create-daloy 1.0.0-rc.6 → 1.0.0-rc.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (13) hide show
  1. package/package.json +1 -1
  2. package/sbom.cdx.json +9 -9
  3. package/sbom.spdx.json +5 -5
  4. package/templates/bun-basic/_agents/skills/daloyjs-best-practices/SKILL.md +11 -0
  5. package/templates/bun-basic/package.json +1 -1
  6. package/templates/cloudflare-worker/_agents/skills/daloyjs-best-practices/SKILL.md +11 -0
  7. package/templates/cloudflare-worker/package.json +1 -1
  8. package/templates/deno-basic/_agents/skills/daloyjs-best-practices/SKILL.md +11 -0
  9. package/templates/deno-basic/deno.json +5 -5
  10. package/templates/node-basic/_agents/skills/daloyjs-best-practices/SKILL.md +11 -0
  11. package/templates/node-basic/package.json +1 -1
  12. package/templates/vercel/_agents/skills/daloyjs-best-practices/SKILL.md +11 -0
  13. package/templates/vercel/package.json +1 -1
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "create-daloy",
3
- "version": "1.0.0-rc.6",
3
+ "version": "1.0.0-rc.7",
4
4
  "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
5
5
  "type": "module",
6
6
  "license": "MIT",
package/sbom.cdx.json CHANGED
@@ -1,25 +1,25 @@
1
1
  {
2
2
  "bomFormat": "CycloneDX",
3
3
  "specVersion": "1.5",
4
- "serialNumber": "urn:uuid:821d3273-581c-5c7e-abdb-d3521aff45ba",
4
+ "serialNumber": "urn:uuid:9abe4827-9ee2-5dd2-995b-b03c4ea6b973",
5
5
  "version": 1,
6
6
  "metadata": {
7
- "timestamp": "2026-07-26T17:41:33.809Z",
7
+ "timestamp": "2026-07-29T20:03:39.587Z",
8
8
  "tools": [
9
9
  {
10
10
  "vendor": "DaloyJS",
11
11
  "name": "daloy-generate-sbom",
12
- "version": "1.0.0-rc.6"
12
+ "version": "1.0.0-rc.7"
13
13
  }
14
14
  ],
15
15
  "authors": [],
16
16
  "component": {
17
17
  "type": "library",
18
- "bom-ref": "pkg:npm/create-daloy@1.0.0-rc.6",
18
+ "bom-ref": "pkg:npm/create-daloy@1.0.0-rc.7",
19
19
  "name": "create-daloy",
20
- "version": "1.0.0-rc.6",
20
+ "version": "1.0.0-rc.7",
21
21
  "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
22
- "purl": "pkg:npm/create-daloy@1.0.0-rc.6",
22
+ "purl": "pkg:npm/create-daloy@1.0.0-rc.7",
23
23
  "licenses": [
24
24
  {
25
25
  "license": {
@@ -42,9 +42,9 @@
42
42
  }
43
43
  ],
44
44
  "swid": {
45
- "tagId": "swidtag-create-daloy-1.0.0-rc.6",
45
+ "tagId": "swidtag-create-daloy-1.0.0-rc.7",
46
46
  "name": "create-daloy",
47
- "version": "1.0.0-rc.6",
47
+ "version": "1.0.0-rc.7",
48
48
  "tagVersion": 0,
49
49
  "patch": false
50
50
  }
@@ -53,7 +53,7 @@
53
53
  "components": [],
54
54
  "dependencies": [
55
55
  {
56
- "ref": "pkg:npm/create-daloy@1.0.0-rc.6",
56
+ "ref": "pkg:npm/create-daloy@1.0.0-rc.7",
57
57
  "dependsOn": []
58
58
  }
59
59
  ]
package/sbom.spdx.json CHANGED
@@ -2,10 +2,10 @@
2
2
  "spdxVersion": "SPDX-2.3",
3
3
  "dataLicense": "CC0-1.0",
4
4
  "SPDXID": "SPDXRef-DOCUMENT",
5
- "name": "create-daloy-1.0.0-rc.6",
6
- "documentNamespace": "https://github.com/daloyjs/daloy/sbom/create-daloy-1.0.0-rc.6-821d3273-581c-5c7e-abdb-d3521aff45ba",
5
+ "name": "create-daloy-1.0.0-rc.7",
6
+ "documentNamespace": "https://github.com/daloyjs/daloy/sbom/create-daloy-1.0.0-rc.7-9abe4827-9ee2-5dd2-995b-b03c4ea6b973",
7
7
  "creationInfo": {
8
- "created": "2026-07-26T17:41:33.809Z",
8
+ "created": "2026-07-29T20:03:39.587Z",
9
9
  "creators": [
10
10
  "Tool: daloy-generate-sbom",
11
11
  "Organization: DaloyJS"
@@ -16,7 +16,7 @@
16
16
  {
17
17
  "SPDXID": "SPDXRef-Package-create-daloy",
18
18
  "name": "create-daloy",
19
- "versionInfo": "1.0.0-rc.6",
19
+ "versionInfo": "1.0.0-rc.7",
20
20
  "downloadLocation": "https://github.com/daloyjs/daloy",
21
21
  "filesAnalyzed": false,
22
22
  "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
27
27
  {
28
28
  "referenceCategory": "PACKAGE-MANAGER",
29
29
  "referenceType": "purl",
30
- "referenceLocator": "pkg:npm/create-daloy@1.0.0-rc.6"
30
+ "referenceLocator": "pkg:npm/create-daloy@1.0.0-rc.7"
31
31
  }
32
32
  ]
33
33
  }
package/templates/bun-basic/_agents/skills/daloyjs-best-practices/SKILL.md CHANGED
@@ -349,6 +349,17 @@ validation, `Origin` checks against DNS rebinding) and composes with the
349
349
  existing middleware chain — put `bearerAuth()` / `rateLimit()` in front of
350
350
  it like any other route. See <https://daloyjs.dev/docs> for the MCP guide.
351
351
 
