@daloyjs/core 0.42.0 → 0.43.0

package/README.md

@@ -516,7 +516,7 @@ DaloyJS is in **public preview** (`0.x`). The public API may still change betwee
 
 - Adapters for Node (Heroku, Railway, Render, Fly.io), Bun, Deno, Cloudflare Workers, Vercel Node / Edge / Next.js / Netlify Edge, Fastly Compute, and AWS Lambda / Netlify Functions / Lambda Function URLs.
 - `daloy dev` watch loop delegates to the host runtime's native watcher (`node --import tsx --watch`, `bun --hot`, or `deno run --watch`) with a `--runtime` override for cross-runtime `package.json` scripts.
-- `pnpm create daloy` scaffolder with Node, Bun, Deno, Cloudflare Worker, and Vercel Edge templates, plus optional `--with-ci` GitHub Actions / Dependabot / CODEOWNERS / SECURITY.md hardening.
+- `pnpm create daloy` scaffolder with Node, Bun, Deno, Cloudflare Worker, and Vercel Edge templates, plus optional `--with-ci` GitHub Actions / Dependabot / CODEOWNERS / SECURITY.md hardening. The completion summary surfaces official install links (nodejs.org, pnpm.io, bun.sh) for any runtime or package manager your selections need but that is missing from `PATH`, and skips a doomed dependency install when the chosen package manager is absent.
 - Container-first templates: `HEALTHCHECK` to `/readyz`, `STOPSIGNAL SIGTERM`, non-root user, `tini` as PID 1.
 - Generated `deploy.yml` for container templates signs every pushed GHCR image with **Sigstore Cosign** (keyless OIDC) and attaches an **SPDX SBOM attestation** so consumers can `cosign verify` and `cosign verify-attestation --type spdxjson` instead of trusting the registry alone.
 - Pretty `printStartupBanner()` / `formatStartupBanner()` helpers at `@daloyjs/core/banner`, used by every starter template (TTY + `NO_COLOR` / `FORCE_COLOR` aware, ASCII fallback for dumb terminals).

package/dist/banner.js

@@ -36,24 +36,44 @@ const GLYPHS_ASCII = {
     mid: "-",
 };
 const ANSI_REGEX = /\u001b\[[0-9;]*m/g;
+/**
+ * Read a single environment variable defensively. On runtimes with a
+ * capability-based permission model (Deno), reading an env var the process was
+ * not granted via `--allow-env` throws a `NotCapable` error. The startup
+ * banner is purely cosmetic, so a missing color/locale hint must never crash
+ * the host application — swallow the denial and treat the variable as unset.
+ * On Node and Bun `process.env` access never throws, so this is a no-op there.
+ *
+ * @param key - Environment variable name.
+ * @returns The value, or `undefined` when unset or inaccessible.
+ */
+function readEnv(key) {
+    try {
+        return process.env[key];
+    }
+    catch {
+        return undefined;
+    }
+}
 function detectColor() {
-    if (process.env.NO_COLOR)
+    if (readEnv("NO_COLOR"))
         return false;
-    if (process.env.FORCE_COLOR && process.env.FORCE_COLOR !== "0")
+    const force = readEnv("FORCE_COLOR");
+    if (force && force !== "0")
         return true;
     const stdout = process.stdout;
     return Boolean(stdout && stdout.isTTY);
 }
 function detectAscii() {
-    if (process.env.DALOY_ASCII)
+    if (readEnv("DALOY_ASCII"))
         return true;
     if (process.platform === "win32") {
-        return !(process.env.WT_SESSION || process.env.TERM_PROGRAM);
+        return !(readEnv("WT_SESSION") || readEnv("TERM_PROGRAM"));
     }
-    const lang = process.env.LANG ?? process.env.LC_ALL ?? "";
+    const lang = readEnv("LANG") ?? readEnv("LC_ALL") ?? "";
     if (/UTF-?8/i.test(lang))
         return false;
-    if (process.env.TERM_PROGRAM)
+    if (readEnv("TERM_PROGRAM"))
         return false;
     return true;
 }

package/dist/cli.js

@@ -547,9 +547,14 @@ async function runDiff(opts, io) {
 }
 /**
  * `daloy doctor` — boot-time + CLI audit. Loads the user's
- * App entry and runs the secure-by-default checklist. Exits non-zero on any
- * finding so the command can guard container `HEALTHCHECK` and CI deploy
- * steps.
+ * App entry and runs the secure-by-default checklist so the command can guard
+ * container `HEALTHCHECK` and CI deploy steps.
+ *
+ * Exit code: non-zero (`1`) only when at least one **`error`-level** finding is
+ * present; `warn`-level findings are advisory and leave the exit code at `0`.
+ * The `--json` output reports `ok: true` only when there are **no findings at
+ * all** (any level), so `ok` is a stricter signal than the exit code — a
+ * warn-only run prints `ok: false` but still exits `0`.
  *
  * @internal
  */

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:c3e0bc4b-403c-5789-b2e4-dbafa73b03ee",
+  "serialNumber": "urn:uuid:66a4adf1-88f7-56e9-a00f-95633f473b23",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-19T08:56:49.249Z",
+    "timestamp": "2026-06-20T12:10:13.811Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "0.42.0"
+        "version": "0.43.0"
       }
     ],
     "authors": [
@@ -19,11 +19,11 @@
     ],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/@daloyjs/core@0.42.0",
+      "bom-ref": "pkg:npm/@daloyjs/core@0.43.0",
       "name": "@daloyjs/core",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
-      "purl": "pkg:npm/@daloyjs/core@0.42.0",
+      "purl": "pkg:npm/@daloyjs/core@0.43.0",
       "licenses": [
         {
           "license": {
@@ -46,9 +46,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag--daloyjs-core-0.42.0",
+        "tagId": "swidtag--daloyjs-core-0.43.0",
         "name": "@daloyjs/core",
-        "version": "0.42.0",
+        "version": "0.43.0",
         "tagVersion": 0,
         "patch": false
       }
@@ -57,7 +57,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/@daloyjs/core@0.42.0",
+      "ref": "pkg:npm/@daloyjs/core@0.43.0",
       "dependsOn": []
     }
   ]

package/dist/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@daloyjs/core-0.42.0",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-0.42.0-c3e0bc4b-403c-5789-b2e4-dbafa73b03ee",
+  "name": "@daloyjs/core-0.43.0",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-0.43.0-66a4adf1-88f7-56e9-a00f-95633f473b23",
   "creationInfo": {
-    "created": "2026-06-19T08:56:49.249Z",
+    "created": "2026-06-20T12:10:13.811Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package--daloyjs-core",
       "name": "@daloyjs/core",
-      "versionInfo": "0.42.0",
+      "versionInfo": "0.43.0",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/@daloyjs/core@0.42.0"
+          "referenceLocator": "pkg:npm/@daloyjs/core@0.43.0"
         }
       ]
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daloyjs/core",
-  "version": "0.42.0",
+  "version": "0.43.0",
   "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
   "type": "module",
   "publishConfig": {
@@ -45,10 +45,6 @@
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
     },
-    "./app": {
-      "types": "./dist/app.d.ts",
-      "import": "./dist/app.js"
-    },
     "./node": {
       "types": "./dist/adapters/node.d.ts",
       "import": "./dist/adapters/node.js"