mir-backend-node-expresslisted

Make It Right (Express module). Express 5 (now the npm default) + Express 4 maintenance-line reliability augmentation. Use alongside mir-backend and mir-backend-node when the target stack is Express — it carries the mechanical footguns that the framework-agnostic tiers deliberately omit: what Express 5 does and does not auto-catch for async handlers, the path-to-regexp route-syntax break that makes `app.get('*')` throw at boot, req.body being undefined rather than {}, the simple-vs-extended query parser change, middleware ordering as a hard contract, error-handler arity, the absence of built-in validation and what fills the gap, CORS/helmet/rate-limit being off by default, trust-proxy spoofing, and object-level authorization gaps that structural frameworks catch but Express doesn't. TRIGGER only when the Node backend stack is Express used directly — building, reviewing, or debugging an Express route, middleware, or error handler. Always loads TOGETHER WITH mir-backend (the gates) and mir-backend-node (V8 even
anantbhandarkar/make-it-right · ★ 15 · API & Backend · score 81

Install: claude install-skill anantbhandarkar/make-it-right

# /mir-backend-node-express · Make It Right (Express) Bottom tier of the chain: `mir-backend` (generic gates) → `mir-backend-node` (V8/Node event-loop model) → **this** (Express library mechanics). Run the gates first; load the Node runtime tier for event-loop and process-model concerns; reach for *this* at Gate 5 (design mechanics), Gate 6 (implementation), and Gate 7 review. **Runtime-level concerns (blocking the event loop, worker_threads, unhandled rejections, stream backpressure, timeouts, heap limits, npm supply chain) live in `mir-backend-node` — not here.** **Stack assumed (npm registry, 13 Aug 2026):** `express@5.2.1` is the `latest` tag; the 4.x maintenance line is `latest-4` = `4.22.2`. Express 5 requires Node ≥ 18 by its own `engines` field, but target Node 22/24 per the runtime tier — Node 20 is EOL. Do not pin `5.2.0`: it shipped an unintended breaking change to extended query parsing and was superseded by `5.2.1` the same day. **If you are writing new Express code, write Express 5.** `npm install express` has resolved to 5.x since 5.1.0 took the `latest` tag on 2025-03-31. Most training data — and most AI output — is still Express 4, which is where the next four items come from. ## The Express footguns AI walks into most ### 1. Express 5 auto-forwards rejected promises — Express 4 does not, and neither catches callbacks **Express 5** awaits the promise returned by a route handler **or by any middleware**, and forwards a rejection to the error-handling mid