@daloyjs/core 1.0.0-beta.0 → 1.0.0-beta.2

package/README.md

@@ -278,13 +278,21 @@ new App({
       customCss: ":root { --scalar-color-accent: #2563eb; }",
       hideTestRequestButton: true,
     },
+    swagger: {
+      docExpansion: "none",
+      displayRequestDuration: true,
+    },
     tags: ["Docs"],
   },
 });
 ```
 
-Switch UIs with one word. `ui: "redoc"` renders Redoc instead, and its
-options are forwarded to `Redoc.init` via `docs.redoc`:
+Switch UIs with one word. Scalar and Swagger UI include developer request
+consoles for authenticated endpoints: Scalar selects the first configured
+OpenAPI security scheme by default, and Swagger UI keeps values from the
+Authorize dialog across reloads. `ui: "redoc"` renders Redoc instead, and its
+options are forwarded to `Redoc.init` via `docs.redoc`; Redoc displays security
+requirements but is a read-only reference UI, not a Try It console:
 
 ```ts
 new App({
@@ -299,7 +307,8 @@ new App({
 The `scalar` option is forwarded to Scalar's HTML API as JSON configuration,
 with Daloy keeping the live `openapiPath` as the source. Use it for themes,
 custom CSS, layout, auth defaults, and client visibility without copying the
-HTML helper. Redoc spins up a `blob:` Web Worker for search, so the
+HTML helper. The `swagger` option is forwarded to `SwaggerUIBundle` with Daloy
+owning `url` / `dom_id`. Redoc spins up a `blob:` Web Worker for search, so the
 auto-mounted `/docs` page widens its CSP with `worker-src 'self' blob:` for
 `ui: "redoc"` only — Scalar and Swagger UI keep the tighter default.
 
@@ -413,7 +422,7 @@ miss                        4,763,878 ops/sec
 
 ### Cold-start tip (serverless / edge)
 
-For deployments where every millisecond of startup matters (Lambda, Vercel Edge, Cloudflare Workers, Fastly Compute), import `App` from the deep entry point instead of the barrel:
+For deployments where every millisecond of startup matters (Lambda, Vercel, Cloudflare Workers, Fastly Compute), import `App` from the deep entry point instead of the barrel:
 
 ```ts
 import { App } from "@daloyjs/core/app";   // ~13 ms faster cold start than "@daloyjs/core"
@@ -498,14 +507,14 @@ The core only ever sees `Request → Response`. Adapters live at the edge.
 
 ## Status
 
-DaloyJS is now in the **`1.0.0` beta** (`1.0.0-beta.0`). The public API is feature-complete and stable for the 1.0 line; from `1.0.0` onward, breaking changes follow SemVer and deprecations get at least one minor cycle. Small adjustments are still possible before the `1.0.0` GA if beta feedback surfaces something. The framework is already in use for production trials.
+DaloyJS is now in the **`1.0.0` beta** (`1.0.0-beta.2`). The public API is feature-complete and stable for the 1.0 line; from `1.0.0` onward, breaking changes follow SemVer and deprecations get at least one minor cycle. Small adjustments are still possible before the `1.0.0` GA if beta feedback surfaces something. The framework is already in use for production trials.
 
 **Release quality bar.** Every release ships with **≥90% line + function coverage and ≥90% branch coverage**, strict TypeScript, OpenSSF Scorecard, CodeQL + Opengrep dual SAST, zizmor workflow linting, and npm provenance. Coverage was relaxed from a former 100% gate so complex security work isn't blocked chasing throwaway tests for unreachable defensive branches or tsx source-map phantoms; see [AGENTS.md](AGENTS.md) for the policy.
 
 ### Routing, validation, and docs
 
 - Contract-first routing with Standard Schema validation (Zod 4, Valibot, ArkType, TypeBox) and OpenAPI 3.1 generated from a single source of truth.
-- Live OpenAPI 3.1 spec served as both JSON (`GET /openapi.json`) and YAML (`GET /openapi.yaml`) when `docs: true`, with a choice of Scalar (default), Swagger UI, or Redoc via `docs.ui`, plus Scalar theming/custom CSS via `docs.scalar` and Redoc options via `docs.redoc`.
+- Live OpenAPI 3.1 spec served as both JSON (`GET /openapi.json`) and YAML (`GET /openapi.yaml`) when `docs: true`, with a choice of Scalar (default), Swagger UI, or Redoc via `docs.ui`, plus Scalar theming/custom CSS/auth defaults via `docs.scalar`, Swagger UI options via `docs.swagger` (including persisted Authorize credentials), and Redoc options via `docs.redoc`.
 - Zero-config OpenAPI `info` autofill from `package.json` (Node / Bun) or `deno.json` / `deno.jsonc` (Deno); explicit `openapi.info` values always win.
 - RFC 7231 + RFC 5789 HTTP-method allowlist enforced inside `app.route()` (WebDAV, `TRACE`, `CONNECT` rejected at the framework boundary).
 - AI-friendly route metadata via optional `meta: { examples, extensions, summary, description, tags }`; examples are validated against your schemas at build time, surfaced as OpenAPI `examples` + `x-daloy-*` extensions, and dumped as `routes.json` / `routes.yaml` via `daloy inspect --ai`.
@@ -516,7 +525,7 @@ DaloyJS is now in the **`1.0.0` beta** (`1.0.0-beta.0`). The public API is featu
 
 - Adapters for Node (Heroku, Railway, Render, Fly.io), Bun, Deno, Cloudflare Workers, Vercel Node / Edge / Next.js / Netlify Edge, Fastly Compute, and AWS Lambda / Netlify Functions / Lambda Function URLs.
 - `daloy dev` watch loop delegates to the host runtime's native watcher (`node --import tsx --watch`, `bun --hot`, or `deno run --watch`) with a `--runtime` override for cross-runtime `package.json` scripts.
-- `pnpm create daloy` scaffolder with Node, Bun, Deno, Cloudflare Worker, and Vercel Edge templates, plus optional `--with-ci` GitHub Actions / Dependabot / CODEOWNERS / SECURITY.md hardening. The completion summary surfaces official install links (nodejs.org, pnpm.io, bun.sh) for any runtime or package manager your selections need but that is missing from `PATH`, and skips a doomed dependency install when the chosen package manager is absent.
+- `pnpm create daloy` scaffolder with Node, Bun, Deno, Cloudflare Worker, and Vercel templates, plus optional `--with-ci` GitHub Actions / Dependabot / CODEOWNERS / SECURITY.md hardening. The completion summary surfaces official install links (nodejs.org, pnpm.io, bun.sh) for any runtime or package manager your selections need but that is missing from `PATH`, and skips a doomed dependency install when the chosen package manager is absent.
 - Container-first templates: `HEALTHCHECK` to `/readyz`, `STOPSIGNAL SIGTERM`, non-root user, `tini` as PID 1.
 - Generated `deploy.yml` for container templates signs every pushed GHCR image with **Sigstore Cosign** (keyless OIDC) and attaches an **SPDX SBOM attestation** so consumers can `cosign verify` and `cosign verify-attestation --type spdxjson` instead of trusting the registry alone.
 - Pretty `printStartupBanner()` / `formatStartupBanner()` helpers at `@daloyjs/core/banner`, used by every starter template (TTY + `NO_COLOR` / `FORCE_COLOR` aware, ASCII fallback for dumb terminals).

