create-daloy 0.34.3 → 0.35.1

package/templates/_ci/node/_github/workflows/opengrep.yml

@@ -0,0 +1,169 @@
+# Opengrep — second SAST engine, complementing CodeQL.
+#
+# Why this exists in your scaffolded Daloy project:
+#   Daloy itself runs two SAST engines (CodeQL + Opengrep) because no
+#   single rule corpus catches everything. Opengrep is the LGPL-2.1
+#   community fork of Semgrep, ships Semgrep-compatible rules, and is
+#   backed by an open consortium. See Aikido's "Ultimate SAST Guide"
+#   (https://www.aikido.dev/blog/ultimate-sast-guide-static-application-security-testing)
+#   and "Launching Opengrep" (https://www.aikido.dev/blog/launching-opengrep-why-we-forked-semgrep).
+#
+#   Pairing CodeQL (semantic, dataflow-heavy, language-server-grade)
+#   with Opengrep (pattern-based AST matching, fast, community-maintained
+#   rule packs) gives defense-in-depth at the source layer — the same
+#   posture Daloy maintains on its own repository.
+#
+# Hardening (matches the rest of the scaffolded bundle):
+#   * Top-level `permissions: {}`; the job opts in only to the two
+#     scopes it needs (`security-events: write` for SARIF upload,
+#     `contents: read` for checkout).
+#   * Third-party actions are SHA-pinned with version comments.
+#   * Opengrep itself is NOT installed via a third-party action.
+#     Instead the binary is downloaded from a pinned GitHub release
+#     and its sigstore cosign signature is verified against the
+#     official `opengrep/opengrep` release identity before execution.
+#     This avoids `curl ... | sh` and avoids adding a new pinned
+#     action to your supply chain just for this scan.
+#   * `step-security/harden-runner` runs in audit mode — the job
+#     needs egress to `github.com` (release artifact),
+#     `objects.githubusercontent.com` (release CDN), `semgrep.dev`
+#     (Semgrep-registry rule packs), and `rekor.sigstore.dev` /
+#     `fulcio.sigstore.dev` (cosign keyless verification). Audit
+#     logs every connection for post-hoc review.
+#   * `actions/checkout` runs with `persist-credentials: false`.
+#   * `set -euo pipefail` on every shell step; binaries are pinned
+#     by version + cosign signature.
+
+name: Opengrep
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # 51 5 * * 4 — weekly Thursday, offset from CodeQL (Mon 04:37)
+    # and Scorecard so concurrent SARIF uploads do not collide.
+    - cron: "51 5 * * 4"
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: opengrep-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  scan:
+    name: Opengrep SAST
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      security-events: write
+      contents: read
+
+    env:
+      # Pin the Opengrep release we install. Bump this in lockstep
+      # with a fresh review of the upstream release notes; the
+      # signature verification step below provides a second line of
+      # defense if this URL is ever poisoned.
+      OPENGREP_VERSION: "v1.22.0"
+      OPENGREP_ASSET: "opengrep_manylinux_x86"
+
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2
+        with:
+          egress-policy: audit
+          disable-sudo: true
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          show-progress: false
+
+      - name: Download Opengrep release binary + signature
+        # We download the binary and its sigstore cert/sig directly
+        # from the pinned GitHub release. No `curl ... | sh`.
+        run: |
+          set -euo pipefail
+          mkdir -p .opengrep
