Zum Hauptinhalt springen
tsecurity.de LIVE
Echtzeit-Radar & Feeds
Alle RSS Feeds
👥 Community & Social
Sichere ProgrammierungWhat is Programming And How i can Enjoy it?(24.09.2026 um 11:54 Uhr)
Sichere ProgrammierungYou Don't Need Adobe Commerce Cloud to Survive Black Friday(24.09.2026 um 11:55 Uhr)
Malware / Trojaner / VirenBeyond Lazarus: Organization of DPRK cyber capabilities(24.09.2026 um 11:59 Uhr)
Malware / Trojaner / VirenBeyond Lazarus: Organization of DPRK Cyber Capabilities(24.09.2026 um 11:59 Uhr)
Malware / Trojaner / VirenThe fake worker threat and the rise of human infiltration(24.09.2026 um 11:59 Uhr)
Malware / Trojaner / VirenPolinRider Spreads Through Compromised GitHub Accounts and Packagist(24.09.2026 um 11:59 Uhr)
Malware / Trojaner / VirenWeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentials(24.09.2026 um 11:59 Uhr)
Sichere ProgrammierungWhat is Programming And How i can Enjoy it?(24.09.2026 um 11:54 Uhr)
Sichere ProgrammierungYou Don't Need Adobe Commerce Cloud to Survive Black Friday(24.09.2026 um 11:55 Uhr)
Malware / Trojaner / VirenBeyond Lazarus: Organization of DPRK cyber capabilities(24.09.2026 um 11:59 Uhr)
Malware / Trojaner / VirenBeyond Lazarus: Organization of DPRK Cyber Capabilities(24.09.2026 um 11:59 Uhr)
Malware / Trojaner / VirenThe fake worker threat and the rise of human infiltration(24.09.2026 um 11:59 Uhr)
Malware / Trojaner / VirenPolinRider Spreads Through Compromised GitHub Accounts and Packagist(24.09.2026 um 11:59 Uhr)
Malware / Trojaner / VirenWeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentials(24.09.2026 um 11:59 Uhr)
Intelligence View
⚡ tsecurity.de Intelligence

How to Structure a TypeScript Project So AI Agents Can Navigate It

Your AI coding assistant is only as good as the codebase it navigates. I've watched Claude Code, Cursor, and Copilot struggle with the same project structures that trip up junior developers — and excel in codebases designed with clear b…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

Your AI coding assistant is only as good as the codebase it navigates. I've watched Claude Code, Cursor, and Copilot struggle with the same project structures that trip up junior developers — and excel in codebases designed with clear boundaries.



After restructuring 8 TypeScript projects specifically to work better with AI agents, here's what actually moves the needle.






Why Project Structure Matters More Now



When you ask an AI agent to "add a new endpoint for user notifications," it needs to:





  1. Find where endpoints live


  2. Understand the existing patterns


  3. Locate related code (models, services, types)


  4. Follow the conventions already established



In a well-structured project, the agent finds all of this in seconds. In a messy one, it hallucinates paths, invents patterns that don't match your codebase, and produces code you'll spend 20 minutes fixing.



The difference isn't the AI model — it's the signal-to-noise ratio in your file tree.






The Structure That Works



Here's the folder structure I use across all my TypeScript projects (NestJS, Next.js, Express):




src/
├── domain/ # Pure business logic, zero dependencies
│ ├── user/
│ │ ├── user.entity.ts
│ │ ├── user.value-objects.ts
│ │ └── user.errors.ts
│ └── order/
│ ├── order.entity.ts
│ └── order.errors.ts
├── application/ # Use cases + port interfaces
│ ├── user/
│ │ ├── use-cases/
│ │ │ ├── create-user.ts
│ │ │ └── update-user.ts
│ │ └── ports/
│ │ ├── user.repository.ts
│ │ └── email.port.ts
│ └── order/
│ ├── use-cases/
│ └── ports/
├── infrastructure/ # Framework + external implementations
│ ├── database/
│ │ ├── prisma-user.repository.ts
│ │ └── prisma-order.repository.ts
│ ├── http/
│ │ ├── controllers/
│ │ │ ├── user.controller.ts
│ │ │ └── order.controller.ts
│ │ ├── middleware/
│ │ └── dto/
│ │ ├── create-user.dto.ts
│ │ └── update-user.dto.ts
│ └── external/
│ ├── email.service.ts
│ └── payment.gateway.ts
├── shared/ # Cross-cutting utilities
│ ├── types/
│ ├── utils/
│ └── constants/
└── CLAUDE.md # AI agent instructions






Why this works for AI agents: every folder name is a clear signal. When the agent sees application/user/use-cases/, it knows exactly what goes there — and more importantly, what doesn't.






