@carecard/auth-util 3.6.0 → 3.8.0

package/.agents/skills/carecard-workspace-standards/SKILL.md

@@ -5,6 +5,10 @@ description: 'Follow the shared SO_CareCardCa/CareCard workspace coding, testing
 
 # CareCard Workspace Standards
 
+Non-negotiable TDD rule: Always write the failing test first, run it to confirm it fails for the intended reason, then implement the code and rerun the test until it passes. Test Driven Development is required for all coding work and must not be skipped. For documentation- or skill-only edits, add or update the relevant validation check before changing the prose.
+
+Non-negotiable code organization rule: Functions with the same or equivalent behavior must use the same or clearly corresponding descriptive names across CareCard repositories, and equivalent functionality must live in files with the same names within each repository's established architecture. No backward compatibility names, aliases, or duplicate locations are allowed.
+
 ## Purpose
 
 Use before modifying, testing, reviewing, or debugging any CareCard workspace repository or cross-repository contract.

package/.agents/skills/github-pr-create-update/SKILL.md

@@ -5,6 +5,10 @@ description: 'Use only when the user explicitly asks for remote Git or GitHub PR
 
 # Pull Request Create
 
+Non-negotiable TDD rule: Always write the failing test first, run it to confirm it fails for the intended reason, then implement the code and rerun the test until it passes. Test Driven Development is required for all coding work and must not be skipped. For documentation- or skill-only edits, add or update the relevant validation check before changing the prose.
+
+Non-negotiable code organization rule: Functions with the same or equivalent behavior must use the same or clearly corresponding descriptive names across CareCard repositories, and equivalent functionality must live in files with the same names within each repository's established architecture. No backward compatibility names, aliases, or duplicate locations are allowed.
+
 ## Purpose
 
 After the user explicitly asks for remote Git or GitHub PR work, create,

package/.agents/skills/github-pr-merge-cleanup/SKILL.md

@@ -5,6 +5,10 @@ description: 'Use only when the user explicitly asks for remote Git or GitHub PR
 
 # Pull Request Merge Close
 
+Non-negotiable TDD rule: Always write the failing test first, run it to confirm it fails for the intended reason, then implement the code and rerun the test until it passes. Test Driven Development is required for all coding work and must not be skipped. For documentation- or skill-only edits, add or update the relevant validation check before changing the prose.
+
+Non-negotiable code organization rule: Functions with the same or equivalent behavior must use the same or clearly corresponding descriptive names across CareCard repositories, and equivalent functionality must live in files with the same names within each repository's established architecture. No backward compatibility names, aliases, or duplicate locations are allowed.
+
 ## Purpose
 
 After the user explicitly asks for remote Git or GitHub PR work, push the

package/.agents/skills/pkg-auth-util-auth-crypto-library/SKILL.md

@@ -5,6 +5,10 @@ description: 'Use when changing pkg-auth-util auth, password, JWT, crypto, key,
 
 # Package Auth Util
 
+Non-negotiable TDD rule: Always write the failing test first, run it to confirm it fails for the intended reason, then implement the code and rerun the test until it passes. Test Driven Development is required for all coding work and must not be skipped. For documentation- or skill-only edits, add or update the relevant validation check before changing the prose.
+
+Non-negotiable code organization rule: Functions with the same or equivalent behavior must use the same or clearly corresponding descriptive names across CareCard repositories, and equivalent functionality must live in files with the same names within each repository's established architecture. No backward compatibility names, aliases, or duplicate locations are allowed.
+
 ## Purpose
 
 CareCard auth utility package for JWT creation/verification primitives, password hashing, crypto helpers, key generation, and tests.