+          base="https://github.com/opengrep/opengrep/releases/download/${OPENGREP_VERSION}/${OPENGREP_ASSET}"
+          echo "Fetching ${base}"
+          curl --proto '=https' --tlsv1.2 -fsSL --retry 3 --retry-delay 2 \
+            -o .opengrep/opengrep      "${base}"
+          curl --proto '=https' --tlsv1.2 -fsSL --retry 3 --retry-delay 2 \
+            -o .opengrep/opengrep.cert "${base}.cert"
+          curl --proto '=https' --tlsv1.2 -fsSL --retry 3 --retry-delay 2 \
+            -o .opengrep/opengrep.sig  "${base}.sig"
+          chmod +x .opengrep/opengrep
+
+      - name: Verify Opengrep signature (cosign / sigstore)
+        # `cosign` is preinstalled on GitHub-hosted `ubuntu-latest`
+        # runners. We require an identity issued by GitHub OIDC to
+        # the opengrep/opengrep release workflow; anything else is a
+        # hard fail (no `|| true`, no fallback).
+        run: |
+          set -euo pipefail
+          if ! command -v cosign >/dev/null 2>&1; then
+            echo "::error::cosign is required but not available on the runner."
+            exit 1
+          fi
+          cosign version
+          cosign verify-blob \
+            --cert ".opengrep/opengrep.cert" \
+            --signature ".opengrep/opengrep.sig" \
+            --certificate-identity-regexp "https://github.com/opengrep/opengrep.+" \
+            --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
+            ".opengrep/opengrep"
+          echo "Opengrep ${OPENGREP_VERSION} signature verified."
+
+      - name: Print Opengrep version
+        run: |
+          set -euo pipefail
+          .opengrep/opengrep --version
+
+      - name: Run Opengrep scan (SARIF)
+        # Curated security-focused rule packs from the Semgrep registry,
+        # which Opengrep consumes unchanged:
+        #   * p/security-audit  — generic SAST audit pack
+        #   * p/owasp-top-ten   — OWASP Top 10 application classes
+        #   * p/cwe-top-25      — CWE Top 25 dangerous weaknesses
+        #   * p/javascript / p/typescript — language-specific rules
+        #   * p/nodejs          — Node.js runtime-specific patterns
+        #   * p/secrets         — hardcoded credentials / API keys
+        #
+        # `--error` is intentionally OFF: SARIF is uploaded to GitHub
+        # code scanning and branch protection rules decide whether
+        # new findings gate merges. The workflow's exit status is
+        # reserved for *infrastructure* failures (download, signature,
+        # binary crash), not findings.
+        run: |
+          set -euo pipefail
+          .opengrep/opengrep scan \
+            --config p/security-audit \
+            --config p/owasp-top-ten \
+            --config p/cwe-top-25 \
+            --config p/javascript \
+            --config p/typescript \
+            --config p/nodejs \
+            --config p/secrets \
+            --sarif-output opengrep.sarif \
+            --metrics off \
+            --timeout 120 \
+            --max-target-bytes 1500000 \
+            --exclude node_modules \
+            --exclude dist \
+            --exclude build \
+            --exclude coverage \
+            --exclude .next \
+            --exclude .opengrep \
+            .
+
+      - name: Upload SARIF to GitHub code scanning
+        if: always()
+        uses: github/codeql-action/upload-sarif@52485aec7be33610227643b0fe83936b8b5f061a # v3
+        with:
+          sarif_file: opengrep.sarif
+          category: opengrep

