# DaloyJS

> DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI 3.1 generation, typed client codegen (Hey API), and security-first defaults. It runs on Node.js, Bun, Deno, and Cloudflare Workers.

Current release: `@daloyjs/core@1.0.0-rc.6` on npm, published to JSR as `@daloyjs/daloy` from the same source. It has zero runtime dependencies. Start a new project with `pnpm create daloy@latest`.

Every docs page is also available as markdown: append `.md` to its URL (the links below point at the markdown versions; drop the `.md` suffix for the canonical HTML). Blog posts are HTML only.

Agents can also query these docs over the Model Context Protocol instead of fetching pages: `https://daloyjs.dev/mcp` is a read-only MCP server with `search_docs`, `get_doc`, and `list_docs` tools.

## Project

- [DaloyJS homepage](https://daloyjs.dev): Project overview, feature tour, benchmarks, and runtime support matrix.
- [Docs MCP server](https://daloyjs.dev/mcp): Read-only Model Context Protocol endpoint (Streamable HTTP, JSON-RPC 2.0) over these same docs, exposing the search_docs, get_doc, and list_docs tools. Prefer this over crawling pages.
- [GitHub repository](https://github.com/daloyjs/daloy): Source, issues, CHANGELOG, SECURITY.md, and the hardened release workflows for @daloyjs/core and create-daloy.
- [npm package @daloyjs/core](https://www.npmjs.com/package/@daloyjs/core): The framework on npm, published with provenance and zero runtime dependencies.
- [JSR package @daloyjs/daloy](https://jsr.io/@daloyjs/daloy): The same source published to JSR as TypeScript, for Deno and JSR-native consumers.
- [create-daloy scaffolder](https://www.npmjs.com/package/create-daloy): Scaffold a production-ready project with `pnpm create daloy@latest`; templates for Node.js, Bun, Deno, and Cloudflare Workers.
- [Why the name "Daloy"?](https://daloyjs.dev/about-the-name): Origin of the project name and how to pronounce it.

## Start here

- [Introduction to DaloyJS](https://daloyjs.dev/docs.md): DaloyJS is a runtime-portable TypeScript web framework built around contract-first routing, Standard Schema validation, OpenAPI 3.1 generation, typed clients, and core security guardrails. Learn what makes it different.
- [Installation](https://daloyjs.dev/docs/installation.md): Install DaloyJS with pnpm, npm, yarn, or bun. Set up the framework on Node.js, Bun, Deno, Cloudflare Workers, or Vercel in minutes.
- [Getting started](https://daloyjs.dev/docs/getting-started.md): Build your first DaloyJS application: declare a contract-first route, validate with Zod, generate OpenAPI, and serve responses on any supported runtime.
- [Scaffold a DaloyJS project](https://daloyjs.dev/docs/scaffolder.md): Use create-daloy to scaffold a production-ready DaloyJS project with templates for Node.js, Bun, Deno, and Cloudflare Workers, plus optional hardened GitHub CI.
- [Where to use DaloyJS](https://daloyjs.dev/docs/where-to-use.md): A beginner-friendly map of where DaloyJS fits, API server, microservice, BFF, in-app gateway, webhook receiver, WebSocket server, MCP server, and where it doesn't (SSR, load balancer, GraphQL/SOAP/gRPC servers). Plain-English definitions of every term.

## Tutorials

- [Tutorial: build a Bookstore API](https://daloyjs.dev/docs/tutorials/bookstore.md): Step-by-step DaloyJS tutorial: build a typed Bookstore REST API with contract-first routes, Zod validation, OpenAPI docs, and a generated TypeScript client.
- [Tutorial: build a multi-user API without BOLA](https://daloyjs.dev/docs/tutorials/multi-user-api.md): Build a DaloyJS projects API that prevents cross-user access. Connect a provider-neutral principal to owner-scoped repository operations and prove isolation with adversarial tests.
- [Demo: large fake REST API](https://daloyjs.dev/docs/tutorials/fake-rest-api.md): Explore a large DaloyJS-style demo API with hundreds of endpoints. Use it to test OpenAPI tooling, typed client generation, docs UX, and navigation at real-world scale.

## Migrating

- [Migrate from Express.js](https://daloyjs.dev/docs/migrating/express.md): A complete, no-prior-knowledge guide to migrating an existing Express.js app to DaloyJS: routing, middleware, req/res, errors, routers, static files, sessions, file uploads, and a side-by-side full example, plus an incremental strangler-fig strategy.

## Core concepts

- [Routing](https://daloyjs.dev/docs/routing.md): Define type-safe HTTP routes in DaloyJS with a contract-first API: path params, query, body, and response schemas inferred end-to-end from a single declaration.
- [Validation in DaloyJS](https://daloyjs.dev/docs/validation.md): DaloyJS validates requests and responses through Standard Schema. Use Zod, Valibot, ArkType, or TypeBox, pick the validator that fits your project.
- [Validation with Zod](https://daloyjs.dev/docs/validation/zod.md): Validate request params, query, headers, and bodies in DaloyJS using Zod schemas. Errors are returned as RFC 9457 problem+json with full type inference.
- [Validation with Valibot](https://daloyjs.dev/docs/validation/valibot.md): Use Valibot as the request and response validator in DaloyJS. Modular, tree-shakeable schemas with full Standard Schema interop, type inference, and RFC 9457 problem+json errors.
- [Errors & problem+json](https://daloyjs.dev/docs/errors.md): Throw typed errors in DaloyJS and have them serialized as RFC 9457 problem+json responses by default. Customize, extend, and document errors in OpenAPI.
- [Plugins & encapsulation](https://daloyjs.dev/docs/plugins.md): Compose DaloyJS apps with encapsulated plugins, scoped middleware, decorators, lifecycle hooks, and route prefixes, for large-scale, maintainable TypeScript services.
- [Middleware combinators](https://daloyjs.dev/docs/combinators.md): Compose curated middleware stacks with every(), express any-of-these-proofs auth with some(), and exempt specific paths from a gate with except(). Dependency-free Hooks composition primitives for DaloyJS.
- [Config validation](https://daloyjs.dev/docs/config.md): Validate application configuration at boot with defineConfig(): load from env, a file, or an async secrets resolver, validate against any Standard Schema validator, and fail fast with every issue reported at once.
- [Structured logging](https://daloyjs.dev/docs/logging.md): Use the built-in, dependency-free createLogger() for structured JSON logs with secure-by-default redaction of credentials, JWTs, and provider tokens. Access a request-scoped logger via ctx.state.log and swap in pino/winston when you need to.

## OpenAPI & typed clients

- [OpenAPI generation](https://daloyjs.dev/docs/openapi.md): Auto-generate OpenAPI 3.1 specs from your DaloyJS routes. Powered by Hey API, the spec stays in sync with your contracts and powers the typed client.
- [API versioning](https://daloyjs.dev/docs/api-versioning.md): Version DaloyJS APIs with explicit URL prefixes such as /api/v1/books, organize major versions as plugins, publish accurate OpenAPI contracts, and retire old endpoints safely.
- [Typed API clients](https://daloyjs.dev/docs/typed-client.md): Generate fully typed TypeScript clients from your DaloyJS OpenAPI spec with Hey API. Get end-to-end type safety between server and client with no drift.
- [API lifecycle & breaking changes](https://daloyjs.dev/docs/api-lifecycle.md): Deprecate and sunset DaloyJS routes with Deprecation and RFC 8594 Sunset headers, then catch breaking API changes in CI with diffOpenAPI, the daloy diff CLI, and the verify:breaking-changes gate.
- [Testing & contract tests](https://daloyjs.dev/docs/testing.md): Write fast, in-process tests for DaloyJS handlers and generate contract tests from your OpenAPI spec to guarantee server and client stay in sync.
- [AI-friendly route metadata](https://daloyjs.dev/docs/ai-metadata.md): Author machine-readable usage examples on DaloyJS routes. Examples are validated against your Standard Schemas at build time and surfaced into OpenAPI for Hey API and LLM codegen tooling.
- [llms.txt for agent-readable docs](https://daloyjs.dev/docs/llms-txt.md): Ship a curated /llms.txt map so coding agents and LLM tools find DaloyJS docs without scraping HTML. Spec shape, Optional section, .md siblings, and how daloyjs.dev generates its index from the same nav as the human docs UI.
- [Model Context Protocol (MCP)](https://daloyjs.dev/docs/mcp.md): Build a dedicated Model Context Protocol server with DaloyJS. Expose tools, resources, and prompts over MCP Streamable HTTP while keeping @daloyjs/core dependency-free and secure by default.
- [Vercel AI SDK](https://daloyjs.dev/docs/ai-sdk.md): Host the Vercel AI SDK (v7) on DaloyJS. Stream chat completions, validate structured model output against your route's response schema, run tool calls behind fetchGuard, and wrap the whole thing in DaloyJS's secure-by-default guardrails. The AI SDK is web-standard, so no adapter is required.

