@daloyjs/core 1.0.0-rc.0 → 1.0.0-rc.2

package/README.md

@@ -211,7 +211,7 @@ That single command runs the two scripts:
 ```jsonc
 // package.json
 "scripts": {
-  "gen:openapi": "node --import tsx scripts/dump-openapi.ts",
+  "gen:openapi": "node scripts/dump-openapi.ts",
   "gen:client":  "openapi-ts",
   "gen":         "pnpm gen:openapi && pnpm gen:client"
 }
@@ -339,11 +339,11 @@ const app = createApp({ docs: true });
 
 | Runtime | Spawned command                                                 |
 | ------- | --------------------------------------------------------------- |
-| Node    | `node --import tsx --watch <entry>`                             |
+| Node    | `node --watch <entry>`                                          |
 | Bun     | `bun --hot <entry>`                                             |
 | Deno    | `deno run --watch --allow-net --allow-env --allow-read <entry>` |
 
-Entry defaults to `src/index.ts`, `src/main.ts`, `src/server.ts`, or `src/app.ts`. Install `tsx` as a dev dependency on Node for TypeScript entries.
+Entry defaults to `src/index.ts`, `src/main.ts`, `src/server.ts`, or `src/app.ts`. Node.js (>= 22.18) runs TypeScript entries natively via built-in type stripping — no loader needed. Projects that rely on non-erasable syntax (enums, runtime namespaces, parameter properties) or extensionless relative imports can keep using a loader directly, e.g. `node --import tsx --watch <entry>` (and `daloy inspect` falls back to `tsx` automatically when the native load fails and `tsx` is installed).
 
 Pass `--runtime <node|bun|deno>` to override runtime detection. This is required when running `daloy dev` from a `package.json` script on Bun or Deno, because the CLI binary's `#!/usr/bin/env node` shebang otherwise forces Node detection. The `bun-basic` template ships `"dev": "daloy dev --runtime bun"` for this reason.
 
@@ -509,7 +509,7 @@ The core only ever sees `Request → Response`. Adapters live at the edge.
 
 ## Status
 
-DaloyJS is now at its **first `1.0.0` release candidate** (`1.0.0-rc.0`). The public API is frozen for the 1.0 line: only bug fixes and documentation land between RC and GA, and from `1.0.0` onward breaking changes follow SemVer with deprecations getting at least one minor cycle. The framework is already in use for production trials.
+DaloyJS is at **`1.0.0-rc.2`**, a security-hardening release candidate. Because the framework has no external users yet, this RC ships a few intentional breaking changes (see the [CHANGELOG](CHANGELOG.md)) to get the secure-by-default posture right before GA rather than deferring them; the generated OpenAPI contract is unchanged. From `1.0.0` GA onward, breaking changes follow SemVer with deprecations getting at least one minor cycle. The framework is already in use for production trials.
 
 **Release quality bar.** Every release ships with **≥90% line + function coverage and ≥90% branch coverage**, strict TypeScript, OpenSSF Scorecard, CodeQL + Opengrep dual SAST, zizmor workflow linting, and npm provenance. Coverage was relaxed from a former 100% gate so complex security work isn't blocked chasing throwaway tests for unreachable defensive branches or tsx source-map phantoms; see [AGENTS.md](AGENTS.md) for the policy.
 
@@ -520,14 +520,14 @@ DaloyJS is now at its **first `1.0.0` release candidate** (`1.0.0-rc.0`). The pu
 - Zero-config OpenAPI `info` autofill from `package.json` (Node / Bun) or `deno.json` / `deno.jsonc` (Deno); explicit `openapi.info` values always win.
 - RFC 7231 + RFC 5789 HTTP-method allowlist enforced inside `app.route()` (WebDAV, `TRACE`, `CONNECT` rejected at the framework boundary).
 - AI-friendly route metadata via optional `meta: { examples, extensions, summary, description, tags }`; examples are validated against your schemas at build time, surfaced as OpenAPI `examples` + `x-daloy-*` extensions, and dumped as `routes.json` / `routes.yaml` via `daloy inspect --ai`.
-- Dependency-free MCP Streamable HTTP server helpers at `@daloyjs/core/mcp`: `createMcpHandler()` exposes tools (with `outputSchema`, `annotations`, and icons), resources, RFC 6570 resource templates, and prompts (with required-argument enforcement) over JSON-RPC 2.0 and validates `Origin` against DNS rebinding (with an `allowedOrigins` allowlist), while `mcpRoutes("/mcp", handler)` mounts the POST / GET / OPTIONS Daloy routes — with the JSON-RPC envelope schema surfaced in OpenAPI — for a dedicated MCP service with the same auth, rate-limit, body-limit, and timeout middleware as any other app.
+- Dependency-free MCP Streamable HTTP server helpers at `@daloyjs/core/mcp`: `createMcpHandler()` exposes tools (with `outputSchema`, `annotations`, and icons), resources, RFC 6570 resource templates, and prompts (with required-argument enforcement) over JSON-RPC 2.0 and validates `Origin` against DNS rebinding (with an `allowedOrigins` allowlist), while `mcpRoutes("/mcp", handler)` mounts the POST / GET / OPTIONS Daloy routes — with the JSON-RPC envelope schema surfaced in OpenAPI — for a dedicated MCP service with the same auth, rate-limit, body-limit, and timeout middleware as any other app. Every `tools/call` argument is validated server-side against the tool's `inputSchema` (a dependency-free JSON-Schema subset — `type`/`required`/`properties`/`additionalProperties`/`enum`/`const`/bounds; exposed as `validateMcpInput()`) before the handler runs, rejecting a mismatch with JSON-RPC `-32602`; the JSON-RPC body is parsed with prototype-pollution-safe `safeJsonParse`; and an unauthenticated `mcpRoutes()` endpoint refuses to boot in production unless opted out with `mcpRoutes(path, handler, { public: true })`.
 - API lifecycle and breaking-change detection: mark routes `deprecated` or give them a `sunset` date to emit RFC 8594 `Deprecation` / `Sunset` headers and an `x-sunset` OpenAPI extension, then gate CI with `diffOpenAPI()` / the `daloy diff` command, which fail on a breaking change versus the last published spec.
 - In-process test client (`app.request()`), contract-test runner (gated in CI via `daloy inspect --check` and shipped as a default test in every `create-daloy` template), in-process typed client, and Hey API codegen via `pnpm gen`.
 
 ### Runtimes and deployment
 
 - Adapters for Node (Heroku, Railway, Render, Fly.io), Bun, Deno, Cloudflare Workers, Vercel Node / Edge / Next.js / Netlify Edge, Fastly Compute, and AWS Lambda / Netlify Functions / Lambda Function URLs.
-- `daloy dev` watch loop delegates to the host runtime's native watcher (`node --import tsx --watch`, `bun --hot`, or `deno run --watch`) with a `--runtime` override for cross-runtime `package.json` scripts.
+- `daloy dev` watch loop delegates to the host runtime's native watcher (`node --watch`, `bun --hot`, or `deno run --watch`) with a `--runtime` override for cross-runtime `package.json` scripts.
