create-exts-app 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,117 @@
+# create-exts-app
+
+A CLI to scaffold a production-ready **Express + TypeScript** API in seconds — no configuration required.
+
+[![npm version](https://img.shields.io/npm/v/create-exts-app.svg)](https://www.npmjs.com/package/create-exts-app)
+[![license](https://img.shields.io/npm/l/create-exts-app.svg)](./LICENSE)
+[![node](https://img.shields.io/node/v/create-exts-app.svg)](https://nodejs.org)
+
+## Quick Start
+
+```bash
+npx create-exts-app my-api
+cd my-api
+npm run dev
+```
+
+That's it — you have a running Express + TypeScript server with hot reload.
+
+You can also run it without a project name to get interactive prompts:
+
+```bash
+npx create-exts-app
+```
+
+## Features
+
+- ⚡ **Three template variants** — pick exactly the amount of tooling you need
+- 🧭 **Interactive setup** — guided prompts when you don't pass flags
+- 🧹 **Built-in tooling** — ESLint, Prettier, Husky, lint-staged, Vitest
+- 🐳 **Optional Docker support** — Dockerfile + docker-compose on request
+- 🔐 **Production-ready middleware** (advanced template) — Helmet, CORS, rate limiting, structured logging with Pino, Zod validation, Swagger docs
+- 🔧 **CI/CD included** (advanced template) — GitHub Actions workflows for CI and release
+- 📦 **Modern ESM** — native ES modules, `tsx` for dev, path aliases where applicable
+- 🚀 **Zero config** — one command, working project
+
+## Templates
+
+| Template   | Includes |
+|------------|----------|
+| `minimal`  | Express + TypeScript only. Nothing else. |
+| `standard` | + ESLint, Prettier, Husky, lint-staged, Vitest, Supertest |
+| `advanced` | + Docker, Swagger (OpenAPI), Zod validation, Pino logging, Helmet, CORS, rate limiting, GitHub Actions CI/CD |
+
+Choose one with `-t`/`--template`, or pick interactively if you omit it.
+
+## Usage
+
+```bash
+npx create-exts-app <project-name> [options]
+```
+
+### Options
+
+| Flag | Description | Default |
+|------|-------------|---------|
+| `-t, --template <type>` | Template to use: `minimal`, `standard`, or `advanced` | `standard` |
+| `--docker` | Include Docker setup (`standard`/`advanced` only) | `false` |
+| `--skip-git` | Skip `git init` | `false` |
+| `--skip-install` | Skip `npm install` after scaffolding | `false` |
+| `-V, --version` | Print the CLI version | — |
+| `-h, --help` | Show help | — |
+
+### Examples
+
+```bash
+# Interactive mode — prompts for name, template, and Docker
+npx create-exts-app
+
+# Standard template (default), skip Docker prompt entirely
+npx create-exts-app my-api
+
+# Advanced template with Docker included
+npx create-exts-app my-api --template advanced --docker
+
+# Minimal template, no git repo, no auto-install
+npx create-exts-app my-api --template minimal --skip-git --skip-install
+```
+
+## What You Get
+
+```
+my-api/
+├── src/
+│   ├── index.ts          # Entry point
+│   ├── app.ts            # Express app setup
+│   ├── config/           # Env, logger, Swagger (standard/advanced)
+│   ├── middleware/        # Security, error handling, validation (advanced)
+│   └── routes/            # API routes (advanced)
+├── tests/                 # Vitest + Supertest (standard/advanced)
+├── package.json
+├── tsconfig.json
+└── ...tooling configs (ESLint, Prettier, Husky, Docker, CI)
+```
+
+Once inside your generated project, the standard commands are available:
+
+| Command | Description |
+|---------|-------------|
+| `npm run dev` | Start the dev server with hot reload |
+| `npm run build` | Compile TypeScript to `dist/` |
+| `npm start` | Run the compiled production build |
+| `npm test` | Run tests (standard/advanced) |
+| `npm run lint` | Lint the source (standard/advanced) |
+| `npm run format` | Format with Prettier (standard/advanced) |
+
+## Requirements
+
+- Node.js `>= 20.0.0`
+- npm (or your package manager of choice, after scaffolding)
+
+## Contributing
+
+Issues and pull requests are welcome. If you're proposing a larger change (a new template, a new flag), open an issue first to discuss it.
+
+## License
+
+MIT © [Mohammad Hossein Noughabi](https://www.npmjs.com/mohammadnoughabi)