package/templates/_ci/node/_github/workflows/osv-scan.yml

@@ -0,0 +1,135 @@
+# Second-source dependency scan against the OSV.dev database
+# (Aikido "SAST vs SCA" / "npm-audit-guide — the missing layer" gate).
+#
+# Why this exists for a REST API service:
+#   `vuln-scan.yml` already runs `__AUDIT_PROD_STEP__`-equivalent
+#   `pnpm/npm/yarn/bun audit` against the committed lockfile every day,
+#   but that single feed (GHSA) is exactly the failure mode the Aikido
+#   write-up "SAST vs SCA" calls out: SCA findings are only as good as
+#   the database you query. The September 2025 npm phishing wave that
+#   compromised `debug`, `chalk`, and ~2B downloads/week of dependent
+#   packages (https://lwn.net/Articles/1037167/) showed that newly-
+#   disclosed malicious package versions often land in OSS feeds
+#   (OpenSSF `malicious-packages`, OSV.dev, PyPI, Go vuln DB) *before*
+#   they propagate into GHSA.
+#
+#   This workflow adds a SECOND, independent source of vulnerability
+#   and malware intel: Google's OSV-Scanner, which queries OSV.dev and
+#   cross-references the OpenSSF `malicious-packages` corpus
+#   (https://github.com/ossf/malicious-packages). Findings that overlap
+#   with the daily package-manager audit are duplicates; findings that
+#   DO NOT overlap are the gap the Aikido article warns about.
+#
+# Defense-in-depth context (see SECURITY.md § Supply chain):
+#   * `.npmrc` `ignore-scripts=true` and `minimum-release-age=1440`
+#     (pnpm scaffolds) block the install-time and zero-day-window
+#     classes of supply-chain attack.
+#   * `verify-lockfile-sources.mjs` already refuses non-registry sources.
+#   * `pnpm/npm/yarn/bun audit` covers the GHSA feed.
+#   * This OSV pass is the LAST layer: "did a pinned version turn out
+#     to carry a CVE or a malware advisory after we pinned it?"
+#
+# Hardening:
+#   * `permissions: {}` at the top level; the single job opts in to
+#     `contents: read` only. No write permissions of any kind.
+#   * `step-security/harden-runner` in audit mode.
+#   * `actions/checkout` runs with `persist-credentials: false`.
+#   * The OSV-Scanner binary is downloaded directly from the official
+#     google/osv-scanner GitHub release and its SHA-256 is verified
+#     against a locally-pinned constant BEFORE the binary is executed.
+#     We deliberately avoid the third-party `google/osv-scanner-action`
+#     wrapper so the only third-party surface is the binary itself, not
+#     a layer of action-side YAML that could be retagged.
+#   * The scan is read-only and runs on the committed lockfile without
+#     installing any dependencies, so a malicious dev dep cannot run a
+#     postinstall during the scan itself.
+
+name: OSV scan
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "pnpm-lock.yaml"
+      - "package-lock.json"
+      - "npm-shrinkwrap.json"
+      - "yarn.lock"
+      - "bun.lock"
+      - "bun.lockb"
+      - "package.json"
+      - ".github/workflows/osv-scan.yml"
+  pull_request:
+    branches: [main]
+    paths:
+      - "pnpm-lock.yaml"
+      - "package-lock.json"
+      - "npm-shrinkwrap.json"
+      - "yarn.lock"
+      - "bun.lock"
+      - "bun.lockb"
+      - "package.json"
+      - ".github/workflows/osv-scan.yml"
+  schedule:
+    # 06:47 UTC daily — offset from vuln-scan (06:13) and Zizmor (07:00)
+    # so the SCA jobs do not collide.
+    - cron: "47 6 * * *"
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: osv-scan-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  scan:
+    name: OSV.dev + malicious-packages scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+
+    env:
+      # Pinned OSV-Scanner release. Bump together with the SHA-256 below.
+      # Source: https://github.com/google/osv-scanner/releases/tag/v2.3.8
+      OSV_SCANNER_VERSION: "2.3.8"
+      # SHA-256 of `osv-scanner_linux_amd64` from the v2.3.8
+      # `osv-scanner_SHA256SUMS` asset.
+      OSV_SCANNER_SHA256: "bc98e15319ed0d515e3f9235287ba53cdc5535d576d24fd573978ecfe9ab92dc"
+
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2
+        with:
+          egress-policy: audit
+          disable-sudo: true
+          disable-file-monitoring: false
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          show-progress: false
+
+      - name: Download and verify OSV-Scanner binary
+        # Pin the binary by SHA-256 BEFORE executing it. A registry or
+        # GitHub Releases compromise that swaps the asset would fail
+        # this check and abort the job.
+        run: |
+          set -euo pipefail
+          url="https://github.com/google/osv-scanner/releases/download/v${OSV_SCANNER_VERSION}/osv-scanner_linux_amd64"
+          curl --proto '=https' --tlsv1.2 --fail --silent --show-error --location \
+            --output osv-scanner "${url}"
+          echo "${OSV_SCANNER_SHA256}  osv-scanner" | sha256sum --check --status
+          chmod +x osv-scanner
+          ./osv-scanner --version
+
+      - name: Scan lockfiles (OSV.dev + malicious-packages)
+        # `scan source --recursive` auto-detects whichever lockfile the
+        # scaffold actually ships (pnpm-lock.yaml, package-lock.json,
+        # yarn.lock, bun.lock, ...). Exits non-zero if any vulnerability
+        # or malware advisory matches a pinned version. This is the
+        # second-source gate beyond the package manager's own audit.
+        run: |
+          set -euo pipefail
+          ./osv-scanner scan source --recursive --format=table .

