DaloyJS Files

@daloyjs/core has no runtime changes; this is a lockstep bump alongside the create-daloy Vercel-template fixes below, so a freshly scaffolded Vercel project deploys cleanly.

Fixed

• The vercel template now deploys cleanly on Vercel out of the box. Two issues made a freshly scaffolded Vercel project error on deploy:
• Root routing. Vercel maps api/<file> to /api/<file>, but a DaloyJS app routes at the root, so the old api/[...path].ts only answered /api/* and the deployed root domain returned a Vercel 404. The template now ships a single api/index.ts plus a vercel.json rewrite (/(.*) → /api) — the canonical Vercel "framework owns routing" pattern — so the app's routes (/healthz, /docs, …) are served at the site root.
• Proxy posture. Vercel always proxies through its edge and sets x-forwarded-for, so DaloyJS's production boot guard returned 500 on every request. The template now sets behindProxy: { hops: Number(process.env.TRUST_PROXY_HOPS ?? "1") } (Vercel is one trusted edge hop; override the env var if another proxy sits in front).
• The cloudflare-worker template no longer 500s on deploy. Cloudflare Workers always run behind Cloudflare's edge (which sets x-forwarded-for), so the same unconfigured-proxy boot guard returned 500 on every request. The template now sets behindProxy: { hops: 1 } (Cloudflare is one trusted edge hop). It also now enables docs: true for parity with the other templates, so /docs, /openapi.json, and /openapi.yaml are served (the Scalar UI loads from a CDN, so the Worker bundle cost is negligible).
• The vercel template's pnpm dev no longer recurses. It previously aliased vercel dev, which Vercel rejects (vercel dev must not recursively invoke itself) because it re-reads that script as its dev command. pnpm dev now runs a local Node dev server (src/dev.ts) that serves the same app over @daloyjs/core/node at the site root — fast iteration with no vercel dev or Vercel login.
• Scalar's "Try it" panel works on every deploy target. The node-basic, bun-basic, and deno-basic templates previously set an OpenAPI servers URL that fell back to localhost, which the browser's connect-src 'self' CSP blocked once deployed where no PUBLIC_URL / RAILWAY_PUBLIC_DOMAIN was set (e.g. Deno Deploy). They now leave servers unset by default so Scalar calls the origin the docs are served from (the deployed domain in production, localhost in dev); set PUBLIC_URL to pin an absolute base URL.

Security

• Pin transitive, dev-only dependencies to clear OSV advisories via pnpm overrides: esbuild >= 0.28.1 (GHSA-gv7w-rqvm-qjhr, GHSA-g7r4-m6w7-qqqr) and js-yaml >= 4.2.0 (GHSA-h67p-54hq-rp68). Both are build-time only and not part of the published @daloyjs/core surface.

Documentation

• Refreshed the Vercel adapter, scaffolder, and deployment docs to the single api/index.ts + rewrite pattern.

Full changelog: https://github.com/daloyjs/daloy/compare/v0.38.2...v0.38.3