create-daloy 1.0.0-beta.2 → 1.0.0-beta.4

package/README.md

@@ -196,6 +196,11 @@ For Node-style templates, the bundle adds the following.
   [npm-audit-guide](https://www.aikido.dev/blog/npm-audit-guide) write-ups warn
   about, and the Deno scaffold gets it too (Deno has no `audit` built in, so
   without OSV-Scanner a Deno scaffold would have no scheduled SCA at all).
+- `.github/workflows/eol-scan.yml` — daily runtime end-of-life detection for
+  pinned Node, Bun, and Deno versions in package metadata and GitHub Actions.
+  A runtime can keep running after it stops receiving security patches; this
+  job fails once a pinned runtime cycle is already EOL and warns within 90 days
+  of EOL.
 
 **Secret and static analysis**
 
@@ -235,8 +240,9 @@ out a reusable package, opt into npm trusted publishing yourself.
 For `deno-basic`, `--with-ci` generates a Deno-native CI workflow, a manual-only
 container publish starter for GHCR that is guarded to `main` or a tag by
 default, plus CodeQL, Opengrep, **OSV-Scanner** (the only scheduled SCA layer
-a Deno scaffold has, since Deno ships no `audit`), Scorecard, zizmor,
-Dependabot for GitHub Actions, CODEOWNERS, and `SECURITY.md`.
+a Deno scaffold has, since Deno ships no `audit`), runtime EOL scanning,
+Scorecard, zizmor, Dependabot for GitHub Actions, CODEOWNERS, and
+`SECURITY.md`.
 
 If you want the governance bundle but not the deployment starter, pass
 `--with-ci --no-deploy`. If you only want a deployment starter, pass

package/bin/create-daloy.mjs

@@ -1137,14 +1137,26 @@ async function writePackageJson(dir, packageJson) {
   await writeFile(path.join(dir, "package.json"), JSON.stringify(packageJson, null, 2) + "\n", "utf8");
 }
 
-async function addLockfileVerifyScript(dir) {
+async function addSecurityScripts(dir, packageManager) {
   const packageJson = await readPackageJsonIfPresent(dir);
   if (!packageJson) return;
   packageJson.scripts ??= {};
   packageJson.scripts["verify:lockfile"] = "node scripts/verify-lockfile-sources.mjs";
+  packageJson.scripts["verify:runtime-eol"] =
+    packageManager === "bun" ? "bun scripts/verify-runtime-eol.mjs" : "node scripts/verify-runtime-eol.mjs";
   await writePackageJson(dir, packageJson);
 }
 
+async function addDenoSecurityTasks(dir) {
+  const file = path.join(dir, "deno.json");
+  if (!existsSync(file)) return;
+  const denoJson = JSON.parse(await readFile(file, "utf8"));
+  denoJson.tasks ??= {};
+  denoJson.tasks["verify:runtime-eol"] =
+    "deno run --allow-read --allow-net=endoflife.date scripts/verify-runtime-eol.mjs";
+  await writeFile(file, JSON.stringify(denoJson, null, 2) + "\n", "utf8");
+}
+
 function renderCiReplacements({ packageManager, template, packageJson, codeOwner, includeSecurityBundle = true }) {
   const setupPm = setupPackageManagerStep(packageManager);
   const needsBunRuntime = template === "bun-basic" && packageManager !== "bun";
@@ -1183,6 +1195,7 @@ function renderCiReplacements({ packageManager, template, packageJson, codeOwner
     ["__SETUP_BUN_RUNTIME_STEP__", needsBunRuntime ? setupBunStep() : ""],
     ["__INSTALL_COMMAND__", installCommand(packageManager)],
     ["__VERIFY_LOCKFILE_COMMAND__", runScriptCommand(packageManager, "verify:lockfile")],
+    ["__RUNTIME_EOL_COMMAND__", runScriptCommand(packageManager, "verify:runtime-eol")],
     ["__TYPECHECK_COMMAND__", runScriptCommand(packageManager, "typecheck")],
     ["__TEST_COMMAND__", runScriptCommand(packageManager, "test")],
     ["__BUILD_STEP__", buildStep],
@@ -1217,14 +1230,15 @@ async function replacePlaceholdersInTree(dir, replacements) {
 async function pruneCiBundle(targetDir, flavor, { includeSecurityBundle, includeDeployWorkflow }) {
   if (!includeSecurityBundle) {
     const workflowFiles = flavor === "deno"
-      ? ["ci.yml", "codeql.yml", "container-scan.yml", "dast.yml", "opengrep.yml", "osv-scan.yml", "scorecard.yml", "secret-scan.yml", "zizmor.yml"]
-      : ["ci.yml", "codeql.yml", "container-scan.yml", "dast.yml", "opengrep.yml", "osv-scan.yml", "scorecard.yml", "secret-scan.yml", "vuln-scan.yml", "zizmor.yml"];
+      ? ["ci.yml", "codeql.yml", "container-scan.yml", "dast.yml", "eol-scan.yml", "opengrep.yml", "osv-scan.yml", "scorecard.yml", "secret-scan.yml", "zizmor.yml"]
+      : ["ci.yml", "codeql.yml", "container-scan.yml", "dast.yml", "eol-scan.yml", "opengrep.yml", "osv-scan.yml", "scorecard.yml", "secret-scan.yml", "vuln-scan.yml", "zizmor.yml"];
     for (const file of workflowFiles) {
       await rm(path.join(targetDir, ".github", "workflows", file), { force: true });
     }
     await rm(path.join(targetDir, ".github", "dependabot.yml"), { force: true });
     await rm(path.join(targetDir, ".github", "CODEOWNERS"), { force: true });
     await rm(path.join(targetDir, "SECURITY.md"), { force: true });
+    await rm(path.join(targetDir, "scripts", "verify-runtime-eol.mjs"), { force: true });
     if (flavor === "node") {
       await rm(path.join(targetDir, "scripts", "verify-lockfile-sources.mjs"), { force: true });
     }
@@ -1264,6 +1278,9 @@ async function copyCiBundle(
         `Invalid --code-owner "${candidate}". Use a GitHub handle (@user), a team (@org/team), or an email address.`,
       );
     }
+    if (includeSecurityBundle) {
+      await addDenoSecurityTasks(targetDir);
+    }
     await replacePlaceholdersInTree(targetDir, new Map([["__CODE_OWNER__", owner]]));
     return;
   }
@@ -1274,7 +1291,7 @@ async function copyCiBundle(
         `Invalid --code-owner "${candidate}". Use a GitHub handle (@user), a team (@org/team), or an email address.`,
       );
     }
-    await addLockfileVerifyScript(targetDir);
+    await addSecurityScripts(targetDir, packageManager);
   }
   const packageJson = await readPackageJsonIfPresent(targetDir);
   await replacePlaceholdersInTree(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-daloy",
-  "version": "1.0.0-beta.2",
+  "version": "1.0.0-beta.4",
   "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
   "type": "module",
   "license": "MIT",

