libmodulor 0.30.0 → 0.31.0

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # CHANGELOG
 
+## v0.31.0 (2026-07-08)
+
+### 🔭 OpenTelemetry support
+
+libmodulor now includes first-class OpenTelemetry instrumentation, making it easier to trace application behavior and integrate with existing observability platforms.
+
+### 🔐 Authentication improvements
+
+- Added JWT support from `Authorization` headers for target servers.
+- Improved MCP target security with API public key validation.
+
+### 🛠 Developer experience
+
+- Added Base64 and Base64URL hash encodings.
+- Added helpers for human-readable `snake_case` formatting.
+- Improved network error handling and translation robustness.
+
+### 📱 Platform updates
+
+- Updated React Native to 0.86 and Expo to 57.0.
+- Refreshed dependencies and documentation.
+
+This release improves observability, security, and overall developer experience.
+
+See all the changes here : https://github.com/c100k/libmodulor/compare/v0.30.0...master
+
 ## v0.30.0 (2026-05-25)
 
 ### ✨ Features

package/README.md

@@ -50,4 +50,4 @@ If you think you can help in any way, feel free to contact me (cf. `author` in `
 
 ## ⚖️ License
 
-[LGPL-3.0](https://github.com/c100k/libmodulor/blob/v0.30.0/LICENSE)
+[LGPL-3.0](https://github.com/c100k/libmodulor/blob/v0.31.0/LICENSE)

package/dist/esm/apps/Helper/src/lib/layers/project.js

@@ -87,19 +87,19 @@ export const PACKAGE_JSON = (name) => `{
         "reflect-metadata": "^0.2.2"
     },
     "devDependencies": {
-        "@biomejs/biome": "^2.4.15",
-        "@types/node": "^25.8.0",
-        "@vitest/coverage-v8": "^4.1.6",
+        "@biomejs/biome": "^2.5.2",
+        "@types/node": "^25.9.4",
+        "@vitest/coverage-v8": "^4.1.10",
         "buffer": "^6.0.3",
         "cookie-parser": "^1.4.7",
         "express": "^5.2.1",
         "express-fileupload": "^1.5.2",
         "fast-check": "^4.8.0",
-        "helmet": "^8.1.0",
+        "helmet": "^8.2.0",
         "jose": "^6.2.3",
         "typescript": "^6.0.3",
-        "vite": "^8.0.13",
-        "vitest": "^4.1.6"
+        "vite": "^8.1.3",
+        "vitest": "^4.1.10"
     }
 }
 `;

package/dist/esm/i18n/WordingManager.js

@@ -50,10 +50,16 @@ let WordingManager = class WordingManager {
         }
         const parts = [];
         for (const [k, v] of Object.entries(constraints)) {
-            parts.push(
             // TODO : Consider moving up the type hierarchy to fetch the constr of the parent when missing
             // e.g. TFreeTextShort > TString
-            this.t(`dt_${type.tName()}_constr_${k}`, undefined, v));
+            const val = this.tOrNull(`dt_${type.tName()}_constr_${k}`, v);
+            if (!val) {
+                continue;
+            }
+            parts.push(val);
+        }
+        if (parts.length === 0) {
+            return null;
         }
         return parts;
     }
@@ -118,8 +124,10 @@ let WordingManager = class WordingManager {
         }
         return val;
     }
-    tOrNull(key) {
-        return this.i18nManager.tOrNull(key);
+    tOrNull(key, expected = undefined) {
+        return this.i18nManager.tOrNull(key, {
+            vars: expected ? { expected } : {},
+        });
     }
 };
 WordingManager = __decorate([

package/dist/esm/index.instrumentation-otl.d.ts

@@ -0,0 +1 @@
+export { InstrumentationOTL, type InstrumentationOTLConfig, } from './instrumentation/instrumentation-otl.js';

package/dist/esm/index.instrumentation-otl.js

@@ -0,0 +1 @@
+export { InstrumentationOTL, } from './instrumentation/instrumentation-otl.js';

package/dist/esm/instrumentation/instrumentation-otl.d.ts

@@ -0,0 +1,12 @@
+import { type InstrumentationConfig as BaseInstrumentationConfig, InstrumentationBase, type InstrumentationModuleDefinition } from '@opentelemetry/instrumentation';
+export type InstrumentationOTLConfig = BaseInstrumentationConfig & {
+    libPath?: string;
+};
+export declare class InstrumentationOTL extends InstrumentationBase<InstrumentationOTLConfig> {
+    constructor(config: InstrumentationOTLConfig);
+    protected init(): InstrumentationModuleDefinition | InstrumentationModuleDefinition[] | undefined;
+    private moduleName;
+    private patchMethod;
+    private unwrapAll;
+    private wrapAll;
+}