## Advanced features

- [File uploads (multipart/form-data)](https://daloyjs.dev/docs/multipart.md): Model multipart/form-data uploads in DaloyJS with typed file fields, per-field MIME, magic-byte, and size caps, plus OpenAPI-aware emission.
- [Idempotency keys](https://daloyjs.dev/docs/idempotency.md): Make unsafe POST/PUT/PATCH/DELETE requests safely retryable with the built-in, dependency-free idempotency() middleware: request fingerprinting, response replay, in-flight 409 conflicts, and a pluggable IdempotencyStore mirroring SessionStore.
- [Response caching](https://daloyjs.dev/docs/response-cache.md): Cache rendered response bodies server-side with the built-in, dependency-free responseCache() middleware: cache-key + TTL, Cache-Control orchestration (s-maxage/max-age), stale-while-revalidate, request directives, and a pluggable ResponseCacheStore mirroring SessionStore.
- [Pagination & cursor helpers](https://daloyjs.dev/docs/pagination.md): Paginate list endpoints with the built-in, dependency-free cursor helpers: opaque base64url cursor encode/decode, RFC 8288 Link header emission, and a paginationQuery() Standard Schema that validates the cursor + limit query parameters and wires them into the generated OpenAPI document and typed client.
- [Multitenancy](https://daloyjs.dev/docs/multitenancy.md): Resolve, validate, and isolate tenants with the secure-by-default tenancy() middleware: pluggable resolution (subdomain, header, path, JWT claim, or custom), refuse-unresolved by default, format-validated tenant ids, no-enumeration rejection, automatic per-tenant response-cache partitioning, and a tenantScope() helper that partitions rateLimit, concurrencyLimit, and idempotency per tenant.
- [Streaming responses (SSE & NDJSON)](https://daloyjs.dev/docs/streaming.md): Build backpressure-safe Server-Sent Events and newline-delimited JSON streams in DaloyJS. Honor AbortSignal, release iterators on disconnect, and reuse the same handler across Node, Bun, Deno, and Cloudflare Workers.
- [WebSocket primitives (Node & Bun)](https://daloyjs.dev/docs/websocket.md): Register typed WebSocket routes in DaloyJS with the same Bun-style handler shape running on both Node and Bun adapters, safe defaults, upgrade rate limiting, and graceful close semantics.
- [AsyncAPI for WebSockets](https://daloyjs.dev/docs/asyncapi.md): Generate AsyncAPI 3.0 contract documents for your DaloyJS app.ws() surfaces with the built-in, dependency-free generateAsyncAPI() generator, plus an auto-mounted interactive AsyncAPI UI (asyncapi: true) that mirrors the Scalar/Swagger OpenAPI docs, a handler meta block, and the daloy inspect --asyncapi CLI flag.
- [Scheduled tasks (in-process cron)](https://daloyjs.dev/docs/scheduler.md): Run periodic work inside your DaloyJS process with app.cron() and the Scheduler primitive. Cron expressions or fixed intervals, single-flight overlap protection, per-run timeouts, and graceful-shutdown integration with zero runtime dependencies.
- [Modular monolith](https://daloyjs.dev/docs/architecture/modular-monolith.md): Reference folder and file structure for building a scalable modular monolith with DaloyJS, bounded contexts as plugins, a thin shared kernel, contract-driven module boundaries, and a clean path to extract services later.
- [CLI, daloy inspect & daloy dev](https://daloyjs.dev/docs/cli.md): Use the daloy CLI to introspect routes, contract-test an app, dump OpenAPI 3.1, or start a watch-mode dev server on any DaloyJS project.

## Observability

- [Tracing with OpenTelemetry](https://daloyjs.dev/docs/tracing.md): Instrument DaloyJS apps with OpenTelemetry-compatible spans. The otelTracing helper produces a Hooks object that starts a SERVER span per request, attaches HTTP semantic-convention attributes, exposes the span on ctx.state, and ends it when the response is sent.
- [Metrics & the /metrics endpoint](https://daloyjs.dev/docs/metrics.md): Expose Prometheus / OpenMetrics from your DaloyJS app: a dependency-free metrics registry (counters, gauges, histograms), RED instrumentation for every route, and an opt-in, auth-guarded /metrics scrape route that inherits the same hardened posture as app.healthcheck().

## Security essentials

- [Security](https://daloyjs.dev/docs/security.md): DaloyJS ships core-enforced security guardrails plus first-party middleware for secure headers, rate limits, CORS, CSRF, sessions, and supply-chain hardening.
- [Secure-by-default](https://daloyjs.dev/docs/security/secure-defaults.md): Daloy auto-applies secureHeaders() and rejects cross-origin state-changing requests unless cors() is registered. Learn the new defaults, escape hatches, and per-route opt-ins.
- [OWASP API Security Top 10 mapping](https://daloyjs.dev/docs/security/owasp-api-top-10.md): How DaloyJS addresses each item in the OWASP API Security Top 10 (2023), what the core enforces, which middleware to enable, and what stays your responsibility.
- [Resource authorization: prevent BOLA and IDOR](https://daloyjs.dev/docs/security/resource-authorization.md): Protect user-owned and tenant-owned records in DaloyJS APIs. Learn function-level, object-level, and property-level authorization with provider-neutral and database-neutral patterns.
- [JWT and authentication safeguards](https://daloyjs.dev/docs/security/auth-slice.md): Secure DaloyJS authentication with asymmetric JWKS middleware, per-scheme revalidation hooks, typed basic-auth callbacks, and non-cacheable authentication challenges.
- [Sessions](https://daloyjs.dev/docs/security/session.md): Use the built-in session() middleware for an edge-friendly signed-cookie session with a pluggable store, key rotation, automatic privilege-change rotation, and conservative __Host- defaults.
- [CSRF protection](https://daloyjs.dev/docs/security/csrf.md): Use the built-in csrf() middleware to protect mutating routes with double-submit-cookie or Fetch Metadata CSRF strategies.
- [Cookie helpers](https://daloyjs.dev/docs/security/cookies.md): Read and write cookies the same way every DaloyJS subsystem does: serializeCookie(), readRequestCookie(), serializeClearCookie(), and assertCookieAttributes() enforce RFC 6265bis prefixes, secure-by-default attributes, and cookie-tossing defenses.
- [Password hashing (passwordHash)](https://daloyjs.dev/docs/security/hashing.md): Hash and verify passwords with zero configuration: passwordHash() and passwordVerify() use OWASP-aligned scrypt from Node core, a PHC-style output string, and constant-time verification, with no runtime dependencies.

