@daloyjs/core 1.1.1 → 1.2.1

package/dist/otlp.js

@@ -0,0 +1,589 @@
+/**
+ * OpenTelemetry OTLP push export — logs, metrics, and semantic-convention
+ * HTTP server instrumentation, with zero runtime dependencies.
+ *
+ * Many container platforms run an in-cluster OTel collector and expect
+ * workloads to **push** telemetry: they inject the standard
+ * `OTEL_EXPORTER_OTLP_ENDPOINT` / `OTEL_EXPORTER_OTLP_HEADERS` /
+ * `OTEL_RESOURCE_ATTRIBUTES` / `OTEL_SERVICE_NAME` variables into every
+ * container and scrape nothing — not stdout, not a `/metrics` route. The
+ * OTel Node SDK covers that with monkey-patching auto-instrumentation, but
+ * its ESM loader hooks are fragile on modern Node and unavailable on edge
+ * runtimes. This module is the framework-native alternative:
+ *
+ * - {@link createOtlpLogExporter} — batched OTLP/HTTP JSON log export;
+ *   tee your logger's `write` sink into it.
+ * - {@link createOtlpMetricsExporter} — cumulative counters + histograms
+ *   pushed as OTLP/HTTP JSON.
+ * - {@link semconvHttpMetrics} — a `Hooks` bundle emitting
+ *   `http.server.request.duration` exactly per the OTel HTTP semantic
+ *   conventions (names, attributes, bucket boundaries), so standard Grafana
+ *   dashboards work unchanged.
+ * - `new App({ telemetry: true })` wires all of the above automatically
+ *   (see {@link TelemetryOptions}).
+ *
+ * Everything is transport-portable (`fetch` + web-standard primitives) and
+ * **fail-safe by contract**: a dead or misconfigured collector never affects
+ * request serving — bounded queues, dropped-batch counters, no retry storms,
+ * a timeout on every export POST, and cumulative metric temporality so
+ * totals survive failed pushes. Long-lived runtimes flush on an `unref`'d
+ * interval plus graceful shutdown; isolate runtimes (Workers, Vercel, Lambda)
+ * flush per request via the adapters' `waitUntil` / handler-await path.
+ *
+ * @module
+ * @since 1.2.0
+ */
+/** Log-queue and batching caps (drop-oldest beyond the queue cap). */
+const LOG_MAX_BATCH = 100;
+const LOG_MAX_QUEUE = 1_000;
+const LOG_FLUSH_INTERVAL_MS = 5_000;
+/** Longest log body / attribute value shipped before truncation. */
+const LOG_MAX_FIELD_LENGTH = 8_192;
+const METRICS_FLUSH_INTERVAL_MS = 15_000;
+/** Default abort timeout for an in-flight OTLP POST. */
+const DEFAULT_FLUSH_TIMEOUT_MS = 5_000;
+/**
+ * Cardinality guard: total metric series (counter + histogram) before new
+ * series are dropped and counted. A hostile client must not be able to mint
+ * unbounded series through attribute values.
+ */
+const METRICS_MAX_SERIES = 2_000;
+/** Longest metric attribute value before truncation (cardinality + memory guard). */
+const METRICS_MAX_ATTR_LENGTH = 256;
+/**
+ * Spec-defined default bucket boundaries for `http.server.request.duration`,
+ * in seconds (OTel HTTP semantic conventions).