package/sbom.cdx.json

@@ -1,25 +1,25 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:85335f39-314a-5935-b7db-6add01a96fca",
+  "serialNumber": "urn:uuid:1f97437c-9665-5c96-94a2-d8d548acda4b",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-22T21:07:22.648Z",
+    "timestamp": "2026-06-26T13:41:50.237Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "1.0.0-beta.2"
+        "version": "1.0.0-beta.4"
       }
     ],
     "authors": [],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/create-daloy@1.0.0-beta.2",
+      "bom-ref": "pkg:npm/create-daloy@1.0.0-beta.4",
       "name": "create-daloy",
-      "version": "1.0.0-beta.2",
+      "version": "1.0.0-beta.4",
       "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
-      "purl": "pkg:npm/create-daloy@1.0.0-beta.2",
+      "purl": "pkg:npm/create-daloy@1.0.0-beta.4",
       "licenses": [
         {
           "license": {
@@ -42,9 +42,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag-create-daloy-1.0.0-beta.2",
+        "tagId": "swidtag-create-daloy-1.0.0-beta.4",
         "name": "create-daloy",
-        "version": "1.0.0-beta.2",
+        "version": "1.0.0-beta.4",
         "tagVersion": 0,
         "patch": false
       }
@@ -53,7 +53,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/create-daloy@1.0.0-beta.2",
+      "ref": "pkg:npm/create-daloy@1.0.0-beta.4",
       "dependsOn": []
     }
   ]

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "create-daloy-1.0.0-beta.2",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/create-daloy-1.0.0-beta.2-85335f39-314a-5935-b7db-6add01a96fca",
+  "name": "create-daloy-1.0.0-beta.4",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/create-daloy-1.0.0-beta.4-1f97437c-9665-5c96-94a2-d8d548acda4b",
   "creationInfo": {
-    "created": "2026-06-22T21:07:22.648Z",
+    "created": "2026-06-26T13:41:50.237Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package-create-daloy",
       "name": "create-daloy",
-      "versionInfo": "1.0.0-beta.2",
+      "versionInfo": "1.0.0-beta.4",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/create-daloy@1.0.0-beta.2"
+          "referenceLocator": "pkg:npm/create-daloy@1.0.0-beta.4"
         }
       ]
     }

package/templates/_ci/deno/SECURITY.md

@@ -27,6 +27,9 @@ The `--with-ci` bundle adds these defaults:
   Semgrep, verified via sigstore cosign before execution), OpenSSF
   Scorecard, zizmor, Dependabot for GitHub Actions and Docker
 	base images, and CODEOWNERS are generated.
+- A daily scheduled `eol-scan.yml` checks pinned Deno versions in `deno.json`
+  and GitHub Actions against endoflife.date so a runtime that has stopped
+  receiving security patches does not stay unnoticed on `main`.
 - A `secret-scan.yml` workflow runs [gitleaks](https://github.com/gitleaks/gitleaks) against the working tree on every PR / push and against the **full git history** on a daily schedule. The gitleaks binary is downloaded from a pinned official release and verified by SHA-256 before execution so the scan does not introduce a new third-party action into the supply chain. Findings block the merge; matched values are redacted from the public log. The rationale (and the remediation playbook for a confirmed leak) follows Aikido's [Secrets Detection guide](https://www.aikido.dev/blog/secret-detection-application-security): a secret in any commit, branch, or tag should be treated as compromised, and detection must consider the entire history — not just the latest snapshot — alongside GitHub-native push protection.
 
