@daloyjs/core 0.34.2 → 0.34.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/README.md +3 -3
  2. package/dist/sbom.cdx.json +9 -9
  3. package/dist/sbom.spdx.json +5 -5
  4. package/package.json +1 -1
package/README.md CHANGED
@@ -32,7 +32,7 @@ DaloyJS exists to be the framework you'd build if you took the best ideas from e
32
32
  | Mature **Swagger / docs / ops** in Node | [Fastify](https://fastify.dev/docs/latest/Reference/) | Encapsulated plugins, structured logger, graceful shutdown, request ids, hooks. |
33
33
  | Modern **TS-first DX**, Bun acceptable | [Elysia](https://elysiajs.com/at-glance.html) | End-to-end typed handlers, typed context, typed client. |
34
34
  | Best-in-class **typed client codegen** for any consumer | [Hey API](https://heyapi.dev/openapi-ts/get-started) | One command (`pnpm gen`) emits a fully-typed fetch SDK from your spec. |
35
- | **Supply-chain-hardened installs and publishing** | [pnpm](https://pnpm.io/motivation) + hardened CI/CD | `ignore-scripts`, release-age cooldown, explicit build allowlist, SHA-pinned actions, isolated OIDC publish with provenance. |
35
+ | **Portable supply-chain hardening for the apps you build** | [pnpm](https://pnpm.io/motivation) defaults + a zero-runtime-dep core | Hardened `.npmrc` (`ignore-scripts`, 24h release-age cooldown, explicit build allowlist), source-verified lockfiles, zero runtime deps, CycloneDX + SPDX SBOM, and an opt-in hardened GitHub Actions bundle for teams that ship on GitHub. |
36
36
 
37
37
  ```
38
38
  framework test suite passing · ≥90% line + function coverage / ≥90% branch coverage · typechecks on TypeScript 6 with `strict: true`
@@ -318,9 +318,9 @@ deployment.
318
318
  | **Method confusion** | Real **405** with `Allow` header, not a misleading 404. |
319
319
  | **CORS misconfig** | First-party `cors()` requires an explicit allowlist and throws for `*` with credentials. |
320
320
  | **Request correlation** | First-party `requestId()` uses cryptographic ids; scaffolded apps enable it. |
321
- | **Supply chain** | pnpm `ignore-scripts=true`, `minimum-release-age=1440`, verified store, reproducible lockfile, lockfile source verification, provenance publishing, and CI/CD hardening against cache poisoning and OIDC token abuse. |
321
+ | **Supply chain (portable)** | pnpm `ignore-scripts=true`, `minimum-release-age=1440`, verified store, reproducible lockfile, `pnpm verify:lockfile` source verification, and a zero-runtime-dependency `@daloyjs/core` published with CycloneDX + SPDX SBOM and npm provenance you can verify on install — regardless of where you host your repo. |
322
322
 
323
- The publish pipeline is also hardened: no `pull_request_target`, no GitHub Actions cache in CI, top-level `permissions: {}`, `step-security/harden-runner`, a separate protected `release.yml` workflow, npm trusted publishing with `--provenance`, CodeQL, OpenSSF Scorecard, zizmor workflow linting, Dependabot, and CODEOWNERS on workflow/package files. See [SECURITY.md](SECURITY.md) and the [supply-chain security docs](https://daloyjs.dev/docs/security/supply-chain).
323
+ **Portable vs. GitHub-only.** The protections in the table above ship to every project you scaffold with `create-daloy`, no matter which CI host you use — GitLab, Bitbucket, Azure DevOps, Jenkins, on-prem, or laptop. The `@daloyjs/core` package you install carries its own SBOM and npm provenance, so an install in *any* environment can be verified end-to-end. The **`@daloyjs/core` release pipeline itself** is separately hardened on GitHub Actions — no `pull_request_target`, no Actions cache, top-level `permissions: {}`, `step-security/harden-runner`, a protected `release.yml`, npm trusted publishing with `--provenance`, CodeQL, OpenSSF Scorecard, zizmor, Dependabot, and CODEOWNERS — and `create-daloy --with-ci` ships that same posture as an **optional GitHub Actions bundle** for teams on GitHub. See [SECURITY.md](SECURITY.md) and the [supply-chain security docs](https://daloyjs.dev/docs/security/supply-chain).
