create-rigel 0.1.0

package/templates/express/docs/design-docs/observability.md

@@ -0,0 +1,194 @@
+# Observability — See It & Debug It
+
+How traces, metrics, and logs flow through this service, how to look at them in Grafana, and how
+to use them to debug a real problem. Read this once; it pays for itself the first time something
+is slow in a way you can't reproduce locally.
+
+---
+
+## Mental model (one line)
+
+> **Traces + metrics → OTLP → otel-lgtm collector. Logs → pino JSON (correlated by a span-reading
+> mixin) → Alloy → Loki.** Helpers live in `config/` so services stay clean; the `NodeSDK` lives
+> only in `providers/telemetry.ts` and boots *before* the app is imported.
+
+```
+                                   ┌────────────────────────────────────────────┐
+                                   │            grafana/otel-lgtm                 │
+  ┌─────────────┐  OTLP/HTTP :4318 │  Collector → Tempo (traces)                  │
+  │             │ ───────────────► │             → Prometheus (metrics)           │
+  │   Node app  │   traces+metrics │             → Loki (logs)                    │
+  │  (Express)  │                  │  Grafana UI  :3000 → published on host :3001 │
+  │             │  stdout JSON     └───────▲──────────────────────────────────────┘
+  │  pino ──────┼──► (docker logs) ─┐      │ push to Loki :3100
+  └─────────────┘   trace_id/span_id│  ┌───┴────────┐
+                                    └─►│   Alloy     │  tails container stdout, parses pino JSON
+                                       └─────────────┘
+```
+
+Why logs take the side road through Alloy instead of OTLP: under ESM, `@opentelemetry/instrumentation-pino`'s
+OTLP log-sending does not reliably emit. So we **don't** depend on it. Correlation is done
+deterministically by a pino `mixin` that reads the active span; shipping is done by Alloy tailing
+stdout. Decoupled and boring — exactly what you want from logging.
+
+---
+
+## Where the code lives
+
+| Concern | File | Notes |
+|---|---|---|
+| SDK boot (traces+metrics) | `src/providers/telemetry.ts` | The **only** file importing `NodeSDK`. Boot-only, excluded from coverage. |
+| Boot ordering | `src/runtime/server.ts` | `await startTelemetry()` **then** `await import('./app.js')`. |
+| Logger | `src/config/logger.ts` | pino + trace-correlation mixin + guarded pretty transport. |
+| Spans | `src/config/tracing.ts` | `withSpan(name, attrs, fn)`. No-op when SDK off. |
+| Metrics | `src/config/metrics.ts` | `increment()`, histograms. No-op when SDK off. |
+| Env flags | `src/config/env.ts` | `OTEL_*`. Blank endpoint ⇒ everything no-ops. |
+| Local backend | `docker-compose.yml` (`lgtm`, `alloy`) | All-in-one; nothing to configure. |
+| Log shipping | `infra/monitoring/alloy/config.alloy` | stdout JSON → Loki. |
+
+---
+
+## Quickstart
+
+```bash
+# 1. Start the backend (and the app) with telemetry wired up.
+docker compose up -d
+
+# 2. Open Grafana.
+#    http://localhost:3001   (user: admin   password: admin)
+
+# 3. Generate some signal.
+curl http://localhost:3000/health
+curl http://localhost:3000/ready
+```
+
+> Running the app outside Docker (`npm run dev`)? Start just the backend and point the app at it:
+>
+> ```bash
+> docker run -d --name lgtm -p 3001:3000 -p 4317:4317 -p 4318:4318 grafana/otel-lgtm
+> # in .env:  OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4318
+> ```
+>
+> Logs won't reach Loki this way (Alloy isn't running), but they print to your terminal with
+> `trace_id`, and traces+metrics still flow to Grafana.
+
+---
+
+## See traces (Tempo)
+
+1. Grafana → **Explore** (compass icon) → data source **Tempo**.
+2. Query type **Search** → run. You'll see recent traces, one row per request (e.g. `GET /health`).
+3. Click a trace → the **span waterfall**. Express, the DB query (pg), and Redis each appear as a
+   span with its own duration. This is where you find *which part* of a request was slow.
+
+What produces these spans: `getNodeAutoInstrumentations()` patches http/express/pg/ioredis
+automatically. Your own service methods add spans via `withSpan(...)` (see below).
+
+## See metrics (Prometheus)
+
+1. Explore → data source **Prometheus**.
+2. Try `http_server_duration_milliseconds_count` or any custom counter you emitted via
+   `increment('domain.action')`. Auto-instrumentation also emits HTTP server duration histograms.
+
+## See logs (Loki)
+
+1. Explore → data source **Loki**.
+2. Query: `{service_name="myapp"}` (the label Alloy derives from the container name).
+3. Each line is the pino JSON, including `trace_id`, `span_id`, `level`, and your `event` field.
+   Filter by level with the `level` label, e.g. `{service_name="myapp", level="error"}`.
+
+---
+
+## Debug a slow request (the payoff)
+
