Non-negotiable rules:

1. Read references/stack.md first to determine the runtime (Node.js or Bun), framework, and locked decisions.
2. Then load only the references needed for the actual task.
3. TypeScript strict mode — no any, no implicit returns, no unchecked index access.
4. All async functions must handle errors — no unhandled promise rejections. Use try/catch or .catch() at every boundary.
5. Input validation at system boundaries — Zod schemas on every external input (request bodies, query params, env vars, CLI args). Never trust req.body.
6. Structured logging via pino — no console.log in production code. JSON to stdout, parsed by log aggregators.
7. Graceful shutdown — handle SIGTERM/SIGINT, drain connections, finish in-flight work, close DB pools.
8. No secrets in code or logs — env vars validated at startup, never logged, never in error responses.

nodejs

Inputs

• $request: The backend task, subsystem, bug, or feature being worked on