@daloyjs/core 0.35.0 → 0.35.2

package/dist/banner.d.ts

@@ -37,4 +37,3 @@ export declare function formatStartupBanner(options: StartupBannerOptions): stri
  * replace ad-hoc `console.log("listening on …")` calls in starter templates.
  */
 export declare function printStartupBanner(options: StartupBannerOptions, write?: (s: string) => void): void;
-//# sourceMappingURL=banner.d.ts.map

package/dist/banner.js

@@ -110,4 +110,3 @@ export function formatStartupBanner(options) {
 export function printStartupBanner(options, write = (s) => process.stdout.write(s)) {
     write(`\n${formatStartupBanner(options)}\n\n`);
 }
-//# sourceMappingURL=banner.js.map

package/dist/cli.d.ts

@@ -146,4 +146,3 @@ export declare function runCli(argv: readonly string[], io: CliIO): Promise<CliR
  * @since 0.14.0
  */
 export declare function buildAiDump(app: App, opts: CliOptions): Record<string, unknown>;
-//# sourceMappingURL=cli.d.ts.map

package/dist/cli.js

@@ -848,4 +848,3 @@ function isApp(value) {
         typeof value.introspect === "function" &&
         typeof value.fetch === "function");
 }
-//# sourceMappingURL=cli.js.map

package/dist/client.d.ts

@@ -74,4 +74,3 @@ export interface ClientOptions {
  */
 export declare function createClient<A extends App>(app: A, opts: ClientOptions): ClientFor<A>;
 export {};
-//# sourceMappingURL=client.d.ts.map

package/dist/client.js

@@ -85,4 +85,3 @@ function safeJson(text) {
         return text;
     }
 }
-//# sourceMappingURL=client.js.map

package/dist/combine.d.ts

@@ -94,4 +94,3 @@ export type ExceptPredicate = string | string[] | ((ctx: BaseContext<any, any>)
  * @since 0.19.0
  */
 export declare function except(when: ExceptPredicate, hooks: Hooks): Hooks;
-//# sourceMappingURL=combine.d.ts.map

package/dist/combine.js

@@ -244,4 +244,3 @@ function mergeCombineHooks(layers) {
     }
     return merged;
 }
-//# sourceMappingURL=combine.js.map

package/dist/compression.d.ts

@@ -124,4 +124,3 @@ export declare function _resetCompressionRuntimeProbeForTests(): void;
  * @since 0.25.0
  */
 export declare function compression(opts?: CompressionOptions): Hooks;
-//# sourceMappingURL=compression.d.ts.map

package/dist/compression.js

@@ -365,4 +365,3 @@ export function compression(opts = {}) {
     hooks[COMPRESSION_HOOK_MARKER] = true;
     return hooks;
 }
-//# sourceMappingURL=compression.js.map

package/dist/config.d.ts

@@ -95,4 +95,3 @@ export interface DefineConfigOptions<S extends StandardSchemaV1> {
  * @since 0.20.0
  */
 export declare function defineConfig<S extends StandardSchemaV1>(opts: DefineConfigOptions<S>): Promise<StandardSchemaV1.InferOutput<S>>;
-//# sourceMappingURL=config.d.ts.map

package/dist/config.js

@@ -130,4 +130,3 @@ export async function defineConfig(opts) {
     }
     return result.value;
 }
-//# sourceMappingURL=config.js.map

package/dist/conn-info.d.ts

@@ -118,4 +118,3 @@ export declare function readRemotePort(ctx: BaseContext<any, any>): number | und
 /** @internal Test-only helper. */
 export declare function _makeConnInfoForTests(info: ConnInfo): MutableConnInfo;
 export {};
-//# sourceMappingURL=conn-info.d.ts.map

package/dist/conn-info.js

@@ -142,4 +142,3 @@ export function readRemotePort(ctx) {
 export function _makeConnInfoForTests(info) {
     return { ...info };
 }
-//# sourceMappingURL=conn-info.js.map

package/dist/contract.d.ts

@@ -47,4 +47,3 @@ export interface ContractTestOptions {
  * @returns A {@link ContractReport}. In CI, exit non-zero when `report.ok` is `false`.
  */
 export declare function runContractTests(app: App, opts?: ContractTestOptions): Promise<ContractReport>;
-//# sourceMappingURL=contract.d.ts.map

package/dist/contract.js

@@ -133,4 +133,3 @@ export async function runContractTests(app, opts = {}) {
         issues,
     };
 }
-//# sourceMappingURL=contract.js.map

