create-daloy 0.36.0 → 0.38.0

package/bin/create-daloy.mjs

@@ -216,7 +216,8 @@ const SYMBOLS = SUPPORTS_UNICODE
 const BAR = color(COLORS.gray, SYMBOLS.bar);
 
 function printIntro(title) {
-  console.log(`${color(COLORS.cyan, SYMBOLS.cornerTL + SYMBOLS.lineH)}  ${color(COLORS.bold, title)}`);
+  console.log(`${color(COLORS.cyan, SYMBOLS.cornerTL + SYMBOLS.lineH)}  ${color(COLORS.bold + COLORS.white, title)}`);
+  console.log(`${BAR}  ${color(COLORS.dim, "Answer a few prompts \u2014 arrow keys to move, Enter to confirm.")}`);
   console.log(BAR);
 }
 
@@ -259,17 +260,18 @@ function renderBox(lines, options = {}) {
 // requests, and responses moving cleanly between client and server.
 const LOGO_WAVE_LINES = SUPPORTS_UNICODE
   ? [
-      "\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F",
-      "\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F",
-      "\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F",
+      "\u2248\u2248\u2248\u2248\u2248\u2248", // ≈≈≈≈≈≈
+      "\u2248\u2248\u2248\u2248\u2248\u2248",
+      "\u2248\u2248\u2248\u2248\u2248\u2248",
     ]
-  : ["~".repeat(25), "~".repeat(25), "~".repeat(25)];
+  : ["~~~~~~", "~~~~~~", "~~~~~~"];
 
-// Sky-blue palette tuned to match `tailwindcss` sky-200/400/700 — the same
-// colors used in the wordmark on https://daloyjs.dev.
+// Sky-blue palette anchored to the brand mark (website/public/assets/source/
+// mark.svg): the three stacked waves are sky-200, sky-400, and sky-600. Each
+// row fades slightly along its length so the cascade reads as flowing water.
 const LOGO_WAVE_GRADIENTS = [
   { start: [186, 230, 253], end: [125, 211, 252] }, // sky-200 -> sky-300
-  { start: [56, 189, 248], end: [14, 165, 233] }, //   sky-400 -> sky-500
+  { start: [56, 189, 248], end: [2, 132, 199] }, //    sky-400 -> sky-600
   { start: [2, 132, 199], end: [3, 105, 161] }, //     sky-600 -> sky-700
 ];
 
