create-daloy 0.38.0 → 0.38.1

package/README.md

@@ -120,6 +120,20 @@ A [Deno](https://deno.com) runtime starter using `@daloyjs/core/deno` with:
 - A health route and contract-first `/books/:id` route with Zod validation.
 - The CLI skips Node-style installs for this template (no `package.json`).
 
+## Authentication (OAuth2 / OpenID Connect)
+
+Scaffolded apps are **resource servers**: DaloyJS verifies and enforces access
+tokens, it does **not** issue them. There is no built-in login UI, user
+database, or OAuth2 authorization server (it is not an identity provider like
+Keycloak, Auth0, or Duende IdentityServer). To add login, bring an OpenID
+Connect provider — managed (Auth0, Okta, Clerk, Microsoft Entra ID, AWS
+Cognito) or self-hosted open source (Keycloak, Zitadel, Ory, Logto) — and have
+DaloyJS verify its JWTs with the first-party `jwk()`, `bearerAuth()`, and
+`requireScopes()` helpers. Don't build your own authorization server.
+
+See [Auth architecture](https://daloyjs.dev/docs/auth/architecture) for the full
+picture and the two recommended designs (API resource server and browser BFF).
+
 ## Minimal scaffolds
 
 Pass `--minimal` to drop the bookstore demo route and the built-in

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-daloy",
-  "version": "0.38.0",
+  "version": "0.38.1",
   "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
   "type": "module",
   "license": "MIT",

package/sbom.cdx.json

@@ -1,25 +1,25 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:b1a2eb69-121b-5cae-87a9-5d036a3e1a7a",
+  "serialNumber": "urn:uuid:5874d6d1-4f7c-5889-b1dc-59abaf86bc40",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-10T11:58:38.391Z",
+    "timestamp": "2026-06-11T09:54:26.989Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "0.38.0"
+        "version": "0.38.1"
       }
     ],
     "authors": [],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/create-daloy@0.38.0",
+      "bom-ref": "pkg:npm/create-daloy@0.38.1",
       "name": "create-daloy",
-      "version": "0.38.0",
+      "version": "0.38.1",
       "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
-      "purl": "pkg:npm/create-daloy@0.38.0",
+      "purl": "pkg:npm/create-daloy@0.38.1",
       "licenses": [
         {
           "license": {
@@ -42,9 +42,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag-create-daloy-0.38.0",
+        "tagId": "swidtag-create-daloy-0.38.1",
         "name": "create-daloy",
-        "version": "0.38.0",
+        "version": "0.38.1",
         "tagVersion": 0,
         "patch": false
       }
@@ -53,7 +53,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/create-daloy@0.38.0",
+      "ref": "pkg:npm/create-daloy@0.38.1",
       "dependsOn": []
     }
   ]

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "create-daloy-0.38.0",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/create-daloy-0.38.0-b1a2eb69-121b-5cae-87a9-5d036a3e1a7a",
+  "name": "create-daloy-0.38.1",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/create-daloy-0.38.1-5874d6d1-4f7c-5889-b1dc-59abaf86bc40",
   "creationInfo": {
-    "created": "2026-06-10T11:58:38.391Z",
+    "created": "2026-06-11T09:54:26.989Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package-create-daloy",
       "name": "create-daloy",
-      "versionInfo": "0.38.0",
+      "versionInfo": "0.38.1",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/create-daloy@0.38.0"
+          "referenceLocator": "pkg:npm/create-daloy@0.38.1"
         }
       ]
     }

package/templates/_ci/deno/_github/workflows/codeql.yml

@@ -44,13 +44,13 @@ jobs:
           show-progress: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@52485aec7be33610227643b0fe83936b8b5f061a # v3
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
           queries: security-extended,security-and-quality
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@52485aec7be33610227643b0fe83936b8b5f061a # v3
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           category: "/language:${{ matrix.language }}"

package/templates/_ci/deno/_github/workflows/container-scan.yml

@@ -139,7 +139,7 @@ jobs:
 
