@codyswann/lisa 4.74.9 → 4.75.1

package/plugins/lisa-expo-devin/skills/ops-db-ops/SKILL.md

@@ -0,0 +1,214 @@
+---
+name: ops-db-ops
+description: Database migrations, reverts, schema generation, GraphQL codegen, and the reset/seed/verify state operations for Expo + serverless backend projects. Operates on the backend (TypeORM) and frontend (GraphQL code generation).
+allowed-tools:
+  - Bash
+  - Read
+---
+
+# Ops: Database Operations
+
+Manage database migrations, schema generation, GraphQL code generation, and the project's
+reset/seed/verify state operations.
+
+**Argument**: `$ARGUMENTS` — operation (`migrate`, `revert`, `generate`, `schema`, `codegen`, `seed`, `reset`, `reset:verify`, `state:inventory`, `state:classify`) and optional environment (default: `dev`)
+
+## Path Convention
+
+- **Frontend**: Current project directory (`.`)
+- **Backend**: `${BACKEND_DIR:-../backend-v2}` — set `BACKEND_DIR` in `.claude/settings.local.json` if your backend is elsewhere
+
+## Safety
+
+**CRITICAL**: Never run migrations or reverts against production without explicit human confirmation.
+
+**Destructive state operations are stricter than that.** `reset` (and any `seed` that clears before
+it writes) is governed by the `reset-seed-coverage` rule and never runs on the strength of a
+confirmation alone:
+
+- Run `--dry-run` first, always, and read what it says it will change. A dry run that reports an
+  entity whose ownership it cannot establish is a STOP, not a warning.
+- The environment is whatever the adapter resolves server-side. A `--stage`, `TEST_ENV`, URL, host,
+  or public build-time variable is a *request* the adapter checks, never the answer. If the requested
+  stage and the resolved environment disagree, that is a refusal to investigate — not something to
+  re-run with a different flag.
+- **Production has no override, in any repo, ever.** There is no flag, variable, or confirmation
+  phrase that makes a production reset correct. If one appears to exist, stop and report it.
+- Never invent a reset. If the project ships no reset adapter, say so and stop; do not improvise
+  deletions with ad-hoc queries or the migration tooling.
+
+## Discovery
+
+Read the backend `package.json` to discover available migration and schema scripts:
+- `migration:run:*` — run pending migrations
+- `migration:revert:*` — revert last migration
+- `migration:generate:*` — generate new migration from entity changes
+- `migration:create` — create empty migration
+- `generate:sql-schema*` — regenerate SQL schema for MCP
+- AWS credential/profile scripts such as `aws:signin:*` and any environment-backed remote profile
+
+Read the backend and frontend `package.json` to discover the state operations. Discover them; do not
+assume these exact names — a project may expose them under its own, and this skill runs whatever the
+project declares:
+- `db:seed` / `seed:*` — write the fixture baseline
+- `db:reset` / `reset:*` — converge state back to that baseline
+- `db:reset:verify` / `reset:verify:*` — prove the post-state, by exact counts
+- `state:inventory` — enumerate what the running environment actually holds
+- `check:state-classification` — compare that inventory against the state contract
+
+Read the frontend `package.json` to discover codegen scripts:
+- `fetch:graphql:schema:*` — fetch GraphQL schema
+- `generate:types:*` — generate TypeScript types
+
+If a state script the operation needs does not exist, report the absence and the scripts that DO
+exist. Do not substitute a different script, and do not fall back to running SQL by hand.
+
+## AWS Prerequisite
+
+All database operations (except `codegen`) require AWS credentials. Verify the target profile first:
+
+```bash
+cd "${BACKEND_DIR:-../backend-v2}"
+aws sts get-caller-identity --profile {aws-profile}
+```
+
+If this is an interactive local session and credentials are expired, refresh the backend's local AWS
+signin flow. In a headless or remote-routine session, use the preconfigured environment-backed
+assume-role profile and do not start an SSO browser/device flow.
