Express REST API Generator

express-rest-api-generator

Generates production-ready Express.js REST API route handlers from natural language descriptions, including Zod input validation middleware, centralized error handling, and integration tests using Supertest. Produces fully typed TypeScript code following RESTful conventions and Express best practices. Activates when the user requests creation of a new REST API endpoint, route, or controller.

When to Use

This skill should be activated when the user:

• create an Express API endpoint
• generate a REST API route with validation
• build an Express.js endpoint from this description
• create a new API route handler with Zod validation and tests
• generate Express REST endpoint
• make an API endpoint with error handling and input validation
• scaffold a REST route with middleware and integration tests

Do NOT use this skill when:

• explain how Express middleware works
• debug my existing API endpoint
• review my Express route handler
• what is Zod schema validation
• fix the 500 error in my REST API

Workflow

Follow these steps precisely. Each step has a validation checkpoint. Do NOT proceed to the next step until the current step passes validation.

Step 1: Analyze API Requirements

1.1 1.

Inputs:

• user_request (string, required): Input: user_request

Expected Output:

• intermediateOutput (string): Intermediate output from step analyze-api-requirements_0

✅ Validation Checkpoint: Run scripts/validate_analyze_api_requirements_0.sh to verify this step.

🚩 Red-Flag Rules:

• No Hardcoded Secrets: Detects hardcoded API keys, passwords, tokens, or connection strings in the generated code (error)
• No Console.log Statements: Production API code should use a structured logger, not console.log (warning)
• Require Async Error Handling: Every async route handler must be wrapped in try/catch or use an async wrapper to prevent unhandled promise rejections (warning)
• Require Zod Validation: Input validation must use Zod schemas, not manual if-checks or other libraries (error)
• Output Length Check: Generated output must not exceed the maximum allowed length, indicating possible runaway generation (error)
• Excessive Output Length: Output is suspiciously long, suggesting confusion or hallucination (warning)
• Empty Output: Output is empty or contains only whitespace (error)
• Apology Pattern: Output starts with an apology, suggesting the model is confused (warning)

1.2 Read the user's natural language description and extract the resource name, HTTP method (GET, POST, PUT, PATCH, DELETE), and route path.

Inputs:

• previousOutput (string, required): Output from step analyze-api-requirements_0

Expected Output:

• intermediateOutput (string): Intermediate output from step analyze-api-requirements_1

✅ Validation Checkpoint: Run scripts/validate_analyze_api_requirements_1.sh to verify this step.

🚩 Red-Flag Rules:

• No Hardcoded Secrets: Detects hardcoded API keys, passwords, tokens, or connection strings in the generated code (error)
• No Console.log Statements: Production API code should use a structured logger, not console.log (warning)
• Require Async Error Handling: Every async route handler must be wrapped in try/catch or use an async wrapper to prevent unhandled promise rejections (warning)
• Require Zod Validation: Input validation must use Zod schemas, not manual if-checks or other libraries (error)
• Output Length Check: Generated output must not exceed the maximum allowed length, indicating possible runaway generation (error)
• Excessive Output Length: Output is suspiciously long, suggesting confusion or hallucination (warning)
• Empty Output: Output is empty or contains only whitespace (error)
• Apology Pattern: Output starts with an apology, suggesting the model is confused (warning)

1.3 2.

Inputs:

• previousOutput (string, required): Output from step analyze-api-requirements_1

Expected Output:

• intermediateOutput (string): Intermediate output from step analyze-api-requirements_2

✅ Validation Checkpoint: Run scripts/validate_analyze_api_requirements_2.sh to verify this step.

🚩 Red-Flag Rules:

• No Hardcoded Secrets: Detects hardcoded API keys, passwords, tokens, or connection strings in the generated code (error)
• No Console.log Statements: Production API code should use a structured logger, not console.log (warning)
• Require Async Error Handling: Every async route handler must be wrapped in try/catch or use an async wrapper to prevent unhandled promise rejections (warning)
• Require Zod Validation: Input validation must use Zod schemas, not manual if-checks or other libraries (error)
• Output Length Check: Generated output must not exceed the maximum allowed length, indicating possible runaway generation (error)
• Excessive Output Length: Output is suspiciously long, suggesting confusion or hallucination (warning)
• Empty Output: Output is empty or contains only whitespace (error)
• Apology Pattern: Output starts with an apology, suggesting the model is confused (warning)

1.4 Identify all request parameters including path params, query params, and request body fields with their expected types.