package/bin/cli.js

@@ -0,0 +1,212 @@
+#!/usr/bin/env node
+
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { existsSync, readFileSync, writeFileSync, cpSync, mkdirSync, rmSync } from 'node:fs';
+import { execSync } from 'node:child_process';
+
+import { Command } from 'commander';
+import inquirer from 'inquirer';
+import chalk from 'chalk';
+import ora from 'ora';
+import figlet from 'figlet';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const program = new Command();
+
+program
+  .name('create-exts-app')
+  .description('Scaffold a production-ready Express + TypeScript API')
+  .version('1.0.0')
+  .argument('[project-name]', 'Name of your project')
+  .option('-t, --template <type>', 'Template variant', 'standard')
+  .option('--skip-git', 'Skip Git initialization')
+  .option('--skip-install', 'Skip dependency installation')
+  .option('--docker', 'Include Docker setup')
+  .action(async (projectName, options) => {
+    // Interactive prompts if name not provided
+    if (!projectName) {
+      const answers = await inquirer.prompt([
+        {
+          type: 'input',
+          name: 'name',
+          message: 'Project name:',
+          validate: (input) => input.trim() !== '' || 'Name is required',
+        },
+        {
+          type: 'list',
+          name: 'template',
+          message: 'Choose a template:',
+          choices: [
+            { name: 'Minimal    (Express + TS only)', value: 'minimal' },
+            { name: 'Standard   (+ ESLint, Prettier, Vitest, Husky)', value: 'standard' },
+            { name: 'Advanced   (+ Docker, Swagger, Zod, Pino, CI/CD)', value: 'advanced' },
+          ],
+          default: 'standard',
+        },
+        {
+          type: 'confirm',
+          name: 'docker',
+          message: 'Include Docker setup?',
+          default: false,
+          when: (ans) => ans.template !== 'minimal',
+        },
+      ]);
+      projectName = answers.name;
+      options.template = answers.template;
+      if (answers.docker !== undefined) options.docker = answers.docker;
+    }
+
+    const targetDir = join(process.cwd(), projectName);
+
+    if (existsSync(targetDir)) {
+      console.error(chalk.red(`\n❌ Directory "${projectName}" already exists.\n`));
+      process.exit(1);
+    }
+
+    // Fancy header
+    console.log(chalk.cyan(figlet.textSync('Express TS', { font: 'Small' })));
+    console.log(chalk.gray('Scaffolding your project...\n'));
+
+    // Step 1: Copy template
+    const spinner = ora('Copying template files...').start();
+    const templateDir = join(__dirname, '..', 'templates', options.template);
+
+    if (!existsSync(templateDir)) {
+      spinner.fail(chalk.red(`Template "${options.template}" not found.`));
+      process.exit(1);
+    }
+
+    mkdirSync(targetDir, { recursive: true });
+    cpSync(templateDir, targetDir, { recursive: true });
+    spinner.succeed('Template files copied');
+
+    // Step 2: Update package.json name
+    const pkgPath = join(targetDir, 'package.json');
+    const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
+    pkg.name = projectName;
+    writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\n');
+
+    // Step 3: Conditional Docker files
+    if (!options.docker) {
+      const dockerFiles = ['Dockerfile', 'docker-compose.yml', '.dockerignore'];
+      dockerFiles.forEach((f) => {
+        const p = join(targetDir, f);
+        if (existsSync(p)) rmSync(p);
+      });
+    }
+
+    // Step 4: Git init
+    if (!options.skipGit) {
