create-daloy 1.0.0-beta.6 → 1.0.0-rc.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-daloy",
-  "version": "1.0.0-beta.6",
+  "version": "1.0.0-rc.0",
   "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
   "type": "module",
   "license": "MIT",

package/sbom.cdx.json

@@ -1,25 +1,25 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:f43c9f53-eb2b-530b-a5b0-1406b6ec4e9f",
+  "serialNumber": "urn:uuid:59eb0e74-bb0a-538a-b5e2-6c2d63f0c0ff",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-01T22:47:11.159Z",
+    "timestamp": "2026-07-03T11:50:58.874Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "1.0.0-beta.6"
+        "version": "1.0.0-rc.0"
       }
     ],
     "authors": [],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/create-daloy@1.0.0-beta.6",
+      "bom-ref": "pkg:npm/create-daloy@1.0.0-rc.0",
       "name": "create-daloy",
-      "version": "1.0.0-beta.6",
+      "version": "1.0.0-rc.0",
       "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
-      "purl": "pkg:npm/create-daloy@1.0.0-beta.6",
+      "purl": "pkg:npm/create-daloy@1.0.0-rc.0",
       "licenses": [
         {
           "license": {
@@ -42,9 +42,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag-create-daloy-1.0.0-beta.6",
+        "tagId": "swidtag-create-daloy-1.0.0-rc.0",
         "name": "create-daloy",
-        "version": "1.0.0-beta.6",
+        "version": "1.0.0-rc.0",
         "tagVersion": 0,
         "patch": false
       }
@@ -53,7 +53,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/create-daloy@1.0.0-beta.6",
+      "ref": "pkg:npm/create-daloy@1.0.0-rc.0",
       "dependsOn": []
     }
   ]

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "create-daloy-1.0.0-beta.6",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/create-daloy-1.0.0-beta.6-f43c9f53-eb2b-530b-a5b0-1406b6ec4e9f",
+  "name": "create-daloy-1.0.0-rc.0",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/create-daloy-1.0.0-rc.0-59eb0e74-bb0a-538a-b5e2-6c2d63f0c0ff",
   "creationInfo": {
-    "created": "2026-07-01T22:47:11.159Z",
+    "created": "2026-07-03T11:50:58.874Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package-create-daloy",
       "name": "create-daloy",
-      "versionInfo": "1.0.0-beta.6",
+      "versionInfo": "1.0.0-rc.0",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/create-daloy@1.0.0-beta.6"
+          "referenceLocator": "pkg:npm/create-daloy@1.0.0-rc.0"
         }
       ]
     }

