create-daloy 0.34.2 → 0.34.3

package/README.md

@@ -57,6 +57,7 @@ pnpm create daloy@latest my-api \
 | `--git` / `--no-git` | Initialize a git repository. Defaults to interactive. |
 | `--minimal` | Strip the bookstore demo route and the built-in `/docs` + `/openapi.json` routes so only the framework bootstrap and `/healthz` ship. |
 | `--with-ci` / `--no-ci` | Add the hardened GitHub Actions, Dependabot, CODEOWNERS, SECURITY.md, and lockfile-source verification bundle. **Defaults to Y** so scaffolded projects are secure by default. |
+| `--with-deploy` / `--no-deploy` | Add the starter `.github/workflows/deploy.yml`. Defaults to the same value as `--with-ci`, so you can keep CI but opt out of deploy scaffolding with `--no-deploy`. |
 | `--code-owner <owner>` | Replace the CODEOWNERS placeholder when `--with-ci` is used, for example `@acme/security`. |
 | `--force` | Overwrite an existing non-empty directory. |
 | `--yes` | Accept all defaults; never prompt. |
@@ -153,6 +154,12 @@ For Node-style templates, the bundle adds:
 - `.github/workflows/ci.yml` with top-level `permissions: {}`, pinned actions,
   `harden-runner`, `persist-credentials: false`, no package-manager cache, and
   install scripts disabled.
+- `.github/workflows/deploy.yml` as a manual-only deployment starter. Container
+  templates publish a Docker image to GHCR with the repo-scoped `GITHUB_TOKEN`,
+  while Vercel and Cloudflare templates ship concrete CLI deploy steps that
+  read their platform credentials from GitHub Actions secrets/variables. The
+  deploy job is gated to `main` or a tag by default, and Node-style templates
+  re-run `verify:lockfile` before shipping.
 - `.github/workflows/vuln-scan.yml` — a daily scheduled SCA cron that runs the
   package manager's audit against the committed lockfile. Catches CVEs disclosed
   *after* the last PR or push and provides SOC 2 CC7.1
@@ -166,8 +173,14 @@ The bundle deliberately does **not** generate an npm publish workflow.
 `create-daloy` scaffolds REST API services, not libraries; if you later carve
 out a reusable package, opt into npm trusted publishing yourself.
 
-For `deno-basic`, `--with-ci` generates a Deno-native CI workflow plus CodeQL,
-Scorecard, zizmor, Dependabot for GitHub Actions, CODEOWNERS, and `SECURITY.md`.
+For `deno-basic`, `--with-ci` generates a Deno-native CI workflow, a manual-only
+container publish starter for GHCR that is guarded to `main` or a tag by
+default, plus CodeQL, Scorecard, zizmor, Dependabot for GitHub Actions,
+CODEOWNERS, and `SECURITY.md`.
+
+If you want the governance bundle but not the deployment starter, pass
+`--with-ci --no-deploy`. If you only want a deployment starter, pass
+`--with-deploy --no-ci`.
 
 If you omit `--code-owner`, the generated CODEOWNERS file uses
 `@your-org/security-team` as a placeholder. Replace it before relying on branch

package/bin/create-daloy.mjs

@@ -333,6 +333,7 @@ ${heading("Options")}
   ${color(COLORS.green, "--git / --no-git")}           Initialize a git repository.
   ${color(COLORS.green, "--minimal")}                  Strip the bookstore + OpenAPI docs demo routes.
   ${color(COLORS.green, "--with-ci / --no-ci")}         Add hardened GitHub Actions + governance files. ${color(COLORS.dim, "(default: Y)")}
+  ${color(COLORS.green, "--with-deploy / --no-deploy")} Add starter deploy.yml workflow(s). ${color(COLORS.dim, "(default: inherits --with-ci)")}
   ${color(COLORS.green, "--code-owner <owner>")}        CODEOWNERS owner for --with-ci, e.g. @acme/security.
   ${color(COLORS.green, "--force")}                    Overwrite an existing non-empty directory.
   ${color(COLORS.green, "--yes, -y")}                  Accept all defaults; never prompt.
@@ -380,6 +381,7 @@ function parseArgs(argv) {
     listTemplates: false,
     minimal: false,
     ci: undefined,
+    deploy: undefined,
     codeOwner: undefined,
   };
   const args = [...argv];
@@ -393,6 +395,8 @@ function parseArgs(argv) {
     else if (a === "--minimal") out.minimal = true;
     else if (a === "--with-ci") out.ci = true;
     else if (a === "--no-ci") out.ci = false;
+    else if (a === "--with-deploy") out.deploy = true;
+    else if (a === "--no-deploy") out.deploy = false;
     else if (a === "--code-owner") out.codeOwner = args.shift();
     else if (a?.startsWith("--code-owner=")) out.codeOwner = a.slice("--code-owner=".length);
     else if (a === "--install") out.install = true;
@@ -686,6 +690,15 @@ function runScriptCommand(packageManager, scriptName) {
   return `${packageManager} run ${scriptName}`;
 }
 
