Deployment readiness

The current package is 1.0.0-rc.1, not a stable 1.0 production-support promise. Evaluate the selected APIs and adapters in staging before deploying them. See support levels.

Build and dependencies

Use Node >=22.17.0, npm >=9 and a committed lockfile. Install with npm ci, compile your ESM application and test the installed package rather than repository-relative imports. Build browser assets through the browser entry point. Do not ship development watchers or provider credentials to the browser.

Request security and isolation

• Authenticate and authorize explicitly; tenant routing alone does neither.
• Use per-request containers; do not share mutable user state globally.
• Configure CSP/security headers for your actual assets and embedding policy.
• Use HTTPS, appropriately scoped secure cookies, and CSRF protection for cookie-authenticated unsafe requests.
• Bound body/upload size, time and concurrency; validate request shape before effects.
• Back multi-instance rate limits with a store supporting atomic increments.
• Keep private, cookie-setting, varied or credentialed responses out of shared caches.
• Store secrets in appropriate secret providers and redact logs/config diagnostics.

Use the composition recipe and server helpers, adjusting illustrative values to your app.

Operations

Define startup/readiness checks for databases, queues and other required services. Apply migrations through an intentional deployment step and keep backup/rollback procedures. Test database adapter behavior against real services. Drain traffic, stop workers and timers, close owned connections and flush telemetry during shutdown; do not assume one framework call closes every resource.

import { initializeTelemetry, shutdownTelemetry } from '@tagna/udiot/telemetry';

initializeTelemetry();
await shutdownTelemetry();

Configure real exporters in the application; this example only checks lifecycle calls. Confirm delivery, retention and redaction separately.

Release gates for your application

Run functional, integration, browser and negative security tests; verify packed imports and real deployment artifacts. Observe a staged rollout and keep a known-good version/lockfile available for rollback. RC support is maintainer-led; there is no implied 24/7 support team or response-time SLA.