## Attack protection

- [SQL injection](https://daloyjs.dev/docs/security/sql-injection.md): How Daloy's HTTP layer helps you stay safe from SQL injection, the ORM/driver patterns that close the rest of the gap, and the dynamic-SQL escape hatch (allowlists) for the cases that parameterized queries can't cover.
- [Command injection](https://daloyjs.dev/docs/security/command-injection.md): How DaloyJS keeps the framework itself free of shell-out primitives, and the safe patterns (and grep rules) you should use when your own handlers need to invoke an external program.
- [SSRF guard (fetchGuard)](https://daloyjs.dev/docs/security/fetch-guard.md): Wrap user-controlled outbound fetch() with fetchGuard() to block SSRF to RFC1918, loopback, link-local, and every documented cloud-metadata IP.
- [Open redirect protection](https://daloyjs.dev/docs/security/safe-redirect.md): Refuse open-redirect inputs with safeRedirect(): validate every ?next= / ?returnTo= candidate against an explicit allowlist of internal paths and external origins before emitting a Location header. Strict, dependency-free defaults.
- [IP allow/deny lists](https://daloyjs.dev/docs/security/ip-restriction.md): Enforce network-layer access control with ipRestriction(): IPv4/IPv6/CIDR allow- and deny-lists that fail closed by default, with explicit opt-in for trusted proxy headers. The static counterpart to ipReputation() and geoBlock().
- [WAF-lite signature/anomaly inspection](https://daloyjs.dev/docs/waf.md): Add a first-party, opt-in defense-in-depth WAF-lite layer with waf(): wire DaloyJS' SQLi, XSS, NoSQL-operator, and command-injection signatures into a single scored inbound-inspection middleware with per-rule enable/disable and a block-or-log mode. Not a replacement for an edge WAF. Zero runtime dependencies.
- [Inbound request-decompression bomb guard](https://daloyjs.dev/docs/request-decompression.md): Accept compressed request bodies safely with requestDecompression(): inflate gzip/deflate uploads behind a decompression-bomb guard with an absolute-size cap and an expansion-ratio cap enforced during inflation. Core is safe by omission. Zero runtime dependencies.
- [Bot / User-Agent management](https://daloyjs.dev/docs/bot-guard.md): Block empty or known-abusive User-Agent strings and verify declared crawlers (Googlebot/Bingbot) with reverse-DNS + forward-confirm using botGuard(): the in-app equivalent of Nginx/WAF bot rules. Opt-in, allowlist-friendly, zero runtime dependencies.
- [Adaptive auto-ban (fail2ban-style)](https://daloyjs.dev/docs/auto-ban.md): Temporarily ban abusive clients with autoBan(): escalating, decaying bans triggered by repeated 401/403/429 (or custom) responses, a pluggable store mirroring rateLimit(), and secure-by-default identity attribution. Zero runtime dependencies.
- [IP reputation / dynamic denylist feed](https://daloyjs.dev/docs/ip-reputation.md): Wire pluggable abuse feeds (Tor exit lists, Spamhaus DROP, cloud-abuse ranges) into your app with ipReputation(): periodic refresh, fail-open semantics, the same SSRF-grade CIDR matcher as ipRestriction(), and a urlFeed() whose outbound fetch is SSRF-hardened by default. Zero runtime dependencies.
- [GeoIP / geo-blocking](https://daloyjs.dev/docs/geo-block.md): Allow or deny traffic by country with geoBlock(): bring your own MaxMind reader or read an edge country header (CF-IPCountry, CloudFront-Viewer-Country, x-vercel-ip-country). No bundled GeoIP database, zero runtime dependencies, fail-closed allow-lists.
- [Per-route / per-client concurrency limits](https://daloyjs.dev/docs/concurrency-limit.md): Bound in-flight requests per route and per client with concurrencyLimit(), HAProxy maxconn/queue parity at the app layer: a semaphore, a bounded FIFO queue, and a fast 503. Complements maxConnections and loadShedding(). Zero runtime dependencies.
- [WebSocket and login safeguards](https://daloyjs.dev/docs/security/websocket-login-throttle.md): Protect WebSocket upgrades and login flows with rate limiting, login throttling, session rotation, upload guards, payload authentication, and safe runtime defaults.
- [Secure admin panels](https://daloyjs.dev/docs/security/admin-panels.md): Map Aikido's secure admin panel checklist to DaloyJS primitives: internal-only routes, ipRestriction, strict CSP, per-admin bearer/JWT auth, login-throttle rate limits, and structured audit logging.

## Hardening & operations

- [Boot guards](https://daloyjs.dev/docs/security/boot-guards.md): Daloy refuses to boot in production on weak session secrets, wildcard CORS, session() without csrf() on state-changing routes, shadow-security auth: routes, unauthenticated mcpRoutes() endpoints, and unconfigured proxy / vendor client-IP headers. Learn each guard, how to opt out, and how to migrate.
- [secureDefaults enforcement](https://daloyjs.dev/docs/security/secure-defaults-enforcement.md): Daloy enforces secureDefaults master-flag acknowledgement, strong JWT HMAC secrets, consistent frame defenses, and hardware-backed 2FA for contributors with publish access.
- [Runtime protections that travel with your app](https://daloyjs.dev/docs/security/runtime-protections.md): The runtime guardrails that ship inside @daloyjs/core and apply at request time, regardless of your CI host, repo platform, or whether you use the generated GitHub Actions bundle.
- [Lifecycle & health](https://daloyjs.dev/docs/security/lifecycle-health.md): Daloy ships connection-draining shutdown with Connection: close, crash-on-unhandled-rejection in production, and app.healthcheck() / app.readinesscheck() primitives that refuse-to-boot in production without an explicit auth or unauthenticated acknowledgement.
- [Runtime resilience and configuration](https://daloyjs.dev/docs/security/lifecycle-leftovers.md): Build resilient DaloyJS services with loadShedding(), app.cspReportRoute(), disconnectStatusCode, and boot-time configuration validation through defineConfig().
- [Composition & network](https://daloyjs.dev/docs/security/composition-network.md): Daloy ships rateLimit({ groupId }) shared buckets, combine primitives every/some/except, ipRestriction() with CIDR allow/deny, and the internal: true route flag with app.inject().
- [Internal services & service meshes](https://daloyjs.dev/docs/security/internal-service-preset.md): Documentation page
- [Compression middleware](https://daloyjs.dev/docs/security/compression.md): Daloy adds portable response compression with CompressionStream, BREACH-aware skip rules, safe cache headers, and ETag handling.
- [mTLS / client-certificate auth](https://daloyjs.dev/docs/mtls.md): Authenticate clients by TLS certificate with clientCertAuth(): verified-chain enforcement, subject/issuer/fingerprint/SAN allow-lists, validity-window checks, native Node TLS, and trusted-proxy header parsing (Envoy XFCC, nginx). Zero runtime dependencies.
- [HTTP message signatures (RFC 9421)](https://daloyjs.dev/docs/http-signatures.md): Sign and verify server-to-server HTTP requests with RFC 9421 HTTP Message Signatures: signMessage/verifyMessage, signRequest/verifyRequest, the httpSignatureAuth() middleware, hmac-sha256/ed25519/ecdsa/rsa-pss algorithms, mandatory algorithm allowlists, created/expires freshness windows, nonce replay defense, and RFC 9530 Content-Digest helpers. Zero runtime dependencies.
- [Redis rate-limit store](https://daloyjs.dev/docs/security/rate-limit-redis.md): Plug a Redis-backed RateLimitStore into rateLimit() for shared counters across replicas, with adapters for ioredis and node-redis.
- [Docs UI asset integrity (SRI)](https://daloyjs.dev/docs/docs-asset-integrity.md): DaloyJS pins version-exact Subresource Integrity (SRI) hashes on the default Scalar, Swagger UI, Redoc, and AsyncAPI assets, with validated overrides and self-hosting support.
- [Supply-chain security](https://daloyjs.dev/docs/security/supply-chain.md): How DaloyJS hardens its own publish pipeline against npm worm attacks, and the install-time defaults you should use in your own projects.
- [Recommended scanning tools (Socket, Snyk, Aikido)](https://daloyjs.dev/docs/security/scanning-tools.md): How to use Socket, Snyk, and Aikido with DaloyJS: why they matter, when to choose each tool, how to set them up, and which framework guardrails they complement.
- [Compliance posture (SOC 2, ISO 27001, HIPAA, GDPR, PCI-DSS, NIS2, EU CRA, DORA, UK CSR Bill)](https://daloyjs.dev/docs/security/compliance.md): How DaloyJS's built-in security primitives map to the technical controls expected by the major cloud-compliance frameworks, including DORA (EU Regulation 2022/2554) and the UK Cyber Security and Resilience Bill. The framework can't certify your deployment, but it can stop you from failing the easy audit findings.