       - name: Upload hadolint SARIF
         if: steps.detect.outputs.present == 'true'
-        uses: github/codeql-action/upload-sarif@52485aec7be33610227643b0fe83936b8b5f061a # v3
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           sarif_file: hadolint.sarif
           category: hadolint
@@ -162,7 +162,7 @@ jobs:
           exit-code: "0"
 
       - name: Upload Trivy filesystem SARIF
-        uses: github/codeql-action/upload-sarif@52485aec7be33610227643b0fe83936b8b5f061a # v3
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           sarif_file: trivy-fs.sarif
           category: trivy-fs
@@ -186,7 +186,7 @@ jobs:
 
       - name: Upload Trivy image SARIF
         if: always() && steps.detect.outputs.present == 'true'
-        uses: github/codeql-action/upload-sarif@52485aec7be33610227643b0fe83936b8b5f061a # v3
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           sarif_file: trivy-image.sarif
           category: trivy-image

package/templates/_ci/deno/_github/workflows/opengrep.yml

@@ -131,7 +131,7 @@ jobs:
 
       - name: Upload SARIF to GitHub code scanning
         if: always()
-        uses: github/codeql-action/upload-sarif@52485aec7be33610227643b0fe83936b8b5f061a # v3
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           sarif_file: opengrep.sarif
           category: opengrep

package/templates/_ci/deno/_github/workflows/scorecard.yml

@@ -41,6 +41,6 @@ jobs:
           publish_results: true
 
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           sarif_file: results.sarif

package/templates/_ci/node/_github/workflows/codeql.yml

@@ -44,13 +44,13 @@ jobs:
           show-progress: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@52485aec7be33610227643b0fe83936b8b5f061a # v3
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
           queries: security-extended,security-and-quality
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@52485aec7be33610227643b0fe83936b8b5f061a # v3
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           category: "/language:${{ matrix.language }}"

package/templates/_ci/node/_github/workflows/container-scan.yml

@@ -157,7 +157,7 @@ jobs:
 
       - name: Upload hadolint SARIF
         if: steps.detect.outputs.present == 'true'
-        uses: github/codeql-action/upload-sarif@52485aec7be33610227643b0fe83936b8b5f061a # v3
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           sarif_file: hadolint.sarif
           category: hadolint
@@ -180,7 +180,7 @@ jobs:
           exit-code: "0"
 
       - name: Upload Trivy filesystem SARIF
-        uses: github/codeql-action/upload-sarif@52485aec7be33610227643b0fe83936b8b5f061a # v3
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           sarif_file: trivy-fs.sarif
           category: trivy-fs
@@ -207,7 +207,7 @@ jobs:
 
       - name: Upload Trivy image SARIF
         if: always() && steps.detect.outputs.present == 'true'
-        uses: github/codeql-action/upload-sarif@52485aec7be33610227643b0fe83936b8b5f061a # v3
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           sarif_file: trivy-image.sarif
           category: trivy-image

package/templates/_ci/node/_github/workflows/opengrep.yml

@@ -163,7 +163,7 @@ jobs:
 
       - name: Upload SARIF to GitHub code scanning
         if: always()
-        uses: github/codeql-action/upload-sarif@52485aec7be33610227643b0fe83936b8b5f061a # v3
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           sarif_file: opengrep.sarif
           category: opengrep

package/templates/_ci/node/_github/workflows/scorecard.yml

@@ -41,6 +41,6 @@ jobs:
           publish_results: true
 
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           sarif_file: results.sarif

package/templates/bun-basic/README.md

@@ -63,4 +63,18 @@ Do not use `.js` here — that's the Node NodeNext convention and will not resol
 - Hot reload via `bun --hot`.
 - Hey API codegen wired to `bun run gen:openapi` + `bun run gen:client`.
 
