@daloyjs/core 1.0.0-rc.2 → 1.0.0-rc.3

package/README.md

@@ -28,6 +28,12 @@ Disclosure](https://img.shields.io/badge/Security-Responsible%20Disclosure-yello
 
 DaloyJS is maintained in the GitHub organization at <https://github.com/daloyjs>; the canonical framework repository is <https://github.com/daloyjs/daloy>.
 
+## Partners
+
+<a href="https://snyk.io">
+  <img src="https://github.com/user-attachments/assets/da58db43-67cc-45d4-ade5-bdaa7b041465" alt="Snyk's Secure Developer Program" width="160">
+</a>
+
 ---
 
 ## Built for the vibe-coding era
@@ -509,7 +515,7 @@ The core only ever sees `Request → Response`. Adapters live at the edge.
 
 ## Status
 
-DaloyJS is at **`1.0.0-rc.2`**, a security-hardening release candidate. Because the framework has no external users yet, this RC ships a few intentional breaking changes (see the [CHANGELOG](CHANGELOG.md)) to get the secure-by-default posture right before GA rather than deferring them; the generated OpenAPI contract is unchanged. From `1.0.0` GA onward, breaking changes follow SemVer with deprecations getting at least one minor cycle. The framework is already in use for production trials.
+DaloyJS is at **`1.0.0-rc.3`**, a security-hardening release candidate. Because the framework has no external users yet, this RC makes a few intentional changes (see the [CHANGELOG](CHANGELOG.md)) to get the secure-by-default posture right before GA rather than deferring them; the generated OpenAPI contract is unchanged. From `1.0.0` GA onward, the API follows SemVer with deprecations getting at least one minor cycle. The framework is already in use for production trials.
 
 **Release quality bar.** Every release ships with **≥90% line + function coverage and ≥90% branch coverage**, strict TypeScript, OpenSSF Scorecard, CodeQL + Opengrep dual SAST, zizmor workflow linting, and npm provenance. Coverage was relaxed from a former 100% gate so complex security work isn't blocked chasing throwaway tests for unreachable defensive branches or tsx source-map phantoms; see [AGENTS.md](AGENTS.md) for the policy.
 

package/dist/adapters/vercel.d.ts

@@ -1,13 +1,15 @@
 /**
  * Vercel / web-standard handler.
  *
- * Vercel now recommends the Node.js runtime over Edge for new functions. The
- * runtime is web-standard, but the export shape differs by integration: Node
- * `/api` functions use a default `{ fetch }` object, while Edge functions use a
- * bare function export. If you are hosting a DaloyJS app inside an existing
- * Next.js app, App Router route handlers use named method exports.
+ * Vercel recommends the Node.js runtime for new functions (it runs on Fluid
+ * Compute with full Node APIs) and has deprecated standalone Edge Functions.
+ * The runtime is web-standard, but the export shape differs by integration:
+ * Node `/api` functions use a default `{ fetch }` object, App Router route
+ * handlers use named method exports, and the deprecated Edge runtime expects a
+ * bare function export — {@link toWebHandler} — plus `export const runtime =
+ * "edge"`.
  *
- *   // Vercel Functions (`api/[...path].ts`)
+ *   // Vercel Functions (`api/[...path].ts`) — recommended
  *   import { toFetchHandler } from "@daloyjs/core/vercel";
  *   export default toFetchHandler(app);
  *
@@ -15,8 +17,6 @@
  *   import { toRouteHandlers } from "@daloyjs/core/vercel";
  *   export const { GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD } =
  *     toRouteHandlers(app);
- *
- * `toEdgeHandler` is kept as a backward-compatible alias of `toWebHandler`.
  */
 import type { App } from "../app.js";
 /** Web-standard handler shape used by Vercel Functions, Next.js route handlers, and middleware. */
@@ -44,8 +44,6 @@ export declare function toWebHandler(app: App): WebHandler;
  * @returns A {@link FetchHandler} object suitable as the module's `export default`.
  */
 export declare function toFetchHandler(app: App): FetchHandler;
-/** Backward-compatible alias for {@link toWebHandler}. */
-export declare const toEdgeHandler: typeof toWebHandler;
 /**
  * Build the `{ GET, POST, ... }` object expected by Next.js App Router
  * `route.ts` files when a DaloyJS app is mounted inside an existing Next app.

