create-daloy 1.3.5 → 1.3.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-daloy",
-  "version": "1.3.5",
+  "version": "1.3.7",
   "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
   "type": "module",
   "license": "MIT",

package/sbom.cdx.json

@@ -1,25 +1,25 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:4bcc5215-ed8c-5ec8-a3a5-56b493479908",
+  "serialNumber": "urn:uuid:3c483f47-57a8-5ad7-9117-f4a0de859fca",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-17T18:49:43.781Z",
+    "timestamp": "2026-09-26T14:10:43.428Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "1.3.5"
+        "version": "1.3.7"
       }
     ],
     "authors": [],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/create-daloy@1.3.5",
+      "bom-ref": "pkg:npm/create-daloy@1.3.7",
       "name": "create-daloy",
-      "version": "1.3.5",
+      "version": "1.3.7",
       "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
-      "purl": "pkg:npm/create-daloy@1.3.5",
+      "purl": "pkg:npm/create-daloy@1.3.7",
       "licenses": [
         {
           "license": {
@@ -42,9 +42,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag-create-daloy-1.3.5",
+        "tagId": "swidtag-create-daloy-1.3.7",
         "name": "create-daloy",
-        "version": "1.3.5",
+        "version": "1.3.7",
         "tagVersion": 0,
         "patch": false
       }
@@ -53,7 +53,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/create-daloy@1.3.5",
+      "ref": "pkg:npm/create-daloy@1.3.7",
       "dependsOn": []
     }
   ]

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "create-daloy-1.3.5",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/create-daloy-1.3.5-4bcc5215-ed8c-5ec8-a3a5-56b493479908",
+  "name": "create-daloy-1.3.7",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/create-daloy-1.3.7-3c483f47-57a8-5ad7-9117-f4a0de859fca",
   "creationInfo": {
-    "created": "2026-09-17T18:49:43.781Z",
+    "created": "2026-09-26T14:10:43.428Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package-create-daloy",
       "name": "create-daloy",
-      "versionInfo": "1.3.5",
+      "versionInfo": "1.3.7",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/create-daloy@1.3.5"
+          "referenceLocator": "pkg:npm/create-daloy@1.3.7"
         }
       ]
     }

package/templates/bun-basic/AGENTS.md

@@ -1,6 +1,6 @@
 # AGENTS.md
 
-A [DaloyJS](https://daloyjs.dev) REST API for the [Bun](https://bun.sh) runtime. **Contract-first**: routes are defined with validation schemas (Zod in this template; DaloyJS also supports Standard Schema-compatible validators) and OpenAPI 3.1 is generated from them. When `docs: true` is set in `new App({...})`, three routes are auto-mounted: `GET /openapi.json`, `GET /openapi.yaml`, and `GET /docs` (Scalar UI).
+A [DaloyJS](https://daloyjs.dev) REST API for the [Bun](https://bun.sh) runtime. **Contract-first**: routes are defined with validation schemas (Zod in this template; DaloyJS also supports Standard Schema-compatible validators) and OpenAPI 3.1 is generated from them. With `docs: "auto"` in `new App({...})`, three routes are auto-mounted outside production: `GET /openapi.json`, `GET /openapi.yaml`, and `GET /docs` (Scalar UI).
 
 - Package manager / runtime: Bun.
 

package/templates/bun-basic/README.md

@@ -22,12 +22,12 @@ curl http://localhost:3000/books/1
 
 ## API documentation
 
-- API docs (Scalar): <http://localhost:3000/docs>
+- API docs (Scalar, development only): <http://localhost:3000/docs>
 - OpenAPI 3.1 JSON: <http://localhost:3000/openapi.json>
 - OpenAPI 3.1 YAML: <http://localhost:3000/openapi.yaml>
 
 The spec is generated live from your routes, so it stays in sync with what is actually deployed.
-To brand Scalar, change `docs: true` in `src/build-app.ts` to `docs: { scalar: { theme, customCss } }`.
+To brand Scalar, change `docs: "auto"` in `src/build-app.ts` to `docs: { scalar: { theme, customCss } }`.
 
