create-daloy 1.0.0-rc.2 → 1.0.0-rc.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-daloy",
-  "version": "1.0.0-rc.2",
+  "version": "1.0.0-rc.4",
   "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
   "type": "module",
   "license": "MIT",

package/sbom.cdx.json

@@ -1,25 +1,25 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:e20f72cf-1e62-57e3-bb1f-3c578913560b",
+  "serialNumber": "urn:uuid:d3388094-26fe-5e1d-980d-c256c3d08aef",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-07T09:24:35.735Z",
+    "timestamp": "2026-07-12T20:39:15.641Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "1.0.0-rc.2"
+        "version": "1.0.0-rc.4"
       }
     ],
     "authors": [],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/create-daloy@1.0.0-rc.2",
+      "bom-ref": "pkg:npm/create-daloy@1.0.0-rc.4",
       "name": "create-daloy",
-      "version": "1.0.0-rc.2",
+      "version": "1.0.0-rc.4",
       "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
-      "purl": "pkg:npm/create-daloy@1.0.0-rc.2",
+      "purl": "pkg:npm/create-daloy@1.0.0-rc.4",
       "licenses": [
         {
           "license": {
@@ -42,9 +42,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag-create-daloy-1.0.0-rc.2",
+        "tagId": "swidtag-create-daloy-1.0.0-rc.4",
         "name": "create-daloy",
-        "version": "1.0.0-rc.2",
+        "version": "1.0.0-rc.4",
         "tagVersion": 0,
         "patch": false
       }
@@ -53,7 +53,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/create-daloy@1.0.0-rc.2",
+      "ref": "pkg:npm/create-daloy@1.0.0-rc.4",
       "dependsOn": []
     }
   ]

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "create-daloy-1.0.0-rc.2",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/create-daloy-1.0.0-rc.2-e20f72cf-1e62-57e3-bb1f-3c578913560b",
+  "name": "create-daloy-1.0.0-rc.4",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/create-daloy-1.0.0-rc.4-d3388094-26fe-5e1d-980d-c256c3d08aef",
   "creationInfo": {
-    "created": "2026-07-07T09:24:35.735Z",
+    "created": "2026-07-12T20:39:15.641Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package-create-daloy",
       "name": "create-daloy",
-      "versionInfo": "1.0.0-rc.2",
+      "versionInfo": "1.0.0-rc.4",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/create-daloy@1.0.0-rc.2"
+          "referenceLocator": "pkg:npm/create-daloy@1.0.0-rc.4"
         }
       ]
     }

package/templates/bun-basic/AGENTS.md

@@ -42,7 +42,7 @@ Do not write `.js` here — that's the Node NodeNext convention and will fail to
 
 ## Core rules
 
-1. The route definition is the contract. Method, path, request schemas, and response schemas live in one place — `app.route({...})`.
+1. The route definition is the contract. Method, path, request schemas, and response schemas live in one place — `app.get(path, contract, handler)` (or `app.route({...})` for reusable `defineRoute()` contracts or metadata-heavy routes).
 2. Validate every input with Zod or another Standard Schema-compatible validator. For Zod object schemas, use `.strict()` to reject unknown keys at the boundary.
 3. Preserve literal types in responses: `status: 200 as const`, `z.literal(...)` on discriminator fields. Codegen depends on these.
 4. Throw typed errors (`NotFoundError`, `BadRequestError`, etc.) from `@daloyjs/core` — never return raw error responses.

package/templates/bun-basic/_agents/skills/daloyjs-best-practices/SKILL.md

@@ -34,9 +34,13 @@ DaloyJS is a **contract-first** framework. Internalize these rules — every
 recommendation below follows from them:
 
 1. **The route definition is the contract.** Method, path, request schemas,
-   and response schemas live in one place (`app.route({...})`). The OpenAPI
-   spec, the typed client, and the runtime validation are all derived from
-   it.
+   and response schemas live in one place — `app.get(path, contract, handler)`
+   (and the matching `app.post`/`put`/`patch`/`delete`/`head` shorthands), or
+   `app.route({...})` when you need a reusable `defineRoute()` contract or a
+   metadata-heavy route. Both forms produce identical runtime behavior,
+   validation, security, and OpenAPI output. The OpenAPI spec, the typed
+   client, and the runtime validation are all derived from the route
+   definition.
 2. **Validation schemas protect every boundary.** This template uses Zod,
    and Daloy accepts any Standard Schema-compatible library. Body, params,
    query, and headers go through the declared schema.
@@ -118,10 +122,14 @@ when it helps consumers understand or safely automate the route:
 2. **Design schemas first.** Define request body/params/query/headers and a
    response body per status code. Prefer `z.object({...}).strict()` for
    inputs so unknown keys are rejected at the boundary.
-3. **Call `app.route({...})`** with `method`, `path`, `operationId`, `tags`,
-   `responses`, `handler` (plus `request` when accepting input). Add `meta`
-   examples / descriptions when the route is user-facing or consumed by
-   agents.
+3. **Call the method shorthand: `app.get(path, contract, handler)`** (or
+   `app.post`/`put`/`patch`/`delete`/`head` for other methods). The contract
+   object's required keys are `operationId`, `tags`, `responses`. Add
+   `request` when the route accepts input, and add `meta` examples /
+   descriptions when the route is user-facing or consumed by agents. Reach
+   for the full `app.route({ method, path, ...contract, handler })` form
+   instead when the route is built from a reusable `defineRoute()` contract,
+   or when composing many routes at once via `registerRoutes()`.
 4. **Return `{ status, body, headers? }` from the handler.** Always use
    `status: 200 as const` so the typed client can narrow.
 5. **Throw typed errors**, do not return raw error responses. Use
@@ -143,22 +151,23 @@ import { NotFoundError } from "@daloyjs/core";
 const Book = z.object({ id: z.string(), title: z.string() }).strict();
 const BookParams = z.object({ id: z.string().min(1) }).strict();
 