 ## Cloud posture (operator checklist)
@@ -62,4 +65,4 @@ Before relying on these files for a company project:
 1. Replace `@your-org/security-team` in `.github/CODEOWNERS` or pass `--code-owner` when scaffolding.
 2. Protect the `main` branch and require the CI, CodeQL, Opengrep, Scorecard, and zizmor checks.
 3. Enable GitHub secret scanning and push protection.
-4. Keep Deno permissions narrow; do not switch tasks to `--allow-all`.
+4. Keep Deno permissions narrow; do not switch tasks to `--allow-all`.

package/templates/_ci/deno/_github/workflows/eol-scan.yml

@@ -0,0 +1,57 @@
+# End-of-life runtime scan generated by create-daloy --with-ci.
+#
+# Why this exists:
+#   A Deno version can keep running after it stops receiving security patches.
+#   This scheduled check looks at pinned runtime versions in deno.json and
+#   GitHub Actions, then compares them with endoflife.date so old runtime pins
+#   do not sit unnoticed on main.
+#
+# Hardening:
+#   * `permissions: {}` at the top level; the job opts in to contents: read.
+#   * Third-party actions are SHA-pinned and managed by Dependabot.
+#   * `step-security/harden-runner` runs in audit mode.
+#   * `actions/checkout` runs with `persist-credentials: false`.
+
+name: EOL runtime scan
+
+on:
+  schedule:
+    # 08:21 UTC daily, offset from the other scheduled security scans.
+    - cron: "21 8 * * *"
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: eol-scan-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  eol:
+    name: Daily EOL runtime scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2
+        with:
+          egress-policy: audit
+          disable-sudo: true
+          disable-file-monitoring: false
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          show-progress: false
+
+      - name: Set up Deno
+        uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2.0.4
+        with:
+          deno-version: v2.x
+
+      - name: Verify pinned runtimes are not EOL
+        run: deno task verify:runtime-eol

