express-skill 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ac-aman
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,85 @@
+# express-skill
+
+> An open, production-ready AI Agent Skill for Express.js development. Compatible with `npx skills`, Antigravity, Claude Desktop, Cursor, and custom agentic AI systems.
+
+---
+
+## Overview
+
+`express-skill` equips AI agents with standard patterns, clean 4-layer architecture workflows, production security defaults, and modular reference blueprints for Express.js applications.
+
+---
+
+## Features
+
+- **Layered Architecture**: Enforces clear separation between Routes, Controllers, Services, and Repositories.
+- **Strict Request Validation**: Integrated `zod` schemas for incoming payloads.
+- **Production Middleware**: Reusable error handler, JWT auth middleware, async wrapper, and logger setup.
+- **Security Defaults**: OWASP-aligned standards with `helmet`, `cors`, and `express-rate-limit`.
+- **TypeScript & JavaScript Blueprints**: Pre-scaffolded starter code templates.
+
+---
+
+## Skill Directory Structure
+
+```text
+express-skill/
+├── package.json             # NPM package manifest
+├── README.md                # Skill documentation & publishing guide
+├── LICENSE                  # MIT License
+├── .gitignore               # Git & NPM ignore rules
+└── skills/
+    └── express-skill/
+        ├── SKILL.md         # Core agent instructions & metadata (YAML frontmatter)
+        ├── references/      # Detailed modular guides loaded on demand
+        │   ├── architecture.md
+        │   ├── middleware.md
+        │   └── security.md
+        └── templates/       # Boilerplate starters
+            ├── express-ts-starter.md
+            └── express-js-starter.md
+```
+
+---
+
+## Installation & Usage
+
+### Option 1: Via `npx skills` (GitHub Repository)
+Push this repository to GitHub and install it into any workspace:
+```bash
+npx skills add ac-aman/express-skill
+```
+
+### Option 2: Via NPM (`npm install`)
+Publish to NPM registry so agents or tools can discover it:
+```bash
+npm install express-skill
+```
+
+---
+
+## Publishing Guide
+
+### Step 1: Login to NPM
+Ensure you have an account on [npmjs.com](https://www.npmjs.com/) and log in via CLI:
+```bash
+npm login
+```
+
+### Step 2: Validate Package Files
+Test which files will be included in your npm tarball:
+```bash
+npm pack --dry-run
+```
+
+### Step 3: Publish to NPM
+Publish the skill publicly:
+```bash
+npm publish --access public
+```
+
+---
+
+## License
+
+[MIT](./LICENSE)

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "express-skill",
+  "version": "1.0.0",
+  "description": "An open AI Agent Skill for building robust, secure, and production-ready Express.js applications.",
+  "main": "skills/express-skill/SKILL.md",
+  "files": [
+    "skills",
+    "README.md",
+    "LICENSE"
+  ],
+  "keywords": [
+    "express",
+    "expressjs",
+    "agent-skill",
+    "skills",
+    "npx-skills",
+    "antigravity",
+    "ai-agent",
+    "claude",
+    "cursor",
+    "copilot"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ac-aman/express-skill.git"
+  },
+  "author": "ac-aman",
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/ac-aman/express-skill/issues"
+  },
+  "homepage": "https://github.com/ac-aman/express-skill#readme"
+}

package/skills/express-skill/SKILL.md

@@ -0,0 +1,72 @@
+---
+name: express-skill
+description: Comprehensive workflow, standards, and architecture guide for building production-ready Express.js web applications and REST APIs.
+license: MIT
+metadata:
+  author: "ac-aman"
+  version: "1.0.0"
+  tags: ["express", "node", "typescript", "rest-api", "backend","MVC", "Features"]
+---
+
+# Express.js Skill Guide
+
+This skill provides AI agents with standard patterns, architecture rules, security standards, and workflow procedures for designing, building, debugging, and maintaining Express.js backend services.
+
+---
+
+## Core Architectural Principles
+
+When building or refactoring Express.js applications, always enforce the following architectural rules:
+
+1. **Layered Architecture (Separation of Concerns)**
+   - **Routes**: Define HTTP endpoints, map request methods, attach middleware, and pass control to controllers.
+   - **Controllers**: Parse input, call service methods, handle response status codes and format JSON output. Keep controllers thin; do not embed business logic or raw database queries here.
+   - **Services**: Encapsulate core business logic, domain rules, third-party integrations, and transactions.
+   - **Repositories / Models**: Manage database access, schema definitions, and ORM/Query Builder calls.
+
+2. **Strict Request Validation**
+   - Use `zod` schema validation on incoming request bodies, query params, and URL path parameters before touching service layers.
+
+3. **Centralized Error Handling**
+   - Never handle errors with ad-hoc `try/catch` blocks inside controllers without passing exceptions to Express's global error handler.
+   - Express 4: Wrap async route handlers with an `asyncHandler` wrapper or return promises cleanly.
+   - Express 5: Async errors automatically pass to `next(err)`.
+
+4. **Security Defaults**
+   - Apply `helmet` middleware early in the app lifecycle.
+   - Enable CORS with explicit origin constraints (`cors()`).
+   - Standardize request rate limiting using `express-rate-limit`.
+   - Never expose raw database errors, stack traces, or internal server details in production responses.
+
+---
+
+## Directory Structure Standard
+
+Follow this canonical directory structure for Express projects:
+
+```text
+src/
+├── config/             # Environment variables (dotenv/zod) & server settings
+├── controllers/        # Request handlers (thin controller layer)
+├── middleware/         # Custom & third-party middleware (auth, error, logger, validation)
+├── models/             # Database schemas / ORM models (Prisma, Mongoose, Kysely, TypeORM)
+├── routes/             # Express router definitions & mounting
+├── services/           # Business logic & domain services
+├── utils/              # Helper functions, logger instance, custom error classes
+├── app.ts              # Express application configuration & middleware setup
+└── server.ts           # HTTP server initialization & graceful shutdown setup
+```
+
+---
+
+## Recommended Packages
+
+| Concern | Package | Usage |
+| :--- | :--- | :--- |
+| **Framework** | `express` | Main Web Framework |
+| **Validation** | `zod` | Input Schema Validation |
+| **Security** | `helmet`, `cors`, `express-rate-limit` | HTTP Security & Rate Limiting |
+| **Logging** | `pino` or `winston`, `morgan` | Structured Logging |
+| **Auth** | `jsonwebtoken`, `argon2` or `bcrypt` | Auth & Password Hashing |
+| **Testing** | `supertest`, `vitest` / `jest` | API Integration Testing |
+| **Dev Tools** | `tsx` or `nodemon`, `typescript` | Dev Server Execution |