mir-backend-node-fastifylisted

Make It Right (Fastify module). Fastify 5 + Node.js specific reliability augmentation. Use alongside mir-backend and mir-backend-node when the target stack is Fastify — it carries the mechanical footguns that the framework-agnostic tiers deliberately omit: schema-first validation and response serialization (and the data-leak risk of skipping the response schema), the fact that additionalProperties:false STRIPS rather than rejects under Fastify's default Ajv settings, the v5 full-JSON-schema requirement, server defaults that ship wide open (requestTimeout 0, connectionTimeout 0, maxParamLength 100, trustProxy false), the reply lifecycle and double-send traps, plugin encapsulation and decorator scoping, hook ordering for authentication, and the Content-Type validation-bypass CVE chain. TRIGGER only when the Node backend stack is Fastify used directly — building, reviewing, or debugging a Fastify route, plugin, hook, schema, or error handler. Always loads TOGETHER WITH mir-backend (the gates) and mir-backend-nod
anantbhandarkar/make-it-right · ★ 15 · API & Backend · score 81

Install: claude install-skill anantbhandarkar/make-it-right

# /mir-backend-node-fastify · Make It Right (Fastify) Bottom tier of the chain: `mir-backend` (generic gates) → `mir-backend-node` (V8/Node event-loop model) → **this** (Fastify library mechanics). Run the gates first; load the Node runtime tier for event-loop and process-model concerns; reach for *this* at Gate 5 (design mechanics), Gate 6 (implementation), and Gate 7 review. **Runtime-level concerns (blocking the event loop, worker_threads, unhandled rejections, stream backpressure, timeouts, heap limits, npm supply chain) live in `mir-backend-node` — not here.** **Stack assumed (npm registry, 13 Aug 2026):** `fastify@5.11.3` is `latest`. Fastify 4 reached end of life on 2025-06-30 and gets no security fixes — the `four` tag sits at `4.29.1`. A `6.0.0-alpha.0` exists on the `next` tag (published 2026-08-11); it is a pre-release, do not target it. Fastify 5 requires Node ≥ 20, but target Node 22/24 per the runtime tier — Node 20 is EOL. **Minimum patched version is 5.8.5**, not just "5.x" — see the CVE chain in Security. ## The Fastify footguns AI walks into most ### 1. Skipping the response schema leaks internal fields Fastify's JSON serialization is driven by `fast-json-stringify` using the JSON Schema on the route. The response schema does two things: it makes serialization faster than `JSON.stringify`, **and it strips any field not declared in the schema**. With no response schema, Fastify applies no serialization filter at all and the full internal object goes to