@thedecipherist/claude-packs 0.0.0-stage → 1.0.0

package/packs/fastify/checks/no-trust-proxy-true.json

@@ -0,0 +1,25 @@
+{
+  "id": "no-trust-proxy-true",
+  "why": "trustProxy: true makes req.ip the leftmost X-Forwarded-For value, so every spoofed header is a fresh rate-limit bucket. Use the ingress hop count or an address list.",
+  "rule": ".claude/rules/security-one-switch.md",
+  "concepts": [
+    "fastify-app",
+    "routes"
+  ],
+  "exclude": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    ".claude/**",
+    "**/.claude/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/test/**",
+    "**/tests/**"
+  ],
+  "code": true,
+  "pattern": "\\btrustProxy\\s*:\\s*true\\b|trust proxy['\\\"]?\\s*,\\s*true",
+  "bad": "const app = Fastify({ trustProxy: true });",
+  "good": "const app = Fastify({ trustProxy: 1 });"
+}

package/packs/fastify/checks/one-error-body.json

@@ -0,0 +1,26 @@
+{
+  "id": "one-error-body",
+  "why": "A route that builds its own 404/400 body diverges from the error handler's contract (here: an empty correlation_id). One notFound()/badRequest() builder, used everywhere.",
+  "rule": ".claude/rules/security-one-switch.md",
+  "concepts": [
+    "routes"
+  ],
+  "exclude": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    ".claude/**",
+    "**/.claude/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/test/**",
+    "**/tests/**",
+    "**/app.ts",
+    "**/errors.*"
+  ],
+  "code": false,
+  "pattern": "code\\s*:\\s*['\\\"](?:NOT_FOUND|BAD_REQUEST|INTERNAL|UNAUTHORIZED|FORBIDDEN)['\\\"]",
+  "bad": "return reply.code(404).send({ error: { code: 'NOT_FOUND', message: 'not found', correlation_id: '' } });",
+  "good": "return notFound(reply);"
+}

package/packs/fastify/checks/origin-from-config-not-host.json

@@ -0,0 +1,31 @@
+{
+  "id": "origin-from-config-not-host",
+  "why": "Host and x-forwarded-* headers are client-controlled unless the proxy sets them. Origin, issuer, redirects and cookie flags come from PUBLIC_URL in the env schema.",
+  "rule": ".claude/rules/trust-config-not-headers.md",
+  "concepts": [
+    "routes"
+  ],
+  "exclude": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    ".claude/**",
+    "**/.claude/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/test/**",
+    "**/tests/**",
+    "**/env.*",
+    "**/config.*",
+    "**/config/**",
+    "**/proxy.*"
+  ],
+  "code": false,
+  "pattern": "\\bheaders\\s*(?:\\.host\\b|\\[\\s*['\\\"](?:host|x-forwarded-proto|x-forwarded-host|x-forwarded-for)['\\\"]\\s*\\])",
+  "bad": "const proto = req.headers['x-forwarded-proto'] ?? 'http';\nconst origin = `${proto}://${req.headers.host}`;",
+  "good": "const origin = env.PUBLIC_URL;",
+  "globs": [
+    "**/ui/**/*.ts"
+  ]
+}

package/packs/fastify/checks/password-needs-slow-hash.json

@@ -0,0 +1,30 @@
+{
+  "id": "password-needs-slow-hash",
+  "why": "A fast digest (md5, sha1, sha256) of a password falls to offline brute force at billions of guesses per second. argon2id or bcrypt (cost >= 12) with the library's own salt.",
+  "rule": ".claude/rules/credentials-and-input.md",
+  "concepts": [
+    "routes"
+  ],
+  "globs": [
+    "**/auth/**",
+    "**/handlers/**",
+    "**/users*"
+  ],
+  "exclude": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    ".claude/**",
+    "**/.claude/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/test/**",
+    "**/tests/**"
+  ],
+  "code": false,
+  "flags": "i",
+  "pattern": "createHash\\s*\\(\\s*['\\\"](?:md5|sha1|sha256|sha512)['\\\"]\\s*\\)[^;\\n]*(?:password|passwd|pwd)|(?:password|passwd)[^;\\n]*createHash\\s*\\(\\s*['\\\"](?:md5|sha1|sha256|sha512)['\\\"]",
+  "bad": "const hash = createHash('sha256').update(password + salt).digest('hex');",
+  "good": "const hash = await argon2.hash(password, { type: argon2.argon2id });"
+}

