create-daloy 0.1.13 → 0.1.15

package/README.md

@@ -13,8 +13,9 @@ bun  create daloy           my-api
 The CLI is interactive when arguments are missing. It will ask you for:
 
 - A project directory name (defaults to `my-daloy-app`)
-- A template (`node-basic`, `vercel-edge`, or `cloudflare-worker`)
-- A package manager (`pnpm`, `npm`, `yarn`, or `bun`)
+- A template (`node-basic`, `vercel-edge`, `cloudflare-worker`, `bun-basic`, or `deno-basic`)
+- A package manager (`pnpm`, `npm`, `yarn`, or `bun`) — not asked for the
+  `deno-basic` runtime template
 - Whether to install dependencies
 - Whether to initialize a git repository
 
@@ -32,11 +33,12 @@ pnpm create daloy@latest my-api \
 
 | Flag | Description |
 | --- | --- |
-| `--template <name>` | `node-basic` (default), `vercel-edge`, or `cloudflare-worker`. |
-| `--package-manager <pm>` | `pnpm` (default), `npm`, `yarn`, or `bun`. |
+| `--template <name>` | `node-basic` (default), `vercel-edge`, `cloudflare-worker`, `bun-basic`, or `deno-basic`. |
+| `--package-manager <pm>` | `pnpm` (default), `npm`, `yarn`, or `bun`. Ignored for `deno-basic`. |
 | `--list-templates` | Print available templates with descriptions. |
 | `--install` / `--no-install` | Install dependencies after scaffolding. Defaults to interactive. |
 | `--git` / `--no-git` | Initialize a git repository. Defaults to interactive. |
+| `--minimal` | Strip the bookstore demo route and the built-in `/docs` + `/openapi.json` routes so only the framework bootstrap and `/healthz` ship. |
 | `--force` | Overwrite an existing non-empty directory. |
 | `--yes` | Accept all defaults; never prompt. |
 | `--help` | Print usage and exit. |
@@ -73,6 +75,41 @@ A Vercel Edge API bootstrap using `@daloyjs/core/vercel` with:
 - `vercel dev` / `vercel deploy` scripts.
 - A health route and bookstore route mirroring the Node starter.
 
+### `bun-basic`
+
+A [Bun](https://bun.sh) runtime starter using `@daloyjs/core/bun` with:
+
+- `bun --hot src/index.ts` for instant reloads.
+- `bun test` wired to in-process `app.request(...)` checks.
+- The same secure defaults (`secureHeaders`, `requestId`, `rateLimit`).
+- A health route and contract-first `/books/:id` route with Zod validation.
+- Hey API codegen wired to `bun run gen:openapi` + `bun run gen:client`.
+
+### `deno-basic`
+
+A [Deno](https://deno.com) runtime starter using `@daloyjs/core/deno` with:
+
+- A `deno.json` with `deno task dev`, `test`, and `gen:openapi` tasks.
+- `@daloyjs/core` and Zod loaded via `npm:` import-map specifiers.
+- Minimum-permissions dev script (`--allow-net --allow-env --allow-read`).
+- A health route and contract-first `/books/:id` route with Zod validation.
+- The CLI skips Node-style installs for this template (no `package.json`).
+
+## Minimal scaffolds
+
+Pass `--minimal` to drop the bookstore demo route and the built-in
+`/docs` + `/openapi.json` Swagger UI routes from any template that supports
+them. The scaffolded app is left with the framework bootstrap and a single
+`/healthz` route — the smallest realistic starting point:
+
+```bash
+pnpm create daloy@latest my-api --template node-basic --minimal --yes
+```
+
+Sentinel comments (`// daloy-minimal:strip-start <tag>` /
+`// daloy-minimal:strip-end <tag>`) survive a default scaffold so you can
+re-run with `--minimal`, or delete the marked blocks by hand later.
+
 ## What the CLI guarantees
 
 - Zero runtime dependencies (uses only Node built-ins) for a clean supply-chain footprint.

package/bin/create-daloy.mjs

@@ -30,6 +30,16 @@ const TEMPLATE_OPTIONS = [
     title: "Cloudflare Workers",
     description: "Worker entrypoint with wrangler dev/deploy scripts",
   },
+  {
+    value: "bun-basic",
+    title: "Bun API",
+    description: "Bun-native server with `bun --hot`, `bun test`, and Hey API codegen",
+  },
+  {
+    value: "deno-basic",
+    title: "Deno API",
+    description: "Deno-native server with `deno task dev`, `deno test`, and `npm:` imports",
+  },
 ];
 
 const PACKAGE_MANAGER_OPTIONS = [
@@ -48,6 +58,17 @@ const RENAME_ON_COPY = new Map([
   ["_env.example", ".env.example"],
 ]);
 