324
324
 
325
325
  ---
326
326
 
package/dist/sbom.cdx.json CHANGED
@@ -1,15 +1,15 @@
1
1
  {
2
2
  "bomFormat": "CycloneDX",
3
3
  "specVersion": "1.5",
4
- "serialNumber": "urn:uuid:84b20929-3d10-58e2-9e87-0279dac97e10",
4
+ "serialNumber": "urn:uuid:83195aa9-d821-5a41-9fbb-6c69378e250d",
5
5
  "version": 1,
6
6
  "metadata": {
7
- "timestamp": "2026-05-23T09:06:35.455Z",
7
+ "timestamp": "2026-05-23T13:34:50.159Z",
8
8
  "tools": [
9
9
  {
10
10
  "vendor": "DaloyJS",
11
11
  "name": "daloy-generate-sbom",
12
- "version": "0.34.2"
12
+ "version": "0.34.3"
13
13
  }
14
14
  ],
15
15
  "authors": [
@@ -19,11 +19,11 @@
19
19
  ],
20
20
  "component": {
21
21
  "type": "library",
22
- "bom-ref": "pkg:npm/@daloyjs/core@0.34.2",
22
+ "bom-ref": "pkg:npm/@daloyjs/core@0.34.3",
23
23
  "name": "@daloyjs/core",
24
- "version": "0.34.2",
24
+ "version": "0.34.3",
25
25
  "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
26
- "purl": "pkg:npm/@daloyjs/core@0.34.2",
26
+ "purl": "pkg:npm/@daloyjs/core@0.34.3",
27
27
  "licenses": [
28
28
  {
29
29
  "license": {
@@ -42,9 +42,9 @@
42
42
  }
43
43
  ],
44
44
  "swid": {
45
- "tagId": "swidtag--daloyjs-core-0.34.2",
45
+ "tagId": "swidtag--daloyjs-core-0.34.3",
46
46
  "name": "@daloyjs/core",
47
- "version": "0.34.2",
47
+ "version": "0.34.3",
48
48
  "tagVersion": 0,
49
49
  "patch": false
50
50
  }
@@ -53,7 +53,7 @@
53
53
  "components": [],
54
54
  "dependencies": [
55
55
  {
56
- "ref": "pkg:npm/@daloyjs/core@0.34.2",
56
+ "ref": "pkg:npm/@daloyjs/core@0.34.3",
57
57
  "dependsOn": []
58
58
  }
59
59
  ]
package/dist/sbom.spdx.json CHANGED
@@ -2,10 +2,10 @@
2
2
  "spdxVersion": "SPDX-2.3",
3
3
  "dataLicense": "CC0-1.0",
4
4
  "SPDXID": "SPDXRef-DOCUMENT",
5
- "name": "@daloyjs/core-0.34.2",
6
- "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-0.34.2-84b20929-3d10-58e2-9e87-0279dac97e10",
5
+ "name": "@daloyjs/core-0.34.3",
6
+ "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-0.34.3-83195aa9-d821-5a41-9fbb-6c69378e250d",
7
7
  "creationInfo": {
8
- "created": "2026-05-23T09:06:35.455Z",
8
+ "created": "2026-05-23T13:34:50.159Z",
9
9
  "creators": [
10
10
  "Tool: daloy-generate-sbom",
11
11
  "Organization: DaloyJS"
@@ -16,7 +16,7 @@
16
16
  {
17
17
  "SPDXID": "SPDXRef-Package--daloyjs-core",
18
18
  "name": "@daloyjs/core",
19
- "versionInfo": "0.34.2",
19
+ "versionInfo": "0.34.3",
20
20
  "downloadLocation": "https://github.com/daloyjs/daloy",
21
21
  "filesAnalyzed": false,
22
22
  "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
27
27
  {
28
28
  "referenceCategory": "PACKAGE-MANAGER",
29
29
  "referenceType": "purl",
30
- "referenceLocator": "pkg:npm/@daloyjs/core@0.34.2"
30
+ "referenceLocator": "pkg:npm/@daloyjs/core@0.34.3"
31
31
  }
32
32
  ]
33
33
  }
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@daloyjs/core",
3
- "version": "0.34.2",
3
+ "version": "0.34.3",
4
4
  "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
5
5
  "type": "module",
6
6
  "publishConfig": {