Senior Backend Engineer

Scaffold and review backend services: API design and OpenAPI-driven code generation for Express/Fastify/Koa, PostgreSQL schema analysis and migration generation, HTTP load testing, and production security hardening. Outputs ready-to-run route handlers, Zod validators, TypeScript types, migrations with rollbacks, and load-test reports.

Core Capabilities

• API scaffolding — generate route handlers, validation middleware, TypeScript types, and OpenAPI specs across Express, Fastify, and Koa.
• Database optimization — schema analysis, missing-index detection, N+1 risk detection, and migration generation with paired rollback scripts.
• Load testing — configurable concurrency with latency percentiles (P50/P90/P95/P99), throughput, error rates, and endpoint comparison.
• Security hardening — JWT config, rate limiting, input validation (Zod), and security headers (helmet) for production readiness.
• Standardized contracts — consistent data/error/meta response envelope and HTTP status conventions.

When to Use

• Designing a new API or refactoring existing endpoints.
• Slow queries or database performance needs improvement.
• Preparing an API for production or after a security review.
• Building regression/load-test baselines for backend endpoints.

Clarify First

Before scaffolding, confirm these inputs. If any is unknown or vague, ASK — do not assume:

• Framework — Express / Fastify / Koa (--framework; changes the generated route handlers, validators, and types)
• API contract source — the OpenAPI spec or endpoint list to scaffold from (the input the scaffolder reads)
• Database intent — the schema file and whether you want analysis vs migration generation (drives database_migration_tool.py)

Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the artifact.

Tools

References

Load the reference that matches the task — keep this file lean and pull detail on demand:

• references/tools-reference.md — full usage examples, flag tables, and sample output for the scaffolder, migration tool, and load tester, plus quick-start and common commands. Read when running any tool.
• references/workflows-and-patterns.md — the API-design, database-optimization, and security-hardening workflows, common response/index patterns, the troubleshooting table, and the success-criteria bar. Read when designing or hardening a service.
• references/api_design_patterns.md — REST vs GraphQL, versioning, error handling, pagination. Read when designing new APIs.
• references/database_optimization_guide.md — indexing strategies, query optimization, N+1 solutions. Read when fixing slow queries.
• references/backend_security_practices.md — OWASP Top 10, auth patterns, input validation. Read when hardening security.

Scope & Limitations

What this skill covers:

• REST API design, scaffolding, and OpenAPI-driven code generation for Express, Fastify, and Koa
• PostgreSQL schema analysis, index optimization, migration generation with rollback support
• HTTP load testing with latency percentile analysis, throughput measurement, and endpoint comparison
• Backend security patterns including JWT configuration, rate limiting, input validation, and security headers

What this skill does NOT cover:

• Frontend development, UI components, or client-side state management -- see senior-frontend
• Infrastructure provisioning, container orchestration, or CI/CD pipeline setup -- see senior-devops
• GraphQL schema design, resolvers, or subscriptions -- see senior-fullstack
• Application performance monitoring (APM), distributed tracing, or log aggregation -- see senior-secops

Integration Points