Generate REST API with Express/Fastify, OpenAPI spec, validation, tests. Use when user asks to "scaffold a REST API".
From sovereign-architectnpx claudepluginhub javimontano/mao-sovereign-architectThis skill is limited to using the following tools:
agents/api-scaffolder-agent.mdagents/api-security-auditor-agent.mdagents/openapi-spec-agent.mdevals/evals.jsonexamples/sample-output.mdprompts/use-case-prompts.mdreferences/body-of-knowledge.mdreferences/knowledge-graph.mmdreferences/state-of-the-art.mdGenerate production-ready REST API with TypeScript, OpenAPI 3.1, Zod validation, JWT auth, database integration, and comprehensive testing.
"API-first design produces better contracts and happier consumers. Write the OpenAPI spec before the handler. The spec is the source of truth — the implementation is the proof."
GET /users, POST /users, GET /users/:id, etc. Document as OpenAPI YAML before writing a single handler.@fastify/swagger) or Express 5 + express-openapi-validator.strict: true, moduleResolution: Bundler, target: ES2022.src/routes/, src/handlers/, src/services/, src/db/, src/schemas/, src/middleware/, src/types/.src/config.ts with Zod schema for all env variables. Fail fast on startup if missing.tsup (or tsc) for compilation. Configure tsx or ts-node for development with --watch.@typescript-eslint/strict, no-console warning, @typescript-eslint/no-floating-promises as error.openapi.yaml (or use code-first via @fastify/swagger): define all paths, request bodies, response schemas, security schemes.openapi-typescript — these become the canonical types for handlers and tests.Authorization: Bearer <token>, attach req.user to request context.@fastify/rate-limit (Fastify) or express-rate-limit (Express). Default: 100 req/min per IP.helmet for Express; @fastify/helmet for Fastify. Set CSP, HSTS, X-Frame-Options.pino for Fastify (built-in), or pino with pino-http for Express. Never console.log.GET /health returns { status: 'ok', uptime: number, version: string }. No auth required.supertest (Express) or Fastify's inject() method. Test real route handlers with mocked services.openapi-backend or prism to validate responses against the OpenAPI spec.Dockerfile multi-stage: build TypeScript → copy only dist/ + node_modules (production only) to runner stage.| Decision | Default | Alternative | When to Switch |
|---|---|---|---|
| Framework | Fastify 4 | Express 5 | Team knows Express; existing Express codebase |
| Validation | Zod | Joi, yup | Legacy Joi codebase |
| ORM | Drizzle ORM | Prisma | Team prefers Prisma's DX |
| Auth | JWT (jsonwebtoken) | Paseto | Stronger security guarantees needed |
| Logging | pino | winston | Winston already in use; rich plugin ecosystem |
| Testing | Vitest + supertest | Jest + supertest | Jest already in project |
| API spec | OpenAPI 3.1 YAML | Swagger 2.0 | Legacy clients require Swagger 2.0 |
| Rate limiting | @fastify/rate-limit | Redis-backed rate limit | Multi-instance deployment |
| Documentation | Scalar UI | Swagger UI | Team prefers Swagger UI |
| Process manager | PM2 (prod) | systemd | Linux systemd deployment |
npm run build exits 0 with zero TypeScript errors.GET /health returns 200 with no authentication required.{ error: string, code: string, details?: object }.@fastify/swagger) or spec-first (via openapi-typescript) so it's always in sync.scaffold-api-graphql).Designs and optimizes AI agent action spaces, tool definitions, observation formats, error recovery, and context for higher task completion rates.