@daloyjs/core 1.0.0 → 1.1.0

package/dist/ip-restriction.js

@@ -8,7 +8,11 @@
  * @since 0.19.0
  */
 import { ForbiddenError } from "./errors.js";
-import { resolveForwardedClientIp, resolveForwardedTrust } from "./conn-info.js";
+import { resolveForwardedClientIp, resolveForwardedTrust, resolveTrustedProxyMatchers, } from "./conn-info.js";
+// Matcher primitives live in a leaf module so `conn-info` can peer-verify
+// without importing this file (which would form a cycle through trust helpers).
+import { compileCidrMatcher, matchesMatcher, parseIp } from "./ip-match.js";
+export { compileCidrMatcher, matchesMatcher, parseIp } from "./ip-match.js";
 /**
  * Block or allow requests by source IP / CIDR range. In direct Web-standard
  * runtimes, pass `resolveIp` from the adapter-specific connection metadata.
@@ -42,7 +46,9 @@ export function ipRestriction(opts) {
     const allow = (opts.allow ?? []).map(compileCidrMatcher);
     const deny = (opts.deny ?? []).map(compileCidrMatcher);
     const hops = resolveForwardedTrust("ipRestriction()", opts);
-    const resolveIp = opts.resolveIp ?? (hops !== undefined ? forwardedIpResolver(hops) : noIpResolver);
+    const proxyMatchers = resolveTrustedProxyMatchers("ipRestriction()", opts);
+    const resolveIp = opts.resolveIp ??
+        (hops !== undefined ? forwardedIpResolver(hops, proxyMatchers) : noIpResolver);
     const message = opts.message ?? "IP address not permitted";
     return {
         // `preBody`, not `beforeHandle`: a gate that returns a Response from
@@ -69,163 +75,6 @@ export function ipRestriction(opts) {
 function noIpResolver(_ctx) {
     return undefined;
 }
-function forwardedIpResolver(hops) {
-    return (ctx) => resolveForwardedClientIp(ctx.request, hops);
-}
-/**
- * Test whether a parsed IP falls inside a compiled CIDR matcher, comparing
- * only the matcher's prefix bits. IPv4-mapped IPv6 addresses
- * (`::ffff:a.b.c.d`) are normalized so they match IPv4 matchers.
- *
- * @param ip Parsed client address from {@link parseIp}.
- * @param m Compiled matcher from {@link compileCidrMatcher}.
- * @returns `true` when the address is within the matcher's range.
- * @internal
- */
-export function matchesMatcher(ip, m) {
-    const candidate = normalizeFamily(ip, m.family);
-    if (!candidate)
-        return false;
-    const expected = m.bytes;
-    const totalBits = candidate.length * 8;
-    const prefix = Math.min(m.prefix, totalBits);
-    const fullBytes = prefix >> 3;
-    for (let i = 0; i < fullBytes; i++) {
-        if (candidate[i] !== expected[i])
-            return false;
-    }
-    const remaining = prefix - fullBytes * 8;
-    if (remaining === 0)
-        return true;
-    const mask = 0xff << (8 - remaining);
-    return ((candidate[fullBytes] ^ expected[fullBytes]) & mask) === 0;
-}
-/**
- * Compile an IP or CIDR pattern (e.g. `"10.0.0.0/8"`, `"::1"`) into an
- * {@link IpMatcher}. A bare address gets a full-length prefix (/32 or /128);
- * host bits beyond the prefix are masked to zero.
- *
- * @param input IPv4/IPv6 address, optionally with a `/prefix` suffix.
- * @returns The compiled matcher used by {@link matchesMatcher}.
- * @throws Error when the address or CIDR prefix is invalid.
- * @internal
- */
-export function compileCidrMatcher(input) {
-    let addr = input;
-    let prefixStr;
-    if (input.includes("/")) {
-        const slash = input.indexOf("/");
-        addr = input.slice(0, slash);
-        prefixStr = input.slice(slash + 1);
-    }
-    const parsed = parseIp(addr);
-    if (!parsed) {
-        throw new Error(`ipRestriction(): invalid IP address ${JSON.stringify(input)}.`);
-    }
-    const totalBits = parsed.family === 4 ? 32 : 128;
-    let prefix = totalBits;
-    if (prefixStr !== undefined) {
-        if (!/^\d+$/.test(prefixStr)) {
-            throw new Error(`ipRestriction(): invalid CIDR prefix in ${JSON.stringify(input)}.`);
-        }
-        prefix = Number.parseInt(prefixStr, 10);