package/templates/_ci/deno/scripts/verify-runtime-eol.mjs

@@ -0,0 +1,211 @@
+const EOL_WARN_DAYS = 90;
+const FETCH_TIMEOUT_MS = 10_000;
+const RUNTIME_FEEDS = {
+  node: "nodejs",
+  bun: "bun",
+  deno: "deno",
+};
+
+const isDeno = typeof globalThis.Deno !== "undefined";
+const args = isDeno ? globalThis.Deno.args : globalThis.process.argv.slice(2);
+const cwd = isDeno ? globalThis.Deno.cwd() : globalThis.process.cwd();
+
+function joinPath(...parts) {
+  return parts.filter(Boolean).join("/").replace(/\/+/g, "/");
+}
+
+async function readText(file) {
+  if (isDeno) return await globalThis.Deno.readTextFile(file);
+  const { readFile } = await import("node:fs/promises");
+  return await readFile(file, "utf8");
+}
+
+async function readDirNames(dir) {
+  if (isDeno) {
+    const out = [];
+    for await (const entry of globalThis.Deno.readDir(dir)) out.push(entry.name);
+    return out;
+  }
+  const { readdir } = await import("node:fs/promises");
+  return await readdir(dir);
+}
+
+function parseVersionKey(value) {
+  if (typeof value !== "string") return null;
+  if (/latest/i.test(value)) return null;
+  const match = value.match(/v?\D*(\d+)(?:\.(\d+))?/);
+  if (!match) return null;
+  return match[2] ? `${Number(match[1])}.${Number(match[2])}` : String(Number(match[1]));
+}
+
+function collectFromPackageJson(json, source) {
+  const out = [];
+  const engines = json && typeof json === "object" ? json.engines : null;
+  if (!engines || typeof engines !== "object") return out;
+  for (const runtime of Object.keys(RUNTIME_FEEDS)) {
+    const version = parseVersionKey(engines[runtime]);
+    if (version) out.push({ runtime, version, source: `${source}: engines.${runtime}` });
+  }
+  return out;
+}
+
+function collectFromDenoJson(json, source) {
+  const out = [];
+  const version = parseVersionKey(json?.runtime?.deno ?? json?.engines?.deno);
+  if (version) out.push({ runtime: "deno", version, source: `${source}: deno runtime` });
+  return out;
+}
+
+function collectFromWorkflow(yaml, source) {
+  const out = [];
+  const patterns = [
+    ["node", /node-version:\s*['"]?([^'"\n#]+)/g],
+    ["bun", /bun-version:\s*['"]?([^'"\n#]+)/g],
+    ["deno", /deno-version:\s*['"]?([^'"\n#]+)/g],
+  ];
+  for (const [runtime, pattern] of patterns) {
+    let match = null;
+    while ((match = pattern.exec(yaml)) !== null) {
+      const version = parseVersionKey(match[1]);
+      if (version) out.push({ runtime, version, source });
+    }
+  }
+  return out;
+}
+
+async function collectPinnedVersions() {
+  const found = [];
+  try {
+    found.push(...collectFromPackageJson(JSON.parse(await readText(joinPath(cwd, "package.json"))), "package.json"));
+  } catch {
+    // No package.json is fine for Deno-native scaffolds.
+  }
+  try {
+    found.push(...collectFromDenoJson(JSON.parse(await readText(joinPath(cwd, "deno.json"))), "deno.json"));
+  } catch {
+    // Node/Bun scaffolds do not ship deno.json.
+  }
+  try {
+    const workflowsDir = joinPath(cwd, ".github", "workflows");
+    for (const name of await readDirNames(workflowsDir)) {
+      if (!/\.(ya?ml)$/.test(name)) continue;
+      found.push(...collectFromWorkflow(await readText(joinPath(workflowsDir, name)), `.github/workflows/${name}`));
+    }
+  } catch {
+    // A local run without GitHub workflows should still scan package metadata.
+  }
+  return found;
+}
+
+async function fetchFeed(runtime) {
+  const feed = RUNTIME_FEEDS[runtime];
+  const ac = new AbortController();
+  const timer = setTimeout(() => ac.abort(), FETCH_TIMEOUT_MS);
+  try {
+    const res = await fetch(`https://endoflife.date/api/${feed}.json`, {
+      headers: {
+        "User-Agent": "daloy-runtime-eol-scan/1",
+        Accept: "application/json",
+      },
+      signal: ac.signal,
+    });
+    if (!res.ok) throw new Error(`${feed} feed returned HTTP ${res.status}`);
+    const json = await res.json();
+    if (!Array.isArray(json)) throw new Error(`${feed} feed returned a non-array payload`);
+    return json;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+function cycleNumber(cycle) {
+  const n = Number.parseFloat(String(cycle));
+  return Number.isFinite(n) ? n : -1;
+}
+
+function findCycle(feed, version) {
+  const exact = feed.find((item) => String(item.cycle) === version);
+  if (exact) return exact;
+  if (!/^\d+$/.test(version)) return null;
+  const major = Number(version);
+  const candidates = feed
+    .filter((item) => Math.floor(cycleNumber(item.cycle)) === major)
+    .sort((a, b) => cycleNumber(b.cycle) - cycleNumber(a.cycle));
+  return candidates[0] ?? null;
+}
+
+function daysUntil(date, now) {
+  return Math.floor((date.getTime() - now.getTime()) / 86_400_000);
+}
+
+function groupPinned(pinned) {
+  const grouped = new Map();
+  for (const pin of pinned) {
+    const key = `${pin.runtime}@${pin.version}`;
+    const current = grouped.get(key);
+    if (current) current.sources.add(pin.source);
+    else grouped.set(key, { ...pin, sources: new Set([pin.source]) });
+  }
+  return [...grouped.values()];
+}
+
+function failProcess() {
+  if (globalThis.process) {
+    globalThis.process.exitCode = 1;
+    return;
+  }
+  if (isDeno) globalThis.Deno.exit(1);
+}
+
+async function main() {
+  const strict = args.includes("--strict");
+  const now = new Date();
+  const findings = [];
+  const pinned = groupPinned(await collectPinnedVersions());
+
+  if (pinned.length === 0) {
+    console.log("verify-runtime-eol: no pinned runtime versions found.");
+    return;
+  }
+
+  const feeds = new Map();
+  for (const pin of pinned) {
+    if (!feeds.has(pin.runtime)) feeds.set(pin.runtime, await fetchFeed(pin.runtime));
+    const cycle = findCycle(feeds.get(pin.runtime), pin.version);
+    if (!cycle || cycle.eol === false) continue;
+    const eol = new Date(cycle.eol);
+    if (Number.isNaN(eol.getTime())) continue;
+    const remaining = daysUntil(eol, now);
+    if (remaining < 0 || remaining <= EOL_WARN_DAYS) {
+      findings.push({
+        runtime: pin.runtime,
+        version: pin.version,
+        cycle: cycle.cycle,
+        eol: cycle.eol,
+        days: remaining,
+        severity: remaining < 0 ? "eol" : "warn",
+        sources: [...pin.sources].sort(),
+      });
+    }
+  }
+
+  for (const finding of findings) {
+    const label = finding.severity === "eol" ? "EOL" : "WARNING";
+    const timing =
+      finding.severity === "eol"
+        ? `${Math.abs(finding.days)} day(s) ago`
+        : `in ${finding.days} day(s)`;
+    console.error(
+      `${label}: ${finding.runtime} ${finding.version} maps to cycle ${finding.cycle}, EOL ${timing} (${finding.eol}). Sources: ${finding.sources.join(", ")}`
+    );
+  }
+
+  if (findings.some((f) => f.severity === "eol") || (strict && findings.length > 0)) {
+    failProcess();
+    return;
+  }
+
+  console.log("verify-runtime-eol: all pinned runtimes are inside supported windows.");
+}
+
+await main();