package/dist/esm/instrumentation/instrumentation-otl.js

@@ -0,0 +1,119 @@
+import { context, SpanStatusCode, trace } from '@opentelemetry/api';
+import { InstrumentationBase, InstrumentationNodeModuleDefinition, } from '@opentelemetry/instrumentation';
+const LIB_NAME = 'libmodulor';
+const LIB_VERSION = '';
+const LIB_MIN_VERSION = '*';
+const NAME = `instrumentation-${LIB_NAME}`;
+const TRACABLES = {
+    [LIB_NAME]: {
+        SimpleUCManager: [
+            'commitTx',
+            'confirmClient',
+            'execClient',
+            'execServer',
+            'initServer',
+            'persist',
+            'persistProjection',
+            'rollbackTx',
+        ],
+        UCExecChecker: ['exec'],
+        UCInputFilesProcessor: ['exec'],
+        UCInputValidator: ['exec'],
+        UCOutputFilesProcessor: ['exec'],
+    },
+    [`${LIB_NAME}/uc-data-store-knex`]: {
+        KnexUCDataStore: [
+            'clear',
+            'destroy',
+            'exists',
+            'init',
+            'initSync',
+            'read',
+            'readProjection',
+            'startTx',
+            'supportedSpecificBindings',
+            'testKey',
+            'write',
+            'writeBulk',
+            'writeProjection',
+        ],
+    },
+};
+export class InstrumentationOTL extends InstrumentationBase {
+    constructor(config) {
+        super(NAME, LIB_VERSION, config);
+    }
+    init() {
+        const namespaces = Object.keys(TRACABLES);
+        const defs = namespaces.map((namespace) => new InstrumentationNodeModuleDefinition(this.moduleName(namespace, this._config.libPath), [LIB_MIN_VERSION], (moduleExports) => this.wrapAll(moduleExports, namespace), (moduleExports) => this.unwrapAll(moduleExports, namespace)));
+        return defs;
+    }
+    moduleName(namespace, libPath) {
+        if (!libPath) {
+            return namespace; // e.g. libmodulor, libmodulor/uc-data-store-knex
+        }
+        if (!namespace.includes('/')) {
+            return libPath; // ../../../index.js
+        }
+        const moduleName = namespace.split('/')[1];
+        return libPath.replace('.js', `.${moduleName}.js`); // e.g. ../../../index.uc-data-store-knex.js
+    }
+    patchMethod(namespace, className, methodName) {
+        return (original) => {
+            const tracer = this.tracer;
+            const spanName = `${className}.${methodName}`;
+            // biome-ignore lint/suspicious/noExplicitAny: can be anything
+            return function patched(...args) {
+                const span = tracer.startSpan(spanName, {
+                    attributes: {
+                        'scope.name': namespace,
+                    },
+                });
+                const ctx = trace.setSpan(context.active(), span);
+                return context.with(ctx, async () => {
+                    try {
+                        const res = await original.apply(this, args);
+                        span.setStatus({
+                            code: SpanStatusCode.OK,
+                        });
+                        return res;
+                    }
+                    catch (err) {
+                        span.recordException(err);
+                        span.setStatus({
+                            code: SpanStatusCode.ERROR,
+                            message: err.message,
+                        });
+                        throw err;
+                    }
+                    finally {
+                        span.end();
+                    }
+                });
+            };
+        };
+    }
+    unwrapAll(moduleExports, namespace) {
+        // biome-ignore lint/style/noNonNullAssertion: we want it
+        const entries = Object.entries(TRACABLES[namespace]);
+        for (const [className, methodNames] of entries) {
+            for (const methodName of methodNames) {
+                // biome-ignore lint/style/noNonNullAssertion: we want it
+                this._unwrap(moduleExports[className].prototype, methodName);
+            }
+        }
+        return moduleExports;
+    }
+    wrapAll(moduleExports, namespace) {
+        // biome-ignore lint/style/noNonNullAssertion: we want it
+        const entries = Object.entries(TRACABLES[namespace]);
+        for (const [className, methodNames] of entries) {
+            for (const methodName of methodNames) {
+                this._wrap(
+                // biome-ignore lint/style/noNonNullAssertion: we want it
+                moduleExports[className].prototype, methodName, this.patchMethod(namespace, className, methodName).bind(this));
+            }
+        }
+        return moduleExports;
+    }
+}

package/dist/esm/std/CryptoManager.d.ts

@@ -1,7 +1,7 @@
 import type { Password, UIntQuantity, UUID } from '../dt/index.js';
 import type { Clearable } from '../utils/index.js';
 import type { BufferManagerBase64String } from './BufferManager.js';
-export type CryptoManagerBinaryToTextEncoding = 'hex';
+export type CryptoManagerBinaryToTextEncoding = 'base64' | 'base64url' | 'hex';
 export type CryptoManagerHash = string;
 export type CryptoManagerHashAlgorithm = 'sha1' | 'sha256' | 'sha512';
 export type CryptoManagerHMACKey = string;