-app.route({
-  method: "GET",
-  path: "/books/:id",
-  operationId: "getBookById",
-  tags: ["Books"],
-  request: { params: BookParams },
-  responses: {
-    200: { description: "Found", body: Book },
-    404: { description: "Not found" },
+app.get(
+  "/books/:id",
+  {
+    operationId: "getBookById",
+    tags: ["Books"],
+    request: { params: BookParams },
+    responses: {
+      200: { description: "Found", body: Book },
+      404: { description: "Not found" },
+    },
   },
-  handler: async ({ params }) => {
+  async ({ params }) => {
     const book = await store.find(params.id);
     if (!book) throw new NotFoundError(`Book ${params.id} not found`);
     return { status: 200 as const, body: book };
   },
-});
+);
 ```
 
 ## Validation & schema conventions

package/templates/bun-basic/package.json

@@ -19,7 +19,7 @@
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "dependencies": {
-    "@daloyjs/core": "^1.0.0-rc.2",
+    "@daloyjs/core": "^1.0.0-rc.4",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/bun-basic/src/build-app.ts

@@ -58,22 +58,23 @@ export function buildApp(): App {
   app.use(secureHeaders());
   app.use(rateLimit({ windowMs: 60_000, max: 120 }));
 
-  app.route({
-    method: "GET",
-    path: "/healthz",
-    operationId: "healthz",
-    tags: ["Ops"],
-    responses: {
-      200: {
-        description: "Service is healthy",
-        body: z.object({ ok: z.literal(true), runtime: z.literal("bun") }),
+  app.get(
+    "/healthz",
+    {
+      operationId: "healthz",
+      tags: ["Ops"],
+      responses: {
+        200: {
+          description: "Service is healthy",
+          body: z.object({ ok: z.literal(true), runtime: z.literal("bun") }),
+        },
       },
     },
-    handler: async () => ({
+    async () => ({
       status: 200 as const,
       body: { ok: true as const, runtime: "bun" as const },
     }),
-  });
+  );
 
   // daloy-minimal:strip-start books
   const Book = z.object({ id: z.string(), title: z.string() }).strict();
@@ -82,22 +83,23 @@ export function buildApp(): App {
     ["2", { id: "2", title: "El Filibusterismo" }],
   ]);
 
-  app.route({
-    method: "GET",
-    path: "/books/:id",
-    operationId: "getBookById",
-    tags: ["Books"],
-    request: { params: z.object({ id: z.string().min(1) }).strict() },
-    responses: {
-      200: { description: "Found", body: Book },
-      404: { description: "Not found" },
+  app.get(
+    "/books/:id",
+    {
+      operationId: "getBookById",
+      tags: ["Books"],
+      request: { params: z.object({ id: z.string().min(1) }).strict() },
+      responses: {
+        200: { description: "Found", body: Book },
+        404: { description: "Not found" },
+      },
     },
-    handler: async ({ params }) => {
+    async ({ params }) => {
       const book = books.get(params.id);
       if (!book) throw new NotFoundError(`Book ${params.id} not found`);
       return { status: 200 as const, body: book };
     },
-  });
+  );
   // daloy-minimal:strip-end books
 
   return app;

package/templates/cloudflare-worker/AGENTS.md

@@ -30,7 +30,7 @@ A [DaloyJS](https://daloyjs.dev) REST API deployed to **Cloudflare Workers**. **
 
 ## Core rules
 
-1. The route definition is the contract. Method, path, request schemas, and response schemas live in one place — `app.route({...})`.
+1. The route definition is the contract. Method, path, request schemas, and response schemas live in one place — `app.get(path, contract, handler)` (or `app.route({...})` for reusable `defineRoute()` contracts or metadata-heavy routes).
 2. Validate every input with Zod or another Standard Schema-compatible validator. For Zod object schemas, use `.strict()` to reject unknown keys at the boundary.
 3. Preserve literal types in responses: `status: 200 as const`, `z.literal(...)` on discriminator fields.
 4. Throw typed errors (`NotFoundError`, `BadRequestError`, etc.) from `@daloyjs/core`.

package/templates/cloudflare-worker/_agents/skills/daloyjs-best-practices/SKILL.md

@@ -37,7 +37,11 @@ DaloyJS is a **contract-first** framework. On Workers, additionally:
    Cloudflare-specific bindings. No `node:` modules unless the user
    explicitly adds `nodejs_compat` to `wrangler.toml` and opts in.
 2. **The route definition is the contract.** Method, path, request
-   schemas, and response schemas live in one place (`app.route({...})`).
+   schemas, and response schemas live in one place. Use the shorthand
+   `app.get(path, contract, handler)` (`app.post`, `app.put`, `app.patch`,
+   `app.delete`, `app.head`) for ordinary routes; use `app.route({...})`
+   for reusable `defineRoute()` contracts, metadata-heavy routes, or when
+   composing many routes via `registerRoutes()`.
 3. **Validation schemas protect every boundary.** This template uses Zod,
    and Daloy accepts any Standard Schema-compatible library.
 4. **Preserve literal types.** Return `status: 200 as const`.
@@ -112,10 +116,14 @@ when it helps consumers understand or safely automate the route:
 
 1. **Open `src/index.ts`.**
 2. **Design schemas first.** Use `z.object({...}).strict()` for inputs.
-3. **Call `app.route({...})`** with `method`, `path`, `operationId`,
-   `tags`, `responses`, `handler` (plus `request` when accepting input).
-   Add `meta` examples / descriptions when the route is user-facing or
-   consumed by agents.
+3. **Call `app.get(path, contract, handler)`** (or the matching
+   `app.post`/`app.put`/`app.patch`/`app.delete`/`app.head` shorthand) with
+   a contract object holding `operationId`, `tags`, `responses` (plus
+   `request` when accepting input). Add `meta` examples / descriptions when
+   the route is user-facing or consumed by agents. Reach for the full
+   `app.route({...})` form instead when the contract is a reusable
+   `defineRoute()` value, is metadata-heavy, or is being composed with many
+   other routes via `registerRoutes()`.
 4. **Return `{ status, body, headers? }`** with `status: 200 as const`.
 5. **Throw typed errors** (`NotFoundError`, `BadRequestError`, etc.).
 6. **Add a test** under `tests/`. Use `app.request(...)` for pure logic;
@@ -144,22 +152,23 @@ function buildApp(env: Env) {
   app.use(secureHeaders());
   app.use(rateLimit({ windowMs: 60_000, max: 120 }));
 
-  app.route({
-    method: "GET",
-    path: "/books/:id",
-    operationId: "getBookById",
-    tags: ["Books"],
-    request: { params: z.object({ id: z.string().min(1) }).strict() },
-    responses: {
-      200: { description: "Found", body: Book },
-      404: { description: "Not found" },
+  app.get(
+    "/books/:id",
+    {
+      operationId: "getBookById",
+      tags: ["Books"],
+      request: { params: z.object({ id: z.string().min(1) }).strict() },