package/templates/_ci/node/SECURITY.md

@@ -25,6 +25,7 @@ The `--with-ci` bundle adds these defaults:
 - CodeQL, OpenSSF Scorecard, zizmor, Dependabot, and CODEOWNERS are generated.
 - A weekly scheduled `opengrep.yml` runs a second SAST engine (Aikido's LGPL-2.1 fork of Semgrep) against the repository using the curated `p/security-audit`, `p/owasp-top-ten`, `p/cwe-top-25`, `p/javascript`, `p/typescript`, `p/nodejs`, and `p/secrets` rule packs. The Opengrep binary is downloaded from a pinned GitHub release and its sigstore cosign signature is verified against the official `opengrep/opengrep` release identity before it runs — no third-party action sits in the supply chain just for this scan. Running two SAST engines (CodeQL + Opengrep) catches different bug classes than either alone; see Aikido's [Ultimate SAST Guide](https://www.aikido.dev/blog/ultimate-sast-guide-static-application-security-testing) for why a layered SAST posture is the recommended default.
 - A daily scheduled `vuln-scan.yml` runs the package manager's audit against the committed lockfile so newly-disclosed CVEs are surfaced even when no PR or push has run CI (SOC 2 CC7.1 continuous-vulnerability-management evidence).
+- A daily scheduled `eol-scan.yml` checks pinned Node, Bun, and Deno versions in package metadata and GitHub Actions against endoflife.date so a runtime that has stopped receiving security patches does not stay unnoticed on `main`.
 - A weekly scheduled `dast.yml` boots the built application and runs an OWASP ZAP baseline scan against it. CodeQL + Opengrep + the `verify:*` family are the SAST half of the posture; this is the DAST half — see Aikido's [SAST vs DAST](https://www.aikido.dev/blog/sast-vs-dast-what-you-need-to-now) write-up for why both matter. Findings are summarized in the workflow log and the job fails on HIGH-risk alerts; MEDIUM / LOW / INFO are surfaced for triage but non-blocking.
 - A `secret-scan.yml` workflow runs [gitleaks](https://github.com/gitleaks/gitleaks) against the working tree on every PR / push and against the **full git history** on a daily schedule. The gitleaks binary is downloaded from a pinned official release and verified by SHA-256 before execution so the scan does not introduce a new third-party action into the supply chain. Findings block the merge; matched values are redacted from the public log. The rationale (and the remediation playbook for a confirmed leak) follows Aikido's [Secrets Detection guide](https://www.aikido.dev/blog/secret-detection-application-security): a secret in any commit, branch, or tag should be treated as compromised, and detection must consider the entire history — not just the latest snapshot — alongside GitHub-native push protection.
 - No npm publish workflow is generated: this scaffold is a REST API service, not a published package. If you later carve out a reusable library you can opt into npm trusted publishing yourself.
@@ -162,4 +163,4 @@ Before relying on these files for a company project:
 1. Replace `@your-org/security-team` in `.github/CODEOWNERS` or pass `--code-owner` when scaffolding.
 2. Protect the `main` branch and require the CI, CodeQL, Opengrep, Scorecard, and zizmor checks.
 3. Enable GitHub secret scanning and push protection.
-4. Keep `ignore-scripts=true` and the `pnpm-workspace.yaml` supply-chain settings on when using pnpm.
+4. Keep `ignore-scripts=true` and the `pnpm-workspace.yaml` supply-chain settings on when using pnpm.

package/templates/_ci/node/_github/workflows/eol-scan.yml

@@ -0,0 +1,67 @@
+# End-of-life runtime scan generated by create-daloy --with-ci.
+#
+# Why this exists:
+#   A runtime version can keep running after it stops receiving security
+#   patches. This scheduled check looks at pinned Node/Bun/Deno versions in
+#   package metadata and GitHub Actions, then compares them with
+#   endoflife.date so old runtime pins do not sit unnoticed on main.
+#
+# Hardening:
+#   * `permissions: {}` at the top level; the job opts in to contents: read.
+#   * Third-party actions are SHA-pinned and managed by Dependabot.
+#   * `step-security/harden-runner` runs in audit mode.
+#   * `actions/checkout` runs with `persist-credentials: false`.
+#   * Install steps run with lifecycle scripts disabled.
+
+name: EOL runtime scan
+
+on:
+  schedule:
+    # 08:21 UTC daily, offset from the other scheduled security scans.
+    - cron: "21 8 * * *"
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: eol-scan-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  eol:
+    name: Daily EOL runtime scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2
+        with:
+          egress-policy: audit
+          disable-sudo: true
+          disable-file-monitoring: false
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          show-progress: false
+
+__SETUP_PACKAGE_MANAGER_STEP__
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: 24
+
+__SETUP_BUN_RUNTIME_STEP__
+
+      - name: Install dependencies (no scripts)
+        run: __INSTALL_COMMAND__
+        env:
+          npm_config_ignore_scripts: "true"
+
+      - name: Verify pinned runtimes are not EOL
+        run: __RUNTIME_EOL_COMMAND__