package/dist/esm/std/HTTPAPICaller.d.ts

@@ -12,8 +12,9 @@ export interface HTTPAPICallerHeaders {
     'Content-Type'?: HTTPContentType;
     Cookie?: string;
 }
+export type HTTPAPICallerAuthorizationHeaderPrefix = 'AWS4-HMAC-SHA256' | 'Basic' | 'Bearer' | 'JWT' | 'OAuth';
 export interface HTTPAPICallerAuthorizationHeader {
-    prefix?: 'AWS4-HMAC-SHA256' | 'Basic' | 'Bearer' | 'JWT' | 'OAuth';
+    prefix?: HTTPAPICallerAuthorizationHeaderPrefix;
     value: ApiKey | JWT | Password;
 }
 export interface HTTPAPICallerBasicAuth {

package/dist/esm/std/impl/JoseJWTManager.js

@@ -34,10 +34,10 @@ let JoseJWTManager = class JoseJWTManager {
         };
     }
     async decode(value, opts) {
-        const { alg } = decodeProtectedHeader(value);
-        assertIsDefined(alg, 'alg');
-        const secret = opts?.secret || this.s().jwt_manager_secret;
         try {
+            const { alg } = decodeProtectedHeader(value);
+            assertIsDefined(alg, 'alg');
+            const secret = opts?.secret || this.s().jwt_manager_secret;
             if (alg.startsWith('HS')) {
                 return (await jwtVerify(value, new TextEncoder().encode(secret))).payload;
             }
@@ -51,8 +51,13 @@ let JoseJWTManager = class JoseJWTManager {
             if (err instanceof JWSSignatureVerificationFailed) {
                 throw new UnauthorizedError();
             }
+            // See node_modules/jose/dist/webapi/util/decode_protected_header.js
+            if (err instanceof TypeError &&
+                err.message.toLowerCase().includes('invalid token')) {
+                throw new UnauthorizedError();
+            }
         }
-        throw new Error(`Unsupported alg ${alg}`);
+        throw new UnauthorizedError();
     }
     async decodeUnsafe(value) {
         const decoded = decodeJwt(value);

package/dist/esm/std/impl/SimpleHTTPAPICaller.js

@@ -55,13 +55,19 @@ let SimpleHTTPAPICaller = class SimpleHTTPAPICaller {
         registerAbort?.(() => {
             abortController.abort();
         });
-        const response = await this.httpAPICallExecutor.fn()(url, {
-            agent,
-            body,
-            headers: reqHeaders,
-            method,
-            signal: abortController.signal,
-        });
+        let response;
+        try {
+            response = await this.httpAPICallExecutor.fn()(url, {
+                agent,
+                body,
+                headers: reqHeaders,
+                method,
+                signal: abortController.signal,
+            });
+        }
+        catch (err) {
+            throw new Error('err_unreachable', { cause: err });
+        }
         const { headers, status } = response;
         this.logger.trace('HTTPAPICaller', {
             body,

package/dist/esm/target/lib/mcp-server/MCPServerRequestChecker.d.ts

@@ -0,0 +1,22 @@
+import type { HTTPStatusNumber } from '../../../dt/index.js';
+import type { Configurable, SettingsManager, Worker } from '../../../std/index.js';
+import { JWTAuthenticationChecker } from '../server/JWTAuthenticationChecker.js';
+import { PublicApiKeyChecker } from '../server/PublicApiKeyChecker.js';
+import type { ServerManagerSettings } from '../server/ServerManager.js';
+import type { ServerRequestHandlerReq } from '../server/ServerRequestHandler.js';
+interface Input {
+    req: ServerRequestHandlerReq;
+}
+interface Output {
+    status: Extract<HTTPStatusNumber, 401> | null;
+}
+type S = Pick<ServerManagerSettings, 'server_mcp_dangerously_skip_auth_check' | 'server_mcp_dangerously_skip_pub_api_key_check' | 'server_public_api_key_header_name'>;
+export declare class MCPServerRequestChecker implements Configurable<S>, Worker<Input, Promise<Output>> {
+    private jwtAuthenticationChecker;
+    private publicApiKeyChecker;
+    private settingsManager;
+    constructor(jwtAuthenticationChecker: JWTAuthenticationChecker, publicApiKeyChecker: PublicApiKeyChecker, settingsManager: SettingsManager<S>);
+    s(): S;
+    exec({ req }: Input): Promise<Output>;
+}
+export {};

