@daloyjs/core 1.2.0 → 1.2.1

package/dist/combine.js

@@ -5,7 +5,7 @@
  *
  * @since 0.19.0
  */
-import { _mergePreBodyWithEarlyRejections, EARLY_REJECTION_HOOK_MARKER } from "./middleware.js";
+import { _mergePreBodyWithEarlyRejections, EARLY_REJECTION_HOOK_MARKER, } from "./middleware.js";
 /**
  * Run every supplied {@link Hooks} bundle in order, pipeline-style.
  * Equivalent to passing the bundles to `app.use(...)` one after another,
@@ -88,7 +88,9 @@ export function some(...layers) {
                 return [
                     async (ctx) => {
                         const early = await hooks.preBody(ctx);
-                        return early instanceof Response ? early : hooks.beforeHandle(ctx);
+                        return early instanceof Response
+                            ? early
+                            : hooks.beforeHandle(ctx);
                     },
                 ];
             }
@@ -152,7 +154,9 @@ export function some(...layers) {
  */
 export function except(when, hooks) {
     const earlyRejectionHooks = hooks[EARLY_REJECTION_HOOK_MARKER];
-    if (!hooks.preBody && !hooks.beforeHandle && !Array.isArray(earlyRejectionHooks))
+    if (!hooks.preBody &&
+        !hooks.beforeHandle &&
+        !Array.isArray(earlyRejectionHooks))
         return hooks;
     const matches = compileExceptMatcher(when);
     const wrapped = { ...hooks };
@@ -166,11 +170,11 @@ export function except(when, hooks) {
     }
     if (hooks.preBody) {
         const original = hooks.preBody;
-        wrapped.preBody = async (ctx) => ((await matches(ctx)) ? undefined : original(ctx));
+        wrapped.preBody = async (ctx) => (await matches(ctx)) ? undefined : original(ctx);
     }
     if (hooks.beforeHandle) {
         const original = hooks.beforeHandle;
-        wrapped.beforeHandle = async (ctx) => ((await matches(ctx)) ? undefined : original(ctx));
+        wrapped.beforeHandle = async (ctx) => (await matches(ctx)) ? undefined : original(ctx);
     }
     return wrapped;
 }
@@ -206,7 +210,9 @@ function compilePathPattern(pattern) {
     return (path) => regex.test(path);
 }
 function mergeCombineHooks(layers) {
-    const pick = (key) => layers.map((h) => h[key]).filter((f) => typeof f === "function");
+    const pick = (key) => layers
+        .map((h) => h[key])
+        .filter((f) => typeof f === "function");
     const merged = {};
     const onRequest = pick("onRequest");
     if (onRequest.length > 0) {
@@ -266,9 +272,9 @@ function mergeCombineHooks(layers) {
     }
     const onResponse = pick("onResponse");
     if (onResponse.length > 0) {
-        merged.onResponse = async (res) => {
+        merged.onResponse = async (res, ctx) => {
             for (const fn of onResponse)
-                await fn(res);
+                await fn(res, ctx);
         };
     }
     // Forward symbol-keyed security markers (CORS / CSRF / session /

package/dist/metrics.d.ts

@@ -17,8 +17,11 @@
  *   `http_requests_in_flight`) into a registry.
  *
  * Everything is built on Web-standard primitives (plus optional `process.*`
- * gauges guarded for non-Node runtimes), so it runs unchanged on Node, Bun,
- * Deno, Cloudflare Workers, and Vercel.
+ * gauges guarded for non-Node runtimes). The registry and renderer run on
+ * Node, Bun, Deno, Cloudflare Workers, and Vercel; **pull scraping
+ * (`GET /metrics`) is only a service-wide signal on a long-lived process**.
+ * On ephemeral isolates use `new App({ telemetry: true })` (OTLP push)
+ * instead of scraping `/metrics`.