package/dist/adapters/node.js

@@ -37,6 +37,15 @@ export function serve(app, opts = {}) {
             dispatchToApp(app, req, res, trustProxy, undefined);
             return;
         }
+        // Refuse Fetch-forbidden methods (CONNECT/TRACE/TRACK) before building a
+        // `Request` — `new Request` throws a `TypeError` for them, which would
+        // otherwise be caught and reported as a generic 500 instead of a clean,
+        // intentional method refusal. Placed after the GET/HEAD fast path so the
+        // hot path never pays for this check.
+        if (FETCH_FORBIDDEN_METHODS.has(method.toUpperCase())) {
+            writeMethodRefused(res);
+            return;
+        }
         // POST/PUT/PATCH/DELETE with a small known content-length: pre-buffer
         // bytes from the Node socket directly so the Request constructor gets a
         // Uint8Array body instead of `Readable.toWeb(req)`. This skips the
@@ -223,6 +232,45 @@ function attachClientCertificate(req, request) {
         return normalizePeerCertificate(raw, sock.authorized === true);
     });
 }
+/**
+ * Methods the WHATWG Fetch standard forbids on a `Request` (`CONNECT`,
+ * `TRACE`, `TRACK`). `new Request(url, { method })` throws a `TypeError` for
+ * these, so the Node adapter refuses them *before* constructing a `Request` —
+ * otherwise that `TypeError` surfaces as a generic `500` instead of a
+ * deliberate method refusal. Refusing `TRACE`/`TRACK` also closes Cross-Site
+ * Tracing, and `CONNECT` has no meaning for an origin server, so a categorical
+ * refusal is the correct secure default. (`CONNECT` is normally routed to
+ * Node's `connect` event rather than the request listener; it is included here
+ * defensively for runtimes/proxies that surface it as a normal request.)
+ */
+const FETCH_FORBIDDEN_METHODS = new Set([
+    "CONNECT",
+    "TRACE",
+    "TRACK",
+]);
+/**
+ * Refuse a Fetch-forbidden HTTP method with a spec-correct `501 Not
+ * Implemented`. `501` is more accurate than `405` here because the method is
+ * unsupported for *every* resource (not just the matched route), and unlike
+ * `405` it does not require an `Allow` header the adapter cannot compute before
+ * routing. Mirrors {@link writeAdapterError}'s RFC 9457 problem+json shape;
+ * `Connection: close` avoids reusing a socket whose (illegal) request body was
+ * never drained.
+ *
+ * @param res - The Node {@link ServerResponse} to write the refusal to.
+ */
+function writeMethodRefused(res) {
+    if (res.headersSent)
+        return;
+    res.statusCode = 501;
+    res.setHeader("content-type", "application/problem+json");
+    res.setHeader("connection", "close");
+    res.end(JSON.stringify({
+        type: "https://daloyjs.dev/errors/not-implemented",
+        title: "Not Implemented",
+        status: 501,
+    }));
+}
 function writeAdapterError(res, e) {
     if (!res.headersSent) {
         res.statusCode = 500;

package/dist/adapters/vercel.d.ts

@@ -19,7 +19,7 @@
  * `toEdgeHandler` is kept as a backward-compatible alias of `toWebHandler`.
  */
 import type { App } from "../app.js";
-/** Web-standard handler shape used by Vercel Edge Functions, Next.js route handlers, and middleware. */
+/** Web-standard handler shape used by Vercel Functions, Next.js route handlers, and middleware. */
 export type WebHandler = (req: Request) => Promise<Response>;
 /** Default export shape for Vercel's web-standard `{ fetch }` runtime. */
 export interface FetchHandler {

package/dist/app.d.ts

@@ -2,7 +2,7 @@ import { WebSocketRegistry, type WebSocketHandler } from "./websocket.js";
 import { type Logger } from "./logger.js";
 import type { HttpMethod, Hooks, PathString, RequestSchemas, ResponsesMap, RouteDefinition } from "./types.js";
 import { type OpenAPIInfo, type OpenAPIOptions } from "./openapi.js";
-import { type DocsAssetOptions, type DocsContentSecurityPolicyOptions, type RedocConfiguration, type ScalarJsonValue, type ScalarReferenceConfiguration } from "./docs.js";
+import { type DocsAssetOptions, type DocsContentSecurityPolicyOptions, type RedocConfiguration, type ScalarJsonValue, type ScalarReferenceConfiguration, type SwaggerUiConfiguration } from "./docs.js";
 import { type AsyncAPIServer } from "./asyncapi.js";
 import { type SecureHeadersOptions } from "./middleware.js";
 import { type LoadSheddingOptions } from "./load-shedding.js";
@@ -13,6 +13,8 @@ import { type BehindProxyConfig } from "./conn-info.js";
 export declare function _resetCrashHandlersForTests(): void;
 /** @internal Test-only helper to reset the latch between tests. */
 export declare function _resetInsecureDefaultsLogForTests(): void;
+/** @internal Test-only helper to reset the indeterminate-env warning latch. */
+export declare function _resetIndeterminateEnvWarningForTests(): void;
 /**
  * Named security posture preset. Currently only one value is supported:
  *
@@ -244,7 +246,7 @@ export interface AppOptions {
      * {@link AppOptions.secureDefaults} is not `false`. Pass `false` to opt
      * out (long-running CLI processes / test harnesses that intentionally
      * swallow rejections may want this). No-op on runtimes without
-     * `process.on` (Cloudflare Workers / Vercel Edge / Fastly).
+     * `process.on` (Cloudflare Workers / Vercel / Fastly).
      *
      * @since 0.18.0
      */
@@ -378,8 +380,21 @@ export interface DocsRouteOptions {
      * renders Redoc.
      */
     ui?: "scalar" | "swagger" | "redoc";
-    /** Scalar API reference UI configuration. Ignored unless `ui` is `"scalar"`. */
+    /**
+     * Scalar API reference UI configuration. Ignored unless `ui` is `"scalar"`.
+     * When OpenAPI security schemes are configured and this object does not set
+     * `authentication.preferredSecurityScheme`, DaloyJS selects the first scheme
+     * so Scalar's developer console opens with an auth type ready to fill.
+     */
     scalar?: ScalarReferenceConfiguration;
+    /**
+     * Swagger UI configuration, forwarded to `SwaggerUIBundle`. Ignored unless
+     * `ui: "swagger"`. DaloyJS owns `url` and `dom_id`; credentials entered in
+     * the Authorize dialog persist across reloads by default.
+     *
+     * @since 0.42.0
+     */
+    swagger?: SwaggerUiConfiguration;
     /**
      * Redoc UI configuration, forwarded to `Redoc.init`. Ignored unless
      * `ui: "redoc"`.
@@ -728,7 +743,7 @@ export declare const DALOY_RAW_STREAM: unique symbol;
  *  - graceful shutdown and lifecycle observability
  *
  * `App` is **runtime-agnostic**: the same instance runs on Node, Bun, Deno,
- * Cloudflare Workers, Vercel Edge, AWS Lambda, and Fastly Compute via the
+ * Cloudflare Workers, Vercel, AWS Lambda, and Fastly Compute via the
  * dedicated adapters.