package/dist/esm/target/lib/mcp-server/MCPServerRequestChecker.js

@@ -0,0 +1,71 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { inject, injectable } from 'inversify';
+import { logDevWarning } from '../../../error/index.js';
+import { JWTAuthenticationChecker } from '../server/JWTAuthenticationChecker.js';
+import { PublicApiKeyChecker } from '../server/PublicApiKeyChecker.js';
+let MCPServerRequestChecker = class MCPServerRequestChecker {
+    jwtAuthenticationChecker;
+    publicApiKeyChecker;
+    settingsManager;
+    constructor(jwtAuthenticationChecker, publicApiKeyChecker, settingsManager) {
+        this.jwtAuthenticationChecker = jwtAuthenticationChecker;
+        this.publicApiKeyChecker = publicApiKeyChecker;
+        this.settingsManager = settingsManager;
+    }
+    s() {
+        return {
+            server_mcp_dangerously_skip_auth_check: this.settingsManager.get()('server_mcp_dangerously_skip_auth_check'),
+            server_mcp_dangerously_skip_pub_api_key_check: this.settingsManager.get()('server_mcp_dangerously_skip_pub_api_key_check'),
+            server_public_api_key_header_name: this.settingsManager.get()('server_public_api_key_header_name'),
+        };
+    }
+    async exec({ req }) {
+        const { header } = req;
+        if (this.s().server_mcp_dangerously_skip_pub_api_key_check) {
+            logDevWarning('Skipping pub api key check');
+        }
+        else {
+            await this.publicApiKeyChecker.exec({
+                checkType: 'on',
+                value: await header(this.s().server_public_api_key_header_name),
+            });
+        }
+        if (this.s().server_mcp_dangerously_skip_auth_check) {
+            logDevWarning('Skipping auth check');
+        }
+        else {
+            const authorizationHeader = await header('Authorization');
+            const auth = await this.jwtAuthenticationChecker.exec({
+                rawValue: authorizationHeader,
+            });
+            if (!auth) {
+                return {
+                    status: 401,
+                };
+            }
+        }
+        return {
+            status: null,
+        };
+    }
+};
+MCPServerRequestChecker = __decorate([
+    injectable(),
+    __param(0, inject(JWTAuthenticationChecker)),
+    __param(1, inject(PublicApiKeyChecker)),
+    __param(2, inject('SettingsManager')),
+    __metadata("design:paramtypes", [JWTAuthenticationChecker,
+        PublicApiKeyChecker, Object])
+], MCPServerRequestChecker);
+export { MCPServerRequestChecker };

package/dist/esm/target/lib/mcp-server/http/express/MCPHTTPExpressProtocolRequestHandlerBuilder.d.ts

@@ -2,14 +2,16 @@ import type { RequestHandler } from 'express';
 import { WordingManager } from '../../../../../i18n/index.js';
 import type { ProductManifest } from '../../../../../product/index.js';
 import type { Logger } from '../../../../../std/index.js';
+import { MCPServerRequestChecker } from '../../MCPServerRequestChecker.js';
 import { MCPServerRequestHandler } from '../../MCPServerRequestHandler.js';
 import type { MCPHTTPRequestHandlerBuilderInput } from '../MCPHTTPRequestHandlerBuilder.js';
 import type { MCPHTTPExpressRequestHandlerBuilder } from './types.js';
 export declare class MCPHTTPExpressProtocolRequestHandlerBuilder implements MCPHTTPExpressRequestHandlerBuilder {
     private logger;
     private productManifest;
+    private serverRequestChecker;
     private serverRequestHandler;
     private wordingManager;
-    constructor(logger: Logger, productManifest: ProductManifest, serverRequestHandler: MCPServerRequestHandler, wordingManager: WordingManager);
+    constructor(logger: Logger, productManifest: ProductManifest, serverRequestChecker: MCPServerRequestChecker, serverRequestHandler: MCPServerRequestHandler, wordingManager: WordingManager);
     exec({ ucs, ucManager, }: MCPHTTPRequestHandlerBuilderInput): RequestHandler;
 }

package/dist/esm/target/lib/mcp-server/http/express/MCPHTTPExpressProtocolRequestHandlerBuilder.js