@@ -291,25 +293,45 @@ function gradientLine(line, startRgb, endRgb) {
 function printBanner(version) {
   if (!SUPPORTS_UNICODE) {
     console.log(`\n${color(COLORS.bold + COLORS.cyan, "create-daloy")}  ${color(COLORS.dim, `v${version}`)}`);
-    console.log(color(COLORS.dim, "Contract-first REST APIs for Node, Bun, Deno, Vercel Edge, and Workers"));
+    console.log(color(COLORS.dim, "The runtime-portable framework with supply-chain-aware defaults"));
+    console.log(color(COLORS.dim, "Secure-by-default runtime | Blocked install scripts | Source-verified lockfiles | Typed end-to-end"));
     console.log(color(COLORS.dim, "https://daloyjs.dev\n"));
     return;
   }
-  for (let i = 0; i < LOGO_WAVE_LINES.length; i += 1) {
-    const { start, end } = LOGO_WAVE_GRADIENTS[i];
-    console.log(`  ${gradientLine(LOGO_WAVE_LINES[i], start, end)}`);
-  }
-  // Centered wordmark beneath the waves: "Daloy" in neutral text, "JS" in
-  // brand sky-blue. Mirrors the SVG lockup used on the website.
+
+  // Brand lockup: the three-wave mark on the left sits beside the wordmark and
+  // tagline on the right — mirroring the social banner on https://daloyjs.dev.
   const wordmark = `${color(COLORS.bold + COLORS.white, "Daloy")}${color(COLORS.bold + COLORS.cyan, "JS")}`;
-  const wordmarkPadding = " ".repeat(Math.max(0, Math.floor((stringWidth(LOGO_WAVE_LINES[0]) - 7) / 2)));
-  console.log(`  ${wordmarkPadding}${wordmark}`);
-  // Build the welcome content lines (each contains its own ANSI color codes).
-  const headline = `${color(COLORS.bold + COLORS.cyan, "Welcome to DaloyJS")}  ${color(COLORS.gray, `\u2014 v${version}`)}`;
-  const subline = color(COLORS.dim, "Contract-first REST APIs for Node, Bun, Deno, Vercel Edge, and Workers.");
-  const docs = `${color(COLORS.gray, "docs:")} ${color(COLORS.cyan, "https://daloyjs.dev/docs")}`;
+  const versionTag = color(COLORS.gray, `v${version}`);
+  const tagline = color(COLORS.gray, "The runtime-portable framework with supply-chain-aware defaults");
+
+  const waves = LOGO_WAVE_LINES.map((line, i) =>
+    gradientLine(line, LOGO_WAVE_GRADIENTS[i].start, LOGO_WAVE_GRADIENTS[i].end),
+  );
+  const gap = "   ";
+
+  console.log("");
+  console.log(`  ${waves[0]}`);
+  console.log(`  ${waves[1]}${gap}${wordmark}  ${versionTag}`);
+  console.log(`  ${waves[2]}${gap}${tagline}`);
   console.log("");
-  console.log(renderBox([headline, subline, "", docs], { accent: COLORS.cyan }));
+
+  // Feature chips, brand-styled with cyan middots between dim labels.
+  const dot = color(COLORS.cyan, " \u00B7 ");
+  const chips = [
+    "Secure-by-default",
+    "Blocked install scripts",
+    "Source-verified lockfiles",
+    "Typed end-to-end",
+  ]
+    .map((chip) => color(COLORS.dim, chip))
+    .join(dot);
+  console.log(`  ${chips}`);
+
+  // Inverse-video "daloyjs.dev" badge, echoing the rounded pill in the brand
+  // banner. Inverse degrades to plain text when color is unavailable.
+  const pill = color(COLORS.cyan + COLORS.inverse, " daloyjs.dev ");
+  console.log(`  ${pill}  ${color(COLORS.gray, "docs:")} ${color(COLORS.cyan + COLORS.underline, "https://daloyjs.dev/docs")}`);
   console.log("");
 }
 
@@ -608,8 +630,12 @@ async function patchDockerfileForPackageManager(dir, packageManager) {
 
   const raw = await readFile(file, "utf8");
   const install = dockerInstallSnippet(packageManager);
+  // Match the pnpm install block tolerant of both LF and CRLF line endings.
+  // Windows checkouts (and packages published from Windows) can carry CRLF;
+  // an `\n`-only pattern would silently fail to match there, leaving the
+  // pnpm-specific COPY/RUN lines in place for npm/yarn/bun scaffolds.
   let next = raw.replace(
-    /COPY package\.json pnpm-lock\.yaml\* \.\/\nRUN corepack enable && corepack prepare pnpm@latest --activate && \\\n+\s+pnpm install --frozen-lockfile --ignore-scripts/,
+    /COPY package\.json pnpm-lock\.yaml\* \.\/\r?\nRUN corepack enable && corepack prepare pnpm@latest --activate && \\\r?\n\s+pnpm install --frozen-lockfile --ignore-scripts/,
     `${install.copy}\n${install.run}`,
   );
 
@@ -623,8 +649,11 @@ async function patchDockerfileForPackageManager(dir, packageManager) {
 
   if (packageManager === "bun" && next.includes("FROM ${NODE_IMAGE} AS builder")) {
     if (!next.includes("ARG BUN_IMAGE=")) {
+      // CRLF-tolerant: the working tree may carry `\r\n`, so a plain
+      // `"...alpine\n"` substring replace would miss and the BUN_IMAGE ARG
+      // would never be inserted.
       next = next.replace(
-        "ARG NODE_IMAGE=node:24-alpine\n",
+        /ARG NODE_IMAGE=node:24-alpine\r?\n/,
         "ARG NODE_IMAGE=node:24-alpine\nARG BUN_IMAGE=oven/bun:1-alpine\n",
       );
     }
@@ -1312,7 +1341,9 @@ async function askChoice(rl, question, choices, defaultChoice) {
   const rawInput = rawInputHandle.stream;
 