+      responses: {
+        200: { description: "Found", body: Book },
+        404: { description: "Not found" },
+      },
     },
-    handler: async ({ params }) => {
+    async ({ params }) => {
       const raw = await env.BOOKS.get(params.id, "json");
       if (!raw) throw new NotFoundError(`Book ${params.id} not found`);
       return { status: 200 as const, body: Book.parse(raw) };
     },
-  });
+  );
 
   return app;
 }

package/templates/cloudflare-worker/package.json

@@ -16,7 +16,7 @@
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "dependencies": {
-    "@daloyjs/core": "^1.0.0-rc.2",
+    "@daloyjs/core": "^1.0.0-rc.4",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/cloudflare-worker/src/index.ts

@@ -32,22 +32,23 @@ app.use(secureHeaders());
 // this baseline. Do not remove it to make a test pass; raise `max` per route.
 app.use(rateLimit({ windowMs: 60_000, max: 120 }));
 
-app.route({
-  method: "GET",
-  path: "/healthz",
-  operationId: "healthz",
-  tags: ["Ops"],
-  responses: {
-    200: {
-      description: "Service is healthy",
-      body: z.object({ ok: z.literal(true), runtime: z.literal("cloudflare-worker") }),
+app.get(
+  "/healthz",
+  {
+    operationId: "healthz",
+    tags: ["Ops"],
+    responses: {
+      200: {
+        description: "Service is healthy",
+        body: z.object({ ok: z.literal(true), runtime: z.literal("cloudflare-worker") }),
+      },
     },
   },
-  handler: async () => ({
+  async () => ({
     status: 200 as const,
     body: { ok: true as const, runtime: "cloudflare-worker" as const },
   }),
-});
+);
 
 // daloy-minimal:strip-start books
 const Book = z.object({ id: z.string(), title: z.string() }).strict();
@@ -55,22 +56,23 @@ const books = new Map<string, z.infer<typeof Book>>([
   ["1", { id: "1", title: "Noli Me Tangere" }],
 ]);
 
-app.route({
-  method: "GET",
-  path: "/books/:id",
-  operationId: "getBookById",
-  tags: ["Books"],
-  request: { params: z.object({ id: z.string().min(1) }).strict() },
-  responses: {
-    200: { description: "Found", body: Book },
-    404: { description: "Not found" },
+app.get(
+  "/books/:id",
+  {
+    operationId: "getBookById",
+    tags: ["Books"],
+    request: { params: z.object({ id: z.string().min(1) }).strict() },
+    responses: {
+      200: { description: "Found", body: Book },
+      404: { description: "Not found" },
+    },
   },
-  handler: async ({ params }) => {
+  async ({ params }) => {
     const book = books.get(params.id);
     if (!book) throw new NotFoundError(`Book ${params.id} not found`);
     return { status: 200 as const, body: book };
   },
-});
+);
 // daloy-minimal:strip-end books
 
 // Cloudflare invokes the default export's `fetch`. The `app` instance is also

package/templates/deno-basic/AGENTS.md

@@ -33,7 +33,7 @@ The typed Hey API SDK is generated outside Deno (Hey API has no Deno entrypoint
 
 ## Core rules
 
-1. The route definition is the contract. Method, path, request schemas, and response schemas live in one place — `app.route({...})`.
+1. The route definition is the contract. Method, path, request schemas, and response schemas live in one place — `app.get(path, contract, handler)` (or `app.route({...})` for reusable `defineRoute()` contracts or metadata-heavy routes).
 2. Validate every input with Zod or another Standard Schema-compatible validator. For Zod object schemas, use `.strict()` to reject unknown keys at the boundary.
 3. Preserve literal types in responses: `status: 200 as const`, `z.literal(...)` on discriminator fields.
 4. Throw typed errors (`NotFoundError`, `BadRequestError`, etc.) from `@daloyjs/core`.

package/templates/deno-basic/_agents/skills/daloyjs-best-practices/SKILL.md

@@ -35,7 +35,11 @@ Do **not** use this skill for tasks unrelated to the API itself.
 DaloyJS is a **contract-first** framework. Internalize these rules:
 
 1. **The route definition is the contract.** Method, path, request schemas,
-   and response schemas live in one place (`app.route({...})`).
+   and response schemas live in one place. Use the method shorthand —
+   `app.get(path, contract, handler)`, `app.post(...)`, etc. — for ordinary
+   routes; use `app.route({...})` for reusable `defineRoute()` contracts,
+   metadata-heavy routes, or when composing many routes via
+   `registerRoutes()`.
 2. **Validation schemas protect every boundary.** This template uses Zod,
    and Daloy accepts any Standard Schema-compatible library.
 3. **Preserve literal types.** Return `status: 200 as const`; use
@@ -120,10 +124,15 @@ when it helps consumers understand or safely automate the route:
 2. **Design schemas first.** Define request body/params/query/headers and a
    response body per status code. Prefer `z.object({...}).strict()` for
    inputs.
-3. **Call `app.route({...})`** with `method`, `path`, `operationId`,
-   `tags`, `responses`, `handler` (plus `request` when accepting input).
+3. **Call `app.get(path, {...}, handler)`** (or `app.post`, `app.put`,
+   `app.patch`, `app.delete`, `app.head` — the method shorthand) with
+   `operationId`, `tags`, `responses` in the contract object (plus
+   `request` when accepting input) and the handler as the third argument.
    Add `meta` examples / descriptions when the route is user-facing or
-   consumed by agents.
+   consumed by agents. Reach for the full `app.route({ method, path, ... })`
+   form instead when the contract is a reusable `defineRoute()` object,
+   the route carries heavy metadata, or you're composing many routes via
+   `registerRoutes()`.
 4. **Return `{ status, body, headers? }` from the handler.** Always
    `status: 200 as const`.
 5. **Throw typed errors** (`NotFoundError`, `BadRequestError`, etc.) from
@@ -143,22 +152,23 @@ import { NotFoundError } from "@daloyjs/core";
 const Book = z.object({ id: z.string(), title: z.string() }).strict();
 const BookParams = z.object({ id: z.string().min(1) }).strict();
 
-app.route({
-  method: "GET",
-  path: "/books/:id",
-  operationId: "getBookById",
-  tags: ["Books"],
-  request: { params: BookParams },
-  responses: {
-    200: { description: "Found", body: Book },
-    404: { description: "Not found" },
+app.get(
+  "/books/:id",
+  {
+    operationId: "getBookById",
+    tags: ["Books"],
+    request: { params: BookParams },
+    responses: {
+      200: { description: "Found", body: Book },
+      404: { description: "Not found" },
+    },
   },
-  handler: async ({ params }) => {
+  async ({ params }) => {
     const book = await store.find(params.id);
     if (!book) throw new NotFoundError(`Book ${params.id} not found`);
     return { status: 200 as const, body: book };
   },
-});
+);
 ```
 