+function execCommand(packageManager, binary, args = "") {
+  const suffix = args ? ` ${args}` : "";
+  if (packageManager === "pnpm") return `pnpm exec ${binary}${suffix}`;
+  if (packageManager === "npm") return `npx ${binary}${suffix}`;
+  if (packageManager === "yarn") return `yarn exec ${binary}${suffix}`;
+  if (packageManager === "bun") return `bunx ${binary}${suffix}`;
+  return `${binary}${suffix}`;
+}
+
 function installCommand(packageManager) {
   if (packageManager === "pnpm") return "pnpm install --frozen-lockfile --ignore-scripts";
   if (packageManager === "npm") return "npm ci --ignore-scripts";
@@ -740,6 +753,163 @@ function setupBunStep() {
           bun-version: latest`;
 }
 
+function setupNodeStep() {
+  return `      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: 24
+          # Package-manager caching is intentionally disabled. Shared caches
+          # can bridge fork PRs into trusted branches when mis-keyed.`;
+}
+
+function installDependenciesStep(command) {
+  return `      - name: Install dependencies
+        run: ${command}
+        env:
+          npm_config_ignore_scripts: "true"`;
+}
+
+function joinWorkflowBlocks(blocks) {
+  return blocks.filter(Boolean).join("\n\n");
+}
+
+// Deploy job ref guard. `workflow_dispatch` accepts any branch by default, so
+// a junior could trigger a production deploy from an unreviewed feature
+// branch by accident. This `if:` limits the deploy job to `main` or a tag
+// push while still allowing maintainers to flip the guard off if they need
+// to deploy from a release branch.
+function deployRefGuard() {
+  return `    # Lock production deploys to main or a tag push. \`workflow_dispatch\`
+    # accepts any branch, so this guard stops an accidental dispatch from a
+    # feature branch from shipping unreviewed code.
+    if: github.ref == 'refs/heads/main' || github.ref_type == 'tag'`;
+}
+
+function containerRegistryHeader() {
+  return `# Default target: GitHub Container Registry (GHCR).
+# No extra secret is required; the workflow uses the repo-scoped GITHUB_TOKEN.
+# After the image is published, point your platform at GHCR or replace the
+# final push steps with your provider's deploy command.
+#
+# Optional container-host handoff examples:
+#   - Fly.io: install flyctl in a later step and run
+#       flyctl deploy --image "$IMAGE_REPO:sha-\${GITHUB_SHA}" --remote-only
+#   - Render: create an image-backed service that tracks
+#       ghcr.io/<owner>/<repo>:sha-\${GITHUB_SHA}`;
+}
+
+function containerPublishSteps() {
+  return `      - name: Log in to GHCR
+        env:
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          set -eu
+          echo "$GH_TOKEN" | docker login ghcr.io -u "\${{ github.actor }}" --password-stdin
+
+      - name: Derive image name
+        run: |
+          set -eu
+          owner="\${GITHUB_REPOSITORY_OWNER,,}"
+          repo="\${GITHUB_REPOSITORY#*/}"
+          repo="\${repo,,}"
+          echo "IMAGE_REPO=ghcr.io/\${owner}/\${repo}" >> "$GITHUB_ENV"
+
+      - name: Build image
+        env:
+          DOCKER_BUILDKIT: "1"
+        run: |
+          set -eu
+          docker build \
+            --tag "$IMAGE_REPO:sha-\${GITHUB_SHA}" \
+            --tag "$IMAGE_REPO:latest" \
+            .
+
+      - name: Push image
+        run: |
+          set -eu
+          docker push "$IMAGE_REPO:sha-\${GITHUB_SHA}"
+          docker push "$IMAGE_REPO:latest"`;
+}
+
+function vercelDeployHeader() {
+  return `# Configure before the first run:
+#   - GitHub Actions secret: VERCEL_TOKEN
+#   - GitHub Actions variables or environment variables: VERCEL_ORG_ID and VERCEL_PROJECT_ID
+# This workflow stays manual-only until you wire those in and decide whether
+# you want automatic deploys from main.`;
+}
+
+function cloudflareDeployHeader() {
+  return `# Configure before the first run:
+#   - GitHub Actions secret: CLOUDFLARE_API_TOKEN
+#   - GitHub Actions variable or environment variable: CLOUDFLARE_ACCOUNT_ID
+# Keep this manual-only until the worker is linked to the right account and
+# the production environment has approval rules.`;
+}
+
+function providerDeploySetup({ packageManager, needsBunRuntime }) {
+  return joinWorkflowBlocks([
+    setupPackageManagerStep(packageManager),
+    setupNodeStep(),
+    needsBunRuntime ? setupBunStep() : "",
+    installDependenciesStep(installCommand(packageManager)),
+  ]);
+}
+
+function vercelDeploySteps(packageManager) {
+  return `      - name: Deploy to Vercel
+        env:
+          VERCEL_TOKEN: \${{ secrets.VERCEL_TOKEN }}
+          VERCEL_ORG_ID: \${{ vars.VERCEL_ORG_ID }}
+          VERCEL_PROJECT_ID: \${{ vars.VERCEL_PROJECT_ID }}
+        run: |
+          set -eu
+          : "\${VERCEL_TOKEN:?Set the VERCEL_TOKEN Actions secret before running this workflow.}"
+          : "\${VERCEL_ORG_ID:?Set the VERCEL_ORG_ID Actions variable before running this workflow.}"
+          : "\${VERCEL_PROJECT_ID:?Set the VERCEL_PROJECT_ID Actions variable before running this workflow.}"
+          ${execCommand(packageManager, "vercel", "deploy --prod --yes --token \"$VERCEL_TOKEN\"")}`;
+}
+
+function cloudflareDeploySteps(packageManager) {
+  return `      - name: Deploy to Cloudflare Workers
+        env:
+          CLOUDFLARE_API_TOKEN: \${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: \${{ vars.CLOUDFLARE_ACCOUNT_ID }}
+        run: |
+          set -eu
+          : "\${CLOUDFLARE_API_TOKEN:?Set the CLOUDFLARE_API_TOKEN Actions secret before running this workflow.}"
+          : "\${CLOUDFLARE_ACCOUNT_ID:?Set the CLOUDFLARE_ACCOUNT_ID Actions variable before running this workflow.}"
+          ${execCommand(packageManager, "wrangler", "deploy")}`;
+}
+
+function renderDeployConfig({ template, packageManager, needsBunRuntime }) {
+  if (template === "vercel-edge") {
+    return {
+      header: vercelDeployHeader(),
+      jobName: "Deploy to Vercel",
+      jobPermissions: "",
+      setupSteps: providerDeploySetup({ packageManager, needsBunRuntime }),
+      steps: vercelDeploySteps(packageManager),
+    };
+  }
+  if (template === "cloudflare-worker") {
+    return {
+      header: cloudflareDeployHeader(),
+      jobName: "Deploy to Cloudflare Workers",
+      jobPermissions: "",
+      setupSteps: providerDeploySetup({ packageManager, needsBunRuntime }),
+      steps: cloudflareDeploySteps(packageManager),
+    };
+  }
+  return {
+    header: containerRegistryHeader(),
+    jobName: "Publish container image",
+    jobPermissions: "      packages: write",
+    setupSteps: "",
+    steps: containerPublishSteps(),
+  };
+}
+
 function workflowStep(name, command) {
   return `      - name: ${name}
         run: ${command}`;
@@ -763,13 +933,21 @@ async function addLockfileVerifyScript(dir) {
   await writePackageJson(dir, packageJson);
 }
 