package/templates/bun-basic/_agents/skills/daloyjs-best-practices/SKILL.md

@@ -73,8 +73,8 @@ bun run typecheck     # tsc --noEmit
 bun test              # Bun's native test runner
 bun run gen:openapi   # write generated/openapi.json
 bun run gen:client    # write generated/client/
+bun run gen           # gen:openapi + gen:client
 bun run contract      # run the focused contract test
-bun run build         # produce dist/
 ```
 
 Always run `bun run typecheck` and `bun test` before declaring a task done.
@@ -91,7 +91,7 @@ definitions:
 
 - `GET /openapi.json` — OpenAPI 3.1 spec as JSON.
 - `GET /openapi.yaml` — OpenAPI 3.1 spec as YAML (served inline as
-  `text/yaml; charset=utf-8`, since `@daloyjs/core` 0.13.1).
+  `text/yaml; charset=utf-8`).
 - `GET /docs` — Scalar API reference UI that loads the spec.
 
 Customize via `docs: { openapiPath, openapiYamlPath, path, ui }`. Set
@@ -179,7 +179,7 @@ app.route({
 
 ## Error handling
 
-- Throw typed errors from `@daloyjs/core` — they serialize to RFC 7807
+- Throw typed errors from `@daloyjs/core` — they serialize to RFC 9457
   problem responses.
 - Add a `responses[code]` entry for every error you throw.
 - Do not swallow errors. Log via `ctx.log.error(err, "context")` and
@@ -225,7 +225,7 @@ in-memory fake via `buildApp({ store })` rather than mocking `fetch`.
 The shipped contract test should fail invalid examples, duplicate/missing
 `operationId`, or missing responses.
 
-Aim for **100% line and function coverage** on routes you add.
+Aim for complete happy- and unhappy-path test coverage of the routes you add.
 
 ## Security best practices
 
@@ -279,6 +279,11 @@ Aim for **100% line and function coverage** on routes you add.
 - Avoid Node-only APIs in code that may also run on the Cloudflare/Vercel
   templates; the Bun runtime is web-standard friendly but check before
   reaching for `node:fs` etc.
+- If a route intentionally returns a body the contract cannot describe (a
+  raw `Response`, HTML, a proxied payload), set
+  `acknowledgeNoResponseBodySchema: true` on that route — never silence the
+  `security.response.bodySchemaMissing` boot warning by widening a schema
+  to `z.any()`.
 
 ## Process expectations
 
@@ -292,6 +297,18 @@ Aim for **100% line and function coverage** on routes you add.
 - Keep `README.md`, this `SKILL.md`, and `AGENTS.md` consistent with the
   code.
 
+## Exposing this API over MCP
+
+`@daloyjs/core` ships a dependency-free Model Context Protocol (Streamable
+HTTP) server helper — also available from the `@daloyjs/core/mcp` subpath.
+To expose selected capabilities to MCP clients (AI agents), build a handler
+with `createMcpHandler({ tools, resources, prompts })` and mount it with
+`mcpRoutes("/mcp", handler)`. Throw `McpToolError` for caller-correctable
+tool failures. The handler ships protocol-level guards (body cap, UTF-8/JSON
+validation, `Origin` checks against DNS rebinding) and composes with the
+existing middleware chain — put `bearerAuth()` / `rateLimit()` in front of
+it like any other route. See <https://daloyjs.dev/docs> for the MCP guide.
+
 ## More
 
 - Framework docs: <https://daloyjs.dev/docs>

package/templates/bun-basic/package.json

@@ -19,7 +19,7 @@
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "dependencies": {
-    "@daloyjs/core": "^1.0.0-beta.6",
+    "@daloyjs/core": "^1.0.0-rc.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/bun-basic/src/build-app.ts

@@ -70,13 +70,13 @@ export function buildApp(): App {
       },
     },
     handler: async () => ({
-      status: 200,
+      status: 200 as const,
       body: { ok: true as const, runtime: "bun" as const },
     }),
   });
 
   // daloy-minimal:strip-start books
-  const Book = z.object({ id: z.string(), title: z.string() });
+  const Book = z.object({ id: z.string(), title: z.string() }).strict();
   const books = new Map<string, z.infer<typeof Book>>([
     ["1", { id: "1", title: "Noli Me Tangere" }],
     ["2", { id: "2", title: "El Filibusterismo" }],
@@ -87,7 +87,7 @@ export function buildApp(): App {
     path: "/books/:id",
     operationId: "getBookById",
     tags: ["Books"],
-    request: { params: z.object({ id: z.string() }) },
+    request: { params: z.object({ id: z.string().min(1) }).strict() },
     responses: {
       200: { description: "Found", body: Book },
       404: { description: "Not found" },
@@ -95,7 +95,7 @@ export function buildApp(): App {
     handler: async ({ params }) => {
       const book = books.get(params.id);
       if (!book) throw new NotFoundError(`Book ${params.id} not found`);
-      return { status: 200, body: book };
+      return { status: 200 as const, body: book };
     },
   });
   // daloy-minimal:strip-end books

package/templates/cloudflare-worker/_agents/skills/daloyjs-best-practices/SKILL.md

@@ -87,7 +87,7 @@ smallest possible Worker. The routes:
 
 - `GET /openapi.json` — OpenAPI 3.1 spec as JSON.
 - `GET /openapi.yaml` — OpenAPI 3.1 spec as YAML (served inline as
