CLAUDE.md — 프로젝트가 기억할 규칙

# myproject — CLAUDE.md

## What this is
TypeScript REST API on Node 22 + Postgres 16, deployed via Fly.io.
Frontend lives in ../myapp-frontend (separate repo).

## Standard commands
npm run dev          # localhost:3000, hot reload
npm test             # vitest
npm run db:migrate   # prisma migrate dev
npm run lint         # eslint + prettier

## Architecture
- src/routes/        Express handlers (one per resource)
- src/services/      business logic (no DB calls here)
- src/repositories/  Prisma queries (the only place DB is touched)
- src/middleware/    auth, validation, error envelope

## Conventions
- TS strict, no `any` (use `unknown` and narrow)
- async/await only, never callbacks
- Validate all inputs with Zod before processing
- Response envelope: { data, error, meta }

## Do not
- Modify schema.prisma without a migration
- Commit .env (use direnv)
- Use console.log in app code (use src/lib/logger.ts)

# src/payments/CLAUDE.md

## Payments — additional rules
This service handles PCI-DSS regulated data. Treat everything here
as SENSITIVE.

- NEVER log card numbers, CVVs, or full PANs (debug code included)
- All encryption goes through src/lib/crypto.ts (AES-256-GCM)
- All Stripe calls go through src/clients/stripe.ts
- Rate limiting is MANDATORY on every public payment endpoint

## Verify before committing
npm run pci-check