+## Authentication (OAuth2 / OpenID Connect)
+
+This app is a **resource server**: DaloyJS verifies and enforces access tokens,
+it does **not** issue them. There is no built-in login UI, user database, or
+OAuth2 authorization server (it is not an identity provider like Keycloak,
+Auth0, or Duende IdentityServer). To add login, bring an OpenID Connect provider
+— managed (Auth0, Okta, Clerk, Microsoft Entra ID, AWS Cognito) or self-hosted
+open source (Keycloak, Zitadel, Ory, Logto) — and verify its JWTs with the
+first-party `jwk()`, `bearerAuth()`, and `requireScopes()` helpers. Don't build
+your own authorization server.
+
+See [Auth architecture](https://daloyjs.dev/docs/auth/architecture) for the
+recommended designs (API resource server and browser BFF).
+
 Read the docs at <https://daloyjs.dev/docs>.

package/templates/bun-basic/package.json

@@ -17,7 +17,7 @@
     "audit": "pnpm audit --prod"
   },
   "dependencies": {
-    "@daloyjs/core": "^0.38.0",
+    "@daloyjs/core": "^0.38.1",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/cloudflare-worker/README.md

@@ -22,3 +22,19 @@ pnpm deploy
 - `@daloyjs/core/cloudflare` with starter security middleware: `secureHeaders` and `requestId`.
 - Smaller edge-friendly body and timeout limits in the generated app.
 - `wrangler.toml` ready for local development and deploys.
+
+## Authentication (OAuth2 / OpenID Connect)
+
+This app is a **resource server**: DaloyJS verifies and enforces access tokens,
+it does **not** issue them. There is no built-in login UI, user database, or
+OAuth2 authorization server (it is not an identity provider like Keycloak,
+Auth0, or Duende IdentityServer). To add login, bring an OpenID Connect provider
+— managed (Auth0, Okta, Clerk, Microsoft Entra ID, AWS Cognito) or self-hosted
+open source (Keycloak, Zitadel, Ory, Logto) — and verify its JWTs with the
+first-party `jwk()`, `bearerAuth()`, and `requireScopes()` helpers. Don't build
+your own authorization server.
+
+See [Auth architecture](https://daloyjs.dev/docs/auth/architecture) for the
+recommended designs (API resource server and browser BFF).
+
+Read the docs at <https://daloyjs.dev/docs>.

package/templates/cloudflare-worker/package.json

@@ -11,7 +11,7 @@
     "audit": "pnpm audit --prod"
   },
   "dependencies": {
-    "@daloyjs/core": "^0.38.0",
+    "@daloyjs/core": "^0.38.1",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/deno-basic/README.md

@@ -56,4 +56,18 @@ deno task test
 <!-- daloy-minimal:strip-end books -->
 - Minimal permissions: `--allow-net --allow-env --allow-read` for `dev`.
 
+## Authentication (OAuth2 / OpenID Connect)
+
+This app is a **resource server**: DaloyJS verifies and enforces access tokens,
+it does **not** issue them. There is no built-in login UI, user database, or
+OAuth2 authorization server (it is not an identity provider like Keycloak,
+Auth0, or Duende IdentityServer). To add login, bring an OpenID Connect provider
+— managed (Auth0, Okta, Clerk, Microsoft Entra ID, AWS Cognito) or self-hosted
+open source (Keycloak, Zitadel, Ory, Logto) — and verify its JWTs with the
+first-party `jwk()`, `bearerAuth()`, and `requireScopes()` helpers. Don't build
+your own authorization server.
+
+See [Auth architecture](https://daloyjs.dev/docs/auth/architecture) for the
+recommended designs (API resource server and browser BFF).
+
 Read the docs at <https://daloyjs.dev/docs>.

