@daloyjs/core 0.35.2 → 0.37.0

package/dist/response-cache.js

@@ -0,0 +1,374 @@
+/**
+ * Server-side response caching for DaloyJS.
+ *
+ * The {@link responseCache} middleware stores rendered response bodies in a
+ * pluggable backend and replays them for subsequent matching requests, so a
+ * hot read endpoint can skip the handler (and its database / upstream calls)
+ * entirely while a cached representation is fresh. It complements — and does
+ * not overlap with — the two caching-adjacent helpers DaloyJS already ships:
+ *
+ * - `etag()` answers conditional `GET`s with `304 Not Modified` but still runs
+ *   the handler to produce the body it hashes.
+ * - `compression()` shrinks the bytes on the wire but caches nothing.
+ *
+ * `responseCache()` is the missing third piece: it caches the **body** so the
+ * handler is not invoked at all on a fresh hit.
+ *
+ * Highlights:
+ *
+ * - **`Cache-Control` orchestration.** Freshness is derived from the response's
+ *   own `Cache-Control` (`s-maxage` wins over `max-age`) when present, falling
+ *   back to the configured `ttlSeconds`. Responses marked `no-store` /
+ *   `private` / `no-cache`, or carrying `Set-Cookie`, are never cached.
+ * - **Request directives.** `Cache-Control: no-store` on the request bypasses
+ *   the cache completely; `no-cache` bypasses the read but still refreshes the
+ *   stored entry (the same directive the background SWR refresh uses, which
+ *   makes revalidation recursion-safe).
+ * - **stale-while-revalidate.** With `staleWhileRevalidateSeconds` plus a
+ *   `revalidate` callback (typically wired to `app.fetch`), a stale-but-recent
+ *   entry is served immediately (marked `X-Cache: STALE`) while a single,
+ *   de-duplicated background refresh repopulates the cache.
+ * - **Pluggable store.** {@link ResponseCacheStore} mirrors `SessionStore` /
+ *   the rate-limit store, with an in-memory {@link MemoryResponseCacheStore}
+ *   default; supply a shared backend (e.g. Redis) for multi-instance fleets.
+ *
+ * This module is dependency-free and uses only Web Standard
+ * `Request`/`Response` + `Headers`, so it runs unchanged on Node, Bun, Deno,
+ * Cloudflare Workers, and Vercel Edge.
+ *
+ * @module
+ * @since 0.37.0
+ */
+/** Internal `ctx.state` key carrying the pending cache key between hooks. */
+const PENDING_STATE_KEY = "__responseCachePending";
+/**
+ * Process-wide registry of in-memory stores shared by
+ * {@link ResponseCacheOptions.groupId}.
+ *
+ * @internal
+ */
+const SHARED_RESPONSE_CACHE_STORES = new Map();
+/**
+ * Test-only helper that clears the process-wide shared stores used by
+ * `responseCache({ groupId })`. Not part of the documented public API.
+ *
+ * @internal
+ */
+export function _resetSharedResponseCacheStoresForTests() {
+    SHARED_RESPONSE_CACHE_STORES.clear();
+}
+// ---------- Default store ----------
+/**
+ * In-memory {@link ResponseCacheStore}. Suitable for tests and single-process
+ * deployments. Expired entries are dropped on access; the map is
+ * opportunistically pruned so it cannot grow without bound.
