A Pattern is not a single skill. It is a small, opinionated bundle of memories, rules, and skills, each pre-scoped to the path it belongs to (for example, a "Server Components by default" rule scoped to /app). Add a Pattern and your AI assistant gets the right conventions in the right place, then it evolves with your project.

Everything here is free and Apache-2.0. Pathrule only ever charges for the hosted product, never for this content.

Catalog

150 patterns across 8 categories. Each links to its full page; Bundle shows the mix of Rules, Memories, and Skills, composed to fit the topic rather than a fixed template.

Framework

| Pattern | What it gives you | Bundle | Token | | --- | --- | --- | --- | | Android with Jetpack Compose | Model Android UI state, effects, navigation, persistence, and background work across real lifecycles. | 2R · 3M · 1S | ::pathrule:package:android-jetpack-compose | | Angular | Write signal-first, zoneless Angular with standalone components and no manual subscriptions. | 4R · 2M | ::pathrule:package:angular | | ASP.NET Core | Build ASP.NET Core services with ordered middleware, validated options, safe lifetimes, and clear boundaries. | 3R · 4M · 1S | ::pathrule:package:aspnet-core | | Astro | Ship content-first sites that send almost no JavaScript by default. | 3R · 3M · 1S | ::pathrule:package:astro | | Django | Write Django apps with a query-efficient ORM, safe settings, and async views that do not block. | 3R · 3M · 1S | ::pathrule:package:django | | Electron Desktop Applications | Harden Electron process boundaries, IPC contracts, navigation, permissions, updates, and local data. | 3R · 2M · 1S | ::pathrule:package:electron-desktop | | Expo (React Native) | Ship Expo apps with file-based routing, EAS Build, and safe OTA updates. | 3R · 3M · 1S | ::pathrule:package:expo-react-native | | Express.js Production APIs | Make middleware order, proxy trust, asynchronous failures, and shutdown behavior explicit. | 3R · 2M · 1S | ::pathrule:package:express-js | | Firebase and Firestore Production | Design Firestore rules, indexes, offline writes, and server authority as one data contract. | 3R · 2M · 1S | ::pathrule:package:firebase-firestore | | Flask Production Applications | Keep Flask application state, request context, extensions, and deployment boundaries explicit. | 2R · 2M | ::pathrule:package:flask | | Flutter | Build Flutter apps that stay fast and leak-free with disciplined widgets and clear state boundaries. | 2R · 3M · 1S | ::pathrule:package:flutter | | Laravel | Build Laravel apps with lean Eloquent queries, validated requests, and queued work that retries safely. | 3R · 2M · 1S | ::pathrule:package:laravel | | NestJS Production Architecture | Control provider scope, module ownership, validation, and transport-independent application logic. | 2R · 3M · 1S | ::pathrule:package:nestjs | | Next.js App Router | Battle-tested conventions for a Next.js App Router codebase, scoped to the paths they belong to. | 4R · 2M · 1S | ::pathrule:package:nextjs-app-router | | Nuxt | Ship Nuxt 4 apps with correct data fetching, server routes, and SSR-safe code. | 5R · 2M · 1S | ::pathrule:package:nuxt | | React Router 7 | Build full-stack React apps with framework mode loaders, actions, and generated route types. | 3R · 2M · 1S | ::pathrule:package:react-router | | Ruby on Rails | Work with Rails 8 as it ships today: the Solid stack, Hotwire views, and queries that do not multiply. | 2R · 5M | ::pathrule:package:rails | | Spring Boot | Keep controllers thin, configuration typed, transactions explicit, and tests aligned with application slices. | 2R · 3M · 1S | ::pathrule:package:spring-boot | | SvelteKit | Keep server secrets, load data, and mutations correct across SvelteKit 2 and Svelte 5. | 2R · 4M · 1S | ::pathrule:package:sveltekit | | SwiftUI | Build SwiftUI apps that compile under Swift 6 strict concurrency and keep state in one owner. | 4R · 2M · 1S | ::pathrule:package:swiftui | | Unity Game Development | Control frame-loop work, object lifetimes, physics timing, asset loading, and saved game state. | 2R · 2M · 1S | ::pathrule:package:unity-game-development | | Vue 3 Production Patterns | Keep Vue reactivity explicit, composables bounded, and server-rendered output deterministic. | 2R · 3M · 1S | ::pathrule:package:vue-3 | | WordPress Plugin and Theme Development | Keep WordPress hooks, capabilities, data access, rendering, and updates safe across releases. | 3R · 2M · 2S | ::pathrule:package:wordpress-development |