@@ -16,21 +16,31 @@ import { WordingManager } from '../../../../../i18n/index.js';
 import { ucMountingPoint, } from '../../../../../uc/index.js';
 import { toReq, toRes } from '../../../server-express/funcs.js';
 import { init, toolConfig } from '../../funcs.js';
+import { MCPServerRequestChecker } from '../../MCPServerRequestChecker.js';
 import { MCPServerRequestHandler } from '../../MCPServerRequestHandler.js';
 import { ucStreamExecOpts } from '../funcs.js';
 let MCPHTTPExpressProtocolRequestHandlerBuilder = class MCPHTTPExpressProtocolRequestHandlerBuilder {
     logger;
     productManifest;
+    serverRequestChecker;
     serverRequestHandler;
     wordingManager;
-    constructor(logger, productManifest, serverRequestHandler, wordingManager) {
+    constructor(logger, productManifest, serverRequestChecker, serverRequestHandler, wordingManager) {
         this.logger = logger;
         this.productManifest = productManifest;
+        this.serverRequestChecker = serverRequestChecker;
         this.serverRequestHandler = serverRequestHandler;
         this.wordingManager = wordingManager;
     }
     exec({ ucs, ucManager, }) {
         return async (req, res) => {
+            const { status } = await this.serverRequestChecker.exec({
+                req: toReq(req),
+            });
+            if (status) {
+                res.status(status).json({});
+                return;
+            }
             const server = init(this.productManifest);
             const transport = new StreamableHTTPServerTransport();
             // In Streamable HTTP, there is usually one request => one transport => one server.
@@ -80,9 +90,11 @@ MCPHTTPExpressProtocolRequestHandlerBuilder = __decorate([
     injectable(),
     __param(0, inject('Logger')),
     __param(1, inject('ProductManifest')),
-    __param(2, inject(MCPServerRequestHandler)),
-    __param(3, inject(WordingManager)),
-    __metadata("design:paramtypes", [Object, Object, MCPServerRequestHandler,
+    __param(2, inject(MCPServerRequestChecker)),
+    __param(3, inject(MCPServerRequestHandler)),
+    __param(4, inject(WordingManager)),
+    __metadata("design:paramtypes", [Object, Object, MCPServerRequestChecker,
+        MCPServerRequestHandler,
         WordingManager])
 ], MCPHTTPExpressProtocolRequestHandlerBuilder);
 export { MCPHTTPExpressProtocolRequestHandlerBuilder };

package/dist/esm/target/lib/mcp-server/http/hono/MCPHTTPHonoProtocolRequestHandlerBuilder.d.ts

@@ -2,14 +2,16 @@ import type { MiddlewareHandler } from 'hono';
 import { WordingManager } from '../../../../../i18n/index.js';
 import type { ProductManifest } from '../../../../../product/index.js';
 import type { Logger } from '../../../../../std/index.js';
+import { MCPServerRequestChecker } from '../../MCPServerRequestChecker.js';
 import { MCPServerRequestHandler } from '../../MCPServerRequestHandler.js';
 import type { MCPHTTPRequestHandlerBuilderInput } from '../MCPHTTPRequestHandlerBuilder.js';
 import type { MCPHTTPHonoRequestHandlerBuilder } from './types.js';
 export declare class MCPHTTPHonoProtocolRequestHandlerBuilder implements MCPHTTPHonoRequestHandlerBuilder {
     private logger;
     private productManifest;
+    private serverRequestChecker;
     private serverRequestHandler;
     private wordingManager;
-    constructor(logger: Logger, productManifest: ProductManifest, serverRequestHandler: MCPServerRequestHandler, wordingManager: WordingManager);
+    constructor(logger: Logger, productManifest: ProductManifest, serverRequestChecker: MCPServerRequestChecker, serverRequestHandler: MCPServerRequestHandler, wordingManager: WordingManager);
     exec({ ucs, ucManager, }: MCPHTTPRequestHandlerBuilderInput): MiddlewareHandler;
 }

package/dist/esm/target/lib/mcp-server/http/hono/MCPHTTPHonoProtocolRequestHandlerBuilder.js

@@ -16,21 +16,31 @@ import { WordingManager } from '../../../../../i18n/index.js';
 import { ucMountingPoint, } from '../../../../../uc/index.js';
 import { toReq, toRes } from '../../../server-hono/funcs.js';
 import { init, toolConfig } from '../../funcs.js';
+import { MCPServerRequestChecker } from '../../MCPServerRequestChecker.js';
 import { MCPServerRequestHandler } from '../../MCPServerRequestHandler.js';
 import { ucStreamExecOpts } from '../funcs.js';
 let MCPHTTPHonoProtocolRequestHandlerBuilder = class MCPHTTPHonoProtocolRequestHandlerBuilder {
     logger;
     productManifest;
+    serverRequestChecker;
     serverRequestHandler;
     wordingManager;
-    constructor(logger, productManifest, serverRequestHandler, wordingManager) {
+    constructor(logger, productManifest, serverRequestChecker, serverRequestHandler, wordingManager) {
         this.logger = logger;
         this.productManifest = productManifest;
+        this.serverRequestChecker = serverRequestChecker;
         this.serverRequestHandler = serverRequestHandler;
         this.wordingManager = wordingManager;
     }
     exec({ ucs, ucManager, }) {
         return async (c) => {
+            const { status } = await this.serverRequestChecker.exec({
+                req: toReq(c),
+            });
+            if (status) {
+                c.status(status);
+                return c.json({});
+            }
             const server = init(this.productManifest);
             const transport = new WebStandardStreamableHTTPServerTransport();
             // In Streamable HTTP, there is usually one request => one transport => one server.
@@ -80,9 +90,11 @@ MCPHTTPHonoProtocolRequestHandlerBuilder = __decorate([
     injectable(),
     __param(0, inject('Logger')),
     __param(1, inject('ProductManifest')),
-    __param(2, inject(MCPServerRequestHandler)),
-    __param(3, inject(WordingManager)),
-    __metadata("design:paramtypes", [Object, Object, MCPServerRequestHandler,
+    __param(2, inject(MCPServerRequestChecker)),
+    __param(3, inject(MCPServerRequestHandler)),
+    __param(4, inject(WordingManager)),
+    __metadata("design:paramtypes", [Object, Object, MCPServerRequestChecker,
+        MCPServerRequestHandler,
         WordingManager])
 ], MCPHTTPHonoProtocolRequestHandlerBuilder);
 export { MCPHTTPHonoProtocolRequestHandlerBuilder };