  *
  * @module
  * @since 0.37.0
@@ -94,7 +97,14 @@ export declare class Histogram extends Metric {
 }
 /** Options for {@link MetricsRegistry}. */
 export interface MetricsRegistryOptions {
-    /** Prefix applied to every metric name. Default `"daloy_"`. Pass `""` for none. */
+    /**
+     * Prefix applied to every metric name except the framework drop counter.
+     * Default `""` so process gauges (`process_resident_memory_bytes`) and HTTP
+     * RED series (`http_requests_total`) match the names stock Grafana panels
+     * already query. Pass `"daloy_"` (or any other prefix) to namespace them.
+     * The cardinality-drop meta-metric stays `daloy_metrics_series_dropped_total`
+     * when this is empty, because it is a DaloyJS-specific series.
+     */
     prefix?: string;
     /**
      * Hard cap on the number of distinct series **per metric**. Once reached,
@@ -172,15 +182,19 @@ export interface HttpMetricsOptions {
     registry: MetricsRegistry;
     /**
      * Resolve the low-cardinality `route` label from the request context.
-     * Strongly recommended: return the route **template** (e.g. `/books/:id`),
-     * not the raw path, to keep series cardinality bounded. When omitted the
-     * request pathname is used, capped by {@link HttpMetricsOptions.maxRouteCardinality}.
+     * When omitted, the matched route **template** (`ctx.routePath`, e.g.
+     * `/books/:id`) is used. That is bounded by the route table, so a hostile
+     * client cannot mint series from raw paths. A custom resolver that returns
+     * a raw pathname should still keep cardinality bounded; the pathname
+     * fallback (no template on the context) is capped by
+     * {@link HttpMetricsOptions.maxRouteCardinality}.
      */
     route?: (ctx: BaseContext<any, any>) => string | undefined;
     /**
-     * Maximum distinct values for the default (pathname-derived) `route` label
-     * before further values collapse to `"<other>"`. Ignored when a custom
-     * {@link HttpMetricsOptions.route} resolver is supplied. Default `100`.
+     * Maximum distinct values for the pathname fallback `route` label (used
+     * only when {@link HttpMetricsOptions.route} is omitted **and**
+     * `ctx.routePath` is missing) before further values collapse to
+     * `"<other>"`. Ignored when a custom resolver is supplied. Default `100`.
      */
     maxRouteCardinality?: number;
     /** Skip instrumentation for matching request paths (e.g. the scrape route). */

package/dist/metrics.js

@@ -17,8 +17,11 @@
  *   `http_requests_in_flight`) into a registry.
  *
  * Everything is built on Web-standard primitives (plus optional `process.*`
- * gauges guarded for non-Node runtimes), so it runs unchanged on Node, Bun,
- * Deno, Cloudflare Workers, and Vercel.
+ * gauges guarded for non-Node runtimes). The registry and renderer run on
+ * Node, Bun, Deno, Cloudflare Workers, and Vercel; **pull scraping
+ * (`GET /metrics`) is only a service-wide signal on a long-lived process**.
+ * On ephemeral isolates use `new App({ telemetry: true })` (OTLP push)
+ * instead of scraping `/metrics`.
  *
  * @module
  * @since 0.37.0
@@ -49,7 +52,10 @@ function escapeHelp(value) {
  * out of the `{...}` block and injecting forged samples.
