create-daloy 1.4.0 → 1.5.0

package/templates/vercel/_Dockerfile

@@ -5,8 +5,8 @@
 # Node.js runtime — **this Dockerfile is not a production runtime**. Ship
 # the function to Vercel; use this image for:
 #   - Reproducible local dev (devcontainers, GitHub Codespaces).
-#   - CI smoke tests that exercise the handler against `vercel dev`
-#     without installing Node/pnpm on the runner.
+#   - CI smoke tests that exercise the handler over the plain Node dev
+#     server (`src/dev.ts`) without installing Node/pnpm on the runner.
 #   - Self-hosted review apps when migrating to the `node-basic`
 #     template later.
 #
@@ -14,11 +14,10 @@
 #   - Non-root runtime user (uid 1001).
 #   - Read-only-root-filesystem friendly: writes are confined to the
 #     working dir; mount `/tmp` as tmpfs (`--read-only --tmpfs /tmp`).
-#   - `STOPSIGNAL SIGTERM` so `vercel dev` exits cleanly.
+#   - `STOPSIGNAL SIGTERM` so the dev server exits cleanly.
 #   - Minimal runner surface: no `curl`, no extra OS packages.
 #     BusyBox `wget` powers the HEALTHCHECK.
-#   - `tini` as PID 1 for proper signal forwarding and zombie reaping
-#     (important because `vercel dev` spawns child processes).
+#   - `tini` as PID 1 for proper signal forwarding and zombie reaping.
 #   - `pnpm install --frozen-lockfile --ignore-scripts` matches the
 #     supply-chain defaults in `.npmrc` (no lifecycle scripts run).
 #   - Base image is consumed through the `NODE_IMAGE` ARG so builds
@@ -32,7 +31,7 @@ ARG NODE_IMAGE=node:24-alpine
 FROM ${NODE_IMAGE} AS builder
 WORKDIR /app
 COPY package.json pnpm-lock.yaml* ./
-RUN corepack enable && corepack prepare pnpm@latest --activate && \
+RUN corepack enable && corepack prepare pnpm@11.1.3 --activate && \
     pnpm install --frozen-lockfile --ignore-scripts
 COPY . .
 
@@ -50,6 +49,8 @@ STOPSIGNAL SIGTERM
 HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
   CMD wget -q -O /dev/null --spider http://127.0.0.1:3000/healthz || exit 1
 ENTRYPOINT ["/sbin/tini", "--"]
-# `vercel dev` binds the dev server. Listen on all interfaces so the
-# container is reachable from the host network.
-CMD ["./node_modules/.bin/vercel", "dev", "--listen", "0.0.0.0:3000"]
+# Serve the same app as the Vercel Function over a plain Node listener
+# (src/dev.ts, bound to all interfaces). `vercel dev` is not used here: it
+# needs `vercel login` and a linked project, so it cannot start in a
+# non-interactive container.
+CMD ["node", "src/dev.ts"]