+      const gitSpinner = ora('Initializing Git repository...').start();
+      try {
+        execSync('git init', { cwd: targetDir, stdio: 'ignore' });
+        execSync('git checkout -b main', { cwd: targetDir, stdio: 'ignore' });
+        gitSpinner.succeed('Git repository initialized');
+      } catch {
+        gitSpinner.warn('Git initialization failed');
+      }
+    }
+
+    // Step 5: Install deps
+    if (!options.skipInstall) {
+      const installSpinner = ora('Installing dependencies...').start();
+      try {
+        execSync('npm install', { cwd: targetDir, stdio: 'ignore' });
+        installSpinner.succeed('Dependencies installed');
+      } catch {
+        installSpinner.warn('Dependency installation failed. Run `npm install` manually.');
+      }
+    }
+
+    // Step 6: Setup Husky (standard & advanced only)
+    if (!options.skipInstall && options.template !== 'minimal') {
+      const huskySpinner = ora('Setting up Git hooks...').start();
+      try {
+        execSync('npx husky init', { cwd: targetDir, stdio: 'ignore' });
+        const preCommit = join(targetDir, '.husky', 'pre-commit');
+        writeFileSync(preCommit, 'npx lint-staged\n', { mode: 0o755 });
+
+        // Pre-push for advanced
+        if (options.template === 'advanced') {
+          const prePush = join(targetDir, '.husky', 'pre-push');
+          writeFileSync(prePush, 'npm run test:run\n', { mode: 0o755 });
+        }
+        huskySpinner.succeed('Git hooks configured');
+      } catch {
+        huskySpinner.warn('Husky setup failed. Run `npx husky init` manually.');
+      }
+    }
+
+    // Step 7: Generate README for advanced
+    if (options.template === 'advanced') {
+      const readme = generateReadme(projectName, options);
+      writeFileSync(join(targetDir, 'README.md'), readme);
+    }
+
+    // Success message
+    console.log(chalk.green.bold(`\n✅ Successfully created ${projectName}\n`));
+    console.log(chalk.white('Get started:'));
+    console.log(chalk.cyan(`  cd ${projectName}`));
+    if (options.skipInstall) console.log(chalk.cyan('  npm install'));
+    console.log(chalk.cyan('  npm run dev'));
+    console.log(chalk.gray('\n📖 Read the README.md for more commands.\n'));
+  });
+
+function generateReadme(name, opts) {
+  return `# ${name}
+
+A production-ready Express + TypeScript API.
+
+## 🚀 Getting Started
+
+\`\`\`bash
+npm install
+npm run dev
+\`\`\`
+
+## 📜 Scripts
+
+| Command | Description |
+|---------|-------------|
+| \`npm run dev\` | Start development server with hot reload |
+| \`npm run build\` | Compile TypeScript to \`dist/\` |
+| \`npm run start\` | Run production build |
+| \`npm test\` | Run tests in watch mode |
+| \`npm run test:run\` | Run tests once |
+| \`npm run test:coverage\` | Run tests with coverage report |
+| \`npm run lint\` | Lint source files |
+| \`npm run lint:fix\` | Fix linting issues |
+| \`npm run format\` | Format code with Prettier |
+
+${opts.docker ? `## 🐳 Docker
+
+\`\`\`bash
+docker-compose up --build
+\`\`\`
+` : ''}
+## 📁 Project Structure
+
+\`\`\`
+src/
+├── config/        # Environment, logger, swagger
+├── middleware/    # Security, error handling, validation
+├── routes/        # API routes
+└── index.ts       # Entry point
+\`\`\`
+
+## 🔒 Environment Variables
+
+| Variable | Description | Default |
+|----------|-------------|---------|
+| \`NODE_ENV\` | Runtime environment | \`development\` |
+| \`PORT\` | Server port | \`3000\` |
+| \`LOG_LEVEL\` | Pino log level | \`info\` |
+
+## License
+
+MIT
+`;
+}
+
+program.parse();