  *
  * @example
@@ -992,6 +1007,32 @@ export declare class App<Routes extends readonly RouteDefinition<any, any, any,
      * a misconfigured surface.
      */
     private assertSecureHookConfig;
+    /**
+     * Whether the resolved runtime environment is indeterminate: no explicit
+     * {@link AppOptions.env} / {@link AppOptions.production} was provided AND
+     * `process.env.NODE_ENV` is unset or empty. This is the common default on
+     * edge runtimes (Cloudflare Workers, Deno Deploy), which have no
+     * `NODE_ENV`. Deliberately does not sniff the runtime — it only reports
+     * whether the environment signal is absent — so it stays runtime-portable.
+     *
+     * @returns `true` when neither an explicit option nor `NODE_ENV` resolves the
+     * environment; `false` otherwise (including when `NODE_ENV` is `development` /
+     * `test`, which is a known, non-production answer).
+     */
+    private isEnvIndeterminate;
+    /**
+     * Emit a single once-per-process warning when a production-only secure-default
+     * refusal (wildcard CORS origin, weak session secret) would not fire purely
+     * because the environment is indeterminate (see {@link isEnvIndeterminate}).
+     * Routed through the logger, so `logger: false` silences it. Only warns when a
+     * risky config is actually present, so a clean app stays quiet. Changes no
+     * enforcement; pure observability for the documented "set `env` on edge"
+     * requirement.
+     *
+     * @param record - The hook object, carrying the wildcard-CORS / session
+     * markers used by {@link assertSecureHookConfig}.
+     */
+    private warnIndeterminateEnvSecurity;
     private assertRouteAuthPayloadConfig;
     private resetBootGuardCache;
     /**

package/dist/app.js

@@ -43,6 +43,18 @@ let insecureDefaultsLoggedThisProcess = false;
 export function _resetInsecureDefaultsLogForTests() {
     insecureDefaultsLoggedThisProcess = false;
 }
+/**
+ * Once-per-process latch for the "production-only secure-default guard skipped
+ * because the runtime environment is indeterminate" warning (see
+ * {@link App.warnIndeterminateEnvSecurity}). Mirrors
+ * {@link insecureDefaultsLoggedThisProcess}: one heads-up per process, not one
+ * per `App` / per `.use()` call.
+ */
+let indeterminateEnvSecurityWarnedThisProcess = false;
+/** @internal Test-only helper to reset the indeterminate-env warning latch. */
+export function _resetIndeterminateEnvWarningForTests() {
+    indeterminateEnvSecurityWarnedThisProcess = false;
+}
 /**
  * The exact set of fields the `"internal-service"` preset flips off when
  * the caller has not set them explicitly. Surfaced through the boot
@@ -613,9 +625,22 @@ export class App {
     assertSecureHookConfig(hooks) {
         if (this.options.secureDefaults === false)
             return;
-        if (!this.isProduction())
-            return;
         const record = hooks;
+        if (!this.isProduction()) {
+            // The refusals below are production-only. When the environment is
+            // *indeterminate* (no explicit `env` / `production` option and no
+            // `NODE_ENV` — the common default on edge runtimes such as Workers /
+            // Deno Deploy / Vercel), those refusals never fire, so a risky
+            // config could ship unguarded. Surface that once as a warning when such
+            // a config is actually present. Enforcement is unchanged — this only
+            // makes the silent skip observable. The runtime itself is deliberately
+            // NOT sniffed (that would couple the core to specific platforms and
+            // break runtime portability); we key only on "is the env signal absent?".
+            if (this.isEnvIndeterminate()) {
+                this.warnIndeterminateEnvSecurity(record);
+            }
+            return;
+        }
         if (record[CORS_WILDCARD_ORIGIN_MARKER] === true) {
             throw new Error('cors({ origin: "*" }) refused in production: a wildcard CORS origin exposes every state-changing route cross-origin. ' +
                 "Replace the wildcard with an explicit allowlist (string[] or predicate), or pass " +
@@ -630,6 +655,70 @@ export class App {
             }
         }
     }
+    /**
+     * Whether the resolved runtime environment is indeterminate: no explicit
+     * {@link AppOptions.env} / {@link AppOptions.production} was provided AND
+     * `process.env.NODE_ENV` is unset or empty. This is the common default on
+     * edge runtimes (Cloudflare Workers, Deno Deploy), which have no
+     * `NODE_ENV`. Deliberately does not sniff the runtime — it only reports
+     * whether the environment signal is absent — so it stays runtime-portable.
+     *
+     * @returns `true` when neither an explicit option nor `NODE_ENV` resolves the
+     * environment; `false` otherwise (including when `NODE_ENV` is `development` /
+     * `test`, which is a known, non-production answer).
+     */
+    isEnvIndeterminate() {
+        if (this.options.env !== undefined ||
+            this.options.production !== undefined) {
+            return false;
+        }
+        const nodeEnv = typeof process !== "undefined" && typeof process.env !== "undefined"
+            ? process.env.NODE_ENV
+            : undefined;
+        return nodeEnv === undefined || nodeEnv === "";
+    }
+    /**
+     * Emit a single once-per-process warning when a production-only secure-default
+     * refusal (wildcard CORS origin, weak session secret) would not fire purely
+     * because the environment is indeterminate (see {@link isEnvIndeterminate}).
+     * Routed through the logger, so `logger: false` silences it. Only warns when a
+     * risky config is actually present, so a clean app stays quiet. Changes no
+     * enforcement; pure observability for the documented "set `env` on edge"
+     * requirement.
+     *
+     * @param record - The hook object, carrying the wildcard-CORS / session
+     * markers used by {@link assertSecureHookConfig}.
+     */
+    warnIndeterminateEnvSecurity(record) {
+        if (indeterminateEnvSecurityWarnedThisProcess)
+            return;
+        const risky = [];
+        if (record[CORS_WILDCARD_ORIGIN_MARKER] === true) {
+            risky.push('cors({ origin: "*" })');
+        }
+        if (record[SESSION_HOOK_MARKER] === true) {
+            const secrets = record[SESSION_SECRETS_MARKER];
+            if (Array.isArray(secrets)) {
+                const hasWeak = secrets.some((s) => {
+                    try {
+                        assertStrongSecret(s, "session");
+                        return false;
+                    }
+                    catch {
+                        return true;
+                    }
+                });
+                if (hasWeak)
+                    risky.push("a weak session secret");
+            }
+        }
+        if (risky.length === 0)
+            return;
+        indeterminateEnvSecurityWarnedThisProcess = true;
+        this.log.warn({ event: "secure_defaults.env_indeterminate", risky }, `DaloyJS: ${risky.join(" and ")} present, but the runtime environment is indeterminate ` +
+            `(no env option and no NODE_ENV). The production-only refuse-to-boot guard is therefore ` +
+            `inactive. If this is production (e.g. an edge runtime), set app({ env: "production" }).`);
+    }
     assertRouteAuthPayloadConfig(route) {
         const auth = route.auth;
         if (!auth || auth.payload !== false)
@@ -845,9 +934,16 @@ export class App {
         // (unless the caller explicitly overrode it). Scalar / Swagger UI keep the
         // tighter default. The policy is deterministic from `ui` + `opts.csp`, so
         // compute it once at mount time instead of per request.
