create-projx 1.6.4 → 1.7.0

package/README.md

@@ -51,6 +51,12 @@ npx create-projx vision-api --components fastapi -y
 # Node API + React frontend
 npx create-projx saas --components fastify,frontend -y
 
+# Minimal Express API + React frontend
+npx create-projx api-app --components express,frontend -y
+
+# Drizzle-backed Node API + React frontend
+npx create-projx ledger --components express,frontend --orm drizzle -y
+
 # Mobile app with backend
 npx create-projx field-app --components fastapi,mobile -y
 
@@ -74,18 +80,20 @@ If this saves you even one hour, it's already paid for itself. (It's free.)
 - **No lock-in.** Projx generates files and walks away. Delete the `.projx` config and it's just a normal repo.
 - **Adopt incrementally.** Already have a project? `projx init` adds CI, hooks, and Docker without touching your code.
 - **Pick your package manager.** npm, pnpm, yarn, or bun. The choice propagates everywhere — scripts, Docker, CI, docs.
+- **Pick your Node ORM.** Prisma is the auto-CRUD default. Drizzle, Sequelize, and TypeORM ship as first-class addons with identical runtime surface (auto-routes, pagination, filtering, search, lifecycle hooks).
 - **AI-agent friendly.** Ships with [SKILL.md](SKILL.md) so Claude, Cursor, and other agents call Projx instead of hand-writing broken scaffolds.
 
 ## What you get
 
-| Component  | Stack                       | What it gives you                                            |
-| ---------- | --------------------------- | ------------------------------------------------------------ |
-| `fastapi`  | Python, SQLAlchemy, Alembic | Auto-entity CRUD, JWT auth, migrations, OpenAPI docs         |
-| `fastify`  | Node.js, Prisma, TypeBox    | Auto-entity CRUD, JWT auth, typed schemas, OpenAPI docs      |
-| `frontend` | React 19, TypeScript, Vite  | Auto-entity UI from `/_meta`, design tokens, light/dark mode |
-| `mobile`   | Flutter, Riverpod, GoRouter | Auto-entity screens, offline-first with Isar, biometric auth |
-| `e2e`      | Playwright                  | Page object model, auth fixtures, accessibility scans        |
-| `infra`    | Terraform, AWS              | EKS, RDS, VPC, ALB, CodePipeline, multi-environment          |
+| Component  | Stack                                                         | What it gives you                                                                    |
+| ---------- | ------------------------------------------------------------- | ------------------------------------------------------------------------------------ |
+| `fastapi`  | Python, SQLAlchemy, Alembic                                   | Auto-entity CRUD, JWT auth, migrations, OpenAPI docs                                 |
+| `fastify`  | Node.js, Prisma / Drizzle / Sequelize / TypeORM, TypeBox      | Auto-entity CRUD, JWT auth, typed schemas, OpenAPI docs (auth currently Prisma-only) |
+| `express`  | Express 5, TypeScript, Prisma / Drizzle / Sequelize / TypeORM | Auto-entity CRUD, validation, security middleware, health checks                     |
+| `frontend` | React 19, TypeScript, Vite                                    | Auto-entity UI from `/_meta`, design tokens, light/dark mode                         |
+| `mobile`   | Flutter, Riverpod, GoRouter                                   | Auto-entity screens, offline-first with Isar, biometric auth                         |
+| `e2e`      | Playwright                                                    | Page object model, auth fixtures, accessibility scans                                |
+| `infra`    | Terraform, AWS                                                | EKS, RDS, VPC, ALB, CodePipeline, multi-environment                                  |
 
 Plus, in every project: Docker Compose for dev + prod, GitHub Actions CI per component (path-filtered), pre-commit hooks, secret detection, VS Code settings, and 80% test coverage enforced.