+ */
+export class MemoryResponseCacheStore {
+    map = new Map();
+    /** @inheritDoc */
+    get(key) {
+        const entry = this.map.get(key);
+        if (!entry)
+            return null;
+        if (entry.staleUntil <= Date.now()) {
+            this.map.delete(key);
+            return null;
+        }
+        return entry;
+    }
+    /** @inheritDoc */
+    set(key, entry) {
+        this.map.set(key, entry);
+        if (this.map.size > 10_000)
+            this.prune();
+    }
+    /** @inheritDoc */
+    delete(key) {
+        this.map.delete(key);
+    }
+    prune() {
+        const now = Date.now();
+        for (const [k, v] of this.map) {
+            if (v.staleUntil <= now)
+                this.map.delete(k);
+        }
+    }
+    /** Test helper. Remove every entry. */
+    clear() {
+        this.map.clear();
+    }
+    /** Test helper. Number of stored entries (including expired). */
+    size() {
+        return this.map.size;
+    }
+}
+function bytesToBase64(bytes) {
+    let bin = "";
+    const CHUNK = 0x8000;
+    for (let i = 0; i < bytes.length; i += CHUNK) {
+        bin += String.fromCharCode(...bytes.subarray(i, i + CHUNK));
+    }
+    return btoa(bin);
+}
+function base64ToBytes(b64) {
+    const bin = atob(b64);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        out[i] = bin.charCodeAt(i);
+    return out;
+}
+/** Parse a `Cache-Control` header into a lower-cased directive map. */
+function parseCacheControl(value) {
+    const out = new Map();
+    if (!value)
+        return out;
+    for (const part of value.split(",")) {
+        const token = part.trim();
+        if (token.length === 0)
+            continue;
+        const eq = token.indexOf("=");
+        if (eq === -1) {
+            out.set(token.toLowerCase(), "");
+        }
+        else {
+            out.set(token.slice(0, eq).trim().toLowerCase(), token.slice(eq + 1).trim());
+        }
+    }
+    return out;
+}
+function parseSeconds(raw) {
+    if (raw === undefined || raw === "")
+        return null;
+    const n = Number(raw.replace(/^"|"$/g, ""));
+    return Number.isFinite(n) && n >= 0 ? Math.floor(n) : null;
+}
+/**
+ * Decide whether a freshly produced response may be cached and, if so, its
+ * freshness lifetime override (ms) from `Cache-Control`. Returns `null` when
+ * the response must not be cached.
+ */
+function freshnessFromResponse(res) {
+    if (res.headers.has("set-cookie"))
+        return null;
+    const cc = parseCacheControl(res.headers.get("cache-control"));
+    if (cc.has("no-store") || cc.has("private") || cc.has("no-cache"))
+        return null;
+    const sMaxAge = parseSeconds(cc.get("s-maxage"));
+    if (sMaxAge !== null)
+        return sMaxAge * 1_000;
+    const maxAge = parseSeconds(cc.get("max-age"));
+    if (maxAge !== null)
+        return maxAge * 1_000;
+    // No explicit directive: fall back to the configured ttl (undefined marker).
+    return undefined;
+}
+function defaultKey(ctx, varyHeaders) {
+    const url = new URL(ctx.request.url);
+    let key = `${ctx.request.method} ${url.pathname}${url.search}`;
+    for (const name of varyHeaders) {
+        key += `\n${name}: ${ctx.request.headers.get(name) ?? ""}`;
+    }
+    return key;
+}
+function buildResponseFromCache(entry, outcome, statusHeaderName, isHead) {
+    const headers = new Headers();
+    for (const [name, value] of entry.headers)
+        headers.set(name, value);
+    const ageSeconds = Math.max(0, Math.floor((Date.now() - entry.storedAt) / 1_000));
+    headers.set("age", String(ageSeconds));
+    if (statusHeaderName)
+        headers.set(statusHeaderName, outcome);
+    const body = isHead || entry.body === "" ? null : base64ToBytes(entry.body);
+    return new Response(body, { status: entry.status, headers });
+}
+function isPromiseLike(value) {
+    return (value !== null &&
+        (typeof value === "object" || typeof value === "function") &&
+        typeof value.then === "function");
+}
+// ---------- Middleware ----------
+/**
+ * Server-side response cache middleware. Mount it ahead of the read endpoints
+ * whose rendered bodies are safe to reuse for a short window.
+ *
+ * Behavior for an eligible method (see {@link ResponseCacheOptions.methods}):
+ *
+ * - **Fresh hit** → the stored response is served and the handler does not run
+ *   (`X-Cache: HIT`, plus an `Age` header).
+ * - **Stale hit within the SWR window** (requires
+ *   {@link ResponseCacheOptions.revalidate}) → the stale response is served
+ *   immediately (`X-Cache: STALE`) while a single background refresh runs.
+ * - **Miss** → the handler runs; a cacheable response is stored
+ *   (`X-Cache: MISS`).