package/.agents/skills/pkg-publish/SKILL.md

@@ -0,0 +1,112 @@
+---
+name: pkg-publish
+description: 'Use when any pkg-* repository has non-Markdown package changes, including source code, public types, tests, scripts, package metadata, lockfiles, dependency behavior, or validation config, and the CareCard packages must be versioned, published in order with just-in-time package pushes, and propagated to pkg-*, ms-*, and app-dashboard consumers. Do not use for Markdown-only changes.'
+---
+
+# pkg Publish
+
+Non-negotiable TDD rule: Always write the failing test first, run it to confirm it fails for the intended reason, then implement the code and rerun the test until it passes. Test Driven Development is required for all coding work and must not be skipped. For documentation- or skill-only edits, add or update the relevant validation check before changing the prose.
+
+Non-negotiable code organization rule: Functions with the same or equivalent behavior must use the same or clearly corresponding descriptive names across CareCard repositories, and equivalent functionality must live in files with the same names within each repository's established architecture. No backward compatibility names, aliases, or duplicate locations are allowed.
+
+## Trigger
+
+Run this skill after every `pkg-*` repository change that touches non-Markdown
+package files: source code, public type declarations, tests, scripts,
+configuration, package metadata, lockfiles, dependency behavior, or validation
+behavior.
+
+Do not run this skill for Markdown-only changes, including README-only or
+`*.md` skill-documentation-only updates.
+
+## Version Rule
+
+1. Check `package.json` in all four package repositories:
+   `pkg-common-util`, `pkg-validate`, `pkg-auth-util`, and `pkg-jwt-read`.
+2. Select one minor version higher than the highest current package version.
+   If the highest version is `3.7.0`, the coordinated target version is
+   `3.8.0`.
+3. Use the same target version for all four packages.
+4. Update each package's `package.json` and `package-lock.json`, then commit the
+   version change on a package release branch before publishing.
+
+## Publish Order
+
+Always publish packages in this order, one repository at a time:
+
+1. `@carecard/common-util`
+2. `@carecard/validate`
+3. `@carecard/auth-util`
+4. `@carecard/jwt-read`
+
+Publish by pushing the package release branch, creating or reusing a pull
+request into `development`, marking it ready, waiting for checks, squash-merging
+with administrator privileges, and verifying npm publication with:
+
+```sh
+npm view <package-name>@<target-version> version
+```
+
+The package GitHub workflow publishes automatically from `development`. Do not
+create a `main` merge unless the user explicitly asks for it.
+
+## Deferred Package Push
+
+Commit coordinated version and dependency updates locally as the release sequence
+progresses. Do not push a `pkg-*` release branch until that package is the next
+package being published by merge into `development`.
+
+Immediately before each package's publishing turn:
+
+1. Verify the repository is on the intended release branch and has a clean
+   working tree.
+2. Run required validation and every direct `.husky` script for that repository.
+3. Push that package's release branch.
+4. Create or reuse the pull request into `development`, merge it, and wait for
+   npm publication before continuing to dependency fanout.
+
+## Dependency Fanout
+
+After each package publishes, update every package repository that depends on
+that package to the exact target version and commit the change before
+continuing:
+
+1. After publishing `@carecard/common-util`, update it in `pkg-validate`,
+   `pkg-auth-util`, and `pkg-jwt-read` when declared.
+2. After publishing `@carecard/validate`, update it in `pkg-auth-util` and
+   `pkg-jwt-read` when declared.
+3. After publishing `@carecard/auth-util`, update it in `pkg-jwt-read` when
+   declared.
+4. `@carecard/jwt-read` is last, so no later package repository depends on it.
+
+Use exact installs so `package.json` and `package-lock.json` stay aligned:
+
+```sh
+npm install <package-name>@<target-version> --save-exact
+```
+
+## Service And Dashboard Consumers
+
+After all four packages are published, update all `ms-*` repositories and
+`app-dashboard` that declare any `@carecard/*` package dependency. Install the
+latest exact target version for every declared CareCard package, run the
+repository's required validation, and commit the dependency updates locally.
+
+Do not push, open pull requests, or merge service/dashboard consumer dependency
+commits unless the user explicitly asks for remote GitHub work for those
+repositories.
+
+## Validation
+
+For each changed repository:
+
+- Run `git diff --check`.
+- Run every direct script in `.husky`; do not bypass hooks.
+- For package repositories, run the package tests, type checks, and lint/format
+  checks required by the hook.
+- For `app-dashboard`, run both `.husky/pre-commit` and `.husky/pre-push` when
+  dependencies change.
+
+Finish by verifying that all four packages are published at the same target
+version and every declared `@carecard/*` dependency in `pkg-*`, `ms-*`, and
+`app-dashboard` is pinned to that version.

package/.agents/skills/pkg-publish/agents/openai.yaml

@@ -0,0 +1,5 @@
+interface:
+  display_name: 'pkg Publish'
+  short_description: 'Publish CareCard packages in order with just-in-time pushes.'
+  brand_color: '#0F766E'
+  default_prompt: 'Use $pkg-publish to publish coordinated CareCard package releases.'

package/.agents/skills/software-design-patterns-and-clean-code/SKILL.md

@@ -5,6 +5,10 @@ description: 'Use every time before coding, refactoring, debugging, or reviewing
 
 # Software Design Patterns And Clean Code
 
+Non-negotiable TDD rule: Always write the failing test first, run it to confirm it fails for the intended reason, then implement the code and rerun the test until it passes. Test Driven Development is required for all coding work and must not be skipped. For documentation- or skill-only edits, add or update the relevant validation check before changing the prose.
+
+Non-negotiable code organization rule: Functions with the same or equivalent behavior must use the same or clearly corresponding descriptive names across CareCard repositories, and equivalent functionality must live in files with the same names within each repository's established architecture. No backward compatibility names, aliases, or duplicate locations are allowed.
+
 ## Purpose
 
 Use this skill with every coding, refactoring, debugging, or review task in

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carecard/auth-util",
-  "version": "3.6.0",
+  "version": "3.8.0",
   "repository": "https://github.com/CareCard-ca/pkg-auth-util.git",
   "description": "Auth utility functions",
   "main": "index.js",
@@ -42,8 +42,8 @@
     "typescript": "6.0.3"
   },
   "dependencies": {
-    "@carecard/common-util": "3.6.0",
-    "@carecard/validate": "3.6.0"
+    "@carecard/common-util": "3.8.0",
+    "@carecard/validate": "3.8.0"
   },
   "overrides": {
     "diff": "8.0.4",

package/readme.md

@@ -5,6 +5,12 @@
 
 Utility package for authentication and authorization in the CareCard ecosystem.
 