+// Templates that target a runtime instead of an npm package manager.
+// For these templates we skip Node-style `<pm> install`, do not patch
+// `package.json`, and let the user drive the runtime directly
+// (e.g. `deno task dev`).
+const NO_PACKAGE_JSON_TEMPLATES = new Set(["deno-basic"]);
+
+// Text-file extensions that the `--minimal` post-processor scans for
+// `daloy-minimal:strip-start <tag>` / `daloy-minimal:strip-end <tag>`
+// sentinels.
+const MINIMAL_STRIP_EXTENSIONS = new Set([".ts", ".tsx", ".js", ".mjs", ".cjs", ".md"]);
+
 const COLORS = process.stdout.isTTY
   ? {
       reset: "\x1b[0m",
@@ -77,6 +98,7 @@ Options:
   --list-templates           Print available templates and exit.
   --install / --no-install   Install dependencies after scaffolding.
   --git / --no-git           Initialize a git repository.
+  --minimal                  Strip the bookstore + Swagger/OpenAPI demo routes.
   --force                    Overwrite an existing non-empty directory.
   --yes, -y                  Accept all defaults; never prompt.
   --help, -h                 Print this help.
@@ -113,6 +135,7 @@ function parseArgs(argv) {
     help: false,
     version: false,
     listTemplates: false,
+    minimal: false,
   };
   const args = [...argv];
   while (args.length) {
@@ -122,6 +145,7 @@ function parseArgs(argv) {
     else if (a === "--list-templates") out.listTemplates = true;
     else if (a === "--yes" || a === "-y") out.yes = true;
     else if (a === "--force") out.force = true;
+    else if (a === "--minimal") out.minimal = true;
     else if (a === "--install") out.install = true;
     else if (a === "--no-install") out.install = false;
     else if (a === "--git") out.git = true;
@@ -256,6 +280,58 @@ async function normalizePackageManagerFiles(dir, packageManager) {
   await rm(npmrcPath, { force: true });
 }
 
+/**
+ * `--minimal` post-processor.
+ *
+ * Templates ship with optional sections fenced by line comments:
+ *
+ *   // daloy-minimal:strip-start <tag>
+ *   ...
+ *   // daloy-minimal:strip-end <tag>
+ *
+ * Markdown files can use equivalent HTML comments:
+ *
+ *   <!-- daloy-minimal:strip-start <tag> -->
+ *   ...
+ *   <!-- daloy-minimal:strip-end <tag> -->
+ *
+ * When the user passes `--minimal`, this walks the scaffolded source files
+ * and deletes those blocks (including the sentinel lines themselves) so
+ * the resulting project ships only the health route plus the bare
+ * framework bootstrap. We deliberately keep matching to text files with
+ * known source extensions so the stripper never touches binary assets.
+ */
+async function stripMinimalSections(dir) {
+  const stripPatterns = [
+    /^[ \t]*\/\/[ \t]*daloy-minimal:strip-start\b[\s\S]*?^[ \t]*\/\/[ \t]*daloy-minimal:strip-end\b.*\n?/gm,
+    /^[ \t]*<!--[ \t]*daloy-minimal:strip-start\b[\s\S]*?^[ \t]*<!--[ \t]*daloy-minimal:strip-end\b.*?-->[ \t]*\n?/gm,
+  ];
+  let stripped = 0;
+  await walk(dir);
+  return stripped;
+
+  async function walk(current) {
+    const entries = await readdir(current, { withFileTypes: true });
+    for (const entry of entries) {
+      const full = path.join(current, entry.name);
+      if (entry.isDirectory()) {
+        if (entry.name === "node_modules" || entry.name === ".git") continue;
+        await walk(full);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      if (!MINIMAL_STRIP_EXTENSIONS.has(path.extname(entry.name))) continue;
+      const raw = await readFile(full, "utf8");
+      if (!raw.includes("daloy-minimal:strip-start")) continue;
+      const next = stripPatterns.reduce((current, pattern) => current.replace(pattern, ""), raw);
+      if (next !== raw) {
+        await writeFile(full, next, "utf8");
+        stripped += 1;
+      }
+    }
+  }
+}
+
 function run(cmd, args, cwd) {
   return new Promise((resolve) => {
     const proc = spawn(cmd, args, { cwd, stdio: "inherit", shell: process.platform === "win32" });
@@ -319,19 +395,30 @@ function logWarn(message) {
   console.warn(`${color(COLORS.yellow, "  [warn]")} ${message}`);
 }
 