package/packs/fastify/checks/sec-headers-present.json

@@ -0,0 +1,28 @@
+{
+  "id": "sec-headers-present",
+  "why": "An app file that creates the Fastify instance must register helmet (inside the single isProd switch). Its absence is invisible in a diff; this check sees the whole file.",
+  "rule": ".claude/rules/security-one-switch.md",
+  "concepts": [
+    "fastify-app"
+  ],
+  "exclude": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    ".claude/**",
+    "**/.claude/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/test/**",
+    "**/tests/**"
+  ],
+  "code": false,
+  "mode": "needs",
+  "pattern": "\\bFastify\\s*\\(|\\bfastify\\s*\\(\\s*\\{",
+  "needs": [
+    "\\bhelmet\\b"
+  ],
+  "bad": "const app = Fastify({ logger });\nawait app.register(rateLimit, {});",
+  "good": "const app = Fastify({ logger });\nif (isProd) { await app.register(helmet, { contentSecurityPolicy: csp }); await app.register(rateLimit, {}); }"
+}

package/packs/fastify/checks/secrets-compared-constant-time.json

@@ -0,0 +1,24 @@
+{
+  "id": "secrets-compared-constant-time",
+  "why": "=== on a token or secret leaks its length and prefix through timing. crypto.timingSafeEqual (or the hash library's verify for passwords).",
+  "rule": ".claude/rules/credentials-and-input.md",
+  "concepts": [
+    "routes"
+  ],
+  "exclude": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    ".claude/**",
+    "**/.claude/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/test/**",
+    "**/tests/**"
+  ],
+  "code": true,
+  "pattern": "\\b(?:token|secret|signature|apiKey|api_key|bearer|otp)\\b\\s*[!=]==?\\s*(?!\\s*(?:undefined|null|''|\\\"\\\"|``))[\\w'\\\"`]",
+  "bad": "if (token === expected) return next();",
+  "good": "if (timingSafeEqual(Buffer.from(token), Buffer.from(expected))) return next();\nif (token === undefined) return reply.code(401).send(unauthorized);"
+}

package/packs/fastify/checks/sse-needs-error-listener.json

@@ -0,0 +1,28 @@
+{
+  "id": "sse-needs-error-listener",
+  "why": "A keepalive write on an errored socket emits 'error' on the ServerResponse; with no listener that is an uncaught exception. Register raw.on('error', stop) before the first write.",
+  "rule": ".claude/rules/streams-and-hijacks.md",
+  "concepts": [
+    "routes"
+  ],
+  "exclude": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    ".claude/**",
+    "**/.claude/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/test/**",
+    "**/tests/**"
+  ],
+  "code": false,
+  "mode": "needs",
+  "pattern": "text/event-stream",
+  "needs": [
+    "\\.on\\s*\\(\\s*['\\\"]error['\\\"]"
+  ],
+  "bad": "raw.writeHead(200, { 'content-type': 'text/event-stream' });\nraw.on('close', stop);",
+  "good": "raw.writeHead(200, { 'content-type': 'text/event-stream' });\nraw.on('error', stop);\nraw.on('close', stop);"
+}