 
@@ -110,6 +118,9 @@ npx create-projx my-app
 # Non-interactive — specify components
 npx create-projx my-app --components fastify,frontend,e2e
 
+# Use Drizzle for Node backends instead of Prisma
+npx create-projx my-app --components express,frontend --orm drizzle
+
 # Accept defaults (Fastify + Frontend + E2E)
 npx create-projx my-app -y
 ```
@@ -189,12 +200,12 @@ Your custom files (controllers, pages, middleware) are never deleted. Files you
 
 Common user-owned files are **default-skipped** automatically — template updates won't touch them:
 
-| Scope | Default skips |
-|-------|---------------|
-| Root (`.projx`) | `docker-compose.yml`, `docker-compose.dev.yml`, `README.md`, `.githooks/pre-commit`, `.github/workflows/ci.yml`, `scripts/setup.sh`, `scripts/setup-docker.sh`, `scripts/setup-ssl.sh` |
-| fastapi | `pyproject.toml` |
-| fastify / frontend / e2e | `package.json` |
-| mobile | `pubspec.yaml` |
+| Scope                    | Default skips                                                                                                                                                |
+| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| Root (`.projx`)          | `docker-compose.yml`, `README.md`, `.githooks/pre-commit`, `.github/workflows/ci.yml`, `scripts/setup.sh`, `scripts/setup-docker.sh`, `scripts/setup-ssl.sh` |
+| fastapi                  | `pyproject.toml`                                                                                                                                             |
+| fastify / frontend / e2e | `package.json`                                                                                                                                               |
+| mobile                   | `pubspec.yaml`                                                                                                                                               |
 
 Defaults are applied once on first `update` and saved to the `skip` array. To skip additional files, add them to `skip` in `.projx` (root-level) or `.projx-component` (per-component):
 
@@ -233,7 +244,7 @@ npx create-projx doctor [--fix]
 npx create-projx gen entity <name> [--ai | --backend]
 npx create-projx sync [--url <url>]
 
---components <list>    Comma-separated: fastapi,fastify,frontend,mobile,e2e,infra
+--components <list>    Comma-separated: fastapi,fastify,express,frontend,mobile,e2e,infra
 --name <dir>           Custom directory for `add <type>` (multi-instance)
 --ai                   Target fastapi (AI/ML) for gen entity
 --backend              Target fastify (API backend) for gen entity
@@ -286,8 +297,11 @@ Scaffold a new entity in your primary backend + typed models for frontend/mobile
 npx create-projx gen entity invoice                                          # interactive
 npx create-projx gen entity invoice --fields "name:string,amount:number"     # non-interactive
 npx create-projx gen entity embedding --ai --fields "name:string,vector:json"  # target AI backend
+npx create-projx gen entity invite --fields "email:string,code:string:unique:generated"  # server-fills `code`
 ```
 
+**Field modifiers** (Fastify/Express only, after the type): `unique` adds a Prisma `@unique` constraint; `generated` (alias: `server`, `server-generated`) marks the field as server-populated — it's omitted from the create-schema and a `beforeCreate` hook stub is emitted that fills it before persist (override the body of `generateXxx()` with your slug/code/UUID logic). Use both together for server-issued unique identifiers (invite codes, slugs, short URLs).
+
 When both `fastapi` and `fastify` exist, the entity generates in the **primary backend** only (not both). First run prompts you to choose and saves to `.projx`:
 
 ```json
@@ -307,6 +321,21 @@ Override with `--ai` (fastapi) or `--backend` (fastify).
 
 No migrations — run `alembic revision --autogenerate` or `prisma migrate dev` (via your package manager) when ready.
 
+### ORM choice (Node backends)
+
+Pick an ORM at create-time with `--orm <provider>`. Default: **prisma**. Supported: `prisma`, `drizzle`, `sequelize`, `typeorm`.
+
+| ORM         | Schema home              | `gen entity` produces                                                               | Sync schema to DB                              |
+| ----------- | ------------------------ | ----------------------------------------------------------------------------------- | ---------------------------------------------- |
+| `prisma`    | `prisma/schema.prisma`   | Prisma model + Fastify/Express module (`schemas.ts`, `index.ts`) + integration test | `prisma migrate dev`                           |
+| `drizzle`   | `src/db/schema.ts`       | Typed `pgTable` + Fastify/Express router wired via `_base/` + CRUD test             | `drizzle-kit push --force`                     |
+| `sequelize` | `src/models/<name>.ts`   | Sequelize `Model` class + aggregator entry + Fastify/Express router + CRUD test     | `pnpm db:sync` (uses `sequelize.sync`)         |
+| `typeorm`   | `src/entities/<name>.ts` | Decorated `@Entity` class + aggregator entry + Fastify/Express router + CRUD test   | `pnpm db:sync` (uses `dataSource.synchronize`) |
+
+All four ORMs scaffold equivalent runtime behavior: `_base/auto-routes.ts` wires POST/GET/PATCH/DELETE/bulk routes with pagination, equality filters, `ILIKE` search, and the lifecycle hook contract (`beforeCreate`, `afterCreate`, `beforeUpdate`, `afterUpdate`, `beforeDelete`).
+
+ORM-specific scaffolding lives in [cli/src/addons/orms/](cli/src/addons/orms/) — each ORM is a self-contained folder with a `manifest.json` (deps, file removals, scripts), `shared/` files, per-framework overlays, and `gen-entity/` templates. Adding a new ORM means adding a new folder there; no CLI core changes.
+
 ### Sync Types
 
 Regenerate all frontend/mobile types from a running backend:
@@ -321,10 +350,10 @@ Fetches `/_meta` from your backend, generates typed interfaces for every entity.
 The generic `api.ts` client accepts type parameters:
 
 ```tsx
-import type { Invoice } from '../types/invoice';
+import type { Invoice } from "../types/invoice";
 
-const { data } = await api.list<Invoice>('/invoices'); // data: Invoice[]
-const item = await api.get<Invoice>('/invoices', id); // item: Invoice
+const { data } = await api.list<Invoice>("/invoices"); // data: Invoice[]
+const item = await api.get<Invoice>("/invoices", id); // item: Invoice
 ```
 
 ## Rename Component Directories
@@ -349,7 +378,6 @@ my-app/
 ├── e2e/                    # Playwright E2E tests
 │   └── .projx-component
 ├── docker-compose.yml      # Production (backend + frontend + SSL)
-├── docker-compose.dev.yml  # Development (PostgreSQL + hot reload)
 ├── .github/workflows/      # CI per component (runs only on changes)
 ├── .githooks/pre-commit    # Format + lint on commit
 ├── .vscode/                # Editor settings + recommended extensions
@@ -371,6 +399,51 @@ The core idea: define a data model, get everything else for free.
 
 **Mobile** — Same metadata endpoint, generates list/detail/form screens. Offline-first with local DB and sync queue.
 
+## Encrypted Service Config
+
+Both backends ship with a `service_configs` table for storing third-party credentials (SMTP, OAuth, S3, etc.) encrypted at rest with AES-256-GCM. The `purpose` column is a free-form string — pick whatever taxonomy fits your project.
+
+```ts
+// Fastify
+import { setServiceConfig, getServiceConfig } from "./lib/service-config.js";
+await setServiceConfig(prisma, "smtp", { host, port, user, password });
+const cfg = await getServiceConfig<{ host: string }>(prisma, "smtp");
+```
+
+```python
+# FastAPI
+from src.entities.service_config._repository import ServiceConfigRepository
+repo = ServiceConfigRepository(session)
+await repo.set_config('smtp', {'host': ..., 'port': 587})
+cfg = await repo.get_config('smtp')
+```
+
+Encryption key resolves from `CRED_ENCRYPTION_KEY` (32-byte base64). If absent, derived from `JWT_SECRET` for development. Set an explicit key in production. Reads are cached in-memory for 10 minutes; `invalidate(purpose)` clears.
+
+## Rate Limiting
+
+The Fastify backend ships with `@fastify/rate-limit` registered globally. Defaults: **200 requests per minute per user** (or per IP for unauthenticated requests). Tune via `RATE_LIMIT_MAX` and `RATE_LIMIT_WINDOW` in `.env`.
