DEV Community: Daloy JS

Why DaloyJS Is the Best Backend (or BFF) for Your Electron App

Daloy JS — Fri, 05 Jun 2026 12:44:25 +0000

If you've ever built an Electron app that needs a backend, you know the problem. You want something lightweight, something that runs on Node, something where you don't spend three hours configuring Swagger, and something that doesn't make you feel like you're setting up a microservices architecture just to expose two endpoints to your own desktop UI.

I've shipped Electron apps with Express. I've tried Fastify. Both work, but they leave you doing a lot of plumbing yourself. Then I found DaloyJS, and honestly, it clicked.

The Electron Backend Problem

Here's the thing about Electron: your renderer process is basically a browser, and your main process is a Node.js server. When you need data from external APIs, or you need a clean layer between your UI and your business logic, you want a BFF, a Backend for Frontend. A thin server that composes upstream calls, holds the session, and returns exactly the shape your UI needs.

DaloyJS was built for this role. The docs even say so plainly: typed upstream client, fetchGuard for safe egress, session handling, and edge runtime support. That combination is exactly the BFF toolkit.

Contract-First Means Less Glue

The killer feature for desktop apps is contract-first routing. You define a route once, and DaloyJS gives you validation, OpenAPI 3.1 docs, and a typed in-process client all from the same source. No stale spec files. No writing types by hand.

Here's what a basic Electron BFF route looks like:

import { z } from "zod";
import { App, requestId, secureHeaders, rateLimit } from "@daloyjs/core";
import { serve } from "@daloyjs/core/node";

const app = new App({
  bodyLimitBytes: 1 << 20,
  requestTimeoutMs: 5_000,
  docs: true, // auto-mounts /docs and /openapi.json
});

app.use(requestId());
app.use(secureHeaders());
app.use(rateLimit({ windowMs: 60_000, max: 120 }));

app.route({
  method: "GET",
  path: "/settings/:userId",
  operationId: "getUserSettings",
  request: { params: z.object({ userId: z.string() }) },
  responses: {
    200: {
      description: "OK",
      body: z.object({ theme: z.string(), language: z.string() }),
    },
  },
  handler: async ({ params }) => ({
    status: 200,
    body: { theme: "dark", language: "en" },
  }),
});

serve(app, { port: 3123 });

From the renderer, you call it with a typed client. No fetch boilerplate, no guessing the response shape:

import { createClient } from "@daloyjs/core/client";

const client = createClient(app, { baseUrl: "http://localhost:3123" });
const result = await client.getUserSettings({ params: { userId: "me" } });
// result.body is fully typed: { theme: string, language: string }

That's the whole loop. One definition, end-to-end types.

Secure by Default, Which Matters More Than You Think

Desktop apps often access local files, internal network APIs, and cloud services at the same time. That's a juicy attack surface if your BFF is careless. DaloyJS starts with prototype-pollution-safe JSON parsing, built-in load shedding, automatic 5xx info-disclosure stripping in production, and fetchGuard that blocks SSRF and cloud-metadata IPs by default. I learned the hard way on a previous job that "just use Express" means you're also responsible for all that yourself.

Scaffold and Go

Getting started takes one command:

pnpm create daloy@latest my-electron-api

The scaffold drops in a hardened .npmrc (blocked install scripts, 24h release-age cooldown, source-verified lockfiles) plus an AGENTS.md so your coding assistant actually understands the project conventions. For a solo dev building a desktop app on the side, that's a lot of boilerplate you never have to write.

The Bottom Line

DaloyJS is not trying to be the next Express. It's trying to remove the glue between the best ideas in the ecosystem: FastAPI-style docs, Hono-style portability, Fastify-style ops, and Elysia-level typing. For an Electron BFF running on Node, that combination is hard to beat. You get a typed contract, security defaults you'd otherwise forget, and auto-generated docs your future self will thank you for.

Start with pnpm create daloy@latest, wire it to your renderer, and stop writing boilerplate.

Why DaloyJS Is the Backend Your Tauri v2 Mobile App Deserves

Daloy JS — Thu, 04 Jun 2026 12:30:36 +0000

If you're building a cross-platform app in Tauri v2 targeting both Android and iOS, you already made one smart decision: Rust for the shell, web tech for the UI, no Electron-sized download. Now you need a backend (or a BFF to front your internal services), and this is where most people make the regrettable choice of "just Express, it'll be fine."

It will not be fine. I've shipped this pattern. It starts clean and ends with a routes/index.js that nobody touches because nobody knows what it does anymore.

DaloyJS is a TypeScript REST framework built around one core idea: define the route once, get everything else for free. Validation, OpenAPI 3.1 docs, a typed client, and a hardened security baseline all come from a single route declaration. No stitching, no stale Swagger files, no "oh the schema and the handler drifted again."

The BFF Match Is Almost Too Good

The docs describe the BFF pattern as "arguably where DaloyJS is at its best," and after reading through the framework, I believe it. A Tauri v2 mobile app needs a backend layer that: handles session state cleanly, fans out to internal or third-party services, and returns exactly the shape the UI needs, not everything from the database. DaloyJS ships all of this as first-party pieces: session(), csrf(), fetchGuard() (which blocks SSRF and private-CIDR calls by default), and typed upstream clients via Hey API codegen.

The typed client part is where I'd have saved two weeks at a previous job. You run pnpm gen, and your Tauri app's frontend gets a fully typed fetch SDK generated from your actual OpenAPI spec. No copy-pasted types, no "wait, did we change that field?"

Here's a minimal BFF route that would serve a Tauri mobile app's product screen:

import { z } from "zod";
import { App, requestId, secureHeaders, rateLimit } from "@daloyjs/core";
import { serve } from "@daloyjs/core/node";

const app = new App({
  bodyLimitBytes: 1 << 20,
  requestTimeoutMs: 5_000,
  openapi: { info: { title: "My App BFF", version: "1.0.0" } },
  docs: true, // mounts GET /docs and GET /openapi.json automatically
});

app.use(requestId());
app.use(secureHeaders());
app.use(rateLimit({ windowMs: 60_000, max: 120 }));

app.route({
  method: "GET",
  path: "/products/:id",
  operationId: "getProduct",
  tags: ["Products"],
  request: {
    params: z.object({ id: z.string().uuid() }),
  },
  responses: {
    200: {
      description: "Product found",
      body: z.object({
        id: z.string(),
        name: z.string(),
        price: z.number(),
      }),
    },
    404: { description: "Not found" },
  },
  handler: async ({ params }) => ({
    status: 200,
    body: { id: params.id, name: "Wireless Headphones", price: 79.99 },
  }),
});

serve(app, { port: 3000 });

One route definition. Validation, OpenAPI, typed handler, and the docs UI at /docs, no extra wiring needed.

Security Is the Default, Not the Checklist

Mobile apps are not browsers. Your Tauri Android and iOS clients are talking to your backend over networks you don't control. DaloyJS starts with prototype-pollution-safe JSON parsing, automatic 5xx info-disclosure stripping in production, and built-in load shedding. You don't need to remember to add these. They're already there.

For a BFF specifically, the fetchGuard() middleware is worth calling out: it blocks outbound calls to private CIDRs and cloud-metadata endpoints by default. I learned the hard way (in a previous job, not a fun postmortem) that SSRF via a BFF is a real attack surface. Here, the safe path is the default path.

Runtime Portability Is Not Just a Bullet Point

The DaloyJS core only knows Request and Response. The same app runs on Node, Bun, Deno, Cloudflare Workers, and Vercel Edge by swapping the adapter import. For a Tauri app in early stages, you might start on Node. When you need to scale or cut cold start times for mobile users in Southeast Asia (hi, my target market), you move to Cloudflare Workers without rewriting your routes.

That's the kind of architectural flexibility that makes a framework worth investing in.

Check out daloyjs.dev and scaffold your first project with pnpm create daloy@latest my-bff.

Why DaloyJS Is the Perfect Backend for Your Lynx App

Daloy JS — Wed, 03 Jun 2026 12:48:12 +0000

If you're building a cross-platform mobile app with Lynx, you already made a smart call. Write once in React-style components, get native rendering on iOS and Android. Clean. But now you need a backend, or more specifically, a BFF (Backend for Frontend), and that choice matters more than most people think.

I've shipped backends in Express, Fastify, and a few others I'd rather not name. Here's why I'd pick DaloyJS for a Lynx project today.

One Contract, No Surprises

The biggest headache in mobile development is API drift: the backend changes a response shape, the app breaks, and nobody catches it until a user screenshots a crash. DaloyJS solves this at the source. You define the route once, and validation, OpenAPI 3.1 docs, and a typed client all come from that same definition. Nothing to keep in sync.

import { z } from "zod";
import { App, requestId, secureHeaders, rateLimit } from "@daloyjs/core";
import { serve } from "@daloyjs/core/node";

const app = new App({
  bodyLimitBytes: 64 * 1024,
  requestTimeoutMs: 5_000,
  openapi: { info: { title: "Lynx App API", version: "1.0.0" } },
  docs: true,
});

app.use(requestId());
app.use(secureHeaders());
app.use(rateLimit({ windowMs: 60_000, max: 120 }));

app.route({
  method: "GET",
  path: "/feed/:userId",
  operationId: "getUserFeed",
  tags: ["Feed"],
  request: { params: z.object({ userId: z.string().uuid() }) },
  responses: {
    200: {
      description: "User feed",
      body: z.object({
        items: z.array(z.object({ id: z.string(), title: z.string() })),
      }),
    },
    404: { description: "User not found" },
  },
  handler: async ({ params }) => ({
    status: 200,
    body: { items: [{ id: "1", title: `Feed for ${params.userId}` }] },
  }),
});

serve(app, { port: 3000 });

That's it. Hit http://localhost:3000/docs and you have a live Scalar API reference. Your Lynx app gets a typed SDK with pnpm gen. No manual swagger files. No stale docs.

Built for the BFF Role

DaloyJS explicitly calls out BFF as one of its sweet spots, and the kit it ships proves it. fetchGuard() blocks SSRF and private network calls by default. Session management with signed cookies is first-party. Rate limiting works out of the box. These are exactly the concerns a BFF sitting between your Lynx app and your internal services has to handle, and here they're already handled.

Deploy Anywhere, Stay Consistent

Lynx targets iOS and Android. Your backend has to be reliable and fast. DaloyJS runs on Node, Bun, Deno, Cloudflare Workers, Vercel Edge, and AWS Lambda, same app code, different adapter. I've personally appreciated this when a project's infrastructure changed mid-flight. (It happens more than anyone admits in retrospect.)

Security Without the Ceremony

Most frameworks treat security as optional configuration you add later and then forget. DaloyJS ships with prototype-pollution-safe JSON, automatic 5xx info-disclosure stripping in production, and a hardened pnpm scaffold with ignore-scripts=true and a 24-hour release-age cooldown. For a mobile app touching real user data, this isn't optional, it's the baseline.

The Bottom Line

Lynx gives your mobile app native performance with web-friendly code. DaloyJS gives your backend contract-first discipline, typed clients, edge-ready deployment, and security defaults that don't require a second pass. The two pair naturally. Scaffold with pnpm create daloy@latest my-lynx-api, wire up your Lynx frontend to the generated typed client, and you have a stack worth shipping.

DaloyJS is MIT licensed. The name means "flow" in Tagalog. Fitting, given how little glue code you end up writing.

DaloyJS Is the Backend Your React Native and Expo App Deserves

Daloy JS — Tue, 02 Jun 2026 12:32:43 +0000

If you've built a React Native or Expo app before, you know the pain: the mobile side looks good, the UX flows well, and then you have to wire up a backend. Suddenly you're choosing between Express (fine but naked), Fastify (great but verbose), or something else that makes you write "boilerplate glue" for the next three days before writing a single real endpoint.

I've been in that situation more than once. And when I found DaloyJS, I felt a bit embarrassed at how much time I had wasted.

One Route Definition, Everything You Need

The core idea in DaloyJS is contract-first routing. You define a route once using a Zod schema, and the framework gives you validation, types, OpenAPI 3.1 docs, and a typed client. No separate spec file. No drift between what the backend returns and what the frontend expects.

Here is a real example you could drop into a BFF (Backend for Frontend) serving a React Native screen:

import { z } from "zod";
import { App, requestId, secureHeaders, rateLimit } from "@daloyjs/core";
import { serve } from "@daloyjs/core/node";

const app = new App({ bodyLimitBytes: 1 << 20, requestTimeoutMs: 5_000 });

app.use(requestId());
app.use(secureHeaders());
app.use(rateLimit({ windowMs: 60_000, max: 120 }));

app.route({
  method: "GET",
  path: "/user/:id",
  operationId: "getUserById",
  request: { params: z.object({ id: z.string().uuid() }) },
  responses: {
    200: {
      description: "User found",
      body: z.object({ id: z.string(), name: z.string(), avatarUrl: z.string().url() }),
    },
    404: { description: "Not found" },
  },
  handler: async ({ params }) => ({
    status: 200,
    body: { id: params.id, name: "Maria Santos", avatarUrl: "https://cdn.example.com/avatar.jpg" },
  }),
});

serve(app, { port: 3000 });

Notice what you did not have to write: a separate OpenAPI file, a validation middleware, a custom error handler for bad UUIDs. DaloyJS handles all of that.

The Typed Client Is the Real Game-Changer

For React Native and Expo apps living in a monorepo, DaloyJS's in-process typed client means your mobile code calls the backend with full TypeScript inference, zero codegen:

import { createClient } from "@daloyjs/core/client";
import { app } from "./server.js";

const client = createClient(app, { baseUrl: "https://api.yourapp.com" });

const r = await client.getUserById({ params: { id: "some-uuid" } });
if (r.status === 200) {
  console.log(r.body.name); // TypeScript knows this is a string
}

No hand-maintained types. No guessing what the API returns at 11pm before a release.