+ *
+ * Request `Cache-Control: no-store` bypasses the cache entirely; `no-cache`
+ * bypasses the read but still refreshes the stored entry. Responses marked
+ * `no-store` / `private` / `no-cache`, carrying `Set-Cookie`, failing
+ * {@link ResponseCacheOptions.cacheableStatus}, or larger than
+ * {@link ResponseCacheOptions.maxBodyBytes} are never cached.
+ *
+ * @example
+ * ```ts
+ * import { App, responseCache } from "@daloyjs/core";
+ *
+ * const app = new App();
+ * app.use(responseCache({ ttlSeconds: 30 }));
+ *
+ * // stale-while-revalidate, wired to the app itself:
+ * app.use(
+ *   responseCache({
+ *     ttlSeconds: 30,
+ *     staleWhileRevalidateSeconds: 300,
+ *     revalidate: (req) => app.fetch(req),
+ *   }),
+ * );
+ * ```
+ *
+ * @param opts - Response-cache configuration.
+ * @returns A {@link Hooks} bundle ready for `app.use(...)`.
+ * @since 0.37.0
+ */
+export function responseCache(opts = {}) {
+    const ttlSeconds = opts.ttlSeconds ?? 60;
+    if (!Number.isInteger(ttlSeconds) || ttlSeconds <= 0) {
+        throw new Error("responseCache(): ttlSeconds must be a positive integer.");
+    }
+    const swrSeconds = opts.staleWhileRevalidateSeconds ?? 0;
+    if (!Number.isInteger(swrSeconds) || swrSeconds < 0) {
+        throw new Error("responseCache(): staleWhileRevalidateSeconds must be a non-negative integer.");
+    }
+    if (swrSeconds > 0 && typeof opts.revalidate !== "function") {
+        throw new Error("responseCache(): staleWhileRevalidateSeconds requires a revalidate callback (e.g. (req) => app.fetch(req)).");
+    }
+    const maxBodyBytes = opts.maxBodyBytes ?? 1_048_576;
+    if (!Number.isInteger(maxBodyBytes) || maxBodyBytes <= 0) {
+        throw new Error("responseCache(): maxBodyBytes must be a positive integer.");
+    }
+    const methods = new Set((opts.methods ?? ["GET", "HEAD"]).map((m) => m.toUpperCase()));
+    const cacheableStatus = opts.cacheableStatus ?? ((status) => status === 200);
+    const varyHeaders = (opts.varyHeaders ?? []).map((h) => h.toLowerCase());
+    const statusHeaderName = opts.statusHeaderName === null ? null : (opts.statusHeaderName ?? "x-cache").toLowerCase();
+    const ttlMs = ttlSeconds * 1_000;
+    const swrMs = swrSeconds * 1_000;
+    const revalidate = opts.revalidate;
+    let store;
+    if (opts.store) {
+        store = opts.store;
+    }
+    else if (opts.groupId) {
+        let shared = SHARED_RESPONSE_CACHE_STORES.get(opts.groupId);
+        if (!shared) {
+            shared = new MemoryResponseCacheStore();
+            SHARED_RESPONSE_CACHE_STORES.set(opts.groupId, shared);
+        }
+        store = shared;
+    }
+    else {
+        store = new MemoryResponseCacheStore();
+    }
+    const keyPrefix = opts.groupId ? `${opts.groupId}:` : "";
+    // De-duplicate concurrent background refreshes per key.
+    const refreshing = new Set();
+    function backgroundRefresh(key, request) {
+        if (!revalidate || refreshing.has(key))
+            return;
+        refreshing.add(key);
+        const refreshReq = new Request(request.url, {
+            method: request.method,
+            headers: new Headers(request.headers),
+        });
+        // Force a read-bypass so the refresh re-runs the handler and re-stores.
+        refreshReq.headers.set("cache-control", "no-cache");
+        void Promise.resolve()
+            .then(() => revalidate(refreshReq))
+            .catch(() => undefined)
+            .finally(() => refreshing.delete(key));
+    }
+    return {
+        async beforeHandle(ctx) {
+            const method = ctx.request.method.toUpperCase();
+            if (!methods.has(method))
+                return undefined;
+            const reqCc = parseCacheControl(ctx.request.headers.get("cache-control"));
+            if (reqCc.has("no-store"))
+                return undefined;
+            const rawKey = opts.keyGenerator
+                ? opts.keyGenerator(ctx)
+                : defaultKey(ctx, varyHeaders);
+            if (rawKey === null)
+                return undefined;
+            const key = `${keyPrefix}${rawKey}`;
+            // `no-cache` bypasses the read but still allows a fresh write below.