-function renderCiReplacements({ packageManager, template, packageJson, codeOwner }) {
+function renderCiReplacements({ packageManager, template, packageJson, codeOwner, includeSecurityBundle = true }) {
   const setupPm = setupPackageManagerStep(packageManager);
   const needsBunRuntime = template === "bun-basic" && packageManager !== "bun";
   const audit = auditCommand(packageManager);
   const auditFull = auditFullCommand(packageManager);
   const buildStep = hasPackageScript(packageJson, "build") ? workflowStep("Build", runScriptCommand(packageManager, "build")) : "";
   const auditStep = audit ? workflowStep(auditStepName(packageManager), audit) : "";
+  const deploy = renderDeployConfig({ template, packageManager, needsBunRuntime });
+  // The verify:lockfile script is only scaffolded when the security bundle
+  // ships. In a deploy-only scaffold the script does not exist on disk, so
+  // the deploy workflow must omit the step instead of failing fast on a
+  // missing file.
+  const deployVerifyLockfileStep = includeSecurityBundle
+    ? workflowStep("Verify lockfile sources", runScriptCommand(packageManager, "verify:lockfile"))
+    : "";
   // vuln-scan.yml: production-tree audit is blocking, full-tree audit is
   // advisory (continue-on-error) so a low-severity dev-tool advisory does
   // not page the on-call on a daily cron.
@@ -781,6 +959,13 @@ function renderCiReplacements({ packageManager, template, packageJson, codeOwner
     : "";
 