Frontend

| Pattern | What it gives you | Bundle | Token | | --- | --- | --- | --- | | Browser Storage and IndexedDB | Own browser persistence schemas, quotas, migrations, cross-tab coordination, privacy, and recovery. | 3R · 2M | ::pathrule:package:browser-storage-indexeddb | | Client State Management | Give URL, form, local, shared, and server state one owner each and derive everything else. | 1R · 2M | ::pathrule:package:client-state-management | | Core Web Vitals | Hit LCP under 2.5 seconds, INP under 200 milliseconds, and CLS under 0.1 on real traffic. | 2R · 2M · 2S | ::pathrule:package:core-web-vitals | | Data Tables and Grids | Keep query state, row identity, virtualization, selection, editing, and keyboard semantics coherent. | 3R · 1M · 1S | ::pathrule:package:data-tables-grids | | Dates, Time Zones, and Calendars | Model instants, local dates, wall-clock schedules, zones, and calendar rules as distinct types. | 2R · 3M · 1S | ::pathrule:package:dates-timezones-calendars | | Design Systems with Storybook | Turn component contracts into documented states, interaction evidence, accessibility checks, and releases. | 1R · 1M · 2S | ::pathrule:package:design-systems-storybook | | Forms with React Hook Form + Zod | Schema-first, type-safe forms with shared client and server validation. | 3R · 1M · 1S | ::pathrule:package:forms-rhf-zod | | Internationalization and Localization | Make locale, messages, formatting, direction, routes, and layout behavior explicit product contracts. | 2R · 2M · 1S | ::pathrule:package:internationalization-localization | | PWA and Offline-First Service Workers | Control service-worker updates, cache versions, offline mutations, navigation, and recovery. | 2R · 2M · 1S | ::pathrule:package:pwa-service-workers | | React + TypeScript | Pragmatic React and TypeScript conventions: typed props, accessible UI, and predictable hooks. | 2R · 3M · 1S | ::pathrule:package:react-typescript | | Real-Time UI with WebSockets | Design WebSocket identity, ordering, reconnect, backpressure, presence, and resynchronization. | 3R · 2M · 1S | ::pathrule:package:websocket-realtime-ui | | Responsive CSS Layouts | Build intrinsic layouts that survive narrow containers, long content, zoom, and localization. | 2R · 1M · 1S | ::pathrule:package:responsive-css-layouts | | shadcn/ui | Own your component code and theme it with CSS variables instead of installing a black-box UI library. | 2R · 3M · 1S | ::pathrule:package:shadcn-ui | | SSR Hydration and Server-Client Consistency | Keep server HTML, initial client state, identifiers, and browser-only behavior deterministic. | 2R · 3M · 1S | ::pathrule:package:ssr-hydration | | Tailwind CSS | Keep Tailwind v4 utility code clean, token-driven, and free of arbitrary-value sprawl. | 2R · 3M · 1S | ::pathrule:package:tailwind-css | | TanStack Query | Treat the server as the source of truth and let the cache do the work. | 2R · 3M · 1S | ::pathrule:package:tanstack-query | | Technical SEO and Structured Data | Make crawlability, canonical identity, metadata, structured data, and rendering testable per page. | 2R · 2M | ::pathrule:package:technical-seo-structured-data | | TypeScript Strict | Make the compiler do the work: no any, no escape hatches, types that model reality. | 4R · 1M · 1S | ::pathrule:package:typescript-strict | | Web Accessibility | Ship interfaces that work for keyboard, screen reader, and low-vision users by default. | 3R · 2M · 1S | ::pathrule:package:web-accessibility | | Web Animation and Motion | Use motion to explain state change while keeping interaction interruptible, accessible, and fast. | 2R · 2M | ::pathrule:package:web-animation-motion |