## Outbound & webhooks

- [Outbound resilience for fetch](https://daloyjs.dev/docs/fetch-resilience.md): Layer a circuit breaker, retry-with-backoff, and per-call timeout on top of fetchGuard() for DaloyJS outbound calls. A dependency-free resilientFetch() that composes with SSRF protection for a mature outbound HTTP client.
- [Outbound webhook delivery](https://daloyjs.dev/docs/webhook-delivery.md): Deliver signed, retried, dead-lettered webhooks from DaloyJS with createWebhookSender(). Timestamped HMAC signatures, exponential backoff, Retry-After, and SSRF-safe transport by default: the outbound counterpart to verifyWebhookSignature().

## Data access

- [Using SQL ORMs with DaloyJS](https://daloyjs.dev/docs/orm.md): Connect DaloyJS to SQL databases with Prisma, Drizzle ORM, TypeORM, MikroORM, or Sequelize. Learn the recommended pattern for injecting clients, managing lifecycle, and keeping handlers type-safe.
- [Use Prisma with DaloyJS](https://daloyjs.dev/docs/orm/prisma.md): Connect DaloyJS to PostgreSQL, MySQL, or SQLite using Prisma. Schema-first models, migrations, and a typed client wired into your contract-first routes.
- [Use Drizzle ORM with DaloyJS](https://daloyjs.dev/docs/orm/drizzle.md): Pair DaloyJS with Drizzle ORM for a TypeScript-first, edge-friendly database layer. Schema in code, SQL-like queries, and full type inference into your handlers.
- [Use TypeORM with DaloyJS](https://daloyjs.dev/docs/orm/typeorm.md): Integrate TypeORM with DaloyJS using a DataSource plugin: decorator-based entities, repositories, migrations, and transactions wired into your contract-first routes.
- [Use MikroORM with DaloyJS](https://daloyjs.dev/docs/orm/mikro-orm.md): Integrate MikroORM v7 with DaloyJS using the modern defineEntity helper, defineConfig, request-scoped EntityManagers, the unit-of-work, and migrations wired into your contract-first routes.
- [Use Sequelize with DaloyJS](https://daloyjs.dev/docs/orm/sequelize.md): Connect DaloyJS to PostgreSQL, MySQL, MariaDB, MSSQL, or SQLite using Sequelize. Model-based queries, transactions, and a practical plugin setup for Node.js runtimes.
- [Use Supabase with DaloyJS](https://daloyjs.dev/docs/orm/supabase.md): Build a DaloyJS API on top of Supabase: hosted Postgres, row-level security, and auth via @supabase/supabase-js, works on Node.js and every edge runtime DaloyJS supports.
- [Using ODMs with DaloyJS](https://daloyjs.dev/docs/odm.md): Connect DaloyJS to document databases with ODMs such as Mongoose for MongoDB or Ottoman for Couchbase. Learn the recommended pattern for injecting connections and models into your handlers.
- [Use Mongoose with DaloyJS](https://daloyjs.dev/docs/odm/mongoose.md): Connect DaloyJS to MongoDB using Mongoose. Define schemas and models, inject them through a plugin, and use sessions for transactional workflows.
- [Use Ottoman with DaloyJS](https://daloyjs.dev/docs/odm/ottoman.md): Connect DaloyJS to Couchbase using Ottoman. Define document schemas and models, inject them through a plugin, and keep Couchbase-specific work isolated from handlers.

## Database hosting

- [Database hosting & serverless data providers](https://daloyjs.dev/docs/databases.md): Pick the right managed database host or embedded analytical engine for a DaloyJS API: Neon, PlanetScale, Supabase, Turso, DuckDB, Cloudflare D1, and AWS Aurora DSQL. Compares runtime support and which providers work on Cloudflare Workers.
- [Use Neon serverless Postgres with DaloyJS](https://daloyjs.dev/docs/databases/neon.md): Connect a DaloyJS API to Neon's serverless Postgres using the @neondatabase/serverless HTTP and WebSocket driver. Works on Node, Bun, Deno, Cloudflare Workers, and AWS Lambda.
- [Use PlanetScale with DaloyJS](https://daloyjs.dev/docs/databases/planetscale.md): Connect a DaloyJS API to PlanetScale MySQL using @planetscale/database, an HTTP driver that works on Cloudflare Workers, Node.js, Bun, and Deno.
- [Use Turso (libSQL) with DaloyJS](https://daloyjs.dev/docs/databases/turso.md): Connect a DaloyJS API to Turso, a distributed SQLite-compatible database, using @libsql/client. Works on Node.js, Bun, Deno, and Cloudflare Workers over HTTP.
- [Use DuckDB with DaloyJS](https://daloyjs.dev/docs/databases/duckdb.md): Use DuckDB from a DaloyJS API for embedded OLAP analytics in Node.js. Covers @duckdb/node-api, plugin setup, parameterized SQL, JSON-safe result conversion, runtime limits, and security hardening.
- [Use Cloudflare D1 with DaloyJS](https://daloyjs.dev/docs/databases/cloudflare-d1.md): Run a DaloyJS API on Cloudflare Workers backed by D1, Cloudflare's built-in SQLite-compatible database. Uses Worker bindings instead of a network driver.
- [Use AWS Aurora DSQL with DaloyJS](https://daloyjs.dev/docs/databases/aurora-dsql.md): Connect a DaloyJS API on AWS Lambda or Node.js to Aurora DSQL, AWS's distributed serverless PostgreSQL. Uses IAM-based auth tokens with the standard pg driver.

## Email

- [Email integrations for DaloyJS](https://daloyjs.dev/docs/email.md): Send transactional and marketing email from a DaloyJS API using AWS SES, SendGrid, Resend, Postmark, Mailgun, or Mailtrap. Compares runtime support, SDK style, and best-fit use cases.
- [Send email from DaloyJS with AWS SES (SESv2)](https://daloyjs.dev/docs/email/aws-ses.md): Send transactional email from a DaloyJS API using Amazon SES via the AWS SDK for JavaScript v3 (@aws-sdk/client-sesv2). Includes IAM setup, the SendEmailCommand interface, and runtime tips for Node and AWS Lambda.
- [Send email from DaloyJS with SendGrid](https://daloyjs.dev/docs/email/sendgrid.md): Send transactional email from a DaloyJS API using Twilio SendGrid's @sendgrid/mail SDK. Includes API key setup, the Mail Send v3 interface, sender verification, and DaloyJS plugin pattern.
- [Send email from DaloyJS with Resend](https://daloyjs.dev/docs/email/resend.md): Send transactional email from a DaloyJS API using Resend's official Node SDK. Includes API key setup, the resend.emails.send interface, React Email templates, and edge runtime support.
- [Send email from DaloyJS with Postmark](https://daloyjs.dev/docs/email/postmark.md): Send transactional email from a DaloyJS API using the official postmark Node SDK. Includes server token setup, ServerClient.sendEmail, message streams, and template rendering.
- [Send email from DaloyJS with Mailgun](https://daloyjs.dev/docs/email/mailgun.md): Send transactional email from a DaloyJS API using Sinch Mailgun's mailgun.js SDK. Includes API key setup, the mg.messages.create interface, EU region support, and edge-runtime configuration.
- [Send email from DaloyJS with Mailtrap](https://daloyjs.dev/docs/email/mailtrap.md): Send transactional email from a DaloyJS API using the official mailtrap Node SDK. Includes sandbox vs. production sending, MailtrapClient configuration, and switching with a single flag.