package/templates/_ci/node/_github/workflows/secret-scan.yml

@@ -0,0 +1,106 @@
+# Secret scanning — gitleaks against PRs, pushes to main, and a daily
+# scheduled sweep of the full git history.
+#
+# Why this exists (Aikido "Secrets Detection: A Practical Guide"
+# https://www.aikido.dev/blog/secret-detection-application-security):
+#
+#   GitHub-native push protection only flags provider-shaped secrets at
+#   push time. Aikido's guide argues that effective secret detection must
+#   also scan the **full git history** (not just the latest snapshot) on
+#   a regular cadence, because a single leaked credential anywhere in any
+#   commit, branch, or tag should be treated as compromised.
+#
+#   This workflow runs `gitleaks` on every PR / push against the working
+#   tree and, on a daily schedule, sweeps the entire commit history so
+#   long-lived secrets that pre-date push-protection enablement (or
+#   secrets that slipped past it via rebased / squashed fork PRs) are
+#   still surfaced.
+#
+# Hardening (matches the rest of the scaffolded CI bundle):
+#
+#   * No new third-party GitHub Action: the gitleaks binary is fetched
+#     from the pinned official release and its SHA-256 is verified
+#     before execution.
+#   * Top-level `permissions: {}`; the single job opts in to
+#     `contents: read`.
+#   * `step-security/harden-runner` in audit mode, sudo disabled.
+#   * `actions/checkout` with `persist-credentials: false`.
+#   * `--redact` keeps any matched value out of the public log.
+#
+# When a finding lands:
+#   1. Rotate the credential immediately.
+#   2. Assess scope (what did the secret access?).
+#   3. Remove it from history if your workflow allows (filter-repo /
+#      BFG); otherwise treat the repo + every downstream clone as
+#      compromised.
+#   4. Add a `.gitleaksignore` entry only for confirmed false positives.
+
+name: Secret scan
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "21 4 * * *"
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: secret-scan-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  gitleaks:
+    name: gitleaks
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+
+    env:
+      # Pinned gitleaks release — bump in lockstep with the SHA-256 below.
+      # Source of truth: https://github.com/gitleaks/gitleaks/releases
+      GITLEAKS_VERSION: "8.30.1"
+      GITLEAKS_SHA256: "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb"
+
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2
+        with:
+          egress-policy: audit
+          disable-sudo: true
+          disable-file-monitoring: false
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          show-progress: false
+          # Full history for the scheduled sweep so gitleaks can walk
+          # every commit; for PR / push runs a shallow clone is fine
+          # because the checked-out tree is what gitleaks scans.
+          fetch-depth: ${{ github.event_name == 'schedule' && 0 || 1 }}
+
+      - name: Install gitleaks (verified SHA-256)
+        run: |
+          set -euo pipefail
+          archive="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          url="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${archive}"
+          curl --proto '=https' --tlsv1.2 -sSfL "$url" -o "$archive"
+          echo "${GITLEAKS_SHA256}  ${archive}" | sha256sum --check --strict
+          mkdir -p "$RUNNER_TEMP/gitleaks"
+          tar -xzf "$archive" -C "$RUNNER_TEMP/gitleaks" gitleaks
+          rm -f "$archive"
+          echo "$RUNNER_TEMP/gitleaks" >> "$GITHUB_PATH"
+
+      - name: gitleaks version
+        run: gitleaks version
+
+      - name: gitleaks (working tree)
+        run: gitleaks dir --no-banner --redact --verbose --exit-code 1 .
+
+      - name: gitleaks (full git history)
+        if: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
+        run: gitleaks git --no-banner --redact --verbose --exit-code 1 .

package/templates/bun-basic/AGENTS.md

@@ -41,6 +41,18 @@ Do not write `.js` here — that's the Node NodeNext convention and will fail to
 6. Every new route ships with a test that covers a happy path and at least one unhappy path.
 7. After any route change: `bun run gen:openapi && bun run gen:client && bun run typecheck && bun test`.
 
