@daloyjs/core 1.0.0-rc.1 → 1.0.0-rc.3

package/README.md

@@ -28,6 +28,12 @@ Disclosure](https://img.shields.io/badge/Security-Responsible%20Disclosure-yello
 
 DaloyJS is maintained in the GitHub organization at <https://github.com/daloyjs>; the canonical framework repository is <https://github.com/daloyjs/daloy>.
 
+## Partners
+
+<a href="https://snyk.io">
+  <img src="https://github.com/user-attachments/assets/da58db43-67cc-45d4-ade5-bdaa7b041465" alt="Snyk's Secure Developer Program" width="160">
+</a>
+
 ---
 
 ## Built for the vibe-coding era
@@ -211,7 +217,7 @@ That single command runs the two scripts:
 ```jsonc
 // package.json
 "scripts": {
-  "gen:openapi": "node --import tsx scripts/dump-openapi.ts",
+  "gen:openapi": "node scripts/dump-openapi.ts",
   "gen:client":  "openapi-ts",
   "gen":         "pnpm gen:openapi && pnpm gen:client"
 }
@@ -339,11 +345,11 @@ const app = createApp({ docs: true });
 
 | Runtime | Spawned command                                                 |
 | ------- | --------------------------------------------------------------- |
-| Node    | `node --import tsx --watch <entry>`                             |
+| Node    | `node --watch <entry>`                                          |
 | Bun     | `bun --hot <entry>`                                             |
 | Deno    | `deno run --watch --allow-net --allow-env --allow-read <entry>` |
 
-Entry defaults to `src/index.ts`, `src/main.ts`, `src/server.ts`, or `src/app.ts`. Install `tsx` as a dev dependency on Node for TypeScript entries.
+Entry defaults to `src/index.ts`, `src/main.ts`, `src/server.ts`, or `src/app.ts`. Node.js (>= 22.18) runs TypeScript entries natively via built-in type stripping — no loader needed. Projects that rely on non-erasable syntax (enums, runtime namespaces, parameter properties) or extensionless relative imports can keep using a loader directly, e.g. `node --import tsx --watch <entry>` (and `daloy inspect` falls back to `tsx` automatically when the native load fails and `tsx` is installed).
 
 Pass `--runtime <node|bun|deno>` to override runtime detection. This is required when running `daloy dev` from a `package.json` script on Bun or Deno, because the CLI binary's `#!/usr/bin/env node` shebang otherwise forces Node detection. The `bun-basic` template ships `"dev": "daloy dev --runtime bun"` for this reason.
 
@@ -509,7 +515,7 @@ The core only ever sees `Request → Response`. Adapters live at the edge.
 
 ## Status
 
-DaloyJS is at **`1.0.0-rc.1`**, a security-hardening release candidate. Because the framework has no external users yet, this RC ships a few intentional breaking changes (see the [CHANGELOG](CHANGELOG.md)) to get the secure-by-default posture right before GA rather than deferring them; the generated OpenAPI contract is unchanged. From `1.0.0` GA onward, breaking changes follow SemVer with deprecations getting at least one minor cycle. The framework is already in use for production trials.
+DaloyJS is at **`1.0.0-rc.3`**, a security-hardening release candidate. Because the framework has no external users yet, this RC makes a few intentional changes (see the [CHANGELOG](CHANGELOG.md)) to get the secure-by-default posture right before GA rather than deferring them; the generated OpenAPI contract is unchanged. From `1.0.0` GA onward, the API follows SemVer with deprecations getting at least one minor cycle. The framework is already in use for production trials.
 
 **Release quality bar.** Every release ships with **≥90% line + function coverage and ≥90% branch coverage**, strict TypeScript, OpenSSF Scorecard, CodeQL + Opengrep dual SAST, zizmor workflow linting, and npm provenance. Coverage was relaxed from a former 100% gate so complex security work isn't blocked chasing throwaway tests for unreachable defensive branches or tsx source-map phantoms; see [AGENTS.md](AGENTS.md) for the policy.
