@cubis/foundry 0.3.10

package/Ai Agent Workflow/workflows/agent-environment-setup/platforms/copilot/skills/nestjs-expert/references/secure-sessions.md

@@ -0,0 +1,56 @@
+# Secure Sessions (NestJS + Fastify)
+
+Use this guide when implementing cookie-based sessions for NestJS apps running with Fastify.
+
+## Session Baseline
+
+- Use `@fastify/cookie` and `@fastify/session`.
+- Register cookie plugin before session plugin.
+- Use a strong random session secret and rotate on schedule.
+- Keep cookie `httpOnly: true`.
+- Set `secure: true` in production.
+- Use explicit `sameSite` based on cross-site requirements.
+
+## Recommended Cookie Settings
+
+```ts
+cookie: {
+  httpOnly: true,
+  secure: process.env.NODE_ENV === 'production',
+  sameSite: 'lax',
+  path: '/',
+  maxAge: 1000 * 60 * 60 * 24, // 24h
+}
+```
+
+## Session Lifecycle
+
+1. Regenerate session ID at login to prevent fixation.
+2. Store only minimum identity context in session.
+3. Clear session and cookie on logout.
+4. Enforce idle timeout and absolute timeout.
+
+## What to Store
+
+- `userId`
+- `organizationId`
+- `role`
+
+Do not store tokens, passwords, raw PII, or authorization policy blobs.
+
+## CSRF and State-Changing Routes
+
+- Enable CSRF protection for cookie-authenticated forms and mutation routes.
+- Validate origin and referer where applicable.
+- Require `POST/PUT/PATCH/DELETE` requests to pass CSRF checks.
+
+## Operational Controls
+
+- Log auth/session failures with redaction.
+- Alert on unusual session churn and repeated invalid signatures.
+- Keep server clocks synchronized to avoid expiry drift.
+
+## Related
+
+- `references/authentication.md`
+- `references/services-di.md`

package/Ai Agent Workflow/workflows/agent-environment-setup/platforms/copilot/skills/nestjs-expert/references/services-di.md

@@ -0,0 +1,143 @@
+# Services & Dependency Injection
+
+> Reference for: NestJS Expert
+> Load when: Creating services, dependency injection, providers
+
+## Service Pattern
+
+```typescript
+import { Injectable, Logger, NotFoundException, ConflictException } from '@nestjs/common';
+import { InjectRepository } from '@nestjs/typeorm';
+import { Repository } from 'typeorm';
+
+@Injectable()
+export class UsersService {
+  private readonly logger = new Logger(UsersService.name);
+
+  constructor(
+    @InjectRepository(User)
+    private readonly repo: Repository<User>,
+    private readonly emailService: EmailService,
+  ) {}
+
+  async create(dto: CreateUserDto): Promise<User> {
+    try {
+      const user = this.repo.create(dto);
+      const saved = await this.repo.save(user);
+      await this.emailService.sendWelcome(saved.email);
+      return saved;
+    } catch (error) {
+      if (error.code === '23505') {
+        throw new ConflictException('Email already exists');
+      }
+      this.logger.error(`Failed to create user: ${error.message}`);
+      throw error;
+    }
+  }
+
+  async findOne(id: string): Promise<User> {
+    const user = await this.repo.findOne({ where: { id } });
+    if (!user) {
+      throw new NotFoundException(`User ${id} not found`);
+    }
+    return user;
+  }
+
+  async update(id: string, dto: UpdateUserDto): Promise<User> {
+    const user = await this.findOne(id);
+    Object.assign(user, dto);
+    return this.repo.save(user);
+  }
+
+  async remove(id: string): Promise<void> {
+    const result = await this.repo.delete(id);
+    if (result.affected === 0) {
+      throw new NotFoundException(`User ${id} not found`);
+    }
+  }
+}
+```
+
+## Module with Providers
+
+```typescript
+@Module({
+  imports: [TypeOrmModule.forFeature([User])],
+  controllers: [UsersController],
+  providers: [UsersService],
+  exports: [UsersService],  // Make available to other modules
+})
+export class UsersModule {}
+```
+
+## Custom Providers
+
+```typescript
+// Value provider
+{ provide: 'API_KEY', useValue: process.env.API_KEY }
+
+// Factory provider
+{
+  provide: 'CONFIG',
+  useFactory: (configService: ConfigService) => ({
+    apiUrl: configService.get('API_URL'),
+  }),
+  inject: [ConfigService],
+}
+
+// Class provider
+{ provide: LoggerService, useClass: CustomLoggerService }
+
+// Async factory
+{
+  provide: 'DATABASE_CONNECTION',
+  useFactory: async () => {
+    const connection = await createConnection();
+    return connection;
+  },
+}
+```
+
+## Injection Patterns
+
+```typescript
+// Constructor injection (preferred)
+constructor(private readonly usersService: UsersService) {}
+
+// Token injection
+constructor(@Inject('API_KEY') private apiKey: string) {}
+
+// Optional injection
+constructor(@Optional() private readonly cache?: CacheService) {}
+
+// Property injection (use sparingly)
+@Inject() private readonly logger: Logger;
+```
+
+## Scope
+
+```typescript
+// Default: Singleton (shared across app)
+@Injectable()
+export class SharedService {}
+
+// Request-scoped: New instance per request
+@Injectable({ scope: Scope.REQUEST })
+export class RequestService {
+  constructor(@Inject(REQUEST) private request: Request) {}
+}
+
+// Transient: New instance every injection
+@Injectable({ scope: Scope.TRANSIENT })
+export class HelperService {}
+```
+
+## Quick Reference
+
+| Pattern | Use When |
+|---------|----------|
+| Constructor DI | Most cases (recommended) |
+| `@Inject(token)` | Non-class tokens |
+| `@Optional()` | Optional dependency |
+| Factory provider | Dynamic configuration |
+| Scope.REQUEST | Per-request state |

