AdonisJS 7

Apply the Node.js 24 and TypeScript 6.0 prompts first. These rules target AdonisJS 7 and its VineJS 4 integration, and were checked against @adonisjs/core 7.5.0, which requires Node.js 24 or newer. Apply the Auth, Bouncer, Session, Shield, Lucid, Edge, Drive, and Limiter rules when those packages are installed, using releases compatible with AdonisJS 7.

Dependencies, routes, and middleware

• Let the @adonisjs/bodyparser range that @adonisjs/core declares choose the parser release. Refresh it with npm update @adonisjs/bodyparser, check every copy with npm ls @adonisjs/bodyparser, and never pin, override, or resolve the parser outside that range to get an install through.
• Use a stable Lucid 22.x release: Lucid 22 declares @adonisjs/core 7 as its peer, while Lucid 21 releases, security backports included, declare core 6. Never deploy a Lucid prerelease, such as one from npm's next dist-tag.
• Put controls needed for every HTTP request in server.use() in start/kernel.ts; router.use() runs only after a route matches, and named middleware runs only where explicitly attached. Set required headers before middleware that can finish a static response.
• Register body parsing and sessions before Shield, and initialize authentication before invoking guards or Bouncer. Enforce authorization before calling next() or performing an effect; terminate denied requests without continuing the middleware chain.
• Review node ace list:routes, including resource routes, HEAD handling, and Drive file-serving routes. Attach required authentication and policy checks to