Inputs:

• previousOutput (string, required): Output from step analyze-api-requirements_2

Expected Output:

• intermediateOutput (string): Intermediate output from step analyze-api-requirements_3

✅ Validation Checkpoint: Run scripts/validate_analyze_api_requirements_3.sh to verify this step.

🚩 Red-Flag Rules:

• No Hardcoded Secrets: Detects hardcoded API keys, passwords, tokens, or connection strings in the generated code (error)
• No Console.log Statements: Production API code should use a structured logger, not console.log (warning)
• Require Async Error Handling: Every async route handler must be wrapped in try/catch or use an async wrapper to prevent unhandled promise rejections (warning)
• Require Zod Validation: Input validation must use Zod schemas, not manual if-checks or other libraries (error)
• Output Length Check: Generated output must not exceed the maximum allowed length, indicating possible runaway generation (error)
• Excessive Output Length: Output is suspiciously long, suggesting confusion or hallucination (warning)
• Empty Output: Output is empty or contains only whitespace (error)
• Apology Pattern: Output starts with an apology, suggesting the model is confused (warning)

1.5 3.

Inputs:

• previousOutput (string, required): Output from step analyze-api-requirements_3

Expected Output:

• intermediateOutput (string): Intermediate output from step analyze-api-requirements_4

✅ Validation Checkpoint: Run scripts/validate_analyze_api_requirements_4.sh to verify this step.

🚩 Red-Flag Rules:

• No Hardcoded Secrets: Detects hardcoded API keys, passwords, tokens, or connection strings in the generated code (error)
• No Console.log Statements: Production API code should use a structured logger, not console.log (warning)
• Require Async Error Handling: Every async route handler must be wrapped in try/catch or use an async wrapper to prevent unhandled promise rejections (warning)
• Require Zod Validation: Input validation must use Zod schemas, not manual if-checks or other libraries (error)
• Output Length Check: Generated output must not exceed the maximum allowed length, indicating possible runaway generation (error)
• Excessive Output Length: Output is suspiciously long, suggesting confusion or hallucination (warning)
• Empty Output: Output is empty or contains only whitespace (error)
• Apology Pattern: Output starts with an apology, suggesting the model is confused (warning)

1.6 List the expected success response shape with HTTP status code and response body structure.

Inputs:

• previousOutput (string, required): Output from step analyze-api-requirements_4

Expected Output:

• intermediateOutput (string): Intermediate output from step analyze-api-requirements_5

✅ Validation Checkpoint: Run scripts/validate_analyze_api_requirements_5.sh to verify this step.

🚩 Red-Flag Rules:

• No Hardcoded Secrets: Detects hardcoded API keys, passwords, tokens, or connection strings in the generated code (error)
• No Console.log Statements: Production API code should use a structured logger, not console.log (warning)
• Require Async Error Handling: Every async route handler must be wrapped in try/catch or use an async wrapper to prevent unhandled promise rejections (warning)
• Require Zod Validation: Input validation must use Zod schemas, not manual if-checks or other libraries (error)
• Output Length Check: Generated output must not exceed the maximum allowed length, indicating possible runaway generation (error)
• Excessive Output Length: Output is suspiciously long, suggesting confusion or hallucination (warning)
• Empty Output: Output is empty or contains only whitespace (error)
• Apology Pattern: Output starts with an apology, suggesting the model is confused (warning)

1.7 4.

Inputs:

• previousOutput (string, required): Output from step analyze-api-requirements_5

Expected Output:

• intermediateOutput (string): Intermediate output from step analyze-api-requirements_6

✅ Validation Checkpoint: Run scripts/validate_analyze_api_requirements_6.sh to verify this step.

🚩 Red-Flag Rules:

• No Hardcoded Secrets: Detects hardcoded API keys, passwords, tokens, or connection strings in the generated code (error)
• No Console.log Statements: Production API code should use a structured logger, not console.log (warning)
• Require Async Error Handling: Every async route handler must be wrapped in try/catch or use an async wrapper to prevent unhandled promise rejections (warning)
• Require Zod Validation: Input validation must use Zod schemas, not manual if-checks or other libraries (error)
• Output Length Check: Generated output must not exceed the maximum allowed length, indicating possible runaway generation (error)
• Excessive Output Length: Output is suspiciously long, suggesting confusion or hallucination (warning)
• Empty Output: Output is empty or contains only whitespace (error)
• Apology Pattern: Output starts with an apology, suggesting the model is confused (warning)

1.8 Identify error scenarios including validation failures, not-found cases, and authorization checks.

Inputs:

• previousOutput (string, required): Output from step analyze-api-requirements_6

Expected Output:

• intermediateOutput (string): Intermediate output from step analyze-api-requirements_7

✅ Validation Checkpoint: Run scripts/validate_analyze_api_requirements_7.sh to verify this step.

🚩 Red-Flag Rules:

• No Hardcoded Secrets: Detects hardcoded API keys, passwords, tokens, or connection strings in the generated code (error)
• No Console.log Statements: Production API code should use a structured logger, not console.log (warning)
• Require Async Error Handling: Every async route handler must be wrapped in try/catch or use an async wrapper to prevent unhandled promise rejections (warning)
• Require Zod Validation: Input validation must use Zod schemas, not manual if-checks or other libraries (error)
• Output Length Check: Generated output must not exceed the maximum allowed length, indicating possible runaway generation (error)
• Excessive Output Length: Output is suspiciously long, suggesting confusion or hallucination (warning)
• Empty Output: Output is empty or contains only whitespace (error)
• Apology Pattern: Output starts with an apology, suggesting the model is confused (warning)

1.9 5.

Inputs:

• previousOutput (string, required): Output from step analyze-api-requirements_7

Expected Output:

• intermediateOutput (string): Intermediate output from step analyze-api-requirements_8

✅ Validation Checkpoint: Run scripts/validate_analyze_api_requirements_8.sh to verify this step.

🚩 Red-Flag Rules:

• No Hardcoded Secrets: Detects hardcoded API keys, passwords, tokens, or connection strings in the generated code (error)
• No Console.log Statements: Production API code should use a structured logger, not console.log (warning)
• Require Async Error Handling: Every async route handler must be wrapped in try/catch or use an async wrapper to prevent unhandled promise rejections (warning)
• Require Zod Validation: Input validation must use Zod schemas, not manual if-checks or other libraries (error)
• Output Length Check: Generated output must not exceed the maximum allowed length, indicating possible runaway generation (error)
• Excessive Output Length: Output is suspiciously long, suggesting confusion or hallucination (warning)
• Empty Output: Output is empty or contains only whitespace (error)
• Apology Pattern: Output starts with an apology, suggesting the model is confused (warning)

1.10 Determine any relationships to other resources or dependencies on external services.

Inputs:

• previousOutput (string, required): Output from step analyze-api-requirements_8

Expected Output:

• api_specification (string): Output: api_specification

✅ Validation Checkpoint: Run scripts/validate_analyze_api_requirements_9.sh to verify this step.

🚩 Red-Flag Rules:

• No Hardcoded Secrets: Detects hardcoded API keys, passwords, tokens, or connection strings in the generated code (error)
• No Console.log Statements: Production API code should use a structured logger, not console.log (warning)
• Require Async Error Handling: Every async route handler must be wrapped in try/catch or use an async wrapper to prevent unhandled promise rejections (warning)
• Require Zod Validation: Input validation must use Zod schemas, not manual if-checks or other libraries (error)
• Output Length Check: Generated output must not exceed the maximum allowed length, indicating possible runaway generation (error)
• Excessive Output Length: Output is suspiciously long, suggesting confusion or hallucination (warning)
• Empty Output: Output is empty or contains only whitespace (error)
• Apology Pattern: Output starts with an apology, suggesting the model is confused (warning)

Step 2: Design Zod Validation Schema

2.1 1.

Inputs:

• api_specification (string, required): Input: api_specification

Expected Output:

• intermediateOutput (string): Intermediate output from step design-validation-schema_0

✅ Validation Checkpoint: Run scripts/validate_design_validation_schema_0.sh to verify this step.

🚩 Red-Flag Rules:

• No Hardcoded Secrets: Detects hardcoded API keys, passwords, tokens, or connection strings in the generated code (error)
• No Console.log Statements: Production API code should use a structured logger, not console.log (warning)
• Require Async Error Handling: Every async route handler must be wrapped in try/catch or use an async wrapper to prevent unhandled promise rejections (warning)
• Require Zod Validation: Input validation must use Zod schemas, not manual if-checks or other libraries (error)
• Output Length Check: Generated output must not exceed the maximum allowed length, indicating possible runaway generation (error)
• Excessive Output Length: Output is suspiciously long, suggesting confusion or hallucination (warning)
• Empty Output: Output is empty or contains only whitespace (error)
• Apology Pattern: Output starts with an apology, suggesting the model is confused (warning)

2.2 Create a Zod schema for request body validation covering all required and optional fields from the API specification.

Inputs:

• previousOutput (string, required): Output from step design-validation-schema_0

Expected Output:

• intermediateOutput (string): Intermediate output from step design-validation-schema_1

✅ Validation Checkpoint: Run scripts/validate_design_validation_schema_1.sh to verify this step.

🚩 Red-Flag Rules:

• No Hardcoded Secrets: Detects hardcoded API keys, passwords, tokens, or connection strings in the generated code (error)
• No Console.log Statements: Production API code should use a structured logger, not console.log (warning)
• Require Async Error Handling: Every async route handler must be wrapped in try/catch or use an async wrapper to prevent unhandled promise rejections (warning)
• Require Zod Validation: Input validation must use Zod schemas, not manual if-checks or other libraries (error)
• Output Length Check: Generated output must not exceed the maximum allowed length, indicating possible runaway generation (error)
• Excessive Output Length: Output is suspiciously long, suggesting confusion or hallucination (warning)
• Empty Output: Output is empty or contains only whitespace (error)
• Apology Pattern: Output starts with an apology, suggesting the model is confused (warning)

2.3 2.

Inputs:

• previousOutput (string, required): Output from step design-validation-schema_1

Expected Output:

• intermediateOutput (string): Intermediate output from step design-validation-schema_2

✅ Validation Checkpoint: Run scripts/validate_design_validation_schema_2.sh to verify this step.

🚩 Red-Flag Rules:

• No Hardcoded Secrets: Detects hardcoded API keys, passwords, tokens, or connection strings in the generated code (error)
• No Console.log Statements: Production API code should use a structured logger, not console.log (warning)
• Require Async Error Handling: Every async route handler must be wrapped in try/catch or use an async wrapper to prevent unhandled promise rejections (warning)
• Require Zod Validation: Input validation must use Zod schemas, not manual if-checks or other libraries (error)
• Output Length Check: Generated output must not exceed the maximum allowed length, indicating possible runaway generation (error)
• Excessive Output Length: Output is suspiciously long, suggesting confusion or hallucination (warning)
• Empty Output: Output is empty or contains only whitespace (error)
• Apology Pattern: Output starts with an apology, suggesting the model is confused (warning)

2.4 Define Zod schemas for path parameters with appropriate coercion (e.g., z.coerce.number() for numeric IDs).

Inputs:

• previousOutput (string, required): Output from step design-validation-schema_2

Expected Output:

• intermediateOutput (string): Intermediate output from step design-validation-schema_3

✅ Validation Checkpoint: Run scripts/validate_design_validation_schema_3.sh to verify this step.

🚩 Red-Flag Rules:

• No Hardcoded Secrets: Detects hardcoded API keys, passwords, tokens, or connection strings in the generated code (error)
• No Console.log Statements: Production API code should use a structured logger, not console.log (warning)
• Require Async Error Handling: Every async route handler must be wrapped in try/catch or use an async wrapper to prevent unhandled promise rejections (warning)
• Require Zod Validation: Input validation must use Zod schemas, not manual if-checks or other libraries (error)
• Output Length Check: Generated output must not exceed the maximum allowed length, indicating possible runaway generation (error)
• Excessive Output Length: Output is suspiciously long, suggesting confusion or hallucination (warning)
• Empty Output: Output is empty or contains only whitespace (error)
• Apology Pattern: Output starts with an apology, suggesting the model is confused (warning)

2.5 3.

Inputs:

• previousOutput (string, required): Output from step design-validation-schema_3

Expected Output:

• intermediateOutput (string): Intermediate output from step design-validation-schema_4

✅ Validation Checkpoint: Run scripts/validate_design_validation_schema_4.sh to verify this step.

🚩 Red-Flag Rules:

• No Hardcoded Secrets: Detects hardcoded API keys, passwords, tokens, or connection strings in the generated code (error)
• No Console.log Statements: Production API code should use a structured logger, not console.log (warning)
• Require Async Error Handling: Every async route handler must be wrapped in try/catch or use an async wrapper to prevent unhandled promise rejections (warning)
• Require Zod Validation: Input validation must use Zod schemas, not manual if-checks or other libraries (error)
• Output Length Check: Generated output must not exceed the maximum allowed length, indicating possible runaway generation (error)
• Excessive Output Length: Output is suspiciously long, suggesting confusion or hallucination (warning)
• Empty Output: Output is empty or contains only whitespace (error)
• Apology Pattern: Output starts with an apology, suggesting the model is confused (warning)

2.6 Define Zod schemas for query parameters including defaults and transformations.

Inputs:

• previousOutput (string, required): Output from step design-validation-schema_4

Expected Output:

• intermediateOutput (string): Intermediate output from step design-validation-schema_5

✅ Validation Checkpoint: Run scripts/validate_design_validation_schema_5.sh to verify this step.

🚩 Red-Flag Rules:

• No Hardcoded Secrets: Detects hardcoded API keys, passwords, tokens, or connection strings in the generated code (error)
• No Console.log Statements: Production API code should use a structured logger, not console.log (warning)
• Require Async Error Handling: Every async route handler must be wrapped in try/catch or use an async wrapper to prevent unhandled promise rejections (warning)
• Require Zod Validation: Input validation must use Zod schemas, not manual if-checks or other libraries (error)
• Output Length Check: Generated output must not exceed the maximum allowed length, indicating possible runaway generation (error)
• Excessive Output Length: Output is suspiciously long, suggesting confusion or hallucination (warning)
• Empty Output: Output is empty or contains only whitespace (error)
• Apology Pattern: Output starts with an apology, suggesting the model is confused (warning)

2.7 4.

Inputs:

• previousOutput (string, required): Output from step design-validation-schema_5

Expected Output:

• intermediateOutput (string): Intermediate output from step design-validation-schema_6

✅ Validation Checkpoint: Run scripts/validate_design_validation_schema_6.sh to verify this step.

🚩 Red-Flag Rules:

• No Hardcoded Secrets: Detects hardcoded API keys, passwords, tokens, or connection strings in the generated code (error)
• No Console.log Statements: Production API code should use a structured logger, not console.log (warning)
• Require Async Error Handling: Every async route handler must be wrapped in try/catch or use an async wrapper to prevent unhandled promise rejections (warning)
• Require Zod Validation: Input validation must use Zod schemas, not manual if-checks or other libraries (error)
• Output Length Check: Generated output must not exceed the maximum allowed length, indicating possible runaway generation (error)
• Excessive Output Length: Output is suspiciously long, suggesting confusion or hallucination (warning)
• Empty Output: Output is empty or contains only whitespace (error)
• Apology Pattern: Output starts with an apology, suggesting the model is confused (warning)

2.8 Add custom Zod refinements for business-rule constraints such as date ranges, mutually exclusive fields, or conditional requirements.

Inputs:

• previousOutput (string, required): Output from step design-validation-schema_6

Expected Output:

• intermediateOutput (string): Intermediate output from step design-validation-schema_7

✅ Validation Checkpoint: Run scripts/validate_design_validation_schema_7.sh to verify this step.

🚩 Red-Flag Rules:

• No Hardcoded Secrets: Detects hardcoded API keys, passwords, tokens, or connection strings in the generated code (error)
• No Console.log Statements: Production API code should use a structured logger, not console.log (warning)
• Require Async Error Handling: Every async route handler must be wrapped in try/catch or use an async wrapper to prevent unhandled promise rejections (warning)
• Require Zod Validation: Input validation must use Zod schemas, not manual if-checks or other libraries (error)
• Output Length Check: Generated output must not exceed the maximum allowed length, indicating possible runaway generation (error)
• Excessive Output Length: Output is suspiciously long, suggesting confusion or hallucination (warning)
• Empty Output: Output is empty or contains only whitespace (error)
• Apology Pattern: Output starts with an apology, suggesting the model is confused (warning)

2.9 5.

Inputs:

• previousOutput (string, required): Output from step design-validation-schema_7

Expected Output:

• intermediateOutput (string): Intermediate output from step design-validation-schema_8

✅ Validation Checkpoint: Run scripts/validate_design_validation_schema_8.sh to verify this step.

🚩 Red-Flag Rules:

• No Hardcoded Secrets: Detects hardcoded API keys, passwords, tokens, or connection strings in the generated code (error)
• No Console.log Statements: Production API code should use a structured logger, not console.log (warning)
• Require Async Error Handling: Every async route handler must be wrapped in try/catch or use an async wrapper to prevent unhandled promise rejections (warning)
• Require Zod Validation: Input validation must use Zod schemas, not manual if-checks or other libraries (error)
• Output Length Check: Generated output must not exceed the maximum allowed length, indicating possible runaway generation (error)
• Excessive Output Length: Output is suspiciously long, suggesting confusion or hallucination (warning)
• Empty Output: Output is empty or contains only whitespace (error)
• Apology Pattern: Output starts with an apology, suggesting the model is confused (warning)

2.10 Export inferred TypeScript types from each Zod schema using z.infer.

Inputs:

• previousOutput (string, required): Output from step design-validation-schema_8

Expected Output:

• validation_schemas (string): Output: validation_schemas

✅ Validation Checkpoint: Run scripts/validate_design_validation_schema_9.sh to verify this step.

🚩 Red-Flag Rules:

• No Hardcoded Secrets: Detects hardcoded API keys, passwords, tokens, or connection strings in the generated code (error)
• No Console.log Statements: Production API code should use a structured logger, not console.log (warning)
• Require Async Error Handling: Every async route handler must be wrapped in try/catch or use an async wrapper to prevent unhandled promise rejections (warning)
• Require Zod Validation: Input validation must use Zod schemas, not manual if-checks or other libraries (error)
• Output Length Check: Generated output must not exceed the maximum allowed length, indicating possible runaway generation (error)
• Excessive Output Length: Output is suspiciously long, suggesting confusion or hallucination (warning)
• Empty Output: Output is empty or contains only whitespace (error)
• Apology Pattern: Output starts with an apology, suggesting the model is confused (warning)

Step 3: Implement Route Handler and Middleware

3.1 1.

Inputs:

• api_specification (string, required): Input: api_specification
• validation_schemas (string, required): Input: validation_schemas

Expected Output:

• intermediateOutput (string): Intermediate output from step implement-route-handler_0

✅ Validation Checkpoint: Run scripts/validate_implement_route_handler_0.sh to verify this step.

🚩 Red-Flag Rules:

• No Hardcoded Secrets: Detects hardcoded API keys, passwords, tokens, or connection strings in the generated code (error)
• No Console.log Statements: Production API code should use a structured logger, not console.log (warning)
• Require Async Error Handling: Every async route handler must be wrapped in try/catch or use an async wrapper to prevent unhandled promise rejections (warning)
• Require Zod Validation: Input validation must use Zod schemas, not manual if-checks or other libraries (error)
• Output Length Check: Generated output must not exceed the maximum allowed length, indicating possible runaway generation (error)
• Excessive Output Length: Output is suspiciously long, suggesting confusion or hallucination (warning)
• Empty Output: Output is empty or contains only whitespace (error)
• Apology Pattern: Output starts with an apology, suggesting the model is confused (warning)

3.2 Create the Express route handler function with proper async/await wrapping and typed request/response objects.

Inputs:

• previousOutput (string, required): Output from step implement-route-handler_0

Expected Output:

• intermediateOutput (string): Intermediate output from step implement-route-handler_1

✅ Validation Checkpoint: Run scripts/validate_implement_route_handler_1.sh to verify this step.

🚩 Red-Flag Rules:

• No Hardcoded Secrets: Detects hardcoded API keys, passwords, tokens, or connection strings in the generated code (error)
• No Console.log Statements: Production API code should use a structured logger, not console.log (warning)
• Require Async Error Handling: Every async route handler must be wrapped in try/catch or use an async wrapper to prevent unhandled promise rejections (warning)
• Require Zod Validation: Input validation must use Zod schemas, not manual if-checks or other libraries (error)
• Output Length Check: Generated output must not exceed the maximum allowed length, indicating possible runaway generation (error)
• Excessive Output Length: Output is suspiciously long, suggesting confusion or hallucination (warning)
• Empty Output: Output is empty or contains only whitespace (error)
• Apology Pattern: Output starts with an apology, suggesting the model is confused (warning)

3.3 2.

Inputs:

• previousOutput (string, required): Output from step implement-route-handler_1

Expected Output:

• intermediateOutput (string): Intermediate output from step implement-route-handler_2

✅ Validation Checkpoint: Run scripts/validate_implement_route_handler_2.sh to verify this step.

🚩 Red-Flag Rules:

• No Hardcoded Secrets: Detects hardcoded API keys, passwords, tokens, or connection strings in the generated code (error)
• No Console.log Statements: Production API code should use a structured logger, not console.log (warning)
• Require Async Error Handling: Every async route handler must be wrapped in try/catch or use an async wrapper to prevent unhandled promise rejections (warning)
• Require Zod Validation: Input validation must use Zod schemas, not manual if-checks or other libraries (error)
• Output Length Check: Generated output must not exceed the maximum allowed length, indicating possible runaway generation (error)
• Excessive Output Length: Output is suspiciously long, suggesting confusion or hallucination (warning)
• Empty Output: Output is empty or contains only whitespace (error)
• Apology Pattern: Output starts with an apology, suggesting the model is confused (warning)

3.4 Implement a reusable validation middleware function that accepts a Zod schema and returns an Express middleware that parses and validates the request, attaching validated data to the request object.

Inputs:

• previousOutput (string, required): Output from step implement-route-handler_2

Expected Output:

• intermediateOutput (string): Intermediate output from step implement-route-handler_3

✅ Validation Checkpoint: Run scripts/validate_implement_route_handler_3.sh to verify this step.

🚩 Red-Flag Rules:

• No Hardcoded Secrets: Detects hardcoded API keys, passwords, tokens, or connection strings in the generated code (error)
• No Console.log Statements: Production API code should use a structured logger, not console.log (warning)
• Require Async Error Handling: Every async route handler must be wrapped in try/catch or use an async wrapper to prevent unhandled promise rejections (warning)
• Require Zod Validation: Input validation must use Zod schemas, not manual if-checks or other libraries (error)
• Output Length Check: Generated output must not exceed the maximum allowed length, indicating possible runaway generation (error)
• Excessive Output Length: Output is suspiciously long, suggesting confusion or hallucination (warning)
• Empty Output: Output is empty or contains only whitespace (error)
• Apology Pattern: Output starts with an apology, suggesting the model is confused (warning)

3.5 3.

Inputs:

• previousOutput (string, required): Output from step implement-route-handler_3

Expected Output:

• intermediateOutput (string): Intermediate output from step implement-route-handler_4

✅ Validation Checkpoint: Run scripts/validate_implement_route_handler_4.sh to verify this step.

🚩 Red-Flag Rules:

• No Hardcoded Secrets: Detects hardcoded API keys, passwords, tokens, or connection strings in the generated code (error)
• No Console.log Statements: Production API code should use a structured logger, not console.log (warning)
• Require Async Error Handling: Every async route handler must be wrapped in try/catch or use an async wrapper to prevent unhandled promise rejections (warning)
• Require Zod Validation: Input validation must use Zod schemas, not manual if-checks or other libraries (error)
• Output Length Check: Generated output must not exceed the maximum allowed length, indicating possible runaway generation (error)
• Excessive Output Length: Output is suspiciously long, suggesting confusion or hallucination (warning)
• Empty Output: Output is empty or contains only whitespace (error)
• Apology Pattern: Output starts with an apology, suggesting the model is confused (warning)

3.6 Wire the route with the validation middleware preceding the handler in the middleware chain.

Inputs:

• previousOutput (string, required): Output from step implement-route-handler_4

Expected Output:

• intermediateOutput (string): Intermediate output from step implement-route-handler_5

✅ Validation Checkpoint: Run scripts/validate_implement_route_handler_5.sh to verify this step.

🚩 Red-Flag Rules:

• No Hardcoded Secrets: Detects hardcoded API keys, passwords, tokens, or connection strings in the generated code (error)
• No Console.log Statements: Production API code should use a structured logger, not console.log (warning)
• Require Async Error Handling: Every async route handler must be wrapped in try/catch or use an async wrapper to prevent unhandled promise rejections (warning)
• Require Zod Validation: Input validation must use Zod schemas, not manual if-checks or other libraries (error)
• Output Length Check: Generated output must not exceed the maximum allowed length, indicating possible runaway generation (error)
• Excessive Output Length: Output is suspiciously long, suggesting confusion or hallucination (warning)
• Empty Output: Output is empty or contains only whitespace (error)
• Apology Pattern: Output starts with an apology, suggesting the model is confused (warning)

3.7 4.

Inputs:

• previousOutput (string, required): Output from step implement-route-handler_5

Expected Output:

• intermediateOutput (string): Intermediate output from step implement-route-handler_6

✅ Validation Checkpoint: Run scripts/validate_implement_route_handler_6.sh to verify this step.

🚩 Red-Flag Rules:

• No Hardcoded Secrets: Detects hardcoded API keys, passwords, tokens, or connection strings in the generated code (error)
• No Console.log Statements: Production API code should use a structured logger, not console.log (warning)
• Require Async Error Handling: Every async route handler must be wrapped in try/catch or use an async wrapper to prevent unhandled promise rejections (warning)
• Require Zod Validation: Input validation must use Zod schemas, not manual if-checks or other libraries (error)
• Output Length Check: Generated output must not exceed the maximum allowed length, indicating possible runaway generation (error)
• Excessive Output Length: Output is suspiciously long, suggesting confusion or hallucination (warning)
• Empty Output: Output is empty or contains only whitespace (error)
• Apology Pattern: Output starts with an apology, suggesting the model is confused (warning)

3.8 Implement the core business logic in the handler, returning the correct HTTP status codes for success (200, 201, 204) based on the HTTP method.

Inputs:

• previousOutput (string, required): Output from step implement-route-handler_6

Expected Output:

• intermediateOutput (string): Intermediate output from step implement-route-handler_7

✅ Validation Checkpoint: Run scripts/validate_implement_route_handler_7.sh to verify this step.

🚩 Red-Flag Rules:

• No Hardcoded Secrets: Detects hardcoded API keys, passwords, tokens, or connection strings in the generated code (error)
• No Console.log Statements: Production API code should use a structured logger, not console.log (warning)
• Require Async Error Handling: Every async route handler must be wrapped in try/catch or use an async wrapper to prevent unhandled promise rejections (warning)
• Require Zod Validation: Input validation must use Zod schemas, not manual if-checks or other libraries (error)
• Output Length Check: Generated output must not exceed the maximum allowed length, indicating possible runaway generation (error)
• Excessive Output Length: Output is suspiciously long, suggesting confusion or hallucination (warning)
• Empty Output: Output is empty or contains only whitespace (error)
• Apology Pattern: Output starts with an apology, suggesting the model is confused (warning)

3.9 5.

Inputs:

• previousOutput (string, required): Output from step implement-route-handler_7

Expected Output:

• intermediateOutput (string): Intermediate output from step implement-route-handler_8

✅ Validation Checkpoint: Run scripts/validate_implement_route_handler_8.sh to verify this step.

🚩 Red-Flag Rules:

• No Hardcoded Secrets: Detects hardcoded API keys, passwords, tokens, or connection strings in the generated code (error)
• No Console.log Statements: Production API code should use a structured logger, not console.log (warning)
• Require Async Error Handling: Every async route handler must be wrapped in try/catch or use an async wrapper to prevent unhandled promise rejections (warning)
• Require Zod Validation: Input validation must use Zod schemas, not manual if-checks or other libraries (error)
• Output Length Check: Generated output must not exceed the maximum allowed length, indicating possible runaway generation (error)
• Excessive Output Length: Output is suspiciously long, suggesting confusion or hallucination (warning)
• Empty Output: Output is empty or contains only whitespace (error)
• Apology Pattern: Output starts with an apology, suggesting the model is confused (warning)

3.10 Add appropriate response headers including Content-Type and Location header for POST/201 responses.

Inputs:

• previousOutput (string, required): Output from step implement-route-handler_8

Expected Output:

• route_handler_code (string): Output: route_handler_code

✅ Validation Checkpoint: Run scripts/validate_implement_route_handler_9.sh to verify this step.

🚩 Red-Flag Rules:

• No Hardcoded Secrets: Detects hardcoded API keys, passwords, tokens, or connection strings in the generated code (error)
• No Console.log Statements: Production API code should use a structured logger, not console.log (warning)
• Require Async Error Handling: Every async route handler must be wrapped in try/catch or use an async wrapper to prevent unhandled promise rejections (warning)
• Require Zod Validation: Input validation must use Zod schemas, not manual if-checks or other libraries (error)
• Output Length Check: Generated output must not exc

…(truncated)