-        const docsCsp = docsContentSecurityPolicy(ui === "redoc"
-            ? { ...opts.csp, allowBlobWorkers: opts.csp?.allowBlobWorkers ?? true }
-            : opts.csp);
+        const docsConnectOrigins = [
+            ...(opts.csp?.connectOrigins ?? []),
+            ...serverConnectOrigins(this.options.openapi?.servers),
+        ];
+        const docsCsp = docsContentSecurityPolicy({
+            ...(ui === "redoc"
+                ? { ...opts.csp, allowBlobWorkers: opts.csp?.allowBlobWorkers ?? true }
+                : opts.csp),
+            ...(docsConnectOrigins.length ? { connectOrigins: docsConnectOrigins } : {}),
+        });
         this.route({
             method: "GET",
             path: docsPath,
@@ -863,6 +959,7 @@ export class App {
                     ? swaggerUiHtml({
                         specUrl: openapiPath,
                         title,
+                        configuration: opts.swagger,
                         assets: opts.assets,
                     })
                     : ui === "redoc"
@@ -875,7 +972,7 @@ export class App {
                         : scalarHtml({
                             specUrl: openapiPath,
                             title,
-                            configuration: opts.scalar,
+                            configuration: scalarConfigurationWithPreferredAuth(opts.scalar, this.options.openapi?.securitySchemes),
                             assets: opts.assets,
                         });
                 return {
@@ -2684,6 +2781,47 @@ function responsePipeline(fns) {
         return current;
     };
 }
+function serverConnectOrigins(servers) {
+    if (!servers)
+        return [];
+    const origins = [];
+    for (const server of servers) {
+        try {
+            const url = new URL(server.url);
+            if ((url.protocol === "http:" || url.protocol === "https:") &&
+                !origins.includes(url.origin)) {
+                origins.push(url.origin);
+            }
+        }
+        catch {
+            // Relative server URLs are already covered by connect-src 'self'.
+        }
+    }
+    return origins;
+}
+function scalarConfigurationWithPreferredAuth(configuration, schemes) {
+    const preferredSecurityScheme = schemes ? Object.keys(schemes)[0] : undefined;
+    if (!preferredSecurityScheme)
+        return configuration;
+    const authentication = configuration?.authentication;
+    if (authentication &&
+        typeof authentication === "object" &&
+        !Array.isArray(authentication) &&
+        "preferredSecurityScheme" in authentication) {
+        return configuration;
+    }
+    return {
+        ...(configuration ?? {}),
+        authentication: {
+            ...(authentication &&
+                typeof authentication === "object" &&
+                !Array.isArray(authentication)
+                ? authentication
+                : {}),
+            preferredSecurityScheme,
+        },
+    };
+}
 function finalizeResponse(res, ctx, hooks, stripFingerprint = true) {
     let final = res;
     const finish = (f) => {
@@ -3034,12 +3172,27 @@ async function readBody(req, ct, limit, multipart) {
         return out;
     }
     if (ct.includes("multipart/form-data")) {
-        // Multipart: rely on platform parser, but enforce content-length first.
+        // Fast-fail on an honestly-declared oversize body.
         const cl = req.headers.get("content-length");
         if (cl && Number(cl) > limit) {
             throw new PayloadTooLargeError(limit);
         }
-        const fd = await req.formData();
+        // Then cap the ACTUAL bytes before handing them to the platform
+        // formData() parser. Content-Length is not a sufficient gate on its own: a
+        // chunked upload sends none, and a lying small value slips past the check —
+        // in both cases the platform parser would otherwise buffer the whole body
+        // in memory on runtimes whose adapter does not cap at the socket layer
+        // (Workers / Deno / Vercel). `readBodyLimited` streams the body and
+        // throws `PayloadTooLargeError` the instant it exceeds `limit`; we then
+        // re-parse the bounded bytes with the standard `formData()` parser,
+        // preserving the multipart boundary via the original Content-Type. This is
+        // Web-standard only (`Request` + `formData`), so it stays runtime-portable.
+        const bytes = await readBodyLimited(req, limit);
+        const fd = await new Request(req.url, {
+            method: "POST",
+            headers: { "content-type": ct },
+            body: bytes,
+        }).formData();
         const out = {};
         let fields = 0;
         let files = 0;
@@ -3256,7 +3409,7 @@ const PACKAGE_JSON_CACHE = {};
  * none is found while walking up from `process.cwd()`, falls back to
  * `deno.json` / `deno.jsonc` so Deno projects get the same DX without a
  * `package.json`. Returns an empty object on edge runtimes (Cloudflare
- * Workers, Vercel Edge) where `node:fs` is absent, on any I/O or parse
+ * Workers) where `node:fs` is absent, on any I/O or parse
  * error, and when nothing is found.
  *
  * The result is memoized at module scope: manifests do not change

package/dist/compression.d.ts

@@ -3,7 +3,7 @@
  * BREACH-aware safe defaults.
  *
  * Built on the web-standard `CompressionStream` API so the same line works
- * on Node, Bun, Deno, Cloudflare Workers, Vercel Edge, and Fastly Compute.
+ * on Node, Bun, Deno, Cloudflare Workers, Vercel, and Fastly Compute.
  * The middleware deliberately refuses to expose a configurable compression
  * level — `CompressionStream` uses the runtime's documented default (gzip
  * level 6 on Node / V8); a `level: 9` opt-in is rejected at construction
@@ -68,10 +68,10 @@ export interface CompressionOptions {
      */
     authCookieNames?: readonly string[];
     /**
-    * Deliberately unsupported. Provided as a `never`-typed trap so the type
-    * system flags accidental opt-in. The actual `CompressionStream` never
-    * exposes a level knob — passing any value triggers a construction-time
-    * refusal.
+     * Deliberately unsupported. Provided as a `never`-typed trap so the type
+     * system flags accidental opt-in. The actual `CompressionStream` never
+     * exposes a level knob — passing any value triggers a construction-time
+     * refusal.
      *
      * @internal
      */

package/dist/compression.js

@@ -3,7 +3,7 @@
  * BREACH-aware safe defaults.
  *
  * Built on the web-standard `CompressionStream` API so the same line works
- * on Node, Bun, Deno, Cloudflare Workers, Vercel Edge, and Fastly Compute.
+ * on Node, Bun, Deno, Cloudflare Workers, Vercel, and Fastly Compute.
  * The middleware deliberately refuses to expose a configurable compression
  * level — `CompressionStream` uses the runtime's documented default (gzip
  * level 6 on Node / V8); a `level: 9` opt-in is rejected at construction

package/dist/docs.d.ts

@@ -254,7 +254,7 @@ export interface DocsAssetOptions {
      */
     crossOrigin?: "anonymous" | "use-credentials";
 }
-/** Shared options for {@link scalarHtml} and {@link swaggerUiHtml}. */
+/** Shared options for {@link scalarHtml}, {@link swaggerUiHtml}, and {@link redocHtml}. */
 export interface DocsOptions {
     /** Absolute or relative URL of the OpenAPI document to render. */
     specUrl: string;
@@ -273,6 +273,53 @@ export interface ScalarHtmlOptions extends DocsOptions {
     /** Forwarded to the Scalar `<script id="api-reference">` tag. */
     configuration?: ScalarReferenceConfiguration;
 }
+/** JSON-only subset of Swagger UI's `SwaggerUIBundle(...)` configuration. */
+export interface SwaggerUiConfiguration {
+    [key: string]: ScalarJsonValue | undefined;
+    /**
+     * Preserve developer-entered API credentials across reloads. Defaults to
+     * `true` in {@link swaggerUiHtml} so the built-in docs behave like a local
+     * developer console instead of forgetting the bearer token on every refresh.
+     */
+    persistAuthorization?: boolean;
+    /** Expand operations by default: `"list"`, `"full"`, or `"none"`. */
+    docExpansion?: "list" | "full" | "none";
+    /** Enable filtering operations by tag/path text. */
+    filter?: boolean | string;
+    /** Show operation extension fields such as `x-*`. */
+    showExtensions?: boolean;
+    /** Show common extension fields. */
+    showCommonExtensions?: boolean;
+    /** Render request duration after "Try it out" calls. */
+    displayRequestDuration?: boolean;
+    /** Sort operations by HTTP method, alphabetically, or with no sorter. */
+    operationsSorter?: "alpha" | "method";
+    /** Sort tags alphabetically or with no sorter. */
+    tagsSorter?: "alpha";
+    /**
+     * Internal URL wiring owned by DaloyJS. Use {@link DocsOptions.specUrl}
+     * instead of passing Swagger UI's `url` directly.
+     */
+    url?: never;
+    /**
+     * Internal DOM mount point owned by DaloyJS. The generated HTML always mounts
+     * Swagger UI into `#swagger`.
+     */
+    dom_id?: never;
+    /** Function-valued Swagger UI plugins cannot cross the server-to-HTML boundary. */
+    plugins?: never;
+    /** Function-valued presets cannot cross the server-to-HTML boundary. */
+    presets?: never;
+    /** Function-valued request interceptors cannot cross the server-to-HTML boundary. */
+    requestInterceptor?: never;
+    /** Function-valued response interceptors cannot cross the server-to-HTML boundary. */
+    responseInterceptor?: never;
+}
+/** Options for {@link swaggerUiHtml}; adds Swagger UI-specific configuration. */
+export interface SwaggerUiHtmlOptions extends DocsOptions {
+    /** Forwarded into `SwaggerUIBundle(...)` after `url` and `dom_id`. */
+    configuration?: SwaggerUiConfiguration;
+}
 /**
  * Options for {@link redocHtml}; adds Redoc-specific UI configuration.
  *
@@ -300,6 +347,14 @@ export interface AsyncApiHtmlOptions extends DocsOptions {
 export interface DocsContentSecurityPolicyOptions {
     /** Extra origins to allow for `script-src` / `style-src` (defaults to jsDelivr). */
     assetOrigins?: string[];
+    /**
+     * Extra origins to allow for `connect-src`. Add API origins here when the
+     * docs UI should send "Try it" requests somewhere other than the same origin
+     * serving the docs page.
+     *
+     * @since 0.42.0
+     */
+    connectOrigins?: string[];
     /** When set, allows nonce-protected inline scripts instead of `'unsafe-inline'`. */
     scriptNonce?: string;
     /** When `false`, omits `'unsafe-inline'` from `style-src`. Defaults to `true`. */
@@ -331,8 +386,12 @@ export declare function scalarHtml(opts: ScalarHtmlOptions): string;
 /**
  * Render a Swagger UI HTML page that loads `opts.specUrl`. Same usage as
  * {@link scalarHtml} but emits the classic Swagger UI bundle.
+ *
+ * Developer-entered credentials are persisted by default
+ * (`persistAuthorization: true`) so routes with OpenAPI security requirements
+ * can be exercised after using Swagger UI's Authorize dialog.
  */
-export declare function swaggerUiHtml(opts: DocsOptions): string;
+export declare function swaggerUiHtml(opts: SwaggerUiHtmlOptions): string;
 /**
  * Render a Redoc HTML page that loads `opts.specUrl`. Same usage as
  * {@link scalarHtml} / {@link swaggerUiHtml} but emits the Redoc standalone

package/dist/docs.js

@@ -67,10 +67,13 @@ export function scalarHtml(opts) {
 /**
  * Render a Swagger UI HTML page that loads `opts.specUrl`. Same usage as
  * {@link scalarHtml} but emits the classic Swagger UI bundle.
+ *
+ * Developer-entered credentials are persisted by default
+ * (`persistAuthorization: true`) so routes with OpenAPI security requirements
+ * can be exercised after using Swagger UI's Authorize dialog.
  */
 export function swaggerUiHtml(opts) {
     const title = escapeHtml(opts.title ?? "API Docs");
-    const url = escapeHtml(opts.specUrl);
     const cssUrl = escapeHtml(opts.assets?.swaggerUiCssUrl ??
         `${JSDELIVR_ORIGIN}/npm/swagger-ui-dist/swagger-ui.css`);
     const bundleUrl = escapeHtml(opts.assets?.swaggerUiBundleUrl ??
@@ -78,6 +81,12 @@ export function swaggerUiHtml(opts) {
     const cssSri = integrityAttr(opts.assets?.swaggerUiCssIntegrity, opts.assets?.crossOrigin);
     const bundleSri = integrityAttr(opts.assets?.swaggerUiBundleIntegrity, opts.assets?.crossOrigin);
     const nonce = nonceAttr(opts.scriptNonce);
+    const configuration = jsonForScript({
+        persistAuthorization: true,
+        ...(opts.configuration ?? {}),
+        url: opts.specUrl,
+        dom_id: "#swagger",
+    });
     return `<!doctype html>
 <html><head>
 <meta charset="utf-8" />
@@ -87,7 +96,7 @@ export function swaggerUiHtml(opts) {
 </head><body>
 <div id="swagger"></div>
 <script src="${bundleUrl}"${bundleSri}${nonce}></script>
-<script${nonce}>window.onload=()=>SwaggerUIBundle({url:"${url}",dom_id:"#swagger"});</script>
+<script${nonce}>window.onload=()=>SwaggerUIBundle(${configuration});</script>
 </body></html>`;
 }
 /**
@@ -179,12 +188,13 @@ export function docsContentSecurityPolicy(opts = {}) {
     const styleSrc = ["'self'", ...assetOrigins];
     if (opts.allowInlineStyles !== false)
         styleSrc.push("'unsafe-inline'");
+    const connectSrc = ["'self'", ...(opts.connectOrigins ?? [])];
     const directives = [
         "default-src 'self'",
         `script-src ${scriptSrc.join(" ")}`,
         `style-src ${styleSrc.join(" ")}`,
         "img-src 'self' data: https:",
-        "connect-src 'self'",
+        `connect-src ${connectSrc.join(" ")}`,
     ];
     // Redoc spawns a Web Worker from a `blob:` URL; without an explicit
     // worker-src the browser falls back to script-src, which forbids `blob:`
@@ -205,6 +215,7 @@ export function htmlResponse(html, opts = {}) {
             "content-security-policy": opts.contentSecurityPolicy ??
                 docsContentSecurityPolicy({
                     assetOrigins: opts.assetOrigins,
+                    connectOrigins: opts.connectOrigins,
                     scriptNonce: opts.scriptNonce,
                     allowInlineStyles: opts.allowInlineStyles,
                 }),

package/dist/idempotency.d.ts

@@ -26,7 +26,7 @@
  *
  * This module is dependency-free and uses only Web Crypto + Web Standard
  * `Request`/`Response`, so it runs unchanged on Node, Bun, Deno, Cloudflare
- * Workers, and Vercel Edge.