-  `text/yaml; charset=utf-8`, since `@daloyjs/core` 0.13.1).
+  `text/yaml; charset=utf-8`).
 - `GET /docs` — Scalar API reference UI that loads the spec.
 
 On Workers the Scalar UI adds the most weight; consider
@@ -185,7 +185,7 @@ export default {
 
 ## Error handling
 
-- Throw typed errors from `@daloyjs/core` — they serialize to RFC 7807
+- Throw typed errors from `@daloyjs/core` — they serialize to RFC 9457
   problem responses.
 - Add a `responses[code]` entry for every error you throw.
 - For unexpected errors, let them bubble. The framework's error
@@ -224,7 +224,7 @@ in-memory fake into `buildApp(env)` during tests.
 The shipped contract test should fail invalid examples, duplicate/missing
 `operationId`, or missing responses.
 
-Aim for **100% line and function coverage** on the routes you add.
+Aim for complete happy- and unhappy-path test coverage of the routes you add.
 
 ## Security best practices
 
@@ -284,6 +284,11 @@ Aim for **100% line and function coverage** on the routes you add.
 - Do not add runtime dependencies without checking the hardened `.npmrc` (installs wait 24h after publish by default).
 - Long-running work belongs in `ctx.waitUntil(...)`, not blocking the
   response.
+- If a route intentionally returns a body the contract cannot describe (a
+  raw `Response`, HTML, a proxied payload), set
+  `acknowledgeNoResponseBodySchema: true` on that route — never silence the
+  `security.response.bodySchemaMissing` boot warning by widening a schema
+  to `z.any()`.
 
 ## Process expectations
 
@@ -296,6 +301,18 @@ Aim for **100% line and function coverage** on the routes you add.
   do not attempt to authenticate on their behalf.
 - Keep `README.md`, this `SKILL.md`, and `AGENTS.md` consistent.
 
+## Exposing this API over MCP
+
+`@daloyjs/core` ships a dependency-free Model Context Protocol (Streamable
+HTTP) server helper — also available from the `@daloyjs/core/mcp` subpath.
+To expose selected capabilities to MCP clients (AI agents), build a handler
+with `createMcpHandler({ tools, resources, prompts })` and mount it with
+`mcpRoutes("/mcp", handler)`. Throw `McpToolError` for caller-correctable
+tool failures. The handler ships protocol-level guards (body cap, UTF-8/JSON
+validation, `Origin` checks against DNS rebinding) and composes with the
+existing middleware chain — put `bearerAuth()` / `rateLimit()` in front of
+it like any other route. See <https://daloyjs.dev/docs> for the MCP guide.
+
 ## More
 
 - Framework docs: <https://daloyjs.dev/docs>

package/templates/cloudflare-worker/package.json

@@ -13,7 +13,7 @@
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "dependencies": {
-    "@daloyjs/core": "^1.0.0-beta.6",
+    "@daloyjs/core": "^1.0.0-rc.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/cloudflare-worker/src/index.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { App, NotFoundError, requestId, secureHeaders } from "@daloyjs/core";
+import { App, NotFoundError, rateLimit, requestId, secureHeaders } from "@daloyjs/core";
 import { toFetchHandler } from "@daloyjs/core/cloudflare";
 
 const app = new App({
@@ -26,6 +26,11 @@ const app = new App({
 
 app.use(requestId());
 app.use(secureHeaders());
+// The in-memory limiter resets per Worker isolate, so treat it as a
+// per-isolate abuse brake, not a global quota. For high-traffic routes, attach
+// Cloudflare's native rate-limit binding in addition to — not instead of —
+// this baseline. Do not remove it to make a test pass; raise `max` per route.
+app.use(rateLimit({ windowMs: 60_000, max: 120 }));
 
 app.route({
   method: "GET",
@@ -39,13 +44,13 @@ app.route({
     },
   },
   handler: async () => ({
-    status: 200,
+    status: 200 as const,
     body: { ok: true as const, runtime: "cloudflare-worker" as const },
   }),
 });
 
 // daloy-minimal:strip-start books
-const Book = z.object({ id: z.string(), title: z.string() });
+const Book = z.object({ id: z.string(), title: z.string() }).strict();
 const books = new Map<string, z.infer<typeof Book>>([
   ["1", { id: "1", title: "Noli Me Tangere" }],
 ]);
@@ -55,7 +60,7 @@ app.route({
   path: "/books/:id",
   operationId: "getBookById",
   tags: ["Books"],
-  request: { params: z.object({ id: z.string() }) },
+  request: { params: z.object({ id: z.string().min(1) }).strict() },
   responses: {
     200: { description: "Found", body: Book },
     404: { description: "Not found" },
@@ -63,7 +68,7 @@ app.route({
   handler: async ({ params }) => {
     const book = books.get(params.id);
     if (!book) throw new NotFoundError(`Book ${params.id} not found`);
-    return { status: 200, body: book };
+    return { status: 200 as const, body: book };
   },
 });
 // daloy-minimal:strip-end books

package/templates/deno-basic/_agents/skills/daloyjs-best-practices/SKILL.md

@@ -93,7 +93,7 @@ definitions:
 
 - `GET /openapi.json` — OpenAPI 3.1 spec as JSON.
 - `GET /openapi.yaml` — OpenAPI 3.1 spec as YAML (served inline as
-  `text/yaml; charset=utf-8`, since `@daloyjs/core` 0.13.1).
