nerdsystem 0.0.14 → 0.0.15

package/dist/commands/init.js

@@ -183,4 +183,4 @@ export async function init(dir, args) {
     log.ok(`Ready. Next:\n  cd ${dir}\n  pnpm install\n  nerd dev\n\nThen open the folder in your coding agent and ask it to build the first feature; the nerdsystem skill walks it through.\nDeploys go to ${project.url}`);
 }
 // Kept in sync with packages/sdk/package.json by the release script.
-const SDK_VERSION = "0.0.14";
+const SDK_VERSION = "0.0.15";

package/dist/gates/index.js

@@ -2,6 +2,7 @@ import { bundleGate, finding, secretsGate } from "./secrets.js";
 import { depsGate, piiGate, policyGate, rulesGate, typecheckGate } from "./code.js";
 import { gitleaksGate, semgrepGate } from "./tools.js";
 import { suppressionsGate } from "./suppressions.js";
+import { staticGate } from "./static.js";
 import { testsGate } from "./tests.js";
 import { applyAttempts, MAX_ATTEMPTS } from "./attempts.js";
 export { gateSummary, skippedGates } from "./types.js";
@@ -10,7 +11,7 @@ export { mask } from "./secrets.js";
 export { MAX_ATTEMPTS, readAttempts } from "./attempts.js";
 export { probeDeployment, skippedProbe, waitForDeployment } from "./smoke.js";
 /** Gates that run on source, before the build. Suppressions first so a human sees them before anything else. */
-export const SOURCE_GATES = [suppressionsGate, secretsGate, gitleaksGate, depsGate, rulesGate, semgrepGate, policyGate, piiGate, typecheckGate, testsGate];
+export const SOURCE_GATES = [suppressionsGate, secretsGate, gitleaksGate, depsGate, rulesGate, staticGate, semgrepGate, policyGate, piiGate, typecheckGate, testsGate];
 /** Gates that need the built output. */
 export const BUILD_GATES = [bundleGate, policyGate];
 function selectGates(gates, onlyRules) {