+
+## Operations
+
+### migrate (run pending migrations)
+
+**Local database**:
+```bash
+cd "${BACKEND_DIR:-../backend-v2}"
+STAGE={env} bun run migration:run:local
+```
+
+**Remote database**:
+```bash
+cd "${BACKEND_DIR:-../backend-v2}"
+STAGE={env} bun run migration:run:remote:local
+```
+
+### revert (undo last migration)
+
+**Local database**:
+```bash
+cd "${BACKEND_DIR:-../backend-v2}"
+STAGE={env} bun run migration:revert:local
+```
+
+**Remote database**:
+```bash
+cd "${BACKEND_DIR:-../backend-v2}"
+STAGE={env} bun run migration:revert:remote:local
+```
+
+### generate (create new migration from entity changes)
+
+```bash
+cd "${BACKEND_DIR:-../backend-v2}"
+NAME={migration_name} bun run migration:generate:{env}
+```
+
+### create (create empty migration)
+
+```bash
+cd "${BACKEND_DIR:-../backend-v2}"
+NAME={migration_name} bun run migration:create
+```
+
+### schema (regenerate SQL schema for MCP)
+
+```bash
+cd "${BACKEND_DIR:-../backend-v2}"
+STAGE={env} bun run generate:sql-schema
+```
+
+### codegen (regenerate GraphQL types in frontend)
+
+1. **Fetch schema**:
+   ```bash
+   bun run fetch:graphql:schema:{env}
+   ```
+
+2. **Generate types**:
+   ```bash
+   bun run generate:types:{env}
+   ```
+
+**Note**: The backend must be running (locally or deployed) for schema fetching to work.
+
+### seed (write the fixture baseline)
+
+Run the project's discovered seed script for the target environment. A seed is additive or
+convergent, never a blind wipe; if the project's seed clears first, treat it as a reset and follow
+the reset sequence below.
+
+```bash
+cd "${BACKEND_DIR:-../backend-v2}"
+{package-manager} run {discovered-seed-script} --stage {env}
+```
+
+### reset (converge state back to the baseline)
+
+Never a single command. The sequence is fixed:
+
+1. **Dry run.** `{discovered-reset-script} --dry-run --stage {env}`. Read the enumeration. Stop on
+   any entity of unknown ownership, on any `forbidden`-classified entity appearing at all, and on
+   any disagreement between the requested stage and the resolved environment.
+2. **Classify first if the contract is stale.** If `check:state-classification` reports an
+   unclassified entity, the reset does not run — an unclassified entity is neither safe to keep nor
+   safe to delete. Fix the state contract, then start over at step 1.
+3. **Apply**, passing an idempotency key when running in CI:
+   `{discovered-reset-script} --stage {env} --idempotency-key {run-id}`.
+4. **Verify** with `reset:verify`. A reset that mutated but did not verify is a failure, not a
+   partial success.
+5. **Converge check.** Applying a second time must report no further change. If the second run keeps
+   deleting, the ownership predicate is wrong — report it rather than re-running.
+
+### reset:verify (prove the post-state)
+
+```bash
+{package-manager} run {discovered-verify-script} --stage {env}
+```
+
+Verification asserts **exact** expected counts per fixture entity. "At least one" passes against a
+leak, which is the condition being guarded.
+
+### state:inventory (enumerate what the environment actually holds)
+
+Produces the runtime inventory the classification check compares against. A complete inventory
+covers more than rows: identity-provider objects, object storage prefixes, search indexes, queues
+and dead-letter backlogs, caches with a persistence tier, derived and materialized views, and
+runtime-created jobs. Record anything that could not be enumerated, with the reason.
+
+### state:classify (compare the inventory to the contract)
+
+```bash
+node scripts/check-state-classification.mjs
+```
+
+Exit 0 = every entity the environment holds is classified and every policy obligation is met.
+Nonzero = an unclassified entity, an unswept `fixture-owned` entity, a stale classification, an
+incomplete inventory, or a missing assurance. Report the findings verbatim — each names the entity
+and what is missing.
+
+## Output Format
+
+Every state operation returns the standard command envelope on stdout — one JSON object with
+`schemaVersion`, `capability`, `mode`, `operation`, `environment`, `contractVersion`, `dryRun`,
+`status`, `correlationId`, and `summary{deleted,created,preserved}`. Report from that envelope, not
+from prose scraped off stderr. A destructive operation that produced no envelope has not been
+verified, whatever its exit code said.
+
+Report operation result:
+
+| Operation | Environment | Target | Status | Details |
+|-----------|-------------|--------|--------|---------|
+| migrate | dev | local DB | SUCCESS | 2 migrations applied |
+| codegen | dev | frontend | SUCCESS | Types regenerated |
+| reset | dev | reset adapter | completed | deleted 12 / preserved 31, converged on second apply, correlation `abc123` |
+| state:classify | dev | state contract | failed | `public.notes` unclassified — fail closed |

package/plugins/lisa-expo-devin/skills/ops-deploy/SKILL.md

@@ -0,0 +1,123 @@
+---
+name: ops-deploy
+description: Deploy Expo frontend (EAS Update/Build) or serverless backend (Serverless Framework) to dev, staging, or production environments.
