@daloyjs/core 0.7.0 → 0.7.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +47 -39
  2. package/package.json +2 -2
package/README.md CHANGED
@@ -1,17 +1,14 @@
1
1
  # DaloyJS
2
2
 
3
- > A **runtime-portable TypeScript web framework** with built-in **contract-first routing**, **validation**, **OpenAPI (Hey API)**, **typed client generation**, **large-scale maintainability**, and **secure-by-default runtime and supply-chain posture**.
3
+ [![CI](https://github.com/daloyjs/daloy/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/daloyjs/daloy/actions/workflows/ci.yml)
4
+ [![CodeQL](https://github.com/daloyjs/daloy/actions/workflows/codeql.yml/badge.svg?branch=main)](https://github.com/daloyjs/daloy/actions/workflows/codeql.yml)
5
+ [![Publish](https://github.com/daloyjs/daloy/actions/workflows/release.yml/badge.svg)](https://github.com/daloyjs/daloy/actions/workflows/release.yml)
6
+ [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/daloyjs/daloy/badge)](https://securityscorecards.dev/viewer/?uri=github.com/daloyjs/daloy)
7
+ [![Zizmor](https://github.com/daloyjs/daloy/actions/workflows/zizmor.yml/badge.svg?branch=main)](https://github.com/daloyjs/daloy/actions/workflows/zizmor.yml)
4
8
 
5
- DaloyJS is maintained in the GitHub organization at <https://github.com/daloyjs>; the canonical framework repository is <https://github.com/daloyjs/daloy>.
6
-
7
- 📚 **Documentation site:** [`./website`](./website) — a Next.js 16 + shadcn/ui + Tailwind v4 site with the landing page, getting-started guide, ORM integration guides, tutorials, security docs, and full API reference. Run it with:
9
+ > A **runtime-portable TypeScript web framework** with built-in **contract-first routing**, **validation**, **OpenAPI (Hey API)**, **typed client generation**, **large-scale maintainability**, and **security-focused runtime plus supply-chain posture**.
8
10
 
9
- ```zsh
10
- cd website
11
- pnpm install
12
- pnpm dev # http://localhost:3000
13
- pnpm build # static prerender of every docs route
14
- ```
11
+ DaloyJS is maintained in the GitHub organization at <https://github.com/daloyjs>; the canonical framework repository is <https://github.com/daloyjs/daloy>.
15
12
 
16
13
  ---
17
14
 
@@ -50,13 +47,27 @@ DaloyJS combines the wins:
50
47
  1. **Explicit contracts, minimal ceremony.** One `app.route({...})` is the source of truth for validation, types, OpenAPI, the typed client, and contract tests.
51
48
  2. **One source of truth for validation, typing, and docs** via [Standard Schema](https://github.com/standard-schema/standard-schema) — Zod 4 / Valibot / ArkType / TypeBox all work, no lock-in.
52
49
  3. **Portable core, optional runtime optimizations** — the only thing the core knows is `Request → Response`. Adapters live at the edge.
53
- 4. **Secure by default — bad defaults are bugs.** Body limits, prototype-pollution-safe JSON, path-traversal rejection, request timeouts, Helmet-grade headers, RFC 9457 problem+json errors with prod-mode redaction.
50
+ 4. **Security guardrails by default — bad defaults are bugs.** The core enforces body limits, prototype-pollution-safe JSON, path-traversal rejection, request timeouts, content-type checks, and RFC 9457 problem+json errors with prod-mode redaction. First-party middleware covers Helmet-grade headers, CORS, CSRF, rate limits, request ids, and signed-cookie sessions.
54
51
  5. **Tooling and inspectability over magic.** `app.introspect()` is a public API; contract-test runner is built in.
55
52
  6. **Optimize for large-team maintenance**, not only solo-dev speed. Encapsulated plugins, decorators, request ids, structured logger.
56
53
 
57
54
  ---
58
55
 
59
- ## Install
56
+ ## Get started
57
+
58
+ For a new DaloyJS project, the recommended path is the official scaffolder:
59
+
60
+ ```bash
61
+ pnpm create daloy@latest my-api
62
+ # or
63
+ npm create daloy@latest my-api
64
+ ```
65
+
66
+ `create-daloy` gives you a working project structure, runtime template selection, docs routes, OpenAPI wiring, and production-oriented defaults without copying code out of the README.
67
+
68
+ See [Scaffold a project](https://daloyjs.dev/docs/scaffolder) for templates and flags.
69
+
70
+ ## Install core manually
60
71
 