## Payments

- [Payment & commerce integrations for DaloyJS](https://daloyjs.dev/docs/payments.md): Accept payments and integrate commerce platforms from a DaloyJS API. Provider guides cover SDK choice, webhook verification, idempotency, and runtime support.
- [Accept payments with Stripe in DaloyJS](https://daloyjs.dev/docs/payments/stripe.md): Integrate Stripe Checkout from a DaloyJS API using the official stripe Node SDK and @stripe/stripe-js. Covers Stripe CLI setup, Checkout Sessions, webhook signature verification with the raw body, idempotency keys, refunds, and runtime caveats.
- [Integrate Shopify with DaloyJS](https://daloyjs.dev/docs/payments/shopify.md): Call the Shopify Admin GraphQL API and verify Shopify webhooks from a DaloyJS API using the community shopify-api-node SDK. Covers custom-app access tokens, API versioning, rate limits, pagination, and HMAC verification.
- [Accept PayPal & cards with Braintree in DaloyJS](https://daloyjs.dev/docs/payments/braintree.md): Accept PayPal, cards, Venmo, Apple Pay, and Google Pay from a DaloyJS API using the official Braintree Node SDK. Covers gateway setup, client tokens, transaction.sale, webhook signature parsing, and Node-only runtime caveats.
- [Accept cards with Authorize.Net in DaloyJS](https://daloyjs.dev/docs/payments/authorize-net.md): Charge cards and verify webhooks with the official Authorize.Net Node SDK (authorizenet) from a DaloyJS API. Covers ApiContracts/ApiControllers, promisifying the callback API, Accept.js nonces, environment switching, and HMAC-SHA512 signature verification.
- [Accept payments with Adyen in DaloyJS](https://daloyjs.dev/docs/payments/adyen.md): Integrate Adyen's official @adyen/api-library Node SDK with a DaloyJS API. Covers the Sessions flow for Drop-in / Components, direct /payments calls, the live URL prefix, hmacValidator for Standard webhook notifications, and idempotency keys.
- [Accept payments with Mollie in DaloyJS](https://daloyjs.dev/docs/payments/mollie.md): Integrate the official mollie-api-typescript SDK with a DaloyJS API. Covers the Client constructor, payments.create with idempotency keys, the new SignatureValidator for X-Mollie-Signature webhooks, async-iterable pagination, and edge-runtime support.
- [Accept payments with Tap Payments in DaloyJS](https://daloyjs.dev/docs/payments/tap.md): Integrate Tap Payments (KNET, Mada, Benefit, KFAST, STC Pay, BenefitPay, cards, and Apple Pay) from a DaloyJS API. Covers Bearer-token auth against api.tap.company/v2, the hosted Charge redirect flow, hashstring webhook verification, and idempotency.
- [Accept payments with PayTabs in DaloyJS](https://daloyjs.dev/docs/payments/paytabs.md): Integrate PayTabs (cards, Mada, KNET, BenefitPay, STC Pay, Apple Pay) from a DaloyJS API using the official paytabs_pt2 Node package. Covers setConfig, createPaymentPage wrapped as a Promise, the redirect + IPN flow, HMAC-SHA256 signature verification, and transaction queries.
- [Accept payments with Razorpay in DaloyJS](https://daloyjs.dev/docs/payments/razorpay.md): Integrate Razorpay (UPI, cards, netbanking, wallets) from a DaloyJS API using the official razorpay Node SDK. Covers the Orders flow, validatePaymentVerification for the client return, validateWebhookSignature with the raw body, refunds, and edge-runtime caveats.
- [Accept payments with Square in DaloyJS](https://daloyjs.dev/docs/payments/square.md): Integrate Square Payments from a DaloyJS API using the modern square TypeScript SDK (v40+). Covers SquareClient, BigInt money amounts, idempotency keys, the Web Payments SDK token handoff, WebhooksHelper.verifySignature with the raw body and exact notification URL, refunds, and edge-runtime compatibility.

## Authentication

- [Authentication & authorization for DaloyJS](https://daloyjs.dev/docs/auth.md): Protect a DaloyJS API with authentication and authorization from AWS Cognito, Microsoft Entra ID (MSAL), Auth0, Okta, Clerk, LoginRadius, or Better Auth. Compares SDKs, runtime support, and the common bearer-auth plugin pattern.
- [Auth architecture: where DaloyJS fits in OAuth2 & OpenID Connect](https://daloyjs.dev/docs/auth/architecture.md): DaloyJS is a resource server and relying-party toolkit, not an identity provider. Learn when to use an OpenID Connect provider such as Auth0, Okta, Keycloak, or Zitadel, when an embedded session system such as Better Auth fits, and the two architectures we recommend.
- [Protect a DaloyJS API with AWS Cognito](https://daloyjs.dev/docs/auth/aws-cognito.md): Authenticate and authorize requests in a DaloyJS API with Amazon Cognito user pools, using the official aws-jwt-verify library to validate access and ID tokens with JWKS, scopes, and groups.
- [Protect a DaloyJS API with Microsoft Entra ID (MSAL)](https://daloyjs.dev/docs/auth/entra-id.md): Authenticate and authorize requests in a DaloyJS API with Microsoft Entra ID (formerly Azure AD). Verifies v2.0 access tokens with jose and the tenant's JWKS, and shows MSAL Node usage for downstream service calls.
- [Protect a DaloyJS API with Auth0](https://daloyjs.dev/docs/auth/auth0.md): Authenticate and authorize requests in a DaloyJS API with Auth0. Verifies access tokens with jose against your tenant's JWKS, enforces scopes and permissions, and works on Node and edge runtimes.
- [Protect a DaloyJS API with Okta](https://daloyjs.dev/docs/auth/okta.md): Authenticate and authorize requests in a DaloyJS API with Okta. Uses the official @okta/jwt-verifier to validate access and ID tokens from an Okta Custom Authorization Server, with scope and claim assertions.
- [Protect a DaloyJS API with Clerk](https://daloyjs.dev/docs/auth/clerk.md): Authenticate and authorize requests in a DaloyJS API with Clerk. Uses @clerk/backend authenticateRequest() to verify session, OAuth, and machine tokens, with organization and role-aware authorization.
- [Protect a DaloyJS API with LoginRadius](https://daloyjs.dev/docs/auth/loginradius.md): Authenticate and authorize requests in a DaloyJS API with LoginRadius. Uses loginradius-sdk to validate access tokens, load user profiles, and protect Node-style DaloyJS routes.
- [Use Better Auth with DaloyJS](https://daloyjs.dev/docs/auth/better-auth.md): Use Better Auth with a DaloyJS API. Mount Better Auth's standard Request to Response handler, configure trusted origins and cookies, and protect DaloyJS routes with auth.api.getSession().