+allowed-tools:
+  - Bash
+  - Read
+---
+
+# Ops: Deploy
+
+Deploy the application to remote environments.
+
+**Argument**: `$ARGUMENTS` — environment (`dev`, `staging`, `production`) and optional target (`frontend`, `backend`, `both`; default: `both`)
+
+## Path Convention
+
+- **Frontend**: Current project directory (`.`)
+- **Backend**: `${BACKEND_DIR:-../backend-v2}` — set `BACKEND_DIR` in `.claude/settings.local.json` if your backend is elsewhere
+
+## Safety
+
+**CRITICAL**: Production deployments require explicit human confirmation before proceeding. Always ask for confirmation when `$ARGUMENTS` contains `production`.
+
+## Discovery
+
+1. Read backend `package.json` to discover `deploy:*`, `aws:signin:*` scripts
+2. Read frontend `package.json` to discover available scripts
+3. Read `.env.{environment}` files to find GraphQL URLs for post-deploy verification
+
+## CI/CD Path (Preferred)
+
+The standard deployment path is via CI/CD — pushing to environment branches triggers auto-deploy. Manual deployment instructions below are for when CI/CD is not suitable.
+
+## Frontend Deployment
+
+### EAS Update (OTA — over-the-air JavaScript update)
+
+Use for JS-only changes (no native module changes).
+
+1. Verify EAS CLI:
+   ```bash
+   eas whoami
+   ```
+   If not authenticated: `eas login`
+
+2. Copy environment file:
+   ```bash
+   cp .env.{environment} .env
+   ```
+
+3. Deploy OTA update:
+   ```bash
+   STAGE={env} NODE_OPTIONS="--max-old-space-size=8192" eas update --auto --channel={env} --message="Manual update"
+   ```
+
+4. Verify deployment:
+   ```bash
+   eas update:list --branch {env} --limit 3
+   ```
+
+### EAS Build (Native binary — only when `app.config.ts` or native modules change)
+
+1. ```bash
+   eas build --platform all --non-interactive --no-wait --profile={profile}
+   ```
+
+2. Check build status:
+   ```bash
+   eas build:list --limit 5
+   ```
+
+## Backend Deployment
+
+### Full Deploy (Serverless Framework)
+
+1. Verify AWS credentials (discover the profile from backend `package.json` or remote-routine
+   `~/.aws/config`):
+   ```bash
+   cd "${BACKEND_DIR:-../backend-v2}"
+   aws sts get-caller-identity --profile {aws-profile}
+   ```
+   If this is an interactive local session and credentials are expired, refresh the backend's local
+   AWS signin flow. In a headless or remote-routine session, use the environment-backed assume-role
+   profile and do not start an SSO browser/device flow.
+
+2. Deploy all functions:
+   ```bash
+   cd "${BACKEND_DIR:-../backend-v2}"
+   bun run deploy:{env}
+   ```
+
+3. Verify (use the GraphQL URL from `.env.{environment}`):
+   ```bash
+   curl -sf {graphql-url} -X POST \
+     -H "Content-Type: application/json" \
+     -d '{"query":"{ __typename }"}' \
+     -w "\nHTTP %{http_code} in %{time_total}s\n"
+   ```
+
+### Single Function Deploy
+
+Discover available function names from backend `package.json` `deploy:function:*` scripts:
+
+```bash
+cd "${BACKEND_DIR:-../backend-v2}"
+FUNCTION_NAME={fn} bun run deploy:function:{env}
+```
+
+## Post-Deploy Verification
+
+After any deployment:
+
+1. **Health check** the deployed environment (use `ops-verify-health` skill)
+2. **Check logs** for errors in the first 5 minutes (use `ops-check-logs` skill)
+3. **Monitor Sentry** for new issues (use `ops-monitor-errors` skill)
+4. **Run browser UAT smoke test** against the deployed environment (use `ops-browser-uat` skill)
+
+Report deployment result as a table:
+
+| Target | Environment | Method | Status | Verification |
+|--------|-------------|--------|--------|-------------|
+| Frontend | dev | EAS Update | SUCCESS/FAIL | URL responds |
+| Backend | dev | Serverless | SUCCESS/FAIL | GraphQL responds |

package/plugins/lisa-expo-devin/skills/ops-monitor-errors/SKILL.md

@@ -0,0 +1,99 @@
+---
+name: ops-monitor-errors
+description: Monitor Sentry for unresolved errors in frontend and backend projects. Supports filtering by project, environment, and time range.