61
72
  DaloyJS is distributed via **pnpm** for [supply-chain hygiene](https://pnpm.io/motivation) and backed by a hardened release pipeline — strict isolation, content-addressable store, deterministic lockfile, no phantom dependencies, SHA-pinned CI actions, and provenance publishing.
62
73
 
@@ -83,16 +94,6 @@ Run `pnpm audit --prod` regularly (or `pnpm run audit` in this repo) — and `pn
83
94
 
84
95
  ---
85
96
 
86
- ## Quick start
87
-
88
- ```bash
89
- pnpm create daloy@latest my-api
90
- # or
91
- npm create daloy@latest my-api
92
- ```
93
-
94
- See [Scaffold a project](https://daloyjs.dev/docs/scaffolder) for templates and flags.
95
-
96
97
  ## Hello world
97
98
 
98
99
  ```ts
@@ -102,7 +103,7 @@ import { serve } from "@daloyjs/core/node";
102
103
 
103
104
  const app = new App({ bodyLimitBytes: 1024 * 1024, requestTimeoutMs: 5_000 });
104
105
 
105
- // Security defaults — usually three plugins in other frameworks.
106
+ // First-party security middleware — usually three plugins in other frameworks.
106
107
  app.use(requestId());
107
108
  app.use(secureHeaders());
108
109
  app.use(rateLimit({ windowMs: 60_000, max: 120 }));
@@ -177,29 +178,34 @@ import { swaggerUiHtml, htmlResponse } from "@daloyjs/core/docs";
177
178
  ```
178
179
 
179
180
  Mount at `/docs` and the UI is always contract-accurate — never stale.
180
- `create-daloy@0.1.14` mounts Swagger UI at `/docs` and the live spec at `/openapi.json` by default.
181
+ `create-daloy@0.1.20` mounts Swagger UI at `/docs` and the live spec at `/openapi.json` by default.
181
182
 
182
183
  ---
183
184
 
184
- ## Security defaults (no plugins required)
185
+ ## Security guardrails
186
+
187
+ Some protections are enforced by the `App` core whenever the relevant request
188
+ path is used. Others are first-party middleware so applications can choose the
189
+ right CORS policy, rate-limit key, CSP, session secret, or CSRF rollout for their
190
+ deployment.
185
191
 