Rule 1: One Concept Per File



This is the single biggest improvement you can make for AI navigation.




// ❌ BAD: user.types.ts — 200 lines of mixed concerns
export interface User { ... }
export interface UserProfile { ... }
export interface CreateUserDto { ... }
export interface UpdateUserDto { ... }
export type UserRole = 'admin' | 'editor' | 'viewer';
export type UserPermission = 'read' | 'write' | 'delete';
export interface UserFilters { ... }
export interface PaginatedUsers { ... }









// ✅ GOOD: split by concept
// domain/user/user.entity.ts
export interface User {
id: string;
email: string;
role: UserRole;
profile: UserProfile | null;
createdAt: Date;
}

export type UserRole = 'admin' | 'editor' | 'viewer';

// domain/user/user-profile.entity.ts
export interface UserProfile {
displayName: string;
avatarUrl: string | null;
bio: string;
}

// infrastructure/http/dto/create-user.dto.ts
export class CreateUserDto {
@IsEmail()
email: string;

@MinLength(8)
password: string;

@IsOptional()
displayName?: string;
}






When an AI agent searches for "User entity," it finds user.entity.ts — not a 200-line grab bag where it has to parse which interface is the domain entity vs. the DTO vs. the filter type.






Rule 2: Predictable Naming Conventions



AI agents learn patterns from your existing files. If your naming is consistent, the agent extrapolates correctly. If it's inconsistent, every new file is a coin flip.




✅ Consistent pattern:
create-user.ts → CreateUser class
update-user.ts → UpdateUser class
delete-user.ts → DeleteUser class
create-order.ts → CreateOrder class

❌ Inconsistent naming:
createUser.ts → CreateUserUseCase class
update_user.ts → UpdateUser class
deleteUserHandler.ts → UserDeleteHandler class
newOrder.ts → OrderCreation class






My naming rules (defined in CLAUDE.md):





  • Files: kebab-case, suffix indicates type — .entity.ts, .repository.ts, .controller.ts, .dto.ts, .port.ts


  • Classes: PascalCase, no suffix redundancy — CreateUser not CreateUserUseCase


  • Interfaces: PascalCase, prefix with purpose — UserRepository, EmailPort


  • Test files: same name + .spec.tscreate-user.spec.ts






Rule 3: Explicit Dependency Direction



This is where most projects fall apart for AI agents. When imports go in every direction, the agent can't predict where to add new code.




// ❌ Infrastructure importing from other infrastructure
// infrastructure/database/prisma-user.repository.ts
import { EmailService } from '../external/email.service'; // Wrong layer!
import { UserController } from '../http/controllers/user.controller'; // Circular!

// ✅ Clean dependency direction: domain ← application ← infrastructure
// infrastructure/database/prisma-user.repository.ts
import { User } from '../../domain/user/user.entity';
import { UserRepository } from '../../application/user/ports/user.repository';






The rule is simple: imports only point inward. Infrastructure → Application → Domain. Never the reverse.



I enforce this with a simple TypeScript path alias in tsconfig.json:




{
"compilerOptions": {
"paths": {
"@domain/*": ["src/domain/*"],
"@application/*": ["src/application/*"],
"@infrastructure/*": ["src/infrastructure/*"],
"@shared/*": ["src/shared/*"]
}
}
}






When the AI sees @domain/user/user.entity, it immediately knows the layer. No ambiguous relative paths like ../../../models/user.






Rule 4: CLAUDE.md at the Root



Every project gets a CLAUDE.md that tells the agent how to navigate:




## Project Structure
- `src/domain/` — pure entities, value objects, domain errors. ZERO external imports.
- `src/application/` — use cases and port interfaces. Only imports from domain.
- `src/infrastructure/` — framework code, DB, HTTP, external services.
- `src/shared/` — cross-cutting utilities used by all layers.