+allowed-tools:
+  - Bash
+  - Read
+---
+
+# Ops: Monitor Errors
+
+Monitor Sentry for errors in the application.
+
+**Argument**: `$ARGUMENTS` — project (`frontend`, `backend`, `all`; default: `all`) and optional time range (default: `1h`)
+
+## Discovery
+
+Discover Sentry configuration from:
+1. `.sentryclirc` — org and project names
+2. `.env.*` files — `EXPO_PUBLIC_SENTRY_DSN` for DSN
+3. `package.json` — `@sentry/react-native` (frontend) or `@sentry/node` (backend) for project type
+
+## Sentry CLI
+
+### List Unresolved Issues
+
+```bash
+sentry-cli issues list \
+  --org {org} \
+  --project {project}
+```
+
+### Filter by Environment
+
+```bash
+sentry-cli issues list \
+  --org {org} \
+  --project {project} \
+  --query "is:unresolved environment:{env}"
+```
+
+### Post-Deploy Check (new issues since deploy)
+
+```bash
+sentry-cli issues list \
+  --org {org} \
+  --project {project} \
+  --query "is:unresolved firstSeen:-{time}"
+```
+
+Where `{time}` is a Sentry duration like `1h`, `30m`, `24h`.
+
+## Sentry API (Fallback)
+
+If `sentry-cli` is not installed or not authenticated, use the API directly:
+
+### List Unresolved Issues
+
+```bash
+curl -sf "https://sentry.io/api/0/projects/{org}/{project}/issues/?query=is:unresolved&sort=date" \
+  -H "Authorization: Bearer $SENTRY_AUTH_TOKEN" | \
+  jq '.[] | {id: .id, title: .title, count: .count, userCount: .userCount, firstSeen: .firstSeen, lastSeen: .lastSeen}'
+```
+
+### Filter by Environment
+
+```bash
+curl -sf "https://sentry.io/api/0/projects/{org}/{project}/issues/?query=is:unresolved+environment:{env}&sort=date" \
+  -H "Authorization: Bearer $SENTRY_AUTH_TOKEN" | \
+  jq '.[] | {id: .id, title: .title, count: .count, userCount: .userCount}'
+```
+
+## Post-Deploy Workflow
+
+After any deployment:
+
+1. Wait 5 minutes for errors to surface
+2. Check for new unresolved issues in the deployed environment
+3. Assess severity: are these new regressions or pre-existing?
+4. Report findings with severity assessment
+
+## Output Format
+
+Report errors as a table:
+
+| Issue ID | Title | Events | Users | First Seen | Severity |
+|----------|-------|--------|-------|------------|----------|
+| 12345 | TypeError: Cannot read property 'name' | 42 | 15 | 5m ago | HIGH |
+| 12346 | Network request failed | 3 | 2 | 2h ago | MEDIUM |
+
+### Severity Classification
+
+| Severity | Criteria |
+|----------|----------|
+| CRITICAL | > 100 events or > 50 users in last hour |
+| HIGH | > 10 events or > 5 users, appeared after deploy |
+| MEDIUM | Recurring issue, < 10 events |
+| LOW | < 3 events, no user impact |
+
+Include summary: total unresolved issues, new since last deploy, and recommendation (proceed / investigate / rollback).

package/plugins/lisa-expo-devin/skills/ops-performance/SKILL.md

@@ -0,0 +1,165 @@
+---
+name: ops-performance
+description: Performance analysis for Expo + serverless backend projects. Runs Lighthouse audits, bundle size analysis, and k6 load tests.
+allowed-tools:
+  - Bash
+  - Read
+---
+
+# Ops: Performance
+
+Analyze application performance.