352
+ The handler speaks the stateless MCP `2026-07-28` revision and every earlier
353
+ one on the same endpoint: modern clients get `server/discover`, per-request
354
+ `_meta`, `resultType` results, caching hints, and multi round-trip requests
355
+ (return `{ resultType: "input_required", inputRequests, requestState }` instead
356
+ of a final result), while legacy clients keep the `initialize` handshake. The
357
+ required `MCP-Protocol-Version` / `Mcp-Method` / `Mcp-Name` headers are
358
+ validated against the body — never relax that check. Treat an incoming
359
+ `requestState` as attacker-controlled: sign it, bind it to the principal and
360
+ the originating request, and give it a short expiry before it influences
361
+ anything.
362
+
352
363
  ## More
353
364
 
354
365
  - Framework docs: <https://daloyjs.dev/docs>
package/templates/bun-basic/package.json CHANGED
@@ -19,7 +19,7 @@
19
19
  "hooks:install": "git config core.hooksPath .githooks"
20
20
  },
21
21
  "dependencies": {
22
- "@daloyjs/core": "^1.0.0-rc.6",
22
+ "@daloyjs/core": "^1.0.0-rc.7",
23
23
  "zod": "^4.4.3"
24
24
  },
25
25
  "devDependencies": {
package/templates/cloudflare-worker/_agents/skills/daloyjs-best-practices/SKILL.md CHANGED
@@ -353,6 +353,17 @@ validation, `Origin` checks against DNS rebinding) and composes with the
353
353
  existing middleware chain — put `bearerAuth()` / `rateLimit()` in front of
354
354
  it like any other route. See <https://daloyjs.dev/docs> for the MCP guide.
355
355
 
356
+ The handler speaks the stateless MCP `2026-07-28` revision and every earlier
357
+ one on the same endpoint: modern clients get `server/discover`, per-request
358
+ `_meta`, `resultType` results, caching hints, and multi round-trip requests
359
+ (return `{ resultType: "input_required", inputRequests, requestState }` instead
360
+ of a final result), while legacy clients keep the `initialize` handshake. The
361
+ required `MCP-Protocol-Version` / `Mcp-Method` / `Mcp-Name` headers are
362
+ validated against the body — never relax that check. Treat an incoming
363
+ `requestState` as attacker-controlled: sign it, bind it to the principal and
364
+ the originating request, and give it a short expiry before it influences
365
+ anything.
366
+
356
367
  ## More
357
368
 
358
369
  - Framework docs: <https://daloyjs.dev/docs>
package/templates/cloudflare-worker/package.json CHANGED
@@ -16,7 +16,7 @@
16
16
  "hooks:install": "git config core.hooksPath .githooks"
17
17
  },
18
18
  "dependencies": {
19
- "@daloyjs/core": "^1.0.0-rc.6",
19
+ "@daloyjs/core": "^1.0.0-rc.7",
20
20
  "zod": "^4.4.3"
21
21
  },
22
22
  "devDependencies": {
package/templates/deno-basic/_agents/skills/daloyjs-best-practices/SKILL.md CHANGED
@@ -340,6 +340,17 @@ validation, `Origin` checks against DNS rebinding) and composes with the
340
340
  existing middleware chain — put `bearerAuth()` / `rateLimit()` in front of
341
341
  it like any other route. See <https://daloyjs.dev/docs> for the MCP guide.
342
342
 
343
+ The handler speaks the stateless MCP `2026-07-28` revision and every earlier
344
+ one on the same endpoint: modern clients get `server/discover`, per-request
345
+ `_meta`, `resultType` results, caching hints, and multi round-trip requests
346
+ (return `{ resultType: "input_required", inputRequests, requestState }` instead
347
+ of a final result), while legacy clients keep the `initialize` handshake. The
348
+ required `MCP-Protocol-Version` / `Mcp-Method` / `Mcp-Name` headers are
349
+ validated against the body — never relax that check. Treat an incoming
350
+ `requestState` as attacker-controlled: sign it, bind it to the principal and
351
+ the originating request, and give it a short expiry before it influences
352
+ anything.
353
+
343
354
  ## More
344
355
 
