# DaloyJS documentation

> Reference documentation for `@daloyjs/core`, a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI 3.1 generation, typed client codegen (Hey API), and security-first defaults. It runs on Node.js, Bun, Deno, and Cloudflare Workers.

This file covers the pages under `https://daloyjs.dev/docs/`. For the whole site, including the blog and the published packages, see https://daloyjs.dev/llms.txt.

Current release: `@daloyjs/core@1.2.1`, with zero runtime dependencies. Start a new project with `pnpm create daloy@latest`.

Every link below points at the markdown version of a docs page. Each markdown file lives at the page URL with `.md` appended (`/docs/routing` becomes `/docs/routing.md`); drop the suffix for the canonical HTML. Every docs page also advertises its markdown sibling with a `rel="alternate" type="text/markdown"` link relation, and points back here with `rel="describedby"`, on both the HTML `<link>` elements and the HTTP `Link:` response header.

Agents that prefer structured tools over page fetches can query these same docs over the Model Context Protocol: `https://daloyjs.dev/mcp` is a read-only MCP server with `search_docs`, `get_doc`, and `list_docs` tools.

Canonical HTML URLs also negotiate Markdown: send `Accept: text/markdown` (and expect `Vary: Accept`). Website HTTP APIs return RFC 9457 problem+json errors and RFC RateLimit headers; versioned catalog at `/api/v1` (unversioned `/api` redirects there), OpenAPI at `/openapi.json`, versioning and deprecation policy under `versioning.surfaces` and at `/docs/api-lifecycle`.

## Developer resources

- [DaloyJS API docs](https://daloyjs.dev/docs/api-reference.md): complete public TypeScript surface.
- [DaloyJS OpenAPI spec](https://daloyjs.dev/docs/openapi.md): generate OpenAPI 3.1 from routes.
- [DaloyJS auth docs](https://daloyjs.dev/docs/auth.md): bearer auth and identity providers.
- [DaloyJS webhooks](https://daloyjs.dev/docs/webhook-delivery.md): signed outbound webhook delivery.
- [DaloyJS MCP server](https://daloyjs.dev/mcp): live docs MCP. Guide: https://daloyjs.dev/docs/mcp.md.

## Start here

- [Introduction to DaloyJS](https://daloyjs.dev/docs.md): DaloyJS is a runtime-portable TypeScript web framework built around contract-first routing, Standard Schema validation, OpenAPI 3.1 generation, typed clients, and core security guardrails. Learn what makes it different.
- [Installation](https://daloyjs.dev/docs/installation.md): Install DaloyJS with pnpm, npm, yarn, or bun. Set up the framework on Node.js, Bun, Deno, Cloudflare Workers, or Vercel in minutes.
- [Getting started](https://daloyjs.dev/docs/getting-started.md): Build your first DaloyJS application: declare a contract-first route, validate with Zod, generate OpenAPI, and serve responses on any supported runtime.
- [Scaffold a DaloyJS project](https://daloyjs.dev/docs/scaffolder.md): Use create-daloy to scaffold a production-ready DaloyJS project with templates for Node.js, Bun, Deno, and Cloudflare Workers, plus optional hardened GitHub CI.
- [Where to use DaloyJS](https://daloyjs.dev/docs/where-to-use.md): A beginner-friendly map of where DaloyJS fits, API server, microservice, BFF, in-app gateway, webhook receiver, WebSocket server, MCP server, and where it doesn't (SSR, load balancer, GraphQL/SOAP/gRPC servers). Plain-English definitions of every term.

## Tutorials

- [Tutorial: build a Bookstore API](https://daloyjs.dev/docs/tutorials/bookstore.md): Step-by-step DaloyJS tutorial: build a typed Bookstore REST API with contract-first routes, Zod validation, OpenAPI docs, and a generated TypeScript client.
- [Tutorial: build a multi-user API without BOLA](https://daloyjs.dev/docs/tutorials/multi-user-api.md): Build a DaloyJS projects API that prevents cross-user access. Connect a provider-neutral principal to owner-scoped repository operations and prove isolation with adversarial tests.
- [Demo: large fake REST API](https://daloyjs.dev/docs/tutorials/fake-rest-api.md): Explore a large DaloyJS-style demo API with hundreds of endpoints. Use it to test OpenAPI tooling, typed client generation, docs UX, and navigation at real-world scale.

## Migrating

- [Migrate from Express.js](https://daloyjs.dev/docs/migrating/express.md): A complete, no-prior-knowledge guide to migrating an existing Express.js app to DaloyJS: routing, middleware, req/res, errors, routers, static files, sessions, file uploads, and a side-by-side full example, plus an incremental strangler-fig strategy.