+You get a report: "some `/applications` calls take 2 seconds." You can't reproduce it. Here's the loop:
+
+1. **Find it in logs.** Loki: `{service_name="myapp"} | json | durationMs > 1000`. You get the
+   exact log line for a slow call, with its `trace_id`.
+2. **Jump to the trace.** Click the `trace_id` value → "Tempo" link (Grafana wires log↔trace via
+   the shared id). You land on that request's span waterfall.
+3. **Read the waterfall.** One span dominates — say a `pg` query span at 1.8s. Now you know it's the
+   database, not your code, not Redis, not the network.
+4. **Confirm the pattern in metrics.** Prometheus: is DB query duration elevated across the board,
+   or just this endpoint? That tells you "fix this query" vs "the DB is under load."
+5. **Fix and verify.** After the fix, the same Loki→Tempo→Prometheus loop confirms the slow span is
+   gone — no guessing, no "works on my machine."
+
+The whole point: **logs tell you *that* it was slow, traces tell you *where*, metrics tell you *how
+often*.** They're joined by `trace_id`, so you move between them in two clicks.
+
+---
+
+## Instrumenting your own code
+
+Service methods keep the existing structured log **and** wrap their work in a span:
+
+```typescript
+import { withSpan } from '../config/tracing.js'
+import { increment } from '../config/metrics.js'
+import { logger } from '../config/logger.js'
+
+export async function createApplication(userId: string, input: CreateApplicationInput) {
+  const start = Date.now()
+  return withSpan('application.create', { userId }, async () => {
+    const app = await applicationRepo.insert(userId, input)
+    increment('application.created')
+    logger.info({ event: 'application.create', userId, applicationId: app.id, durationMs: Date.now() - start })
+    return app
+  })
+}
+```
+
+Because `withSpan` is active, every `logger.*` call inside it automatically carries that span's
+`trace_id`/`span_id` (the mixin reads the active span). You don't thread anything by hand.
+
+---
+
+## Turning it off (tests / CI / local)
+
+Leave **`OTEL_EXPORTER_OTLP_ENDPOINT` blank**. `startTelemetry()` returns early, no SDK starts, and
+`withSpan`/`metrics`/`logger` fall back to the `@opentelemetry/api` no-op — zero overhead, no
+network, no backend needed. This is the default for `npm test` and CI. **Never** start the LGTM
+stack in CI.
+
+---
+
+## Production
+
+The otel-lgtm image is for **dev/demo/testing**, not production. In prod, point
+`OTEL_EXPORTER_OTLP_ENDPOINT` at your real collector (e.g. Grafana Cloud, an OTel Collector
+deployment, or a vendor endpoint) and run a log agent (Alloy/Promtail/vendor) against stdout. The
+app code does not change — only the endpoint and the log shipper's destination.
+
+---
+
+## Gotchas → solutions (the hard-won bits)
+
+1. **ESM import hoisting broke instrumentation.** A static `import` of the app loaded express/pg/redis
+   before the SDK started, so nothing got patched. → `server.ts` `await startTelemetry()` first,
+   then `await import('./app.js')`. `telemetry.ts` must not statically import any instrumented module.
+2. **Service can't import Providers** (layer rule, enforced by madge). → `withSpan`/`metrics`/`logger`
+   live in `config/` (every layer may import Config) and use only the `@opentelemetry/api` global.
+3. **`z.coerce.boolean('false') === true`.** → Use `z.stringbool()` (zod 4) for boolean env flags.
+4. **NodeSDK option/version skew.** → Use the plural `metricReaders` (and `logRecordProcessors` if you
+   ever add OTLP logs). Keep every `@opentelemetry/*` on one release line; don't bump `api` past the
+   SDK's peer range.
+5. **`pino-pretty` crashed the prod image.** It's a devDependency, absent after `npm ci --omit=dev`.
+   → `logger.ts` only uses the pretty transport if `require.resolve('pino-pretty')` succeeds; prod
+   logs JSON.
+6. **Logs never reached Loki under ESM.** The pino→OTLP bridge silently emitted nothing (verified by
+   a missing `trace_id`). → Two parts: deterministic correlation via a pino `mixin` reading the active
+   span, and shipping via Alloy tailing stdout JSON. Independent of auto-patching.
+7. **Coverage gates.** `telemetry.ts` is boot-only → excluded from coverage (like `server.ts`).
+   Unit-test the `config/` helpers against the no-op API (fast, no infra).
+8. **Port clash.** otel-lgtm's Grafana defaults to 3000 → published on host **3001** so it doesn't
+   collide with the app/frontend.
+9. **CI.** Leave `OTEL_EXPORTER_OTLP_ENDPOINT` blank in tests so the SDK no-ops; never start the LGTM
+   stack in CI. Verify against real backends only in dev.
+
+---
+
+## See also
+
+- `docs/design-docs/decisions/ADR-001-observability.md` — *why* these choices were made.
+- `ARCHITECTURE.md` — the layer rules that put the helpers in Config and the SDK in Providers.