   return new Map([
+    ["__DEPLOY_HEADER__", deploy.header],
+    ["__DEPLOY_JOB_NAME__", deploy.jobName],
+    ["__DEPLOY_JOB_PERMISSIONS__", deploy.jobPermissions],
+    ["__DEPLOY_SETUP_STEPS__", deploy.setupSteps],
+    ["__DEPLOY_STEPS__", deploy.steps],
+    ["__DEPLOY_VERIFY_LOCKFILE_STEP__", deployVerifyLockfileStep],
+    ["__DEPLOY_REF_GUARD__", deployRefGuard()],
     ["__CODE_OWNER__", codeOwner],
     ["__SETUP_PACKAGE_MANAGER_STEP__", setupPm],
     ["__SETUP_BUN_RUNTIME_STEP__", needsBunRuntime ? setupBunStep() : ""],
@@ -817,7 +1002,35 @@ async function replacePlaceholdersInTree(dir, replacements) {
   }
 }
 
-async function copyCiBundle(targetDir, template, packageManager, skipPackageManager, codeOwner) {
+async function pruneCiBundle(targetDir, flavor, { includeSecurityBundle, includeDeployWorkflow }) {
+  if (!includeSecurityBundle) {
+    const workflowFiles = flavor === "deno"
+      ? ["ci.yml", "codeql.yml", "container-scan.yml", "dast.yml", "scorecard.yml", "zizmor.yml"]
+      : ["ci.yml", "codeql.yml", "container-scan.yml", "dast.yml", "scorecard.yml", "vuln-scan.yml", "zizmor.yml"];
+    for (const file of workflowFiles) {
+      await rm(path.join(targetDir, ".github", "workflows", file), { force: true });
+    }
+    await rm(path.join(targetDir, ".github", "dependabot.yml"), { force: true });
+    await rm(path.join(targetDir, ".github", "CODEOWNERS"), { force: true });
+    await rm(path.join(targetDir, "SECURITY.md"), { force: true });
+    if (flavor === "node") {
+      await rm(path.join(targetDir, "scripts", "verify-lockfile-sources.mjs"), { force: true });
+    }
+  }
+
+  if (!includeDeployWorkflow) {
+    await rm(path.join(targetDir, ".github", "workflows", "deploy.yml"), { force: true });
+  }
+}
+
+async function copyCiBundle(
+  targetDir,
+  template,
+  packageManager,
+  skipPackageManager,
+  codeOwner,
+  { includeSecurityBundle = true, includeDeployWorkflow = true } = {},
+) {
   const flavor = skipPackageManager ? "deno" : "node";
   const sourceDir = path.join(CI_TEMPLATES_DIR, flavor);
   if (!existsSync(sourceDir)) {
@@ -825,23 +1038,42 @@ async function copyCiBundle(targetDir, template, packageManager, skipPackageMana
   }
   await copyTemplate(sourceDir, targetDir);
 
-  const candidate = codeOwner?.trim() ?? "";
-  if (candidate && !VALID_CODE_OWNER.test(candidate)) {
-    throw new Error(
-      `Invalid --code-owner "${candidate}". Use a GitHub handle (@user), a team (@org/team), or an email address.`,
-    );
+  await pruneCiBundle(targetDir, flavor, { includeSecurityBundle, includeDeployWorkflow });
+
+  if (!includeSecurityBundle && !includeDeployWorkflow) {
+    return;
   }
+
+  const candidate = codeOwner?.trim() ?? "";
   const owner = candidate || "@your-org/security-team";
   if (skipPackageManager) {
+    if (includeSecurityBundle && candidate && !VALID_CODE_OWNER.test(candidate)) {
+      throw new Error(
+        `Invalid --code-owner "${candidate}". Use a GitHub handle (@user), a team (@org/team), or an email address.`,
+      );
+    }
     await replacePlaceholdersInTree(targetDir, new Map([["__CODE_OWNER__", owner]]));
     return;
   }
 
-  await addLockfileVerifyScript(targetDir);
+  if (includeSecurityBundle) {
+    if (candidate && !VALID_CODE_OWNER.test(candidate)) {
+      throw new Error(
+        `Invalid --code-owner "${candidate}". Use a GitHub handle (@user), a team (@org/team), or an email address.`,
+      );
+    }
+    await addLockfileVerifyScript(targetDir);
+  }
   const packageJson = await readPackageJsonIfPresent(targetDir);
   await replacePlaceholdersInTree(
     targetDir,
-    renderCiReplacements({ packageManager, template, packageJson, codeOwner: owner }),
+    renderCiReplacements({
+      packageManager,
+      template,
+      packageJson,
+      codeOwner: owner,
+      includeSecurityBundle,
+    }),
   );
 }
 
