@thedecipherist/claude-packs 0.0.0-stage → 1.0.0

package/packs/js-ts/checks/localhost-default-in-server.json

@@ -0,0 +1,29 @@
+{
+  "id": "localhost-default-in-server",
+  "why": "A production default of localhost sends real traffic nowhere, silently.",
+  "rule": ".claude/rules/env-through-config.md",
+  "globs": [],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    "**/dashboard/**",
+    "**/client/**",
+    "**/public/**",
+    "**/web/**",
+    "**/scripts/**",
+    "**/cli/**"
+  ],
+  "pattern": "(?:\\?\\?|\\|\\|)\\s*['\"`]https?://(?:localhost|127\\.0\\.0\\.1)",
+  "bad": "const url = process.env.DASHBOARD_URL ?? 'http://localhost:3002';",
+  "good": "const url = env.DASHBOARD_URL;",
+  "concepts": [
+    "js"
+  ]
+}

package/packs/js-ts/checks/no-any.json

@@ -0,0 +1,27 @@
+{
+  "id": "no-any",
+  "why": "`any` switches the type checker off for everything it touches; use `unknown` and narrow (Zod, instanceof, a type guard), or a generic.",
+  "rule": ".claude/rules/no-any.md",
+  "concepts": [
+    "ts"
+  ],
+  "globs": [],
+  "exclude": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/tests/**",
+    "**/test/**",
+    "**/*.config.*",
+    ".claude/**",
+    "**/.claude/**",
+    "**/*.d.ts"
+  ],
+  "code": true,
+  "pattern": "(:\\s*any\\b|\\bas\\s+any\\b|<any>|\\bany\\[\\]|Array<any>|Record<[^>]*,\\s*any>)",
+  "bad": "function handle(body: any) { return body.x as any; }",
+  "good": "function handle(body: unknown) { const b = BodySchema.parse(body); return b.x; }\nconst company = 'any company'; // any in prose"
+}

package/packs/js-ts/checks/no-cast-escape-hatches.json

@@ -0,0 +1,24 @@
+{
+  "id": "no-cast-escape-hatches",
+  "why": "`as never` and `as unknown as T` switch the type checker off at exactly the place that needed it (a Mongo filter, a tool argument). Type the helper (Filter<T>, OptionalUnlessRequiredId<T>) instead.",
+  "rule": ".claude/rules/no-unsafe-assertions.md",
+  "concepts": [
+    "js"
+  ],
+  "exclude": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    ".claude/**",
+    "**/.claude/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/test/**",
+    "**/tests/**"
+  ],
+  "code": true,
+  "pattern": "\\bas\\s+never\\b|\\bas\\s+unknown\\s+as\\b",
+  "bad": "await col.updateOne(filter as never, update as never);\nconst s = x as unknown as Source[];",
+  "good": "await col.updateOne(filter, update);"
+}

package/packs/js-ts/checks/no-console-in-app.json

@@ -0,0 +1,31 @@
+{
+  "id": "no-console-in-app",
+  "why": "console.* in application code is unstructured, unlevelled and unredacted; it bypasses the logger (pino in Fastify). CLIs and scripts under bin/, scripts/ or tools/ may print.",
+  "rule": ".claude/rules/no-console.md",
+  "concepts": [
+    "js"
+  ],
+  "globs": [],
+  "exclude": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/tests/**",
+    "**/test/**",
+    "**/*.config.*",
+    ".claude/**",
+    "**/.claude/**",
+    "**/bin/**",
+    "**/scripts/**",
+    "**/tools/**",
+    "**/cli.*",
+    "**/cli/**"
+  ],
+  "code": true,
+  "pattern": "\\bconsole\\s*\\.\\s*(log|info|warn|error|debug|trace)\\s*\\(",
+  "bad": "console.log('user created', user.id);",
+  "good": "request.log.info({ userId: user.id }, 'user created');\n// console.log('in a comment is fine')"
+}