package/templates/express/docs/design-docs/team-workflow.md

@@ -0,0 +1,64 @@
+# Team Workflow
+
+How a 5-person team collaborates on this harness. Pairs with `.github/CODEOWNERS`
+and `.github/pull_request_template.md`.
+
+---
+
+## Branching
+
+- `main` is always deployable. No direct pushes.
+- Feature branches: `<type>/<short-slug>` — e.g. `feat/application-stages`, `fix/cursor-decode`.
+- One feature = one branch = one plan in `docs/exec-plans/active/`.
+- Rebase on `main` before opening a PR; keep branches short-lived (< 3 days).
+
+## The PR Flow
+
+1. Build layer-by-layer with `/build-layer`; each layer is gated and committed.
+2. When the plan's layers are all checked off, run `/garbage-collect`.
+3. Open a PR — the template checklist auto-populates. Fill every box.
+4. CI must be green (lint → typecheck → test → audit → secret-scan → arch-check).
+5. Code Owners review (see below). Address feedback with new commits (don't force-push mid-review).
+6. Squash-merge to `main`. Delete the branch.
+
+## Branch Protection (configure on `main` in GitHub → Settings → Branches)
+
+- [x] Require a pull request before merging
+- [x] Require approvals: **1** (2 for security-sensitive paths)
+- [x] Require review from Code Owners
+- [x] Dismiss stale approvals when new commits are pushed
+- [x] Require status checks to pass: `ci`
+- [x] Require branches to be up to date before merging
+- [x] Require conversation resolution before merging
+- [x] Do not allow bypassing the above (applies to admins too)
+- [x] Restrict who can push to matching branches (no direct pushes)
+
+## Approve vs. Merge
+
+| Action | Who |
+|---|---|
+| Open a PR | Anyone |
+| Review / approve | Any engineer not the author |
+| Approve security-sensitive paths (`auth/`, `hooks/`, `config/`, `migrations/`) | A Code Owner for that path (per `CODEOWNERS`) |
+| Merge to `main` | The PR author, once required approvals + CI are green |
+| Merge a security-sensitive PR | A `leads` member |
+
+Rule of thumb: **the author merges their own PR** after it's approved and green — this
+keeps ownership with the person who has the most context. Exception: security-sensitive
+PRs are merged by a Code Owner.
+
+## Required Reviews by Path
+
+These come from `.github/CODEOWNERS`. Edit that file to swap the placeholder team
+slugs for your real ones, then enable "Require review from Code Owners" in branch
+protection so they're enforced:
+
+- `/.claude/hooks/`, `/src/providers/auth/`, `/src/config/` → `@your-team/leads` (security-sensitive)
+- `/Dockerfile`, `/docker-compose.yml`, `/.github/workflows/` → `@your-team/platform` (build/containers/CI)
+- `/db/migrations/` → `@your-team/leads` (irreversible DB changes)
+- everything else → `@your-team/engineers`
+
+## Hotfixes
+
+- Branch from `main`: `fix/<slug>`. Same PR flow, but reviewers prioritise.
+- A hotfix still needs CI green and one approval — no exceptions, even under pressure.