package/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "create-exts-app",
+  "version": "1.0.0",
+  "description": "Scaffold a production-ready Express + TypeScript API with professional tooling",
+  "type": "module",
+  "bin": {
+    "create-exts-app": "bin/cli.js"
+  },
+  "files": [
+    "bin/",
+    "templates/"
+  ],
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "keywords": [
+    "express",
+    "typescript",
+    "boilerplate",
+    "scaffold",
+    "vitest",
+    "eslint",
+    "prettier",
+    "husky",
+    "cli"
+  ],
+  "author": "Your Name",
+  "license": "MIT",
+  "dependencies": {
+    "chalk": "^5.3.0",
+    "commander": "^12.0.0",
+    "figlet": "^1.7.0",
+    "inquirer": "^12.0.0",
+    "ora": "^8.0.0"
+  }
+}

package/templates/advanced/.dockerignore

@@ -0,0 +1,8 @@
+node_modules
+dist
+.git
+.env
+*.log
+coverage
+.vscode
+.github

package/templates/advanced/.editorconfig

@@ -0,0 +1,9 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_size = 2
+indent_style = space
+insert_final_newline = true
+trim_trailing_whitespace = true

package/templates/advanced/.gitattributes

@@ -0,0 +1 @@
+* text=auto eol=lf

package/templates/advanced/.github/workflows/ci.yml

@@ -0,0 +1,32 @@
+name: CI
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [22.x, 24.x, 26.x]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: 'npm'
+      - run: npm ci
+      - run: npm run lint
+      - run: npm run test:run
+      - run: npm run build
+
+  docker:
+    runs-on: ubuntu-latest
+    needs: test
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build Docker image
+        run: docker build -t myapp .

package/templates/advanced/.github/workflows/release.yml

@@ -0,0 +1,19 @@
+name: Release
+
+on:
+  push:
+    tags: ['v*']
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          registry-url: 'https://registry.npmjs.org'
+      - run: npm ci
+      - run: npm run build
+      - run: npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

package/templates/advanced/.husky/pre-commit

@@ -0,0 +1 @@
+npx lint-staged

package/templates/advanced/.husky/pre-push

@@ -0,0 +1 @@
+npm run test:run

package/templates/advanced/.vscode/extensions.json

@@ -0,0 +1,6 @@
+{
+  "recommendations": [
+    "dbaeumer.vscode-eslint",
+    "esbenp.prettier-vscode"
+  ]
+}

package/templates/advanced/.vscode/settings.json

@@ -0,0 +1,8 @@
+{
+  "editor.defaultFormatter": "esbenp.prettier-vscode",
+  "editor.formatOnSave": true,
+  "editor.codeActionsOnSave": {
+    "source.fixAll.eslint": "explicit"
+  },
+  "typescript.preferences.importModuleSpecifier": "relative"
+}

package/templates/advanced/Dockerfile

@@ -0,0 +1,17 @@
+# Build stage
+FROM node:24-alpine AS builder
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci
+COPY . .
+RUN npm run build
+
+# Production stage
+FROM node:24-alpine
+WORKDIR /app
+ENV NODE_ENV=production
+COPY package*.json ./
+RUN npm ci --omit=dev
+COPY --from=builder /app/dist ./dist
+EXPOSE 3000
+CMD ["node", "dist/index.js"]

package/templates/advanced/docker-compose.yml

@@ -0,0 +1,12 @@
+version: '3.8'
+
+services:
+  app:
+    build: .
+    ports:
+      - "3000:3000"
+    environment:
+      - NODE_ENV=production
+      - PORT=3000
+      - LOG_LEVEL=info
+    restart: unless-stopped

package/templates/advanced/eslint.config.mjs

@@ -0,0 +1,35 @@
+// @ts-check
+import js from '@eslint/js';
+import tseslint from 'typescript-eslint';
+import globals from 'globals';
+
+export default tseslint.config(
+  js.configs.recommended,
+  ...tseslint.configs.recommended,
+  ...tseslint.configs.recommendedTypeChecked,
+  {
+    languageOptions: {
+      parserOptions: {
+        projectService: true,
+        tsconfigDirName: import.meta.dirname,
+      },
+      globals: {
+        ...globals.node,
+        ...globals.es2024,
+      },
+    },
+    rules: {
+      '@typescript-eslint/no-unused-vars': [
+        'error',
+        { argsIgnorePattern: '^_', varsIgnorePattern: '^_' },
+      ],
+      '@typescript-eslint/explicit-function-return-type': 'off',
+      '@typescript-eslint/explicit-module-boundary-types': 'off',
+      'prefer-const': 'error',
+      'no-console': 'warn',
+    },
+  },
+  {
+    ignores: ['dist/', 'node_modules/', 'coverage/', '*.config.*'],
+  }
+);