@@ -1213,7 +1445,7 @@ function createSpinner(initialMessage) {
   };
 }
 
-function printSummary({ projectName, template, packageManager, installDeps, skipPackageManager, withCi }) {
+function printSummary({ projectName, template, packageManager, installDeps, skipPackageManager, withCi, withDeploy }) {
   const templateMeta = TEMPLATE_OPTIONS.find((option) => option.value === template);
   const templateLabel = templateMeta ? `${templateMeta.title} ${color(COLORS.dim, `(${template})`)}` : template;
   const summaryLines = [
@@ -1230,6 +1462,9 @@ function printSummary({ projectName, template, packageManager, installDeps, skip
   if (withCi) {
     summaryLines.push(`${color(COLORS.gray, "Security  ")} ${color(COLORS.cyan, "GitHub CI bundle")}`);
   }
+  if (withDeploy) {
+    summaryLines.push(`${color(COLORS.gray, "Deploy    ")} ${color(COLORS.cyan, "Starter workflow")}`);
+  }
   console.log("");
   console.log(renderBox(summaryLines, { accent: COLORS.green }));
   console.log("");
@@ -1413,6 +1648,15 @@ async function main() {
       withCi = rl ? await askYesNo(rl, "Add hardened GitHub Actions and security files?", true) : true;
     }
 
+    let withDeploy = opts.deploy;
+    if (withDeploy === undefined) {
+      if (withCi) {
+        withDeploy = true;
+      } else {
+        withDeploy = rl ? await askYesNo(rl, "Add a starter deployment workflow?", false) : false;
+      }
+    }
+
     rl?.close();
 
     if (interactive) {
@@ -1443,9 +1687,18 @@ async function main() {
       }
     }
 
-    if (withCi) {
-      await copyCiBundle(targetDir, template, packageManager, skipPackageManager, opts.codeOwner);
-      logStep("GitHub security bundle added", skipPackageManager ? "deno" : packageManager);
+    if (withCi || withDeploy) {
+      await copyCiBundle(targetDir, template, packageManager, skipPackageManager, opts.codeOwner, {
+        includeSecurityBundle: withCi,
+        includeDeployWorkflow: withDeploy,
+      });
+      if (withCi && withDeploy) {
+        logStep("GitHub automation added", `${skipPackageManager ? "deno" : packageManager} + deploy`);
+      } else if (withCi) {
+        logStep("GitHub security bundle added", skipPackageManager ? "deno" : packageManager);
+      } else if (withDeploy) {
+        logStep("Deploy starter added", template);
+      }
     }
 
     if (initGit) {
@@ -1474,7 +1727,7 @@ async function main() {
       }
     }
 
-    printSummary({ projectName, template, packageManager, installDeps, skipPackageManager, withCi });
+    printSummary({ projectName, template, packageManager, installDeps, skipPackageManager, withCi, withDeploy });
   } catch (err) {
     rl?.close();
     if (err && err.message === "Cancelled") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-daloy",
-  "version": "0.34.2",
+  "version": "0.34.3",
   "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
   "type": "module",
   "license": "MIT",

package/sbom.cdx.json

@@ -1,25 +1,25 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:6244f261-e99d-5b5f-9ccb-5a10bc0de8b7",
+  "serialNumber": "urn:uuid:9fb86079-cf96-5a72-94a8-dd7d3cdc62cc",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-23T09:06:22.609Z",
+    "timestamp": "2026-05-23T13:34:45.760Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "0.34.2"
+        "version": "0.34.3"
       }
     ],
     "authors": [],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/create-daloy@0.34.2",
+      "bom-ref": "pkg:npm/create-daloy@0.34.3",
       "name": "create-daloy",
-      "version": "0.34.2",
+      "version": "0.34.3",
       "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
-      "purl": "pkg:npm/create-daloy@0.34.2",
+      "purl": "pkg:npm/create-daloy@0.34.3",
       "licenses": [
         {
           "license": {
@@ -38,9 +38,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag-create-daloy-0.34.2",
+        "tagId": "swidtag-create-daloy-0.34.3",
         "name": "create-daloy",
-        "version": "0.34.2",
+        "version": "0.34.3",
         "tagVersion": 0,
         "patch": false
       }
@@ -49,7 +49,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/create-daloy@0.34.2",
+      "ref": "pkg:npm/create-daloy@0.34.3",
       "dependsOn": []
     }
   ]