+## Secure-by-default (do not let an AI strip these)
+
+Per Supabase + Aikido on [secure-by-default development](https://www.aikido.dev/blog/supabase-approach-to-secure-by-default-development): *"If you tell an AI to make something work, it might remove the very security checks that protect you."* When a guard rejects a request, **satisfy it, do not delete it.**
+
+- Keep `secureHeaders()`, `requestId()`, `rateLimit()` registered, and `bodyLimitBytes` / `requestTimeoutMs` set on `new App({...})`. Tighten per-route; never raise globally to pass a test.
+- Keep Zod `.strict()` on top-level request objects; do not switch to `.passthrough()`. Keep `responses[N].body` schemas tight; never widen to `z.any()` to let a privileged field escape.
+- Every protected route attaches an auth `beforeHandle` and ships an unhappy-path test proving an unauthenticated request returns `401` (and wrong scope returns `403`) — the HTTP-boundary equivalent of Supabase's pgTAP policy tests.
+- JWT verifiers keep an explicit `algorithms` allowlist; never trust the token's `alg` header, never allow `none`, always check `exp` / `nbf`.
+- Credential / HMAC comparisons use `timingSafeEqual`, never `===`. Throw typed errors from `@daloyjs/core` so problem+json redacts in prod; never return raw stack traces.
+- `.env`, secrets, and private keys never get committed — the template `_gitignore` is the source of truth.
+- Do not bypass safety checks (`--no-verify`, `bun install --trust`) without recording the reason in the PR.
+
 ## Process expectations
 
 - Quality gates must pass before declaring work done: `bun run typecheck` and `bun test`.

package/templates/bun-basic/_gitignore

@@ -8,3 +8,8 @@ coverage/
 !.env.example
 generated/
 bun.lockb
+
+# An `npm-shrinkwrap.json` published with a package overrides the
+# consumer's lockfile and can pin transitives to unsigned tarballs.
+# See https://socket.dev/blog/understanding-the-security-concerns-of-npm-shrinkwrap
+npm-shrinkwrap.json

package/templates/bun-basic/package.json

@@ -13,10 +13,11 @@
     "test": "bun test",
     "gen:openapi": "bun run scripts/dump-openapi.ts",
     "gen:client": "openapi-ts",
-    "gen": "pnpm gen:openapi && pnpm gen:client"
+    "gen": "pnpm gen:openapi && pnpm gen:client",
+    "audit": "pnpm audit --prod"
   },
   "dependencies": {
-    "@daloyjs/core": "^0.34.3",
+    "@daloyjs/core": "^0.35.1",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/cloudflare-worker/AGENTS.md

@@ -31,6 +31,19 @@ A [DaloyJS](https://daloyjs.dev) REST API deployed to **Cloudflare Workers**. **
 8. Long-running work belongs in `ctx.waitUntil(...)`, not blocking the response.
 9. Every new route ships with a test that covers a happy path and at least one unhappy path.
 
