The first TypeScript REST API framework built for secure AI-assisted
Oslo, Norway
- Tweets 155
- Following 300
- Followers 21
- Likes 60
`pnpm create daloy@latest`. Interactive picker, --minimal, --with-ci, five runtime templates (Node, Bun, Deno, Workers, Vercel Edge), AGENTS.md and a daloyjs-best-practices skill drop-in, and a startup banner that doesn't feel embarrassing.
daloyjs.dev/blog/scaffolding…
43
Every framework needs a predictable error contract. DaloyJS uses RFC 9457 application/problem+json for HttpError, ValidationError, UnauthorizedError, TooManyRequestsError — with automatic 5xx redaction in prod and a Retry-After that just works.
daloyjs.dev/blog/problem-det…
15
Route by route: scaffold with `create-daloy`, model a Book with Zod, add list/create/get endpoints, watch validation errors arrive as RFC 9457 problem+json automatically, emit OpenAPI, generate a typed client, test with `app.request()`.
daloyjs.dev/blog/building-a-…
3
38
The DaloyJS request lifecycle, end to end: onRequest → beforeHandle → handler → afterHandle → onSend → onResponse, plus onError. Where each hook fires, how scopes compose, and what to put in which slot.
daloyjs.dev/blog/middleware-…
1
11
The features your generated clients are quietly waiting for: top-level webhooks, route-level callbacks for payment-style async flows, and `discriminator()` / `discriminatedUnion()` for polymorphic payloads you can switch on with confidence.
daloyjs.dev/blog/openapi-3-1…
16
Multipart in DaloyJS: `fileField()` and `multipartObject()` with per-file size caps, MIME allowlists, filename predicates, and OpenAPI binary schema emission — while keeping the file as a Web standard File/Blob. Stream to S3, R2, or disk.
daloyjs.dev/blog/file-upload…
2
21
A short history of the double-submit cookie, the case for tokenless protection via Sec-Fetch-Site, and when each one fails. Why `strategy: "both"` is the realistic default for apps that still have to serve a 2018 mobile browser somewhere.
daloyjs.dev/blog/csrf-in-202…
12
Per-request structured logs, correlated request IDs, Server-Timing, and OTel-shaped spans — without a hard dep on @opentelemetry/api. One observability story that runs identically on Node, Bun, Workers, and Vercel Edge.
daloyjs.dev/blog/observabili…
26
The default in-memory `rateLimit()` is a one-instance lie behind a load balancer. `@daloyjs/core/rate-limit-redis` fixes it with an atomic Lua INCR+PEXPIRE. Plus the three levers that matter in prod: fail-open, Retry-After, store location.
daloyjs.dev/blog/rate-limiti…
18
`onPluginInstalled()` and `onShutdown()` are first-class events in DaloyJS. Platform teams use them to ship observability, service registration, graceful drain, and policy plugins — with zero imports in the route files.
daloyjs.dev/blog/plugin-life…
6
`daloy inspect` is the API-surface review tool platform teams keep wishing they had. Full route table, schema presence, contract issues, live OpenAPI 3.1 — loaded from your TS entry via tsx, zero build step. Point it at a PR.
daloyjs.dev/blog/daloy-cli-i…
1
21
Every `create-daloy` project ships an AGENTS.md and a focused SKILL.md. Small on purpose. Copilot, Claude Code, Cursor, and Codex make safer edits from the first prompt because the rules are written down where they look.
daloyjs.dev/blog/designing-f…
2
72
Ten years of shipping fullstack apps, one Filipino dev in Norway, and the framework I kept wishing existed at 2am. The honest origin story of DaloyJS.
daloyjs.dev/blog/the-flow-i-…
2
13
Why DaloyJS Is the Framework to Bet On in 2027 open.substack.com/pub/daloyj…
9
Trust nobody. Not even your node_modules. 😠 linkedin.com/pulse/trust-nob…
1
11
Why DaloyJS Is the Best Framework for Your Modern Web App open.substack.com/pub/daloyj…
16
If you are a @reactnative developer or an @expo developer, this one is for you.
dev.to/daloyjs/daloyjs-is-th…
49