 <!-- daloy-minimal:strip-end docs -->
 

package/templates/bun-basic/_agents/skills/daloyjs-best-practices/SKILL.md

@@ -99,7 +99,7 @@ stay in sync.
 
 ## OpenAPI & docs routes
 
-When `docs: true` is set on `new App({...})` (the default in this template),
+With `docs: "auto"` on `new App({...})` (the default in this template),
 three routes are auto-mounted off the spec generated from your route
 definitions:
 
@@ -109,8 +109,8 @@ definitions:
 - `GET /docs` — Scalar API reference UI that loads the spec.
 
 Customize via `docs: { openapiPath, openapiYamlPath, path, ui }`. Set
-`openapiYamlPath: false` to disable just the YAML route, `docs: "auto"` to
-mount only outside production, or `docs: false` to disable all three.
+`openapiYamlPath: false` to disable just the YAML route, `docs: true` to
+also mount them in production, or `docs: false` to disable all three.
 For hand-rolled mounting, `openapiToYAML` is exported from
 `@daloyjs/core/openapi`.
 

package/templates/bun-basic/package.json

@@ -19,7 +19,7 @@
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "dependencies": {
-    "@daloyjs/core": "^1.3.5",
+    "@daloyjs/core": "^1.3.7",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/bun-basic/src/build-app.ts

@@ -26,7 +26,7 @@ export function buildApp(): App {
       ? { behindProxy: { hops: Number(process.env.TRUST_PROXY_HOPS) } }
       : {}),
     // daloy-minimal:strip-start docs
-    // Auto-mounted docs (when `docs: true`):
+    // Auto-mounted docs, outside production only (`docs: "auto"`):
     //   GET /openapi.json — OpenAPI 3.1 spec (JSON)
     //   GET /openapi.yaml — OpenAPI 3.1 spec (YAML, served inline as text/yaml)
     //   GET /docs         — Scalar API reference UI that loads the spec
@@ -43,7 +43,7 @@ export function buildApp(): App {
       // to pin an absolute base URL (e.g. for client codegen).
       ...(process.env.PUBLIC_URL ? { servers: [{ url: process.env.PUBLIC_URL }] } : {}),
     },
-    docs: true,
+    docs: "auto",
     // daloy-minimal:strip-end docs
   });
 

package/templates/cloudflare-worker/AGENTS.md

@@ -1,6 +1,6 @@
 # AGENTS.md
 
-A [DaloyJS](https://daloyjs.dev) REST API deployed to **Cloudflare Workers**. **Contract-first**: routes are defined with validation schemas (Zod in this template; DaloyJS also supports Standard Schema-compatible validators) and OpenAPI 3.1 is generated from them. `docs: true` is set in `new App({...})`, so `GET /openapi.json`, `GET /openapi.yaml`, and `GET /docs` (Scalar UI) are auto-mounted. DaloyJS is dependency-free and the Scalar UI loads from a CDN, so bundle cost is negligible; drop `docs` (and the `openapi` block) for the smallest bundle.
+A [DaloyJS](https://daloyjs.dev) REST API deployed to **Cloudflare Workers**. **Contract-first**: routes are defined with validation schemas (Zod in this template; DaloyJS also supports Standard Schema-compatible validators) and OpenAPI 3.1 is generated from them. `docs: "auto"` is set, and since `production: true` the spec routes (`/openapi.json`, `/openapi.yaml`, `/docs`) stay off; set `docs: true` to publish them. Drop `docs` and `openapi` for the smallest bundle.
 
 - Package manager: pnpm (use `pnpm` unless the project's `package.json` was rewritten for npm/yarn/bun).
 - Runtime: Cloudflare Workers (Web Standard `Request`/`Response`).

package/templates/cloudflare-worker/_agents/skills/daloyjs-best-practices/SKILL.md

@@ -93,8 +93,9 @@ check, run `pnpm contract`.
 
 ## OpenAPI & docs routes
 
-This Worker starter sets `docs: true` in `new App({...})`, so three routes
-are auto-mounted off the spec generated from your route definitions.
+This Worker starter sets `docs: "auto"` in `new App({...})`. Because it also
+sets `production: true`, the three routes below stay off in the deployed
+Worker; set `docs: true` to publish them (or while developing).
 DaloyJS is dependency-free and the Scalar UI loads from a CDN, so the bundle
 cost is negligible; drop `docs` (and the `openapi` block) if you need the
 smallest possible Worker. The routes:
@@ -105,7 +106,7 @@ smallest possible Worker. The routes:
 - `GET /docs` — Scalar API reference UI that loads the spec.
 