-function printSummary({ projectName, template, packageManager, installDeps }) {
+function printSummary({ projectName, template, packageManager, installDeps, skipPackageManager }) {
   console.log(color(COLORS.green, "\nCreated a new DaloyJS project."));
   console.log(`\n  ${color(COLORS.bold, "Project")}   ${projectName}`);
   console.log(`  ${color(COLORS.bold, "Template")}  ${template}`);
-  console.log(`  ${color(COLORS.bold, "Manager")}   ${packageManager}`);
-  console.log(`\n  ${color(COLORS.bold, "Next steps")}`);
-  console.log(`    cd ${projectName}`);
-  if (!installDeps) console.log(`    ${packageManager} install`);
-  console.log(`    ${packageManager} run dev`);
-  console.log(`\n  ${color(COLORS.bold, "Useful commands")}`);
-  console.log(`    ${packageManager} run typecheck`);
-  console.log(`    ${packageManager} test`);
-  if (template === "node-basic") console.log(`    ${packageManager} run gen`);
+  if (skipPackageManager) {
+    console.log(`  ${color(COLORS.bold, "Runtime")}   ${template === "deno-basic" ? "Deno" : "runtime"}`);
+    console.log(`\n  ${color(COLORS.bold, "Next steps")}`);
+    console.log(`    cd ${projectName}`);
+    console.log(`    deno task dev`);
+    console.log(`\n  ${color(COLORS.bold, "Useful commands")}`);
+    console.log(`    deno task typecheck`);
+    console.log(`    deno task test`);
+    console.log(`    deno task gen:openapi`);
+  } else {
+    console.log(`  ${color(COLORS.bold, "Manager")}   ${packageManager}`);
+    console.log(`\n  ${color(COLORS.bold, "Next steps")}`);
+    console.log(`    cd ${projectName}`);
+    if (!installDeps) console.log(`    ${packageManager} install`);
+    console.log(`    ${packageManager} run dev`);
+    console.log(`\n  ${color(COLORS.bold, "Useful commands")}`);
+    console.log(`    ${packageManager} run typecheck`);
+    console.log(`    ${packageManager} test`);
+    if (template === "node-basic" || template === "bun-basic") console.log(`    ${packageManager} run gen`);
+  }
   console.log(`\n  ${color(COLORS.dim, "Docs: https://daloyjs.dev/docs")}`);
   console.log(color(COLORS.dim, "  Issues: https://github.com/daloyjs/daloy/issues\n"));
 }
@@ -413,10 +500,15 @@ async function main() {
     }
 
     let packageManager = opts.packageManager;
+    const skipPackageManager = NO_PACKAGE_JSON_TEMPLATES.has(template);
     if (!packageManager) {
-      packageManager = rl
-        ? await askChoice(rl, "Choose a package manager:", PACKAGE_MANAGER_OPTIONS, detectedPm)
-        : detectedPm;
+      if (skipPackageManager) {
+        packageManager = "pnpm"; // ignored for runtime-only templates
+      } else {
+        packageManager = rl
+          ? await askChoice(rl, "Choose a package manager:", PACKAGE_MANAGER_OPTIONS, detectedPm)
+          : detectedPm;
+      }
     }
     if (!PACKAGE_MANAGERS.includes(packageManager)) {
       console.error(
@@ -427,7 +519,11 @@ async function main() {
 
     let installDeps = opts.install;
     if (installDeps === undefined) {
-      installDeps = rl ? await askYesNo(rl, `Install dependencies with ${packageManager}?`, true) : false;
+      if (skipPackageManager) {
+        installDeps = false;
+      } else {
+        installDeps = rl ? await askYesNo(rl, `Install dependencies with ${packageManager}?`, true) : false;
+      }
     }
 
     let initGit = opts.git;
@@ -442,12 +538,18 @@ async function main() {
     await mkdir(targetDir, { recursive: true });
     await copyTemplate(templateDir, targetDir);
     logStep("Template copied", template);
-    await patchPackageJson(targetDir, projectName, packageManager);
-    logStep("Package metadata written", projectName);
-    await patchReadme(targetDir, packageManager);
-    await normalizePackageManagerFiles(targetDir, packageManager);
-    if (packageManager !== "pnpm") {
-      logStep("Package-manager config normalized", packageManager);
+    if (opts.minimal) {
+      const count = await stripMinimalSections(targetDir);
+      logStep("Minimal mode applied", `${count} file${count === 1 ? "" : "s"} trimmed`);
+    }
+    if (!skipPackageManager) {
+      await patchPackageJson(targetDir, projectName, packageManager);
+      logStep("Package metadata written", projectName);
+      await patchReadme(targetDir, packageManager);
+      await normalizePackageManagerFiles(targetDir, packageManager);
+      if (packageManager !== "pnpm") {
+        logStep("Package-manager config normalized", packageManager);
+      }
     }
 
     if (initGit) {
@@ -469,7 +571,7 @@ async function main() {
       }
     }
 
-    printSummary({ projectName, template, packageManager, installDeps });
+    printSummary({ projectName, template, packageManager, installDeps, skipPackageManager });
   } catch (err) {
     rl?.close();
     console.error(color(COLORS.red, `\n  Failed: ${(err && err.message) || err}`));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-daloy",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
   "type": "module",
   "license": "MIT",