## Core concepts

- [Routing](https://daloyjs.dev/docs/routing.md): Define type-safe HTTP routes in DaloyJS with a contract-first API: path params, query, body, and response schemas inferred end-to-end from a single declaration.
- [Validation in DaloyJS](https://daloyjs.dev/docs/validation.md): DaloyJS validates requests and responses through Standard Schema. Use Zod, Valibot, ArkType, or TypeBox, pick the validator that fits your project.
- [Validation with Zod](https://daloyjs.dev/docs/validation/zod.md): Validate request params, query, headers, and bodies in DaloyJS using Zod schemas. Errors are returned as RFC 9457 problem+json with full type inference.
- [Validation with Valibot](https://daloyjs.dev/docs/validation/valibot.md): Use Valibot as the request and response validator in DaloyJS. Modular, tree-shakeable schemas with full Standard Schema interop, type inference, and RFC 9457 problem+json errors.
- [Errors & problem+json](https://daloyjs.dev/docs/errors.md): Throw typed errors in DaloyJS and have them serialized as RFC 9457 problem+json responses by default. Customize, extend, and document errors in OpenAPI.
- [Plugins & encapsulation](https://daloyjs.dev/docs/plugins.md): Compose DaloyJS apps with encapsulated plugins, scoped middleware, decorators, lifecycle hooks, and route prefixes, for large-scale, maintainable TypeScript services.
- [Middleware combinators](https://daloyjs.dev/docs/combinators.md): Compose curated middleware stacks with every(), express any-of-these-proofs auth with some(), and exempt specific paths from a gate with except(). Dependency-free Hooks composition primitives for DaloyJS.
- [Config validation](https://daloyjs.dev/docs/config.md): Validate application configuration at boot with defineConfig(): load from env, a file, or an async secrets resolver, validate against any Standard Schema validator, and fail fast with every issue reported at once.
- [Structured logging](https://daloyjs.dev/docs/logging.md): Use the built-in, dependency-free createLogger() for structured JSON logs with secure-by-default redaction of credentials, JWTs, and provider tokens. Access a request-scoped logger via ctx.state.log and swap in pino/winston when you need to.

## OpenAPI & typed clients

- [DaloyJS OpenAPI spec](https://daloyjs.dev/docs/openapi.md): DaloyJS OpenAPI spec generation: emit OpenAPI 3.1 from your routes. Powered by Hey API, the spec stays in sync with your contracts and powers the typed client.
- [API versioning](https://daloyjs.dev/docs/api-versioning.md): Version DaloyJS APIs with explicit URL prefixes such as /api/v1/books, organize major versions as plugins, publish accurate OpenAPI contracts, and retire old endpoints safely.
- [Typed API clients](https://daloyjs.dev/docs/typed-client.md): Generate fully typed TypeScript clients from your DaloyJS OpenAPI spec with Hey API. Get end-to-end type safety between server and client with no drift.
- [API lifecycle & breaking changes](https://daloyjs.dev/docs/api-lifecycle.md): Deprecate and sunset DaloyJS routes with Deprecation and RFC 8594 Sunset headers, then catch breaking API changes in CI with diffOpenAPI, the daloy diff CLI, and the verify:breaking-changes gate.
- [Testing & contract tests](https://daloyjs.dev/docs/testing.md): Write fast, in-process tests for DaloyJS handlers and generate contract tests from your OpenAPI spec to guarantee server and client stay in sync.
- [AI-friendly route metadata](https://daloyjs.dev/docs/ai-metadata.md): Author machine-readable usage examples on DaloyJS routes. Examples are validated against your Standard Schemas at build time and surfaced into OpenAPI for Hey API and LLM codegen tooling.
- [llms.txt for agent-readable docs](https://daloyjs.dev/docs/llms-txt.md): Ship a curated /llms.txt map so coding agents and LLM tools find DaloyJS docs without scraping HTML. Covers the v2 spec: link relations for discovery, both markdown URL forms, subpath coverage, and how daloyjs.dev generates its index from the same nav as the human docs UI.
- [DaloyJS MCP server](https://daloyjs.dev/docs/mcp.md): DaloyJS MCP server: build a dedicated Model Context Protocol server. Expose tools, resources, and prompts over stateless MCP 2026-07-28 Streamable HTTP while keeping @daloyjs/core dependency-free and secure by default.
- [Vercel AI SDK](https://daloyjs.dev/docs/ai-sdk.md): Host the Vercel AI SDK (v7) on DaloyJS. Stream chat completions, validate structured model output against your route's response schema, run tool calls behind fetchGuard, and wrap the whole thing in DaloyJS's secure-by-default guardrails. The AI SDK is web-standard, so no adapter is required.

## Advanced features

- [File uploads (multipart/form-data)](https://daloyjs.dev/docs/multipart.md): Model multipart/form-data uploads in DaloyJS with typed file fields, per-field MIME, magic-byte, and size caps, plus OpenAPI-aware emission.
- [Idempotency keys](https://daloyjs.dev/docs/idempotency.md): Make unsafe POST/PUT/PATCH/DELETE requests safely retryable with the built-in, dependency-free idempotency() middleware: request fingerprinting, response replay, in-flight 409 conflicts, and a pluggable IdempotencyStore mirroring SessionStore.
- [Response caching](https://daloyjs.dev/docs/response-cache.md): Cache rendered response bodies server-side with the built-in, dependency-free responseCache() middleware: cache-key + TTL, Cache-Control orchestration (s-maxage/max-age), stale-while-revalidate, request directives, and a pluggable ResponseCacheStore mirroring SessionStore.
- [Pagination & cursor helpers](https://daloyjs.dev/docs/pagination.md): Paginate list endpoints with the built-in, dependency-free cursor helpers: opaque base64url cursor encode/decode, RFC 8288 Link header emission, and a paginationQuery() Standard Schema that validates the cursor + limit query parameters and wires them into the generated OpenAPI document and typed client.
- [Multitenancy](https://daloyjs.dev/docs/multitenancy.md): Resolve, validate, and isolate tenants with the secure-by-default tenancy() middleware: pluggable resolution (subdomain, header, path, JWT claim, or custom), refuse-unresolved by default, format-validated tenant ids, no-enumeration rejection, automatic per-tenant response-cache partitioning, and a tenantScope() helper that partitions rateLimit, concurrencyLimit, and idempotency per tenant.
- [Streaming responses (SSE & NDJSON)](https://daloyjs.dev/docs/streaming.md): Build backpressure-safe Server-Sent Events and newline-delimited JSON streams in DaloyJS. Honor AbortSignal, release iterators on disconnect, and reuse the same handler across Node, Bun, Deno, and Cloudflare Workers.
- [WebSocket primitives (Node & Bun)](https://daloyjs.dev/docs/websocket.md): Register typed WebSocket routes in DaloyJS with the same Bun-style handler shape running on both Node and Bun adapters, safe defaults, upgrade rate limiting, and graceful close semantics.
- [AsyncAPI for WebSockets](https://daloyjs.dev/docs/asyncapi.md): Generate AsyncAPI 3.0 contract documents for your DaloyJS app.ws() surfaces with the built-in, dependency-free generateAsyncAPI() generator, plus an auto-mounted interactive AsyncAPI UI (asyncapi: true) that mirrors the Scalar/Swagger OpenAPI docs, a handler meta block, and the daloy inspect --asyncapi CLI flag.
- [Scheduled tasks (in-process cron)](https://daloyjs.dev/docs/scheduler.md): Run periodic work inside your DaloyJS process with app.cron() and the Scheduler primitive. Cron expressions or fixed intervals, single-flight overlap protection, per-run timeouts, and graceful-shutdown integration with zero runtime dependencies.
- [Modular monolith](https://daloyjs.dev/docs/architecture/modular-monolith.md): Reference folder and file structure for building a scalable modular monolith with DaloyJS, bounded contexts as plugins, a thin shared kernel, contract-driven module boundaries, and a clean path to extract services later.
- [CLI, daloy inspect & daloy dev](https://daloyjs.dev/docs/cli.md): Use the daloy CLI to introspect routes, contract-test an app, dump OpenAPI 3.1, or start a watch-mode dev server on any DaloyJS project.

