@cubis/foundry 0.3.31 → 0.3.32

package/workflows/workflows/agent-environment-setup/platforms/copilot/skills/rust-engineer/references/traits.md

@@ -0,0 +1,413 @@
+# Traits, Generics, and Type System
+
+## Basic Trait Definition
+
+```rust
+// Simple trait
+trait Drawable {
+    fn draw(&self);
+}
+
+// Trait with default implementation
+trait Describable {
+    fn describe(&self) -> String {
+        String::from("No description available")
+    }
+}
+
+// Implementing traits
+struct Circle {
+    radius: f64,
+}
+
+impl Drawable for Circle {
+    fn draw(&self) {
+        println!("Drawing circle with radius {}", self.radius);
+    }
+}
+
+impl Describable for Circle {
+    fn describe(&self) -> String {
+        format!("A circle with radius {}", self.radius)
+    }
+}
+```
+
+## Associated Types
+
+```rust
+// Associated types vs generic parameters
+trait Container {
+    type Item;
+
+    fn add(&mut self, item: Self::Item);
+    fn get(&self, index: usize) -> Option<&Self::Item>;
+}
+
+impl Container for Vec<i32> {
+    type Item = i32;
+
+    fn add(&mut self, item: i32) {
+        self.push(item);
+    }
+
+    fn get(&self, index: usize) -> Option<&i32> {
+        self.get(index)
+    }
+}
+
+// Iterator trait (standard library example)
+trait MyIterator {
+    type Item;
+
+    fn next(&mut self) -> Option<Self::Item>;
+}
+```
+
+## Generic Traits and Bounds
+
+```rust
+// Generic trait with multiple bounds
+fn print_info<T>(item: &T)
+where
+    T: std::fmt::Display + std::fmt::Debug,
+{
+    println!("Display: {}", item);
+    println!("Debug: {:?}", item);
+}
+
+// Generic struct with trait bounds
+struct Pair<T: PartialOrd> {
+    first: T,
+    second: T,
+}
+
+impl<T: PartialOrd> Pair<T> {
+    fn new(first: T, second: T) -> Self {
+        Self { first, second }
+    }
+
+    fn larger(&self) -> &T {
+        if self.first > self.second {
+            &self.first
+        } else {
+            &self.second
+        }
+    }
+}
+
+// Blanket implementation
+trait MyTrait {
+    fn do_something(&self);
+}
+
+impl<T: std::fmt::Display> MyTrait for T {
+    fn do_something(&self) {
+        println!("Value: {}", self);
+    }
+}
+```
+
+## Trait Objects (Dynamic Dispatch)
+
+```rust
+// Static dispatch (monomorphization)
+fn static_dispatch<T: Drawable>(item: &T) {
+    item.draw();
+}
+
+// Dynamic dispatch (trait objects)
+fn dynamic_dispatch(item: &dyn Drawable) {
+    item.draw();
+}
+
+// Storing trait objects
+struct Canvas {
+    shapes: Vec<Box<dyn Drawable>>,
+}
+
+impl Canvas {
+    fn new() -> Self {
+        Self { shapes: Vec::new() }
+    }
+
+    fn add_shape(&mut self, shape: Box<dyn Drawable>) {
+        self.shapes.push(shape);
+    }
+
+    fn draw_all(&self) {
+        for shape in &self.shapes {
+            shape.draw();
+        }
+    }
+}
+
+// Object safety: traits must meet criteria
+trait ObjectSafe {
+    fn method(&self);  // OK: takes &self
+}
+
+trait NotObjectSafe {
+    fn generic<T>(&self);  // NOT OK: generic method
+    fn by_value(self);     // NOT OK: takes self by value
+}
+```
+
+## Derive Macros
+
+```rust
+// Standard derive macros
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+struct User {
+    id: u64,
+    name: String,
+}
+
+// Deriving more traits
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
+struct Point {
+    x: i32,
+    y: i32,
+}
+
+// Custom derive with serde
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Serialize, Deserialize)]
+struct Config {
+    host: String,
+    port: u16,
+}
+```
+
+## Advanced Trait Patterns
+
+```rust
+// Extension trait pattern
+trait StringExt {
+    fn truncate_to(&self, max_len: usize) -> String;
+}
+
+impl StringExt for str {
+    fn truncate_to(&self, max_len: usize) -> String {
+        if self.len() <= max_len {
+            self.to_string()
+        } else {
+            format!("{}...", &self[..max_len])
+        }
+    }
+}
+
+// Sealed trait pattern (prevent external implementation)
+mod sealed {
+    pub trait Sealed {}
+}
+
+pub trait MySealed: sealed::Sealed {
+    fn method(&self);
+}
+
+struct MyType;
+impl sealed::Sealed for MyType {}
+impl MySealed for MyType {
+    fn method(&self) {
+        println!("Implemented");
+    }
+}
+
+// Supertraits
+trait Printable {
+    fn print(&self);
+}
+
+trait Loggable: Printable {  // Supertrait: must also impl Printable
+    fn log(&self) {
+        self.print();  // Can call supertrait methods
+    }
+}
+```
+
+## Associated Constants
+
+```rust
+trait Config {