package/templates/_ci/node/scripts/verify-runtime-eol.mjs

@@ -0,0 +1,211 @@
+const EOL_WARN_DAYS = 90;
+const FETCH_TIMEOUT_MS = 10_000;
+const RUNTIME_FEEDS = {
+  node: "nodejs",
+  bun: "bun",
+  deno: "deno",
+};
+
+const isDeno = typeof globalThis.Deno !== "undefined";
+const args = isDeno ? globalThis.Deno.args : globalThis.process.argv.slice(2);
+const cwd = isDeno ? globalThis.Deno.cwd() : globalThis.process.cwd();
+
+function joinPath(...parts) {
+  return parts.filter(Boolean).join("/").replace(/\/+/g, "/");
+}
+
+async function readText(file) {
+  if (isDeno) return await globalThis.Deno.readTextFile(file);
+  const { readFile } = await import("node:fs/promises");
+  return await readFile(file, "utf8");
+}
+
+async function readDirNames(dir) {
+  if (isDeno) {
+    const out = [];
+    for await (const entry of globalThis.Deno.readDir(dir)) out.push(entry.name);
+    return out;
+  }
+  const { readdir } = await import("node:fs/promises");
+  return await readdir(dir);
+}
+
+function parseVersionKey(value) {
+  if (typeof value !== "string") return null;
+  if (/latest/i.test(value)) return null;
+  const match = value.match(/v?\D*(\d+)(?:\.(\d+))?/);
+  if (!match) return null;
+  return match[2] ? `${Number(match[1])}.${Number(match[2])}` : String(Number(match[1]));
+}
+
+function collectFromPackageJson(json, source) {
+  const out = [];
+  const engines = json && typeof json === "object" ? json.engines : null;
+  if (!engines || typeof engines !== "object") return out;
+  for (const runtime of Object.keys(RUNTIME_FEEDS)) {
+    const version = parseVersionKey(engines[runtime]);
+    if (version) out.push({ runtime, version, source: `${source}: engines.${runtime}` });
+  }
+  return out;
+}
+
+function collectFromDenoJson(json, source) {
+  const out = [];
+  const version = parseVersionKey(json?.runtime?.deno ?? json?.engines?.deno);
+  if (version) out.push({ runtime: "deno", version, source: `${source}: deno runtime` });
+  return out;
+}
+
+function collectFromWorkflow(yaml, source) {
+  const out = [];
+  const patterns = [
+    ["node", /node-version:\s*['"]?([^'"\n#]+)/g],
+    ["bun", /bun-version:\s*['"]?([^'"\n#]+)/g],
+    ["deno", /deno-version:\s*['"]?([^'"\n#]+)/g],
+  ];
+  for (const [runtime, pattern] of patterns) {
+    let match = null;
+    while ((match = pattern.exec(yaml)) !== null) {
+      const version = parseVersionKey(match[1]);
+      if (version) out.push({ runtime, version, source });
+    }
+  }
+  return out;
+}
+
+async function collectPinnedVersions() {
+  const found = [];
+  try {
+    found.push(...collectFromPackageJson(JSON.parse(await readText(joinPath(cwd, "package.json"))), "package.json"));
+  } catch {
+    // No package.json is fine for Deno-native scaffolds.
+  }
+  try {
+    found.push(...collectFromDenoJson(JSON.parse(await readText(joinPath(cwd, "deno.json"))), "deno.json"));
+  } catch {
+    // Node/Bun scaffolds do not ship deno.json.
+  }
+  try {
+    const workflowsDir = joinPath(cwd, ".github", "workflows");
+    for (const name of await readDirNames(workflowsDir)) {
+      if (!/\.(ya?ml)$/.test(name)) continue;
+      found.push(...collectFromWorkflow(await readText(joinPath(workflowsDir, name)), `.github/workflows/${name}`));
+    }
+  } catch {
+    // A local run without GitHub workflows should still scan package metadata.
+  }
+  return found;
+}
+
+async function fetchFeed(runtime) {
+  const feed = RUNTIME_FEEDS[runtime];
+  const ac = new AbortController();
+  const timer = setTimeout(() => ac.abort(), FETCH_TIMEOUT_MS);
+  try {
+    const res = await fetch(`https://endoflife.date/api/${feed}.json`, {
+      headers: {
+        "User-Agent": "daloy-runtime-eol-scan/1",
+        Accept: "application/json",
+      },
+      signal: ac.signal,
+    });
+    if (!res.ok) throw new Error(`${feed} feed returned HTTP ${res.status}`);
+    const json = await res.json();
+    if (!Array.isArray(json)) throw new Error(`${feed} feed returned a non-array payload`);
+    return json;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+function cycleNumber(cycle) {
+  const n = Number.parseFloat(String(cycle));
+  return Number.isFinite(n) ? n : -1;
+}
+
+function findCycle(feed, version) {
+  const exact = feed.find((item) => String(item.cycle) === version);
+  if (exact) return exact;
+  if (!/^\d+$/.test(version)) return null;
+  const major = Number(version);
+  const candidates = feed
+    .filter((item) => Math.floor(cycleNumber(item.cycle)) === major)
+    .sort((a, b) => cycleNumber(b.cycle) - cycleNumber(a.cycle));
+  return candidates[0] ?? null;
+}
+
+function daysUntil(date, now) {
+  return Math.floor((date.getTime() - now.getTime()) / 86_400_000);
+}
+
+function groupPinned(pinned) {
+  const grouped = new Map();
+  for (const pin of pinned) {
+    const key = `${pin.runtime}@${pin.version}`;
+    const current = grouped.get(key);
+    if (current) current.sources.add(pin.source);
+    else grouped.set(key, { ...pin, sources: new Set([pin.source]) });
+  }
+  return [...grouped.values()];
+}
+
+function failProcess() {
+  if (globalThis.process) {
+    globalThis.process.exitCode = 1;
+    return;
+  }
+  if (isDeno) globalThis.Deno.exit(1);
+}
+
+async function main() {
+  const strict = args.includes("--strict");
+  const now = new Date();
+  const findings = [];
+  const pinned = groupPinned(await collectPinnedVersions());
+
+  if (pinned.length === 0) {
+    console.log("verify-runtime-eol: no pinned runtime versions found.");
+    return;
+  }
+
+  const feeds = new Map();
+  for (const pin of pinned) {
+    if (!feeds.has(pin.runtime)) feeds.set(pin.runtime, await fetchFeed(pin.runtime));
+    const cycle = findCycle(feeds.get(pin.runtime), pin.version);
+    if (!cycle || cycle.eol === false) continue;
+    const eol = new Date(cycle.eol);
+    if (Number.isNaN(eol.getTime())) continue;
+    const remaining = daysUntil(eol, now);
+    if (remaining < 0 || remaining <= EOL_WARN_DAYS) {
+      findings.push({
+        runtime: pin.runtime,
+        version: pin.version,
+        cycle: cycle.cycle,
+        eol: cycle.eol,
+        days: remaining,
+        severity: remaining < 0 ? "eol" : "warn",
+        sources: [...pin.sources].sort(),
+      });
+    }
+  }
+
+  for (const finding of findings) {
+    const label = finding.severity === "eol" ? "EOL" : "WARNING";
+    const timing =
+      finding.severity === "eol"
+        ? `${Math.abs(finding.days)} day(s) ago`
+        : `in ${finding.days} day(s)`;
+    console.error(
+      `${label}: ${finding.runtime} ${finding.version} maps to cycle ${finding.cycle}, EOL ${timing} (${finding.eol}). Sources: ${finding.sources.join(", ")}`
+    );
+  }
+
+  if (findings.some((f) => f.severity === "eol") || (strict && findings.length > 0)) {
+    failProcess();
+    return;
+  }
+
+  console.log("verify-runtime-eol: all pinned runtimes are inside supported windows.");
+}
+
+await main();

