@daloyjs/core 0.39.1 → 0.42.0

package/dist/docs.d.ts

@@ -226,6 +226,24 @@ export interface DocsAssetOptions {
      * @since 0.39.0
      */
     redocScriptIntegrity?: string;
+    /** Override the AsyncAPI React standalone bundle URL (useful for self-hosting). */
+    asyncapiScriptUrl?: string;
+    /**
+     * SRI hash for {@link asyncapiScriptUrl}. One or more space-separated
+     * `sha256-`/`sha384-`/`sha512-` base64 digests. Invalid values throw.
+     *
+     * @since 0.42.0
+     */
+    asyncapiScriptIntegrity?: string;
+    /** Override the AsyncAPI React component stylesheet URL (useful for self-hosting). */
+    asyncapiStyleUrl?: string;
+    /**
+     * SRI hash for {@link asyncapiStyleUrl}. One or more space-separated
+     * `sha256-`/`sha384-`/`sha512-` base64 digests. Invalid values throw.
+     *
+     * @since 0.42.0
+     */
+    asyncapiStyleIntegrity?: string;
     /**
      * `crossorigin` attribute value emitted alongside any pinned integrity
      * hash. SRI on a cross-origin asset requires CORS, so this defaults to
@@ -264,6 +282,20 @@ export interface RedocHtmlOptions extends DocsOptions {
     /** Forwarded as the options object to `Redoc.init(specUrl, configuration, element)`. */
     configuration?: RedocConfiguration;
 }
+/**
+ * Options for {@link asyncapiHtml}; adds AsyncAPI-specific UI configuration.
+ *
+ * @since 0.42.0
+ */
+export interface AsyncApiHtmlOptions extends DocsOptions {
+    /**
+     * Forwarded as the `config` object to `AsyncApiStandalone.render({ schema, config }, el)`.
+     * Defaults to showing the sidebar and inline errors.
+     */
+    configuration?: {
+        [key: string]: ScalarJsonValue | undefined;
+    };
+}
 /** Options for {@link docsContentSecurityPolicy}. */
 export interface DocsContentSecurityPolicyOptions {
     /** Extra origins to allow for `script-src` / `style-src` (defaults to jsDelivr). */
@@ -316,6 +348,23 @@ export declare function swaggerUiHtml(opts: DocsOptions): string;
  * @since 0.39.0
  */
 export declare function redocHtml(opts: RedocHtmlOptions): string;
+/**
+ * Render an AsyncAPI HTML page that loads `opts.specUrl` (an AsyncAPI 3.0
+ * document) into the official AsyncAPI React component. Same shape as
+ * {@link redocHtml}: a prebuilt standalone bundle is loaded from a CDN via a
+ * `<script>` tag (no build step, no extra deps) and the spec URL is handed to
+ * `AsyncApiStandalone.render(...)`. This is the AsyncAPI equivalent of the
+ * Scalar / Swagger UI / Redoc OpenAPI viewers.
+ *
+ * Serve it with the same CSP as the OpenAPI docs UIs ({@link docsContentSecurityPolicy}):
+ * it needs the asset origin (jsDelivr by default) in `script-src` / `style-src`
+ * and `connect-src 'self'` so the component can `fetch` the spec. The spec URL
+ * and configuration are embedded with `<`-escaped JSON so an attacker-controlled
+ * value cannot break out of the inline `<script>`.
+ *
+ * @since 0.42.0
+ */
+export declare function asyncapiHtml(opts: AsyncApiHtmlOptions): string;
 /**
  * Build a Content-Security-Policy string compatible with the docs HTML
  * produced by {@link scalarHtml} / {@link swaggerUiHtml}.

