All packs

---
description: Stripe checkout and webhooks
globs: app/api/stripe/**,lib/stripe.ts
---
- Checkout Sessions created server-side; pass
  client_reference_id = user id.
- Webhook: read raw body with await req.text(),
  verify with constructEvent; 400 on failure.
- Handle idempotently (store event.id).
- Grant access only from verified webhooks,
  never from the success redirect.

## Working rules
1. Scope is king. Implement only the current
   task in TASKS.md. Suggest cuts, never additions.
2. Never restructure the scene tree without asking.
3. Every change leaves the game runnable (F5).

## Conventions
- Signals up, calls down. No get_parent().get_parent().
- Input via InputMap actions, never raw keycodes.
- Feel numbers are @export. List old → new.

{"id": "pr-reviewer-01",
 "input": "Diff:\n+ const q = `SELECT * FROM
   users WHERE id = ${req.params.id}`",
 "expect": {
   "must_include": ["injection", "request_changes"],
   "json_schema_valid": true }}

$ python run_evals.py --agent pr-reviewer

---
name: code-reviewer
description: Use PROACTIVELY after any
  non-trivial change, before committing.
tools: Read, Grep, Glob, Bash
---
Start with git diff. Do not edit files.
Report MUST / SHOULD / NIT with path:line.
If the diff is clean, say "No MUST items"
and stop.

---
description: FastAPI routes and dependencies
globs: app/api/**/*.py,app/main.py
---
- Every route: explicit response_model,
  status_code and summary.
- Ownership is filtered in the query.
  Other users' objects → 404.
- Lists paginated (limit ≤ 100), stable order.

---
description: Migrations, RLS, grants and policies
globs: supabase/migrations/**
---
- Every CREATE TABLE ships, in the same
  migration: enable RLS, revoke defaults,
  one policy per command.
- Policies use (select auth.uid()).