package/dist/adapters/vercel.js

@@ -18,8 +18,6 @@ export function toWebHandler(app) {
 export function toFetchHandler(app) {
     return { fetch: toWebHandler(app) };
 }
-/** Backward-compatible alias for {@link toWebHandler}. */
-export const toEdgeHandler = toWebHandler;
 /**
  * Build the `{ GET, POST, ... }` object expected by Next.js App Router
  * `route.ts` files when a DaloyJS app is mounted inside an existing Next app.

package/dist/app.d.ts

@@ -1401,6 +1401,25 @@ export declare class App<Routes extends readonly RouteDefinition<any, any, any,
      * });
      * ```
      *
+     * ### Scoping (Fastify-style encapsulation)
+     *
+     * Decorations are **scoped to the app instance they are declared on**, and
+     * are captured per route at registration time:
+     *
+     * - Calling `decorate()` on the root app makes the value visible to every
+     *   route, including routes inside plugins/groups registered *afterwards*
+     *   (app-level decorations flow inward).
+     * - Calling `decorate()` on the child app passed to {@link App.register} /
+     *   {@link App.group} scopes the value to **that plugin's routes only** — it
+     *   does not leak to sibling plugins or back to the root.
+     *
+     * Each route binds to its scope's decorations when it is registered, so
+     * **decorate before registering the routes that consume the value** (the same
+     * ordering Fastify requires). Adding a decoration to a scope that already had
+     * at least one is picked up by that scope's existing routes; but the first
+     * decoration added to a scope *after* its routes were registered will not
+     * reach them.
+     *
      * @param key - Property name on `ctx.state`.
      * @param value - Value bound to that property on every request.
      * @param opts - Pass `{ override: true }` to replace an existing decoration (logged as a warning).

package/dist/app.js

@@ -1433,7 +1433,22 @@ export class App {
             ...corsOriginAllows,
         ];
         const securityMarkers = securityMarkersFromHooks([globalHookLayer, ...sources]);
-        this.router.add(def.method, fullPath, { def: merged, hooks, mergedHooks, hasFinalizeHook, corsOriginAllows, fullCorsOriginAllows }, def.operationId);
+        // Capture the decorations of this route's scope at registration time so the
+        // dispatch hot path reads the scope-local bag rather than the root app's.
+        // `this.decorations` is this scope's own bag (the root's, or the child's
+        // copy created in `group()`), so plugin-local decorations never leak to
+        // sibling plugins or the root. `undefined` when empty keeps the per-request
+        // `Object.assign` skipped for the common no-decoration case.
+        const decorations = this.decorationsCount === 0 ? undefined : this.decorations;
+        this.router.add(def.method, fullPath, {
+            def: merged,
+            hooks,
+            mergedHooks,
+            hasFinalizeHook,
+            corsOriginAllows,
+            fullCorsOriginAllows,
+            decorations,
+        }, def.operationId);
         // `routes` is statically a readonly tuple so the typed client can infer
         // per-route methods; at runtime it is a growable array, so we push through
         // a mutable view.
@@ -1946,7 +1961,15 @@ export class App {
         child.corsOriginAllows = corsOriginAllowsFromHooks(child.groupHooks);
         child.groupTags = [...this.groupTags, ...(config.tags ?? [])];
         child.groupAuth = config.auth ?? this.groupAuth;
-        child.decorations = this.decorations;
+        // Encapsulate decorations (Fastify-style): the child gets its OWN bag
+        // seeded with a copy of the parent's current decorations. App-level
+        // decorations therefore flow inward, while `child.decorate()` mutates only
+        // this copy — it never leaks back to the parent or sideways to sibling
+        // plugins (each sibling copies the parent bag at its own registration).
+        // Routes snapshot this bag in `route()`; the shared reference used before
+        // made decorators app-global instead of scoped.
+        child.decorations = { ...this.decorations };
+        child.decorationsCount = this.decorationsCount;
         child.installedPlugins = this.installedPlugins;
         child.closeHooks = this.closeHooks;
         child.idleConnectionCloseHooks = this.idleConnectionCloseHooks;
@@ -2032,6 +2055,25 @@ export class App {
      * });
      * ```
      *
+     * ### Scoping (Fastify-style encapsulation)
+     *
+     * Decorations are **scoped to the app instance they are declared on**, and
+     * are captured per route at registration time:
+     *
+     * - Calling `decorate()` on the root app makes the value visible to every
+     *   route, including routes inside plugins/groups registered *afterwards*
+     *   (app-level decorations flow inward).
+     * - Calling `decorate()` on the child app passed to {@link App.register} /
+     *   {@link App.group} scopes the value to **that plugin's routes only** — it
+     *   does not leak to sibling plugins or back to the root.
+     *
+     * Each route binds to its scope's decorations when it is registered, so
+     * **decorate before registering the routes that consume the value** (the same
+     * ordering Fastify requires). Adding a decoration to a scope that already had
+     * at least one is picked up by that scope's existing routes; but the first
+     * decoration added to a scope *after* its routes were registered will not
+     * reach them.
+     *
      * @param key - Property name on `ctx.state`.
      * @param value - Value bound to that property on every request.
      * @param opts - Pass `{ override: true }` to replace an existing decoration (logged as a warning).
@@ -2466,8 +2508,13 @@ export class App {
             const state = ctx.state;
             state.requestId = requestId;
             state.log = log;
-            if (this.decorationsCount !== 0)
-                Object.assign(state, this.decorations);
+            // Apply the decorations captured for THIS route's scope (see
+            // `CompiledRoute.decorations`) rather than the root app's bag, so a
+            // plugin's decorations reach only that plugin's routes. `undefined` when
+            // the scope had none keeps the common case allocation-free.
+            const routeDecorations = match.handler.decorations;
+            if (routeDecorations !== undefined)
+                Object.assign(state, routeDecorations);
             if (allHooks.beforeHandle !== undefined) {
                 const beforeResult = allHooks.beforeHandle(ctx);
                 const before = isPromiseLike(beforeResult) ? await beforeResult : beforeResult;