package/dist/esm/target/lib/react/useAction.js

@@ -5,7 +5,6 @@ export function useAction({ action, autoExec = false, confirm, onError, onInit,
     const [errMsg, setErrMsg] = useState(null);
     const [execRes, setExecRes] = useState(null);
     const [execState, setExecState] = useState(onInit ? UCExecState.INITIALIZING : UCExecState.IDLE);
-    // biome-ignore lint/correctness/useExhaustiveDependencies : must run only once
     useEffect(() => {
         (async () => {
             if (execState === UCExecState.INITIALIZING) {

package/dist/esm/target/lib/react/useUC.js

@@ -21,9 +21,6 @@ export function useUC(appManifest, def, auth, opts) {
         }
         return v;
     });
-    // biome-ignore lint/correctness/useExhaustiveDependencies(appManifest): avoid infinite re-rendering
-    // biome-ignore lint/correctness/useExhaustiveDependencies(def): avoid infinite re-rendering
-    // biome-ignore lint/correctness/useExhaustiveDependencies(opts?.fillWith): avoid infinite re-rendering
     useEffect(() => {
         const v = new UC(appManifest, def, auth);
         if (opts?.fillWith) {

package/dist/esm/target/lib/server/AuthenticationChecker.js

@@ -30,19 +30,20 @@ let AuthenticationChecker = class AuthenticationChecker {
         this.ucPolicyFactory = ucPolicyFactory;
     }
     async exec({ authCookie, authorizationHeader, uc, }) {
+        const { lifecycle: { server }, sec, } = uc.def;
+        const authType = sec?.authType ?? DEFAULT_UC_SEC_AT;
         this.logger.trace('Checking auth', {
             authCookie,
             authorizationHeader,
+            authType,
         });
         const output = {
             allowed: false, // By default it's not allowed
             auth: null,
         };
-        const { lifecycle: { server }, sec, } = uc.def;
         if (typeof server !== 'object') {
             return output;
         }
-        const authType = sec?.authType ?? DEFAULT_UC_SEC_AT;
         const policy = (await this.ucPolicyFactory(server.policy));
         const canBeExecutedPreAuth = await policy.canBeExecutedPreAuth();
         if (canBeExecutedPreAuth) {
@@ -53,29 +54,33 @@ let AuthenticationChecker = class AuthenticationChecker {
         }
         else {
             // Follows the OpenAPI spec : https://swagger.io/docs/specification/authentication
+            const fromAuthHeader = authorizationHeader && !Array.isArray(authorizationHeader)
+                ? authorizationHeader
+                : undefined;
+            const fromCookie = authCookie && !Array.isArray(authCookie)
+                ? authCookie
+                : undefined;
             switch (authType) {
                 case 'apiKey':
-                    if (authorizationHeader &&
-                        !Array.isArray(authorizationHeader)) {
+                    if (fromAuthHeader) {
                         output.auth =
                             await this.privateApiKeyAuthenticationChecker.exec({
-                                rawValue: authorizationHeader,
+                                rawValue: fromAuthHeader,
                             });
                     }
                     break;
                 case 'basic':
-                    if (authorizationHeader &&
-                        !Array.isArray(authorizationHeader)) {
+                    if (fromAuthHeader) {
                         output.auth =
                             await this.basicAuthenticationChecker.exec({
-                                rawValue: authorizationHeader,
+                                rawValue: fromAuthHeader,
                             });
                     }
                     break;
                 case 'jwt':
-                    if (authCookie && !Array.isArray(authCookie)) {
+                    if (fromCookie || fromAuthHeader) {
                         output.auth = await this.jwtAuthenticationChecker.exec({
-                            rawValue: authCookie,
+                            rawValue: fromCookie ?? fromAuthHeader,
                         });
                     }
                     break;

