@cubis/foundry 0.3.10

package/Ai Agent Workflow/powers/postman/nestjs-expert/steering/secure-sessions.md

@@ -0,0 +1,56 @@
+# Secure Sessions (NestJS + Fastify)
+
+Use this guide when implementing cookie-based sessions for NestJS apps running with Fastify.
+
+## Session Baseline
+
+- Use `@fastify/cookie` and `@fastify/session`.
+- Register cookie plugin before session plugin.
+- Use a strong random session secret and rotate on schedule.
+- Keep cookie `httpOnly: true`.
+- Set `secure: true` in production.
+- Use explicit `sameSite` based on cross-site requirements.
+
+## Recommended Cookie Settings
+
+```ts
+cookie: {
+  httpOnly: true,
+  secure: process.env.NODE_ENV === 'production',
+  sameSite: 'lax',
+  path: '/',
+  maxAge: 1000 * 60 * 60 * 24, // 24h
+}
+```
+
+## Session Lifecycle
+
+1. Regenerate session ID at login to prevent fixation.
+2. Store only minimum identity context in session.
+3. Clear session and cookie on logout.
+4. Enforce idle timeout and absolute timeout.
+
+## What to Store
+
+- `userId`
+- `organizationId`
+- `role`
+
+Do not store tokens, passwords, raw PII, or authorization policy blobs.
+
+## CSRF and State-Changing Routes
+
+- Enable CSRF protection for cookie-authenticated forms and mutation routes.
+- Validate origin and referer where applicable.
+- Require `POST/PUT/PATCH/DELETE` requests to pass CSRF checks.
+
+## Operational Controls
+
+- Log auth/session failures with redaction.
+- Alert on unusual session churn and repeated invalid signatures.
+- Keep server clocks synchronized to avoid expiry drift.
+
+## Related
+
+- `steering/authentication.md`
+- `steering/services-di.md`

package/Ai Agent Workflow/powers/postman/nestjs-expert/steering/services-di.md

@@ -0,0 +1,143 @@
+# Services & Dependency Injection
+
+> Reference for: NestJS Expert
+> Load when: Creating services, dependency injection, providers
+
+## Service Pattern
+
+```typescript
+import { Injectable, Logger, NotFoundException, ConflictException } from '@nestjs/common';
+import { InjectRepository } from '@nestjs/typeorm';
+import { Repository } from 'typeorm';
+
+@Injectable()
+export class UsersService {
+  private readonly logger = new Logger(UsersService.name);
+
+  constructor(
+    @InjectRepository(User)
+    private readonly repo: Repository<User>,
+    private readonly emailService: EmailService,
+  ) {}
+
+  async create(dto: CreateUserDto): Promise<User> {
+    try {
+      const user = this.repo.create(dto);
+      const saved = await this.repo.save(user);
+      await this.emailService.sendWelcome(saved.email);
+      return saved;
+    } catch (error) {
+      if (error.code === '23505') {
+        throw new ConflictException('Email already exists');
+      }
+      this.logger.error(`Failed to create user: ${error.message}`);
+      throw error;
+    }
+  }
+
+  async findOne(id: string): Promise<User> {
+    const user = await this.repo.findOne({ where: { id } });
+    if (!user) {
+      throw new NotFoundException(`User ${id} not found`);
+    }
+    return user;
+  }
+
+  async update(id: string, dto: UpdateUserDto): Promise<User> {
+    const user = await this.findOne(id);
+    Object.assign(user, dto);
+    return this.repo.save(user);
+  }
+
+  async remove(id: string): Promise<void> {
+    const result = await this.repo.delete(id);
+    if (result.affected === 0) {
+      throw new NotFoundException(`User ${id} not found`);
+    }
+  }
+}
+```
+
+## Module with Providers
+
+```typescript
+@Module({
+  imports: [TypeOrmModule.forFeature([User])],
+  controllers: [UsersController],
+  providers: [UsersService],
+  exports: [UsersService],  // Make available to other modules
+})
+export class UsersModule {}
+```
+
+## Custom Providers
+
+```typescript
+// Value provider
+{ provide: 'API_KEY', useValue: process.env.API_KEY }
+
+// Factory provider
+{
+  provide: 'CONFIG',
+  useFactory: (configService: ConfigService) => ({
+    apiUrl: configService.get('API_URL'),
+  }),
+  inject: [ConfigService],
+}
+
+// Class provider
+{ provide: LoggerService, useClass: CustomLoggerService }
+
+// Async factory
+{
+  provide: 'DATABASE_CONNECTION',
+  useFactory: async () => {
+    const connection = await createConnection();
+    return connection;
+  },
+}
+```
+
+## Injection Patterns
+
+```typescript
+// Constructor injection (preferred)
+constructor(private readonly usersService: UsersService) {}
+
+// Token injection
+constructor(@Inject('API_KEY') private apiKey: string) {}
+
+// Optional injection
+constructor(@Optional() private readonly cache?: CacheService) {}
+
+// Property injection (use sparingly)
+@Inject() private readonly logger: Logger;
+```
+
+## Scope
+
+```typescript
+// Default: Singleton (shared across app)
+@Injectable()
+export class SharedService {}
+
+// Request-scoped: New instance per request
+@Injectable({ scope: Scope.REQUEST })
+export class RequestService {
+  constructor(@Inject(REQUEST) private request: Request) {}
+}
+
+// Transient: New instance every injection
+@Injectable({ scope: Scope.TRANSIENT })
+export class HelperService {}
+```
+
+## Quick Reference
+
+| Pattern | Use When |
+|---------|----------|
+| Constructor DI | Most cases (recommended) |
+| `@Inject(token)` | Non-class tokens |
+| `@Optional()` | Optional dependency |
+| Factory provider | Dynamic configuration |
+| Scope.REQUEST | Per-request state |