+
+Override per route for sensitive endpoints:
+
+```ts
+fastify.post(
+  "/auth/resend-verification",
+  {
+    config: {
+      rateLimit: {
+        max: 5,
+        timeWindow: "1 hour",
+        keyGenerator: (req) => (req.body?.email ?? req.ip).toLowerCase(),
+      },
+    },
+  },
+  handler,
+);
+```
+
+For the FastAPI service, edge rate limits are enforced by the frontend nginx (`auth_limit` and `api_limit` zones in [frontend/nginx.conf](frontend/nginx.conf)) — no application-level limiter is wired by default since the service is internal.
+
 ## Development
 
 Contributing to Projx itself:

package/dist/{baseline-PZM4KJJW.js → baseline-FHOZNS4D.js}

@@ -8,8 +8,8 @@ import {
   matchesSkip,
   saveBaselineRef,
   writeTemplateToDir
-} from "./chunk-XQ7FE4U3.js";
-import "./chunk-6YRBHJ2V.js";
+} from "./chunk-IMZKHDIL.js";
+import "./chunk-HAT7D4G2.js";
 export {
   BASELINE_REF,
   applyTemplate,

package/dist/{chunk-6YRBHJ2V.js → chunk-HAT7D4G2.js}

@@ -4,6 +4,7 @@ import { existsSync, readFileSync } from "fs";
 import {
   chmod,
   cp,
+  mkdtemp,
   mkdir,
   readdir,
   readFile,
@@ -18,12 +19,19 @@ var REPO_URL = `https://github.com/${REPO}`;
 var COMPONENTS = [
   "fastapi",
   "fastify",
+  "express",
   "frontend",
   "mobile",
   "e2e",
   "infra"
 ];
 var PACKAGE_MANAGERS = ["npm", "pnpm", "yarn", "bun"];
+var ORM_PROVIDERS = [
+  "prisma",
+  "drizzle",
+  "sequelize",
+  "typeorm"
+];
 function pmCommands(pm) {
   switch (pm) {
     case "npm":
@@ -88,7 +96,7 @@ function detectPackageManager(cwd) {
   return null;
 }
 function detectPackageManagerFromComponents(cwd, componentPaths) {
-  const jsComponents = ["fastify", "frontend", "e2e"];
+  const jsComponents = ["fastify", "express", "frontend", "e2e"];
   for (const component of jsComponents) {
     const dir = componentPaths[component];
     if (!dir) continue;
@@ -99,6 +107,7 @@ function detectPackageManagerFromComponents(cwd, componentPaths) {
   }
   return detectPackageManager(cwd);
 }
+var KNOWN_FEATURES = ["auth"];
 function toKebab(s) {
   return s.replace(/([a-z])([A-Z])/g, "$1-$2").replace(/[\s_]+/g, "-").toLowerCase();
 }
@@ -127,8 +136,7 @@ async function downloadRepo(localPath) {
   if (localPath) {
     return localPath;
   }
-  const dest = join(tmpdir(), `projx-${Date.now()}`);
-  await mkdir(dest, { recursive: true });
+  const dest = await mkdtemp(join(tmpdir(), "projx-"));
   if (hasCommand("git")) {
     execSync(`git clone --depth 1 ${REPO_URL}.git "${dest}/repo"`, {
       stdio: "pipe"
@@ -213,7 +221,12 @@ async function copyStaticFiles(repoDir, dest) {
     await cp(extensionsJson, join(dest, ".vscode/extensions.json"));
     manifest.push(".vscode/extensions.json");
   }
-  const staticScripts = ["setup-docker.sh", "setup-ssl.sh"];
+  const staticScripts = [
+    "ci-local.sh",
+    "setup-docker.sh",
+    "setup-ssl.sh",
+    "style-check.py"
+  ];
   const scriptsSrc = join(tpl, "scripts");
   if (existsSync(scriptsSrc)) {
     await mkdir(join(dest, "scripts"), { recursive: true });
@@ -326,10 +339,10 @@ async function writeProjxConfig(cwd, data) {
 }
 var DEFAULT_ROOT_SKIP_PATTERNS = [
   "docker-compose.yml",
-  "docker-compose.dev.yml",
   "README.md",
   ".githooks/pre-commit",
   ".github/workflows/ci.yml",
+  "scripts/ci-local.sh",
   "scripts/setup.sh",