package/packs/fastify/checks/user-bytes-need-disposition.json

@@ -0,0 +1,29 @@
+{
+  "id": "user-bytes-need-disposition",
+  "why": "Serving uploaded bytes inline with their stored mime on the app origin is stored XSS: a text/html or image/svg+xml upload runs with the session cookie. Content-Disposition: attachment, or an allow-listed type.",
+  "rule": ".claude/rules/trust-config-not-headers.md",
+  "concepts": [
+    "routes"
+  ],
+  "exclude": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    ".claude/**",
+    "**/.claude/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/test/**",
+    "**/tests/**"
+  ],
+  "code": false,
+  "mode": "needs",
+  "pattern": "\\.type\\(\\s*[\\w.]+\\.(?:mime|mimeType|contentType|content_type)\\b",
+  "needs": [
+    "Content-Disposition"
+  ],
+  "bad": "return reply.type(got.meta.mime).send(got.bytes);",
+  "good": "return reply.header('Content-Disposition', `attachment; filename=\"${safeName}\"`).type(got.meta.mime).send(got.bytes);",
+  "flags": "i"
+}

package/packs/fastify/pack.json

@@ -0,0 +1,41 @@
+{
+  "name": "fastify",
+  "version": "1.0.0",
+  "description": "Fastify servers: security always on, trust config not headers, Zod at every route, streams and hijacks handled.",
+  "type": "stock",
+  "author": "claude-packs",
+  "license": "MIT",
+  "homepage": "https://github.com/TheDecipherist/claude-packs",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/TheDecipherist/claude-packs.git",
+    "directory": "packs/fastify"
+  },
+  "keywords": [
+    "fastify",
+    "api"
+  ],
+  "engines": {
+    "claude-packs": ">=0.19.0"
+  },
+  "folders": {},
+  "concepts": {
+    "fastify-app": [
+      "**/app.ts",
+      "**/server.ts",
+      "**/src/index.ts",
+      "**/plugins/**/*.ts"
+    ],
+    "routes": [
+      "**/routes/**/*.ts",
+      "**/handlers/**/*.ts",
+      "**/controllers/**/*.ts",
+      "**/app.ts",
+      "**/server.ts",
+      "**/ui/router*.ts",
+      "**/auth/**/*.ts"
+    ]
+  },
+  "skillsIn": null,
+  "hooks": {}
+}

package/packs/fastify/rules/credentials-and-input.md

@@ -0,0 +1,23 @@
+---
+# concepts: routes
+paths:
+  - "placeholder"
+---
+
+# Passwords are slow-hashed, secrets compared constant-time, regexes never built from input
+
+<constraints>
+Always do:
+- Passwords at rest: argon2id (preferred) or bcrypt cost ≥ 12; the library manages the salt. The plaintext exists only in the request that carries it: never persisted, logged, returned or put in an error message; response schemas omit the hash field entirely.
+- Secrets compared constant-time: the hash library's verify for passwords, `crypto.timingSafeEqual` for tokens (`secrets-compared-constant-time`).
+- Login failures say "Invalid email or password", never which field.
+- Every public, unauthenticated endpoint that accepts user-submitted data (login, signup, contact, reviews, newsletter) carries a human gate (a CAPTCHA verified **server-side**) plus a rate limit, and its rejections are observable.
+- Unauthenticated input that becomes durable state later rendered to another user is a decision recorded in the feature doc, not a default.
+- A `RegExp` built from input goes through an escape helper (`no-regexp-from-input`), with a test that goes red when the sanitiser is bypassed.
+- Test passwords are generated per run and test emails assembled at runtime; no password, secret or email literal is ever committed, tests included.
+
+Never do:
+- md5/sha-family digests for passwords, salted or not (`password-needs-slow-hash`): fast hashes fall to offline brute force at billions of guesses per second.
+- `===` on a token or secret.
+- `err.message` in a client-facing body.
+</constraints>