## Observability

- [Tracing with OpenTelemetry](https://daloyjs.dev/docs/tracing.md): Instrument DaloyJS apps with OpenTelemetry-compatible spans. The otelTracing helper produces a Hooks object that starts a SERVER span per request, attaches HTTP semantic-convention attributes, exposes the span on ctx.state, and ends it when the response is sent.
- [Metrics & the /metrics endpoint](https://daloyjs.dev/docs/metrics.md): Expose Prometheus / OpenMetrics from your DaloyJS app: a dependency-free metrics registry (counters, gauges, histograms), RED instrumentation for every route, and an opt-in, auth-guarded /metrics scrape route that inherits the same hardened posture as app.healthcheck().
- [OTLP export (OpenTelemetry push)](https://daloyjs.dev/docs/otlp.md): Push logs and OTel semantic-convention HTTP metrics to an OpenTelemetry collector with zero dependencies. One App option reads the standard OTEL_EXPORTER_OTLP_* variables; standalone exporters cover custom signals.

## Security essentials

- [Security](https://daloyjs.dev/docs/security.md): DaloyJS ships core-enforced security guardrails plus first-party middleware for secure headers, rate limits, CORS, CSRF, sessions, and supply-chain hardening.
- [Secure-by-default](https://daloyjs.dev/docs/security/secure-defaults.md): Daloy auto-applies secureHeaders() and rejects cross-origin state-changing requests unless cors() is registered. Learn the new defaults, escape hatches, and per-route opt-ins.
- [OWASP API Security Top 10 mapping](https://daloyjs.dev/docs/security/owasp-api-top-10.md): How DaloyJS addresses each item in the OWASP API Security Top 10 (2023), what the core enforces, which middleware to enable, and what stays your responsibility.
- [Resource authorization: prevent BOLA and IDOR](https://daloyjs.dev/docs/security/resource-authorization.md): Protect user-owned and tenant-owned records in DaloyJS APIs. Learn function-level, object-level, and property-level authorization with provider-neutral and database-neutral patterns.
- [JWT and authentication safeguards](https://daloyjs.dev/docs/security/auth-slice.md): Secure DaloyJS authentication with asymmetric JWKS middleware, per-scheme revalidation hooks, typed basic-auth callbacks, and non-cacheable authentication challenges.
- [Sessions](https://daloyjs.dev/docs/security/session.md): Use the built-in session() middleware for an edge-friendly signed-cookie session with a pluggable store, key rotation, automatic privilege-change rotation, and conservative __Host- defaults.
- [CSRF protection](https://daloyjs.dev/docs/security/csrf.md): Use the built-in csrf() middleware to protect mutating routes with double-submit-cookie or Fetch Metadata CSRF strategies.
- [Cookie helpers](https://daloyjs.dev/docs/security/cookies.md): Read and write cookies the same way every DaloyJS subsystem does: serializeCookie(), readRequestCookie(), serializeClearCookie(), and assertCookieAttributes() enforce RFC 6265bis prefixes, secure-by-default attributes, and cookie-tossing defenses.
- [Password hashing (passwordHash)](https://daloyjs.dev/docs/security/hashing.md): Hash and verify passwords with zero configuration: passwordHash() and passwordVerify() use OWASP-aligned scrypt from Node core, a PHC-style output string, and constant-time verification, with no runtime dependencies.