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "create-daloy-0.34.2",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/create-daloy-0.34.2-6244f261-e99d-5b5f-9ccb-5a10bc0de8b7",
+  "name": "create-daloy-0.34.3",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/create-daloy-0.34.3-9fb86079-cf96-5a72-94a8-dd7d3cdc62cc",
   "creationInfo": {
-    "created": "2026-05-23T09:06:22.609Z",
+    "created": "2026-05-23T13:34:45.760Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package-create-daloy",
       "name": "create-daloy",
-      "versionInfo": "0.34.2",
+      "versionInfo": "0.34.3",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/create-daloy@0.34.2"
+          "referenceLocator": "pkg:npm/create-daloy@0.34.3"
         }
       ]
     }

package/templates/_ci/deno/_github/workflows/deploy.yml

@@ -0,0 +1,118 @@
+# Starter deployment workflow generated by create-daloy --with-ci.
+#
+# This workflow is intentionally manual-only so a fresh scaffold does not fail
+# on every push before you wire in environment protection. Once you are ready,
+# add your preferred push/tag trigger.
+#
+# Default target: GitHub Container Registry (GHCR).
+# No extra secret is required; the workflow uses the repo-scoped GITHUB_TOKEN.
+# After the image is published, point your platform at GHCR or replace the
+# final push steps with your provider's deploy command.
+#
+# Optional container-host handoff examples:
+#   - Fly.io: install flyctl in a later step and run
+#       flyctl deploy --image "$IMAGE_REPO:sha-${GITHUB_SHA}" --remote-only
+#   - Render: create an image-backed service that tracks
+#       ghcr.io/<owner>/<repo>:sha-${GITHUB_SHA}
+
+name: Deploy
+
+on:
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: deploy-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  verify:
+    name: Verify before deploy
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2
+        with:
+          egress-policy: audit
+          disable-sudo: true
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          show-progress: false
+
+      - name: Set up Deno
+        uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2.0.4
+        with:
+          deno-version: v2.x
+
+      - name: Typecheck
+        run: deno task typecheck
+
+      - name: Test
+        run: deno task test
+
+  deploy:
+    name: Publish container image
+    needs: verify
+    # Lock production deploys to main or a tag push. `workflow_dispatch`
+    # accepts any branch, so this guard stops an accidental dispatch from a
+    # feature branch from shipping unreviewed code.
+    if: github.ref == 'refs/heads/main' || github.ref_type == 'tag'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    environment:
+      name: production
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2
+        with:
+          egress-policy: audit
+          disable-sudo: true
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          show-progress: false
+
+      - name: Log in to GHCR
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -eu
+          echo "$GH_TOKEN" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
+
+      - name: Derive image name
+        run: |
+          set -eu
+          owner="${GITHUB_REPOSITORY_OWNER,,}"
+          repo="${GITHUB_REPOSITORY#*/}"
+          repo="${repo,,}"
+          echo "IMAGE_REPO=ghcr.io/${owner}/${repo}" >> "$GITHUB_ENV"
+
+      - name: Build image
+        env:
+          DOCKER_BUILDKIT: "1"
+        run: |
+          set -eu
+          docker build \
+            --tag "$IMAGE_REPO:sha-${GITHUB_SHA}" \
+            --tag "$IMAGE_REPO:latest" \
+            .
+
+      - name: Push image
+        run: |
+          set -eu
+          docker push "$IMAGE_REPO:sha-${GITHUB_SHA}"
+          docker push "$IMAGE_REPO:latest"

package/templates/_ci/node/SECURITY.md

@@ -24,6 +24,7 @@ The `--with-ci` bundle adds these defaults:
 - Lockfile source verification rejects git dependencies and non-registry tarball URLs.
 - CodeQL, OpenSSF Scorecard, zizmor, Dependabot, and CODEOWNERS are generated.
 - A daily scheduled `vuln-scan.yml` runs the package manager's audit against the committed lockfile so newly-disclosed CVEs are surfaced even when no PR or push has run CI (SOC 2 CC7.1 continuous-vulnerability-management evidence).
+- A weekly scheduled `dast.yml` boots the built application and runs an OWASP ZAP baseline scan against it. CodeQL + the `verify:*` family are the SAST half of the posture; this is the DAST half — see Aikido's [SAST vs DAST](https://www.aikido.dev/blog/sast-vs-dast-what-you-need-to-now) write-up for why both matter. Findings are summarized in the workflow log and the job fails on HIGH-risk alerts; MEDIUM / LOW / INFO are surfaced for triage but non-blocking.
 - No npm publish workflow is generated: this scaffold is a REST API service, not a published package. If you later carve out a reusable library you can opt into npm trusted publishing yourself.
 