package/templates/vercel/_agents/skills/daloyjs-best-practices/SKILL.md

@@ -90,7 +90,7 @@ pnpm dev          # local Node dev server (src/dev.ts) on http://localhost:3000
 pnpm typecheck    # tsc --noEmit
 pnpm test         # run test suite
 pnpm contract     # daloy inspect --check api/index.ts
-pnpm deploy       # deploy to Vercel
+pnpm run deploy   # deploy to Vercel (`pnpm deploy` is pnpm's own command)
 pnpm audit        # supply-chain audit
 ```
 
@@ -321,7 +321,7 @@ reference. Skip that file for ordinary route work.
 
 ## Logging & observability
 
-- Use `ctx.log` — it carries the request id.
+- Use `ctx.state.log` — it carries the request id.
 - `console.log` shows up in Vercel's runtime logs; the framework logger
   emits structured JSON for log aggregators.
 

package/templates/vercel/_dockerignore

@@ -11,4 +11,7 @@ coverage
 .env.*
 !.env.example
 generated
-otherdocs
+# Private keys and certificates never belong in an image.
+*.pem
+*.key
+*.p12

package/templates/vercel/_env.example

@@ -1 +1,9 @@
-# Add Vercel project env vars here.
+# Add Vercel project env vars here (Project -> Settings -> Environment Variables).
+
+# Required once per project so Vercel builds with the pnpm pinned in
+# package.json#packageManager (see README "Deploy").
+# ENABLE_EXPERIMENTAL_COREPACK=1
+
+# Vercel's edge is one trusted proxy hop, which is the default. Only change it
+# if you know your chain differs.
+# TRUST_PROXY_HOPS=1

package/templates/vercel/_gitignore

@@ -12,3 +12,8 @@ coverage/
 # consumer's lockfile and can pin transitives to unsigned tarballs.
 # See https://socket.dev/blog/understanding-the-security-concerns-of-npm-shrinkwrap
 npm-shrinkwrap.json
+
+# Private keys and certificates (keep them in a secret manager, not git).
+*.pem
+*.key
+*.p12

package/templates/vercel/_npmrc

@@ -1,4 +1,7 @@
 # DaloyJS supply-chain hardening defaults — see the "Supply chain" docs.
+#
+# pnpm 11+ reads its settings from pnpm-workspace.yaml, not from this file,
+# so the same values are set there. They stay here for npm and older tooling.
 
 auto-install-peers=true
 strict-peer-dependencies=true

package/templates/vercel/_vercelignore

@@ -0,0 +1,10 @@
+# Files `vercel deploy` must never upload. The Vercel CLI does not apply
+# .gitignore to CLI uploads, so local secrets need their own entry here.
+.env
+.env.*
+!.env.example
+*.pem
+*.key
+.githooks/
+tests/
+coverage/

package/templates/vercel/api/index.ts

@@ -26,9 +26,10 @@ export const app = new App({
   // Reverse-proxy posture. On Vercel, every request reaches the function
   // through Vercel's edge, which sets `x-forwarded-for`. The app must declare
   // that trusted hop, otherwise DaloyJS refuses the spoofable header and
-  // returns 500 in production. Vercel is exactly one edge hop, so the default
-  // is 1; override TRUST_PROXY_HOPS only if you put another proxy in front
-  // (e.g. set it to 2 behind Cloudflare -> Vercel).
+  // returns 500 in production. Vercel overwrites `x-forwarded-for` with the
+  // real client IP (it does not append), so the chain is one hop even with a
+  // CDN such as Cloudflare in front: keep the default of 1. rateLimit() below
+  // follows this setting, so each client gets its own bucket.
   behindProxy: { hops: Number(process.env.TRUST_PROXY_HOPS ?? "1") },
   // daloy-minimal:strip-start docs
   // Auto-mounted docs, outside production only (`docs: "auto"`):

package/templates/vercel/package.json

@@ -10,18 +10,18 @@
     "dev": "node --watch src/dev.ts",
     "deploy": "vercel deploy",
     "typecheck": "tsc --noEmit",
-    "test": "node --test tests/**/*.test.ts",
+    "test": "node --test \"tests/**/*.test.ts\"",
     "contract": "daloy inspect --check api/index.ts",
     "audit": "pnpm audit --prod",
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "dependencies": {
-    "@daloyjs/core": "^1.4.0",
+    "@daloyjs/core": "^1.5.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {
     "@types/node": "^26.1.0",
-    "typescript": "^7.0.2",
+    "typescript": "^5.9.3",
     "vercel": "^48.0.0"
   }
 }

package/templates/vercel/pnpm-workspace.yaml

@@ -22,3 +22,19 @@ minimumReleaseAge: 1440
 # Transitive deps must resolve from the configured registry, which makes
 # typosquatted-tarball and compromised-fork attacks much harder to land.
 blockExoticSubdeps: true
+
+# pnpm 11+ ignores these keys in `.npmrc`, so they live here. `.npmrc` keeps
+# the same values for older tooling.
+#
+# Never run dependency lifecycle scripts (postinstall / preinstall / prepare):
+# the main execution channel of the chalk/debug, node-ipc and Shai-Hulud
+# malware. If you later need a build step, allowlist that one package with
+# `allowBuilds` instead of turning this off.
+ignoreScripts: true
+# Fail on unmet or incompatible peer dependencies instead of warning.
+strictPeerDependencies: true
+# Re-verify package integrity hashes against the lockfile on install.
+verifyStoreIntegrity: true
+# Use the lockfile as-is whenever it satisfies package.json.
+preferFrozenLockfile: true
+autoInstallPeers: true