DEVSTACKDevStack: production-ready stacks, wired and verified

wired, not just installed

Every module lands in the right place.

Helmet, CORS, rate limiting and logging, in the order they belong. This is the generated apps/api/src/app.ts, unedited:

export function createApp(deps: AppDeps): Express {
  const app = express()

  // Do not advertise the framework, even when no security middleware is selected.
  app.disable('x-powered-by')

  // Order (B17.2): request id, logging, security, body parsing, routes, not found, errors.
  app.use(requestId(deps.logger))
  app.use(requestLoggerMiddleware)
  if (docsEnabled) app.use(createDocsRouter())
  app.use(helmetMiddleware)
  app.use(corsMiddleware)
  app.use(apiRateLimiter)
  app.use(express.json())

  app.use(createHealthRouter(deps.readinessChecks))