## Attack protection

- [SQL injection](https://daloyjs.dev/docs/security/sql-injection.md): How Daloy's HTTP layer helps you stay safe from SQL injection, the ORM/driver patterns that close the rest of the gap, and the dynamic-SQL escape hatch (allowlists) for the cases that parameterized queries can't cover.
- [Command injection](https://daloyjs.dev/docs/security/command-injection.md): How DaloyJS keeps the framework itself free of shell-out primitives, and the safe patterns (and grep rules) you should use when your own handlers need to invoke an external program.
- [SSRF guard (fetchGuard)](https://daloyjs.dev/docs/security/fetch-guard.md): Wrap user-controlled outbound fetch() with fetchGuard() to block SSRF to RFC1918, loopback, link-local, and every documented cloud-metadata IP.
- [Open redirect protection](https://daloyjs.dev/docs/security/safe-redirect.md): Refuse open-redirect inputs with safeRedirect(): validate every ?next= / ?returnTo= candidate against an explicit allowlist of internal paths and external origins before emitting a Location header. Strict, dependency-free defaults.
- [IP allow/deny lists](https://daloyjs.dev/docs/security/ip-restriction.md): Enforce network-layer access control with ipRestriction(): IPv4/IPv6/CIDR allow- and deny-lists that fail closed by default, with explicit opt-in for trusted proxy headers. The static counterpart to ipReputation() and geoBlock().
- [WAF-lite signature/anomaly inspection](https://daloyjs.dev/docs/waf.md): Add a first-party, opt-in defense-in-depth WAF-lite layer with waf(): wire DaloyJS' SQLi, XSS, NoSQL-operator, and command-injection signatures into a single scored inbound-inspection middleware with per-rule enable/disable and a block-or-log mode. Not a replacement for an edge WAF. Zero runtime dependencies.
- [Inbound request-decompression bomb guard](https://daloyjs.dev/docs/request-decompression.md): Accept compressed request bodies safely with requestDecompression(): inflate gzip/deflate uploads behind a decompression-bomb guard with an absolute-size cap and an expansion-ratio cap enforced during inflation. Core is safe by omission. Zero runtime dependencies.
- [Bot / User-Agent management](https://daloyjs.dev/docs/bot-guard.md): Block empty or known-abusive User-Agent strings and verify declared crawlers (Googlebot/Bingbot) with reverse-DNS + forward-confirm using botGuard(): the in-app equivalent of Nginx/WAF bot rules. Opt-in, allowlist-friendly, zero runtime dependencies.
- [Adaptive auto-ban (fail2ban-style)](https://daloyjs.dev/docs/auto-ban.md): Temporarily ban abusive clients with autoBan(): escalating, decaying bans triggered by repeated 401/403/429 (or custom) responses, a pluggable store mirroring rateLimit(), and secure-by-default identity attribution. Zero runtime dependencies.
- [IP reputation / dynamic denylist feed](https://daloyjs.dev/docs/ip-reputation.md): Wire pluggable abuse feeds (Tor exit lists, Spamhaus DROP, cloud-abuse ranges) into your app with ipReputation(): periodic refresh, fail-open semantics, the same SSRF-grade CIDR matcher as ipRestriction(), and a urlFeed() whose outbound fetch is SSRF-hardened by default. Zero runtime dependencies.
- [GeoIP / geo-blocking](https://daloyjs.dev/docs/geo-block.md): Allow or deny traffic by country with geoBlock(): bring your own MaxMind reader or read an edge country header (CF-IPCountry, CloudFront-Viewer-Country, x-vercel-ip-country). No bundled GeoIP database, zero runtime dependencies, fail-closed allow-lists.
- [Per-route / per-client concurrency limits](https://daloyjs.dev/docs/concurrency-limit.md): Bound in-flight requests per route and per client with concurrencyLimit(), HAProxy maxconn/queue parity at the app layer: a semaphore, a bounded FIFO queue, and a fast 503. Complements maxConnections and loadShedding(). Zero runtime dependencies.
- [WebSocket and login safeguards](https://daloyjs.dev/docs/security/websocket-login-throttle.md): Protect WebSocket upgrades and login flows with rate limiting, login throttling, session rotation, upload guards, payload authentication, and safe runtime defaults.
- [Secure admin panels](https://daloyjs.dev/docs/security/admin-panels.md): Map Aikido's secure admin panel checklist to DaloyJS primitives: internal-only routes, ipRestriction, strict CSP, per-admin bearer/JWT auth, login-throttle rate limits, and structured audit logging.

