@thedecipherist/claude-packs 0.0.0-stage → 1.1.0

package/packs/http-api/checks/middleware-skips-without-user.json

@@ -0,0 +1,26 @@
+{
+  "id": "middleware-skips-without-user",
+  "why": "A middleware that passes when there is no user fails open, and a control nobody has seen fire is worse than none.",
+  "rule": ".claude/rules/routes-scope-to-the-caller.md",
+  "globs": [
+    "**/*.ts",
+    "**/*.js",
+    "**/*.mjs",
+    "**/*.cjs"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "pattern": "if\\s*\\(\\s*!req\\.user\\s*\\)\\s*\\{\\s*next\\(\\)",
+  "bad": "if (!req.user) {\n  next();\n  return;\n}",
+  "good": "if (!req.user) {\n  res.status(401).json(body);\n  return;\n}",
+  "kind": "security"
+}

package/packs/http-api/checks/next-api-route-versioned.json

@@ -0,0 +1,47 @@
+{
+  "id": "next-api-route-versioned",
+  "why": "A route file outside a version folder is an unversioned API.",
+  "rule": ".claude/rules/apis-are-versioned.md",
+  "globs": [
+    "**/app/api/**/route.ts",
+    "**/app/api/**/route.js",
+    "**/pages/api/**/*.ts"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    "**/api/auth/**",
+    "**/api/webhook*/**",
+    "**/api/health/**",
+    "**/api/cron/**",
+    "**/app/api/v1/**",
+    "**/app/api/v2/**",
+    "**/app/api/v3/**",
+    "**/app/api/v4/**",
+    "**/app/api/v5/**",
+    "**/app/api/v6/**",
+    "**/app/api/v7/**",
+    "**/app/api/v8/**",
+    "**/app/api/v9/**",
+    "**/pages/api/v1/**",
+    "**/pages/api/v2/**",
+    "**/pages/api/v3/**",
+    "**/pages/api/v4/**",
+    "**/pages/api/v5/**",
+    "**/pages/api/v6/**",
+    "**/pages/api/v7/**",
+    "**/pages/api/v8/**",
+    "**/pages/api/v9/**"
+  ],
+  "pattern": "^export\\s+(?:async\\s+)?(?:function|const)\\s+(?:GET|POST|PUT|PATCH|DELETE)\\b",
+  "bad": "export async function GET(request) {\n  return json(rows);\n}",
+  "good": "export const dynamic = 'force-dynamic';",
+  "flags": "m"
+}

package/packs/http-api/checks/no-security-off-switch.json

@@ -0,0 +1,28 @@
+{
+  "id": "no-security-off-switch",
+  "why": "Temporary access paths are never removed, and an AI writes the comment instead of the check because the comment passes every test.",
+  "rule": ".claude/rules/routes-scope-to-the-caller.md",
+  "globs": [
+    "**/*.ts",
+    "**/*.tsx",
+    "**/*.js",
+    "**/*.mjs",
+    "**/*.cjs"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "code": true,
+  "pattern": "process\\.env\\.\\w*(?:BYPASS|DISABLE_\\w*(?:AUTH|RATE|LIMIT|CSRF)|SKIP_\\w*(?:AUTH|VERIFY)|ALLOW_ALL|INSECURE)\\w*",
+  "bad": "if (process.env.DISABLE_RATE_LIMIT === 'true') return;",
+  "good": "if (isTest) return;",
+  "kind": "security"
+}

package/packs/http-api/checks/oauth-state-signed.json

@@ -0,0 +1,26 @@
+{
+  "id": "oauth-state-signed",
+  "why": "OAuth state exists to stop forged callbacks, and unsigned JSON is the forgery.",
+  "rule": ".claude/rules/credentials-handled-safely.md",
+  "globs": [
+    "**/*.ts",
+    "**/*.js",
+    "**/*.mjs",
+    "**/*.cjs"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "pattern": "\\bstate\\s*=\\s*Buffer\\.from\\(\\s*JSON\\.stringify|JSON\\.parse\\(\\s*Buffer\\.from\\(\\s*state\\b",
+  "bad": "const state = Buffer.from(JSON.stringify({ company_id })).toString('base64url');",
+  "good": "const state = randomBytes(32).toString('base64url');\nawait saveState(hashToken(state), { company_id });",
+  "kind": "security"
+}

package/packs/http-api/checks/one-time-code-compared-raw.json

@@ -0,0 +1,26 @@
+{
+  "id": "one-time-code-compared-raw",
+  "why": "A one-time code is stored hashed and compared in constant time.",
+  "rule": ".claude/rules/credentials-handled-safely.md",
+  "globs": [
+    "**/*.ts",
+    "**/*.js",
+    "**/*.mjs",
+    "**/*.cjs"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "pattern": "\\.\\w*(?:_code|_otp)\\s*!==?\\s*(?:code|otp|input\\.\\w+|req\\.body\\.\\w+)\\b",
+  "bad": "if (user.reset_code !== code) return deny();",
+  "good": "if (!safeEqual(hash(code), user.reset_code_hash)) return deny();",
+  "kind": "security"
+}

package/packs/http-api/checks/query-cast-is-not-validation.json

@@ -0,0 +1,28 @@
+{
+  "id": "query-cast-is-not-validation",
+  "why": "A TypeScript type on a request body is a wish; only a runtime parse makes it true, and with Mongo the difference is operator injection.",
+  "rule": ".claude/rules/routes-validate-and-answer.md",
+  "globs": [
+    "**/*.ts",
+    "**/*.tsx",
+    "**/*.js",
+    "**/*.mjs",
+    "**/*.cjs"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "code": true,
+  "pattern": "\\breq\\.query\\.\\w+\\s+as\\s+\\w+|\\breq\\.query\\[[^\\]]+\\]\\s+as\\s+\\w+",
+  "bad": "const rule = req.query.rule as string;",
+  "good": "const { rule } = QuerySchema.parse(req.query);",
+  "kind": "security"
+}

package/packs/http-api/checks/queue-action-from-client.json

@@ -0,0 +1,26 @@
+{
+  "id": "queue-action-from-client",
+  "why": "The guard belongs on the action, not the route that reaches it: a generic endpoint that takes the action from the body reaches every privileged one.",
+  "rule": ".claude/rules/routes-scope-to-the-caller.md",
+  "globs": [
+    "**/*.ts",
+    "**/*.js",
+    "**/*.mjs",
+    "**/*.cjs"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "pattern": "\\baction:\\s*(?:input|body|req\\.body)\\.action\\b",
+  "bad": "const doc = { action: input.action, params: input.params };",
+  "good": "const doc = { action: ALLOWED[input.action].name, params: parsed };",
+  "kind": "security"
+}

package/packs/http-api/checks/rate-limit-one-module.json

@@ -0,0 +1,28 @@
+{
+  "id": "rate-limit-one-module",
+  "why": "Per-process limits multiply by replica count and vanish on restart, and six copies means six places to fix.",
+  "rule": ".claude/rules/routes-validate-and-answer.md",
+  "globs": [
+    "**/*.ts",
+    "**/*.tsx",
+    "**/*.js",
+    "**/*.mjs",
+    "**/*.cjs"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "code": true,
+  "pattern": "\\b(?:rateLimit\\w*|rateStore)\\s*(?::[^=\\n]+)?=\\s*new Map\\b",
+  "bad": "const rateStore = new Map();",
+  "good": "import { rateLimit } from './rate-limit';",
+  "kind": "security"
+}

package/packs/http-api/checks/role-checked-in-one-guard.json

@@ -0,0 +1,27 @@
+{
+  "id": "role-checked-in-one-guard",
+  "why": "Copies of a security gate drift apart without any diff showing it, and the weakest copy decides what is exposed.",
+  "rule": ".claude/rules/routes-scope-to-the-caller.md",
+  "globs": [
+    "**/app/api/**/route.ts",
+    "**/app/api/**/route.js",
+    "**/routes/**/*.ts",
+    "**/routes/**/*.js"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "strings": true,
+  "pattern": "\\brole\\s*[!=]==?\\s*['\\\"]admin['\\\"]|\\.role\\s*[!=]==?\\s*['\\\"]admin['\\\"]",
+  "bad": "if (session.user.role !== 'admin') return forbidden();",
+  "good": "const denied = await adminGuard();\nif (denied) return denied;",
+  "kind": "security"
+}

package/packs/http-api/checks/route-body-needs-schema.json

@@ -0,0 +1,31 @@
+{
+  "id": "route-body-needs-schema",
+  "why": "A TypeScript type on a request body is a wish; only a runtime parse makes it true, and with Mongo the difference is operator injection.",
+  "rule": ".claude/rules/routes-validate-and-answer.md",
+  "globs": [
+    "**/app/api/**/route.ts",
+    "**/app/api/**/route.js",
+    "**/routes/**/*.ts",
+    "**/routes/**/*.js"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "code": true,
+  "pattern": "\\bawait\\s+(?:req|request)\\.json\\(\\)|\\breq\\.body\\b",
+  "mode": "needs",
+  "needs": [
+    "(?<!JSON)\\.(?:safeParse|parse)\\("
+  ],
+  "bad": "const body = await request.json();\nconst { a } = body;",
+  "good": "const body = Schema.parse(await request.json());",
+  "kind": "security"
+}

package/packs/http-api/checks/route-scopes-to-the-caller.json

@@ -0,0 +1,31 @@
+{
+  "id": "route-scopes-to-the-caller",
+  "why": "Authentication says who is calling; without an owner in the query, every customer's data is one guessed id away.",
+  "rule": ".claude/rules/routes-scope-to-the-caller.md",
+  "globs": [
+    "**/app/api/**/route.ts",
+    "**/app/api/**/route.js",
+    "**/routes/**/*.ts",
+    "**/routes/**/*.js"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "code": true,
+  "pattern": "\\b(?:find|get|list|update|delete|search)\\w*\\(\\s*(?:id|siteId|sessionId|params\\.id|query\\.siteId)\\b|\\bsiteId:\\s*query\\.siteId\\b",
+  "mode": "needs",
+  "needs": [
+    "session\\.user\\.id|\\breq\\.userId\\b|\\w*[Ss]iteAccess\\(|adminGuard\\(|assertAdmin\\(|validateServiceKey\\("
+  ],
+  "bad": "const s = await findSegmentById(id);\nreturn json(s);",
+  "good": "const s = await findSegmentById(id, session.user.id);",
+  "kind": "security"
+}

package/packs/http-api/checks/secret-compared-constant-time-any.json

@@ -0,0 +1,28 @@
+{
+  "id": "secret-compared-constant-time-any",
+  "why": "Timing leaks are the smaller half; a short code with no per-account attempt count falls to a loop.",
+  "rule": ".claude/rules/routes-validate-and-answer.md",
+  "globs": [
+    "**/*.ts",
+    "**/*.tsx",
+    "**/*.js",
+    "**/*.mjs",
+    "**/*.cjs"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "strings": true,
+  "pattern": "\\b\\w*(?:[Ss]ecret|SECRET|[Tt]oken|TOKEN|SERVICE_KEY|[Ss]erviceKey|[Aa]piKey|verificationCode|authHeader|provided)\\b\\s*[!=]==?\\s*(?!\\s*(?:undefined|null|''|\\\"\\\"))[`\\w]",
+  "bad": "if (provided !== SERVICE_KEY) deny();\nif (user.verificationCode !== code) deny();",
+  "good": "if (!safeEqual(provided, SERVICE_KEY)) deny();",
+  "kind": "security"
+}

package/packs/http-api/checks/secret-in-job-record.json

@@ -0,0 +1,27 @@
+{
+  "id": "secret-in-job-record",
+  "why": "A job record is logged, listed and retained, so it carries a reference, never the secret.",
+  "rule": ".claude/rules/credentials-handled-safely.md",
+  "globs": [
+    "**/*.ts",
+    "**/*.js",
+    "**/*.mjs",
+    "**/*.cjs"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "pattern": "\\b(?:enqueue\\w*|insertOne)\\([^;]*?\\b(?:key_pem|private_?key|password|secret_value)\\b|\\bconnection_string:\\s*connStr\\b",
+  "bad": "await enqueueCommand(c, h, 'docker.secret-create', { data: Buffer.from(key_pem).toString('base64') }, who);",
+  "good": "await enqueueCommand(c, h, 'docker.secret-create', { secret_ref: refId }, who);",
+  "flags": "i",
+  "kind": "security"
+}

package/packs/http-api/checks/server-fetches-tenant-url.json

@@ -0,0 +1,30 @@
+{
+  "id": "server-fetches-tenant-url",
+  "why": "The server has network reach its users do not: a URL a user gave goes through one fetch that refuses private, link-local and metadata ranges.",
+  "rule": ".claude/rules/routes-validate-and-answer.md",
+  "globs": [
+    "**/*.ts",
+    "**/*.js",
+    "**/*.mjs",
+    "**/*.cjs"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    "**/dashboard/**",
+    "**/client/**",
+    "**/public/**",
+    "**/web/**"
+  ],
+  "pattern": "\\bfetch\\(\\s*(?:[\\w.]+\\.(?:url|uri|endpoint)|webhookUrl|targetUrl|callbackUrl)\\b|new\\s+MongoClient\\(\\s*(?:decrypted|user|input)\\w*|ldap\\.createClient\\(\\s*\\{\\s*url:\\s*config\\.",
+  "bad": "await fetch(config.url, { method: 'POST', body });",
+  "good": "await safeFetch(config.url, { method: 'POST', body });",
+  "kind": "security"
+}

package/packs/http-api/checks/short-code-needs-limit.json

@@ -0,0 +1,26 @@
+{
+  "id": "short-code-needs-limit",
+  "why": "A six-digit code with no per-account attempt limit is an open door.",
+  "rule": ".claude/rules/credentials-handled-safely.md",
+  "globs": [
+    "**/*.ts",
+    "**/*.js",
+    "**/*.mjs",
+    "**/*.cjs"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "pattern": "randomInt\\(\\s*\\d[\\d_]*\\s*,\\s*\\d[\\d_]*\\s*\\)\\.toString\\(\\)",
+  "bad": "const code = randomInt(100_000, 1_000_000).toString();",
+  "good": "const code = randomBytes(32).toString('base64url');",
+  "kind": "security"
+}

package/packs/http-api/checks/user-url-through-safe-fetch.json

@@ -0,0 +1,28 @@
+{
+  "id": "user-url-through-safe-fetch",
+  "why": "Letting a customer choose where your server sends a request gives them a reach into your private network and metadata endpoints.",
+  "rule": ".claude/rules/routes-validate-and-answer.md",
+  "globs": [
+    "**/*.ts",
+    "**/*.tsx",
+    "**/*.js",
+    "**/*.mjs",
+    "**/*.cjs"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "code": true,
+  "pattern": "\\bfetch\\(\\s*(?:channel|webhook|hook|alert|req|request|body|input|payload)\\.\\w*(?:[uU]rl|URL)\\b",
+  "bad": "await fetch(channel.webhookUrl, opts);",
+  "good": "await safeFetch(channel.webhookUrl, opts);",
+  "kind": "security"
+}

package/packs/http-api/checks/webhook-dedupes-event-id.json

@@ -0,0 +1,30 @@
+{
+  "id": "webhook-dedupes-event-id",
+  "why": "Every provider delivers at least once, so a handler with no dedupe key eventually bills or downgrades twice.",
+  "rule": ".claude/rules/routes-validate-and-answer.md",
+  "globs": [
+    "**/webhook*/**",
+    "**/webhook*.ts",
+    "**/webhook*.js"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "code": true,
+  "pattern": "\\.webhooks\\.constructEvent\\(",
+  "mode": "needs",
+  "needs": [
+    "\\bevent\\.id\\b"
+  ],
+  "bad": "stripe.webhooks.constructEvent(b, s, k);",
+  "good": "stripe.webhooks.constructEvent(b, s, k); if (await seen(event.id)) return ok();",
+  "kind": "security"
+}

package/packs/http-api/pack.json

@@ -0,0 +1,45 @@
+{
+  "name": "http-api",
+  "version": "1.0.0",
+  "description": "Any HTTP server, in any framework: every route ties a record to its caller, guards fail closed, input is validated, secrets are compared and stored safely, and what a route returns gives nothing away.",
+  "type": "stock",
+  "author": "claude-packs",
+  "license": "MIT",
+  "homepage": "https://github.com/TheDecipherist/claude-packs",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/TheDecipherist/claude-packs.git",
+    "directory": "packs/http-api"
+  },
+  "keywords": [
+    "http",
+    "api",
+    "security"
+  ],
+  "engines": {
+    "claude-packs": ">=0.25.0"
+  },
+  "concepts": {
+    "routes": [
+      "**/routes/**",
+      "**/app/api/**"
+    ],
+    "handlers": [
+      "**/handlers/**",
+      "**/controllers/**",
+      "**/services/**"
+    ],
+    "adapters": [
+      "**/adapters/**",
+      "**/repositories/**"
+    ],
+    "api": [
+      "**/routes/**",
+      "**/app/api/**",
+      "**/server.ts",
+      "**/server.js",
+      "**/app.ts",
+      "**/app.js"
+    ]
+  }
+}

package/packs/http-api/rules/adapters-one-db-gateway.md

@@ -0,0 +1,18 @@
+---
+# concepts: adapters
+paths:
+  - "placeholder"
+---
+
+# One database gateway: every query goes through it, chain keys first
+
+<constraints>
+Always do:
+- Keep exactly one module that imports the database driver; every other adapter calls it.
+- Put the chain keys (the tenancy scope: the account, organisation or tenant a record belongs to) on top of every query in the gateway, before any filter a caller passes, so no code path can leave them out. Lead compound indexes with them.
+- Map driver errors to the one error contract in the gateway.
+
+Never do:
+- Import the driver anywhere else, or let a caller build a query that sets or omits a chain key.
+- Open a connection per request: the gateway holds one client.
+</constraints>

package/packs/http-api/rules/apis-are-versioned.md

@@ -0,0 +1,27 @@
+---
+# concepts: api
+paths:
+  - "placeholder"
+---
+
+# Every API is versioned from its first route, and a version never breaks
+
+<constraints>
+Always do:
+- Serve every route under `/api/v<N>/` from the first line, with the prefix set once, where routes are mounted. That holds for an API only your own pages call: there is no good reason not to version one.
+- Keep a published version additive: add optional fields and new routes only.
+- Make a breaking change a new version: removing or renaming a field, changing a type, tightening validation, changing a status code or a default.
+- Keep the old version working, marked with `Deprecation` and `Sunset` headers and a date, until its traffic is gone.
+- Hold each version to a contract test that fails when a response shape changes.
+- Point clients at one base URL constant.
+
+Never do:
+- Add an unversioned route "for now".
+- Change what a published version returns, because a client you cannot see depends on it.
+- Share a response schema between versions once they differ: the old one is frozen.
+
+Left out on purpose: `/health`, auth callbacks and webhooks, whose paths belong to the platform or the provider.
+</constraints>
+
+## Check
+`api-path-versioned`, `next-api-route-versioned`, `client-calls-a-version`. The `change-an-api` skill walks a change.

package/packs/http-api/rules/credentials-handled-safely.md

@@ -0,0 +1,22 @@
+---
+paths:
+  - "placeholder"
+---
+
+# Credentials are short-lived, hashed at rest and never in a record
+
+<constraints>
+Always do:
+- Store API keys and tokens hashed, and look them up by hash.
+- Sign OAuth `state`, or keep a random value server-side.
+- Pin the algorithm when verifying a token.
+- Consume a one-time token in one atomic update, and revoke refresh tokens on a password reset.
+- Keep a reference in a job record, and the secret in the secret store.
+
+Never do:
+- Name a field `_encrypted` and write plain text to it.
+- Use a six-digit code with no per-account attempt limit.
+</constraints>
+
+## Check
+`secret-in-job-record`, `oauth-state-signed`, `encrypted-name-plaintext-value`, `short-code-needs-limit`, `one-time-code-compared-raw`, `jwt-verify-pins-algorithm`.

package/packs/http-api/rules/handlers-own-the-work.md

@@ -0,0 +1,17 @@
+---
+# concepts: handlers
+paths:
+  - "placeholder"
+---
+
+# A handler does the work through adapters and answers in the one error contract
+
+<constraints>
+Always do:
+- Take parsed, typed input (the route validated it), and return a typed result or throw an error of the one error contract.
+- Reach a database or another service only through an adapter, so a handler can be tested with the adapters faked.
+
+Never do:
+- Import a database driver or an HTTP client in a handler.
+- Build an error reply by hand: throw the contract's error, and let the one error handler answer.
+</constraints>