   printPromptHeader(question);
-  printRailLine(color(COLORS.dim, `Use \u2191 \u2193 to navigate, Enter to confirm, type a number to jump.`));
+  printRailLine(
+    `${color(COLORS.dim, "\u2191/\u2193")} ${color(COLORS.gray, "navigate")}   ${color(COLORS.dim, "1\u20139")} ${color(COLORS.gray, "jump")}   ${color(COLORS.dim, "enter")} ${color(COLORS.gray, "confirm")}`,
+  );
 
   let index = Math.max(
     0,
@@ -1326,15 +1357,16 @@ async function askChoice(rl, question, choices, defaultChoice) {
       .map((choice, i) => {
         const isActive = i === active;
         const isDefault = optionValue(choice) === defaultChoice;
+        const pointer = isActive ? color(COLORS.cyan, SYMBOLS.pointer) : " ";
         const marker = isActive ? color(COLORS.cyan, SYMBOLS.radioOn) : color(COLORS.gray, SYMBOLS.radioOff);
         const titleRaw = optionTitle(choice).padEnd(titleWidth);
         const valueRaw = optionValue(choice).padEnd(valueWidth);
         const title = isActive ? color(COLORS.bold + COLORS.cyan, titleRaw) : color(COLORS.white, titleRaw);
-        const value = color(COLORS.dim, `(${valueRaw})`);
+        const value = color(COLORS.dim, `${valueRaw}`);
         const description = optionDescription(choice);
         const descColored = isActive ? color(COLORS.cyan, description) : color(COLORS.dim, description);
         const recommended = isDefault ? color(COLORS.green, `  ${SYMBOLS.star} recommended`) : "";
-        return `${BAR}  ${marker} ${title}  ${value}  ${descColored}${recommended}`;
+        return `${BAR}  ${pointer} ${marker} ${title}  ${value}  ${descColored}${recommended}`;
       })
       .join("\n");
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-daloy",
-  "version": "0.36.0",
+  "version": "0.38.0",
   "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
   "type": "module",
   "license": "MIT",

package/sbom.cdx.json

@@ -1,25 +1,25 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:f93cd589-45c8-513e-a365-e0e8bd5ad309",
+  "serialNumber": "urn:uuid:b1a2eb69-121b-5cae-87a9-5d036a3e1a7a",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-28T20:50:57.300Z",
+    "timestamp": "2026-06-10T11:58:38.391Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "0.36.0"
+        "version": "0.38.0"
       }
     ],
     "authors": [],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/create-daloy@0.36.0",
+      "bom-ref": "pkg:npm/create-daloy@0.38.0",
       "name": "create-daloy",
-      "version": "0.36.0",
+      "version": "0.38.0",
       "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
-      "purl": "pkg:npm/create-daloy@0.36.0",
+      "purl": "pkg:npm/create-daloy@0.38.0",
       "licenses": [
         {
           "license": {
@@ -42,9 +42,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag-create-daloy-0.36.0",
+        "tagId": "swidtag-create-daloy-0.38.0",
         "name": "create-daloy",
-        "version": "0.36.0",
+        "version": "0.38.0",
         "tagVersion": 0,
         "patch": false
       }
@@ -53,7 +53,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/create-daloy@0.36.0",
+      "ref": "pkg:npm/create-daloy@0.38.0",
       "dependsOn": []
     }
   ]