package/Ai Agent Workflow/powers/postman/nestjs-expert/steering/strangler-fig-pattern.md

@@ -0,0 +1,47 @@
+# Strangler Fig Pattern
+
+Use this pattern to migrate from legacy Express routes to NestJS incrementally without a big-bang rewrite.
+
+## Goal
+
+Move route groups from legacy to NestJS in controlled slices while preserving behavior and uptime.
+
+## Migration Flow
+
+1. Keep legacy and NestJS running side by side.
+2. Add an edge router that forwards requests by route prefix.
+3. Migrate one bounded module at a time.
+4. Verify parity with contract tests and traffic shadowing.
+5. Shift traffic gradually.
+6. Remove legacy routes after sustained stability.
+
+## Routing Strategy
+
+- Legacy example: `/api/users/*` -> Express
+- New module: `/api/v2/users/*` -> NestJS
+- Optional cutover: keep same route and switch backend behind gateway flags
+
+## Safety Gates Per Slice
+
+- Contract tests pass against both implementations.
+- Error rates and latency remain within agreed SLO bounds.
+- Rollback is immediate by flipping router rules.
+- Data migrations are idempotent and reversible when possible.
+
+## Common Risks
+
+- Hidden shared state in legacy middleware.
+- Inconsistent auth/session behavior across stacks.
+- Schema drift between old and new DTO/validation layers.
+
+## Required Controls
+
+- Single source of truth for auth/session policy.
+- Structured logging with correlation IDs across both paths.
+- Feature flags for route-level cutovers.
+- Post-cutover monitoring window before route deletion.
+
+## Related
+
+- `steering/migration-from-express.md`
+- `steering/authentication.md`

package/Ai Agent Workflow/powers/postman/nestjs-expert/steering/testing-patterns.md

