create-daloy 1.4.0 → 1.5.0

package/bin/create-daloy.mjs

@@ -95,6 +95,9 @@ const RENAME_ON_COPY = new Map([
   ["_github", ".github"],
   ["_Dockerfile", "Dockerfile"],
   ["_dockerignore", ".dockerignore"],
+  // Keeps local secrets out of `vercel deploy` uploads: the Vercel CLI does
+  // not apply .gitignore to what it uploads.
+  ["_vercelignore", ".vercelignore"],
   // Directory: holds skill files for AI coding agents under
   // `.agents/skills/<skill-name>/SKILL.md`. Templates author this as
   // `_agents/` so npm pack does not drop the dotfolder during publish.
@@ -548,6 +551,10 @@ const TOOL_INSTALL_GUIDES = {
 const MIN_NODE_MAJOR = 24;
 const MIN_NPM_MAJOR = 12;
 const MIN_PNPM_MAJOR = 11;
+// Exact pnpm used by the generated CI (pnpm/action-setup) and, for templates
+// whose platform needs it, by package.json#packageManager. One constant so the
+// two can never drift.
+const PINNED_PNPM_VERSION = "11.1.3";
 
 /**
  * Parse the leading major-version integer out of a version string such as
@@ -719,7 +726,7 @@ async function copyTemplate(src, dest) {
   }
 }
 
-async function patchPackageJson(dir, projectName, packageManager) {
+async function patchPackageJson(dir, projectName, packageManager, template) {
   const file = path.join(dir, "package.json");
   if (!existsSync(file)) return;
   const raw = await readFile(file, "utf8");
@@ -742,6 +749,11 @@ async function patchPackageJson(dir, projectName, packageManager) {
   }
   if (packageManager === "pnpm") {
     json.engines = { ...json.engines, pnpm: `>=${MIN_PNPM_MAJOR}.0.0` };
+    // Vercel otherwise picks pnpm from the lockfile format (9.x/10.x), which
+    // fails the engines.pnpm floor above and aborts every deploy. With this
+    // field plus the ENABLE_EXPERIMENTAL_COREPACK=1 project variable (see the
+    // template README), Vercel builds with the same pnpm as CI.
+    if (template === "vercel") json.packageManager = `pnpm@${PINNED_PNPM_VERSION}`;
   }
   await writeFile(file, JSON.stringify(json, null, 2) + "\n", "utf8");
 }
@@ -767,16 +779,27 @@ async function patchTemplateTextFiles(dir, packageManager) {
 }
 
 function rewritePackageManagerText(raw, packageManager) {
-  return raw
+  // The release-day cooldown note names pnpm's settings file. Bun scaffolds
+  // get the same cooldown from bunfig.toml; npm and yarn scaffolds have no
+  // cooldown configured, so the note would be wrong there and is dropped.
+  const cooldownNote =
+    /> \*\*Install refused right after a DaloyJS release\?\*\*[\s\S]*?safeguard off\.\r?\n\r?\n/;
+  const withCooldownNote =
+    packageManager === "bun"
+      ? raw.replace("`pnpm-workspace.yaml`), a supply-chain", "`bunfig.toml`), a supply-chain")
+      : raw.replace(cooldownNote, "");
+  return withCooldownNote
     .replace(
       "Package manager: pnpm (use `pnpm` unless the project's `package.json` was rewritten for npm/yarn/bun).",
       `Package manager: ${packageManager}.`
     )
+    .replace("Package manager: pnpm.", `Package manager: ${packageManager}.`)
     .replace(/\bpnpm install\b/g, `${packageManager} install`)
     .replace(/\bpnpm gen:openapi\b/g, `${packageManager} run gen:openapi`)
     .replace(/\bpnpm gen:client\b/g, `${packageManager} run gen:client`)
     .replace(/\bpnpm typecheck\b/g, `${packageManager} run typecheck`)
     .replace(/\bpnpm build\b/g, `${packageManager} run build`)
+    .replace(/\bpnpm run deploy\b/g, `${packageManager} run deploy`)
     .replace(/\bpnpm deploy\b/g, `${packageManager} run deploy`)
     .replace(/\bpnpm dev\b/g, `${packageManager} run dev`)
     .replace(/\bpnpm gen\b/g, `${packageManager} run gen`)
@@ -843,6 +866,20 @@ const NPM_STRICT_NPMRC = `# DaloyJS install-time guardrails for the npm CLI.
 engine-strict=true
 `;
 