package/templates/express/docs/exec-plans/tech-debt-tracker.md

@@ -0,0 +1,31 @@
+# Technical Debt Tracker
+
+Debt is logged here immediately when created. Never ignored until it's a crisis.
+Paid in small daily amounts.
+
+---
+
+## Severity
+
+| Level | Meaning | Fix by |
+|---|---|---|
+| P0 | Security or data integrity risk | Immediately |
+| P1 | Blocks future feature or causes recurring bugs | Within 2 sprints |
+| P2 | Degrades quality or velocity | Within the quarter |
+| P3 | Code smell, DX improvement | When in the area |
+
+---
+
+## Open Debt
+
+| ID | Severity | Area | Description | Created By | Date |
+|---|---|---|---|---|---|
+| *(none yet)* | — | — | — | — | — |
+
+---
+
+## Resolved Debt
+
+| ID | Description | Resolved By | Date |
+|---|---|---|---|
+| *(none yet)* | — | — | — |

package/templates/express/docs/product-specs/ROADMAP.md

@@ -0,0 +1,49 @@
+# Product Roadmap
+
+**Product:** *(name)* · **Brief:** *(one-line, or link to the brief)* · **Last updated:** *(YYYY-MM-DD)*
+**Walking skeleton:** *(SPEC-001 — the thinnest end-to-end slice; build this first)*
+
+> LIVING document — the altitude ABOVE specs. `/write-roadmap` writes it from a product brief.
+> `/write-spec` reads it to pick the next spec and pre-fill epic + dependency context, and flips
+> a row's **Spec ID** and **Status** as specs are created. Update in place; never delete history.
+
+---
+
+## Bounded Contexts (Epics)
+
+| Epic | Bounded Context | Responsibility |
+|---|---|---|
+| *(none yet)* | — | — |
+
+---
+
+## Spec Roadmap (dependency-ordered)
+
+| Order | Spec ID | Name | Epic | Depends On | Skeleton | Status |
+|---|---|---|---|---|---|---|
+| *(none yet)* | — | — | — | — | — | — |
+
+> `Spec ID` is `—` until `/write-spec` creates the file and assigns the real number.
+> `Depends On` references other rows by Spec ID (or by Order if not yet numbered).
+> Exactly one row carries `✅ yes` in `Skeleton`. Every spec appears after its dependencies.
+
+---
+
+## Build Sequence Rationale
+
+1. *(walking skeleton — why this thin slice first: proves auth + one entity + one endpoint end-to-end)*
+2. *(next slice — what it unblocks)*
+
+---
+
+## Roadmap Statuses
+
+| Status | Meaning |
+|---|---|
+| NOT_STARTED | On the roadmap, no spec file yet |
+| DRAFT | `/write-spec` wrote a SPEC-XXX (in `draft/`) |
+| READY | Spec approved — plannable |
+| PLANNED | `/write-plan` created a plan |
+| IN_PROGRESS | Being built |
+| SHIPPED | Complete and live |
+| CANCELLED | Removed from the roadmap |