package/packs/fastify/rules/security-one-switch.md

@@ -0,0 +1,28 @@
+---
+# concepts: fastify-app
+paths:
+  - "placeholder"
+---
+
+# Security hardening is production machinery: one `isProd` switch, off in dev, proven by the prod gate
+
+The owner's iron rule, from scars: helmet's CSP blocked the inline hydration script, Secure-only cookies forced a fake reverse proxy mid-development just to log in, and a login rate limiter in a hot-reload loop is self-inflicted lockout. Dev runs bare; prod runs everything; the prod-build gate is where it is verified.
+
+<constraints>
+Always do:
+- **One** `if (isProd) { … }` branch at app setup mounts all of it: `@fastify/helmet` with a real CSP (nonce per request for the one inline script), HSTS when TLS terminates upstream, `nosniff`, frame protection, Secure cookies, every rate limiter. Never per-middleware sprinkles that half-apply.
+- `isProd` comes from the env module (`NODE_ENV === 'production'`), and **every network-reachable deploy, staging included, runs with it on**. A staging box in dev mode has unlimited login brute force and no CSP.
+- Dev keeps functional auth (login and sessions work; `cookie.secure = isProd`) and nothing else.
+- Because dev never exercises the hardening, the prod-build gate (`preflight-build`, then the browser pass against the built app with zero console errors, CSP violations are console errors) is the **only** place it is verified. It is never skipped.
+- `helmet` is present in the app file (`sec-headers-present`); `trustProxy` is the ingress hop count or a list, never `true` (`no-trust-proxy-true`): with `true`, `req.ip` is the leftmost `X-Forwarded-For` value and one header per request is one fresh rate-limit bucket per request.
+- The rate limiter is correct on all four counts: keyed so a spoofed header cannot mint buckets; a store that survives N replicas (or a stated "one replica" decision); bounded map growth plus a global ceiling; rejections observable (a 429 logs or counts, so an attack is not a quiet week).
+- Every request-path query carries a timeout (`maxTimeMS`, an `AbortSignal`) and the request has a deadline.
+- `/health` does not hit the database per request; cache the last ping for a few seconds.
+- A cap on concurrent streams per client (SSE connections, change streams opened by `wait_*` tools).
+- One `setErrorHandler`, one `setNotFoundHandler`, one body shape `{ error: { code, message, correlation_id } }`; a 500 carries the correlation id, never `err.message` (`no-err-message-to-client`).
+
+Never do:
+- Security plugins outside the single switch, or logic that differs between prod and dev beyond the switch, the log level and the listen address.
+- A source-IP check as authorization behind a proxy: `req.ip` is attacker-controlled when proxies are trusted. A real credential, or an unpublished port.
+- A route that builds its own 404/400 body (`one-error-body`).
+</constraints>

package/packs/fastify/rules/streams-and-hijacks.md

@@ -0,0 +1,22 @@
+---
+# concepts: routes
+paths:
+  - "placeholder"
+---
+
+# A hijacked reply handles its own errors; a stream has an error listener and a stop
+
+Once `reply.hijack()` runs, Fastify's error handler can no longer answer: a throw afterwards leaves the socket open forever. A `ServerResponse` that errors with no `'error'` listener crashes the process.
+
+<constraints>
+Always do:
+- `reply.hijack()` is immediately followed by `try { … } catch { raw.end() }` (`hijack-needs-try`).
+- An SSE response registers `raw.on('error', stop)` and `raw.on('close', stop)` before the first write, and `stop` closes every change stream and timer it opened (`sse-needs-error-listener`).
+- Every `watch()` opened for a request is closed by that request's `stop`; cap them per client.
+- Long-running loops take an `AbortSignal` and return a stop function (`background-loop-needs-stop`); `startWatchers()`'s stop handle is kept and called from `shutdown`.
+- Poll with a change stream or `findOneAndUpdate` wake-ups, not `while (Date.now() < deadline) await sleep(150)` against the database (`watch-not-poll`, mongo pack).
+
+Never do:
+- `Promise.race` with a bare `setTimeout` (the loser leaks); use `AbortSignal.timeout(ms)` or `setTimeout` from `node:timers/promises` with a signal.
+- An in-memory `Map` used as a session/transport store without a TTL sweep and a max size.
+</constraints>