-        if (!Number.isInteger(prefix) || prefix < 0 || prefix > totalBits) {
-            throw new Error(`ipRestriction(): invalid CIDR prefix in ${JSON.stringify(input)}.`);
-        }
-    }
-    return { family: parsed.family, prefix, bytes: applyPrefixMask(parsed.bytes, prefix) };
-}
-function normalizeFamily(ip, family) {
-    if (ip.family === family)
-        return ip.bytes;
-    if (ip.family === 6 && family === 4) {
-        // IPv4-mapped IPv6 (::ffff:a.b.c.d) — accept as IPv4.
-        const b = ip.bytes;
-        const isMapped = b.slice(0, 10).every((x) => x === 0) && b[10] === 0xff && b[11] === 0xff;
-        if (isMapped)
-            return b.slice(12);
-        return undefined;
-    }
-    return undefined;
-}
-function applyPrefixMask(bytes, prefix) {
-    const out = new Uint8Array(bytes);
-    const fullBytes = prefix >> 3;
-    const remaining = prefix - fullBytes * 8;
-    if (remaining > 0 && fullBytes < out.length) {
-        const mask = 0xff << (8 - remaining);
-        out[fullBytes] = out[fullBytes] & mask;
-    }
-    for (let i = fullBytes + (remaining > 0 ? 1 : 0); i < out.length; i++) {
-        out[i] = 0;
-    }
-    return out;
-}
-/**
- * Parse an IPv4 or IPv6 address string into raw bytes. Supports IPv6 `::`
- * compression and IPv4-mapped tails (`::ffff:1.2.3.4`).
- *
- * @param input Address string; surrounding whitespace is trimmed.
- * @returns The parsed address, or `undefined` when the input is not a valid
- *   IP (callers treat unparseable addresses as a rejection, failing closed).
- * @internal
- */
-export function parseIp(input) {
-    const trimmed = input.trim();
-    if (trimmed.includes(":"))
-        return parseIPv6(trimmed);
-    return parseIPv4(trimmed);
-}
-function parseIPv4(input) {
-    const parts = input.split(".");
-    if (parts.length !== 4)
-        return undefined;
-    const bytes = new Uint8Array(4);
-    for (let i = 0; i < 4; i++) {
-        const part = parts[i];
-        if (!/^\d{1,3}$/.test(part))
-            return undefined;
-        const n = Number.parseInt(part, 10);
-        if (n < 0 || n > 255)
-            return undefined;
-        bytes[i] = n;
-    }
-    return { bytes, family: 4 };
-}
-function parseIPv6(input) {
-    // Support IPv4-mapped tail (::ffff:1.2.3.4).
-    let working = input;
-    const lastColon = working.lastIndexOf(":");
-    if (lastColon !== -1 && working.slice(lastColon + 1).includes(".")) {
-        const v4 = parseIPv4(working.slice(lastColon + 1));
-        if (!v4)
-            return undefined;
-        const hi = (v4.bytes[0] << 8) | v4.bytes[1];
-        const lo = (v4.bytes[2] << 8) | v4.bytes[3];
-        working = working.slice(0, lastColon + 1) + hi.toString(16) + ":" + lo.toString(16);
-    }
-    const parts = working.split("::");
-    if (parts.length > 2)
-        return undefined;
-    const headGroups = parts[0] === "" ? [] : parts[0].split(":");
-    const tailGroups = parts.length === 2 && parts[1] !== "" ? parts[1].split(":") : [];
-    const explicit = headGroups.length + tailGroups.length;
-    if (explicit > 8)
-        return undefined;
-    if (parts.length === 1 && explicit !== 8)
-        return undefined;
-    const missing = parts.length === 2 ? 8 - explicit : 0;
-    const groups = [...headGroups, ...Array.from({ length: missing }, () => "0"), ...tailGroups];
-    if (groups.length !== 8)
-        return undefined;
-    const bytes = new Uint8Array(16);
-    for (let index = 0; index < 8; index++) {
-        const group = groups[index];
-        if (!/^[0-9a-fA-F]{1,4}$/.test(group))
-            return undefined;
-        const n = Number.parseInt(group, 16);
-        bytes[index * 2] = (n >> 8) & 0xff;
-        bytes[index * 2 + 1] = n & 0xff;
-    }
-    return { bytes, family: 6 };
+function forwardedIpResolver(hops, trustedPeers) {
+    return (ctx) => resolveForwardedClientIp(ctx.request, hops, trustedPeers);
 }