+  `text/yaml; charset=utf-8`).
 - `GET /docs` — Scalar API reference UI that loads the spec.
 
 Customize via `docs: { openapiPath, openapiYamlPath, path, ui }`. Set
@@ -177,7 +177,7 @@ app.route({
 
 ## Error handling
 
-- Throw typed errors from `@daloyjs/core` — they serialize to RFC 7807
+- Throw typed errors from `@daloyjs/core` — they serialize to RFC 9457
   problem responses.
 - Add a `responses[code]` entry for every error you throw.
 - Do not swallow errors. Log via `ctx.log.error(...)` and rethrow.
@@ -221,7 +221,7 @@ limiting (429). For external services, inject an in-memory fake via
 The shipped contract test should fail invalid examples, duplicate/missing
 `operationId`, or missing responses.
 
-Aim for **100% line and function coverage** on routes you add.
+Aim for complete happy- and unhappy-path test coverage of the routes you add.
 
 ## Security best practices
 
@@ -271,6 +271,11 @@ Aim for **100% line and function coverage** on routes you add.
 - Use `deno task ...`, not `npm`/`pnpm`. There is no `package.json`.
 - If you need a new dependency, add it to `imports` in `deno.json` via
   `npm:` or `jsr:` specifiers; do not introduce a `package.json`.
+- If a route intentionally returns a body the contract cannot describe (a
+  raw `Response`, HTML, a proxied payload), set
+  `acknowledgeNoResponseBodySchema: true` on that route — never silence the
+  `security.response.bodySchemaMissing` boot warning by widening a schema
+  to `z.any()`.
 
 ## Process expectations
 
@@ -284,6 +289,18 @@ Aim for **100% line and function coverage** on routes you add.
 - Keep `README.md`, this `SKILL.md`, and `AGENTS.md` consistent with the
   code.
 
+## Exposing this API over MCP
+
+`@daloyjs/core` ships a dependency-free Model Context Protocol (Streamable
+HTTP) server helper — also available from the `@daloyjs/core/mcp` subpath.
+To expose selected capabilities to MCP clients (AI agents), build a handler
+with `createMcpHandler({ tools, resources, prompts })` and mount it with
+`mcpRoutes("/mcp", handler)`. Throw `McpToolError` for caller-correctable
+tool failures. The handler ships protocol-level guards (body cap, UTF-8/JSON
+validation, `Origin` checks against DNS rebinding) and composes with the
+existing middleware chain — put `bearerAuth()` / `rateLimit()` in front of
+it like any other route. See <https://daloyjs.dev/docs> for the MCP guide.
+
 ## More
 
 - Framework docs: <https://daloyjs.dev/docs>

package/templates/deno-basic/deno.json

@@ -10,11 +10,11 @@
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "imports": {
-    "@daloyjs/core": "jsr:@daloyjs/daloy@^1.0.0-beta.6",
-    "@daloyjs/core/banner": "jsr:@daloyjs/daloy@^1.0.0-beta.6/banner",
-    "@daloyjs/core/contract": "jsr:@daloyjs/daloy@^1.0.0-beta.6/contract",
-    "@daloyjs/core/deno": "jsr:@daloyjs/daloy@^1.0.0-beta.6/deno",
-    "@daloyjs/core/openapi": "jsr:@daloyjs/daloy@^1.0.0-beta.6/openapi",
+    "@daloyjs/core": "jsr:@daloyjs/daloy@^1.0.0-rc.0",
+    "@daloyjs/core/banner": "jsr:@daloyjs/daloy@^1.0.0-rc.0/banner",
+    "@daloyjs/core/contract": "jsr:@daloyjs/daloy@^1.0.0-rc.0/contract",
+    "@daloyjs/core/deno": "jsr:@daloyjs/daloy@^1.0.0-rc.0/deno",
+    "@daloyjs/core/openapi": "jsr:@daloyjs/daloy@^1.0.0-rc.0/openapi",
     "zod": "npm:zod@^4.4.3"
   },
   "compilerOptions": {

package/templates/deno-basic/src/build-app.ts

@@ -71,13 +71,13 @@ export function buildApp(): App {
       },
     },
     handler: async () => ({
-      status: 200,
+      status: 200 as const,
       body: { ok: true as const, runtime: "deno" as const },
     }),
   });
 
   // daloy-minimal:strip-start books
-  const Book = z.object({ id: z.string(), title: z.string() });
+  const Book = z.object({ id: z.string(), title: z.string() }).strict();
   const books = new Map<string, z.infer<typeof Book>>([
     ["1", { id: "1", title: "Noli Me Tangere" }],
     ["2", { id: "2", title: "El Filibusterismo" }],
@@ -88,7 +88,7 @@ export function buildApp(): App {
     path: "/books/:id",
     operationId: "getBookById",
     tags: ["Books"],
-    request: { params: z.object({ id: z.string() }) },
+    request: { params: z.object({ id: z.string().min(1) }).strict() },
     responses: {
       200: { description: "Found", body: Book },
       404: { description: "Not found" },
@@ -96,7 +96,7 @@ export function buildApp(): App {
     handler: async ({ params }) => {
       const book = books.get(params.id);
       if (!book) throw new NotFoundError(`Book ${params.id} not found`);
-      return { status: 200, body: book };
+      return { status: 200 as const, body: book };
     },
   });
   // daloy-minimal:strip-end books

package/templates/node-basic/_agents/skills/daloyjs-best-practices/SKILL.md

@@ -82,6 +82,7 @@ pnpm gen:client   # write generated/client/
 pnpm contract     # daloy inspect --check src/build-app.ts
 pnpm build        # emit dist/
 pnpm audit        # supply-chain audit
+pnpm hooks:install  # enable the optional pre-push contract gate
 ```
 
