create-daloy 0.1.7 → 0.1.10

package/README.md

@@ -52,7 +52,7 @@ A production-ready Node.js HTTP server using `@daloyjs/core` with:
 
 - Strict TypeScript and `tsx` for instant dev runs.
 - Hardened `.npmrc` for safer installs.
-- `secureHeaders`, `requestId`, and `rateLimit` enabled by default.
+- `secureHeaders`, `requestId`, and `rateLimit` enabled by default (`rateLimit` is global until you configure `keyGenerator` or trusted proxy headers).
 - A sample `GET /healthz` and contract-first `GET /books/:id` route with Zod validation.
 - `pnpm gen` wired to emit OpenAPI 3.1 + a typed Hey API client.
 
@@ -79,4 +79,5 @@ A Vercel Edge API bootstrap using `@daloyjs/core/vercel` with:
 - Templates are copied verbatim from this package's `templates/` directory.
 - Files prefixed with `_` are renamed (`_gitignore` → `.gitignore`, `_npmrc` → `.npmrc`) to survive npm packing.
 - pnpm-specific `.npmrc` hardening is kept only when you choose `pnpm`; other package managers get a clean project without unsupported config warnings.
+- pnpm projects ship with `ignore-scripts=true`, `minimum-release-age=1440`, `verify-store-integrity=true`, `prefer-frozen-lockfile=true`, and `strict-peer-dependencies=true` by default.
 - The CLI never executes template scripts and never makes network calls beyond the package manager you select.

package/bin/create-daloy.mjs

@@ -185,15 +185,70 @@ async function copyTemplate(src, dest) {
   }
 }
 
-async function patchPackageJson(dir, projectName) {
+async function patchPackageJson(dir, projectName, packageManager) {
   const file = path.join(dir, "package.json");
   if (!existsSync(file)) return;
   const raw = await readFile(file, "utf8");
   const json = JSON.parse(raw);
   json.name = projectName.startsWith("@") ? projectName : projectName.toLowerCase();
+  if (json.scripts && packageManager && packageManager !== "pnpm") {
+    json.scripts = rewriteScriptsForPackageManager(json.scripts, packageManager);
+  }
   await writeFile(file, JSON.stringify(json, null, 2) + "\n", "utf8");
 }
 
+async function patchReadme(dir, packageManager) {
+  if (packageManager === "pnpm") return;
+  const file = path.join(dir, "README.md");
+  if (!existsSync(file)) return;
+  const raw = await readFile(file, "utf8");
+  const next = raw
+    .replace(/\bpnpm install\b/g, `${packageManager} install`)
+    .replace(/\bpnpm dev\b/g, `${packageManager} run dev`)
+    .replace(/\bpnpm gen\b/g, `${packageManager} run gen`)
+    .replace(/\bpnpm build\b/g, `${packageManager} run build`)
+    .replace(
+      "- Hardened `.npmrc` for safer installs.",
+      `- Package-manager scripts adjusted for ${packageManager}.`,
+    )
+    .replace(
+      "- Hey API codegen wired to `pnpm gen`.",
+      `- Hey API codegen wired to \`${packageManager} run gen\`.`,
+    );
+  await writeFile(file, next, "utf8");
+}
+
+/**
+ * Rewrite scaffolded package.json scripts so they work under the user's
+ * chosen package manager. Templates are authored with `pnpm` because that
+ * is the recommended manager, but `pnpm <subscript>` and `pnpm audit` will
+ * fail under npm/yarn/bun. We rewrite both forms to the equivalent that
+ * the chosen manager understands.
+ */
+function rewriteScriptsForPackageManager(scripts, pm) {
+  // `pnpm audit` → `<pm> audit`. yarn/bun also expose an `audit` command;
+  // npm of course does too. Keep flags intact.
+  // `pnpm <subscript>` (where subscript is another script in the same
+  // package.json) → `<pm> run <subscript>` so cross-script chains work
+  // everywhere. Both yarn and bun also accept `<pm> run <name>`.
+  const out = {};
+  const subscriptNames = new Set(Object.keys(scripts));
+  for (const [name, command] of Object.entries(scripts)) {
+    if (typeof command !== "string") {
+      out[name] = command;
+      continue;
+    }
+    let next = command.replace(/\bpnpm\s+audit\b/g, `${pm} audit`);
+    next = next.replace(/\bpnpm\s+([a-zA-Z0-9_:-]+)/g, (match, sub) => {
+      if (sub === "audit") return match; // already handled above
+      if (!subscriptNames.has(sub)) return match;
+      return `${pm} run ${sub}`;
+    });
+    out[name] = next;
+  }
+  return out;
+}
+
 async function normalizePackageManagerFiles(dir, packageManager) {
   if (packageManager === "pnpm") return;
   const npmrcPath = path.join(dir, ".npmrc");
@@ -387,8 +442,9 @@ async function main() {
     await mkdir(targetDir, { recursive: true });
     await copyTemplate(templateDir, targetDir);
     logStep("Template copied", template);
-    await patchPackageJson(targetDir, projectName);
+    await patchPackageJson(targetDir, projectName, packageManager);
     logStep("Package metadata written", projectName);
+    await patchReadme(targetDir, packageManager);
     await normalizePackageManagerFiles(targetDir, packageManager);
     if (packageManager !== "pnpm") {
       logStep("Package-manager config normalized", packageManager);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-daloy",
-  "version": "0.1.7",
+  "version": "0.1.10",
   "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
   "type": "module",
   "license": "MIT",
@@ -43,4 +43,4 @@
   "scripts": {
     "test": "node --test test/**/*.test.mjs"
   }
-}
+}