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "create-daloy-0.36.0",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/create-daloy-0.36.0-f93cd589-45c8-513e-a365-e0e8bd5ad309",
+  "name": "create-daloy-0.38.0",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/create-daloy-0.38.0-b1a2eb69-121b-5cae-87a9-5d036a3e1a7a",
   "creationInfo": {
-    "created": "2026-05-28T20:50:57.300Z",
+    "created": "2026-06-10T11:58:38.391Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package-create-daloy",
       "name": "create-daloy",
-      "versionInfo": "0.36.0",
+      "versionInfo": "0.38.0",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/create-daloy@0.36.0"
+          "referenceLocator": "pkg:npm/create-daloy@0.38.0"
         }
       ]
     }

package/templates/bun-basic/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

package/templates/bun-basic/_agents/skills/daloyjs-best-practices/SKILL.md

@@ -1,3 +1,14 @@
+---
+name: daloyjs-best-practices
+description: >-
+  Best practices for building, testing, and hardening this DaloyJS REST API on
+  the Bun runtime. Use when adding or changing HTTP routes, Zod schemas,
+  middleware, or error handling; regenerating the OpenAPI spec or the typed
+  Hey API client; or working on auth, rate limits, secrets, and the project's
+  quality gates.
+license: MIT
+---
+
 # SKILL.md — DaloyJS best practices (Bun)
 
 Operational guidance and best practices for AI coding agents working in this

package/templates/bun-basic/package.json

@@ -17,7 +17,7 @@
     "audit": "pnpm audit --prod"
   },
   "dependencies": {
-    "@daloyjs/core": "^0.36.0",
+    "@daloyjs/core": "^0.38.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/cloudflare-worker/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

package/templates/cloudflare-worker/_agents/skills/daloyjs-best-practices/SKILL.md

@@ -1,3 +1,14 @@
+---
+name: daloyjs-best-practices
+description: >-
+  Best practices for building, testing, and hardening this DaloyJS REST API on
+  Cloudflare Workers. Use when adding or changing HTTP routes, Zod schemas,
+  middleware, or error handling; wiring Worker bindings (KV, D1, R2, Queues,
+  env, secrets); or working on auth, rate limits, and the project's quality
+  gates.
+license: MIT
+---
+
 # SKILL.md — DaloyJS best practices (Cloudflare Workers)
 
 Operational guidance and best practices for AI coding agents working in this

package/templates/cloudflare-worker/package.json

@@ -11,7 +11,7 @@
     "audit": "pnpm audit --prod"
   },
   "dependencies": {
-    "@daloyjs/core": "^0.36.0",
+    "@daloyjs/core": "^0.38.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/deno-basic/AGENTS.md

@@ -2,7 +2,7 @@
 
 A [DaloyJS](https://daloyjs.dev) REST API for the [Deno](https://deno.com) runtime. **Contract-first**: routes are defined with Zod schemas and OpenAPI 3.1 is generated from them. When `docs: true` is set in `new App({...})`, three routes are auto-mounted: `GET /openapi.json`, `GET /openapi.yaml`, and `GET /docs` (Scalar UI).
 
-- Runtime: Deno (no Node package manager). Dependencies are loaded via `npm:` and `jsr:` specifiers in `deno.json`.
+- Runtime: Deno (no Node package manager). DaloyJS loads from `jsr:` and third-party packages such as Zod load from `npm:` in `deno.json`.
 
 ## Commands
 
@@ -18,7 +18,7 @@ The typed Hey API SDK is generated outside Deno (Hey API has no Deno entrypoint
 - `src/build-app.ts` — `buildApp()` factory. Routes, schemas, and middleware live here. **Pure, no side effects.**
 - `src/main.ts` — calls `buildApp()` and starts the listener via `@daloyjs/core/deno`. The only file that opens a port.
 - `scripts/dump-openapi.ts` — imports `buildApp()` and writes `generated/openapi.json`. Codegen reads from `buildApp()` only — never import `src/main.ts` from scripts.
-- `deno.json` — tasks, import map, and `npm:` specifiers. There is no `package.json` in this project.
+- `deno.json` — tasks, import map, and JSR-first dependency specifiers. There is no `package.json` in this project.
 - `generated/` — machine-written. Do not edit by hand.
 - `tests/` — Deno test files.
 

package/templates/deno-basic/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

package/templates/deno-basic/README.md

@@ -49,7 +49,7 @@ deno task test
 
 ## What's included
 
-- `@daloyjs/core` (loaded via `npm:` specifiers in `deno.json`).
+- `@daloyjs/core` (loaded via `jsr:` specifiers in `deno.json`).
 - Starter security middleware: `secureHeaders`, `requestId`, and `rateLimit`.
 <!-- daloy-minimal:strip-start books -->
 - A health route and contract-first `/books/:id` route with Zod validation.