package/dist/gates/rules.js

@@ -36,6 +36,16 @@ export const RULES = {
     "rules/advisory": { title: "Platform advisory", severity: "warn", audience: "agent", risk: "Not blocking, but the project is missing something the platform expects.", fix: "Follow the instruction in the finding." },
     "rules/shape": { title: "Not in the nerdsystem shape", severity: "warn", audience: "human", risk: "Every app on nerdsystem is one shape: a Vite client, a Hono server on @nerdsystem/sdk, SQLite on D1, and a bucket. This repository is not in that shape. A clean scan says nothing about whether it would deploy here.", fix: "Start a project with `nerd init` and have the agent port the screens into it. The server and the login are rebuilt on the platform's sign-in and database. The compare pages on nerdsystem.com say what carries over." },
     "typecheck/error": { title: "TypeScript error", severity: "block", audience: "agent", risk: "The code would not compile reliably; the build may fail or behave unexpectedly.", fix: "Fix the type error at the file and line shown. Run `npx tsc -b` for the full message." },
+    "code/raw-sql": { title: "SQL built from values", severity: "block", audience: "agent", risk: "A value from a request placed straight into SQL lets a visitor rewrite the query and read or delete other people's data.", fix: "Use the Drizzle query builder, or bind values as parameters (`.prepare(\"... where id = ?\").bind(id)`). Never put a variable inside the SQL text.", example: { wrong: "c.env.DB.prepare(`select * from notes where id = ${id}`)", right: "db(c.env.DB).select().from(schema.notes).where(eq(schema.notes.id, id))" } },
+    "code/eval": { title: "eval or new Function", severity: "block", audience: "agent", risk: "Running text as code lets anyone who can influence that text run their own code in the app.", fix: "Remove it. Parse data with JSON.parse and choose behaviour with ordinary code." },
+    "code/password-in-app": { title: "Password handling in app code", severity: "block", audience: "agent", risk: "Storing or comparing passwords yourself is unnecessary here and easy to get wrong.", fix: "Remove it. Sign-in is provided by the platform: read the signed-in user from `c.var.user` and protect routes with `requireAuth()`.", example: { wrong: "if (user.password === body.password) { ... }", right: "app.get(\"/api/me\", requireAuth(), (c) => c.json(c.var.user));" } },
+    "code/tokens-in-app": { title: "Signing or verifying tokens in app code", severity: "warn", audience: "agent", risk: "A second token system beside the platform's sessions is a second way in, and a common source of mistakes.", fix: "Use the session the SDK provides (`c.var.user`). If a third-party service requires its own signed token, keep that code in one file and say so to the person." },
+    "code/html-from-data": { title: "HTML built from data", severity: "warn", audience: "agent", risk: "Text a user typed, rendered as HTML, can carry a script that runs in other users' browsers.", fix: "Render the value as text and let React escape it. Do not use `dangerouslySetInnerHTML` or `innerHTML` with anything that is not a fixed string." },
+    "code/open-redirect": { title: "Redirect to an address from the request", severity: "warn", audience: "agent", risk: "A link to your app could send people on to a look-alike site.", fix: "Redirect only to paths inside the app: check that the value starts with a single `/` and is one of the pages you expect." },
+    "code/fetch-user-url": { title: "Fetching an address from the request", severity: "warn", audience: "agent", risk: "A visitor could make the server fetch addresses it should not reach.", fix: "Fetch only fixed addresses, or check the host against a short list you wrote." },
+    "code/weak-random": { title: "Math.random used for a secret", severity: "warn", audience: "agent", risk: "Math.random is predictable, so a token or code made with it can be guessed.", fix: "Use `crypto.randomUUID()` or `crypto.getRandomValues()`." },
+    "code/unvalidated-body": { title: "A request body read without a check", severity: "warn", audience: "agent", risk: "Fields of any type or size reach the route, which is how bad data and oversized input get into the database.", fix: "Read it with `readBody(c, schema)` from `@nerdsystem/sdk` and a zod schema that gives every field a type and a limit. It answers 400 for anything else.", example: { wrong: "const body = await c.req.json();", right: "const input = await readBody(c, z.object({ title: z.string().trim().min(1).max(200) }));" } },
+    "code/routes-open-by-default": { title: "Routes are open unless each one is protected", severity: "warn", audience: "agent", risk: "A route added without `requireAuth()` answers everyone on the internet.", fix: "Pass the list of public routes to `createNerdApp({ public: [\"GET /api/health\"] })` (needs @nerdsystem/sdk 0.0.15 or later). Every other route then requires sign-in automatically. Run the tests afterwards: a route that was meant to be public must be on the list." },
     "tests/missing": { title: "No access tests", severity: "warn", audience: "agent", risk: "Nothing checks that a signed-out visitor is refused, or that one user cannot reach another user's data. Those are the two mistakes that expose people's records, and nobody looking at the screen can see them.", fix: "Add the access tests: update @nerdsystem/sdk to the latest version, add vitest as a dev dependency with a `test` script (`vitest run`), and copy `test/setup.ts`, `test/global-setup.ts`, `test/access.test.ts`, and `vitest.config.ts` from a fresh `npx nerdsystem init` app. Then write one owner test for each route with an id in its path, set `\"tests\": \"required\"` in nerd.json, and run `nerd check`." },
     "tests/required-missing": { title: "Access tests are missing", severity: "block", audience: "agent", risk: "This app is set to require access tests and has none, so nothing checks that a signed-out visitor is refused or that one user cannot reach another user's data.", fix: "Restore `test/access.test.ts` and the `test` script (`vitest run`) in package.json. Do not remove `\"tests\": \"required\"` from nerd.json to get past this." },
     "tests/not-installed": { title: "Dependencies are not installed", severity: "block", audience: "agent", risk: "The tests cannot run, so nothing has been checked.", fix: "Run `pnpm install`, then `nerd check` again." },

package/dist/gates/static.d.ts

@@ -0,0 +1,2 @@
+import { type Gate } from "./types.js";
+export declare const staticGate: Gate;