+ *
+ * @since 1.2.0
+ */
+export const HTTP_SERVER_REQUEST_DURATION_BUCKETS = [
+    0.005, 0.01, 0.025, 0.05, 0.075, 0.1, 0.25, 0.5, 0.75, 1, 2.5, 5, 7.5, 10,
+];
+/** OTLP severity numbers keyed by the framework logger's level names. */
+const SEVERITY = {
+    trace: [1, "TRACE"],
+    debug: [5, "DEBUG"],
+    info: [9, "INFO"],
+    warn: [13, "WARN"],
+    error: [17, "ERROR"],
+    fatal: [21, "FATAL"],
+};
+/** Known HTTP methods per the semconv `http.request.method` well-known set. */
+const KNOWN_METHODS = new Set([
+    "GET",
+    "HEAD",
+    "POST",
+    "PUT",
+    "DELETE",
+    "CONNECT",
+    "OPTIONS",
+    "TRACE",
+    "PATCH",
+]);
+/** Portable environment lookup (Node/Bun/Deno-with-node-compat; undefined elsewhere). */
+function envVar(name) {
+    const env = globalThis.process?.env;
+    return env?.[name];
+}
+/** Decode one OTEL env-list component; invalid percent-encoding is kept raw. */
+function decodeOtelComponent(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+}
+/**
+ * Parse `key=value,key2=value2` lists (`OTEL_EXPORTER_OTLP_HEADERS` /
+ * `OTEL_RESOURCE_ATTRIBUTES`). Spec values are percent-encoded; commas in a
+ * value must be `%2C`.
+ */
+function parseKvList(raw) {
+    const out = {};
+    if (!raw)
+        return out;
+    for (const pair of raw.split(",")) {
+        const trimmed = pair.trim();
+        const idx = trimmed.indexOf("=");
+        if (idx <= 0)
+            continue;
+        const key = decodeOtelComponent(trimmed.slice(0, idx).trim());
+        if (key.length === 0)
+            continue;
+        out[key] = decodeOtelComponent(trimmed.slice(idx + 1).trim());
+    }
+    return out;
+}
+function truncate(value, max) {
+    return value.length <= max ? value : value.slice(0, max);
+}
+function toAttrList(record, maxLength) {
+    return Object.entries(record).map(([key, value]) => ({
+        key,
+        value: { stringValue: truncate(value, maxLength) },
+    }));
+}
+function resolveTransport(signalPath, opts) {
+    const rawEndpoint = opts.endpoint ?? envVar("OTEL_EXPORTER_OTLP_ENDPOINT");
+    if (!rawEndpoint)
+        return null;
+    const base = rawEndpoint.replace(/\/+$/, "").replace(/:4317$/, ":4318");
+    const headers = {
+        "content-type": "application/json",
+    };
+    Object.assign(headers, parseKvList(envVar("OTEL_EXPORTER_OTLP_HEADERS")), opts.headers ?? {});
+    const resource = parseKvList(envVar("OTEL_RESOURCE_ATTRIBUTES"));
+    const serviceName = envVar("OTEL_SERVICE_NAME");
+    if (serviceName && resource["service.name"] === undefined) {
+        resource["service.name"] = serviceName;
+    }
+    Object.assign(resource, opts.resourceAttributes ?? {});
+    return {
+        url: base + signalPath,
+        headers,
+        resourceAttributes: toAttrList(resource, LOG_MAX_FIELD_LENGTH),
+        fetchImpl: opts.fetch ?? fetch,
+    };
+}
+/** Start an `unref`'d repeating flush where the runtime supports timers. */
+function startFlushTimer(intervalMs, flush) {
+    if (intervalMs <= 0 || typeof setInterval !== "function")
+        return;
+    const timer = setInterval(() => void flush(), intervalMs);
+    timer.unref?.();
+}
+/** AbortSignal that fires after `timeoutMs`, or `undefined` when timeout is disabled. */
+function flushSignal(timeoutMs) {
+    if (timeoutMs <= 0)
+        return undefined;
+    if (typeof AbortSignal !== "undefined" &&
+        typeof AbortSignal.timeout === "function") {
+        return AbortSignal.timeout(timeoutMs);
+    }
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    timer.unref?.();
+    return controller.signal;
+}
+/** Shared POST init: never follow redirects (tenant headers would leak). */
+function exportRequestInit(headers, body, timeoutMs) {
+    const init = {
+        method: "POST",
+        headers,
+        body,
+        redirect: "error",
+    };
+    const signal = flushSignal(timeoutMs);
+    if (signal !== undefined)
+        init.signal = signal;
+    return init;
+}
+function toLogRecord(line) {
+    let level = "info";
+    let body = line;
+    const attributes = [];
+    try {
+        const parsed = JSON.parse(line);
+        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+            throw new Error();
+        if (typeof parsed.level === "string")
+            level = parsed.level;
+        const msg = parsed.msg ?? parsed.message ?? parsed.event;
+        body = typeof msg === "string" ? msg : line;
+        for (const [key, value] of Object.entries(parsed)) {
+            if (key === "level" || key === "msg" || key === "message")
+                continue;
+            attributes.push({
+                key,
+                value: {
+                    stringValue: truncate(typeof value === "string"
+                        ? value
+                        : (JSON.stringify(value) ?? "null"), LOG_MAX_FIELD_LENGTH),
+                },
+            });
+        }
+    }
+    catch {
+        // Not a JSON object (boot banner etc.) — ship verbatim as the body.