 On Workers the Scalar UI adds the most weight; consider
-`docs: { ui: "swagger" }` or `docs: "auto"` (off in production), or pass
+`docs: { ui: "swagger" }`, or pass
 `docs: { openapiYamlPath: false }` to drop the YAML route only.
 For hand-rolled mounting, `openapiToYAML` is exported from
 `@daloyjs/core/openapi`.

package/templates/cloudflare-worker/package.json

@@ -16,7 +16,7 @@
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "dependencies": {
-    "@daloyjs/core": "^1.3.5",
+    "@daloyjs/core": "^1.3.7",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/cloudflare-worker/src/index.ts

@@ -13,14 +13,16 @@ const app = new App({
   // additional proxy in front of the Worker.
   behindProxy: { hops: 1 },
   // daloy-minimal:strip-start docs
-  // Auto-mounted docs (since `docs: true`): GET /openapi.json, /openapi.yaml,
-  // and /docs (Scalar UI). DaloyJS is dependency-free and the Scalar UI loads
-  // from a CDN, so this adds negligible Worker bundle size. Drop `docs` (and
-  // this `openapi` block) if you want the smallest possible bundle.
+  // `docs: "auto"` mounts GET /openapi.json, /openapi.yaml and /docs (Scalar
+  // UI) only outside production. With `production: true` above they stay off,
+  // so a deployed Worker does not publish its schema; set `docs: true` to
+  // publish them (or while developing). The Scalar UI loads from a CDN, so
+  // either way the bundle cost is negligible. Drop `docs` (and this `openapi`
+  // block) for the smallest possible bundle.
   openapi: {
     info: { title: "My Daloy Cloudflare API", version: "0.0.1" },
   },
-  docs: true,
+  docs: "auto",
   // daloy-minimal:strip-end docs
 });
 

package/templates/deno-basic/AGENTS.md

@@ -1,6 +1,6 @@
 # AGENTS.md
 
-A [DaloyJS](https://daloyjs.dev) REST API for the [Deno](https://deno.com) runtime. **Contract-first**: routes are defined with validation schemas (Zod in this template; DaloyJS also supports Standard Schema-compatible validators) and OpenAPI 3.1 is generated from them. When `docs: true` is set in `new App({...})`, three routes are auto-mounted: `GET /openapi.json`, `GET /openapi.yaml`, and `GET /docs` (Scalar UI).
+A [DaloyJS](https://daloyjs.dev) REST API for the [Deno](https://deno.com) runtime. **Contract-first**: routes are defined with validation schemas (Zod in this template; DaloyJS also supports Standard Schema-compatible validators) and OpenAPI 3.1 is generated from them. With `docs: "auto"` in `new App({...})`, three routes are auto-mounted outside production: `GET /openapi.json`, `GET /openapi.yaml`, and `GET /docs` (Scalar UI).
 
 - Runtime: Deno (no Node package manager). DaloyJS loads from `jsr:` and third-party packages such as Zod load from `npm:` in `deno.json`.
 

package/templates/deno-basic/README.md

@@ -21,12 +21,12 @@ curl http://localhost:3000/books/1
 
 ## API documentation
 
-- API docs (Scalar): <http://localhost:3000/docs>
+- API docs (Scalar, development only): <http://localhost:3000/docs>
 - OpenAPI 3.1 JSON: <http://localhost:3000/openapi.json>
 - OpenAPI 3.1 YAML: <http://localhost:3000/openapi.yaml>
 
 The spec is generated live from your routes, so it stays in sync with what is actually deployed.
-To brand Scalar, change `docs: true` in `src/build-app.ts` to `docs: { scalar: { theme, customCss } }`.
+To brand Scalar, change `docs: "auto"` in `src/build-app.ts` to `docs: { scalar: { theme, customCss } }`.
 
