express: Architecture

Architecture health: 77/100 (C)

Overview

express is a JavaScript/TypeScript project. It is a library of 1 package. The main structural risks to watch: 6 oversized "god" files. The file with the widest blast radius is test/support/utils.js: 10 files depend on it at runtime.

_This entire analysis runs on your machine with no AI required. Connect a model provider to also narrate the reasoning and recover decisions._

Where to start

1. index.js Start here: how the system boots and wires its subsystems together.
2. test/support/utils.js Core module: 10 other modules depend on it, so it shapes much of the system.
3. lib/utils.js Core module: 7 other modules depend on it, so it shapes much of the system.
4. lib/express.js Core module: 3 other modules depend on it, so it shapes much of the system.
5. examples/mvc/db.js Core module: 3 other modules depend on it, so it shapes much of the system.
6. examples/auth/index.js Key flow: Authentication, a high-risk path that enters at GET / (examples/auth/index.js).

System map

flowchart TD
  subgraph sys_boundary["express"]
    express["express"]
  end
  class express library
  classDef frontend fill:#2563eb,stroke:#93c5fd,color:#fff,stroke-width:2px;
  classDef service fill:#059669,stroke:#6ee7b7,color:#fff,stroke-width:2px;
  classDef store fill:#d97706,stroke:#fcd34d,color:#fff,stroke-width:2px;
  classDef queue fill:#9333ea,stroke:#d8b4fe,color:#fff,stroke-width:2px;
  classDef job fill:#4f46e5,stroke:#a5b4fc,color:#fff,stroke-width:2px;
  classDef external fill:#475569,stroke:#cbd5e1,color:#fff,stroke-width:2px;
  classDef aiprovider fill:#e11d48,stroke:#fda4af,color:#fff,stroke-width:2px;
  classDef library fill:#0891b2,stroke:#67e8f9,color:#fff,stroke-width:2px;
  classDef cli fill:#0d9488,stroke:#5eead4,color:#fff,stroke-width:2px;
  classDef user fill:#64748b,stroke:#e2e8f0,color:#fff,stroke-width:2px;
  classDef muted fill:#334155,stroke:#64748b,color:#cbd5e1,stroke-width:1px;

Critical flows

Application startup high risk

Entry: process start (index.js)

Boot wires every subsystem together; a fault here stops the whole process from starting. It also passes through a fragile zone (express.js), widening the blast radius.

sequenceDiagram
  actor C0 as Process
  participant F0 as index.js
  participant F1 as express.js
  C0->>F0: process start
  F0->>F1: calls

Authentication high risk

Entry: GET / (examples/auth/index.js)

returns a response to the caller (client)

Authentication guards every protected resource; a regression here can expose data or grant unauthorized access.

sequenceDiagram
  actor C0 as Caller
  participant F0 as auth/index.js
  participant F1 as cookie-sessions/index.js
  participant F2 as session/index.js
  participant F3 as redis.js
  C0->>F0: GET /
  F0-->>C0: returns a response to the caller
  F1-->>C0: returns a response to the caller
  F2-->>C0: returns a response to the caller
  F3-->>C0: returns a response to the caller

Fragile zones

• test/support/utils.js (score 20): 10 files depend on it at runtime
• lib/utils.js (score 14): 7 files depend on it at runtime
• lib/express.js (score 6.8): 3 files depend on it at runtime
• lib/response.js (score 6.3): 1 file depends on it at runtime; oversized and doing too much
• examples/mvc/db.js (score 6): 3 files depend on it at runtime

Architecture rules