package/templates/bun-basic/_githooks/pre-push

@@ -2,10 +2,10 @@
 # daloyjs-pre-push-contract-hook v1
 #
 # Localhost-only contract gate. Rejects a push whose OpenAPI contract has
-# error-level issues: missing or duplicate operationIds, response examples that
-# don't match their schema, accidental body schemas on safe methods, or routes
-# with no declared responses. Catches the class of drift `tsc` can't see before
-# it leaves your machine, with CI as the backstop.
+# error-level issues: missing or duplicate operationIds, examples that don't
+# match their schema, or routes with no declared responses. Safe-method body
+# schemas are reported as warnings. Catches the class of drift `tsc` can't see
+# before it leaves your machine, with CI as the backstop.
 #
 # Enable once per clone:  bun run hooks:install   (sets core.hooksPath here)
 # Bypass once:            git push --no-verify

package/templates/bun-basic/package.json

@@ -19,7 +19,7 @@
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "dependencies": {
-    "@daloyjs/core": "^1.0.0-beta.2",
+    "@daloyjs/core": "^1.0.0-beta.4",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/cloudflare-worker/_githooks/pre-push

@@ -2,12 +2,12 @@
 # daloyjs-pre-push-contract-hook v1
 #
 # Localhost-only contract gate. Rejects a push whose OpenAPI contract has
-# error-level issues: missing or duplicate operationIds, response examples that
-# don't match their schema, accidental body schemas on safe methods, or routes
-# with no declared responses. Catches the class of drift `tsc` can't see before
-# it leaves your machine, with CI as the backstop.
+# error-level issues: missing or duplicate operationIds, examples that don't
+# match their schema, or routes with no declared responses. Safe-method body
+# schemas are reported as warnings. Catches the class of drift `tsc` can't see
+# before it leaves your machine, with CI as the backstop.
 #
-# Enable once per clone:  npm run hooks:install   (sets core.hooksPath here)
+# Enable once per clone:  pnpm hooks:install   (sets core.hooksPath here)
 # Bypass once:            git push --no-verify
 DALOY="./node_modules/.bin/daloy"
 if [ ! -x "$DALOY" ]; then

package/templates/cloudflare-worker/package.json

@@ -7,13 +7,13 @@
     "dev": "wrangler dev",
     "deploy": "wrangler deploy",
     "typecheck": "tsc --noEmit",
-    "test": "node --import tsx/esm --test tests/**/*.test.ts",
+    "test": "node --import tsx --test tests/**/*.test.ts",
     "contract": "daloy inspect --check src/index.ts",
     "audit": "pnpm audit --prod",
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "dependencies": {
-    "@daloyjs/core": "^1.0.0-beta.2",
+    "@daloyjs/core": "^1.0.0-beta.4",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/deno-basic/_githooks/pre-push