 Always run `pnpm typecheck` and `pnpm test` before declaring a task done.
@@ -97,7 +98,7 @@ definitions:
 
 - `GET /openapi.json` — OpenAPI 3.1 spec as JSON.
 - `GET /openapi.yaml` — OpenAPI 3.1 spec as YAML (served inline as
-  `text/yaml; charset=utf-8`, since `@daloyjs/core` 0.13.1).
+  `text/yaml; charset=utf-8`).
 - `GET /docs` — Scalar API reference UI that loads the spec.
 
 Customize via `docs: { openapiPath, openapiYamlPath, path, ui }`. Set
@@ -146,7 +147,7 @@ bugs (drifted client SDK, missing test, broken codegen).
 5. **Throw typed errors, do not return raw error responses.** Use
    `NotFoundError`, `BadRequestError`, `UnauthorizedError`,
    `ForbiddenError`, `ConflictError`, etc. from `@daloyjs/core`. The
-   framework maps them to RFC 7807 problem responses.
+   framework maps them to RFC 9457 problem responses.
 6. **Add a test in `tests/<route>.test.ts`.** Use `app.request(...)` for
    in-process tests — no port needed (see "Testing best practices").
 7. **Run the contract gate.** Run `pnpm contract` or `pnpm test` before
@@ -209,7 +210,7 @@ app.route({
 ## Error handling
 
 - Throw typed errors from `@daloyjs/core` — they carry status codes and
-  serialize to RFC 7807 problem responses (`application/problem+json`).
+  serialize to RFC 9457 problem responses (`application/problem+json`).
 - Add a `responses[code]` entry for every error you throw, so the OpenAPI
   spec and the typed client know it can happen.
 - Do not swallow errors in handlers. If you need to log and rethrow, use
@@ -276,7 +277,7 @@ For routes that touch external services, write a thin in-memory fake
 inside the test and inject it via the factory pattern (`buildApp({ store })`).
 Do not mock global `fetch` unless there is no alternative.
 