+            const bypassRead = reqCc.has("no-cache");
+            if (!bypassRead) {
+                const getResult = store.get(key);
+                const entry = isPromiseLike(getResult) ? await getResult : getResult;
+                if (entry) {
+                    const now = Date.now();
+                    if (now < entry.freshUntil) {
+                        return buildResponseFromCache(entry, "HIT", statusHeaderName, method === "HEAD");
+                    }
+                    if (revalidate && now < entry.staleUntil) {
+                        backgroundRefresh(key, ctx.request);
+                        return buildResponseFromCache(entry, "STALE", statusHeaderName, method === "HEAD");
+                    }
+                }
+            }
+            ctx.state[PENDING_STATE_KEY] = {
+                key,
+                freshnessOverrideMs: null,
+            };
+            return undefined;
+        },
+        async onSend(res, ctx) {
+            if (!ctx)
+                return undefined;
+            const state = ctx.state;
+            const pending = state[PENDING_STATE_KEY];
+            if (!pending)
+                return undefined;
+            delete state[PENDING_STATE_KEY];
+            if (!cacheableStatus(res.status)) {
+                if (statusHeaderName)
+                    res.headers.set(statusHeaderName, "MISS");
+                return undefined;
+            }
+            const freshness = freshnessFromResponse(res);
+            if (freshness === null) {
+                // Response opted out of caching (no-store / private / Set-Cookie ...).
+                if (statusHeaderName)
+                    res.headers.set(statusHeaderName, "MISS");
+                return undefined;
+            }
+            const buf = new Uint8Array(await res.clone().arrayBuffer());
+            if (buf.byteLength > maxBodyBytes) {
+                if (statusHeaderName)
+                    res.headers.set(statusHeaderName, "MISS");
+                return undefined;
+            }
+            const headers = [];
+            res.headers.forEach((value, name) => {
+                // `Age` is recomputed on every serve; never persist a stale one.
+                if (name === "age")
+                    return;
+                headers.push([name, value]);
+            });
+            const now = Date.now();
+            const freshMs = freshness ?? ttlMs;
+            const entry = {
+                status: res.status,
+                headers,
+                body: buf.byteLength ? bytesToBase64(buf) : "",
+                storedAt: now,
+                freshUntil: now + freshMs,
+                staleUntil: now + freshMs + swrMs,
+            };
+            const setResult = store.set(pending.key, entry, freshMs + swrMs);
+            if (isPromiseLike(setResult))
+                await setResult;
+            if (statusHeaderName)
+                res.headers.set(statusHeaderName, "MISS");
+            return undefined;
+        },
+    };
+}

package/dist/router.d.ts

@@ -30,7 +30,29 @@ export declare class Router<T> {
     private operationIds;
     /** Static (no-param/no-wildcard) routes for O(1) lookup. */
     private staticTable;
+    /**
+     * Register a handler for the given method and path. Static paths land in the
+     * O(1) `staticTable`; paths with `:param`/`*wildcard` segments are inserted
+     * into the trie. Wildcards must be the terminal segment.
+     *
+     * @param method - HTTP method to register the handler under.
+     * @param path - Route path; supports `:param` and a trailing `*wildcard`.
+     * @param handler - Value returned by {@link Router.find} on a match.
+     * @param operationId - Optional unique id; tracked to reject duplicates.
+     * @throws Error on a duplicate route, duplicate `operationId`, or conflicting
+     *   param names at the same trie position.
+     */
     add(method: HttpMethod, path: string, handler: T, operationId?: string): void;
+    /**
+     * Look up the handler registered for the given method and path. Tries the
+     * static fast path first, then walks the trie, extracting and decoding path
+     * params. Path-traversal lookups (`..`, `//`) are rejected up front.
+     *
+     * @param method - HTTP method to match.
+     * @param path - Request path to resolve, including any dynamic segments.
+     * @returns The matched handler with decoded params, or `undefined` if no
+     *   route matches the method + path.
+     */
     find(method: HttpMethod, path: string): RouteMatch<T> | undefined;
     /** Returns the set of methods registered at this exact path (for 405 responses). */
     allowedMethods(path: string): HttpMethod[];

package/dist/router.js

@@ -25,6 +25,18 @@ export class Router {
     operationIds = new Set();
     /** Static (no-param/no-wildcard) routes for O(1) lookup. */
     staticTable = new Map();
+    /**
+     * Register a handler for the given method and path. Static paths land in the
+     * O(1) `staticTable`; paths with `:param`/`*wildcard` segments are inserted
+     * into the trie. Wildcards must be the terminal segment.
+     *
+     * @param method - HTTP method to register the handler under.
+     * @param path - Route path; supports `:param` and a trailing `*wildcard`.
+     * @param handler - Value returned by {@link Router.find} on a match.
+     * @param operationId - Optional unique id; tracked to reject duplicates.
+     * @throws Error on a duplicate route, duplicate `operationId`, or conflicting
+     *   param names at the same trie position.
+     */
     add(method, path, handler, operationId) {
         const segments = splitPath(path);
         if (operationId && this.operationIds.has(operationId))
@@ -75,6 +87,16 @@ export class Router {
             throw new Error(`Duplicate route: ${method} ${path}`);
         node.handlers[method] = handler;
     }
+    /**
+     * Look up the handler registered for the given method and path. Tries the
+     * static fast path first, then walks the trie, extracting and decoding path
+     * params. Path-traversal lookups (`..`, `//`) are rejected up front.
+     *
+     * @param method - HTTP method to match.
+     * @param path - Request path to resolve, including any dynamic segments.
+     * @returns The matched handler with decoded params, or `undefined` if no
+     *   route matches the method + path.
+     */
     find(method, path) {
         // Reject path traversal attempts before walking.
         if (path.includes("/../") || path.endsWith("/..") || path.includes("//")) {
@@ -117,19 +139,54 @@ export class Router {
                 return r;
         }
         if (node.paramChild) {
-            params[node.paramChild.name] = decodeURIComponent(seg);
-            const r = this.walk(node.paramChild.node, segs, i + 1, params);
-            if (r)
-                return r;
-            delete params[node.paramChild.name];
+            const decoded = safeDecodeURIComponent(seg);
+            if (decoded !== undefined) {
+                params[node.paramChild.name] = decoded;
+                const r = this.walk(node.paramChild.node, segs, i + 1, params);
+                if (r)
+                    return r;
+                delete params[node.paramChild.name];
+            }
         }
         if (node.wildcardChild) {
-            params[node.wildcardChild.name] = segs.slice(i).map(decodeURIComponent).join("/");
-            return node.wildcardChild.node;
+            const rest = decodeSegments(segs, i);
+            if (rest !== undefined) {
+                params[node.wildcardChild.name] = rest;
+                return node.wildcardChild.node;
+            }
         }
         return undefined;
     }
 }
+/**
+ * Decode a single path segment, returning `undefined` instead of throwing when
+ * the segment contains a malformed percent-escape (e.g. `%zz` or a lone `%`).
+ * A malformed segment therefore fails to match and yields a clean 404 rather
+ * than letting a `URIError` bubble up as a generic 500.
+ */
+function safeDecodeURIComponent(segment) {
+    try {
+        return decodeURIComponent(segment);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Decode and join the wildcard tail starting at `index`. Returns `undefined`
+ * if any captured segment carries a malformed percent-escape, so the lookup
+ * misses cleanly instead of throwing.
+ */
+function decodeSegments(segs, index) {
+    const parts = [];
+    for (let i = index; i < segs.length; i++) {
+        const decoded = safeDecodeURIComponent(segs[i]);
+        if (decoded === undefined)
+            return undefined;
+        parts.push(decoded);
+    }
+    return parts.join("/");
+}
 function splitPath(path) {
     const clean = path.replace(/\/+$/, "") || "/";
     if (clean === "/")

package/dist/safe-redirect.d.ts

@@ -38,7 +38,7 @@
  * });
  * ```
  *
- * @since 0.35.2
+ * @since 0.35.0
  */
 /** Reason an open-redirect candidate was refused. */
 export type SafeRedirectBlockReason = "empty-target" | "invalid-control-characters" | "protocol-relative" | "backslash-path" | "path-not-allowed" | "origin-not-allowed" | "scheme-not-allowed" | "parse-failed";
@@ -86,6 +86,6 @@ export interface SafeRedirectOptions {
  * @param target - User-supplied URL candidate (path or absolute URL).
  * @param options - Allowlist + response configuration.
  *
- * @since 0.35.2
+ * @since 0.35.0
  */
 export declare function safeRedirect(target: string, options?: SafeRedirectOptions): Response;

package/dist/safe-redirect.js

@@ -38,7 +38,7 @@
  * });
  * ```
  *
- * @since 0.35.2
+ * @since 0.35.0
  */
 /** Thrown when {@link safeRedirect} refuses a candidate URL and no `fallback` is configured. */
 export class OpenRedirectBlockedError extends Error {
@@ -51,12 +51,7 @@ export class OpenRedirectBlockedError extends Error {
         this.target = target;
     }
 }
-const FORBIDDEN_SCHEMES = new Set([
-    "javascript:",
-    "data:",
-    "vbscript:",
-    "file:",
-]);
+const FORBIDDEN_SCHEMES = new Set(["javascript:", "data:", "vbscript:", "file:"]);
 const ALLOWED_REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
 // Reject NUL, CR, LF, and other C0/C1 control characters; they enable
 // response-splitting via the `Location` header.
@@ -126,7 +121,7 @@ function classify(target, allowedPaths, allowedOrigins) {
  * @param target - User-supplied URL candidate (path or absolute URL).
  * @param options - Allowlist + response configuration.
  *
- * @since 0.35.2
+ * @since 0.35.0
  */
 export function safeRedirect(target, options = {}) {
     const allowedPaths = options.allowedPaths ?? [];

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:1d9fa950-874b-5a89-9b39-98f1bbdfdb30",
+  "serialNumber": "urn:uuid:99cd0a75-d472-56c5-bd8e-c5247eb9e1df",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-28T07:51:16.251Z",
+    "timestamp": "2026-05-31T20:28:21.245Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "0.35.2"
+        "version": "0.37.0"
       }
     ],
     "authors": [
@@ -19,11 +19,11 @@
     ],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/@daloyjs/core@0.35.2",
+      "bom-ref": "pkg:npm/@daloyjs/core@0.37.0",
       "name": "@daloyjs/core",
-      "version": "0.35.2",
+      "version": "0.37.0",
       "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
-      "purl": "pkg:npm/@daloyjs/core@0.35.2",
+      "purl": "pkg:npm/@daloyjs/core@0.37.0",
       "licenses": [
         {
           "license": {
@@ -46,9 +46,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag--daloyjs-core-0.35.2",
+        "tagId": "swidtag--daloyjs-core-0.37.0",
         "name": "@daloyjs/core",
-        "version": "0.35.2",
+        "version": "0.37.0",
         "tagVersion": 0,
         "patch": false
       }
@@ -57,7 +57,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/@daloyjs/core@0.35.2",
+      "ref": "pkg:npm/@daloyjs/core@0.37.0",
       "dependsOn": []
     }
   ]

package/dist/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@daloyjs/core-0.35.2",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-0.35.2-1d9fa950-874b-5a89-9b39-98f1bbdfdb30",
+  "name": "@daloyjs/core-0.37.0",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-0.37.0-99cd0a75-d472-56c5-bd8e-c5247eb9e1df",
   "creationInfo": {
-    "created": "2026-05-28T07:51:16.251Z",
+    "created": "2026-05-31T20:28:21.245Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package--daloyjs-core",
       "name": "@daloyjs/core",
-      "versionInfo": "0.35.2",
+      "versionInfo": "0.37.0",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/@daloyjs/core@0.35.2"
+          "referenceLocator": "pkg:npm/@daloyjs/core@0.37.0"
         }
       ]
     }