nerdsystem 0.0.14 → 0.0.16

package/dist/commands/deploy.js

@@ -7,6 +7,7 @@ import { formatMb } from "../snapshot.js";
 import { CliError, log, printJson, runOrThrow, table, dashboardUrl, ensureDeps } from "../util.js";
 import { runChecks } from "./check.js";
 import { appendLineage, cliVersion, LOCAL_ONLY_NOTE, packProject, readLineage, uploadSnapshot, uploadStopMessage } from "./source.js";
+import { lockedGetPaths } from "../gates/tests.js";
 import { BUILD_GATES, gateSummary, knownSecretsFrom, probeDeployment, runGates, skippedProbe, SOURCE_GATES, waitForDeployment } from "../gates/index.js";
 const MODULE_EXT = new Set([".js", ".mjs", ".wasm"]);
 function walk(dir, base = dir) {
@@ -62,7 +63,7 @@ export async function applyRemoteMigrations(root, api) {
  * Probes the live URL after an upload, the same checks the builder runs after a git build.
  * Informational: the app is already live, so findings are printed, never thrown.
  */
-async function probeAfterDeploy(deployment, url, skip) {
+async function probeAfterDeploy(root, deployment, url, skip) {
     if (skip)
         return skippedProbe("--skip-probe was given");
     if (deployment.status !== "live")
@@ -71,7 +72,7 @@ async function probeAfterDeploy(deployment, url, skip) {
     // headers or routes; probing that would report false auth failures. Wait, and say so when it never came.
     if (!(await waitForDeployment(url)))
         return skippedProbe("the app had not started answering within 30 seconds; open the URL to check, or run nerd deploy again to probe it");
-    return probeDeployment(url);
+    return probeDeployment(url, undefined, { lockedGets: lockedGetPaths(root) });
 }
 function printProbe(url, probes) {
     if (probes.status === "skip")
@@ -183,7 +184,7 @@ export async function shipBuild(args) {
     log.ok(`Deployed ${deployment.id} (${deployment.status}) → ${project.url}`);
     if (!opts["skip-probe"] && deployment.status === "live")
         log.step(`Probing ${project.url}`);
-    const probes = await probeAfterDeploy(deployment, project.url, Boolean(opts["skip-probe"]));
+    const probes = await probeAfterDeploy(root, deployment, project.url, Boolean(opts["skip-probe"]));
     return { deployment, url: project.url, migrations: mig, probes, source, sourceSkipped, lineage, warnings: pack.warnings };
 }
 /** The one line about the code after a live deploy, keyed on what the API recorded, not on what we sent. */

package/dist/commands/init.js

@@ -183,4 +183,4 @@ export async function init(dir, args) {
     log.ok(`Ready. Next:\n  cd ${dir}\n  pnpm install\n  nerd dev\n\nThen open the folder in your coding agent and ask it to build the first feature; the nerdsystem skill walks it through.\nDeploys go to ${project.url}`);
 }
 // Kept in sync with packages/sdk/package.json by the release script.
-const SDK_VERSION = "0.0.14";
+const SDK_VERSION = "0.0.16";

package/dist/gates/index.js

@@ -2,6 +2,7 @@ import { bundleGate, finding, secretsGate } from "./secrets.js";
 import { depsGate, piiGate, policyGate, rulesGate, typecheckGate } from "./code.js";
 import { gitleaksGate, semgrepGate } from "./tools.js";
 import { suppressionsGate } from "./suppressions.js";
+import { staticGate } from "./static.js";
 import { testsGate } from "./tests.js";
 import { applyAttempts, MAX_ATTEMPTS } from "./attempts.js";
 export { gateSummary, skippedGates } from "./types.js";
@@ -10,7 +11,7 @@ export { mask } from "./secrets.js";
 export { MAX_ATTEMPTS, readAttempts } from "./attempts.js";
 export { probeDeployment, skippedProbe, waitForDeployment } from "./smoke.js";
 /** Gates that run on source, before the build. Suppressions first so a human sees them before anything else. */
-export const SOURCE_GATES = [suppressionsGate, secretsGate, gitleaksGate, depsGate, rulesGate, semgrepGate, policyGate, piiGate, typecheckGate, testsGate];
+export const SOURCE_GATES = [suppressionsGate, secretsGate, gitleaksGate, depsGate, rulesGate, staticGate, semgrepGate, policyGate, piiGate, typecheckGate, testsGate];
 /** Gates that need the built output. */
 export const BUILD_GATES = [bundleGate, policyGate];
 function selectGates(gates, onlyRules) {

package/dist/gates/rules.js

@@ -36,6 +36,16 @@ export const RULES = {
     "rules/advisory": { title: "Platform advisory", severity: "warn", audience: "agent", risk: "Not blocking, but the project is missing something the platform expects.", fix: "Follow the instruction in the finding." },
     "rules/shape": { title: "Not in the nerdsystem shape", severity: "warn", audience: "human", risk: "Every app on nerdsystem is one shape: a Vite client, a Hono server on @nerdsystem/sdk, SQLite on D1, and a bucket. This repository is not in that shape. A clean scan says nothing about whether it would deploy here.", fix: "Start a project with `nerd init` and have the agent port the screens into it. The server and the login are rebuilt on the platform's sign-in and database. The compare pages on nerdsystem.com say what carries over." },
     "typecheck/error": { title: "TypeScript error", severity: "block", audience: "agent", risk: "The code would not compile reliably; the build may fail or behave unexpectedly.", fix: "Fix the type error at the file and line shown. Run `npx tsc -b` for the full message." },
+    "code/raw-sql": { title: "SQL built from values", severity: "block", audience: "agent", risk: "A value from a request placed straight into SQL lets a visitor rewrite the query and read or delete other people's data.", fix: "Use the Drizzle query builder, or bind values as parameters (`.prepare(\"... where id = ?\").bind(id)`). Never put a variable inside the SQL text.", example: { wrong: "c.env.DB.prepare(`select * from notes where id = ${id}`)", right: "db(c.env.DB).select().from(schema.notes).where(eq(schema.notes.id, id))" } },
+    "code/eval": { title: "eval or new Function", severity: "block", audience: "agent", risk: "Running text as code lets anyone who can influence that text run their own code in the app.", fix: "Remove it. Parse data with JSON.parse and choose behaviour with ordinary code." },
+    "code/password-in-app": { title: "Password handling in app code", severity: "block", audience: "agent", risk: "Storing or comparing passwords yourself is unnecessary here and easy to get wrong.", fix: "Remove it. Sign-in is provided by the platform: read the signed-in user from `c.var.user` and protect routes with `requireAuth()`.", example: { wrong: "if (user.password === body.password) { ... }", right: "app.get(\"/api/me\", requireAuth(), (c) => c.json(c.var.user));" } },
+    "code/tokens-in-app": { title: "Signing or verifying tokens in app code", severity: "warn", audience: "agent", risk: "A second token system beside the platform's sessions is a second way in, and a common source of mistakes.", fix: "Use the session the SDK provides (`c.var.user`). If a third-party service requires its own signed token, keep that code in one file and say so to the person." },
+    "code/html-from-data": { title: "HTML built from data", severity: "warn", audience: "agent", risk: "Text a user typed, rendered as HTML, can carry a script that runs in other users' browsers.", fix: "Render the value as text and let React escape it. Do not use `dangerouslySetInnerHTML` or `innerHTML` with anything that is not a fixed string." },
+    "code/open-redirect": { title: "Redirect to an address from the request", severity: "warn", audience: "agent", risk: "A link to your app could send people on to a look-alike site.", fix: "Redirect only to paths inside the app: check that the value starts with a single `/` and is one of the pages you expect." },
+    "code/fetch-user-url": { title: "Fetching an address from the request", severity: "warn", audience: "agent", risk: "A visitor could make the server fetch addresses it should not reach.", fix: "Fetch only fixed addresses, or check the host against a short list you wrote." },
+    "code/weak-random": { title: "Math.random used for a secret", severity: "warn", audience: "agent", risk: "Math.random is predictable, so a token or code made with it can be guessed.", fix: "Use `crypto.randomUUID()` or `crypto.getRandomValues()`." },
+    "code/unvalidated-body": { title: "A request body read without a check", severity: "warn", audience: "agent", risk: "Fields of any type or size reach the route, which is how bad data and oversized input get into the database.", fix: "Read it with `readBody(c, schema)` from `@nerdsystem/sdk` and a zod schema that gives every field a type and a limit. It answers 400 for anything else.", example: { wrong: "const body = await c.req.json();", right: "const input = await readBody(c, z.object({ title: z.string().trim().min(1).max(200) }));" } },
+    "code/routes-open-by-default": { title: "Routes are open unless each one is protected", severity: "warn", audience: "agent", risk: "A route added without `requireAuth()` answers everyone on the internet.", fix: "Pass the list of public routes to `createNerdApp({ public: [\"GET /api/health\"] })` (needs @nerdsystem/sdk 0.0.15 or later). Every other route then requires sign-in automatically. Run the tests afterwards: a route that was meant to be public must be on the list." },
     "tests/missing": { title: "No access tests", severity: "warn", audience: "agent", risk: "Nothing checks that a signed-out visitor is refused, or that one user cannot reach another user's data. Those are the two mistakes that expose people's records, and nobody looking at the screen can see them.", fix: "Add the access tests: update @nerdsystem/sdk to the latest version, add vitest as a dev dependency with a `test` script (`vitest run`), and copy `test/setup.ts`, `test/global-setup.ts`, `test/access.test.ts`, and `vitest.config.ts` from a fresh `npx nerdsystem init` app. Then write one owner test for each route with an id in its path, set `\"tests\": \"required\"` in nerd.json, and run `nerd check`." },
     "tests/required-missing": { title: "Access tests are missing", severity: "block", audience: "agent", risk: "This app is set to require access tests and has none, so nothing checks that a signed-out visitor is refused or that one user cannot reach another user's data.", fix: "Restore `test/access.test.ts` and the `test` script (`vitest run`) in package.json. Do not remove `\"tests\": \"required\"` from nerd.json to get past this." },
     "tests/not-installed": { title: "Dependencies are not installed", severity: "block", audience: "agent", risk: "The tests cannot run, so nothing has been checked.", fix: "Run `pnpm install`, then `nerd check` again." },
@@ -60,6 +70,7 @@ export const RULES = {
     "gates/retry-cap": { title: "Automatic fixing stopped after three attempts", severity: "block", audience: "human", risk: "The same rule has failed three runs in a row; further automatic attempts are unlikely to help and may make things worse.", fix: "Read the findings above and decide: fix it by hand, ask the agent a different way, or approve a suppression in the dashboard if the finding is wrong." },
     "smoke/unreachable": { title: "Deployed app did not respond", severity: "block", audience: "human", risk: "The app is not serving requests.", fix: "Check `nerd logs` for startup errors and the deployment status." },
     "smoke/header-missing": { title: "A security header is missing", severity: "warn", audience: "agent", risk: "Browsers lose a protection against clickjacking, content sniffing, or script injection.", fix: "Keep createNerdApp()'s default security headers; if you disabled them, re-enable or set the header yourself." },
+    "smoke/route-open": { title: "A locked route answers strangers on the live app", severity: "block", audience: "agent", risk: "A route the tests found locked is answering signed-out visitors on the live app, so its data may be readable by anyone right now.", fix: "Run `nerd rollback` to return to the previous version now. Then find why the live app differs from the tests (a route registered only in production, or the `public` list in `createNerdApp`), fix it, and deploy again." },
     "smoke/auth-me": { title: "Session endpoint misbehaves", severity: "block", audience: "agent", risk: "Visitors cannot tell whether they are signed in, so the app's login flow is broken.", fix: "/api/auth/me must return 200 with {user:null} when signed out. Do not override the SDK's auth routes." },
     "smoke/auth-login": { title: "Wrong credentials are not rejected", severity: "block", audience: "agent", risk: "The login endpoint does not return 401 for a wrong password.", fix: "Do not override the SDK's /api/auth/login route." },
 };

package/dist/gates/smoke.d.ts

@@ -12,7 +12,12 @@ export declare function waitForDeployment(url: string, opts?: {
 /**
  * Runs the live-URL probes: security headers on GET /, GET /api/auth/me answers 200 with
  * {"user":null} when signed out, and POST /api/auth/login with wrong credentials answers 401.
+ * With `lockedGets` (paths the app's access tests found locked), each is also fetched signed out on
+ * the live app and must still answer 401 or 403: the same question the tests asked, put to the real
+ * thing. Only GETs are tried, so a probe can never change anyone's data.
  */
-export declare function probeDeployment(url: string, fetchImpl?: FetchLike): Promise<GateResult>;
+export declare function probeDeployment(url: string, fetchImpl?: FetchLike, opts?: {
+    lockedGets?: string[];
+}): Promise<GateResult>;
 /** The result recorded when the probe did not run, so --json consumers see why rather than a missing key. */
 export declare function skippedProbe(reason: string): GateResult;

package/dist/gates/smoke.js

@@ -7,6 +7,8 @@
 import { finding, fingerprint } from "./secrets.js";
 import { verdict } from "./types.js";
 const PROBE_TIMEOUT_MS = 10_000;
+/** Most routes fetched signed out after a deploy. */
+const MAX_ROUTE_PROBES = 25;
 const REQUIRED_HEADERS = ["x-content-type-options", "content-security-policy", "x-frame-options"];
 /** Default fetch wrapped so it is never called with a foreign `this` (workerd throws "Illegal invocation"). */
 const defaultFetch = (input, init) => fetch(input, init);
@@ -51,8 +53,11 @@ export async function waitForDeployment(url, opts = {}) {
 /**
  * Runs the live-URL probes: security headers on GET /, GET /api/auth/me answers 200 with
  * {"user":null} when signed out, and POST /api/auth/login with wrong credentials answers 401.
+ * With `lockedGets` (paths the app's access tests found locked), each is also fetched signed out on
+ * the live app and must still answer 401 or 403: the same question the tests asked, put to the real
+ * thing. Only GETs are tried, so a probe can never change anyone's data.
  */
-export async function probeDeployment(url, fetchImpl = defaultFetch) {
+export async function probeDeployment(url, fetchImpl = defaultFetch, opts = {}) {
     const startedAt = Date.now();
     const base = url.replace(/\/$/, "");
     const findings = [];
@@ -93,6 +98,15 @@ export async function probeDeployment(url, fetchImpl = defaultFetch) {
         if (login.status !== 401)
             findings.push(smokeFinding("smoke/auth-login", `Wrong credentials returned ${login.status} instead of 401.`, "/api/auth/login"));
     }
+    for (const p of (opts.lockedGets ?? []).slice(0, MAX_ROUTE_PROBES)) {
+        const res = await get(p);
+        if (!res)
+            continue;
+        await res.body?.cancel().catch(() => { });
+        if (res.status !== 401 && res.status !== 403) {
+            findings.push(smokeFinding("smoke/route-open", `GET ${p} answered ${res.status} to a signed-out visitor on the live app, although the tests found it locked.`, `route:${p}`));
+        }
+    }
     return probeResult(findings, startedAt);
 }
 /** The result recorded when the probe did not run, so --json consumers see why rather than a missing key. */

package/dist/gates/static.d.ts

@@ -0,0 +1,2 @@
+import { type Gate } from "./types.js";
+export declare const staticGate: Gate;

package/dist/gates/static.js

@@ -0,0 +1,58 @@
+import { lineOf, sourceFiles } from "./fs.js";
+import { finding } from "./secrets.js";
+import { counts, result, verdict } from "./types.js";
+const SERVER = /^src\/server\//;
+/**
+ * The patterns semgrep's nerdsystem rules look for (packages/cli/rules/semgrep.yml), as plain text
+ * matching, so they run on every machine and every deploy without anything installed. Semgrep reads the
+ * code's structure and stays the more exact tool where it runs; these are deliberately narrow so they
+ * do not cry wolf. Three block, as the same semgrep rules do; the rest warn.
+ */
+const CHECKS = [
+    // SQL assembled from values: a template with ${} or a string joined with +, handed to prepare/exec/sql.raw.
+    { rule: "code/raw-sql", re: /(\.prepare|\.exec|sql\.raw)\(\s*(`[^`]*\$\{|["'][^"'\n]*["']\s*\+)/g },
+    { rule: "code/eval", re: /(^|[^.\w])eval\s*\(|\bnew\s+Function\s*\(/g },
+    { rule: "code/password-in-app", re: /\.password\s*={2,3}|={2,3}\s*\w+\.password\b|\b(bcrypt|bcryptjs|argon2)\.(compare|hash|verify)\w*\s*\(|from\s+["'](bcrypt|bcryptjs|argon2)["']/g, files: SERVER },
+    { rule: "code/tokens-in-app", re: /\bjwt\.(sign|verify)\s*\(|from\s+["'](jsonwebtoken|jose|hono\/jwt)["']/g, files: SERVER },
+    { rule: "code/html-from-data", re: /dangerouslySetInnerHTML\s*=\s*\{\{\s*__html\s*:(?!\s*["'][^"'\n]*["']\s*\}\})|\.innerHTML\s*\+?=(?![=])(?!\s*["'][^"'\n]*["']\s*(;|\n|$))/g },
+    { rule: "code/open-redirect", re: /\.redirect\(\s*(c\.req\.(query|param|header)\(|\(?await\s+c\.req\.)/g, files: SERVER },
+    { rule: "code/fetch-user-url", re: /\bfetch\(\s*(c\.req\.(query|param|header)\(|\(?await\s+c\.req\.)/g, files: SERVER },
+    { rule: "code/weak-random", re: /\b\w*(token|secret|nonce|otp|passcode|apikey|api_key)\w*\s*[:=][^;\n]*Math\.random\(\)/gi },
+    // An unchecked body: c.req.json() used directly instead of readBody(c, schema).
+    { rule: "code/unvalidated-body", re: /\bc\.req\.(json|parseBody|formData)\(\)/g, files: SERVER },
+];
+/** Blanks out comments, keeping every character position, so a pattern inside a comment is not a finding. */
+function withoutComments(text) {
+    return text.replace(/\/\*[\s\S]*?\*\/|(^|[^:"'`\\])\/\/[^\n]*/g, (m) => m.replace(/[^\n]/g, " "));
+}
+export const staticGate = {
+    name: "static",
+    title: "Unsafe code patterns",
+    blocking: true,
+    rulePrefixes: ["code/"],
+    async run(ctx) {
+        const t = Date.now();
+        const findings = [];
+        for (const f of sourceFiles(ctx.root)) {
+            if (!/\.(ts|tsx|js|jsx|mjs)$/.test(f.rel) || !f.rel.startsWith("src/"))
+                continue;
+            const text = withoutComments(f.text);
+            for (const c of CHECKS) {
+                if (c.files && !c.files.test(f.rel))
+                    continue;
+                c.re.lastIndex = 0;
+                let m;
+                let perFile = 0;
+                while ((m = c.re.exec(text)) && perFile < 10) {
+                    findings.push(finding(c.rule, { file: f.rel, line: lineOf(text, m.index) }));
+                    perFile++;
+                }
+            }
+            // Sign-in for every route is opt-in for apps created before it existed; say so until it is on.
+            if (f.rel === "src/server/index.ts" && /createNerdApp\s*(<[^>]*>)?\s*\(/.test(text) && !/createNerdApp\s*(<[^>]*>)?\s*\(\s*\{[\s\S]*?\bpublic\s*:/.test(text)) {
+                findings.push(finding("code/routes-open-by-default", { file: f.rel }));
+            }
+        }
+        return result(this, verdict(findings), findings.length ? counts(findings) : "Nothing unsafe found", findings, t);
+    },
+};

package/dist/gates/tests.d.ts

@@ -4,6 +4,11 @@ import { type Gate } from "./types.js";
  * characters a "METHOD /path" needs survive and the length is capped: a route cannot carry a sentence.
  */
 export declare function safeRoute(name: unknown): string | null;
+/**
+ * Concrete paths for the GET routes the last test run found locked, for the live probe after a deploy:
+ * every `:param` becomes "1". Empty when there is no report (an app without access tests).
+ */
+export declare function lockedGetPaths(root: string): string[];
 /**
  * Runs the app's own tests and reads what they checked about access. The person who owns the app cannot
  * read the code, and the agent that forgot a sign-in check tends to forget the test for it too, so the

package/dist/gates/tests.js

@@ -26,6 +26,18 @@ function readJson(file) {
         return null;
     }
 }
+/**
+ * Concrete paths for the GET routes the last test run found locked, for the live probe after a deploy:
+ * every `:param` becomes "1". Empty when there is no report (an app without access tests).
+ */
+export function lockedGetPaths(root) {
+    const report = readJson(path.join(root, REPORT));
+    if (!report || report.everyRouteChecked !== true)
+        return [];
+    return list(report.locked)
+        .filter((r) => r.startsWith("GET ") && !r.includes("*"))
+        .map((r) => r.slice(4).split("/").map((seg) => (seg.startsWith(":") ? "1" : seg)).join("/"));
+}
 /** True when a file under test/ uses the SDK's harness, which is what writes the access report. */
 function hasHarnessTests(root) {
     const dir = path.join(root, "test");
@@ -62,10 +74,6 @@ export const testsGate = {
             const f = finding(required ? "tests/required-missing" : "tests/missing", { file: "test/access.test.ts" });
             return result(this, required ? "fail" : "warn", "No access tests in this app", [f], t);
         }
-        // Git builds do not run this yet (the build container has not been proven to run the local database);
-        // the terminal path, which every `nerd deploy` takes, does.
-        if (ctx.committed)
-            return result(this, "skip", "Runs before `nerd deploy`; not yet part of git builds", [], t);
         if (!existsSync(path.join(ctx.root, "node_modules"))) {
             return result(this, "fail", "Dependencies are not installed", [finding("tests/not-installed", {})], t);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nerdsystem",
-  "version": "0.0.14",
+  "version": "0.0.16",
   "description": "nerd: start, check, and deploy a web app on nerdsystem from the terminal or a coding agent.",
   "type": "module",
   "bin": {

package/template/.claude/skills/nerdsystem/SKILL.md

@@ -36,7 +36,7 @@ Tell the person plainly what does not carry. Their users sign up again on the ne
 1. Make the change, and write or update its tests in the same step (see "Build it so it is safe and it works").
 2. `nerd check` (static rules, typecheck, then the tests and access checks). Fix anything it reports.
 3. `nerd dev` to run locally when you need to try it. The local app talks to the real auth service, so signup and login work exactly as in production.
-4. `nerd deploy` when it is ready. It runs the checks, builds, stores a copy of the code, applies pending migrations, uploads, prints the URL, and probes the live URL (headers and the sign-in routes). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
+4. `nerd deploy` when it is ready. It runs the checks, builds, stores a copy of the code, applies pending migrations, uploads, prints the URL, and probes the live URL (headers, the sign-in routes, and a signed-out GET of every route the tests found locked; a `smoke/route-open` finding means a locked route is answering strangers on the live app, so run `nerd rollback` first and investigate second). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
 
 Run `nerd check --json` when you want a machine-readable list of problems. Its summary says how many gates ran and which were skipped (`skipped` in the JSON): semgrep and gitleaks only run locally when installed; git builds always run them in the builder.
@@ -99,10 +99,10 @@ Then in `src/server/index.ts`: `app.route("/api/notes", notes);`
 
 The person you are building for usually cannot read code. They will not spot a missing sign-in check or a query that returns someone else's rows, and neither will anyone looking at the screen. So the standard is yours to hold, every time, without being asked:
 
-1. **Lock every route first.** Put `requireAuth()` or `requireRole(...)` in front of every route as middleware, before any input is read (`router.use("*", requireAuth())` for a whole router). A route is public only when everyone on the internet is meant to reach it and it returns nothing private; then add it to the `public` list in `test/access.test.ts` and tell the person in plain words that it is open.
+1. **Every route is locked unless you open it.** `createNerdApp({ public: [...] })` in `src/server/index.ts` makes every route require a signed-in user except the ones named in that list, so a route you forget to protect answers 401 instead of answering everyone. Still put `requireAuth()` on each router (`router.use("*", requireAuth())`) and `requireRole(...)` where a role is needed: it says what the route expects and gives TypeScript a user. A route is public only when everyone on the internet is meant to reach it and it returns nothing private; then add it to the `public` list in `src/server/index.ts` and to the same list in `test/access.test.ts`, and tell the person in plain words that it is open. Never remove the `public` option or widen it to get something working.
 2. **Scope every query to the signed-in user.** Reads, updates, and deletes on user data filter on `c.var.user.id`. On a route with an id in its path, put the id and the user id in the same `where`, and answer 404 when nothing matches, so someone else's row looks like it does not exist.
 3. **Take identity from the session, never from the request.** The user id, the role, a price, an owner: none of these come from the body, the query string, or a header the browser sends. Read the user from `c.var.user` and look the rest up on the server.
-4. **Check every input on the server.** Type, length, range, and allowed values, for every field of every body, query, and path parameter. Answer 400 with the usual error shape. The client's own checks are for the person's convenience; they protect nothing.
+4. **Check every input on the server.** Read a body with `readBody(c, schema)` and a query string with `readQuery(c, schema)` from `@nerdsystem/sdk`, with a zod schema that gives every field a type, a length, a range, or a list of allowed values (see `src/server/routes/todos.ts`). They answer 400 in the usual error shape for anything else, before your code runs. Do not call `c.req.json()` directly; `nerd check` flags it. Path parameters get the same care: turn an id into a number and let a missing row be a 404. The client's own checks are for the person's convenience; they protect nothing.
 5. **Hiding a button is not access control.** If only admins may do something, the route says `requireRole("admin")`. What the page shows is decoration.
 6. **Files:** check the type and the size before writing to `c.env.STORAGE`, store under a key that starts with the owner's user id, and serve them through a route that checks the owner. Never build a key from a name the browser sent without cleaning it.
 7. **Say nothing useful in an error.** No stack traces, SQL, or internal ids in responses; log them with `console.error` and answer with `{ error: { code, message } }`.
@@ -161,6 +161,7 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 - New bindings in `wrangler.jsonc`. Only `DB`, `STORAGE`, and `ASSETS` exist. Durable Objects are not available.
 - Scripts that call `wrangler deploy`, `wrangler secret`, or remote `wrangler d1` commands.
 - Typecheck failures in either `src/server` or `src/client`.
+- SQL built from values, `eval` or `new Function`, and password handling in server code (the `code/` rules; they block). It also flags, without blocking: tokens signed in app code, HTML built from data, redirects and fetches to an address from the request, `Math.random` for a secret, a body read without `readBody`, and an app that has not turned on `public` in `createNerdApp`.
 - A failing test, a missing access sweep, or a route with an id that no second user was tried against (the `tests/` rules above).
 
 ## Scheduled jobs and email

package/template/.cursor/rules/nerdsystem.mdc

@@ -2,7 +2,7 @@
 description: How to build, run, and deploy this app on nerdsystem. Applies to server, database, auth, and deploy work.
 alwaysApply: true
 ---
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (37f79c2cf2a8); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (e719563eac29); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -37,7 +37,7 @@ Tell the person plainly what does not carry. Their users sign up again on the ne
 1. Make the change, and write or update its tests in the same step (see "Build it so it is safe and it works").
 2. `nerd check` (static rules, typecheck, then the tests and access checks). Fix anything it reports.
 3. `nerd dev` to run locally when you need to try it. The local app talks to the real auth service, so signup and login work exactly as in production.
-4. `nerd deploy` when it is ready. It runs the checks, builds, stores a copy of the code, applies pending migrations, uploads, prints the URL, and probes the live URL (headers and the sign-in routes). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
+4. `nerd deploy` when it is ready. It runs the checks, builds, stores a copy of the code, applies pending migrations, uploads, prints the URL, and probes the live URL (headers, the sign-in routes, and a signed-out GET of every route the tests found locked; a `smoke/route-open` finding means a locked route is answering strangers on the live app, so run `nerd rollback` first and investigate second). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
 
 Run `nerd check --json` when you want a machine-readable list of problems. Its summary says how many gates ran and which were skipped (`skipped` in the JSON): semgrep and gitleaks only run locally when installed; git builds always run them in the builder.
@@ -100,10 +100,10 @@ Then in `src/server/index.ts`: `app.route("/api/notes", notes);`
 
 The person you are building for usually cannot read code. They will not spot a missing sign-in check or a query that returns someone else's rows, and neither will anyone looking at the screen. So the standard is yours to hold, every time, without being asked:
 
-1. **Lock every route first.** Put `requireAuth()` or `requireRole(...)` in front of every route as middleware, before any input is read (`router.use("*", requireAuth())` for a whole router). A route is public only when everyone on the internet is meant to reach it and it returns nothing private; then add it to the `public` list in `test/access.test.ts` and tell the person in plain words that it is open.
+1. **Every route is locked unless you open it.** `createNerdApp({ public: [...] })` in `src/server/index.ts` makes every route require a signed-in user except the ones named in that list, so a route you forget to protect answers 401 instead of answering everyone. Still put `requireAuth()` on each router (`router.use("*", requireAuth())`) and `requireRole(...)` where a role is needed: it says what the route expects and gives TypeScript a user. A route is public only when everyone on the internet is meant to reach it and it returns nothing private; then add it to the `public` list in `src/server/index.ts` and to the same list in `test/access.test.ts`, and tell the person in plain words that it is open. Never remove the `public` option or widen it to get something working.
 2. **Scope every query to the signed-in user.** Reads, updates, and deletes on user data filter on `c.var.user.id`. On a route with an id in its path, put the id and the user id in the same `where`, and answer 404 when nothing matches, so someone else's row looks like it does not exist.
 3. **Take identity from the session, never from the request.** The user id, the role, a price, an owner: none of these come from the body, the query string, or a header the browser sends. Read the user from `c.var.user` and look the rest up on the server.
-4. **Check every input on the server.** Type, length, range, and allowed values, for every field of every body, query, and path parameter. Answer 400 with the usual error shape. The client's own checks are for the person's convenience; they protect nothing.
+4. **Check every input on the server.** Read a body with `readBody(c, schema)` and a query string with `readQuery(c, schema)` from `@nerdsystem/sdk`, with a zod schema that gives every field a type, a length, a range, or a list of allowed values (see `src/server/routes/todos.ts`). They answer 400 in the usual error shape for anything else, before your code runs. Do not call `c.req.json()` directly; `nerd check` flags it. Path parameters get the same care: turn an id into a number and let a missing row be a 404. The client's own checks are for the person's convenience; they protect nothing.
 5. **Hiding a button is not access control.** If only admins may do something, the route says `requireRole("admin")`. What the page shows is decoration.
 6. **Files:** check the type and the size before writing to `c.env.STORAGE`, store under a key that starts with the owner's user id, and serve them through a route that checks the owner. Never build a key from a name the browser sent without cleaning it.
 7. **Say nothing useful in an error.** No stack traces, SQL, or internal ids in responses; log them with `console.error` and answer with `{ error: { code, message } }`.
@@ -162,6 +162,7 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 - New bindings in `wrangler.jsonc`. Only `DB`, `STORAGE`, and `ASSETS` exist. Durable Objects are not available.
 - Scripts that call `wrangler deploy`, `wrangler secret`, or remote `wrangler d1` commands.
 - Typecheck failures in either `src/server` or `src/client`.
+- SQL built from values, `eval` or `new Function`, and password handling in server code (the `code/` rules; they block). It also flags, without blocking: tokens signed in app code, HTML built from data, redirects and fetches to an address from the request, `Math.random` for a secret, a body read without `readBody`, and an app that has not turned on `public` in `createNerdApp`.
 - A failing test, a missing access sweep, or a route with an id that no second user was tried against (the `tests/` rules above).
 
 ## Scheduled jobs and email

package/template/.github/copilot-instructions.md

@@ -1,4 +1,4 @@
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (37f79c2cf2a8); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (e719563eac29); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -33,7 +33,7 @@ Tell the person plainly what does not carry. Their users sign up again on the ne
 1. Make the change, and write or update its tests in the same step (see "Build it so it is safe and it works").
 2. `nerd check` (static rules, typecheck, then the tests and access checks). Fix anything it reports.
 3. `nerd dev` to run locally when you need to try it. The local app talks to the real auth service, so signup and login work exactly as in production.
-4. `nerd deploy` when it is ready. It runs the checks, builds, stores a copy of the code, applies pending migrations, uploads, prints the URL, and probes the live URL (headers and the sign-in routes). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
+4. `nerd deploy` when it is ready. It runs the checks, builds, stores a copy of the code, applies pending migrations, uploads, prints the URL, and probes the live URL (headers, the sign-in routes, and a signed-out GET of every route the tests found locked; a `smoke/route-open` finding means a locked route is answering strangers on the live app, so run `nerd rollback` first and investigate second). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
 
 Run `nerd check --json` when you want a machine-readable list of problems. Its summary says how many gates ran and which were skipped (`skipped` in the JSON): semgrep and gitleaks only run locally when installed; git builds always run them in the builder.
@@ -96,10 +96,10 @@ Then in `src/server/index.ts`: `app.route("/api/notes", notes);`
 
 The person you are building for usually cannot read code. They will not spot a missing sign-in check or a query that returns someone else's rows, and neither will anyone looking at the screen. So the standard is yours to hold, every time, without being asked:
 
-1. **Lock every route first.** Put `requireAuth()` or `requireRole(...)` in front of every route as middleware, before any input is read (`router.use("*", requireAuth())` for a whole router). A route is public only when everyone on the internet is meant to reach it and it returns nothing private; then add it to the `public` list in `test/access.test.ts` and tell the person in plain words that it is open.
+1. **Every route is locked unless you open it.** `createNerdApp({ public: [...] })` in `src/server/index.ts` makes every route require a signed-in user except the ones named in that list, so a route you forget to protect answers 401 instead of answering everyone. Still put `requireAuth()` on each router (`router.use("*", requireAuth())`) and `requireRole(...)` where a role is needed: it says what the route expects and gives TypeScript a user. A route is public only when everyone on the internet is meant to reach it and it returns nothing private; then add it to the `public` list in `src/server/index.ts` and to the same list in `test/access.test.ts`, and tell the person in plain words that it is open. Never remove the `public` option or widen it to get something working.
 2. **Scope every query to the signed-in user.** Reads, updates, and deletes on user data filter on `c.var.user.id`. On a route with an id in its path, put the id and the user id in the same `where`, and answer 404 when nothing matches, so someone else's row looks like it does not exist.
 3. **Take identity from the session, never from the request.** The user id, the role, a price, an owner: none of these come from the body, the query string, or a header the browser sends. Read the user from `c.var.user` and look the rest up on the server.
-4. **Check every input on the server.** Type, length, range, and allowed values, for every field of every body, query, and path parameter. Answer 400 with the usual error shape. The client's own checks are for the person's convenience; they protect nothing.
+4. **Check every input on the server.** Read a body with `readBody(c, schema)` and a query string with `readQuery(c, schema)` from `@nerdsystem/sdk`, with a zod schema that gives every field a type, a length, a range, or a list of allowed values (see `src/server/routes/todos.ts`). They answer 400 in the usual error shape for anything else, before your code runs. Do not call `c.req.json()` directly; `nerd check` flags it. Path parameters get the same care: turn an id into a number and let a missing row be a 404. The client's own checks are for the person's convenience; they protect nothing.
 5. **Hiding a button is not access control.** If only admins may do something, the route says `requireRole("admin")`. What the page shows is decoration.
 6. **Files:** check the type and the size before writing to `c.env.STORAGE`, store under a key that starts with the owner's user id, and serve them through a route that checks the owner. Never build a key from a name the browser sent without cleaning it.
 7. **Say nothing useful in an error.** No stack traces, SQL, or internal ids in responses; log them with `console.error` and answer with `{ error: { code, message } }`.
@@ -158,6 +158,7 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 - New bindings in `wrangler.jsonc`. Only `DB`, `STORAGE`, and `ASSETS` exist. Durable Objects are not available.
 - Scripts that call `wrangler deploy`, `wrangler secret`, or remote `wrangler d1` commands.
 - Typecheck failures in either `src/server` or `src/client`.
+- SQL built from values, `eval` or `new Function`, and password handling in server code (the `code/` rules; they block). It also flags, without blocking: tokens signed in app code, HTML built from data, redirects and fetches to an address from the request, `Math.random` for a secret, a body read without `readBody`, and an app that has not turned on `public` in `createNerdApp`.
 - A failing test, a missing access sweep, or a route with an id that no second user was tried against (the `tests/` rules above).
 
 ## Scheduled jobs and email

package/template/AGENTS.md

@@ -1,4 +1,4 @@
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (37f79c2cf2a8); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (e719563eac29); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -33,7 +33,7 @@ Tell the person plainly what does not carry. Their users sign up again on the ne
 1. Make the change, and write or update its tests in the same step (see "Build it so it is safe and it works").
 2. `nerd check` (static rules, typecheck, then the tests and access checks). Fix anything it reports.
 3. `nerd dev` to run locally when you need to try it. The local app talks to the real auth service, so signup and login work exactly as in production.
-4. `nerd deploy` when it is ready. It runs the checks, builds, stores a copy of the code, applies pending migrations, uploads, prints the URL, and probes the live URL (headers and the sign-in routes). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
+4. `nerd deploy` when it is ready. It runs the checks, builds, stores a copy of the code, applies pending migrations, uploads, prints the URL, and probes the live URL (headers, the sign-in routes, and a signed-out GET of every route the tests found locked; a `smoke/route-open` finding means a locked route is answering strangers on the live app, so run `nerd rollback` first and investigate second). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
 
 Run `nerd check --json` when you want a machine-readable list of problems. Its summary says how many gates ran and which were skipped (`skipped` in the JSON): semgrep and gitleaks only run locally when installed; git builds always run them in the builder.
@@ -96,10 +96,10 @@ Then in `src/server/index.ts`: `app.route("/api/notes", notes);`
 
 The person you are building for usually cannot read code. They will not spot a missing sign-in check or a query that returns someone else's rows, and neither will anyone looking at the screen. So the standard is yours to hold, every time, without being asked:
 
-1. **Lock every route first.** Put `requireAuth()` or `requireRole(...)` in front of every route as middleware, before any input is read (`router.use("*", requireAuth())` for a whole router). A route is public only when everyone on the internet is meant to reach it and it returns nothing private; then add it to the `public` list in `test/access.test.ts` and tell the person in plain words that it is open.
+1. **Every route is locked unless you open it.** `createNerdApp({ public: [...] })` in `src/server/index.ts` makes every route require a signed-in user except the ones named in that list, so a route you forget to protect answers 401 instead of answering everyone. Still put `requireAuth()` on each router (`router.use("*", requireAuth())`) and `requireRole(...)` where a role is needed: it says what the route expects and gives TypeScript a user. A route is public only when everyone on the internet is meant to reach it and it returns nothing private; then add it to the `public` list in `src/server/index.ts` and to the same list in `test/access.test.ts`, and tell the person in plain words that it is open. Never remove the `public` option or widen it to get something working.
 2. **Scope every query to the signed-in user.** Reads, updates, and deletes on user data filter on `c.var.user.id`. On a route with an id in its path, put the id and the user id in the same `where`, and answer 404 when nothing matches, so someone else's row looks like it does not exist.
 3. **Take identity from the session, never from the request.** The user id, the role, a price, an owner: none of these come from the body, the query string, or a header the browser sends. Read the user from `c.var.user` and look the rest up on the server.
-4. **Check every input on the server.** Type, length, range, and allowed values, for every field of every body, query, and path parameter. Answer 400 with the usual error shape. The client's own checks are for the person's convenience; they protect nothing.
+4. **Check every input on the server.** Read a body with `readBody(c, schema)` and a query string with `readQuery(c, schema)` from `@nerdsystem/sdk`, with a zod schema that gives every field a type, a length, a range, or a list of allowed values (see `src/server/routes/todos.ts`). They answer 400 in the usual error shape for anything else, before your code runs. Do not call `c.req.json()` directly; `nerd check` flags it. Path parameters get the same care: turn an id into a number and let a missing row be a 404. The client's own checks are for the person's convenience; they protect nothing.
 5. **Hiding a button is not access control.** If only admins may do something, the route says `requireRole("admin")`. What the page shows is decoration.
 6. **Files:** check the type and the size before writing to `c.env.STORAGE`, store under a key that starts with the owner's user id, and serve them through a route that checks the owner. Never build a key from a name the browser sent without cleaning it.
 7. **Say nothing useful in an error.** No stack traces, SQL, or internal ids in responses; log them with `console.error` and answer with `{ error: { code, message } }`.
@@ -158,6 +158,7 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 - New bindings in `wrangler.jsonc`. Only `DB`, `STORAGE`, and `ASSETS` exist. Durable Objects are not available.
 - Scripts that call `wrangler deploy`, `wrangler secret`, or remote `wrangler d1` commands.
 - Typecheck failures in either `src/server` or `src/client`.
+- SQL built from values, `eval` or `new Function`, and password handling in server code (the `code/` rules; they block). It also flags, without blocking: tokens signed in app code, HTML built from data, redirects and fetches to an address from the request, `Math.random` for a secret, a body read without `readBody`, and an app that has not turned on `public` in `createNerdApp`.
 - A failing test, a missing access sweep, or a route with an id that no second user was tried against (the `tests/` rules above).
 
 ## Scheduled jobs and email

package/template/CLAUDE.md

@@ -28,7 +28,8 @@ nerdsystem deploys this app to Cloudflare and provides authentication and author
 5. Keep every API route under `/api/`. Other paths are served from static assets and never reach the Worker.
 6. Do not add Cloudflare bindings to `wrangler.jsonc`, and do not run `wrangler deploy`. Bindings are provisioned by the platform.
 7. Secrets and environment variables for the deployed app are managed with `nerd` commands, never committed.
-8. Every route is locked with `requireAuth()` or `requireRole()` unless it is listed as public in `test/access.test.ts`, and every route with an id in its path has a test showing a second user cannot reach it. Write the tests with the feature. `nerd check` refuses a deploy when they fail or are missing; never weaken one to get through.
+8. Every route requires a signed-in user unless it is named in `createNerdApp({ public: [...] })` and in the same list in `test/access.test.ts`, and every route with an id in its path has a test showing a second user cannot reach it. Write the tests with the feature. `nerd check` refuses a deploy when they fail or are missing; never weaken one to get through.
+9. Read request bodies with `readBody(c, schema)` and a zod schema, never `c.req.json()` directly.
 
 ## Roles
 

package/template/GEMINI.md

@@ -1,4 +1,4 @@
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (37f79c2cf2a8); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (e719563eac29); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -33,7 +33,7 @@ Tell the person plainly what does not carry. Their users sign up again on the ne
 1. Make the change, and write or update its tests in the same step (see "Build it so it is safe and it works").
 2. `nerd check` (static rules, typecheck, then the tests and access checks). Fix anything it reports.
 3. `nerd dev` to run locally when you need to try it. The local app talks to the real auth service, so signup and login work exactly as in production.
-4. `nerd deploy` when it is ready. It runs the checks, builds, stores a copy of the code, applies pending migrations, uploads, prints the URL, and probes the live URL (headers and the sign-in routes). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
+4. `nerd deploy` when it is ready. It runs the checks, builds, stores a copy of the code, applies pending migrations, uploads, prints the URL, and probes the live URL (headers, the sign-in routes, and a signed-out GET of every route the tests found locked; a `smoke/route-open` finding means a locked route is answering strangers on the live app, so run `nerd rollback` first and investigate second). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
 
 Run `nerd check --json` when you want a machine-readable list of problems. Its summary says how many gates ran and which were skipped (`skipped` in the JSON): semgrep and gitleaks only run locally when installed; git builds always run them in the builder.
@@ -96,10 +96,10 @@ Then in `src/server/index.ts`: `app.route("/api/notes", notes);`
 
 The person you are building for usually cannot read code. They will not spot a missing sign-in check or a query that returns someone else's rows, and neither will anyone looking at the screen. So the standard is yours to hold, every time, without being asked:
 
-1. **Lock every route first.** Put `requireAuth()` or `requireRole(...)` in front of every route as middleware, before any input is read (`router.use("*", requireAuth())` for a whole router). A route is public only when everyone on the internet is meant to reach it and it returns nothing private; then add it to the `public` list in `test/access.test.ts` and tell the person in plain words that it is open.
+1. **Every route is locked unless you open it.** `createNerdApp({ public: [...] })` in `src/server/index.ts` makes every route require a signed-in user except the ones named in that list, so a route you forget to protect answers 401 instead of answering everyone. Still put `requireAuth()` on each router (`router.use("*", requireAuth())`) and `requireRole(...)` where a role is needed: it says what the route expects and gives TypeScript a user. A route is public only when everyone on the internet is meant to reach it and it returns nothing private; then add it to the `public` list in `src/server/index.ts` and to the same list in `test/access.test.ts`, and tell the person in plain words that it is open. Never remove the `public` option or widen it to get something working.
 2. **Scope every query to the signed-in user.** Reads, updates, and deletes on user data filter on `c.var.user.id`. On a route with an id in its path, put the id and the user id in the same `where`, and answer 404 when nothing matches, so someone else's row looks like it does not exist.
 3. **Take identity from the session, never from the request.** The user id, the role, a price, an owner: none of these come from the body, the query string, or a header the browser sends. Read the user from `c.var.user` and look the rest up on the server.
-4. **Check every input on the server.** Type, length, range, and allowed values, for every field of every body, query, and path parameter. Answer 400 with the usual error shape. The client's own checks are for the person's convenience; they protect nothing.
+4. **Check every input on the server.** Read a body with `readBody(c, schema)` and a query string with `readQuery(c, schema)` from `@nerdsystem/sdk`, with a zod schema that gives every field a type, a length, a range, or a list of allowed values (see `src/server/routes/todos.ts`). They answer 400 in the usual error shape for anything else, before your code runs. Do not call `c.req.json()` directly; `nerd check` flags it. Path parameters get the same care: turn an id into a number and let a missing row be a 404. The client's own checks are for the person's convenience; they protect nothing.
 5. **Hiding a button is not access control.** If only admins may do something, the route says `requireRole("admin")`. What the page shows is decoration.
 6. **Files:** check the type and the size before writing to `c.env.STORAGE`, store under a key that starts with the owner's user id, and serve them through a route that checks the owner. Never build a key from a name the browser sent without cleaning it.
 7. **Say nothing useful in an error.** No stack traces, SQL, or internal ids in responses; log them with `console.error` and answer with `{ error: { code, message } }`.
@@ -158,6 +158,7 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 - New bindings in `wrangler.jsonc`. Only `DB`, `STORAGE`, and `ASSETS` exist. Durable Objects are not available.
 - Scripts that call `wrangler deploy`, `wrangler secret`, or remote `wrangler d1` commands.
 - Typecheck failures in either `src/server` or `src/client`.
+- SQL built from values, `eval` or `new Function`, and password handling in server code (the `code/` rules; they block). It also flags, without blocking: tokens signed in app code, HTML built from data, redirects and fetches to an address from the request, `Math.random` for a secret, a body read without `readBody`, and an app that has not turned on `public` in `createNerdApp`.
 - A failing test, a missing access sweep, or a route with an id that no second user was tried against (the `tests/` rules above).
 
 ## Scheduled jobs and email

package/template/package.json

@@ -18,7 +18,8 @@
     "drizzle-orm": "^0.45.4",
     "hono": "^4.13.16",
     "react": "^19.3.1",
-    "react-dom": "^19.3.1"
+    "react-dom": "^19.3.1",
+    "zod": "^4.6.7"
   },
   "pnpm": {
     "onlyBuiltDependencies": [

package/template/src/server/index.ts

@@ -3,7 +3,11 @@ import todos from "./routes/todos";
 
 // createNerdApp gives you a Hono app with sessions at /api/auth and c.var.user on every request.
 // Static assets (the React client) are served by the platform for every path outside /api.
-const app = createNerdApp();
+//
+// Every route needs a signed-in user unless it is named in `public`. A route you forget to protect
+// answers 401, not everyone. Add a route here only when the whole internet is meant to reach it and it
+// returns nothing private, and add it to the same list in test/access.test.ts.
+const app = createNerdApp({ public: ["GET /api/health"] });
 
 app.get("/api/health", (c) => c.json({ ok: true, user: c.var.user?.email ?? null }));
 

package/template/src/server/routes/todos.ts

@@ -1,8 +1,13 @@
 import { Hono } from "hono";
 import { and, desc, eq } from "drizzle-orm";
-import { requireAuth, type NerdHonoEnv } from "@nerdsystem/sdk";
+import { z } from "zod";
+import { readBody, requireAuth, type NerdHonoEnv } from "@nerdsystem/sdk";
 import { db, schema } from "../db";
 
+// What each request may contain. readBody() answers 400 for anything else, before the route runs.
+const NewTodo = z.object({ title: z.string().trim().min(1, "title is required").max(200) });
+const TodoChange = z.object({ done: z.boolean() });
+
 // Every route here needs a signed-in user. c.var.user is set by the SDK.
 const todos = new Hono<NerdHonoEnv>();
 todos.use("*", requireAuth());
@@ -18,13 +23,10 @@ todos.get("/", async (c) => {
 });
 
 todos.post("/", async (c) => {
-  const body = (await c.req.json().catch(() => ({}))) as { title?: unknown };
-  if (typeof body.title !== "string" || !body.title.trim()) {
-    return c.json({ error: { code: "bad_request", message: "title is required" } }, 400);
-  }
+  const input = await readBody(c, NewTodo);
   const row = await db(c.env.DB)
     .insert(schema.todos)
-    .values({ userId: c.var.user!.id, title: body.title.trim() })
+    .values({ userId: c.var.user!.id, title: input.title })
     .returning()
     .get();
   return c.json({ todo: row }, 201);
@@ -32,10 +34,10 @@ todos.post("/", async (c) => {
 
 todos.patch("/:id", async (c) => {
   const id = Number(c.req.param("id"));
-  const body = (await c.req.json().catch(() => ({}))) as { done?: unknown };
+  const input = await readBody(c, TodoChange);
   const row = await db(c.env.DB)
     .update(schema.todos)
-    .set({ done: Boolean(body.done) })
+    .set({ done: input.done })
     .where(and(eq(schema.todos.id, id), eq(schema.todos.userId, c.var.user!.id)))
     .returning()
     .get();

package/template/test/todos.test.ts

@@ -26,6 +26,9 @@ describe("todos", () => {
     const erin = await t.as("erin");
     expect((await erin.post("/api/todos", {})).status).toBe(400);
     expect((await erin.post("/api/todos", { title: "   " })).status).toBe(400);
+    expect((await erin.post("/api/todos", { title: "x".repeat(201) })).status).toBe(400);
+    expect((await erin.post("/api/todos", { title: 42 })).status).toBe(400);
+    expect((await erin.patch("/api/todos/1", { done: "yes" })).status).toBe(400);
     expect((await erin.patch("/api/todos/999999", { done: true })).status).toBe(404);
   });
 });