@@ -0,0 +1,189 @@
+# Testing Patterns
+
+> Reference for: NestJS Expert
+> Load when: Writing tests, Jest, mocking, E2E testing
+
+## Unit Test Setup
+
+```typescript
+import { Test, TestingModule } from '@nestjs/testing';
+import { getRepositoryToken } from '@nestjs/typeorm';
+import { Repository } from 'typeorm';
+import { NotFoundException } from '@nestjs/common';
+
+describe('UsersService', () => {
+  let service: UsersService;
+  let repo: jest.Mocked<Repository<User>>;
+
+  beforeEach(async () => {
+    const module: TestingModule = await Test.createTestingModule({
+      providers: [
+        UsersService,
+        {
+          provide: getRepositoryToken(User),
+          useValue: {
+            create: jest.fn(),
+            save: jest.fn(),
+            findOne: jest.fn(),
+            delete: jest.fn(),
+          },
+        },
+      ],
+    }).compile();
+
+    service = module.get(UsersService);
+    repo = module.get(getRepositoryToken(User));
+  });
+
+  afterEach(() => jest.clearAllMocks());
+});
+```
+
+## Service Tests
+
+```typescript
+describe('create', () => {
+  it('should create user', async () => {
+    const dto = { email: 'test@test.com', password: 'pass', name: 'Test' };
+    const user = { id: '1', ...dto };
+
+    repo.create.mockReturnValue(user as User);
+    repo.save.mockResolvedValue(user as User);
+
+    const result = await service.create(dto);
+
+    expect(repo.create).toHaveBeenCalledWith(dto);
+    expect(repo.save).toHaveBeenCalledWith(user);
+    expect(result).toEqual(user);
+  });
+});
+
+describe('findOne', () => {
+  it('should return user', async () => {
+    const user = { id: '1', email: 'test@test.com' };
+    repo.findOne.mockResolvedValue(user as User);
+
+    const result = await service.findOne('1');
+    expect(result).toEqual(user);
+  });
+
+  it('should throw NotFoundException', async () => {
+    repo.findOne.mockResolvedValue(null);
+    await expect(service.findOne('1')).rejects.toThrow(NotFoundException);
+  });
+});
+```
+
+## Controller Tests
+
+```typescript
+describe('UsersController', () => {
+  let controller: UsersController;
+  let service: jest.Mocked<UsersService>;
+
+  beforeEach(async () => {
+    const module = await Test.createTestingModule({
+      controllers: [UsersController],
+      providers: [
+        {
+          provide: UsersService,
+          useValue: {
+            create: jest.fn(),
+            findOne: jest.fn(),
+          },
+        },
+      ],
+    }).compile();
+
+    controller = module.get(UsersController);
+    service = module.get(UsersService);
+  });
+
+  it('should create user', async () => {
+    const dto = { email: 'test@test.com', password: 'pass', name: 'Test' };
+    const user = { id: '1', ...dto };
+    service.create.mockResolvedValue(user as User);
+
+    const result = await controller.create(dto);
+    expect(result).toEqual(user);
+  });
+});
+```
+
+## E2E Tests
+
+```typescript
+import { INestApplication } from '@nestjs/common';
+import * as request from 'supertest';
+
+describe('UsersController (e2e)', () => {
+  let app: INestApplication;
+  let authToken: string;
+
+  beforeAll(async () => {
+    const moduleFixture = await Test.createTestingModule({
+      imports: [AppModule],
+    }).compile();
+
+    app = moduleFixture.createNestApplication();
+    app.useGlobalPipes(new ValidationPipe({ whitelist: true }));
+    await app.init();
+
+    // Get auth token
+    const response = await request(app.getHttpServer())
+      .post('/auth/login')
+      .send({ email: 'test@test.com', password: 'password' });
+    authToken = response.body.access_token;
+  });
+
+  afterAll(() => app.close());
+
+  it('/users (POST)', () => {
+    return request(app.getHttpServer())
+      .post('/users')
+      .set('Authorization', `Bearer ${authToken}`)
+      .send({ email: 'new@test.com', password: 'Test1234', name: 'New' })
+      .expect(201)
+      .expect((res) => {
+        expect(res.body.email).toBe('new@test.com');
+      });
+  });
+
+  it('/users/:id (GET) - 404', () => {
+    return request(app.getHttpServer())
+      .get('/users/nonexistent-id')
+      .set('Authorization', `Bearer ${authToken}`)
+      .expect(404);
+  });
+});
+```
+
+## Mock Factory
+
+```typescript
+export const createMockRepository = <T>() => ({
+  create: jest.fn(),
+  save: jest.fn(),
+  find: jest.fn(),
+  findOne: jest.fn(),
+  update: jest.fn(),
+  delete: jest.fn(),
+  createQueryBuilder: jest.fn(() => ({
+    where: jest.fn().mockReturnThis(),
+    andWhere: jest.fn().mockReturnThis(),
+    getOne: jest.fn(),
+    getMany: jest.fn(),
+  })),
+});
+```
+
+## Quick Reference
+
+| Pattern | Use Case |
+|---------|----------|
+| `Test.createTestingModule()` | Create test module |
+| `jest.fn()` | Mock function |
+| `mockResolvedValue()` | Mock async return |
+| `mockReturnValue()` | Mock sync return |
+| `supertest` | E2E HTTP testing |
+| `beforeAll` / `afterAll` | Setup/teardown |