345
356
  - Framework docs: <https://daloyjs.dev/docs>
package/templates/deno-basic/deno.json CHANGED
@@ -10,11 +10,11 @@
10
10
  "hooks:install": "git config core.hooksPath .githooks"
11
11
  },
12
12
  "imports": {
13
- "@daloyjs/core": "jsr:@daloyjs/daloy@^1.0.0-rc.5",
14
- "@daloyjs/core/banner": "jsr:@daloyjs/daloy@^1.0.0-rc.5/banner",
15
- "@daloyjs/core/contract": "jsr:@daloyjs/daloy@^1.0.0-rc.5/contract",
16
- "@daloyjs/core/deno": "jsr:@daloyjs/daloy@^1.0.0-rc.5/deno",
17
- "@daloyjs/core/openapi": "jsr:@daloyjs/daloy@^1.0.0-rc.5/openapi",
13
+ "@daloyjs/core": "jsr:@daloyjs/daloy@^1.0.0-rc.7",
14
+ "@daloyjs/core/banner": "jsr:@daloyjs/daloy@^1.0.0-rc.7/banner",
15
+ "@daloyjs/core/contract": "jsr:@daloyjs/daloy@^1.0.0-rc.7/contract",
16
+ "@daloyjs/core/deno": "jsr:@daloyjs/daloy@^1.0.0-rc.7/deno",
17
+ "@daloyjs/core/openapi": "jsr:@daloyjs/daloy@^1.0.0-rc.7/openapi",
18
18
  "zod": "npm:zod@^4.4.3"
19
19
  },
20
20
  "compilerOptions": {
package/templates/node-basic/_agents/skills/daloyjs-best-practices/SKILL.md CHANGED
@@ -420,6 +420,17 @@ validation, `Origin` checks against DNS rebinding) and composes with the
420
420
  existing middleware chain — put `bearerAuth()` / `rateLimit()` in front of
421
421
  it like any other route. See <https://daloyjs.dev/docs> for the MCP guide.
422
422
 
423
+ The handler speaks the stateless MCP `2026-07-28` revision and every earlier
424
+ one on the same endpoint: modern clients get `server/discover`, per-request
425
+ `_meta`, `resultType` results, caching hints, and multi round-trip requests
426
+ (return `{ resultType: "input_required", inputRequests, requestState }` instead
427
+ of a final result), while legacy clients keep the `initialize` handshake. The
428
+ required `MCP-Protocol-Version` / `Mcp-Method` / `Mcp-Name` headers are
429
+ validated against the body — never relax that check. Treat an incoming
430
+ `requestState` as attacker-controlled: sign it, bind it to the principal and
431
+ the originating request, and give it a short expiry before it influences
432
+ anything.
433
+
423
434
  ## More
424
435
 
425
436
  - Framework docs: <https://daloyjs.dev/docs>
package/templates/node-basic/package.json CHANGED
@@ -20,7 +20,7 @@
20
20
  "hooks:install": "git config core.hooksPath .githooks"
21
21
  },
22
22
  "dependencies": {
23
- "@daloyjs/core": "^1.0.0-rc.6",
23
+ "@daloyjs/core": "^1.0.0-rc.7",
24
24
  "zod": "^4.4.3"
25
25
  },
26
26
  "devDependencies": {
package/templates/vercel/_agents/skills/daloyjs-best-practices/SKILL.md CHANGED
@@ -340,6 +340,17 @@ validation, `Origin` checks against DNS rebinding) and composes with the
340
340
  existing middleware chain — put `bearerAuth()` / `rateLimit()` in front of
341
341
  it like any other route. See <https://daloyjs.dev/docs> for the MCP guide.
342
342
 
343
+ The handler speaks the stateless MCP `2026-07-28` revision and every earlier
344
+ one on the same endpoint: modern clients get `server/discover`, per-request
345
+ `_meta`, `resultType` results, caching hints, and multi round-trip requests
346
+ (return `{ resultType: "input_required", inputRequests, requestState }` instead
347
+ of a final result), while legacy clients keep the `initialize` handshake. The
348
+ required `MCP-Protocol-Version` / `Mcp-Method` / `Mcp-Name` headers are
349
+ validated against the body — never relax that check. Treat an incoming
350
+ `requestState` as attacker-controlled: sign it, bind it to the principal and
351
+ the originating request, and give it a short expiry before it influences
352
+ anything.
353
+
343
354
  ## More
344
355
 
345
356
  - Framework docs: <https://daloyjs.dev/docs>
package/templates/vercel/package.json CHANGED
@@ -16,7 +16,7 @@
16
16
  "hooks:install": "git config core.hooksPath .githooks"
17
17
  },
18
18
  "dependencies": {
19
- "@daloyjs/core": "^1.0.0-rc.6",
19
+ "@daloyjs/core": "^1.0.0-rc.7",
20
20
  "zod": "^4.4.3"
21
21
  },
22
22
  "devDependencies": {