## Hardening & operations

- [Boot guards](https://daloyjs.dev/docs/security/boot-guards.md): Daloy refuses to boot in production on weak session secrets, wildcard CORS, session() without csrf() on state-changing routes, shadow-security auth: routes, unauthenticated mcpRoutes() endpoints, and unconfigured proxy / vendor client-IP headers. Learn each guard, how to opt out, and how to migrate.
- [secureDefaults enforcement](https://daloyjs.dev/docs/security/secure-defaults-enforcement.md): Daloy enforces secureDefaults master-flag acknowledgement, strong JWT HMAC secrets, consistent frame defenses, and hardware-backed 2FA for contributors with publish access.
- [Runtime protections that travel with your app](https://daloyjs.dev/docs/security/runtime-protections.md): The runtime guardrails that ship inside @daloyjs/core and apply at request time, regardless of your CI host, repo platform, or whether you use the generated GitHub Actions bundle.
- [Lifecycle & health](https://daloyjs.dev/docs/security/lifecycle-health.md): Daloy ships connection-draining shutdown with Connection: close, crash-on-unhandled-rejection in production, and app.healthcheck() / app.readinesscheck() primitives that refuse-to-boot in production without an explicit auth or unauthenticated acknowledgement.
- [Runtime resilience and configuration](https://daloyjs.dev/docs/security/lifecycle-leftovers.md): Build resilient DaloyJS services with loadShedding(), app.cspReportRoute(), disconnectStatusCode, and boot-time configuration validation through defineConfig().
- [Composition & network](https://daloyjs.dev/docs/security/composition-network.md): Daloy ships rateLimit({ groupId }) shared buckets, combine primitives every/some/except, ipRestriction() with CIDR allow/deny, and the internal: true route flag with app.inject().
- [Internal services & service meshes](https://daloyjs.dev/docs/security/internal-service-preset.md): Documentation page
- [Compression middleware](https://daloyjs.dev/docs/security/compression.md): Daloy adds portable response compression with CompressionStream, BREACH-aware skip rules, safe cache headers, and ETag handling.
- [mTLS / client-certificate auth](https://daloyjs.dev/docs/mtls.md): Authenticate clients by TLS certificate with clientCertAuth(): verified-chain enforcement, subject/issuer/fingerprint/SAN allow-lists, validity-window checks, native Node TLS, and trusted-proxy header parsing (Envoy XFCC, nginx). Zero runtime dependencies.
- [HTTP message signatures (RFC 9421)](https://daloyjs.dev/docs/http-signatures.md): Sign and verify server-to-server HTTP requests with RFC 9421 HTTP Message Signatures: signMessage/verifyMessage, signRequest/verifyRequest, the httpSignatureAuth() middleware, hmac-sha256/ed25519/ecdsa/rsa-pss algorithms, mandatory algorithm allowlists, created/expires freshness windows, nonce replay defense, and RFC 9530 Content-Digest helpers. Zero runtime dependencies.
- [Redis rate-limit store](https://daloyjs.dev/docs/security/rate-limit-redis.md): Plug a Redis-backed RateLimitStore into rateLimit() for shared counters across replicas, with adapters for ioredis and node-redis.
- [Docs UI asset integrity (SRI)](https://daloyjs.dev/docs/docs-asset-integrity.md): DaloyJS pins version-exact Subresource Integrity (SRI) hashes on the default Scalar, Swagger UI, Redoc, and AsyncAPI assets, with validated overrides and self-hosting support.
- [Supply-chain security](https://daloyjs.dev/docs/security/supply-chain.md): How DaloyJS hardens its own publish pipeline against npm worm attacks, and the install-time defaults you should use in your own projects.
- [Recommended scanning tools (Socket, Snyk, Aikido)](https://daloyjs.dev/docs/security/scanning-tools.md): How to use Socket, Snyk, and Aikido with DaloyJS: why they matter, when to choose each tool, how to set them up, and which framework guardrails they complement.
- [Compliance posture (SOC 2, ISO 27001, HIPAA, GDPR, PCI-DSS, NIS2, EU CRA, DORA, UK CSR Bill)](https://daloyjs.dev/docs/security/compliance.md): How DaloyJS's built-in security primitives map to the technical controls expected by the major cloud-compliance frameworks, including DORA (EU Regulation 2022/2554) and the UK Cyber Security and Resilience Bill. The framework can't certify your deployment, but it can stop you from failing the easy audit findings.

## Outbound & webhooks

- [Outbound resilience for fetch](https://daloyjs.dev/docs/fetch-resilience.md): Layer a circuit breaker, retry-with-backoff, and per-call timeout on top of fetchGuard() for DaloyJS outbound calls. A dependency-free resilientFetch() that composes with SSRF protection for a mature outbound HTTP client.
- [DaloyJS webhooks](https://daloyjs.dev/docs/webhook-delivery.md): DaloyJS webhooks: deliver signed, retried, dead-lettered events with createWebhookSender(). Timestamped HMAC signatures, exponential backoff, Retry-After, and SSRF-safe transport by default: the outbound counterpart to verifyWebhookSignature().

## Data access

- [Using SQL ORMs with DaloyJS](https://daloyjs.dev/docs/orm.md): Connect DaloyJS to SQL databases with Prisma, Drizzle ORM, TypeORM, MikroORM, or Sequelize. Learn the recommended pattern for injecting clients, managing lifecycle, and keeping handlers type-safe.
- [Use Prisma with DaloyJS](https://daloyjs.dev/docs/orm/prisma.md): Connect DaloyJS to PostgreSQL, MySQL, or SQLite using Prisma. Schema-first models, migrations, and a typed client wired into your contract-first routes.
- [Use Drizzle ORM with DaloyJS](https://daloyjs.dev/docs/orm/drizzle.md): Pair DaloyJS with Drizzle ORM for a TypeScript-first, edge-friendly database layer. Schema in code, SQL-like queries, and full type inference into your handlers.
- [Use TypeORM with DaloyJS](https://daloyjs.dev/docs/orm/typeorm.md): Integrate TypeORM with DaloyJS using a DataSource plugin: decorator-based entities, repositories, migrations, and transactions wired into your contract-first routes.
- [Use MikroORM with DaloyJS](https://daloyjs.dev/docs/orm/mikro-orm.md): Integrate MikroORM v7 with DaloyJS using the modern defineEntity helper, defineConfig, request-scoped EntityManagers, the unit-of-work, and migrations wired into your contract-first routes.
- [Use Sequelize with DaloyJS](https://daloyjs.dev/docs/orm/sequelize.md): Connect DaloyJS to PostgreSQL, MySQL, MariaDB, MSSQL, or SQLite using Sequelize. Model-based queries, transactions, and a practical plugin setup for Node.js runtimes.
- [Use Supabase with DaloyJS](https://daloyjs.dev/docs/orm/supabase.md): Build a DaloyJS API on top of Supabase: hosted Postgres, row-level security, and auth via @supabase/supabase-js, works on Node.js and every edge runtime DaloyJS supports.
- [Using ODMs with DaloyJS](https://daloyjs.dev/docs/odm.md): Connect DaloyJS to document databases with ODMs such as Mongoose for MongoDB or Ottoman for Couchbase. Learn the recommended pattern for injecting connections and models into your handlers.
- [Use Mongoose with DaloyJS](https://daloyjs.dev/docs/odm/mongoose.md): Connect DaloyJS to MongoDB using Mongoose. Define schemas and models, inject them through a plugin, and use sessions for transactional workflows.
- [Use Ottoman with DaloyJS](https://daloyjs.dev/docs/odm/ottoman.md): Connect DaloyJS to Couchbase using Ottoman. Define document schemas and models, inject them through a plugin, and keep Couchbase-specific work isolated from handlers.