package/templates/advanced/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "my-project",
+  "version": "1.0.0",
+  "description": "Production-ready Express + TypeScript API",
+  "type": "module",
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "scripts": {
+    "dev": "tsx watch src/index.ts",
+    "build": "tsc && tsc-alias",
+    "start": "node dist/index.js",
+    "test": "vitest",
+    "test:run": "vitest run",
+    "test:coverage": "vitest run --coverage",
+    "lint": "eslint src tests",
+    "lint:fix": "eslint src tests --fix",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "prepare": "husky"
+  },
+  "lint-staged": {
+    "*.{ts,tsx,js,jsx,mjs,cjs}": [
+      "eslint --fix",
+      "prettier --write"
+    ]
+  },
+  "dependencies": {
+    "cors": "^2.8.5",
+    "express": "^5.2.0",
+    "express-rate-limit": "^7.0.0",
+    "helmet": "^8.0.0",
+    "pino": "^9.0.0",
+    "pino-pretty": "^13.0.0",
+    "swagger-ui-express": "^5.0.0",
+    "zod": "^3.23.0"
+  },
+  "devDependencies": {
+    "@types/cors": "^2.8.0",
+    "@types/express": "^5.0.0",
+    "@types/node": "^22.0.0",
+    "@types/supertest": "^6.0.0",
+    "@types/swagger-ui-express": "^4.1.0",
+    "eslint": "^10.9.1",
+    "globals": "^15.0.0",
+    "husky": "^9.1.7",
+    "lint-staged": "^15.0.0",
+    "prettier": "^3.9.6",
+    "supertest": "^7.0.0",
+    "tsc-alias": "^1.8.0",
+    "tsx": "^4.0.0",
+    "typescript": "^5.7.0",
+    "typescript-eslint": "^8.0.0",
+    "vitest": "^4.1.11"
+  }
+}

package/templates/advanced/prettier.config.mjs

@@ -0,0 +1,10 @@
+/** @type {import("prettier").Config} */
+export default {
+  semi: true,
+  trailingComma: 'all',
+  singleQuote: true,
+  printWidth: 100,
+  tabWidth: 2,
+  useTabs: false,
+  endOfLine: 'lf',
+};

package/templates/advanced/src/app.ts

@@ -0,0 +1,20 @@
+import express from 'express';
+import { applySecurityMiddleware } from '@middleware/security.js';
+import { errorHandler } from '@middleware/errorHandler.js';
+import { setupSwagger } from '@config/swagger.js';
+import healthRouter from '@routes/health.js';
+
+export const app = express();
+
+app.use(express.json());
+
+applySecurityMiddleware(app);
+setupSwagger(app);
+
+app.use('/health', healthRouter);
+
+app.use((_req, res) => {
+  res.status(404).json({ success: false, error: { message: 'Not found' } });
+});
+
+app.use(errorHandler);

package/templates/advanced/src/config/env.ts

@@ -0,0 +1,10 @@
+import { z } from 'zod';
+
+const envSchema = z.object({
+  NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),
+  PORT: z.string().transform(Number).default('3000'),
+  LOG_LEVEL: z.enum(['debug', 'info', 'warn', 'error']).default('info'),
+  DATABASE_URL: z.string().optional(),
+});
+
+export const env = envSchema.parse(process.env);

package/templates/advanced/src/config/logger.ts

@@ -0,0 +1,11 @@
+import pino from 'pino';
+import { env } from './env.js';
+
+export const logger = pino({
+  level: env.LOG_LEVEL,
+  transport:
+    env.NODE_ENV === 'development'
+      ? { target: 'pino-pretty', options: { colorize: true } }
+      : undefined,
+  base: { pid: process.pid },
+});

package/templates/advanced/src/config/swagger.ts

@@ -0,0 +1,39 @@
+import swaggerUi from 'swagger-ui-express';
+import type { Express } from 'express';
+
+const swaggerDocument = {
+  openapi: '3.0.0',
+  info: {
+    title: 'Express TS API',
+    version: '1.0.0',
+    description: 'Auto-generated API documentation',
+  },
+  servers: [{ url: 'http://localhost:3000' }],
+  paths: {
+    '/health': {
+      get: {
+        summary: 'Health check',
+        responses: {
+          '200': {
+            description: 'Service is healthy',
+            content: {
+              'application/json': {
+                schema: {
+                  type: 'object',
+                  properties: {
+                    status: { type: 'string', example: 'ok' },
+                    timestamp: { type: 'string', format: 'date-time' },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    },
+  },
+};
+
+export const setupSwagger = (app: Express) => {
+  app.use('/api-docs', swaggerUi.serve, swaggerUi.setup(swaggerDocument));
+};