 - `pnpm create daloy` scaffolder with Node, Bun, Deno, Cloudflare Worker, and Vercel templates, plus optional `--with-ci` GitHub Actions / Dependabot / CODEOWNERS / SECURITY.md hardening. The completion summary surfaces official install links (nodejs.org, pnpm.io, bun.sh) for any runtime or package manager your selections need but that is missing from `PATH`, and skips a doomed dependency install when the chosen package manager is absent.
 - Container-first templates: `HEALTHCHECK` to `/readyz`, `STOPSIGNAL SIGTERM`, non-root user, `tini` as PID 1.
 - Generated `deploy.yml` for container templates signs every pushed GHCR image with **Sigstore Cosign** (keyless OIDC) and attaches an **SPDX SBOM attestation** so consumers can `cosign verify` and `cosign verify-attestation --type spdxjson` instead of trusting the registry alone.
@@ -549,7 +549,9 @@ DaloyJS is now at its **first `1.0.0` release candidate** (`1.0.0-rc.0`). The pu
 
 The framework refuses to start (or to construct) when configuration is unsafe:
 
-- Weak session secrets, `cors({ origin: "*" })` with credentials, `session()` + state-changing route without `csrf()`, and unconfigured `X-Forwarded-*` in production.
+- Weak session secrets, `cors({ origin: "*" })` with credentials, `session()` + state-changing route without `csrf()`, and unconfigured forwarded / client-IP headers (`X-Forwarded-*`, `X-Real-IP`, and vendor headers `CF-Connecting-IP` / `Fly-Client-IP` / `True-Client-IP`) in production.
+- **Shadow auth**: a route that declares an `auth:` requirement (advertised as protected in the OpenAPI `security` list) but installs no authentication hook to enforce it. Built-in auth middlewares (`bearerAuth` / `basicAuth` / `jwk` / `httpSignatureAuth` / `clientCertAuth`) satisfy the guard automatically; mark a custom auth hook (or upstream-gateway-enforced auth) with `markAuthHook()`.
+- **Unauthenticated MCP**: an `mcpRoutes()` endpoint with no auth hook — MCP tools are model-controlled and side-effecting. Opt out for a genuinely public server with `mcpRoutes(path, handler, { public: true })`.
 - `secureDefaults: false` in production unless `acknowledgeInsecureDefaults: true` is set, plus a once-per-process `error` log naming every disabled default.
 - `preset: "internal-service"` topology preset for service-to-service deployments behind a mesh / sidecar / private network: turns OFF the browser-only guards (auto `secureHeaders`, `corsCrossOriginGuard`, `csrf` boot guard, unconfigured `X-Forwarded-*` guard) while keeping every input, parser, credential, SSRF, weak-secret, and refuse-to-boot guard ON. Per-knob options still win, the choice is logged at boot under `event: "security.preset.applied"`, and the live posture is auditable via `app.getSecurityPosture()`.
 - `createJwtSigner()` / `createJwtVerifier()` refuse `alg: "none"`, accept only an explicit allowlist, refuse HS + JWK combinations, refuse to sign without `exp`, and refuse HS-shaped secrets under 32 bytes (RFC 7518 §3.2).
@@ -587,13 +589,13 @@ The framework refuses to start (or to construct) when configuration is unsafe:
 - `clientCertAuth()` mTLS / client-certificate auth at `@daloyjs/core/mtls`: authenticate zero-trust / service-to-service callers by their TLS client certificate from two sources — **native TLS** (the Node adapter lazily reads the peer cert off the socket; plain requests pay nothing) or a **TLS-terminating proxy** (Envoy `X-Forwarded-Client-Cert` and nginx/HAProxy-style structured headers). `requireVerified` by default, exact `allowSubjectCNs` / `allowIssuerCNs`, **constant-time** `allowFingerprints`, `allowSANs` (SPIFFE/DNS/URI/IP, `TYPE:value` or bare), validity-window enforcement, and a custom async `verify()` hook. Missing cert → `401` problem+json with `Cache-Control: no-store`; any failed check → `403` (never echoes cert details). The accepted `ClientCertificate` is stamped on `ctx.state`. `parseForwardedClientCert()` / `normalizePeerCertificate()` exported standalone. Zero runtime dependencies.
 - `autoBan()` adaptive auto-ban (fail2ban-style) at `@daloyjs/core/auto-ban`: temporarily ban abusive clients after repeated suspicious responses (default `401` / `403` / `429`, configurable `watchStatuses`) within a rolling `windowMs`. Bans **escalate** exponentially for repeat offenders (`banMs` → `2×` → `4×`, capped at `maxBanMs`) and **decay** once the client goes quiet. Observes the outgoing status via `onSend` (counts failures from any downstream middleware/handler), enforces in `beforeHandle`. Secure-by-default identity attribution — refuses to construct without `keyGenerator` or `trustProxyHeaders` so one offender can never ban everyone; unattributable requests are skipped. Pluggable `AutoBanStore` (mirrors the `rateLimit()` store; in-memory default, Redis-able for multi-instance), `groupId` sharing across route groups, `429`/`403` ban response with `Retry-After`, and `onBan` / `onStrike` hooks. Zero runtime dependencies.
 - `botGuard()` bot / User-Agent management at `@daloyjs/core/bot-guard`: the in-app equivalent of Nginx/WAF bot rules. Blocks empty/missing `User-Agent` (default on) and known-abusive `User-Agent` strings / `RegExp`s, and **verifies declared crawlers** — a request claiming to be Googlebot/Bingbot is confirmed via reverse-DNS + forward-confirm (the method Google and Bing document), so a spoofed `User-Agent` can't impersonate a trusted crawler. Ships `GOOGLEBOT` / `BINGBOT` / `WELL_KNOWN_BOTS` presets and accepts custom `VerifiedBotRule`s. Allowlist-first (`allowUserAgents` bypasses every rule), secure-by-default (`verifiedBots` refuses to construct without an IP source; unverifiable crawlers blocked unless `blockUnverifiableBots: false`), subdomain-boundary-safe domain matching, per-IP verification cache to keep DNS off the hot path, `mode: "log"` monitor mode, `onBlock` callback, and a pluggable `BotResolver` (default lazy `node:dns/promises`). Zero runtime dependencies.
-- `ipReputation()` IP reputation / dynamic denylist feed at `@daloyjs/core/ip-reputation`: wires pluggable, periodically-refreshed abuse feeds (Tor exit lists, Spamhaus DROP, cloud-abuse ranges, or your own threat intel) into the request path without a redeploy, reusing the same SSRF-grade CIDR matcher as `ipRestriction()`. Ships `urlFeed()` (fetches newline / Spamhaus-DROP-style lists, skips comment lines, keeps good rows from a partially-malformed feed) plus a custom `IpReputationFeed` interface. **Fail-open by design** — a feed that can't be loaded (initial or refresh) never blocks traffic; the last-known-good list is retained per feed. Periodic `unref`'d refresh, `mode: "log"` monitor mode, `onMatch` / `onError` callbacks, manual `refresh()` / `stop()` / `has()` / `size` controller, and pluggable IP resolution (`trustProxyHeaders` / `resolveIp`). Zero runtime dependencies.
+- `ipReputation()` IP reputation / dynamic denylist feed at `@daloyjs/core/ip-reputation`: wires pluggable, periodically-refreshed abuse feeds (Tor exit lists, Spamhaus DROP, cloud-abuse ranges, or your own threat intel) into the request path without a redeploy, reusing the same SSRF-grade CIDR matcher as `ipRestriction()`. Ships `urlFeed()` (fetches newline / Spamhaus-DROP-style lists, skips comment lines, keeps good rows from a partially-malformed feed; **SSRF-hardened by default** — the outbound fetch runs through `fetchGuard()`, so a compromised feed host can't redirect it into cloud-metadata / internal space; override via `fetchImpl`) plus a custom `IpReputationFeed` interface. **Fail-open by design** — a feed that can't be loaded (initial or refresh) never blocks traffic; the last-known-good list is retained per feed. Periodic `unref`'d refresh, `mode: "log"` monitor mode, `onMatch` / `onError` callbacks, manual `refresh()` / `stop()` / `has()` / `size` controller, and pluggable IP resolution (`trustProxyHeaders` / `resolveIp`). Zero runtime dependencies.
 - `geoBlock()` GeoIP / geo-blocking at `@daloyjs/core/geo-block`: country allow/deny middleware that maps the client IP to an ISO 3166-1 alpha-2 country and rejects (or logs) traffic from countries you don't serve. **No bundled GeoIP database and no runtime dependency** — supply either an operator-owned `lookupCountry(ip)` (a MaxMind / `ip2location` reader, or your own table, reusing the trusted-proxy `X-Forwarded-For` / `X-Real-IP` IP resolution) or a `resolveCountry(ctx)` that reads an edge-injected header (`CF-IPCountry`, `CloudFront-Viewer-Country`, `x-vercel-ip-country`). Deny wins over allow (least privilege); **allow-lists fail closed** on an unknown country while deny-only fails open (overridable via `allowUnknownCountry`). Country codes are validated at construction so typos throw instead of silently never matching. `mode: "log"` monitor mode with an `onBlock` decision hook (`denied_country` / `not_in_allowlist` / `unknown_country`), the resolved country stamped on `ctx.state.geo` for allowed requests, and a `403` problem+json rejection that never echoes the country/IP. Zero runtime dependencies.
 - `concurrencyLimit()` per-route / per-client concurrency limits + queueing at `@daloyjs/core/concurrency-limit`: HAProxy `maxconn`/queue parity at the app layer. Bounds in-flight requests through a surface with a per-bucket semaphore (`maxConcurrent`), a bounded FIFO queue (`maxQueue`) with an optional `queueTimeoutMs`, and a fast `503` + `Retry-After` once the queue is full or the wait times out. Partition the budget with `scope`: `"global"` (default), `"route"` (per `method + path`), `"client"` (per identity, needs `trustProxyHeaders`/`keyGenerator`), or a custom function (`undefined` skips limiting, fail-open). Acquires in `beforeHandle` and releases in `onSend`, so slots are freed on success, error, and short-circuit paths alike — never leaked. `onReject` observability hook, configurable `retryAfterSeconds`/`message`. Complements the `maxConnections` socket cap and `loadShedding()`. Zero runtime dependencies. HAProxy `maxconn`/queue parity at the app layer. Bounds in-flight requests through a surface with a per-bucket semaphore (`maxConcurrent`), a bounded FIFO queue (`maxQueue`) with an optional `queueTimeoutMs`, and a fast `503` + `Retry-After` once the queue is full or the wait times out. Partition the budget with `scope`: `"global"` (default), `"route"` (per `method + path`), `"client"` (per identity, needs `trustProxyHeaders`/`keyGenerator`), or a custom function (`undefined` skips limiting, fail-open). Acquires in `beforeHandle` and releases in `onSend`, so slots are freed on success, error, and short-circuit paths alike — never leaked. `onReject` observability hook, configurable `retryAfterSeconds`/`message`. Complements the `maxConnections` socket cap and `loadShedding()`. Zero runtime dependencies.
 - `requestDecompression()` inbound decompression-bomb guard at `@daloyjs/core/request-decompression`: core is safe by omission (it never decompresses request bodies), so this is the opt-in middleware for services that must accept compressed uploads. Inflates `gzip` / `deflate` bodies behind two caps enforced **during** inflation so a zip bomb is aborted before it is fully materialised: an absolute `maxDecompressedBytes` (required) and an expansion-ratio `maxRatio` (default `100`), both rejecting with `413`. The compressed upload itself is bounded by `maxCompressedBytes` (default 1 MiB) before a byte is inflated. Unknown, non-allowlisted, runtime-unsupported, or **layered** (`gzip, gzip`) encodings are refused `415`; malformed streams `400`; bodyless / uncompressed / `identity` / `GET` / `HEAD` traffic passes through untouched. Runs in `onRequest` and stashes the inflated bytes so schema-validated bodies and raw-body handlers both see the decompressed payload. `onBomb` observability hook, exported `decompressRequestBody()` for custom flows. Built on web-standard `DecompressionStream` (brotli excluded — not in the spec). Zero runtime dependencies.
 - `waf()` opt-in WAF-lite signature/anomaly inbound-inspection middleware at `@daloyjs/core/waf`: a first-party defense-in-depth layer for teams without an edge WAF (it does **not** replace ModSecurity / a CDN WAF). Wires DaloyJS' high-confidence injection signatures — SQLi, XSS, NoSQL-operator injection (reusing `hasMongoOperatorKeys` for a structural body check), and command injection — into a single scored inbound-inspection pass over the decoded path, the raw + decoded query string, an opt-in header allowlist, and the validated body. Each rule that fires adds an anomaly `score`; reaching `blockThreshold` (default `5`) rejects with a generic `403` (block mode) or merely reports via `onMatch` (log mode) so operators can tune against real traffic first. Per-rule enable/disable + score overrides, inspection-surface toggles, control-character-stripped log samples, and bounded scanning (`maxValueLength` / `maxBodyNodes`) keep a hostile payload from becoming CPU-DoS. The `403` body never names the rule that fired. Zero runtime dependencies.
 - Built-in docs UI Subresource Integrity (SRI): `DocsAssetOptions` lets `scalarHtml()` / `swaggerUiHtml()` / `redocHtml()` and the `docs: { assets }` auto-mount pin version-exact `*Integrity` hashes (`sha256`/`sha384`/`sha512`) plus a `crossOrigin` value (default `"anonymous"`) on the CDN-loaded Scalar / Swagger UI / Redoc `<script>` / `<link>` tags, so a poisoned jsDelivr asset can't execute. Malformed SRI values throw a `TypeError` at startup (browsers ignore unparseable `integrity`, so failing loud avoids a false sense of protection); self-hosting the assets via the same `assets` URLs stays supported. Zero runtime dependencies.
-- HTTP Message Signatures (RFC 9421) at `@daloyjs/core/http-signatures`: first-party sign/verify for server-to-server request authentication via the standard `Signature` / `Signature-Input` headers — complements the inbound-only webhook HMAC and `clientCertAuth()` mTLS. `signMessage()` / `signRequest()` build an RFC 9421 signature base over derived components (`@method`, `@target-uri`, `@authority`, `@scheme`, `@request-target`, `@path`, `@query`, `@query-param`, `@status`) and HTTP fields with Structured-Fields header serialization; `verifyMessage()` / `verifyRequest()` and the `httpSignatureAuth()` middleware check them. Algorithms `hmac-sha256` / `ed25519` / `ecdsa-p256-sha256` / `ecdsa-p384-sha384` / `rsa-pss-sha512` / `rsa-v1_5-sha256` via WebCrypto (no `node:` imports). Secure-by-default verify: a **mandatory `algorithms` allowlist** (no implicit "any alg"), optional per-key alg pinning to defeat algorithm-confusion, a required `created` timestamp with a 300s freshness window, `created`-in-future / `expires` skew rejection, configurable `requiredComponents`, a 32-byte raw-HMAC floor, and `nonce` replay defense; the middleware answers a missing/invalid signature with `401` + `Cache-Control: no-store` and stamps the verified result on `ctx.state.httpSignature`. Ships RFC 9530 `contentDigest()` / `verifyContentDigest()` to bind the request body. Zero runtime dependencies.
+- HTTP Message Signatures (RFC 9421) at `@daloyjs/core/http-signatures`: first-party sign/verify for server-to-server request authentication via the standard `Signature` / `Signature-Input` headers — complements the inbound-only webhook HMAC and `clientCertAuth()` mTLS. `signMessage()` / `signRequest()` build an RFC 9421 signature base over derived components (`@method`, `@target-uri`, `@authority`, `@scheme`, `@request-target`, `@path`, `@query`, `@query-param`, `@status`) and HTTP fields with Structured-Fields header serialization; `verifyMessage()` / `verifyRequest()` and the `httpSignatureAuth()` middleware check them. Algorithms `hmac-sha256` / `ed25519` / `ecdsa-p256-sha256` / `ecdsa-p384-sha384` / `rsa-pss-sha512` / `rsa-v1_5-sha256` via WebCrypto (no `node:` imports). Secure-by-default verify: a **mandatory `algorithms` allowlist** (no implicit "any alg"), optional per-key alg pinning to defeat algorithm-confusion, a required `created` timestamp with a 300s freshness window, `created`-in-future / `expires` skew rejection, configurable `requiredComponents`, a 32-byte raw-HMAC floor, a 2048-bit RSA modulus floor (NIST SP 800-131A, parity with the JWT verifier), and `nonce` replay defense; the middleware answers a missing/invalid signature with `401` + `Cache-Control: no-store` and stamps the verified result on `ctx.state.httpSignature`. Ships RFC 9530 `contentDigest()` / `verifyContentDigest()` to bind the request body. Zero runtime dependencies.
 - `compression()` built on web-standard `CompressionStream` (prefers `br` > `gzip` > `deflate`), with BREACH-aware always-on guards (skips `Set-Cookie`, `Authorization`, session / CSRF cookies, already-compressed content types), `minimumSize: 1024`, negative-compression-ratio post-check, no configurable `compressLevel` knob (CPU-DoS defense — `level: 9` is refused at construction), always-on `Vary: Accept-Encoding`, and strong → weak ETag downgrade per RFC 9110 §8.8.3.
 - `etag()` helper auto-skips on `Set-Cookie` and private / no-store / no-cache `Cache-Control` (cross-tenant fingerprinting defense).
 - `timing` / `timingSafeEqual` helpers.

package/bin/daloy.mjs

@@ -2,9 +2,11 @@
 /**
  * `daloy` CLI shim. Real logic lives in `dist/cli.js` (`src/cli.ts`).
  *
- * For TypeScript entry files we try to register `tsx` if it's installed
- * in the consumer project; otherwise we surface a friendly error pointing
- * users at `node --import tsx`.
+ * TypeScript entry files are imported directly — Node.js >= 22.18 strips
+ * erasable TypeScript syntax natively. If the native load fails (older
+ * Node, non-erasable syntax such as enums, or extensionless relative
+ * imports) we fall back to registering `tsx` when the consumer project has
+ * it installed; otherwise we surface a friendly error.
  */
 
 import { pathToFileURL, fileURLToPath } from "node:url";
@@ -20,17 +22,33 @@ const PKG = JSON.parse(
 
 const TS_EXT = /\.(ts|tsx|mts|cts)$/i;
 
+/**
+ * Error codes that mean the host Node.js could not load a TypeScript file
+ * natively — the cases where falling back to a transpiling loader (tsx)
+ * can still succeed.
+ */
+const NATIVE_TS_ERROR_CODES = new Set([
+  // Type stripping disabled (--no-strip-types) or Node too old.
+  "ERR_UNKNOWN_FILE_EXTENSION",
+  // Non-erasable syntax: enums, runtime namespaces, parameter properties.
+  "ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX",
+  // Extensionless relative imports that native stripping refuses to resolve.
+  "ERR_MODULE_NOT_FOUND",
+]);
+
 let tsxRegistered = false;
-async function ensureTsxIfNeeded(specifier) {
-  if (!TS_EXT.test(specifier) || tsxRegistered) return;
+async function registerTsxFallback(specifier, cause) {
   try {
     const api = await import("tsx/esm/api");
     api.register();
     tsxRegistered = true;
   } catch {
     throw new Error(
-      `Loading TypeScript entry "${specifier}" requires tsx. Install it ` +
-        `(\`pnpm add -D tsx\`) or run: node --import tsx ./node_modules/.bin/daloy inspect ${specifier}`
+      `Loading TypeScript entry "${specifier}" failed: ${cause?.message ?? cause}\n` +
+        "Node.js runs erasable-only TypeScript natively (>= 22.18). If the entry uses " +
+        "non-erasable syntax (enums, runtime namespaces, parameter properties) or " +
+        "extensionless relative imports, install tsx (`pnpm add -D tsx`) and re-run.",
+      { cause }
     );
   }
 }
@@ -40,8 +58,18 @@ async function importEntry(specifier) {
   if (!existsSync(abs)) {
     throw new Error(`Entry file not found: ${abs}`);
   }
-  await ensureTsxIfNeeded(abs);
-  return import(pathToFileURL(abs).href);
+  const href = pathToFileURL(abs).href;
+  if (!TS_EXT.test(abs) || tsxRegistered) return import(href);
+  try {
+    return await import(href);
+  } catch (err) {
+    if (!NATIVE_TS_ERROR_CODES.has(err?.code)) throw err;
+    await registerTsxFallback(abs, err);
+    // Cache-bust so the retried load resolves through tsx's hooks instead of
+    // the failed native module job. The first attempt failed before
+    // evaluation, so no side effects ran twice.
+    return import(`${href}?daloy-tsx-fallback=1`);
+  }
 }
 
 function spawnDev(command, args) {
@@ -62,7 +90,7 @@ function spawnDev(command, args) {
           new Error(
             `\`${command}\` was not found on PATH. ` +
               (command === "node"
-                ? "Install `tsx` as a dev dependency (`pnpm add -D tsx`) and ensure Node.js is on PATH."
+                ? "Ensure Node.js is on PATH."
                 : `Install ${command} or run daloy dev from the runtime that hosts it.`)
           )
         );

package/dist/app.d.ts

@@ -1107,19 +1107,32 @@ export declare class App<Routes extends readonly RouteDefinition<any, any, any,
     /**
      * First-request boot guard. Verifies that the assembled hook
      * chain + route table is internally consistent before any user handler
-     * runs. Currently checks: when `session()` is installed and any route
-     * accepts a state-changing method (`POST` / `PUT` / `PATCH` / `DELETE`),
-     * a `csrf()` hook (or third-party equivalent stamped with
-     * {@link CSRF_HOOK_MARKER}) must also be present in that route's effective
-     * hook chain. Opt out with `app({ csrf: "off" })` or
-     * `app({ secureDefaults: false })`. Runs once per App between registration
-     * changes; the result is cached so the fast path is a single boolean check.