   "scripts/setup-docker.sh",
   "scripts/setup-ssl.sh"
@@ -337,6 +350,7 @@ var DEFAULT_ROOT_SKIP_PATTERNS = [
 var DEFAULT_COMPONENT_SKIP_PATTERNS = {
   fastapi: ["pyproject.toml"],
   fastify: ["package.json"],
+  express: ["package.json"],
   frontend: ["package.json"],
   e2e: ["package.json"],
   mobile: ["pubspec.yaml"]
@@ -381,10 +395,11 @@ function evalExpr(expr, vars) {
   const components = vars.components;
   const projectName = vars.projectName;
   const pmName = vars.pm?.name ?? "npm";
-  const argNames = ["components", "projectName", "pm"];
-  const argValues = [components, projectName, pmName];
+  const orm = vars.orm ?? "prisma";
+  const argNames = ["components", "projectName", "pm", "orm"];
+  const argValues = [components, projectName, pmName, orm];
   for (const [k, v] of Object.entries(vars)) {
-    if (k === "components" || k === "projectName" || k === "pm") continue;
+    if (["components", "projectName", "pm", "orm"].includes(k)) continue;
     if (!/^[a-zA-Z_$][\w$]*$/.test(k)) continue;
     argNames.push(k);
     argValues.push(v);
@@ -521,9 +536,11 @@ export {
   REPO_URL,
   COMPONENTS,
   PACKAGE_MANAGERS,
+  ORM_PROVIDERS,
   pmCommands,
   detectPackageManager,
   detectPackageManagerFromComponents,
+  KNOWN_FEATURES,
   toKebab,
   toSnake,
   toTitle,

package/dist/{chunk-XQ7FE4U3.js → chunk-IMZKHDIL.js}

@@ -13,12 +13,14 @@ import {
   toSnake,
   upsertComponentMarker,
   writeProjxConfig
-} from "./chunk-6YRBHJ2V.js";
+} from "./chunk-HAT7D4G2.js";
 
 // src/baseline.ts
 import { existsSync, writeFileSync, unlinkSync } from "fs";
 import {
   chmod,
+  cp,
+  mkdtemp,
   mkdir,
   writeFile,
   rm,
@@ -27,6 +29,7 @@ import {
 } from "fs/promises";
 import { execSync } from "child_process";
 import { join as join2, dirname } from "path";
+import { fileURLToPath } from "url";
 import { tmpdir } from "os";
 
 // src/generators/index.ts
@@ -38,6 +41,7 @@ function shellSafeUpper(s) {
 var CANONICAL_DISPLAY = {
   fastapi: "FastAPI",
   fastify: "Fastify",
+  express: "Express",
   frontend: "Frontend",
   mobile: "Flutter",
   e2e: "E2E",
@@ -59,6 +63,7 @@ function withInstances(vars) {
     instances: enriched,
     fastapiInstances: byType("fastapi"),
     fastifyInstances: byType("fastify"),
+    expressInstances: byType("express"),
     frontendInstances: byType("frontend"),
     mobileInstances: byType("mobile"),
     e2eInstances: byType("e2e"),
@@ -72,9 +77,6 @@ async function renderShared(filename, vars) {
 async function generateDockerCompose(vars) {
   return renderShared("docker-compose.yml.ejs", withInstances(vars));
 }
-async function generateDockerComposeDev(vars) {
-  return renderShared("docker-compose.dev.yml.ejs", withInstances(vars));
-}
 async function generatePreCommit(vars) {
   return renderShared("pre-commit.ejs", withInstances(vars));
 }
@@ -110,9 +112,7 @@ function generateVscodeSettings(vars) {
   settings["editor.formatOnSave"] = true;
   settings["editor.codeActionsOnSave"] = { "source.fixAll.eslint": "explicit" };
   settings["eslint.useFlatConfig"] = true;
-  const prettierComponent = ["frontend", "fastify", "e2e"].find(
-    (c) => vars.components.includes(c)
-  );
+  const prettierComponent = ["frontend", "fastify", "express", "e2e"].find((c) => vars.components.includes(c));