+
+**Argument**: `$ARGUMENTS` — analysis type (`lighthouse`, `bundle`, `k6`, `all`; default: `all`) and optional target environment
+
+## Path Convention
+
+- **Frontend**: Current project directory (`.`)
+- **Backend**: `${BACKEND_DIR:-../backend-v2}` — set `BACKEND_DIR` in `.claude/settings.local.json` if your backend is elsewhere
+
+## Discovery
+
+1. Read frontend `package.json` for `lighthouse:check`, `export:web`, `analyze:bundle` scripts
+2. Read backend `package.json` for `k6:*` scripts
+3. Read `e2e/constants.ts` or `.env.*` files for environment URLs
+
+## Lighthouse Audit
+
+### Against Local
+
+```bash
+npx lighthouse http://localhost:8081 \
+  --output=json \
+  --output-path=./lighthouse-local.json \
+  --chrome-flags='--headless --no-sandbox'
+```
+
+### Against Deployed Environment
+
+Discover frontend URLs from `e2e/constants.ts` or `.env.*` files:
+
+```bash
+npx lighthouse https://{env_url} \
+  --output=json \
+  --output-path=./lighthouse-{env}.json \
+  --chrome-flags='--headless --no-sandbox'
+```
+
+### LHCI (Lighthouse CI — uses project config)
+
+```bash
+bun run lighthouse:check
+```
+
+### Parse Lighthouse Results
+
+```bash
+cat lighthouse-{env}.json | jq '{
+  performance: .categories.performance.score,
+  accessibility: .categories.accessibility.score,
+  bestPractices: .categories["best-practices"].score,
+  seo: .categories.seo.score,
+  fcp: .audits["first-contentful-paint"].displayValue,
+  lcp: .audits["largest-contentful-paint"].displayValue,
+  tbt: .audits["total-blocking-time"].displayValue,
+  cls: .audits["cumulative-layout-shift"].displayValue,
+  si: .audits["speed-index"].displayValue
+}'
+```
+
+## Bundle Analysis
+
+### Full Analysis (export + source-map-explorer)
+
+```bash
+bun run export:web && bun run analyze:bundle
+```
+
+### Quick Size Check
+
+```bash
+bun run export:web
+echo "=== Total Bundle Size ==="
+du -sh dist/
+echo ""
+echo "=== Largest JS Files ==="
+find dist -name "*.js" -exec ls -lhS {} + 2>/dev/null | head -20
+```
+
+## k6 Load Tests
+
+Discover available k6 scripts from the backend `package.json` (matching `k6:*`).
+
+### Smoke Test (minimal load, verify endpoints work)
+
+```bash
+cd "${BACKEND_DIR:-../backend-v2}"
+bun run k6:smoke
+```
+
+### Load Test (normal traffic simulation)
+
+```bash
+cd "${BACKEND_DIR:-../backend-v2}"
+bun run k6:load
+```
+
+### Stress Test (push beyond normal capacity)
+
+```bash
+cd "${BACKEND_DIR:-../backend-v2}"
+bun run k6:stress
+```
+
+### Spike Test (sudden traffic burst)
+
+```bash
+cd "${BACKEND_DIR:-../backend-v2}"
+bun run k6:spike
+```
+
+### Docker-based k6 (no local k6 install needed)
+
+```bash
+cd "${BACKEND_DIR:-../backend-v2}"
+bun run k6:docker:smoke
+bun run k6:docker:load
+```
+
+## Output Format
+
+### Lighthouse Scores
+
+| Metric | Score | Rating |
+|--------|-------|--------|
+| Performance | 0.85 | GOOD |
+| Accessibility | 0.92 | GOOD |
+| Best Practices | 0.88 | GOOD |
+| SEO | 0.95 | GOOD |
+
+### Core Web Vitals
+
+| Metric | Value | Threshold | Status |
+|--------|-------|-----------|--------|
+| FCP (First Contentful Paint) | 1.2s | < 1.8s | PASS |
+| LCP (Largest Contentful Paint) | 2.1s | < 2.5s | PASS |
+| TBT (Total Blocking Time) | 150ms | < 200ms | PASS |
+| CLS (Cumulative Layout Shift) | 0.05 | < 0.1 | PASS |
+
+### Bundle Size
+
+| Category | Size | Notes |
+|----------|------|-------|
+| Total dist/ | 4.2 MB | |
+| Largest chunk | 1.1 MB | vendor.js |
+
+### k6 Results
+
+| Metric | Value |
+|--------|-------|
+| Requests/sec | 450 |
+| Avg response time | 120ms |
+| p95 response time | 350ms |
+| Error rate | 0.1% |
+
+Include recommendations for any metrics that fall below thresholds.