+## Secure-by-default (do not let an AI strip these)
+
+Per Supabase + Aikido on [secure-by-default development](https://www.aikido.dev/blog/supabase-approach-to-secure-by-default-development): *"If you tell an AI to make something work, it might remove the very security checks that protect you."* When a guard rejects a request, **satisfy it, do not delete it.**
+
+- Keep `secureHeaders()`, `requestId()`, `rateLimit()` registered, and `bodyLimitBytes` / `requestTimeoutMs` set on `new App({...})`. For production, add Cloudflare's native rate-limit binding **in addition to** the in-memory limiter, not instead of it.
+- Read secrets and bindings (KV, D1, R2) from the `env` argument; never hard-code, never log them.
+- Keep Zod `.strict()` on top-level request objects; do not switch to `.passthrough()`. Keep `responses[N].body` schemas tight; never widen to `z.any()` to let a privileged field escape.
+- Every protected route attaches an auth `beforeHandle` and ships an unhappy-path test proving an unauthenticated request returns `401` (and wrong scope returns `403`) — the HTTP-boundary equivalent of Supabase's pgTAP policy tests.
+- JWT verifiers keep an explicit `algorithms` allowlist; never trust the token's `alg` header, never allow `none`, always check `exp` / `nbf`.
+- Credential / HMAC comparisons use `crypto.subtle.timingSafeEqual`, never `===`. Throw typed errors from `@daloyjs/core` so problem+json redacts in prod; never return raw stack traces.
+- Keep `compatibility_date` pinned; do not enable `nodejs_compat` unless a feature requires it.
+- `.env`, `.dev.vars`, secrets, private keys: never commit. Use `wrangler secret put` for production secrets.
+
 ## Process expectations
 
 - Quality gates must pass before declaring work done: `pnpm typecheck` and `pnpm test`.

package/templates/cloudflare-worker/_gitignore

@@ -4,4 +4,13 @@ dist/
 .DS_Store
 *.log
 .env
+.env.*
+!.env.example
 .dev.vars
+.dev.vars.*
+!.dev.vars.example
+
+# An `npm-shrinkwrap.json` published with a package overrides the
+# consumer's lockfile and can pin transitives to unsigned tarballs.
+# See https://socket.dev/blog/understanding-the-security-concerns-of-npm-shrinkwrap
+npm-shrinkwrap.json

package/templates/cloudflare-worker/_npmrc

@@ -12,5 +12,6 @@ minimum-release-age=1440
 
 # Block postinstall/preinstall/prepare hooks from transitive deps —
 # the primary execution channel for chalk/debug, node-ipc, Shai-Hulud.
-# Allowlist trusted builds via package.json `pnpm.onlyBuiltDependencies`.
+# If you later adopt pnpm's build-script allowlist, keep it in
+# pnpm-workspace.yaml instead of turning this off.
 ignore-scripts=true

package/templates/cloudflare-worker/package.json

@@ -7,10 +7,11 @@
     "dev": "wrangler dev",
     "deploy": "wrangler deploy",
     "typecheck": "tsc --noEmit",
-    "test": "node --import tsx/esm --test tests/**/*.test.ts"
+    "test": "node --import tsx/esm --test tests/**/*.test.ts",
+    "audit": "pnpm audit --prod"
   },
   "dependencies": {
-    "@daloyjs/core": "^0.34.3",
+    "@daloyjs/core": "^0.35.1",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/deno-basic/AGENTS.md

@@ -33,6 +33,18 @@ The typed Hey API SDK is generated outside Deno (Hey API has no Deno entrypoint
 7. Every new route ships with a test that covers a happy path and at least one unhappy path.
 8. After any route change: `deno task gen:openapi && deno task typecheck && deno task test`.
 
+## Secure-by-default (do not let an AI strip these)
+
+Per Supabase + Aikido on [secure-by-default development](https://www.aikido.dev/blog/supabase-approach-to-secure-by-default-development): *"If you tell an AI to make something work, it might remove the very security checks that protect you."* When a guard rejects a request, **satisfy it, do not delete it.**
+
+- Keep `secureHeaders()`, `requestId()`, `rateLimit()` registered, and `bodyLimitBytes` / `requestTimeoutMs` set on `new App({...})`. Tighten per-route; never raise globally to pass a test.
+- Keep Deno permissions narrow. Never add `--allow-all`; never broaden `--allow-net` / `--allow-read` / `--allow-env` to silence a prompt — add the specific host / path / var.
+- Keep Zod `.strict()` on top-level request objects; do not switch to `.passthrough()`. Keep `responses[N].body` schemas tight; never widen to `z.any()` to let a privileged field escape.
+- Every protected route attaches an auth `beforeHandle` and ships an unhappy-path test proving an unauthenticated request returns `401` (and wrong scope returns `403`) — the HTTP-boundary equivalent of Supabase's pgTAP policy tests.
+- JWT verifiers keep an explicit `algorithms` allowlist; never trust the token's `alg` header, never allow `none`, always check `exp` / `nbf`.
+- Credential / HMAC comparisons use a constant-time comparison, never `===`. Throw typed errors from `@daloyjs/core` so problem+json redacts in prod; never return raw stack traces.
+- `.env`, secrets, and private keys never get committed — the template `_gitignore` is the source of truth.
+
 ## Process expectations
 