Backend

| Pattern | What it gives you | Bundle | Token | | --- | --- | --- | --- | | Apache Airflow Data Workflows | Design Airflow DAGs around data intervals, idempotent tasks, backfills, retries, and observable datasets. | 2R · 2M · 2S | ::pathrule:package:apache-airflow | | Apache Spark Data Processing | Control Spark partitioning, shuffles, skew, schemas, retries, and output commits at data scale. | 2R · 2M · 1S | ::pathrule:package:apache-spark | | Auth (Sessions, JWT, OAuth) | Build authentication that resists XSS, CSRF, and token replay by default. | 4R · 1M · 1S | ::pathrule:package:auth-sessions-jwt-oauth | | Background Jobs & Queues | Make every queued job safe to run twice so retries heal instead of corrupt. | 2R · 3M · 1S | ::pathrule:package:background-jobs-queues | | Database Connections, Pooling, and Capacity | Budget database connections across replicas, workers, transactions, queues, and failure recovery. | 3R · 2M · 1S | ::pathrule:package:database-connection-pooling | | Database Transactions, Deadlocks, and Concurrency | Protect database invariants with explicit isolation, locking order, retries, idempotency, and evidence. | 4R · 2M · 1S | ::pathrule:package:database-transactions-deadlocks | | Drizzle ORM | Keep your TypeScript schema, migrations, and typed queries honest with Drizzle. | 2R · 3M · 1S | ::pathrule:package:drizzle-orm | | Elasticsearch and OpenSearch | Design mappings, analyzers, queries, shards, aliases, and reindexing around search behavior. | 3R · 3M · 1S | ::pathrule:package:elasticsearch-opensearch | | Email Delivery and SMTP | Treat email as an authenticated, asynchronous delivery system with feedback and privacy boundaries. | 3R · 2M · 2S | ::pathrule:package:email-delivery-smtp | | FastAPI (Python) | Build type-safe async Python APIs with Pydantic validation and dependency injection. | 4R · 2M · 1S | ::pathrule:package:fastapi | | File Uploads and Object Storage | Treat uploads as untrusted objects with bounded transfer, quarantine, validation, and authorized delivery. | 3R · 1M · 1S | ::pathrule:package:file-uploads-object-storage | | Go API (Gin / Echo) | Build idiomatic Go HTTP services with honest errors, context propagation, and validated input. | 3R · 2M · 1S | ::pathrule:package:go-api | | GraphQL API | Ship a GraphQL API that batches its queries, authorizes per field, and cannot be walked by a stranger. | 4R · 1M · 1S | ::pathrule:package:graphql-api | | gRPC and Protocol Buffers | Evolve Protobuf contracts with deadlines, status semantics, streaming backpressure, and compatibility. | 3R · 3M · 1S | ::pathrule:package:grpc-protobuf | | Kafka Event-Driven Services | Produce and consume Kafka events with keys that preserve order and handlers that survive redelivery. | 3R · 2M · 2S | ::pathrule:package:kafka-event-driven | | MongoDB + Mongoose | Model MongoDB documents around the queries you run, then keep those queries indexed and lean. | 2R · 3M · 1S | ::pathrule:package:mongodb-mongoose | | Multi-Tenant SaaS | Make cross-tenant data leaks structurally impossible instead of relying on every query being careful. | 4R · 2M · 1S | ::pathrule:package:multi-tenancy | | Node + TypeScript API (Hono) | Build type-safe Hono APIs with chained routes, schema validation, and a typed RPC client. | 3R · 3M · 1S | ::pathrule:package:node-ts-api-hono | | Pandas and DataFrame Pipelines | Make DataFrame schemas, missing values, joins, mutation, memory, and reproducibility explicit. | 2R · 3M · 1S | ::pathrule:package:pandas-dataframes | | PostgreSQL Schema & Migrations | Design normalized PostgreSQL schemas and ship lock-safe, forward-only migrations. | 3R · 2M · 1S | ::pathrule:package:postgres-schema | | Prisma ORM | Use Prisma 7 as it actually ships: generated client, driver adapters, and one instance per process. | 3R · 1M · 1S | ::pathrule:package:prisma-orm | | RabbitMQ Messaging | Design RabbitMQ routing, acknowledgements, publisher confirms, retries, dead letters, and flow control. | 3R · 2M · 1S | ::pathrule:package:rabbitmq-messaging | | Redis Caching | Cache with Redis so reads get faster without serving stale or inconsistent data. | 2R · 3M · 1S | ::pathrule:package:redis-caching | | REST / HTTP API Design | Design HTTP APIs that stay predictable, safe to retry, and easy to evolve. | 2R · 3M · 1S | ::pathrule:package:rest-api-design | | SQL Query Performance and Indexing | Tune SQL from measured plans, realistic data, deliberate indexes, and bounded result shapes. | 3R · 2M · 1S | ::pathrule:package:sql-query-performance | | SQLite in Production | Operate SQLite with explicit transactions, WAL behavior, connection ownership, migrations, and backups. | 3R · 2M | ::pathrule:package:sqlite-production | | Supabase + RLS | Row Level Security done right: deny by default, user JWT only, and a clean migration workflow. | 3R · 3M · 1S | ::pathrule:package:supabase-rls |