+// Bun reads its install settings from bunfig.toml, not from pnpm-workspace.yaml
+// or .npmrc. Without this file a Bun scaffold would have no release-age
+// cooldown at all, silently dropping the 24h supply-chain floor the pnpm path
+// enforces. `minimumReleaseAge` is in seconds and needs Bun >= 1.3; older Bun
+// ignores the key, which is why bun-basic's engines floor is >= 1.3.0.
+const BUN_BUNFIG = `# DaloyJS install-time guardrails for Bun.
+#
+# Wait 24h (86400 seconds) before resolving a freshly published version.
+# Most npm worm campaigns are detected and unpublished within hours. Set to 0
+# only for a real hotfix. Requires Bun >= 1.3.
+[install]
+minimumReleaseAge = 86400
+`;
+
 async function normalizePackageManagerFiles(dir, packageManager) {
   if (packageManager === "pnpm") return;
   // pnpm-workspace.yaml is pnpm-only; drop it for every other manager.
@@ -860,6 +897,9 @@ async function normalizePackageManagerFiles(dir, packageManager) {
   } else if (existsSync(npmrc)) {
     await rm(npmrc, { force: true });
   }
+  if (packageManager === "bun") {
+    await writeFile(path.join(dir, "bunfig.toml"), BUN_BUNFIG, "utf8");
+  }
 }
 
 function dockerInstallSnippet(packageManager) {
@@ -902,7 +942,7 @@ async function patchDockerfileForPackageManager(dir, packageManager) {
   // an `\n`-only pattern would silently fail to match there, leaving the
   // pnpm-specific COPY/RUN lines in place for npm/yarn/bun scaffolds.
   let next = raw.replace(
-    /COPY package\.json pnpm-lock\.yaml\* \.\/\r?\nRUN corepack enable && corepack prepare pnpm@latest --activate && \\\r?\n\s+pnpm install --frozen-lockfile --ignore-scripts/,
+    /COPY package\.json pnpm-lock\.yaml\* \.\/\r?\nRUN corepack enable && corepack prepare pnpm@[\w.-]+ --activate && \\\r?\n\s+pnpm install --frozen-lockfile --ignore-scripts/,
     `${install.copy}\n${install.run}`
   );
 
@@ -1031,7 +1071,7 @@ function setupPackageManagerStep(packageManager) {
     return `      - name: Set up pnpm
         uses: pnpm/action-setup@ac6db6d3c1f721f886538a378a2d73e85697340a # v6
         with:
-          version: 11.1.3
+          version: ${PINNED_PNPM_VERSION}
           run_install: false`;
   }
   if (packageManager === "yarn") {
@@ -1329,9 +1369,23 @@ async function addDenoSecurityTasks(dir) {
  */
 function nodeVersionStrategy(template) {
   if (template === "bun-basic") {
-    return { strategy: "", version: "24" };
+    return {
+      strategy: "",
+      version: "24",
+      checksNote: [
+        "# The verify job runs once (Bun is the runtime, so there is no Node",
+        "# version matrix). Protect `main` with the single `Verify` check.",
+      ].join("\n"),
+    };
   }
   return {
+    checksNote: [
+      "# The verify job runs as a matrix across both ends of the `engines.node`",
+      "# range declared in package.json, so a change that only works on one of",
+      "# them fails here instead of in production. That means the required status",
+      "# checks to protect `main` with are the per-version jobs (`Verify (24)`,",
+      "# `Verify (26)`), not a single `Verify`.",
+    ].join("\n"),
     strategy: [
       "    strategy:",
       "      fail-fast: false",
@@ -1445,6 +1499,7 @@ function renderCiReplacements({
     ["__BUILD_STEP__", buildStep],
     ["__CONTRACT_STEP__", contractStep],
     ["__CI_NODE_STRATEGY__", nodeVersions.strategy],
+    ["__CI_REQUIRED_CHECKS_NOTE__", nodeVersions.checksNote],
     ["__CI_NODE_VERSION__", nodeVersions.version],
     ["__DAST_LAUNCH_COMMAND__", dast.command],
     ["__DAST_EXTRA_ENV__", dast.extraEnv],
@@ -2339,7 +2394,7 @@ async function main() {
       logStep("Minimal mode applied", `${count} file${count === 1 ? "" : "s"} trimmed`);
     }
     if (!skipPackageManager) {
-      await patchPackageJson(targetDir, packageName, packageManager);
+      await patchPackageJson(targetDir, packageName, packageManager, template);
       logStep("Package metadata written", packageName);
       await patchTemplateTextFiles(targetDir, packageManager);
       await patchDockerignoreForPackageManager(targetDir, packageManager);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-daloy",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
   "type": "module",
   "license": "MIT",