   if (prettierComponent) {
     settings["prettier.configPath"] = `${vars.paths[prettierComponent]}/.prettierrc`;
   }
@@ -127,7 +127,7 @@ function generateVscodeSettings(vars) {
 // src/baseline.ts
 var BASELINE_REF = "refs/projx/baseline";
 async function migrateComponentMarkers(cwd, components, componentPaths, applyDefaults) {
-  const { readComponentMarker: readComponentMarker2, writeComponentMarker } = await import("./utils-AVKSTHIF.js");
+  const { readComponentMarker: readComponentMarker2, writeComponentMarker } = await import("./utils-BZGSJ7XZ.js");
   for (const component of components) {
     const dir = componentPaths[component];
     const markerDir = join2(cwd, dir);
@@ -155,6 +155,9 @@ async function writeManagedProjx(cwd, version, vars, applyDefaults) {
   if (pmObj?.name && !merged.packageManager) {
     merged.packageManager = pmObj.name;
   }
+  if (typeof vars.orm === "string" && !merged.orm) {
+    merged.orm = vars.orm;
+  }
   if (applyDefaults && !merged.defaultsApplied) {
     const userSkip = Array.isArray(merged.skip) ? merged.skip : [];
     merged.skip = [.../* @__PURE__ */ new Set([...userSkip, ...DEFAULT_ROOT_SKIP_PATTERNS])];
@@ -413,7 +416,7 @@ async function writeTemplateToDir(dest, repoDir, components, componentPaths, var
       nameSnake
     });
   }
-  const hasBackend = components.includes("fastapi") || components.includes("fastify");
+  const hasBackend = components.includes("fastapi") || components.includes("fastify") || components.includes("express");
   const userSkip = rootSkip ?? [];
   const defaultRootSkip = applyDefaults ? DEFAULT_ROOT_SKIP_PATTERNS : [];
   const effectiveSkip = [.../* @__PURE__ */ new Set([...userSkip, ...defaultRootSkip])];
@@ -427,11 +430,6 @@ async function writeTemplateToDir(dest, repoDir, components, componentPaths, var
         join2(dest, "docker-compose.yml"),
         await generateDockerCompose(vars)
       );
-    if (shouldWrite("docker-compose.dev.yml"))
-      await writeFile(
-        join2(dest, "docker-compose.dev.yml"),
-        await generateDockerComposeDev(vars)
-      );
   }
   if (shouldWrite("README.md"))
     await writeFile(join2(dest, "README.md"), await generateReadme(vars));
@@ -497,9 +495,9 @@ async function writeOneInstance(inst, opts) {
   }
   const outDir = join2(dest, targetDir);
   await mkdir(outDir, { recursive: true });
-  const { cp } = await import("fs/promises");
+  const { cp: cp2 } = await import("fs/promises");
   if (existsSync(srcDir)) {
-    await cp(srcDir, outDir, { recursive: true, force: true });
+    await cp2(srcDir, outDir, { recursive: true, force: true });
   }
   await rm(tmpDir, { recursive: true, force: true });
   const instancePaths = {
@@ -507,6 +505,7 @@ async function writeOneInstance(inst, opts) {
     [type]: targetDir
   };
   await renderEjsInDir(outDir, { ...vars, paths: instancePaths });
+  await applyOrmProviderToInstance(outDir, type, vars);
   await upsertComponentMarker(
     join2(dest, targetDir),
     type,
@@ -520,6 +519,143 @@ async function writeOneInstance(inst, opts) {
     vars.nameOverrides
   );
 }
+async function applyOrmProviderToInstance(dir, component, vars) {
+  const orm = typeof vars.orm === "string" ? vars.orm : void 0;
+  if (!orm || orm === "prisma") return;
+  if (component !== "fastify" && component !== "express") return;