  */
 function escapeLabelValue(value) {
-    return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n");
+    return value
+        .replace(/\\/g, "\\\\")
+        .replace(/"/g, '\\"')
+        .replace(/\n/g, "\\n");
 }
 /**
  * Validate and normalize a label bag: every key must match the Prometheus
@@ -137,7 +143,10 @@ export class Counter extends Metric {
     }
     /** @internal */
     render() {
-        const lines = [`# HELP ${this.name} ${escapeHelp(this.help)}`, `# TYPE ${this.name} counter`];
+        const lines = [
+            `# HELP ${this.name} ${escapeHelp(this.help)}`,
+            `# TYPE ${this.name} counter`,
+        ];
         for (const { labels, value } of this.series.values()) {
             lines.push(`${this.name}${renderLabelBlock(labels)} ${value}`);
         }
@@ -183,7 +192,10 @@ export class Gauge extends Metric {
     }
     /** @internal */
     render() {
-        const lines = [`# HELP ${this.name} ${escapeHelp(this.help)}`, `# TYPE ${this.name} gauge`];
+        const lines = [
+            `# HELP ${this.name} ${escapeHelp(this.help)}`,
+            `# TYPE ${this.name} gauge`,
+        ];
         for (const { labels, value } of this.series.values()) {
             lines.push(`${this.name}${renderLabelBlock(labels)} ${value}`);
         }
@@ -219,7 +231,12 @@ export class Histogram extends Metric {
         if (!s) {
             if (!this.registry._admitSeries(this.series.size))
                 return;
-            s = { labels: entries, counts: new Array(this.bounds.length).fill(0), sum: 0, count: 0 };
+            s = {
+                labels: entries,
+                counts: new Array(this.bounds.length).fill(0),
+                sum: 0,
+                count: 0,
+            };
             this.series.set(key, s);
         }
         s.count += 1;
@@ -231,7 +248,10 @@ export class Histogram extends Metric {
     }
     /** @internal */
     render() {
-        const lines = [`# HELP ${this.name} ${escapeHelp(this.help)}`, `# TYPE ${this.name} histogram`];
+        const lines = [
+            `# HELP ${this.name} ${escapeHelp(this.help)}`,
+            `# TYPE ${this.name} histogram`,
+        ];
         for (const s of this.series.values()) {
             for (let i = 0; i < this.bounds.length; i++) {
                 lines.push(`${this.name}_bucket${renderLabelBlock(s.labels, ["le", String(this.bounds[i])])} ${s.counts[i]}`);
@@ -272,7 +292,7 @@ export class MetricsRegistry {
     collectors = [];
     droppedCounter;
     constructor(opts = {}) {
-        this.prefix = opts.prefix ?? "daloy_";
+        this.prefix = opts.prefix ?? "";
         this.maxSeries = opts.maxSeries ?? 5000;
         if (!Number.isInteger(this.maxSeries) || this.maxSeries <= 0) {
             throw new Error("MetricsRegistry maxSeries must be a positive integer.");
@@ -345,7 +365,9 @@ export class MetricsRegistry {
         return metric;
     }
     registerDefaultMetrics() {
-        this.droppedCounter = this.counter("metrics_series_dropped_total", "Series dropped after hitting the per-metric cardinality cap.");
+        this.droppedCounter = this.counter(this.prefix === ""
+            ? "daloy_metrics_series_dropped_total"
+            : "metrics_series_dropped_total", "Series dropped after hitting the per-metric cardinality cap.");
         if (typeof process === "undefined")
             return;
         const rss = this.gauge("process_resident_memory_bytes", "Resident memory size in bytes.");
@@ -369,7 +391,8 @@ export class MetricsRegistry {
 }
 /** Monotonic clock in milliseconds, falling back to `Date.now` where needed. */
 function nowMs() {
-    return typeof performance !== "undefined" && typeof performance.now === "function"
+    return typeof performance !== "undefined" &&
+        typeof performance.now === "function"
         ? performance.now()
         : Date.now();
 }

package/dist/otlp.d.ts

@@ -25,7 +25,10 @@
  * Everything is transport-portable (`fetch` + web-standard primitives) and
  * **fail-safe by contract**: a dead or misconfigured collector never affects
  * request serving — bounded queues, dropped-batch counters, no retry storms,
- * and cumulative metric temporality so totals survive failed pushes.
+ * a timeout on every export POST, and cumulative metric temporality so
+ * totals survive failed pushes. Long-lived runtimes flush on an `unref`'d
+ * interval plus graceful shutdown; isolate runtimes (Workers, Vercel, Lambda)
+ * flush per request via the adapters' `waitUntil` / handler-await path.
  *
  * @module
  * @since 1.2.0
@@ -63,9 +66,16 @@ export interface OtlpExporterOptions {
     /**
      * Flush cadence in ms on runtimes with timers (`unref`'d — never keeps the
      * process alive). Defaults: 5000 (logs), 15000 (metrics). Set `0` to
-     * disable the timer and flush manually / on shutdown only.
+     * disable the timer and flush manually / on shutdown / via the serverless
+     * adapters' per-request flush.
      */
     flushIntervalMs?: number;
+    /**
+     * Abort an in-flight export POST after this many ms so a blackholed
+     * collector cannot latch `flushing` forever. Default `5000`. Set `0` to
+     * wait indefinitely (tests that drive `fetch` themselves).
+     */
+    flushTimeoutMs?: number;
     /** Injectable transport for tests. Default `globalThis.fetch`. */
     fetch?: typeof fetch;
 }
@@ -86,7 +96,12 @@ export interface OtlpLogExporter {
     pushLine(line: string): void;
     /** Push pending records now. Never rejects; failures count as drops. */
     flush(): Promise<void>;
-    /** Batches dropped because the queue overflowed or the collector errored. */
+    /**
+     * Mixed drop counter: overflowed log *lines* (one per `shift()` at the
+     * queue cap) plus failed export *POSTs* (collector 4xx/5xx, network error,
+     * timeout, or disallowed redirect). Not a count of failed HTTP batches
+     * alone — compare against queue depth under load, not "POSTs that failed".
+     */
     readonly droppedBatches: number;
 }
 /**
@@ -115,7 +130,12 @@ export interface OtlpMetricsExporter {
     record(name: string, attributes: Record<string, string>, value: number, options: OtlpHistogramOptions): void;
     /** Push the current state now. Never rejects; failures count as drops. */
     flush(): Promise<void>;
-    /** Pushes dropped because the collector rejected/errored, plus series dropped at the cardinality cap. */
+    /**
+     * Mixed drop counter: failed export *POSTs* (collector 4xx/5xx, network
+     * error, timeout, or disallowed redirect) plus *series* refused at the
+     * cardinality cap. A cardinality attack inflates this without any POST
+     * failing.
+     */
     readonly droppedBatches: number;
 }
 /**
@@ -190,7 +210,13 @@ export declare function semconvHttpMetrics(sink: OtlpMetricsExporter, opts?: Sem
  * equivalent to `{}` — everything defaults on, reading the standard `OTEL_*`
  * environment variables. When no `OTEL_EXPORTER_OTLP_ENDPOINT` is present
  * (and no explicit `exporter.endpoint` is given) the option is a silent
- * no-op, so it is safe to leave enabled in development.
+ * no-op, so it is safe to leave enabled in development. A caller-supplied
+ * `Logger` instance is not intercepted (it owns its own sink). On isolate
+ * runtimes use `toFetchHandler` / `toLambdaHandler` so a per-request flush
+ * actually runs; Node/Bun/Deno long-lived processes flush on the interval
+ * and on shutdown. The collector endpoint is operator config, so export
+ * uses raw `fetch` (not `fetchGuard`) — the same trust class as a database
+ * URL.
  *
  * @since 1.2.0
  */

package/dist/otlp.js

@@ -25,7 +25,10 @@
  * Everything is transport-portable (`fetch` + web-standard primitives) and
  * **fail-safe by contract**: a dead or misconfigured collector never affects
  * request serving — bounded queues, dropped-batch counters, no retry storms,
- * and cumulative metric temporality so totals survive failed pushes.
+ * a timeout on every export POST, and cumulative metric temporality so
+ * totals survive failed pushes. Long-lived runtimes flush on an `unref`'d
+ * interval plus graceful shutdown; isolate runtimes (Workers, Vercel, Lambda)
+ * flush per request via the adapters' `waitUntil` / handler-await path.
  *
  * @module
  * @since 1.2.0
@@ -37,6 +40,8 @@ const LOG_FLUSH_INTERVAL_MS = 5_000;
 /** Longest log body / attribute value shipped before truncation. */
 const LOG_MAX_FIELD_LENGTH = 8_192;
 const METRICS_FLUSH_INTERVAL_MS = 15_000;
+/** Default abort timeout for an in-flight OTLP POST. */
+const DEFAULT_FLUSH_TIMEOUT_MS = 5_000;
 /**
  * Cardinality guard: total metric series (counter + histogram) before new
  * series are dropped and counted. A hostile client must not be able to mint
@@ -77,11 +82,23 @@ const KNOWN_METHODS = new Set([
 ]);
 /** Portable environment lookup (Node/Bun/Deno-with-node-compat; undefined elsewhere). */
 function envVar(name) {
-    const env = globalThis.process
-        ?.env;
+    const env = globalThis.process?.env;
     return env?.[name];
 }
-/** Parse `key=value,key2=value2` lists (OTEL_EXPORTER_OTLP_HEADERS / OTEL_RESOURCE_ATTRIBUTES). */
+/** Decode one OTEL env-list component; invalid percent-encoding is kept raw. */
+function decodeOtelComponent(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+}
+/**
+ * Parse `key=value,key2=value2` lists (`OTEL_EXPORTER_OTLP_HEADERS` /
+ * `OTEL_RESOURCE_ATTRIBUTES`). Spec values are percent-encoded; commas in a
+ * value must be `%2C`.
+ */
 function parseKvList(raw) {
     const out = {};
     if (!raw)
@@ -91,7 +108,10 @@ function parseKvList(raw) {
         const idx = trimmed.indexOf("=");
         if (idx <= 0)
             continue;
-        out[trimmed.slice(0, idx)] = trimmed.slice(idx + 1);
+        const key = decodeOtelComponent(trimmed.slice(0, idx).trim());
+        if (key.length === 0)
+            continue;
+        out[key] = decodeOtelComponent(trimmed.slice(idx + 1).trim());
     }
     return out;
 }
@@ -109,7 +129,9 @@ function resolveTransport(signalPath, opts) {
     if (!rawEndpoint)
         return null;
     const base = rawEndpoint.replace(/\/+$/, "").replace(/:4317$/, ":4318");
-    const headers = { "content-type": "application/json" };
+    const headers = {
+        "content-type": "application/json",
+    };
     Object.assign(headers, parseKvList(envVar("OTEL_EXPORTER_OTLP_HEADERS")), opts.headers ?? {});
     const resource = parseKvList(envVar("OTEL_RESOURCE_ATTRIBUTES"));
     const serviceName = envVar("OTEL_SERVICE_NAME");
@@ -131,6 +153,32 @@ function startFlushTimer(intervalMs, flush) {
     const timer = setInterval(() => void flush(), intervalMs);
     timer.unref?.();
 }
+/** AbortSignal that fires after `timeoutMs`, or `undefined` when timeout is disabled. */
+function flushSignal(timeoutMs) {
+    if (timeoutMs <= 0)
+        return undefined;
+    if (typeof AbortSignal !== "undefined" &&
+        typeof AbortSignal.timeout === "function") {
+        return AbortSignal.timeout(timeoutMs);
+    }
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    timer.unref?.();
+    return controller.signal;
+}
+/** Shared POST init: never follow redirects (tenant headers would leak). */
+function exportRequestInit(headers, body, timeoutMs) {
+    const init = {
+        method: "POST",
+        headers,
+        body,
+        redirect: "error",
+    };
+    const signal = flushSignal(timeoutMs);
+    if (signal !== undefined)
+        init.signal = signal;
+    return init;
+}
 function toLogRecord(line) {
     let level = "info";
     let body = line;
@@ -149,7 +197,9 @@ function toLogRecord(line) {
             attributes.push({
                 key,
                 value: {
-                    stringValue: truncate(typeof value === "string" ? value : JSON.stringify(value) ?? "null", LOG_MAX_FIELD_LENGTH),
+                    stringValue: truncate(typeof value === "string"
+                        ? value
+                        : (JSON.stringify(value) ?? "null"), LOG_MAX_FIELD_LENGTH),
                 },
             });
         }
@@ -183,6 +233,7 @@ export function createOtlpLogExporter(opts = {}) {
     if (transport === null)
         return null;
     const { url, headers, resourceAttributes, fetchImpl } = transport;
+    const timeoutMs = opts.flushTimeoutMs ?? DEFAULT_FLUSH_TIMEOUT_MS;
     const queue = [];
     let dropped = 0;
     let flushing = false;
@@ -201,11 +252,7 @@ export function createOtlpLogExporter(opts = {}) {
                         },
                     ],
                 };
-                const res = await fetchImpl(url, {
-                    method: "POST",
-                    headers,
-                    body: JSON.stringify(payload),
-                });
+                const res = await fetchImpl(url, exportRequestInit(headers, JSON.stringify(payload), timeoutMs));
                 if (!res.ok)
                     dropped += 1;
             }
@@ -253,6 +300,7 @@ export function createOtlpMetricsExporter(opts = {}) {
     if (transport === null)
         return null;
     const { url, headers, resourceAttributes, fetchImpl } = transport;
+    const timeoutMs = opts.flushTimeoutMs ?? DEFAULT_FLUSH_TIMEOUT_MS;
     const counters = new Map();
     const histograms = new Map();
     let dropped = 0;
@@ -266,7 +314,10 @@ export function createOtlpMetricsExporter(opts = {}) {
     }
     function sortedEntries(attributes) {
         return Object.entries(attributes)
-            .map(([k, v]) => [k, truncate(v, METRICS_MAX_ATTR_LENGTH)])
+            .map(([k, v]) => [
+            k,
+            truncate(v, METRICS_MAX_ATTR_LENGTH),
+        ])
             .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
     }
     function atCapacity() {
@@ -279,6 +330,9 @@ export function createOtlpMetricsExporter(opts = {}) {
         if (flushing || !dirty)
             return;
         flushing = true;
+        // Clear before the POST so a concurrent count/record keeps the flag true
+        // and the next flush carries the in-flight increment.
+        dirty = false;
         try {
             const now = (BigInt(Date.now()) * 1000000n).toString();
             const sumsByName = new Map();
@@ -341,18 +395,15 @@ export function createOtlpMetricsExporter(opts = {}) {
                     },
                 ],
             };
-            const res = await fetchImpl(url, {
-                method: "POST",
-                headers,
-                body: JSON.stringify(payload),
-            });
-            if (res.ok)
-                dirty = false;
-            else
+            const res = await fetchImpl(url, exportRequestInit(headers, JSON.stringify(payload), timeoutMs));
+            if (!res.ok) {
                 dropped += 1;
+                dirty = true;
+            }
         }
         catch {
-            dropped += 1; // totals retained; cumulative temporality self-heals
+            dropped += 1;
+            dirty = true; // totals retained; cumulative temporality self-heals
         }
         finally {
             flushing = false;
@@ -371,7 +422,10 @@ export function createOtlpMetricsExporter(opts = {}) {
                     return;
                 s = {
                     name,
-                    attributes: entries.map(([k, v]) => ({ key: k, value: { stringValue: v } })),
+                    attributes: entries.map(([k, v]) => ({
+                        key: k,
+                        value: { stringValue: v },
+                    })),
                     total: 0,
                     startTimeUnixNano: (BigInt(Date.now()) * 1000000n).toString(),
                 };
@@ -393,7 +447,10 @@ export function createOtlpMetricsExporter(opts = {}) {
                     name,
                     unit: options.unit,
                     boundaries: options.boundaries,
-                    attributes: entries.map(([k, v]) => ({ key: k, value: { stringValue: v } })),
+                    attributes: entries.map(([k, v]) => ({
+                        key: k,
+                        value: { stringValue: v },
+                    })),
                     count: 0,
                     sum: 0,
                     bucketCounts: new Array(options.boundaries.length + 1).fill(0),
@@ -417,7 +474,8 @@ export function createOtlpMetricsExporter(opts = {}) {
 }
 /** Monotonic clock in milliseconds, falling back to `Date.now` where needed. */
 function nowMs() {
-    return typeof performance !== "undefined" && typeof performance.now === "function"
+    return typeof performance !== "undefined" &&
+        typeof performance.now === "function"
         ? performance.now()
         : Date.now();
 }
@@ -460,21 +518,25 @@ export function semconvHttpMetrics(sink, opts = {}) {
             if (started === undefined)
                 return;
             SEMCONV_START_TIMES.delete(request);
-            let pathname = "/";
-            let scheme = "http";
-            try {
-                const parsed = new URL(request.url);
-                pathname = parsed.pathname;
-                scheme = parsed.protocol.replace(":", "");
-            }
-            catch {
-                /* malformed URL — keep the fallbacks */
+            const url = request.url;
+            if (opts.exclude !== undefined) {
+                let pathname = "/";
+                try {
+                    pathname = new URL(url).pathname;
+                }
+                catch {
+                    /* malformed URL — keep the fallback */
+                }
+                if (opts.exclude(pathname))
+                    return;
             }
-            if (opts.exclude !== undefined && opts.exclude(pathname))
-                return;
+            const colon = url.indexOf(":");
+            const scheme = colon > 0 ? url.slice(0, colon) : "http";
             const rawMethod = request.method.toUpperCase();
             const attributes = {
-                "http.request.method": KNOWN_METHODS.has(rawMethod) ? rawMethod : "_OTHER",
+                "http.request.method": KNOWN_METHODS.has(rawMethod)
+                    ? rawMethod
+                    : "_OTHER",
                 "http.response.status_code": String(res.status),
                 "url.scheme": scheme,
             };

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:3d6cece6-6c87-5815-9301-8b0be8579da5",
+  "serialNumber": "urn:uuid:e489b0cf-2d9d-5f9f-93c0-ff3c851e6f48",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-20T11:51:20.093Z",
+    "timestamp": "2026-08-20T14:37:11.548Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "1.2.0"
+        "version": "1.2.1"
       }
     ],
     "authors": [
@@ -19,11 +19,11 @@
     ],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/@daloyjs/core@1.2.0",
+      "bom-ref": "pkg:npm/@daloyjs/core@1.2.1",
       "name": "@daloyjs/core",
-      "version": "1.2.0",
+      "version": "1.2.1",
       "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
-      "purl": "pkg:npm/@daloyjs/core@1.2.0",
+      "purl": "pkg:npm/@daloyjs/core@1.2.1",
       "licenses": [
         {
           "license": {
@@ -46,9 +46,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag--daloyjs-core-1.2.0",
+        "tagId": "swidtag--daloyjs-core-1.2.1",
         "name": "@daloyjs/core",
-        "version": "1.2.0",
+        "version": "1.2.1",
         "tagVersion": 0,
         "patch": false
       }
@@ -57,7 +57,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/@daloyjs/core@1.2.0",
+      "ref": "pkg:npm/@daloyjs/core@1.2.1",
       "dependsOn": []
     }
   ]

package/dist/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@daloyjs/core-1.2.0",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.2.0-3d6cece6-6c87-5815-9301-8b0be8579da5",
+  "name": "@daloyjs/core-1.2.1",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.2.1-e489b0cf-2d9d-5f9f-93c0-ff3c851e6f48",
   "creationInfo": {
-    "created": "2026-08-20T11:51:20.093Z",
+    "created": "2026-08-20T14:37:11.548Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package--daloyjs-core",
       "name": "@daloyjs/core",
-      "versionInfo": "1.2.0",
+      "versionInfo": "1.2.1",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/@daloyjs/core@1.2.0"
+          "referenceLocator": "pkg:npm/@daloyjs/core@1.2.1"
         }
       ]
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daloyjs/core",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops \u2014 distributed via pnpm.",
   "type": "module",
   "publishConfig": {