package/sbom.cdx.json

@@ -1,25 +1,25 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:5f0f2cd1-d8e0-57ff-8eed-0d66ff49df85",
+  "serialNumber": "urn:uuid:7e070550-e391-54c4-9693-0a1f0c97d9ad",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-28T08:58:10.492Z",
+    "timestamp": "2026-09-29T22:26:34.115Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "1.4.0"
+        "version": "1.5.0"
       }
     ],
     "authors": [],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/create-daloy@1.4.0",
+      "bom-ref": "pkg:npm/create-daloy@1.5.0",
       "name": "create-daloy",
-      "version": "1.4.0",
+      "version": "1.5.0",
       "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
-      "purl": "pkg:npm/create-daloy@1.4.0",
+      "purl": "pkg:npm/create-daloy@1.5.0",
       "licenses": [
         {
           "license": {
@@ -42,9 +42,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag-create-daloy-1.4.0",
+        "tagId": "swidtag-create-daloy-1.5.0",
         "name": "create-daloy",
-        "version": "1.4.0",
+        "version": "1.5.0",
         "tagVersion": 0,
         "patch": false
       }
@@ -53,7 +53,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/create-daloy@1.4.0",
+      "ref": "pkg:npm/create-daloy@1.5.0",
       "dependsOn": []
     }
   ]

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "create-daloy-1.4.0",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/create-daloy-1.4.0-5f0f2cd1-d8e0-57ff-8eed-0d66ff49df85",
+  "name": "create-daloy-1.5.0",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/create-daloy-1.5.0-7e070550-e391-54c4-9693-0a1f0c97d9ad",
   "creationInfo": {
-    "created": "2026-09-28T08:58:10.492Z",
+    "created": "2026-09-29T22:26:34.115Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package-create-daloy",
       "name": "create-daloy",
-      "versionInfo": "1.4.0",
+      "versionInfo": "1.5.0",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/create-daloy@1.4.0"
+          "referenceLocator": "pkg:npm/create-daloy@1.5.0"
         }
       ]
     }

package/templates/_ci/deno/_github/workflows/container-scan.yml

@@ -116,6 +116,16 @@ jobs:
             ref="${ref%% as *}"
             ref="${ref## }"
             ref="${ref%% }"
+            # Resolve `${NAME}` against this Dockerfile's `ARG NAME=default`
+            # line, so ARG-driven base images are checked instead of skipped.
+            case "$ref" in
+              '${'*'}')
+                name="${ref#??}"
+                name="${name%?}"
+                def="$(grep -E "^ARG ${name}=" Dockerfile | head -n 1 | cut -d= -f2-)"
+                [ -n "$def" ] && ref="$def"
+                ;;
+            esac
             case "$ref" in
               scratch|"\${"*|*"@sha256:"*) ;;
               *)

package/templates/_ci/deno/_github/workflows/deploy.yml

@@ -59,9 +59,18 @@ jobs:
         with:
           deno-version: v2.x
 
+      - name: Install dependencies (frozen lockfile)
+        # Same integrity gate as ci.yml: fail when any dependency does not
+        # match the committed deno.lock, so a deploy never ships something
+        # the OSV scan did not see.
+        run: deno install --frozen=true
+
       - name: Typecheck
         run: deno task typecheck
 
