DaloyJS 1.0.0-beta.0 Is Here (and Nothing Broke, On Purpose)

DaloyJS just crossed a line I have been quietly nervous about for months. We tagged 1.0.0-beta.0. The framework that spent its whole life as a 0.x preview is now in beta for its first major release.

And here is the part that feels like a punchline: the single most important line in this changelog is that nothing changed. No new middleware. No new adapter. No clever helper I will write three blog posts about. If you were on 0.44.0 yesterday, 1.0.0-beta.0 is the exact same code with a braver version number.

So why bother tagging it?

Because a version number is a promise, and I finally felt okay making this one. During 0.x the deal was simple and a little rude: any minor release could break you. That is normal for a young framework. You move fast, you rename things, you apologize in the changelog. It is also exhausting for anyone trying to build something real on top of you.

1.0.0-beta.0 flips that deal. The public API is feature-complete and stable for the 1.0 line. From 1.0.0 onward we follow SemVer like adults: no breaking changes in a 1.x minor, and deprecations get at least one minor cycle of warning before anything disappears. The beta is me saying I think we are ready, then handing it to you to prove me wrong before the GA.

Wait, nothing changed, really?

Really. But that does not mean nothing happened. The work that earned the 1.0 happened across the entire 0.x run: the secure-by-default request path, the contract-first route that generates OpenAPI plus a typed client, the multi-runtime adapters, the supply-chain hardening, the SSRF guard, the auth and rate-limit and webhook pieces, all of it. Beta day is not when the features arrive. It is when I stop adding features and start defending the shape of what is already there.

Your existing app still looks like this, because of course it does:

app.route({
  method: "GET",
  path: "/health",
  operationId: "health",
  responses: {
    200: { description: "OK", body: z.object({ status: z.literal("ok") }) },
  },
  handler: async () => ({ status: 200, body: { status: "ok" } }),
});

How to get it

We published 1.0.0-beta.0 to the latest tag on npm and to JSR, in lockstep across @daloyjs/core, create-daloy, and @daloyjs/daloy. So a plain install gets you the beta with no special incantation:

# Scaffold a fresh project on the beta
pnpm create daloy@latest my-api

# Or add the core to an existing project
npm i @daloyjs/core
pnpm add @daloyjs/core

# Pin it explicitly if you like being specific
npm i @daloyjs/core@1.0.0-beta.0

Quick aside, because I almost did the clever thing here. The instinct with a beta is to hide it behind a beta dist-tag so that a normal npm i keeps handing people the last stable release. That is the responsible move when you have users who did not ask to be guinea pigs. We do not have that problem yet. We have the opposite problem: zero users to surprise, and a lot of people to win over. Parking the beta in a corner where nobody trips over it would have been the cautious choice and also the useless one. So it goes to latest. Come trip over it.

What I actually want from you

A beta is not a victory lap, it is a request for evidence. The best possible outcome for the next few weeks is that someone builds a real thing on 1.0.0-beta.0 and finds the rough edge I missed. File the bug. Tell me the API name that reads wrong. Show me the adapter that behaves differently than the docs claim. That is the entire point of shipping a beta instead of just tagging 1.0.0 and praying.

If you want the full picture before you dive in, the case for using DaloyJS today covers the why, and Secure by Default covers the defenses you inherit on the very first route. Then go run pnpm create daloy@latest and report back.

One small, slightly emotional note to close on. Tagging a 1.0 beta, even a boring one, is the part of a project where it stops being a thing I am tinkering with and starts being a thing other people are allowed to depend on. That is terrifying in the good way. Thanks for being early.