package/dist/gates/static.js

@@ -0,0 +1,58 @@
+import { lineOf, sourceFiles } from "./fs.js";
+import { finding } from "./secrets.js";
+import { counts, result, verdict } from "./types.js";
+const SERVER = /^src\/server\//;
+/**
+ * The patterns semgrep's nerdsystem rules look for (packages/cli/rules/semgrep.yml), as plain text
+ * matching, so they run on every machine and every deploy without anything installed. Semgrep reads the
+ * code's structure and stays the more exact tool where it runs; these are deliberately narrow so they
+ * do not cry wolf. Three block, as the same semgrep rules do; the rest warn.
+ */
+const CHECKS = [
+    // SQL assembled from values: a template with ${} or a string joined with +, handed to prepare/exec/sql.raw.
+    { rule: "code/raw-sql", re: /(\.prepare|\.exec|sql\.raw)\(\s*(`[^`]*\$\{|["'][^"'\n]*["']\s*\+)/g },
+    { rule: "code/eval", re: /(^|[^.\w])eval\s*\(|\bnew\s+Function\s*\(/g },
+    { rule: "code/password-in-app", re: /\.password\s*={2,3}|={2,3}\s*\w+\.password\b|\b(bcrypt|bcryptjs|argon2)\.(compare|hash|verify)\w*\s*\(|from\s+["'](bcrypt|bcryptjs|argon2)["']/g, files: SERVER },
+    { rule: "code/tokens-in-app", re: /\bjwt\.(sign|verify)\s*\(|from\s+["'](jsonwebtoken|jose|hono\/jwt)["']/g, files: SERVER },
+    { rule: "code/html-from-data", re: /dangerouslySetInnerHTML\s*=\s*\{\{\s*__html\s*:(?!\s*["'][^"'\n]*["']\s*\}\})|\.innerHTML\s*\+?=(?![=])(?!\s*["'][^"'\n]*["']\s*(;|\n|$))/g },
+    { rule: "code/open-redirect", re: /\.redirect\(\s*(c\.req\.(query|param|header)\(|\(?await\s+c\.req\.)/g, files: SERVER },
+    { rule: "code/fetch-user-url", re: /\bfetch\(\s*(c\.req\.(query|param|header)\(|\(?await\s+c\.req\.)/g, files: SERVER },
+    { rule: "code/weak-random", re: /\b\w*(token|secret|nonce|otp|passcode|apikey|api_key)\w*\s*[:=][^;\n]*Math\.random\(\)/gi },
+    // An unchecked body: c.req.json() used directly instead of readBody(c, schema).
+    { rule: "code/unvalidated-body", re: /\bc\.req\.(json|parseBody|formData)\(\)/g, files: SERVER },
+];
+/** Blanks out comments, keeping every character position, so a pattern inside a comment is not a finding. */
+function withoutComments(text) {
+    return text.replace(/\/\*[\s\S]*?\*\/|(^|[^:"'`\\])\/\/[^\n]*/g, (m) => m.replace(/[^\n]/g, " "));
+}
+export const staticGate = {
+    name: "static",
+    title: "Unsafe code patterns",
+    blocking: true,
+    rulePrefixes: ["code/"],
+    async run(ctx) {
+        const t = Date.now();
+        const findings = [];
+        for (const f of sourceFiles(ctx.root)) {
+            if (!/\.(ts|tsx|js|jsx|mjs)$/.test(f.rel) || !f.rel.startsWith("src/"))
+                continue;
+            const text = withoutComments(f.text);
+            for (const c of CHECKS) {
+                if (c.files && !c.files.test(f.rel))
+                    continue;
+                c.re.lastIndex = 0;
+                let m;
+                let perFile = 0;
+                while ((m = c.re.exec(text)) && perFile < 10) {
+                    findings.push(finding(c.rule, { file: f.rel, line: lineOf(text, m.index) }));
+                    perFile++;
+                }
+            }
+            // Sign-in for every route is opt-in for apps created before it existed; say so until it is on.
+            if (f.rel === "src/server/index.ts" && /createNerdApp\s*(<[^>]*>)?\s*\(/.test(text) && !/createNerdApp\s*(<[^>]*>)?\s*\(\s*\{[\s\S]*?\bpublic\s*:/.test(text)) {
+                findings.push(finding("code/routes-open-by-default", { file: f.rel }));
+            }
+        }
+        return result(this, verdict(findings), findings.length ? counts(findings) : "Nothing unsafe found", findings, t);
+    },
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nerdsystem",
-  "version": "0.0.14",
+  "version": "0.0.15",
   "description": "nerd: start, check, and deploy a web app on nerdsystem from the terminal or a coding agent.",
   "type": "module",
   "bin": {

package/template/.claude/skills/nerdsystem/SKILL.md

@@ -99,10 +99,10 @@ Then in `src/server/index.ts`: `app.route("/api/notes", notes);`
 
 The person you are building for usually cannot read code. They will not spot a missing sign-in check or a query that returns someone else's rows, and neither will anyone looking at the screen. So the standard is yours to hold, every time, without being asked:
 
-1. **Lock every route first.** Put `requireAuth()` or `requireRole(...)` in front of every route as middleware, before any input is read (`router.use("*", requireAuth())` for a whole router). A route is public only when everyone on the internet is meant to reach it and it returns nothing private; then add it to the `public` list in `test/access.test.ts` and tell the person in plain words that it is open.
+1. **Every route is locked unless you open it.** `createNerdApp({ public: [...] })` in `src/server/index.ts` makes every route require a signed-in user except the ones named in that list, so a route you forget to protect answers 401 instead of answering everyone. Still put `requireAuth()` on each router (`router.use("*", requireAuth())`) and `requireRole(...)` where a role is needed: it says what the route expects and gives TypeScript a user. A route is public only when everyone on the internet is meant to reach it and it returns nothing private; then add it to the `public` list in `src/server/index.ts` and to the same list in `test/access.test.ts`, and tell the person in plain words that it is open. Never remove the `public` option or widen it to get something working.
 2. **Scope every query to the signed-in user.** Reads, updates, and deletes on user data filter on `c.var.user.id`. On a route with an id in its path, put the id and the user id in the same `where`, and answer 404 when nothing matches, so someone else's row looks like it does not exist.
 3. **Take identity from the session, never from the request.** The user id, the role, a price, an owner: none of these come from the body, the query string, or a header the browser sends. Read the user from `c.var.user` and look the rest up on the server.
-4. **Check every input on the server.** Type, length, range, and allowed values, for every field of every body, query, and path parameter. Answer 400 with the usual error shape. The client's own checks are for the person's convenience; they protect nothing.
+4. **Check every input on the server.** Read a body with `readBody(c, schema)` and a query string with `readQuery(c, schema)` from `@nerdsystem/sdk`, with a zod schema that gives every field a type, a length, a range, or a list of allowed values (see `src/server/routes/todos.ts`). They answer 400 in the usual error shape for anything else, before your code runs. Do not call `c.req.json()` directly; `nerd check` flags it. Path parameters get the same care: turn an id into a number and let a missing row be a 404. The client's own checks are for the person's convenience; they protect nothing.
 5. **Hiding a button is not access control.** If only admins may do something, the route says `requireRole("admin")`. What the page shows is decoration.
 6. **Files:** check the type and the size before writing to `c.env.STORAGE`, store under a key that starts with the owner's user id, and serve them through a route that checks the owner. Never build a key from a name the browser sent without cleaning it.
 7. **Say nothing useful in an error.** No stack traces, SQL, or internal ids in responses; log them with `console.error` and answer with `{ error: { code, message } }`.
@@ -161,6 +161,7 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 - New bindings in `wrangler.jsonc`. Only `DB`, `STORAGE`, and `ASSETS` exist. Durable Objects are not available.
 - Scripts that call `wrangler deploy`, `wrangler secret`, or remote `wrangler d1` commands.
 - Typecheck failures in either `src/server` or `src/client`.
+- SQL built from values, `eval` or `new Function`, and password handling in server code (the `code/` rules; they block). It also flags, without blocking: tokens signed in app code, HTML built from data, redirects and fetches to an address from the request, `Math.random` for a secret, a body read without `readBody`, and an app that has not turned on `public` in `createNerdApp`.
 - A failing test, a missing access sweep, or a route with an id that no second user was tried against (the `tests/` rules above).
 
 ## Scheduled jobs and email

package/template/.cursor/rules/nerdsystem.mdc

@@ -2,7 +2,7 @@
 description: How to build, run, and deploy this app on nerdsystem. Applies to server, database, auth, and deploy work.
 alwaysApply: true
 ---
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (37f79c2cf2a8); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (f851c99006a8); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -100,10 +100,10 @@ Then in `src/server/index.ts`: `app.route("/api/notes", notes);`
 
 The person you are building for usually cannot read code. They will not spot a missing sign-in check or a query that returns someone else's rows, and neither will anyone looking at the screen. So the standard is yours to hold, every time, without being asked:
 
-1. **Lock every route first.** Put `requireAuth()` or `requireRole(...)` in front of every route as middleware, before any input is read (`router.use("*", requireAuth())` for a whole router). A route is public only when everyone on the internet is meant to reach it and it returns nothing private; then add it to the `public` list in `test/access.test.ts` and tell the person in plain words that it is open.
+1. **Every route is locked unless you open it.** `createNerdApp({ public: [...] })` in `src/server/index.ts` makes every route require a signed-in user except the ones named in that list, so a route you forget to protect answers 401 instead of answering everyone. Still put `requireAuth()` on each router (`router.use("*", requireAuth())`) and `requireRole(...)` where a role is needed: it says what the route expects and gives TypeScript a user. A route is public only when everyone on the internet is meant to reach it and it returns nothing private; then add it to the `public` list in `src/server/index.ts` and to the same list in `test/access.test.ts`, and tell the person in plain words that it is open. Never remove the `public` option or widen it to get something working.
 2. **Scope every query to the signed-in user.** Reads, updates, and deletes on user data filter on `c.var.user.id`. On a route with an id in its path, put the id and the user id in the same `where`, and answer 404 when nothing matches, so someone else's row looks like it does not exist.
 3. **Take identity from the session, never from the request.** The user id, the role, a price, an owner: none of these come from the body, the query string, or a header the browser sends. Read the user from `c.var.user` and look the rest up on the server.
-4. **Check every input on the server.** Type, length, range, and allowed values, for every field of every body, query, and path parameter. Answer 400 with the usual error shape. The client's own checks are for the person's convenience; they protect nothing.
+4. **Check every input on the server.** Read a body with `readBody(c, schema)` and a query string with `readQuery(c, schema)` from `@nerdsystem/sdk`, with a zod schema that gives every field a type, a length, a range, or a list of allowed values (see `src/server/routes/todos.ts`). They answer 400 in the usual error shape for anything else, before your code runs. Do not call `c.req.json()` directly; `nerd check` flags it. Path parameters get the same care: turn an id into a number and let a missing row be a 404. The client's own checks are for the person's convenience; they protect nothing.
 5. **Hiding a button is not access control.** If only admins may do something, the route says `requireRole("admin")`. What the page shows is decoration.
 6. **Files:** check the type and the size before writing to `c.env.STORAGE`, store under a key that starts with the owner's user id, and serve them through a route that checks the owner. Never build a key from a name the browser sent without cleaning it.
 7. **Say nothing useful in an error.** No stack traces, SQL, or internal ids in responses; log them with `console.error` and answer with `{ error: { code, message } }`.
@@ -162,6 +162,7 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 - New bindings in `wrangler.jsonc`. Only `DB`, `STORAGE`, and `ASSETS` exist. Durable Objects are not available.
 - Scripts that call `wrangler deploy`, `wrangler secret`, or remote `wrangler d1` commands.
 - Typecheck failures in either `src/server` or `src/client`.
+- SQL built from values, `eval` or `new Function`, and password handling in server code (the `code/` rules; they block). It also flags, without blocking: tokens signed in app code, HTML built from data, redirects and fetches to an address from the request, `Math.random` for a secret, a body read without `readBody`, and an app that has not turned on `public` in `createNerdApp`.
 - A failing test, a missing access sweep, or a route with an id that no second user was tried against (the `tests/` rules above).
 
 ## Scheduled jobs and email

package/template/.github/copilot-instructions.md

@@ -1,4 +1,4 @@
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (37f79c2cf2a8); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (f851c99006a8); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -96,10 +96,10 @@ Then in `src/server/index.ts`: `app.route("/api/notes", notes);`
 
 The person you are building for usually cannot read code. They will not spot a missing sign-in check or a query that returns someone else's rows, and neither will anyone looking at the screen. So the standard is yours to hold, every time, without being asked:
 
-1. **Lock every route first.** Put `requireAuth()` or `requireRole(...)` in front of every route as middleware, before any input is read (`router.use("*", requireAuth())` for a whole router). A route is public only when everyone on the internet is meant to reach it and it returns nothing private; then add it to the `public` list in `test/access.test.ts` and tell the person in plain words that it is open.
+1. **Every route is locked unless you open it.** `createNerdApp({ public: [...] })` in `src/server/index.ts` makes every route require a signed-in user except the ones named in that list, so a route you forget to protect answers 401 instead of answering everyone. Still put `requireAuth()` on each router (`router.use("*", requireAuth())`) and `requireRole(...)` where a role is needed: it says what the route expects and gives TypeScript a user. A route is public only when everyone on the internet is meant to reach it and it returns nothing private; then add it to the `public` list in `src/server/index.ts` and to the same list in `test/access.test.ts`, and tell the person in plain words that it is open. Never remove the `public` option or widen it to get something working.
 2. **Scope every query to the signed-in user.** Reads, updates, and deletes on user data filter on `c.var.user.id`. On a route with an id in its path, put the id and the user id in the same `where`, and answer 404 when nothing matches, so someone else's row looks like it does not exist.
 3. **Take identity from the session, never from the request.** The user id, the role, a price, an owner: none of these come from the body, the query string, or a header the browser sends. Read the user from `c.var.user` and look the rest up on the server.
-4. **Check every input on the server.** Type, length, range, and allowed values, for every field of every body, query, and path parameter. Answer 400 with the usual error shape. The client's own checks are for the person's convenience; they protect nothing.
+4. **Check every input on the server.** Read a body with `readBody(c, schema)` and a query string with `readQuery(c, schema)` from `@nerdsystem/sdk`, with a zod schema that gives every field a type, a length, a range, or a list of allowed values (see `src/server/routes/todos.ts`). They answer 400 in the usual error shape for anything else, before your code runs. Do not call `c.req.json()` directly; `nerd check` flags it. Path parameters get the same care: turn an id into a number and let a missing row be a 404. The client's own checks are for the person's convenience; they protect nothing.
 5. **Hiding a button is not access control.** If only admins may do something, the route says `requireRole("admin")`. What the page shows is decoration.
 6. **Files:** check the type and the size before writing to `c.env.STORAGE`, store under a key that starts with the owner's user id, and serve them through a route that checks the owner. Never build a key from a name the browser sent without cleaning it.
 7. **Say nothing useful in an error.** No stack traces, SQL, or internal ids in responses; log them with `console.error` and answer with `{ error: { code, message } }`.
@@ -158,6 +158,7 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 - New bindings in `wrangler.jsonc`. Only `DB`, `STORAGE`, and `ASSETS` exist. Durable Objects are not available.
 - Scripts that call `wrangler deploy`, `wrangler secret`, or remote `wrangler d1` commands.
 - Typecheck failures in either `src/server` or `src/client`.
+- SQL built from values, `eval` or `new Function`, and password handling in server code (the `code/` rules; they block). It also flags, without blocking: tokens signed in app code, HTML built from data, redirects and fetches to an address from the request, `Math.random` for a secret, a body read without `readBody`, and an app that has not turned on `public` in `createNerdApp`.
 - A failing test, a missing access sweep, or a route with an id that no second user was tried against (the `tests/` rules above).
 
 ## Scheduled jobs and email

package/template/AGENTS.md

@@ -1,4 +1,4 @@
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (37f79c2cf2a8); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (f851c99006a8); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -96,10 +96,10 @@ Then in `src/server/index.ts`: `app.route("/api/notes", notes);`
 
 The person you are building for usually cannot read code. They will not spot a missing sign-in check or a query that returns someone else's rows, and neither will anyone looking at the screen. So the standard is yours to hold, every time, without being asked:
 
-1. **Lock every route first.** Put `requireAuth()` or `requireRole(...)` in front of every route as middleware, before any input is read (`router.use("*", requireAuth())` for a whole router). A route is public only when everyone on the internet is meant to reach it and it returns nothing private; then add it to the `public` list in `test/access.test.ts` and tell the person in plain words that it is open.
+1. **Every route is locked unless you open it.** `createNerdApp({ public: [...] })` in `src/server/index.ts` makes every route require a signed-in user except the ones named in that list, so a route you forget to protect answers 401 instead of answering everyone. Still put `requireAuth()` on each router (`router.use("*", requireAuth())`) and `requireRole(...)` where a role is needed: it says what the route expects and gives TypeScript a user. A route is public only when everyone on the internet is meant to reach it and it returns nothing private; then add it to the `public` list in `src/server/index.ts` and to the same list in `test/access.test.ts`, and tell the person in plain words that it is open. Never remove the `public` option or widen it to get something working.
 2. **Scope every query to the signed-in user.** Reads, updates, and deletes on user data filter on `c.var.user.id`. On a route with an id in its path, put the id and the user id in the same `where`, and answer 404 when nothing matches, so someone else's row looks like it does not exist.
 3. **Take identity from the session, never from the request.** The user id, the role, a price, an owner: none of these come from the body, the query string, or a header the browser sends. Read the user from `c.var.user` and look the rest up on the server.
-4. **Check every input on the server.** Type, length, range, and allowed values, for every field of every body, query, and path parameter. Answer 400 with the usual error shape. The client's own checks are for the person's convenience; they protect nothing.
+4. **Check every input on the server.** Read a body with `readBody(c, schema)` and a query string with `readQuery(c, schema)` from `@nerdsystem/sdk`, with a zod schema that gives every field a type, a length, a range, or a list of allowed values (see `src/server/routes/todos.ts`). They answer 400 in the usual error shape for anything else, before your code runs. Do not call `c.req.json()` directly; `nerd check` flags it. Path parameters get the same care: turn an id into a number and let a missing row be a 404. The client's own checks are for the person's convenience; they protect nothing.
 5. **Hiding a button is not access control.** If only admins may do something, the route says `requireRole("admin")`. What the page shows is decoration.
 6. **Files:** check the type and the size before writing to `c.env.STORAGE`, store under a key that starts with the owner's user id, and serve them through a route that checks the owner. Never build a key from a name the browser sent without cleaning it.
 7. **Say nothing useful in an error.** No stack traces, SQL, or internal ids in responses; log them with `console.error` and answer with `{ error: { code, message } }`.
@@ -158,6 +158,7 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 - New bindings in `wrangler.jsonc`. Only `DB`, `STORAGE`, and `ASSETS` exist. Durable Objects are not available.
 - Scripts that call `wrangler deploy`, `wrangler secret`, or remote `wrangler d1` commands.
 - Typecheck failures in either `src/server` or `src/client`.
+- SQL built from values, `eval` or `new Function`, and password handling in server code (the `code/` rules; they block). It also flags, without blocking: tokens signed in app code, HTML built from data, redirects and fetches to an address from the request, `Math.random` for a secret, a body read without `readBody`, and an app that has not turned on `public` in `createNerdApp`.
 - A failing test, a missing access sweep, or a route with an id that no second user was tried against (the `tests/` rules above).
 
 ## Scheduled jobs and email

package/template/CLAUDE.md

@@ -28,7 +28,8 @@ nerdsystem deploys this app to Cloudflare and provides authentication and author
 5. Keep every API route under `/api/`. Other paths are served from static assets and never reach the Worker.
 6. Do not add Cloudflare bindings to `wrangler.jsonc`, and do not run `wrangler deploy`. Bindings are provisioned by the platform.
 7. Secrets and environment variables for the deployed app are managed with `nerd` commands, never committed.
-8. Every route is locked with `requireAuth()` or `requireRole()` unless it is listed as public in `test/access.test.ts`, and every route with an id in its path has a test showing a second user cannot reach it. Write the tests with the feature. `nerd check` refuses a deploy when they fail or are missing; never weaken one to get through.
+8. Every route requires a signed-in user unless it is named in `createNerdApp({ public: [...] })` and in the same list in `test/access.test.ts`, and every route with an id in its path has a test showing a second user cannot reach it. Write the tests with the feature. `nerd check` refuses a deploy when they fail or are missing; never weaken one to get through.
+9. Read request bodies with `readBody(c, schema)` and a zod schema, never `c.req.json()` directly.
 
 ## Roles
 

package/template/GEMINI.md

@@ -1,4 +1,4 @@
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (37f79c2cf2a8); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (f851c99006a8); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -96,10 +96,10 @@ Then in `src/server/index.ts`: `app.route("/api/notes", notes);`
 
 The person you are building for usually cannot read code. They will not spot a missing sign-in check or a query that returns someone else's rows, and neither will anyone looking at the screen. So the standard is yours to hold, every time, without being asked:
 
-1. **Lock every route first.** Put `requireAuth()` or `requireRole(...)` in front of every route as middleware, before any input is read (`router.use("*", requireAuth())` for a whole router). A route is public only when everyone on the internet is meant to reach it and it returns nothing private; then add it to the `public` list in `test/access.test.ts` and tell the person in plain words that it is open.
+1. **Every route is locked unless you open it.** `createNerdApp({ public: [...] })` in `src/server/index.ts` makes every route require a signed-in user except the ones named in that list, so a route you forget to protect answers 401 instead of answering everyone. Still put `requireAuth()` on each router (`router.use("*", requireAuth())`) and `requireRole(...)` where a role is needed: it says what the route expects and gives TypeScript a user. A route is public only when everyone on the internet is meant to reach it and it returns nothing private; then add it to the `public` list in `src/server/index.ts` and to the same list in `test/access.test.ts`, and tell the person in plain words that it is open. Never remove the `public` option or widen it to get something working.
 2. **Scope every query to the signed-in user.** Reads, updates, and deletes on user data filter on `c.var.user.id`. On a route with an id in its path, put the id and the user id in the same `where`, and answer 404 when nothing matches, so someone else's row looks like it does not exist.
 3. **Take identity from the session, never from the request.** The user id, the role, a price, an owner: none of these come from the body, the query string, or a header the browser sends. Read the user from `c.var.user` and look the rest up on the server.
-4. **Check every input on the server.** Type, length, range, and allowed values, for every field of every body, query, and path parameter. Answer 400 with the usual error shape. The client's own checks are for the person's convenience; they protect nothing.
+4. **Check every input on the server.** Read a body with `readBody(c, schema)` and a query string with `readQuery(c, schema)` from `@nerdsystem/sdk`, with a zod schema that gives every field a type, a length, a range, or a list of allowed values (see `src/server/routes/todos.ts`). They answer 400 in the usual error shape for anything else, before your code runs. Do not call `c.req.json()` directly; `nerd check` flags it. Path parameters get the same care: turn an id into a number and let a missing row be a 404. The client's own checks are for the person's convenience; they protect nothing.
 5. **Hiding a button is not access control.** If only admins may do something, the route says `requireRole("admin")`. What the page shows is decoration.
 6. **Files:** check the type and the size before writing to `c.env.STORAGE`, store under a key that starts with the owner's user id, and serve them through a route that checks the owner. Never build a key from a name the browser sent without cleaning it.
 7. **Say nothing useful in an error.** No stack traces, SQL, or internal ids in responses; log them with `console.error` and answer with `{ error: { code, message } }`.
@@ -158,6 +158,7 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 - New bindings in `wrangler.jsonc`. Only `DB`, `STORAGE`, and `ASSETS` exist. Durable Objects are not available.
 - Scripts that call `wrangler deploy`, `wrangler secret`, or remote `wrangler d1` commands.
 - Typecheck failures in either `src/server` or `src/client`.
+- SQL built from values, `eval` or `new Function`, and password handling in server code (the `code/` rules; they block). It also flags, without blocking: tokens signed in app code, HTML built from data, redirects and fetches to an address from the request, `Math.random` for a secret, a body read without `readBody`, and an app that has not turned on `public` in `createNerdApp`.
 - A failing test, a missing access sweep, or a route with an id that no second user was tried against (the `tests/` rules above).
 
 ## Scheduled jobs and email

package/template/package.json

@@ -18,7 +18,8 @@
     "drizzle-orm": "^0.45.4",
     "hono": "^4.13.16",
     "react": "^19.3.1",
-    "react-dom": "^19.3.1"
+    "react-dom": "^19.3.1",
+    "zod": "^4.6.7"
   },
   "pnpm": {
     "onlyBuiltDependencies": [

package/template/src/server/index.ts

@@ -3,7 +3,11 @@ import todos from "./routes/todos";
 
 // createNerdApp gives you a Hono app with sessions at /api/auth and c.var.user on every request.
 // Static assets (the React client) are served by the platform for every path outside /api.
-const app = createNerdApp();
+//
+// Every route needs a signed-in user unless it is named in `public`. A route you forget to protect
+// answers 401, not everyone. Add a route here only when the whole internet is meant to reach it and it
+// returns nothing private, and add it to the same list in test/access.test.ts.
+const app = createNerdApp({ public: ["GET /api/health"] });
 
 app.get("/api/health", (c) => c.json({ ok: true, user: c.var.user?.email ?? null }));
 

package/template/src/server/routes/todos.ts

@@ -1,8 +1,13 @@
 import { Hono } from "hono";
 import { and, desc, eq } from "drizzle-orm";
-import { requireAuth, type NerdHonoEnv } from "@nerdsystem/sdk";
+import { z } from "zod";
+import { readBody, requireAuth, type NerdHonoEnv } from "@nerdsystem/sdk";
 import { db, schema } from "../db";
 
+// What each request may contain. readBody() answers 400 for anything else, before the route runs.
+const NewTodo = z.object({ title: z.string().trim().min(1, "title is required").max(200) });
+const TodoChange = z.object({ done: z.boolean() });
+
 // Every route here needs a signed-in user. c.var.user is set by the SDK.
 const todos = new Hono<NerdHonoEnv>();
 todos.use("*", requireAuth());
@@ -18,13 +23,10 @@ todos.get("/", async (c) => {
 });
 
 todos.post("/", async (c) => {
-  const body = (await c.req.json().catch(() => ({}))) as { title?: unknown };
-  if (typeof body.title !== "string" || !body.title.trim()) {
-    return c.json({ error: { code: "bad_request", message: "title is required" } }, 400);
-  }
+  const input = await readBody(c, NewTodo);
   const row = await db(c.env.DB)
     .insert(schema.todos)
-    .values({ userId: c.var.user!.id, title: body.title.trim() })
+    .values({ userId: c.var.user!.id, title: input.title })
     .returning()
     .get();
   return c.json({ todo: row }, 201);
@@ -32,10 +34,10 @@ todos.post("/", async (c) => {
 
 todos.patch("/:id", async (c) => {
   const id = Number(c.req.param("id"));
-  const body = (await c.req.json().catch(() => ({}))) as { done?: unknown };
+  const input = await readBody(c, TodoChange);
   const row = await db(c.env.DB)
     .update(schema.todos)
-    .set({ done: Boolean(body.done) })
+    .set({ done: input.done })
     .where(and(eq(schema.todos.id, id), eq(schema.todos.userId, c.var.user!.id)))
     .returning()
     .get();

package/template/test/todos.test.ts

@@ -26,6 +26,9 @@ describe("todos", () => {
     const erin = await t.as("erin");
     expect((await erin.post("/api/todos", {})).status).toBe(400);
     expect((await erin.post("/api/todos", { title: "   " })).status).toBe(400);
+    expect((await erin.post("/api/todos", { title: "x".repeat(201) })).status).toBe(400);
+    expect((await erin.post("/api/todos", { title: 42 })).status).toBe(400);
+    expect((await erin.patch("/api/todos/1", { done: "yes" })).status).toBe(400);
     expect((await erin.patch("/api/todos/999999", { done: true })).status).toBe(404);
   });
 });