+## Development Rule
+
+Non-negotiable TDD rule: Always write the failing test first, run it to confirm it fails for the intended reason, then implement the code and rerun the test until it passes. Test Driven Development is required for all coding work and must not be skipped. For documentation- or skill-only edits, add or update the relevant validation check before changing the prose.
+
+Non-negotiable code organization rule: Functions with the same or equivalent behavior must use the same or clearly corresponding descriptive names across CareCard repositories, and equivalent functionality must live in files with the same names within each repository's established architecture. No backward compatibility names, aliases, or duplicate locations are allowed.
+
 ## Features
 
 - **JWT Utilities**: Create, verify, and parse JSON Web Tokens with support for EdDSA (Ed25519) and RSA.

package/.agents/skills/npm-package-flow/SKILL.md

@@ -1,75 +0,0 @@
----
-name: npm-package-flow
-description: 'Use in pkg-* repositories when publishable package code changes require a version bump, GitHub development/main squash-merge flow, npm publication, and uncommitted consumer package updates in ms-* and app-dashboard.'
----
-
-# npm Package Flow
-
-## Purpose
-
-Use this skill in a `pkg-*` repository when package code changes need to be
-published to npm and propagated to CareCard consumers.
-
-The package name is the `name` field in the repository `package.json`.
-
-## Publishable vs Non-Publishable Changes
-
-Publishable package changes include runtime source changes, public exports,
-TypeScript declarations, package metadata that affects consumers, security
-behavior, or dependency behavior that changes the package contract.
-
-The following are not publishable package changes by themselves:
-
-- Skills or `.agents` guidance.
-- Documentation and README updates.
-- Tests, fixtures, mocks, snapshots, or validation-only changes.
-- Formatting-only changes and comments.
-
-For non-publishable changes, do not bump the package version, publish to npm,
-or update `ms-*` and `app-dashboard` package versions.
-
-## Required Flow For Publishable Changes
-
-Run this workflow only when the user explicitly asks for package publication,
-remote GitHub merge work, or the full package-flow completion. Remote Git and
-GitHub operations must not be inferred.
-
-1. Finish package code, tests, documentation, and skill updates inside the
-   current `pkg-*` repository.
-2. Bump the package version in `package.json` and `package-lock.json` according
-   to the user request or the package change scope.
-3. Run the package's required tests, lint, type checks, and every direct Husky
-   script. Fix failures before continuing.
-4. Commit the package changes to the current branch.
-5. Push the current branch, create or reuse the PR into `development`,
-   squash-merge it with administrator privileges, and delete the merged branch.
-6. Create a new merge branch from the updated `development` branch and use that
-   branch to open a PR into `main`.
-7. Squash-merge the merge branch into `main` with administrator privileges and
-   delete the merge branch. This `main` merge publishes the package.
-8. Confirm publication with `npm view <package-name>@<version> version`.
-9. Check out a fresh local branch with the same name as the deleted working
-   branch from the updated `development` branch.
-10. Update the new `@carecard/...` package version in `app-dashboard` and in
-    only the `ms-*` repositories that already declare the package, plus any
-    explicitly intended new consumers.
-11. Run `npm install` and relevant validation in each updated consumer.
-12. Do not commit the `ms-*` or `app-dashboard` consumer updates unless the user
-    explicitly asks.
-
-## Consumer Update Rules
-
-- Discover existing consumers by checking each target repository `package.json`
-  for the published package name.
-- Install exact package versions, for example
-  `npm install <package-name>@<version> --save-exact`.
-- Keep consumer updates local and uncommitted unless the user gives a separate
-  commit or PR instruction.
-- If a consumer should become a new dependency, require explicit user intent for
-  that repository.
-
-## Reporting
-
-Report the package name, published version, development PR, main PR, npm
-publication check, consumer repositories updated, validation commands run, and
-any consumer updates intentionally left uncommitted.

package/.agents/skills/npm-package-flow/agents/openai.yaml

@@ -1,5 +0,0 @@
-interface:
-  display_name: 'npm Package Flow'
-  short_description: 'Use in pkg-* repositories when publishable @carecard package code changes need npm publication and consumer updates.'
-  brand_color: '#0F766E'
-  default_prompt: 'Use $npm-package-flow when this task matches the skill scope.'