+    }
+    const [severityNumber, severityText] = SEVERITY[level] ?? SEVERITY.info;
+    return {
+        timeUnixNano: (BigInt(Date.now()) * 1000000n).toString(),
+        severityNumber,
+        severityText,
+        body: { stringValue: truncate(body, LOG_MAX_FIELD_LENGTH) },
+        attributes,
+    };
+}
+/**
+ * Create a batched OTLP/HTTP JSON log exporter, or `null` when no endpoint is
+ * configured (local development, tests) so callers can no-op cheaply.
+ *
+ * Fail-safe by contract: {@link OtlpLogExporter.flush} never rejects, a dead
+ * collector cannot grow the queue past its cap (oldest records are dropped
+ * and counted), and export work is decoupled from request handling.
+ *
+ * @param opts - Endpoint/header/resource overrides; defaults from `OTEL_*` env vars.
+ * @returns The exporter, or `null` when no endpoint is configured.
+ * @since 1.2.0
+ */
+export function createOtlpLogExporter(opts = {}) {
+    const transport = resolveTransport("/v1/logs", opts);
+    if (transport === null)
+        return null;
+    const { url, headers, resourceAttributes, fetchImpl } = transport;
+    const timeoutMs = opts.flushTimeoutMs ?? DEFAULT_FLUSH_TIMEOUT_MS;
+    const queue = [];
+    let dropped = 0;
+    let flushing = false;
+    async function flush() {
+        if (flushing || queue.length === 0)
+            return;
+        flushing = true;
+        try {
+            while (queue.length > 0) {
+                const batch = queue.splice(0, LOG_MAX_BATCH);
+                const payload = {
+                    resourceLogs: [
+                        {
+                            resource: { attributes: resourceAttributes },
+                            scopeLogs: [{ scope: { name: "daloyjs" }, logRecords: batch }],
+                        },
+                    ],
+                };
+                const res = await fetchImpl(url, exportRequestInit(headers, JSON.stringify(payload), timeoutMs));
+                if (!res.ok)
+                    dropped += 1;
+            }
+        }
+        catch {
+            dropped += 1;
+            queue.length = 0; // never let a dead collector grow the queue
+        }
+        finally {
+            flushing = false;
+        }
+    }
+    startFlushTimer(opts.flushIntervalMs ?? LOG_FLUSH_INTERVAL_MS, flush);
+    return {
+        pushLine(line) {
+            if (queue.length >= LOG_MAX_QUEUE) {
+                queue.shift();
+                dropped += 1;
+            }
+            queue.push(toLogRecord(line.endsWith("\n") ? line.trimEnd() : line));
+        },
+        flush,
+        get droppedBatches() {
+            return dropped;
+        },
+    };
+}
+/**
+ * Create a cumulative OTLP/HTTP JSON metrics exporter, or `null` when no
+ * endpoint is configured.
+ *
+ * Counters export as monotonic cumulative sums and histograms as cumulative
+ * explicit-bounds histograms, so state survives failed pushes (the next
+ * successful push carries the accumulated totals). Total series are capped
+ * ({@link OtlpMetricsExporter.droppedBatches} counts series refused at the
+ * cap) and attribute values are length-truncated — both cardinality guards
+ * against hostile or buggy attribute sources.
+ *
+ * @param opts - Endpoint/header/resource overrides; defaults from `OTEL_*` env vars.
+ * @returns The exporter, or `null` when no endpoint is configured.