 ## Validation & schema conventions

package/templates/deno-basic/deno.json

@@ -10,11 +10,11 @@
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "imports": {
-    "@daloyjs/core": "jsr:@daloyjs/daloy@^1.0.0-rc.2",
-    "@daloyjs/core/banner": "jsr:@daloyjs/daloy@^1.0.0-rc.2/banner",
-    "@daloyjs/core/contract": "jsr:@daloyjs/daloy@^1.0.0-rc.2/contract",
-    "@daloyjs/core/deno": "jsr:@daloyjs/daloy@^1.0.0-rc.2/deno",
-    "@daloyjs/core/openapi": "jsr:@daloyjs/daloy@^1.0.0-rc.2/openapi",
+    "@daloyjs/core": "jsr:@daloyjs/daloy@^1.0.0-rc.4",
+    "@daloyjs/core/banner": "jsr:@daloyjs/daloy@^1.0.0-rc.4/banner",
+    "@daloyjs/core/contract": "jsr:@daloyjs/daloy@^1.0.0-rc.4/contract",
+    "@daloyjs/core/deno": "jsr:@daloyjs/daloy@^1.0.0-rc.4/deno",
+    "@daloyjs/core/openapi": "jsr:@daloyjs/daloy@^1.0.0-rc.4/openapi",
     "zod": "npm:zod@^4.4.3"
   },
   "compilerOptions": {

package/templates/deno-basic/src/build-app.ts

@@ -59,22 +59,23 @@ export function buildApp(): App {
   app.use(secureHeaders());
   app.use(rateLimit({ windowMs: 60_000, max: 120 }));
 
-  app.route({
-    method: "GET",
-    path: "/healthz",
-    operationId: "healthz",
-    tags: ["Ops"],
-    responses: {
-      200: {
-        description: "Service is healthy",
-        body: z.object({ ok: z.literal(true), runtime: z.literal("deno") }),
+  app.get(
+    "/healthz",
+    {
+      operationId: "healthz",
+      tags: ["Ops"],
+      responses: {
+        200: {
+          description: "Service is healthy",
+          body: z.object({ ok: z.literal(true), runtime: z.literal("deno") }),
+        },
       },
     },
-    handler: async () => ({
+    async () => ({
       status: 200 as const,
       body: { ok: true as const, runtime: "deno" as const },
     }),
-  });
+  );
 
   // daloy-minimal:strip-start books
   const Book = z.object({ id: z.string(), title: z.string() }).strict();
@@ -83,22 +84,23 @@ export function buildApp(): App {
     ["2", { id: "2", title: "El Filibusterismo" }],
   ]);
 
-  app.route({
-    method: "GET",
-    path: "/books/:id",
-    operationId: "getBookById",
-    tags: ["Books"],
-    request: { params: z.object({ id: z.string().min(1) }).strict() },
-    responses: {
-      200: { description: "Found", body: Book },
-      404: { description: "Not found" },
+  app.get(
+    "/books/:id",
+    {
+      operationId: "getBookById",
+      tags: ["Books"],
+      request: { params: z.object({ id: z.string().min(1) }).strict() },
+      responses: {
+        200: { description: "Found", body: Book },
+        404: { description: "Not found" },
+      },
     },
-    handler: async ({ params }) => {
+    async ({ params }) => {
       const book = books.get(params.id);
       if (!book) throw new NotFoundError(`Book ${params.id} not found`);
       return { status: 200 as const, body: book };
     },
-  });
+  );
   // daloy-minimal:strip-end books
 
   return app;

package/templates/node-basic/AGENTS.md

@@ -48,7 +48,7 @@ You import the file you see. On `pnpm build`, TypeScript rewrites the `.ts` spec
 
 ## Core rules
 
-1. The route definition is the contract. Method, path, request schemas, and response schemas live in one place — `app.route({...})`.
+1. The route definition is the contract: `app.get(path, contract, handler)` shorthand, or `app.route({...})` for reusable `defineRoute()` contracts.
 2. Validate every input with Zod or another Standard Schema-compatible validator. For Zod object schemas, use `.strict()` to reject unknown keys at the boundary.
 3. Preserve literal types in responses: `status: 200 as const`, `z.literal(...)` on discriminator fields. Codegen depends on these.
 4. Throw typed errors (`NotFoundError`, `BadRequestError`, etc.) from `@daloyjs/core` — never return raw error responses.
@@ -71,9 +71,6 @@ Per Supabase + Aikido on [secure-by-default development](https://www.aikido.dev/
 
 ## Process expectations
 
-- Quality gates must pass before declaring work done: `pnpm typecheck` and `pnpm test`.
-- Update the OpenAPI spec and typed client whenever route shapes change (`pnpm gen`) and run the contract gate (`pnpm contract`).
 - Bug fixes include a regression test.
-- Never bypass safety checks (`--no-verify`, `--ignore-scripts=false`) without a clear reason.
 
