About DaloyJS

DaloyJS is a runtime-portable, contract-first TypeScript web framework. One route definition is the source of truth for validation, OpenAPI 3.1, typed clients, and the HTTP handler. The runtime has zero npm dependencies, ships secure defaults (body limits, request timeouts, header sanitization, JWT algorithm allowlists, timing-safe comparisons, prototype-pollution-safe parsers, and an opt-in SSRF-guarded fetch wrapper), and runs the same app on Node.js, Bun, Deno, Cloudflare Workers, and Vercel.

The project is open source under the MIT license. The framework publishes as @daloyjs/core on npm and as @daloyjs/daloy on JSR from the same TypeScript source. Scaffold a new app with pnpm create daloy@latest. The source, issue tracker, changelog, and security policy live in the GitHub repository at github.com/daloyjs/daloy.

Daloy means flow in Tagalog, pronounced da-loy. The name is a reminder that requests, responses, contracts, types, and generated clients should move through one flow instead of drifting apart across layers. A longer note on the name is at /about-the-name.

DaloyJS is maintained by Devlin Duldulao, a Filipino fullstack developer based in Norway, together with volunteer contributors. It is a software project, not a registered company with a public walk-in office. Technical questions, sponsorship, and security reports all go through the contact page.

More: contact, privacy, about the name, and the docs.