+      - name: Contract check
+        run: deno task contract
+
       - name: Test
         run: deno task test
 

package/templates/_ci/node/_github/workflows/ci.yml

@@ -1,10 +1,6 @@
 # Hardened CI generated by create-daloy --with-ci.
 #
-# The verify job runs as a matrix across both ends of the `engines.node`
-# range declared in package.json, so a change that only works on one of
-# them fails here instead of in production. That means the required status
-# checks to protect `main` with are the per-version jobs (`Verify (24)`,
-# `Verify (26)`), not a single `Verify`.
+__CI_REQUIRED_CHECKS_NOTE__
 name: CI
 
 on:

package/templates/_ci/node/_github/workflows/container-scan.yml

@@ -134,6 +134,16 @@ jobs:
             ref="${ref%% as *}"
             ref="${ref## }"
             ref="${ref%% }"
+            # Resolve `${NAME}` against this Dockerfile's `ARG NAME=default`
+            # line, so ARG-driven base images are checked instead of skipped.
+            case "$ref" in
+              '${'*'}')
+                name="${ref#??}"
+                name="${name%?}"
+                def="$(grep -E "^ARG ${name}=" Dockerfile | head -n 1 | cut -d= -f2-)"
+                [ -n "$def" ] && ref="$def"
+                ;;
+            esac
             case "$ref" in
               scratch|"\${"*|*"@sha256:"*) ;;
               *)

package/templates/bun-basic/AGENTS.md

@@ -2,7 +2,7 @@
 
 A [DaloyJS](https://daloyjs.dev) REST API for the [Bun](https://bun.sh) runtime. **Contract-first**: routes are defined with validation schemas (Zod in this template; DaloyJS also supports Standard Schema-compatible validators) and OpenAPI 3.1 is generated from them. With `docs: "auto"` in `new App({...})`, three routes are auto-mounted outside production: `GET /openapi.json`, `GET /openapi.yaml`, and `GET /docs` (Scalar UI).
 
-- Package manager / runtime: Bun.
+- Runtime: Bun. Package manager: pnpm.
 
 ## Agent guidance
 

package/templates/bun-basic/README.md

@@ -5,7 +5,7 @@ A [DaloyJS](https://daloyjs.dev) starter for the [Bun](https://bun.sh) runtime.
 ## Develop
 
 ```bash
-bun install
+pnpm install
 bun run dev          # http://localhost:3000
 ```
 
@@ -18,6 +18,11 @@ curl http://localhost:3000/books/1
 <!-- daloy-minimal:strip-end books -->
 ```
 
+> **Install refused right after a DaloyJS release?** New installs wait 24 hours
+> before using a freshly published version (`minimumReleaseAge` in
+> `pnpm-workspace.yaml`), a supply-chain safeguard. If `@daloyjs/core` was just
+> released, retry a few hours later rather than turning the safeguard off.
+
 <!-- daloy-minimal:strip-start docs -->
 
 ## API documentation

package/templates/bun-basic/_Dockerfile

@@ -22,8 +22,11 @@
 #       docker build --build-arg \
 #         NODE_IMAGE=node:24-alpine@sha256:<digest> \
 #         BUN_IMAGE=oven/bun:1-alpine@sha256:<digest> .
-#     Dependabot's `docker` ecosystem (see `.github/dependabot.yml`)
-#     keeps the digest fresh. The companion `container-scan.yml`
+#     The default is a floating tag, and Dependabot's `docker` ecosystem
+#     cannot update a `FROM ${ARG}` line. For automatic digest updates,
+#     write the digest into the ARG default below (for example
+#     `ARG NODE_IMAGE=node:24-alpine@sha256:<digest>`).
+#     The companion `container-scan.yml`
 #     workflow lints this file with hadolint and scans the built image
 #     with Trivy on every PR.
 
@@ -35,7 +38,7 @@ FROM ${NODE_IMAGE} AS builder
 WORKDIR /app
 # Install deps in a layer that only invalidates when manifests change.
 COPY package.json pnpm-lock.yaml* ./
-RUN corepack enable && corepack prepare pnpm@latest --activate && \
+RUN corepack enable && corepack prepare pnpm@11.1.3 --activate && \
   pnpm install --frozen-lockfile --ignore-scripts
 COPY . .
 

package/templates/bun-basic/_agents/skills/daloyjs-best-practices/SKILL.md

@@ -201,7 +201,7 @@ app.get(
 - Throw typed errors from `@daloyjs/core` — they serialize to RFC 9457
   problem responses.
 - Add a `responses[code]` entry for every error you throw.
-- Do not swallow errors. Log via `ctx.log.error(err, "context")` and
+- Do not swallow errors. Log via `ctx.state.log.error({ err }, "context")` and
   rethrow if recovery is impossible.
 
 ## Middleware
@@ -267,15 +267,15 @@ Tests run with `bun test`. Use **in-process** requests through
 
