The complete public surface of DaloyJS v1.0.0-rc.5, organized by import path. Every signature in this reference is generated from the same TypeScript types your editor reads on hover, open the source files for fuller TSDoc, examples, and security rationale.
Reference sections
The reference is split into five focused pages so each one stays scannable:
App & routing: the App class, route contracts, hooks and context types, dispatch order, errors, and schema validation.
Feature modules: OpenAPI, typed client, contract tests, MCP, docs UIs, streaming, multipart, WebSocket, tracing, and the CLI.
Runtime adapters: serve() for Node.js, Bun, and Deno, plus the Cloudflare, Vercel, Fastly, and Lambda handlers.
Minimal server
This page is a reference, the signatures below are the source of truth, not a step-by-step tutorial. If you are starting from scratch, the getting-started guide walks through scaffolding, validation, the typed client, and OpenAPI docs in full. The snippet here is just enough to map the types below onto a server you can actually run.
bash
pnpm add @daloyjs/core zod
ts
// index.tsimport { z } from "zod";import { App } from "@daloyjs/core"; // root barrelimport { serve } from "@daloyjs/core/node"; // adapters are subpath-onlyconst app = new App({ title: "Hello API", version: "1.0.0" }).get( "/hello", { operationId: "hello", responses: { // A response `body` schema enables OWASP-API3 field stripping. 200: { description: "Greeting", body: z.object({ message: z.string() }) }, }, }, // The handler returns the discriminated union HandlerReturn<Res>: // { status, body, headers? }, keyed by a status declared above. () => ({ status: 200, body: { message: "Hello from DaloyJS" } }),);const { port } = serve(app); // NodeServerOptions.port defaults to 3000console.log(`listening on http://localhost:${port}`);
Run it with node index.ts: Node.js (22.18+) strips TypeScript types natively, no loader required. Every response already carries the secure-by-default headers (secureHeaders) and an x-request-id (requestId); errors serialize to RFC 9457 application/problem+json. To serve /docs and /openapi.json, pass docs: true to new App(...) (it defaults to false).
If you drop the response body schema the route still works, but DaloyJS logs a security.response.bodySchemaMissing warning at startup: response field-level stripping (OWASP API3) cannot be applied to a schema-less body. Declare the schema, or ignore the warning for routes that intentionally return no body.
Subpath modules
Quick map of subpath modules exposed by the package:
You can import any feature two ways: from the root @daloyjs/core barrel (convenient and tree-shakeable), or from its own subpath (for example @daloyjs/core/jwt) for the smallest possible bundle without relying on a bundler's tree-shaking. Both resolve to the same code. Runtime adapters are the one exception: they are available only as subpaths (for example @daloyjs/core/node), so runtime-specific code such as node:http never leaks into an edge or Worker bundle.
Two ways to import
same code@daloyjs/core featureApp, jwt, fetchGuard, ...
convenientRoot barrelimport { App } from "@daloyjs/core"
smallest bundleOwn subpathimport { ... } from "@daloyjs/core/jwt"
The barrel and per-feature subpaths resolve to the same code, so pick whichever suits your bundler. Runtime adapters are the exception: they ship only as subpaths so platform code (like node:http) never leaks into an edge bundle.