package/Ai Agent Workflow/workflows/agent-environment-setup/platforms/copilot/skills/nestjs-expert/references/strangler-fig-pattern.md

@@ -0,0 +1,47 @@
+# Strangler Fig Pattern
+
+Use this pattern to migrate from legacy Express routes to NestJS incrementally without a big-bang rewrite.
+
+## Goal
+
+Move route groups from legacy to NestJS in controlled slices while preserving behavior and uptime.
+
+## Migration Flow
+
+1. Keep legacy and NestJS running side by side.
+2. Add an edge router that forwards requests by route prefix.
+3. Migrate one bounded module at a time.
+4. Verify parity with contract tests and traffic shadowing.
+5. Shift traffic gradually.
+6. Remove legacy routes after sustained stability.
+
+## Routing Strategy
+
+- Legacy example: `/api/users/*` -> Express
+- New module: `/api/v2/users/*` -> NestJS
+- Optional cutover: keep same route and switch backend behind gateway flags
+
+## Safety Gates Per Slice
+
+- Contract tests pass against both implementations.
+- Error rates and latency remain within agreed SLO bounds.
+- Rollback is immediate by flipping router rules.
+- Data migrations are idempotent and reversible when possible.
+
+## Common Risks
+
+- Hidden shared state in legacy middleware.
+- Inconsistent auth/session behavior across stacks.
+- Schema drift between old and new DTO/validation layers.
+
+## Required Controls
+
+- Single source of truth for auth/session policy.
+- Structured logging with correlation IDs across both paths.
+- Feature flags for route-level cutovers.
+- Post-cutover monitoring window before route deletion.
+
+## Related
+
+- `references/migration-from-express.md`
+- `references/authentication.md`

package/Ai Agent Workflow/workflows/agent-environment-setup/platforms/copilot/skills/nestjs-expert/references/testing-patterns.md

