuth`, `clientCertAuth`)
+ * stamp it so the framework's route-auth boot guard can confirm that any route
+ * declaring an `auth:` requirement is actually enforced by a hook rather than
+ * being silently public (a `security` entry in the OpenAPI doc with no runtime
+ * check). Wrap a custom authentication hook with {@link markAuthHook} to opt it
+ * into the same guard.
+ *
+ * @since 1.0.0
+ */
+export declare const AUTH_HOOK_MARKER: unique symbol;
+/**
+ * Mark a custom {@link Hooks} bundle as performing request authentication.
+ *
+ * Use this when you authenticate with your own hook (not one of the built-in
+ * auth middlewares) but still declare `auth:` on the protected routes: it
+ * stamps {@link AUTH_HOOK_MARKER} so the production route-auth boot guard treats
+ * those routes as enforced. It is also the correct escape hatch when
+ * authentication is performed by an upstream gateway/mesh and the in-app hook
+ * is intentionally a pass-through.
+ *
+ * @param hooks - The hook bundle to mark (mutated in place and returned).
+ * @returns The same `hooks` object, now stamped as an auth hook.
+ *
+ * @example
+ * ```ts
+ * app.use(markAuthHook({
+ *   async beforeHandle(ctx) {
+ *     if (!(await myVerify(ctx.request))) throw new UnauthorizedError();
+ *   },
+ * }));
+ * ```
+ *
+ * @since 1.0.0
+ */
+export declare function markAuthHook(hooks: Hooks): Hooks;
 /** Predicate stamped on a CORS `Hooks` object that returns `true` for allowed origins. */
 export type CorsOriginAllow = (origin: string) => boolean;
 /** Options for {@link cors}. */

package/dist/middleware.js

@@ -447,6 +447,47 @@ export const CORS_WILDCARD_ORIGIN_MARKER = Symbol.for("daloyjs.middleware.cors.w
  * @since 0.17.0
  */
 export const CSRF_HOOK_MARKER = Symbol.for("daloyjs.middleware.csrf");
+/**
+ * Marker stamped on a {@link Hooks} bundle that authenticates the request —
+ * i.e. rejects callers without valid credentials. Built-in auth middlewares
+ * (`bearerAuth`, `basicAuth`, `jwk`, `httpSignatureAuth`, `clientCertAuth`)
+ * stamp it so the framework's route-auth boot guard can confirm that any route
+ * declaring an `auth:` requirement is actually enforced by a hook rather than
+ * being silently public (a `security` entry in the OpenAPI doc with no runtime
+ * check). Wrap a custom authentication hook with {@link markAuthHook} to opt it
+ * into the same guard.
+ *
+ * @since 1.0.0
+ */
+export const AUTH_HOOK_MARKER = Symbol.for("daloyjs.auth.hook");
+/**
+ * Mark a custom {@link Hooks} bundle as performing request authentication.
+ *
+ * Use this when you authenticate with your own hook (not one of the built-in
+ * auth middlewares) but still declare `auth:` on the protected routes: it
+ * stamps {@link AUTH_HOOK_MARKER} so the production route-auth boot guard treats
+ * those routes as enforced. It is also the correct escape hatch when
+ * authentication is performed by an upstream gateway/mesh and the in-app hook
+ * is intentionally a pass-through.
+ *
+ * @param hooks - The hook bundle to mark (mutated in place and returned).
+ * @returns The same `hooks` object, now stamped as an auth hook.
+ *
+ * @example
+ * ```ts
+ * app.use(markAuthHook({
+ *   async beforeHandle(ctx) {
+ *     if (!(await myVerify(ctx.request))) throw new UnauthorizedError();
+ *   },
+ * }));
+ * ```
+ *
+ * @since 1.0.0
+ */
+export function markAuthHook(hooks) {
+    hooks[AUTH_HOOK_MARKER] = true;
+    return hooks;
+}
 /**
  * Cross-Origin Resource Sharing (CORS) middleware. Handles both preflight
  * (`OPTIONS`) and actual requests, attaching the correct
@@ -838,7 +879,7 @@ export function bearerAuth(opts) {
     if (/["\r\n\0]/.test(realm)) {
         throw new Error("bearerAuth(): realm must not contain quotes, CR, LF, or NUL bytes.");
     }
-    return {
+    return markAuthHook({
         async beforeHandle(ctx) {
             const h = ctx.request.headers.get("authorization") ?? "";
             const m = /^Bearer\s+(.+)$/i.exec(h);
@@ -866,7 +907,7 @@ export function bearerAuth(opts) {
             }
             return undefined;
         },
-    };
+    });
 }
 const CSRF_STATE_TOKEN = "csrfToken";
 const CSRF_STATE_ISSUED = "__csrfIssued";
@@ -1115,7 +1156,7 @@ export function basicAuth(opts) {
     if (!Number.isInteger(maxBytes) || maxBytes < 1) {
         throw new Error("basicAuth(): maxCredentialBytes must be a positive integer.");
     }
-    return {
+    return markAuthHook({
         async beforeHandle(ctx) {
             const header = ctx.request.headers.get("authorization") ?? "";
             const match = BASIC_AUTH_TOKEN_RE.exec(header);
@@ -1134,7 +1175,7 @@ export function basicAuth(opts) {
             }
             return undefined;
         },
-    };
+    });
 }
 // ---------- requireScopes ----------
 /**