Billing

| Pattern | What it gives you | Bundle | Token | | --- | --- | --- | --- | | B2B Billing and Net Terms | Connect purchase orders, approvals, due dates, partial payments, and collections in one receivable flow. | 2R · 2M · 1S | ::pathrule:package:b2b-billing-net-terms | | Dunning and Churn Recovery | Recover failed payments with stateful retries, clear customer action, and safe access transitions. | 1R · 1M · 2S | ::pathrule:package:dunning-churn-recovery | | E-commerce Cart and Checkout | Keep catalog, cart, price, inventory, order, payment, and fulfillment state consistent. | 4R · 2M · 1S | ::pathrule:package:ecommerce-cart-checkout | | Invoicing and Tax | Keep invoice facts immutable, tax evidence traceable, and corrections auditable across providers. | 2R · 1M · 1S | ::pathrule:package:invoicing-tax | | Marketplace Payments and Payouts | Keep charges, fees, seller balances, refunds, disputes, and payouts in one auditable ledger. | 3R · 2M · 1S | ::pathrule:package:marketplace-payouts | | Multi-Currency Payments | Keep presentment, settlement, ledger, and reporting currencies explicit through every money movement. | 2R · 2M | ::pathrule:package:multi-currency-payments | | Paddle Billing | Treat Paddle transactions and webhooks as evidence while your application owns access state. | 3R · 2M · 1S | ::pathrule:package:paddle-billing | | Payment Authentication with 3DS and SCA | Model payment authentication as a resumable server-owned state machine, not a browser callback. | 4R · 2M · 1S | ::pathrule:package:payment-3ds-sca | | Payment Reconciliation Ledger | Close the gap between internal orders, provider balances, bank payouts, fees, refunds, and disputes. | 2R · 3M · 2S | ::pathrule:package:payment-reconciliation-ledger | | Pricing and Plan Modeling | Model products, prices, entitlements, and commercial terms without scattering plan-name checks. | 1R · 2M | ::pathrule:package:pricing-plan-modeling | | Refunds, Chargebacks, and Disputes | Model every payment reversal as an auditable state transition with deadlines, evidence, and ledger impact. | 3R · 3M · 2S | ::pathrule:package:refunds-chargebacks-disputes | | Stripe Billing | Safe Stripe integration: verified webhooks, idempotent handlers, and the right API for the job. | 4R · 4M · 1S | ::pathrule:package:stripe-billing | | Subscriptions & Usage Billing | Ship metered subscriptions on Stripe Billing without dropping usage or double-charging customers. | 3R · 2M · 1S | ::pathrule:package:subscriptions-usage-billing |