package/packs/js-ts/checks/no-dynamic-import-node-builtin.json

@@ -0,0 +1,25 @@
+{
+  "id": "no-dynamic-import-node-builtin",
+  "why": "await import('node:\u2026') in a handler re-resolves a built-in on every call. Built-ins are static imports at the top of the file.",
+  "rule": ".claude/rules/stack-is-fastify-and-nextjs.md",
+  "concepts": [
+    "js"
+  ],
+  "exclude": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    ".claude/**",
+    "**/.claude/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/test/**",
+    "**/tests/**",
+    "**/*_test.*"
+  ],
+  "code": false,
+  "pattern": "\\bimport\\s*\\(\\s*['\\\"]node:",
+  "bad": "const { createHash } = await import('node:crypto');",
+  "good": "import { createHash } from 'node:crypto';"
+}

package/packs/js-ts/checks/no-inline-binary.json

@@ -0,0 +1,20 @@
+{
+  "id": "no-inline-binary",
+  "why": "A base64 blob in a .ts file is a binary asset pretending to be source: unreviewable, undiffable, and loaded into memory on import. Serve the file as a file.",
+  "rule": ".claude/rules/stack-is-fastify-and-nextjs.md",
+  "concepts": [
+    "js"
+  ],
+  "exclude": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    ".claude/**",
+    "**/.claude/**"
+  ],
+  "code": false,
+  "pattern": "[A-Za-z0-9+/=]{2000,}",
+  "bad": "const PNG = 'iVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgoiVBORw0KGgo';",
+  "good": "app.get('/logo.png', (_, r) => r.sendFile('logo.png'));"
+}

package/packs/js-ts/checks/no-inline-zod-outside-schemas.json

@@ -0,0 +1,27 @@
+{
+  "id": "no-inline-zod-outside-schemas",
+  "why": "A z.object() in a route, handler, adapter or service is the per-layer copy that drifts, one commit before the second copy appears. Declare it in the schemas module and import it.",
+  "rule": ".claude/rules/schema-single-source-of-truth.md",
+  "concepts": [
+    "handlers"
+  ],
+  "exclude": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    ".claude/**",
+    "**/.claude/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/test/**",
+    "**/tests/**",
+    "**/schemas/**",
+    "**/schema/**",
+    "**/*.schema.*"
+  ],
+  "code": true,
+  "pattern": "\\bz\\.object\\s*\\(",
+  "bad": "const Body = z.object({ name: z.string().max(80) });",
+  "good": "import { CreateSessionInput } from '../schemas/index.js';"
+}

package/packs/js-ts/checks/no-local-sleep.json

@@ -0,0 +1,25 @@
+{
+  "id": "no-local-sleep",
+  "why": "Five hand-rolled sleep() helpers in one package. node:timers/promises exports setTimeout(ms, value, { signal }) which also cancels.",
+  "rule": ".claude/rules/stack-is-fastify-and-nextjs.md",
+  "concepts": [
+    "js"
+  ],
+  "exclude": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    ".claude/**",
+    "**/.claude/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/test/**",
+    "**/tests/**",
+    "**/*_test.*"
+  ],
+  "code": true,
+  "pattern": "new\\s+Promise\\s*(?:<[^>]*>)?\\s*\\(\\s*\\(?\\s*(\\w+)\\s*\\)?\\s*=>\\s*(?:global)?setTimeout\\s*\\(\\s*\\1\\b",
+  "bad": "const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));",
+  "good": "import { setTimeout as sleep } from 'node:timers/promises';\nawait sleep(500, undefined, { signal });"
+}

package/packs/js-ts/checks/no-nested-ternary.json

@@ -0,0 +1,20 @@
+{
+  "id": "no-nested-ternary",
+  "why": "A ternary inside a ternary is an if-chain in one line. Use a lookup table (lookup-over-if-chains) or a small function.",
+  "rule": ".claude/rules/lookup-over-if-chains.md",
+  "concepts": [
+    "js"
+  ],
+  "exclude": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    ".claude/**",
+    "**/.claude/**"
+  ],
+  "code": true,
+  "pattern": "\\s\\?\\s[^:;\\n]*\\s\\?\\s[^:;\\n]*\\s:\\s|\\s\\?\\s[^:;\\n{}(),]*\\s:\\s[^?;\\n{}(),]*\\s\\?\\s",
+  "bad": "const label = w.status === 'ok' ? (w.fresh ? 'live' : 'stale') : 'dead';\nconst y = a ? b : c ? d : e;\n",
+  "good": "const label = LABELS[w.status];\nconst v = a?.b ?? c ? d : e;\nconst RE = /expect\\(\\s*([^()]+(?:\\([^()]*\\))?)\\s*\\)/;\nconst s = `${a ? 'x' : ''} ${b ? 'y' : ''}`;\n"
+}