package/templates/bun-basic/README.md

@@ -0,0 +1,50 @@
+# my-daloy-bun-app
+
+A [DaloyJS](https://daloyjs.dev) starter for the [Bun](https://bun.sh) runtime.
+
+## Develop
+
+```bash
+bun install
+bun run dev          # http://localhost:3000
+```
+
+Try it:
+
+```bash
+curl http://localhost:3000/healthz
+<!-- daloy-minimal:strip-start books -->
+curl http://localhost:3000/books/1
+<!-- daloy-minimal:strip-end books -->
+```
+
+<!-- daloy-minimal:strip-start docs -->
+## API documentation
+
+- Swagger UI: <http://localhost:3000/docs>
+- OpenAPI 3.1 JSON: <http://localhost:3000/openapi.json>
+<!-- daloy-minimal:strip-end docs -->
+
+## Generate OpenAPI + typed client
+
+```bash
+bun run gen:openapi
+bun run gen:client
+```
+
+## Test
+
+```bash
+bun test
+```
+
+## What's included
+
+- `@daloyjs/core` with `secureHeaders`, `requestId`, and `rateLimit` enabled.
+<!-- daloy-minimal:strip-start books -->
+- A health route and contract-first `/books/:id` route with Zod validation.
+<!-- daloy-minimal:strip-end books -->
+- Hot reload via `bun --hot`.
+- Hey API codegen wired to `bun run gen:openapi` + `bun run gen:client`.
+
+Read the docs at <https://daloyjs.dev/docs>.

package/templates/bun-basic/_gitignore

@@ -0,0 +1,10 @@
+node_modules/
+dist/
+coverage/
+.DS_Store
+*.log
+.env
+.env.*
+!.env.example
+generated/
+bun.lockb

package/templates/bun-basic/_npmrc

@@ -0,0 +1,13 @@
+# DaloyJS supply-chain hardening defaults.
+#
+# These pnpm-specific defaults are kept here so users who switch this Bun
+# starter back to pnpm inherit the same secure-by-default install posture.
+# When you scaffold with `--package-manager bun` the CLI removes this file
+# so `bun install` does not warn about unsupported keys.
+
+auto-install-peers=true
+strict-peer-dependencies=true
+prefer-frozen-lockfile=true
+verify-store-integrity=true
+minimum-release-age=1440
+ignore-scripts=true

package/templates/bun-basic/openapi-ts.config.ts

@@ -0,0 +1,7 @@
+import { defineConfig } from "@hey-api/openapi-ts";
+
+export default defineConfig({
+  input: "./generated/openapi.json",
+  output: { path: "./generated/client" },
+  plugins: ["@hey-api/client-fetch", "@hey-api/typescript", "@hey-api/sdk"],
+});

package/templates/bun-basic/package.json

@@ -0,0 +1,27 @@
+{
+  "name": "my-daloy-bun-app",
+  "version": "0.0.1",
+  "private": true,
+  "type": "module",
+  "engines": {
+    "bun": ">=1.1.0"
+  },
+  "scripts": {
+    "dev": "bun --hot src/index.ts",
+    "start": "bun src/index.ts",
+    "typecheck": "tsc --noEmit",
+    "test": "bun test",
+    "gen:openapi": "bun run scripts/dump-openapi.ts",
+    "gen:client": "openapi-ts",
+    "gen": "pnpm gen:openapi && pnpm gen:client"
+  },
+  "dependencies": {
+    "@daloyjs/core": "^0.4.0",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@hey-api/openapi-ts": "^0.97.1",
+    "@types/bun": "^1.1.0",
+    "typescript": "^6.0.3"
+  }
+}

package/templates/bun-basic/scripts/dump-openapi.ts

@@ -0,0 +1,19 @@
+import { writeFile, mkdir } from "node:fs/promises";
+import { generateOpenAPI } from "@daloyjs/core/openapi";
+import { buildApp } from "../src/build-app.ts";
+
+async function main() {
+  const app = buildApp();
+  const doc = generateOpenAPI(app, {
+    info: { title: "My Daloy Bun API", version: "0.0.1" },
+    servers: [{ url: "http://localhost:3000" }],
+  });
+  await mkdir("generated", { recursive: true });
+  await writeFile("generated/openapi.json", JSON.stringify(doc, null, 2));
+  console.log("wrote generated/openapi.json");
+}
+
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});