## Database hosting

- [Database hosting & serverless data providers](https://daloyjs.dev/docs/databases.md): Pick the right managed database host or embedded analytical engine for a DaloyJS API: Neon, PlanetScale, Supabase, Turso, DuckDB, Cloudflare D1, and AWS Aurora DSQL. Compares runtime support and which providers work on Cloudflare Workers.
- [Use Neon serverless Postgres with DaloyJS](https://daloyjs.dev/docs/databases/neon.md): Connect a DaloyJS API to Neon's serverless Postgres using the @neondatabase/serverless HTTP and WebSocket driver. Works on Node, Bun, Deno, Cloudflare Workers, and AWS Lambda.
- [Use PlanetScale with DaloyJS](https://daloyjs.dev/docs/databases/planetscale.md): Connect a DaloyJS API to PlanetScale MySQL using @planetscale/database, an HTTP driver that works on Cloudflare Workers, Node.js, Bun, and Deno.
- [Use Turso (libSQL) with DaloyJS](https://daloyjs.dev/docs/databases/turso.md): Connect a DaloyJS API to Turso, a distributed SQLite-compatible database, using @libsql/client. Works on Node.js, Bun, Deno, and Cloudflare Workers over HTTP.
- [Use DuckDB with DaloyJS](https://daloyjs.dev/docs/databases/duckdb.md): Use DuckDB from a DaloyJS API for embedded OLAP analytics in Node.js. Covers @duckdb/node-api, plugin setup, parameterized SQL, JSON-safe result conversion, runtime limits, and security hardening.
- [Use Cloudflare D1 with DaloyJS](https://daloyjs.dev/docs/databases/cloudflare-d1.md): Run a DaloyJS API on Cloudflare Workers backed by D1, Cloudflare's built-in SQLite-compatible database. Uses Worker bindings instead of a network driver.
- [Use AWS Aurora DSQL with DaloyJS](https://daloyjs.dev/docs/databases/aurora-dsql.md): Connect a DaloyJS API on AWS Lambda or Node.js to Aurora DSQL, AWS's distributed serverless PostgreSQL. Uses IAM-based auth tokens with the standard pg driver.

## Email

- [Email integrations for DaloyJS](https://daloyjs.dev/docs/email.md): Send transactional and marketing email from a DaloyJS API using AWS SES, SendGrid, Resend, Postmark, Mailgun, or Mailtrap. Compares runtime support, SDK style, and best-fit use cases.
- [Send email from DaloyJS with AWS SES (SESv2)](https://daloyjs.dev/docs/email/aws-ses.md): Send transactional email from a DaloyJS API using Amazon SES via the AWS SDK for JavaScript v3 (@aws-sdk/client-sesv2). Includes IAM setup, the SendEmailCommand interface, and runtime tips for Node and AWS Lambda.
- [Send email from DaloyJS with SendGrid](https://daloyjs.dev/docs/email/sendgrid.md): Send transactional email from a DaloyJS API using Twilio SendGrid's @sendgrid/mail SDK. Includes API key setup, the Mail Send v3 interface, sender verification, and DaloyJS plugin pattern.
- [Send email from DaloyJS with Resend](https://daloyjs.dev/docs/email/resend.md): Send transactional email from a DaloyJS API using Resend's official Node SDK. Includes API key setup, the resend.emails.send interface, React Email templates, and edge runtime support.
- [Send email from DaloyJS with Postmark](https://daloyjs.dev/docs/email/postmark.md): Send transactional email from a DaloyJS API using the official postmark Node SDK. Includes server token setup, ServerClient.sendEmail, message streams, and template rendering.
- [Send email from DaloyJS with Mailgun](https://daloyjs.dev/docs/email/mailgun.md): Send transactional email from a DaloyJS API using Sinch Mailgun's mailgun.js SDK. Includes API key setup, the mg.messages.create interface, EU region support, and edge-runtime configuration.
- [Send email from DaloyJS with Mailtrap](https://daloyjs.dev/docs/email/mailtrap.md): Send transactional email from a DaloyJS API using the official mailtrap Node SDK. Includes sandbox vs. production sending, MailtrapClient configuration, and switching with a single flag.