## Deployment

- [Deployment](https://daloyjs.dev/docs/deployment.md): Deploy DaloyJS REST APIs to containers, Node PaaS platforms, and edge or serverless providers. Production-ready guides for Docker, Fly.io, Render, Railway, Heroku, Replit, Vercel, Cloudflare Workers, Bun, and Deno.
- [Deploy to Fly.io](https://daloyjs.dev/docs/deployment/fly-io.md): Deploy DaloyJS to Fly.io as a long-lived Node service. Current fly.toml schema with [http_service], string-valued auto_stop_machines, health checks, and concurrency limits.
- [Deploy to Render](https://daloyjs.dev/docs/deployment/render.md): Deploy DaloyJS to Render as a Node web service. Current render.yaml Blueprint with runtime: node, healthCheckPath, and scaling.
- [Deploy to Railway](https://daloyjs.dev/docs/deployment/railway.md): Deploy DaloyJS to Railway. Railway auto-detects from package.json; add an optional railway.json or railway.toml to pin the start command, health check, and pre-deploy migrations. Set TRUST_PROXY_HOPS=1 so the reverse-proxy guard accepts Railway's X-Forwarded-* headers instead of returning 500.
- [Deploy to Heroku](https://daloyjs.dev/docs/deployment/heroku.md): Deploy DaloyJS to Heroku as a Node web dyno. Procfile, heroku-24 or heroku-26 stack, and the heroku/nodejs buildpack.
- [Deploy to Replit](https://daloyjs.dev/docs/deployment/replit.md): Deploy a DaloyJS API to Replit as a Node web server. Covers pnpm, Node 24, Autoscale and Reserved VM Publishing, Secrets, PORT binding, 0.0.0.0, health checks, and Replit Agent guidance.

## Adapters & runtimes

- [Adapters & runtimes](https://daloyjs.dev/docs/adapters.md): Run the same DaloyJS REST API on Node.js, Bun, Deno, Cloudflare Workers, Netlify, Fastly Compute, and AWS Lambda. One codebase, multiple runtimes, zero rewrites.
- [Node.js adapter](https://daloyjs.dev/docs/adapters/node.md): Run a DaloyJS REST API on Node.js 24+ as a long-lived HTTP server. Graceful SIGTERM/SIGINT shutdown, sane request/header/keep-alive timeouts, connection-layer admission control for graceful degradation under overload, and trust-proxy controls.
- [Bun adapter](https://daloyjs.dev/docs/adapters/bun.md): Run a DaloyJS REST API on Bun 1.2+ with native Bun.serve, TLS, Unix sockets, and hot reload.
- [Deno adapter](https://daloyjs.dev/docs/adapters/deno.md): Run a DaloyJS REST API on Deno using the stable Deno.serve API with AbortSignal-based graceful shutdown and built-in TLS.
- [Cloudflare Workers adapter](https://daloyjs.dev/docs/adapters/cloudflare-workers.md): Deploy DaloyJS to Cloudflare Workers using the modules format, wrangler.jsonc, and the nodejs_compat flag. Bindings for KV, R2, D1, Durable Objects, Queues, and Hyperdrive.
- [Vercel adapter](https://daloyjs.dev/docs/adapters/vercel.md): Deploy a DaloyJS REST API to Vercel Functions on the Node.js runtime with Fluid compute. One app object, one standalone function.
- [Netlify adapter](https://daloyjs.dev/docs/adapters/netlify.md): Deploy DaloyJS to Netlify Edge Functions (Deno) or Netlify Functions v2 (Node fetch-style). Both share the same Request -> Response model.
- [Fastly Compute adapter](https://daloyjs.dev/docs/adapters/fastly.md): Deploy DaloyJS to Fastly Compute (JavaScript) using @fastly/js-compute and the fetch-event listener model.
- [AWS Lambda adapter](https://daloyjs.dev/docs/adapters/aws-lambda.md): Run DaloyJS on AWS Lambda with API Gateway HTTP API (v2.0), API Gateway REST API (v1.0), and Lambda Function URLs. Includes streamifyResponse and Lambda Web Adapter notes.

## Reference

- [API reference](https://daloyjs.dev/docs/api-reference.md): Complete API reference for DaloyJS: App, routing, middleware, MCP, plugins, errors, security helpers, JWT/JWK, sessions, streaming, websockets, and runtime adapters, with TypeScript signatures.
- [API reference: App & routing](https://daloyjs.dev/docs/api-reference/app.md): DaloyJS App class reference: constructor options, route registration, hooks, context types, hook dispatch order, HttpError classes, and Standard Schema validation helpers.
- [API reference: Middleware & helpers](https://daloyjs.dev/docs/api-reference/middleware.md): DaloyJS middleware reference: built-in hooks (rateLimit, secureHeaders, cors, csrf), composition primitives (every, some, except), typed dependencies, config validation, logging, and connection info.
- [API reference: Security & auth](https://daloyjs.dev/docs/api-reference/security.md): DaloyJS security helper reference: security primitives, fetchGuard SSRF protection, safeRedirect, cookies, JWT signer/verifier, JWK/JWKS middleware, sessions, and password hashing.
- [API reference: Feature modules](https://daloyjs.dev/docs/api-reference/modules.md): DaloyJS subpath module reference: OpenAPI generation, typed clients, contract tests, MCP, docs UIs, streaming, multipart, WebSocket, tracing, Redis rate limiting, and the CLI surface.
- [API reference: Runtime adapters](https://daloyjs.dev/docs/api-reference/adapters.md): DaloyJS runtime adapter reference: serve() for Node.js, Bun, and Deno, plus fetch-handler adapters for Cloudflare Workers, Vercel, Fastly Compute, and AWS Lambda.