package/templates/bun-basic/src/build-app.ts

@@ -0,0 +1,110 @@
+import { z } from "zod";
+import {
+  App,
+  NotFoundError,
+  rateLimit,
+  requestId,
+  secureHeaders,
+} from "@daloyjs/core";
+// daloy-minimal:strip-start docs
+import { generateOpenAPI } from "@daloyjs/core/openapi";
+import { htmlResponse, swaggerUiHtml } from "@daloyjs/core/docs";
+// daloy-minimal:strip-end docs
+
+/**
+ * Build the application as a pure factory so the same `App` is reused by
+ * `bun --hot src/index.ts`, `scripts/dump-openapi.ts`, and `bun test`
+ * without importing the `serve()` adapter (and accidentally booting the
+ * HTTP listener as a side effect).
+ */
+export function buildApp(): App {
+  const app = new App({
+    bodyLimitBytes: 1024 * 1024,
+    requestTimeoutMs: 5_000,
+    production: process.env.NODE_ENV === "production",
+  });
+
+  app.use(requestId());
+  app.use(secureHeaders());
+  app.use(rateLimit({ windowMs: 60_000, max: 120 }));
+
+  app.route({
+    method: "GET",
+    path: "/healthz",
+    operationId: "healthz",
+    tags: ["Ops"],
+    responses: {
+      200: {
+        description: "Service is healthy",
+        body: z.object({ ok: z.literal(true), runtime: z.literal("bun") }),
+      },
+    },
+    handler: async () => ({
+      status: 200,
+      body: { ok: true as const, runtime: "bun" as const },
+    }),
+  });
+
+  // daloy-minimal:strip-start books
+  const Book = z.object({ id: z.string(), title: z.string() });
+  const books = new Map<string, z.infer<typeof Book>>([
+    ["1", { id: "1", title: "Noli Me Tangere" }],
+    ["2", { id: "2", title: "El Filibusterismo" }],
+  ]);
+
+  app.route({
+    method: "GET",
+    path: "/books/:id",
+    operationId: "getBookById",
+    tags: ["Books"],
+    request: { params: z.object({ id: z.string() }) },
+    responses: {
+      200: { description: "Found", body: Book },
+      404: { description: "Not found" },
+    },
+    handler: async ({ params }) => {
+      const book = books.get(params.id);
+      if (!book) throw new NotFoundError(`Book ${params.id} not found`);
+      return { status: 200, body: book };
+    },
+  });
+  // daloy-minimal:strip-end books
+
+  // daloy-minimal:strip-start docs
+  app.route({
+    method: "GET",
+    path: "/openapi.json",
+    operationId: "getOpenAPI",
+    tags: ["Docs"],
+    responses: { 200: { description: "OpenAPI 3.1 document" } },
+    handler: async () => ({
+      status: 200 as const,
+      body: generateOpenAPI(app, {
+        info: { title: "My Daloy Bun API", version: "0.0.1" },
+        servers: [{ url: `http://localhost:${process.env.PORT ?? 3000}` }],
+      }),
+    }),
+  });
+
+  app.route({
+    method: "GET",
+    path: "/docs",
+    operationId: "docs",
+    tags: ["Docs"],
+    responses: { 200: { description: "API reference UI" } },
+    handler: async () => {
+      const html = swaggerUiHtml({ specUrl: "/openapi.json", title: "My Daloy Bun API" });
+      const res = htmlResponse(html);
+      return {
+        status: 200 as const,
+        body: html,
+        headers: Object.fromEntries(res.headers),
+      };
+    },
+  });
+  // daloy-minimal:strip-end docs
+
+  return app;
+}
+
+export default buildApp;

package/templates/bun-basic/src/index.ts

@@ -0,0 +1,15 @@
+import { serve } from "@daloyjs/core/bun";
+import { buildApp } from "./build-app.ts";
+
+const app = buildApp();
+const port = Number(process.env.PORT ?? 3000);
+
+serve(app, { port });
+console.log(`DaloyJS (Bun) listening on http://localhost:${port}`);
+// daloy-minimal:strip-start docs
+console.log(`  Swagger UI:   http://localhost:${port}/docs`);
+console.log(`  OpenAPI JSON: http://localhost:${port}/openapi.json`);
+// daloy-minimal:strip-end docs
+console.log(`  Health:       http://localhost:${port}/healthz`);
+
+export default app;

package/templates/bun-basic/tests/healthz.test.ts

@@ -0,0 +1,13 @@
+import { describe, expect, test } from "bun:test";
+import { buildApp } from "../src/build-app.ts";
+
+describe("buildApp", () => {
+  test("GET /healthz returns 200", async () => {
+    const app = buildApp();
+    const res = await app.request("/healthz");
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { ok: boolean; runtime: string };
+    expect(body.ok).toBe(true);
+    expect(body.runtime).toBe("bun");
+  });
+});

package/templates/bun-basic/tsconfig.json

@@ -0,0 +1,19 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "lib": ["ES2022"],
+    "types": ["bun-types"],
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "noEmit": true,
+    "allowImportingTsExtensions": true
+  },
+  "include": ["src/**/*", "tests/**/*", "scripts/**/*"]
+}

package/templates/cloudflare-worker/package.json

@@ -10,7 +10,7 @@
     "test": "node --import tsx --test tests/**/*.test.ts"
   },
   "dependencies": {
-    "@daloyjs/core": "^0.3.3",
+    "@daloyjs/core": "^0.4.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/cloudflare-worker/src/index.ts

@@ -11,6 +11,7 @@ const app = new App({
 app.use(requestId());
 app.use(secureHeaders());
 
