djDaloyJS

Search docs

Jump between documentation pages.

Browse docs

Installation

DaloyJS targets Node.js ≥ 24.15 (active LTS) and is distributed on the public npm registry as @daloyjs/core. The package has no peer dependencies, so npm, yarn, pnpm, and bun can all install it directly. We recommend pnpm together with the hardened .npmrc defaults below for supply-chain reasons, but it is not required. The engines.pnpm entry in package.json is advisory metadata, while engines.node communicates the supported runtime and may warn or fail depending on your package manager and engine-strict settings.

Fastest path: scaffold a project

Use the official generator — it sets up a hardened .npmrc, strict TypeScript, and a working route in one command.

Package links: create-daloy on npm and @daloyjs/core on npm.

bash
pnpm create daloy@latest my-api
npm  create daloy@latest my-api
yarn create daloy           my-api
bun  create daloy           my-api

See Scaffold a project for templates and flags.

Or install into an existing project

Prerequisites

  • Node.js 24.15 or newer (active LTS).
  • A package manager. Any of these works — pnpm 11.x or newer is recommended for supply-chain hardening, but npm, yarn, and bun install @daloyjs/core cleanly because the package has no peer dependencies.

To enable pnpm via Corepack:

bash
corepack enable
corepack prepare pnpm@11.1.2 --activate
pnpm --version

Install DaloyJS

bash
pnpm add @daloyjs/core zod
npm  install @daloyjs/core zod
yarn add     @daloyjs/core zod
bun  add     @daloyjs/core zod
# optional — only if you want to generate a typed SDK
pnpm add -D @hey-api/openapi-ts

The framework package published to npm is @daloyjs/core.

Hardened .npmrc

Drop this .npmrc in your project root to make pnpm reject unsafe installs by default:

ini
auto-install-peers=true
strict-peer-dependencies=true
prefer-frozen-lockfile=true
verify-store-integrity=true
# Optional, pnpm 10+:
# minimum-release-age=1440   # wait 24h before installing fresh releases
# ignore-scripts=true        # whitelist install scripts via approve-builds

Read the rationale in Security and the pnpm motivation guide.

Verify

Run this from the project root after installing — it works the same under pnpm, npm, yarn, or bun because it shells straight to node:

bash
node -e "import('@daloyjs/core').then(m => console.log('DaloyJS ok →', Object.keys(m).slice(0, 6)))"

Next

Continue with Getting started to write your first route.