@daloyjs/core 1.0.0-rc.1 → 1.0.0-rc.2

package/README.md

@@ -211,7 +211,7 @@ That single command runs the two scripts:
 ```jsonc
 // package.json
 "scripts": {
-  "gen:openapi": "node --import tsx scripts/dump-openapi.ts",
+  "gen:openapi": "node scripts/dump-openapi.ts",
   "gen:client":  "openapi-ts",
   "gen":         "pnpm gen:openapi && pnpm gen:client"
 }
@@ -339,11 +339,11 @@ const app = createApp({ docs: true });
 
 | Runtime | Spawned command                                                 |
 | ------- | --------------------------------------------------------------- |
-| Node    | `node --import tsx --watch <entry>`                             |
+| Node    | `node --watch <entry>`                                          |
 | Bun     | `bun --hot <entry>`                                             |
 | Deno    | `deno run --watch --allow-net --allow-env --allow-read <entry>` |
 
-Entry defaults to `src/index.ts`, `src/main.ts`, `src/server.ts`, or `src/app.ts`. Install `tsx` as a dev dependency on Node for TypeScript entries.
+Entry defaults to `src/index.ts`, `src/main.ts`, `src/server.ts`, or `src/app.ts`. Node.js (>= 22.18) runs TypeScript entries natively via built-in type stripping — no loader needed. Projects that rely on non-erasable syntax (enums, runtime namespaces, parameter properties) or extensionless relative imports can keep using a loader directly, e.g. `node --import tsx --watch <entry>` (and `daloy inspect` falls back to `tsx` automatically when the native load fails and `tsx` is installed).
 
 Pass `--runtime <node|bun|deno>` to override runtime detection. This is required when running `daloy dev` from a `package.json` script on Bun or Deno, because the CLI binary's `#!/usr/bin/env node` shebang otherwise forces Node detection. The `bun-basic` template ships `"dev": "daloy dev --runtime bun"` for this reason.
 
@@ -509,7 +509,7 @@ The core only ever sees `Request → Response`. Adapters live at the edge.
 
 ## Status
 
-DaloyJS is at **`1.0.0-rc.1`**, a security-hardening release candidate. Because the framework has no external users yet, this RC ships a few intentional breaking changes (see the [CHANGELOG](CHANGELOG.md)) to get the secure-by-default posture right before GA rather than deferring them; the generated OpenAPI contract is unchanged. From `1.0.0` GA onward, breaking changes follow SemVer with deprecations getting at least one minor cycle. The framework is already in use for production trials.
+DaloyJS is at **`1.0.0-rc.2`**, a security-hardening release candidate. Because the framework has no external users yet, this RC ships a few intentional breaking changes (see the [CHANGELOG](CHANGELOG.md)) to get the secure-by-default posture right before GA rather than deferring them; the generated OpenAPI contract is unchanged. From `1.0.0` GA onward, breaking changes follow SemVer with deprecations getting at least one minor cycle. The framework is already in use for production trials.
 
 **Release quality bar.** Every release ships with **≥90% line + function coverage and ≥90% branch coverage**, strict TypeScript, OpenSSF Scorecard, CodeQL + Opengrep dual SAST, zizmor workflow linting, and npm provenance. Coverage was relaxed from a former 100% gate so complex security work isn't blocked chasing throwaway tests for unreachable defensive branches or tsx source-map phantoms; see [AGENTS.md](AGENTS.md) for the policy.
 
@@ -527,7 +527,7 @@ DaloyJS is at **`1.0.0-rc.1`**, a security-hardening release candidate. Because
 ### Runtimes and deployment
 
 - Adapters for Node (Heroku, Railway, Render, Fly.io), Bun, Deno, Cloudflare Workers, Vercel Node / Edge / Next.js / Netlify Edge, Fastly Compute, and AWS Lambda / Netlify Functions / Lambda Function URLs.
-- `daloy dev` watch loop delegates to the host runtime's native watcher (`node --import tsx --watch`, `bun --hot`, or `deno run --watch`) with a `--runtime` override for cross-runtime `package.json` scripts.
+- `daloy dev` watch loop delegates to the host runtime's native watcher (`node --watch`, `bun --hot`, or `deno run --watch`) with a `--runtime` override for cross-runtime `package.json` scripts.
 - `pnpm create daloy` scaffolder with Node, Bun, Deno, Cloudflare Worker, and Vercel templates, plus optional `--with-ci` GitHub Actions / Dependabot / CODEOWNERS / SECURITY.md hardening. The completion summary surfaces official install links (nodejs.org, pnpm.io, bun.sh) for any runtime or package manager your selections need but that is missing from `PATH`, and skips a doomed dependency install when the chosen package manager is absent.
 - Container-first templates: `HEALTHCHECK` to `/readyz`, `STOPSIGNAL SIGTERM`, non-root user, `tini` as PID 1.