 For the full workflow — adding routes step-by-step, schema conventions, testing patterns, security guidance, and deployment notes — read [.agents/skills/daloyjs-best-practices/SKILL.md](.agents/skills/daloyjs-best-practices/SKILL.md).

package/templates/node-basic/_agents/skills/daloyjs-best-practices/SKILL.md

@@ -35,10 +35,14 @@ DaloyJS is a **contract-first** framework. Internalize these rules — every
 recommendation below follows from them:
 
 1. **The route definition is the contract.** Method, path, request schemas,
-   and response schemas live in one place (`app.route({...})`). The OpenAPI
-   spec, the typed client, and the runtime validation are all derived from
-   it. Never duplicate that information by hand-writing fetch calls, types,
-   or `openapi.json` entries.
+   and response schemas live in one place — `app.get(path, contract, handler)`
+   (and the matching `app.post`/`put`/`patch`/`delete`/`head` shorthands), or
+   `app.route({...})` when you need a reusable `defineRoute()` contract or a
+   metadata-heavy route. Both forms produce identical runtime behavior,
+   validation, security, and OpenAPI output. The OpenAPI spec, the typed
+   client, and the runtime validation are all derived from the route
+   definition. Never duplicate that information by hand-writing fetch calls,
+   types, or `openapi.json` entries.
 2. **Validation schemas protect every boundary.** This template uses Zod,
    and Daloy accepts any Standard Schema-compatible library. Body, params,
    query, and headers go through the declared schema. If a field is not in
@@ -136,10 +140,14 @@ bugs (drifted client SDK, missing test, broken codegen).
    them in `src/build-app.ts` or extract a `src/schemas/*.ts` module if
    they grow. Prefer `z.object({...}).strict()` for inputs so unknown
    keys are rejected at the boundary.
-3. **Call `app.route({...})`.** Required keys: `method`, `path`,
-   `operationId`, `tags`, `responses`, `handler`. Add `request` when the
-   route accepts input, and add `meta` examples / descriptions when the
-   route is user-facing or consumed by agents.
+3. **Call the method shorthand: `app.get(path, contract, handler)`** (or
+   `app.post`/`put`/`patch`/`delete`/`head` for other methods). The contract
+   object's required keys are `operationId`, `tags`, `responses`. Add
+   `request` when the route accepts input, and add `meta` examples /
+   descriptions when the route is user-facing or consumed by agents. Reach
+   for the full `app.route({ method, path, ...contract, handler })` form
+   instead when the route is built from a reusable `defineRoute()` contract,
+   or when composing many routes at once via `registerRoutes()`.
 4. **Return `{ status, body, headers? }` from the handler.** Always use
    `status: 200 as const` (or whatever code) so the typed client can
    narrow. For literal discriminators in `body`, use `as const` or
@@ -166,22 +174,23 @@ import { NotFoundError } from "@daloyjs/core";
 const Book = z.object({ id: z.string(), title: z.string() }).strict();
 const BookParams = z.object({ id: z.string().min(1) }).strict();
 
