create-daloy 0.26.0 → 0.34.1

package/templates/node-basic/_Dockerfile

@@ -1,19 +1,31 @@
 # syntax=docker/dockerfile:1.7
-# Container-first defaults for a DaloyJS app (Wave 6 item 4).
+# Container-first defaults for a DaloyJS app.
 #
 # Hardening shipped out of the box:
 #   - Non-root runtime user (uid 1001).
 #   - Read-only root filesystem at runtime (use `--read-only` or set
 #     `readOnlyRootFilesystem: true` in your orchestrator).
 #   - `STOPSIGNAL SIGTERM` so the framework's graceful-shutdown drain
-#     (Wave 4) fires on container stop.
-#   - `HEALTHCHECK` wired to `app.healthcheck()` / `app.readinesscheck()`
-#     (mount the routes via `app.healthcheck()` / `app.readinesscheck()`).
+#     fires on container stop.
+#   - `HEALTHCHECK` wired to the `/healthz` route registered in
+#     `src/build-app.ts`.
 #   - `tini` as PID 1 for proper signal forwarding and zombie reaping.
+#   - Minimal runner surface: no `curl` / no extra OS packages. The
+#     healthcheck uses BusyBox `wget` already in `node:*-alpine`.
+#   - Base image is consumed through the `NODE_IMAGE` ARG so you can
+#     pin to an immutable digest (recommended for production):
+#       docker build --build-arg \
+#         NODE_IMAGE=node:24-alpine@sha256:<digest> .
+#     Dependabot's `docker` ecosystem (see `.github/dependabot.yml`)
+#     keeps the digest fresh. The companion `container-scan.yml`
+#     workflow lints this file with hadolint and scans the built
+#     image with Trivy on every PR.
 
-ARG NODE_VERSION=24-alpine
+# Override at build time to pin a specific digest:
+#   NODE_IMAGE=node:24-alpine@sha256:<digest>
+ARG NODE_IMAGE=node:24-alpine
 
-FROM node:${NODE_VERSION} AS builder
+FROM ${NODE_IMAGE} AS builder
 WORKDIR /app
 COPY package.json pnpm-lock.yaml* ./
 RUN corepack enable && corepack prepare pnpm@latest --activate && \
@@ -21,11 +33,12 @@ RUN corepack enable && corepack prepare pnpm@latest --activate && \
 COPY . .
 RUN pnpm build
 
-FROM node:${NODE_VERSION} AS runner
+FROM ${NODE_IMAGE} AS runner
 WORKDIR /app
 ENV NODE_ENV=production
-# tini for clean signal handling at PID 1.
-RUN apk add --no-cache tini curl && \
+# tini only — no curl, no extra packages. BusyBox `wget` (already in
+# alpine) is enough for the HEALTHCHECK below.
+RUN apk add --no-cache tini && \
     addgroup -S app -g 1001 && \
     adduser -S app -G app -u 1001
 COPY --from=builder --chown=app:app /app/dist ./dist
@@ -35,6 +48,6 @@ USER app
 EXPOSE 3000
 STOPSIGNAL SIGTERM
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
-  CMD curl -fsS http://127.0.0.1:3000/readyz || exit 1
+  CMD wget -q -O /dev/null --spider http://127.0.0.1:3000/healthz || exit 1
 ENTRYPOINT ["/sbin/tini", "--"]
 CMD ["node", "dist/index.js"]

package/templates/node-basic/_dockerignore

@@ -1,4 +1,5 @@
 node_modules
+.pnpm-store/
 dist
 coverage
 .git

package/templates/node-basic/package.json

@@ -18,7 +18,7 @@
     "audit": "pnpm audit --prod"
   },
   "dependencies": {
-    "@daloyjs/core": "^0.32.0",
+    "@daloyjs/core": "^0.34.1",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/vercel-edge/AGENTS.md

@@ -19,6 +19,16 @@ A [DaloyJS](https://daloyjs.dev) REST API deployed to **Vercel Edge**. **Contrac
 - `vercel.json` — Vercel build/runtime configuration.
 - `tests/` — test files.
 