## Conventions
- One class/interface per file
- File names: kebab-case with type suffix (.entity.ts, .repository.ts)
- Use cases: one per file in `application/{module}/use-cases/`
- New endpoint = controller method + DTO + use case + port (if needed)

## Adding a New Feature
1. Define entity in `domain/{module}/`
2. Create use case in `application/{module}/use-cases/`
3. Define ports in `application/{module}/ports/`
4. Implement infrastructure in `infrastructure/`
5. Wire up in module file
6. Run `npm run typecheck && npm run test`






This isn't just documentation — it's a navigation map. The AI reads this first and knows exactly where to put new code, what patterns to follow, and what commands to run for verification.






Rule 5: Kill Barrel Exports



This one surprised me. Barrel exports (index.ts files that re-export everything) actually hurt AI agent performance:




// ❌ src/domain/user/index.ts
export * from './user.entity';
export * from './user-profile.entity';
export * from './user.errors';
export * from './user.value-objects';






The problem: when the AI encounters import { User } from '@domain/user', it doesn't know which file contains User. It has to open the barrel, scan all re-exports, then find the source file. With large barrels (20+ exports), the agent frequently picks the wrong source when it needs to modify the definition.




// ✅ Direct imports — AI knows exactly where to look
import { User } from '@domain/user/user.entity';
import { UserNotFoundError } from '@domain/user/user.errors';






Direct imports are longer, but they're unambiguous. The AI can jump straight to the right file. The trade-off is worth it.






Rule 6: Co-locate Tests






❌ Separate test directory:
src/
application/user/use-cases/create-user.ts
tests/
unit/
application/
user/
use-cases/
create-user.spec.ts ← 5 directories deep, mirrors src

✅ Co-located tests:
src/
application/user/use-cases/
create-user.ts
create-user.spec.ts ← right next to the source






When the AI modifies create-user.ts, it naturally finds create-user.spec.ts in the same directory. No searching through a mirrored test tree. It updates both files in one pass.






The Proof: Before vs After



I restructured a 40K-line NestJS project using these rules. Here's what changed in my AI-assisted workflow:

































Metric Before (flat structure) After (layered + conventions)
AI finds correct file on first try ~60% ~95%
Generated code follows project patterns ~40% ~85%
"Fix the imports" follow-up prompts 3-4 per feature 0-1 per feature
Time from prompt to working code 8-12 min 2-4 min


The biggest win wasn't any single rule — it was the combination. When naming is predictable AND dependencies flow one direction AND CLAUDE.md explains the patterns, the AI connects the dots.






What This Doesn't Solve



To be clear: structure alone doesn't make AI write correct business logic. It still:





  • Misses edge cases in your domain rules


  • Oversimplifies error handling (as I covered in my previous article)


  • Doesn't understand your specific performance requirements


  • Can't infer undocumented business constraints



Structure makes the AI a better navigator. Your job is still being the architect.






Key Takeaways





  • One concept per file — the single biggest improvement for AI navigation


  • Predictable naming — consistent conventions let AI extrapolate patterns correctly


  • Explicit dependency direction — imports only point inward (infrastructure → application → domain)


  • CLAUDE.md at the root — a navigation map the AI reads first before touching any code


  • Kill barrel exports — direct imports give AI unambiguous file locations


  • Co-locate tests — the AI updates source and tests in one pass



Your codebase is the AI's context window. Make it scannable, predictable, and unambiguous — and the AI goes from "occasionally useful" to "consistently reliable."






More practical guides on AI-augmented architecture on Twitter/X. Connect on LinkedIn for the discussion.






Originally published on my Hashnode blog.

SOC Incident Playbook: Remote Code Execution (RCE) Defense
title: Detect Exploitation - How to Structure a TypeScript Project So AI Agents Can Navigate It
id: 8f2c1ef4-d130-4c18-888a-e87e0c7c8759
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "How to Structure a TypeScript " ascii wide
    condition:
        any of them
}
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich How to Structure a TypeScript Project So.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten How to Structure a TypeScript Project So AI Agents Can Navigate It

Thematisch verwandte Begriffe: Structure, TypeScript, Project, Agents · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY Kritische Sicherheitsmeldung
Advisory →
TTS Reader • tsecurity.de Voice
tsecurity.de Icon
tsecurity.de App
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
🔖 Gespeicherte Artikel
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel Rechts: nächster Artikel unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel TTP ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...

Zurück: vorheriger Vor: nächster
↗ Original-Quelle
Social Reaktionen Deine Reaktion zählt
Einstufung & Relevanz-Poll 0 Stimmen
In sozialen Netzwerken teilen 1-Klick