package/packs/fastify/rules/tests-use-inject.md

@@ -0,0 +1,13 @@
+---
+# concepts: tests
+---
+# API tests go through Fastify's inject(), never a bound port
+
+<constraints>
+Always do:
+- Build the server with `buildServer()` and call `app.inject({ method, url, payload })` in every API test, then `app.close()`.
+- Cover each route's success, its validation failure and its error contract reply.
+
+Never do:
+- Call `listen()` in a test, or reach a real network service; fake the adapters.
+</constraints>

package/packs/fastify/rules/three-layers.md

@@ -0,0 +1,20 @@
+---
+# concepts: routes, fastify-app
+paths:
+  - "placeholder"
+---
+
+# Three layers, one direction: routes → handlers → adapters
+
+<constraints>
+Always do:
+- Routes (`app.ts`, `routes/**`, Next's `app/api/**/route.ts`) are thin: parse and validate the request with the entity schema, call one handler, return its result. Request-in, handler-call, response-out, nothing else.
+- Handlers (`handlers/**`, one file per domain) hold the business logic and orchestration; they call adapters for anything external and never reach outside the process themselves.
+- Adapters (`adapters/**`, the database gateway, external API clients, queues) wrap everything external; the Mongo gateway is the one place driver code lives (`mongo` pack).
+- All API routes live under `/api/v1/` from the first line; no unversioned route "for now" (`api-routes-versioned`).
+- A service owns its domain and is reached through its interface; shared code is hoisted to a shared package, never imported sideways from a sibling's internals.
+
+Never do:
+- A database call, `fetch` to an external API, or business logic inline in a route file (`no-db-in-route-file`).
+- A handler that imports the driver or an HTTP client directly.
+</constraints>

package/packs/fastify/rules/trust-config-not-headers.md

@@ -0,0 +1,24 @@
+---
+# concepts: routes
+paths:
+  - "placeholder"
+---
+
+# Origin, protocol and cookie flags come from config, never from request headers
+
+`Host`, `x-forwarded-proto` and `x-forwarded-host` are client-controlled unless the proxy strips and sets them. Building an OAuth issuer, a redirect or a cookie flag from them hands the attacker the discovery document.
+
+<constraints>
+Always do:
+- `PUBLIC_URL` in the env schema is the only source for issuer, endpoints, absolute redirects and the `resource` claim.
+- `secure: env.PUBLIC_URL.startsWith('https')`, not a header. Session cookies use the `__Host-` prefix (`path: '/'`, `secure`, no `domain`), `httpOnly`, `sameSite: 'lax'` or `'strict'`.
+- Proxy awareness through Fastify's `trustProxy` option configured from env, then `request.protocol`/`request.hostname`; never raw `headers['x-forwarded-*']` in route code.
+- Parse `body`, `query`, `params` with the entity's Zod schema (`safeParse` → 400); the same schema the schemas module exports. A cast or `String(body.x)` is not validation (`no-cast-at-route-boundary`).
+- User-uploaded bytes are served with `Content-Disposition: attachment` or an allow-listed `Content-Type`; a stored `text/html`/`image/svg+xml` served inline on the app origin is stored XSS (`user-bytes-need-disposition`).
+- One `preHandler` loads the session/auth context onto `request`; routes never repeat the load-and-redirect block.
+
+Never do:
+- `headers.host`, `headers['x-forwarded-proto']`, `headers['x-forwarded-host']` outside the config/proxy module (`origin-from-config-not-host`).
+- `setCookie('session', …)` without the `__Host-` prefix (`cookie-host-prefix`).
+- `req.body as { … }`, `req.query as …`, `Number(query.page)`.
+</constraints>