 - Generated `deploy.yml` for container templates signs every pushed GHCR image with **Sigstore Cosign** (keyless OIDC) and attaches an **SPDX SBOM attestation** so consumers can `cosign verify` and `cosign verify-attestation --type spdxjson` instead of trusting the registry alone.

package/bin/daloy.mjs

@@ -2,9 +2,11 @@
 /**
  * `daloy` CLI shim. Real logic lives in `dist/cli.js` (`src/cli.ts`).
  *
- * For TypeScript entry files we try to register `tsx` if it's installed
- * in the consumer project; otherwise we surface a friendly error pointing
- * users at `node --import tsx`.
+ * TypeScript entry files are imported directly — Node.js >= 22.18 strips
+ * erasable TypeScript syntax natively. If the native load fails (older
+ * Node, non-erasable syntax such as enums, or extensionless relative
+ * imports) we fall back to registering `tsx` when the consumer project has
+ * it installed; otherwise we surface a friendly error.
  */
 
 import { pathToFileURL, fileURLToPath } from "node:url";
@@ -20,17 +22,33 @@ const PKG = JSON.parse(
 
 const TS_EXT = /\.(ts|tsx|mts|cts)$/i;
 
+/**
+ * Error codes that mean the host Node.js could not load a TypeScript file
+ * natively — the cases where falling back to a transpiling loader (tsx)
+ * can still succeed.
+ */
+const NATIVE_TS_ERROR_CODES = new Set([
+  // Type stripping disabled (--no-strip-types) or Node too old.
+  "ERR_UNKNOWN_FILE_EXTENSION",
+  // Non-erasable syntax: enums, runtime namespaces, parameter properties.
+  "ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX",
+  // Extensionless relative imports that native stripping refuses to resolve.
+  "ERR_MODULE_NOT_FOUND",
+]);
+
 let tsxRegistered = false;
-async function ensureTsxIfNeeded(specifier) {
-  if (!TS_EXT.test(specifier) || tsxRegistered) return;
+async function registerTsxFallback(specifier, cause) {
   try {
     const api = await import("tsx/esm/api");
     api.register();
     tsxRegistered = true;
   } catch {
     throw new Error(
-      `Loading TypeScript entry "${specifier}" requires tsx. Install it ` +
-        `(\`pnpm add -D tsx\`) or run: node --import tsx ./node_modules/.bin/daloy inspect ${specifier}`
+      `Loading TypeScript entry "${specifier}" failed: ${cause?.message ?? cause}\n` +
+        "Node.js runs erasable-only TypeScript natively (>= 22.18). If the entry uses " +
+        "non-erasable syntax (enums, runtime namespaces, parameter properties) or " +
+        "extensionless relative imports, install tsx (`pnpm add -D tsx`) and re-run.",
+      { cause }
     );
   }
 }
@@ -40,8 +58,18 @@ async function importEntry(specifier) {
   if (!existsSync(abs)) {
     throw new Error(`Entry file not found: ${abs}`);
   }
-  await ensureTsxIfNeeded(abs);
-  return import(pathToFileURL(abs).href);
+  const href = pathToFileURL(abs).href;
+  if (!TS_EXT.test(abs) || tsxRegistered) return import(href);
+  try {
+    return await import(href);
+  } catch (err) {
+    if (!NATIVE_TS_ERROR_CODES.has(err?.code)) throw err;
+    await registerTsxFallback(abs, err);
+    // Cache-bust so the retried load resolves through tsx's hooks instead of
+    // the failed native module job. The first attempt failed before
+    // evaluation, so no side effects ran twice.
+    return import(`${href}?daloy-tsx-fallback=1`);
+  }
 }
 
 function spawnDev(command, args) {
@@ -62,7 +90,7 @@ function spawnDev(command, args) {
           new Error(
             `\`${command}\` was not found on PATH. ` +
               (command === "node"
-                ? "Install `tsx` as a dev dependency (`pnpm add -D tsx`) and ensure Node.js is on PATH."
+                ? "Ensure Node.js is on PATH."
                 : `Install ${command} or run daloy dev from the runtime that hosts it.`)
           )
         );

package/dist/cli.d.ts

@@ -130,8 +130,11 @@ export declare function normalizeEntryArg(entry: string): string;
  * runtime and entry file. Pure function so tests can assert exact argv
  * without spawning a child process.
  *
- * - Node: `node --import tsx --watch <entry>` (tsx must be installed as a
- *   dev dependency for TS files; .js entries also work).
+ * - Node: `node --watch <entry>` (Node >= 22.18 strips TypeScript types
+ *   natively, so `.ts` entries with erasable-only syntax run without a
+ *   loader; `.js` entries also work. Projects that need non-erasable
+ *   syntax — enums, runtime namespaces, parameter properties — should
+ *   transpile or add a loader such as tsx themselves).
  * - Bun:  `bun --hot <entry>` (Bun ships with TS support).