+ * Workers, and Vercel.
  *
  * @module
  * @since 0.37.0

package/dist/idempotency.js

@@ -26,7 +26,7 @@
  *
  * This module is dependency-free and uses only Web Crypto + Web Standard
  * `Request`/`Response`, so it runs unchanged on Node, Bun, Deno, Cloudflare
- * Workers, and Vercel Edge.
+ * Workers, and Vercel.
  *
  * @module
  * @since 0.37.0

package/dist/index.d.ts

@@ -4,6 +4,7 @@ export { findRoutesMissingResponseBodySchema } from "./app.js";
 export { _resetPackageJsonCacheForTests } from "./app.js";
 export { _resetCrashHandlersForTests } from "./app.js";
 export { _resetInsecureDefaultsLogForTests } from "./app.js";
+export { _resetIndeterminateEnvWarningForTests } from "./app.js";
 export type { AppOptions, AppOpenAPIOptions, DocsRouteOptions, AsyncAPIRouteOptions, HealthRouteOptions, CspReportRouteOptions, MetricsRouteOptions, IntrospectedRoute, PluginInstalledEvent, PluginExtension, ShutdownEvent, SecurityPreset, } from "./app.js";
 export { getConnInfo, setConnInfo, assertBehindProxy, resolveClientIp, readRemoteAddress, readRemotePort, pickForwardedForByHops, } from "./conn-info.js";
 export type { BehindProxyConfig, ConnInfo } from "./conn-info.js";
@@ -73,7 +74,7 @@ export type { RequestIdOptions, SecureHeadersOptions, CspDirectivesOptions, Cors
 export type { BearerAuthOptions, BearerAuthVerifyHook } from "./middleware.js";
 export { createLogger, noopLogger, DEFAULT_REDACT_KEYS } from "./logger.js";
 export type { Logger, LogLevel, ConsoleLoggerOptions, LoggerRedactionOptions, } from "./logger.js";
-export type { ScalarJsonPrimitive, ScalarJsonValue, ScalarReferenceConfiguration, ScalarTheme, RedocConfiguration, RedocHtmlOptions, AsyncApiHtmlOptions, DocsAssetOptions, } from "./docs.js";
+export type { ScalarJsonPrimitive, ScalarJsonValue, ScalarReferenceConfiguration, ScalarTheme, RedocConfiguration, RedocHtmlOptions, SwaggerUiConfiguration, SwaggerUiHtmlOptions, AsyncApiHtmlOptions, DocsAssetOptions, } from "./docs.js";
 export { formatStartupBanner, printStartupBanner } from "./banner.js";
 export type { StartupBannerLink, StartupBannerOptions } from "./banner.js";
 export { sseStream, sseResponse, ndjsonStream, ndjsonResponse, } from "./streaming.js";

package/dist/index.js

@@ -4,6 +4,7 @@ export { findRoutesMissingResponseBodySchema } from "./app.js";
 export { _resetPackageJsonCacheForTests } from "./app.js";
 export { _resetCrashHandlersForTests } from "./app.js";
 export { _resetInsecureDefaultsLogForTests } from "./app.js";
+export { _resetIndeterminateEnvWarningForTests } from "./app.js";
 export { getConnInfo, setConnInfo, assertBehindProxy, resolveClientIp, readRemoteAddress, readRemotePort, pickForwardedForByHops, } from "./conn-info.js";
 export { subdomains, PSL_SNAPSHOT_DATE, PSL_PUBLIC_SUFFIXES, MAX_SNAPSHOT_AGE_DAYS, } from "./subdomains.js";
 export { defineDependency, DEPENDENCY_MARKER } from "./dependency.js";

package/dist/metrics.d.ts

@@ -18,7 +18,7 @@
  *
  * Everything is built on Web-standard primitives (plus optional `process.*`
  * gauges guarded for non-Node runtimes), so it runs unchanged on Node, Bun,
- * Deno, Cloudflare Workers, and Vercel Edge.
+ * Deno, Cloudflare Workers, and Vercel.
  *
  * @module
  * @since 0.37.0

package/dist/metrics.js

@@ -18,7 +18,7 @@
  *
  * Everything is built on Web-standard primitives (plus optional `process.*`
  * gauges guarded for non-Node runtimes), so it runs unchanged on Node, Bun,
- * Deno, Cloudflare Workers, and Vercel Edge.
+ * Deno, Cloudflare Workers, and Vercel.
  *
  * @module
  * @since 0.37.0
@@ -231,10 +231,7 @@ export class Histogram extends Metric {
     }
     /** @internal */
     render() {
-        const lines = [
-            `# HELP ${this.name} ${escapeHelp(this.help)}`,
-            `# TYPE ${this.name} histogram`,
-        ];
+        const lines = [`# HELP ${this.name} ${escapeHelp(this.help)}`, `# TYPE ${this.name} histogram`];
         for (const s of this.series.values()) {
             for (let i = 0; i < this.bounds.length; i++) {
                 lines.push(`${this.name}_bucket${renderLabelBlock(s.labels, ["le", String(this.bounds[i])])} ${s.counts[i]}`);

package/dist/middleware.d.ts

@@ -72,7 +72,7 @@ export interface CspDirectivesOptions {
      * Pair with {@link SecureHeadersOptions.reportingEndpoints} (or
      * {@link App.cspReportRoute}) to register the receiver.
      *
-      * @since 0.20.0
+     * @since 0.20.0
      */
     reportTo?: string;
 }
@@ -112,7 +112,7 @@ export interface SecureHeadersOptions {
      * `reportTo: "csp-endpoint"` here as a shortcut) to direct CSP
      * violation reports there.
      *
-      * @since 0.20.0
+     * @since 0.20.0
      */
     reportingEndpoints?: Record<string, string>;
     /**
@@ -121,7 +121,7 @@ export interface SecureHeadersOptions {
      * header so violation reports land at the matching
      * `reportingEndpoints` URL.
      *
-      * @since 0.20.0
+     * @since 0.20.0
      */
     reportTo?: string;
 }
@@ -500,9 +500,9 @@ export interface BearerAuthOptions {
     realm?: string;
     /**
      * Optional per-request revalidation hook. Called after `validate`
-    * accepts the token. Returning `false` rejects the request with `403`;
-    * returning `true` or `undefined` accepts. Use for revocation lists,
-    * token-version counters, etc.
+     * accepts the token. Returning `false` rejects the request with `403`;
+     * returning `true` or `undefined` accepts. Use for revocation lists,
+     * token-version counters, etc.