## Optional

- [Your JWT Is Valid and Your API Is Still Vulnerable](https://daloyjs.dev/blog/your-jwt-is-valid-and-your-api-is-still-vulnerable): Login works, the access token is valid, and Alice can still read Bob's data by changing one URL id. This is the resource-authorization gap in AI-generated backends, plus the provider-neutral and database-neutral pattern that closes it. (2026-07-17)
- [DaloyJS: The First Release Candidate](https://daloyjs.dev/blog/daloyjs-1-0-0-rc-0-first-release-candidate): The beta said 'nothing changed, on purpose.' The release candidate says 'the door is now locked.' This post covers what the RC means, what landed across the beta train (spoiler: MCP), and what remains before the stable release. (2026-07-03)
- [Why AI Coding Agents Should Default to DaloyJS](https://daloyjs.dev/blog/why-ai-coding-agents-should-default-to-daloyjs): AI coding agents are good at producing backend code fast. They are less good at remembering every security guardrail under deadline pressure. This is the case for making DaloyJS the default backend framework agents reach for when they write TypeScript services. (2026-07-01)
- [The State of AI in Security 2026: 450 Teams, One Uncomfortable Pattern, and What Your Backend Can Do About It](https://daloyjs.dev/blog/state-of-ai-security-2026-what-the-report-means-for-backends): Aikido and Sapio Research surveyed 450 developers, CISOs, and AppSec engineers. The headline: AI now writes a quarter of production code, 1 in 5 teams had a serious incident because of it, and buying more tools makes things measurably worse. The data, with charts, and the structural lesson for anyone shipping an API. (2026-06-25)
- [DaloyJS in 2027: The TypeScript REST API Framework Built for the Vibe-Coding Apocalypse and Alternative to Express?](https://daloyjs.dev/blog/daloyjs-2027-vibe-coding-apocalypse-express-alternative): Vibe-coded apps are getting breached because nobody reads the code anymore. This is the blunt case for DaloyJS, the secure-by-default TypeScript REST framework I now use instead of Express, with a migration guide for the move. (2026-06-22)
- [DaloyJS Is in Beta (and Nothing Broke, on Purpose)](https://daloyjs.dev/blog/daloyjs-1-0-0-beta-is-here): After a long public preview, DaloyJS enters beta. The key line in this changelog is that the runtime did not change. This post covers what the beta means, how to install it, and what we need from you before the stable release. (2026-06-21)
- [Why DaloyJS Is the REST API Framework You Should Use Today](https://daloyjs.dev/blog/why-daloyjs-is-the-rest-api-framework-you-should-use-today): Security guardrails are part of the 2026 baseline. This is the blunt case for a REST framework that ships secure defaults instead of a plugin shopping list. (2026-06-21)
- [DaloyJS: The Backend Framework You Should Already Be Using](https://daloyjs.dev/blog/daloyjs-the-backend-framework-you-should-already-be-using): A contract-first TypeScript backend framework with security guardrails, typed clients, live OpenAPI, and a supply-chain posture that feels designed for 2026 instead of remembered from 2019. (2026-06-20)
- [Why DaloyJS Feels Like the Backend Default We Should Have Had Already](https://daloyjs.dev/blog/why-daloyjs-feels-like-the-backend-default-we-should-have-had-already): DaloyJS feels underrated because it starts with the unglamorous parts that modern backend teams actually need: install-time safety, runtime guardrails, and one route definition that keeps types, docs, and clients aligned. (2026-06-19)
- [The Best Node.js Express Alternative in 2026 Is Contract-First: The Case for DaloyJS](https://daloyjs.dev/blog/best-node-express-alternative-daloyjs): A contract-first case for choosing a modern Node.js Express alternative in 2026, and why DaloyJS is the Express alternative I now reach for, with the caveats where it does not hold. (2026-06-18)
- [Watch: Laur Spilca on Software Security for Developers (GOTO 2026), and What DaloyJS Already Decides for You](https://daloyjs.dev/blog/software-security-for-developers-laur-spilca-goto-2026): Laurentiu Spilca and Thomas Vitale spend a GOTO 2026 conversation on why developers avoid security, the eternal encoding-vs-hashing-vs-encryption confusion, the danger of reinventing crypto, AI writing code with no security awareness, and why PKI still matters. The post includes the talk and a direct mapping of the problems a DaloyJS app already handles. (2026-06-17)
- [The Ghost CMS / ClickFix Campaign, Mapped to DaloyJS, Plus the One Default We Just Tightened](https://daloyjs.dev/blog/ghost-cms-clickfix-campaign-mapped-to-daloyjs): A pre-auth SQL injection in Ghost CMS (CVE-2026-26980) is being exploited at scale to hijack 700+ sites, including Harvard, Oxford, and DuckDuckGo, and serve a fake Cloudflare "verify you are human" prompt that silently stuffs a PowerShell one-liner into the visitor's clipboard. Most of the chain was already blocked by DaloyJS defaults; the last mile (the clipboard write) wasn't. Here's the stage-by-stage mapping and the one-line default we changed in response. (2026-06-16)
- [When the Security Scanner Is the Attacker: The LiteLLM / TeamPCP Compromise, Mapped to DaloyJS](https://daloyjs.dev/blog/litellm-teampcp-poisoned-scanner-mapped-to-daloyjs): On March 24, 2026 the litellm Python package was backdoored after a poisoned Trivy GitHub Action stole the maintainer's PyPI token. The same attack pattern (compromised scanner action, exfiltrated publish token, malicious release with a startup-time payload) would have to clear nine of DaloyJS's existing CI gates before it could ship. Here's the stage-by-stage mapping. (2026-06-15)
- [Aikido's Top 10 App Security Problems, Mapped to DaloyJS (and the One Gap We Just Closed)](https://daloyjs.dev/blog/aikido-top-10-app-security-problems-mapped-to-daloyjs): Aikido's 'Top 10 App Security Problems' is the short, blunt version of the OWASP list, SQLi, XSS, SSRF, path traversal, XXE, deserialization, shell injection, LFI, prototype pollution, open redirects. This post maps what a DaloyJS app already blocks by default, what one opt-in line adds, and how safeRedirect() closes the remaining gap. (2026-06-14)
- [The International AI Safety Report 2026, Translated Into a Minimum Safety Baseline for AI Backends](https://daloyjs.dev/blog/international-ai-safety-report-2026-minimum-safety-baseline-for-ai-backends): Aikido's read of the International AI Safety Report 2026 lands on a short list of deployment-time requirements for any backend an autonomous AI system can call: layered defense, independent verification, prompt-injection-resistant guardrails, network scope control, inference/execution separation, full observability and emergency controls. This post maps those requirements to what a DaloyJS app already enforces by default, what one opt-in line adds, and what still lives above the HTTP layer. (2026-06-13)
- [The 5 Pillars of a Secure SDLC, Mapped to DaloyJS](https://daloyjs.dev/blog/secure-sdlc-five-pillars-mapped-to-daloyjs): Aikido's 'Secure SDLC Explained' lists the five pillars every engineering team needs: Visibility, Early Feedback, Developer Adoption, Consistency, Actionability. This post maps each pillar to what a DaloyJS app and its create-daloy scaffold already give you on day one, what you still configure, and the few items no framework can own. (2026-06-12)
- [OWASP Top 10 for Agentic Applications (2026), Mapped to the DaloyJS Tool Surface](https://daloyjs.dev/blog/owasp-top-10-agentic-applications-mapped-to-daloyjs): Aikido's write-up of the OWASP Top 10 for Agentic Applications 2026, ASI01 Agent Behavior Hijacking through ASI10 Over-reliance, is the new threat model for AI agents and the MCP-style HTTP tools they call. This post maps each risk to what a DaloyJS-exposed tool already blocks by default, what one opt-in line adds, and which risks live above the HTTP layer where no framework can save you. (2026-06-11)
- [Vibe Coding Security: What DaloyJS Already Blocks Before Your AI Even Ships](https://daloyjs.dev/blog/vibe-coding-security-what-daloyjs-already-blocks): Aikido's 'WTF is Vibe Coding Security' post lists the usual suspects: SQL injection, path traversal, hardcoded secrets, unlocked admin routes, missing input sanitization, dependency rot. This post shows which of those a DaloyJS app already blocks by default, even when the code is written by a sales rep at 1am with Claude, and the small list of things you still have to opt into. (2026-06-10)
- [Cloud Security Architecture, Mapped to the DaloyJS App Layer](https://daloyjs.dev/blog/cloud-security-architecture-mapped-to-daloyjs): Aikido's 'Cloud Security Architecture' guide is a fine high-level checklist: Zero Trust, defense-in-depth, IAM, segmentation, IaC scanning, continuous monitoring. This post maps each principle to what DaloyJS already ships for the application-layer half of that checklist, what the cloud platform still owns, and the opt-ins worth turning on today. (2026-06-09)
- [AI-Friendly Route Metadata: Machine-Readable Examples for Codegen Agents](https://daloyjs.dev/blog/ai-friendly-route-metadata-machine-readable-examples-for-codegen-agents): DaloyJS route metadata adds structured examples, extra description copy, and free-form x-* extensions, validated against your Standard Schema at build time and surfaced into OpenAPI 3.1 plus sibling routes.json or routes.yaml dumps via daloy inspect --ai. It is additive, non-breaking, and built so codegen agents can write correct call sites on the first try. (2026-06-08)