-Aim for **100% line and function coverage** on routes you add. If a
+Aim for complete happy- and unhappy-path test coverage of the routes you add. If a
 branch is impractical to test (e.g. defensive `never` arms), refactor it
 out rather than adding ignore comments — agent coverage tools may not
 honor them.
@@ -347,6 +348,11 @@ honor them.
   `--ignore-scripts=false` on install without a clear reason.
 - Avoid global mutable state in `buildApp()`. If you need shared state,
   pass it in as a parameter (`buildApp({ store })`).
+- If a route intentionally returns a body the contract cannot describe (a
+  raw `Response`, HTML, a proxied payload), set
+  `acknowledgeNoResponseBodySchema: true` on that route — never silence the
+  `security.response.bodySchemaMissing` boot warning by widening a schema
+  to `z.any()`.
 
 ## Process expectations
 
@@ -361,6 +367,18 @@ honor them.
 - Keep `README.md`, this `SKILL.md`, and `AGENTS.md` consistent with the
   code. If you add a workflow, document it here.
 
+## Exposing this API over MCP
+
+`@daloyjs/core` ships a dependency-free Model Context Protocol (Streamable
+HTTP) server helper — also available from the `@daloyjs/core/mcp` subpath.
+To expose selected capabilities to MCP clients (AI agents), build a handler
+with `createMcpHandler({ tools, resources, prompts })` and mount it with
+`mcpRoutes("/mcp", handler)`. Throw `McpToolError` for caller-correctable
+tool failures. The handler ships protocol-level guards (body cap, UTF-8/JSON
+validation, `Origin` checks against DNS rebinding) and composes with the
+existing middleware chain — put `bearerAuth()` / `rateLimit()` in front of
+it like any other route. See <https://daloyjs.dev/docs> for the MCP guide.
+
 ## More
 
 - Framework docs: <https://daloyjs.dev/docs>

package/templates/node-basic/package.json

@@ -20,7 +20,7 @@
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "dependencies": {
-    "@daloyjs/core": "^1.0.0-beta.6",
+    "@daloyjs/core": "^1.0.0-rc.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/node-basic/src/build-app.ts

@@ -75,13 +75,13 @@ export function buildApp(): App {
       },
     },
     handler: async () => ({
-      status: 200,
+      status: 200 as const,
       body: { ok: true as const, uptime: process.uptime() },
     }),
   });
 
   // daloy-minimal:strip-start books
-  const Book = z.object({ id: z.string(), title: z.string() });
+  const Book = z.object({ id: z.string(), title: z.string() }).strict();
   const books = new Map<string, z.infer<typeof Book>>([
     ["1", { id: "1", title: "Noli Me Tangere" }],
     ["2", { id: "2", title: "El Filibusterismo" }],
@@ -92,7 +92,7 @@ export function buildApp(): App {
     path: "/books/:id",
     operationId: "getBookById",
     tags: ["Books"],
-    request: { params: z.object({ id: z.string() }) },
+    request: { params: z.object({ id: z.string().min(1) }).strict() },
     responses: {
       200: { description: "Found", body: Book },
       404: { description: "Not found" },
@@ -100,7 +100,7 @@ export function buildApp(): App {
     handler: async ({ params }) => {
       const book = books.get(params.id);
       if (!book) throw new NotFoundError(`Book ${params.id} not found`);
-      return { status: 200, body: book };
+      return { status: 200 as const, body: book };
     },
   });
   // daloy-minimal:strip-end books