package/dist/cookie.d.ts

@@ -123,4 +123,3 @@ export declare function serializeClearCookie(name: string, attributes?: CookieAt
 export declare function readRequestCookie(header: string | null | undefined, name: string): string | null;
 /** @internal Re-exported for tests. */
 export declare const __COOKIE_FRAMEWORK_PREFIX__ = "daloy.cookie";
-//# sourceMappingURL=cookie.d.ts.map

package/dist/cookie.js

@@ -202,4 +202,3 @@ export function readRequestCookie(header, name) {
 }
 /** @internal Re-exported for tests. */
 export const __COOKIE_FRAMEWORK_PREFIX__ = FRAMEWORK_PREFIX;
-//# sourceMappingURL=cookie.js.map

package/dist/dependency.d.ts

@@ -45,4 +45,3 @@ export interface DependencyHooks extends Hooks {
  * @since 0.24.0
  */
 export declare function defineDependency<TName extends string, TValue, TStateKey extends string = TName>(opts: DependencyOptions<TName, TValue, TStateKey>): DependencyHooks;
-//# sourceMappingURL=dependency.d.ts.map

package/dist/dependency.js

@@ -65,4 +65,3 @@ export function defineDependency(opts) {
     });
     return hooks;
 }
-//# sourceMappingURL=dependency.js.map

package/dist/discriminator.d.ts

@@ -71,4 +71,3 @@ export type DiscriminatedUnion<V extends Record<string, StandardSchemaV1>> = Sta
  */
 export declare function discriminatedUnion<P extends string, V extends Record<string, StandardSchemaV1>>(propertyName: P, variants: V, opts?: DiscriminatedUnionOptions): DiscriminatedUnion<V>;
 export {};
-//# sourceMappingURL=discriminator.d.ts.map

package/dist/discriminator.js

@@ -111,4 +111,3 @@ function variantToJsonSchema(schema) {
     }
     return {};
 }
-//# sourceMappingURL=discriminator.js.map

package/dist/docs.d.ts

@@ -153,4 +153,3 @@ export declare function docsContentSecurityPolicy(opts?: DocsContentSecurityPoli
  * {@link docsContentSecurityPolicy} (or a caller-supplied override).
  */
 export declare function htmlResponse(html: string, opts?: HtmlResponseOptions): Response;
-//# sourceMappingURL=docs.d.ts.map

package/dist/docs.js

@@ -113,4 +113,3 @@ function scalarConfigurationAttr(specUrl, configuration) {
     const { content: _content, fetch: _fetch, plugins: _plugins, sources: _sources, spec: _spec, url: _url, ...uiConfiguration } = configuration;
     return ` data-configuration='${escapeHtml(JSON.stringify({ ...uiConfiguration, url: specUrl }))}'`;
 }
-//# sourceMappingURL=docs.js.map

package/dist/errors.d.ts

@@ -327,4 +327,3 @@ export declare class RequestTimeoutError extends HttpError {
 export declare class InternalError extends HttpError {
     constructor(detail?: string);
 }
-//# sourceMappingURL=errors.d.ts.map

package/dist/errors.js

@@ -202,8 +202,12 @@ export class HttpError extends Error {
         if (opts.requestId)
             out.instance = `urn:request:${opts.requestId}`;
         const headers = new Headers({ "content-type": "application/problem+json" });
-        for (const [name, value] of Object.entries(this.headers ?? {})) {
-            headers.set(name, value);
+        // Skip the Object.entries({}) churn on the common case where the
+        // error was constructed without extra response headers.
+        if (this.headers !== undefined) {
+            for (const [name, value] of Object.entries(this.headers)) {
+                headers.set(name, value);
+            }
         }
         // Merge Context.set.headers (CSRF rotation, session renewal,
         // request-id, secureHeaders output) without overriding headers the
@@ -444,4 +448,3 @@ export class InternalError extends HttpError {
         this.name = "InternalError";
     }
 }
-//# sourceMappingURL=errors.js.map

package/dist/etag.d.ts

@@ -45,4 +45,3 @@ export interface ETagOptions {
  * @since 0.21.0
  */
 export declare function etag(opts?: ETagOptions): Hooks;
-//# sourceMappingURL=etag.d.ts.map

package/dist/etag.js

@@ -114,4 +114,3 @@ export function etag(opts = {}) {
         },
     };
 }
-//# sourceMappingURL=etag.js.map

