Scaffold a project

create-daloy is the official project generator. It scaffolds a working DaloyJS app in seconds — no copy-pasting from the docs.

Package link: create-daloy on npm. The generated apps install the framework from @daloyjs/core on npm.

Quick start

# pick the package manager you actually use
pnpm create daloy@latest my-api
npm  create daloy@latest my-api
yarn create daloy           my-api
bun  create daloy           my-api

The CLI is interactive when arguments are missing. It will ask for a project name, a template, a package manager, whether to install dependencies, whether to initialize a git repository, and whether to add the GitHub security bundle.

Non-interactive usage

pnpm create daloy@latest my-api --template node-basic --package-manager pnpm --with-ci --code-owner @acme/security --install --git

Flags

• --template <name> — node-basic (default), vercel-edge, cloudflare-worker, bun-basic, or deno-basic.
• --package-manager <pm> — pnpm (default), npm, yarn, or bun.
• --list-templates — print available templates with descriptions.
• --install / --no-install — install dependencies after scaffolding.
• --git / --no-git — initialize a git repository.
• --minimal — strip the bookstore demo and the /docs + /openapi.json Swagger UI routes so the scaffold only ships the framework bootstrap and a health route. Useful when you want to start from the smallest possible app.
• --with-ci / --no-ci — add hardened GitHub Actions, Dependabot, CODEOWNERS, SECURITY.md, and lockfile-source verification.
• --code-owner <owner> — replace the CODEOWNERS placeholder when --with-ci is used, for example @acme/security.
• --force — overwrite an existing non-empty directory.
• --yes — accept all defaults; never prompt.

Templates

Run create-daloy --list-templates to inspect the available starters without creating a project.

node-basic

A production-ready Node.js HTTP server using @daloyjs/core with secureHeaders, requestId, rateLimit, a hardened .npmrc, a sample GET /healthz route, a contract-first GET /books/:id route with Zod validation, and Hey API codegen wired to pnpm gen.

Like FastAPI, every scaffolded project also exposes API documentation out of the box: /docs serves Swagger UI and /openapi.json serves the live OpenAPI 3.1 spec generated from your route definitions. The dev server logs both URLs at startup.

cloudflare-worker

A minimal Cloudflare Worker using @daloyjs/core/cloudflare with wrangler.toml ready to deploy, secureHeaders + requestIdenabled by default, smaller edge-friendly body and timeout limits, and a Zod-validated route exposed as fetch.

vercel-edge

A Vercel Edge API using @daloyjs/core/vercel with a catch-all api/[...path].ts route, vercel dev / vercel deploy scripts, secureHeaders + requestId enabled by default, smaller edge-friendly body and timeout limits, and the same health and bookstore examples as the Node starter.

The Vercel template also ships /docs (Swagger UI) and /openapi.jsonwired to the same app, so the deployed Edge URL serves API documentation automatically.

bun-basic

A Bun runtime starter using@daloyjs/core/bun. Ships bun --hot for instant reloads,bun test for the test runner, the same starter security middleware as the Node template (secureHeaders / requestId / rateLimit), the bookstore demo route, and Hey API codegen wired through bun run gen:openapi +bun run gen:client.

deno-basic

A Deno runtime starter using@daloyjs/core/deno. Ships a deno.json with deno task dev, deno task test, and deno task gen:openapi tasks, loads @daloyjs/core and Zod via npm: import-map specifiers, and runs with the minimum permissions Deno requires (--allow-net --allow-env --allow-read). The CLI skips Node-style installs for this template — there is no package.json to patch.

Minimal scaffolds

Pass --minimal to drop the bookstore demo route and the built-in /docs + /openapi.json Swagger UI routes from any template that supports them. The scaffolded app is left with the framework bootstrap and a single /healthz route, which is the smallest realistic starting point for teams that already know exactly what they want to build:

pnpm create daloy@latest my-api --template node-basic --minimal --yes

Sentinel comments (// daloy-minimal:strip-start <tag> /// daloy-minimal:strip-end <tag>) survive a default scaffold so you can re-run the generator with --minimal later, or delete the marked blocks by hand.

Hardened CI/security bundle

Pass --with-ci when the new project should start with GitHub-side supply-chain guardrails as well as runtime defaults. Node-style templates get CI, a disabled-by-default npm trusted publishing skeleton, CodeQL, OpenSSF Scorecard, zizmor, Dependabot, CODEOWNERS, SECURITY.md, and a lockfile-source verification script. The Deno template gets the same governance and scanning files with a Deno-native CI workflow, but no npm publish workflow because it has no package.json.

pnpm create daloy@latest my-api --template node-basic --package-manager pnpm --with-ci --code-owner @acme/security

The generated workflows use top-level permissions: {}, pinned third-party actions, harden-runner, persist-credentials: false, disabled install scripts, and no package-manager cache. Replace the CODEOWNERS placeholder if you did not pass --code-owner, then enable branch protection, required status checks, secret scanning, and push protection in GitHub settings.

Which template should I choose?

• Choose node-basic for a traditional REST API on Node, Docker, Fly.io, Railway, Render, or any VM/container host.
• Choose vercel-edge when Vercel is your deployment target and you want an Edge API route from the first commit.
• Choose cloudflare-worker only when your deployment target is Cloudflare Workers. It exists because DaloyJS is runtime-portable, not because Cloudflare is required.
• Choose bun-basic when your team already runs on Bun and wants bun --hot + bun test in the box.
• Choose deno-basic when you want a runtime-native Deno project with deno taskscripts, an import map, and Deno's permission flags.

Why a generator?

DaloyJS is a backend framework, so the first ten minutes matter. The scaffolder gives every project the same guardrail-first posture, the same TypeScript baseline, and the same scripts so an AI coding agent or a new teammate can navigate it without a tour. Node, Bun, and Deno starters include secureHeaders, requestId, and rateLimit; the edge starters include secureHeaders and requestId plus tighter body and timeout limits.

The CLI itself ships with zero runtime dependencies— only Node built-ins — so the supply-chain story stays clean. Templates are copied verbatim from the package's templates/ directory and never run scripts during scaffolding. When you choose pnpm, the generated app keeps the hardened .npmrc and pnpm-workspace.yaml; when you choose another package manager, the CLI removes pnpm-specific config so installs stay warning-free. When you choose --with-ci, it also adds the GitHub-side security files that a company repo normally has to assemble by hand.

Next

After scaffolding, jump straight to Getting started for the route walkthrough, or Security for the guardrails and middleware you just inherited.