package/packs/full-stack/checks/no-express-no-vite.json

@@ -0,0 +1,23 @@
+{
+  "id": "no-express-no-vite",
+  "why": "The stack is Fastify and Next.js. Express and Vite are never imported, depended on or mentioned; a 'ported from Express' comment is how the next Express import gets in.",
+  "rule": ".claude/rules/stack-is-fastify-and-nextjs.md",
+  "concepts": [
+    "js"
+  ],
+  "globs": [
+    "**/package.json"
+  ],
+  "exclude": [
+    "**/node_modules/**",
+    "**/dist/**",
+    ".claude/**",
+    "**/.claude/**",
+    "**/*.md"
+  ],
+  "code": false,
+  "flags": "i",
+  "pattern": "['\"](express|vite)['\"]\\s*:|from\\s*['\"](express|vite)['\"]|require\\(\\s*['\"](express|vite)['\"]\\s*\\)",
+  "bad": "import express from 'express';\n// same as express trust proxy 1",
+  "good": "import Fastify from 'fastify';\napp.register(helmet);\n\"vitest\": \"3.0.0\"\nThe express lane is closed.\n"
+}

package/packs/full-stack/hooks/stack-guard.mjs

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+// stack-guard (PreToolUse, Write|Edit|MultiEdit|NotebookEdit|Bash): the full-stack configuration's stack is Fastify and
+// Next.js, and Zod 4 (STEP 3 item 4). Refused, by every write route (lib/writes.mjs) and on an install command:
+//   - express or vite added to a package.json (dependencies of any kind) or installed (`npm i`, `pnpm add`, `yarn add`, `bun add`);
+//   - an import or require of express or vite (or one of their subpaths, @vitejs/*) added to a JS or TS file;
+//   - zod pinned below 4 in a package.json, or installed as zod@3.
+// The API is Fastify (routes, inject() tests, its own plugins: @fastify/helmet, @fastify/rate-limit); the web app is Next.js,
+// which builds itself. Another project's files are not judged.
+//   node stack-guard.mjs --selftest
+import { basename, extname, join } from 'node:path';
+import { judgeEvent } from './lib/writes.mjs';
+import { bashOf, runHook, scratchProject, verdicts, writeOf } from './lib/selftest.mjs';
+import { asHook, isMain } from './lib/hook-log.mjs';
+
+const BANNED = /^(express|vite|@vitejs\/.+)$/;
+const CODE = new Set(['.js', '.mjs', '.cjs', '.ts', '.mts', '.cts', '.tsx', '.jsx']);
+const IMPORT = /(?:\bfrom\s*|\bimport\s*\(\s*|\brequire\s*\(\s*|^\s*import\s+)['"]((?:@vitejs\/[\w.-]+|express|vite)(?:\/[\w./-]*)?)['"]/gm;
+const WHY = 'The full-stack configuration builds on Fastify (the API: routes, handlers, inject() tests, @fastify/helmet and @fastify/rate-limit) and Next.js (the web app, which builds itself). Use those; express and vite are not part of this stack.';
+
+function depsOf(text) {
+  try {
+    const j = JSON.parse(text || '{}');
+    return Object.assign({}, j.dependencies, j.devDependencies, j.peerDependencies, j.optionalDependencies);
+  } catch { return null; }
+}
+const zodBelow4 = (spec) => typeof spec === 'string' && /^[\^~>=<\s]*[0-3](\.|$)/.test(spec.trim());
+
+export function judgeManifest(before, after) {
+  const was = depsOf(before) ?? {}, now = depsOf(after);
+  if (!now) return null;
+  const added = Object.keys(now).filter((d) => BANNED.test(d) && !(d in was));
+  if (added.length) return `package.json gains ${added.join(', ')}. ${WHY}`;
+  if (zodBelow4(now.zod) && now.zod !== was.zod) return `package.json pins zod ${now.zod}. Schemas are Zod 4 (import { z } from 'zod', version 4 or later); take the latest 4.x.`;
+  return null;