+     * runs. Currently checks (production + `secureDefaults` only):
+     *
+     * 1. **Shadow auth** — a route that declares an `auth:` requirement (so it is
+     *    advertised as protected in the OpenAPI `security` list) must have an
+     *    authentication hook ({@link AUTH_HOOK_MARKER}) in its effective chain.
+     *    Otherwise it accepts unauthenticated requests while claiming protection.
+     * 2. **Unauthenticated MCP** — a route from {@link mcpRoutes} must have an
+     *    auth hook unless it opted out with `mcpRoutes(path, handler, { public: true })`.
+     *    MCP tools are model-controlled and side-effecting, so a public one is a
+     *    high-impact default.
+     * 3. **Missing CSRF** — when `session()` is installed and any route accepts a
+     *    state-changing method (`POST`/`PUT`/`PATCH`/`DELETE`), a `csrf()` hook
+     *    (or third-party equivalent stamped with {@link CSRF_HOOK_MARKER}) must
+     *    also be present. Skipped when `app({ csrf: "off" })`.
+     *
+     * Opt out of all guards with `app({ secureDefaults: false })`. Runs once per
+     * App between registration changes; the result is cached so the fast path is a
+     * single boolean check.
      */
     private assertBootGuards;
     /**
      * Per-request guard for spoofed proxy headers. When the App was
      * constructed without an explicit {@link AppOptions.trustProxy} value
-     * and a request arrives carrying an `X-Forwarded-*` header, refuse to
+     * and a request arrives carrying a spoofable forwarded / client-IP header
+     * (`X-Forwarded-*`, `X-Real-IP`, or a vendor header like `CF-Connecting-IP`,
+     * `Fly-Client-IP`, `True-Client-IP`), refuse to
      * dispatch it: the rate limiter, audit log, and request-id propagation
      * would otherwise honour the attacker-supplied IP. Returns a structured
      * `500 problem+json` so the failure is loud at the network boundary.

package/dist/app.js

@@ -6,7 +6,7 @@ import { createLogger, noopLogger } from "./logger.js";
 import { generateOpenAPI, openapiToYAML, } from "./openapi.js";
 import { asyncapiHtml, docsContentSecurityPolicy, redocHtml, scalarHtml, swaggerUiHtml, } from "./docs.js";
 import { generateAsyncAPI, asyncapiToYAML, } from "./asyncapi.js";
-import { secureHeaders as secureHeadersMiddleware, CORS_HOOK_MARKER, CORS_ORIGIN_ALLOW_MARKER, CORS_WILDCARD_ORIGIN_MARKER, CSRF_HOOK_MARKER, REQUIRE_SCOPES_AGGREGATE_KEY, REQUIRE_SCOPES_HOOK_MARKER, SECURE_HEADERS_MARKER, } from "./middleware.js";
+import { secureHeaders as secureHeadersMiddleware, AUTH_HOOK_MARKER, CORS_HOOK_MARKER, CORS_ORIGIN_ALLOW_MARKER, CORS_WILDCARD_ORIGIN_MARKER, CSRF_HOOK_MARKER, REQUIRE_SCOPES_AGGREGATE_KEY, REQUIRE_SCOPES_HOOK_MARKER, SECURE_HEADERS_MARKER, } from "./middleware.js";
 import { COMPRESSION_HOOK_MARKER } from "./compression.js";
 import { SESSION_HOOK_MARKER, SESSION_SECRETS_MARKER } from "./session.js";
 import { loadShedding as loadSheddingMiddleware, } from "./load-shedding.js";
@@ -118,6 +118,13 @@ const CANONICAL_HTTP_METHODS = new Set([
     "HEAD",
     "OPTIONS",
 ]);
+/**
+ * Global-registry symbol stamped by `mcpRoutes()` on the route definitions it
+ * produces (unless the caller opts out with `public: true`). Read here — rather
+ * than importing from `mcp.ts` — so the MCP module is never pulled into the core
+ * `App` bundle. Must match the string used in `mcpRoutes`.
+ */
+const MCP_ROUTE_MARKER = Symbol.for("daloyjs.mcp.route");
 /**
  * Apply a topology-aware security preset on top of caller-supplied
  * options. Returns a new options object where preset defaults fill in
@@ -906,13 +913,24 @@ export class App {
     /**
      * First-request boot guard. Verifies that the assembled hook
      * chain + route table is internally consistent before any user handler
-     * runs. Currently checks: when `session()` is installed and any route
-     * accepts a state-changing method (`POST` / `PUT` / `PATCH` / `DELETE`),
-     * a `csrf()` hook (or third-party equivalent stamped with
-     * {@link CSRF_HOOK_MARKER}) must also be present in that route's effective
-     * hook chain. Opt out with `app({ csrf: "off" })` or
-     * `app({ secureDefaults: false })`. Runs once per App between registration
-     * changes; the result is cached so the fast path is a single boolean check.
+     * runs. Currently checks (production + `secureDefaults` only):
+     *
+     * 1. **Shadow auth** — a route that declares an `auth:` requirement (so it is
+     *    advertised as protected in the OpenAPI `security` list) must have an
+     *    authentication hook ({@link AUTH_HOOK_MARKER}) in its effective chain.
+     *    Otherwise it accepts unauthenticated requests while claiming protection.
+     * 2. **Unauthenticated MCP** — a route from {@link mcpRoutes} must have an
+     *    auth hook unless it opted out with `mcpRoutes(path, handler, { public: true })`.
+     *    MCP tools are model-controlled and side-effecting, so a public one is a
+     *    high-impact default.
+     * 3. **Missing CSRF** — when `session()` is installed and any route accepts a
+     *    state-changing method (`POST`/`PUT`/`PATCH`/`DELETE`), a `csrf()` hook
+     *    (or third-party equivalent stamped with {@link CSRF_HOOK_MARKER}) must
+     *    also be present. Skipped when `app({ csrf: "off" })`.
+     *
+     * Opt out of all guards with `app({ secureDefaults: false })`. Runs once per
+     * App between registration changes; the result is cached so the fast path is a
+     * single boolean check.
      */
     assertBootGuards() {
         if (this.bootGuard.checked) {
@@ -923,13 +941,40 @@ export class App {
         this.bootGuard.checked = true;
         if (this.options.secureDefaults === false)
             return;
-        if (this.options.csrf === "off")
-            return;
         // Per the risk register: boot guards only fire in production so CI /
         // staging surfaces that ship sample secrets / no CSRF token while
         // iterating do not pay the refuse-to-boot cost.
         if (!this.isProduction())
             return;
+        // Guard 1: shadow auth — declared `auth:` with nothing enforcing it.
