nerdsystem 0.0.12 → 0.0.14

package/dist/commands/admin.js

@@ -25,6 +25,8 @@ export async function adminSuspend(opts) {
     if (opts.json)
         return printJson(r);
     log.ok(`Suspended ${r.org} at ${r.suspendedAt}: ${r.projectsTrashed} project(s) trashed, ${r.usersSuspended} user(s) suspended, ${r.tokensRevoked} token(s) revoked.`);
+    if (r.stillBilling)
+        log.warn(`Stripe subscription ${r.stillBilling} is still billing, and the owner can no longer reach the portal. Cancel or refund it in the Stripe dashboard.`);
 }
 export async function adminUnsuspend(opts) {
     if (!opts.org)

package/dist/commands/init.js

@@ -29,7 +29,7 @@ async function pickOrg(api, wanted) {
         return me.orgs[0].slug;
     if (me.orgs.length === 0)
         throw new CliError("You have no orgs. Create one in the dashboard first.");
-    throw new CliError(`Pick an org with --org. Yours: ${me.orgs.map((o) => o.slug).join(", ")}`);
+    throw new CliError(`Pick an org with --org. Yours: ${me.orgs.map((o) => o.slug).join(", ")}`, 1, { code: "org_required" });
 }
 /** Creates the remote project and writes nerd.json. Shared by init and link. */
 export async function linkProject(root, args) {
@@ -171,7 +171,7 @@ export async function init(dir, args) {
         const reason = err instanceof Error ? err.message : String(err);
         const code = err instanceof CliError && err.code ? err.code : "error";
         // A plan limit is not something to fix in the folder: the API's message says how to free a slot.
-        const link = `cd ${dir} && nerd link --slug ${slug}${args.org ? ` --org ${args.org}` : ""}`;
+        const link = `cd ${dir} && nerd link --slug ${slug}${args.org ? ` --org ${args.org}` : code === "org_required" ? " --org <one of yours>" : ""}`;
         const next = code === "plan_limit" ? `When a slot is free, run: ${link}` : `Fix that, then run: ${link}`;
         const message = `The folder is ready but the project was not created: ${reason}`;
         // Same pattern as `nerd check --json`: the JSON goes to stdout, the exit code stays non-zero.
@@ -183,4 +183,4 @@ export async function init(dir, args) {
     log.ok(`Ready. Next:\n  cd ${dir}\n  pnpm install\n  nerd dev\n\nThen open the folder in your coding agent and ask it to build the first feature; the nerdsystem skill walks it through.\nDeploys go to ${project.url}`);
 }
 // Kept in sync with packages/sdk/package.json by the release script.
-const SDK_VERSION = "0.0.12";
+const SDK_VERSION = "0.0.14";

package/dist/commands/org.d.ts

@@ -17,7 +17,7 @@ export declare function domainsList(opts: {
 export declare function domainsAdd(hostname: string | undefined, opts: {
     json: boolean;
 }): Promise<void>;
-export declare function domainsRemove(id: string | undefined, opts: {
+export declare function domainsRemove(idOrHostname: string | undefined, opts: {
     json: boolean;
 }): Promise<void>;
 export declare function logs(opts: {

package/dist/commands/org.js

@@ -54,11 +54,21 @@ export async function domainsAdd(hostname, opts) {
         return printJson(r);
     log.ok(`Added ${r.domain.hostname}. Create this DNS record, then check with \`nerd domains\`:\n\n  ${r.domain.hostname}  CNAME  ${r.cnameTarget}`);
 }
-export async function domainsRemove(id, opts) {
-    if (!id)
-        throw new CliError("Usage: nerd domains remove <domainId>");
+export async function domainsRemove(idOrHostname, opts) {
+    if (!idOrHostname)
+        throw new CliError("Usage: nerd domains remove <hostname or domain id>");
     const nerd = readNerdJson(findProjectRoot());
-    const r = await ApiClient.fromConfig().delete(projectPath(nerd, `/domains/${id}`));
+    const api = ApiClient.fromConfig();
+    // People (and agents) pass the hostname they added; the API deletes by id, so look it up.
+    let id = idOrHostname;
+    if (!idOrHostname.startsWith("dom_")) {
+        const { domains } = await api.get(projectPath(nerd, "/domains"));
+        const match = domains.find((d) => d.hostname === idOrHostname.toLowerCase());
+        if (!match)
+            throw new CliError(`No custom domain ${idOrHostname} on this project. \`nerd domains\` lists them.`);
+        id = match.id;
+    }
+    const r = await api.delete(projectPath(nerd, `/domains/${id}`));
     if (opts.json)
         return printJson(r);
     log.ok("Removed.");

package/dist/gates/index.js

@@ -2,6 +2,7 @@ import { bundleGate, finding, secretsGate } from "./secrets.js";
 import { depsGate, piiGate, policyGate, rulesGate, typecheckGate } from "./code.js";
 import { gitleaksGate, semgrepGate } from "./tools.js";
 import { suppressionsGate } from "./suppressions.js";
+import { testsGate } from "./tests.js";
 import { applyAttempts, MAX_ATTEMPTS } from "./attempts.js";
 export { gateSummary, skippedGates } from "./types.js";
 export { RULES, ruleFor } from "./rules.js";
@@ -9,7 +10,7 @@ export { mask } from "./secrets.js";
 export { MAX_ATTEMPTS, readAttempts } from "./attempts.js";
 export { probeDeployment, skippedProbe, waitForDeployment } from "./smoke.js";
 /** Gates that run on source, before the build. Suppressions first so a human sees them before anything else. */
-export const SOURCE_GATES = [suppressionsGate, secretsGate, gitleaksGate, depsGate, rulesGate, semgrepGate, policyGate, piiGate, typecheckGate];
+export const SOURCE_GATES = [suppressionsGate, secretsGate, gitleaksGate, depsGate, rulesGate, semgrepGate, policyGate, piiGate, typecheckGate, testsGate];
 /** Gates that need the built output. */
 export const BUILD_GATES = [bundleGate, policyGate];
 function selectGates(gates, onlyRules) {

package/dist/gates/rules.js

@@ -36,6 +36,13 @@ export const RULES = {
     "rules/advisory": { title: "Platform advisory", severity: "warn", audience: "agent", risk: "Not blocking, but the project is missing something the platform expects.", fix: "Follow the instruction in the finding." },
     "rules/shape": { title: "Not in the nerdsystem shape", severity: "warn", audience: "human", risk: "Every app on nerdsystem is one shape: a Vite client, a Hono server on @nerdsystem/sdk, SQLite on D1, and a bucket. This repository is not in that shape. A clean scan says nothing about whether it would deploy here.", fix: "Start a project with `nerd init` and have the agent port the screens into it. The server and the login are rebuilt on the platform's sign-in and database. The compare pages on nerdsystem.com say what carries over." },
     "typecheck/error": { title: "TypeScript error", severity: "block", audience: "agent", risk: "The code would not compile reliably; the build may fail or behave unexpectedly.", fix: "Fix the type error at the file and line shown. Run `npx tsc -b` for the full message." },
+    "tests/missing": { title: "No access tests", severity: "warn", audience: "agent", risk: "Nothing checks that a signed-out visitor is refused, or that one user cannot reach another user's data. Those are the two mistakes that expose people's records, and nobody looking at the screen can see them.", fix: "Add the access tests: update @nerdsystem/sdk to the latest version, add vitest as a dev dependency with a `test` script (`vitest run`), and copy `test/setup.ts`, `test/global-setup.ts`, `test/access.test.ts`, and `vitest.config.ts` from a fresh `npx nerdsystem init` app. Then write one owner test for each route with an id in its path, set `\"tests\": \"required\"` in nerd.json, and run `nerd check`." },
+    "tests/required-missing": { title: "Access tests are missing", severity: "block", audience: "agent", risk: "This app is set to require access tests and has none, so nothing checks that a signed-out visitor is refused or that one user cannot reach another user's data.", fix: "Restore `test/access.test.ts` and the `test` script (`vitest run`) in package.json. Do not remove `\"tests\": \"required\"` from nerd.json to get past this." },
+    "tests/not-installed": { title: "Dependencies are not installed", severity: "block", audience: "agent", risk: "The tests cannot run, so nothing has been checked.", fix: "Run `pnpm install`, then `nerd check` again." },
+    "tests/failing": { title: "A test fails", severity: "block", audience: "agent", risk: "The app does not do what its tests say it should, or lets someone reach something they should not.", fix: "Run `pnpm test` and read which test failed and why. Fix the app's code. Change a test only when the behaviour it describes was meant to change, and never weaken an access test to make it pass." },
+    "tests/routes-not-checked": { title: "No test tried every route as a signed-out visitor", severity: "block", audience: "agent", risk: "A route added without a sign-in check would go live readable by anyone.", fix: "Keep the test in `test/access.test.ts` that calls `await t.expectEveryRouteLocked({ public: [...] })`. It covers every route automatically; list a route as public only when everyone on the internet is meant to reach it." },
+    "tests/owner-not-checked": { title: "A route with an id was not tried by a second user", severity: "block", audience: "agent", risk: "One signed-in user may be able to read, change, or delete another user's data by guessing its id.", fix: "Add an owner test for the route in `test/access.test.ts` using `t.expectHiddenFrom`.", example: { wrong: "// no test: nothing shows a second user is refused on /api/notes/:id", right: 'const note = await (await alice.post("/api/notes", { title: "mine" })).json();\nawait t.expectHiddenFrom(bob, "DELETE", `/api/notes/${note.note.id}`);' } },
+    "tests/harness-in-app": { title: "The test harness is imported by app code", severity: "block", audience: "agent", risk: "The test harness can sign in as anyone. In deployed code it would be a way around the login.", fix: "Remove the import of `@nerdsystem/sdk/testing` from files under `src/`. It belongs only in `test/`." },
     "typecheck/failed": { title: "Typecheck failed", severity: "block", audience: "agent", risk: "The project does not compile.", fix: "Run `npx tsc -b` and fix the errors it prints." },
     "policy/blocked-package": { title: "Package not allowed", severity: "block", audience: "agent", risk: "The package is a miner, proxy, or headless browser, which the acceptable use policy forbids and the platform cannot run.", fix: "Remove the package and the code that uses it. If the app genuinely needs a browser or scraping, say so to the person; it is not supported here." },
     "policy/mining-pool": { title: "Mining pool reference", severity: "block", audience: "human", risk: "The code references a cryptocurrency mining pool, which is forbidden by the acceptable use policy.", fix: "Remove it. If this is unexpected, inspect the file: it may have been added by a compromised dependency." },

package/dist/gates/tests.d.ts

@@ -0,0 +1,14 @@
+import { type Gate } from "./types.js";
+/**
+ * Route names come from the app's own code, and findings are read by a coding agent, so only the
+ * characters a "METHOD /path" needs survive and the length is capped: a route cannot carry a sentence.
+ */
+export declare function safeRoute(name: unknown): string | null;
+/**
+ * Runs the app's own tests and reads what they checked about access. The person who owns the app cannot
+ * read the code, and the agent that forgot a sign-in check tends to forget the test for it too, so the
+ * gate does not trust that tests exist: the harness calls every route the app declares, and this gate
+ * refuses the deploy unless that sweep ran, every route with an id in its path was tried by a second user,
+ * and everything passed.
+ */
+export declare const testsGate: Gate;

package/dist/gates/tests.js

@@ -0,0 +1,103 @@
+import { existsSync, readdirSync, readFileSync, rmSync } from "node:fs";
+import path from "node:path";
+import { exec } from "./code.js";
+import { sourceFiles } from "./fs.js";
+import { finding } from "./secrets.js";
+import { result } from "./types.js";
+const HARNESS = "@nerdsystem/sdk/testing";
+const REPORT = ".nerd/access-report.json";
+/**
+ * Route names come from the app's own code, and findings are read by a coding agent, so only the
+ * characters a "METHOD /path" needs survive and the length is capped: a route cannot carry a sentence.
+ */
+export function safeRoute(name) {
+    if (typeof name !== "string")
+        return null;
+    const m = /^(GET|POST|PUT|PATCH|DELETE) (\/[A-Za-z0-9/:_.*-]{0,120})$/.exec(name);
+    return m ? `${m[1]} ${m[2]}` : null;
+}
+const list = (v) => (Array.isArray(v) ? v.map(safeRoute).filter((r) => r !== null) : []);
+const hasId = (route) => route.split(" ")[1].split("/").some((seg) => seg.startsWith(":"));
+function readJson(file) {
+    try {
+        return JSON.parse(readFileSync(file, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+/** True when a file under test/ uses the SDK's harness, which is what writes the access report. */
+function hasHarnessTests(root) {
+    const dir = path.join(root, "test");
+    if (!existsSync(dir))
+        return false;
+    const walk = (d) => readdirSync(d, { withFileTypes: true }).some((e) => (e.isDirectory() ? walk(path.join(d, e.name)) : /\.(ts|tsx|mts|js|mjs)$/.test(e.name) && readFileSync(path.join(d, e.name), "utf8").includes(HARNESS)));
+    return walk(dir);
+}
+/**
+ * Runs the app's own tests and reads what they checked about access. The person who owns the app cannot
+ * read the code, and the agent that forgot a sign-in check tends to forget the test for it too, so the
+ * gate does not trust that tests exist: the harness calls every route the app declares, and this gate
+ * refuses the deploy unless that sweep ran, every route with an id in its path was tried by a second user,
+ * and everything passed.
+ */
+export const testsGate = {
+    name: "tests",
+    title: "Tests and access checks",
+    blocking: true,
+    rulePrefixes: ["tests/"],
+    async run(ctx) {
+        const t = Date.now();
+        const findings = [];
+        // The harness can sign in anyone. It must never be reachable from the code that is deployed.
+        for (const f of sourceFiles(ctx.root)) {
+            if (f.rel.startsWith("src/") && f.text.includes(HARNESS))
+                findings.push(finding("tests/harness-in-app", { file: f.rel }));
+        }
+        if (findings.length)
+            return result(this, "fail", "The test harness is imported by app code", findings, t);
+        const pkg = readJson(path.join(ctx.root, "package.json"));
+        const required = readJson(path.join(ctx.root, "nerd.json"))?.tests === "required";
+        if (!pkg?.scripts?.test || !hasHarnessTests(ctx.root)) {
+            const f = finding(required ? "tests/required-missing" : "tests/missing", { file: "test/access.test.ts" });
+            return result(this, required ? "fail" : "warn", "No access tests in this app", [f], t);
+        }
+        // Git builds do not run this yet (the build container has not been proven to run the local database);
+        // the terminal path, which every `nerd deploy` takes, does.
+        if (ctx.committed)
+            return result(this, "skip", "Runs before `nerd deploy`; not yet part of git builds", [], t);
+        if (!existsSync(path.join(ctx.root, "node_modules"))) {
+            return result(this, "fail", "Dependencies are not installed", [finding("tests/not-installed", {})], t);
+        }
+        rmSync(path.join(ctx.root, REPORT), { force: true });
+        const run = await exec("npx", ["vitest", "run"], ctx.root);
+        if (run.code !== 0) {
+            const files = new Set();
+            for (const line of `${run.stdout}\n${run.stderr}`.split("\n")) {
+                const m = /FAIL\s+(test\/[A-Za-z0-9_./-]{1,120}\.test\.[a-z]{2,3})/.exec(line);
+                if (m)
+                    files.add(m[1]);
+            }
+            for (const file of [...files].slice(0, 10))
+                findings.push(finding("tests/failing", { file }));
+            if (!findings.length)
+                findings.push(finding("tests/failing", {}));
+            return result(this, "fail", `${findings.length} test file(s) failing`, findings, t, "vitest");
+        }
+        const report = readJson(path.join(ctx.root, REPORT));
+        const routes = list(report?.routes);
+        const open = list(report?.public);
+        if (!report || report.everyRouteChecked !== true) {
+            return result(this, "fail", "No test checked every route as a signed-out visitor", [finding("tests/routes-not-checked", { file: "test/access.test.ts" })], t, "vitest");
+        }
+        const covered = new Set([...list(report.ownerChecked), ...list(report.shared), ...open]);
+        for (const route of routes.filter(hasId)) {
+            if (!covered.has(route))
+                findings.push(finding("tests/owner-not-checked", { file: "test/access.test.ts", fix: `Add a test for ${route}: one user creates the thing, then \`await t.expectHiddenFrom(otherUser, "${route.split(" ")[0]}", <the path with the real id>)\`. If every signed-in user is meant to reach it, declare \`t.shared("${route}", "<why>")\` instead.`, fingerprint: `tests/owner-not-checked:${route}` }));
+        }
+        if (findings.length)
+            return result(this, "fail", `${findings.length} route(s) with an id were not tried by a second user`, findings, t, "vitest");
+        const locked = routes.length - open.length;
+        return result(this, "pass", `Tests passed; ${locked} route(s) refuse a signed-out visitor, ${open.length} public${open.length ? ` (${open.join(", ")})` : ""}`, [], t, "vitest");
+    },
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nerdsystem",
-  "version": "0.0.12",
+  "version": "0.0.14",
   "description": "nerd: start, check, and deploy a web app on nerdsystem from the terminal or a coding agent.",
   "type": "module",
   "bin": {
@@ -40,6 +40,10 @@
     "directory": "packages/cli"
   },
   "homepage": "https://nerdsystem.com",
+  "bugs": {
+    "url": "https://nerdsystem.com/about",
+    "email": "support@nerdsystem.com"
+  },
   "keywords": [
     "cloudflare",
     "deploy",

package/template/.claude/skills/nerdsystem/SKILL.md

@@ -33,8 +33,8 @@ Tell the person plainly what does not carry. Their users sign up again on the ne
 
 ## The loop
 
-1. Make the change.
-2. `nerd check` (static rules, then typecheck). Fix anything it reports.
+1. Make the change, and write or update its tests in the same step (see "Build it so it is safe and it works").
+2. `nerd check` (static rules, typecheck, then the tests and access checks). Fix anything it reports.
 3. `nerd dev` to run locally when you need to try it. The local app talks to the real auth service, so signup and login work exactly as in production.
 4. `nerd deploy` when it is ready. It runs the checks, builds, stores a copy of the code, applies pending migrations, uploads, prints the URL, and probes the live URL (headers and the sign-in routes). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
@@ -95,13 +95,44 @@ export default notes;
 
 Then in `src/server/index.ts`: `app.route("/api/notes", notes);`
 
+## Build it so it is safe and it works
+
+The person you are building for usually cannot read code. They will not spot a missing sign-in check or a query that returns someone else's rows, and neither will anyone looking at the screen. So the standard is yours to hold, every time, without being asked:
+
+1. **Lock every route first.** Put `requireAuth()` or `requireRole(...)` in front of every route as middleware, before any input is read (`router.use("*", requireAuth())` for a whole router). A route is public only when everyone on the internet is meant to reach it and it returns nothing private; then add it to the `public` list in `test/access.test.ts` and tell the person in plain words that it is open.
+2. **Scope every query to the signed-in user.** Reads, updates, and deletes on user data filter on `c.var.user.id`. On a route with an id in its path, put the id and the user id in the same `where`, and answer 404 when nothing matches, so someone else's row looks like it does not exist.
+3. **Take identity from the session, never from the request.** The user id, the role, a price, an owner: none of these come from the body, the query string, or a header the browser sends. Read the user from `c.var.user` and look the rest up on the server.
+4. **Check every input on the server.** Type, length, range, and allowed values, for every field of every body, query, and path parameter. Answer 400 with the usual error shape. The client's own checks are for the person's convenience; they protect nothing.
+5. **Hiding a button is not access control.** If only admins may do something, the route says `requireRole("admin")`. What the page shows is decoration.
+6. **Files:** check the type and the size before writing to `c.env.STORAGE`, store under a key that starts with the owner's user id, and serve them through a route that checks the owner. Never build a key from a name the browser sent without cleaning it.
+7. **Say nothing useful in an error.** No stack traces, SQL, or internal ids in responses; log them with `console.error` and answer with `{ error: { code, message } }`.
+8. **No raw HTML from data.** Let React render text. Do not use `dangerouslySetInnerHTML` or `innerHTML` with anything a user typed.
+
+### Tests are part of the feature
+
+The project ships with a test harness (`test/setup.ts`, from `@nerdsystem/sdk/testing`) that runs the real server code against a fresh local database and signs in made-up users. `pnpm test` runs it; `nerd check` and `nerd deploy` run it too and refuse the deploy when:
+
+- a test fails (`tests/failing`);
+- the test that calls `t.expectEveryRouteLocked({ public: [...] })` is gone (`tests/routes-not-checked`). That one call tries every route the app has as a signed-out visitor, so a new route is covered the moment it exists and fails until it is locked or deliberately listed as public;
+- a route with an id in its path has not been tried by a second user (`tests/owner-not-checked`).
+
+For every feature you build:
+
+- **One owner test per route with an id**, in `test/access.test.ts`: one user creates the thing, then `await t.expectHiddenFrom(otherUser, "PATCH", `/api/things/${id}`, body)` for each method. For lists, `await t.expectNotListed(otherUser, "/api/things", "a title only the owner has")`. If every signed-in user is truly meant to reach it (a shared catalogue, a public profile), declare `t.shared("GET /api/things/:id", "why")` instead and tell the person.
+- **One test file per feature** (`test/<feature>.test.ts`, like `test/todos.test.ts`): the main path a person takes from start to finish, and the inputs it must refuse.
+- **A role test** for anything behind `requireRole`: a signed-in user without the role gets 403, one with it gets through (`await t.as("dana", { roles: ["admin"] })`).
+
+When a test fails, fix the app. Change a test only when the behaviour it describes was meant to change. Never delete or weaken an access test, widen the `public` list, add `t.shared`, or remove `"tests": "required"` from `nerd.json` to get a deploy through; if you believe one of those is right, stop and ask the person in plain words first. Never import `@nerdsystem/sdk/testing` from anything under `src/`: it can sign in as anyone, and `nerd check` refuses it.
+
+What the tests do not prove: that the feature is the one the person wanted, or that its rules (who may book which slot, what a discount applies to) are right. Say what you built and what is public when you hand it over, so they can tell you if it is wrong.
+
 ## Data rules
 
 - Every table holding user data has a `user_id` text column, and every read and write filters on `c.var.user.id`. This is how users are kept apart.
 - Schema changes are migrations. Edit `schema.ts`, run `pnpm db:generate`, commit the new file in `migrations/`. Never hand-write SQL into production; `nerd deploy` applies migrations in name order and records which ran.
 - Migrations are forward-only. To undo, write another migration.
 - Prefer small, additive migrations. SQLite cannot alter columns in place.
-- `nerd db export` downloads a SQL dump of the production database (`<slug>-<date>.sql`, or `--out file.sql`); use it before a risky migration or when the person wants their data.
+- `nerd db export` downloads a SQL dump of the production database (`<slug>-<date>.sql`, or `--out file.sql`); use it before a risky migration or when the person wants their data. The live app's database requests wait while it runs, so run it at a quiet moment.
 
 ## Errors
 
@@ -130,12 +161,13 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 - New bindings in `wrangler.jsonc`. Only `DB`, `STORAGE`, and `ASSETS` exist. Durable Objects are not available.
 - Scripts that call `wrangler deploy`, `wrangler secret`, or remote `wrangler d1` commands.
 - Typecheck failures in either `src/server` or `src/client`.
+- A failing test, a missing access sweep, or a route with an id that no second user was tried against (the `tests/` rules above).
 
 ## Scheduled jobs and email
 
 - **Scheduled jobs**: put the work in the `POST /api/cron` handler (already in `src/server/index.ts`, guarded by `verifyCron()`), then turn the schedule on with `nerd cron hourly` or `nerd cron daily`. The platform calls it; the app never needs its own timer.
-- **Secrets** (Stripe keys, API tokens): never in code or in the client. Locally they live in `.dev.vars` (gitignored). For production, ask the person to run `nerd secret set NAME` and paste the value; it reaches the app as `c.env.NAME` on the next deploy. Pull request previews do not get it unless it was set with `--previews` (use that only for keys that are safe in a preview, such as a test-mode key). `nerd secret list` shows names only. Do not put a real secret value in any command you run yourself.
-- **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. The relay only sends to addresses that have an account on this app (someone who signed up); any other recipient is refused with a 400, and the sender name is always the app's name. It is limited per day by plan (50 on Free, 1,000 on Pro at $39 a month, 2,000 on Studio at $99 a month), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
+- **Secrets** (Stripe keys, API tokens): never in code or in the client. Locally they live in `.dev.vars` (gitignored). For production, ask the person to add it under the app's Settings tab in the dashboard, or to run `nerd secret set NAME` and paste the value; it reaches the app as `c.env.NAME` on the next deploy. Pull request previews do not get it unless it was set with `--previews` (use that only for keys that are safe in a preview, such as a test-mode key). `nerd secret list` shows names only. Do not put a real secret value in any command you run yourself.
+- **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. The relay only sends to addresses that have an account on this app (someone who signed up); any other recipient is refused with a 400, and the sender name is always the app's name. On the Free plan the recipient must also have confirmed their address by finishing a password reset (403 otherwise); paid plans can write to every signed-up user. It is limited per day by plan (50 on Free, 1,000 on Pro at $39 a month, 2,000 on Studio at $99 a month), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
 
 ## Debugging production
 

package/template/.cursor/rules/nerdsystem.mdc

@@ -2,7 +2,7 @@
 description: How to build, run, and deploy this app on nerdsystem. Applies to server, database, auth, and deploy work.
 alwaysApply: true
 ---
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (0e64cbbdd978); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (37f79c2cf2a8); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -34,8 +34,8 @@ Tell the person plainly what does not carry. Their users sign up again on the ne
 
 ## The loop
 
-1. Make the change.
-2. `nerd check` (static rules, then typecheck). Fix anything it reports.
+1. Make the change, and write or update its tests in the same step (see "Build it so it is safe and it works").
+2. `nerd check` (static rules, typecheck, then the tests and access checks). Fix anything it reports.
 3. `nerd dev` to run locally when you need to try it. The local app talks to the real auth service, so signup and login work exactly as in production.
 4. `nerd deploy` when it is ready. It runs the checks, builds, stores a copy of the code, applies pending migrations, uploads, prints the URL, and probes the live URL (headers and the sign-in routes). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
@@ -96,13 +96,44 @@ export default notes;
 
 Then in `src/server/index.ts`: `app.route("/api/notes", notes);`
 
+## Build it so it is safe and it works
+
+The person you are building for usually cannot read code. They will not spot a missing sign-in check or a query that returns someone else's rows, and neither will anyone looking at the screen. So the standard is yours to hold, every time, without being asked:
+
+1. **Lock every route first.** Put `requireAuth()` or `requireRole(...)` in front of every route as middleware, before any input is read (`router.use("*", requireAuth())` for a whole router). A route is public only when everyone on the internet is meant to reach it and it returns nothing private; then add it to the `public` list in `test/access.test.ts` and tell the person in plain words that it is open.
+2. **Scope every query to the signed-in user.** Reads, updates, and deletes on user data filter on `c.var.user.id`. On a route with an id in its path, put the id and the user id in the same `where`, and answer 404 when nothing matches, so someone else's row looks like it does not exist.
+3. **Take identity from the session, never from the request.** The user id, the role, a price, an owner: none of these come from the body, the query string, or a header the browser sends. Read the user from `c.var.user` and look the rest up on the server.
+4. **Check every input on the server.** Type, length, range, and allowed values, for every field of every body, query, and path parameter. Answer 400 with the usual error shape. The client's own checks are for the person's convenience; they protect nothing.
+5. **Hiding a button is not access control.** If only admins may do something, the route says `requireRole("admin")`. What the page shows is decoration.
+6. **Files:** check the type and the size before writing to `c.env.STORAGE`, store under a key that starts with the owner's user id, and serve them through a route that checks the owner. Never build a key from a name the browser sent without cleaning it.
+7. **Say nothing useful in an error.** No stack traces, SQL, or internal ids in responses; log them with `console.error` and answer with `{ error: { code, message } }`.
+8. **No raw HTML from data.** Let React render text. Do not use `dangerouslySetInnerHTML` or `innerHTML` with anything a user typed.
+
+### Tests are part of the feature
+
+The project ships with a test harness (`test/setup.ts`, from `@nerdsystem/sdk/testing`) that runs the real server code against a fresh local database and signs in made-up users. `pnpm test` runs it; `nerd check` and `nerd deploy` run it too and refuse the deploy when:
+
+- a test fails (`tests/failing`);
+- the test that calls `t.expectEveryRouteLocked({ public: [...] })` is gone (`tests/routes-not-checked`). That one call tries every route the app has as a signed-out visitor, so a new route is covered the moment it exists and fails until it is locked or deliberately listed as public;
+- a route with an id in its path has not been tried by a second user (`tests/owner-not-checked`).
+
+For every feature you build:
+
+- **One owner test per route with an id**, in `test/access.test.ts`: one user creates the thing, then `await t.expectHiddenFrom(otherUser, "PATCH", `/api/things/${id}`, body)` for each method. For lists, `await t.expectNotListed(otherUser, "/api/things", "a title only the owner has")`. If every signed-in user is truly meant to reach it (a shared catalogue, a public profile), declare `t.shared("GET /api/things/:id", "why")` instead and tell the person.
+- **One test file per feature** (`test/<feature>.test.ts`, like `test/todos.test.ts`): the main path a person takes from start to finish, and the inputs it must refuse.
+- **A role test** for anything behind `requireRole`: a signed-in user without the role gets 403, one with it gets through (`await t.as("dana", { roles: ["admin"] })`).
+
+When a test fails, fix the app. Change a test only when the behaviour it describes was meant to change. Never delete or weaken an access test, widen the `public` list, add `t.shared`, or remove `"tests": "required"` from `nerd.json` to get a deploy through; if you believe one of those is right, stop and ask the person in plain words first. Never import `@nerdsystem/sdk/testing` from anything under `src/`: it can sign in as anyone, and `nerd check` refuses it.
+
+What the tests do not prove: that the feature is the one the person wanted, or that its rules (who may book which slot, what a discount applies to) are right. Say what you built and what is public when you hand it over, so they can tell you if it is wrong.
+
 ## Data rules
 
 - Every table holding user data has a `user_id` text column, and every read and write filters on `c.var.user.id`. This is how users are kept apart.
 - Schema changes are migrations. Edit `schema.ts`, run `pnpm db:generate`, commit the new file in `migrations/`. Never hand-write SQL into production; `nerd deploy` applies migrations in name order and records which ran.
 - Migrations are forward-only. To undo, write another migration.
 - Prefer small, additive migrations. SQLite cannot alter columns in place.
-- `nerd db export` downloads a SQL dump of the production database (`<slug>-<date>.sql`, or `--out file.sql`); use it before a risky migration or when the person wants their data.
+- `nerd db export` downloads a SQL dump of the production database (`<slug>-<date>.sql`, or `--out file.sql`); use it before a risky migration or when the person wants their data. The live app's database requests wait while it runs, so run it at a quiet moment.
 
 ## Errors
 
@@ -131,12 +162,13 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 - New bindings in `wrangler.jsonc`. Only `DB`, `STORAGE`, and `ASSETS` exist. Durable Objects are not available.
 - Scripts that call `wrangler deploy`, `wrangler secret`, or remote `wrangler d1` commands.
 - Typecheck failures in either `src/server` or `src/client`.
+- A failing test, a missing access sweep, or a route with an id that no second user was tried against (the `tests/` rules above).
 
 ## Scheduled jobs and email
 
 - **Scheduled jobs**: put the work in the `POST /api/cron` handler (already in `src/server/index.ts`, guarded by `verifyCron()`), then turn the schedule on with `nerd cron hourly` or `nerd cron daily`. The platform calls it; the app never needs its own timer.
-- **Secrets** (Stripe keys, API tokens): never in code or in the client. Locally they live in `.dev.vars` (gitignored). For production, ask the person to run `nerd secret set NAME` and paste the value; it reaches the app as `c.env.NAME` on the next deploy. Pull request previews do not get it unless it was set with `--previews` (use that only for keys that are safe in a preview, such as a test-mode key). `nerd secret list` shows names only. Do not put a real secret value in any command you run yourself.
-- **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. The relay only sends to addresses that have an account on this app (someone who signed up); any other recipient is refused with a 400, and the sender name is always the app's name. It is limited per day by plan (50 on Free, 1,000 on Pro at $39 a month, 2,000 on Studio at $99 a month), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
+- **Secrets** (Stripe keys, API tokens): never in code or in the client. Locally they live in `.dev.vars` (gitignored). For production, ask the person to add it under the app's Settings tab in the dashboard, or to run `nerd secret set NAME` and paste the value; it reaches the app as `c.env.NAME` on the next deploy. Pull request previews do not get it unless it was set with `--previews` (use that only for keys that are safe in a preview, such as a test-mode key). `nerd secret list` shows names only. Do not put a real secret value in any command you run yourself.
+- **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. The relay only sends to addresses that have an account on this app (someone who signed up); any other recipient is refused with a 400, and the sender name is always the app's name. On the Free plan the recipient must also have confirmed their address by finishing a password reset (403 otherwise); paid plans can write to every signed-up user. It is limited per day by plan (50 on Free, 1,000 on Pro at $39 a month, 2,000 on Studio at $99 a month), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
 
 ## Debugging production
 

package/template/.github/copilot-instructions.md

@@ -1,4 +1,4 @@
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (0e64cbbdd978); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (37f79c2cf2a8); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -30,8 +30,8 @@ Tell the person plainly what does not carry. Their users sign up again on the ne
 
 ## The loop
 
-1. Make the change.
-2. `nerd check` (static rules, then typecheck). Fix anything it reports.
+1. Make the change, and write or update its tests in the same step (see "Build it so it is safe and it works").
+2. `nerd check` (static rules, typecheck, then the tests and access checks). Fix anything it reports.
 3. `nerd dev` to run locally when you need to try it. The local app talks to the real auth service, so signup and login work exactly as in production.
 4. `nerd deploy` when it is ready. It runs the checks, builds, stores a copy of the code, applies pending migrations, uploads, prints the URL, and probes the live URL (headers and the sign-in routes). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
@@ -92,13 +92,44 @@ export default notes;
 
 Then in `src/server/index.ts`: `app.route("/api/notes", notes);`
 
+## Build it so it is safe and it works
+
+The person you are building for usually cannot read code. They will not spot a missing sign-in check or a query that returns someone else's rows, and neither will anyone looking at the screen. So the standard is yours to hold, every time, without being asked:
+
+1. **Lock every route first.** Put `requireAuth()` or `requireRole(...)` in front of every route as middleware, before any input is read (`router.use("*", requireAuth())` for a whole router). A route is public only when everyone on the internet is meant to reach it and it returns nothing private; then add it to the `public` list in `test/access.test.ts` and tell the person in plain words that it is open.
+2. **Scope every query to the signed-in user.** Reads, updates, and deletes on user data filter on `c.var.user.id`. On a route with an id in its path, put the id and the user id in the same `where`, and answer 404 when nothing matches, so someone else's row looks like it does not exist.
+3. **Take identity from the session, never from the request.** The user id, the role, a price, an owner: none of these come from the body, the query string, or a header the browser sends. Read the user from `c.var.user` and look the rest up on the server.
+4. **Check every input on the server.** Type, length, range, and allowed values, for every field of every body, query, and path parameter. Answer 400 with the usual error shape. The client's own checks are for the person's convenience; they protect nothing.
+5. **Hiding a button is not access control.** If only admins may do something, the route says `requireRole("admin")`. What the page shows is decoration.
+6. **Files:** check the type and the size before writing to `c.env.STORAGE`, store under a key that starts with the owner's user id, and serve them through a route that checks the owner. Never build a key from a name the browser sent without cleaning it.
+7. **Say nothing useful in an error.** No stack traces, SQL, or internal ids in responses; log them with `console.error` and answer with `{ error: { code, message } }`.
+8. **No raw HTML from data.** Let React render text. Do not use `dangerouslySetInnerHTML` or `innerHTML` with anything a user typed.
+
+### Tests are part of the feature
+
+The project ships with a test harness (`test/setup.ts`, from `@nerdsystem/sdk/testing`) that runs the real server code against a fresh local database and signs in made-up users. `pnpm test` runs it; `nerd check` and `nerd deploy` run it too and refuse the deploy when:
+
+- a test fails (`tests/failing`);
+- the test that calls `t.expectEveryRouteLocked({ public: [...] })` is gone (`tests/routes-not-checked`). That one call tries every route the app has as a signed-out visitor, so a new route is covered the moment it exists and fails until it is locked or deliberately listed as public;
+- a route with an id in its path has not been tried by a second user (`tests/owner-not-checked`).
+
+For every feature you build:
+
+- **One owner test per route with an id**, in `test/access.test.ts`: one user creates the thing, then `await t.expectHiddenFrom(otherUser, "PATCH", `/api/things/${id}`, body)` for each method. For lists, `await t.expectNotListed(otherUser, "/api/things", "a title only the owner has")`. If every signed-in user is truly meant to reach it (a shared catalogue, a public profile), declare `t.shared("GET /api/things/:id", "why")` instead and tell the person.
+- **One test file per feature** (`test/<feature>.test.ts`, like `test/todos.test.ts`): the main path a person takes from start to finish, and the inputs it must refuse.
+- **A role test** for anything behind `requireRole`: a signed-in user without the role gets 403, one with it gets through (`await t.as("dana", { roles: ["admin"] })`).
+
+When a test fails, fix the app. Change a test only when the behaviour it describes was meant to change. Never delete or weaken an access test, widen the `public` list, add `t.shared`, or remove `"tests": "required"` from `nerd.json` to get a deploy through; if you believe one of those is right, stop and ask the person in plain words first. Never import `@nerdsystem/sdk/testing` from anything under `src/`: it can sign in as anyone, and `nerd check` refuses it.
+
+What the tests do not prove: that the feature is the one the person wanted, or that its rules (who may book which slot, what a discount applies to) are right. Say what you built and what is public when you hand it over, so they can tell you if it is wrong.
+
 ## Data rules
 
 - Every table holding user data has a `user_id` text column, and every read and write filters on `c.var.user.id`. This is how users are kept apart.
 - Schema changes are migrations. Edit `schema.ts`, run `pnpm db:generate`, commit the new file in `migrations/`. Never hand-write SQL into production; `nerd deploy` applies migrations in name order and records which ran.
 - Migrations are forward-only. To undo, write another migration.
 - Prefer small, additive migrations. SQLite cannot alter columns in place.
-- `nerd db export` downloads a SQL dump of the production database (`<slug>-<date>.sql`, or `--out file.sql`); use it before a risky migration or when the person wants their data.
+- `nerd db export` downloads a SQL dump of the production database (`<slug>-<date>.sql`, or `--out file.sql`); use it before a risky migration or when the person wants their data. The live app's database requests wait while it runs, so run it at a quiet moment.
 
 ## Errors
 
@@ -127,12 +158,13 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 - New bindings in `wrangler.jsonc`. Only `DB`, `STORAGE`, and `ASSETS` exist. Durable Objects are not available.
 - Scripts that call `wrangler deploy`, `wrangler secret`, or remote `wrangler d1` commands.
 - Typecheck failures in either `src/server` or `src/client`.
+- A failing test, a missing access sweep, or a route with an id that no second user was tried against (the `tests/` rules above).
 
 ## Scheduled jobs and email
 
 - **Scheduled jobs**: put the work in the `POST /api/cron` handler (already in `src/server/index.ts`, guarded by `verifyCron()`), then turn the schedule on with `nerd cron hourly` or `nerd cron daily`. The platform calls it; the app never needs its own timer.
-- **Secrets** (Stripe keys, API tokens): never in code or in the client. Locally they live in `.dev.vars` (gitignored). For production, ask the person to run `nerd secret set NAME` and paste the value; it reaches the app as `c.env.NAME` on the next deploy. Pull request previews do not get it unless it was set with `--previews` (use that only for keys that are safe in a preview, such as a test-mode key). `nerd secret list` shows names only. Do not put a real secret value in any command you run yourself.
-- **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. The relay only sends to addresses that have an account on this app (someone who signed up); any other recipient is refused with a 400, and the sender name is always the app's name. It is limited per day by plan (50 on Free, 1,000 on Pro at $39 a month, 2,000 on Studio at $99 a month), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
+- **Secrets** (Stripe keys, API tokens): never in code or in the client. Locally they live in `.dev.vars` (gitignored). For production, ask the person to add it under the app's Settings tab in the dashboard, or to run `nerd secret set NAME` and paste the value; it reaches the app as `c.env.NAME` on the next deploy. Pull request previews do not get it unless it was set with `--previews` (use that only for keys that are safe in a preview, such as a test-mode key). `nerd secret list` shows names only. Do not put a real secret value in any command you run yourself.
+- **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. The relay only sends to addresses that have an account on this app (someone who signed up); any other recipient is refused with a 400, and the sender name is always the app's name. On the Free plan the recipient must also have confirmed their address by finishing a password reset (403 otherwise); paid plans can write to every signed-up user. It is limited per day by plan (50 on Free, 1,000 on Pro at $39 a month, 2,000 on Studio at $99 a month), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
 
 ## Debugging production
 

package/template/.nerd/access-report.json

@@ -0,0 +1,29 @@
+{
+  "version": 1,
+  "routes": [
+    "DELETE /api/todos/:id",
+    "GET /api/admin/ping",
+    "GET /api/health",
+    "GET /api/todos",
+    "PATCH /api/todos/:id",
+    "POST /api/cron",
+    "POST /api/todos"
+  ],
+  "locked": [
+    "DELETE /api/todos/:id",
+    "GET /api/admin/ping",
+    "GET /api/todos",
+    "PATCH /api/todos/:id",
+    "POST /api/cron",
+    "POST /api/todos"
+  ],
+  "public": [
+    "GET /api/health"
+  ],
+  "ownerChecked": [
+    "DELETE /api/todos/:id",
+    "PATCH /api/todos/:id"
+  ],
+  "shared": [],
+  "everyRouteChecked": true
+}

package/template/AGENTS.md

@@ -1,4 +1,4 @@
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (0e64cbbdd978); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (37f79c2cf2a8); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -30,8 +30,8 @@ Tell the person plainly what does not carry. Their users sign up again on the ne
 
 ## The loop
 
-1. Make the change.
-2. `nerd check` (static rules, then typecheck). Fix anything it reports.
+1. Make the change, and write or update its tests in the same step (see "Build it so it is safe and it works").
+2. `nerd check` (static rules, typecheck, then the tests and access checks). Fix anything it reports.
 3. `nerd dev` to run locally when you need to try it. The local app talks to the real auth service, so signup and login work exactly as in production.
 4. `nerd deploy` when it is ready. It runs the checks, builds, stores a copy of the code, applies pending migrations, uploads, prints the URL, and probes the live URL (headers and the sign-in routes). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
@@ -92,13 +92,44 @@ export default notes;
 
 Then in `src/server/index.ts`: `app.route("/api/notes", notes);`
 
+## Build it so it is safe and it works
+
+The person you are building for usually cannot read code. They will not spot a missing sign-in check or a query that returns someone else's rows, and neither will anyone looking at the screen. So the standard is yours to hold, every time, without being asked:
+
+1. **Lock every route first.** Put `requireAuth()` or `requireRole(...)` in front of every route as middleware, before any input is read (`router.use("*", requireAuth())` for a whole router). A route is public only when everyone on the internet is meant to reach it and it returns nothing private; then add it to the `public` list in `test/access.test.ts` and tell the person in plain words that it is open.
+2. **Scope every query to the signed-in user.** Reads, updates, and deletes on user data filter on `c.var.user.id`. On a route with an id in its path, put the id and the user id in the same `where`, and answer 404 when nothing matches, so someone else's row looks like it does not exist.
+3. **Take identity from the session, never from the request.** The user id, the role, a price, an owner: none of these come from the body, the query string, or a header the browser sends. Read the user from `c.var.user` and look the rest up on the server.
+4. **Check every input on the server.** Type, length, range, and allowed values, for every field of every body, query, and path parameter. Answer 400 with the usual error shape. The client's own checks are for the person's convenience; they protect nothing.
+5. **Hiding a button is not access control.** If only admins may do something, the route says `requireRole("admin")`. What the page shows is decoration.
+6. **Files:** check the type and the size before writing to `c.env.STORAGE`, store under a key that starts with the owner's user id, and serve them through a route that checks the owner. Never build a key from a name the browser sent without cleaning it.
+7. **Say nothing useful in an error.** No stack traces, SQL, or internal ids in responses; log them with `console.error` and answer with `{ error: { code, message } }`.
+8. **No raw HTML from data.** Let React render text. Do not use `dangerouslySetInnerHTML` or `innerHTML` with anything a user typed.
+
+### Tests are part of the feature
+
+The project ships with a test harness (`test/setup.ts`, from `@nerdsystem/sdk/testing`) that runs the real server code against a fresh local database and signs in made-up users. `pnpm test` runs it; `nerd check` and `nerd deploy` run it too and refuse the deploy when:
+
+- a test fails (`tests/failing`);
+- the test that calls `t.expectEveryRouteLocked({ public: [...] })` is gone (`tests/routes-not-checked`). That one call tries every route the app has as a signed-out visitor, so a new route is covered the moment it exists and fails until it is locked or deliberately listed as public;
+- a route with an id in its path has not been tried by a second user (`tests/owner-not-checked`).
+
+For every feature you build:
+
+- **One owner test per route with an id**, in `test/access.test.ts`: one user creates the thing, then `await t.expectHiddenFrom(otherUser, "PATCH", `/api/things/${id}`, body)` for each method. For lists, `await t.expectNotListed(otherUser, "/api/things", "a title only the owner has")`. If every signed-in user is truly meant to reach it (a shared catalogue, a public profile), declare `t.shared("GET /api/things/:id", "why")` instead and tell the person.
+- **One test file per feature** (`test/<feature>.test.ts`, like `test/todos.test.ts`): the main path a person takes from start to finish, and the inputs it must refuse.
+- **A role test** for anything behind `requireRole`: a signed-in user without the role gets 403, one with it gets through (`await t.as("dana", { roles: ["admin"] })`).
+
+When a test fails, fix the app. Change a test only when the behaviour it describes was meant to change. Never delete or weaken an access test, widen the `public` list, add `t.shared`, or remove `"tests": "required"` from `nerd.json` to get a deploy through; if you believe one of those is right, stop and ask the person in plain words first. Never import `@nerdsystem/sdk/testing` from anything under `src/`: it can sign in as anyone, and `nerd check` refuses it.
+
+What the tests do not prove: that the feature is the one the person wanted, or that its rules (who may book which slot, what a discount applies to) are right. Say what you built and what is public when you hand it over, so they can tell you if it is wrong.
+
 ## Data rules
 
 - Every table holding user data has a `user_id` text column, and every read and write filters on `c.var.user.id`. This is how users are kept apart.
 - Schema changes are migrations. Edit `schema.ts`, run `pnpm db:generate`, commit the new file in `migrations/`. Never hand-write SQL into production; `nerd deploy` applies migrations in name order and records which ran.
 - Migrations are forward-only. To undo, write another migration.
 - Prefer small, additive migrations. SQLite cannot alter columns in place.
-- `nerd db export` downloads a SQL dump of the production database (`<slug>-<date>.sql`, or `--out file.sql`); use it before a risky migration or when the person wants their data.
+- `nerd db export` downloads a SQL dump of the production database (`<slug>-<date>.sql`, or `--out file.sql`); use it before a risky migration or when the person wants their data. The live app's database requests wait while it runs, so run it at a quiet moment.
 
 ## Errors
 
@@ -127,12 +158,13 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 - New bindings in `wrangler.jsonc`. Only `DB`, `STORAGE`, and `ASSETS` exist. Durable Objects are not available.
 - Scripts that call `wrangler deploy`, `wrangler secret`, or remote `wrangler d1` commands.
 - Typecheck failures in either `src/server` or `src/client`.
+- A failing test, a missing access sweep, or a route with an id that no second user was tried against (the `tests/` rules above).
 
 ## Scheduled jobs and email
 
 - **Scheduled jobs**: put the work in the `POST /api/cron` handler (already in `src/server/index.ts`, guarded by `verifyCron()`), then turn the schedule on with `nerd cron hourly` or `nerd cron daily`. The platform calls it; the app never needs its own timer.
-- **Secrets** (Stripe keys, API tokens): never in code or in the client. Locally they live in `.dev.vars` (gitignored). For production, ask the person to run `nerd secret set NAME` and paste the value; it reaches the app as `c.env.NAME` on the next deploy. Pull request previews do not get it unless it was set with `--previews` (use that only for keys that are safe in a preview, such as a test-mode key). `nerd secret list` shows names only. Do not put a real secret value in any command you run yourself.
-- **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. The relay only sends to addresses that have an account on this app (someone who signed up); any other recipient is refused with a 400, and the sender name is always the app's name. It is limited per day by plan (50 on Free, 1,000 on Pro at $39 a month, 2,000 on Studio at $99 a month), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
+- **Secrets** (Stripe keys, API tokens): never in code or in the client. Locally they live in `.dev.vars` (gitignored). For production, ask the person to add it under the app's Settings tab in the dashboard, or to run `nerd secret set NAME` and paste the value; it reaches the app as `c.env.NAME` on the next deploy. Pull request previews do not get it unless it was set with `--previews` (use that only for keys that are safe in a preview, such as a test-mode key). `nerd secret list` shows names only. Do not put a real secret value in any command you run yourself.
+- **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. The relay only sends to addresses that have an account on this app (someone who signed up); any other recipient is refused with a 400, and the sender name is always the app's name. On the Free plan the recipient must also have confirmed their address by finishing a password reset (403 otherwise); paid plans can write to every signed-up user. It is limited per day by plan (50 on Free, 1,000 on Pro at $39 a month, 2,000 on Studio at $99 a month), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
 
 ## Debugging production
 

package/template/CLAUDE.md

@@ -5,7 +5,8 @@ nerdsystem deploys this app to Cloudflare and provides authentication and author
 ## Commands
 
 - `nerd dev` starts the app locally with a real session flow against the platform auth service.
-- `nerd check` typechecks both sides and verifies the platform rules below. Run it before `nerd deploy`.
+- `nerd check` typechecks both sides, verifies the platform rules below, and runs the tests in `test/`. Run it before `nerd deploy`.
+- `pnpm test` runs the tests alone: the real server code against a fresh local database, with made-up signed-in users.
 - `nerd deploy` builds, stores a copy of the code, applies pending migrations to the production database, and ships the app. Prints the URL.
 - `nerd save` keeps a copy of the code on nerdsystem without deploying; `nerd pull <org>/<project>` restores it on another computer.
 - `nerd db query "select ..."` runs SQL against the production database. `nerd deployments` lists recent deploys.
@@ -27,6 +28,7 @@ nerdsystem deploys this app to Cloudflare and provides authentication and author
 5. Keep every API route under `/api/`. Other paths are served from static assets and never reach the Worker.
 6. Do not add Cloudflare bindings to `wrangler.jsonc`, and do not run `wrangler deploy`. Bindings are provisioned by the platform.
 7. Secrets and environment variables for the deployed app are managed with `nerd` commands, never committed.
+8. Every route is locked with `requireAuth()` or `requireRole()` unless it is listed as public in `test/access.test.ts`, and every route with an id in its path has a test showing a second user cannot reach it. Write the tests with the feature. `nerd check` refuses a deploy when they fail or are missing; never weaken one to get through.
 
 ## Roles
 

package/template/GEMINI.md

@@ -1,4 +1,4 @@
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (0e64cbbdd978); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (37f79c2cf2a8); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -30,8 +30,8 @@ Tell the person plainly what does not carry. Their users sign up again on the ne
 
 ## The loop
 
-1. Make the change.
-2. `nerd check` (static rules, then typecheck). Fix anything it reports.
+1. Make the change, and write or update its tests in the same step (see "Build it so it is safe and it works").
+2. `nerd check` (static rules, typecheck, then the tests and access checks). Fix anything it reports.
 3. `nerd dev` to run locally when you need to try it. The local app talks to the real auth service, so signup and login work exactly as in production.
 4. `nerd deploy` when it is ready. It runs the checks, builds, stores a copy of the code, applies pending migrations, uploads, prints the URL, and probes the live URL (headers and the sign-in routes). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
@@ -92,13 +92,44 @@ export default notes;
 
 Then in `src/server/index.ts`: `app.route("/api/notes", notes);`
 
+## Build it so it is safe and it works
+
+The person you are building for usually cannot read code. They will not spot a missing sign-in check or a query that returns someone else's rows, and neither will anyone looking at the screen. So the standard is yours to hold, every time, without being asked:
+
+1. **Lock every route first.** Put `requireAuth()` or `requireRole(...)` in front of every route as middleware, before any input is read (`router.use("*", requireAuth())` for a whole router). A route is public only when everyone on the internet is meant to reach it and it returns nothing private; then add it to the `public` list in `test/access.test.ts` and tell the person in plain words that it is open.
+2. **Scope every query to the signed-in user.** Reads, updates, and deletes on user data filter on `c.var.user.id`. On a route with an id in its path, put the id and the user id in the same `where`, and answer 404 when nothing matches, so someone else's row looks like it does not exist.
+3. **Take identity from the session, never from the request.** The user id, the role, a price, an owner: none of these come from the body, the query string, or a header the browser sends. Read the user from `c.var.user` and look the rest up on the server.
+4. **Check every input on the server.** Type, length, range, and allowed values, for every field of every body, query, and path parameter. Answer 400 with the usual error shape. The client's own checks are for the person's convenience; they protect nothing.
+5. **Hiding a button is not access control.** If only admins may do something, the route says `requireRole("admin")`. What the page shows is decoration.
+6. **Files:** check the type and the size before writing to `c.env.STORAGE`, store under a key that starts with the owner's user id, and serve them through a route that checks the owner. Never build a key from a name the browser sent without cleaning it.
+7. **Say nothing useful in an error.** No stack traces, SQL, or internal ids in responses; log them with `console.error` and answer with `{ error: { code, message } }`.
+8. **No raw HTML from data.** Let React render text. Do not use `dangerouslySetInnerHTML` or `innerHTML` with anything a user typed.
+
+### Tests are part of the feature
+
+The project ships with a test harness (`test/setup.ts`, from `@nerdsystem/sdk/testing`) that runs the real server code against a fresh local database and signs in made-up users. `pnpm test` runs it; `nerd check` and `nerd deploy` run it too and refuse the deploy when:
+
+- a test fails (`tests/failing`);
+- the test that calls `t.expectEveryRouteLocked({ public: [...] })` is gone (`tests/routes-not-checked`). That one call tries every route the app has as a signed-out visitor, so a new route is covered the moment it exists and fails until it is locked or deliberately listed as public;
+- a route with an id in its path has not been tried by a second user (`tests/owner-not-checked`).
+
+For every feature you build:
+
+- **One owner test per route with an id**, in `test/access.test.ts`: one user creates the thing, then `await t.expectHiddenFrom(otherUser, "PATCH", `/api/things/${id}`, body)` for each method. For lists, `await t.expectNotListed(otherUser, "/api/things", "a title only the owner has")`. If every signed-in user is truly meant to reach it (a shared catalogue, a public profile), declare `t.shared("GET /api/things/:id", "why")` instead and tell the person.
+- **One test file per feature** (`test/<feature>.test.ts`, like `test/todos.test.ts`): the main path a person takes from start to finish, and the inputs it must refuse.
+- **A role test** for anything behind `requireRole`: a signed-in user without the role gets 403, one with it gets through (`await t.as("dana", { roles: ["admin"] })`).
+
+When a test fails, fix the app. Change a test only when the behaviour it describes was meant to change. Never delete or weaken an access test, widen the `public` list, add `t.shared`, or remove `"tests": "required"` from `nerd.json` to get a deploy through; if you believe one of those is right, stop and ask the person in plain words first. Never import `@nerdsystem/sdk/testing` from anything under `src/`: it can sign in as anyone, and `nerd check` refuses it.
+
+What the tests do not prove: that the feature is the one the person wanted, or that its rules (who may book which slot, what a discount applies to) are right. Say what you built and what is public when you hand it over, so they can tell you if it is wrong.
+
 ## Data rules
 
 - Every table holding user data has a `user_id` text column, and every read and write filters on `c.var.user.id`. This is how users are kept apart.
 - Schema changes are migrations. Edit `schema.ts`, run `pnpm db:generate`, commit the new file in `migrations/`. Never hand-write SQL into production; `nerd deploy` applies migrations in name order and records which ran.
 - Migrations are forward-only. To undo, write another migration.
 - Prefer small, additive migrations. SQLite cannot alter columns in place.
-- `nerd db export` downloads a SQL dump of the production database (`<slug>-<date>.sql`, or `--out file.sql`); use it before a risky migration or when the person wants their data.
+- `nerd db export` downloads a SQL dump of the production database (`<slug>-<date>.sql`, or `--out file.sql`); use it before a risky migration or when the person wants their data. The live app's database requests wait while it runs, so run it at a quiet moment.
 
 ## Errors
 
@@ -127,12 +158,13 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 - New bindings in `wrangler.jsonc`. Only `DB`, `STORAGE`, and `ASSETS` exist. Durable Objects are not available.
 - Scripts that call `wrangler deploy`, `wrangler secret`, or remote `wrangler d1` commands.
 - Typecheck failures in either `src/server` or `src/client`.
+- A failing test, a missing access sweep, or a route with an id that no second user was tried against (the `tests/` rules above).
 
 ## Scheduled jobs and email
 
 - **Scheduled jobs**: put the work in the `POST /api/cron` handler (already in `src/server/index.ts`, guarded by `verifyCron()`), then turn the schedule on with `nerd cron hourly` or `nerd cron daily`. The platform calls it; the app never needs its own timer.
-- **Secrets** (Stripe keys, API tokens): never in code or in the client. Locally they live in `.dev.vars` (gitignored). For production, ask the person to run `nerd secret set NAME` and paste the value; it reaches the app as `c.env.NAME` on the next deploy. Pull request previews do not get it unless it was set with `--previews` (use that only for keys that are safe in a preview, such as a test-mode key). `nerd secret list` shows names only. Do not put a real secret value in any command you run yourself.
-- **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. The relay only sends to addresses that have an account on this app (someone who signed up); any other recipient is refused with a 400, and the sender name is always the app's name. It is limited per day by plan (50 on Free, 1,000 on Pro at $39 a month, 2,000 on Studio at $99 a month), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
+- **Secrets** (Stripe keys, API tokens): never in code or in the client. Locally they live in `.dev.vars` (gitignored). For production, ask the person to add it under the app's Settings tab in the dashboard, or to run `nerd secret set NAME` and paste the value; it reaches the app as `c.env.NAME` on the next deploy. Pull request previews do not get it unless it was set with `--previews` (use that only for keys that are safe in a preview, such as a test-mode key). `nerd secret list` shows names only. Do not put a real secret value in any command you run yourself.
+- **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. The relay only sends to addresses that have an account on this app (someone who signed up); any other recipient is refused with a 400, and the sender name is always the app's name. On the Free plan the recipient must also have confirmed their address by finishing a password reset (403 otherwise); paid plans can write to every signed-up user. It is limited per day by plan (50 on Free, 1,000 on Pro at $39 a month, 2,000 on Studio at $99 a month), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
 
 ## Debugging production
 

package/template/migrations/meta/0000_snapshot.json

@@ -0,0 +1,64 @@
+{
+  "version": "6",
+  "dialect": "sqlite",
+  "id": "a804e9fb-b416-462b-a3e2-0349c283a4b7",
+  "prevId": "00000000-0000-0000-0000-000000000000",
+  "tables": {
+    "todos": {
+      "name": "todos",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "integer",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "done": {
+          "name": "done",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    }
+  },
+  "views": {},
+  "enums": {},
+  "_meta": {
+    "schemas": {},
+    "tables": {},
+    "columns": {}
+  },
+  "internal": {
+    "indexes": {}
+  }
+}

package/template/migrations/meta/_journal.json

@@ -0,0 +1,13 @@
+{
+  "version": "7",
+  "dialect": "sqlite",
+  "entries": [
+    {
+      "idx": 0,
+      "version": "6",
+      "when": 1794323561793,
+      "tag": "0000_init",
+      "breakpoints": true
+    }
+  ]
+}

package/template/nerd.json

@@ -1,5 +1,6 @@
 {
   "$schema": "https://nerdsystem.com/schemas/nerd.json",
   "org": "",
-  "project": ""
+  "project": "",
+  "tests": "required"
 }

package/template/package.json

@@ -7,6 +7,7 @@
     "dev": "nerd dev",
     "build": "vite build",
     "check": "nerd check",
+    "test": "vitest run",
     "deploy": "nerd deploy",
     "typecheck": "tsc -p tsconfig.worker.json --noEmit && tsc -p tsconfig.client.json --noEmit",
     "db:generate": "drizzle-kit generate",
@@ -34,6 +35,7 @@
     "drizzle-kit": "^0.31.11",
     "typescript": "^5.9.3",
     "vite": "^8.3.5",
+    "vitest": "^4.1.0",
     "wrangler": "^4.156.2"
   }
 }

package/template/test/access.test.ts

@@ -0,0 +1,42 @@
+// Who can reach what. `nerd check` runs these before every deploy and refuses the deploy when one fails,
+// when the first test is missing, or when a route with an id in its path has no owner test below.
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import type { TestHarness } from "@nerdsystem/sdk/testing";
+import { startTestApp } from "./setup";
+
+let t: TestHarness;
+let stop: () => Promise<void>;
+beforeAll(async () => ({ t, stop } = await startTestApp()));
+afterAll(() => stop());
+
+describe("a signed-out visitor", () => {
+  it("is refused on every route that is not public", async () => {
+    // This calls every route the app has, including ones added later. A new route fails here until it
+    // has requireAuth() or requireRole() in front of it. Only list a route as public when everyone on
+    // the internet is meant to reach it, and it returns nothing private.
+    await t.expectEveryRouteLocked({ public: ["GET /api/health"] });
+  });
+});
+
+describe("one person's todos", () => {
+  it("cannot be seen, changed, or deleted by someone else", async () => {
+    const alice = await t.as("alice");
+    const bob = await t.as("bob");
+    const created = (await (await alice.post("/api/todos", { title: "only-alice-sees-this" })).json()) as { todo: { id: number } };
+
+    await t.expectNotListed(bob, "/api/todos", "only-alice-sees-this");
+    await t.expectHiddenFrom(bob, "PATCH", `/api/todos/${created.todo.id}`, { done: true });
+    await t.expectHiddenFrom(bob, "DELETE", `/api/todos/${created.todo.id}`);
+
+    // And it is still there, unchanged, for the person who owns it.
+    const mine = (await (await alice.get("/api/todos")).json()) as { todos: { id: number; done: boolean }[] };
+    expect(mine.todos).toEqual([expect.objectContaining({ id: created.todo.id, done: false })]);
+  });
+});
+
+describe("the admin route", () => {
+  it("needs the admin role, not just a sign-in", async () => {
+    expect((await (await t.as("carol")).get("/api/admin/ping")).status).toBe(403);
+    expect((await (await t.as("dana", { roles: ["admin"] })).get("/api/admin/ping")).status).toBe(200);
+  });
+});

package/template/test/global-setup.ts

@@ -0,0 +1,7 @@
+// Runs once before the tests: a report from an earlier run must not vouch for this one.
+import { rmSync } from "node:fs";
+import path from "node:path";
+
+export default function setup(): void {
+  rmSync(path.resolve(import.meta.dirname, "..", ".nerd", "access-report.json"), { force: true });
+}

package/template/test/setup.ts

@@ -0,0 +1,40 @@
+// Starts the app for tests: the real server code, a fresh local database with every migration applied,
+// and the nerdsystem test harness. Nothing here talks to the network or to the live app.
+// You should not need to change this file. Add tests next to it.
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { getPlatformProxy } from "wrangler";
+import { testApp, type AccessReport, type TestHarness } from "@nerdsystem/sdk/testing";
+import app from "../src/server";
+
+const root = path.resolve(import.meta.dirname, "..");
+const reportFile = path.join(root, ".nerd", "access-report.json");
+
+/** Each test file adds what it checked to the one report `nerd check` reads. */
+function mergeReport(next: AccessReport): void {
+  const prev: AccessReport | null = existsSync(reportFile) ? JSON.parse(readFileSync(reportFile, "utf8")) : null;
+  const union = <T,>(a: T[] | undefined, b: T[]) => [...new Set([...(a ?? []), ...b])].sort();
+  const merged: AccessReport = {
+    version: 1,
+    routes: next.routes,
+    locked: union(prev?.locked, next.locked),
+    public: union(prev?.public, next.public),
+    ownerChecked: union(prev?.ownerChecked, next.ownerChecked),
+    shared: union(prev?.shared, next.shared),
+    everyRouteChecked: Boolean(prev?.everyRouteChecked) || next.everyRouteChecked,
+  };
+  mkdirSync(path.dirname(reportFile), { recursive: true });
+  writeFileSync(reportFile, `${JSON.stringify(merged, null, 2)}\n`);
+}
+
+export async function startTestApp(): Promise<{ t: TestHarness; env: { DB: D1Database; STORAGE: R2Bucket }; stop: () => Promise<void> }> {
+  const platform = await getPlatformProxy<{ DB: D1Database; STORAGE: R2Bucket }>({ configPath: path.join(root, "wrangler.jsonc"), persist: false });
+  const dir = path.join(root, "migrations");
+  for (const file of readdirSync(dir).filter((f) => f.endsWith(".sql")).sort()) {
+    for (const statement of readFileSync(path.join(dir, file), "utf8").split("--> statement-breakpoint")) {
+      if (statement.trim()) await platform.env.DB.prepare(statement).run();
+    }
+  }
+  const t = await testApp(app, { env: platform.env, onReport: mergeReport });
+  return { t, env: platform.env, stop: () => platform.dispose() };
+}

package/template/test/todos.test.ts

@@ -0,0 +1,31 @@
+// Does the feature work? One test file per feature: the main path a person takes, and the input it must refuse.
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import type { TestHarness } from "@nerdsystem/sdk/testing";
+import { startTestApp } from "./setup";
+
+let t: TestHarness;
+let stop: () => Promise<void>;
+beforeAll(async () => ({ t, stop } = await startTestApp()));
+afterAll(() => stop());
+
+describe("todos", () => {
+  it("adds a todo, lists it, marks it done, and deletes it", async () => {
+    const erin = await t.as("erin");
+    const added = await erin.post("/api/todos", { title: "  Buy milk  " });
+    expect(added.status).toBe(201);
+    const { todo } = (await added.json()) as { todo: { id: number; title: string; done: boolean } };
+    expect(todo).toMatchObject({ title: "Buy milk", done: false });
+
+    expect(((await (await erin.get("/api/todos")).json()) as { todos: unknown[] }).todos).toHaveLength(1);
+    expect(((await (await erin.patch(`/api/todos/${todo.id}`, { done: true })).json()) as { todo: { done: boolean } }).todo.done).toBe(true);
+    expect((await erin.delete(`/api/todos/${todo.id}`)).status).toBe(200);
+    expect(((await (await erin.get("/api/todos")).json()) as { todos: unknown[] }).todos).toHaveLength(0);
+  });
+
+  it("refuses a todo with no title, and answers 404 for one that does not exist", async () => {
+    const erin = await t.as("erin");
+    expect((await erin.post("/api/todos", {})).status).toBe(400);
+    expect((await erin.post("/api/todos", { title: "   " })).status).toBe(400);
+    expect((await erin.patch("/api/todos/999999", { done: true })).status).toBe(404);
+  });
+});

package/template/vitest.config.ts

@@ -0,0 +1,16 @@
+// Tests run the server code in Node against a local database. This file keeps them apart from vite.config.ts,
+// whose Cloudflare plugin is for building and for `nerd dev`.
+import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+  test: {
+    include: ["test/**/*.test.ts"],
+    // The SDK is published for bundlers, so let Vite load it instead of Node.
+    server: { deps: { inline: ["@nerdsystem/sdk"] } },
+    globalSetup: ["test/global-setup.ts"],
+    // One file at a time: each starts its own local database, and they share one access report.
+    fileParallelism: false,
+    testTimeout: 20_000,
+    hookTimeout: 30_000,
+  },
+});