package/Ai Agent Workflow/powers/postman/oneup-design/POWER.md

@@ -0,0 +1,72 @@
+---
+name: "oneup-design"
+displayName: "OneUp Design System"
+description: "OneUp HR design system with One* components, colors, spacing, and typography tokens"
+keywords: ["design", "ui", "component", "color", "spacing", "padding", "typography", "OneText", "OneButton", "OneCard", "widget", "theme"]
+---
+
+# OneUp Design System
+
+## Onboarding
+
+Import the design system:
+```dart
+import '../../../../core/design_system/one_design_system.dart';
+```
+
+## When to Load Steering Files
+
+- Working with colors → `colors.md`
+- Working with spacing/padding → `spacing.md`
+- Using One* components → `components.md`
+
+## MCP Tools (Use Before Writing UI)
+
+1. `listComponents` → Find One* component
+2. `getComponentSpec` → Get props/examples
+3. `getDesignTokens` → Get tokens
+4. `validateWidget` → Validate compliance
+
+## Quick Reference
+
+### Colors
+
+```dart
+// Theme-aware
+context.colors.primary
+context.colors.surface
+context.colors.onSurface
+
+// Static
+OneColor.success   // #2DC656
+OneColor.error     // #FF3C35
+OneColor.white
+```
+
+### Spacing
+
+```dart
+OneSpacing.sm   // 8
+OneSpacing.md   // 12
+OneSpacing.lg   // 16
+OneSpacing.xl   // 20
+```
+
+### Padding
+
+```dart
+OnePadding.screenHorizontal  // h: 20
+OnePadding.cardAll           // all: 16
+OnePadding.custom(left: OneSpacing.sm)
+```
+
+### Forbidden Patterns
+
+```dart
+// ❌ Never use
+SizedBox(height: 16)         // Use OneSpacing.lg
+Color(0xFF...)               // Use context.colors.X
+Colors.white                 // Use OneColor.white
+Text(...)                    // Use OneText.X()
+ElevatedButton(...)          // Use OneButton.primary()
+```

