v0.13.0 - Scope

The "Scope" release: Elysia analysis. In Elysia, a hook is local to the plugin that registers it unless it says { as: 'scoped' } or { as: 'global' }, and it applies only to routes registered after it. An auth plugin that forgets the scope, or a route registered one line too early, leaves a route open while the code looks protected. CodeDiag now models both.

npx @sabahattink/codediag scan .

Highlights

• Routes followed through plugins. Routes on new Elysia() instances are traced through prefix, group(), guard(), and use() across files, functional plugins and tsconfig path aliases included, and replayed in registration order.
• Auth where Elysia runs it. onBeforeHandle(), a derive() or resolve() that rejects with 401 or 403, guard(), auth macros such as better-auth's { auth: true }, onRequest(), or a check in the handler. A derive() that only adds user to the context does not count.
• The hook that did not reach. When an auth hook exists but stays local to its plugin, or comes after the route, the finding names the hook and its line.
• Body validation from TypeBox, Zod, or any Standard Schema in the route options or a guard(), only for handlers that actually read the body.
• "Routes not analyzed." On a Koa, Hapi, Nuxt, Astro, or other server CodeDiag has no analyzer for, the report says so instead of showing no route findings.

Checked against db-studio, ConvertX, ohmyblog, and two Elysia starters. Suggested by a reader on Indie Hackers. See the changelog.