Infra

| Pattern | What it gives you | Bundle | Token | | --- | --- | --- | --- | | AWS ECS and Fargate | Operate ECS services with bounded tasks, IAM roles, networking, health, deployment, and Fargate capacity. | 2R · 3M · 1S | ::pathrule:package:aws-ecs-fargate | | AWS Lambda | Write Lambda handlers that reuse their init work, retry safely, and do not exhaust the database. | 3R · 2M · 1S | ::pathrule:package:aws-lambda | | Azure Functions Production Patterns | Design Azure Functions around trigger semantics, bindings, idempotency, configuration, and scaling. | 2R · 2M | ::pathrule:package:azure-functions | | Backup and Disaster Recovery | Define recovery objectives, isolate backups, prove restores, and rehearse service recovery under pressure. | 3R · 1M · 2S | ::pathrule:package:backup-disaster-recovery | | CDN and Edge Caching | Define cache keys, freshness, validation, privacy, invalidation, and origin protection as one contract. | 2R · 2M · 1S | ::pathrule:package:cdn-edge-caching | | Cloudflare Workers | Write Workers that use bindings, respect the isolate model, and stay inside the CPU budget. | 2R · 2M · 1S | ::pathrule:package:cloudflare-workers | | DNS and Domain Management | Manage zones, delegation, DNSSEC, records, TTLs, and cutovers as reviewed production infrastructure. | 3R · 2M | ::pathrule:package:dns-domain-management | | Docker & Containers | Ship small, secure, cache-friendly container images by default. | 2R · 2M · 1S | ::pathrule:package:docker-containers | | GitHub Actions CI/CD | Build hardened, fast, OIDC-deployed GitHub Actions pipelines that AI agents keep secure by default. | 3R · 1M · 1S | ::pathrule:package:github-actions-cicd | | GitOps with Argo CD | Operate Argo CD through desired-state ownership, reconciliation, sync waves, health, drift, and rollback. | 2R · 3M · 1S | ::pathrule:package:gitops-argocd | | Google Cloud Run | Design Cloud Run around container concurrency, request lifetime, identity, scaling, and revisions. | 2R · 2M · 1S | ::pathrule:package:google-cloud-run | | Kubernetes + Helm | Ship workloads that Kubernetes can schedule, restart, drain, and scale without dropping requests. | 5R · 2M · 1S | ::pathrule:package:kubernetes-helm | | Linux Services with systemd | Run Linux services with explicit users, dependencies, restart policy, signals, logs, limits, and hardening. | 3R · 2M · 1S | ::pathrule:package:linux-systemd-services | | Nginx and Reverse Proxy Operations | Operate Nginx with explicit upstream, header, timeout, buffering, reload, and trust contracts. | 3R · 2M · 1S | ::pathrule:package:nginx-reverse-proxy | | Observability | Emit correlated logs, metrics, and traces that make incidents debuggable. | 2R · 2M · 1S | ::pathrule:package:observability | | Prometheus and Grafana Operations | Operate metrics with bounded cardinality, durable rules, actionable alerts, and trustworthy dashboards. | 2R · 3M · 2S | ::pathrule:package:prometheus-grafana | | Secrets & Environment Management | Keep secrets out of git, inject them at runtime, and rotate them automatically. | 3R · 2M · 1S | ::pathrule:package:secrets-env-management | | Terraform / IaC | Ship Terraform with locked remote state, pinned versions, and a plan-gated CI pipeline. | 3R · 3M · 1S | ::pathrule:package:terraform-iac | | TLS Certificates and HTTPS Operations | Operate certificate identity, issuance, renewal, trust chains, protocol policy, and key rotation. | 4R · 2M · 1S | ::pathrule:package:tls-https-operations | | Vercel Deployment | Ship to Vercel with safe previews, scoped env vars, and instant rollbacks. | 2R · 3M · 1S | ::pathrule:package:vercel-deploy |

Workflow

| Pattern | What it gives you | Bundle | Token | | --- | --- | --- | --- | | Bash and Shell Automation | Write shell automation with safe quoting, strict inputs, deterministic cleanup, and portable failure. | 3R · 2M · 1S | ::pathrule:package:bash-shell-automation | | Code Review | Ship small pull requests that reviewers can approve fast with confidence. | 3R · 1M · 1S | ::pathrule:package:code-review | | Debugging and Root Cause Analysis | Turn vague failures into reproducible evidence, competing hypotheses, controlled tests, and verified causes. | 1R · 2M · 2S | ::pathrule:package:debugging-root-cause | | Dependency Upgrades and Breaking Changes | Upgrade dependencies through contract inventory, small steps, codemods, compatibility tests, and rollback. | 2R · 2M · 2S | ::pathrule:package:dependency-upgrades | | Developer Onboarding | Turn a new contributor's first setup and change into a repeatable test of the engineering system. | 2R · 4M · 2S | ::pathrule:package:developer-onboarding | | Documentation Engineering | Treat operational and developer documentation as owned, testable interfaces that change with the system. | 1R · 2M | ::pathrule:package:documentation-engineering | | Feature Flags and Progressive Delivery | Separate deployment from exposure with typed flags, deterministic targeting, rollback, and retirement. | 2R · 2M · 1S | ::pathrule:package:feature-flags-progressive-delivery | | Flaky Test Management | Detect, quarantine, diagnose, own, and eliminate nondeterministic tests without normalizing retries. | 1R · 2M · 2S | ::pathrule:package:flaky-test-management | | Git & Conventional Commits | Keep history readable and releases automatic with small commits and Conventional Commits. | 2R · 1M · 1S | ::pathrule:package:git-conventional-commits | | Git Branching, Rebase, and Merge Conflicts | Keep Git history integration reviewable, recoverable, conflict-aware, and free of accidental data loss. | 2R · 2M | ::pathrule:package:git-branching-rebase | | Incident Response and Postmortems | Coordinate incidents with clear authority, durable timelines, safe mitigation, and owned learning. | 1R · 1M · 3S | ::pathrule:package:incident-response-postmortems | | Modern Python Tooling (uv + Ruff) | Set up Python projects the 2026 way: one fast tool for envs and deps, one for lint and format. | 2R · 2M · 1S | ::pathrule:package:python-tooling | | Monorepo (pnpm + Turborepo) | Keep a pnpm and Turborepo monorepo fast, cacheable, and boundary-clean. | 3R · 2M · 1S | ::pathrule:package:monorepo-pnpm-turborepo | | OpenAPI and Swagger Contract Workflow | Keep OpenAPI contracts authoritative, compatible, generated, and aligned with runtime behavior. | 2R · 2M · 1S | ::pathrule:package:openapi-swagger-workflow | | Release Management | Promote immutable artifacts with compatibility evidence, explicit approval, rollback, and release notes. | 2R · 1M · 2S | ::pathrule:package:release-management | | Technical Debt Management | Turn costly shortcuts into owned, evidence-backed decisions with triggers and a credible payoff path. | 1R · 2M · 1S | ::pathrule:package:technical-debt-management | | Testing (Vitest + Playwright) | Unit test behavior with Vitest, drive real user flows with Playwright, and keep both green in CI. | 3R · 2M · 1S | ::pathrule:package:testing-vitest-playwright |