+  await applyOrmAddon(orm, component, dir, vars);
+}
+function sharedAddonDir() {
+  const thisFile = fileURLToPath(import.meta.url);
+  return join2(thisFile, "../../src/addons");
+}
+async function loadOrmManifest(orm) {
+  const path = join2(sharedAddonDir(), "orms", orm, "manifest.json");
+  if (!existsSync(path)) {
+    throw new Error(
+      `ORM "${orm}" is not yet supported. No manifest found at ${path}.`
+    );
+  }
+  return JSON.parse(await readFile2(path, "utf-8"));
+}
+function applyPackageOverrides(pkg, overrides) {
+  if (overrides.descriptionReplace && typeof pkg.description === "string") {
+    pkg.description = pkg.description.replaceAll(
+      overrides.descriptionReplace.from,
+      overrides.descriptionReplace.to
+    );
+  }
+  const scripts = pkg.scripts ?? {};
+  for (const prefix of overrides.removeScriptPrefixes ?? []) {
+    for (const key of Object.keys(scripts)) {
+      if (key.startsWith(prefix)) delete scripts[key];
+    }
+  }
+  Object.assign(scripts, overrides.addScripts ?? {});
+  pkg.scripts = scripts;
+  const dependencies = pkg.dependencies ?? {};
+  for (const dep of overrides.removeDependencies ?? []) {
+    delete dependencies[dep];
+  }
+  Object.assign(dependencies, overrides.addDependencies ?? {});
+  pkg.dependencies = dependencies;
+  const devDependencies = pkg.devDependencies ?? {};
+  for (const dep of overrides.removeDevDependencies ?? []) {
+    delete devDependencies[dep];
+  }
+  Object.assign(devDependencies, overrides.addDevDependencies ?? {});
+  pkg.devDependencies = devDependencies;
+}
+async function applyOrmAddon(orm, framework, dir, vars) {
+  const manifest = await loadOrmManifest(orm);
+  if (!manifest.frameworks.includes(framework)) {
+    throw new Error(
+      `ORM "${orm}" does not support framework "${framework}". Supported: ${manifest.frameworks.join(", ")}`
+    );
+  }
+  for (const relPath of manifest.removeFromBase) {
+    await rm(join2(dir, relPath), { recursive: true, force: true });
+  }
+  const pkgPath = join2(dir, "package.json");
+  const pkg = await readJsonObject(pkgPath);
+  applyPackageOverrides(pkg, manifest.packageOverrides);
+  await writeJsonObject(pkgPath, pkg);
+  const addonRoot = join2(sharedAddonDir(), "orms", orm);
+  const sharedSrc = join2(addonRoot, "shared");
+  const frameworkSrc = join2(addonRoot, framework);
+  if (existsSync(sharedSrc)) {
+    await cp(sharedSrc, dir, { recursive: true, force: true });
+  }
+  if (existsSync(frameworkSrc)) {
+    await cp(frameworkSrc, dir, { recursive: true, force: true });
+  }
+  await writeFile(
+    join2(dir, "Dockerfile"),
+    ormNodeDockerfileSource(manifest, vars)
+  );
+}
+async function readJsonObject(path) {
+  return JSON.parse(await readFile2(path, "utf-8"));
+}
+async function writeJsonObject(path, data) {
+  await writeFile(path, JSON.stringify(data, null, 2) + "\n");
+}
+function ormNodeDockerfileSource(manifest, vars) {
+  const pm = vars.pm;
+  const pmName = pm.name ?? "npm";
+  const lockfile = pm.lockfile ?? "package-lock.json";
+  const install = pm.ci ?? "npm ci";
+  const exec = pm.exec ?? "npx";
+  const run = pm.run ?? "npm run";
+  const dockerCfg = manifest.dockerfile ?? {};
+  const extraConfigCopy = (dockerCfg.extraConfigFiles ?? []).join(" ");