186
- | Threat | Default behavior |
192
+ | Threat | Built-in behavior |
187
193
  |---|---|
188
- | **Body-size DoS** | Streamed read, hard cap (default 1 MiB), `Content-Length` checked first. |
189
- | **Prototype pollution** | `safeJsonParse` strips `__proto__` / `constructor` / `prototype` via reviver. |
190
- | **Header / response splitting** | `sanitizeHeaderName` / `sanitizeHeaderValue` reject CRLF + NUL. |
191
- | **Path traversal** | Router rejects `..` segments and `//` before walking. |
192
- | **Slow-loris / hung handlers** | `requestTimeoutMs` aborts handlers (default 30 s); Node adapter sets `requestTimeout` + `headersTimeout` + `maxHeaderSize`. |
193
- | **MIME sniffing** | `secureHeaders()` sets `X-Content-Type-Options: nosniff`. |
194
- | **Clickjacking** | `X-Frame-Options: DENY` + CSP `frame-ancestors 'none'`. |
195
- | **XSS via injected scripts** | Strict CSP `default-src 'self'` baseline. |
196
- | **Cross-origin leakage** | `cross-origin-opener-policy` + `cross-origin-resource-policy` set to `same-origin`. |
194
+ | **Body-size DoS** | Core-enforced streamed read with a hard cap (default 1 MiB); `Content-Length` checked first. |
195
+ | **Prototype pollution** | Core JSON parser strips `__proto__` / `constructor` / `prototype` via reviver. |
196
+ | **Header / response splitting** | Core header sanitizers reject CRLF + NUL. |
197
+ | **Path traversal** | Core router rejects `..` segments and `//` before walking. |
198
+ | **Slow-loris / hung handlers** | Core `requestTimeoutMs` aborts handlers (default 30 s); Node adapter sets `requestTimeout` + `headersTimeout` + `maxHeaderSize`. |
199
+ | **MIME sniffing** | First-party `secureHeaders()` sets `X-Content-Type-Options: nosniff`; scaffolded apps enable it. |
200
+ | **Clickjacking** | First-party `secureHeaders()` sets `X-Frame-Options: DENY` + CSP `frame-ancestors 'none'`; scaffolded apps enable it. |
201
+ | **XSS via injected scripts** | First-party `secureHeaders()` provides a strict CSP `default-src 'self'` baseline; scaffolded apps enable it. |
202
+ | **Cross-origin leakage** | First-party `secureHeaders()` sets `cross-origin-opener-policy` + `cross-origin-resource-policy` to `same-origin`; scaffolded apps enable it. |
197
203
  | **Information disclosure (5xx)** | Production mode strips `detail` from 5xx problem+json automatically. |
198
- | **Credential timing attacks** | `timingSafeEqual()` for tokens & signatures. |
199
- | **Brute-force / scraping** | `rateLimit()` with token-bucket + `Retry-After`. |
204
+ | **Credential timing attacks** | First-party `timingSafeEqual()` helper for tokens & signatures. |
205
+ | **Brute-force / scraping** | First-party `rateLimit()` with token-bucket + `Retry-After`; Node/Bun/Deno scaffolded apps enable it. |
200
206
  | **Method confusion** | Real **405** with `Allow` header, not a misleading 404. |
201
- | **CORS misconfig** | Explicit allowlist; never `*` with credentials. |
202
- | **Request correlation** | Cryptographic `randomId()` request ids on every response. |
207
+ | **CORS misconfig** | First-party `cors()` requires an explicit allowlist and throws for `*` with credentials. |
208
+ | **Request correlation** | First-party `requestId()` uses cryptographic ids; scaffolded apps enable it. |
203
209
  | **Supply chain** | pnpm `ignore-scripts=true`, `minimum-release-age=1440`, verified store, reproducible lockfile, lockfile source verification, provenance publishing, and CI/CD hardening against cache poisoning and OIDC token abuse. |
204
210
 
205
211
  The publish pipeline is also hardened: no `pull_request_target`, no GitHub Actions cache in CI, top-level `permissions: {}`, `step-security/harden-runner`, a separate protected `release.yml` workflow, npm trusted publishing with `--provenance`, CodeQL, OpenSSF Scorecard, zizmor workflow linting, Dependabot, and CODEOWNERS on workflow/package files. See [SECURITY.md](SECURITY.md) and the [supply-chain security docs](https://daloyjs.dev/docs/security/supply-chain).
@@ -333,6 +339,8 @@ WebSockets and HTTP/2 + HTTP/3 adapters.
333
339
  - [x] `--minimal` flag that strips the bookstore demo and `/docs` + `/openapi.json` routes from any template
334
340
  - [x] `daloy inspect` CLI: route table, schema summary, contract-test gate, OpenAPI dump, tag/method filters
335
341
  - [x] Redis-backed `RateLimitStore` at `@daloyjs/core/rate-limit-redis` with `ioredisAdapter` / `nodeRedisAdapter` and a fail-open default for shared counters across replicas
342
+ - [x] AI-agent helper files (`AGENTS.md` + `SKILL.md`) shipped in every `create-daloy` template so Copilot/Claude/Cursor/Codex have project context out of the box
343
+ - [x] Polished `create-daloy` terminal UX: DaloyJS welcome banner, arrow-key pickers, install spinner, and boxed next steps while preserving zero runtime dependencies
336
344
 
337
345
  ## License
338
346
 
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@daloyjs/core",
3
- "version": "0.7.0",
3
+ "version": "0.7.2",
4
4
  "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
5
5
  "type": "module",
6
6
  "publishConfig": {
@@ -10,7 +10,7 @@
10
10
  "type": "git",
11
11
  "url": "git+https://github.com/daloyjs/daloy.git"
12
12
  },
13
- "homepage": "https://github.com/daloyjs/daloy#readme",
13
+ "homepage": "https://daloyjs.dev",
14
14
  "bugs": {
15
15
  "url": "https://github.com/daloyjs/daloy/issues"
16
16
  },