package/templates/vercel/AGENTS.md

@@ -46,7 +46,7 @@ You import the file you see. Vercel and tsx resolve `.ts` directly. Bare package
 2. Validate every input with Zod or another Standard Schema-compatible validator. For Zod object schemas, use `.strict()` to reject unknown keys at the boundary.
 3. Preserve literal types in responses: `status: 200 as const`, `z.literal(...)` on discriminator fields.
 4. Throw typed errors (`NotFoundError`, `BadRequestError`, etc.) from `@daloyjs/core`.
-5. Keep `requestId()`, `secureHeaders()`, and `rateLimit()` enabled. For production traffic, back rate-limiting with Vercel KV or another shared store (the in-memory limiter resets per instance).
+5. Keep `requestId()`, `secureHeaders()`, and `rateLimit()` enabled. For production traffic, back rate-limiting with a shared store such as Upstash Redis from the Vercel Marketplace (the in-memory limiter resets per instance).
 6. Prefer Web Standards (`Request`/`Response`, `fetch`, `Web Crypto`) even though Node APIs are available; Edge runtime code must avoid `node:` modules.
 7. Keep a single `api/index.ts` entry and the `vercel.json` `/(.*)` → `/api` rewrite so DaloyJS handles all routing at the site root.
 8. Keep operation IDs stable and examples schema-valid; `pnpm contract` must pass after route, metadata, or OpenAPI-facing changes.
@@ -56,7 +56,7 @@ You import the file you see. Vercel and tsx resolve `.ts` directly. Bare package
 
 Per Supabase + Aikido on [secure-by-default development](https://www.aikido.dev/blog/supabase-approach-to-secure-by-default-development): _"If you tell an AI to make something work, it might remove the very security checks that protect you."_ When a guard rejects a request, **satisfy it, do not delete it.**
 
-- Keep `secureHeaders()`, `requestId()`, `rateLimit()`, `bodyLimitBytes`, and `requestTimeoutMs`. For production, back rate limits with Vercel KV or another shared store.
+- Keep `secureHeaders()`, `requestId()`, `rateLimit()`, `bodyLimitBytes`, and `requestTimeoutMs`. For production, back rate limits with a shared store such as Upstash Redis from the Vercel Marketplace.
 - Keep Zod `.strict()` on top-level request objects; do not switch to `.passthrough()`. For other validators, use the strict / no-extra-keys equivalent. Keep `responses[N].body` schemas tight; never widen to `z.any()` to let a privileged field escape.
 - Every protected route attaches auth `beforeHandle` and tests unauthenticated `401` plus wrong-scope `403`.
 - JWT verifiers keep an explicit `algorithms` allowlist; never trust the token's `alg` header, never allow `none`, always check `exp` / `nbf`.

package/templates/vercel/_agents/skills/daloyjs-best-practices/SKILL.md

@@ -94,7 +94,7 @@ definitions:
 
 - `GET /openapi.json` — OpenAPI 3.1 spec as JSON.
 - `GET /openapi.yaml` — OpenAPI 3.1 spec as YAML (served inline as
-  `text/yaml; charset=utf-8`, since `@daloyjs/core` 0.13.1).
+  `text/yaml; charset=utf-8`).
 - `GET /docs` — Scalar API reference UI that loads the spec.
 
 Customize via `docs: { openapiPath, openapiYamlPath, path, ui }`. Set
@@ -173,7 +173,7 @@ app.route({
 
 ## Error handling
 
-- Throw typed errors from `@daloyjs/core` — they serialize to RFC 7807
+- Throw typed errors from `@daloyjs/core` — they serialize to RFC 9457
   problem responses.
 - Add a `responses[code]` entry for every error you throw.
 
@@ -210,13 +210,13 @@ in-memory fake during tests.
 The shipped contract test should fail invalid examples, duplicate/missing
 `operationId`, or missing responses.
 
-Aim for **100% line and function coverage** on the routes you add.
+Aim for complete happy- and unhappy-path test coverage of the routes you add.
 