package/templates/advanced/src/index.ts

@@ -0,0 +1,8 @@
+import { app } from './app.js';
+import { env } from '@config/env.js';
+import { logger } from '@config/logger.js';
+
+app.listen(env.PORT, () => {
+  logger.info(`🚀 Server running on http://localhost:${env.PORT}`);
+  logger.info(`📖 API docs available at http://localhost:${env.PORT}/api-docs`);
+});

package/templates/advanced/src/middleware/errorHandler.ts

@@ -0,0 +1,18 @@
+import type { ErrorRequestHandler } from 'express';
+import { logger } from '@config/logger.js';
+import { env } from '@config/env.js';
+
+export const errorHandler: ErrorRequestHandler = (err, _req, res, _next) => {
+  logger.error(err);
+
+  const statusCode = err.statusCode || err.status || 500;
+  const message = err.message || 'Internal Server Error';
+
+  res.status(statusCode).json({
+    success: false,
+    error: {
+      message,
+      ...(env.NODE_ENV === 'development' && { stack: err.stack }),
+    },
+  });
+};

package/templates/advanced/src/middleware/security.ts

@@ -0,0 +1,17 @@
+import helmet from 'helmet';
+import cors from 'cors';
+import rateLimit from 'express-rate-limit';
+import type { Express } from 'express';
+
+export const applySecurityMiddleware = (app: Express) => {
+  app.use(helmet());
+  app.use(cors({ origin: process.env.CORS_ORIGIN || '*' }));
+  app.use(
+    rateLimit({
+      windowMs: 15 * 60 * 1000,
+      max: 100,
+      standardHeaders: true,
+      legacyHeaders: false,
+    }),
+  );
+};

package/templates/advanced/src/middleware/validate.ts

@@ -0,0 +1,26 @@
+import type { Request, Response, NextFunction } from 'express';
+import { z, type ZodSchema } from 'zod';
+
+export const validate = (schema: ZodSchema) => {
+  return (req: Request, res: Response, next: NextFunction) => {
+    try {
+      schema.parse({
+        body: req.body,
+        query: req.query,
+        params: req.params,
+      });
+      next();
+    } catch (err) {
+      if (err instanceof z.ZodError) {
+        return res.status(400).json({
+          success: false,
+          error: {
+            message: 'Validation failed',
+            details: err.errors,
+          },
+        });
+      }
+      next(err);
+    }
+  };
+};

package/templates/advanced/src/routes/health.ts

@@ -0,0 +1,9 @@
+import { Router } from 'express';
+
+const router = Router();
+
+router.get('/', (_req, res) => {
+  res.json({ status: 'ok', timestamp: new Date().toISOString() });
+});
+
+export default router;

package/templates/advanced/tests/app.test.ts

@@ -0,0 +1,26 @@
+import { describe, it, expect } from 'vitest';
+import request from 'supertest';
+import { app } from '../src/app.js';
+
+describe('App', () => {
+  it('GET /health returns status ok', async () => {
+    const res = await request(app).get('/health');
+
+    expect(res.status).toBe(200);
+    expect(res.body).toHaveProperty('status', 'ok');
+    expect(res.body).toHaveProperty('timestamp');
+  });
+
+  it('returns 404 for unknown routes', async () => {
+    const res = await request(app).get('/unknown');
+
+    expect(res.status).toBe(404);
+    expect(res.body.success).toBe(false);
+    expect(res.body.error).toHaveProperty('message', 'Not found');
+  });
+
+  it('serves swagger docs', async () => {
+    const res = await request(app).get('/api-docs');
+    expect(res.status).toBe(301);
+  });
+});

package/templates/advanced/tests/setup.ts

@@ -0,0 +1,9 @@
+import { beforeAll, afterAll } from 'vitest';
+
+beforeAll(() => {
+  process.env.NODE_ENV = 'test';
+});
+
+afterAll(() => {
+  // cleanup if needed
+});

package/templates/advanced/tsconfig.json

@@ -0,0 +1,47 @@
+{
+  "compilerOptions": {
+    "target": "ES2024",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "lib": [
+      "ES2024"
+    ],
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "baseUrl": ".",
+    "paths": {
+      "@/*": [
+        "src/*"
+      ],
+      "@config/*": [
+        "src/config/*"
+      ],
+      "@middleware/*": [
+        "src/middleware/*"
+      ],
+      "@routes/*": [
+        "src/routes/*"
+      ]
+    },
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "resolveJsonModule": true,
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "noImplicitReturns": true,
+    "noFallthroughCasesInSwitch": true
+  },
+  "include": [
+    "src/**/*"
+  ],
+  "exclude": [
+    "node_modules",
+    "dist",
+    "tests"
+  ]
+}