@@ -0,0 +1,189 @@
+# Testing Patterns
+
+> Reference for: NestJS Expert
+> Load when: Writing tests, Jest, mocking, E2E testing
+
+## Unit Test Setup
+
+```typescript
+import { Test, TestingModule } from '@nestjs/testing';
+import { getRepositoryToken } from '@nestjs/typeorm';
+import { Repository } from 'typeorm';
+import { NotFoundException } from '@nestjs/common';
+
+describe('UsersService', () => {
+  let service: UsersService;
+  let repo: jest.Mocked<Repository<User>>;
+
+  beforeEach(async () => {
+    const module: TestingModule = await Test.createTestingModule({
+      providers: [
+        UsersService,
+        {
+          provide: getRepositoryToken(User),
+          useValue: {
+            create: jest.fn(),
+            save: jest.fn(),
+            findOne: jest.fn(),
+            delete: jest.fn(),
+          },
+        },
+      ],
+    }).compile();
+
+    service = module.get(UsersService);
+    repo = module.get(getRepositoryToken(User));
+  });
+
+  afterEach(() => jest.clearAllMocks());
+});
+```
+
+## Service Tests
+
+```typescript
+describe('create', () => {
+  it('should create user', async () => {
+    const dto = { email: 'test@test.com', password: 'pass', name: 'Test' };
+    const user = { id: '1', ...dto };
+
+    repo.create.mockReturnValue(user as User);
+    repo.save.mockResolvedValue(user as User);
+
+    const result = await service.create(dto);
+
+    expect(repo.create).toHaveBeenCalledWith(dto);
+    expect(repo.save).toHaveBeenCalledWith(user);
+    expect(result).toEqual(user);
+  });
+});
+
+describe('findOne', () => {
+  it('should return user', async () => {
+    const user = { id: '1', email: 'test@test.com' };
+    repo.findOne.mockResolvedValue(user as User);
+
+    const result = await service.findOne('1');
+    expect(result).toEqual(user);
+  });
+
+  it('should throw NotFoundException', async () => {
+    repo.findOne.mockResolvedValue(null);
+    await expect(service.findOne('1')).rejects.toThrow(NotFoundException);
+  });
+});
+```
+
+## Controller Tests
+
+```typescript
+describe('UsersController', () => {
+  let controller: UsersController;
+  let service: jest.Mocked<UsersService>;
+
+  beforeEach(async () => {
+    const module = await Test.createTestingModule({
+      controllers: [UsersController],
+      providers: [
+        {
+          provide: UsersService,
+          useValue: {
+            create: jest.fn(),
+            findOne: jest.fn(),
+          },
+        },
+      ],
+    }).compile();
+
+    controller = module.get(UsersController);
+    service = module.get(UsersService);
+  });
+
+  it('should create user', async () => {
+    const dto = { email: 'test@test.com', password: 'pass', name: 'Test' };
+    const user = { id: '1', ...dto };
+    service.create.mockResolvedValue(user as User);
+
+    const result = await controller.create(dto);
+    expect(result).toEqual(user);
+  });
+});
+```
+
+## E2E Tests
+
+```typescript
+import { INestApplication } from '@nestjs/common';
+import * as request from 'supertest';
+
+describe('UsersController (e2e)', () => {
+  let app: INestApplication;
+  let authToken: string;
+
+  beforeAll(async () => {
+    const moduleFixture = await Test.createTestingModule({
+      imports: [AppModule],
+    }).compile();
+
+    app = moduleFixture.createNestApplication();
+    app.useGlobalPipes(new ValidationPipe({ whitelist: true }));
+    await app.init();
+
+    // Get auth token
+    const response = await request(app.getHttpServer())
+      .post('/auth/login')
+      .send({ email: 'test@test.com', password: 'password' });
+    authToken = response.body.access_token;
+  });
+
+  afterAll(() => app.close());
+
+  it('/users (POST)', () => {
+    return request(app.getHttpServer())
+      .post('/users')
+      .set('Authorization', `Bearer ${authToken}`)
+      .send({ email: 'new@test.com', password: 'Test1234', name: 'New' })
+      .expect(201)
+      .expect((res) => {
+        expect(res.body.email).toBe('new@test.com');
+      });
+  });
+
+  it('/users/:id (GET) - 404', () => {
+    return request(app.getHttpServer())
+      .get('/users/nonexistent-id')
+      .set('Authorization', `Bearer ${authToken}`)
+      .expect(404);
+  });
+});
+```
+
+## Mock Factory
+
+```typescript
+export const createMockRepository = <T>() => ({
+  create: jest.fn(),
+  save: jest.fn(),
+  find: jest.fn(),
+  findOne: jest.fn(),
+  update: jest.fn(),
+  delete: jest.fn(),
+  createQueryBuilder: jest.fn(() => ({
+    where: jest.fn().mockReturnThis(),
+    andWhere: jest.fn().mockReturnThis(),
+    getOne: jest.fn(),
+    getMany: jest.fn(),
+  })),
+});
+```
+
+## Quick Reference
+
+| Pattern | Use Case |
+|---------|----------|
+| `Test.createTestingModule()` | Create test module |
+| `jest.fn()` | Mock function |
+| `mockResolvedValue()` | Mock async return |
+| `mockReturnValue()` | Mock sync return |
+| `supertest` | E2E HTTP testing |
+| `beforeAll` / `afterAll` | Setup/teardown |

package/Ai Agent Workflow/workflows/agent-environment-setup/platforms/copilot/skills/nextjs-developer/POWER.md