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:8448de36-3a72-553d-882f-b5b36bbd1426",
+  "serialNumber": "urn:uuid:50e7cfc8-73fe-5f9a-96b0-38df20d401b5",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-07T09:24:36.816Z",
+    "timestamp": "2026-07-09T19:29:34.036Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "1.0.0-rc.2"
+        "version": "1.0.0-rc.3"
       }
     ],
     "authors": [
@@ -19,11 +19,11 @@
     ],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/@daloyjs/core@1.0.0-rc.2",
+      "bom-ref": "pkg:npm/@daloyjs/core@1.0.0-rc.3",
       "name": "@daloyjs/core",
-      "version": "1.0.0-rc.2",
+      "version": "1.0.0-rc.3",
       "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
-      "purl": "pkg:npm/@daloyjs/core@1.0.0-rc.2",
+      "purl": "pkg:npm/@daloyjs/core@1.0.0-rc.3",
       "licenses": [
         {
           "license": {
@@ -46,9 +46,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag--daloyjs-core-1.0.0-rc.2",
+        "tagId": "swidtag--daloyjs-core-1.0.0-rc.3",
         "name": "@daloyjs/core",
-        "version": "1.0.0-rc.2",
+        "version": "1.0.0-rc.3",
         "tagVersion": 0,
         "patch": false
       }
@@ -57,7 +57,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/@daloyjs/core@1.0.0-rc.2",
+      "ref": "pkg:npm/@daloyjs/core@1.0.0-rc.3",
       "dependsOn": []
     }
   ]

package/dist/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@daloyjs/core-1.0.0-rc.2",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.0.0-rc.2-8448de36-3a72-553d-882f-b5b36bbd1426",
+  "name": "@daloyjs/core-1.0.0-rc.3",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.0.0-rc.3-50e7cfc8-73fe-5f9a-96b0-38df20d401b5",
   "creationInfo": {
-    "created": "2026-07-07T09:24:36.816Z",
+    "created": "2026-07-09T19:29:34.036Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package--daloyjs-core",
       "name": "@daloyjs/core",
-      "versionInfo": "1.0.0-rc.2",
+      "versionInfo": "1.0.0-rc.3",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/@daloyjs/core@1.0.0-rc.2"
+          "referenceLocator": "pkg:npm/@daloyjs/core@1.0.0-rc.3"
         }
       ]
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daloyjs/core",
-  "version": "1.0.0-rc.2",
+  "version": "1.0.0-rc.3",
   "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
   "type": "module",
   "publishConfig": {