package/templates/advanced/vitest.config.ts

@@ -0,0 +1,25 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    globals: true,
+    environment: 'node',
+    include: ['tests/**/*.test.ts'],
+    coverage: {
+      provider: 'v8',
+      reporter: ['text', 'json', 'html'],
+      thresholds: {
+        lines: 80,
+        functions: 80,
+        branches: 70,
+        statements: 80,
+      },
+      exclude: [
+        'tests/',
+        'dist/',
+        '**/*.config.*',
+        'src/config/swagger.ts',
+      ],
+    },
+  },
+});

package/templates/minimal/package.json

@@ -0,0 +1,23 @@
+{
+  "name": "my-project",
+  "version": "1.0.0",
+  "description": "Minimal Express + TypeScript API",
+  "type": "module",
+  "scripts": {
+    "dev": "tsx watch src/index.ts",
+    "build": "tsc",
+    "start": "node dist/index.js"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "dependencies": {
+    "express": "^5.2.0"
+  },
+  "devDependencies": {
+    "@types/express": "^5.0.0",
+    "@types/node": "^22.0.0",
+    "tsx": "^4.0.0",
+    "typescript": "^7.0.0"
+  }
+}

package/templates/minimal/src/app.ts

@@ -0,0 +1,13 @@
+import express from 'express';
+
+export const app = express();
+
+app.use(express.json());
+
+app.get('/health', (_req, res) => {
+  res.json({ status: 'ok', timestamp: new Date().toISOString() });
+});
+
+app.use((_req, res) => {
+  res.status(404).json({ error: 'Not found' });
+});

package/templates/minimal/src/index.ts

@@ -0,0 +1,7 @@
+import { app } from './app.js';
+
+const PORT = Number(process.env.PORT) || 3000;
+
+app.listen(PORT, () => {
+  console.log(`Server running on http://localhost:${PORT}`);
+});

package/templates/minimal/tsconfig.json

@@ -0,0 +1,26 @@
+{
+  "compilerOptions": {
+    "target": "ES2024",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "lib": [
+      "ES2024"
+    ],
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "resolveJsonModule": true,
+    "declaration": true,
+    "sourceMap": true
+  },
+  "include": [
+    "src/**/*"
+  ],
+  "exclude": [
+    "node_modules",
+    "dist"
+  ]
+}

package/templates/standard/.editorconfig

@@ -0,0 +1,9 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_size = 2
+indent_style = space
+insert_final_newline = true
+trim_trailing_whitespace = true

package/templates/standard/.husky/pre-commit

@@ -0,0 +1 @@
+npx lint-staged

package/templates/standard/.vscode/extensions.json

@@ -0,0 +1,6 @@
+{
+  "recommendations": [
+    "dbaeumer.vscode-eslint",
+    "esbenp.prettier-vscode"
+  ]
+}

package/templates/standard/.vscode/settings.json

@@ -0,0 +1,8 @@
+{
+  "editor.defaultFormatter": "esbenp.prettier-vscode",
+  "editor.formatOnSave": true,
+  "editor.codeActionsOnSave": {
+    "source.fixAll.eslint": "explicit"
+  },
+  "typescript.preferences.importModuleSpecifier": "relative"
+}

package/templates/standard/eslint.config.mjs

@@ -0,0 +1,35 @@
+// @ts-check
+import js from '@eslint/js';
+import tseslint from 'typescript-eslint';
+import globals from 'globals';
+
+export default tseslint.config(
+  js.configs.recommended,
+  ...tseslint.configs.recommended,
+  ...tseslint.configs.recommendedTypeChecked,
+  {
+    languageOptions: {
+      parserOptions: {
+        projectService: true,
+        tsconfigDirName: import.meta.dirname,
+      },
+      globals: {
+        ...globals.node,
+        ...globals.es2024,
+      },
+    },
+    rules: {
+      '@typescript-eslint/no-unused-vars': [
+        'error',
+        { argsIgnorePattern: '^_', varsIgnorePattern: '^_' },
+      ],
+      '@typescript-eslint/explicit-function-return-type': 'off',
+      '@typescript-eslint/explicit-module-boundary-types': 'off',
+      'prefer-const': 'error',
+      'no-console': 'warn',
+    },
+  },
+  {
+    ignores: ['dist/', 'node_modules/', 'coverage/', '*.config.*'],
+  }
+);