 
@@ -527,7 +533,7 @@ DaloyJS is at **`1.0.0-rc.1`**, a security-hardening release candidate. Because
 ### Runtimes and deployment
 
 - Adapters for Node (Heroku, Railway, Render, Fly.io), Bun, Deno, Cloudflare Workers, Vercel Node / Edge / Next.js / Netlify Edge, Fastly Compute, and AWS Lambda / Netlify Functions / Lambda Function URLs.
-- `daloy dev` watch loop delegates to the host runtime's native watcher (`node --import tsx --watch`, `bun --hot`, or `deno run --watch`) with a `--runtime` override for cross-runtime `package.json` scripts.
+- `daloy dev` watch loop delegates to the host runtime's native watcher (`node --watch`, `bun --hot`, or `deno run --watch`) with a `--runtime` override for cross-runtime `package.json` scripts.
 - `pnpm create daloy` scaffolder with Node, Bun, Deno, Cloudflare Worker, and Vercel templates, plus optional `--with-ci` GitHub Actions / Dependabot / CODEOWNERS / SECURITY.md hardening. The completion summary surfaces official install links (nodejs.org, pnpm.io, bun.sh) for any runtime or package manager your selections need but that is missing from `PATH`, and skips a doomed dependency install when the chosen package manager is absent.
 - Container-first templates: `HEALTHCHECK` to `/readyz`, `STOPSIGNAL SIGTERM`, non-root user, `tini` as PID 1.
 - Generated `deploy.yml` for container templates signs every pushed GHCR image with **Sigstore Cosign** (keyless OIDC) and attaches an **SPDX SBOM attestation** so consumers can `cosign verify` and `cosign verify-attestation --type spdxjson` instead of trusting the registry alone.

package/bin/daloy.mjs

@@ -2,9 +2,11 @@
 /**
  * `daloy` CLI shim. Real logic lives in `dist/cli.js` (`src/cli.ts`).
  *
- * For TypeScript entry files we try to register `tsx` if it's installed
- * in the consumer project; otherwise we surface a friendly error pointing
- * users at `node --import tsx`.
+ * TypeScript entry files are imported directly — Node.js >= 22.18 strips
+ * erasable TypeScript syntax natively. If the native load fails (older
+ * Node, non-erasable syntax such as enums, or extensionless relative
+ * imports) we fall back to registering `tsx` when the consumer project has
+ * it installed; otherwise we surface a friendly error.
  */
 
 import { pathToFileURL, fileURLToPath } from "node:url";
@@ -20,17 +22,33 @@ const PKG = JSON.parse(
 
 const TS_EXT = /\.(ts|tsx|mts|cts)$/i;
 
+/**
+ * Error codes that mean the host Node.js could not load a TypeScript file
+ * natively — the cases where falling back to a transpiling loader (tsx)
+ * can still succeed.
+ */
+const NATIVE_TS_ERROR_CODES = new Set([
+  // Type stripping disabled (--no-strip-types) or Node too old.
+  "ERR_UNKNOWN_FILE_EXTENSION",
+  // Non-erasable syntax: enums, runtime namespaces, parameter properties.
+  "ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX",
+  // Extensionless relative imports that native stripping refuses to resolve.
