create-daloy 1.0.0-rc.4 → 1.0.0-rc.5

package/bin/create-daloy.mjs

@@ -58,8 +58,8 @@ const PACKAGE_MANAGERS = PACKAGE_MANAGER_OPTIONS.map((option) => option.value);
 // `--template <old>` commands (and published docs/blog posts) keep working.
 // Each maps to its current canonical template value.
 const TEMPLATE_ALIASES = new Map([
-  // `vercel` shipped before Vercel deprecated standalone Edge Functions;
-  // the template now targets the recommended Node.js runtime as `vercel`.
+  // The `vercel` template targets the Node.js runtime, which Vercel
+  // recommends over Edge for standalone functions (both run on Fluid compute).
 ]);
 
 const RENAME_ON_COPY = new Map([
@@ -487,6 +487,62 @@ const TOOL_INSTALL_GUIDES = {
   deno: { label: "Deno", url: "https://docs.deno.com/runtime/getting_started/installation/" },
 };
 
+// Version floors the scaffolder and the projects it generates depend on. The
+// CLI itself targets Node >= 24; npm scaffolds require npm >= 12 (see the
+// injected `engines.npm` + engine-strict `.npmrc`); pnpm scaffolds require
+// pnpm >= 11 (see the injected `engines.pnpm`, which pnpm always enforces).
+// The pnpm floor is security-relevant: older pnpm silently ignores the
+// `minimumReleaseAge` guardrail in the generated `pnpm-workspace.yaml`, so
+// the 24h supply-chain cooldown would be off without any warning. We surface
+// these up front so a user on an old runtime gets a clear "here's what to
+// install" message instead of a cryptic syntax error, npm's raw EBADENGINE
+// dump, or a silently weakened install posture.
+const MIN_NODE_MAJOR = 24;
+const MIN_NPM_MAJOR = 12;
+const MIN_PNPM_MAJOR = 11;
+
+/**
+ * Parse the leading major-version integer out of a version string such as
+ * `"v24.3.0"`, `"24.3.0"`, or `"10.8.2\n"`. Returns `NaN` when no leading
+ * number can be found so callers can fail open on an unrecognizable value.
+ *
+ * @param {string} version - a version string, e.g. `process.version` or `npm --version` output.
+ * @returns {number} the major version, or `NaN` if it cannot be parsed.
+ */
+function parseMajorVersion(version) {
+  const match = /(\d+)/.exec(String(version ?? "").trim());
+  return match ? Number(match[1]) : NaN;
+}
+
+/**
+ * Decide whether the running Node.js satisfies the DaloyJS floor. Fails **open**
+ * on an unparseable version so a valid-but-unusual runtime is never wrongly
+ * blocked.
+ *
+ * @param {string} [version=process.version] - the Node.js version to check.
+ * @returns {{ ok: boolean, major: number }} whether it meets the floor, plus the parsed major.
+ */
+function checkNodeVersion(version = process.version) {
+  const major = parseMajorVersion(version);
+  const ok = !Number.isFinite(major) || major >= MIN_NODE_MAJOR;
+  return { ok, major };
+}
+
+/**
+ * Resolve the installed major version of a CLI tool by running `<tool>
+ * --version`. Returns `NaN` when the tool is absent, errors, or prints an
+ * unparseable version — callers treat `NaN` as "unknown, don't block".
+ *
+ * @param {string} tool - bare executable name, e.g. `npm`.
+ * @param {string} [cwd] - working directory for the probe.
+ * @returns {Promise<number>} the tool's major version, or `NaN`.
+ */
+async function detectToolMajor(tool, cwd) {
+  const { code, output } = await runQuiet(tool, ["--version"], cwd);
+  if (code !== 0) return NaN;
+  return parseMajorVersion(output);
+}
+
 /**
  * Compute the CLIs a freshly-scaffolded project needs to run, given the chosen
  * template (which fixes the runtime) and package manager. Runtime-only
@@ -621,6 +677,21 @@ async function patchPackageJson(dir, projectName, packageManager) {
   if (json.scripts && packageManager && packageManager !== "pnpm") {
     json.scripts = rewriteScriptsForPackageManager(json.scripts, packageManager);
   }
+  // Package-manager engine floors are injected per manager so no project
+  // inherits an irrelevant constraint (templates ship without them):
+  // - npm scaffolds get `engines.npm >= 12`, paired with the engine-strict
+  //   `.npmrc` from normalizePackageManagerFiles so the floor is enforced,
+  //   not just advisory.
+  // - pnpm scaffolds get `engines.pnpm >= 11`; pnpm always enforces the
+  //   project's `engines.pnpm` (no engine-strict needed). The floor matters
+  //   because pnpm < 11 silently ignores `minimumReleaseAge` in
+  //   pnpm-workspace.yaml — the 24h supply-chain cooldown would be off.
+  if (packageManager === "npm") {
+    json.engines = { ...json.engines, npm: ">=12.0.0" };
+  }
+  if (packageManager === "pnpm") {
+    json.engines = { ...json.engines, pnpm: `>=${MIN_PNPM_MAJOR}.0.0` };
+  }
   await writeFile(file, JSON.stringify(json, null, 2) + "\n", "utf8");
 }
 