+    const MAX_SIZE: usize;
+    const DEFAULT_TIMEOUT: u64;
+}
+
+struct ServerConfig;
+
+impl Config for ServerConfig {
+    const MAX_SIZE: usize = 1024;
+    const DEFAULT_TIMEOUT: u64 = 30;
+}
+
+fn use_config<T: Config>() {
+    println!("Max size: {}", T::MAX_SIZE);
+}
+```
+
+## Generic Associated Types (GATs)
+
+```rust
+// GATs allow generics in associated types
+trait LendingIterator {
+    type Item<'a> where Self: 'a;
+
+    fn next<'a>(&'a mut self) -> Option<Self::Item<'a>>;
+}
+
+struct WindowsMut<'data, T> {
+    data: &'data mut [T],
+    index: usize,
+}
+
+impl<'data, T> LendingIterator for WindowsMut<'data, T> {
+    type Item<'a> = &'a mut [T] where Self: 'a;
+
+    fn next<'a>(&'a mut self) -> Option<Self::Item<'a>> {
+        if self.index >= self.data.len() {
+            return None;
+        }
+
+        let start = self.index;
+        self.index += 2;
+
+        Some(&mut self.data[start..start.min(self.data.len())])
+    }
+}
+```
+
+## Marker Traits
+
+```rust
+use std::marker::{PhantomData, Send, Sync};
+
+// Send: type can be transferred across thread boundaries
+// Sync: type can be shared between threads (&T is Send)
+
+// Custom marker trait
+trait Trusted {}
+
+struct TrustedData<T> {
+    data: T,
+    _marker: PhantomData<T>,
+}
+
+impl<T: Trusted> TrustedData<T> {
+    fn new(data: T) -> Self {
+        Self {
+            data,
+            _marker: PhantomData,
+        }
+    }
+}
+```
+
+## Operator Overloading
+
+```rust
+use std::ops::{Add, Mul};
+
+#[derive(Debug, Clone, Copy)]
+struct Vector2D {
+    x: f64,
+    y: f64,
+}
+
+impl Add for Vector2D {
+    type Output = Self;
+
+    fn add(self, other: Self) -> Self {
+        Self {
+            x: self.x + other.x,
+            y: self.y + other.y,
+        }
+    }
+}
+
+impl Mul<f64> for Vector2D {
+    type Output = Self;
+
+    fn mul(self, scalar: f64) -> Self {
+        Self {
+            x: self.x * scalar,
+            y: self.y * scalar,
+        }
+    }
+}
+
+// Usage
+let v1 = Vector2D { x: 1.0, y: 2.0 };
+let v2 = Vector2D { x: 3.0, y: 4.0 };
+let v3 = v1 + v2;
+let v4 = v1 * 2.5;
+```
+
+## From/Into Conversion Traits
+
+```rust
+struct UserId(u64);
+
+impl From<u64> for UserId {
+    fn from(id: u64) -> Self {
+        UserId(id)
+    }
+}
+
+// Into is automatically implemented
+fn accept_user_id(id: impl Into<UserId>) {
+    let user_id = id.into();
+    println!("User ID: {}", user_id.0);
+}
+
+// TryFrom for fallible conversions
+use std::convert::TryFrom;
+
+impl TryFrom<i64> for UserId {
+    type Error = &'static str;
+
+    fn try_from(value: i64) -> Result<Self, Self::Error> {
+        if value < 0 {
+            Err("User ID cannot be negative")
+        } else {
+            Ok(UserId(value as u64))
+        }
+    }
+}
+```
+
+## Const Traits (Nightly)
+
+```rust
+// Const trait implementations (requires nightly)
+#![feature(const_trait_impl)]
+
+#[const_trait]
+trait ConstAdd {
+    fn add(self, other: Self) -> Self;
+}
+
+impl const ConstAdd for i32 {
+    fn add(self, other: Self) -> Self {
+        self + other
+    }
+}
+
+const fn compute() -> i32 {
+    5.add(10)  // Can use in const context
+}
+```
+
+## Best Practices
+
+- Prefer associated types when there's one clear type per implementation
+- Use generic parameters when multiple types might be used simultaneously
+- Keep traits small and focused (single responsibility)
+- Use extension traits to add functionality to existing types
+- Document trait requirements and invariants
+- Use marker traits for compile-time guarantees
+- Prefer static dispatch for performance, dynamic dispatch for flexibility
+- Use #[derive] when possible instead of manual implementations
+- Implement standard traits (Debug, Clone, etc.) for better ecosystem integration
+- Use sealed traits to prevent external implementations when needed

package/workflows/workflows/agent-environment-setup/platforms/copilot/skills/saas-builder/POWER.md

@@ -0,0 +1,165 @@
+---
+name: "saas-builder"
+displayName: "SaaS Builder"
+description: "Build production-ready multi-tenant SaaS applications with serverless architecture, integrated billing, and enterprise-grade security"
+keywords: ["saas", "multi-tenant", "serverless", "aws", "lambda", "dynamodb", "stripe", "billing", "react", "typescript"]
+author: "Allen Helton"
+---
+
+# SaaS Builder Power
+
+Build production-ready multi-tenant SaaS applications with serverless architecture, integrated billing, and enterprise-grade security.
