The Thin Route Law: 40 Lines or It Lives Somewhere Else

Every legacy backend has the 250-line route handler: validation, auth, pricing math, three DB calls, email sending, and a webhook client, all in one file, untestable. The thin route law exists to make that shape unmergeable.

The rule: over ~40 lines of handler means logic is leaking — push it down into a provider. A compliant route does four things: validate input against LIMITS, check auth via requirePaidUser(), delegate to exactly one provider call, return JSON. Look at the Dodo webhook route: read body, verify, grant-or-revoke, respond. Thirty-two lines, and every line is HTTP, not business.

Providers hold the verbs (create, findById, listByBuyer, toggle), registries pick the engine, and models/*.js stays a frozen one-line shim so old imports never break. Tests then target providers directly — no HTTP harness needed for money logic.

Agents love this shape too: the file to change is always obvious, and the blast radius is one folder. Strictness here is what lets everything else move fast.