@@ -0,0 +1,166 @@
+---
+name: "nextjs-developer"
+displayName: "Next.js Developer"
+description: "Expert Next.js 14+ developer with App Router, Server Components, Server Actions, performance optimization, SEO, and production deployment patterns"
+keywords:
+  [
+    "nextjs",
+    "next.js",
+    "react",
+    "app router",
+    "server components",
+    "server actions",
+    "vercel",
+    "ssr",
+    "seo",
+    "typescript",
+  ]
+---
+
+# Next.js Developer
+
+## Overview
+
+Senior Next.js developer expertise for Next.js 14+ with App Router and full-stack features. Covers server components, server actions, edge runtime, performance optimization, and production deployment with focus on fast, SEO-friendly applications.
+
+## When to Use
+
+- Building new Next.js 14+ projects with App Router
+- Implementing Server Components and Server Actions
+- Optimizing Core Web Vitals and performance
+- Setting up data fetching with caching and revalidation
+- Configuring SEO (metadata, sitemaps, structured data)
+- Deploying to Vercel, Docker, or self-hosted environments
+- Writing tests with Playwright and React Testing Library
+
+## Quick Reference
+
+### App Router File Conventions
+
+```
+app/
+├── layout.tsx          # Root layout (required)
+├── page.tsx            # Home page
+├── loading.tsx         # Loading UI (Suspense boundary)
+├── error.tsx           # Error boundary
+├── not-found.tsx       # 404 page
+├── (auth)/             # Route group (no URL segment)
+│   ├── login/page.tsx
+│   └── register/page.tsx
+├── dashboard/
+│   ├── layout.tsx      # Nested layout
+│   ├── page.tsx
+│   └── @modal/         # Parallel route (slot)
+│       └── (..)settings/page.tsx  # Intercepting route
+└── api/
+    └── route.ts        # API route handler
+```
+
+### Server vs Client Components
+
+```tsx
+// Server Component (default) — no directive needed
+async function ProductList() {
+  const products = await db.product.findMany();
+  return (
+    <ul>
+      {products.map((p) => (
+        <li key={p.id}>{p.name}</li>
+      ))}
+    </ul>
+  );
+}
+
+// Client Component — needs 'use client' directive
+("use client");
+import { useState } from "react";
+export function Counter() {
+  const [count, setCount] = useState(0);
+  return <button onClick={() => setCount((c) => c + 1)}>{count}</button>;
+}
+```
+
+### Server Actions
+
+```tsx
+// Inline server action
+async function createPost(formData: FormData) {
+  "use server";
+  const title = formData.get("title") as string;
+  await db.post.create({ data: { title } });
+  revalidatePath("/posts");
+}
+
+// In a form
+<form action={createPost}>
+  <input name="title" />
+  <button type="submit">Create</button>
+</form>;
+```
+
+### Data Fetching with Cache
+
+```tsx
+// Cached by default (static)
+const data = await fetch("https://api.example.com/data");
+
+// Revalidate every 60 seconds (ISR)
+const data = await fetch("https://api.example.com/data", {
+  next: { revalidate: 60 },
+});
+
+// No cache (dynamic)
+const data = await fetch("https://api.example.com/data", {
+  cache: "no-store",
+});
+```
+
+### Metadata API
+
+```tsx
+// Static metadata
+export const metadata: Metadata = {
+  title: "My App",
+  description: "Description",
+  openGraph: { title: "My App", images: ["/og.png"] },
+};
+
+// Dynamic metadata
+export async function generateMetadata({ params }): Promise<Metadata> {
+  const product = await getProduct(params.id);
+  return { title: product.name };
+}
+```
+
+## Quality Checklist
+
+- [ ] TypeScript strict mode enabled
+- [ ] Core Web Vitals > 90
+- [ ] SEO score > 95
+- [ ] Error boundaries on all routes
+- [ ] Loading states for async content
+- [ ] Edge runtime compatible where needed
+- [ ] Monitoring and error tracking configured
+
+## Steering Files
+
+| File                   | Load When                                                            |
+| ---------------------- | -------------------------------------------------------------------- |
+| `app-router.md`        | Route structure, layouts, route groups, parallel/intercepting routes |
+| `server-components.md` | Server/Client component patterns, streaming, Suspense                |
+| `server-actions.md`    | Form handling, mutations, validation, optimistic updates             |
+| `data-fetching.md`     | Fetch patterns, caching, revalidation, SWR/React Query               |
+| `performance.md`       | Image/font/script optimization, Core Web Vitals, bundle analysis     |
+| `seo.md`               | Metadata API, sitemaps, structured data, Open Graph                  |
+| `deployment.md`        | Vercel, Docker, self-hosting, monitoring, multi-region               |
+| `testing.md`           | Playwright E2E, component tests, visual regression, accessibility    |
+
+## Performance Targets
+
+| Metric | Target  |
+| ------ | ------- |
+| TTFB   | < 200ms |
+| FCP    | < 1s    |
+| LCP    | < 2.5s  |
+| CLS    | < 0.1   |
+| FID    | < 100ms |