-app.route({
-  method: "GET",
-  path: "/books/:id",
-  operationId: "getBookById",
-  tags: ["Books"],
-  request: { params: BookParams },
-  responses: {
-    200: { description: "Found", body: Book },
-    404: { description: "Not found" },
+app.get(
+  "/books/:id",
+  {
+    operationId: "getBookById",
+    tags: ["Books"],
+    request: { params: BookParams },
+    responses: {
+      200: { description: "Found", body: Book },
+      404: { description: "Not found" },
+    },
   },
-  handler: async ({ params }) => {
+  async ({ params }) => {
     const book = await store.find(params.id);
     if (!book) throw new NotFoundError(`Book ${params.id} not found`);
     return { status: 200 as const, body: book };
   },
-});
+);
 ```
 
 ## Validation & schema conventions

package/templates/node-basic/package.json

@@ -20,7 +20,7 @@
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "dependencies": {
-    "@daloyjs/core": "^1.0.0-rc.2",
+    "@daloyjs/core": "^1.0.0-rc.4",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/node-basic/src/build-app.ts

@@ -63,22 +63,23 @@ export function buildApp(): App {
   app.use(secureHeaders());
   app.use(rateLimit({ windowMs: 60_000, max: 120 }));
 
-  app.route({
-    method: "GET",
-    path: "/healthz",
-    operationId: "healthz",
-    tags: ["Ops"],
-    responses: {
-      200: {
-        description: "Service is healthy",
-        body: z.object({ ok: z.literal(true), uptime: z.number() }),
+  app.get(
+    "/healthz",
+    {
+      operationId: "healthz",
+      tags: ["Ops"],
+      responses: {
+        200: {
+          description: "Service is healthy",
+          body: z.object({ ok: z.literal(true), uptime: z.number() }),
+        },
       },
     },
-    handler: async () => ({
+    async () => ({
       status: 200 as const,
       body: { ok: true as const, uptime: process.uptime() },
     }),
-  });
+  );
 
   // daloy-minimal:strip-start books
   const Book = z.object({ id: z.string(), title: z.string() }).strict();
@@ -87,22 +88,23 @@ export function buildApp(): App {
     ["2", { id: "2", title: "El Filibusterismo" }],
   ]);
 
-  app.route({
-    method: "GET",
-    path: "/books/:id",
-    operationId: "getBookById",
-    tags: ["Books"],
-    request: { params: z.object({ id: z.string().min(1) }).strict() },
-    responses: {
-      200: { description: "Found", body: Book },
-      404: { description: "Not found" },
+  app.get(
+    "/books/:id",
+    {
+      operationId: "getBookById",
+      tags: ["Books"],
+      request: { params: z.object({ id: z.string().min(1) }).strict() },
+      responses: {
+        200: { description: "Found", body: Book },
+        404: { description: "Not found" },
+      },
     },
-    handler: async ({ params }) => {
+    async ({ params }) => {
       const book = books.get(params.id);
       if (!book) throw new NotFoundError(`Book ${params.id} not found`);
       return { status: 200 as const, body: book };
     },
-  });
+  );
   // daloy-minimal:strip-end books
 
   return app;

package/templates/vercel/AGENTS.md

@@ -42,7 +42,7 @@ You import the file you see. Vercel resolves `.ts` at deploy time; Node runs it
 
 ## Core rules
 
-1. The route definition is the contract. Method, path, request schemas, and response schemas live in one place — `app.route({...})`.
+1. The route definition is the contract. Method, path, request schemas, and response schemas live in one place — `app.get(path, contract, handler)` (or `app.route({...})` for reusable `defineRoute()` contracts or metadata-heavy routes).
 2. Validate every input with Zod or another Standard Schema-compatible validator. For Zod object schemas, use `.strict()` to reject unknown keys at the boundary.
 3. Preserve literal types in responses: `status: 200 as const`, `z.literal(...)` on discriminator fields.
 4. Throw typed errors (`NotFoundError`, `BadRequestError`, etc.) from `@daloyjs/core`.
@@ -57,11 +57,11 @@ You import the file you see. Vercel resolves `.ts` at deploy time; Node runs it
 Per Supabase + Aikido on [secure-by-default development](https://www.aikido.dev/blog/supabase-approach-to-secure-by-default-development): _"If you tell an AI to make something work, it might remove the very security checks that protect you."_ When a guard rejects a request, **satisfy it, do not delete it.**
 
 - Keep `secureHeaders()`, `requestId()`, `rateLimit()`, `bodyLimitBytes`, and `requestTimeoutMs`. For production, back rate limits with a shared store such as Upstash Redis from the Vercel Marketplace.