+        const shadowAuth = this.routeSecurityMarkers.find((r) => r.declaresAuth && !r.hasAuth);
+        if (shadowAuth) {
+            const err = new Error(`Route ${shadowAuth.method} ${shadowAuth.path} declares an auth requirement (auth: ...) ` +
+                `but no authentication hook is installed in its effective hook chain, so it is advertised ` +
+                `as protected while accepting unauthenticated requests. ` +
+                `Install an auth middleware (bearerAuth/basicAuth/jwk/httpSignatureAuth/clientCertAuth), ` +
+                `wrap a custom auth hook with markAuthHook(...), remove the route's auth: declaration, ` +
+                `or pass app({ secureDefaults: false }) to disable this guard. ` +
+                `See https://daloyjs.dev/docs/security/boot-guards.`);
+            this.bootGuard.error = err;
+            throw err;
+        }
+        // Guard 2: unauthenticated MCP tool endpoint.
+        const mcpNoAuth = this.routeSecurityMarkers.find((r) => r.isMcp && !r.hasAuth);
+        if (mcpNoAuth) {
+            const err = new Error(`MCP route ${mcpNoAuth.method} ${mcpNoAuth.path} (from mcpRoutes()) has no authentication ` +
+                `hook in its effective hook chain. MCP tools are model-controlled and can trigger side ` +
+                `effects, so an unauthenticated endpoint is a high-impact default. ` +
+                `Install an auth middleware covering the MCP route (e.g. app.use(bearerAuth({ ... }))), ` +
+                `wrap a custom auth hook with markAuthHook(...), pass mcpRoutes(path, handler, { public: true }) ` +
+                `to intentionally expose it, or pass app({ secureDefaults: false }) to disable this guard. ` +
+                `See https://daloyjs.dev/docs/security/boot-guards.`);
+            this.bootGuard.error = err;
+            throw err;
+        }
+        // Guard 3: session() + state-changing route without csrf().
+        if (this.options.csrf === "off")
+            return;
         const stateChanging = this.routeSecurityMarkers.find((r) => isStateChangingMethod(r.method) && r.hasSession && !r.hasCsrf);
         if (!stateChanging)
             return;
@@ -946,7 +991,9 @@ export class App {
     /**
      * Per-request guard for spoofed proxy headers. When the App was
      * constructed without an explicit {@link AppOptions.trustProxy} value
-     * and a request arrives carrying an `X-Forwarded-*` header, refuse to
+     * and a request arrives carrying a spoofable forwarded / client-IP header
+     * (`X-Forwarded-*`, `X-Real-IP`, or a vendor header like `CF-Connecting-IP`,
+     * `Fly-Client-IP`, `True-Client-IP`), refuse to
      * dispatch it: the rate limiter, audit log, and request-id propagation
      * would otherwise honour the attacker-supplied IP. Returns a structured
      * `500 problem+json` so the failure is loud at the network boundary.
@@ -976,6 +1023,13 @@ export class App {
             "x-forwarded-proto",
             "x-forwarded-port",
             "x-real-ip",
+            // Platform-specific client-IP headers are just as spoofable as
+            // X-Forwarded-* when the app is not actually behind that platform's
+            // proxy. Refuse them too so a client cannot forge its source IP via a
+            // vendor header the operator never configured trust for.
+            "cf-connecting-ip",
+            "fly-client-ip",
+            "true-client-ip",
         ]) {
             if (headers.has(name)) {
                 found = name;
@@ -1388,6 +1442,8 @@ export class App {
             method: merged.method,
             path: merged.path,
             ...securityMarkers,
+            declaresAuth: merged.auth !== undefined && merged.auth !== null,
+            isMcp: merged[MCP_ROUTE_MARKER] === true,
         });
         this.resetBootGuardCache();
         return this;
@@ -2887,14 +2943,17 @@ export function topoSortExtensions(exts) {
 function securityMarkersFromHooks(layers) {
     let hasSession = false;
     let hasCsrf = false;
+    let hasAuth = false;
     for (const hooks of layers) {
         const record = hooks;
         if (record[SESSION_HOOK_MARKER] === true)
             hasSession = true;
         if (record[CSRF_HOOK_MARKER] === true)
             hasCsrf = true;
+        if (record[AUTH_HOOK_MARKER] === true)
+            hasAuth = true;
     }
-    return { hasSession, hasCsrf };
+    return { hasSession, hasCsrf, hasAuth };
 }
 function isStateChangingMethod(method) {
     return method === "POST" || method === "PUT" || method === "PATCH" || method === "DELETE";

package/dist/cli.d.ts

@@ -130,8 +130,11 @@ export declare function normalizeEntryArg(entry: string): string;
  * runtime and entry file. Pure function so tests can assert exact argv
  * without spawning a child process.
  *
- * - Node: `node --import tsx --watch <entry>` (tsx must be installed as a
- *   dev dependency for TS files; .js entries also work).
+ * - Node: `node --watch <entry>` (Node >= 22.18 strips TypeScript types
+ *   natively, so `.ts` entries with erasable-only syntax run without a
+ *   loader; `.js` entries also work. Projects that need non-erasable
+ *   syntax — enums, runtime namespaces, parameter properties — should
+ *   transpile or add a loader such as tsx themselves).
  * - Bun:  `bun --hot <entry>` (Bun ships with TS support).
  * - Deno: `deno run --watch --allow-net --allow-env --allow-read <entry>`
  *   (the three permissions cover serving HTTP, reading env vars, and

package/dist/cli.js

@@ -22,8 +22,9 @@ Usage:
 Commands:
   inspect [entry]        Load an App and print its routes (default command).
   dev     [entry]        Start the entry file with the host runtime's
-                         native watch mode (tsx --watch on Node, --hot on
-                         Bun, --watch on Deno).
+                         native watch mode (node --watch on Node, --hot on
+                         Bun, --watch on Deno). Node runs TypeScript
+                         entries via its built-in type stripping.
   doctor  [entry]        Audit a loaded App's secure-by-default posture.
                          Exits non-zero on any violation so the
                          command can guard container HEALTHCHECK and CI
@@ -186,8 +187,11 @@ export function normalizeEntryArg(entry) {
  * runtime and entry file. Pure function so tests can assert exact argv
  * without spawning a child process.
  *
- * - Node: `node --import tsx --watch <entry>` (tsx must be installed as a
- *   dev dependency for TS files; .js entries also work).
+ * - Node: `node --watch <entry>` (Node >= 22.18 strips TypeScript types
+ *   natively, so `.ts` entries with erasable-only syntax run without a
+ *   loader; `.js` entries also work. Projects that need non-erasable
+ *   syntax — enums, runtime namespaces, parameter properties — should
+ *   transpile or add a loader such as tsx themselves).
  * - Bun:  `bun --hot <entry>` (Bun ships with TS support).
  * - Deno: `deno run --watch --allow-net --allow-env --allow-read <entry>`
  *   (the three permissions cover serving HTTP, reading env vars, and
@@ -219,7 +223,7 @@ export function buildDevCommand(runtime, entry) {
             };
         case "node":
         default:
-            return { command: "node", args: ["--import", "tsx", "--watch", safe] };
+            return { command: "node", args: ["--watch", safe] };
     }
 }
 /**

package/dist/http-signatures.js

@@ -48,6 +48,14 @@ export const DEFAULT_SIGNATURE_CLOCK_SKEW_SECONDS = 60;
 const MAX_HEADER_LENGTH = 8192;
 /** Minimum byte length for a raw HMAC secret (RFC 7518 §3.2). */
 const MIN_HMAC_KEY_BYTES = 32;
+/**
+ * Minimum RSA modulus size accepted for `rsa-*` signature algorithms. NIST
+ * SP 800-131A has disallowed RSA keys shorter than 2048 bits since 2014; the
+ * JWT verifier ({@link file://./jwt.ts}) enforces the same floor, so the HTTP
+ * Message Signatures path holds the parity to keep undersized (crackable) RSA
+ * keys out of every signature-verification surface in the framework.
