About DaloyJS

DaloyJS is a runtime-portable, contract-first TypeScript web framework. One route definition is the source of truth for validation, OpenAPI 3.1, typed clients, and the HTTP handler. The runtime has zero npm dependencies, ships secure-by-default guardrails (body limits, request timeouts, header sanitization, JWT algorithm allowlists, timing-safe comparisons, prototype-pollution-safe parsers, SSRF-safe fetch), and runs the same app on Node.js, Bun, Deno, Cloudflare Workers, and Vercel.

The project is open source under the MIT license. The framework publishes as @daloyjs/core on npm and as @daloyjs/daloy on JSR from the same TypeScript source. Scaffold a new app with pnpm create daloy@latest. The source, issue tracker, changelog, and security policy live in the GitHub repository at github.com/daloyjs/daloy.

Daloy means flow in Tagalog, pronounced da-loy. The name is a reminder that requests, responses, contracts, types, and generated clients should move through one flow instead of drifting apart across layers. A longer note on the name is at /about-the-name.

DaloyJS is maintained by Devlin Duldulao, a Filipino fullstack developer based in Norway, together with volunteer contributors. It is a software project, not a registered company with a public walk-in office. Technical questions, sponsorship, and security reports all go through the contact page.

More: contact, privacy, about the name, and the docs.