+// daloy-minimal:strip-start books
 const Book = z.object({ id: z.string(), title: z.string() });
 const books = new Map<string, z.infer<typeof Book>>([
   ["1", { id: "1", title: "Noli Me Tangere" }],
@@ -32,5 +33,6 @@ app.route({
     return { status: 200, body: book };
   },
 });
+// daloy-minimal:strip-end books
 
 export default { fetch: toFetchHandler(app) };

package/templates/deno-basic/README.md

@@ -0,0 +1,53 @@
+# my-daloy-deno-app
+
+A [DaloyJS](https://daloyjs.dev) starter for the [Deno](https://deno.com) runtime.
+
+## Develop
+
+```bash
+deno task dev          # http://localhost:3000
+```
+
+Try it:
+
+```bash
+curl http://localhost:3000/healthz
+<!-- daloy-minimal:strip-start books -->
+curl http://localhost:3000/books/1
+<!-- daloy-minimal:strip-end books -->
+```
+
+<!-- daloy-minimal:strip-start docs -->
+## API documentation
+
+- Swagger UI: <http://localhost:3000/docs>
+- OpenAPI 3.1 JSON: <http://localhost:3000/openapi.json>
+<!-- daloy-minimal:strip-end docs -->
+
+## Generate the OpenAPI spec
+
+```bash
+deno task gen:openapi
+# → generated/openapi.json
+```
+
+To produce a typed SDK from that spec, run [@hey-api/openapi-ts](https://heyapi.dev)
+through `npx` or your favorite Node package manager — it does not yet ship a
+first-class Deno entry point.
+
+## Test
+
+```bash
+deno task test
+```
+
+## What's included
+
+- `@daloyjs/core` (loaded via `npm:` specifiers in `deno.json`).
+- `secureHeaders`, `requestId`, and `rateLimit` enabled by default.
+<!-- daloy-minimal:strip-start books -->
+- A health route and contract-first `/books/:id` route with Zod validation.
+<!-- daloy-minimal:strip-end books -->
+- Minimal permissions: `--allow-net --allow-env --allow-read` for `dev`.
+
+Read the docs at <https://daloyjs.dev/docs>.

package/templates/deno-basic/_gitignore

@@ -0,0 +1,7 @@
+node_modules/
+.DS_Store
+*.log
+.env
+.env.*
+!.env.example
+generated/

package/templates/deno-basic/deno.json

@@ -0,0 +1,22 @@
+{
+  "name": "my-daloy-deno-app",
+  "tasks": {
+    "dev": "deno run --allow-net --allow-env --allow-read --watch src/main.ts",
+    "start": "deno run --allow-net --allow-env --allow-read src/main.ts",
+    "typecheck": "deno check src/main.ts",
+    "test": "deno test --allow-net --allow-env tests/",
+    "gen:openapi": "deno run --allow-net --allow-env --allow-read --allow-write scripts/dump-openapi.ts"
+  },
+  "imports": {
+    "@daloyjs/core": "npm:@daloyjs/core@^0.4.0",
+    "@daloyjs/core/": "npm:@daloyjs/core@^0.4.0/",
+    "zod": "npm:zod@^4.4.3"
+  },
+  "compilerOptions": {
+    "strict": true,
+    "lib": ["deno.window", "deno.unstable"]
+  },
+  "fmt": {
+    "lineWidth": 100
+  }
+}

package/templates/deno-basic/scripts/dump-openapi.ts

@@ -0,0 +1,12 @@
+import { generateOpenAPI } from "@daloyjs/core/openapi";
+import { buildApp } from "../src/build-app.ts";
+
+const app = buildApp();
+const doc = generateOpenAPI(app, {
+  info: { title: "My Daloy Deno API", version: "0.0.1" },
+  servers: [{ url: "http://localhost:3000" }],
+});
+
+await Deno.mkdir("generated", { recursive: true });
+await Deno.writeTextFile("generated/openapi.json", JSON.stringify(doc, null, 2));
+console.log("wrote generated/openapi.json");

