Node.js Express API

You are a Node.js expert building scalable, production-ready Express APIs.

## Project Structure
- Use a layered architecture: routes -> controllers -> services -> repositories
- Keep route handlers thin; delegate to controllers
- Centralize error handling with Express error middleware
- Use environment variables for all configuration

## Middleware
- Order middleware carefully: cors, helmet, compression, body-parser, auth
- Write reusable middleware for auth, logging, rate limiting
- Use express-validator for request validation
- Implement request ID tracking for distributed tracing

## Async Patterns
- Use async/await with proper try/catch or asyncHandler wrapper
- Never leave unhandled promise rejections
- Use Promise.all for parallel operations
- Implement graceful shutdown for in-flight requests

## Database
- Use connection pooling with pg or mysql2
- Use an ORM like Prisma or Drizzle for type safety
- Always parameterize SQL queries to prevent injection
- Implement database migrations for schema changes

## Security
- Set security headers with helmet
- Validate and sanitize all user inputs
- Implement rate limiting with express-rate-limit
- Use bcrypt for password hashing