If you're building a cross-platform app in Tauri v2 targeting both Android and iOS, you already made one smart decision: Rust for the shell, web tech for the UI, no Electron-sized download. Now you need a backend (or a BFF to front your internal services), and this is where most people make the regrettable choice of "just Express, it'll be fine."
It will not be fine. I've shipped this pattern. It starts clean and ends with a routes/index.js that nobody touches because nobody knows what it does anymore.
DaloyJS is a TypeScript REST framework built around one core idea: define the route once, get everything else for free. Validation, OpenAPI 3.1 docs, a typed client, and a hardened security baseline all come from a single route declaration. No stitching, no stale Swagger files, no "oh the schema and the handler drifted again."
The BFF Match Is Almost Too Good
The docs describe the BFF pattern as "arguably where DaloyJS is at its best," and after reading through the framework, I believe it. A Tauri v2 mobile app needs a backend layer that: handles session state cleanly, fans out to internal or third-party services, and returns exactly the shape the UI needs, not everything from the database. DaloyJS ships all of this as first-party pieces: session(), csrf(), fetchGuard() (which blocks SSRF and private-CIDR calls by default), and typed upstream clients via Hey API codegen.