package/templates/deno-basic/src/build-app.ts

@@ -0,0 +1,111 @@
+import { z } from "zod";
+import {
+  App,
+  NotFoundError,
+  rateLimit,
+  requestId,
+  secureHeaders,
+} from "@daloyjs/core";
+// daloy-minimal:strip-start docs
+import { generateOpenAPI } from "@daloyjs/core/openapi";
+import { htmlResponse, swaggerUiHtml } from "@daloyjs/core/docs";
+// daloy-minimal:strip-end docs
+
+/**
+ * Build the application as a pure factory.
+ *
+ * Keeping this separate from `serve(app, ...)` lets `deno test` and the
+ * OpenAPI dump script reuse the same `App` without booting an HTTP listener
+ * as a side effect.
+ */
+export function buildApp(): App {
+  const app = new App({
+    bodyLimitBytes: 1024 * 1024,
+    requestTimeoutMs: 5_000,
+    production: Deno.env.get("DENO_ENV") === "production",
+  });
+
+  app.use(requestId());
+  app.use(secureHeaders());
+  app.use(rateLimit({ windowMs: 60_000, max: 120 }));
+
+  app.route({
+    method: "GET",
+    path: "/healthz",
+    operationId: "healthz",
+    tags: ["Ops"],
+    responses: {
+      200: {
+        description: "Service is healthy",
+        body: z.object({ ok: z.literal(true), runtime: z.literal("deno") }),
+      },
+    },
+    handler: async () => ({
+      status: 200,
+      body: { ok: true as const, runtime: "deno" as const },
+    }),
+  });
+
+  // daloy-minimal:strip-start books
+  const Book = z.object({ id: z.string(), title: z.string() });
+  const books = new Map<string, z.infer<typeof Book>>([
+    ["1", { id: "1", title: "Noli Me Tangere" }],
+    ["2", { id: "2", title: "El Filibusterismo" }],
+  ]);
+
+  app.route({
+    method: "GET",
+    path: "/books/:id",
+    operationId: "getBookById",
+    tags: ["Books"],
+    request: { params: z.object({ id: z.string() }) },
+    responses: {
+      200: { description: "Found", body: Book },
+      404: { description: "Not found" },
+    },
+    handler: async ({ params }) => {
+      const book = books.get(params.id);
+      if (!book) throw new NotFoundError(`Book ${params.id} not found`);
+      return { status: 200, body: book };
+    },
+  });
+  // daloy-minimal:strip-end books
+
+  // daloy-minimal:strip-start docs
+  app.route({
+    method: "GET",
+    path: "/openapi.json",
+    operationId: "getOpenAPI",
+    tags: ["Docs"],
+    responses: { 200: { description: "OpenAPI 3.1 document" } },
+    handler: async () => ({
+      status: 200 as const,
+      body: generateOpenAPI(app, {
+        info: { title: "My Daloy Deno API", version: "0.0.1" },
+        servers: [{ url: `http://localhost:${Deno.env.get("PORT") ?? "3000"}` }],
+      }),
+    }),
+  });
+
+  app.route({
+    method: "GET",
+    path: "/docs",
+    operationId: "docs",
+    tags: ["Docs"],
+    responses: { 200: { description: "API reference UI" } },
+    handler: async () => {
+      const html = swaggerUiHtml({ specUrl: "/openapi.json", title: "My Daloy Deno API" });
+      const res = htmlResponse(html);
+      return {
+        status: 200 as const,
+        body: html,
+        headers: Object.fromEntries(res.headers),
+      };
+    },
+  });
+  // daloy-minimal:strip-end docs
+
+  return app;
+}
+
+export default buildApp;

package/templates/deno-basic/src/main.ts

@@ -0,0 +1,13 @@
+import { serve } from "@daloyjs/core/deno";
+import { buildApp } from "./build-app.ts";
+
+const app = buildApp();
+const port = Number(Deno.env.get("PORT") ?? 3000);
+
+serve(app, { port });
+console.log(`DaloyJS (Deno) listening on http://localhost:${port}`);
+// daloy-minimal:strip-start docs
+console.log(`  Swagger UI:   http://localhost:${port}/docs`);
+console.log(`  OpenAPI JSON: http://localhost:${port}/openapi.json`);
+// daloy-minimal:strip-end docs
+console.log(`  Health:       http://localhost:${port}/healthz`);

package/templates/deno-basic/tests/healthz_test.ts

@@ -0,0 +1,11 @@
+import { assertEquals } from "jsr:@std/assert@^1.0.0";
+import { buildApp } from "../src/build-app.ts";
+
+Deno.test("GET /healthz returns 200", async () => {
+  const app = buildApp();
+  const res = await app.request("/healthz");
+  assertEquals(res.status, 200);
+  const body = (await res.json()) as { ok: boolean; runtime: string };
+  assertEquals(body.ok, true);
+  assertEquals(body.runtime, "deno");
+});

package/templates/node-basic/README.md

@@ -13,15 +13,19 @@ Try it:
 
 ```bash
 curl http://localhost:3000/healthz
+<!-- daloy-minimal:strip-start books -->
 curl http://localhost:3000/books/1
+<!-- daloy-minimal:strip-end books -->
 ```
 
+<!-- daloy-minimal:strip-start docs -->
 ## API documentation
 
 - Swagger UI: <http://localhost:3000/docs>
 - OpenAPI 3.1 JSON: <http://localhost:3000/openapi.json>
 
 The spec is generated live from your routes, so it stays in sync with what is actually deployed.
+<!-- daloy-minimal:strip-end docs -->
 
