nerdsystem 0.0.13 → 0.0.15

package/dist/commands/init.js

@@ -29,7 +29,7 @@ async function pickOrg(api, wanted) {
         return me.orgs[0].slug;
     if (me.orgs.length === 0)
         throw new CliError("You have no orgs. Create one in the dashboard first.");
-    throw new CliError(`Pick an org with --org. Yours: ${me.orgs.map((o) => o.slug).join(", ")}`);
+    throw new CliError(`Pick an org with --org. Yours: ${me.orgs.map((o) => o.slug).join(", ")}`, 1, { code: "org_required" });
 }
 /** Creates the remote project and writes nerd.json. Shared by init and link. */
 export async function linkProject(root, args) {
@@ -171,7 +171,7 @@ export async function init(dir, args) {
         const reason = err instanceof Error ? err.message : String(err);
         const code = err instanceof CliError && err.code ? err.code : "error";
         // A plan limit is not something to fix in the folder: the API's message says how to free a slot.
-        const link = `cd ${dir} && nerd link --slug ${slug}${args.org ? ` --org ${args.org}` : ""}`;
+        const link = `cd ${dir} && nerd link --slug ${slug}${args.org ? ` --org ${args.org}` : code === "org_required" ? " --org <one of yours>" : ""}`;
         const next = code === "plan_limit" ? `When a slot is free, run: ${link}` : `Fix that, then run: ${link}`;
         const message = `The folder is ready but the project was not created: ${reason}`;
         // Same pattern as `nerd check --json`: the JSON goes to stdout, the exit code stays non-zero.
@@ -183,4 +183,4 @@ export async function init(dir, args) {
     log.ok(`Ready. Next:\n  cd ${dir}\n  pnpm install\n  nerd dev\n\nThen open the folder in your coding agent and ask it to build the first feature; the nerdsystem skill walks it through.\nDeploys go to ${project.url}`);
 }
 // Kept in sync with packages/sdk/package.json by the release script.
-const SDK_VERSION = "0.0.13";
+const SDK_VERSION = "0.0.15";

package/dist/gates/index.js

@@ -2,6 +2,8 @@ import { bundleGate, finding, secretsGate } from "./secrets.js";
 import { depsGate, piiGate, policyGate, rulesGate, typecheckGate } from "./code.js";
 import { gitleaksGate, semgrepGate } from "./tools.js";
 import { suppressionsGate } from "./suppressions.js";
+import { staticGate } from "./static.js";
+import { testsGate } from "./tests.js";
 import { applyAttempts, MAX_ATTEMPTS } from "./attempts.js";
 export { gateSummary, skippedGates } from "./types.js";
 export { RULES, ruleFor } from "./rules.js";
@@ -9,7 +11,7 @@ export { mask } from "./secrets.js";
 export { MAX_ATTEMPTS, readAttempts } from "./attempts.js";
 export { probeDeployment, skippedProbe, waitForDeployment } from "./smoke.js";
 /** Gates that run on source, before the build. Suppressions first so a human sees them before anything else. */
-export const SOURCE_GATES = [suppressionsGate, secretsGate, gitleaksGate, depsGate, rulesGate, semgrepGate, policyGate, piiGate, typecheckGate];
+export const SOURCE_GATES = [suppressionsGate, secretsGate, gitleaksGate, depsGate, rulesGate, staticGate, semgrepGate, policyGate, piiGate, typecheckGate, testsGate];
 /** Gates that need the built output. */
 export const BUILD_GATES = [bundleGate, policyGate];
 function selectGates(gates, onlyRules) {

package/dist/gates/rules.js

@@ -36,6 +36,23 @@ export const RULES = {
     "rules/advisory": { title: "Platform advisory", severity: "warn", audience: "agent", risk: "Not blocking, but the project is missing something the platform expects.", fix: "Follow the instruction in the finding." },
     "rules/shape": { title: "Not in the nerdsystem shape", severity: "warn", audience: "human", risk: "Every app on nerdsystem is one shape: a Vite client, a Hono server on @nerdsystem/sdk, SQLite on D1, and a bucket. This repository is not in that shape. A clean scan says nothing about whether it would deploy here.", fix: "Start a project with `nerd init` and have the agent port the screens into it. The server and the login are rebuilt on the platform's sign-in and database. The compare pages on nerdsystem.com say what carries over." },
     "typecheck/error": { title: "TypeScript error", severity: "block", audience: "agent", risk: "The code would not compile reliably; the build may fail or behave unexpectedly.", fix: "Fix the type error at the file and line shown. Run `npx tsc -b` for the full message." },
+    "code/raw-sql": { title: "SQL built from values", severity: "block", audience: "agent", risk: "A value from a request placed straight into SQL lets a visitor rewrite the query and read or delete other people's data.", fix: "Use the Drizzle query builder, or bind values as parameters (`.prepare(\"... where id = ?\").bind(id)`). Never put a variable inside the SQL text.", example: { wrong: "c.env.DB.prepare(`select * from notes where id = ${id}`)", right: "db(c.env.DB).select().from(schema.notes).where(eq(schema.notes.id, id))" } },
+    "code/eval": { title: "eval or new Function", severity: "block", audience: "agent", risk: "Running text as code lets anyone who can influence that text run their own code in the app.", fix: "Remove it. Parse data with JSON.parse and choose behaviour with ordinary code." },
+    "code/password-in-app": { title: "Password handling in app code", severity: "block", audience: "agent", risk: "Storing or comparing passwords yourself is unnecessary here and easy to get wrong.", fix: "Remove it. Sign-in is provided by the platform: read the signed-in user from `c.var.user` and protect routes with `requireAuth()`.", example: { wrong: "if (user.password === body.password) { ... }", right: "app.get(\"/api/me\", requireAuth(), (c) => c.json(c.var.user));" } },
+    "code/tokens-in-app": { title: "Signing or verifying tokens in app code", severity: "warn", audience: "agent", risk: "A second token system beside the platform's sessions is a second way in, and a common source of mistakes.", fix: "Use the session the SDK provides (`c.var.user`). If a third-party service requires its own signed token, keep that code in one file and say so to the person." },
+    "code/html-from-data": { title: "HTML built from data", severity: "warn", audience: "agent", risk: "Text a user typed, rendered as HTML, can carry a script that runs in other users' browsers.", fix: "Render the value as text and let React escape it. Do not use `dangerouslySetInnerHTML` or `innerHTML` with anything that is not a fixed string." },
+    "code/open-redirect": { title: "Redirect to an address from the request", severity: "warn", audience: "agent", risk: "A link to your app could send people on to a look-alike site.", fix: "Redirect only to paths inside the app: check that the value starts with a single `/` and is one of the pages you expect." },
+    "code/fetch-user-url": { title: "Fetching an address from the request", severity: "warn", audience: "agent", risk: "A visitor could make the server fetch addresses it should not reach.", fix: "Fetch only fixed addresses, or check the host against a short list you wrote." },
+    "code/weak-random": { title: "Math.random used for a secret", severity: "warn", audience: "agent", risk: "Math.random is predictable, so a token or code made with it can be guessed.", fix: "Use `crypto.randomUUID()` or `crypto.getRandomValues()`." },
+    "code/unvalidated-body": { title: "A request body read without a check", severity: "warn", audience: "agent", risk: "Fields of any type or size reach the route, which is how bad data and oversized input get into the database.", fix: "Read it with `readBody(c, schema)` from `@nerdsystem/sdk` and a zod schema that gives every field a type and a limit. It answers 400 for anything else.", example: { wrong: "const body = await c.req.json();", right: "const input = await readBody(c, z.object({ title: z.string().trim().min(1).max(200) }));" } },
+    "code/routes-open-by-default": { title: "Routes are open unless each one is protected", severity: "warn", audience: "agent", risk: "A route added without `requireAuth()` answers everyone on the internet.", fix: "Pass the list of public routes to `createNerdApp({ public: [\"GET /api/health\"] })` (needs @nerdsystem/sdk 0.0.15 or later). Every other route then requires sign-in automatically. Run the tests afterwards: a route that was meant to be public must be on the list." },
+    "tests/missing": { title: "No access tests", severity: "warn", audience: "agent", risk: "Nothing checks that a signed-out visitor is refused, or that one user cannot reach another user's data. Those are the two mistakes that expose people's records, and nobody looking at the screen can see them.", fix: "Add the access tests: update @nerdsystem/sdk to the latest version, add vitest as a dev dependency with a `test` script (`vitest run`), and copy `test/setup.ts`, `test/global-setup.ts`, `test/access.test.ts`, and `vitest.config.ts` from a fresh `npx nerdsystem init` app. Then write one owner test for each route with an id in its path, set `\"tests\": \"required\"` in nerd.json, and run `nerd check`." },
+    "tests/required-missing": { title: "Access tests are missing", severity: "block", audience: "agent", risk: "This app is set to require access tests and has none, so nothing checks that a signed-out visitor is refused or that one user cannot reach another user's data.", fix: "Restore `test/access.test.ts` and the `test` script (`vitest run`) in package.json. Do not remove `\"tests\": \"required\"` from nerd.json to get past this." },
+    "tests/not-installed": { title: "Dependencies are not installed", severity: "block", audience: "agent", risk: "The tests cannot run, so nothing has been checked.", fix: "Run `pnpm install`, then `nerd check` again." },
+    "tests/failing": { title: "A test fails", severity: "block", audience: "agent", risk: "The app does not do what its tests say it should, or lets someone reach something they should not.", fix: "Run `pnpm test` and read which test failed and why. Fix the app's code. Change a test only when the behaviour it describes was meant to change, and never weaken an access test to make it pass." },
+    "tests/routes-not-checked": { title: "No test tried every route as a signed-out visitor", severity: "block", audience: "agent", risk: "A route added without a sign-in check would go live readable by anyone.", fix: "Keep the test in `test/access.test.ts` that calls `await t.expectEveryRouteLocked({ public: [...] })`. It covers every route automatically; list a route as public only when everyone on the internet is meant to reach it." },
+    "tests/owner-not-checked": { title: "A route with an id was not tried by a second user", severity: "block", audience: "agent", risk: "One signed-in user may be able to read, change, or delete another user's data by guessing its id.", fix: "Add an owner test for the route in `test/access.test.ts` using `t.expectHiddenFrom`.", example: { wrong: "// no test: nothing shows a second user is refused on /api/notes/:id", right: 'const note = await (await alice.post("/api/notes", { title: "mine" })).json();\nawait t.expectHiddenFrom(bob, "DELETE", `/api/notes/${note.note.id}`);' } },
+    "tests/harness-in-app": { title: "The test harness is imported by app code", severity: "block", audience: "agent", risk: "The test harness can sign in as anyone. In deployed code it would be a way around the login.", fix: "Remove the import of `@nerdsystem/sdk/testing` from files under `src/`. It belongs only in `test/`." },
     "typecheck/failed": { title: "Typecheck failed", severity: "block", audience: "agent", risk: "The project does not compile.", fix: "Run `npx tsc -b` and fix the errors it prints." },
     "policy/blocked-package": { title: "Package not allowed", severity: "block", audience: "agent", risk: "The package is a miner, proxy, or headless browser, which the acceptable use policy forbids and the platform cannot run.", fix: "Remove the package and the code that uses it. If the app genuinely needs a browser or scraping, say so to the person; it is not supported here." },
     "policy/mining-pool": { title: "Mining pool reference", severity: "block", audience: "human", risk: "The code references a cryptocurrency mining pool, which is forbidden by the acceptable use policy.", fix: "Remove it. If this is unexpected, inspect the file: it may have been added by a compromised dependency." },

package/dist/gates/static.d.ts

@@ -0,0 +1,2 @@
+import { type Gate } from "./types.js";
+export declare const staticGate: Gate;

package/dist/gates/static.js

@@ -0,0 +1,58 @@
+import { lineOf, sourceFiles } from "./fs.js";
+import { finding } from "./secrets.js";
+import { counts, result, verdict } from "./types.js";
+const SERVER = /^src\/server\//;
+/**
+ * The patterns semgrep's nerdsystem rules look for (packages/cli/rules/semgrep.yml), as plain text
+ * matching, so they run on every machine and every deploy without anything installed. Semgrep reads the
+ * code's structure and stays the more exact tool where it runs; these are deliberately narrow so they
+ * do not cry wolf. Three block, as the same semgrep rules do; the rest warn.
+ */
+const CHECKS = [
+    // SQL assembled from values: a template with ${} or a string joined with +, handed to prepare/exec/sql.raw.
+    { rule: "code/raw-sql", re: /(\.prepare|\.exec|sql\.raw)\(\s*(`[^`]*\$\{|["'][^"'\n]*["']\s*\+)/g },
+    { rule: "code/eval", re: /(^|[^.\w])eval\s*\(|\bnew\s+Function\s*\(/g },
+    { rule: "code/password-in-app", re: /\.password\s*={2,3}|={2,3}\s*\w+\.password\b|\b(bcrypt|bcryptjs|argon2)\.(compare|hash|verify)\w*\s*\(|from\s+["'](bcrypt|bcryptjs|argon2)["']/g, files: SERVER },
+    { rule: "code/tokens-in-app", re: /\bjwt\.(sign|verify)\s*\(|from\s+["'](jsonwebtoken|jose|hono\/jwt)["']/g, files: SERVER },
+    { rule: "code/html-from-data", re: /dangerouslySetInnerHTML\s*=\s*\{\{\s*__html\s*:(?!\s*["'][^"'\n]*["']\s*\}\})|\.innerHTML\s*\+?=(?![=])(?!\s*["'][^"'\n]*["']\s*(;|\n|$))/g },
+    { rule: "code/open-redirect", re: /\.redirect\(\s*(c\.req\.(query|param|header)\(|\(?await\s+c\.req\.)/g, files: SERVER },
+    { rule: "code/fetch-user-url", re: /\bfetch\(\s*(c\.req\.(query|param|header)\(|\(?await\s+c\.req\.)/g, files: SERVER },
+    { rule: "code/weak-random", re: /\b\w*(token|secret|nonce|otp|passcode|apikey|api_key)\w*\s*[:=][^;\n]*Math\.random\(\)/gi },
+    // An unchecked body: c.req.json() used directly instead of readBody(c, schema).
+    { rule: "code/unvalidated-body", re: /\bc\.req\.(json|parseBody|formData)\(\)/g, files: SERVER },
+];
+/** Blanks out comments, keeping every character position, so a pattern inside a comment is not a finding. */
+function withoutComments(text) {
+    return text.replace(/\/\*[\s\S]*?\*\/|(^|[^:"'`\\])\/\/[^\n]*/g, (m) => m.replace(/[^\n]/g, " "));
+}
+export const staticGate = {
+    name: "static",
+    title: "Unsafe code patterns",
+    blocking: true,
+    rulePrefixes: ["code/"],
+    async run(ctx) {
+        const t = Date.now();
+        const findings = [];
+        for (const f of sourceFiles(ctx.root)) {
+            if (!/\.(ts|tsx|js|jsx|mjs)$/.test(f.rel) || !f.rel.startsWith("src/"))
+                continue;
+            const text = withoutComments(f.text);
+            for (const c of CHECKS) {
+                if (c.files && !c.files.test(f.rel))
+                    continue;
+                c.re.lastIndex = 0;
+                let m;
+                let perFile = 0;
+                while ((m = c.re.exec(text)) && perFile < 10) {
+                    findings.push(finding(c.rule, { file: f.rel, line: lineOf(text, m.index) }));
+                    perFile++;
+                }
+            }
+            // Sign-in for every route is opt-in for apps created before it existed; say so until it is on.
+            if (f.rel === "src/server/index.ts" && /createNerdApp\s*(<[^>]*>)?\s*\(/.test(text) && !/createNerdApp\s*(<[^>]*>)?\s*\(\s*\{[\s\S]*?\bpublic\s*:/.test(text)) {
+                findings.push(finding("code/routes-open-by-default", { file: f.rel }));
+            }
+        }
+        return result(this, verdict(findings), findings.length ? counts(findings) : "Nothing unsafe found", findings, t);
+    },
+};

package/dist/gates/tests.d.ts

@@ -0,0 +1,14 @@
+import { type Gate } from "./types.js";
+/**
+ * Route names come from the app's own code, and findings are read by a coding agent, so only the
+ * characters a "METHOD /path" needs survive and the length is capped: a route cannot carry a sentence.
+ */
+export declare function safeRoute(name: unknown): string | null;
+/**
+ * Runs the app's own tests and reads what they checked about access. The person who owns the app cannot
+ * read the code, and the agent that forgot a sign-in check tends to forget the test for it too, so the
+ * gate does not trust that tests exist: the harness calls every route the app declares, and this gate
+ * refuses the deploy unless that sweep ran, every route with an id in its path was tried by a second user,
+ * and everything passed.
+ */
+export declare const testsGate: Gate;

package/dist/gates/tests.js

@@ -0,0 +1,103 @@
+import { existsSync, readdirSync, readFileSync, rmSync } from "node:fs";
+import path from "node:path";
+import { exec } from "./code.js";
+import { sourceFiles } from "./fs.js";
+import { finding } from "./secrets.js";
+import { result } from "./types.js";
+const HARNESS = "@nerdsystem/sdk/testing";
+const REPORT = ".nerd/access-report.json";
+/**
+ * Route names come from the app's own code, and findings are read by a coding agent, so only the
+ * characters a "METHOD /path" needs survive and the length is capped: a route cannot carry a sentence.
+ */
+export function safeRoute(name) {
+    if (typeof name !== "string")
+        return null;
+    const m = /^(GET|POST|PUT|PATCH|DELETE) (\/[A-Za-z0-9/:_.*-]{0,120})$/.exec(name);
+    return m ? `${m[1]} ${m[2]}` : null;
+}
+const list = (v) => (Array.isArray(v) ? v.map(safeRoute).filter((r) => r !== null) : []);
+const hasId = (route) => route.split(" ")[1].split("/").some((seg) => seg.startsWith(":"));
+function readJson(file) {
+    try {
+        return JSON.parse(readFileSync(file, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+/** True when a file under test/ uses the SDK's harness, which is what writes the access report. */
+function hasHarnessTests(root) {
+    const dir = path.join(root, "test");
+    if (!existsSync(dir))
+        return false;
+    const walk = (d) => readdirSync(d, { withFileTypes: true }).some((e) => (e.isDirectory() ? walk(path.join(d, e.name)) : /\.(ts|tsx|mts|js|mjs)$/.test(e.name) && readFileSync(path.join(d, e.name), "utf8").includes(HARNESS)));
+    return walk(dir);
+}
+/**
+ * Runs the app's own tests and reads what they checked about access. The person who owns the app cannot
+ * read the code, and the agent that forgot a sign-in check tends to forget the test for it too, so the
+ * gate does not trust that tests exist: the harness calls every route the app declares, and this gate
+ * refuses the deploy unless that sweep ran, every route with an id in its path was tried by a second user,
+ * and everything passed.
+ */
+export const testsGate = {
+    name: "tests",
+    title: "Tests and access checks",
+    blocking: true,
+    rulePrefixes: ["tests/"],
+    async run(ctx) {
+        const t = Date.now();
+        const findings = [];
+        // The harness can sign in anyone. It must never be reachable from the code that is deployed.
+        for (const f of sourceFiles(ctx.root)) {
+            if (f.rel.startsWith("src/") && f.text.includes(HARNESS))
+                findings.push(finding("tests/harness-in-app", { file: f.rel }));
+        }
+        if (findings.length)
+            return result(this, "fail", "The test harness is imported by app code", findings, t);
+        const pkg = readJson(path.join(ctx.root, "package.json"));
+        const required = readJson(path.join(ctx.root, "nerd.json"))?.tests === "required";
+        if (!pkg?.scripts?.test || !hasHarnessTests(ctx.root)) {
+            const f = finding(required ? "tests/required-missing" : "tests/missing", { file: "test/access.test.ts" });
+            return result(this, required ? "fail" : "warn", "No access tests in this app", [f], t);
+        }
+        // Git builds do not run this yet (the build container has not been proven to run the local database);
+        // the terminal path, which every `nerd deploy` takes, does.
+        if (ctx.committed)
+            return result(this, "skip", "Runs before `nerd deploy`; not yet part of git builds", [], t);
+        if (!existsSync(path.join(ctx.root, "node_modules"))) {
+            return result(this, "fail", "Dependencies are not installed", [finding("tests/not-installed", {})], t);
+        }
+        rmSync(path.join(ctx.root, REPORT), { force: true });
+        const run = await exec("npx", ["vitest", "run"], ctx.root);
+        if (run.code !== 0) {
+            const files = new Set();
+            for (const line of `${run.stdout}\n${run.stderr}`.split("\n")) {
+                const m = /FAIL\s+(test\/[A-Za-z0-9_./-]{1,120}\.test\.[a-z]{2,3})/.exec(line);
+                if (m)
+                    files.add(m[1]);
+            }
+            for (const file of [...files].slice(0, 10))
+                findings.push(finding("tests/failing", { file }));
+            if (!findings.length)
+                findings.push(finding("tests/failing", {}));
+            return result(this, "fail", `${findings.length} test file(s) failing`, findings, t, "vitest");
+        }
+        const report = readJson(path.join(ctx.root, REPORT));
+        const routes = list(report?.routes);
+        const open = list(report?.public);
+        if (!report || report.everyRouteChecked !== true) {
+            return result(this, "fail", "No test checked every route as a signed-out visitor", [finding("tests/routes-not-checked", { file: "test/access.test.ts" })], t, "vitest");
+        }
+        const covered = new Set([...list(report.ownerChecked), ...list(report.shared), ...open]);
+        for (const route of routes.filter(hasId)) {
+            if (!covered.has(route))
+                findings.push(finding("tests/owner-not-checked", { file: "test/access.test.ts", fix: `Add a test for ${route}: one user creates the thing, then \`await t.expectHiddenFrom(otherUser, "${route.split(" ")[0]}", <the path with the real id>)\`. If every signed-in user is meant to reach it, declare \`t.shared("${route}", "<why>")\` instead.`, fingerprint: `tests/owner-not-checked:${route}` }));
+        }
+        if (findings.length)
+            return result(this, "fail", `${findings.length} route(s) with an id were not tried by a second user`, findings, t, "vitest");
+        const locked = routes.length - open.length;
+        return result(this, "pass", `Tests passed; ${locked} route(s) refuse a signed-out visitor, ${open.length} public${open.length ? ` (${open.join(", ")})` : ""}`, [], t, "vitest");
+    },
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nerdsystem",
-  "version": "0.0.13",
+  "version": "0.0.15",
   "description": "nerd: start, check, and deploy a web app on nerdsystem from the terminal or a coding agent.",
   "type": "module",
   "bin": {

package/template/.claude/skills/nerdsystem/SKILL.md

@@ -33,8 +33,8 @@ Tell the person plainly what does not carry. Their users sign up again on the ne
 
 ## The loop
 
-1. Make the change.
-2. `nerd check` (static rules, then typecheck). Fix anything it reports.
+1. Make the change, and write or update its tests in the same step (see "Build it so it is safe and it works").
+2. `nerd check` (static rules, typecheck, then the tests and access checks). Fix anything it reports.
 3. `nerd dev` to run locally when you need to try it. The local app talks to the real auth service, so signup and login work exactly as in production.
 4. `nerd deploy` when it is ready. It runs the checks, builds, stores a copy of the code, applies pending migrations, uploads, prints the URL, and probes the live URL (headers and the sign-in routes). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
@@ -95,6 +95,37 @@ export default notes;
 
 Then in `src/server/index.ts`: `app.route("/api/notes", notes);`
 
+## Build it so it is safe and it works
+
+The person you are building for usually cannot read code. They will not spot a missing sign-in check or a query that returns someone else's rows, and neither will anyone looking at the screen. So the standard is yours to hold, every time, without being asked:
+
+1. **Every route is locked unless you open it.** `createNerdApp({ public: [...] })` in `src/server/index.ts` makes every route require a signed-in user except the ones named in that list, so a route you forget to protect answers 401 instead of answering everyone. Still put `requireAuth()` on each router (`router.use("*", requireAuth())`) and `requireRole(...)` where a role is needed: it says what the route expects and gives TypeScript a user. A route is public only when everyone on the internet is meant to reach it and it returns nothing private; then add it to the `public` list in `src/server/index.ts` and to the same list in `test/access.test.ts`, and tell the person in plain words that it is open. Never remove the `public` option or widen it to get something working.
+2. **Scope every query to the signed-in user.** Reads, updates, and deletes on user data filter on `c.var.user.id`. On a route with an id in its path, put the id and the user id in the same `where`, and answer 404 when nothing matches, so someone else's row looks like it does not exist.
+3. **Take identity from the session, never from the request.** The user id, the role, a price, an owner: none of these come from the body, the query string, or a header the browser sends. Read the user from `c.var.user` and look the rest up on the server.
+4. **Check every input on the server.** Read a body with `readBody(c, schema)` and a query string with `readQuery(c, schema)` from `@nerdsystem/sdk`, with a zod schema that gives every field a type, a length, a range, or a list of allowed values (see `src/server/routes/todos.ts`). They answer 400 in the usual error shape for anything else, before your code runs. Do not call `c.req.json()` directly; `nerd check` flags it. Path parameters get the same care: turn an id into a number and let a missing row be a 404. The client's own checks are for the person's convenience; they protect nothing.
+5. **Hiding a button is not access control.** If only admins may do something, the route says `requireRole("admin")`. What the page shows is decoration.
+6. **Files:** check the type and the size before writing to `c.env.STORAGE`, store under a key that starts with the owner's user id, and serve them through a route that checks the owner. Never build a key from a name the browser sent without cleaning it.
+7. **Say nothing useful in an error.** No stack traces, SQL, or internal ids in responses; log them with `console.error` and answer with `{ error: { code, message } }`.
+8. **No raw HTML from data.** Let React render text. Do not use `dangerouslySetInnerHTML` or `innerHTML` with anything a user typed.
+
+### Tests are part of the feature
+
+The project ships with a test harness (`test/setup.ts`, from `@nerdsystem/sdk/testing`) that runs the real server code against a fresh local database and signs in made-up users. `pnpm test` runs it; `nerd check` and `nerd deploy` run it too and refuse the deploy when:
+
+- a test fails (`tests/failing`);
+- the test that calls `t.expectEveryRouteLocked({ public: [...] })` is gone (`tests/routes-not-checked`). That one call tries every route the app has as a signed-out visitor, so a new route is covered the moment it exists and fails until it is locked or deliberately listed as public;
+- a route with an id in its path has not been tried by a second user (`tests/owner-not-checked`).
+
+For every feature you build:
+
+- **One owner test per route with an id**, in `test/access.test.ts`: one user creates the thing, then `await t.expectHiddenFrom(otherUser, "PATCH", `/api/things/${id}`, body)` for each method. For lists, `await t.expectNotListed(otherUser, "/api/things", "a title only the owner has")`. If every signed-in user is truly meant to reach it (a shared catalogue, a public profile), declare `t.shared("GET /api/things/:id", "why")` instead and tell the person.
+- **One test file per feature** (`test/<feature>.test.ts`, like `test/todos.test.ts`): the main path a person takes from start to finish, and the inputs it must refuse.
+- **A role test** for anything behind `requireRole`: a signed-in user without the role gets 403, one with it gets through (`await t.as("dana", { roles: ["admin"] })`).
+
+When a test fails, fix the app. Change a test only when the behaviour it describes was meant to change. Never delete or weaken an access test, widen the `public` list, add `t.shared`, or remove `"tests": "required"` from `nerd.json` to get a deploy through; if you believe one of those is right, stop and ask the person in plain words first. Never import `@nerdsystem/sdk/testing` from anything under `src/`: it can sign in as anyone, and `nerd check` refuses it.
+
+What the tests do not prove: that the feature is the one the person wanted, or that its rules (who may book which slot, what a discount applies to) are right. Say what you built and what is public when you hand it over, so they can tell you if it is wrong.
+
 ## Data rules
 
 - Every table holding user data has a `user_id` text column, and every read and write filters on `c.var.user.id`. This is how users are kept apart.
@@ -130,6 +161,8 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 - New bindings in `wrangler.jsonc`. Only `DB`, `STORAGE`, and `ASSETS` exist. Durable Objects are not available.
 - Scripts that call `wrangler deploy`, `wrangler secret`, or remote `wrangler d1` commands.
 - Typecheck failures in either `src/server` or `src/client`.
+- SQL built from values, `eval` or `new Function`, and password handling in server code (the `code/` rules; they block). It also flags, without blocking: tokens signed in app code, HTML built from data, redirects and fetches to an address from the request, `Math.random` for a secret, a body read without `readBody`, and an app that has not turned on `public` in `createNerdApp`.
+- A failing test, a missing access sweep, or a route with an id that no second user was tried against (the `tests/` rules above).
 
 ## Scheduled jobs and email
 

package/template/.cursor/rules/nerdsystem.mdc

@@ -2,7 +2,7 @@
 description: How to build, run, and deploy this app on nerdsystem. Applies to server, database, auth, and deploy work.
 alwaysApply: true
 ---
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (497090779572); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (f851c99006a8); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -34,8 +34,8 @@ Tell the person plainly what does not carry. Their users sign up again on the ne
 
 ## The loop
 
-1. Make the change.
-2. `nerd check` (static rules, then typecheck). Fix anything it reports.
+1. Make the change, and write or update its tests in the same step (see "Build it so it is safe and it works").
+2. `nerd check` (static rules, typecheck, then the tests and access checks). Fix anything it reports.
 3. `nerd dev` to run locally when you need to try it. The local app talks to the real auth service, so signup and login work exactly as in production.
 4. `nerd deploy` when it is ready. It runs the checks, builds, stores a copy of the code, applies pending migrations, uploads, prints the URL, and probes the live URL (headers and the sign-in routes). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
@@ -96,6 +96,37 @@ export default notes;
 
 Then in `src/server/index.ts`: `app.route("/api/notes", notes);`
 
+## Build it so it is safe and it works
+
+The person you are building for usually cannot read code. They will not spot a missing sign-in check or a query that returns someone else's rows, and neither will anyone looking at the screen. So the standard is yours to hold, every time, without being asked:
+
+1. **Every route is locked unless you open it.** `createNerdApp({ public: [...] })` in `src/server/index.ts` makes every route require a signed-in user except the ones named in that list, so a route you forget to protect answers 401 instead of answering everyone. Still put `requireAuth()` on each router (`router.use("*", requireAuth())`) and `requireRole(...)` where a role is needed: it says what the route expects and gives TypeScript a user. A route is public only when everyone on the internet is meant to reach it and it returns nothing private; then add it to the `public` list in `src/server/index.ts` and to the same list in `test/access.test.ts`, and tell the person in plain words that it is open. Never remove the `public` option or widen it to get something working.
+2. **Scope every query to the signed-in user.** Reads, updates, and deletes on user data filter on `c.var.user.id`. On a route with an id in its path, put the id and the user id in the same `where`, and answer 404 when nothing matches, so someone else's row looks like it does not exist.
+3. **Take identity from the session, never from the request.** The user id, the role, a price, an owner: none of these come from the body, the query string, or a header the browser sends. Read the user from `c.var.user` and look the rest up on the server.
+4. **Check every input on the server.** Read a body with `readBody(c, schema)` and a query string with `readQuery(c, schema)` from `@nerdsystem/sdk`, with a zod schema that gives every field a type, a length, a range, or a list of allowed values (see `src/server/routes/todos.ts`). They answer 400 in the usual error shape for anything else, before your code runs. Do not call `c.req.json()` directly; `nerd check` flags it. Path parameters get the same care: turn an id into a number and let a missing row be a 404. The client's own checks are for the person's convenience; they protect nothing.
+5. **Hiding a button is not access control.** If only admins may do something, the route says `requireRole("admin")`. What the page shows is decoration.
+6. **Files:** check the type and the size before writing to `c.env.STORAGE`, store under a key that starts with the owner's user id, and serve them through a route that checks the owner. Never build a key from a name the browser sent without cleaning it.
+7. **Say nothing useful in an error.** No stack traces, SQL, or internal ids in responses; log them with `console.error` and answer with `{ error: { code, message } }`.
+8. **No raw HTML from data.** Let React render text. Do not use `dangerouslySetInnerHTML` or `innerHTML` with anything a user typed.
+
+### Tests are part of the feature
+
+The project ships with a test harness (`test/setup.ts`, from `@nerdsystem/sdk/testing`) that runs the real server code against a fresh local database and signs in made-up users. `pnpm test` runs it; `nerd check` and `nerd deploy` run it too and refuse the deploy when:
+
+- a test fails (`tests/failing`);
+- the test that calls `t.expectEveryRouteLocked({ public: [...] })` is gone (`tests/routes-not-checked`). That one call tries every route the app has as a signed-out visitor, so a new route is covered the moment it exists and fails until it is locked or deliberately listed as public;
+- a route with an id in its path has not been tried by a second user (`tests/owner-not-checked`).
+
+For every feature you build:
+
+- **One owner test per route with an id**, in `test/access.test.ts`: one user creates the thing, then `await t.expectHiddenFrom(otherUser, "PATCH", `/api/things/${id}`, body)` for each method. For lists, `await t.expectNotListed(otherUser, "/api/things", "a title only the owner has")`. If every signed-in user is truly meant to reach it (a shared catalogue, a public profile), declare `t.shared("GET /api/things/:id", "why")` instead and tell the person.
+- **One test file per feature** (`test/<feature>.test.ts`, like `test/todos.test.ts`): the main path a person takes from start to finish, and the inputs it must refuse.
+- **A role test** for anything behind `requireRole`: a signed-in user without the role gets 403, one with it gets through (`await t.as("dana", { roles: ["admin"] })`).
+
+When a test fails, fix the app. Change a test only when the behaviour it describes was meant to change. Never delete or weaken an access test, widen the `public` list, add `t.shared`, or remove `"tests": "required"` from `nerd.json` to get a deploy through; if you believe one of those is right, stop and ask the person in plain words first. Never import `@nerdsystem/sdk/testing` from anything under `src/`: it can sign in as anyone, and `nerd check` refuses it.
+
+What the tests do not prove: that the feature is the one the person wanted, or that its rules (who may book which slot, what a discount applies to) are right. Say what you built and what is public when you hand it over, so they can tell you if it is wrong.
+
 ## Data rules
 
 - Every table holding user data has a `user_id` text column, and every read and write filters on `c.var.user.id`. This is how users are kept apart.
@@ -131,6 +162,8 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 - New bindings in `wrangler.jsonc`. Only `DB`, `STORAGE`, and `ASSETS` exist. Durable Objects are not available.
 - Scripts that call `wrangler deploy`, `wrangler secret`, or remote `wrangler d1` commands.
 - Typecheck failures in either `src/server` or `src/client`.
+- SQL built from values, `eval` or `new Function`, and password handling in server code (the `code/` rules; they block). It also flags, without blocking: tokens signed in app code, HTML built from data, redirects and fetches to an address from the request, `Math.random` for a secret, a body read without `readBody`, and an app that has not turned on `public` in `createNerdApp`.
+- A failing test, a missing access sweep, or a route with an id that no second user was tried against (the `tests/` rules above).
 
 ## Scheduled jobs and email
 

package/template/.github/copilot-instructions.md

@@ -1,4 +1,4 @@
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (497090779572); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (f851c99006a8); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -30,8 +30,8 @@ Tell the person plainly what does not carry. Their users sign up again on the ne
 
 ## The loop
 
-1. Make the change.
-2. `nerd check` (static rules, then typecheck). Fix anything it reports.
+1. Make the change, and write or update its tests in the same step (see "Build it so it is safe and it works").
+2. `nerd check` (static rules, typecheck, then the tests and access checks). Fix anything it reports.
 3. `nerd dev` to run locally when you need to try it. The local app talks to the real auth service, so signup and login work exactly as in production.
 4. `nerd deploy` when it is ready. It runs the checks, builds, stores a copy of the code, applies pending migrations, uploads, prints the URL, and probes the live URL (headers and the sign-in routes). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
@@ -92,6 +92,37 @@ export default notes;
 
 Then in `src/server/index.ts`: `app.route("/api/notes", notes);`
 
+## Build it so it is safe and it works
+
+The person you are building for usually cannot read code. They will not spot a missing sign-in check or a query that returns someone else's rows, and neither will anyone looking at the screen. So the standard is yours to hold, every time, without being asked:
+
+1. **Every route is locked unless you open it.** `createNerdApp({ public: [...] })` in `src/server/index.ts` makes every route require a signed-in user except the ones named in that list, so a route you forget to protect answers 401 instead of answering everyone. Still put `requireAuth()` on each router (`router.use("*", requireAuth())`) and `requireRole(...)` where a role is needed: it says what the route expects and gives TypeScript a user. A route is public only when everyone on the internet is meant to reach it and it returns nothing private; then add it to the `public` list in `src/server/index.ts` and to the same list in `test/access.test.ts`, and tell the person in plain words that it is open. Never remove the `public` option or widen it to get something working.
+2. **Scope every query to the signed-in user.** Reads, updates, and deletes on user data filter on `c.var.user.id`. On a route with an id in its path, put the id and the user id in the same `where`, and answer 404 when nothing matches, so someone else's row looks like it does not exist.
+3. **Take identity from the session, never from the request.** The user id, the role, a price, an owner: none of these come from the body, the query string, or a header the browser sends. Read the user from `c.var.user` and look the rest up on the server.
+4. **Check every input on the server.** Read a body with `readBody(c, schema)` and a query string with `readQuery(c, schema)` from `@nerdsystem/sdk`, with a zod schema that gives every field a type, a length, a range, or a list of allowed values (see `src/server/routes/todos.ts`). They answer 400 in the usual error shape for anything else, before your code runs. Do not call `c.req.json()` directly; `nerd check` flags it. Path parameters get the same care: turn an id into a number and let a missing row be a 404. The client's own checks are for the person's convenience; they protect nothing.
+5. **Hiding a button is not access control.** If only admins may do something, the route says `requireRole("admin")`. What the page shows is decoration.
+6. **Files:** check the type and the size before writing to `c.env.STORAGE`, store under a key that starts with the owner's user id, and serve them through a route that checks the owner. Never build a key from a name the browser sent without cleaning it.
+7. **Say nothing useful in an error.** No stack traces, SQL, or internal ids in responses; log them with `console.error` and answer with `{ error: { code, message } }`.
+8. **No raw HTML from data.** Let React render text. Do not use `dangerouslySetInnerHTML` or `innerHTML` with anything a user typed.
+
+### Tests are part of the feature
+
+The project ships with a test harness (`test/setup.ts`, from `@nerdsystem/sdk/testing`) that runs the real server code against a fresh local database and signs in made-up users. `pnpm test` runs it; `nerd check` and `nerd deploy` run it too and refuse the deploy when:
+
+- a test fails (`tests/failing`);
+- the test that calls `t.expectEveryRouteLocked({ public: [...] })` is gone (`tests/routes-not-checked`). That one call tries every route the app has as a signed-out visitor, so a new route is covered the moment it exists and fails until it is locked or deliberately listed as public;
+- a route with an id in its path has not been tried by a second user (`tests/owner-not-checked`).
+
+For every feature you build:
+
+- **One owner test per route with an id**, in `test/access.test.ts`: one user creates the thing, then `await t.expectHiddenFrom(otherUser, "PATCH", `/api/things/${id}`, body)` for each method. For lists, `await t.expectNotListed(otherUser, "/api/things", "a title only the owner has")`. If every signed-in user is truly meant to reach it (a shared catalogue, a public profile), declare `t.shared("GET /api/things/:id", "why")` instead and tell the person.
+- **One test file per feature** (`test/<feature>.test.ts`, like `test/todos.test.ts`): the main path a person takes from start to finish, and the inputs it must refuse.
+- **A role test** for anything behind `requireRole`: a signed-in user without the role gets 403, one with it gets through (`await t.as("dana", { roles: ["admin"] })`).
+
+When a test fails, fix the app. Change a test only when the behaviour it describes was meant to change. Never delete or weaken an access test, widen the `public` list, add `t.shared`, or remove `"tests": "required"` from `nerd.json` to get a deploy through; if you believe one of those is right, stop and ask the person in plain words first. Never import `@nerdsystem/sdk/testing` from anything under `src/`: it can sign in as anyone, and `nerd check` refuses it.
+
+What the tests do not prove: that the feature is the one the person wanted, or that its rules (who may book which slot, what a discount applies to) are right. Say what you built and what is public when you hand it over, so they can tell you if it is wrong.
+
 ## Data rules
 
 - Every table holding user data has a `user_id` text column, and every read and write filters on `c.var.user.id`. This is how users are kept apart.
@@ -127,6 +158,8 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 - New bindings in `wrangler.jsonc`. Only `DB`, `STORAGE`, and `ASSETS` exist. Durable Objects are not available.
 - Scripts that call `wrangler deploy`, `wrangler secret`, or remote `wrangler d1` commands.
 - Typecheck failures in either `src/server` or `src/client`.
+- SQL built from values, `eval` or `new Function`, and password handling in server code (the `code/` rules; they block). It also flags, without blocking: tokens signed in app code, HTML built from data, redirects and fetches to an address from the request, `Math.random` for a secret, a body read without `readBody`, and an app that has not turned on `public` in `createNerdApp`.
+- A failing test, a missing access sweep, or a route with an id that no second user was tried against (the `tests/` rules above).
 
 ## Scheduled jobs and email
 

package/template/.nerd/access-report.json

@@ -0,0 +1,29 @@
+{
+  "version": 1,
+  "routes": [
+    "DELETE /api/todos/:id",
+    "GET /api/admin/ping",
+    "GET /api/health",
+    "GET /api/todos",
+    "PATCH /api/todos/:id",
+    "POST /api/cron",
+    "POST /api/todos"
+  ],
+  "locked": [
+    "DELETE /api/todos/:id",
+    "GET /api/admin/ping",
+    "GET /api/todos",
+    "PATCH /api/todos/:id",
+    "POST /api/cron",
+    "POST /api/todos"
+  ],
+  "public": [
+    "GET /api/health"
+  ],
+  "ownerChecked": [
+    "DELETE /api/todos/:id",
+    "PATCH /api/todos/:id"
+  ],
+  "shared": [],
+  "everyRouteChecked": true
+}

package/template/AGENTS.md

@@ -1,4 +1,4 @@
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (497090779572); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (f851c99006a8); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -30,8 +30,8 @@ Tell the person plainly what does not carry. Their users sign up again on the ne
 
 ## The loop
 
-1. Make the change.
-2. `nerd check` (static rules, then typecheck). Fix anything it reports.
+1. Make the change, and write or update its tests in the same step (see "Build it so it is safe and it works").
+2. `nerd check` (static rules, typecheck, then the tests and access checks). Fix anything it reports.
 3. `nerd dev` to run locally when you need to try it. The local app talks to the real auth service, so signup and login work exactly as in production.
 4. `nerd deploy` when it is ready. It runs the checks, builds, stores a copy of the code, applies pending migrations, uploads, prints the URL, and probes the live URL (headers and the sign-in routes). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
@@ -92,6 +92,37 @@ export default notes;
 
 Then in `src/server/index.ts`: `app.route("/api/notes", notes);`
 
+## Build it so it is safe and it works
+
+The person you are building for usually cannot read code. They will not spot a missing sign-in check or a query that returns someone else's rows, and neither will anyone looking at the screen. So the standard is yours to hold, every time, without being asked:
+
+1. **Every route is locked unless you open it.** `createNerdApp({ public: [...] })` in `src/server/index.ts` makes every route require a signed-in user except the ones named in that list, so a route you forget to protect answers 401 instead of answering everyone. Still put `requireAuth()` on each router (`router.use("*", requireAuth())`) and `requireRole(...)` where a role is needed: it says what the route expects and gives TypeScript a user. A route is public only when everyone on the internet is meant to reach it and it returns nothing private; then add it to the `public` list in `src/server/index.ts` and to the same list in `test/access.test.ts`, and tell the person in plain words that it is open. Never remove the `public` option or widen it to get something working.
+2. **Scope every query to the signed-in user.** Reads, updates, and deletes on user data filter on `c.var.user.id`. On a route with an id in its path, put the id and the user id in the same `where`, and answer 404 when nothing matches, so someone else's row looks like it does not exist.
+3. **Take identity from the session, never from the request.** The user id, the role, a price, an owner: none of these come from the body, the query string, or a header the browser sends. Read the user from `c.var.user` and look the rest up on the server.
+4. **Check every input on the server.** Read a body with `readBody(c, schema)` and a query string with `readQuery(c, schema)` from `@nerdsystem/sdk`, with a zod schema that gives every field a type, a length, a range, or a list of allowed values (see `src/server/routes/todos.ts`). They answer 400 in the usual error shape for anything else, before your code runs. Do not call `c.req.json()` directly; `nerd check` flags it. Path parameters get the same care: turn an id into a number and let a missing row be a 404. The client's own checks are for the person's convenience; they protect nothing.
+5. **Hiding a button is not access control.** If only admins may do something, the route says `requireRole("admin")`. What the page shows is decoration.
+6. **Files:** check the type and the size before writing to `c.env.STORAGE`, store under a key that starts with the owner's user id, and serve them through a route that checks the owner. Never build a key from a name the browser sent without cleaning it.
+7. **Say nothing useful in an error.** No stack traces, SQL, or internal ids in responses; log them with `console.error` and answer with `{ error: { code, message } }`.
+8. **No raw HTML from data.** Let React render text. Do not use `dangerouslySetInnerHTML` or `innerHTML` with anything a user typed.
+
+### Tests are part of the feature
+
+The project ships with a test harness (`test/setup.ts`, from `@nerdsystem/sdk/testing`) that runs the real server code against a fresh local database and signs in made-up users. `pnpm test` runs it; `nerd check` and `nerd deploy` run it too and refuse the deploy when:
+
+- a test fails (`tests/failing`);
+- the test that calls `t.expectEveryRouteLocked({ public: [...] })` is gone (`tests/routes-not-checked`). That one call tries every route the app has as a signed-out visitor, so a new route is covered the moment it exists and fails until it is locked or deliberately listed as public;
+- a route with an id in its path has not been tried by a second user (`tests/owner-not-checked`).
+
+For every feature you build:
+
+- **One owner test per route with an id**, in `test/access.test.ts`: one user creates the thing, then `await t.expectHiddenFrom(otherUser, "PATCH", `/api/things/${id}`, body)` for each method. For lists, `await t.expectNotListed(otherUser, "/api/things", "a title only the owner has")`. If every signed-in user is truly meant to reach it (a shared catalogue, a public profile), declare `t.shared("GET /api/things/:id", "why")` instead and tell the person.
+- **One test file per feature** (`test/<feature>.test.ts`, like `test/todos.test.ts`): the main path a person takes from start to finish, and the inputs it must refuse.
+- **A role test** for anything behind `requireRole`: a signed-in user without the role gets 403, one with it gets through (`await t.as("dana", { roles: ["admin"] })`).
+
+When a test fails, fix the app. Change a test only when the behaviour it describes was meant to change. Never delete or weaken an access test, widen the `public` list, add `t.shared`, or remove `"tests": "required"` from `nerd.json` to get a deploy through; if you believe one of those is right, stop and ask the person in plain words first. Never import `@nerdsystem/sdk/testing` from anything under `src/`: it can sign in as anyone, and `nerd check` refuses it.
+
+What the tests do not prove: that the feature is the one the person wanted, or that its rules (who may book which slot, what a discount applies to) are right. Say what you built and what is public when you hand it over, so they can tell you if it is wrong.
+
 ## Data rules
 
 - Every table holding user data has a `user_id` text column, and every read and write filters on `c.var.user.id`. This is how users are kept apart.
@@ -127,6 +158,8 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 - New bindings in `wrangler.jsonc`. Only `DB`, `STORAGE`, and `ASSETS` exist. Durable Objects are not available.
 - Scripts that call `wrangler deploy`, `wrangler secret`, or remote `wrangler d1` commands.
 - Typecheck failures in either `src/server` or `src/client`.
+- SQL built from values, `eval` or `new Function`, and password handling in server code (the `code/` rules; they block). It also flags, without blocking: tokens signed in app code, HTML built from data, redirects and fetches to an address from the request, `Math.random` for a secret, a body read without `readBody`, and an app that has not turned on `public` in `createNerdApp`.
+- A failing test, a missing access sweep, or a route with an id that no second user was tried against (the `tests/` rules above).
 
 ## Scheduled jobs and email
 

package/template/CLAUDE.md

@@ -5,7 +5,8 @@ nerdsystem deploys this app to Cloudflare and provides authentication and author
 ## Commands
 
 - `nerd dev` starts the app locally with a real session flow against the platform auth service.
-- `nerd check` typechecks both sides and verifies the platform rules below. Run it before `nerd deploy`.
+- `nerd check` typechecks both sides, verifies the platform rules below, and runs the tests in `test/`. Run it before `nerd deploy`.
+- `pnpm test` runs the tests alone: the real server code against a fresh local database, with made-up signed-in users.
 - `nerd deploy` builds, stores a copy of the code, applies pending migrations to the production database, and ships the app. Prints the URL.
 - `nerd save` keeps a copy of the code on nerdsystem without deploying; `nerd pull <org>/<project>` restores it on another computer.
 - `nerd db query "select ..."` runs SQL against the production database. `nerd deployments` lists recent deploys.
@@ -27,6 +28,8 @@ nerdsystem deploys this app to Cloudflare and provides authentication and author
 5. Keep every API route under `/api/`. Other paths are served from static assets and never reach the Worker.
 6. Do not add Cloudflare bindings to `wrangler.jsonc`, and do not run `wrangler deploy`. Bindings are provisioned by the platform.
 7. Secrets and environment variables for the deployed app are managed with `nerd` commands, never committed.
+8. Every route requires a signed-in user unless it is named in `createNerdApp({ public: [...] })` and in the same list in `test/access.test.ts`, and every route with an id in its path has a test showing a second user cannot reach it. Write the tests with the feature. `nerd check` refuses a deploy when they fail or are missing; never weaken one to get through.
+9. Read request bodies with `readBody(c, schema)` and a zod schema, never `c.req.json()` directly.
 
 ## Roles
 

package/template/GEMINI.md

@@ -1,4 +1,4 @@
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (497090779572); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (f851c99006a8); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -30,8 +30,8 @@ Tell the person plainly what does not carry. Their users sign up again on the ne
 
 ## The loop
 
-1. Make the change.
-2. `nerd check` (static rules, then typecheck). Fix anything it reports.
+1. Make the change, and write or update its tests in the same step (see "Build it so it is safe and it works").
+2. `nerd check` (static rules, typecheck, then the tests and access checks). Fix anything it reports.
 3. `nerd dev` to run locally when you need to try it. The local app talks to the real auth service, so signup and login work exactly as in production.
 4. `nerd deploy` when it is ready. It runs the checks, builds, stores a copy of the code, applies pending migrations, uploads, prints the URL, and probes the live URL (headers and the sign-in routes). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
@@ -92,6 +92,37 @@ export default notes;
 
 Then in `src/server/index.ts`: `app.route("/api/notes", notes);`
 
+## Build it so it is safe and it works
+
+The person you are building for usually cannot read code. They will not spot a missing sign-in check or a query that returns someone else's rows, and neither will anyone looking at the screen. So the standard is yours to hold, every time, without being asked:
+
+1. **Every route is locked unless you open it.** `createNerdApp({ public: [...] })` in `src/server/index.ts` makes every route require a signed-in user except the ones named in that list, so a route you forget to protect answers 401 instead of answering everyone. Still put `requireAuth()` on each router (`router.use("*", requireAuth())`) and `requireRole(...)` where a role is needed: it says what the route expects and gives TypeScript a user. A route is public only when everyone on the internet is meant to reach it and it returns nothing private; then add it to the `public` list in `src/server/index.ts` and to the same list in `test/access.test.ts`, and tell the person in plain words that it is open. Never remove the `public` option or widen it to get something working.
+2. **Scope every query to the signed-in user.** Reads, updates, and deletes on user data filter on `c.var.user.id`. On a route with an id in its path, put the id and the user id in the same `where`, and answer 404 when nothing matches, so someone else's row looks like it does not exist.
+3. **Take identity from the session, never from the request.** The user id, the role, a price, an owner: none of these come from the body, the query string, or a header the browser sends. Read the user from `c.var.user` and look the rest up on the server.
+4. **Check every input on the server.** Read a body with `readBody(c, schema)` and a query string with `readQuery(c, schema)` from `@nerdsystem/sdk`, with a zod schema that gives every field a type, a length, a range, or a list of allowed values (see `src/server/routes/todos.ts`). They answer 400 in the usual error shape for anything else, before your code runs. Do not call `c.req.json()` directly; `nerd check` flags it. Path parameters get the same care: turn an id into a number and let a missing row be a 404. The client's own checks are for the person's convenience; they protect nothing.
+5. **Hiding a button is not access control.** If only admins may do something, the route says `requireRole("admin")`. What the page shows is decoration.
+6. **Files:** check the type and the size before writing to `c.env.STORAGE`, store under a key that starts with the owner's user id, and serve them through a route that checks the owner. Never build a key from a name the browser sent without cleaning it.
+7. **Say nothing useful in an error.** No stack traces, SQL, or internal ids in responses; log them with `console.error` and answer with `{ error: { code, message } }`.
+8. **No raw HTML from data.** Let React render text. Do not use `dangerouslySetInnerHTML` or `innerHTML` with anything a user typed.
+
+### Tests are part of the feature
+
+The project ships with a test harness (`test/setup.ts`, from `@nerdsystem/sdk/testing`) that runs the real server code against a fresh local database and signs in made-up users. `pnpm test` runs it; `nerd check` and `nerd deploy` run it too and refuse the deploy when:
+
+- a test fails (`tests/failing`);
+- the test that calls `t.expectEveryRouteLocked({ public: [...] })` is gone (`tests/routes-not-checked`). That one call tries every route the app has as a signed-out visitor, so a new route is covered the moment it exists and fails until it is locked or deliberately listed as public;
+- a route with an id in its path has not been tried by a second user (`tests/owner-not-checked`).
+
+For every feature you build:
+
+- **One owner test per route with an id**, in `test/access.test.ts`: one user creates the thing, then `await t.expectHiddenFrom(otherUser, "PATCH", `/api/things/${id}`, body)` for each method. For lists, `await t.expectNotListed(otherUser, "/api/things", "a title only the owner has")`. If every signed-in user is truly meant to reach it (a shared catalogue, a public profile), declare `t.shared("GET /api/things/:id", "why")` instead and tell the person.
+- **One test file per feature** (`test/<feature>.test.ts`, like `test/todos.test.ts`): the main path a person takes from start to finish, and the inputs it must refuse.
+- **A role test** for anything behind `requireRole`: a signed-in user without the role gets 403, one with it gets through (`await t.as("dana", { roles: ["admin"] })`).
+
+When a test fails, fix the app. Change a test only when the behaviour it describes was meant to change. Never delete or weaken an access test, widen the `public` list, add `t.shared`, or remove `"tests": "required"` from `nerd.json` to get a deploy through; if you believe one of those is right, stop and ask the person in plain words first. Never import `@nerdsystem/sdk/testing` from anything under `src/`: it can sign in as anyone, and `nerd check` refuses it.
+
+What the tests do not prove: that the feature is the one the person wanted, or that its rules (who may book which slot, what a discount applies to) are right. Say what you built and what is public when you hand it over, so they can tell you if it is wrong.
+
 ## Data rules
 
 - Every table holding user data has a `user_id` text column, and every read and write filters on `c.var.user.id`. This is how users are kept apart.
@@ -127,6 +158,8 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 - New bindings in `wrangler.jsonc`. Only `DB`, `STORAGE`, and `ASSETS` exist. Durable Objects are not available.
 - Scripts that call `wrangler deploy`, `wrangler secret`, or remote `wrangler d1` commands.
 - Typecheck failures in either `src/server` or `src/client`.
+- SQL built from values, `eval` or `new Function`, and password handling in server code (the `code/` rules; they block). It also flags, without blocking: tokens signed in app code, HTML built from data, redirects and fetches to an address from the request, `Math.random` for a secret, a body read without `readBody`, and an app that has not turned on `public` in `createNerdApp`.
+- A failing test, a missing access sweep, or a route with an id that no second user was tried against (the `tests/` rules above).
 
 ## Scheduled jobs and email
 

package/template/migrations/meta/0000_snapshot.json

@@ -0,0 +1,64 @@
+{
+  "version": "6",
+  "dialect": "sqlite",
+  "id": "a804e9fb-b416-462b-a3e2-0349c283a4b7",
+  "prevId": "00000000-0000-0000-0000-000000000000",
+  "tables": {
+    "todos": {
+      "name": "todos",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "integer",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "done": {
+          "name": "done",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    }
+  },
+  "views": {},
+  "enums": {},
+  "_meta": {
+    "schemas": {},
+    "tables": {},
+    "columns": {}
+  },
+  "internal": {
+    "indexes": {}
+  }
+}

package/template/migrations/meta/_journal.json

@@ -0,0 +1,13 @@
+{
+  "version": "7",
+  "dialect": "sqlite",
+  "entries": [
+    {
+      "idx": 0,
+      "version": "6",
+      "when": 1794323561793,
+      "tag": "0000_init",
+      "breakpoints": true
+    }
+  ]
+}

package/template/nerd.json

@@ -1,5 +1,6 @@
 {
   "$schema": "https://nerdsystem.com/schemas/nerd.json",
   "org": "",
-  "project": ""
+  "project": "",
+  "tests": "required"
 }

package/template/package.json

@@ -7,6 +7,7 @@
     "dev": "nerd dev",
     "build": "vite build",
     "check": "nerd check",
+    "test": "vitest run",
     "deploy": "nerd deploy",
     "typecheck": "tsc -p tsconfig.worker.json --noEmit && tsc -p tsconfig.client.json --noEmit",
     "db:generate": "drizzle-kit generate",
@@ -17,7 +18,8 @@
     "drizzle-orm": "^0.45.4",
     "hono": "^4.13.16",
     "react": "^19.3.1",
-    "react-dom": "^19.3.1"
+    "react-dom": "^19.3.1",
+    "zod": "^4.6.7"
   },
   "pnpm": {
     "onlyBuiltDependencies": [
@@ -34,6 +36,7 @@
     "drizzle-kit": "^0.31.11",
     "typescript": "^5.9.3",
     "vite": "^8.3.5",
+    "vitest": "^4.1.0",
     "wrangler": "^4.156.2"
   }
 }

package/template/src/server/index.ts

@@ -3,7 +3,11 @@ import todos from "./routes/todos";
 
 // createNerdApp gives you a Hono app with sessions at /api/auth and c.var.user on every request.
 // Static assets (the React client) are served by the platform for every path outside /api.
-const app = createNerdApp();
+//
+// Every route needs a signed-in user unless it is named in `public`. A route you forget to protect
+// answers 401, not everyone. Add a route here only when the whole internet is meant to reach it and it
+// returns nothing private, and add it to the same list in test/access.test.ts.
+const app = createNerdApp({ public: ["GET /api/health"] });
 
 app.get("/api/health", (c) => c.json({ ok: true, user: c.var.user?.email ?? null }));
 

package/template/src/server/routes/todos.ts

@@ -1,8 +1,13 @@
 import { Hono } from "hono";
 import { and, desc, eq } from "drizzle-orm";
-import { requireAuth, type NerdHonoEnv } from "@nerdsystem/sdk";
+import { z } from "zod";
+import { readBody, requireAuth, type NerdHonoEnv } from "@nerdsystem/sdk";
 import { db, schema } from "../db";
 
+// What each request may contain. readBody() answers 400 for anything else, before the route runs.
+const NewTodo = z.object({ title: z.string().trim().min(1, "title is required").max(200) });
+const TodoChange = z.object({ done: z.boolean() });
+
 // Every route here needs a signed-in user. c.var.user is set by the SDK.
 const todos = new Hono<NerdHonoEnv>();
 todos.use("*", requireAuth());
@@ -18,13 +23,10 @@ todos.get("/", async (c) => {
 });
 
 todos.post("/", async (c) => {
-  const body = (await c.req.json().catch(() => ({}))) as { title?: unknown };
-  if (typeof body.title !== "string" || !body.title.trim()) {
-    return c.json({ error: { code: "bad_request", message: "title is required" } }, 400);
-  }
+  const input = await readBody(c, NewTodo);
   const row = await db(c.env.DB)
     .insert(schema.todos)
-    .values({ userId: c.var.user!.id, title: body.title.trim() })
+    .values({ userId: c.var.user!.id, title: input.title })
     .returning()
     .get();
   return c.json({ todo: row }, 201);
@@ -32,10 +34,10 @@ todos.post("/", async (c) => {
 
 todos.patch("/:id", async (c) => {
   const id = Number(c.req.param("id"));
-  const body = (await c.req.json().catch(() => ({}))) as { done?: unknown };
+  const input = await readBody(c, TodoChange);
   const row = await db(c.env.DB)
     .update(schema.todos)
-    .set({ done: Boolean(body.done) })
+    .set({ done: input.done })
     .where(and(eq(schema.todos.id, id), eq(schema.todos.userId, c.var.user!.id)))
     .returning()
     .get();

package/template/test/access.test.ts

@@ -0,0 +1,42 @@
+// Who can reach what. `nerd check` runs these before every deploy and refuses the deploy when one fails,
+// when the first test is missing, or when a route with an id in its path has no owner test below.
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import type { TestHarness } from "@nerdsystem/sdk/testing";
+import { startTestApp } from "./setup";
+
+let t: TestHarness;
+let stop: () => Promise<void>;
+beforeAll(async () => ({ t, stop } = await startTestApp()));
+afterAll(() => stop());
+
+describe("a signed-out visitor", () => {
+  it("is refused on every route that is not public", async () => {
+    // This calls every route the app has, including ones added later. A new route fails here until it
+    // has requireAuth() or requireRole() in front of it. Only list a route as public when everyone on
+    // the internet is meant to reach it, and it returns nothing private.
+    await t.expectEveryRouteLocked({ public: ["GET /api/health"] });
+  });
+});
+
+describe("one person's todos", () => {
+  it("cannot be seen, changed, or deleted by someone else", async () => {
+    const alice = await t.as("alice");
+    const bob = await t.as("bob");
+    const created = (await (await alice.post("/api/todos", { title: "only-alice-sees-this" })).json()) as { todo: { id: number } };
+
+    await t.expectNotListed(bob, "/api/todos", "only-alice-sees-this");
+    await t.expectHiddenFrom(bob, "PATCH", `/api/todos/${created.todo.id}`, { done: true });
+    await t.expectHiddenFrom(bob, "DELETE", `/api/todos/${created.todo.id}`);
+
+    // And it is still there, unchanged, for the person who owns it.
+    const mine = (await (await alice.get("/api/todos")).json()) as { todos: { id: number; done: boolean }[] };
+    expect(mine.todos).toEqual([expect.objectContaining({ id: created.todo.id, done: false })]);
+  });
+});
+
+describe("the admin route", () => {
+  it("needs the admin role, not just a sign-in", async () => {
+    expect((await (await t.as("carol")).get("/api/admin/ping")).status).toBe(403);
+    expect((await (await t.as("dana", { roles: ["admin"] })).get("/api/admin/ping")).status).toBe(200);
+  });
+});

package/template/test/global-setup.ts

@@ -0,0 +1,7 @@
+// Runs once before the tests: a report from an earlier run must not vouch for this one.
+import { rmSync } from "node:fs";
+import path from "node:path";
+
+export default function setup(): void {
+  rmSync(path.resolve(import.meta.dirname, "..", ".nerd", "access-report.json"), { force: true });
+}

package/template/test/setup.ts

@@ -0,0 +1,40 @@
+// Starts the app for tests: the real server code, a fresh local database with every migration applied,
+// and the nerdsystem test harness. Nothing here talks to the network or to the live app.
+// You should not need to change this file. Add tests next to it.
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { getPlatformProxy } from "wrangler";
+import { testApp, type AccessReport, type TestHarness } from "@nerdsystem/sdk/testing";
+import app from "../src/server";
+
+const root = path.resolve(import.meta.dirname, "..");
+const reportFile = path.join(root, ".nerd", "access-report.json");
+
+/** Each test file adds what it checked to the one report `nerd check` reads. */
+function mergeReport(next: AccessReport): void {
+  const prev: AccessReport | null = existsSync(reportFile) ? JSON.parse(readFileSync(reportFile, "utf8")) : null;
+  const union = <T,>(a: T[] | undefined, b: T[]) => [...new Set([...(a ?? []), ...b])].sort();
+  const merged: AccessReport = {
+    version: 1,
+    routes: next.routes,
+    locked: union(prev?.locked, next.locked),
+    public: union(prev?.public, next.public),
+    ownerChecked: union(prev?.ownerChecked, next.ownerChecked),
+    shared: union(prev?.shared, next.shared),
+    everyRouteChecked: Boolean(prev?.everyRouteChecked) || next.everyRouteChecked,
+  };
+  mkdirSync(path.dirname(reportFile), { recursive: true });
+  writeFileSync(reportFile, `${JSON.stringify(merged, null, 2)}\n`);
+}
+
+export async function startTestApp(): Promise<{ t: TestHarness; env: { DB: D1Database; STORAGE: R2Bucket }; stop: () => Promise<void> }> {
+  const platform = await getPlatformProxy<{ DB: D1Database; STORAGE: R2Bucket }>({ configPath: path.join(root, "wrangler.jsonc"), persist: false });
+  const dir = path.join(root, "migrations");
+  for (const file of readdirSync(dir).filter((f) => f.endsWith(".sql")).sort()) {
+    for (const statement of readFileSync(path.join(dir, file), "utf8").split("--> statement-breakpoint")) {
+      if (statement.trim()) await platform.env.DB.prepare(statement).run();
+    }
+  }
+  const t = await testApp(app, { env: platform.env, onReport: mergeReport });
+  return { t, env: platform.env, stop: () => platform.dispose() };
+}

package/template/test/todos.test.ts

@@ -0,0 +1,34 @@
+// Does the feature work? One test file per feature: the main path a person takes, and the input it must refuse.
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import type { TestHarness } from "@nerdsystem/sdk/testing";
+import { startTestApp } from "./setup";
+
+let t: TestHarness;
+let stop: () => Promise<void>;
+beforeAll(async () => ({ t, stop } = await startTestApp()));
+afterAll(() => stop());
+
+describe("todos", () => {
+  it("adds a todo, lists it, marks it done, and deletes it", async () => {
+    const erin = await t.as("erin");
+    const added = await erin.post("/api/todos", { title: "  Buy milk  " });
+    expect(added.status).toBe(201);
+    const { todo } = (await added.json()) as { todo: { id: number; title: string; done: boolean } };
+    expect(todo).toMatchObject({ title: "Buy milk", done: false });
+
+    expect(((await (await erin.get("/api/todos")).json()) as { todos: unknown[] }).todos).toHaveLength(1);
+    expect(((await (await erin.patch(`/api/todos/${todo.id}`, { done: true })).json()) as { todo: { done: boolean } }).todo.done).toBe(true);
+    expect((await erin.delete(`/api/todos/${todo.id}`)).status).toBe(200);
+    expect(((await (await erin.get("/api/todos")).json()) as { todos: unknown[] }).todos).toHaveLength(0);
+  });
+
+  it("refuses a todo with no title, and answers 404 for one that does not exist", async () => {
+    const erin = await t.as("erin");
+    expect((await erin.post("/api/todos", {})).status).toBe(400);
+    expect((await erin.post("/api/todos", { title: "   " })).status).toBe(400);
+    expect((await erin.post("/api/todos", { title: "x".repeat(201) })).status).toBe(400);
+    expect((await erin.post("/api/todos", { title: 42 })).status).toBe(400);
+    expect((await erin.patch("/api/todos/1", { done: "yes" })).status).toBe(400);
+    expect((await erin.patch("/api/todos/999999", { done: true })).status).toBe(404);
+  });
+});

package/template/vitest.config.ts

@@ -0,0 +1,16 @@
+// Tests run the server code in Node against a local database. This file keeps them apart from vite.config.ts,
+// whose Cloudflare plugin is for building and for `nerd dev`.
+import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+  test: {
+    include: ["test/**/*.test.ts"],
+    // The SDK is published for bundlers, so let Vite load it instead of Node.
+    server: { deps: { inline: ["@nerdsystem/sdk"] } },
+    globalSetup: ["test/global-setup.ts"],
+    // One file at a time: each starts its own local database, and they share one access report.
+    fileParallelism: false,
+    testTimeout: 20_000,
+    hookTimeout: 30_000,
+  },
+});