## Payments

- [Payment & commerce integrations for DaloyJS](https://daloyjs.dev/docs/payments.md): Accept payments and integrate commerce platforms from a DaloyJS API. Provider guides cover SDK choice, webhook verification, idempotency, and runtime support.
- [Accept payments with Stripe in DaloyJS](https://daloyjs.dev/docs/payments/stripe.md): Integrate Stripe Checkout from a DaloyJS API using the official stripe Node SDK and @stripe/stripe-js. Covers Stripe CLI setup, Checkout Sessions, webhook signature verification with the raw body, idempotency keys, refunds, and runtime caveats.
- [Integrate Shopify with DaloyJS](https://daloyjs.dev/docs/payments/shopify.md): Call the Shopify Admin GraphQL API and verify Shopify webhooks from a DaloyJS API using the community shopify-api-node SDK. Covers custom-app access tokens, API versioning, rate limits, pagination, and HMAC verification.
- [Accept PayPal & cards with Braintree in DaloyJS](https://daloyjs.dev/docs/payments/braintree.md): Accept PayPal, cards, Venmo, Apple Pay, and Google Pay from a DaloyJS API using the official Braintree Node SDK. Covers gateway setup, client tokens, transaction.sale, webhook signature parsing, and Node-only runtime caveats.
- [Accept cards with Authorize.Net in DaloyJS](https://daloyjs.dev/docs/payments/authorize-net.md): Charge cards and verify webhooks with the official Authorize.Net Node SDK (authorizenet) from a DaloyJS API. Covers ApiContracts/ApiControllers, promisifying the callback API, Accept.js nonces, environment switching, and HMAC-SHA512 signature verification.
- [Accept payments with Adyen in DaloyJS](https://daloyjs.dev/docs/payments/adyen.md): Integrate Adyen's official @adyen/api-library Node SDK with a DaloyJS API. Covers the Sessions flow for Drop-in / Components, direct /payments calls, the live URL prefix, hmacValidator for Standard webhook notifications, and idempotency keys.
- [Accept payments with Mollie in DaloyJS](https://daloyjs.dev/docs/payments/mollie.md): Integrate the official mollie-api-typescript SDK with a DaloyJS API. Covers the Client constructor, payments.create with idempotency keys, the new SignatureValidator for X-Mollie-Signature webhooks, async-iterable pagination, and edge-runtime support.
- [Accept payments with Tap Payments in DaloyJS](https://daloyjs.dev/docs/payments/tap.md): Integrate Tap Payments (KNET, Mada, Benefit, KFAST, STC Pay, BenefitPay, cards, and Apple Pay) from a DaloyJS API. Covers Bearer-token auth against api.tap.company/v2, the hosted Charge redirect flow, hashstring webhook verification, and idempotency.
- [Accept payments with PayTabs in DaloyJS](https://daloyjs.dev/docs/payments/paytabs.md): Integrate PayTabs (cards, Mada, KNET, BenefitPay, STC Pay, Apple Pay) from a DaloyJS API using the official paytabs_pt2 Node package. Covers setConfig, createPaymentPage wrapped as a Promise, the redirect + IPN flow, HMAC-SHA256 signature verification, and transaction queries.
- [Accept payments with Razorpay in DaloyJS](https://daloyjs.dev/docs/payments/razorpay.md): Integrate Razorpay (UPI, cards, netbanking, wallets) from a DaloyJS API using the official razorpay Node SDK. Covers the Orders flow, validatePaymentVerification for the client return, validateWebhookSignature with the raw body, refunds, and edge-runtime caveats.
- [Accept payments with Square in DaloyJS](https://daloyjs.dev/docs/payments/square.md): Integrate Square Payments from a DaloyJS API using the modern square TypeScript SDK (v40+). Covers SquareClient, BigInt money amounts, idempotency keys, the Web Payments SDK token handoff, WebhooksHelper.verifySignature with the raw body and exact notification URL, refunds, and edge-runtime compatibility.

## Authentication

- [DaloyJS auth docs](https://daloyjs.dev/docs/auth.md): DaloyJS auth docs: protect an API with authentication and authorization from AWS Cognito, Microsoft Entra ID (MSAL), Auth0, Okta, Clerk, LoginRadius, or Better Auth. Compares SDKs, runtime support, and the common bearer-auth plugin pattern.
- [Auth architecture: where DaloyJS fits in OAuth2 & OpenID Connect](https://daloyjs.dev/docs/auth/architecture.md): DaloyJS is a resource server and relying-party toolkit, not an identity provider. Learn when to use an OpenID Connect provider such as Auth0, Okta, Keycloak, or Zitadel, when an embedded session system such as Better Auth fits, and the two architectures we recommend.
- [Protect a DaloyJS API with AWS Cognito](https://daloyjs.dev/docs/auth/aws-cognito.md): Authenticate and authorize requests in a DaloyJS API with Amazon Cognito user pools, using the official aws-jwt-verify library to validate access and ID tokens with JWKS, scopes, and groups.
- [Protect a DaloyJS API with Microsoft Entra ID (MSAL)](https://daloyjs.dev/docs/auth/entra-id.md): Authenticate and authorize requests in a DaloyJS API with Microsoft Entra ID (formerly Azure AD). Verifies v2.0 access tokens with jose and the tenant's JWKS, and shows MSAL Node usage for downstream service calls.
- [Protect a DaloyJS API with Auth0](https://daloyjs.dev/docs/auth/auth0.md): Authenticate and authorize requests in a DaloyJS API with Auth0. Verifies access tokens with jose against your tenant's JWKS, enforces scopes and permissions, and works on Node and edge runtimes.
- [Protect a DaloyJS API with Okta](https://daloyjs.dev/docs/auth/okta.md): Authenticate and authorize requests in a DaloyJS API with Okta. Uses the official @okta/jwt-verifier to validate access and ID tokens from an Okta Custom Authorization Server, with scope and claim assertions.
- [Protect a DaloyJS API with Clerk](https://daloyjs.dev/docs/auth/clerk.md): Authenticate and authorize requests in a DaloyJS API with Clerk. Uses @clerk/backend authenticateRequest() to verify session, OAuth, and machine tokens, with organization and role-aware authorization.
- [Protect a DaloyJS API with LoginRadius](https://daloyjs.dev/docs/auth/loginradius.md): Authenticate and authorize requests in a DaloyJS API with LoginRadius. Uses loginradius-sdk to validate access tokens, load user profiles, and protect Node-style DaloyJS routes.
- [Use Better Auth with DaloyJS](https://daloyjs.dev/docs/auth/better-auth.md): Use Better Auth with a DaloyJS API. Mount Better Auth's standard Request to Response handler, configure trusted origins and cookies, and protect DaloyJS routes with auth.api.getSession().