package/dist/esm/target/lib/server/JWTAuthenticationChecker.d.ts

@@ -9,6 +9,7 @@ export declare class JWTAuthenticationChecker implements Configurable<S>, Worker
     private jwtManager;
     private logger;
     private settingsManager;
+    private static PREFIXES;
     constructor(jwtManager: JWTManager, logger: Logger, settingsManager: SettingsManager<S>);
     s(): S;
     exec({ rawValue }: Input): Promise<Output | null>;

package/dist/esm/target/lib/server/JWTAuthenticationChecker.js

@@ -10,12 +10,18 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
+var JWTAuthenticationChecker_1;
 import { inject, injectable } from 'inversify';
 import { UnauthorizedError } from '../../../error/index.js';
 let JWTAuthenticationChecker = class JWTAuthenticationChecker {
+    static { JWTAuthenticationChecker_1 = this; }
     jwtManager;
     logger;
     settingsManager;
+    static PREFIXES = [
+        'Bearer',
+        'JWT',
+    ];
     constructor(jwtManager, logger, settingsManager) {
         this.jwtManager = jwtManager;
         this.logger = logger;
@@ -27,7 +33,10 @@ let JWTAuthenticationChecker = class JWTAuthenticationChecker {
         };
     }
     async exec({ rawValue }) {
-        const value = rawValue?.replace('JWT ', '');
+        let value = rawValue;
+        for (const p of JWTAuthenticationChecker_1.PREFIXES) {
+            value = value?.replaceAll(`${p} `, '');
+        }
         if (!value) {
             return null;
         }
@@ -68,7 +77,7 @@ let JWTAuthenticationChecker = class JWTAuthenticationChecker {
         return false;
     }
 };
-JWTAuthenticationChecker = __decorate([
+JWTAuthenticationChecker = JWTAuthenticationChecker_1 = __decorate([
     injectable(),
     __param(0, inject('JWTManager')),
     __param(1, inject('Logger')),

package/dist/esm/target/react-native-pure/UCFormFieldControl.js

@@ -11,7 +11,6 @@ const MULTIPLE_VALUES_SEPARATOR = ',';
 export function UCFormFieldControl({ disabled, errMsg = null, execState, f, onChange: onChangeBase, }) {
     const { colors, formFieldControl, renderFormFieldControl } = useStyleContext();
     const [internalValue, setInternalValue] = useState(f.getValue());
-    // biome-ignore lint/correctness/useExhaustiveDependencies: It is actually necessary because only `f` or `f.getValue` does not trigger the effect
     useEffect(() => {
         setInternalValue(f.getValue());
     }, [f.getValue()]);

package/dist/esm/testing/impl/NodeAppTesterConfigurator.js

@@ -4,6 +4,7 @@ import { FakeFSManager } from '../../std/impl/FakeFSManager.js';
 import { FakeHTTPAPICallExecutor } from '../../std/impl/FakeHTTPAPICallExecutor.js';
 import { NodeDeterministicCryptoManager } from '../../std/impl/NodeDeterministicCryptoManager.js';
 import { SimpleFormDataBuilder } from '../../std/impl/SimpleFormDataBuilder.js';
+import { StaticSettingsManager } from '../../std/impl/StaticSettingsManager.js';
 import { bindCommon } from '../../utils/ioc/bindCommon.js';
 import { bindNodeCore } from '../../utils/ioc/bindNodeCore.js';
 import { bindServer } from '../../utils/ioc/bindServer.js';
@@ -16,6 +17,12 @@ export class NodeAppTesterConfigurator {
         bindCommon(container);
         bindNodeCore(container);
         bindServer(container);
+        // bindCommon binds it to StaticSettingsManager.
+        // But bindNodeCore binds it to EnvSettingsManager.
+        // Tests must be env-agnostic and run with static settings.
+        (await container.rebind('SettingsManager'))
+            .to(StaticSettingsManager)
+            .inSingletonScope();
         (await container.rebind('ProductManifest')).toConstantValue({
             appReg: [{ name: ctx.appManifest.name }],
             name: PRODUCT_NAME_PLACEHOLDER,

package/dist/esm/testing/impl/newNodeAppTester.js

@@ -1,5 +1,6 @@
 import { Container } from 'inversify';
 import { TApiKey, TPassword, TUsername, } from '../../dt/index.js';
+import { StaticSettingsManager } from '../../std/impl/StaticSettingsManager.js';
 import { STD_DEFAULT_JWT_MANAGER_SETTINGS, } from '../../std/index.js';
 import { MCPHTTPExpressFakeRequestHandlerBuilder } from '../../target/lib/mcp-server/http/express/MCPHTTPExpressFakeRequestHandlerBuilder.js';
 import { TARGET_DEFAULT_SERVER_MANAGER_SETTINGS } from '../../target/lib/server/consts.js';
@@ -34,6 +35,12 @@ export async function newNodeAppTester(serverPortRangeStart, idx, args) {
     updateSettings(container, settings);
     bindNodeCore(container);
     bindServer(container);
+    // bindCommon binds it to StaticSettingsManager.
+    // But bindNodeCore binds it to EnvSettingsManager.
+    // Tests must be env-agnostic and run with static settings.
+    (await container.rebind('SettingsManager'))
+        .to(StaticSettingsManager)
+        .inSingletonScope();
     container.bind('AppDocsEmitter').to(SimpleAppDocsEmitter);
     container
         .bind('ServerManager')