package/templates/deno-basic/_agents/skills/daloyjs-best-practices/SKILL.md

@@ -1,3 +1,14 @@
+---
+name: daloyjs-best-practices
+description: >-
+  Best practices for building, testing, and hardening this DaloyJS REST API on
+  the Deno runtime. Use when adding or changing HTTP routes, Zod schemas,
+  middleware, or error handling; regenerating the OpenAPI spec; managing Deno
+  permissions and tasks; or working on auth, rate limits, secrets, and the
+  project's quality gates.
+license: MIT
+---
+
 # SKILL.md — DaloyJS best practices (Deno)
 
 Operational guidance and best practices for AI coding agents working in this
@@ -43,7 +54,7 @@ DaloyJS is a **contract-first** framework. Internalize these rules:
   `@daloyjs/core/deno`. The only file allowed to open a port.
 - `scripts/dump-openapi.ts` — imports `buildApp()` and writes
   `generated/openapi.json`.
-- `deno.json` — tasks, import map, and `npm:` specifiers. **There is no
+- `deno.json` — tasks, import map, and JSR-first dependency specifiers. **There is no
   `package.json`** in this project — do not add one.
 - `tests/` — Deno test files (`*.test.ts`).
 - `generated/` — **machine-written**. Never edit by hand.

package/templates/deno-basic/deno.json

@@ -8,8 +8,10 @@
     "gen:openapi": "deno run --allow-net --allow-env --allow-read --allow-write scripts/dump-openapi.ts"
   },
   "imports": {
-    "@daloyjs/core": "npm:@daloyjs/core@^0.36.0",
-    "@daloyjs/core/": "npm:@daloyjs/core@^0.36.0/",
+    "@daloyjs/core": "jsr:@daloyjs/daloy@^0.38.0",
+    "@daloyjs/core/banner": "jsr:@daloyjs/daloy@^0.38.0/banner",
+    "@daloyjs/core/deno": "jsr:@daloyjs/daloy@^0.38.0/deno",
+    "@daloyjs/core/openapi": "jsr:@daloyjs/daloy@^0.38.0/openapi",
     "zod": "npm:zod@^4.4.3"
   },
   "compilerOptions": {

package/templates/deno-basic/deno.lock

@@ -0,0 +1,35 @@
+{
+  "version": "5",
+  "specifiers": {
+    "jsr:@std/assert@1": "1.0.19",
+    "jsr:@std/internal@^1.0.12": "1.0.14",
+    "npm:@daloyjs/core@0.37": "0.37.0",
+    "npm:zod@^4.4.3": "4.4.3"
+  },
+  "jsr": {
+    "@std/assert@1.0.19": {
+      "integrity": "eaada96ee120cb980bc47e040f82814d786fe8162ecc53c91d8df60b8755991e",
+      "dependencies": [
+        "jsr:@std/internal"
+      ]
+    },
+    "@std/internal@1.0.14": {
+      "integrity": "291516b3d4c35024d6ffbc0a9df5bf4c64116e05b50012cf846710152d2ffdf7"
+    }
+  },
+  "npm": {
+    "@daloyjs/core@0.37.0": {
+      "integrity": "sha512-z7XRaoue2TqDIyQIdsg8ZKlBPmvYU8WX2ieYk3sGBMyt181bkb9NBgnxD/m6W54ojpiz4ArFRxyJ9BQTfjLvnQ==",
+      "bin": true
+    },
+    "zod@4.4.3": {
+      "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ=="
+    }
+  },
+  "workspace": {
+    "dependencies": [
+      "npm:@daloyjs/core@0.37",
+      "npm:zod@^4.4.3"
+    ]
+  }
+}

package/templates/node-basic/AGENTS.md

@@ -27,13 +27,13 @@ When `docs: true` is set in `new App({...})`, three routes are auto-mounted:
 