package/templates/cloudflare-worker/_npmrc

@@ -1,4 +1,16 @@
+# DaloyJS supply-chain hardening defaults — see the "Supply chain" docs.
+
 auto-install-peers=true
 strict-peer-dependencies=true
 prefer-frozen-lockfile=true
 verify-store-integrity=true
+
+# 24h cooldown on freshly published versions. Drops you off the hot path
+# of npm worm campaigns, which are typically detected and unpublished
+# within hours.
+minimum-release-age=1440
+
+# Block postinstall/preinstall/prepare hooks from transitive deps —
+# the primary execution channel for chalk/debug, node-ipc, Shai-Hulud.
+# Allowlist trusted builds via package.json `pnpm.onlyBuiltDependencies`.
+ignore-scripts=true

package/templates/cloudflare-worker/package.json

@@ -10,7 +10,7 @@
     "test": "node --import tsx --test tests/**/*.test.ts"
   },
   "dependencies": {
-    "@daloyjs/core": "^0.1.0",
+    "@daloyjs/core": "^0.2.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/node-basic/_npmrc

@@ -1,7 +1,21 @@
+# DaloyJS supply-chain hardening defaults.
+#
+# See the DaloyJS "Supply chain" docs and the 2026-05-11 TanStack incident
+# postmortem (https://tanstack.com/blog/npm-supply-chain-compromise-postmortem)
+# for context on why every line below is on by default.
+
 auto-install-peers=true
 strict-peer-dependencies=true
 prefer-frozen-lockfile=true
 verify-store-integrity=true
-# Optional, pnpm 10+:
-# minimum-release-age=1440
-# ignore-scripts=true
+
+# Wait 24h before resolving a freshly published version. Most npm worm
+# campaigns are detected and unpublished within hours; this window keeps
+# you off the early-installer hot path. Set to 0 only for a real hotfix.
+minimum-release-age=1440
+
+# postinstall / preinstall / prepare hooks from transitive deps are the
+# main execution channel used by chalk/debug, node-ipc, and Shai-Hulud
+# malware. Allowlist the few packages you actually trust to build via
+# package.json `pnpm.onlyBuiltDependencies` instead of turning this off.
+ignore-scripts=true

package/templates/node-basic/package.json

@@ -18,7 +18,7 @@
     "audit": "pnpm audit --prod"
   },
   "dependencies": {
-    "@daloyjs/core": "^0.1.0",
+    "@daloyjs/core": "^0.2.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/node-basic/scripts/dump-openapi.ts

@@ -1,12 +1,13 @@
 import { writeFile, mkdir } from "node:fs/promises";
 import { generateOpenAPI } from "@daloyjs/core/openapi";
-import { App } from "@daloyjs/core";
+import { buildApp } from "../src/build-app.js";
 
-// Re-import the app definition, then write the spec.
-// Keep this script deterministic so codegen output is stable in CI.
+// Build a fresh app from the factory so the spec dump never starts the HTTP
+// listener as a side effect. Keep this script deterministic so codegen output
+// is stable in CI.
 
 async function main() {
-  const { default: app } = (await import("../src/index.js")) as { default: App };
+  const app = buildApp();
   const doc = generateOpenAPI(app, {
     info: { title: "My Daloy API", version: "0.0.1" },
     servers: [{ url: "http://localhost:3000" }],

package/templates/node-basic/src/build-app.ts

@@ -0,0 +1,110 @@
+import { z } from "zod";
+import {
+  App,
+  NotFoundError,
+  rateLimit,
+  requestId,
+  secureHeaders,
+} from "@daloyjs/core";
+import { generateOpenAPI } from "@daloyjs/core/openapi";
+import { htmlResponse, swaggerUiHtml } from "@daloyjs/core/docs";
+
+/**
+ * Build the application as a pure factory.
+ *
+ * Keeping construction separate from `serve(app, ...)` lets tooling
+ * (`scripts/dump-openapi.ts`, contract tests, in-process tests via
+ * `app.request(...)`) import and reuse the app without booting an
+ * HTTP listener as a side effect.
+ */
+export function buildApp(): App {
+  const app = new App({
+    bodyLimitBytes: 1024 * 1024,
+    requestTimeoutMs: 5_000,
+    production: process.env.NODE_ENV === "production",
+  });
+
+  app.use(requestId());
+  app.use(secureHeaders());
+  app.use(rateLimit({ windowMs: 60_000, max: 120 }));
+
+  app.route({
+    method: "GET",
+    path: "/healthz",
+    operationId: "healthz",
+    tags: ["Ops"],
+    responses: {
+      200: {
+        description: "Service is healthy",
+        body: z.object({ ok: z.literal(true), uptime: z.number() }),
+      },
+    },
+    handler: async () => ({
+      status: 200,
+      body: { ok: true as const, uptime: process.uptime() },
+    }),
+  });
+
+  const Book = z.object({ id: z.string(), title: z.string() });
+  const books = new Map<string, z.infer<typeof Book>>([
+    ["1", { id: "1", title: "Noli Me Tangere" }],
+    ["2", { id: "2", title: "El Filibusterismo" }],
+  ]);
+
+  app.route({
+    method: "GET",
+    path: "/books/:id",
+    operationId: "getBookById",
+    tags: ["Books"],
+    request: { params: z.object({ id: z.string() }) },
+    responses: {
+      200: { description: "Found", body: Book },
+      404: { description: "Not found" },
+    },
+    handler: async ({ params }) => {
+      const book = books.get(params.id);
+      if (!book) throw new NotFoundError(`Book ${params.id} not found`);
+      return { status: 200, body: book };
+    },
+  });
+
+  // --- API documentation ---------------------------------------------------
+  // `/openapi.json` returns the live OpenAPI 3.1 spec generated from the
+  // routes defined above. `/docs` serves a Swagger UI page that loads it.
+
+  app.route({
+    method: "GET",
+    path: "/openapi.json",
+    operationId: "getOpenAPI",
+    tags: ["Docs"],
+    responses: { 200: { description: "OpenAPI 3.1 document" } },
+    handler: async () => ({
+      status: 200 as const,
+      body: generateOpenAPI(app, {
+        info: { title: "My Daloy API", version: "0.0.1" },
+        servers: [{ url: `http://localhost:${process.env.PORT ?? 3000}` }],
+      }),
+    }),
+  });
+
+  app.route({
+    method: "GET",
+    path: "/docs",
+    operationId: "docs",
+    tags: ["Docs"],
+    responses: { 200: { description: "API reference UI" } },
+    handler: async () => {
+      const html = swaggerUiHtml({ specUrl: "/openapi.json", title: "My Daloy API" });
+      const res = htmlResponse(html);
+      return {
+        status: 200 as const,
+        body: html,
+        headers: Object.fromEntries(res.headers),
+      };
+    },
+  });
+
+  return app;
+}
+
+export default buildApp;

package/templates/node-basic/src/index.ts

@@ -1,105 +1,13 @@
-import { z } from "zod";
-import {
-  App,
-  NotFoundError,
-  rateLimit,
-  requestId,
-  secureHeaders,
-} from "@daloyjs/core";
 import { serve } from "@daloyjs/core/node";
-import { generateOpenAPI } from "@daloyjs/core/openapi";
-import { htmlResponse, swaggerUiHtml } from "@daloyjs/core/docs";
-
-const app = new App({
-  bodyLimitBytes: 1024 * 1024,
-  requestTimeoutMs: 5_000,
-  production: process.env.NODE_ENV === "production",
-});
-
-app.use(requestId());
-app.use(secureHeaders());
-app.use(rateLimit({ windowMs: 60_000, max: 120 }));
-
-app.route({
-  method: "GET",
-  path: "/healthz",
-  operationId: "healthz",
-  tags: ["Ops"],
-  responses: {
-    200: {
-      description: "Service is healthy",
-      body: z.object({ ok: z.literal(true), uptime: z.number() }),
-    },
-  },
-  handler: async () => ({
-    status: 200,
-    body: { ok: true as const, uptime: process.uptime() },
-  }),
-});
-
-const Book = z.object({ id: z.string(), title: z.string() });
-const books = new Map<string, z.infer<typeof Book>>([
-  ["1", { id: "1", title: "Noli Me Tangere" }],
-  ["2", { id: "2", title: "El Filibusterismo" }],
-]);
-
-app.route({
-  method: "GET",
-  path: "/books/:id",
-  operationId: "getBookById",
-  tags: ["Books"],
-  request: { params: z.object({ id: z.string() }) },
-  responses: {
-    200: { description: "Found", body: Book },
-    404: { description: "Not found" },
-  },
-  handler: async ({ params }) => {
-    const book = books.get(params.id);
-    if (!book) throw new NotFoundError(`Book ${params.id} not found`);
-    return { status: 200, body: book };
-  },
-});
+import { buildApp } from "./build-app.js";
 
+const app = buildApp();
 const port = Number(process.env.PORT ?? 3000);
 
-// --- API documentation -----------------------------------------------------
-// `/openapi.json` returns the live OpenAPI 3.1 spec generated from the routes
-// defined above. `/docs` serves a Swagger UI page that loads that spec.
-
-app.route({
-  method: "GET",
-  path: "/openapi.json",
-  operationId: "getOpenAPI",
-  tags: ["Docs"],
-  responses: { 200: { description: "OpenAPI 3.1 document" } },
-  handler: async () => ({
-    status: 200 as const,
-    body: generateOpenAPI(app, {
-      info: { title: "My Daloy API", version: "0.0.1" },
-      servers: [{ url: `http://localhost:${port}` }],
-    }),
-  }),
-});
-
-app.route({
-  method: "GET",
-  path: "/docs",
-  operationId: "docs",
-  tags: ["Docs"],
-  responses: { 200: { description: "API reference UI" } },
-  handler: async () => {
-    const html = swaggerUiHtml({ specUrl: "/openapi.json", title: "My Daloy API" });
-    const res = htmlResponse(html);
-    return {
-      status: 200 as const,
-      body: html,
-      headers: Object.fromEntries(res.headers),
-    };
-  },
-});
-
 serve(app, { port });
 console.log(`DaloyJS listening on http://localhost:${port}`);
-console.log(`  Swagger UI:  http://localhost:${port}/docs`);
+console.log(`  Swagger UI:   http://localhost:${port}/docs`);
 console.log(`  OpenAPI JSON: http://localhost:${port}/openapi.json`);
 console.log(`  Health:       http://localhost:${port}/healthz`);
+
+export default app;

package/templates/vercel-edge/_npmrc

@@ -1,4 +1,16 @@
+# DaloyJS supply-chain hardening defaults — see the "Supply chain" docs.
+
 auto-install-peers=true
 strict-peer-dependencies=true
 prefer-frozen-lockfile=true
 verify-store-integrity=true
+
+# 24h cooldown on freshly published versions. Drops you off the hot path
+# of npm worm campaigns, which are typically detected and unpublished
+# within hours.
+minimum-release-age=1440
+
+# Block postinstall/preinstall/prepare hooks from transitive deps —
+# the primary execution channel for chalk/debug, node-ipc, Shai-Hulud.
+# Allowlist trusted builds via package.json `pnpm.onlyBuiltDependencies`.
+ignore-scripts=true

package/templates/vercel-edge/package.json

@@ -10,7 +10,7 @@
     "test": "node --import tsx --test tests/**/*.test.ts"
   },
   "dependencies": {
-    "@daloyjs/core": "^0.1.1",
+    "@daloyjs/core": "^0.2.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {