create-daloy 1.1.1 → 1.2.1

package/README.md

@@ -281,7 +281,7 @@ not need.
 Every scaffolded project ships with two files that help AI coding agents (Copilot, Claude Code, Cursor, Codex, etc.) understand and work in your project:
 
 - `AGENTS.md` (repo root) — a small, top-of-context file (per the open [AGENTS.md](https://agents.md) convention): one-line project description, package manager / runtime, project shape, core rules, and the few commands an agent needs. It links to the full skill below.
-- `.agents/skills/daloyjs-best-practices/SKILL.md` — comprehensive operational guidance following the open `agents/skills/<skill-name>/SKILL.md` convention: when to use the skill, project structure, core workflows (adding routes, regenerating the OpenAPI spec and client), schema and validation conventions, error-handling patterns, middleware order, testing best practices (happy and unhappy paths), security best practices, logging and observability notes, configuration and secrets handling, deployment notes, pitfalls and guardrails, and process expectations.
+- `.agents/skills/daloyjs-best-practices/SKILL.md` — comprehensive operational guidance following the open `agents/skills/<skill-name>/SKILL.md` convention: when to use the skill, project structure, core workflows (adding routes, regenerating the OpenAPI spec and client), schema and validation conventions, error-handling patterns, middleware order, testing best practices (happy and unhappy paths), security best practices, logging and observability notes, configuration and secrets handling, deployment notes, pitfalls and guardrails, and process expectations. Rare topics (MCP, `--with-ci` workflows) live under `.agents/skills/daloyjs-best-practices/references/` and are opened only when the skill says to read them.
 
 Both files are tailored to the chosen template (Node, Bun, Deno, Vercel, or Cloudflare Workers), and Node-style templates rewrite their commands to match your selected package manager. They follow the "instruction budget" advice — small root file, progressive disclosure for the rest — so they don't waste agent tokens. Edit or delete them freely; the framework does not depend on them at runtime.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-daloy",
-  "version": "1.1.1",
+  "version": "1.2.1",
   "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
   "type": "module",
   "license": "MIT",

package/sbom.cdx.json

@@ -1,25 +1,25 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:f35e58c0-2ed9-54a4-8887-56f76fffb19e",
+  "serialNumber": "urn:uuid:225c0848-3f06-5b6c-b289-7c58ce4fb1ea",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-09T15:46:09.548Z",
+    "timestamp": "2026-08-20T14:37:41.578Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "1.1.1"
+        "version": "1.2.1"
       }
     ],
     "authors": [],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/create-daloy@1.1.1",
+      "bom-ref": "pkg:npm/create-daloy@1.2.1",
       "name": "create-daloy",
-      "version": "1.1.1",
+      "version": "1.2.1",
       "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
-      "purl": "pkg:npm/create-daloy@1.1.1",
+      "purl": "pkg:npm/create-daloy@1.2.1",
       "licenses": [
         {
           "license": {
@@ -42,9 +42,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag-create-daloy-1.1.1",
+        "tagId": "swidtag-create-daloy-1.2.1",
         "name": "create-daloy",
-        "version": "1.1.1",
+        "version": "1.2.1",
         "tagVersion": 0,
         "patch": false
       }
@@ -53,7 +53,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/create-daloy@1.1.1",
+      "ref": "pkg:npm/create-daloy@1.2.1",
       "dependsOn": []
     }
   ]

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "create-daloy-1.1.1",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/create-daloy-1.1.1-f35e58c0-2ed9-54a4-8887-56f76fffb19e",
+  "name": "create-daloy-1.2.1",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/create-daloy-1.2.1-225c0848-3f06-5b6c-b289-7c58ce4fb1ea",
   "creationInfo": {
-    "created": "2026-08-09T15:46:09.548Z",
+    "created": "2026-08-20T14:37:41.578Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package-create-daloy",
       "name": "create-daloy",
-      "versionInfo": "1.1.1",
+      "versionInfo": "1.2.1",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/create-daloy@1.1.1"
+          "referenceLocator": "pkg:npm/create-daloy@1.2.1"
         }
       ]
     }

package/templates/bun-basic/_agents/skills/daloyjs-best-practices/SKILL.md

@@ -1,11 +1,13 @@
 ---
 name: daloyjs-best-practices
 description: >-
-  Best practices for building, testing, and hardening this DaloyJS REST API on
-  the Bun runtime. Use when adding or changing HTTP routes, Zod/Standard Schema
-  validation schemas, middleware, route metadata, or error handling;
-  regenerating the OpenAPI spec or typed Hey API client; running contract
-  gates; or working on auth, rate limits, secrets, and security defaults.
+  Build, test, and harden this DaloyJS REST API on Bun. Use when the user
+  asks to add or change an endpoint, route, Zod/Standard Schema,
+  middleware, error handling, OpenAPI spec, typed Hey API client, contract
+  gate, auth, rate limit, or security default. Also use for phrasing like
+  "add GET /...", "new route", "regenerate the client", "bun test", or
+  "fix the 401". Do not use for frontend UI, infra-only work, or unrelated
+  docs.
 license: MIT
 ---
 
@@ -25,8 +27,15 @@ Use this skill when you need to:
 - Wire up new middleware, validation, or error handling.
 - Add or update tests, run typecheck, or build the project.
 - Harden the API (auth, CORS, rate limits, secrets, dependency hygiene).
+- User phrasing such as "add GET /books", "new endpoint", "regenerate the
+  client", or "fix the 401".
 
-Do **not** use this skill for tasks unrelated to the API itself.
+Do **not** use this skill for frontend UI, infra-only work, or unrelated
+docs. Rare topics live under `references/`: **read**
+[references/mcp.md](references/mcp.md) only when adding an MCP endpoint,
+and **read** [references/ci-workflows.md](references/ci-workflows.md) only
+when editing `.github/` or a `--with-ci` workflow. Do not load those files
+up front.
 
 ## Core principles
 
@@ -276,20 +285,9 @@ Aim for complete happy- and unhappy-path test coverage of the routes you add.
 
 ## CI and workflows (`--with-ci` scaffolds)
 
-If this project was scaffolded with `--with-ci`, `.github/` holds a hardened
-GitHub Actions bundle alongside `CODEOWNERS`, `SECURITY.md`, and the
-`verify:lockfile` / `verify:runtime-eol` scripts wired into `package.json`.
-Those files carry the same weight as the secure defaults above — an agent
-asked to "make CI pass" must not soften them.
-
-- Keep every `uses:` pinned to a full commit SHA with its version comment. Never move an action to a tag or a branch, and never add an unpinned one.
-- Keep `permissions: {}` at the top of each workflow and grant scopes per job. If a step needs more, give that one job the narrowest scope that works — never widen the workflow default.
-- Keep `persist-credentials: false` on `actions/checkout` and keep package-manager caching off; a shared cache can bridge fork PRs into trusted branches.
-- Keep installs running with lifecycle scripts disabled (`--ignore-scripts` / `npm_config_ignore_scripts`).
-- `verify:lockfile`, `verify:runtime-eol`, the audit steps, the contract check, and the scanners are gates. When one fails, fix the finding — do not delete the step, add `continue-on-error`, or lower a severity threshold to go green.
-- Keep `cooldown` in `.github/dependabot.yml` aligned with `minimum-release-age` in `.npmrc`. They are one 24h supply-chain policy expressed to two different tools; changing one alone silently defeats it.
-- `dast.yml` boots this template's own start command. If you change how the app starts, update that workflow to match or the weekly scan will fail.
-- Read `SECURITY.md` before deleting a workflow. On a private repository without GitHub Advanced Security some of them are _expected_ to be removed, and it lists exactly which.
+Only when editing `.github/`, Dependabot, or a `--with-ci` workflow:
+**read** [references/ci-workflows.md](references/ci-workflows.md) as
+reference. Skip that file for ordinary route work.
 
 ## Logging & observability
 
@@ -339,26 +337,9 @@ asked to "make CI pass" must not soften them.
 
 ## Exposing this API over MCP
 
-`@daloyjs/core` ships a dependency-free Model Context Protocol (Streamable
-HTTP) server helper — also available from the `@daloyjs/core/mcp` subpath.
-To expose selected capabilities to MCP clients (AI agents), build a handler
-with `createMcpHandler({ tools, resources, prompts })` and mount it with
-`mcpRoutes("/mcp", handler)`. Throw `McpToolError` for caller-correctable
-tool failures. The handler ships protocol-level guards (body cap, UTF-8/JSON
-validation, `Origin` checks against DNS rebinding) and composes with the
-existing middleware chain — put `bearerAuth()` / `rateLimit()` in front of
-it like any other route. See <https://daloyjs.dev/docs> for the MCP guide.
-
-The handler speaks the stateless MCP `2026-07-28` revision and every earlier
-one on the same endpoint: modern clients get `server/discover`, per-request
-`_meta`, `resultType` results, caching hints, and multi round-trip requests
-(return `{ resultType: "input_required", inputRequests, requestState }` instead
-of a final result), while legacy clients keep the `initialize` handshake. The
-required `MCP-Protocol-Version` / `Mcp-Method` / `Mcp-Name` headers are
-validated against the body — never relax that check. Treat an incoming
-`requestState` as attacker-controlled: sign it, bind it to the principal and
-the originating request, and give it a short expiry before it influences
-anything.
+Only when adding or changing an MCP endpoint: **read**
+[references/mcp.md](references/mcp.md) as reference (do not treat it as a
+script to run). Skip that file for ordinary HTTP route work.
 
 ## More
 

package/templates/bun-basic/_agents/skills/daloyjs-best-practices/references/ci-workflows.md

@@ -0,0 +1,19 @@
+# CI and workflows (`--with-ci` scaffolds)
+
+**Read this file as reference** when editing `.github/`, Dependabot, or a
+`--with-ci` workflow. Skip it unless the task touches CI.
+
+If this project was scaffolded with `--with-ci`, `.github/` holds a hardened
+GitHub Actions bundle alongside `CODEOWNERS`, `SECURITY.md`, and the
+`verify:lockfile` / `verify:runtime-eol` scripts wired into `package.json`.
+Those files carry the same weight as the secure defaults in `SKILL.md` — an
+agent asked to "make CI pass" must not soften them.
+
+- Keep every `uses:` pinned to a full commit SHA with its version comment. Never move an action to a tag or a branch, and never add an unpinned one.
+- Keep `permissions: {}` at the top of each workflow and grant scopes per job. If a step needs more, give that one job the narrowest scope that works — never widen the workflow default.
+- Keep `persist-credentials: false` on `actions/checkout` and keep package-manager caching off; a shared cache can bridge fork PRs into trusted branches.
+- Keep installs running with lifecycle scripts disabled (`--ignore-scripts` / `npm_config_ignore_scripts`).
+- `verify:lockfile`, `verify:runtime-eol`, the audit steps, the contract check, and the scanners are gates. When one fails, fix the finding — do not delete the step, add `continue-on-error`, or lower a severity threshold to go green.
+- Keep `cooldown` in `.github/dependabot.yml` aligned with `minimum-release-age` in `.npmrc`. They are one 24h supply-chain policy expressed to two different tools; changing one alone silently defeats it.
+- `dast.yml` boots this template's own start command. If you change how the app starts, update that workflow to match or the weekly scan will fail.
+- Read `SECURITY.md` before deleting a workflow. On a private repository without GitHub Advanced Security some of them are _expected_ to be removed, and it lists exactly which.

package/templates/bun-basic/_agents/skills/daloyjs-best-practices/references/mcp.md

@@ -0,0 +1,25 @@
+# Exposing this API over MCP
+
+**Read this file as reference** when adding or changing an MCP endpoint. Do
+not treat it as a script to run. Skip it for ordinary HTTP route work.
+
+`@daloyjs/core` ships a dependency-free Model Context Protocol (Streamable
+HTTP) server helper — also available from the `@daloyjs/core/mcp` subpath.
+To expose selected capabilities to MCP clients (AI agents), build a handler
+with `createMcpHandler({ tools, resources, prompts })` and mount it with
+`mcpRoutes("/mcp", handler)`. Throw `McpToolError` for caller-correctable
+tool failures. The handler ships protocol-level guards (body cap, UTF-8/JSON
+validation, `Origin` checks against DNS rebinding) and composes with the
+existing middleware chain — put `bearerAuth()` / `rateLimit()` in front of
+it like any other route. See <https://daloyjs.dev/docs> for the MCP guide.
+
+The handler speaks the stateless MCP `2026-07-28` revision and every earlier
+one on the same endpoint: modern clients get `server/discover`, per-request
+`_meta`, `resultType` results, caching hints, and multi round-trip requests
+(return `{ resultType: "input_required", inputRequests, requestState }` instead
+of a final result), while legacy clients keep the `initialize` handshake. The
+required `MCP-Protocol-Version` / `Mcp-Method` / `Mcp-Name` headers are
+validated against the body — never relax that check. Treat an incoming
+`requestState` as attacker-controlled: sign it, bind it to the principal and
+the originating request, and give it a short expiry before it influences
+anything.

package/templates/bun-basic/package.json

@@ -19,7 +19,7 @@
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "dependencies": {
-    "@daloyjs/core": "^1.1.1",
+    "@daloyjs/core": "^1.2.1",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/cloudflare-worker/_agents/skills/daloyjs-best-practices/SKILL.md

@@ -1,11 +1,13 @@
 ---
 name: daloyjs-best-practices
 description: >-
-  Best practices for building, testing, and hardening this DaloyJS REST API on
-  Cloudflare Workers. Use when adding or changing HTTP routes, Zod/Standard
-  Schema validation schemas, middleware, route metadata, or error handling;
-  wiring Worker bindings (KV, D1, R2, Queues, env, secrets); running contract
-  gates; or working on auth, rate limits, and security defaults.
+  Build, test, and harden this DaloyJS REST API on Cloudflare Workers. Use
+  when the user asks to add or change an endpoint, route, Zod/Standard
+  Schema, middleware, error handling, Worker binding (KV, D1, R2, Queues,
+  env), contract gate, auth, or rate limit. Also use for phrasing like
+  "add GET /...", "new route", "wrangler", "fix the 401", or "add a KV
+  binding". Do not use for frontend UI, infra-only work, or unrelated
+  docs.
 license: MIT
 ---
 
@@ -26,8 +28,15 @@ Use this skill when you need to:
 - Change Worker bindings (KV, D1, R2, Queues, env vars) in `wrangler.toml`.
 - Run tests/typecheck or deploy the Worker.
 - Harden the API (auth, CORS, rate limits, secrets, dependency hygiene).
+- User phrasing such as "add GET /books", "new endpoint", "add a KV
+  binding", or "fix the 401".
 
-Do **not** use this skill for tasks unrelated to the API itself.
+Do **not** use this skill for frontend UI, infra-only work, or unrelated
+docs. Rare topics live under `references/`: **read**
+[references/mcp.md](references/mcp.md) only when adding an MCP endpoint,
+and **read** [references/ci-workflows.md](references/ci-workflows.md) only
+when editing `.github/` or a `--with-ci` workflow. Do not load those files
+up front.
 
 ## Core principles
 
@@ -279,20 +288,9 @@ Aim for complete happy- and unhappy-path test coverage of the routes you add.
 
 ## CI and workflows (`--with-ci` scaffolds)
 
-If this project was scaffolded with `--with-ci`, `.github/` holds a hardened
-GitHub Actions bundle alongside `CODEOWNERS`, `SECURITY.md`, and the
-`verify:lockfile` / `verify:runtime-eol` scripts wired into `package.json`.
-Those files carry the same weight as the secure defaults above — an agent
-asked to "make CI pass" must not soften them.
-
-- Keep every `uses:` pinned to a full commit SHA with its version comment. Never move an action to a tag or a branch, and never add an unpinned one.
-- Keep `permissions: {}` at the top of each workflow and grant scopes per job. If a step needs more, give that one job the narrowest scope that works — never widen the workflow default.
-- Keep `persist-credentials: false` on `actions/checkout` and keep package-manager caching off; a shared cache can bridge fork PRs into trusted branches.
-- Keep installs running with lifecycle scripts disabled (`--ignore-scripts` / `npm_config_ignore_scripts`).
-- `verify:lockfile`, `verify:runtime-eol`, the audit steps, the contract check, and the scanners are gates. When one fails, fix the finding — do not delete the step, add `continue-on-error`, or lower a severity threshold to go green.
-- Keep `cooldown` in `.github/dependabot.yml` aligned with `minimum-release-age` in `.npmrc`. They are one 24h supply-chain policy expressed to two different tools; changing one alone silently defeats it.
-- `dast.yml` boots this template's own start command. If you change how the app starts, update that workflow to match or the weekly scan will fail.
-- Read `SECURITY.md` before deleting a workflow. On a private repository without GitHub Advanced Security some of them are _expected_ to be removed, and it lists exactly which.
+Only when editing `.github/`, Dependabot, or a `--with-ci` workflow:
+**read** [references/ci-workflows.md](references/ci-workflows.md) as
+reference. Skip that file for ordinary route work.
 
 ## Logging & observability
 
@@ -343,26 +341,9 @@ asked to "make CI pass" must not soften them.
 
 ## Exposing this API over MCP
 
-`@daloyjs/core` ships a dependency-free Model Context Protocol (Streamable
-HTTP) server helper — also available from the `@daloyjs/core/mcp` subpath.
-To expose selected capabilities to MCP clients (AI agents), build a handler
-with `createMcpHandler({ tools, resources, prompts })` and mount it with
-`mcpRoutes("/mcp", handler)`. Throw `McpToolError` for caller-correctable
-tool failures. The handler ships protocol-level guards (body cap, UTF-8/JSON
-validation, `Origin` checks against DNS rebinding) and composes with the
-existing middleware chain — put `bearerAuth()` / `rateLimit()` in front of
-it like any other route. See <https://daloyjs.dev/docs> for the MCP guide.
-
-The handler speaks the stateless MCP `2026-07-28` revision and every earlier
-one on the same endpoint: modern clients get `server/discover`, per-request
-`_meta`, `resultType` results, caching hints, and multi round-trip requests
-(return `{ resultType: "input_required", inputRequests, requestState }` instead
-of a final result), while legacy clients keep the `initialize` handshake. The
-required `MCP-Protocol-Version` / `Mcp-Method` / `Mcp-Name` headers are
-validated against the body — never relax that check. Treat an incoming
-`requestState` as attacker-controlled: sign it, bind it to the principal and
-the originating request, and give it a short expiry before it influences
-anything.
+Only when adding or changing an MCP endpoint: **read**
+[references/mcp.md](references/mcp.md) as reference (do not treat it as a
+script to run). Skip that file for ordinary HTTP route work.
 
 ## More
 

package/templates/cloudflare-worker/_agents/skills/daloyjs-best-practices/references/ci-workflows.md

@@ -0,0 +1,19 @@
+# CI and workflows (`--with-ci` scaffolds)
+
+**Read this file as reference** when editing `.github/`, Dependabot, or a
+`--with-ci` workflow. Skip it unless the task touches CI.
+
+If this project was scaffolded with `--with-ci`, `.github/` holds a hardened
+GitHub Actions bundle alongside `CODEOWNERS`, `SECURITY.md`, and the
+`verify:lockfile` / `verify:runtime-eol` scripts wired into `package.json`.
+Those files carry the same weight as the secure defaults in `SKILL.md` — an
+agent asked to "make CI pass" must not soften them.
+
+- Keep every `uses:` pinned to a full commit SHA with its version comment. Never move an action to a tag or a branch, and never add an unpinned one.
+- Keep `permissions: {}` at the top of each workflow and grant scopes per job. If a step needs more, give that one job the narrowest scope that works — never widen the workflow default.
+- Keep `persist-credentials: false` on `actions/checkout` and keep package-manager caching off; a shared cache can bridge fork PRs into trusted branches.
+- Keep installs running with lifecycle scripts disabled (`--ignore-scripts` / `npm_config_ignore_scripts`).
+- `verify:lockfile`, `verify:runtime-eol`, the audit steps, the contract check, and the scanners are gates. When one fails, fix the finding — do not delete the step, add `continue-on-error`, or lower a severity threshold to go green.
+- Keep `cooldown` in `.github/dependabot.yml` aligned with `minimum-release-age` in `.npmrc`. They are one 24h supply-chain policy expressed to two different tools; changing one alone silently defeats it.
+- `dast.yml` boots this template's own start command. If you change how the app starts, update that workflow to match or the weekly scan will fail.
+- Read `SECURITY.md` before deleting a workflow. On a private repository without GitHub Advanced Security some of them are _expected_ to be removed, and it lists exactly which.

package/templates/cloudflare-worker/_agents/skills/daloyjs-best-practices/references/mcp.md

@@ -0,0 +1,25 @@
+# Exposing this API over MCP
+
+**Read this file as reference** when adding or changing an MCP endpoint. Do
+not treat it as a script to run. Skip it for ordinary HTTP route work.
+
+`@daloyjs/core` ships a dependency-free Model Context Protocol (Streamable
+HTTP) server helper — also available from the `@daloyjs/core/mcp` subpath.
+To expose selected capabilities to MCP clients (AI agents), build a handler
+with `createMcpHandler({ tools, resources, prompts })` and mount it with
+`mcpRoutes("/mcp", handler)`. Throw `McpToolError` for caller-correctable
+tool failures. The handler ships protocol-level guards (body cap, UTF-8/JSON
+validation, `Origin` checks against DNS rebinding) and composes with the
+existing middleware chain — put `bearerAuth()` / `rateLimit()` in front of
+it like any other route. See <https://daloyjs.dev/docs> for the MCP guide.
+
+The handler speaks the stateless MCP `2026-07-28` revision and every earlier
+one on the same endpoint: modern clients get `server/discover`, per-request
+`_meta`, `resultType` results, caching hints, and multi round-trip requests
+(return `{ resultType: "input_required", inputRequests, requestState }` instead
+of a final result), while legacy clients keep the `initialize` handshake. The
+required `MCP-Protocol-Version` / `Mcp-Method` / `Mcp-Name` headers are
+validated against the body — never relax that check. Treat an incoming
+`requestState` as attacker-controlled: sign it, bind it to the principal and
+the originating request, and give it a short expiry before it influences
+anything.

package/templates/cloudflare-worker/package.json

@@ -16,7 +16,7 @@
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "dependencies": {
-    "@daloyjs/core": "^1.1.1",
+    "@daloyjs/core": "^1.2.1",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/deno-basic/_agents/skills/daloyjs-best-practices/SKILL.md

@@ -1,12 +1,13 @@
 ---
 name: daloyjs-best-practices
 description: >-
-  Best practices for building, testing, and hardening this DaloyJS REST API on
-  the Deno runtime. Use when adding or changing HTTP routes, Zod/Standard
-  Schema validation schemas, middleware, route metadata, or error handling;
-  regenerating the OpenAPI spec; running contract gates; managing Deno
-  permissions and tasks; or working on auth, rate limits, secrets, and
-  security defaults.
+  Build, test, and harden this DaloyJS REST API on Deno. Use when the user
+  asks to add or change an endpoint, route, Zod/Standard Schema,
+  middleware, error handling, OpenAPI spec, contract gate, Deno
+  permission, deno.json import, auth, or rate limit. Also use for phrasing
+  like "add GET /...", "new route", "deno task", "fix the 401", or "allow
+  net". Do not use for frontend UI, npm/pnpm package.json work, or
+  unrelated docs.
 license: MIT
 ---
 
@@ -27,8 +28,15 @@ Use this skill when you need to:
 - Wire up new middleware, validation, or error handling.
 - Add or update tests, run typecheck, or build the project.
 - Harden the API (auth, CORS, rate limits, permissions, secrets).
+- User phrasing such as "add GET /books", "new endpoint", "deno task", or
+  "fix the 401".
 
-Do **not** use this skill for tasks unrelated to the API itself.
+Do **not** use this skill for frontend UI, npm/pnpm `package.json` work,
+or unrelated docs. Rare topics live under `references/`: **read**
+[references/mcp.md](references/mcp.md) only when adding an MCP endpoint,
+and **read** [references/ci-workflows.md](references/ci-workflows.md) only
+when editing `.github/` or a `--with-ci` workflow. Do not load those files
+up front.
 
 ## Core principles
 
@@ -274,18 +282,9 @@ Aim for complete happy- and unhappy-path test coverage of the routes you add.
 
 ## CI and workflows (`--with-ci` scaffolds)
 
-If this project was scaffolded with `--with-ci`, `.github/` holds a hardened
-GitHub Actions bundle alongside `CODEOWNERS`, `SECURITY.md`, and a
-`verify:runtime-eol` task added to `deno.json`. Those files carry the same
-weight as the secure defaults above — an agent asked to "make CI pass" must
-not soften them.
-
-- Keep every `uses:` pinned to a full commit SHA with its version comment. Never move an action to a tag or a branch, and never add an unpinned one.
-- Keep `permissions: {}` at the top of each workflow and grant scopes per job. If a step needs more, give that one job the narrowest scope that works — never widen the workflow default.
-- Keep `persist-credentials: false` on `actions/checkout` and keep caching off; a shared cache can bridge fork PRs into trusted branches.
-- `deno.lock` is committed and CI installs with `deno install --frozen=true`. Deno ships no `audit` command, so the lockfile is this project's integrity anchor: when a dependency changes, update it deliberately with `deno install` and commit the result. Never drop `--frozen` to make CI pass.
-- `verify:runtime-eol`, the contract check, and the scanners are gates. When one fails, fix the finding — do not delete the step, add `continue-on-error`, or lower a severity threshold to go green.
-- Read `SECURITY.md` before deleting a workflow. On a private repository without GitHub Advanced Security, some of them are _expected_ to be removed, and it lists exactly which.
+Only when editing `.github/` or a `--with-ci` workflow: **read**
+[references/ci-workflows.md](references/ci-workflows.md) as reference.
+Skip that file for ordinary route work.
 
 ## Logging & observability
 
@@ -330,26 +329,9 @@ not soften them.
 
 ## Exposing this API over MCP
 
-`@daloyjs/core` ships a dependency-free Model Context Protocol (Streamable
-HTTP) server helper — also available from the `@daloyjs/core/mcp` subpath.
-To expose selected capabilities to MCP clients (AI agents), build a handler
-with `createMcpHandler({ tools, resources, prompts })` and mount it with
-`mcpRoutes("/mcp", handler)`. Throw `McpToolError` for caller-correctable
-tool failures. The handler ships protocol-level guards (body cap, UTF-8/JSON
-validation, `Origin` checks against DNS rebinding) and composes with the
-existing middleware chain — put `bearerAuth()` / `rateLimit()` in front of
-it like any other route. See <https://daloyjs.dev/docs> for the MCP guide.
-
-The handler speaks the stateless MCP `2026-07-28` revision and every earlier
-one on the same endpoint: modern clients get `server/discover`, per-request
-`_meta`, `resultType` results, caching hints, and multi round-trip requests
-(return `{ resultType: "input_required", inputRequests, requestState }` instead
-of a final result), while legacy clients keep the `initialize` handshake. The
-required `MCP-Protocol-Version` / `Mcp-Method` / `Mcp-Name` headers are
-validated against the body — never relax that check. Treat an incoming
-`requestState` as attacker-controlled: sign it, bind it to the principal and
-the originating request, and give it a short expiry before it influences
-anything.
+Only when adding or changing an MCP endpoint: **read**
+[references/mcp.md](references/mcp.md) as reference (do not treat it as a
+script to run). Skip that file for ordinary HTTP route work.
 
 ## More
 

package/templates/deno-basic/_agents/skills/daloyjs-best-practices/references/ci-workflows.md

@@ -0,0 +1,17 @@
+# CI and workflows (`--with-ci` scaffolds)
+
+**Read this file as reference** when editing `.github/` or a `--with-ci`
+workflow. Skip it unless the task touches CI.
+
+If this project was scaffolded with `--with-ci`, `.github/` holds a hardened
+GitHub Actions bundle alongside `CODEOWNERS`, `SECURITY.md`, and a
+`verify:runtime-eol` task added to `deno.json`. Those files carry the same
+weight as the secure defaults in `SKILL.md` — an agent asked to "make CI
+pass" must not soften them.
+
+- Keep every `uses:` pinned to a full commit SHA with its version comment. Never move an action to a tag or a branch, and never add an unpinned one.
+- Keep `permissions: {}` at the top of each workflow and grant scopes per job. If a step needs more, give that one job the narrowest scope that works — never widen the workflow default.
+- Keep `persist-credentials: false` on `actions/checkout` and keep caching off; a shared cache can bridge fork PRs into trusted branches.
+- `deno.lock` is committed and CI installs with `deno install --frozen=true`. Deno ships no `audit` command, so the lockfile is this project's integrity anchor: when a dependency changes, update it deliberately with `deno install` and commit the result. Never drop `--frozen` to make CI pass.
+- `verify:runtime-eol`, the contract check, and the scanners are gates. When one fails, fix the finding — do not delete the step, add `continue-on-error`, or lower a severity threshold to go green.
+- Read `SECURITY.md` before deleting a workflow. On a private repository without GitHub Advanced Security, some of them are _expected_ to be removed, and it lists exactly which.

package/templates/deno-basic/_agents/skills/daloyjs-best-practices/references/mcp.md

@@ -0,0 +1,25 @@
+# Exposing this API over MCP
+
+**Read this file as reference** when adding or changing an MCP endpoint. Do
+not treat it as a script to run. Skip it for ordinary HTTP route work.
+
+`@daloyjs/core` ships a dependency-free Model Context Protocol (Streamable
+HTTP) server helper — also available from the `@daloyjs/core/mcp` subpath.
+To expose selected capabilities to MCP clients (AI agents), build a handler
+with `createMcpHandler({ tools, resources, prompts })` and mount it with
+`mcpRoutes("/mcp", handler)`. Throw `McpToolError` for caller-correctable
+tool failures. The handler ships protocol-level guards (body cap, UTF-8/JSON
+validation, `Origin` checks against DNS rebinding) and composes with the
+existing middleware chain — put `bearerAuth()` / `rateLimit()` in front of
+it like any other route. See <https://daloyjs.dev/docs> for the MCP guide.
+
+The handler speaks the stateless MCP `2026-07-28` revision and every earlier
+one on the same endpoint: modern clients get `server/discover`, per-request
+`_meta`, `resultType` results, caching hints, and multi round-trip requests
+(return `{ resultType: "input_required", inputRequests, requestState }` instead
+of a final result), while legacy clients keep the `initialize` handshake. The
+required `MCP-Protocol-Version` / `Mcp-Method` / `Mcp-Name` headers are
+validated against the body — never relax that check. Treat an incoming
+`requestState` as attacker-controlled: sign it, bind it to the principal and
+the originating request, and give it a short expiry before it influences
+anything.

package/templates/deno-basic/deno.json

@@ -10,11 +10,11 @@
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "imports": {
-    "@daloyjs/core": "jsr:@daloyjs/daloy@^1.1.1",
-    "@daloyjs/core/banner": "jsr:@daloyjs/daloy@^1.1.1/banner",
-    "@daloyjs/core/contract": "jsr:@daloyjs/daloy@^1.1.1/contract",
-    "@daloyjs/core/deno": "jsr:@daloyjs/daloy@^1.1.1/deno",
-    "@daloyjs/core/openapi": "jsr:@daloyjs/daloy@^1.1.1/openapi",
+    "@daloyjs/core": "jsr:@daloyjs/daloy@^1.2.1",
+    "@daloyjs/core/banner": "jsr:@daloyjs/daloy@^1.2.1/banner",
+    "@daloyjs/core/contract": "jsr:@daloyjs/daloy@^1.2.1/contract",
+    "@daloyjs/core/deno": "jsr:@daloyjs/daloy@^1.2.1/deno",
+    "@daloyjs/core/openapi": "jsr:@daloyjs/daloy@^1.2.1/openapi",
     "zod": "npm:zod@^4.4.3"
   },
   "compilerOptions": {

package/templates/node-basic/_agents/skills/daloyjs-best-practices/SKILL.md

@@ -1,11 +1,12 @@
 ---
 name: daloyjs-best-practices
 description: >-
-  Best practices for building, testing, and hardening this DaloyJS REST API on
-  Node.js. Use when adding or changing HTTP routes, Zod/Standard Schema
-  validation schemas, middleware, route metadata, or error handling;
-  regenerating the OpenAPI spec or typed Hey API client; running contract
-  gates; or working on auth, rate limits, secrets, and security defaults.
+  Build, test, and harden this DaloyJS REST API on Node.js. Use when the
+  user asks to add or change an endpoint, route, Zod/Standard Schema,
+  middleware, error handling, OpenAPI spec, typed Hey API client, contract
+  gate, auth, rate limit, or security default. Also use for phrasing like
+  "add GET /...", "new route", "regenerate the client", or "fix the 401".
+  Do not use for frontend UI, infra-only work, or unrelated docs.
 license: MIT
 ---
 
@@ -25,9 +26,15 @@ Use this skill when you need to:
 - Wire up new middleware, validation, or error handling.
 - Add or update tests, run typecheck, or build the project.
 - Harden the API (auth, CORS, rate limits, secrets, dependency hygiene).
+- User phrasing such as "add GET /books", "new endpoint", "regenerate the
+  client", or "fix the 401".
 
-Do **not** use this skill for tasks unrelated to the API itself (infra-only
-changes, unrelated docs sites, etc.).
+Do **not** use this skill for frontend UI, infra-only work, or unrelated
+docs. Rare topics live under `references/`: **read**
+[references/mcp.md](references/mcp.md) only when adding an MCP endpoint,
+and **read** [references/ci-workflows.md](references/ci-workflows.md) only
+when editing `.github/` or a `--with-ci` workflow. Do not load those files
+up front.
 
 ## Core principles
 
@@ -336,20 +343,9 @@ honor them.
 
 ## CI and workflows (`--with-ci` scaffolds)
 
-If this project was scaffolded with `--with-ci`, `.github/` holds a hardened
-GitHub Actions bundle alongside `CODEOWNERS`, `SECURITY.md`, and the
-`verify:lockfile` / `verify:runtime-eol` scripts wired into `package.json`.
-Those files carry the same weight as the secure defaults above — an agent
-asked to "make CI pass" must not soften them.
-
-- Keep every `uses:` pinned to a full commit SHA with its version comment. Never move an action to a tag or a branch, and never add an unpinned one.
-- Keep `permissions: {}` at the top of each workflow and grant scopes per job. If a step needs more, give that one job the narrowest scope that works — never widen the workflow default.
-- Keep `persist-credentials: false` on `actions/checkout` and keep package-manager caching off; a shared cache can bridge fork PRs into trusted branches.
-- Keep installs running with lifecycle scripts disabled (`--ignore-scripts` / `npm_config_ignore_scripts`).
-- `verify:lockfile`, `verify:runtime-eol`, the audit steps, the contract check, and the scanners are gates. When one fails, fix the finding — do not delete the step, add `continue-on-error`, or lower a severity threshold to go green.
-- Keep `cooldown` in `.github/dependabot.yml` aligned with `minimum-release-age` in `.npmrc`. They are one 24h supply-chain policy expressed to two different tools; changing one alone silently defeats it.
-- `dast.yml` boots this template's own start command. If you change how the app starts, update that workflow to match or the weekly scan will fail.
-- Read `SECURITY.md` before deleting a workflow. On a private repository without GitHub Advanced Security some of them are _expected_ to be removed, and it lists exactly which.
+Only when editing `.github/`, Dependabot, or a `--with-ci` workflow:
+**read** [references/ci-workflows.md](references/ci-workflows.md) as
+reference. Skip that file for ordinary route work.
 
 ## Logging & observability
 
@@ -410,26 +406,9 @@ asked to "make CI pass" must not soften them.
 
 ## Exposing this API over MCP
 
-`@daloyjs/core` ships a dependency-free Model Context Protocol (Streamable
-HTTP) server helper — also available from the `@daloyjs/core/mcp` subpath.
-To expose selected capabilities to MCP clients (AI agents), build a handler
-with `createMcpHandler({ tools, resources, prompts })` and mount it with
-`mcpRoutes("/mcp", handler)`. Throw `McpToolError` for caller-correctable
-tool failures. The handler ships protocol-level guards (body cap, UTF-8/JSON
-validation, `Origin` checks against DNS rebinding) and composes with the
-existing middleware chain — put `bearerAuth()` / `rateLimit()` in front of
-it like any other route. See <https://daloyjs.dev/docs> for the MCP guide.
-
-The handler speaks the stateless MCP `2026-07-28` revision and every earlier
-one on the same endpoint: modern clients get `server/discover`, per-request
-`_meta`, `resultType` results, caching hints, and multi round-trip requests
-(return `{ resultType: "input_required", inputRequests, requestState }` instead
-of a final result), while legacy clients keep the `initialize` handshake. The
-required `MCP-Protocol-Version` / `Mcp-Method` / `Mcp-Name` headers are
-validated against the body — never relax that check. Treat an incoming
-`requestState` as attacker-controlled: sign it, bind it to the principal and
-the originating request, and give it a short expiry before it influences
-anything.
+Only when adding or changing an MCP endpoint: **read**
+[references/mcp.md](references/mcp.md) as reference (do not treat it as a
+script to run). Skip that file for ordinary HTTP route work.
 
 ## More
 

package/templates/node-basic/_agents/skills/daloyjs-best-practices/references/ci-workflows.md

@@ -0,0 +1,19 @@
+# CI and workflows (`--with-ci` scaffolds)
+
+**Read this file as reference** when editing `.github/`, Dependabot, or a
+`--with-ci` workflow. Skip it unless the task touches CI.
+
+If this project was scaffolded with `--with-ci`, `.github/` holds a hardened
+GitHub Actions bundle alongside `CODEOWNERS`, `SECURITY.md`, and the
+`verify:lockfile` / `verify:runtime-eol` scripts wired into `package.json`.
+Those files carry the same weight as the secure defaults in `SKILL.md` — an
+agent asked to "make CI pass" must not soften them.
+
+- Keep every `uses:` pinned to a full commit SHA with its version comment. Never move an action to a tag or a branch, and never add an unpinned one.
+- Keep `permissions: {}` at the top of each workflow and grant scopes per job. If a step needs more, give that one job the narrowest scope that works — never widen the workflow default.
+- Keep `persist-credentials: false` on `actions/checkout` and keep package-manager caching off; a shared cache can bridge fork PRs into trusted branches.
+- Keep installs running with lifecycle scripts disabled (`--ignore-scripts` / `npm_config_ignore_scripts`).
+- `verify:lockfile`, `verify:runtime-eol`, the audit steps, the contract check, and the scanners are gates. When one fails, fix the finding — do not delete the step, add `continue-on-error`, or lower a severity threshold to go green.
+- Keep `cooldown` in `.github/dependabot.yml` aligned with `minimum-release-age` in `.npmrc`. They are one 24h supply-chain policy expressed to two different tools; changing one alone silently defeats it.
+- `dast.yml` boots this template's own start command. If you change how the app starts, update that workflow to match or the weekly scan will fail.
+- Read `SECURITY.md` before deleting a workflow. On a private repository without GitHub Advanced Security some of them are _expected_ to be removed, and it lists exactly which.

package/templates/node-basic/_agents/skills/daloyjs-best-practices/references/mcp.md

@@ -0,0 +1,25 @@
+# Exposing this API over MCP
+
+**Read this file as reference** when adding or changing an MCP endpoint. Do
+not treat it as a script to run. Skip it for ordinary HTTP route work.
+
+`@daloyjs/core` ships a dependency-free Model Context Protocol (Streamable
+HTTP) server helper — also available from the `@daloyjs/core/mcp` subpath.
+To expose selected capabilities to MCP clients (AI agents), build a handler
+with `createMcpHandler({ tools, resources, prompts })` and mount it with
+`mcpRoutes("/mcp", handler)`. Throw `McpToolError` for caller-correctable
+tool failures. The handler ships protocol-level guards (body cap, UTF-8/JSON
+validation, `Origin` checks against DNS rebinding) and composes with the
+existing middleware chain — put `bearerAuth()` / `rateLimit()` in front of
+it like any other route. See <https://daloyjs.dev/docs> for the MCP guide.
+
+The handler speaks the stateless MCP `2026-07-28` revision and every earlier
+one on the same endpoint: modern clients get `server/discover`, per-request
+`_meta`, `resultType` results, caching hints, and multi round-trip requests
+(return `{ resultType: "input_required", inputRequests, requestState }` instead
+of a final result), while legacy clients keep the `initialize` handshake. The
+required `MCP-Protocol-Version` / `Mcp-Method` / `Mcp-Name` headers are
+validated against the body — never relax that check. Treat an incoming
+`requestState` as attacker-controlled: sign it, bind it to the principal and
+the originating request, and give it a short expiry before it influences
+anything.

package/templates/node-basic/package.json

@@ -20,7 +20,7 @@
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "dependencies": {
-    "@daloyjs/core": "^1.1.1",
+    "@daloyjs/core": "^1.2.1",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/vercel/_agents/skills/daloyjs-best-practices/SKILL.md

@@ -1,12 +1,13 @@
 ---
 name: daloyjs-best-practices
 description: >-
-  Best practices for building, testing, and hardening this DaloyJS REST API on
-  Vercel (Node.js runtime). Use when adding or changing HTTP routes,
-  Zod/Standard Schema validation schemas, middleware, route metadata, or error
-  handling; regenerating the OpenAPI spec or typed Hey API client; keeping the
-  single Vercel Functions entrypoint and Web-Standard handler; running contract
-  gates; or working on auth, rate limits, secrets, and security defaults.
+  Build, test, and harden this DaloyJS REST API on Vercel (Node.js
+  runtime). Use when the user asks to add or change an endpoint, route,
+  Zod/Standard Schema, middleware, error handling, OpenAPI spec, typed
+  client, contract gate, auth, rate limit, or the single Functions
+  entrypoint / rewrite. Also use for phrasing like "add GET /...", "new
+  route", "fix the 401", or "deploy this API". Do not use for Next.js App
+  Router work, frontend UI, or unrelated docs.
 license: MIT
 ---
 
@@ -27,8 +28,14 @@ Use this skill when you need to:
 - Run tests or typecheck the project.
 - Deploy or troubleshoot the Vercel Functions entrypoint.
 - Harden the API (auth, CORS, rate limits, secrets, dependency hygiene).
+- User phrasing such as "add GET /books", "new endpoint", or "fix the 401".
 
-Do **not** use this skill for tasks unrelated to the API itself.
+Do **not** use this skill for Next.js App Router work, frontend UI, or
+unrelated docs. Rare topics live under `references/`: **read**
+[references/mcp.md](references/mcp.md) only when adding an MCP endpoint,
+and **read** [references/ci-workflows.md](references/ci-workflows.md) only
+when editing `.github/` or a `--with-ci` workflow. Do not load those files
+up front.
 
 ## Core principles
 
@@ -265,20 +272,9 @@ Aim for complete happy- and unhappy-path test coverage of the routes you add.
 
 ## CI and workflows (`--with-ci` scaffolds)
 
-If this project was scaffolded with `--with-ci`, `.github/` holds a hardened
-GitHub Actions bundle alongside `CODEOWNERS`, `SECURITY.md`, and the
-`verify:lockfile` / `verify:runtime-eol` scripts wired into `package.json`.
-Those files carry the same weight as the secure defaults above — an agent
-asked to "make CI pass" must not soften them.
-
-- Keep every `uses:` pinned to a full commit SHA with its version comment. Never move an action to a tag or a branch, and never add an unpinned one.
-- Keep `permissions: {}` at the top of each workflow and grant scopes per job. If a step needs more, give that one job the narrowest scope that works — never widen the workflow default.
-- Keep `persist-credentials: false` on `actions/checkout` and keep package-manager caching off; a shared cache can bridge fork PRs into trusted branches.
-- Keep installs running with lifecycle scripts disabled (`--ignore-scripts` / `npm_config_ignore_scripts`).
-- `verify:lockfile`, `verify:runtime-eol`, the audit steps, the contract check, and the scanners are gates. When one fails, fix the finding — do not delete the step, add `continue-on-error`, or lower a severity threshold to go green.
-- Keep `cooldown` in `.github/dependabot.yml` aligned with `minimum-release-age` in `.npmrc`. They are one 24h supply-chain policy expressed to two different tools; changing one alone silently defeats it.
-- `dast.yml` boots this template's own start command. If you change how the app starts, update that workflow to match or the weekly scan will fail.
-- Read `SECURITY.md` before deleting a workflow. On a private repository without GitHub Advanced Security some of them are _expected_ to be removed, and it lists exactly which.
+Only when editing `.github/`, Dependabot, or a `--with-ci` workflow:
+**read** [references/ci-workflows.md](references/ci-workflows.md) as
+reference. Skip that file for ordinary route work.
 