 ## Imports
 
-This project uses TypeScript with `"module": "NodeNext"` (ESM). Relative imports **must include a `.js` extension**, even when the source file is `.ts`:
+This project uses TypeScript with `"module": "NodeNext"` plus `"rewriteRelativeImportExtensions"`, so relative imports use the **`.ts` extension** — the actual file you see on disk:
 
 ```ts
-import { buildApp } from "./build-app.js"; // resolves to build-app.ts at typecheck, build-app.js at runtime
+import { buildApp } from "./build-app.ts";
 ```
 
-This is the official Node.js ESM convention — TypeScript rewrites the specifier during typecheck, and the compiled output really is `.js`. Bare-specifier imports from packages (`@daloyjs/core`, `zod`, …) do not need an extension.
+You import the file you see. On `pnpm build`, TypeScript rewrites the `.ts` specifier to `.js` in the compiled `dist/` output, so the deployed code is still valid Node ESM. (Node ESM has no extensionless relative imports — `.ts` is the most natural form available.) Bare-specifier imports from packages (`@daloyjs/core`, `zod`, …) do not need an extension.
 
 ## Core rules
 

package/templates/node-basic/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

package/templates/node-basic/README.md

@@ -48,13 +48,13 @@ node dist/index.js
 
 ## Imports
 
-This project uses Node.js **ESM** with `"module": "NodeNext"`. Relative imports must include a `.js` extension, even when the source file is `.ts`:
+This project uses Node.js **ESM** with `"module": "NodeNext"` and `"rewriteRelativeImportExtensions"`. Relative imports use the `.ts` extension — the actual file on disk:
 
 ```ts
-import { buildApp } from "./build-app.js"; // ./build-app.ts on disk
+import { buildApp } from "./build-app.ts";
 ```
 
-TypeScript resolves the `.js` specifier to the matching `.ts` file at typecheck, and the compiled output really is `.js`. This is the official Node ESM convention — not a typo.
+On `pnpm build`, TypeScript rewrites the `.ts` specifier to `.js` in the compiled `dist/` output, so the deployed code is valid Node ESM. (Node ESM has no extensionless relative imports — `.ts` is the most natural form available.)
 
 ## What's included
 

package/templates/node-basic/_agents/skills/daloyjs-best-practices/SKILL.md

@@ -1,3 +1,13 @@
+---
+name: daloyjs-best-practices
+description: >-
+  Best practices for building, testing, and hardening this DaloyJS REST API on
+  Node.js. Use when adding or changing HTTP routes, Zod schemas, middleware, or
+  error handling; regenerating the OpenAPI spec or the typed Hey API client; or
+  working on auth, rate limits, secrets, and the project's quality gates.
+license: MIT
+---
+
 # SKILL.md — DaloyJS best practices (Node)
 
 Operational guidance and best practices for AI coding agents working in this

package/templates/node-basic/package.json

@@ -18,7 +18,7 @@
     "audit": "pnpm audit --prod"
   },
   "dependencies": {
-    "@daloyjs/core": "^0.36.0",
+    "@daloyjs/core": "^0.38.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/node-basic/scripts/dump-openapi.ts

@@ -1,6 +1,6 @@
 import { writeFile, mkdir } from "node:fs/promises";
 import { generateOpenAPI } from "@daloyjs/core/openapi";
-import { buildApp } from "../src/build-app.js";
+import { buildApp } from "../src/build-app.ts";
 
 // Build a fresh app from the factory so the spec dump never starts the HTTP
 // listener as a side effect. Keep this script deterministic so codegen output

package/templates/node-basic/src/index.ts

@@ -1,6 +1,6 @@
 import { serve } from "@daloyjs/core/node";
 import { printStartupBanner, type StartupBannerLink } from "@daloyjs/core/banner";
-import { buildApp } from "./build-app.js";
+import { buildApp } from "./build-app.ts";
 
 const app = buildApp();
 const port = Number(process.env.PORT ?? 3000);

package/templates/node-basic/tsconfig.json

@@ -11,7 +11,9 @@
     "esModuleInterop": true,
     "skipLibCheck": true,
     "forceConsistentCasingInFileNames": true,
-    "resolveJsonModule": true
+    "resolveJsonModule": true,
+    "allowImportingTsExtensions": true,
+    "rewriteRelativeImportExtensions": true
   },
   "include": ["src/**/*", "scripts/**/*", "tests/**/*"],
   "exclude": ["node_modules", "dist"]

package/templates/vercel-edge/AGENTS.md

@@ -21,13 +21,13 @@ A [DaloyJS](https://daloyjs.dev) REST API deployed to **Vercel Edge**. **Contrac
 