      *
      * @since 0.22.0
      */

package/dist/middleware.js

@@ -44,7 +44,7 @@ function generateCspNonce() {
     const cryptoApi = globalThis.crypto;
     if (!cryptoApi?.getRandomValues) {
         throw new Error("secureHeaders(): WebCrypto is required to generate a CSP nonce. " +
-            "Run on Node 20+, Bun, Deno, Cloudflare Workers, or Vercel Edge.");
+            "Run on Node 20+, Bun, Deno, Cloudflare Workers, or Vercel.");
     }
     const nonceBytes = new Uint8Array(16);
     cryptoApi.getRandomValues(nonceBytes);
@@ -193,10 +193,7 @@ export function secureHeaders(opts = {}) {
         }
         cspOpt = { directives, reportTo: opts.reportTo };
     }
-    else if (opts.reportTo &&
-        cspOpt !== false &&
-        typeof cspOpt === "object" &&
-        !cspOpt.reportTo) {
+    else if (opts.reportTo && cspOpt !== false && typeof cspOpt === "object" && !cspOpt.reportTo) {
         cspOpt = { ...cspOpt, reportTo: opts.reportTo };
     }
     const cspIsDynamic = cspOpt !== false && typeof cspOpt === "object";
@@ -479,10 +476,9 @@ export function cors(opts) {
     // produces broken-but-not-obviously-broken behavior in production. Fail
     // closed at construction time instead.
     if (opts.credentials) {
-        const includesWildcard = opts.origin === "*" ||
-            (Array.isArray(opts.origin) && opts.origin.includes("*"));
+        const includesWildcard = opts.origin === "*" || (Array.isArray(opts.origin) && opts.origin.includes("*"));
         if (includesWildcard) {
-            throw new Error("cors(): origin: \"*\" cannot be combined with credentials: true. " +
+            throw new Error('cors(): origin: "*" cannot be combined with credentials: true. ' +
                 "Pass an explicit origin string, an array of allowed origins, or a predicate function instead.");
         }
     }
@@ -558,8 +554,7 @@ export function cors(opts) {
     };
     hooks[CORS_HOOK_MARKER] = true;
     hooks[CORS_ORIGIN_ALLOW_MARKER] = (origin) => allow(origin) !== null;
-    const hasWildcard = opts.origin === "*" ||
-        (Array.isArray(opts.origin) && opts.origin.includes("*"));
+    const hasWildcard = opts.origin === "*" || (Array.isArray(opts.origin) && opts.origin.includes("*"));
     if (hasWildcard) {
         hooks[CORS_WILDCARD_ORIGIN_MARKER] = true;
     }
@@ -732,9 +727,7 @@ export function loginThrottle(opts = {}) {
         groupId,
         keyGenerator,
         ...(opts.store ? { store: opts.store } : {}),
-        ...(opts.trustProxyHeaders !== undefined
-            ? { trustProxyHeaders: opts.trustProxyHeaders }
-            : {}),
+        ...(opts.trustProxyHeaders !== undefined ? { trustProxyHeaders: opts.trustProxyHeaders } : {}),
         ...(opts.retryAfter !== undefined ? { retryAfter: opts.retryAfter } : {}),
     });
     let slowdownBuckets = SHARED_LOGIN_THROTTLE_BUCKETS.get(groupId);
@@ -1229,9 +1222,7 @@ export function requireScopes(scopes) {
                 });
             }
             const owned = readUserScopes(user);
-            const missing = owned === null
-                ? aggregate.slice()
-                : aggregate.filter((s) => !owned.has(s));
+            const missing = owned === null ? aggregate.slice() : aggregate.filter((s) => !owned.has(s));
             if (missing.length > 0) {
                 throw new ForbiddenError(`Missing required scope(s): ${missing.join(", ")}.`);
             }

package/dist/pagination.d.ts

@@ -22,7 +22,7 @@
  *
  * Everything here is built on Web-standard `URL` / `Request` and `btoa` /
  * `atob`, so it runs unchanged on Node, Bun, Deno, Cloudflare Workers, and
- * Vercel Edge.
+ * Vercel.
  *
  * @module
  * @since 0.37.0

package/dist/pagination.js

@@ -22,7 +22,7 @@
  *
  * Everything here is built on Web-standard `URL` / `Request` and `btoa` /
  * `atob`, so it runs unchanged on Node, Bun, Deno, Cloudflare Workers, and
- * Vercel Edge.
+ * Vercel.
  *
  * @module
  * @since 0.37.0

package/dist/request-decompression.d.ts

@@ -24,7 +24,7 @@
  *
  * The compressed input itself is bounded by `maxCompressedBytes` before a single
  * byte is inflated. Built on the web-standard `DecompressionStream`, so the same
- * line works on Node, Bun, Deno, Cloudflare Workers, and Vercel Edge. Zero
+ * line works on Node, Bun, Deno, Cloudflare Workers, and Vercel. Zero
  * runtime dependencies.
  *
  * The middleware runs in the {@link "./types.js".Hooks.onRequest} phase — before

package/dist/request-decompression.js

@@ -24,7 +24,7 @@
  *
  * The compressed input itself is bounded by `maxCompressedBytes` before a single
  * byte is inflated. Built on the web-standard `DecompressionStream`, so the same
- * line works on Node, Bun, Deno, Cloudflare Workers, and Vercel Edge. Zero
+ * line works on Node, Bun, Deno, Cloudflare Workers, and Vercel. Zero
  * runtime dependencies.
  *
  * The middleware runs in the {@link "./types.js".Hooks.onRequest} phase — before

package/dist/response-cache.d.ts

@@ -34,7 +34,7 @@
  *
  * This module is dependency-free and uses only Web Standard
  * `Request`/`Response` + `Headers`, so it runs unchanged on Node, Bun, Deno,
- * Cloudflare Workers, and Vercel Edge.
+ * Cloudflare Workers, and Vercel.
  *
  * @module
  * @since 0.37.0

package/dist/response-cache.js

@@ -34,7 +34,7 @@
  *
  * This module is dependency-free and uses only Web Standard
  * `Request`/`Response` + `Headers`, so it runs unchanged on Node, Bun, Deno,
- * Cloudflare Workers, and Vercel Edge.
+ * Cloudflare Workers, and Vercel.
