Installation

DaloyJS targets Node.js 24 LTS or Node.js 26 and newer (engines.node: ^24.0.0 || >=26.0.0) and is distributed on the public npm registry as @daloyjs/core. The package has no peer dependencies, so npm, yarn, pnpm, and bun can all install it directly. We recommend pnpm together with the hardened .npmrc defaults below for supply-chain reasons, but it is not required. The engines.pnpm entry in package.json is advisory metadata, while engines.node communicates the supported runtime and may warn or fail depending on your package manager and engine-strict settings.

Fastest path: scaffold a project

Use the official generator, it sets up a hardened .npmrc, strict TypeScript, and a working route in one command.

Package links: create-daloy on npm and @daloyjs/core on npm.

# choose one package manager
pnpm create daloy@latest my-api
npm  create daloy@latest my-api
yarn create daloy           my-api
bun  create daloy           my-api

See Scaffold a project for templates and flags.

Or install into an existing project

Prerequisites

• Node.js 24 LTS, or 26.0.0 and newer (Node.js 25 is not supported).
• TypeScript 7 or 6. DaloyJS is built with TypeScript 7, and CI checks that apps on TypeScript 6 compile against the published types (see TypeScript versions).
• A package manager. Any of these works, pnpm 11.x or newer is recommended for supply-chain hardening, but npm, yarn, and bun install @daloyjs/core cleanly because the package has no peer dependencies.

To enable pnpm via Corepack:

corepack enable
corepack prepare pnpm@11.1.3 --activate
pnpm --version

Install DaloyJS

pnpm add @daloyjs/core zod

npm install @daloyjs/core zod

yarn add @daloyjs/core zod

bun add @daloyjs/core zod

Optional, only if you want to generate a typed SDK. Pin the Hey API generator to the exact snapshot below; the next section explains why:

pnpm add -D typescript @hey-api/openapi-ts@0.0.0-next-20260930190945 prettier

npm install --save-dev typescript @hey-api/openapi-ts@0.0.0-next-20260930190945 prettier

yarn add --dev typescript @hey-api/openapi-ts@0.0.0-next-20260930190945 prettier

bun add --dev typescript @hey-api/openapi-ts@0.0.0-next-20260930190945 prettier

The framework package published to npm is @daloyjs/core.

TypeScript versions

@daloyjs/core ships compiled JavaScript plus .d.ts files and has no typescript peer dependency, so the TypeScript version is your app's choice:

Choose TypeScript 6 when a tool in your stack loads typescript as a library. TypeScript 7 removed that JavaScript API, so those tools cannot run on it yet.

Hardened install settings

On pnpm 11+, put the supply-chain settings in pnpm-workspace.yaml in your project root (camelCase keys; pnpm 11 reads this file even in a single-package project). pnpm 11 ignores these settings in .npmrc, so an .npmrc-only setup does not get the cooldown or the script policy.

minimumReleaseAge: 1440
blockExoticSubdeps: true
ignoreScripts: true
strictPeerDependencies: true
verifyStoreIntegrity: true
preferFrozenLockfile: true
autoInstallPeers: true

For npm and older pnpm versions, keep the same values in .npmrc as well:

auto-install-peers=true
strict-peer-dependencies=true
prefer-frozen-lockfile=true
verify-store-integrity=true
minimum-release-age=1440
ignore-scripts=true

The cooldown and ignoreScripts reduce supply-chain risk for these installs; they do not stop every attack. ignoreScripts blocks install-script payloads, not code that runs when a package is imported, and the 24-hour cooldown only helps against compromises that are caught within a day.

Read the rationale in Security and the pnpm motivation guide.

Verify

Run this from the project root after installing, it works the same under pnpm, npm, yarn, or bun because it shells straight to node:

node -e "import('@daloyjs/core').then(m => console.log('DaloyJS ok ->', Object.keys(m).slice(0, 6)))"

Next