package/dist/fetch-guard.d.ts

@@ -205,4 +205,3 @@ export interface FetchGuardOptions {
  * @since 0.34.0
  */
 export declare function fetchGuard(options?: FetchGuardOptions): typeof fetch;
-//# sourceMappingURL=fetch-guard.d.ts.map

package/dist/fetch-guard.js

@@ -328,4 +328,3 @@ function createDefaultResolver() {
         return results.map((r) => r.address);
     };
 }
-//# sourceMappingURL=fetch-guard.js.map

package/dist/hashing.d.ts

@@ -56,4 +56,3 @@ export declare function passwordHash(password: string): Promise<string>;
  * @since 0.15.0
  */
 export declare function passwordVerify(password: string, storedHash: string): Promise<boolean>;
-//# sourceMappingURL=hashing.d.ts.map

package/dist/hashing.js

@@ -151,4 +151,3 @@ export async function passwordVerify(password, storedHash) {
         return false;
     return nodeTimingSafeEqual(derived, parsed.hash);
 }
-//# sourceMappingURL=hashing.js.map

package/dist/index.d.ts

@@ -63,4 +63,3 @@ export { otelTracing, TRACING_SPAN_KIND_SERVER, TRACING_SPAN_STATUS_UNSET, TRACI
 export type { OtelTracingOptions, TracingAttributes, TracingAttributeValue, TracingSpan, TracingStartSpanOptions, TracingTracer, } from "./tracing.js";
 export { defineWebSocket, WebSocketRegistry, WebSocketProtocolError, WebSocketPayloadTooLargeError, WS_GUID, WS_READY_STATE, WS_OPCODE, WS_CLOSE_CODE, WS_MAX_CONTROL_PAYLOAD, DEFAULT_WS_BACKPRESSURE_LIMIT, DEFAULT_WS_MAX_PAYLOAD_LENGTH, DEFAULT_WS_IDLE_TIMEOUT_SECONDS, computeAcceptKey, parseSubprotocols, validateSelectedSubprotocol, validateUpgrade, checkWebSocketOrigin, parseFrame, encodeFrame, encodeClosePayload, decodeClosePayload, encodeSendPayload, normalizeWebSocketOptions, wsRateLimit, FrameSink, FRAME_INCOMPLETE, } from "./websocket.js";
 export type { WebSocketConnection, WebSocketContext, WebSocketHandler, WebSocketRouteEntry, NormalizedWebSocketOptions, WebSocketBeforeUpgrade, HandshakeResult, ParsedFrame, MessageEvent as WebSocketMessageEvent, FrameSinkEvents, } from "./websocket.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -31,4 +31,3 @@ export { session, rotateSession, signValue, verifySignedValue, MemorySessionStor
 export { fileField, multipartObject, isFileFieldSchema, isMultipartObjectSchema, } from "./multipart.js";
 export { otelTracing, TRACING_SPAN_KIND_SERVER, TRACING_SPAN_STATUS_UNSET, TRACING_SPAN_STATUS_OK, TRACING_SPAN_STATUS_ERROR, } from "./tracing.js";
 export { defineWebSocket, WebSocketRegistry, WebSocketProtocolError, WebSocketPayloadTooLargeError, WS_GUID, WS_READY_STATE, WS_OPCODE, WS_CLOSE_CODE, WS_MAX_CONTROL_PAYLOAD, DEFAULT_WS_BACKPRESSURE_LIMIT, DEFAULT_WS_MAX_PAYLOAD_LENGTH, DEFAULT_WS_IDLE_TIMEOUT_SECONDS, computeAcceptKey, parseSubprotocols, validateSelectedSubprotocol, validateUpgrade, checkWebSocketOrigin, parseFrame, encodeFrame, encodeClosePayload, decodeClosePayload, encodeSendPayload, normalizeWebSocketOptions, wsRateLimit, FrameSink, FRAME_INCOMPLETE, } from "./websocket.js";
-//# sourceMappingURL=index.js.map

package/dist/ip-restriction.d.ts

@@ -89,4 +89,3 @@ export declare function matchesMatcher(ip: ParsedIp, m: IpMatcher): boolean;
 export declare function compileCidrMatcher(input: string): IpMatcher;
 /** @internal */
 export declare function parseIp(input: string): ParsedIp | undefined;
-//# sourceMappingURL=ip-restriction.d.ts.map

package/dist/ip-restriction.js

@@ -203,4 +203,3 @@ function parseIPv6(input) {
     }
     return { bytes, family: 6 };
 }
-//# sourceMappingURL=ip-restriction.js.map

package/dist/jwk.d.ts

@@ -79,4 +79,3 @@ export interface JwkOptions {
  * @since 0.22.0
  */
 export declare function jwk(opts: JwkOptions): Hooks;
-//# sourceMappingURL=jwk.d.ts.map

package/dist/jwk.js

@@ -266,4 +266,3 @@ function extractScopes(payload) {
     }
     return out;
 }
-//# sourceMappingURL=jwk.js.map

package/dist/jwt.d.ts

@@ -115,4 +115,3 @@ export declare function createJwtSigner(opts: JwtSignerOptions): {
 export declare function createJwtVerifier(opts: JwtVerifierOptions): {
     verify(token: string): Promise<JwtVerified>;
 };
-//# sourceMappingURL=jwt.d.ts.map

package/dist/jwt.js

@@ -500,4 +500,3 @@ async function verifyInternal(token, r) {
     }
     return { header, payload };
 }
-//# sourceMappingURL=jwt.js.map

package/dist/load-shedding.d.ts

@@ -70,4 +70,3 @@ export declare function loadShedding(opts?: LoadSheddingOptions): Hooks;
  * @internal
  */
 export declare const LOAD_SHEDDING_MARKER: unique symbol;
-//# sourceMappingURL=load-shedding.d.ts.map

package/dist/load-shedding.js

@@ -168,4 +168,3 @@ export function loadShedding(opts = {}) {
  * @internal
  */
 export const LOAD_SHEDDING_MARKER = Symbol.for("daloyjs.loadShedding");
-//# sourceMappingURL=load-shedding.js.map

package/dist/logger.d.ts

@@ -121,4 +121,3 @@ export declare function createLogger(opts?: ConsoleLoggerOptions): Logger;
  */
 export declare const noopLogger: Logger;
 export {};
-//# sourceMappingURL=logger.d.ts.map

package/dist/logger.js

@@ -258,4 +258,3 @@ export const noopLogger = {
         return noopLogger;
     },
 };
-//# sourceMappingURL=logger.js.map

package/dist/middleware.d.ts

@@ -727,4 +727,3 @@ export declare const REQUIRE_SCOPES_HOOK_MARKER: unique symbol;
  */
 export declare function requireScopes(scopes: readonly string[]): Hooks;
 export { timingSafeEqual };
-//# sourceMappingURL=middleware.d.ts.map

package/dist/middleware.js

@@ -223,7 +223,7 @@ export function secureHeaders(opts = {}) {
     const ref = opts.referrerPolicy ?? "no-referrer";
     if (ref !== false)
         headers["referrer-policy"] = ref;
-    const perm = opts.permissionsPolicy ?? "camera=(), microphone=(), geolocation=()";
+    const perm = opts.permissionsPolicy ?? "camera=(), microphone=(), geolocation=(), clipboard-write=()";
     if (perm !== false)
         headers["permissions-policy"] = perm;
     const coop = opts.crossOriginOpenerPolicy ?? "same-origin";
@@ -259,14 +259,16 @@ export function secureHeaders(opts = {}) {
                 .join(", ");
         }
     }
-    const hooks = {
-        beforeHandle(ctx) {
-            if (cspIsDynamic && cspOpt.nonce) {
+    const headerEntries = Object.entries(headers);
+    const hooks = {};
+    if (cspIsDynamic) {
+        hooks.beforeHandle = (ctx) => {
+            if (cspOpt.nonce) {
                 ctx.state[CSP_NONCE_STATE] = generateCspNonce();
             }
-        },
-        onSend(res, ctx) {
-            if (cspIsDynamic && !res.headers.has("content-security-policy")) {
+        };
+        hooks.onSend = (res, ctx) => {
+            if (!res.headers.has("content-security-policy")) {
                 const nonce = ctx
                     ? ctx.state[CSP_NONCE_STATE]
                     : undefined;
@@ -275,14 +277,16 @@ export function secureHeaders(opts = {}) {
                     res.headers.set("content-security-policy", header);
             }
             return undefined;
-        },
-        onResponse(res) {
-            for (const [k, v] of Object.entries(headers)) {
+        };
+    }
+    if (headerEntries.length > 0) {
+        hooks.onResponse = (res) => {
+            for (const [k, v] of headerEntries) {
                 if (!res.headers.has(k))
                     res.headers.set(k, v);
             }
-        },
-    };
+        };
+    }
     hooks[SECURE_HEADERS_MARKER] = true;
     return hooks;
 }
@@ -1248,4 +1252,3 @@ export function requireScopes(scopes) {
     return hooks;
 }
 export { timingSafeEqual };
-//# sourceMappingURL=middleware.js.map

package/dist/multipart.d.ts

@@ -166,4 +166,3 @@ export declare function getMultipartShape(s: unknown): {
 /** Internal: read the file-field options used for OpenAPI documentation. */
 export declare function getFileFieldOptions(s: unknown): (Required<Pick<FileFieldOptions, "format">> & FileFieldOptions) | undefined;
 export {};
-//# sourceMappingURL=multipart.d.ts.map

package/dist/multipart.js

@@ -384,4 +384,3 @@ export function getFileFieldOptions(s) {
         return undefined;
     return s[FILE_FIELD_MARKER];
 }
-//# sourceMappingURL=multipart.js.map

package/dist/openapi.d.ts

@@ -125,4 +125,3 @@ export declare function generateOpenAPI(app: App, options: OpenAPIOptions): Reco
  * artifacts. Reads/writes nothing; pure transform.
  */
 export declare function openapiToYAML(doc: Record<string, unknown>): string;
-//# sourceMappingURL=openapi.d.ts.map

package/dist/openapi.js

@@ -498,4 +498,3 @@ export function openapiToYAML(doc) {
     const result = yamlEmit(doc, "");
     return result.startsWith("\n") ? result.slice(1) : result;
 }
-//# sourceMappingURL=openapi.js.map

package/dist/rate-limit-redis.d.ts

@@ -98,4 +98,3 @@ export interface NodeRedisLike {
 }
 /** Wrap a [`node-redis`](https://github.com/redis/node-redis) v4+ client. */
 export declare function nodeRedisAdapter(client: NodeRedisLike): RedisCommands;
-//# sourceMappingURL=rate-limit-redis.d.ts.map

package/dist/rate-limit-redis.js

@@ -114,4 +114,3 @@ export function nodeRedisAdapter(client) {
         },
     };
 }
-//# sourceMappingURL=rate-limit-redis.js.map

package/dist/router.d.ts

@@ -36,4 +36,3 @@ export declare class Router<T> {
     allowedMethods(path: string): HttpMethod[];
     private walk;
 }
-//# sourceMappingURL=router.d.ts.map

package/dist/router.js

@@ -136,4 +136,3 @@ function splitPath(path) {
         return [];
     return clean.replace(/^\//, "").split("/");
 }
-//# sourceMappingURL=router.js.map

package/dist/safe-redirect.d.ts

@@ -38,7 +38,7 @@
  * });
  * ```
  *
- * @since 0.35.0
+ * @since 0.35.2
  */
 /** Reason an open-redirect candidate was refused. */
 export type SafeRedirectBlockReason = "empty-target" | "invalid-control-characters" | "protocol-relative" | "backslash-path" | "path-not-allowed" | "origin-not-allowed" | "scheme-not-allowed" | "parse-failed";
@@ -86,7 +86,6 @@ export interface SafeRedirectOptions {
  * @param target - User-supplied URL candidate (path or absolute URL).
  * @param options - Allowlist + response configuration.
  *
- * @since 0.35.0
+ * @since 0.35.2
  */
 export declare function safeRedirect(target: string, options?: SafeRedirectOptions): Response;
-//# sourceMappingURL=safe-redirect.d.ts.map

package/dist/safe-redirect.js

@@ -38,7 +38,7 @@
  * });
  * ```
  *
- * @since 0.35.0
+ * @since 0.35.2
  */
 /** Thrown when {@link safeRedirect} refuses a candidate URL and no `fallback` is configured. */
 export class OpenRedirectBlockedError extends Error {
@@ -126,7 +126,7 @@ function classify(target, allowedPaths, allowedOrigins) {
  * @param target - User-supplied URL candidate (path or absolute URL).
  * @param options - Allowlist + response configuration.
  *
- * @since 0.35.0
+ * @since 0.35.2
  */
 export function safeRedirect(target, options = {}) {
     const allowedPaths = options.allowedPaths ?? [];
@@ -166,4 +166,3 @@ export function safeRedirect(target, options = {}) {
     }
     throw new OpenRedirectBlockedError(result.reason, target);
 }
-//# sourceMappingURL=safe-redirect.js.map

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:c41e526d-a8c9-5e8a-bef4-4d616a1ee814",
+  "serialNumber": "urn:uuid:1d9fa950-874b-5a89-9b39-98f1bbdfdb30",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-24T23:40:26.023Z",
+    "timestamp": "2026-05-28T07:51:16.251Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "0.35.0"
+        "version": "0.35.2"
       }
     ],
     "authors": [
@@ -19,11 +19,11 @@
     ],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/@daloyjs/core@0.35.0",
+      "bom-ref": "pkg:npm/@daloyjs/core@0.35.2",
       "name": "@daloyjs/core",
-      "version": "0.35.0",
+      "version": "0.35.2",
       "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
-      "purl": "pkg:npm/@daloyjs/core@0.35.0",
+      "purl": "pkg:npm/@daloyjs/core@0.35.2",
       "licenses": [
         {
           "license": {
@@ -46,9 +46,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag--daloyjs-core-0.35.0",
+        "tagId": "swidtag--daloyjs-core-0.35.2",
         "name": "@daloyjs/core",
-        "version": "0.35.0",
+        "version": "0.35.2",
         "tagVersion": 0,
         "patch": false
       }
@@ -57,7 +57,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/@daloyjs/core@0.35.0",
+      "ref": "pkg:npm/@daloyjs/core@0.35.2",
       "dependsOn": []
     }
   ]

package/dist/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@daloyjs/core-0.35.0",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-0.35.0-c41e526d-a8c9-5e8a-bef4-4d616a1ee814",
+  "name": "@daloyjs/core-0.35.2",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-0.35.2-1d9fa950-874b-5a89-9b39-98f1bbdfdb30",
   "creationInfo": {
-    "created": "2026-05-24T23:40:26.023Z",
+    "created": "2026-05-28T07:51:16.251Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package--daloyjs-core",
       "name": "@daloyjs/core",
-      "versionInfo": "0.35.0",
+      "versionInfo": "0.35.2",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/@daloyjs/core@0.35.0"
+          "referenceLocator": "pkg:npm/@daloyjs/core@0.35.2"
         }
       ]
     }

package/dist/schema.d.ts

@@ -73,4 +73,3 @@ export declare function validate<S extends StandardSchemaV1>(schema: S, value: u
  * @since 0.1.0
  */
 export declare function isStandardSchema(x: unknown): x is StandardSchemaV1;
-//# sourceMappingURL=schema.d.ts.map

package/dist/schema.js

@@ -41,4 +41,3 @@ export function isStandardSchema(x) {
         "~standard" in x &&
         typeof x["~standard"]?.validate === "function");
 }
-//# sourceMappingURL=schema.js.map

package/dist/security-schemes.d.ts

@@ -210,4 +210,3 @@ export declare function oauth2Scheme(options: OAuth2SchemeOptions): OAuth2Scheme
  * @since 0.1.0
  */
 export declare function openIdConnectScheme(options: OpenIdConnectSchemeOptions): OpenIdConnectScheme;
-//# sourceMappingURL=security-schemes.d.ts.map

package/dist/security-schemes.js

@@ -177,4 +177,3 @@ export function openIdConnectScheme(options) {
         scheme.description = options.description;
     return markRequirePayloadAuth(scheme, options);
 }
-//# sourceMappingURL=security-schemes.js.map

package/dist/security.d.ts

@@ -85,21 +85,6 @@ export declare function sanitizeHeaderValue(value: string): string;
  * @since 0.1.0
  */
 export declare function timingSafeEqual(a: string, b: string): boolean;
-/**
- * Generate a cryptographically strong, URL-safe identifier (~22 chars).
- *
- * Uses Web Crypto's `crypto.randomUUID()` when available, falling back to
- * 16 random bytes via `crypto.getRandomValues()`. The last-resort fallback
- * (timestamp + `Math.random()`) only triggers in environments without
- * WebCrypto, which is none of Node 20+/Bun/Deno/Cloudflare Workers/Vercel
- * Edge.
- *
- * Suitable for request ids, session ids, and short-lived correlation tokens.
- * Do not use for long-lived secrets unless you also sign or wrap them.
- *
- * @returns A random URL-safe id string.
- * @since 0.1.0
- */
 export declare function randomId(): string;
 /**
  * Header names that MUST appear at most once on a request per RFC 7230.
@@ -388,4 +373,3 @@ export declare function hasMongoOperatorKeys(value: unknown): boolean;
  * @since 0.35.0
  */
 export declare function assertNoMongoOperators(value: unknown): void;
-//# sourceMappingURL=security.d.ts.map