Security Without the Extra Homework

The framework ships with secureHeaders, rate limiting, and prototype-pollution-safe JSON out of the box. For a mobile app backend that sits on the open internet, those are not optional. With DaloyJS, they are not an afterthought either.

Run It Anywhere

DaloyJS runs on Node, Bun, Deno, Cloudflare Workers, and Vercel Edge. That means your Expo app's BFF can start on a simple VPS and migrate to edge functions later without rewriting the app logic.

"Daloy" means flow in Tagalog. After shipping it in a side project, that name feels right. The code flows. The types flow. The deployment flows. Honestly, I wish I had this ten years ago.

Why DaloyJS Is the Right Backend (or BFF) for Your NativeScript App

Daloy JS — Mon, 01 Jun 2026 21:46:42 +0000

If you've shipped a NativeScript app before, you know the backend story can get messy fast. You need typed contracts, clean API docs your mobile team can actually consume, and something that doesn't fall apart when you move between runtimes. DaloyJS handles all of that without making you feel like you're assembling IKEA furniture without the manual.

The Contract-First Win

The biggest win for a NativeScript setup is contract-first routing. You define a route once, and you automatically get Zod validation, OpenAPI 3.1 docs, and a fully typed Hey API client.

That last part is the important one: run pnpm gen and your NativeScript app gets a typed fetch SDK generated directly from your real spec, not some hand-maintained wrapper you'll forget to update three sprints from now. I've learned the hard way that stale API clients in mobile apps are a gift that keeps giving, and not in a good way.

Here's what a single route definition looks like. This one call is all you need to get validation, types, OpenAPI docs, and a client:

import { z } from "zod";
import { App, secureHeaders, rateLimit, requestId } from "@daloyjs/core";
import { serve } from "@daloyjs/core/node";

const app = new App({ bodyLimitBytes: 1 << 20, requestTimeoutMs: 5_000 });

app.use(requestId());
app.use(secureHeaders());
app.use(rateLimit({ windowMs: 60_000, max: 120 }));

app.route({
  method: "GET",
  path: "/books/:id",
  operationId: "getBookById",
  request: { params: z.object({ id: z.string() }) },
  responses: {
    200: {
      description: "\"Found\","
      body: z.object({ id: z.string(), title: "z.string() }),"
    },
    404: { description: "\"Not found\" },"
  },
  handler: async ({ params }) => ({
    status: 200,
    body: { id: params.id, title: "`Book ${params.id}` },"
  }),
});

serve(app, { port: 3000 });

One route definition. That's your validation, your OpenAPI 3.1 spec, your Scalar docs at /docs, and the typed client your NativeScript app will consume. No drift, no ceremony.

Runtime Portability for BFF Patterns

DaloyJS runs on Node, Bun, Deno, Cloudflare Workers, and Vercel Edge with the same app and the same tests. For a NativeScript BFF, this matters: you can push the BFF to the edge and have it geographically close to your mobile users without rewriting anything.

// Same app, different adapter. That's it.

// Node
import { serve } from "@daloyjs/core/node";
serve(app, { port: 3000 });

// Cloudflare Workers (edge, close to your NativeScript users)
import { handler } from "@daloyjs/core/cloudflare";
export default { fetch: handler(app) };

Security Defaults That Actually Ship

Mobile apps hit public APIs constantly, and "I'll harden it later" is not a real plan. DaloyJS scaffolds your project with:

Blocked install scripts (ignore-scripts=true in .npmrc)
A 24-hour release-age cooldown on fresh packages
Source-verified lockfiles
Prototype-pollution-safe JSON parsing
Built-in rate limiting and secureHeaders() middleware
Automatic info-disclosure stripping in production

You get all of this from the first pnpm create daloy@latest my-api. No checklist, no "Phase 2 hardening sprint."

One Line for Instant API Docs

The docs: true flag auto-mounts a Scalar API reference at /docs and the live OpenAPI 3.1 spec at /openapi.json. Your iOS and Android developers will thank you for this, probably silently, but still.

const app = new App({
  docs: true, // That's it. /docs is live.
  bodyLimitBytes: 1 << 20,
  requestTimeoutMs: 5_000,
});

The Short Version

For a NativeScript backend or BFF, DaloyJS gives you the OpenAPI ergonomics you'd want from FastAPI, the runtime portability of Hono, and supply-chain hygiene that most teams bolt on too late. It's a solid choice. I say that as someone who has shipped the less solid choices first.