@@ -707,16 +778,36 @@ function rewriteScriptsForPackageManager(scripts, pm) {
   return out;
 }
 
+// npm-native `.npmrc` written for npm scaffolds. The pnpm-specific hardening
+// keys (minimum-release-age, verify-store-integrity, …) mean nothing to npm,
+// but `engine-strict=true` is honored by npm and turns the `engines.npm`
+// floor in package.json into a hard failure instead of a silent warning — so
+// DaloyJS's "npm >= 12" requirement is actually enforced at install time.
+const NPM_STRICT_NPMRC = `# DaloyJS install-time guardrails for the npm CLI.
+#
+# engine-strict makes npm refuse to install when the developer's npm (or
+# Node.js) is older than the "engines" floor in package.json — DaloyJS
+# requires npm >= 12 — instead of only printing a warning. Remove this line
+# only if you deliberately want to install on an unsupported npm version.
+engine-strict=true
+`;
+
 async function normalizePackageManagerFiles(dir, packageManager) {
   if (packageManager === "pnpm") return;
-  // The hardened `.npmrc` and `pnpm-workspace.yaml` only make sense for pnpm.
-  // Removing them keeps npm/yarn/bun scaffolds from inheriting pnpm-specific
-  // settings the chosen package manager would either ignore or misinterpret.
-  for (const file of [".npmrc", "pnpm-workspace.yaml"]) {
-    const target = path.join(dir, file);
-    if (existsSync(target)) {
-      await rm(target, { force: true });
-    }
+  // pnpm-workspace.yaml is pnpm-only; drop it for every other manager.
+  const workspace = path.join(dir, "pnpm-workspace.yaml");
+  if (existsSync(workspace)) {
+    await rm(workspace, { force: true });
+  }
+  // The hardened `.npmrc` is authored for pnpm. For npm we replace it with an
+  // npm-native `.npmrc` that keeps the one guardrail npm understands
+  // (`engine-strict=true`, enforcing the npm >= 12 engine floor). yarn and bun
+  // ignore or misinterpret these keys, so they get no `.npmrc` at all.
+  const npmrc = path.join(dir, ".npmrc");
+  if (packageManager === "npm") {
+    await writeFile(npmrc, NPM_STRICT_NPMRC, "utf8");
+  } else if (existsSync(npmrc)) {
+    await rm(npmrc, { force: true });
   }
 }
 
@@ -1789,6 +1880,26 @@ async function main() {
     process.exit(0);
   }
 
+  // Preflight: the CLI and every template it emits require a modern Node.js.
+  // `npm create daloy` / npx will happily run this on an old Node (engines are
+  // advisory there), so we check ourselves and stop with a clear, actionable
+  // message rather than scaffolding a project the user's runtime can't run.
+  const nodeCheck = checkNodeVersion();
+  if (!nodeCheck.ok) {
+    printBanner(await readPkgVersion());
+    logError(
+      `DaloyJS needs Node.js ${MIN_NODE_MAJOR} or newer — you're on ${process.version}.`,
+    );
+    console.log(
+      `  ${color(COLORS.yellow, SYMBOLS.pointer)} Install an up-to-date Node.js: ${color(COLORS.cyan + COLORS.underline, TOOL_INSTALL_GUIDES.node.url)}`,
+    );
+    console.log(
+      `  ${color(COLORS.yellow, SYMBOLS.pointer)} ${color(COLORS.dim, "Or switch versions with a manager like nvm, fnm, or Volta.")}`,
+    );
+    console.log("");
+    process.exit(1);
+  }
+
   printBanner(await readPkgVersion());
 
   const detectedPm = detectPackageManager();
@@ -1989,6 +2100,49 @@ async function main() {
       installDeps = false;
     }
 
+    // npm scaffolds require npm >= 12 (enforced by the injected engines.npm +
+    // engine-strict .npmrc). Detect an older npm here so we can explain the fix
+    // clearly instead of leaving the user with npm's raw EBADENGINE failure.
+    if (packageManager === "npm" && !missingTools.some((tool) => tool.tool === "npm")) {
+      const npmMajor = await detectToolMajor("npm", targetDir);
+      if (Number.isFinite(npmMajor) && npmMajor < MIN_NPM_MAJOR) {
+        logWarn(`This project requires npm >= ${MIN_NPM_MAJOR}, but you're on npm ${npmMajor}.x.`);
+        console.log(
+          `  ${color(COLORS.yellow, SYMBOLS.pointer)} Upgrade npm: ${color(COLORS.cyan, "npm install -g npm@latest")} ${color(COLORS.dim, `(or reinstall Node.js: ${TOOL_INSTALL_GUIDES.npm.url})`)}`,
+        );
+        if (installDeps) {
+          console.log(
+            `  ${color(COLORS.yellow, SYMBOLS.pointer)} ${color(COLORS.dim, "Skipping the automatic install until npm is up to date.")}`,
+          );
+          installDeps = false;
+        }
+      }
+    }
+
+    // pnpm scaffolds require pnpm >= 11 (enforced by the injected
+    // engines.pnpm, which pnpm always checks). The floor is security-relevant:
+    // pnpm < 11 silently ignores the pnpm-workspace.yaml `minimumReleaseAge`
+    // guardrail, so the 24h supply-chain cooldown would be off without any
+    // warning. Detect an older pnpm here and explain the fix clearly.
+    if (packageManager === "pnpm" && !missingTools.some((tool) => tool.tool === "pnpm")) {
+      const pnpmMajor = await detectToolMajor("pnpm", targetDir);
+      if (Number.isFinite(pnpmMajor) && pnpmMajor < MIN_PNPM_MAJOR) {
+        logWarn(`This project requires pnpm >= ${MIN_PNPM_MAJOR}, but you're on pnpm ${pnpmMajor}.x.`);
+        console.log(
+          `  ${color(COLORS.yellow, SYMBOLS.pointer)} Upgrade pnpm: ${color(COLORS.cyan, "npm install -g pnpm@latest")} ${color(COLORS.dim, `(or corepack use pnpm@latest — ${TOOL_INSTALL_GUIDES.pnpm.url})`)}`,
+        );
+        console.log(
+          `  ${color(COLORS.yellow, SYMBOLS.pointer)} ${color(COLORS.dim, `pnpm < ${MIN_PNPM_MAJOR} silently ignores minimumReleaseAge in pnpm-workspace.yaml, disabling the 24h supply-chain cooldown.`)}`,
+        );
+        if (installDeps) {
+          console.log(
+            `  ${color(COLORS.yellow, SYMBOLS.pointer)} ${color(COLORS.dim, "Skipping the automatic install until pnpm is up to date.")}`,
+          );
+          installDeps = false;
+        }
+      }
+    }
+
     if (installDeps) {
       const spinner = createSpinner(`Installing dependencies with ${color(COLORS.cyan, packageManager)}\u2026`);
       spinner.start();
@@ -2033,4 +2187,15 @@ if (process.env.DALOY_TEST_IMPORT !== "1") {
   await main();
 }
 