package/templates/deno-basic/deno.json

@@ -8,10 +8,10 @@
     "gen:openapi": "deno run --allow-net --allow-env --allow-read --allow-write scripts/dump-openapi.ts"
   },
   "imports": {
-    "@daloyjs/core": "jsr:@daloyjs/daloy@^0.38.0",
-    "@daloyjs/core/banner": "jsr:@daloyjs/daloy@^0.38.0/banner",
-    "@daloyjs/core/deno": "jsr:@daloyjs/daloy@^0.38.0/deno",
-    "@daloyjs/core/openapi": "jsr:@daloyjs/daloy@^0.38.0/openapi",
+    "@daloyjs/core": "jsr:@daloyjs/daloy@^0.38.1",
+    "@daloyjs/core/banner": "jsr:@daloyjs/daloy@^0.38.1/banner",
+    "@daloyjs/core/deno": "jsr:@daloyjs/daloy@^0.38.1/deno",
+    "@daloyjs/core/openapi": "jsr:@daloyjs/daloy@^0.38.1/openapi",
     "zod": "npm:zod@^4.4.3"
   },
   "compilerOptions": {

package/templates/node-basic/README.md

@@ -65,4 +65,18 @@ On `pnpm build`, TypeScript rewrites the `.ts` specifier to `.js` in the compile
 - Hardened `.npmrc` for safer installs.
 - Hey API codegen wired to `pnpm gen`.
 
+## Authentication (OAuth2 / OpenID Connect)
+
+This app is a **resource server**: DaloyJS verifies and enforces access tokens,
+it does **not** issue them. There is no built-in login UI, user database, or
+OAuth2 authorization server (it is not an identity provider like Keycloak,
+Auth0, or Duende IdentityServer). To add login, bring an OpenID Connect provider
+— managed (Auth0, Okta, Clerk, Microsoft Entra ID, AWS Cognito) or self-hosted
+open source (Keycloak, Zitadel, Ory, Logto) — and verify its JWTs with the
+first-party `jwk()`, `bearerAuth()`, and `requireScopes()` helpers. Don't build
+your own authorization server.
+
+See [Auth architecture](https://daloyjs.dev/docs/auth/architecture) for the
+recommended designs (API resource server and browser BFF).
+
 Read the docs at <https://daloyjs.dev/docs>.

package/templates/node-basic/package.json

@@ -18,7 +18,7 @@
     "audit": "pnpm audit --prod"
   },
   "dependencies": {
-    "@daloyjs/core": "^0.38.0",
+    "@daloyjs/core": "^0.38.1",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/vercel-edge/README.md

@@ -77,3 +77,17 @@ Vercel bundles the `api/` functions at deploy time and resolves `.ts` directly,
   <!-- daloy-minimal:strip-start docs -->
 - A Scalar API reference UI at `/docs`, plus live OpenAPI 3.1 specs at `/openapi.json` and `/openapi.yaml`.
 <!-- daloy-minimal:strip-end docs -->
+
+## Authentication (OAuth2 / OpenID Connect)
+
+This app is a **resource server**: DaloyJS verifies and enforces access tokens,
+it does **not** issue them. There is no built-in login UI, user database, or
+OAuth2 authorization server (it is not an identity provider like Keycloak,
+Auth0, or Duende IdentityServer). To add login, bring an OpenID Connect provider
+— managed (Auth0, Okta, Clerk, Microsoft Entra ID, AWS Cognito) or self-hosted
+open source (Keycloak, Zitadel, Ory, Logto) — and verify its JWTs with the
+first-party `jwk()`, `bearerAuth()`, and `requireScopes()` helpers. Don't build
+your own authorization server.
+
+See [Auth architecture](https://daloyjs.dev/docs/auth/architecture) for the
+recommended designs (API resource server and browser BFF).

package/templates/vercel-edge/package.json

@@ -11,7 +11,7 @@
     "audit": "pnpm audit --prod"
   },
   "dependencies": {
-    "@daloyjs/core": "^0.38.0",
+    "@daloyjs/core": "^0.38.1",
     "zod": "^4.4.3"
   },
   "devDependencies": {