 ## Logging & observability
 
@@ -330,26 +326,9 @@ asked to "make CI pass" must not soften them.
 
 ## Exposing this API over MCP
 
-`@daloyjs/core` ships a dependency-free Model Context Protocol (Streamable
-HTTP) server helper — also available from the `@daloyjs/core/mcp` subpath.
-To expose selected capabilities to MCP clients (AI agents), build a handler
-with `createMcpHandler({ tools, resources, prompts })` and mount it with
-`mcpRoutes("/mcp", handler)`. Throw `McpToolError` for caller-correctable
-tool failures. The handler ships protocol-level guards (body cap, UTF-8/JSON
-validation, `Origin` checks against DNS rebinding) and composes with the
-existing middleware chain — put `bearerAuth()` / `rateLimit()` in front of
-it like any other route. See <https://daloyjs.dev/docs> for the MCP guide.
-
-The handler speaks the stateless MCP `2026-07-28` revision and every earlier
-one on the same endpoint: modern clients get `server/discover`, per-request
-`_meta`, `resultType` results, caching hints, and multi round-trip requests
-(return `{ resultType: "input_required", inputRequests, requestState }` instead
-of a final result), while legacy clients keep the `initialize` handshake. The
-required `MCP-Protocol-Version` / `Mcp-Method` / `Mcp-Name` headers are
-validated against the body — never relax that check. Treat an incoming
-`requestState` as attacker-controlled: sign it, bind it to the principal and
-the originating request, and give it a short expiry before it influences
-anything.
+Only when adding or changing an MCP endpoint: **read**
+[references/mcp.md](references/mcp.md) as reference (do not treat it as a
+script to run). Skip that file for ordinary HTTP route work.
 
 ## More
 

package/templates/vercel/_agents/skills/daloyjs-best-practices/references/ci-workflows.md

@@ -0,0 +1,19 @@
+# CI and workflows (`--with-ci` scaffolds)
+
+**Read this file as reference** when editing `.github/`, Dependabot, or a
+`--with-ci` workflow. Skip it unless the task touches CI.
+
+If this project was scaffolded with `--with-ci`, `.github/` holds a hardened
+GitHub Actions bundle alongside `CODEOWNERS`, `SECURITY.md`, and the
+`verify:lockfile` / `verify:runtime-eol` scripts wired into `package.json`.
+Those files carry the same weight as the secure defaults in `SKILL.md` — an
+agent asked to "make CI pass" must not soften them.
+
+- Keep every `uses:` pinned to a full commit SHA with its version comment. Never move an action to a tag or a branch, and never add an unpinned one.
+- Keep `permissions: {}` at the top of each workflow and grant scopes per job. If a step needs more, give that one job the narrowest scope that works — never widen the workflow default.
+- Keep `persist-credentials: false` on `actions/checkout` and keep package-manager caching off; a shared cache can bridge fork PRs into trusted branches.
+- Keep installs running with lifecycle scripts disabled (`--ignore-scripts` / `npm_config_ignore_scripts`).
+- `verify:lockfile`, `verify:runtime-eol`, the audit steps, the contract check, and the scanners are gates. When one fails, fix the finding — do not delete the step, add `continue-on-error`, or lower a severity threshold to go green.
+- Keep `cooldown` in `.github/dependabot.yml` aligned with `minimum-release-age` in `.npmrc`. They are one 24h supply-chain policy expressed to two different tools; changing one alone silently defeats it.
+- `dast.yml` boots this template's own start command. If you change how the app starts, update that workflow to match or the weekly scan will fail.
+- Read `SECURITY.md` before deleting a workflow. On a private repository without GitHub Advanced Security some of them are _expected_ to be removed, and it lists exactly which.

package/templates/vercel/_agents/skills/daloyjs-best-practices/references/mcp.md

@@ -0,0 +1,25 @@
+# Exposing this API over MCP
+
+**Read this file as reference** when adding or changing an MCP endpoint. Do
+not treat it as a script to run. Skip it for ordinary HTTP route work.
+
+`@daloyjs/core` ships a dependency-free Model Context Protocol (Streamable
+HTTP) server helper — also available from the `@daloyjs/core/mcp` subpath.
+To expose selected capabilities to MCP clients (AI agents), build a handler
+with `createMcpHandler({ tools, resources, prompts })` and mount it with
+`mcpRoutes("/mcp", handler)`. Throw `McpToolError` for caller-correctable
+tool failures. The handler ships protocol-level guards (body cap, UTF-8/JSON
+validation, `Origin` checks against DNS rebinding) and composes with the
+existing middleware chain — put `bearerAuth()` / `rateLimit()` in front of
+it like any other route. See <https://daloyjs.dev/docs> for the MCP guide.
+
+The handler speaks the stateless MCP `2026-07-28` revision and every earlier
+one on the same endpoint: modern clients get `server/discover`, per-request
+`_meta`, `resultType` results, caching hints, and multi round-trip requests
+(return `{ resultType: "input_required", inputRequests, requestState }` instead
+of a final result), while legacy clients keep the `initialize` handshake. The
+required `MCP-Protocol-Version` / `Mcp-Method` / `Mcp-Name` headers are
+validated against the body — never relax that check. Treat an incoming
+`requestState` as attacker-controlled: sign it, bind it to the principal and
+the originating request, and give it a short expiry before it influences
+anything.

package/templates/vercel/package.json

@@ -16,7 +16,7 @@
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "dependencies": {
-    "@daloyjs/core": "^1.1.1",
+    "@daloyjs/core": "^1.2.1",
     "zod": "^4.4.3"
   },
   "devDependencies": {