+  const migrateCmd = dockerCfg.migrateCommand ?? "";
+  const setup = pmName === "pnpm" ? `ENV PNPM_HOME="/pnpm"
+ENV PATH="$PNPM_HOME:$PATH"
+RUN corepack enable && corepack prepare pnpm@10.33.0 --activate
+` : pmName === "yarn" ? "RUN corepack enable\n" : pmName === "bun" ? "RUN npm install -g bun\n" : "";
+  const buildCopy = extraConfigCopy ? `COPY package.json tsconfig.json ${extraConfigCopy} ./` : `COPY package.json tsconfig.json ./`;
+  const migrateStage = migrateCmd ? `FROM build AS migrate
+CMD ["sh", "-c", "${exec} ${migrateCmd}"]
+
+` : "";
+  return `FROM node:22-bookworm-slim AS base
+
+RUN apt-get update \\
+    && apt-get install -y --no-install-recommends ca-certificates \\
+    && rm -rf /var/lib/apt/lists/*
+
+${setup}WORKDIR /app
+
+FROM base AS deps
+COPY package.json ${lockfile} ./
+RUN ${install}
+
+FROM base AS build
+ENV NODE_OPTIONS="--max-old-space-size=768"
+COPY --from=deps /app/node_modules ./node_modules
+${buildCopy}
+COPY src ./src
+RUN ${run} build
+
+${migrateStage}FROM base AS runtime
+ENV NODE_ENV=production
+RUN npm install -g pm2@5.4.3
+RUN chown -R node /app
+USER node
+
+COPY --from=build --chown=node:node /app/node_modules ./node_modules
+COPY --from=build --chown=node:node /app/dist ./dist
+COPY --chown=node:node package.json ecosystem.config.cjs* ./
+
+EXPOSE 3000
+
+HEALTHCHECK --interval=30s --timeout=10s --start-period=20s --retries=3 \\
+    CMD ["node", "-e", "require('http').get('http://localhost:3000/api/health', r => process.exit(r.statusCode === 200 ? 0 : 1)).on('error', () => process.exit(1))"]
+
+CMD ["sh", "-c", "if [ -f ecosystem.config.cjs ]; then pm2-runtime ecosystem.config.cjs; else node dist/server.js; fi"]
+`;
+}
 async function substituteNamesForInstance(inst, dest, name, nameSnake, overrides) {
   const { type, path } = inst;
   const isCanonical = path === type;
@@ -537,6 +673,13 @@ async function substituteNamesForInstance(inst, dest, name, nameSnake, overrides
       "projx-fastify",
       target
     );
+  } else if (type === "express") {
+    const target = isCanonical ? overrides?.express ?? `${name}-express` : `${name}-${path}`;
+    await replaceInFile(
+      join2(dest, `${path}/package.json`),
+      "projx-express",
+      target
+    );
   } else if (type === "frontend") {
     const target = isCanonical ? overrides?.frontend ?? `${name}-frontend` : `${name}-${path}`;
     await replaceInFile(
@@ -573,7 +716,7 @@ async function detectPackageNameOverrides(cwd, components, componentPaths) {
     const name = await readTomlProjectName(file);
     if (name) overrides.fastapi = name;
   }
-  for (const c of ["fastify", "frontend", "e2e"]) {
+  for (const c of ["fastify", "express", "frontend", "e2e"]) {
     if (!components.includes(c)) continue;
     const file = join2(cwd, componentPaths[c], "package.json");
     const name = await readJsonName(file);
@@ -715,8 +858,7 @@ async function applyTemplate(cwd, repoDir, components, componentPaths, vars, ver
     }
     const baselineRef = getBaselineRef(cwd);
     if (baselineRef) {
-      const tmpTemplate = join2(tmpdir(), `projx-tpl-${Date.now()}`);
-      await mkdir(tmpTemplate, { recursive: true });
+      const tmpTemplate = await mkdtemp(join2(tmpdir(), "projx-tpl-"));
       await writeTemplateToDir(
         tmpTemplate,
         repoDir,