+ */
+const MIN_RSA_KEY_BITS = 2048;
 const ENC = new TextEncoder();
 // ---------------------------------------------------------------------------
 // WebCrypto + encoding helpers
@@ -132,11 +140,37 @@ function algSpec(alg) {
             };
     }
 }
+/**
+ * Refuse RSA keys whose modulus is shorter than {@link MIN_RSA_KEY_BITS}.
+ *
+ * Only applies to the `rsa-*` algorithms — non-RSA keys are ignored. Every RSA
+ * `CryptoKey` carries a numeric `algorithm.modulusLength`; when WebCrypto
+ * reports a length below the floor the key is refused for both signing and
+ * verification. Mirrors the JWT verifier's `assertRsaModulusFloor` so no
+ * signature surface in the framework accepts an undersized RSA key.
+ *
+ * @param alg - The HTTP signature algorithm the key will be used with.
+ * @param key - The imported (or caller-supplied) `CryptoKey`.
+ * @throws {TypeError} When `alg` is RSA and the modulus is under the floor.
+ */
+function assertRsaModulusFloor(alg, key) {
+    if (alg !== "rsa-pss-sha512" && alg !== "rsa-v1_5-sha256")
+        return;
+    const algorithm = key.algorithm;
+    const modulusLength = algorithm?.modulusLength;
+    if (typeof modulusLength !== "number" || !Number.isFinite(modulusLength))
+        return;
+    if (modulusLength < MIN_RSA_KEY_BITS) {
+        throw new TypeError(`http-signatures: ${alg} key modulus must be at least ${MIN_RSA_KEY_BITS} bits (NIST SP 800-131A); got ${modulusLength}.`);
+    }
+}
 async function importKey(alg, material, usage) {
     const spec = algSpec(alg);
     const c = getCrypto();
-    if (isCryptoKey(material))
+    if (isCryptoKey(material)) {
+        assertRsaModulusFloor(alg, material);
         return material;
+    }
     if (material instanceof Uint8Array) {
         if (!spec.symmetric) {
             throw new TypeError(`http-signatures: raw byte keys are only supported for hmac-sha256; got ${alg}.`);
@@ -147,9 +181,11 @@ async function importKey(alg, material, usage) {
         return c.subtle.importKey("raw", material, spec.importParams, false, [usage]);
     }
     if (isJsonWebKey(material)) {
-        return c.subtle.importKey("jwk", material, spec.importParams, false, [
+        const key = await c.subtle.importKey("jwk", material, spec.importParams, false, [
             usage,
         ]);
+        assertRsaModulusFloor(alg, key);
+        return key;
     }
     throw new TypeError("http-signatures: unsupported key material.");
 }
@@ -731,7 +767,7 @@ export function verifyRequest(request, opts) {
 export function httpSignatureAuth(opts) {
     const stateKey = opts.stateKey ?? "httpSignature";
     const message = opts.message ?? "Valid HTTP message signature required";
-    return {
+    const authHooks = {
         async beforeHandle(ctx) {
             const headers = ctx.request.headers;
             if (opts.optional && !headers.has("signature"))
@@ -744,6 +780,11 @@ export function httpSignatureAuth(opts) {
             return undefined;
         },
     };
+    // Same global symbol as middleware's AUTH_HOOK_MARKER (stamped inline to keep
+    // the middleware module out of this bundle): lets the route-auth boot guard
+    // recognize that a route declaring `auth:` is actually enforced here.
+    authHooks[Symbol.for("daloyjs.auth.hook")] = true;
+    return authHooks;
 }
 const CONTENT_DIGEST_HASH = {
     "sha-256": "SHA-256",

package/dist/index.d.ts

@@ -19,11 +19,11 @@ export type { StandardSchemaV1 } from "./schema.js";
 export { validate, isStandardSchema } from "./schema.js";
 export { diffOpenAPI, hasBreakingChanges } from "./openapi-diff.js";
 export type { ChangeSeverity, OpenAPIChange, OpenAPIDiffResult } from "./openapi-diff.js";
-export { MCP_DEFAULT_MAX_BODY_BYTES, MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSIONS, McpToolError, createMcpHandler, mcpRoutes, } from "./mcp.js";
-export type { McpContent, McpEmbeddedResourceContent, McpHandler, McpHandlerOptions, McpIcon, McpImageContent, McpJsonObject, McpJsonRpcId, McpJsonSchema, McpJsonValue, McpPrompt, McpPromptArgument, McpPromptDefinition, McpPromptMessage, McpPromptResult, McpRequestContext, McpResource, McpResourceContents, McpResourceDefinition, McpResourceTemplate, McpResourceTemplateDefinition, McpServerInfo, McpTextContent, McpTool, McpToolAnnotations, McpToolHandler, McpToolResult, } from "./mcp.js";
+export { MCP_DEFAULT_MAX_BODY_BYTES, MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSIONS, McpToolError, createMcpHandler, mcpRoutes, validateMcpInput, } from "./mcp.js";
+export type { McpContent, McpEmbeddedResourceContent, McpHandler, McpHandlerOptions, McpIcon, McpImageContent, McpJsonObject, McpJsonRpcId, McpJsonSchema, McpJsonValue, McpPrompt, McpPromptArgument, McpPromptDefinition, McpPromptMessage, McpPromptResult, McpRequestContext, McpResource, McpResourceContents, McpResourceDefinition, McpResourceTemplate, McpResourceTemplateDefinition, McpRoutesOptions, McpServerInfo, McpTextContent, McpTool, McpToolAnnotations, McpToolHandler, McpToolResult, } from "./mcp.js";
 export { readBodyLimited, safeJsonParse, isForbiddenObjectKey, sanitizeHeaderName, sanitizeHeaderValue, timingSafeEqual, randomId, assertNoDuplicateSingletonHeaders, assertNoReservedInternalHeaders, assertHeaderCountWithinLimit, DEFAULT_MAX_HEADER_COUNT, RESERVED_INBOUND_HEADER_PREFIXES, SMUGGLING_SINGLETON_HEADERS, verifyWebhookSignature, signWebhookPayload, WEBHOOK_DEFAULT_TOLERANCE_SECONDS, assertStrongSecret, MIN_PROD_SECRET_BYTES, WEAK_SECRET_STRINGS, sanitizeFilename, assertSafeRelativePath, hasMongoOperatorKeys, assertNoMongoOperators, } from "./security.js";
 export type { WebhookHmacAlgorithm } from "./security.js";
-export { requestId, secureHeaders, SECURE_HEADERS_MARKER, cors, CORS_HOOK_MARKER, CORS_ORIGIN_ALLOW_MARKER, CORS_WILDCARD_ORIGIN_MARKER, rateLimit, loginThrottle, timing, bearerAuth, basicAuth, csrf, CSRF_HOOK_MARKER, fetchMetadata, requireScopes, REQUIRE_SCOPES_AGGREGATE_KEY, REQUIRE_SCOPES_HOOK_MARKER, _resetSharedRateLimitStoresForTests, } from "./middleware.js";
