create-daloy 0.1.17 → 0.1.19

package/README.md

@@ -19,6 +19,11 @@ The CLI is interactive when arguments are missing. It will ask you for:
 - Whether to install dependencies
 - Whether to initialize a git repository
 
+Interactive runs use a polished terminal UI with a DaloyJS welcome banner,
+arrow-key template and package-manager pickers, progress indicators, and a
+boxed completion summary. Non-TTY environments and `--yes` mode keep a plain,
+script-friendly transcript with the same decisions and next steps.
+
 ## Non-interactive usage
 
 ```bash
@@ -63,6 +68,7 @@ A production-ready Node.js HTTP server using `@daloyjs/core` with:
 A minimal Cloudflare Worker bootstrap using `@daloyjs/core/cloudflare` with:
 
 - `wrangler.toml` ready to deploy.
+- `secureHeaders` and `requestId` enabled by default, with smaller edge-friendly body and timeout limits.
 - Zod-validated route exposed as `fetch`.
 - A sample test that exercises `app.request(...)`.
 
@@ -73,6 +79,7 @@ A Vercel Edge API bootstrap using `@daloyjs/core/vercel` with:
 - `api/[...path].ts` catch-all routing so DaloyJS owns the API surface.
 - `export const config = { runtime: "edge" }` ready for Vercel Edge.
 - `vercel dev` / `vercel deploy` scripts.
+- `secureHeaders` and `requestId` enabled by default, with smaller edge-friendly body and timeout limits.
 - A health route and bookstore route mirroring the Node starter.
 
 ### `bun-basic`
@@ -81,7 +88,7 @@ A [Bun](https://bun.sh) runtime starter using `@daloyjs/core/bun` with:
 
 - `bun --hot src/index.ts` for instant reloads.
 - `bun test` wired to in-process `app.request(...)` checks.
-- The same secure defaults (`secureHeaders`, `requestId`, `rateLimit`).
+- The same starter security middleware as the Node template (`secureHeaders`, `requestId`, `rateLimit`).
 - A health route and contract-first `/books/:id` route with Zod validation.
 - Hey API codegen wired to `bun run gen:openapi` + `bun run gen:client`.
 
@@ -92,6 +99,7 @@ A [Deno](https://deno.com) runtime starter using `@daloyjs/core/deno` with:
 - A `deno.json` with `deno task dev`, `test`, and `gen:openapi` tasks.
 - `@daloyjs/core` and Zod loaded via `npm:` import-map specifiers.
 - Minimum-permissions dev script (`--allow-net --allow-env --allow-read`).
+- The same starter security middleware as the Node template (`secureHeaders`, `requestId`, `rateLimit`).
 - A health route and contract-first `/books/:id` route with Zod validation.
 - The CLI skips Node-style installs for this template (no `package.json`).
 
@@ -113,17 +121,18 @@ re-run with `--minimal`, or delete the marked blocks by hand later.
 ## What the CLI guarantees
 
 - Zero runtime dependencies (uses only Node built-ins) for a clean supply-chain footprint.
+- A modern terminal experience with Unicode/color capability detection and ASCII fallbacks.
 - Templates are copied verbatim from this package's `templates/` directory.
-- Files prefixed with `_` are renamed (`_gitignore` → `.gitignore`, `_npmrc` → `.npmrc`) to survive npm packing.
+- Files and folders prefixed with `_` are renamed on copy (`_gitignore` → `.gitignore`, `_npmrc` → `.npmrc`, `_agents/` → `.agents/`) to survive npm packing.
 - pnpm-specific `.npmrc` hardening is kept only when you choose `pnpm`; other package managers get a clean project without unsupported config warnings.
 - pnpm projects ship with `ignore-scripts=true`, `minimum-release-age=1440`, `verify-store-integrity=true`, `prefer-frozen-lockfile=true`, and `strict-peer-dependencies=true` by default.
 - The CLI never executes template scripts and never makes network calls beyond the package manager you select.
 
 ## AI agent helper files
 
-Every scaffolded project ships with two files at the repo root that help AI coding agents (Copilot, Claude Code, Cursor, Codex, etc.) understand and work in your project:
+Every scaffolded project ships with two files that help AI coding agents (Copilot, Claude Code, Cursor, Codex, etc.) understand and work in your project:
 
-- `AGENTS.md` — a small, top-of-context file (per the open [AGENTS.md](https://agents.md) convention): one-line project description, package manager / runtime, and the few commands an agent needs. It points to `SKILL.md` for the rest.
-- `SKILL.md` — operational guidance for AI agents: when to use the skill, project structure, core workflows (adding routes, regenerating the OpenAPI spec and client), decision rules, and pitfalls to avoid.
+- `AGENTS.md` (repo root) — a small, top-of-context file (per the open [AGENTS.md](https://agents.md) convention): one-line project description, package manager / runtime, project shape, core rules, and the few commands an agent needs. It links to the full skill below.
+- `.agents/skills/daloyjs-best-practices/SKILL.md` — comprehensive operational guidance following the open `agents/skills/<skill-name>/SKILL.md` convention: when to use the skill, project structure, core workflows (adding routes, regenerating the OpenAPI spec and client), schema and validation conventions, error-handling patterns, middleware order, testing best practices (happy and unhappy paths), security best practices, logging and observability notes, configuration and secrets handling, deployment notes, pitfalls and guardrails, and process expectations.
 
 Both files are tailored to the chosen template (Node, Bun, Deno, Vercel Edge, or Cloudflare Workers), and Node-style templates rewrite their commands to match your selected package manager. They follow the "instruction budget" advice — small root file, progressive disclosure for the rest — so they don't waste agent tokens. Edit or delete them freely; the framework does not depend on them at runtime.