package/dist/docs.js

@@ -123,6 +123,45 @@ export function redocHtml(opts) {
 <script${nonce}>Redoc.init(${specArg},${optionsArg},document.getElementById("redoc"));</script>
 </body></html>`;
 }
+/**
+ * Render an AsyncAPI HTML page that loads `opts.specUrl` (an AsyncAPI 3.0
+ * document) into the official AsyncAPI React component. Same shape as
+ * {@link redocHtml}: a prebuilt standalone bundle is loaded from a CDN via a
+ * `<script>` tag (no build step, no extra deps) and the spec URL is handed to
+ * `AsyncApiStandalone.render(...)`. This is the AsyncAPI equivalent of the
+ * Scalar / Swagger UI / Redoc OpenAPI viewers.
+ *
+ * Serve it with the same CSP as the OpenAPI docs UIs ({@link docsContentSecurityPolicy}):
+ * it needs the asset origin (jsDelivr by default) in `script-src` / `style-src`
+ * and `connect-src 'self'` so the component can `fetch` the spec. The spec URL
+ * and configuration are embedded with `<`-escaped JSON so an attacker-controlled
+ * value cannot break out of the inline `<script>`.
+ *
+ * @since 0.42.0
+ */
+export function asyncapiHtml(opts) {
+    const title = escapeHtml(opts.title ?? "AsyncAPI");
+    const scriptUrl = escapeHtml(opts.assets?.asyncapiScriptUrl ??
+        `${JSDELIVR_ORIGIN}/npm/@asyncapi/react-component/browser/standalone/index.js`);
+    const styleUrl = escapeHtml(opts.assets?.asyncapiStyleUrl ??
+        `${JSDELIVR_ORIGIN}/npm/@asyncapi/react-component/styles/default.min.css`);
+    const scriptSri = integrityAttr(opts.assets?.asyncapiScriptIntegrity, opts.assets?.crossOrigin);
+    const styleSri = integrityAttr(opts.assets?.asyncapiStyleIntegrity, opts.assets?.crossOrigin);
+    const nonce = nonceAttr(opts.scriptNonce);
+    const specArg = jsonForScript(opts.specUrl);
+    const configArg = jsonForScript(opts.configuration ?? { show: { sidebar: true, errors: true } });
+    return `<!doctype html>
+<html><head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>${title}</title>
+<link rel="stylesheet" href="${styleUrl}"${styleSri} />
+</head><body>
+<div id="asyncapi"></div>
+<script src="${scriptUrl}"${scriptSri}${nonce}></script>
+<script${nonce}>AsyncApiStandalone.render({schema:{url:${specArg},options:{method:"GET"}},config:${configArg}},document.getElementById("asyncapi"));</script>
+</body></html>`;
+}
 /**
  * Build a Content-Security-Policy string compatible with the docs HTML
  * produced by {@link scalarHtml} / {@link swaggerUiHtml}.

package/dist/idempotency.d.ts

@@ -31,7 +31,7 @@
  * @module
  * @since 0.37.0
  */
-import type { Hooks } from "./types.js";
+import type { BaseContext, Hooks } from "./types.js";
 /**
  * Test-only helper that clears the process-wide shared stores used by
  * `idempotency({ groupId })`. Not part of the documented public API.
@@ -149,6 +149,24 @@ export interface IdempotencyOptions {
      * store; supply an explicit `store` to coordinate across processes.
      */
     groupId?: string;
+    /**
+     * Namespace idempotency keys by the calling principal so one client can
+     * never replay another client's stored response by reusing the same key
+     * (CWE-524 — cross-tenant cached-response disclosure). The returned string
+     * is mixed into the store key, so two principals using the *same*
+     * `Idempotency-Key` get independent reservations.
+     *
+     * Defaults to the request's `Authorization` header value, which scopes the
+     * common bearer- / API-key-authenticated case (Stripe-style idempotency)
+     * out of the box. Override it when identity lives elsewhere, e.g.
+     * `scope: (ctx) => ctx.state.session?.id` for cookie-based sessions, or
+     * return `undefined` to opt a request out of scoping (e.g. truly public,
+     * unauthenticated idempotent writes). Returning a stable per-user id is
+     * preferable to the raw credential when tokens rotate between retries.
+     *
+     * @since 0.40.0
+     */
+    scope?: (ctx: BaseContext<any, any>) => string | undefined | Promise<string | undefined>;
 }
 /**
  * In-memory {@link IdempotencyStore}. Suitable for tests and single-process
@@ -157,10 +175,14 @@ export interface IdempotencyOptions {
  */
 export declare class MemoryIdempotencyStore implements IdempotencyStore {
     private readonly map;
+    /**
+     * @inheritDoc
+     * `_ttlMs` is part of the {@link IdempotencyStore} contract but unused here:
+     * the in-memory store derives expiry from `record.expiresAt`.
+     */
+    reserve(key: string, record: IdempotencyRecord, _ttlMs?: number): IdempotencyRecord | null;
     /** @inheritDoc */
-    reserve(key: string, record: IdempotencyRecord): IdempotencyRecord | null;
-    /** @inheritDoc */
-    complete(key: string, record: IdempotencyRecord): void;
+    complete(key: string, record: IdempotencyRecord, _ttlMs?: number): void;
     /** @inheritDoc */
     release(key: string): void;
     private read;

package/dist/idempotency.js

@@ -61,8 +61,12 @@ export function _resetSharedIdempotencyStoresForTests() {
  */
 export class MemoryIdempotencyStore {
     map = new Map();
-    /** @inheritDoc */
-    reserve(key, record) {
+    /**
+     * @inheritDoc
+     * `_ttlMs` is part of the {@link IdempotencyStore} contract but unused here:
+     * the in-memory store derives expiry from `record.expiresAt`.
+     */
+    reserve(key, record, _ttlMs) {
         const existing = this.read(key);
         if (existing)
             return existing;
@@ -72,7 +76,7 @@ export class MemoryIdempotencyStore {
         return null;
     }
     /** @inheritDoc */
-    complete(key, record) {
+    complete(key, record, _ttlMs) {
         this.map.set(key, record);
     }
     /** @inheritDoc */
@@ -154,7 +158,16 @@ function stableStringify(value) {
 async function computeFingerprint(method, ctx) {
     const url = new URL(ctx.request.url);
     const material = `${method}\n${url.pathname}${url.search}\n${stableStringify(ctx.body)}`;
-    const digest = new Uint8Array(await getSubtle().digest("SHA-256", enc.encode(material)));
+    return sha256Hex(material);
+}
+/**
+ * SHA-256 hex of an arbitrary string. Used to fingerprint requests and to
+ * derive a fixed-length, delimiter-safe tag for the caller-scope namespace so
+ * a long or attacker-controlled `Authorization` value cannot inject into or
+ * bloat the store key.
+ */
+async function sha256Hex(input) {
+    const digest = new Uint8Array(await getSubtle().digest("SHA-256", enc.encode(input)));
     return bytesToHex(digest);
 }
 // Printable ASCII only (no control chars / whitespace). Anchored + bounded to
@@ -271,7 +284,14 @@ export function idempotency(opts = {}) {
             const key = rawKey.trim();
             validateKey(key, headerName, maxKeyLength);
             const fingerprint = await computeFingerprint(method, ctx);
-            const storeKey = `${keyPrefix}${key}`;
+            // Namespace the key by the calling principal so client B can never
+            // replay client A's stored response by reusing the same Idempotency-Key
+            // (CWE-524). Defaults to the Authorization header; `scope` overrides.
+            const scopeRaw = opts.scope
+                ? await opts.scope(ctx)
+                : (ctx.request.headers.get("authorization") ?? undefined);
+            const scopeTag = scopeRaw ? `${await sha256Hex(scopeRaw)}:` : "";
+            const storeKey = `${keyPrefix}${scopeTag}${key}`;
             const now = Date.now();
             const record = {
                 fingerprint,

package/dist/index.d.ts

@@ -1,9 +1,10 @@
 export { App } from "./app.js";
 export { createApp } from "./app.js";
+export { findRoutesMissingResponseBodySchema } from "./app.js";
 export { _resetPackageJsonCacheForTests } from "./app.js";
 export { _resetCrashHandlersForTests } from "./app.js";
 export { _resetInsecureDefaultsLogForTests } from "./app.js";
-export type { AppOptions, AppOpenAPIOptions, DocsRouteOptions, HealthRouteOptions, CspReportRouteOptions, MetricsRouteOptions, IntrospectedRoute, PluginInstalledEvent, PluginExtension, ShutdownEvent, SecurityPreset, } from "./app.js";
+export type { AppOptions, AppOpenAPIOptions, DocsRouteOptions, AsyncAPIRouteOptions, HealthRouteOptions, CspReportRouteOptions, MetricsRouteOptions, IntrospectedRoute, PluginInstalledEvent, PluginExtension, ShutdownEvent, SecurityPreset, } from "./app.js";
 export { getConnInfo, setConnInfo, assertBehindProxy, resolveClientIp, readRemoteAddress, readRemotePort, pickForwardedForByHops, } from "./conn-info.js";
 export type { BehindProxyConfig, ConnInfo } from "./conn-info.js";
 export { subdomains, PSL_SNAPSHOT_DATE, PSL_PUBLIC_SUFFIXES, MAX_SNAPSHOT_AGE_DAYS, } from "./subdomains.js";
@@ -72,7 +73,7 @@ export type { RequestIdOptions, SecureHeadersOptions, CspDirectivesOptions, Cors
 export type { BearerAuthOptions, BearerAuthVerifyHook } from "./middleware.js";
 export { createLogger, noopLogger, DEFAULT_REDACT_KEYS } from "./logger.js";
 export type { Logger, LogLevel, ConsoleLoggerOptions, LoggerRedactionOptions, } from "./logger.js";
-export type { ScalarJsonPrimitive, ScalarJsonValue, ScalarReferenceConfiguration, ScalarTheme, RedocConfiguration, RedocHtmlOptions, DocsAssetOptions, } from "./docs.js";
+export type { ScalarJsonPrimitive, ScalarJsonValue, ScalarReferenceConfiguration, ScalarTheme, RedocConfiguration, RedocHtmlOptions, AsyncApiHtmlOptions, DocsAssetOptions, } from "./docs.js";
 export { formatStartupBanner, printStartupBanner } from "./banner.js";
 export type { StartupBannerLink, StartupBannerOptions } from "./banner.js";
 export { sseStream, sseResponse, ndjsonStream, ndjsonResponse, } from "./streaming.js";
@@ -95,5 +96,7 @@ export { fileField, multipartObject, isFileFieldSchema, isMultipartObjectSchema,
 export type { FileFieldSchema, FileFieldOptions, FileMagicBytesOption, FileMagicBytesSignature, MultipartObjectOptions, MultipartShape, UploadedFile, } from "./multipart.js";
 export { otelTracing, TRACING_SPAN_KIND_SERVER, TRACING_SPAN_STATUS_UNSET, TRACING_SPAN_STATUS_OK, TRACING_SPAN_STATUS_ERROR, } from "./tracing.js";
 export type { OtelTracingOptions, TracingAttributes, TracingAttributeValue, TracingSpan, TracingStartSpanOptions, TracingTracer, } from "./tracing.js";
+export { tenancy, tenantScope, tenantFromSubdomain, tenantFromHeader, tenantFromPathPrefix, tenantFromClaim, defaultTenantNormalize, } from "./tenancy.js";
+export type { TenancyOptions, TenantResolver, TenantScopeOptions, SubdomainTenantOptions, PathPrefixTenantOptions, ClaimTenantOptions, UnresolvedStatus, InvalidStatus, } from "./tenancy.js";
 export { defineWebSocket, WebSocketRegistry, WebSocketProtocolError, WebSocketPayloadTooLargeError, WS_GUID, WS_READY_STATE, WS_OPCODE, WS_CLOSE_CODE, WS_MAX_CONTROL_PAYLOAD, DEFAULT_WS_BACKPRESSURE_LIMIT, DEFAULT_WS_MAX_PAYLOAD_LENGTH, DEFAULT_WS_IDLE_TIMEOUT_SECONDS, computeAcceptKey, parseSubprotocols, validateSelectedSubprotocol, validateUpgrade, checkWebSocketOrigin, parseFrame, encodeFrame, encodeClosePayload, decodeClosePayload, encodeSendPayload, normalizeWebSocketOptions, wsRateLimit, FrameSink, FRAME_INCOMPLETE, } from "./websocket.js";
 export type { WebSocketConnection, WebSocketContext, WebSocketHandler, WebSocketMeta, WebSocketRouteEntry, NormalizedWebSocketOptions, WebSocketBeforeUpgrade, HandshakeResult, ParsedFrame, MessageEvent as WebSocketMessageEvent, FrameSinkEvents, } from "./websocket.js";