-export { choiceInputMode, requiredTools, missingToolGuides, isToolInstalled, TOOL_INSTALL_GUIDES };
+export {
+  choiceInputMode,
+  requiredTools,
+  missingToolGuides,
+  isToolInstalled,
+  TOOL_INSTALL_GUIDES,
+  parseMajorVersion,
+  checkNodeVersion,
+  MIN_NODE_MAJOR,
+  MIN_NPM_MAJOR,
+  MIN_PNPM_MAJOR,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-daloy",
-  "version": "1.0.0-rc.4",
+  "version": "1.0.0-rc.5",
   "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
   "type": "module",
   "license": "MIT",

package/sbom.cdx.json

@@ -1,25 +1,25 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:d3388094-26fe-5e1d-980d-c256c3d08aef",
+  "serialNumber": "urn:uuid:02713320-c651-582f-b203-48552fa27a2e",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-12T20:39:15.641Z",
+    "timestamp": "2026-07-20T09:04:50.510Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "1.0.0-rc.4"
+        "version": "1.0.0-rc.5"
       }
     ],
     "authors": [],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/create-daloy@1.0.0-rc.4",
+      "bom-ref": "pkg:npm/create-daloy@1.0.0-rc.5",
       "name": "create-daloy",
-      "version": "1.0.0-rc.4",
+      "version": "1.0.0-rc.5",
       "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
-      "purl": "pkg:npm/create-daloy@1.0.0-rc.4",
+      "purl": "pkg:npm/create-daloy@1.0.0-rc.5",
       "licenses": [
         {
           "license": {
@@ -42,9 +42,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag-create-daloy-1.0.0-rc.4",
+        "tagId": "swidtag-create-daloy-1.0.0-rc.5",
         "name": "create-daloy",
-        "version": "1.0.0-rc.4",
+        "version": "1.0.0-rc.5",
         "tagVersion": 0,
         "patch": false
       }
@@ -53,7 +53,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/create-daloy@1.0.0-rc.4",
+      "ref": "pkg:npm/create-daloy@1.0.0-rc.5",
       "dependsOn": []
     }
   ]

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "create-daloy-1.0.0-rc.4",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/create-daloy-1.0.0-rc.4-d3388094-26fe-5e1d-980d-c256c3d08aef",
+  "name": "create-daloy-1.0.0-rc.5",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/create-daloy-1.0.0-rc.5-02713320-c651-582f-b203-48552fa27a2e",
   "creationInfo": {
-    "created": "2026-07-12T20:39:15.641Z",
+    "created": "2026-07-20T09:04:50.510Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package-create-daloy",
       "name": "create-daloy",
-      "versionInfo": "1.0.0-rc.4",
+      "versionInfo": "1.0.0-rc.5",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/create-daloy@1.0.0-rc.4"
+          "referenceLocator": "pkg:npm/create-daloy@1.0.0-rc.5"
         }
       ]
     }

package/templates/bun-basic/_agents/skills/daloyjs-best-practices/SKILL.md

@@ -166,7 +166,7 @@ app.get(
     const book = await store.find(params.id);
     if (!book) throw new NotFoundError(`Book ${params.id} not found`);
     return { status: 200 as const, body: book };
-  },
+  }
 );
 ```
 
@@ -231,6 +231,9 @@ Cover both **happy paths and unhappy paths** for every route: valid input,
 validation failures (400), auth failures (401/403), not-found (404),
 conflicts (409), rate limiting (429). For external services, inject an
 in-memory fake via `buildApp({ store })` rather than mocking `fetch`.
+For user-owned or tenant-owned resources, use at least two principals and
+prove that Alice's valid token cannot list, read, update, or delete Bob's
+record.
 The shipped contract test should fail invalid examples, duplicate/missing
 `operationId`, or missing responses.
 
@@ -249,6 +252,17 @@ Aim for complete happy- and unhappy-path test coverage of the routes you add.
   at boot. Fail fast on missing config.
 - For auth, verify JWT signatures against an allowlist of keys, never
   trust the `alg` header, always check `exp` / `nbf`.
+- Authentication and scopes are not resource authorization. For every route
+  that accepts a resource id, classify the resource as public, user-owned,
+  tenant-owned, shared, or administrator-only.
+- Scope user-owned and tenant-owned database reads and writes with both the
+  caller-controlled id and the trusted owner / tenant from the verified
+  principal. Do not fetch by id alone and rely on the UI or a later caller to
+  remember the ownership check.
+- Never accept `ownerId`, `userId`, `tenantId`, `role`, or another privileged
+  ownership field from an ordinary request body. Derive it from the verified
+  principal and reject the field with a strict request schema.
+- Use an explicit, permissioned, audited path for administrator bypasses.
 - Validate redirects against an allowlist.
 - Set `bodyLimitBytes` and `requestTimeoutMs` on `new App({...})` to
   mitigate DoS.

package/templates/bun-basic/package.json

@@ -19,12 +19,12 @@
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "dependencies": {
-    "@daloyjs/core": "^1.0.0-rc.4",
+    "@daloyjs/core": "^1.0.0-rc.5",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@hey-api/openapi-ts": "^0.99.0",
+    "@hey-api/openapi-ts": "0.0.0-next-20260711024907",
     "@types/bun": "^1.1.0",
-    "typescript": "^6.0.3"
+    "typescript": "^7.0.2"
   }
 }

package/templates/cloudflare-worker/_agents/skills/daloyjs-best-practices/SKILL.md

@@ -167,7 +167,7 @@ function buildApp(env: Env) {
       const raw = await env.BOOKS.get(params.id, "json");
       if (!raw) throw new NotFoundError(`Book ${params.id} not found`);
       return { status: 200 as const, body: Book.parse(raw) };
-    },
+    }
   );
 
   return app;
@@ -230,6 +230,9 @@ Cover **happy paths and unhappy paths** for every route: valid input,
 validation failures (400), auth failures (401/403), not-found (404),
 conflict (409), rate limiting (429). For external services, inject an
 in-memory fake into `buildApp(env)` during tests.
+For user-owned or tenant-owned resources, use at least two principals and
+prove that Alice's valid token cannot list, read, update, or delete Bob's
+record.
 The shipped contract test should fail invalid examples, duplicate/missing
 `operationId`, or missing responses.
 
@@ -249,6 +252,17 @@ Aim for complete happy- and unhappy-path test coverage of the routes you add.
   `wrangler.toml`.
 - For auth, verify JWT signatures with the Web Crypto API
   (`crypto.subtle`). Never trust the `alg` header from the token.
+- Authentication and scopes are not resource authorization. For every route
+  that accepts a resource id, classify the resource as public, user-owned,
+  tenant-owned, shared, or administrator-only.
+- Scope user-owned and tenant-owned database reads and writes with both the
+  caller-controlled id and the trusted owner / tenant from the verified
+  principal. Do not fetch by id alone and rely on the UI or a later caller to
+  remember the ownership check.
+- Never accept `ownerId`, `userId`, `tenantId`, `role`, or another privileged
+  ownership field from an ordinary request body. Derive it from the verified
+  principal and reject the field with a strict request schema.
+- Use an explicit, permissioned, audited path for administrator bypasses.
 - Validate redirects against an allowlist.
 - Set `bodyLimitBytes` and `requestTimeoutMs` on `new App({...})` to
   mitigate DoS.

package/templates/cloudflare-worker/package.json

@@ -16,12 +16,12 @@
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "dependencies": {
-    "@daloyjs/core": "^1.0.0-rc.4",
+    "@daloyjs/core": "^1.0.0-rc.5",
     "zod": "^4.4.3"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^4.20240909.0",
-    "typescript": "^6.0.3",
+    "typescript": "^7.0.2",
     "wrangler": "^4.0.0"
   }
 }

package/templates/deno-basic/_agents/skills/daloyjs-best-practices/SKILL.md

@@ -167,7 +167,7 @@ app.get(
     const book = await store.find(params.id);
     if (!book) throw new NotFoundError(`Book ${params.id} not found`);
     return { status: 200 as const, body: book };
-  },
+  }
 );
 ```
 
@@ -228,6 +228,9 @@ Cover **happy paths and unhappy paths**: valid input, validation failures
 (400), auth failures (401/403), not-found (404), conflict (409), rate
 limiting (429). For external services, inject an in-memory fake via
 `buildApp({ store })`.
+For user-owned or tenant-owned resources, use at least two principals and
+prove that Alice's valid token cannot list, read, update, or delete Bob's
+record.
 The shipped contract test should fail invalid examples, duplicate/missing
 `operationId`, or missing responses.
 
@@ -249,6 +252,17 @@ Aim for complete happy- and unhappy-path test coverage of the routes you add.
   missing config.
 - For auth, verify JWT signatures against an allowlist of keys, never
   trust the `alg` header, always check `exp` / `nbf`.
+- Authentication and scopes are not resource authorization. For every route
+  that accepts a resource id, classify the resource as public, user-owned,
+  tenant-owned, shared, or administrator-only.
+- Scope user-owned and tenant-owned database reads and writes with both the
+  caller-controlled id and the trusted owner / tenant from the verified
+  principal. Do not fetch by id alone and rely on the UI or a later caller to
+  remember the ownership check.
+- Never accept `ownerId`, `userId`, `tenantId`, `role`, or another privileged
+  ownership field from an ordinary request body. Derive it from the verified
+  principal and reject the field with a strict request schema.
+- Use an explicit, permissioned, audited path for administrator bypasses.
 - Validate redirects against an allowlist.
 - Set `bodyLimitBytes` and `requestTimeoutMs` on `new App({...})` to
   mitigate DoS.

package/templates/deno-basic/deno.json

@@ -10,11 +10,11 @@
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "imports": {
-    "@daloyjs/core": "jsr:@daloyjs/daloy@^1.0.0-rc.4",
-    "@daloyjs/core/banner": "jsr:@daloyjs/daloy@^1.0.0-rc.4/banner",
-    "@daloyjs/core/contract": "jsr:@daloyjs/daloy@^1.0.0-rc.4/contract",
-    "@daloyjs/core/deno": "jsr:@daloyjs/daloy@^1.0.0-rc.4/deno",
-    "@daloyjs/core/openapi": "jsr:@daloyjs/daloy@^1.0.0-rc.4/openapi",
+    "@daloyjs/core": "jsr:@daloyjs/daloy@^1.0.0-rc.5",
+    "@daloyjs/core/banner": "jsr:@daloyjs/daloy@^1.0.0-rc.5/banner",
+    "@daloyjs/core/contract": "jsr:@daloyjs/daloy@^1.0.0-rc.5/contract",
+    "@daloyjs/core/deno": "jsr:@daloyjs/daloy@^1.0.0-rc.5/deno",
+    "@daloyjs/core/openapi": "jsr:@daloyjs/daloy@^1.0.0-rc.5/openapi",
     "zod": "npm:zod@^4.4.3"
   },
   "compilerOptions": {

package/templates/node-basic/_agents/skills/daloyjs-best-practices/SKILL.md

@@ -189,7 +189,7 @@ app.get(
     const book = await store.find(params.id);
     if (!book) throw new NotFoundError(`Book ${params.id} not found`);
     return { status: 200 as const, body: book };
-  },
+  }
 );
 ```
 
@@ -277,6 +277,9 @@ Cover both **happy paths** and **unhappy paths** for every route:
 - Validation failure: missing/invalid fields → `400` with problem details.
 - Auth failure (when applicable): unauthenticated → `401`; wrong scope →
   `403`.
+- Resource authorization (when a route accepts an id): Alice can access
+  Alice's record, but the same valid Alice token receives `404` for Bob's
+  record. Cover reads, lists, updates, and deletes where applicable.
 - Not found: unknown id → `404`.
 - Conflict: duplicate create → `409`.
 - Rate limit: hammer the route → `429` after the configured threshold.
@@ -307,6 +310,17 @@ honor them.
 - For auth, prefer a small JWT or session middleware over rolling your
   own. Verify signatures against an allowlist of keys, never trust the
   `alg` header from the token, and always check `exp` / `nbf`.
+- Authentication and scopes are not resource authorization. For every route
+  that accepts a resource id, classify the resource as public, user-owned,
+  tenant-owned, shared, or administrator-only.
+- Scope user-owned and tenant-owned database reads and writes with both the
+  caller-controlled id and the trusted owner / tenant from the verified
+  principal. Do not fetch by id alone and rely on the UI or a later caller to
+  remember the ownership check.
+- Never accept `ownerId`, `userId`, `tenantId`, `role`, or another privileged
+  ownership field from an ordinary request body. Derive it from the verified
+  principal and reject the field with a strict request schema.
+- Use an explicit, permissioned, audited path for administrator bypasses.
 - Validate redirects against an allowlist. Open redirects are an OWASP
   Top-10 issue.
 - Limit body sizes via `bodyLimitBytes` on `new App({...})` — large

package/templates/node-basic/package.json

@@ -20,12 +20,12 @@
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "dependencies": {
-    "@daloyjs/core": "^1.0.0-rc.4",
+    "@daloyjs/core": "^1.0.0-rc.5",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@hey-api/openapi-ts": "^0.99.0",
+    "@hey-api/openapi-ts": "0.0.0-next-20260711024907",
     "@types/node": "^26.1.0",
-    "typescript": "^6.0.3"
+    "typescript": "^7.0.2"
   }
 }

package/templates/vercel/_agents/skills/daloyjs-best-practices/SKILL.md

@@ -164,7 +164,7 @@ app.get(
     const book = await store.find(params.id);
     if (!book) throw new NotFoundError(`Book ${params.id} not found`);
     return { status: 200 as const, body: book };
-  },
+  }
 );
 ```
 
@@ -217,6 +217,9 @@ Cover **happy paths and unhappy paths** for every route: valid input,
 validation failures (400), auth failures (401/403), not-found (404),
 conflict (409), rate limiting (429). For external services, inject an
 in-memory fake during tests.
+For user-owned or tenant-owned resources, use at least two principals and
+prove that Alice's valid token cannot list, read, update, or delete Bob's
+record.
 The shipped contract test should fail invalid examples, duplicate/missing
 `operationId`, or missing responses.
 
@@ -237,6 +240,17 @@ Aim for complete happy- and unhappy-path test coverage of the routes you add.
 - For auth, verify JWT signatures with the Web Crypto API
   (`crypto.subtle`, available on both Node.js and Edge). Never trust the
   `alg` header from the token.
+- Authentication and scopes are not resource authorization. For every route
+  that accepts a resource id, classify the resource as public, user-owned,
+  tenant-owned, shared, or administrator-only.
+- Scope user-owned and tenant-owned database reads and writes with both the
+  caller-controlled id and the trusted owner / tenant from the verified
+  principal. Do not fetch by id alone and rely on the UI or a later caller to
+  remember the ownership check.
+- Never accept `ownerId`, `userId`, `tenantId`, `role`, or another privileged
+  ownership field from an ordinary request body. Derive it from the verified
+  principal and reject the field with a strict request schema.
+- Use an explicit, permissioned, audited path for administrator bypasses.
 - Validate redirects against an allowlist.
 - Set `bodyLimitBytes` and `requestTimeoutMs` on `new App({...})` to
   mitigate DoS.

package/templates/vercel/package.json

@@ -16,12 +16,12 @@
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "dependencies": {
-    "@daloyjs/core": "^1.0.0-rc.4",
+    "@daloyjs/core": "^1.0.0-rc.5",
     "zod": "^4.4.3"
   },
   "devDependencies": {
     "@types/node": "^26.1.0",
-    "typescript": "^6.0.3",
+    "typescript": "^7.0.2",
     "vercel": "^48.0.0"
   }
 }