@daloyjs/core 1.2.1 → 1.3.1

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:e489b0cf-2d9d-5f9f-93c0-ff3c851e6f48",
+  "serialNumber": "urn:uuid:3be788cc-3073-595a-871d-593791c06327",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-20T14:37:11.548Z",
+    "timestamp": "2026-08-29T14:05:07.830Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "1.2.1"
+        "version": "1.3.1"
       }
     ],
     "authors": [
@@ -19,11 +19,11 @@
     ],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/@daloyjs/core@1.2.1",
+      "bom-ref": "pkg:npm/@daloyjs/core@1.3.1",
       "name": "@daloyjs/core",
-      "version": "1.2.1",
+      "version": "1.3.1",
       "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
-      "purl": "pkg:npm/@daloyjs/core@1.2.1",
+      "purl": "pkg:npm/@daloyjs/core@1.3.1",
       "licenses": [
         {
           "license": {
@@ -46,9 +46,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag--daloyjs-core-1.2.1",
+        "tagId": "swidtag--daloyjs-core-1.3.1",
         "name": "@daloyjs/core",
-        "version": "1.2.1",
+        "version": "1.3.1",
         "tagVersion": 0,
         "patch": false
       }
@@ -57,7 +57,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/@daloyjs/core@1.2.1",
+      "ref": "pkg:npm/@daloyjs/core@1.3.1",
       "dependsOn": []
     }
   ]

package/dist/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@daloyjs/core-1.2.1",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.2.1-e489b0cf-2d9d-5f9f-93c0-ff3c851e6f48",
+  "name": "@daloyjs/core-1.3.1",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.3.1-3be788cc-3073-595a-871d-593791c06327",
   "creationInfo": {
-    "created": "2026-08-20T14:37:11.548Z",
+    "created": "2026-08-29T14:05:07.830Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package--daloyjs-core",
       "name": "@daloyjs/core",
-      "versionInfo": "1.2.1",
+      "versionInfo": "1.3.1",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/@daloyjs/core@1.2.1"
+          "referenceLocator": "pkg:npm/@daloyjs/core@1.3.1"
         }
       ]
     }

package/dist/scheduler.js

@@ -487,16 +487,21 @@ export class Scheduler {
             }, 0);
             return;
         }
-        const delay = this.#nextDelay(task);
-        task.nextRunAt = this.#now() + delay;
+        // One clock read anchors both the delay and nextRunAt: splitting them
+        // let a millisecond slip between the two reads push nextRunAt (and so
+        // the tick's scheduledFor) off the cron boundary by a per-process
+        // delta, which broke cronEnqueue's cross-replica payload dedup.
+        const now = this.#now();
+        const delay = this.#nextDelay(task, now);
+        task.nextRunAt = now + delay;
         task.timer = this.#timers.set(() => {
             void this.#tick(task);
         }, delay);
     }
-    #nextDelay(task) {
+    #nextDelay(task, now) {
         if (task.fields !== undefined) {
-            const next = nextCronRun(task.fields, new Date(this.#now()), task.def.timeZone);
-            return Math.max(0, next.getTime() - this.#now());
+            const next = nextCronRun(task.fields, new Date(now), task.def.timeZone);
+            return Math.max(0, next.getTime() - now);
         }
         return task.def.intervalMs;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daloyjs/core",
-  "version": "1.2.1",
+  "version": "1.3.1",
   "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops \u2014 distributed via pnpm.",
   "type": "module",
   "publishConfig": {
@@ -170,6 +170,10 @@
       "types": "./dist/scheduler.d.ts",
       "import": "./dist/scheduler.js"
     },
+    "./jobs": {
+      "types": "./dist/jobs.d.ts",
+      "import": "./dist/jobs.js"
+    },
     "./mtls": {
       "types": "./dist/mtls.d.ts",
       "import": "./dist/mtls.js"
@@ -260,6 +264,8 @@
     "test": "node --import tsx --test tests/**/*.test.ts",
     "test:red-team": "node --import tsx --test tests/red-team-attacks.test.ts tests/red-team-attacks-2.test.ts tests/red-team-attacks-3.test.ts tests/red-team-attacks-4.test.ts tests/red-team-attacks-5.test.ts tests/red-team-attacks-6.test.ts tests/red-team-attacks-7.test.ts tests/red-team-attacks-8.test.ts tests/red-team-attacks-9.test.ts tests/red-team-attacks-10.test.ts tests/red-team-attacks-11.test.ts",
     "red-team:live": "node --import tsx red-team-live/run.ts",
+    "red-team:live:mcp": "node --import tsx red-team-live/mcp-attacks.ts",
+    "red-team:live:wave2": "node --import tsx red-team-live/skill-wave2-attacks.ts",
     "coverage": "node --import tsx --test --experimental-test-coverage --test-coverage-include='src/**' --test-coverage-lines=90 --test-coverage-functions=90 tests/**/*.test.ts",
     "coverage:branches": "tsc -p tsconfig.coverage.json && node --test --experimental-test-coverage --test-coverage-include='dist-coverage/src/**' --test-coverage-branches=92 dist-coverage/tests/**/*.test.js",
     "typecheck": "tsc --noEmit && tsc -p tsconfig.typetest.json && tsc -p tests/tsconfig.json --noEmit && tsc -p red-team-live/tsconfig.json --noEmit",