-- Keep Zod `.strict()` on top-level request objects; do not switch to `.passthrough()`. For other validators, use the strict / no-extra-keys equivalent. Keep `responses[N].body` schemas tight; never widen to `z.any()` to let a privileged field escape.
+- Keep Zod `.strict()` on top-level request objects; do not switch to `.passthrough()`. Keep `responses[N].body` schemas tight; never widen to `z.any()` to let a privileged field escape.
 - Every protected route attaches auth `beforeHandle` and tests unauthenticated `401` plus wrong-scope `403`.
 - JWT verifiers keep an explicit `algorithms` allowlist; never trust the token's `alg` header, never allow `none`, always check `exp` / `nbf`.
 - Credential / HMAC comparisons use constant-time comparison, never `===`. Throw typed errors so problem+json redacts in prod.
-- Keep the single `api/index.ts` entry and the `vercel.json` rewrite so DaloyJS owns routing — do not split into per-path files that bypass the middleware chain, and do not remove the rewrite (the root domain would 404).
+- Keep the single `api/index.ts` entry and the `vercel.json` rewrite; do not split into per-path files or remove the rewrite (the root domain would 404).
 - `.env`, `.env.local`, secrets, private keys: never commit. Use `vercel env` for production secrets.
 
 ## Process expectations

package/templates/vercel/_agents/skills/daloyjs-best-practices/SKILL.md

@@ -41,7 +41,12 @@ DaloyJS is a **contract-first** framework. On Vercel, additionally:
    need it (`export const runtime = "edge"` + `toWebHandler(app)`), and
    then drop `node:` modules.
 2. **The route definition is the contract.** Method, path, request
-   schemas, and response schemas live in one place (`app.route({...})`).
+   schemas, and response schemas live in one place — `app.get(path,
+   contract, handler)` (and the matching `app.post`/`put`/`patch`/
+   `delete`/`head` shorthands), or `app.route({...})` when you need a
+   reusable `defineRoute()` contract or a metadata-heavy route. Both
+   forms produce identical runtime behavior, validation, security, and
+   OpenAPI output.
 3. **Validation schemas protect every boundary.** This template uses Zod,
    and Daloy accepts any Standard Schema-compatible library.
 4. **Preserve literal types.** Return `status: 200 as const`.
@@ -120,10 +125,14 @@ when it helps consumers understand or safely automate the route:
 
 1. **Open `api/index.ts`.**
 2. **Design schemas first.** Use `z.object({...}).strict()` for inputs.
-3. **Call `app.route({...})`** with `method`, `path`, `operationId`,
-   `tags`, `responses`, `handler` (plus `request` when accepting input).
-   Add `meta` examples / descriptions when the route is user-facing or
-   consumed by agents.
+3. **Call the method shorthand: `app.get(path, contract, handler)`** (or
+   `app.post`/`put`/`patch`/`delete`/`head` for other methods). The
+   contract object's required keys are `operationId`, `tags`, `responses`.
+   Add `request` when the route accepts input, and add `meta` examples /
+   descriptions when the route is user-facing or consumed by agents.
+   Reach for the full `app.route({ method, path, ...contract, handler })`
+   form instead when the route is built from a reusable `defineRoute()`
+   contract, or when composing many routes at once via `registerRoutes()`.
 4. **Return `{ status, body, headers? }`** with `status: 200 as const`.
 5. **Throw typed errors** (`NotFoundError`, `BadRequestError`, etc.)
    from `@daloyjs/core`.
@@ -140,22 +149,23 @@ import { NotFoundError } from "@daloyjs/core";
 const Book = z.object({ id: z.string(), title: z.string() }).strict();
 const BookParams = z.object({ id: z.string().min(1) }).strict();
 
-app.route({
-  method: "GET",
-  path: "/books/:id",
-  operationId: "getBookById",
-  tags: ["Books"],
-  request: { params: BookParams },
-  responses: {
-    200: { description: "Found", body: Book },
-    404: { description: "Not found" },
+app.get(
+  "/books/:id",
+  {
+    operationId: "getBookById",
+    tags: ["Books"],
+    request: { params: BookParams },
+    responses: {
+      200: { description: "Found", body: Book },
+      404: { description: "Not found" },
+    },
   },
-  handler: async ({ params }) => {
+  async ({ params }) => {
     const book = await store.find(params.id);
     if (!book) throw new NotFoundError(`Book ${params.id} not found`);
     return { status: 200 as const, body: book };
   },
-});
+);
 ```
 