package/packs/js-ts/checks/no-secret-in-log.json

@@ -0,0 +1,24 @@
+{
+  "id": "no-secret-in-log",
+  "why": "Passwords in logs reach every log store, backup and support tool, and cannot be recalled.",
+  "rule": ".claude/rules/secrets-stay-secret.md",
+  "concepts": [
+    "js"
+  ],
+  "globs": [],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "strings": true,
+  "pattern": "\\b(?:console\\.\\w+|log(?:ger)?\\.\\w+)\\([^\\n]*(?:JSON\\.stringify\\(\\s*(?:req\\.body|request\\.body|body|credentials|payload)\\b|,\\s*(?:req\\.body|request\\.body|body|credentials)\\s*[,)]|\\b(?:password|passwd|apiKey|api_key|secret|authHeader|authorization)\\s*[,)])",
+  "bad": "console.log('body', JSON.stringify(body));\nlogger.info('login', password);",
+  "good": "console.log('body keys', Object.keys(body).length);\nlogger.info({ userId }, 'login ok');"
+}

package/packs/js-ts/checks/no-shell-string-interpolation.json

@@ -0,0 +1,24 @@
+{
+  "id": "no-shell-string-interpolation",
+  "why": "A path or argument interpolated into a shell string breaks on a space and injects on a $. Pass argv arrays to spawn/execFile, never a template string to bash -c.",
+  "rule": ".claude/rules/await-handled-at-a-boundary.md",
+  "concepts": [
+    "js"
+  ],
+  "exclude": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    ".claude/**",
+    "**/.claude/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/test/**",
+    "**/tests/**"
+  ],
+  "pattern": "\\b(?:exec|execSync|spawn|spawnSync)\\(\\s*`[^`]*\\$\\{|\\[\\s*['\"]-c['\"]\\s*,\\s*`[^`]*\\$\\{",
+  "bad": "command: `bash ${join(dir, hook.script)} ${TAG}`,\nspawn('bash', ['-c', `git log ${ref}`]);",
+  "good": "command: ['bash', join(dir, hook.script), TAG],\nexecFile('git', ['log', ref]);",
+  "strings": true
+}

package/packs/js-ts/checks/no-swallowed-errors.json

@@ -0,0 +1,25 @@
+{
+  "id": "no-swallowed-errors",
+  "why": "An empty catch or a .catch that returns nothing hides the failure: the work silently didn't happen and nobody is told. Handle it, rethrow with context, or let the boundary catch it.",
+  "rule": ".claude/rules/errors-never-swallowed.md",
+  "concepts": [
+    "js"
+  ],
+  "globs": [],
+  "exclude": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/tests/**",
+    "**/test/**",
+    ".claude/**",
+    "**/.claude/**"
+  ],
+  "code": true,
+  "pattern": "catch\\s*(?:\\([^)]*\\))?\\s*\\{\\s*\\}|\\.catch\\s*\\(\\s*(?:\\(\\s*[\\w$]*\\s*\\)|[\\w$]+)?\\s*=>\\s*(?:\\{\\s*\\}|\\(\\s*\\{\\s*\\}\\s*\\)|\\[\\s*\\]|null|undefined|void\\s+0)\\s*\\)|\\.catch\\s*\\(\\s*(?:noop|_\\.noop)\\s*\\)",
+  "bad": "try { await save(x); } catch {}\nawait send(m).catch(() => {});\nconst v = await get(k).catch(() => null);\nconst v = await get(k).catch(() => ({}));\n",
+  "good": "try { await save(x); } catch (err: unknown) { throw new Error('save failed', { cause: err }); }\nawait send(m).catch((err: unknown) => log.warn({ err }, 'send failed'));"
+}