 ```ts
 import { test, expect } from "bun:test";
-import { buildApp } from "../src/build-app";
+import { buildApp } from "../src/build-app.ts";
 
 test("GET /healthz returns ok", async () => {
   const app = buildApp();
   const res = await app.request("/healthz");
   expect(res.status).toBe(200);
-  const body = await res.json();
+  const body = (await res.json()) as { ok: boolean; runtime: string };
   expect(body.ok).toBe(true);
-  expect(typeof body.uptime).toBe("number");
+  expect(body.runtime).toBe("bun");
 });
 ```
 
@@ -324,7 +324,7 @@ Aim for complete happy- and unhappy-path test coverage of the routes you add.
   of it when URLs can be influenced by users or tenants. SSRF protections
   should fail closed for private ranges and cloud metadata endpoints.
 - Bun ships its own audit story; check `bun pm audit` periodically and
-  pin versions in `bun.lockb`.
+  pin versions in the committed lockfile.
 
 ## CI and workflows (`--with-ci` scaffolds)
 
@@ -334,7 +334,7 @@ reference. Skip that file for ordinary route work.
 
 ## Logging & observability
 
-- Use the framework logger via `ctx.log` — it carries the request id
+- Use the framework logger via `ctx.state.log` — it carries the request id
   automatically.
 - Avoid `console.log` in production code paths; the structured logger
   emits JSON for log aggregators.

package/templates/bun-basic/_dockerignore

@@ -9,4 +9,7 @@ coverage
 .env.*
 !.env.example
 generated
-otherdocs
+# Private keys and certificates never belong in an image.
+*.pem
+*.key
+*.p12

package/templates/bun-basic/_env.example

@@ -0,0 +1,12 @@
+# Copy to .env for local use (Bun loads .env automatically). Real secrets
+# belong in your platform's secret store, never in git (.env is git-ignored).
+PORT=3000
+
+# Number of reverse-proxy hops in front of the app (load balancer, PaaS edge,
+# CDN). Required in production behind any proxy: without it DaloyJS refuses
+# forwarded headers and answers 500. rateLimit() also uses it to key each
+# client instead of the proxy. Leave unset when clients connect directly.
+# TRUST_PROXY_HOPS=1
+
+# Public base URL, used as the OpenAPI `servers` entry (no localhost default).
+# PUBLIC_URL=https://api.example.com

package/templates/bun-basic/_gitignore

@@ -13,3 +13,8 @@ bun.lockb
 # consumer's lockfile and can pin transitives to unsigned tarballs.
 # See https://socket.dev/blog/understanding-the-security-concerns-of-npm-shrinkwrap
 npm-shrinkwrap.json
+
+# Private keys and certificates (keep them in a secret manager, not git).
+*.pem
+*.key
+*.p12

package/templates/bun-basic/_npmrc

@@ -1,9 +1,11 @@
 # DaloyJS supply-chain hardening defaults.
 #
-# These pnpm-specific defaults are kept here so users who switch this Bun
-# starter back to pnpm inherit the same secure-by-default install posture.
+# pnpm is this template's default package manager (Bun is the runtime).
 # When you scaffold with `--package-manager bun` the CLI removes this file
-# so `bun install` does not warn about unsupported keys.
+# and writes bunfig.toml with the same 24h cooldown instead.
+#
+# pnpm 11+ reads its settings from pnpm-workspace.yaml, not from this file,
+# so the same values are set there. They stay here for npm and older tooling.
 
 auto-install-peers=true
 strict-peer-dependencies=true

package/templates/bun-basic/package.json

@@ -4,7 +4,7 @@
   "private": true,
   "type": "module",
   "engines": {
-    "bun": ">=1.1.0"
+    "bun": ">=1.3.0"
   },
   "scripts": {
     "dev": "daloy dev --runtime bun",
@@ -19,12 +19,12 @@
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "dependencies": {
-    "@daloyjs/core": "^1.4.0",
+    "@daloyjs/core": "^1.5.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {
     "@hey-api/openapi-ts": "0.0.0-next-20260711024907",
-    "@types/bun": "^1.1.0",
+    "@types/bun": "^1.3.0",
     "typescript": "^7.0.2"
   }
 }

package/templates/bun-basic/pnpm-workspace.yaml

@@ -1,10 +1,8 @@