 ## Security best practices
 
 - Keep `secureHeaders()`, `requestId()`, and `rateLimit()` enabled. For
-  production traffic, back rate-limiting with Vercel KV or another
-  shared store so limits apply across instances.
+  production traffic, back rate-limiting with a shared store (e.g. Upstash
+  Redis from the Vercel Marketplace) so limits apply across instances.
 - Never make a failing test pass by deleting or weakening a security guard.
   If a guard blocks a legitimate route, add the narrowest per-route
   override or configuration knob and cover both the allowed and rejected
@@ -270,6 +270,11 @@ Aim for **100% line and function coverage** on the routes you add.
 - Do not weaken response literal types (`as const`).
 - Do not return errors as `{ status: 4xx, body }`. Throw a typed error.
 - Do not add runtime dependencies without checking the hardened `.npmrc` (installs wait 24h after publish by default).
+- If a route intentionally returns a body the contract cannot describe (a
+  raw `Response`, HTML, a proxied payload), set
+  `acknowledgeNoResponseBodySchema: true` on that route — never silence the
+  `security.response.bodySchemaMissing` boot warning by widening a schema
+  to `z.any()`.
 
 ## Process expectations
 
@@ -282,6 +287,18 @@ Aim for **100% line and function coverage** on the routes you add.
   authenticate on their behalf.
 - Keep `README.md`, this `SKILL.md`, and `AGENTS.md` consistent.
 
+## Exposing this API over MCP
+
+`@daloyjs/core` ships a dependency-free Model Context Protocol (Streamable
+HTTP) server helper — also available from the `@daloyjs/core/mcp` subpath.
+To expose selected capabilities to MCP clients (AI agents), build a handler
+with `createMcpHandler({ tools, resources, prompts })` and mount it with
+`mcpRoutes("/mcp", handler)`. Throw `McpToolError` for caller-correctable
+tool failures. The handler ships protocol-level guards (body cap, UTF-8/JSON
+validation, `Origin` checks against DNS rebinding) and composes with the
+existing middleware chain — put `bearerAuth()` / `rateLimit()` in front of
+it like any other route. See <https://daloyjs.dev/docs> for the MCP guide.
+
 ## More
 
 - Framework docs: <https://daloyjs.dev/docs>

package/templates/vercel/api/index.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { App, NotFoundError, requestId, secureHeaders } from "@daloyjs/core";
+import { App, NotFoundError, rateLimit, requestId, secureHeaders } from "@daloyjs/core";
 import { toFetchHandler } from "@daloyjs/core/vercel";
 
 // This template targets Vercel's Node.js runtime — the runtime Vercel now
@@ -44,6 +44,12 @@ export const app = new App({
 
 app.use(requestId());
 app.use(secureHeaders());
+// The in-memory limiter resets per function instance on Vercel, so treat it as
+// a per-instance abuse brake, not a global quota. For production traffic, back
+// it with a shared `RateLimitStore` (e.g. Upstash Redis from the Vercel
+// Marketplace) — in addition to, not instead of, this baseline. Do not remove
+// it to make a test pass; raise `max` per route.
+app.use(rateLimit({ windowMs: 60_000, max: 120 }));
 
 app.route({
   method: "GET",
@@ -57,13 +63,13 @@ app.route({
     },
   },
   handler: async () => ({
-    status: 200,
+    status: 200 as const,
     body: { ok: true as const, runtime: "vercel" as const },
   }),
 });
 
 // daloy-minimal:strip-start books
-const Book = z.object({ id: z.string(), title: z.string() });
+const Book = z.object({ id: z.string(), title: z.string() }).strict();
 const books = new Map<string, z.infer<typeof Book>>([
   ["1", { id: "1", title: "Noli Me Tangere" }],
 ]);
@@ -73,7 +79,7 @@ app.route({
   path: "/books/:id",
   operationId: "getBookById",
   tags: ["Books"],
-  request: { params: z.object({ id: z.string() }) },
+  request: { params: z.object({ id: z.string().min(1) }).strict() },
   responses: {
     200: { description: "Found", body: Book },
     404: { description: "Not found" },
@@ -81,7 +87,7 @@ app.route({
   handler: async ({ params }) => {
     const book = books.get(params.id);
     if (!book) throw new NotFoundError(`Book ${params.id} not found`);
-    return { status: 200, body: book };
+    return { status: 200 as const, body: book };
   },
 });
 // daloy-minimal:strip-end books

package/templates/vercel/package.json

@@ -13,7 +13,7 @@
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "dependencies": {
-    "@daloyjs/core": "^1.0.0-beta.6",
+    "@daloyjs/core": "^1.0.0-rc.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {