senior-backend v1.1.0A

Immutable. This exact content is served forever at /api/v1/blob/a8165e2bc4a485a2.

---
name: senior-backend
description: >
  Backend development with Node.js/Express/Fastify and PostgreSQL. Use when designing REST or
  GraphQL APIs, optimizing database queries, implementing authentication, building
  microservices, handling migrations, or reviewing backend code.
license: MIT + Commons Clause
metadata:
  version: 1.1.0
  author: borghei
  category: engineering
  domain: backend
  updated: 2026-06-17
  tags: [api-design, microservices, databases, caching, queues]
---
# Senior Backend Engineer

Scaffold and review backend services: API design and OpenAPI-driven code generation for Express/Fastify/Koa, PostgreSQL schema analysis and migration generation, HTTP load testing, and production security hardening. Outputs ready-to-run route handlers, Zod validators, TypeScript types, migrations with rollbacks, and load-test reports.

## Core Capabilities

- **API scaffolding** — generate route handlers, validation middleware, TypeScript types, and OpenAPI specs across Express, Fastify, and Koa.
- **Database optimization** — schema analysis, missing-index detection, N+1 risk detection, and migration generation with paired rollback scripts.
- **Load testing** — configurable concurrency with latency percentiles (P50/P90/P95/P99), throughput, error rates, and endpoint comparison.
- **Security hardening** — JWT config, rate limiting, input validation (Zod), and security headers (helmet) for production readiness.
- **Standardized contracts** — consistent `data`/`error`/`meta` response envelope and HTTP status conventions.

## When to Use

- Designing a new API or refactoring existing endpoints.
- Slow queries or database performance needs improvement.
- Preparing an API for production or after a security review.
- Building regression/load-test baselines for backend endpoints.

## Clarify First

Before scaffolding, confirm these inputs. If any is unknown or vague, ASK — do not assume:

- [ ] **Framework** — Express / Fastify / Koa (`--framework`; changes the generated route handlers, validators, and types)
- [ ] **API contract source** — the OpenAPI spec or endpoint list to scaffold from (the input the scaffolder reads)
- [ ] **Database intent** — the schema file and whether you want analysis vs migration generation (drives `database_migration_tool.py`)

Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the artifact.

## Tools

| Tool | Purpose | Command |
|------|---------|---------|
| `api_scaffolder.py` | Generate route handlers, Zod validators, and TS types from an OpenAPI spec | `python scripts/api_scaffolder.py openapi.yaml --framework express --output src/routes/` |
| `database_migration_tool.py` | Analyze schemas, suggest indexes, and generate migrations with rollbacks | `python scripts/database_migration_tool.py schema.sql --analyze` |
| `api_load_tester.py` | HTTP load test with latency percentiles, throughput, and comparison | `python scripts/api_load_tester.py https://api.example.com/users --concurrency 50 --duration 30` |

## References

Load the reference that matches the task — keep this file lean and pull detail on demand:

- **[references/tools-reference.md](references/tools-reference.md)** — full usage examples, flag tables, and sample output for the scaffolder, migration tool, and load tester, plus quick-start and common commands. Read when running any tool.
- **[references/workflows-and-patterns.md](references/workflows-and-patterns.md)** — the API-design, database-optimization, and security-hardening workflows, common response/index patterns, the troubleshooting table, and the success-criteria bar. Read when designing or hardening a service.
- **[references/api_design_patterns.md](references/api_design_patterns.md)** — REST vs GraphQL, versioning, error handling, pagination. Read when designing new APIs.
- **[references/database_optimization_guide.md](references/database_optimization_guide.md)** — indexing strategies, query optimization, N+1 solutions. Read when fixing slow queries.
- **[references/backend_security_practices.md](references/backend_security_practices.md)** — OWASP Top 10, auth patterns, input validation. Read when hardening security.

## Scope & Limitations

**What this skill covers:**
- REST API design, scaffolding, and OpenAPI-driven code generation for Express, Fastify, and Koa
- PostgreSQL schema analysis, index optimization, migration generation with rollback support
- HTTP load testing with latency percentile analysis, throughput measurement, and endpoint comparison
- Backend security patterns including JWT configuration, rate limiting, input validation, and security headers

**What this skill does NOT cover:**
- Frontend development, UI components, or client-side state management -- see `senior-frontend`
- Infrastructure provisioning, container orchestration, or CI/CD pipeline setup -- see `senior-devops`
- GraphQL schema design, resolvers, or subscriptions -- see `senior-fullstack`
- Application performance monitoring (APM), distributed tracing, or log aggregation -- see `senior-secops`

## Integration Points

| Skill | Integration | Data Flow |
|-------|-------------|-----------|
| `senior-fullstack` | API routes generated here feed into fullstack project scaffolding | OpenAPI spec → fullstack scaffolder consumes as API contract |
| `senior-devops` | Migration scripts output here are consumed by CI/CD deployment pipelines | `migrations/` directory → deployment workflow applies and verifies |
| `senior-security` | Load test results and security hardening output feed into security review | Load test JSON → security audit validates rate limiting and error handling |
| `senior-qa` | Generated route handlers and validators provide test surface for QA automation | Route files + Zod schemas → QA generates integration test suites |
| `senior-frontend` | TypeScript types generated by the scaffolder are shared with frontend consumers | `types.ts` → frontend imports API types for type-safe client code |
| `code-reviewer` | Schema analysis issues and migration diffs feed into code review checklists | Analysis report → reviewer validates index coverage and naming conventions |