## Deployment

- [Deployment](https://daloyjs.dev/docs/deployment.md): Deploy DaloyJS REST APIs to containers, Node PaaS platforms, and edge or serverless providers. Production-ready guides for Docker, Fly.io, Render, Railway, Heroku, Replit, Vercel, Cloudflare Workers, Bun, and Deno.
- [Deploy to Fly.io](https://daloyjs.dev/docs/deployment/fly-io.md): Deploy DaloyJS to Fly.io as a long-lived Node service. Current fly.toml schema with [http_service], string-valued auto_stop_machines, health checks, and concurrency limits.
- [Deploy to Render](https://daloyjs.dev/docs/deployment/render.md): Deploy DaloyJS to Render as a Node web service. Current render.yaml Blueprint with runtime: node, healthCheckPath, and scaling.
- [Deploy to Railway](https://daloyjs.dev/docs/deployment/railway.md): Deploy DaloyJS to Railway. Railway auto-detects from package.json; add an optional railway.json or railway.toml to pin the start command, health check, and pre-deploy migrations. Set TRUST_PROXY_HOPS=1 so the reverse-proxy guard accepts Railway's X-Forwarded-* headers instead of returning 500.
- [Deploy to Heroku](https://daloyjs.dev/docs/deployment/heroku.md): Deploy DaloyJS to Heroku as a Node web dyno. Procfile, heroku-24 or heroku-26 stack, and the heroku/nodejs buildpack.
- [Deploy to Replit](https://daloyjs.dev/docs/deployment/replit.md): Deploy a DaloyJS API to Replit as a Node web server. Covers pnpm, Node 24, Autoscale and Reserved VM Publishing, Secrets, PORT binding, 0.0.0.0, health checks, and Replit Agent guidance.

## Adapters & runtimes

- [Adapters & runtimes](https://daloyjs.dev/docs/adapters.md): Run the same DaloyJS REST API on Node.js, Bun, Deno, Cloudflare Workers, Netlify, Fastly Compute, and AWS Lambda. One codebase, multiple runtimes, zero rewrites.
- [Node.js adapter](https://daloyjs.dev/docs/adapters/node.md): Run a DaloyJS REST API on Node.js 24+ as a long-lived HTTP server. Graceful SIGTERM/SIGINT shutdown, sane request/header/keep-alive timeouts, connection-layer admission control for graceful degradation under overload, and trust-proxy controls.
- [Bun adapter](https://daloyjs.dev/docs/adapters/bun.md): Run a DaloyJS REST API on Bun 1.2+ with native Bun.serve, TLS, Unix sockets, and hot reload.
- [Deno adapter](https://daloyjs.dev/docs/adapters/deno.md): Run a DaloyJS REST API on Deno using the stable Deno.serve API with AbortSignal-based graceful shutdown and built-in TLS.
- [Cloudflare Workers adapter](https://daloyjs.dev/docs/adapters/cloudflare-workers.md): Deploy DaloyJS to Cloudflare Workers using the modules format, wrangler.jsonc, and the nodejs_compat flag. Bindings for KV, R2, D1, Durable Objects, Queues, and Hyperdrive.
- [Vercel adapter](https://daloyjs.dev/docs/adapters/vercel.md): Deploy a DaloyJS REST API to Vercel Functions on the Node.js runtime with Fluid compute. One app object, one standalone function.
- [Netlify adapter](https://daloyjs.dev/docs/adapters/netlify.md): Deploy DaloyJS to Netlify Edge Functions (Deno) or Netlify Functions v2 (Node fetch-style). Both share the same Request -> Response model.
- [Fastly Compute adapter](https://daloyjs.dev/docs/adapters/fastly.md): Deploy DaloyJS to Fastly Compute (JavaScript) using @fastly/js-compute and the fetch-event listener model.
- [AWS Lambda adapter](https://daloyjs.dev/docs/adapters/aws-lambda.md): Run DaloyJS on AWS Lambda with API Gateway HTTP API (v2.0), API Gateway REST API (v1.0), and Lambda Function URLs. Includes streamifyResponse and Lambda Web Adapter notes.

## Reference

- [DaloyJS API docs](https://daloyjs.dev/docs/api-reference.md): DaloyJS API docs: complete public TypeScript surface for App, routing, middleware, MCP, plugins, errors, security helpers, JWT/JWK, sessions, streaming, websockets, and runtime adapters.
- [API reference: App & routing](https://daloyjs.dev/docs/api-reference/app.md): DaloyJS App class reference: constructor options, route registration, hooks, context types, hook dispatch order, HttpError classes, and Standard Schema validation helpers.
- [API reference: Middleware & helpers](https://daloyjs.dev/docs/api-reference/middleware.md): DaloyJS middleware reference: built-in hooks (rateLimit, secureHeaders, cors, csrf), composition primitives (every, some, except), typed dependencies, config validation, logging, and connection info.
- [API reference: Security & auth](https://daloyjs.dev/docs/api-reference/security.md): DaloyJS security helper reference: security primitives, fetchGuard SSRF protection, safeRedirect, cookies, JWT signer/verifier, JWK/JWKS middleware, sessions, and password hashing.
- [API reference: Feature modules](https://daloyjs.dev/docs/api-reference/modules.md): DaloyJS subpath module reference: OpenAPI generation, typed clients, contract tests, MCP, docs UIs, streaming, multipart, WebSocket, tracing, Redis rate limiting, and the CLI surface.
- [API reference: Runtime adapters](https://daloyjs.dev/docs/api-reference/adapters.md): DaloyJS runtime adapter reference: serve() for Node.js, Bun, and Deno, plus fetch-handler adapters for Cloudflare Workers, Vercel, Fastly Compute, and AWS Lambda.