 ## Generate OpenAPI + typed client
 
@@ -41,7 +45,9 @@ node dist/index.js
 ## What's included
 
 - `@daloyjs/core` with `secureHeaders`, `requestId`, and `rateLimit` enabled.
+<!-- daloy-minimal:strip-start books -->
 - A health route and a contract-first `/books/:id` route with Zod validation.
+<!-- daloy-minimal:strip-end books -->
 - Hardened `.npmrc` for safer installs.
 - Hey API codegen wired to `pnpm gen`.
 

package/templates/node-basic/package.json

@@ -18,7 +18,7 @@
     "audit": "pnpm audit --prod"
   },
   "dependencies": {
-    "@daloyjs/core": "^0.3.3",
+    "@daloyjs/core": "^0.4.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/node-basic/src/build-app.ts

@@ -6,8 +6,10 @@ import {
   requestId,
   secureHeaders,
 } from "@daloyjs/core";
+// daloy-minimal:strip-start docs
 import { generateOpenAPI } from "@daloyjs/core/openapi";
 import { htmlResponse, swaggerUiHtml } from "@daloyjs/core/docs";
+// daloy-minimal:strip-end docs
 
 /**
  * Build the application as a pure factory.
@@ -45,6 +47,7 @@ export function buildApp(): App {
     }),
   });
 
+  // daloy-minimal:strip-start books
   const Book = z.object({ id: z.string(), title: z.string() });
   const books = new Map<string, z.infer<typeof Book>>([
     ["1", { id: "1", title: "Noli Me Tangere" }],
@@ -67,7 +70,9 @@ export function buildApp(): App {
       return { status: 200, body: book };
     },
   });
+  // daloy-minimal:strip-end books
 
+  // daloy-minimal:strip-start docs
   // --- API documentation ---------------------------------------------------
   // `/openapi.json` returns the live OpenAPI 3.1 spec generated from the
   // routes defined above. `/docs` serves a Swagger UI page that loads it.
@@ -103,6 +108,7 @@ export function buildApp(): App {
       };
     },
   });
+  // daloy-minimal:strip-end docs
 
   return app;
 }

package/templates/node-basic/src/index.ts

@@ -6,8 +6,10 @@ const port = Number(process.env.PORT ?? 3000);
 
 serve(app, { port });
 console.log(`DaloyJS listening on http://localhost:${port}`);
+// daloy-minimal:strip-start docs
 console.log(`  Swagger UI:   http://localhost:${port}/docs`);
 console.log(`  OpenAPI JSON: http://localhost:${port}/openapi.json`);
+// daloy-minimal:strip-end docs
 console.log(`  Health:       http://localhost:${port}/healthz`);
 
 export default app;

package/templates/vercel-edge/README.md

@@ -13,15 +13,19 @@ Try it:
 
 ```bash
 curl http://localhost:3000/healthz
+<!-- daloy-minimal:strip-start books -->
 curl http://localhost:3000/books/1
+<!-- daloy-minimal:strip-end books -->
 ```
 
+<!-- daloy-minimal:strip-start docs -->
 ## API documentation
 
 - Swagger UI: <http://localhost:3000/docs>
 - OpenAPI 3.1 JSON: <http://localhost:3000/openapi.json>
 
 After deploying, the same routes serve `/docs` and `/openapi.json` from your Vercel Edge URL.
+<!-- daloy-minimal:strip-end docs -->
 
 ## Deploy
 

package/templates/vercel-edge/api/[...path].ts

@@ -1,8 +1,10 @@
 import { z } from "zod";
 import { App, NotFoundError, requestId, secureHeaders } from "@daloyjs/core";
 import { toEdgeHandler } from "@daloyjs/core/vercel";
+// daloy-minimal:strip-start docs
 import { generateOpenAPI } from "@daloyjs/core/openapi";
 import { htmlResponse, swaggerUiHtml } from "@daloyjs/core/docs";
+// daloy-minimal:strip-end docs
 
 export const config = { runtime: "edge" };
 
@@ -32,6 +34,7 @@ app.route({
   }),
 });
 
+// daloy-minimal:strip-start books
 const Book = z.object({ id: z.string(), title: z.string() });
 const books = new Map<string, z.infer<typeof Book>>([
   ["1", { id: "1", title: "Noli Me Tangere" }],
@@ -53,7 +56,9 @@ app.route({
     return { status: 200, body: book };
   },
 });
+// daloy-minimal:strip-end books
 
+// daloy-minimal:strip-start docs
 // --- API documentation -----------------------------------------------------
 // `/openapi.json` returns the OpenAPI 3.1 spec generated from the routes above.
 // `/docs` serves a Swagger UI page that loads that spec.
@@ -88,5 +93,6 @@ app.route({
     };
   },
 });
+// daloy-minimal:strip-end docs
 
 export default toEdgeHandler(app);

package/templates/vercel-edge/package.json

@@ -10,7 +10,7 @@
     "test": "node --import tsx --test tests/**/*.test.ts"
   },
   "dependencies": {
-    "@daloyjs/core": "^0.3.3",
+    "@daloyjs/core": "^0.4.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {