v1.2.0

v1.2.0 (2026-09-27)

Changed

• Engine floor raised to guard-core-php ^4.2.0, the parity release. The 4.1.0 family tags were a version-accuracy error and were yanked/unpublished, so the published ^4.1.0 constraint of v1.1.0 does not resolve publicly; 1.2.0 floors rennf93/guard-core-php to ^4.2.0 and picks up the 4.2.0 engine train: the on_block hook payloads now carry the reference log-format reasons, route-level IP rules (RouteConfig ipWhitelist/ipBlacklist/blockedCountries/whitelistCountries) are enforced, and the spec 4.1.0 corpus runs with an empty divergence registry (219 cases, pipeline gate 35 passed / 0 failed / 0 xfail). The CI engine checkout stamps the mounted sibling path checkout at 4.2.99 so the floor resolves against the engine master while keeping the published constraint ^4.2.0.

Added

• Parity pass-through surface. GuardMiddleware now finishes pass-through responses the way the reference response factory does: the engine's security headers (securityHeaders) and CORS verdict headers (enableCors, corsAllow*) are merged onto the handler's response, and the engine's behavioral return rules observe the response status plus a body prefix bounded by behavior_max_response_body_inspect_bytes (captured from the PSR-7 stream only while behavior_scan_response_body is on, stream rewound afterwards when seekable), so globalBehaviorRules and route behaviorRules with return_pattern rules act on what the application actually served.
• Per-route configuration. The middleware takes routes (path pattern to RouteConfig, exact or trailing-slash prefix match) and an optional routeResolver closure receiving the raw PSR-7 server request, attaching per-route behavior rules, detection exclusions, rate-limit tiers and check bypasses to the engine's request state.
• Geo rate-limit resolver. A geoRateLimitResolver option injects the country resolver that powers RouteConfig geoRateLimits tiers; when absent, the middleware bridges the engine config's geo_ip_handler (kept by the engine only when country lists are configured).
• Reachability tests for every new surface in bin/test_psr15.php (108 checks green) and pass-through/route/geo documentation in the README and docs/configuration.md.