package/Ai Agent Workflow/powers/postman/oneup-design/SKILL.md

@@ -0,0 +1,71 @@
+---
+name: "oneup-design"
+description: "OneUp HR design system with One* components, colors, spacing, and typography tokens"
+---
+
+
+# OneUp Design System
+
+## Onboarding
+
+Import the design system:
+```dart
+import '../../../../core/design_system/one_design_system.dart';
+```
+
+## When to Load Steering Files
+
+- Working with colors → `colors.md`
+- Working with spacing/padding → `spacing.md`
+- Using One* components → `components.md`
+
+## MCP Tools (Use Before Writing UI)
+
+1. `listComponents` → Find One* component
+2. `getComponentSpec` → Get props/examples
+3. `getDesignTokens` → Get tokens
+4. `validateWidget` → Validate compliance
+
+## Quick Reference
+
+### Colors
+
+```dart
+// Theme-aware
+context.colors.primary
+context.colors.surface
+context.colors.onSurface
+
+// Static
+OneColor.success   // #2DC656
+OneColor.error     // #FF3C35
+OneColor.white
+```
+
+### Spacing
+
+```dart
+OneSpacing.sm   // 8
+OneSpacing.md   // 12
+OneSpacing.lg   // 16
+OneSpacing.xl   // 20
+```
+
+### Padding
+
+```dart
+OnePadding.screenHorizontal  // h: 20
+OnePadding.cardAll           // all: 16
+OnePadding.custom(left: OneSpacing.sm)
+```
+
+### Forbidden Patterns
+
+```dart
+// ❌ Never use
+SizedBox(height: 16)         // Use OneSpacing.lg
+Color(0xFF...)               // Use context.colors.X
+Colors.white                 // Use OneColor.white
+Text(...)                    // Use OneText.X()
+ElevatedButton(...)          // Use OneButton.primary()
+```

package/Ai Agent Workflow/powers/postman/oneup-design/steering/colors.md

@@ -0,0 +1,41 @@
+# Color Tokens
+
+## Theme-Aware Colors
+
+Use `context.colors.X` - these adapt to light/dark theme:
+
+| Token | Access | Usage |
+|-------|--------|-------|
+| primary | `context.colors.primary` | Primary actions, buttons, links |
+| onPrimary | `context.colors.onPrimary` | Text/icons on primary |
+| secondary | `context.colors.secondary` | Secondary actions |
+| surface | `context.colors.surface` | Card backgrounds, sheets |
+| onSurface | `context.colors.onSurface` | Primary text |
+| onSurfaceVariant | `context.colors.onSurfaceVariant` | Secondary text, hints |
+| outline | `context.colors.outline` | Borders, dividers |
+| error | `context.colors.error` | Error states |
+
+## Static Colors
+
+Use `OneColor.X` - fixed colors for status:
+
+| Token | Hex | Usage |
+|-------|-----|-------|
+| success | #2DC656 | Success indicators |
+| warning | #FFBF00 | Warning indicators |
+| error | #FF3C35 | Error badges |
+| info | #48AFFA | Info indicators |
+| white | #FFFFFF | White overlays |
+| black | #000000 | Black overlays |
+| disableColor | #70808F | Disabled states |
+
+## Forbidden
+
+```dart
+// ❌ NEVER use these
+Color(0xFF123456);
+Colors.white;
+Colors.black;
+Theme.of(context).colorScheme.primary;
+OneColor.primary;  // Use context.colors.primary instead
+```

package/Ai Agent Workflow/powers/postman/oneup-design/steering/components.md

@@ -0,0 +1,53 @@
+# Component Mapping
+
+## Flutter → One* Components
+
+| Flutter Widget | One* Component |
+|----------------|----------------|
+| ElevatedButton | OneButton |
+| TextButton | OneButton.text |
+| OutlinedButton | OneButton.outlined |
+| TextField | OneTextField |
+| Card | OneCard |
+| Text | OneText |
+| CircularProgressIndicator | OneLoading |
+| Checkbox | OneCheckbox |
+| Switch | OneSwitch |
+| Radio | OneRadio |
+| Slider | OneSlider |
+| BottomSheet | OneBottomSheet |
+| Dialog | OneDialog |
+| SnackBar | OneSnackBar |
+| AppBar | OneAppBar |
+| Chip | OneChip |
+| Badge | OneBadge |
+| Avatar | OneAvatar |
+| Divider | OneDivider |
+
+## Usage Examples
+
+```dart
+// ❌ Don't use
+ElevatedButton(
+  onPressed: () {},
+  child: Text('Submit'),
+)
+
+// ✅ Use instead
+OneButton(
+  onPressed: () {},
+  label: 'Submit',
+)
+```
+
+```dart
+// ❌ Don't use
+TextField(
+  decoration: InputDecoration(labelText: 'Email'),
+)
+
+// ✅ Use instead
+OneTextField(
+  label: 'Email',
+)
+```