 <!-- daloy-minimal:strip-end docs -->
 

package/templates/deno-basic/_agents/skills/daloyjs-best-practices/SKILL.md

@@ -100,7 +100,7 @@ focused contract check, run `deno task contract`.
 
 ## OpenAPI & docs routes
 
-When `docs: true` is set on `new App({...})` (the default in this template),
+With `docs: "auto"` on `new App({...})` (the default in this template),
 three routes are auto-mounted off the spec generated from your route
 definitions:
 
@@ -110,8 +110,8 @@ definitions:
 - `GET /docs` — Scalar API reference UI that loads the spec.
 
 Customize via `docs: { openapiPath, openapiYamlPath, path, ui }`. Set
-`openapiYamlPath: false` to disable just the YAML route, `docs: "auto"` to
-mount only outside production, or `docs: false` to disable all three.
+`openapiYamlPath: false` to disable just the YAML route, `docs: true` to
+also mount them in production, or `docs: false` to disable all three.
 For hand-rolled mounting, `openapiToYAML` is exported from
 `@daloyjs/core/openapi`.
 

package/templates/deno-basic/deno.json

@@ -10,11 +10,11 @@
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "imports": {
-    "@daloyjs/core": "jsr:@daloyjs/daloy@^1.3.5",
-    "@daloyjs/core/banner": "jsr:@daloyjs/daloy@^1.3.5/banner",
-    "@daloyjs/core/contract": "jsr:@daloyjs/daloy@^1.3.5/contract",
-    "@daloyjs/core/deno": "jsr:@daloyjs/daloy@^1.3.5/deno",
-    "@daloyjs/core/openapi": "jsr:@daloyjs/daloy@^1.3.5/openapi",
+    "@daloyjs/core": "jsr:@daloyjs/daloy@^1.3.7",
+    "@daloyjs/core/banner": "jsr:@daloyjs/daloy@^1.3.7/banner",
+    "@daloyjs/core/contract": "jsr:@daloyjs/daloy@^1.3.7/contract",
+    "@daloyjs/core/deno": "jsr:@daloyjs/daloy@^1.3.7/deno",
+    "@daloyjs/core/openapi": "jsr:@daloyjs/daloy@^1.3.7/openapi",
     "zod": "npm:zod@^4.4.3"
   },
   "compilerOptions": {

package/templates/deno-basic/src/build-app.ts

@@ -27,7 +27,7 @@ export function buildApp(): App {
       ? { behindProxy: { hops: Number(Deno.env.get("TRUST_PROXY_HOPS")) } }
       : {}),
     // daloy-minimal:strip-start docs
-    // Auto-mounted docs (when `docs: true`):
+    // Auto-mounted docs, outside production only (`docs: "auto"`):
     //   GET /openapi.json — OpenAPI 3.1 spec (JSON)
     //   GET /openapi.yaml — OpenAPI 3.1 spec (YAML, served inline as text/yaml)
     //   GET /docs         — Scalar API reference UI that loads the spec
@@ -44,7 +44,7 @@ export function buildApp(): App {
       // deployed. Set PUBLIC_URL to pin an absolute base URL (e.g. for codegen).
       ...(Deno.env.get("PUBLIC_URL") ? { servers: [{ url: Deno.env.get("PUBLIC_URL")! }] } : {}),
     },
-    docs: true,
+    docs: "auto",
     // daloy-minimal:strip-end docs
   });
 

package/templates/node-basic/AGENTS.md

@@ -4,7 +4,7 @@ A [DaloyJS](https://daloyjs.dev) Node.js REST API. **Contract-first**:
 routes are defined with validation schemas (Zod in this template; DaloyJS also
 supports Standard Schema-compatible validators) and OpenAPI 3.1 is generated
 from them.
-When `docs: true` is set in `new App({...})`, three routes are auto-mounted:
+With `docs: "auto"` in `new App({...})`, three routes are auto-mounted outside production:
 `GET /openapi.json`, `GET /openapi.yaml`, and `GET /docs` (Scalar UI).
 