package/templates/standard/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "my-project",
+  "version": "1.0.0",
+  "description": "Express + TypeScript API with ESLint, Prettier, Husky, Vitest",
+  "type": "module",
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "scripts": {
+    "dev": "tsx watch src/index.ts",
+    "build": "tsc",
+    "start": "node dist/index.js",
+    "test": "vitest",
+    "test:run": "vitest run",
+    "test:coverage": "vitest run --coverage",
+    "lint": "eslint src tests",
+    "lint:fix": "eslint src tests --fix",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "prepare": "husky"
+  },
+  "lint-staged": {
+    "*.{ts,tsx,js,jsx,mjs,cjs}": [
+      "eslint --fix",
+      "prettier --write"
+    ]
+  },
+  "dependencies": {
+    "express": "^5.2.0"
+  },
+  "devDependencies": {
+    "@types/express": "^5.0.0",
+    "@types/node": "^22.0.0",
+    "@types/supertest": "^6.0.0",
+    "eslint": "^10.9.1",
+    "globals": "^15.0.0",
+    "husky": "^9.1.7",
+    "lint-staged": "^15.0.0",
+    "prettier": "^3.9.6",
+    "supertest": "^7.0.0",
+    "tsx": "^4.0.0",
+    "typescript": "^5.7.0",
+    "typescript-eslint": "^8.0.0",
+    "vitest": "^4.1.11"
+  }
+}

package/templates/standard/prettier.config.mjs

@@ -0,0 +1,10 @@
+/** @type {import("prettier").Config} */
+export default {
+  semi: true,
+  trailingComma: 'all',
+  singleQuote: true,
+  printWidth: 100,
+  tabWidth: 2,
+  useTabs: false,
+  endOfLine: 'lf',
+};

package/templates/standard/src/app.ts

@@ -0,0 +1,13 @@
+import express from 'express';
+
+export const app = express();
+
+app.use(express.json());
+
+app.get('/health', (_req, res) => {
+  res.json({ status: 'ok', timestamp: new Date().toISOString() });
+});
+
+app.use((_req, res) => {
+  res.status(404).json({ error: 'Not found' });
+});

package/templates/standard/src/index.ts

@@ -0,0 +1,7 @@
+import { app } from './app.js';
+
+const PORT = Number(process.env.PORT) || 3000;
+
+app.listen(PORT, () => {
+  console.log(`🚀 Server running on http://localhost:${PORT}`);
+});

package/templates/standard/tests/app.test.ts

@@ -0,0 +1,20 @@
+import { describe, it, expect } from 'vitest';
+import request from 'supertest';
+import { app } from '../src/app.js';
+
+describe('App', () => {
+  it('GET /health returns status ok', async () => {
+    const res = await request(app).get('/health');
+
+    expect(res.status).toBe(200);
+    expect(res.body).toHaveProperty('status', 'ok');
+    expect(res.body).toHaveProperty('timestamp');
+  });
+
+  it('returns 404 for unknown routes', async () => {
+    const res = await request(app).get('/unknown');
+
+    expect(res.status).toBe(404);
+    expect(res.body).toEqual({ error: 'Not found' });
+  });
+});

package/templates/standard/tsconfig.json

@@ -0,0 +1,32 @@
+{
+  "compilerOptions": {
+    "target": "ES2024",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "lib": [
+      "ES2024"
+    ],
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "resolveJsonModule": true,
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "noImplicitReturns": true,
+    "noFallthroughCasesInSwitch": true
+  },
+  "include": [
+    "src/**/*"
+  ],
+  "exclude": [
+    "node_modules",
+    "dist",
+    "tests"
+  ]
+}

package/templates/standard/vitest.config.ts

@@ -0,0 +1,14 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    globals: true,
+    environment: 'node',
+    include: ['tests/**/*.test.ts'],
+    coverage: {
+      provider: 'v8',
+      reporter: ['text', 'json', 'html'],
+      exclude: ['tests/', 'dist/', '*.config.*'],
+    },
+  },
+});