+ * @since 1.2.0
+ */
+export function createOtlpMetricsExporter(opts = {}) {
+    const transport = resolveTransport("/v1/metrics", opts);
+    if (transport === null)
+        return null;
+    const { url, headers, resourceAttributes, fetchImpl } = transport;
+    const timeoutMs = opts.flushTimeoutMs ?? DEFAULT_FLUSH_TIMEOUT_MS;
+    const counters = new Map();
+    const histograms = new Map();
+    let dropped = 0;
+    let flushing = false;
+    let dirty = false;
+    function seriesKey(name, entries) {
+        let key = name;
+        for (const [k, v] of entries)
+            key += "|" + k + "=" + v;
+        return key;
+    }
+    function sortedEntries(attributes) {
+        return Object.entries(attributes)
+            .map(([k, v]) => [
+            k,
+            truncate(v, METRICS_MAX_ATTR_LENGTH),
+        ])
+            .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+    }
+    function atCapacity() {
+        if (counters.size + histograms.size < METRICS_MAX_SERIES)
+            return false;
+        dropped += 1;
+        return true;
+    }
+    async function flush() {
+        if (flushing || !dirty)
+            return;
+        flushing = true;
+        // Clear before the POST so a concurrent count/record keeps the flag true
+        // and the next flush carries the in-flight increment.
+        dirty = false;
+        try {
+            const now = (BigInt(Date.now()) * 1000000n).toString();
+            const sumsByName = new Map();
+            for (const s of counters.values()) {
+                const group = sumsByName.get(s.name);
+                if (group === undefined)
+                    sumsByName.set(s.name, [s]);
+                else
+                    group.push(s);
+            }
+            const histsByName = new Map();
+            for (const h of histograms.values()) {
+                const group = histsByName.get(h.name);
+                if (group === undefined)
+                    histsByName.set(h.name, [h]);
+                else
+                    group.push(h);
+            }
+            const metrics = [];
+            for (const [name, group] of sumsByName) {
+                metrics.push({
+                    name,
+                    unit: "1",
+                    sum: {
+                        aggregationTemporality: 2, // cumulative
+                        isMonotonic: true,
+                        dataPoints: group.map((s) => ({
+                            attributes: s.attributes,
+                            startTimeUnixNano: s.startTimeUnixNano,
+                            timeUnixNano: now,
+                            asDouble: s.total,
+                        })),
+                    },
+                });
+            }
+            for (const [name, group] of histsByName) {
+                metrics.push({
+                    name,
+                    unit: group[0].unit,
+                    histogram: {
+                        aggregationTemporality: 2, // cumulative
+                        dataPoints: group.map((h) => ({
+                            attributes: h.attributes,
+                            startTimeUnixNano: h.startTimeUnixNano,
+                            timeUnixNano: now,
+                            // uint64 fields use the string JSON mapping in OTLP.
+                            count: String(h.count),
+                            sum: h.sum,
+                            bucketCounts: h.bucketCounts.map(String),
+                            explicitBounds: [...h.boundaries],
+                        })),
+                    },
+                });
+            }
+            const payload = {
+                resourceMetrics: [
+                    {
+                        resource: { attributes: resourceAttributes },
+                        scopeMetrics: [{ scope: { name: "daloyjs" }, metrics }],
+                    },
+                ],
+            };
+            const res = await fetchImpl(url, exportRequestInit(headers, JSON.stringify(payload), timeoutMs));
+            if (!res.ok) {
+                dropped += 1;
+                dirty = true;
+            }
+        }
+        catch {
+            dropped += 1;
+            dirty = true; // totals retained; cumulative temporality self-heals
+        }
+        finally {
+            flushing = false;
+        }
+    }
+    startFlushTimer(opts.flushIntervalMs ?? METRICS_FLUSH_INTERVAL_MS, flush);
+    return {
+        count(name, attributes, value = 1) {
+            if (!Number.isFinite(value) || value < 0)
+                return;
+            const entries = sortedEntries(attributes);
+            const key = seriesKey(name, entries);
+            let s = counters.get(key);
+            if (s === undefined) {
+                if (atCapacity())
+                    return;
+                s = {