package/dist/jwt.d.ts

@@ -57,7 +57,7 @@ export interface JwtSignerOptions {
     env?: "production" | "development" | "test";
     /** Set `secureDefaults: false` to skip the production opt-out gate. */
     secureDefaults?: boolean;
-    /** Optional extra header fields (`kid`, `typ`, ...). `alg` is always derived. */
+    /** Optional extra header fields (`kid`, `typ`, ...). `alg` is always derived. `crit` is refused: no JWS extensions are supported, so a `crit` token could never verify. */
     header?: Record<string, unknown>;
 }
 /** Options for {@link createJwtVerifier}. */
@@ -94,6 +94,20 @@ export interface JwtVerifierOptions {
      * never `token_revoked` (which would leak the existence of the `jti`).
      */
     isRevoked?: (verified: JwtVerified) => boolean | Promise<boolean>;
+    /**
+     * Maximum accepted token lifetime in seconds, enforced at verification
+     * time as `exp - (iat ?? now) <= maxLifetimeSeconds`. Mirrors the signer-
+     * side {@link JwtSignerOptions.maxLifetimeSeconds} requirement: without it,
+     * a verifier accepts any validly-signed token no matter how long it lives
+     * (a 100-year token issued by a misconfigured or compromised signer of the
+     * same key would verify). Tokens with no `exp` are also rejected when this
+     * is set. Optional — left unset for callers that deliberately accept
+     * externally-issued long-lived tokens (e.g. refresh tokens verified by a
+     * dedicated endpoint).
+     *
+     * @since 1.1.0
+     */
+    maxLifetimeSeconds?: number;
     /** Optional injectable clock for tests. */
     now?: () => number;
 }

package/dist/jwt.js

@@ -260,6 +260,14 @@ export function createJwtSigner(opts) {
         opts.secureDefaults !== false) {
         throw new JwtError("ack_no_exp_refused_in_production", "jwt(): acknowledgeNoExp: true is refused in production under secureDefaults — every issued JWT must carry an exp claim.");
     }
+    // The verifier refuses any `crit` header per RFC 7515 §4.1.11 (no JWS
+    // extensions are supported), so the signer must never emit one either —
+    // otherwise it would mint tokens its own verifier rejects. Checked
+    // synchronously at construction like every other signer option.
+    const extraHeader = opts.header && isJsonObject(opts.header) ? { ...opts.header } : {};
+    if ("crit" in extraHeader) {
+        throw new JwtError("unsupported_crit", "jwt(): header.crit is refused — this implementation supports no JWS extensions, so a crit token could never verify.");
+    }
     const resolved = (async () => {
         const key = await importKey(alg, opts.key, "sign");
         return {
@@ -267,7 +275,7 @@ export function createJwtSigner(opts) {
             key,
             maxLifetimeSeconds: opts.maxLifetimeSeconds,
             allowNoExp: opts.acknowledgeNoExp === true,
-            header: opts.header && isJsonObject(opts.header) ? { ...opts.header } : {},
+            header: extraHeader,
         };
     })();
     return {
@@ -375,6 +383,12 @@ export function createJwtVerifier(opts) {
     if (opts.isRevoked !== undefined && typeof opts.isRevoked !== "function") {
         throw new JwtError("invalid_is_revoked", "jwt(): isRevoked must be a function (verified) => boolean | Promise<boolean>.");
     }
+    if (opts.maxLifetimeSeconds !== undefined &&
+        (!Number.isFinite(opts.maxLifetimeSeconds) ||
+            opts.maxLifetimeSeconds <= 0 ||
+            !Number.isInteger(opts.maxLifetimeSeconds))) {
+        throw new JwtError("invalid_max_lifetime", "jwt(): verifier maxLifetimeSeconds must be a positive integer.");
+    }
     const issuers = normalizeStringSet(opts.issuer);
     const audiences = normalizeStringSet(opts.audience);
     const keyCache = new Map();
@@ -403,6 +417,7 @@ export function createJwtVerifier(opts) {
         audiences,
         clockSkewSeconds: opts.clockSkewSeconds ?? 0,
         isRevoked: opts.isRevoked ?? null,
+        maxLifetimeSeconds: opts.maxLifetimeSeconds ?? null,
         now: opts.now ?? (() => Math.floor(Date.now() / 1000)),
     };
     return {
@@ -449,6 +464,15 @@ async function verifyInternal(token, r) {
         throw new JwtError("alg_not_allowed", `jwt(): token alg "${String(algRaw)}" is not in the allowlist.`);
     }
     const alg = algRaw;
+    // RFC 7515 §4.1.11: a JWS whose header carries `crit` MUST be rejected when
+    // any listed extension is not understood. This verifier supports no JWS
+    // extensions at all, so any `crit` header is refused outright — otherwise a
+    // token smuggling an extension-marked-critical parameter (e.g.
+    // `crit:["exp"]` with `exp` mirrored into the header) would be accepted
+    // while its critical semantics were silently ignored.
+    if (header.crit !== undefined) {
+        throw new JwtError("unsupported_crit", "jwt(): token header carries 'crit' but this verifier supports no JWS extensions; refusing per RFC 7515 §4.1.11.");
+    }
     const key = await r.resolveKey(header);
     const sig = b64urlDecode(sigB64);
     const signingInput = ENC.encode(`${headerB64}.${payloadB64}`);
@@ -475,6 +499,16 @@ async function verifyInternal(token, r) {
         }
         throw err;
     }
+    if (r.maxLifetimeSeconds !== null) {
+        const exp = payload.exp;
+        if (typeof exp !== "number" || !Number.isFinite(exp)) {
+            throw new JwtError("missing_exp", "jwt(): verifier maxLifetimeSeconds is set but the token has no exp claim.");
+        }
+        const iat = typeof payload.iat === "number" && Number.isFinite(payload.iat) ? payload.iat : now;
+        if (exp - iat > r.maxLifetimeSeconds) {
+            throw new JwtError("lifetime_exceeded", `jwt(): token lifetime ${exp - iat}s exceeds verifier maxLifetimeSeconds ${r.maxLifetimeSeconds}s.`);
+        }
+    }
     if (r.issuers) {
         const iss = payload.iss;
         if (typeof iss !== "string" || !r.issuers.has(iss)) {

package/dist/middleware.d.ts

@@ -453,7 +453,7 @@ export interface RateLimitStore {
 export type RateLimitContext = PreBodyContext<any> | BaseContext<any, any>;
 /** Options for {@link rateLimit}. */
 export interface RateLimitOptions {
-    /** Rolling-window width in milliseconds (e.g. `60_000` for one minute). */
+    /** Fixed-window width in milliseconds (e.g. `60_000` for one minute). */
     windowMs: number;
     /** Maximum allowed requests per `windowMs` per key. */
     max: number;
@@ -474,7 +474,9 @@ export interface RateLimitOptions {
      * When enabled, the key is the **rightmost** `X-Forwarded-For` entry — the
      * one your immediate proxy appended — never the attacker-influenceable
      * leftmost one, so rotating spoofed left entries cannot evade the limit.
-     * Behind more than one proxy hop, set {@link trustedHops} instead.
+     * Behind more than one proxy hop, set {@link trustedHops} instead; to also
+     * verify the peer is one of YOUR proxies (required when the origin itself
+     * can be reached), set {@link trustedProxies}.
      */
     trustProxyHeaders?: boolean;
     /**
@@ -486,6 +488,18 @@ export interface RateLimitOptions {
      * is supplied.
      */
     trustedHops?: number;
+    /**
+     * Declare WHICH proxies are yours: an IP/CIDR allowlist for the immediate
+     * peer's address. Forwarded headers feed the bucket key only when the TCP
+     * socket actually talking to the adapter matches the list — the one
+     * property a remote client cannot spoof — so a direct-to-origin attacker
+     * can neither evade the limit with rotating spoofed XFF nor burn another
+     * identity's bucket. Implies proxy-header trust at one hop unless
+     * {@link trustedHops} says otherwise; validated and compiled at
+     * construction. On peer-less edge platforms verification fails closed.
+     * Ignored when a custom `keyGenerator` is supplied.
+     */
+    trustedProxies?: readonly string[];
     /** When true, set Retry-After header on 429. Default: true. */
     retryAfter?: boolean;
     /**
@@ -578,6 +592,17 @@ export interface LoginThrottleOptions {
      * supplied.
      */
     trustedHops?: number;
+    /**
+     * Declare WHICH proxies are yours: an IP/CIDR allowlist for the immediate
+     * peer's address. Forwarded headers feed the throttle key only when the
+     * TCP socket actually talking to the adapter matches the list, so a
+     * direct-to-origin attacker cannot dodge the slowdown with spoofed XFF.
+     * Implies proxy-header trust at one hop unless {@link trustedHops} says
+     * otherwise; validated and compiled at construction. On peer-less edge
+     * platforms verification fails closed. Ignored when a custom
+     * `keyGenerator` is supplied.
+     */
+    trustedProxies?: readonly string[];
     /** When true, set Retry-After header on 429. Default: true. */
     retryAfter?: boolean;
     /** Start slowing responses after this many attempts in the same window. Default: 2. */

package/dist/middleware.js

@@ -7,7 +7,7 @@
 import { assertCookieAttributes, readRequestCookie, serializeCookie } from "./cookie.js";
 import { TooManyRequestsError, ForbiddenError } from "./errors.js";
 import { randomId, sanitizeHeaderName, timingSafeEqual } from "./security.js";
-import { resolveForwardedClientIp, resolveForwardedTrust } from "./conn-info.js";
+import { getConnInfo, resolveForwardedClientIp, resolveForwardedTrust, resolveTrustedProxyMatchers, } from "./conn-info.js";
 /**
  * Generate or accept a stable `X-Request-ID` for every request. The id is
  * stamped on `ctx.state.requestId`, mirrored on outgoing response headers,
@@ -777,7 +777,8 @@ export function rateLimit(opts) {
     }
     const groupPrefix = opts.groupId ? `${opts.groupId}:` : "";
     const hops = resolveForwardedTrust("rateLimit()", opts);
-    const keyOf = opts.keyGenerator ?? defaultForwardedRateLimitKey(hops);
+    const proxyMatchers = resolveTrustedProxyMatchers("rateLimit()", opts);
+    const keyOf = opts.keyGenerator ?? defaultForwardedRateLimitKey(hops, proxyMatchers);
     const enforce = async (ctx) => {
         const key = `${groupPrefix}${keyOf(ctx)}`;
         const { count, resetMs } = await store.hit(key, opts.windowMs);
@@ -807,20 +808,37 @@ function assertPositiveInteger(name, value) {
 }
 /**
  * Default rate-limit / login-throttle key: the spoof-resistant forwarded client
- * IP, or the shared `"global"` bucket when proxy-header trust is off or the
- * request carries no trustworthy forwarded identity.
+ * IP, the unspoofable TCP peer when no trustworthy forwarded identity exists,
+ * or the shared `"global"` bucket only when proxy-header trust is off or the
+ * adapter attached no peer metadata.
  *
  * @param hops - Trusted proxy hop count from
  *   {@link "./conn-info.js".resolveForwardedTrust}, or `undefined` when
  *   forwarded-header trust is disabled.
+ * @param trustedPeers - Compiled `trustedProxies` allowlist from
+ *   {@link "./conn-info.js".resolveTrustedProxyMatchers}; when supplied, the
+ *   forwarded identity is honoured only for a verified proxy peer.
  * @returns A key generator suitable for {@link rateLimit} and
  *   {@link loginThrottle}.
  * @internal
  */
-function defaultForwardedRateLimitKey(hops) {
+function defaultForwardedRateLimitKey(hops, trustedPeers) {
     if (hops === undefined)
         return () => "global";
-    return (ctx) => resolveForwardedClientIp(ctx.request, hops) ?? "global";
+    return (ctx) => {
+        const forwarded = resolveForwardedClientIp(ctx.request, hops, trustedPeers);
+        if (forwarded !== undefined)
+            return forwarded;
+        // Fail safe, not silent: missing/untrusted XFF must not collapse every
+        // caller into one shared bucket (attacker-induced global lockout). Key on
+        // the unspoofable TCP peer when the adapter exposed one — including the
+        // plain `trustProxyHeaders: true` path, not only `trustedProxies`. Only a
+        // truly peer-less request shares "global".
+        const peer = getConnInfo(ctx.request)?.remoteAddress;
+        if (peer !== undefined)
+            return `peer:${peer}`;
+        return "global";
+    };
 }
 function wait(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
@@ -854,7 +872,8 @@ export function loginThrottle(opts = {}) {
     assertNonNegativeInteger("maxDelayMs", maxDelayMs);
     const groupId = opts.groupId ?? "login";
     const hops = resolveForwardedTrust("loginThrottle()", opts);
-    const keyGenerator = opts.keyGenerator ?? defaultForwardedRateLimitKey(hops);
+    const proxyMatchers = resolveTrustedProxyMatchers("loginThrottle()", opts);
+    const keyGenerator = opts.keyGenerator ?? defaultForwardedRateLimitKey(hops, proxyMatchers);
     const limiter = rateLimit({
         windowMs,
         max,

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:74d895c1-b279-5248-ae56-b1fc6706445d",
+  "serialNumber": "urn:uuid:6f1d01b1-95cd-5475-994d-9d54a26deac5",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-03T08:30:50.442Z",
+    "timestamp": "2026-08-07T14:15:51.163Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "1.0.0"
+        "version": "1.1.0"
       }
     ],
     "authors": [
@@ -19,11 +19,11 @@
     ],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/@daloyjs/core@1.0.0",
+      "bom-ref": "pkg:npm/@daloyjs/core@1.1.0",
       "name": "@daloyjs/core",
-      "version": "1.0.0",
+      "version": "1.1.0",
       "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
-      "purl": "pkg:npm/@daloyjs/core@1.0.0",
+      "purl": "pkg:npm/@daloyjs/core@1.1.0",
       "licenses": [
         {
           "license": {
@@ -46,9 +46,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag--daloyjs-core-1.0.0",
+        "tagId": "swidtag--daloyjs-core-1.1.0",
         "name": "@daloyjs/core",
-        "version": "1.0.0",
+        "version": "1.1.0",
         "tagVersion": 0,
         "patch": false
       }
@@ -57,7 +57,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/@daloyjs/core@1.0.0",
+      "ref": "pkg:npm/@daloyjs/core@1.1.0",
       "dependsOn": []
     }
   ]

package/dist/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@daloyjs/core-1.0.0",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.0.0-74d895c1-b279-5248-ae56-b1fc6706445d",
+  "name": "@daloyjs/core-1.1.0",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.1.0-6f1d01b1-95cd-5475-994d-9d54a26deac5",
   "creationInfo": {
-    "created": "2026-08-03T08:30:50.442Z",
+    "created": "2026-08-07T14:15:51.163Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package--daloyjs-core",
       "name": "@daloyjs/core",
-      "versionInfo": "1.0.0",
+      "versionInfo": "1.1.0",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/@daloyjs/core@1.0.0"
+          "referenceLocator": "pkg:npm/@daloyjs/core@1.1.0"
         }
       ]
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daloyjs/core",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops \u2014 distributed via pnpm.",
   "type": "module",
   "publishConfig": {