@@ -2,10 +2,10 @@
 # daloyjs-pre-push-contract-hook v1
 #
 # Localhost-only contract gate. Rejects a push whose OpenAPI contract has
-# error-level issues: missing or duplicate operationIds, response examples that
-# don't match their schema, accidental body schemas on safe methods, or routes
-# with no declared responses. Catches the class of drift the type-checker can't
-# see before it leaves your machine, with CI as the backstop.
+# error-level issues: missing or duplicate operationIds, examples that don't
+# match their schema, or routes with no declared responses. Safe-method body
+# schemas are reported as warnings. Catches the class of drift the type-checker
+# can't see before it leaves your machine, with CI as the backstop.
 #
 # Enable once per clone:  deno task hooks:install   (sets core.hooksPath here)
 # Bypass once:            git push --no-verify

package/templates/deno-basic/deno.json

@@ -10,11 +10,11 @@
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "imports": {
-    "@daloyjs/core": "jsr:@daloyjs/daloy@^1.0.0-beta.2",
-    "@daloyjs/core/banner": "jsr:@daloyjs/daloy@^1.0.0-beta.2/banner",
-    "@daloyjs/core/contract": "jsr:@daloyjs/daloy@^1.0.0-beta.2/contract",
-    "@daloyjs/core/deno": "jsr:@daloyjs/daloy@^1.0.0-beta.2/deno",
-    "@daloyjs/core/openapi": "jsr:@daloyjs/daloy@^1.0.0-beta.2/openapi",
+    "@daloyjs/core": "jsr:@daloyjs/daloy@^1.0.0-beta.4",
+    "@daloyjs/core/banner": "jsr:@daloyjs/daloy@^1.0.0-beta.4/banner",
+    "@daloyjs/core/contract": "jsr:@daloyjs/daloy@^1.0.0-beta.4/contract",
+    "@daloyjs/core/deno": "jsr:@daloyjs/daloy@^1.0.0-beta.4/deno",
+    "@daloyjs/core/openapi": "jsr:@daloyjs/daloy@^1.0.0-beta.4/openapi",
     "zod": "npm:zod@^4.4.3"
   },
   "compilerOptions": {

package/templates/node-basic/_githooks/pre-push

@@ -2,12 +2,12 @@
 # daloyjs-pre-push-contract-hook v1
 #
 # Localhost-only contract gate. Rejects a push whose OpenAPI contract has
-# error-level issues: missing or duplicate operationIds, response examples that
-# don't match their schema, accidental body schemas on safe methods, or routes
-# with no declared responses. Catches the class of drift `tsc` can't see before
-# it leaves your machine, with CI as the backstop.
+# error-level issues: missing or duplicate operationIds, examples that don't
+# match their schema, or routes with no declared responses. Safe-method body
+# schemas are reported as warnings. Catches the class of drift `tsc` can't see
+# before it leaves your machine, with CI as the backstop.
 #
-# Enable once per clone:  npm run hooks:install   (sets core.hooksPath here)
+# Enable once per clone:  pnpm hooks:install   (sets core.hooksPath here)
 # Bypass once:            git push --no-verify
 DALOY="./node_modules/.bin/daloy"
 if [ ! -x "$DALOY" ]; then

package/templates/node-basic/package.json

@@ -11,16 +11,16 @@
     "start": "node dist/index.js",
     "build": "tsc -p tsconfig.build.json",
     "typecheck": "tsc --noEmit",
-    "test": "node --import tsx/esm --test tests/**/*.test.ts",
+    "test": "node --import tsx --test tests/**/*.test.ts",
     "contract": "daloy inspect --check src/build-app.ts",
-    "gen:openapi": "node --import tsx/esm scripts/dump-openapi.ts",
+    "gen:openapi": "node --import tsx scripts/dump-openapi.ts",
     "gen:client": "openapi-ts",
     "gen": "pnpm gen:openapi && pnpm gen:client",
     "audit": "pnpm audit --prod",
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "dependencies": {
-    "@daloyjs/core": "^1.0.0-beta.2",
+    "@daloyjs/core": "^1.0.0-beta.4",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/vercel/_githooks/pre-push

@@ -2,12 +2,12 @@
 # daloyjs-pre-push-contract-hook v1
 #
 # Localhost-only contract gate. Rejects a push whose OpenAPI contract has
-# error-level issues: missing or duplicate operationIds, response examples that
-# don't match their schema, accidental body schemas on safe methods, or routes
-# with no declared responses. Catches the class of drift `tsc` can't see before
-# it leaves your machine, with CI as the backstop.
+# error-level issues: missing or duplicate operationIds, examples that don't
+# match their schema, or routes with no declared responses. Safe-method body
+# schemas are reported as warnings. Catches the class of drift `tsc` can't see
+# before it leaves your machine, with CI as the backstop.
 #
-# Enable once per clone:  npm run hooks:install   (sets core.hooksPath here)
+# Enable once per clone:  pnpm hooks:install   (sets core.hooksPath here)
 # Bypass once:            git push --no-verify
 DALOY="./node_modules/.bin/daloy"
 if [ ! -x "$DALOY" ]; then

package/templates/vercel/package.json

@@ -4,16 +4,16 @@
   "private": true,
   "type": "module",
   "scripts": {
-    "dev": "node --import tsx/esm src/dev.ts",
+    "dev": "node --import tsx src/dev.ts",
     "deploy": "vercel deploy",
     "typecheck": "tsc --noEmit",
-    "test": "node --import tsx/esm --test tests/**/*.test.ts",
+    "test": "node --import tsx --test tests/**/*.test.ts",
     "contract": "daloy inspect --check api/index.ts",
     "audit": "pnpm audit --prod",
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "dependencies": {
-    "@daloyjs/core": "^1.0.0-beta.2",
+    "@daloyjs/core": "^1.0.0-beta.4",
     "zod": "^4.4.3"
   },
   "devDependencies": {