+export { requestId, secureHeaders, SECURE_HEADERS_MARKER, cors, CORS_HOOK_MARKER, CORS_ORIGIN_ALLOW_MARKER, CORS_WILDCARD_ORIGIN_MARKER, rateLimit, loginThrottle, timing, bearerAuth, basicAuth, markAuthHook, AUTH_HOOK_MARKER, csrf, CSRF_HOOK_MARKER, fetchMetadata, requireScopes, REQUIRE_SCOPES_AGGREGATE_KEY, REQUIRE_SCOPES_HOOK_MARKER, _resetSharedRateLimitStoresForTests, } from "./middleware.js";
 export { etag } from "./etag.js";
 export type { ETagOptions } from "./etag.js";
 export { compression, COMPRESSION_HOOK_MARKER, _resetCompressionRuntimeProbeForTests, } from "./compression.js";

package/dist/index.js

@@ -11,9 +11,9 @@ export { defineDependency, DEPENDENCY_MARKER } from "./dependency.js";
 export { HttpError, BadRequestError, ValidationError, NotFoundError, ConflictError, UnauthorizedError, ForbiddenError, MethodNotAllowedError, PayloadTooLargeError, RequestHeaderFieldsTooLargeError, UnsupportedMediaTypeError, TooManyRequestsError, RequestTimeoutError, InternalError, MessageLeakError, httpError, SAFE_CUSTOM_ERROR_RESPONSE_HEADERS, checkCustomErrorResponseHeaders, } from "./errors.js";
 export { validate, isStandardSchema } from "./schema.js";
 export { diffOpenAPI, hasBreakingChanges } from "./openapi-diff.js";
-export { MCP_DEFAULT_MAX_BODY_BYTES, MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSIONS, McpToolError, createMcpHandler, mcpRoutes, } from "./mcp.js";
+export { MCP_DEFAULT_MAX_BODY_BYTES, MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSIONS, McpToolError, createMcpHandler, mcpRoutes, validateMcpInput, } from "./mcp.js";
 export { readBodyLimited, safeJsonParse, isForbiddenObjectKey, sanitizeHeaderName, sanitizeHeaderValue, timingSafeEqual, randomId, assertNoDuplicateSingletonHeaders, assertNoReservedInternalHeaders, assertHeaderCountWithinLimit, DEFAULT_MAX_HEADER_COUNT, RESERVED_INBOUND_HEADER_PREFIXES, SMUGGLING_SINGLETON_HEADERS, verifyWebhookSignature, signWebhookPayload, WEBHOOK_DEFAULT_TOLERANCE_SECONDS, assertStrongSecret, MIN_PROD_SECRET_BYTES, WEAK_SECRET_STRINGS, sanitizeFilename, assertSafeRelativePath, hasMongoOperatorKeys, assertNoMongoOperators, } from "./security.js";
-export { requestId, secureHeaders, SECURE_HEADERS_MARKER, cors, CORS_HOOK_MARKER, CORS_ORIGIN_ALLOW_MARKER, CORS_WILDCARD_ORIGIN_MARKER, rateLimit, loginThrottle, timing, bearerAuth, basicAuth, csrf, CSRF_HOOK_MARKER, fetchMetadata, requireScopes, REQUIRE_SCOPES_AGGREGATE_KEY, REQUIRE_SCOPES_HOOK_MARKER, _resetSharedRateLimitStoresForTests, } from "./middleware.js";
+export { requestId, secureHeaders, SECURE_HEADERS_MARKER, cors, CORS_HOOK_MARKER, CORS_ORIGIN_ALLOW_MARKER, CORS_WILDCARD_ORIGIN_MARKER, rateLimit, loginThrottle, timing, bearerAuth, basicAuth, markAuthHook, AUTH_HOOK_MARKER, csrf, CSRF_HOOK_MARKER, fetchMetadata, requireScopes, REQUIRE_SCOPES_AGGREGATE_KEY, REQUIRE_SCOPES_HOOK_MARKER, _resetSharedRateLimitStoresForTests, } from "./middleware.js";
 export { etag } from "./etag.js";
 export { compression, COMPRESSION_HOOK_MARKER, _resetCompressionRuntimeProbeForTests, } from "./compression.js";
 export { createJwtSigner, createJwtVerifier, JwtError, DEFAULT_JWT_MAX_LIFETIME_SECONDS, } from "./jwt.js";

package/dist/ip-reputation.d.ts

@@ -160,8 +160,12 @@ export interface UrlFeedOptions {
     /** Feed name. Defaults to the URL. */
     name?: string;
     /**
-     * Custom `fetch` implementation. Defaults to the platform `fetch`. Provide an
-     * SSRF-guarded fetch or a non-standard-runtime client here.
+     * Custom `fetch` implementation. Defaults to an SSRF-hardened
+     * {@link fetchGuard} instance so a compromised or malicious feed host cannot
+     * redirect the request into internal/link-local space (cloud metadata, etc.).
+     * Override with your own client for a non-standard runtime, or with
+     * `fetchGuard({ allowPrivate: true })` for an intentionally internal feed
+     * mirror.
      */
     fetchImpl?: typeof fetch;
     /** Extra request headers (e.g. an API token for a commercial feed). */
@@ -174,6 +178,8 @@ export interface UrlFeedOptions {
  * are skipped by {@link ipReputation}, so a partially-malformed feed still loads
  * its good entries.
  *
+ * The outbound fetch is SSRF-hardened by default (see {@link UrlFeedOptions.fetchImpl}).
+ *
  * @param url - The feed URL.
  * @param opts - Optional feed name, custom `fetch`, and request headers.
  * @returns A feed ready to pass to {@link IpReputationOptions.feeds}.

package/dist/ip-reputation.js

@@ -45,6 +45,7 @@
  * @since 0.37.0
  */
 import { ForbiddenError } from "./errors.js";
+import { fetchGuard } from "./fetch-guard.js";
 import { compileCidrMatcher, matchesMatcher, parseIp, } from "./ip-restriction.js";
 const DEFAULT_REFRESH_MS = 60 * 60_000;
 const DEFAULT_FETCH_TIMEOUT_MS = 30_000;
@@ -74,6 +75,8 @@ function parseFeedLine(line) {
  * are skipped by {@link ipReputation}, so a partially-malformed feed still loads
  * its good entries.
  *
+ * The outbound fetch is SSRF-hardened by default (see {@link UrlFeedOptions.fetchImpl}).
+ *
  * @param url - The feed URL.
  * @param opts - Optional feed name, custom `fetch`, and request headers.
  * @returns A feed ready to pass to {@link IpReputationOptions.feeds}.
@@ -81,7 +84,10 @@ function parseFeedLine(line) {
  */
 export function urlFeed(url, opts = {}) {
     const name = opts.name ?? url;
-    const doFetch = opts.fetchImpl ?? globalThis.fetch;
+    // Secure-by-default: route the outbound feed fetch through fetchGuard() so
+    // redirects are re-validated per hop and internal/metadata targets are
+    // refused, matching createWebhookSender's posture. Callers can override.
+    const doFetch = opts.fetchImpl ?? fetchGuard();
     return {
         name,
         async fetch(signal) {