package/dist/mtls.js

@@ -347,7 +347,7 @@ export function clientCertAuth(opts = {}) {
                 return certFromHeaders(ctx.request, headerConfig);
             return undefined;
         });
-    return {
+    const authHooks = {
         async beforeHandle(ctx) {
             const cert = resolve(ctx);
             if (!cert) {
@@ -386,6 +386,11 @@ export function clientCertAuth(opts = {}) {
             return undefined;
         },
     };
+    // Same global symbol as middleware's AUTH_HOOK_MARKER (stamped inline to keep
+    // the middleware module out of this bundle): lets the route-auth boot guard
+    // recognize that a route declaring `auth:` is actually enforced here.
+    authHooks[Symbol.for("daloyjs.auth.hook")] = true;
+    return authHooks;
 }
 function assertHeaderConfig(cfg) {
     if (cfg.format === "xfcc")

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:e297e402-67fc-54e1-a292-02441ebb5d71",
+  "serialNumber": "urn:uuid:63bae5ad-16c4-5db2-9929-3188903cb4f9",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-03T11:51:00.910Z",
+    "timestamp": "2026-07-04T14:31:15.314Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "1.0.0-rc.0"
+        "version": "1.0.0-rc.1"
       }
     ],
     "authors": [
@@ -19,11 +19,11 @@
     ],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/@daloyjs/core@1.0.0-rc.0",
+      "bom-ref": "pkg:npm/@daloyjs/core@1.0.0-rc.1",
       "name": "@daloyjs/core",
-      "version": "1.0.0-rc.0",
+      "version": "1.0.0-rc.1",
       "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
-      "purl": "pkg:npm/@daloyjs/core@1.0.0-rc.0",
+      "purl": "pkg:npm/@daloyjs/core@1.0.0-rc.1",
       "licenses": [
         {
           "license": {
@@ -46,9 +46,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag--daloyjs-core-1.0.0-rc.0",
+        "tagId": "swidtag--daloyjs-core-1.0.0-rc.1",
         "name": "@daloyjs/core",
-        "version": "1.0.0-rc.0",
+        "version": "1.0.0-rc.1",
         "tagVersion": 0,
         "patch": false
       }
@@ -57,7 +57,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/@daloyjs/core@1.0.0-rc.0",
+      "ref": "pkg:npm/@daloyjs/core@1.0.0-rc.1",
       "dependsOn": []
     }
   ]

package/dist/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@daloyjs/core-1.0.0-rc.0",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.0.0-rc.0-e297e402-67fc-54e1-a292-02441ebb5d71",
+  "name": "@daloyjs/core-1.0.0-rc.1",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.0.0-rc.1-63bae5ad-16c4-5db2-9929-3188903cb4f9",
   "creationInfo": {
-    "created": "2026-07-03T11:51:00.910Z",
+    "created": "2026-07-04T14:31:15.314Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package--daloyjs-core",
       "name": "@daloyjs/core",
-      "versionInfo": "1.0.0-rc.0",
+      "versionInfo": "1.0.0-rc.1",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/@daloyjs/core@1.0.0-rc.0"
+          "referenceLocator": "pkg:npm/@daloyjs/core@1.0.0-rc.1"
         }
       ]
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daloyjs/core",
-  "version": "1.0.0-rc.0",
+  "version": "1.0.0-rc.1",
   "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
   "type": "module",
   "publishConfig": {