  * - Deno: `deno run --watch --allow-net --allow-env --allow-read <entry>`
  *   (the three permissions cover serving HTTP, reading env vars, and

package/dist/cli.js

@@ -22,8 +22,9 @@ Usage:
 Commands:
   inspect [entry]        Load an App and print its routes (default command).
   dev     [entry]        Start the entry file with the host runtime's
-                         native watch mode (tsx --watch on Node, --hot on
-                         Bun, --watch on Deno).
+                         native watch mode (node --watch on Node, --hot on
+                         Bun, --watch on Deno). Node runs TypeScript
+                         entries via its built-in type stripping.
   doctor  [entry]        Audit a loaded App's secure-by-default posture.
                          Exits non-zero on any violation so the
                          command can guard container HEALTHCHECK and CI
@@ -186,8 +187,11 @@ export function normalizeEntryArg(entry) {
  * runtime and entry file. Pure function so tests can assert exact argv
  * without spawning a child process.
  *
- * - Node: `node --import tsx --watch <entry>` (tsx must be installed as a
- *   dev dependency for TS files; .js entries also work).
+ * - Node: `node --watch <entry>` (Node >= 22.18 strips TypeScript types
+ *   natively, so `.ts` entries with erasable-only syntax run without a
+ *   loader; `.js` entries also work. Projects that need non-erasable
+ *   syntax — enums, runtime namespaces, parameter properties — should
+ *   transpile or add a loader such as tsx themselves).
  * - Bun:  `bun --hot <entry>` (Bun ships with TS support).
  * - Deno: `deno run --watch --allow-net --allow-env --allow-read <entry>`
  *   (the three permissions cover serving HTTP, reading env vars, and
@@ -219,7 +223,7 @@ export function buildDevCommand(runtime, entry) {
             };
         case "node":
         default:
-            return { command: "node", args: ["--import", "tsx", "--watch", safe] };
+            return { command: "node", args: ["--watch", safe] };
     }
 }
 /**

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:63bae5ad-16c4-5db2-9929-3188903cb4f9",
+  "serialNumber": "urn:uuid:8448de36-3a72-553d-882f-b5b36bbd1426",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-04T14:31:15.314Z",
+    "timestamp": "2026-07-07T09:24:36.816Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "1.0.0-rc.1"
+        "version": "1.0.0-rc.2"
       }
     ],
     "authors": [
@@ -19,11 +19,11 @@
     ],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/@daloyjs/core@1.0.0-rc.1",
+      "bom-ref": "pkg:npm/@daloyjs/core@1.0.0-rc.2",
       "name": "@daloyjs/core",
-      "version": "1.0.0-rc.1",
+      "version": "1.0.0-rc.2",
       "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
-      "purl": "pkg:npm/@daloyjs/core@1.0.0-rc.1",
+      "purl": "pkg:npm/@daloyjs/core@1.0.0-rc.2",
       "licenses": [
         {
           "license": {
@@ -46,9 +46,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag--daloyjs-core-1.0.0-rc.1",
+        "tagId": "swidtag--daloyjs-core-1.0.0-rc.2",
         "name": "@daloyjs/core",
-        "version": "1.0.0-rc.1",
+        "version": "1.0.0-rc.2",
         "tagVersion": 0,
         "patch": false
       }
@@ -57,7 +57,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/@daloyjs/core@1.0.0-rc.1",
+      "ref": "pkg:npm/@daloyjs/core@1.0.0-rc.2",
       "dependsOn": []
     }
   ]

package/dist/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@daloyjs/core-1.0.0-rc.1",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.0.0-rc.1-63bae5ad-16c4-5db2-9929-3188903cb4f9",
+  "name": "@daloyjs/core-1.0.0-rc.2",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.0.0-rc.2-8448de36-3a72-553d-882f-b5b36bbd1426",
   "creationInfo": {
-    "created": "2026-07-04T14:31:15.314Z",
+    "created": "2026-07-07T09:24:36.816Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package--daloyjs-core",
       "name": "@daloyjs/core",
-      "versionInfo": "1.0.0-rc.1",
+      "versionInfo": "1.0.0-rc.2",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/@daloyjs/core@1.0.0-rc.1"
+          "referenceLocator": "pkg:npm/@daloyjs/core@1.0.0-rc.2"
         }
       ]
     }

package/dist/types.d.ts

@@ -199,7 +199,10 @@ export interface AuthSpec {
  *
  * @example
  * ```ts
- * // src/types.d.ts
+ * // Put this in a regular module the compiler always checks (e.g. the
+ * // plugin file that calls `app.decorate(...)`). Avoid a separate .d.ts:
+ * // `skipLibCheck` skips declaration files, so a broken import there
+ * // silently types the state value as `any`.
  * declare module "@daloyjs/core" {
  *   interface AppState {
  *     user: { id: string; roles: string[] };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daloyjs/core",
-  "version": "1.0.0-rc.1",
+  "version": "1.0.0-rc.2",
   "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
   "type": "module",
   "publishConfig": {