 ## Imports
 
-This project uses TypeScript with `"module": "NodeNext"` (ESM). Relative imports **must include a `.js` extension**, even when the source file is `.ts`:
+This project uses TypeScript with `"allowImportingTsExtensions"`, so relative imports use the **`.ts` extension** — the actual file you see on disk:
 
 ```ts
-import handler from "../api/[...path].js"; // resolves to the .ts source at typecheck, .js at runtime
+import handler from "../api/[...path].ts";
 ```
 
-This is the official Node.js ESM convention — TypeScript rewrites the specifier during typecheck, and the deployed output really is `.js`. Bare-specifier imports from packages (`@daloyjs/core`, `zod`, …) do not need an extension.
+You import the file you see. Vercel bundles the `api/` functions at deploy time and resolves `.ts` directly, and the test runner (tsx) does too. Bare-specifier imports from packages (`@daloyjs/core`, `zod`, …) do not need an extension.
 
 ## Core rules
 

package/templates/vercel-edge/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

package/templates/vercel-edge/README.md

@@ -59,13 +59,13 @@ That catch-all API route lets DaloyJS own routing while Vercel handles the runti
 
 ## Imports
 
-This project uses TypeScript with `"module": "NodeNext"` (ESM). Relative imports must include a `.js` extension, even when the source file is `.ts`:
+This project uses TypeScript with `"allowImportingTsExtensions"`. Relative imports use the `.ts` extension — the actual file on disk:
 
 ```ts
-import handler from "../api/[...path].js"; // ../api/[...path].ts on disk
+import handler from "../api/[...path].ts";
 ```
 
-TypeScript resolves the `.js` specifier to the matching `.ts` file at typecheck, and the deployed output really is `.js`. This is the official Node ESM convention — not a typo.
+Vercel bundles the `api/` functions at deploy time and resolves `.ts` directly, and the test runner (tsx) does too.
 
 ## What's included
 

package/templates/vercel-edge/_agents/skills/daloyjs-best-practices/SKILL.md

@@ -1,3 +1,15 @@
+---
+name: daloyjs-best-practices
+description: >-
+  Best practices for building, testing, and hardening this DaloyJS REST API on
+  Vercel Edge. Use when adding or changing HTTP routes, Zod schemas,
+  middleware, or error handling; regenerating the OpenAPI spec or the typed
+  Hey API client; keeping the catch-all Edge entrypoint and Web-Standard
+  runtime constraints; or working on auth, rate limits, secrets, and the
+  project's quality gates.
+license: MIT
+---
+
 # SKILL.md — DaloyJS best practices (Vercel Edge)
 
 Operational guidance and best practices for AI coding agents working in this

package/templates/vercel-edge/package.json

@@ -11,7 +11,7 @@
     "audit": "pnpm audit --prod"
   },
   "dependencies": {
-    "@daloyjs/core": "^0.36.0",
+    "@daloyjs/core": "^0.38.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/vercel-edge/tests/app.test.ts

@@ -1,6 +1,6 @@
 import assert from "node:assert/strict";
 import test from "node:test";
-import handler from "../api/[...path].js";
+import handler from "../api/[...path].ts";
 
 test("Vercel Edge handler responds through DaloyJS", async () => {
   const response = await handler(new Request("https://example.test/healthz"));

package/templates/vercel-edge/tsconfig.json

@@ -12,7 +12,8 @@
     "forceConsistentCasingInFileNames": true,
     "resolveJsonModule": true,
     "isolatedModules": true,
-    "noEmit": true
+    "noEmit": true,
+    "allowImportingTsExtensions": true
   },
   "include": ["api/**/*.ts", "tests/**/*.ts"]
 }