 - Quality gates must pass before declaring work done: `deno task typecheck` and `deno task test`.

package/templates/deno-basic/_gitignore

@@ -5,3 +5,8 @@ node_modules/
 .env.*
 !.env.example
 generated/
+
+# An `npm-shrinkwrap.json` published with a package overrides the
+# consumer's lockfile and can pin transitives to unsigned tarballs.
+# See https://socket.dev/blog/understanding-the-security-concerns-of-npm-shrinkwrap
+npm-shrinkwrap.json

package/templates/deno-basic/deno.json

@@ -8,8 +8,8 @@
     "gen:openapi": "deno run --allow-net --allow-env --allow-read --allow-write scripts/dump-openapi.ts"
   },
   "imports": {
-    "@daloyjs/core": "npm:@daloyjs/core@^0.34.3",
-    "@daloyjs/core/": "npm:@daloyjs/core@^0.34.3/",
+    "@daloyjs/core": "npm:@daloyjs/core@^0.35.1",
+    "@daloyjs/core/": "npm:@daloyjs/core@^0.35.1/",
     "zod": "npm:zod@^4.4.3"
   },
   "compilerOptions": {

package/templates/node-basic/AGENTS.md

@@ -45,6 +45,18 @@ This is the official Node.js ESM convention — TypeScript rewrites the specifie
 6. Every new route ships with a test that covers a happy path and at least one unhappy path.
 7. After any route change: `pnpm gen && pnpm typecheck && pnpm test`.
 
+## Secure-by-default (do not let an AI strip these)
+
+Per Supabase + Aikido on [secure-by-default development](https://www.aikido.dev/blog/supabase-approach-to-secure-by-default-development): *"If you tell an AI to make something work, it might remove the very security checks that protect you."* When a guard rejects a request, **satisfy it, do not delete it.**
+
+- Keep `secureHeaders()`, `requestId()`, `rateLimit()` registered, and `bodyLimitBytes` / `requestTimeoutMs` set on `new App({...})`. Tighten per-route; never raise globally to pass a test.
+- Keep Zod `.strict()` on top-level request objects; do not switch to `.passthrough()`. Keep `responses[N].body` schemas tight; never widen to `z.any()` to let a privileged field escape.
+- Every protected route attaches an auth `beforeHandle` and ships an unhappy-path test proving an unauthenticated request returns `401` (and wrong scope returns `403`) — the HTTP-boundary equivalent of Supabase's pgTAP policy tests.
+- JWT verifiers keep an explicit `algorithms` allowlist; never trust the token's `alg` header, never allow `none`, always check `exp` / `nbf`.
+- Credential / HMAC comparisons use `timingSafeEqual`, never `===`. Throw typed errors from `@daloyjs/core` so problem+json redacts in prod; never return raw stack traces.
+- `.env`, secrets, and private keys never get committed — the template `_gitignore` is the source of truth.
+- Do not bypass safety checks (`--no-verify`, `--ignore-scripts=false`, lowering the 24h `minimum-release-age` in `.npmrc`) without recording the reason in the PR.
+
 ## Process expectations
 
 - Quality gates must pass before declaring work done: `pnpm typecheck` and `pnpm test`.