+}
+
+export function judgeCode(before, after) {
+  const names = (t) => [...(t ?? '').matchAll(IMPORT)].map((m) => m[1]);
+  const had = names(before);
+  const added = names(after).filter((n) => !had.includes(n));
+  return added.length ? `this file gains an import of ${added[0]}. ${WHY}` : null;
+}
+
+export function judgeInstall(command) {
+  for (const part of command.replace(/<<-?\s*['"]?(\w+)['"]?[\s\S]*?\n\1\b/g, '').split(/&&|\|\||;|\|/)) {
+    const w = part.trim().split(/\s+/);
+    const at = w.findIndex((x, i) => ['npm', 'pnpm', 'yarn', 'bun'].includes(w[i - 1]) && ['i', 'install', 'add'].includes(x));
+    if (at < 0) continue;
+    for (const a of w.slice(at + 1).filter((x) => !x.startsWith('-'))) {
+      const name = a.replace(/(?!^)@[^/]*$/, '');
+      if (BANNED.test(name)) return `\`${part.trim()}\` installs ${name}. ${WHY}`;
+      if (name === 'zod' && /@[\^~]?[0-3](\.|$)/.test(a.slice(name.length))) return `\`${part.trim()}\` installs ${a}. Schemas are Zod 4: install zod@4 (the latest).`;
+    }
+  }
+  return null;
+}
+
+const main = (text) => judgeEvent(text, {
+  name: 'stack-guard',
+  command: judgeInstall,
+  write: (w) => (w.after === null ? null : basename(w.path) === 'package.json' ? judgeManifest(w.before, w.after) : CODE.has(extname(w.path)) ? judgeCode(w.before, w.after) : null),
+});
+
+function selftest() {
+  const hook = new URL(import.meta.url).pathname;
+  const pkg = (deps) => JSON.stringify({ name: 'x', dependencies: deps }, null, 2);
+  const dir = scratchProject({ 'api/package.json': pkg({ fastify: '5.6.1' }), 'api/src/old.ts': "import express from 'express';\n" });
+  const w = (rel, text) => runHook(hook, dir, writeOf(join(dir, rel), text));
+  const sh = (cmd) => runHook(hook, dir, bashOf(cmd, dir));
+  const cases = [
+    ['express added to package.json', w('api/package.json', pkg({ fastify: '5.6.1', express: '5.1.0' })), 2],
+    ['vite added as a dev dependency', w('api/package.json', JSON.stringify({ devDependencies: { vite: '7.1.0' } })), 2],
+    ['zod 3 pinned', w('api/package.json', pkg({ fastify: '5.6.1', zod: '^3.23.8' })), 2],
+    ['zod 4 and fastify plugins', w('api/package.json', pkg({ fastify: '5.6.1', zod: '4.1.12', '@fastify/helmet': '13.0.2' })), 0],
+    ['an import of express added', w('api/src/server.ts', "import express from 'express';\n"), 2],
+    ['a require of vite', w('tools/build.cjs', "const { build } = require('vite');\n"), 2],
+    ['an import of @vitejs/plugin-react', w('channel/vite.config.ts', "import react from '@vitejs/plugin-react';\n"), 2],
+    ['a file that already had the import keeps it', w('api/src/old.ts', "import express from 'express';\nexport const x = 1;\n"), 0],
+    ['fastify imported', w('api/src/server.ts', "import Fastify from 'fastify';\n"), 0],
+    ['a doc that names express', w('docs/why.md', "We never use express.\n"), 0],
+    ['npm install express', sh('npm install express'), 2],
+    ['pnpm add -D vite@7', sh('pnpm add -D vite@7'), 2],
+    ['npm i zod@3', sh('npm i zod@3.23.8'), 2],
+    ['npm i zod@4 fastify', sh('npm i zod@4.1.12 fastify'), 0],
+  ];
+  return verdicts('stack-guard', cases);
+}
+
+export const hook = main; // run-hooks.mjs calls it with the event's text (KWB-24)
+if (isMain(import.meta.url)) process.exit(process.argv.includes('--selftest') ? selftest() : await asHook('stack-guard', main));

package/packs/full-stack/pack.json

@@ -0,0 +1,76 @@
+{
+  "name": "full-stack",
+  "version": "1.0.0",
+  "description": "The full-stack configuration's stack choice: Fastify and Next.js only (stack-guard). The rest of the configuration is other packs: http-api, fastify, zod, docker.",
+  "type": "stock",
+  "author": "claude-packs",
+  "license": "MIT",
+  "homepage": "https://github.com/TheDecipherist/claude-packs",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/TheDecipherist/claude-packs.git",
+    "directory": "packs/full-stack"
+  },
+  "keywords": [
+    "fastify",
+    "nextjs",
+    "zod"
+  ],
+  "engines": {
+    "claude-packs": ">=0.19.0"
+  },
+  "configurationPack": true,
+  "folders": {},
+  "concepts": {
+    "api": [
+      "api"
+    ],
+    "core": [
+      "core"
+    ],
+    "routes": [
+      "routes"
+    ],
+    "handlers": [
+      "handlers"
+    ],
+    "adapters": [
+      "adapters"
+    ],
+    "schemas": [
+      "schemas"
+    ],
+    "channel": [
+      "channel"
+    ],
+    "manifests": [
+      "**/package.json"
+    ],
+    "api-tests": [
+      "api-tests"
+    ],
+    "tests": [
+      "api-tests",
+      "**/*.test.ts",
+      "**/*.test.tsx"
+    ],
+    "ui": [
+      "channel"
+    ]
+  },
+  "skillsIn": null,
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Write|Edit|MultiEdit|NotebookEdit|Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/stack-guard.mjs\"",
+            "timeout": 10
+          }
+        ]
+      }
+    ]
+  }
+}

package/packs/full-stack/rules/stack-is-fastify-and-nextjs.md

@@ -0,0 +1,20 @@
+---
+# concepts: api, core, channel, manifests
+paths:
+  - "placeholder"
+---
+
+# The stack is Fastify and Next.js. Never Express, never Vite.
+
+<constraints>
+Always do:
+- HTTP servers and APIs: **Fastify** (current major, `latest-versions`). Web apps: **Next.js**. Bundling is Next's; tests run on `node:test` or the project's existing runner.
+- Check the current versions of every dependency with `latest-versions` before adding one, with its row in `docs/versions.md`.
+- Export a `buildServer()` that returns the Fastify instance without listening; only the entry file listens.
+
+Never do:
+- Import, depend on or mention `express` or `vite` in code or comments (`stack-guard`, `no-express-no-vite`). A stale "ported from Express" comment is how the next Express import gets in.
+- `await import('node:…')` of a built-in in a hot path: built-ins are static imports.
+- A `.ts` source line over 200 characters (`line-under-200-chars`): a 1,100-character tool description belongs in a `descriptions.ts` table.
+- Base64 blobs in source (`no-inline-binary`): assets are files served as files.
+</constraints>

package/packs/go/checks/go-exec-result-ignored.json

@@ -0,0 +1,15 @@
+{
+  "id": "go-exec-result-ignored",
+  "why": "A discarded error on a state change reports success for work that failed.",
+  "rule": ".claude/rules/go-errors-are-handled.md",
+  "globs": [
+    "**/*.go"
+  ],
+  "exclude": [
+    "**/*_test.go",
+    "**/vendor/**"
+  ],
+  "pattern": "_,\\s*_(?:,\\s*_)?\\s*=\\s*[\\w.]*(?:Exec\\w*|Run|Shell|\\w*Run|\\w*Shell)\\(",
+  "bad": "_, _, _ = docker.ExecAndCapture(ctx, id, cmd)",
+  "good": "if _, _, err := docker.ExecAndCapture(ctx, id, cmd); err != nil { return Fail(err.Error()) }"
+}