AI

| Pattern | What it gives you | Bundle | Token | | --- | --- | --- | --- | | Agent Memory | Store durable agent memory with provenance, tenant isolation, retrieval policy, and deliberate forgetting. | 1R · 3M · 1S | ::pathrule:package:agent-memory | | AI Agents in Production | Run agent loops with hard budgets, small tool surfaces, and approval gates on anything irreversible. | 4R · 2M · 1S | ::pathrule:package:ai-agents | | AI Safety Guardrails | Classify risk, isolate untrusted content, authorize tools, validate output, and escalate safely. | 3R · 1M · 1S | ::pathrule:package:ai-safety-guardrails | | AI SDK (Vercel AI SDK) | Build streaming, tool-calling LLM features with one typed API across every provider. | 3R · 2M · 1S | ::pathrule:package:ai-sdk | | AI-Generated Code Verification | Verify AI-authored changes through scope control, contracts, tests, security, runtime evidence, and rollback. | 2R · 2M · 2S | ::pathrule:package:ai-code-verification | | LLM Evaluations & Testing | Catch hallucinations and quality regressions before users do, with evals on every prompt change. | 1R · 2M · 2S | ::pathrule:package:llm-evals | | LLM Fine-Tuning and Dataset Curation | Fine-tune models through licensed datasets, leakage control, reproducible training, evaluations, and rollback. | 2R · 3M · 2S | ::pathrule:package:llm-fine-tuning | | LLM Observability and Tracing | Trace model, retrieval, tool, safety, token, cost, and user outcomes without leaking prompt content. | 2R · 4M · 1S | ::pathrule:package:llm-observability-tracing | | LLM Streaming UX | Design typed stream events, resumable state, cancellation, and honest partial-output interactions. | 1R · 2M · 2S | ::pathrule:package:llm-streaming-ux | | LLM Structured Outputs | Treat model output as untrusted data that must satisfy a versioned schema before use. | 2R · 1M · 1S | ::pathrule:package:llm-structured-outputs | | Local LLM Inference with Ollama and vLLM | Operate local inference with explicit model identity, memory budgets, batching, quantization, and limits. | 2R · 3M · 1S | ::pathrule:package:local-llm-ollama-vllm | | MCP Client and Tool Integration | Build MCP clients with explicit capabilities, consent, auth, transport, schemas, and result handling. | 3R · 2M · 1S | ::pathrule:package:mcp-client-integration | | MCP Server Authoring | Build Model Context Protocol servers whose tools an LLM can actually call correctly and safely. | 3R · 1M · 1S | ::pathrule:package:mcp-server-authoring | | Model Routing and Cost Control | Route AI work by capability, risk, latency, reliability, and budget with observable fallbacks. | 3R · 2M · 1S | ::pathrule:package:model-routing-cost-control | | Prompt Versioning and Management | Ship prompts as immutable, reviewable artifacts with typed inputs, eval evidence, rollout, and rollback. | 2R · 2M · 2S | ::pathrule:package:prompt-versioning-management | | RAG & Embeddings | Ground LLM answers in your own data with retrieval that returns the right chunks, not just similar ones. | 2R · 3M · 1S | ::pathrule:package:rag-embeddings |

Security

| Pattern | What it gives you | Bundle | Token | | --- | --- | --- | --- | | Account Takeover and MFA | Protect sign-in, recovery, factor changes, and sensitive actions as one abuse-resistant system. | 3R · 1M · 1S | ::pathrule:package:account-takeover-mfa | | API Keys and Service-to-Service Authentication | Issue machine credentials with scopes, prefixes, hashing, rotation, audit, expiration, and leak response. | 3R · 1M | ::pathrule:package:api-keys-service-auth | | API Rate Limiting and Abuse | Bound request frequency, concurrency, payload cost, and expensive business actions. | 3R · 1M | ::pathrule:package:api-rate-limiting-abuse | | Application Encryption and Key Management | Design encryption around threat models, authenticated modes, envelope keys, rotation, access, and recovery. | 4R · 2M · 1S | ::pathrule:package:application-encryption-key-management | | Authorization with RBAC and ReBAC | Authorize every action against the real resource, relationship, tenant, and current policy state. | 4R · 2M · 1S | ::pathrule:package:authorization-rbac-rebac | | Container and Image Security | Build traceable images, minimize contents, verify provenance, and constrain runtime power. | 2R · 1M · 2S | ::pathrule:package:container-image-security | | Enterprise SSO with SAML and OIDC | Operate enterprise SSO with tenant-bound issuers, signed responses, secure linking, JIT, SCIM, and rotation. | 4R · 2M · 1S | ::pathrule:package:enterprise-sso-saml-oidc | | IAM and Least Privilege | Keep human and workload access temporary, scoped, reviewable, and deny-first. | 3R · 1M · 1S | ::pathrule:package:iam-least-privilege | | PII and Data Privacy | Minimize personal data, preserve purpose, enforce access, and make deletion real. | 3R · 2M | ::pathrule:package:pii-data-privacy | | Security Audit Logging | Record security-relevant actions as trustworthy evidence without turning logs into a secret database. | 3R · 2M | ::pathrule:package:security-audit-logging | | Software Supply Chain Security | Stop a poisoned dependency from running in your build, CI, and production. | 4R · 1M · 1S | ::pathrule:package:supply-chain-security | | SSRF and Egress Security | Treat server-side URL fetching as a privileged network capability with validation at every hop. | 5R · 1M · 1S | ::pathrule:package:ssrf-egress-security | | Threat Modeling | Model trust boundaries, rank realistic abuse paths, and turn threats into tested requirements. | 1R · 1M · 2S | ::pathrule:package:threat-modeling | | Web Security (OWASP) | Build web apps that deny by default, distrust every input, and ship secure headers. | 3R · 2M · 1S | ::pathrule:package:web-security |

What is a Pattern

Each Pattern declares its pieces with a kind (memory | rule | skill), the target nodePath, and the full content body:

• Memories capture decisions and conventions ("how we do X here").
• Rules are constraints your agent should respect (with scope, priority, and advisory or strict enforcement).
• Skills are reusable checklists or procedures.

The bundle for each pattern is composed from its actual subject: rule-heavy for constraint and security topics, memory-heavy for conventions and architecture, skill-heavy for review and checklist topics. No two need to look alike.

Using a Pattern

Browse the catalog at pathrule.io/patterns.

• One-click import: paste a reference token into your AI assistant and Pathrule places each piece at the right path in your workspace.

  ::pathrule:package:nextjs-app-router

• Manual copy: copy the full bundle from a Pattern page and paste the pieces where you want them.

Using the package programmatically

import { getAllPatterns, getPattern, serializePatternBundle } from "@pathrule/patterns";

const pattern = getPattern("nextjs-app-router");
if (pattern) {
  console.log(serializePatternBundle(pattern));
}

The package is a pure, dependency-free, serializable data module. It carries no React, DOM, or cloud imports, so it can be rendered on the web, bundled into a local snapshot, or synced to a backend without change.

Contributing

Patterns are curated and first-party for now, so we keep quality and provenance high. Community contribution will open later with a review process. Until then, please use issues to suggest a Pattern or report a fix.

License

Apache-2.0. See NOTICE.