 ## Validation & schema conventions

package/templates/vercel/api/index.ts

@@ -51,22 +51,23 @@ app.use(secureHeaders());
 // it to make a test pass; raise `max` per route.
 app.use(rateLimit({ windowMs: 60_000, max: 120 }));
 
-app.route({
-  method: "GET",
-  path: "/healthz",
-  operationId: "healthz",
-  tags: ["Ops"],
-  responses: {
-    200: {
-      description: "Service is healthy",
-      body: z.object({ ok: z.literal(true), runtime: z.literal("vercel") }),
+app.get(
+  "/healthz",
+  {
+    operationId: "healthz",
+    tags: ["Ops"],
+    responses: {
+      200: {
+        description: "Service is healthy",
+        body: z.object({ ok: z.literal(true), runtime: z.literal("vercel") }),
+      },
     },
   },
-  handler: async () => ({
+  async () => ({
     status: 200 as const,
     body: { ok: true as const, runtime: "vercel" as const },
   }),
-});
+);
 
 // daloy-minimal:strip-start books
 const Book = z.object({ id: z.string(), title: z.string() }).strict();
@@ -74,22 +75,23 @@ const books = new Map<string, z.infer<typeof Book>>([
   ["1", { id: "1", title: "Noli Me Tangere" }],
 ]);
 
-app.route({
-  method: "GET",
-  path: "/books/:id",
-  operationId: "getBookById",
-  tags: ["Books"],
-  request: { params: z.object({ id: z.string().min(1) }).strict() },
-  responses: {
-    200: { description: "Found", body: Book },
-    404: { description: "Not found" },
+app.get(
+  "/books/:id",
+  {
+    operationId: "getBookById",
+    tags: ["Books"],
+    request: { params: z.object({ id: z.string().min(1) }).strict() },
+    responses: {
+      200: { description: "Found", body: Book },
+      404: { description: "Not found" },
+    },
   },
-  handler: async ({ params }) => {
+  async ({ params }) => {
     const book = books.get(params.id);
     if (!book) throw new NotFoundError(`Book ${params.id} not found`);
     return { status: 200 as const, body: book };
   },
-});
+);
 // daloy-minimal:strip-end books
 
 export default toFetchHandler(app);

package/templates/vercel/package.json

@@ -16,7 +16,7 @@
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "dependencies": {
-    "@daloyjs/core": "^1.0.0-rc.2",
+    "@daloyjs/core": "^1.0.0-rc.4",
     "zod": "^4.4.3"
   },
   "devDependencies": {