The first TypeScript REST API framework built for secure AI-assisted
Oslo, Norway
- Tweets 155
- Following 300
- Followers 21
- Likes 60
Newly released. We have a @scalar section on our landing page, and it is pretty. ☺️ daloyjs.dev/
1
1
6
280
We have documentation of how to use @tursodatabase in a daloyjs service. daloyjs.dev/docs/databases/t…
1
34
We are a documentation of how to use @postmarkapp with DaloyJS 😊. daloyjs.dev/docs/email/postm…
40
Check out our @duckdb integration documentation. 🙂
daloyjs.dev/docs/databases/d…
2
44
DaloyJS 1.0.0-rc.0: the first release candidate.
The public API is frozen now. Only bug fixes and docs until 1.0.0 GA.
The beta run quietly added a dependency-free MCP server and a faster Node hot path.
Build something real on it and find the bug I missed 👇
daloyjs.dev/blog/daloyjs-1-0…
36
OTel-shaped spans without a hard dependency on @opentelemetry api. Bring your own tracer; DaloyJS just emits the right shape — on every runtime.
daloyjs.dev/docs/tracing
25
AI now writes ~24% of production code, and 1 in 5 teams report a serious AI-code incident.
Our take on what @AikidoSecurity + Sapio Research's State of AI in Security & Development 2026 means for backend teams: stricter contracts, CI gates, less tool noise.
daloyjs.dev/blog/state-of-ai…
125
The launch post. One `app.route({...})` becomes your validation, types, OpenAPI, typed client, and contract tests. The same app runs on Node, Bun, Deno, Workers, and Vercel Edge. One route, many runtimes, zero ceremony.
daloyjs.dev/blog/introducing…
24
Pretty API docs are great until they drift from the contract. DaloyJS ships `docs.scalar` — theme it, hide Try-it, drop in a brand stylesheet — and locks the spec URL to your live OpenAPI path at serialize time. No drift.
daloyjs.dev/blog/branded-api…
11
Codegen agents kept hallucinating my call sites. So DaloyJS added a `meta` field on every route — structured examples, x-* extensions, validated against your schema, dumped to routes.json for Claude/GPT/Hey API to read.
daloyjs.dev/blog/ai-friendly…
18
A tour of the always-on defenses in the DaloyJS request path — the ones you no longer have to remember to turn on — plus the opt-in upgrades worth flipping today. Security shouldn't be a checklist you forget at 2am.
daloyjs.dev/blog/secure-by-d…
12
One `app.route({...})` projects into `generateOpenAPI(app)`, `createClient(app)`, and `runContractTests(app)`. Plus `pnpm gen` for a Hey API typed fetch SDK your frontend imports directly. One definition, no babysitting.
daloyjs.dev/blog/contract-fi…
14
We are writing a post about the @AikidoSecurity latest State of AI security development in 2026. We are really thankful to see the reports they gathered. aikido.dev/state-of-ai-secur…
1
19
One Bookstore app, five entry files, five deployments. Node `serve()`, Bun `handle.url`, Deno `onListen`, Workers `ctx.waitUntil`, and Vercel's three handler shapes. With receipts.
daloyjs.dev/blog/same-app-fi…
27
`secureHeaders({ contentSecurityPolicy: { nonce: true, trustedTypes: {...} } })` — `ctx.state.cspNonce` flows into your template, the nonce lands on all four script/style directives, and Trusted Types ships report-only first so you don't lose a weekend.
daloyjs.dev/blog/csp-nonces-…
14
The new `session()` middleware: __Host- cookie defaults, secret: [current, ...previous] rotation, `regenerate()` to kill session fixation, MemorySessionStore for tests, and a SessionStore contract for Redis or Workers KV.
daloyjs.dev/blog/sessions-on…
1
33
A maintainer's field guide: .npmrc that says no by default, pnpm 11 keys, SHA-pinned actions, permissions: {}, no Actions cache on installs, zizmor + Scorecard + CodeQL, trusted publishing with provenance. `--with-ci` drops it into your repo.
daloyjs.dev/blog/supply-chai…
56
DaloyJS 1.0.0-beta.0 is live 🎉
After a long 0.x run, the API is feature-complete and stable for 1.0. Same secure-by-default framework, braver version number.
daloyjs.dev/blog/daloyjs-1-0…
1
1
3
219