tac-api-surface
Load when adding or modifying Next.js route handlers, server actions, public API endpoints, edge functions (supabase/functions/), webhooks, or rate-limited surfaces in tac-express. Covers the security boundary between apps and services, validation patterns, error handling, rate limiting (Upstash), and the public-vs-authenticated split.