package/templates/node-basic/_gitignore

@@ -7,3 +7,8 @@ coverage/
 .env.*
 !.env.example
 generated/
+
+# An `npm-shrinkwrap.json` published with a package overrides the
+# consumer's lockfile and can pin transitives to unsigned tarballs.
+# See https://socket.dev/blog/understanding-the-security-concerns-of-npm-shrinkwrap
+npm-shrinkwrap.json

package/templates/node-basic/_npmrc

@@ -16,6 +16,6 @@ minimum-release-age=1440
 
 # postinstall / preinstall / prepare hooks from transitive deps are the
 # main execution channel used by chalk/debug, node-ipc, and Shai-Hulud
-# malware. Allowlist the few packages you actually trust to build via
-# package.json `pnpm.onlyBuiltDependencies` instead of turning this off.
+# malware. If you later adopt pnpm's build-script allowlist, keep it in
+# pnpm-workspace.yaml instead of turning this off.
 ignore-scripts=true

package/templates/node-basic/package.json

@@ -18,7 +18,7 @@
     "audit": "pnpm audit --prod"
   },
   "dependencies": {
-    "@daloyjs/core": "^0.34.3",
+    "@daloyjs/core": "^0.35.1",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/vercel-edge/AGENTS.md

@@ -40,6 +40,18 @@ This is the official Node.js ESM convention — TypeScript rewrites the specifie
 7. The catch-all `api/[...path].ts` must remain a catch-all so DaloyJS handles routing.
 8. Every new route ships with a test that covers a happy path and at least one unhappy path.
 
+## Secure-by-default (do not let an AI strip these)
+
+Per Supabase + Aikido on [secure-by-default development](https://www.aikido.dev/blog/supabase-approach-to-secure-by-default-development): *"If you tell an AI to make something work, it might remove the very security checks that protect you."* When a guard rejects a request, **satisfy it, do not delete it.**
+
+- Keep `secureHeaders()`, `requestId()`, `rateLimit()` registered, and `bodyLimitBytes` / `requestTimeoutMs` set on `new App({...})`. For production, back the limiter with Vercel KV **in addition to** the in-memory limiter (which resets per instance).
+- Keep Zod `.strict()` on top-level request objects; do not switch to `.passthrough()`. Keep `responses[N].body` schemas tight; never widen to `z.any()` to let a privileged field escape.
+- Every protected route attaches an auth `beforeHandle` and ships an unhappy-path test proving an unauthenticated request returns `401` (and wrong scope returns `403`) — the HTTP-boundary equivalent of Supabase's pgTAP policy tests.
+- JWT verifiers keep an explicit `algorithms` allowlist; never trust the token's `alg` header, never allow `none`, always check `exp` / `nbf`.
+- Credential / HMAC comparisons use `crypto.subtle.timingSafeEqual`, never `===`. Throw typed errors from `@daloyjs/core` so problem+json redacts in prod; never return raw stack traces.
+- Keep `api/[...path].ts` a catch-all so DaloyJS owns routing — do not split into per-path files that bypass the middleware chain.
+- `.env`, `.env.local`, secrets, private keys: never commit. Use `vercel env` for production secrets.
+
 ## Process expectations
 
 - Quality gates must pass before declaring work done: `pnpm typecheck` and `pnpm test`.

package/templates/vercel-edge/_gitignore

@@ -7,3 +7,8 @@ coverage/
 .env
 .env.*
 !.env.example
+
+# An `npm-shrinkwrap.json` published with a package overrides the
+# consumer's lockfile and can pin transitives to unsigned tarballs.
+# See https://socket.dev/blog/understanding-the-security-concerns-of-npm-shrinkwrap
+npm-shrinkwrap.json

package/templates/vercel-edge/_npmrc

@@ -12,5 +12,6 @@ minimum-release-age=1440
 
 # Block postinstall/preinstall/prepare hooks from transitive deps —
 # the primary execution channel for chalk/debug, node-ipc, Shai-Hulud.
-# Allowlist trusted builds via package.json `pnpm.onlyBuiltDependencies`.
+# If you later adopt pnpm's build-script allowlist, keep it in
+# pnpm-workspace.yaml instead of turning this off.
 ignore-scripts=true