 # pnpm workspace-level supply-chain settings.
 #
-# This file is here even though the default package manager for this
-# template is Bun, because users can switch to pnpm with
-# `pnpm create daloy --package-manager pnpm`. When that happens, the
-# scaffolder keeps this file so pnpm 11+ picks up the workspace-level
-# supply-chain controls below. If you keep using Bun, you can delete it.
+# pnpm is this template's default package manager (Bun is the runtime).
+# Scaffolding with `--package-manager bun` removes this file and writes a
+# bunfig.toml with the same 24h release-age cooldown instead.
 #
 # pnpm 11+ reads `pnpm-workspace.yaml` as a settings file even when no
 # `packages:` list is declared. It is the only file format that accepts
@@ -23,3 +21,19 @@ minimumReleaseAge: 1440
 # Transitive deps must resolve from the configured registry, which makes
 # typosquatted-tarball and compromised-fork attacks much harder to land.
 blockExoticSubdeps: true
+
+# pnpm 11+ ignores these keys in `.npmrc`, so they live here. `.npmrc` keeps
+# the same values for older tooling.
+#
+# Never run dependency lifecycle scripts (postinstall / preinstall / prepare):
+# the main execution channel of the chalk/debug, node-ipc and Shai-Hulud
+# malware. If you later need a build step, allowlist that one package with
+# `allowBuilds` instead of turning this off.
+ignoreScripts: true
+# Fail on unmet or incompatible peer dependencies instead of warning.
+strictPeerDependencies: true
+# Re-verify package integrity hashes against the lockfile on install.
+verifyStoreIntegrity: true
+# Use the lockfile as-is whenever it satisfies package.json.
+preferFrozenLockfile: true
+autoInstallPeers: true

package/templates/bun-basic/src/index.ts

@@ -11,7 +11,9 @@ const handle = serve(app, {
   idleTimeout: 30,
 });
 
-const url = handle.url ? String(handle.url) : `http://localhost:${port}`;
+// `handle.url` is a URL whose string form ends in "/"; use the origin so the
+// links below do not become "//docs" (which 404s).
+const url = handle.url ? handle.url.origin : `http://localhost:${port}`;
 const links: StartupBannerLink[] = [
   // daloy-minimal:strip-start docs
   { label: "API docs", url: `${url}/docs` },

package/templates/bun-basic/tsconfig.json

@@ -4,7 +4,7 @@
     "module": "ESNext",
     "moduleResolution": "Bundler",
     "lib": ["ES2022"],
-    "types": ["bun-types"],
+    "types": ["bun"],
     "strict": true,
     "noUncheckedIndexedAccess": true,
     "esModuleInterop": true,

package/templates/cloudflare-worker/AGENTS.md

@@ -19,7 +19,7 @@ A [DaloyJS](https://daloyjs.dev) REST API deployed to **Cloudflare Workers**. **
 - `pnpm test` — run test suite
 - `pnpm contract` — run `daloy inspect --check src/index.ts`
 - `pnpm hooks:install` — enable the optional pre-push contract gate
-- `pnpm deploy` — `wrangler deploy`
+- `pnpm run deploy` — `wrangler deploy`
 - `pnpm audit` — supply-chain audit
 
 ## Project shape

package/templates/cloudflare-worker/README.md

@@ -9,10 +9,15 @@ pnpm install
 pnpm dev          # http://localhost:8787
 ```
 
+> **Install refused right after a DaloyJS release?** New installs wait 24 hours
+> before using a freshly published version (`minimumReleaseAge` in
+> `pnpm-workspace.yaml`), a supply-chain safeguard. If `@daloyjs/core` was just
+> released, retry a few hours later rather than turning the safeguard off.
+
 ## Deploy
 
 ```bash
-pnpm deploy
+pnpm run deploy
 ```
 
 `@daloyjs/core/cloudflare` exposes `toFetchHandler(app)`, so the same `App` you would use on Node also runs on Workers.

package/templates/cloudflare-worker/_Dockerfile

@@ -34,7 +34,7 @@ ARG NODE_IMAGE=node:24-alpine
 FROM ${NODE_IMAGE} AS builder
 WORKDIR /app
 COPY package.json pnpm-lock.yaml* ./
-RUN corepack enable && corepack prepare pnpm@latest --activate && \
+RUN corepack enable && corepack prepare pnpm@11.1.3 --activate && \
     pnpm install --frozen-lockfile --ignore-scripts
 COPY . .