package/packs/js-ts/checks/no-ts-enum.json

@@ -0,0 +1,20 @@
+{
+  "id": "no-ts-enum",
+  "why": "A TypeScript enum emits runtime code and fights structural typing. Use a union of string literals.",
+  "rule": ".claude/rules/unions-over-enums.md",
+  "concepts": [
+    "ts"
+  ],
+  "globs": [],
+  "exclude": [
+    "**/node_modules/**",
+    "**/dist/**",
+    ".claude/**",
+    "**/.claude/**"
+  ],
+  "code": true,
+  "pattern": "^\\s*(?:export\\s+)?(?:const\\s+)?enum\\s+\\w+",
+  "flags": "m",
+  "bad": "export enum Mode { Fast, Slow }\n",
+  "good": "export type Mode = 'fast' | 'slow';\n"
+}

package/packs/js-ts/checks/process-env-only-in-config.json

@@ -0,0 +1,31 @@
+{
+  "id": "process-env-only-in-config",
+  "why": "process.env read outside the config module is a setting the Zod env schema never sees: a typo is discovered at runtime, not at startup. new Anthropic() with no key does the same silently.",
+  "rule": ".claude/rules/env-through-config.md",
+  "concepts": [
+    "js"
+  ],
+  "exclude": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    ".claude/**",
+    "**/.claude/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/test/**",
+    "**/tests/**",
+    "**/env.*",
+    "**/config.*",
+    "**/config/**",
+    "**/*.config.*",
+    "**/scripts/**",
+    "**/bin/**",
+    "**/hooks/**"
+  ],
+  "code": true,
+  "pattern": "\\bprocess\\.env\\b|\\bnew\\s+(Anthropic|OpenAI)\\s*\\(\\s*\\)",
+  "bad": "const key = process.env.ANTHROPIC_API_KEY;\nconst client = new Anthropic();",
+  "good": "import { env } from '../env.js';\nconst client = new Anthropic({ apiKey: env.ANTHROPIC_API_KEY });"
+}

package/packs/js-ts/checks/race-leaves-work-running.json

@@ -0,0 +1,23 @@
+{
+  "id": "race-leaves-work-running",
+  "why": "Promise.race ends the wait, not the work, which goes on using its connection and may still write.",
+  "rule": ".claude/rules/outbound-calls-have-a-limit.md",
+  "globs": [],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "pattern": "Promise\\.race\\(\\s*\\[",
+  "bad": "await Promise.race([work(), timeout(5000)]);",
+  "good": "await work({ signal: AbortSignal.timeout(5000) });",
+  "concepts": [
+    "js"
+  ]
+}

package/packs/js-ts/checks/reject-as-catch-all-exists.json

@@ -0,0 +1,24 @@
+{
+  "id": "reject-as-catch-all-exists",
+  "why": "\"Already exists\" as a catch-all also hides auth failures and a dead service. Check the status, then swallow only that one.",
+  "rule": ".claude/rules/errors-never-swallowed.md",
+  "globs": [],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "pattern": "catch\\s*\\{\\s*(?://|/\\*)\\s*[^\\n]*(?:already exist|may already|may exist)",
+  "bad": "try { await create(); } catch {\n  // Volume may already exist\n}",
+  "good": "try { await create(); } catch (err) { if (!isConflict(err)) throw err; }",
+  "flags": "i",
+  "concepts": [
+    "js"
+  ]
+}

package/packs/js-ts/checks/secret-has-no-fallback.json

@@ -0,0 +1,24 @@
+{
+  "id": "secret-has-no-fallback",
+  "why": "A default secret is public in the source, and a deployment with a missing variable then runs with it and looks healthy.",
+  "rule": ".claude/rules/secrets-stay-secret.md",
+  "concepts": [
+    "js"
+  ],
+  "globs": [],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "strings": true,
+  "pattern": "process\\.env\\.\\w*(?:SECRET|TOKEN|PASSWORD|PASSWD|API_KEY|PRIVATE_KEY|SERVICE_KEY|CREDENTIAL)\\w*(?:\\s*(?:\\|\\||\\?\\?)\\s*process\\.env\\.\\w+)*\\s*(?:\\|\\||\\?\\?)\\s*['\\\"`]",
+  "bad": "const s = process.env.TOKEN_SECRET || process.env.OTHER_SECRET || 'dev-secret';\nconst k = process.env.WEBHOOK_SECRET ?? '';",
+  "good": "const s = requireEnv('TOKEN_SECRET');"
+}

package/packs/js-ts/checks/secret-needs-crypto-random.json

@@ -0,0 +1,24 @@
+{
+  "id": "secret-needs-crypto-random",
+  "why": "`Math.random` output can be predicted from earlier output, so a key built from it is a guess, not a secret.",
+  "rule": ".claude/rules/secrets-stay-secret.md",
+  "concepts": [
+    "js"
+  ],
+  "globs": [],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "code": true,
+  "pattern": "function\\s+\\w*(?:Key|Token|Code|Secret|Password|Otp|Salt|Nonce)\\w*\\s*\\([^)]*\\)[^{]*\\{[^}]*?Math\\.random|\\b(?:key|token|code|secret|otp|password)\\w*\\s*(?:\\+?=|:)[^\\n]*Math\\.random",
+  "bad": "function generateApiKey() { let k = ''; for (let i = 0; i < 32; i++) k += c[Math.floor(Math.random() * 62)]; return k; }",
+  "good": "function generateApiKey() { return randomBytes(24).toString('base64url'); }"
+}

package/packs/js-ts/checks/server-close-awaited.json

@@ -0,0 +1,27 @@
+{
+  "id": "server-close-awaited",
+  "why": "A process that exits before server.close() finishes drops the requests in flight.",
+  "rule": ".claude/rules/outbound-calls-have-a-limit.md",
+  "globs": [
+    "**/server.ts",
+    "**/server.js",
+    "**/server.mjs",
+    "**/src/index.ts",
+    "**/src/main.ts"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "code": true,
+  "pattern": "(?<!await\\s)\\bserver\\.close\\(\\s*\\)\\s*;",
+  "bad": "server.close();\nawait closeDb();",
+  "good": "await new Promise((r) => server.close(r));\nawait closeDb();"
+}

package/packs/js-ts/checks/session-user-typed-once.json

@@ -0,0 +1,24 @@
+{
+  "id": "session-user-typed-once",
+  "why": "A cast at each use means a renamed field compiles everywhere and fails at run time, in a security check.",
+  "rule": ".claude/rules/types-once-at-the-edge.md",
+  "concepts": [
+    "js"
+  ],
+  "globs": [],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "code": true,
+  "pattern": "\\(\\s*session\\??\\.user\\s+as\\s",
+  "bad": "const role = (session.user as { role?: string }).role;",
+  "good": "const role = session.user.role;"
+}

package/packs/js-ts/checks/switch-is-a-table.json

@@ -0,0 +1,24 @@
+{
+  "id": "switch-is-a-table",
+  "why": "A switch with three or more cases on a kind is the if-chain in another costume: every new kind edits it. In JS/TS a Record<Kind, handler> is a compile error when a kind is missing.",
+  "rule": ".claude/rules/lookup-over-if-chains.md",
+  "concepts": [
+    "js"
+  ],
+  "exclude": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    ".claude/**",
+    "**/.claude/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/test/**",
+    "**/tests/**"
+  ],
+  "code": true,
+  "pattern": "\\bswitch\\s*\\([^)]*\\)\\s*\\{\\s*(?:case\\b[^:\\n]*:\\s*(?:return\\b[^;\\n]*;|[\\w.]+\\s*=[^;\\n]*;\\s*break;)\\s*){3,}",
+  "bad": "switch (def.type) {\n  case 'string': return s();\n  case 'number': return n();\n  case 'boolean': return b();\n}",
+  "good": "const CONVERTERS = { string: s, number: n, boolean: b } satisfies Record<ZodType, Converter>;\nreturn CONVERTERS[def.type](def);"
+}

package/packs/js-ts/checks/test-imports-the-source.json

@@ -0,0 +1,19 @@
+{
+  "id": "test-imports-the-source",
+  "why": "A green test that holds its own copy of the logic is worse than no test, because it says the code is proven.",
+  "rule": ".claude/rules/tests-can-fail.md",
+  "globs": [
+    "**/*.test.*",
+    "**/*.spec.*"
+  ],
+  "exclude": [],
+  "strings": true,
+  "pattern": "\\b(?:describe|it|test)\\(",
+  "mode": "needs",
+  "needs": [
+    "^import\\s+(?!type\\b)[^;]*?from\\s+['\\\"](?:\\.\\.?/|@/|~/)|\\bimport\\(\\s*['\\\"`]|\\brequire\\(\\s*['\\\"]\\.|execSync\\(|spawn\\("
+  ],
+  "bad": "describe('x', () => { function copy() {} it('y', () => {}); });",
+  "good": "import { f } from '../src/f';\ndescribe('x', () => {});",
+  "flags": "m"
+}

package/packs/js-ts/checks/test-name-says-behaviour.json

@@ -0,0 +1,16 @@
+{
+  "id": "test-name-says-behaviour",
+  "why": "A test named `works` says nothing when it fails. Name the behaviour.",
+  "rule": ".claude/rules/test-names-describe-behavior.md",
+  "concepts": [
+    "js-tests"
+  ],
+  "globs": [],
+  "exclude": [
+    "**/node_modules/**"
+  ],
+  "pattern": "\\b(?:it|test)\\(\\s*['\"`](?:works?|test\\s*\\d*|should work|it works|basic|ok|todo)['\"`]",
+  "flags": "i",
+  "bad": "it('works', () => {});\n",
+  "good": "it('refuses an expired token', () => {});\n"
+}

package/packs/js-ts/checks/tsconfig-flags.json

@@ -0,0 +1,21 @@
+{
+  "id": "tsconfig-flags",
+  "why": "strict, noUncheckedIndexedAccess and verbatimModuleSyntax are the three flags that cost hours when turned on late and nothing when turned on first. A tsconfig that carries compilerOptions carries all three.",
+  "rule": ".claude/rules/tsconfig-strict.md",
+  "concepts": [
+    "tsconfig"
+  ],
+  "exclude": [
+    "**/node_modules/**"
+  ],
+  "code": false,
+  "mode": "needs",
+  "pattern": "^(?![\\s\\S]*\\\"extends\\\")[\\s\\S]*\\\"compilerOptions\\\"",
+  "needs": [
+    "\\\"strict\\\"\\s*:\\s*true",
+    "\\\"noUncheckedIndexedAccess\\\"\\s*:\\s*true",
+    "\\\"verbatimModuleSyntax\\\"\\s*:\\s*true"
+  ],
+  "bad": "{ \"compilerOptions\": { \"strict\": true, \"target\": \"ES2023\" } }",
+  "good": "{ \"compilerOptions\": { \"strict\": true, \"noUncheckedIndexedAccess\": true, \"verbatimModuleSyntax\": true, \"target\": \"ES2023\" } }\n{ \"extends\": \"./tsconfig.base.json\", \"include\": [\"src\"] }"
+}

package/packs/js-ts/checks/void-needs-catch.json

@@ -0,0 +1,24 @@
+{
+  "id": "void-needs-catch",
+  "why": "`void start()` discards the promise; its rejection is unhandled and kills the process. `void x().catch(log)` or guarded().",
+  "rule": ".claude/rules/await-handled-at-a-boundary.md",
+  "concepts": [
+    "js"
+  ],
+  "exclude": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    ".claude/**",
+    "**/.claude/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/test/**",
+    "**/tests/**"
+  ],
+  "code": true,
+  "pattern": "\\bvoid\\s+(?![\\w.]+\\([^;]*\\.catch\\s*\\()[\\w.]+\\s*\\([^;]*\\)\\s*;",
+  "bad": "void loop();\nvoid server.close();",
+  "good": "void loop().catch((err: unknown) => log.error({ err }, 'loop died'));\nshutdown('SIGTERM', 0).catch(() => process.exit(1));"
+}