package/dist/esm/utils/strings/humanize.js

@@ -1,5 +1,8 @@
 export function humanize(value) {
-    let res = value.replace(/([a-z])([A-Z])/g, '$1 $2').trim();
+    let res = value
+        .replace(/([a-z])([A-Z])/g, '$1 $2')
+        .replace(/([a-z])_([a-z])/g, '$1 $2')
+        .trim();
     res = res.charAt(0).toUpperCase() + res.slice(1);
     return res;
 }

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "libmodulor",
     "description": "A TypeScript library to create platform-agnostic applications",
-    "version": "0.30.0",
+    "version": "0.31.0",
     "license": "LGPL-3.0",
     "author": "Chafik H'nini <chafik.hnini@gmail.com>",
     "homepage": "https://libmodulor.c100k.eu",
@@ -29,6 +29,9 @@
         "./cloudflare-worker-hono": {
             "import": "./dist/esm/index.cloudflare-worker-hono.js"
         },
+        "./instrumentation-otl": {
+            "import": "./dist/esm/index.instrumentation-otl.js"
+        },
         "./locales/de": {
             "import": "./dist/esm/i18n/locales/de.js"
         },
@@ -103,46 +106,59 @@
         "test": "tsc && vitest run"
     },
     "devDependencies": {
-        "@biomejs/biome": "^2.4.15",
+        "@babel/core": "^7.29.7",
+        "@biomejs/biome": "^2.5.2",
+        "@opentelemetry/auto-instrumentations-node": "^0.77.0",
+        "@opentelemetry/exporter-trace-otlp-http": "^0.220.0",
+        "@opentelemetry/resources": "^2.9.0",
+        "@opentelemetry/sdk-node": "^0.220.0",
+        "@opentelemetry/semantic-conventions": "^1.41.1",
         "@react-native-community/slider": "^4.5.7",
-        "@types/react": "^19.2.14",
+        "@types/react": "^19.2.17",
         "@types/react-dom": "^19.2.3",
-        "babel-plugin-parameter-decorator": "^1.0.16",
         "babel-plugin-transform-typescript-metadata": "^0.3.2",
-        "expo": "^55.0.24",
+        "expo": "^57.0.2",
         "expo-document-picker": "^14.0.8",
         "expo-image-picker": "^17.0.11",
-        "react-native-safe-area-context": "^5.7.0",
-        "wrangler": "^4.91.0",
+        "react-native-safe-area-context": "^5.8.0",
+        "wrangler": "^4.107.0",
         "zod": "^4.4.3"
     },
     "peerDependencies": {
         "@hono/node-server": "^1.19.14",
         "@modelcontextprotocol/sdk": "^1.29.0",
-        "@stricli/core": "^1.2.7",
+        "@opentelemetry/api": "^1.9.1",
+        "@opentelemetry/instrumentation": "^0.220.0",
+        "@stricli/core": "^1.2.9",
         "buffer": "^6.0.3",
         "cookie-parser": "^1.4.7",
         "express": "^5.2.1",
         "express-fileupload": "^1.5.2",
         "fast-check": "^4.8.0",
-        "helmet": "^8.1.0",
-        "hono": "^4.12.18",
+        "helmet": "^8.2.0",
+        "hono": "^4.12.28",
         "inversify": "^7.11.0",
         "jose": "^6.2.3",
-        "knex": "^3.2.10",
-        "next": "^15.5.18",
-        "pg": "^8.20.0",
-        "react": "19.2.3",
-        "react-dom": "19.2.3",
-        "react-native": "^0.84.1",
+        "knex": "^3.3.0",
+        "next": "^15.5.20",
+        "pg": "^8.22.0",
+        "react": "^19.2.7",
+        "react-dom": "^19.2.7",
+        "react-native": "^0.86.0",
         "reflect-metadata": "^0.2.2",
         "sqlite3": "^5.1.7",
         "typescript": "^6.0.3",
-        "vite": "^8.0.13",
-        "vitest": "^4.1.6",
+        "vite": "^8.1.3",
+        "vitest": "^4.1.10",
         "zod": "^4.4.3"
     },
     "peerDependenciesMeta": {
+        "@opentelemetry/api": {
+            "optional": true
+        },
+        "@opentelemetry/instrumentation": {
+            "optional": true
+        },
         "@hono/node-server": {
             "optional": true
         },