package/templates/express/docs/product-specs/index.md

@@ -0,0 +1,21 @@
+# Product Specs Index
+
+> Whole-product decomposition (epics → dependency-ordered specs, walking skeleton) lives in
+> [`ROADMAP.md`](ROADMAP.md). `/write-spec` fills this index per spec as each is created.
+
+| ID | Name | Status | Plan | Created |
+|---|---|---|---|---|
+| *(no specs yet)* | — | — | — | — |
+
+---
+
+## Spec Statuses
+
+| Status | Meaning |
+|---|---|
+| DRAFT | Written, not yet reviewed |
+| READY | Reviewed and approved — plannable |
+| PLANNED | Plan created (PLAN-XXX assigned) |
+| IN_PROGRESS | Currently being built |
+| SHIPPED | Feature complete and in production |
+| CANCELLED | No longer being built |

package/templates/express/eslint.config.mjs

@@ -0,0 +1,94 @@
+import tseslint from '@typescript-eslint/eslint-plugin'
+import tsparser from '@typescript-eslint/parser'
+import boundaries from 'eslint-plugin-boundaries'
+
+// Layer import boundaries — the mechanical enforcement of ARCHITECTURE.md.
+// eslint-plugin-boundaries v6: the rule is `boundaries/dependencies` (the old
+// `element-types` is deprecated), selectors are object-based, element patterns are
+// folder globs (`src/<layer>/**`), and the TypeScript import resolver is REQUIRED so
+// the project's `.js`-extension ESM specifiers resolve to their .ts files — without
+// it, boundaries classifies nothing and silently enforces nothing.
+const LAYER_ELEMENTS = [
+  { type: 'types', pattern: 'src/types/**' },
+  { type: 'config', pattern: 'src/config/**' },
+  { type: 'models', pattern: 'src/models/**' },
+  { type: 'repo', pattern: 'src/repo/**' },
+  { type: 'services', pattern: 'src/services/**' },
+  { type: 'runtime', pattern: 'src/runtime/**' },
+  { type: 'providers', pattern: 'src/providers/**' },
+  { type: 'utils', pattern: 'src/utils/**' },
+]
+
+// Allowed dependencies per layer (mirrors ARCHITECTURE.md "Allowed Imports").
+// `config` and `utils` are cross-cutting; `providers` is wired in by `runtime` only.
+// Each layer lists itself so intra-layer imports stay legal (barrels, logger->env,
+// featureFlags->redis). Anything not allowed is rejected (default: disallow).
+const DEP_RULES = [
+  { from: { type: 'types' }, allow: { to: { type: ['types'] } } },
+  { from: { type: 'utils' }, allow: { to: { type: ['types', 'utils'] } } },
+  { from: { type: 'config' }, allow: { to: { type: ['types', 'utils', 'config'] } } },
+  { from: { type: 'models' }, allow: { to: { type: ['types', 'config', 'utils', 'models'] } } },
+  { from: { type: 'repo' }, allow: { to: { type: ['types', 'config', 'models', 'utils', 'repo'] } } },
+  { from: { type: 'services' }, allow: { to: { type: ['types', 'config', 'repo', 'utils', 'services'] } } },
+  { from: { type: 'providers' }, allow: { to: { type: ['types', 'config', 'utils', 'providers'] } } },
+  {
+    from: { type: 'runtime' },
+    allow: { to: { type: ['types', 'config', 'repo', 'services', 'providers', 'utils', 'runtime'] } },
+  },
+]
+
+export default [
+  {
+    files: ['src/**/*.ts'],
+    languageOptions: {
+      parser: tsparser,
+      parserOptions: {
+        project: './tsconfig.json',
+      },
+    },
+    plugins: {
+      '@typescript-eslint': tseslint,
+      boundaries,
+    },
+    settings: {
+      'boundaries/elements': LAYER_ELEMENTS,
+      // Required so boundaries resolves the repo's `.js`-extension ESM imports to .ts files.
+      'import/resolver': { typescript: { alwaysTryTypes: true } },
+    },
+    rules: {
+      'no-console': 'error',
+      '@typescript-eslint/no-explicit-any': 'error',
+      '@typescript-eslint/no-unsafe-assignment': 'error',
+      '@typescript-eslint/no-floating-promises': 'error',
+      // Custom rule: block process.env outside config
+      'no-restricted-syntax': [
+        'error',
+        {
+          selector: 'MemberExpression[object.name="process"][property.name="env"]',
+          message: 'Use env from src/config/env.ts instead of process.env directly',
+        },
+      ],
+      // Mechanical layer-boundary enforcement (v6 rule + object selectors).
+      'boundaries/dependencies': [
+        'error',
+        {
+          default: 'disallow',
+          rules: DEP_RULES,
+        },
+      ],
+    },
+  },
+  {
+    files: ['src/config/env.ts'],
+    rules: {
+      'no-restricted-syntax': 'off', // env.ts is allowed to use process.env
+    },
+  },
+  {
+    files: ['tests/**/*.ts'],
+    rules: {
+      'no-console': 'off', // tests can use console for debugging
+      '@typescript-eslint/no-explicit-any': 'off', // tests can use any for mocks
+    },
+  },
+]

package/templates/express/gitignore

@@ -0,0 +1,36 @@
+# Dependencies
+node_modules/
+
+# Build output
+dist/
+
+# Environment — NEVER commit .env files
+.env
+.env.local
+.env.*.local
+
+# Logs
+*.log
+logs/
+
+# Coverage
+coverage/
+
+# OS
+.DS_Store
+Thumbs.db
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+
+# Docker
+docker-compose.override.yml
+
+# k6 results
+k6-results/
+
+# Sequelize CLI
+.sequelizerc.local

package/templates/express/infra/monitoring/alloy/config.alloy

@@ -0,0 +1,59 @@
+// Grafana Alloy — ship container stdout (pino JSON) to Loki inside otel-lgtm.
+//
+// The app writes structured JSON logs carrying trace_id / span_id (via the pino mixin in
+// src/config/logger.ts). Alloy tails every container's stdout, parses the JSON to surface
+// `level` and `trace_id`, and pushes to Loki. In Grafana you can then jump log ↔ trace.
+//
+// Traces and metrics do NOT pass through here — the app exports those straight to the
+// collector over OTLP. Only logs use this path (it sidesteps the known ESM pino→OTLP bug).
+
+discovery.docker "containers" {
+  host = "unix:///var/run/docker.sock"
+}
+
+// Turn the Docker container name (e.g. "/harness-app-1") into a clean `service_name` label.
+discovery.relabel "containers" {
+  targets = discovery.docker.containers.targets
+
+  rule {
+    source_labels = ["__meta_docker_container_name"]
+    regex         = "/(.*)"
+    target_label  = "service_name"
+  }
+  rule {
+    source_labels = ["__meta_docker_container_name"]
+    regex         = "/(.*)"
+    target_label  = "container"
+  }
+}
+
+loki.source.docker "containers" {
+  host       = "unix:///var/run/docker.sock"
+  targets    = discovery.relabel.containers.output
+  labels     = { job = "docker" }
+  forward_to = [loki.process.pino.receiver]
+}
+
+// Parse pino JSON so `level` becomes a label and `trace_id` is queryable.
+loki.process "pino" {
+  stage.json {
+    expressions = {
+      level    = "level",
+      trace_id = "trace_id",
+    }
+  }
+
+  stage.labels {
+    values = {
+      level = "",
+    }
+  }
+
+  forward_to = [loki.write.default.receiver]
+}
+
+loki.write "default" {
+  endpoint {
+    url = "http://lgtm:3100/loki/api/v1/push"
+  }
+}

package/templates/express/jest.config.ts

@@ -0,0 +1,61 @@
+import type { Config } from 'jest'
+
+const config: Config = {
+  preset: 'ts-jest/presets/default-esm',
+  testEnvironment: 'node',
+  extensionsToTreatAsEsm: ['.ts'],
+  moduleNameMapper: {
+    '^(\\.{1,2}/.*)\\.js$': '$1',
+  },
+  transform: {
+    '^.+\\.tsx?$': [
+      'ts-jest',
+      {
+        useESM: true,
+      },
+    ],
+  },
+  testMatch: ['**/tests/**/*.test.ts'],
+  collectCoverageFrom: [
+    'src/**/*.ts',
+    '!src/**/*.d.ts',
+    '!src/runtime/server.ts',
+    '!src/providers/telemetry.ts', // boot-only OTel SDK wiring, like server.ts
+  ],
+  coverageDirectory: 'coverage',
+  coverageReporters: ['text', 'lcov', 'html'],
+  coverageThreshold: {
+    './src/utils/': {
+      branches: 100,
+      functions: 100,
+      lines: 100,
+      statements: 100,
+    },
+    './src/services/': {
+      branches: 90,
+      functions: 90,
+      lines: 90,
+      statements: 90,
+    },
+    './src/repo/': {
+      branches: 80,
+      functions: 80,
+      lines: 80,
+      statements: 80,
+    },
+    './src/runtime/routes/': {
+      branches: 75,
+      functions: 75,
+      lines: 75,
+      statements: 75,
+    },
+    './src/providers/': {
+      branches: 70,
+      functions: 70,
+      lines: 70,
+      statements: 70,
+    },
+  },
+}
+
+export default config

package/templates/express/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "harness-typescript-template",
+  "version": "0.0.1",
+  "description": "Express + TypeScript + Sequelize harness template",
+  "type": "module",
+  "engines": {
+    "node": ">=24",
+    "npm": ">=11"
+  },
+  "scripts": {
+    "dev": "tsx watch src/runtime/server.ts",
+    "build": "tsc -p tsconfig.build.json",
+    "start": "node dist/runtime/server.js",
+    "test": "jest",
+    "test:arch": "jest tests/architecture/",
+    "test:coverage": "jest --coverage",
+    "test:watch": "jest --watch",
+    "load:smoke": "k6 run tests/load/smoke.js",
+    "load:stress": "k6 run tests/load/stress.js",
+    "load:soak": "k6 run tests/load/soak.js",
+    "lint": "eslint src/ --max-warnings=0",
+    "lint:fix": "eslint src/ --fix",
+    "format": "prettier --write \"src/**/*.ts\" \"tests/**/*.ts\"",
+    "format:check": "prettier --check \"src/**/*.ts\" \"tests/**/*.ts\"",
+    "typecheck": "tsc --noEmit",
+    "check:circular": "madge --circular src/ --extensions ts",
+    "gate": "npm run typecheck && npm run lint && npm run check:circular && npm run test:arch",
+    "audit": "npm audit --omit=dev --audit-level=high",
+    "openapi:export": "tsx scripts/openapi.export.ts",
+    "db:migrate": "sequelize-cli db:migrate",
+    "db:migrate:undo": "sequelize-cli db:migrate:undo",
+    "db:seed": "sequelize-cli db:seed:all",
+    "prepare": "husky"
+  },
+  "keywords": [
+    "express",
+    "typescript",
+    "sequelize",
+    "harness"
+  ],
+  "author": "",
+  "license": "MIT",
+  "dependencies": {},
+  "devDependencies": {}
+}