+                    name,
+                    attributes: entries.map(([k, v]) => ({
+                        key: k,
+                        value: { stringValue: v },
+                    })),
+                    total: 0,
+                    startTimeUnixNano: (BigInt(Date.now()) * 1000000n).toString(),
+                };
+                counters.set(key, s);
+            }
+            s.total += value;
+            dirty = true;
+        },
+        record(name, attributes, value, options) {
+            if (!Number.isFinite(value))
+                return;
+            const entries = sortedEntries(attributes);
+            const key = seriesKey(name, entries);
+            let h = histograms.get(key);
+            if (h === undefined) {
+                if (atCapacity())
+                    return;
+                h = {
+                    name,
+                    unit: options.unit,
+                    boundaries: options.boundaries,
+                    attributes: entries.map(([k, v]) => ({
+                        key: k,
+                        value: { stringValue: v },
+                    })),
+                    count: 0,
+                    sum: 0,
+                    bucketCounts: new Array(options.boundaries.length + 1).fill(0),
+                    startTimeUnixNano: (BigInt(Date.now()) * 1000000n).toString(),
+                };
+                histograms.set(key, h);
+            }
+            h.count += 1;
+            h.sum += value;
+            let bucket = h.boundaries.findIndex((bound) => value <= bound);
+            if (bucket === -1)
+                bucket = h.boundaries.length;
+            h.bucketCounts[bucket] += 1;
+            dirty = true;
+        },
+        flush,
+        get droppedBatches() {
+            return dropped;
+        },
+    };
+}
+/** Monotonic clock in milliseconds, falling back to `Date.now` where needed. */
+function nowMs() {
+    return typeof performance !== "undefined" &&
+        typeof performance.now === "function"
+        ? performance.now()
+        : Date.now();
+}
+const SEMCONV_START_TIMES = new WeakMap();
+/**
+ * A `Hooks` bundle recording `http.server.request.duration` per the OTel HTTP
+ * semantic conventions into an {@link OtlpMetricsExporter}:
+ *
+ * - unit `s`, spec bucket boundaries
+ *   ({@link HTTP_SERVER_REQUEST_DURATION_BUCKETS});
+ * - attributes `http.request.method` (well-known set, else `_OTHER`),
+ *   `http.response.status_code`, `url.scheme`, `http.route` (the matched
+ *   route **template** via `ctx.routePath`), and `error.type` (the status
+ *   code, on `5xx` only).
+ *
+ * Only requests that produce a request context are recorded. On the
+ * unmatched-404 fast path the framework skips context construction entirely
+ * (a deliberate allocation optimization), so unmatched floods record nothing
+ * — which is also the strongest possible cardinality guarantee: a hostile
+ * client can never mint metric series from raw paths.
+ *
+ * Install it **before** registering routes (group-hook ordering), or let
+ * `new App({ telemetry: true })` install it for you.
+ *
+ * @param sink - Metrics exporter the duration histogram is recorded into.
+ * @param opts - Optional path exclusion.
+ * @returns A `Hooks` object for `app.use(...)` or `new App({ hooks })`.
+ * @since 1.2.0
+ */
+export function semconvHttpMetrics(sink, opts = {}) {
+    return {
+        onRequest(req) {
+            SEMCONV_START_TIMES.set(req, nowMs());
+        },
+        onResponse(res, ctx) {
+            const request = ctx?.request;
+            if (request === undefined)
+                return;
+            const started = SEMCONV_START_TIMES.get(request);
+            if (started === undefined)
+                return;
+            SEMCONV_START_TIMES.delete(request);
+            const url = request.url;
+            if (opts.exclude !== undefined) {
+                let pathname = "/";
+                try {
+                    pathname = new URL(url).pathname;
+                }
+                catch {
+                    /* malformed URL — keep the fallback */
+                }
+                if (opts.exclude(pathname))
+                    return;
+            }
+            const colon = url.indexOf(":");
+            const scheme = colon > 0 ? url.slice(0, colon) : "http";
+            const rawMethod = request.method.toUpperCase();
+            const attributes = {
+                "http.request.method": KNOWN_METHODS.has(rawMethod)
+                    ? rawMethod
+                    : "_OTHER",
+                "http.response.status_code": String(res.status),
+                "url.scheme": scheme,
+            };
+            // Spec: http.route only when a route template is known. Never the raw
+            // pathname — an unmatched-path flood must not mint metric series.
+            const routePath = ctx?.routePath;
+            if (typeof routePath === "string")
+                attributes["http.route"] = routePath;
+            if (res.status >= 500)
+                attributes["error.type"] = String(res.status);
+            sink.record("http.server.request.duration", attributes, (nowMs() - started) / 1000, { unit: "s", boundaries: HTTP_SERVER_REQUEST_DURATION_BUCKETS });
+        },
+    };
+}
+/**
+ * Build the exporters, hooks, and logger sink for the `App` `telemetry`
+ * option. Returns an inert bundle (all `null`/`undefined`) when no endpoint
+ * is configured, so `telemetry: true` costs nothing in development.
+ *
+ * @param options - The resolved {@link TelemetryOptions}.
+ * @returns The wiring bundle.
+ * @since 1.2.0
+ */
+export function createAppTelemetry(options) {
+    const exporterOpts = options.exporter ?? {};
+    const logs = options.logs === false ? null : createOtlpLogExporter(exporterOpts);
+    const metrics = options.metrics === false ? null : createOtlpMetricsExporter(exporterOpts);
+    const logWrite = logs === null
+        ? undefined
+        : (line) => {
+            const proc = globalThis.process;
+            if (proc?.stdout?.write !== undefined)
+                proc.stdout.write(line + "\n");
+            // eslint-disable-next-line no-console
+            else
+                console.log(line);
+            logs.pushLine(line);
+        };
+    const endpointRaw = exporterOpts.endpoint ?? envVar("OTEL_EXPORTER_OTLP_ENDPOINT") ?? null;
+    return {
+        logs,
+        metrics,
+        hooks: metrics === null ? undefined : semconvHttpMetrics(metrics),
+        logWrite,
+        endpoint: endpointRaw,
+        async flush() {
+            await Promise.all([logs?.flush(), metrics?.flush()]);
+        },
+    };
+}

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:9f8a7323-070b-54ee-8121-9f94a41c10eb",
+  "serialNumber": "urn:uuid:e489b0cf-2d9d-5f9f-93c0-ff3c851e6f48",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-09T15:45:42.359Z",
+    "timestamp": "2026-08-20T14:37:11.548Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "1.1.1"
+        "version": "1.2.1"
       }
     ],
     "authors": [
@@ -19,11 +19,11 @@
     ],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/@daloyjs/core@1.1.1",
+      "bom-ref": "pkg:npm/@daloyjs/core@1.2.1",
       "name": "@daloyjs/core",
-      "version": "1.1.1",
+      "version": "1.2.1",
       "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
-      "purl": "pkg:npm/@daloyjs/core@1.1.1",
+      "purl": "pkg:npm/@daloyjs/core@1.2.1",
       "licenses": [
         {
           "license": {
@@ -46,9 +46,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag--daloyjs-core-1.1.1",
+        "tagId": "swidtag--daloyjs-core-1.2.1",
         "name": "@daloyjs/core",
-        "version": "1.1.1",
+        "version": "1.2.1",
         "tagVersion": 0,
         "patch": false
       }
@@ -57,7 +57,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/@daloyjs/core@1.1.1",
+      "ref": "pkg:npm/@daloyjs/core@1.2.1",
       "dependsOn": []
     }
   ]

package/dist/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@daloyjs/core-1.1.1",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.1.1-9f8a7323-070b-54ee-8121-9f94a41c10eb",
+  "name": "@daloyjs/core-1.2.1",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.2.1-e489b0cf-2d9d-5f9f-93c0-ff3c851e6f48",
   "creationInfo": {
-    "created": "2026-08-09T15:45:42.359Z",
+    "created": "2026-08-20T14:37:11.548Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package--daloyjs-core",
       "name": "@daloyjs/core",
-      "versionInfo": "1.1.1",
+      "versionInfo": "1.2.1",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/@daloyjs/core@1.1.1"
+          "referenceLocator": "pkg:npm/@daloyjs/core@1.2.1"
         }
       ]
     }