  *
  * @module
  * @since 0.37.0
@@ -304,9 +304,7 @@ export function responseCache(opts = {}) {
             const reqCc = parseCacheControl(ctx.request.headers.get("cache-control"));
             if (reqCc.has("no-store"))
                 return undefined;
-            const rawKey = opts.keyGenerator
-                ? opts.keyGenerator(ctx)
-                : defaultKey(ctx, varyHeaders);
+            const rawKey = opts.keyGenerator ? opts.keyGenerator(ctx) : defaultKey(ctx, varyHeaders);
             if (rawKey === null)
                 return undefined;
             const key = `${keyPrefix}${rawKey}`;

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:24c97016-8019-52fa-bf46-65a4325559ec",
+  "serialNumber": "urn:uuid:086b2383-b351-57fb-bd98-0fbf04f2342b",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-21T08:21:23.570Z",
+    "timestamp": "2026-06-22T21:07:28.471Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "1.0.0-beta.0"
+        "version": "1.0.0-beta.2"
       }
     ],
     "authors": [
@@ -19,11 +19,11 @@
     ],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/@daloyjs/core@1.0.0-beta.0",
+      "bom-ref": "pkg:npm/@daloyjs/core@1.0.0-beta.2",
       "name": "@daloyjs/core",
-      "version": "1.0.0-beta.0",
+      "version": "1.0.0-beta.2",
       "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
-      "purl": "pkg:npm/@daloyjs/core@1.0.0-beta.0",
+      "purl": "pkg:npm/@daloyjs/core@1.0.0-beta.2",
       "licenses": [
         {
           "license": {
@@ -46,9 +46,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag--daloyjs-core-1.0.0-beta.0",
+        "tagId": "swidtag--daloyjs-core-1.0.0-beta.2",
         "name": "@daloyjs/core",
-        "version": "1.0.0-beta.0",
+        "version": "1.0.0-beta.2",
         "tagVersion": 0,
         "patch": false
       }
@@ -57,7 +57,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/@daloyjs/core@1.0.0-beta.0",
+      "ref": "pkg:npm/@daloyjs/core@1.0.0-beta.2",
       "dependsOn": []
     }
   ]

package/dist/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@daloyjs/core-1.0.0-beta.0",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.0.0-beta.0-24c97016-8019-52fa-bf46-65a4325559ec",
+  "name": "@daloyjs/core-1.0.0-beta.2",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.0.0-beta.2-086b2383-b351-57fb-bd98-0fbf04f2342b",
   "creationInfo": {
-    "created": "2026-06-21T08:21:23.570Z",
+    "created": "2026-06-22T21:07:28.471Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package--daloyjs-core",
       "name": "@daloyjs/core",
-      "versionInfo": "1.0.0-beta.0",
+      "versionInfo": "1.0.0-beta.2",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/@daloyjs/core@1.0.0-beta.0"
+          "referenceLocator": "pkg:npm/@daloyjs/core@1.0.0-beta.2"
         }
       ]
     }

package/dist/scheduler.d.ts

@@ -22,7 +22,7 @@
  *
  * Everything is built on Web-standard primitives (`AbortController`,
  * `Intl.DateTimeFormat` for timezone wall-clock math, `setTimeout`), so it
- * runs unchanged on Node, Bun, Deno, Cloudflare Workers, and Vercel Edge, with
+ * runs unchanged on Node, Bun, Deno, Cloudflare Workers, and Vercel, with
  * zero runtime dependencies. Pair it with {@link App.cron} for an app-managed
  * scheduler whose lifecycle is tied to graceful shutdown, or drive a
  * {@link Scheduler} directly.

package/dist/scheduler.js

@@ -22,7 +22,7 @@
  *
  * Everything is built on Web-standard primitives (`AbortController`,
  * `Intl.DateTimeFormat` for timezone wall-clock math, `setTimeout`), so it
- * runs unchanged on Node, Bun, Deno, Cloudflare Workers, and Vercel Edge, with
+ * runs unchanged on Node, Bun, Deno, Cloudflare Workers, and Vercel, with
  * zero runtime dependencies. Pair it with {@link App.cron} for an app-managed
  * scheduler whose lifecycle is tied to graceful shutdown, or drive a
  * {@link Scheduler} directly.
@@ -63,11 +63,27 @@ const CRON_ALIASES = {
     "@hourly": "0 * * * *",
 };
 const MONTH_NAMES = {
-    jan: 1, feb: 2, mar: 3, apr: 4, may: 5, jun: 6,
-    jul: 7, aug: 8, sep: 9, oct: 10, nov: 11, dec: 12,
+    jan: 1,
+    feb: 2,
+    mar: 3,
+    apr: 4,
+    may: 5,
+    jun: 6,
+    jul: 7,
+    aug: 8,
+    sep: 9,
+    oct: 10,
+    nov: 11,
+    dec: 12,
 };
 const DAY_NAMES = {
-    sun: 0, mon: 1, tue: 2, wed: 3, thu: 4, fri: 5, sat: 6,
+    sun: 0,
+    mon: 1,
+    tue: 2,
+    wed: 3,
+    thu: 4,
+    fri: 5,
+    sat: 6,
 };
 function resolveNamed(token, names) {
     const lower = token.toLowerCase();
@@ -163,7 +179,13 @@ export function parseCron(expression) {
     };
 }
 const WEEKDAY_INDEX = {
-    Sun: 0, Mon: 1, Tue: 2, Wed: 3, Thu: 4, Fri: 5, Sat: 6,
+    Sun: 0,
+    Mon: 1,
+    Tue: 2,
+    Wed: 3,
+    Thu: 4,
+    Fri: 5,
+    Sat: 6,
 };
 function wallClockOf(date, timeZone) {
     if (timeZone === undefined || timeZone === "UTC") {
@@ -323,7 +345,12 @@ export class Scheduler {
             skipped: 0,
         };
         this.#tasks.set(def.name, task);
-        this.#logger?.debug({ event: "scheduler.task.defined", task: def.name, cron: def.cron, intervalMs: def.intervalMs }, `Scheduled task "${def.name}" defined`);
+        this.#logger?.debug({
+            event: "scheduler.task.defined",
+            task: def.name,
+            cron: def.cron,
+            intervalMs: def.intervalMs,
+        }, `Scheduled task "${def.name}" defined`);
         if (this.#started && !this.#stopped)
             this.#arm(task, def.runOnStart === true);
         return this;
@@ -518,7 +545,13 @@ export class Scheduler {
             catch (error) {
                 task.failures++;
                 task.lastError = error;
-                this.#logger?.error({ event: "scheduler.task.failed", task: task.def.name, runCount, timedOut, err: serializeError(error) }, `Scheduled task "${task.def.name}" failed`);
+                this.#logger?.error({
+                    event: "scheduler.task.failed",
+                    task: task.def.name,
+                    runCount,
+                    timedOut,
+                    err: serializeError(error),
+                }, `Scheduled task "${task.def.name}" failed`);
                 try {
                     task.def.onError?.(error, { name: task.def.name, runCount, timedOut });
                 }

package/dist/session.d.ts

@@ -13,7 +13,7 @@
  * backed by Redis, Cloudflare KV, Vercel KV, or any other shared store.
  *
  * The module is dependency-free and uses Web Crypto (`crypto.subtle`), so it
- * works on Node, Bun, Deno, Cloudflare Workers, and Vercel Edge.
+ * works on Node, Bun, Deno, Cloudflare Workers, and Vercel.
  */
 import type { BaseContext, Hooks } from "./types.js";
 /**

package/dist/session.js

@@ -13,7 +13,7 @@
  * backed by Redis, Cloudflare KV, Vercel KV, or any other shared store.
  *
  * The module is dependency-free and uses Web Crypto (`crypto.subtle`), so it
- * works on Node, Bun, Deno, Cloudflare Workers, and Vercel Edge.
+ * works on Node, Bun, Deno, Cloudflare Workers, and Vercel.
  */
 import { assertCookieAttributes, readRequestCookie, serializeClearCookie, serializeCookie, } from "./cookie.js";
 import { timingSafeEqual } from "./security.js";
@@ -385,7 +385,9 @@ const DEFAULT_ROTATE_SESSION_KEYS = [
 ];
 function sessionFromContext(ctx) {
     const value = ctx.state[STATE_KEY];
-    if (!value || typeof value !== "object" || typeof value.regenerate !== "function") {
+    if (!value ||
+        typeof value !== "object" ||
+        typeof value.regenerate !== "function") {
         throw new Error("rotateSession(): session() must run before rotateSession().");
     }
     return value;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daloyjs/core",
-  "version": "1.0.0-beta.0",
+  "version": "1.0.0-beta.2",
   "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
   "type": "module",
   "publishConfig": {