 - Package manager: pnpm (use `pnpm` unless the project's `package.json` was rewritten for npm/yarn/bun).

package/templates/node-basic/README.md

@@ -22,12 +22,12 @@ curl http://localhost:3000/books/1
 
 ## API documentation
 
-- API docs (Scalar): <http://localhost:3000/docs>
+- API docs (Scalar, development only): <http://localhost:3000/docs>
 - OpenAPI 3.1 JSON: <http://localhost:3000/openapi.json>
 - OpenAPI 3.1 YAML: <http://localhost:3000/openapi.yaml>
 
 The spec is generated live from your routes, so it stays in sync with what is actually deployed.
-To brand Scalar, change `docs: true` in `src/build-app.ts` to `docs: { scalar: { theme, customCss } }`.
+To brand Scalar, change `docs: "auto"` in `src/build-app.ts` to `docs: { scalar: { theme, customCss } }`.
 
 <!-- daloy-minimal:strip-end docs -->
 

package/templates/node-basic/_agents/skills/daloyjs-best-practices/SKILL.md

@@ -104,7 +104,7 @@ check, run `pnpm contract`. If a change touches route shapes, also run
 
 ## OpenAPI & docs routes
 
-When `docs: true` is set on `new App({...})` (the default in this template),
+With `docs: "auto"` on `new App({...})` (the default in this template),
 three routes are auto-mounted off the spec generated from your route
 definitions:
 
@@ -114,8 +114,8 @@ definitions:
 - `GET /docs` — Scalar API reference UI that loads the spec.
 
 Customize via `docs: { openapiPath, openapiYamlPath, path, ui }`. Set
-`openapiYamlPath: false` to disable just the YAML route, `docs: "auto"` to
-mount only outside production, or `docs: false` to disable all three.
+`openapiYamlPath: false` to disable just the YAML route, `docs: true` to
+also mount them in production, or `docs: false` to disable all three.
 
 For hand-rolled mounting (when `docs: false`), the YAML serializer is
 exported from the openapi subpath:

package/templates/node-basic/package.json

@@ -20,7 +20,7 @@
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "dependencies": {
-    "@daloyjs/core": "^1.3.5",
+    "@daloyjs/core": "^1.3.7",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/node-basic/src/build-app.ts

@@ -28,12 +28,13 @@ export function buildApp(): App {
       ? { behindProxy: { hops: Number(process.env.TRUST_PROXY_HOPS) } }
       : {}),
     // daloy-minimal:strip-start docs
-    // Auto-mounted docs (when `docs: true`):
+    // Auto-mounted docs, outside production only (`docs: "auto"`):
     //   GET /openapi.json — OpenAPI 3.1 spec (JSON)
     //   GET /openapi.yaml — OpenAPI 3.1 spec (YAML, served inline as text/yaml)
     //   GET /docs         — Scalar API reference UI that loads the spec
-    // `docs: true` always mounts. Use `docs: "auto"` to mount only when
-    // `NODE_ENV !== "production"`, or `docs: false` to disable entirely.
+    // `docs: "auto"` skips them when the App is in production, so a deployed
+    // API does not publish its schema. Use `docs: true` to mount them in
+    // production as well, or `docs: false` to disable entirely.
     // Customize paths via `docs: { openapiPath, openapiYamlPath, path, ui }`,
     // or pass `openapiYamlPath: false` to disable just the YAML route.
     // `info.title` / `info.version` default to the top-level `title` /
@@ -48,7 +49,7 @@ export function buildApp(): App {
       // to pin an absolute base URL (e.g. for client codegen).
       ...(process.env.PUBLIC_URL ? { servers: [{ url: process.env.PUBLIC_URL }] } : {}),
     },
-    docs: true,
+    docs: "auto",
     // daloy-minimal:strip-end docs
   });
 

package/templates/vercel/AGENTS.md

@@ -1,6 +1,6 @@
 # AGENTS.md
 
-A [DaloyJS](https://daloyjs.dev) REST API deployed to **Vercel** on the **Node.js runtime**. **Contract-first**: routes use validation schemas (Zod here; DaloyJS also supports Standard Schema-compatible validators) and generate OpenAPI 3.1. `docs: true` auto-mounts `GET /openapi.json`, `GET /openapi.yaml`, and `GET /docs` (Scalar UI).
+A [DaloyJS](https://daloyjs.dev) REST API deployed to **Vercel** on the **Node.js runtime**. **Contract-first**: routes use validation schemas (Zod here; DaloyJS also supports Standard Schema-compatible validators) and generate OpenAPI 3.1. `docs: "auto"` auto-mounts `GET /openapi.json`, `GET /openapi.yaml`, and `GET /docs` (Scalar UI) outside production.
 