+## Imports
+
+This project uses TypeScript with `"module": "NodeNext"` (ESM). Relative imports **must include a `.js` extension**, even when the source file is `.ts`:
+
+```ts
+import handler from "../api/[...path].js"; // resolves to the .ts source at typecheck, .js at runtime
+```
+
+This is the official Node.js ESM convention — TypeScript rewrites the specifier during typecheck, and the deployed output really is `.js`. Bare-specifier imports from packages (`@daloyjs/core`, `zod`, …) do not need an extension.
+
 ## Core rules
 
 1. The route definition is the contract. Method, path, request schemas, and response schemas live in one place — `app.route({...})`.

package/templates/vercel-edge/README.md

@@ -57,6 +57,16 @@ export default toFetchHandler(app);
 
 That catch-all API route lets DaloyJS own routing while Vercel handles the runtime.
 
+## Imports
+
+This project uses TypeScript with `"module": "NodeNext"` (ESM). Relative imports must include a `.js` extension, even when the source file is `.ts`:
+
+```ts
+import handler from "../api/[...path].js"; // ../api/[...path].ts on disk
+```
+
+TypeScript resolves the `.js` specifier to the matching `.ts` file at typecheck, and the deployed output really is `.js`. This is the official Node ESM convention — not a typo.
+
 ## What's included
 
 - `@daloyjs/core/vercel` with starter security middleware: `secureHeaders` and `requestId`.

package/templates/vercel-edge/_Dockerfile

@@ -0,0 +1,55 @@
+# syntax=docker/dockerfile:1.7
+# Containerized local-dev / CI environment for a DaloyJS Vercel Edge API.
+#
+# Production deploys go through `vercel deploy` to Vercel's managed
+# Edge runtime — **this Dockerfile is not a production runtime**. Ship
+# the function to Vercel; use this image for:
+#   - Reproducible local dev (devcontainers, GitHub Codespaces).
+#   - CI smoke tests that exercise the handler against `vercel dev`
+#     without installing Node/pnpm on the runner.
+#   - Self-hosted review apps when migrating to the `node-basic`
+#     template later.
+#
+# Hardening shipped out of the box:
+#   - Non-root runtime user (uid 1001).
+#   - Read-only-root-filesystem friendly: writes are confined to the
+#     working dir; mount `/tmp` as tmpfs (`--read-only --tmpfs /tmp`).
+#   - `STOPSIGNAL SIGTERM` so `vercel dev` exits cleanly.
+#   - Minimal runner surface: no `curl`, no extra OS packages.
+#     BusyBox `wget` powers the HEALTHCHECK.
+#   - `tini` as PID 1 for proper signal forwarding and zombie reaping
+#     (important because `vercel dev` spawns child processes).
+#   - `pnpm install --frozen-lockfile --ignore-scripts` matches the
+#     supply-chain defaults in `.npmrc` (no lifecycle scripts run).
+#   - Base image is consumed through the `NODE_IMAGE` ARG so builds
+#     can pin to an immutable digest:
+#       docker build --build-arg \
+#         NODE_IMAGE=node:24-alpine@sha256:<digest> .
+
+# Override at build time to pin a specific digest.
+ARG NODE_IMAGE=node:24-alpine
+
+FROM ${NODE_IMAGE} AS builder
+WORKDIR /app
+COPY package.json pnpm-lock.yaml* ./
+RUN corepack enable && corepack prepare pnpm@latest --activate && \
+    pnpm install --frozen-lockfile --ignore-scripts
+COPY . .
+
+FROM ${NODE_IMAGE} AS runner
+WORKDIR /app
+ENV NODE_ENV=development
+# tini only — no curl, no extra packages.
+RUN apk add --no-cache tini && \
+    addgroup -S app -g 1001 && \
+  adduser -S app -G app -u 1001
+COPY --from=builder --chown=app:app /app /app
+USER app
+EXPOSE 3000
+STOPSIGNAL SIGTERM
+HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
+  CMD wget -q -O /dev/null --spider http://127.0.0.1:3000/healthz || exit 1
+ENTRYPOINT ["/sbin/tini", "--"]
+# `vercel dev` binds the dev server. Listen on all interfaces so the
+# container is reachable from the host network.
+CMD ["./node_modules/.bin/vercel", "dev", "--listen", "0.0.0.0:3000"]

package/templates/vercel-edge/_dockerignore

@@ -0,0 +1,14 @@
+node_modules
+.pnpm-store/
+.vercel
+dist
+coverage
+.git
+.github
+.vscode
+*.log
+.env
+.env.*
+!.env.example
+generated
+otherdocs

package/templates/vercel-edge/package.json

@@ -10,7 +10,7 @@
     "test": "node --import tsx/esm --test tests/**/*.test.ts"
   },
   "dependencies": {
-    "@daloyjs/core": "^0.32.0",
+    "@daloyjs/core": "^0.34.1",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/_ci/node/_github/workflows/release.yml

@@ -1,125 +0,0 @@
-# Hardened npm publish skeleton generated by create-daloy --with-ci.
-#
-# Publishing is disabled until you set the repository variable
-# NPM_PUBLISH_ENABLED=true, remove "private": true from package.json, and
-# configure npm trusted publishing for this repository/environment.
-name: Publish
-
-on:
-  push:
-    tags:
-      - "v*"
-  workflow_dispatch:
-
-permissions: {}
-
-concurrency:
-  group: publish-${{ github.ref }}
-  cancel-in-progress: false
-
-jobs:
-  verify:
-    name: Verify before publish
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    permissions:
-      contents: read
-    steps:
-      - name: Harden runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2
-        with:
-          egress-policy: audit
-          disable-sudo: true
-
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-        with:
-          persist-credentials: false
-          show-progress: false
-
-__SETUP_PACKAGE_MANAGER_STEP__
-
-      - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
-        with:
-          node-version: 24
-
-__SETUP_BUN_RUNTIME_STEP__
-
-      - name: Install dependencies
-        run: __INSTALL_COMMAND__
-        env:
-          npm_config_ignore_scripts: "true"
-
-      - name: Verify lockfile sources
-        run: __VERIFY_LOCKFILE_COMMAND__
-
-      - name: Typecheck
-        run: __TYPECHECK_COMMAND__
-
-      - name: Test
-        run: __TEST_COMMAND__
-
-__BUILD_STEP__
-
-  publish-npm:
-    name: Publish npm package
-    needs: verify
-    if: vars.NPM_PUBLISH_ENABLED == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    environment:
-      name: ${{ vars.NPM_PUBLISH_ENVIRONMENT || 'npm-publish' }}
-      url: https://www.npmjs.com/package/${{ github.event.repository.name }}
-    permissions:
-      contents: read
-      id-token: write
-
-    steps:
-      - name: Harden runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2
-        with:
-          egress-policy: block
-          allowed-endpoints: >
-            api.github.com:443
-            github.com:443
-            objects.githubusercontent.com:443
-            registry.npmjs.org:443
-            fulcio.sigstore.dev:443
-            rekor.sigstore.dev:443
-            tuf-repo-cdn.sigstore.dev:443
-          disable-sudo: true
-
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-        with:
-          persist-credentials: false
-          show-progress: false
-
-__SETUP_PACKAGE_MANAGER_STEP__
-
-      - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
-        with:
-          node-version: 24
-          registry-url: "https://registry.npmjs.org"
-
-__SETUP_BUN_RUNTIME_STEP__
-
-      - name: Install dependencies
-        run: __INSTALL_COMMAND__
-        env:
-          npm_config_ignore_scripts: "true"
-
-      - name: Refuse private package publish
-        run: |
-          node -e "const pkg = require('./package.json'); if (pkg.private) { console.error('package.json is private; remove private:true before enabling npm publish'); process.exit(1); }"
-
-__TAG_VERSION_CHECK_STEP__
-
-__BUILD_STEP__
-
-      - name: Publish to npm with provenance
-        run: npm publish --access public --provenance
-        env:
-          NPM_CONFIG_PROVENANCE: "true"