 ## Container hardening

package/templates/_ci/node/_github/CODEOWNERS

@@ -7,6 +7,7 @@
 /.github/                         __CODE_OWNER__
 /.github/workflows/               __CODE_OWNER__
 /.github/workflows/vuln-scan.yml  __CODE_OWNER__
+/.github/workflows/dast.yml       __CODE_OWNER__
 /.github/dependabot.yml           __CODE_OWNER__
 /.github/CODEOWNERS               __CODE_OWNER__
 

package/templates/_ci/node/_github/workflows/dast.yml

@@ -0,0 +1,177 @@
+# Dynamic Application Security Testing (DAST) generated by
+# create-daloy --with-ci.
+#
+# Why this exists:
+#   The shipped `ci.yml` + `codeql.yml` + `scorecard.yml` + `zizmor.yml`
+#   stack is the SAST half of your security posture — static analysis
+#   of source, dependencies, and workflows. Aikido's "SAST vs DAST:
+#   what you need to know"
+#   (https://www.aikido.dev/blog/sast-vs-dast-what-you-need-to-now)
+#   argues that SAST and DAST catch different bug classes and that you
+#   want both. This workflow adds the dynamic half: it boots your built
+#   application, points OWASP ZAP's baseline scanner at it, and fails
+#   the run on any HIGH-risk finding.
+#
+#   Because Daloy is JSON-first and the framework already enforces
+#   header sanitization, body limits, router path-traversal rejection,
+#   and `secureHeaders()` defaults, the baseline scan usually goes
+#   green out of the box on a fresh scaffold. The value is the
+#   *continuous* probe — newly-disclosed ZAP rules apply to your
+#   unchanged code, and runtime regressions (a misconfigured CORS
+#   policy, a header you set with CRLF in it, a redirect to an
+#   open-redirect target) get caught before they hit production.
+#
+# Trigger surface:
+#   * Weekly cron — continuous coverage against newly-disclosed rules.
+#   * `workflow_dispatch` — on-demand probe for security review.
+#   Deliberately NOT on every PR: a baseline scan takes several
+#   minutes and the same surface is exercised by your test suite on
+#   every PR via `ci.yml`.
+#
+# Customizing:
+#   * The "Start application" step expects `pnpm build` to produce
+#     `dist/index.js` and a `PORT` env var to control the listen port,
+#     matching the shipped `node-basic` template. If your app starts
+#     differently, edit the `nohup` line below.
+#   * If your app needs seed data, secrets, or a database, add them
+#     before the start step (use `vars` / `secrets` in the GitHub
+#     Environment).
+#   * To probe a deployed staging URL instead of a local build, drop
+#     the "Set up …", "Install", "Build", "Start application", and
+#     "Wait for target" steps and point the ZAP `docker run` line at
+#     `https://staging.example.com`.
+
+name: DAST
+
+on:
+  schedule:
+    # 07:42 UTC weekly (Wed) — offset from the other scheduled scans
+    # so they do not all queue at once.
+    - cron: "42 7 * * 3"
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: dast-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  zap-baseline:
+    name: ZAP baseline scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    permissions:
+      contents: read
+
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2
+        with:
+          egress-policy: audit
+          disable-sudo: true
+          disable-file-monitoring: false
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          show-progress: false
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@ac6db6d3c1f721f886538a378a2d73e85697340a # v6
+        with:
+          version: 11.1.3
+          run_install: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: 24
+
+      - name: Install dependencies (no scripts)
+        run: pnpm install --frozen-lockfile --ignore-scripts
+        env:
+          npm_config_ignore_scripts: "true"
+
+      - name: Build
+        run: pnpm build
+
+      - name: Start application (background)
+        run: |
+          mkdir -p dast-results
+          chmod 777 dast-results
+          nohup node dist/index.js > dast-results/server.log 2>&1 &
+          echo $! > dast-results/server.pid
+        env:
+          PORT: "3000"
+          NODE_ENV: production
+
+      - name: Wait for target to be reachable
+        run: |
+          for i in $(seq 1 30); do
+            if curl -fsS --max-time 2 http://localhost:3000/healthz > /dev/null \
+              || curl -fsS --max-time 2 http://localhost:3000/ > /dev/null; then
+              echo "Target ready after ${i} attempt(s)."
+              exit 0
+            fi
+            sleep 1
+          done
+          echo "::error::DAST target did not become reachable in 30s."
+          cat dast-results/server.log || true
+          exit 1
+
+      - name: Run OWASP ZAP baseline scan
+        run: |
+          docker pull ghcr.io/zaproxy/zaproxy:stable
+          docker run --rm --network host \
+            -v "$PWD/dast-results:/zap/wrk/:rw" \
+            -t ghcr.io/zaproxy/zaproxy:stable \
+            zap-baseline.py \
+              -t http://localhost:3000 \
+              -J zap-report.json \
+              -w zap-report.md \
+              -r zap-report.html \
+              -I \
+              || true
+
+      - name: Stop application
+        if: always()
+        run: |
+          if [ -f dast-results/server.pid ]; then
+            kill "$(cat dast-results/server.pid)" || true
+          fi
+
+      - name: Summarize ZAP findings and fail on HIGH
+        if: always()
+        run: |
+          report=dast-results/zap-report.json
+          if [ ! -f "$report" ]; then
+            echo "::warning::No ZAP JSON report produced (scan may have failed to start)."
+            exit 0
+          fi
+          counts=$(node -e "
+            const r = JSON.parse(require('node:fs').readFileSync(process.argv[1], 'utf8'));
+            const c = { high: 0, medium: 0, low: 0, info: 0 };
+            for (const site of r.site ?? []) {
+              for (const alert of site.alerts ?? []) {
+                const code = String(alert.riskcode);
+                if (code === '3') c.high++;
+                else if (code === '2') c.medium++;
+                else if (code === '1') c.low++;
+                else c.info++;
+              }
+            }
+            process.stdout.write(JSON.stringify(c));
+          " "$report")
+          echo "ZAP findings: ${counts}"
+          high=$(node -e "process.stdout.write(String(JSON.parse(process.argv[1]).high))" "$counts")
+          if [ -f dast-results/zap-report.md ]; then
+            echo "----- ZAP markdown report -----"
+            cat dast-results/zap-report.md
+            echo "----- end report -----"
+          fi
+          if [ "${high}" -gt 0 ]; then
+            echo "::error::ZAP reported ${high} HIGH-risk finding(s) against your application surface."
+            exit 1
+          fi

package/templates/_ci/node/_github/workflows/deploy.yml

@@ -0,0 +1,94 @@
+# Starter deployment workflow generated by create-daloy --with-ci.
+#
+# This workflow is intentionally manual-only so a fresh scaffold does not fail
+# on every push before you wire in secrets, variables, and environment
+# approvals. Once you are ready, add your preferred push/tag trigger.
+#
+__DEPLOY_HEADER__
+
+name: Deploy
+
+on:
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: deploy-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  verify:
+    name: Verify before deploy
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2
+        with:
+          egress-policy: audit
+          disable-sudo: true
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          show-progress: false
+
+__SETUP_PACKAGE_MANAGER_STEP__
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: 24
+          # Package-manager caching is intentionally disabled. Shared caches
+          # can bridge fork PRs into trusted branches when mis-keyed.
+
+__SETUP_BUN_RUNTIME_STEP__
+
+      - name: Install dependencies
+        run: __INSTALL_COMMAND__
+        env:
+          npm_config_ignore_scripts: "true"
+
+__DEPLOY_VERIFY_LOCKFILE_STEP__
+
+      - name: Typecheck
+        run: __TYPECHECK_COMMAND__
+
+      - name: Test
+        run: __TEST_COMMAND__
+
+__BUILD_STEP__
+
+  deploy:
+    name: __DEPLOY_JOB_NAME__
+    needs: verify
+__DEPLOY_REF_GUARD__
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    environment:
+      name: production
+    permissions:
+      contents: read
+__DEPLOY_JOB_PERMISSIONS__
+
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2
+        with:
+          egress-policy: audit
+          disable-sudo: true
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          show-progress: false
+
+__DEPLOY_SETUP_STEPS__
+
+__DEPLOY_STEPS__

package/templates/bun-basic/package.json

@@ -16,7 +16,7 @@
     "gen": "pnpm gen:openapi && pnpm gen:client"
   },
   "dependencies": {
-    "@daloyjs/core": "^0.34.2",
+    "@daloyjs/core": "^0.34.3",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/cloudflare-worker/package.json

@@ -10,7 +10,7 @@
     "test": "node --import tsx/esm --test tests/**/*.test.ts"
   },
   "dependencies": {
-    "@daloyjs/core": "^0.34.2",
+    "@daloyjs/core": "^0.34.3",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/deno-basic/deno.json

@@ -8,8 +8,8 @@
     "gen:openapi": "deno run --allow-net --allow-env --allow-read --allow-write scripts/dump-openapi.ts"
   },
   "imports": {
-    "@daloyjs/core": "npm:@daloyjs/core@^0.34.2",
-    "@daloyjs/core/": "npm:@daloyjs/core@^0.34.2/",
+    "@daloyjs/core": "npm:@daloyjs/core@^0.34.3",
+    "@daloyjs/core/": "npm:@daloyjs/core@^0.34.3/",
     "zod": "npm:zod@^4.4.3"
   },
   "compilerOptions": {

package/templates/node-basic/package.json

@@ -18,7 +18,7 @@
     "audit": "pnpm audit --prod"
   },
   "dependencies": {
-    "@daloyjs/core": "^0.34.2",
+    "@daloyjs/core": "^0.34.3",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/vercel-edge/package.json

@@ -10,7 +10,7 @@
     "test": "node --import tsx/esm --test tests/**/*.test.ts"
   },
   "dependencies": {
-    "@daloyjs/core": "^0.34.2",
+    "@daloyjs/core": "^0.34.3",
     "zod": "^4.4.3"
   },
   "devDependencies": {