 - Package manager: pnpm (use `pnpm` unless the project's `package.json` was rewritten for npm/yarn/bun).
 - Runtime: Vercel Node.js Functions on Fluid Compute (Web Standard `Request`/`Response`).

package/templates/vercel/README.md

@@ -22,12 +22,12 @@ curl http://localhost:3000/books/1
 
 ## API documentation
 
-- API docs (Scalar): <http://localhost:3000/docs>
+- API docs (Scalar, development only): <http://localhost:3000/docs>
 - OpenAPI 3.1 JSON: <http://localhost:3000/openapi.json>
 - OpenAPI 3.1 YAML: <http://localhost:3000/openapi.yaml>
 
 After deploying, the same routes serve `/docs`, `/openapi.json`, and `/openapi.yaml` from your Vercel deployment URL.
-To brand Scalar, change `docs: true` in `api/index.ts` to `docs: { scalar: { theme, customCss } }`.
+To brand Scalar, change `docs: "auto"` in `api/index.ts` to `docs: { scalar: { theme, customCss } }`.
 
 <!-- daloy-minimal:strip-end docs -->
 

package/templates/vercel/_agents/skills/daloyjs-best-practices/SKILL.md

@@ -100,7 +100,7 @@ check, run `pnpm contract`.
 
 ## OpenAPI & docs routes
 
-When `docs: true` is set on `new App({...})` (the default in this template),
+With `docs: "auto"` on `new App({...})` (the default in this template),
 three routes are auto-mounted off the spec generated from your route
 definitions:
 
@@ -110,8 +110,8 @@ definitions:
 - `GET /docs` — Scalar API reference UI that loads the spec.
 
 Customize via `docs: { openapiPath, openapiYamlPath, path, ui }`. Set
-`openapiYamlPath: false` to disable just the YAML route, `docs: "auto"` to
-mount only outside production, or `docs: false` to disable all three.
+`openapiYamlPath: false` to disable just the YAML route, `docs: true` to
+also mount them in production, or `docs: false` to disable all three.
 On Vercel the YAML serializer is pure-string (no extra deps) and adds
 <1KB to the bundle. For hand-rolled mounting, `openapiToYAML` is exported
 from `@daloyjs/core/openapi`.

package/templates/vercel/api/index.ts

@@ -31,14 +31,14 @@ export const app = new App({
   // (e.g. set it to 2 behind Cloudflare -> Vercel).
   behindProxy: { hops: Number(process.env.TRUST_PROXY_HOPS ?? "1") },
   // daloy-minimal:strip-start docs
-  // Auto-mounted docs (when `docs: true`):
+  // Auto-mounted docs, outside production only (`docs: "auto"`):
   //   GET /openapi.json — OpenAPI 3.1 spec (JSON)
   //   GET /openapi.yaml — OpenAPI 3.1 spec (YAML, served inline as text/yaml)
   //   GET /docs         — Scalar API reference UI that loads the spec
   openapi: {
     info: { title: "My Daloy Vercel API", version: "0.0.1" },
   },
-  docs: true,
+  docs: "auto",
   // daloy-minimal:strip-end docs
 });
 

package/templates/vercel/package.json

@@ -16,7 +16,7 @@
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "dependencies": {
-    "@daloyjs/core": "^1.3.5",
+    "@daloyjs/core": "^1.3.7",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/bun-basic/CLAUDE.md

@@ -1 +0,0 @@
-@AGENTS.md

package/templates/cloudflare-worker/CLAUDE.md

@@ -1 +0,0 @@
-@AGENTS.md

package/templates/deno-basic/CLAUDE.md

@@ -1 +0,0 @@
-@AGENTS.md

package/templates/node-basic/CLAUDE.md

@@ -1 +0,0 @@
-@AGENTS.md

package/templates/vercel/CLAUDE.md

@@ -1 +0,0 @@
-@AGENTS.md