package/dist/index.js

@@ -1,5 +1,6 @@
 export { App } from "./app.js";
 export { createApp } from "./app.js";
+export { findRoutesMissingResponseBodySchema } from "./app.js";
 export { _resetPackageJsonCacheForTests } from "./app.js";
 export { _resetCrashHandlersForTests } from "./app.js";
 export { _resetInsecureDefaultsLogForTests } from "./app.js";
@@ -47,4 +48,5 @@ export { encodeCursor, decodeCursor, buildLinkHeader, buildPageLinks, pagination
 export { MetricsRegistry, Counter, Gauge, Histogram, httpMetrics, DEFAULT_DURATION_BUCKETS, PROMETHEUS_CONTENT_TYPE, } from "./metrics.js";
 export { fileField, multipartObject, isFileFieldSchema, isMultipartObjectSchema, } from "./multipart.js";
 export { otelTracing, TRACING_SPAN_KIND_SERVER, TRACING_SPAN_STATUS_UNSET, TRACING_SPAN_STATUS_OK, TRACING_SPAN_STATUS_ERROR, } from "./tracing.js";
+export { tenancy, tenantScope, tenantFromSubdomain, tenantFromHeader, tenantFromPathPrefix, tenantFromClaim, defaultTenantNormalize, } from "./tenancy.js";
 export { defineWebSocket, WebSocketRegistry, WebSocketProtocolError, WebSocketPayloadTooLargeError, WS_GUID, WS_READY_STATE, WS_OPCODE, WS_CLOSE_CODE, WS_MAX_CONTROL_PAYLOAD, DEFAULT_WS_BACKPRESSURE_LIMIT, DEFAULT_WS_MAX_PAYLOAD_LENGTH, DEFAULT_WS_IDLE_TIMEOUT_SECONDS, computeAcceptKey, parseSubprotocols, validateSelectedSubprotocol, validateUpgrade, checkWebSocketOrigin, parseFrame, encodeFrame, encodeClosePayload, decodeClosePayload, encodeSendPayload, normalizeWebSocketOptions, wsRateLimit, FrameSink, FRAME_INCOMPLETE, } from "./websocket.js";

package/dist/response-cache.d.ts

@@ -141,6 +141,26 @@ export interface ResponseCacheOptions {
      * store.
      */
     groupId?: string;
+    /**
+     * Whether to cache responses to requests that carry an `Authorization`
+     * header. Default: `false`.
+     *
+     * A shared response cache keyed on method + URL (the default) does not
+     * include the credential, so caching an authenticated response would serve
+     * one user's private data to the next user requesting the same URL
+     * (CWE-524 — cross-tenant cached-response disclosure). For that reason, and
+     * per RFC 9111 §3.5 (a shared cache MUST NOT reuse a response to an
+     * `Authorization`-bearing request unless explicitly permitted), such
+     * requests bypass the cache entirely by default.
+     *
+     * Set this to `true` only when the response is genuinely shareable across
+     * principals (e.g. public reference data served behind a bearer gate) — and
+     * then also add the credential to {@link varyHeaders} or a custom
+     * {@link keyGenerator} so distinct callers cannot collide.
+     *
+     * @since 0.40.0
+     */
+    cacheAuthenticatedRequests?: boolean;
 }
 /**
  * In-memory {@link ResponseCacheStore}. Suitable for tests and single-process
@@ -151,8 +171,12 @@ export declare class MemoryResponseCacheStore implements ResponseCacheStore {
     private readonly map;
     /** @inheritDoc */
     get(key: string): CachedResponse | null;
-    /** @inheritDoc */
-    set(key: string, entry: CachedResponse): void;
+    /**
+     * @inheritDoc
+     * `_ttlMs` is part of the {@link ResponseCacheStore} contract but unused
+     * here: the in-memory store derives freshness from `entry.freshUntil`.
+     */
+    set(key: string, entry: CachedResponse, _ttlMs?: number): void;
     /** @inheritDoc */
     delete(key: string): void;
     private prune;

package/dist/response-cache.js

@@ -76,8 +76,12 @@ export class MemoryResponseCacheStore {
         }
         return entry;
     }
-    /** @inheritDoc */
-    set(key, entry) {
+    /**
+     * @inheritDoc
+     * `_ttlMs` is part of the {@link ResponseCacheStore} contract but unused
+     * here: the in-memory store derives freshness from `entry.freshUntil`.
+     */
+    set(key, entry, _ttlMs) {
         this.map.set(key, entry);
         if (this.map.size > 10_000)
             this.prune();
@@ -245,6 +249,7 @@ export function responseCache(opts = {}) {
         throw new Error("responseCache(): maxBodyBytes must be a positive integer.");
     }
     const methods = new Set((opts.methods ?? ["GET", "HEAD"]).map((m) => m.toUpperCase()));
+    const cacheAuthenticatedRequests = opts.cacheAuthenticatedRequests === true;
     const cacheableStatus = opts.cacheableStatus ?? ((status) => status === 200);
     const varyHeaders = (opts.varyHeaders ?? []).map((h) => h.toLowerCase());
     const statusHeaderName = opts.statusHeaderName === null ? null : (opts.statusHeaderName ?? "x-cache").toLowerCase();
@@ -289,6 +294,13 @@ export function responseCache(opts = {}) {
             const method = ctx.request.method.toUpperCase();
             if (!methods.has(method))
                 return undefined;
+            // RFC 9111 §3.5 / CWE-524: a shared cache keyed on method+URL must not
+            // store or reuse a response to an Authorization-bearing request, or it
+            // would serve one principal's private data to the next caller. Opt in
+            // via `cacheAuthenticatedRequests` for genuinely shareable content.
+            if (!cacheAuthenticatedRequests && ctx.request.headers.has("authorization")) {
+                return undefined;
+            }
             const reqCc = parseCacheControl(ctx.request.headers.get("cache-control"));
             if (reqCc.has("no-store"))
                 return undefined;

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:67351bdb-989b-5f0b-81f1-020a4c493489",
+  "serialNumber": "urn:uuid:c3e0bc4b-403c-5789-b2e4-dbafa73b03ee",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-17T18:34:55.006Z",
+    "timestamp": "2026-06-19T08:56:49.249Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "0.39.1"
+        "version": "0.42.0"
       }
     ],
     "authors": [
@@ -19,11 +19,11 @@
     ],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/@daloyjs/core@0.39.1",
+      "bom-ref": "pkg:npm/@daloyjs/core@0.42.0",
       "name": "@daloyjs/core",
-      "version": "0.39.1",
+      "version": "0.42.0",
       "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
-      "purl": "pkg:npm/@daloyjs/core@0.39.1",
+      "purl": "pkg:npm/@daloyjs/core@0.42.0",
       "licenses": [
         {
           "license": {
@@ -46,9 +46,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag--daloyjs-core-0.39.1",
+        "tagId": "swidtag--daloyjs-core-0.42.0",
         "name": "@daloyjs/core",
-        "version": "0.39.1",
+        "version": "0.42.0",
         "tagVersion": 0,
         "patch": false
       }
@@ -57,7 +57,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/@daloyjs/core@0.39.1",
+      "ref": "pkg:npm/@daloyjs/core@0.42.0",
       "dependsOn": []
     }
   ]

package/dist/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@daloyjs/core-0.39.1",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-0.39.1-67351bdb-989b-5f0b-81f1-020a4c493489",
+  "name": "@daloyjs/core-0.42.0",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-0.42.0-c3e0bc4b-403c-5789-b2e4-dbafa73b03ee",
   "creationInfo": {
-    "created": "2026-06-17T18:34:55.006Z",
+    "created": "2026-06-19T08:56:49.249Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package--daloyjs-core",
       "name": "@daloyjs/core",
-      "versionInfo": "0.39.1",
+      "versionInfo": "0.42.0",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/@daloyjs/core@0.39.1"
+          "referenceLocator": "pkg:npm/@daloyjs/core@0.42.0"
         }
       ]
     }