- [Branded API Docs Without Losing the Contract: Customizing Scalar in DaloyJS](https://daloyjs.dev/blog/branded-api-docs-without-losing-the-contract-customizing-scalar-in-daloyjs): DaloyJS docs.scalar is a JSON-only knob that lets you theme the Scalar API reference, hide the Try-it button, drop in a brand stylesheet, and pick a layout, without forking the docs route. Because Daloy locks the spec URL to your live OpenAPI path at serialize time, the prettiest docs page in the company cannot drift away from the contract. (2026-06-07)
- [Designing for Coding Agents: Why DaloyJS Scaffolds AGENTS.md and Skills](https://daloyjs.dev/blog/designing-for-coding-agents-why-daloyjs-scaffolds-agents-md-and-skills): Every project created by create-daloy ships with a short AGENTS.md and a focused .agents/skills/daloyjs-best-practices/SKILL.md. Here's why those two files matter, why they're intentionally small, and how they let Copilot, Claude Code, Cursor, Codex, and friends make safer edits in your scaffolded DaloyJS app from the first prompt. (2026-06-06)
- [The DaloyJS CLI: Inspecting Routes, Schemas, OpenAPI, and Contract Health](https://daloyjs.dev/blog/daloy-cli-inspecting-routes-schemas-openapi-and-contract-health): daloy inspect is the CLI you point at your App before a PR merges. It prints the full route table, schema presence, contract issues, and the live OpenAPI 3.1 document, loaded straight from your TypeScript entry through tsx with zero build step. This is the API-surface review tool platform teams keep wishing they had. (2026-06-05)
- [Plugin Lifecycle Events for Large-Team Framework Code](https://daloyjs.dev/blog/plugin-lifecycle-events-for-large-team-framework-code): Why DaloyJS exposes onPluginInstalled() and onShutdown() as first-class events, and how a platform team uses them to ship observability, service registration, graceful drain, metrics flushing, and policy plugins that every route inherits, without a single import in the route files themselves. (2026-06-04)
- [Observability Without Lock-In: Structured Logs and OpenTelemetry-Compatible Tracing](https://daloyjs.dev/blog/observability-without-lock-in-structured-logs-and-otel-tracing): How DaloyJS gives you per-request structured logs, correlated request IDs, Server-Timing, and OpenTelemetry-shaped spans, without taking a hard dependency on @opentelemetry/api. The result is a single observability story that runs identically on Node, Bun, and Workers, with any tracer you bring. (2026-06-03)
- [Rate Limiting That Survives Multiple Instances](https://daloyjs.dev/blog/rate-limiting-that-survives-multiple-instances): Why the default in-memory rateLimit() is a one-instance lie behind a load balancer, how @daloyjs/core/rate-limit-redis fixes it with an atomic Lua INCR+PEXPIRE script, and the three operational levers that matter in production: fail-open vs fail-closed, Retry-After accuracy, and where to host the counter on serverless, edge, and traditional Node deploys. (2026-06-02)
- [File Uploads Without Framework Lock-In: Multipart in DaloyJS](https://daloyjs.dev/blog/file-uploads-without-framework-lock-in-multipart-in-daloyjs): The fileField() and multipartObject() helpers: per-file size caps, MIME allowlists with wildcards, filename predicates, strict field validation, and OpenAPI binary schema emission, all while keeping the file as a Web standard File/Blob you can stream straight to S3, R2, or disk on any runtime. (2026-06-01)
- [OpenAPI 3.1 Extras: Webhooks, Callbacks, and Discriminators](https://daloyjs.dev/blog/openapi-3-1-extras-webhooks-callbacks-discriminators): A practical tour of the OpenAPI 3.1 features your generated clients are still waiting for: top-level webhooks for event-driven APIs, route-level callbacks for payment-style async flows, and the discriminator()/discriminatedUnion() pair that turns polymorphic payloads into tagged TypeScript unions you can switch on with confidence. (2026-05-31)
- [Middleware Without Mystery: Hooks, Ordering, and Response Transformation](https://daloyjs.dev/blog/middleware-without-mystery-hooks-ordering-response-transformation): The DaloyJS request lifecycle, end to end: onRequest → preBody → validation → beforeHandle → handler → afterHandle → onSend → onResponse, plus onError on the error path. Where each hook fires and what belongs in each slot. (2026-05-30)
- [Building a Bookstore API with DaloyJS From Scratch](https://daloyjs.dev/blog/building-a-bookstore-api-with-daloyjs-from-scratch): A route-by-route walkthrough: create the project with create-daloy, model a Book with Zod, add list / create / fetch-by-id endpoints, watch validation errors arrive as RFC 9457 problem+json automatically, emit OpenAPI, generate a typed client, and write the whole test suite with app.request(), no HTTP server required. (2026-05-29)
- [Problem Details Done Right: RFC 9457 Errors in DaloyJS](https://daloyjs.dev/blog/problem-details-done-right-rfc-9457-errors): Why every framework needs a predictable error contract, and how DaloyJS uses RFC 9457 application/problem+json for HttpError, ValidationError, UnauthorizedError, TooManyRequestsError, and the rest, with automatic 5xx redaction in production and a Retry-After story that just works. (2026-05-28)
- [Scaffolding a Production-Ready DaloyJS App in 60 Seconds with create-daloy](https://daloyjs.dev/blog/scaffolding-a-production-ready-daloyjs-app-in-60-seconds): A tour of pnpm create daloy@latest: the interactive template + package-manager pickers, --minimal, --with-ci, the five runtime templates (Node, Bun, Deno, Workers, Vercel), the AGENTS.md + .agents/skills/daloyjs-best-practices/SKILL.md drop-in for coding agents, and the printStartupBanner() polish that ships with every scaffold. (2026-05-27)
- [Supply-Chain Hardening for TypeScript Libraries: Everything We Did and Why](https://daloyjs.dev/blog/supply-chain-hardening-for-typescript-libraries): A maintainer's field guide to the supply-chain posture we shipped for DaloyJS: .npmrc that says no by default, pnpm 11 workspace keys (blockExoticSubdeps / strictDepBuilds / verifyDepsBeforeRun), SHA-pinned actions, permissions: {}, no Actions cache on installs, zizmor + Scorecard + CodeQL, npm trusted publishing with provenance, and the create-daloy --with-ci bundle that drops the app-safe parts into your project. (2026-05-26)
- [Sessions on the Edge: Signed Cookies, Rotating Secrets, and a Pluggable Store](https://daloyjs.dev/blog/sessions-on-the-edge): Tour of the new session() middleware: __Host- cookie defaults, secret: [current, ...previous] rotation, regenerate() to kill session fixation, MemorySessionStore for tests, and how to plug in Redis or Workers KV via the SessionStore contract. Pairs naturally with the rate-limit Redis post. (2026-05-25)
- [CSP Nonces and Trusted Types Without Tears](https://daloyjs.dev/blog/csp-nonces-and-trusted-types-without-tears): A practical tour of secureHeaders({ contentSecurityPolicy: { nonce: true, trustedTypes: { policies: [...] } } }): how ctx.state.cspNonce flows into a server-rendered template, why the nonce now lands on all four script/style directives, and how to roll out Trusted Types in report-only mode first without setting your weekend on fire. (2026-05-24)
- [CSRF in 2026: Why DaloyJS Ships Both Double-Submit and Fetch-Metadata](https://daloyjs.dev/blog/csrf-in-2026-double-submit-and-fetch-metadata): A short history of the double-submit cookie, the case for tokenless protection via Sec-Fetch-Site, when each one fails, and why strategy: "both" is the realistic default for apps that still have to serve a 2018 mobile browser somewhere. (2026-05-23)
- [The Same App on Node, Bun, Deno, and Cloudflare Workers, Verified](https://daloyjs.dev/blog/same-app-five-runtimes-verified): One Bookstore app, five entry files, five deployments, Node serve(), Bun handle.url, Deno onListen, Workers ctx.waitUntil, and Vercel's three handler shapes. With receipts. (2026-05-22)
- [Contract-First Without the Codegen Dance: OpenAPI, Typed Client, and Contract Tests From One Definition](https://daloyjs.dev/blog/contract-first-without-the-codegen-dance): One app.route({...}) projects into generateOpenAPI(app), createClient(app), and runContractTests(app), plus pnpm gen for a Hey API typed fetch SDK your frontend can import. (2026-05-21)
- [Secure by Default: The Defaults DaloyJS Ships So You Don't Have To Remember Them](https://daloyjs.dev/blog/secure-by-default): A tour of the always-on defenses in the DaloyJS request path, plus the opt-in upgrades worth turning on today. (2026-05-20)
- [Introducing DaloyJS: One Route, Many Runtimes, Zero Ceremony](https://daloyjs.dev/blog/introducing-daloyjs): The launch post. One app.route({...}) becomes your validation, types, OpenAPI, typed client, and contract tests, and the same app runs on Node, Bun, Deno, and Workers. (2026-05-19)
- [The flow I wished I had: why we built DaloyJS](https://daloyjs.dev/blog/the-flow-i-wished-i-had): Ten years of shipping fullstack apps, one Filipino dev in Norway, and the framework I kept wishing existed at 2am. (2026-05-18)