+  "ERR_MODULE_NOT_FOUND",
+]);
+
 let tsxRegistered = false;
-async function ensureTsxIfNeeded(specifier) {
-  if (!TS_EXT.test(specifier) || tsxRegistered) return;
+async function registerTsxFallback(specifier, cause) {
   try {
     const api = await import("tsx/esm/api");
     api.register();
     tsxRegistered = true;
   } catch {
     throw new Error(
-      `Loading TypeScript entry "${specifier}" requires tsx. Install it ` +
-        `(\`pnpm add -D tsx\`) or run: node --import tsx ./node_modules/.bin/daloy inspect ${specifier}`
+      `Loading TypeScript entry "${specifier}" failed: ${cause?.message ?? cause}\n` +
+        "Node.js runs erasable-only TypeScript natively (>= 22.18). If the entry uses " +
+        "non-erasable syntax (enums, runtime namespaces, parameter properties) or " +
+        "extensionless relative imports, install tsx (`pnpm add -D tsx`) and re-run.",
+      { cause }
     );
   }
 }
@@ -40,8 +58,18 @@ async function importEntry(specifier) {
   if (!existsSync(abs)) {
     throw new Error(`Entry file not found: ${abs}`);
   }
-  await ensureTsxIfNeeded(abs);
-  return import(pathToFileURL(abs).href);
+  const href = pathToFileURL(abs).href;
+  if (!TS_EXT.test(abs) || tsxRegistered) return import(href);
+  try {
+    return await import(href);
+  } catch (err) {
+    if (!NATIVE_TS_ERROR_CODES.has(err?.code)) throw err;
+    await registerTsxFallback(abs, err);
+    // Cache-bust so the retried load resolves through tsx's hooks instead of
+    // the failed native module job. The first attempt failed before
+    // evaluation, so no side effects ran twice.
+    return import(`${href}?daloy-tsx-fallback=1`);
+  }
 }
 
 function spawnDev(command, args) {
@@ -62,7 +90,7 @@ function spawnDev(command, args) {
           new Error(
             `\`${command}\` was not found on PATH. ` +
               (command === "node"
-                ? "Install `tsx` as a dev dependency (`pnpm add -D tsx`) and ensure Node.js is on PATH."
+                ? "Ensure Node.js is on PATH."
                 : `Install ${command} or run daloy dev from the runtime that hosts it.`)
           )
         );

package/dist/adapters/vercel.d.ts

@@ -1,13 +1,15 @@
 /**
  * Vercel / web-standard handler.
  *
- * Vercel now recommends the Node.js runtime over Edge for new functions. The
- * runtime is web-standard, but the export shape differs by integration: Node
- * `/api` functions use a default `{ fetch }` object, while Edge functions use a
- * bare function export. If you are hosting a DaloyJS app inside an existing
- * Next.js app, App Router route handlers use named method exports.
+ * Vercel recommends the Node.js runtime for new functions (it runs on Fluid
+ * Compute with full Node APIs) and has deprecated standalone Edge Functions.
+ * The runtime is web-standard, but the export shape differs by integration:
+ * Node `/api` functions use a default `{ fetch }` object, App Router route
+ * handlers use named method exports, and the deprecated Edge runtime expects a
+ * bare function export — {@link toWebHandler} — plus `export const runtime =
+ * "edge"`.
  *
- *   // Vercel Functions (`api/[...path].ts`)
+ *   // Vercel Functions (`api/[...path].ts`) — recommended
  *   import { toFetchHandler } from "@daloyjs/core/vercel";
  *   export default toFetchHandler(app);
  *
@@ -15,8 +17,6 @@
  *   import { toRouteHandlers } from "@daloyjs/core/vercel";
  *   export const { GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD } =
  *     toRouteHandlers(app);
- *
- * `toEdgeHandler` is kept as a backward-compatible alias of `toWebHandler`.
  */
 import type { App } from "../app.js";
 /** Web-standard handler shape used by Vercel Functions, Next.js route handlers, and middleware. */
@@ -44,8 +44,6 @@ export declare function toWebHandler(app: App): WebHandler;
  * @returns A {@link FetchHandler} object suitable as the module's `export default`.
  */
 export declare function toFetchHandler(app: App): FetchHandler;
-/** Backward-compatible alias for {@link toWebHandler}. */
-export declare const toEdgeHandler: typeof toWebHandler;
 /**
  * Build the `{ GET, POST, ... }` object expected by Next.js App Router
  * `route.ts` files when a DaloyJS app is mounted inside an existing Next app.

package/dist/adapters/vercel.js

@@ -18,8 +18,6 @@ export function toWebHandler(app) {
 export function toFetchHandler(app) {
     return { fetch: toWebHandler(app) };
 }
-/** Backward-compatible alias for {@link toWebHandler}. */
-export const toEdgeHandler = toWebHandler;
 /**
  * Build the `{ GET, POST, ... }` object expected by Next.js App Router
  * `route.ts` files when a DaloyJS app is mounted inside an existing Next app.

package/dist/app.d.ts

@@ -1401,6 +1401,25 @@ export declare class App<Routes extends readonly RouteDefinition<any, any, any,
      * });
      * ```
      *
+     * ### Scoping (Fastify-style encapsulation)
+     *
+     * Decorations are **scoped to the app instance they are declared on**, and
+     * are captured per route at registration time:
+     *
+     * - Calling `decorate()` on the root app makes the value visible to every
+     *   route, including routes inside plugins/groups registered *afterwards*
+     *   (app-level decorations flow inward).
+     * - Calling `decorate()` on the child app passed to {@link App.register} /
+     *   {@link App.group} scopes the value to **that plugin's routes only** — it
+     *   does not leak to sibling plugins or back to the root.
+     *
+     * Each route binds to its scope's decorations when it is registered, so
+     * **decorate before registering the routes that consume the value** (the same
+     * ordering Fastify requires). Adding a decoration to a scope that already had
+     * at least one is picked up by that scope's existing routes; but the first
+     * decoration added to a scope *after* its routes were registered will not
+     * reach them.
+     *
      * @param key - Property name on `ctx.state`.
      * @param value - Value bound to that property on every request.
      * @param opts - Pass `{ override: true }` to replace an existing decoration (logged as a warning).

package/dist/app.js

@@ -1433,7 +1433,22 @@ export class App {
             ...corsOriginAllows,
         ];
         const securityMarkers = securityMarkersFromHooks([globalHookLayer, ...sources]);
-        this.router.add(def.method, fullPath, { def: merged, hooks, mergedHooks, hasFinalizeHook, corsOriginAllows, fullCorsOriginAllows }, def.operationId);
+        // Capture the decorations of this route's scope at registration time so the
+        // dispatch hot path reads the scope-local bag rather than the root app's.
+        // `this.decorations` is this scope's own bag (the root's, or the child's
+        // copy created in `group()`), so plugin-local decorations never leak to
+        // sibling plugins or the root. `undefined` when empty keeps the per-request
+        // `Object.assign` skipped for the common no-decoration case.
+        const decorations = this.decorationsCount === 0 ? undefined : this.decorations;
+        this.router.add(def.method, fullPath, {
+            def: merged,
+            hooks,
+            mergedHooks,
+            hasFinalizeHook,
+            corsOriginAllows,
+            fullCorsOriginAllows,
+            decorations,
+        }, def.operationId);
         // `routes` is statically a readonly tuple so the typed client can infer
         // per-route methods; at runtime it is a growable array, so we push through
         // a mutable view.
@@ -1946,7 +1961,15 @@ export class App {
         child.corsOriginAllows = corsOriginAllowsFromHooks(child.groupHooks);
         child.groupTags = [...this.groupTags, ...(config.tags ?? [])];
         child.groupAuth = config.auth ?? this.groupAuth;
-        child.decorations = this.decorations;
+        // Encapsulate decorations (Fastify-style): the child gets its OWN bag
+        // seeded with a copy of the parent's current decorations. App-level
+        // decorations therefore flow inward, while `child.decorate()` mutates only
+        // this copy — it never leaks back to the parent or sideways to sibling
+        // plugins (each sibling copies the parent bag at its own registration).
+        // Routes snapshot this bag in `route()`; the shared reference used before
+        // made decorators app-global instead of scoped.
+        child.decorations = { ...this.decorations };
+        child.decorationsCount = this.decorationsCount;
         child.installedPlugins = this.installedPlugins;
         child.closeHooks = this.closeHooks;
         child.idleConnectionCloseHooks = this.idleConnectionCloseHooks;
@@ -2032,6 +2055,25 @@ export class App {
      * });
      * ```
      *
+     * ### Scoping (Fastify-style encapsulation)
+     *
+     * Decorations are **scoped to the app instance they are declared on**, and
+     * are captured per route at registration time:
+     *
+     * - Calling `decorate()` on the root app makes the value visible to every
+     *   route, including routes inside plugins/groups registered *afterwards*
+     *   (app-level decorations flow inward).
+     * - Calling `decorate()` on the child app passed to {@link App.register} /
+     *   {@link App.group} scopes the value to **that plugin's routes only** — it
+     *   does not leak to sibling plugins or back to the root.
+     *
+     * Each route binds to its scope's decorations when it is registered, so
+     * **decorate before registering the routes that consume the value** (the same
+     * ordering Fastify requires). Adding a decoration to a scope that already had
+     * at least one is picked up by that scope's existing routes; but the first
+     * decoration added to a scope *after* its routes were registered will not
+     * reach them.
+     *
      * @param key - Property name on `ctx.state`.
      * @param value - Value bound to that property on every request.
      * @param opts - Pass `{ override: true }` to replace an existing decoration (logged as a warning).
@@ -2466,8 +2508,13 @@ export class App {
             const state = ctx.state;
             state.requestId = requestId;
             state.log = log;
-            if (this.decorationsCount !== 0)
-                Object.assign(state, this.decorations);
+            // Apply the decorations captured for THIS route's scope (see
+            // `CompiledRoute.decorations`) rather than the root app's bag, so a
+            // plugin's decorations reach only that plugin's routes. `undefined` when
+            // the scope had none keeps the common case allocation-free.
+            const routeDecorations = match.handler.decorations;
+            if (routeDecorations !== undefined)
+                Object.assign(state, routeDecorations);
             if (allHooks.beforeHandle !== undefined) {
                 const beforeResult = allHooks.beforeHandle(ctx);
                 const before = isPromiseLike(beforeResult) ? await beforeResult : beforeResult;

package/dist/cli.d.ts

@@ -130,8 +130,11 @@ export declare function normalizeEntryArg(entry: string): string;
  * runtime and entry file. Pure function so tests can assert exact argv
  * without spawning a child process.
  *
- * - Node: `node --import tsx --watch <entry>` (tsx must be installed as a
- *   dev dependency for TS files; .js entries also work).
+ * - Node: `node --watch <entry>` (Node >= 22.18 strips TypeScript types
+ *   natively, so `.ts` entries with erasable-only syntax run without a
+ *   loader; `.js` entries also work. Projects that need non-erasable
+ *   syntax — enums, runtime namespaces, parameter properties — should
+ *   transpile or add a loader such as tsx themselves).
  * - Bun:  `bun --hot <entry>` (Bun ships with TS support).
  * - Deno: `deno run --watch --allow-net --allow-env --allow-read <entry>`
  *   (the three permissions cover serving HTTP, reading env vars, and

package/dist/cli.js

@@ -22,8 +22,9 @@ Usage:
 Commands:
   inspect [entry]        Load an App and print its routes (default command).
   dev     [entry]        Start the entry file with the host runtime's
-                         native watch mode (tsx --watch on Node, --hot on
-                         Bun, --watch on Deno).
+                         native watch mode (node --watch on Node, --hot on
+                         Bun, --watch on Deno). Node runs TypeScript
+                         entries via its built-in type stripping.
   doctor  [entry]        Audit a loaded App's secure-by-default posture.
                          Exits non-zero on any violation so the
                          command can guard container HEALTHCHECK and CI
@@ -186,8 +187,11 @@ export function normalizeEntryArg(entry) {
  * runtime and entry file. Pure function so tests can assert exact argv
  * without spawning a child process.
  *
- * - Node: `node --import tsx --watch <entry>` (tsx must be installed as a
- *   dev dependency for TS files; .js entries also work).
+ * - Node: `node --watch <entry>` (Node >= 22.18 strips TypeScript types
+ *   natively, so `.ts` entries with erasable-only syntax run without a
+ *   loader; `.js` entries also work. Projects that need non-erasable
+ *   syntax — enums, runtime namespaces, parameter properties — should
+ *   transpile or add a loader such as tsx themselves).
  * - Bun:  `bun --hot <entry>` (Bun ships with TS support).
  * - Deno: `deno run --watch --allow-net --allow-env --allow-read <entry>`
  *   (the three permissions cover serving HTTP, reading env vars, and
@@ -219,7 +223,7 @@ export function buildDevCommand(runtime, entry) {
             };
         case "node":
         default:
-            return { command: "node", args: ["--import", "tsx", "--watch", safe] };
+            return { command: "node", args: ["--watch", safe] };
     }
 }
 /**

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:63bae5ad-16c4-5db2-9929-3188903cb4f9",
+  "serialNumber": "urn:uuid:50e7cfc8-73fe-5f9a-96b0-38df20d401b5",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-04T14:31:15.314Z",
+    "timestamp": "2026-07-09T19:29:34.036Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "1.0.0-rc.1"
+        "version": "1.0.0-rc.3"
       }
     ],
     "authors": [
@@ -19,11 +19,11 @@
     ],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/@daloyjs/core@1.0.0-rc.1",
+      "bom-ref": "pkg:npm/@daloyjs/core@1.0.0-rc.3",
       "name": "@daloyjs/core",
-      "version": "1.0.0-rc.1",
+      "version": "1.0.0-rc.3",
       "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
-      "purl": "pkg:npm/@daloyjs/core@1.0.0-rc.1",
+      "purl": "pkg:npm/@daloyjs/core@1.0.0-rc.3",
       "licenses": [
         {
           "license": {
@@ -46,9 +46,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag--daloyjs-core-1.0.0-rc.1",
+        "tagId": "swidtag--daloyjs-core-1.0.0-rc.3",
         "name": "@daloyjs/core",
-        "version": "1.0.0-rc.1",
+        "version": "1.0.0-rc.3",
         "tagVersion": 0,
         "patch": false
       }
@@ -57,7 +57,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/@daloyjs/core@1.0.0-rc.1",
+      "ref": "pkg:npm/@daloyjs/core@1.0.0-rc.3",
       "dependsOn": []
     }
   ]

package/dist/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@daloyjs/core-1.0.0-rc.1",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.0.0-rc.1-63bae5ad-16c4-5db2-9929-3188903cb4f9",
+  "name": "@daloyjs/core-1.0.0-rc.3",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.0.0-rc.3-50e7cfc8-73fe-5f9a-96b0-38df20d401b5",
   "creationInfo": {
-    "created": "2026-07-04T14:31:15.314Z",
+    "created": "2026-07-09T19:29:34.036Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package--daloyjs-core",
       "name": "@daloyjs/core",
-      "versionInfo": "1.0.0-rc.1",
+      "versionInfo": "1.0.0-rc.3",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/@daloyjs/core@1.0.0-rc.1"
+          "referenceLocator": "pkg:npm/@daloyjs/core@1.0.0-rc.3"
         }
       ]
     }

package/dist/types.d.ts

@@ -199,7 +199,10 @@ export interface AuthSpec {
  *
  * @example
  * ```ts
- * // src/types.d.ts
+ * // Put this in a regular module the compiler always checks (e.g. the
+ * // plugin file that calls `app.decorate(...)`). Avoid a separate .d.ts:
+ * // `skipLibCheck` skips declaration files, so a broken import there
+ * // silently types the state value as `any`.
  * declare module "@daloyjs/core" {
  *   interface AppState {
  *     user: { id: string; roles: string[] };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daloyjs/core",
-  "version": "1.0.0-rc.1",
+  "version": "1.0.0-rc.3",
   "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
   "type": "module",
   "publishConfig": {