+
+## Overview
+
+The SaaS Builder power provides tools and patterns for building scalable, cost-efficient SaaS applications on AWS. It combines serverless infrastructure, multi-tenant data isolation, subscription management, and usage-based billing into a cohesive development framework.
+
+## Core Capabilities
+
+- **Multi-tenant architecture** with tenant isolation at the data layer
+- **Serverless-first** infrastructure (Lambda, API Gateway, DynamoDB)
+- **Integrated billing** with Stripe and usage metering
+- **Authentication & authorization** with JWT and RBAC
+- **Cost-per-tenant economics** with zero idle costs
+- **React + TypeScript** frontend with Tailwind CSS
+
+## MCP Servers
+
+- **fetch**: HTTP requests for external API integration
+- **stripe**: Payment processing and subscription management (disabled by default)
+- **aws-knowledge-mcp-server**: AWS documentation and best practices
+- **awslabs.dynamodb-mcp-server**: DynamoDB operations with tenant isolation
+- **awslabs.aws-serverless-mcp**: Serverless application deployment
+- **playwright**: Browser automation for testing (disabled by default)
+
+## Architecture Principles
+
+### Multi-Tenancy
+- Tenant ID prefix in all database keys: `${tenantId}#${entityType}#${id}`
+- Lambda authorizer injects tenant context from JWT
+- No cross-tenant data access
+- Tenant-specific feature flags and quotas
+
+### Cost Optimization
+- Pay-per-use serverless components
+- DynamoDB on-demand pricing
+- Zero cost when idle
+- Linear scaling economics
+
+### Security
+- Managed authentication (Cognito/Auth0)
+- JWT tokens with tenant claims
+- Role-based access control (RBAC)
+- Encryption at rest and in transit
+
+## Repository Structure
+
+```
+/
+├── frontend/          # React + TypeScript + Tailwind
+├── backend/           # Lambda functions
+│   ├── functions/     # API handlers
+│   │   ├── authorizer/
+│   │   ├── api/
+│   │   └── billing/
+│   ├── lib/           # Business logic
+│   └── infrastructure/ # IaC (CDK/SAM)
+├── schema/            # API contracts (OpenAPI)
+└── .kiro/             # Kiro configuration
+```
+
+## Billing & Payments
+
+### Money Handling
+- Integer cents only (never floats)
+- Store: `amount_cents: 1999` (represents $19.99)
+- Currency code with every amount
+
+### Payment Integration
+- Stripe for payment processing
+- Webhook verification and idempotency
+- Subscription lifecycle management
+- Usage-based metering with EventBridge
+
+### Subscription States
+- `trial`, `active`, `past_due`, `canceled`, `expired`
+- Grace periods for payment failures
+- Prorated plan changes
+
+## Implementation Patterns
+
+### API Design
+- RESTful conventions: `/api/v1/users`, `/api/v1/users/{id}`
+- Versioned endpoints
+- OpenAPI specification
+- Proper HTTP status codes
+
+### Lambda Functions
+Every function follows this pattern:
+1. Extract tenant context from authorizer
+2. Extract user roles from authorizer
+3. Validate parameters
+4. Check permissions (RBAC)
+5. Prefix database operations with tenant ID
+6. Return proper status codes
+7. Log with tenant context
+
+### DynamoDB
+- Composite keys: `pk: ${tenantId}#${entityType}#${id}`
+- GSI for queries: `GSI1PK: ${tenantId}`, `GSI1SK: ${entityType}#${timestamp}`
+- Tenant-scoped queries only
+
+### Frontend
+- Functional React components with hooks
+- TypeScript strict mode
+- Tailwind utility classes
+- Tenant context in React Context
+- Feature flags for tenant-specific UI
+
+## Getting Started
+
+1. Configure AWS credentials and region in `mcp.json`
+2. Enable Stripe integration if using payments
+3. Review steering files for detailed patterns
+4. Use OpenAPI schema as source of truth
+5. Implement Lambda authorizer first
+6. Build tenant-aware API endpoints
+7. Add usage metering for billable operations
+
+## Configuration
+
+Edit `saas-builder/mcp.json` to:
+- Set AWS profile and region for serverless deployment
+- Enable Stripe integration (update `disabled: false`)
+- Enable Playwright for browser testing
+- Configure auto-approve for trusted tools
+
+## Best Practices
+
+- Never use floats for money calculations
+- Always validate tenant context
+- Check user roles before operations
+- Prefix all keys with tenant ID
+- Use idempotency keys for payments
+- Verify webhook signatures
+- Implement rate limiting per tenant
+- Monitor cost per tenant
+- Test cross-tenant isolation
+- Design for 10x growth
+
+## Testing
+
+- Unit tests for business logic
+- Integration tests for tenant isolation
+- Test cross-tenant data leakage
+- Use Stripe test mode
+- Test webhook delivery failures
+- Load test with multi-tenant traffic
+
+## Compliance
+
+- PCI compliance via Stripe (never store cards)
+- GDPR support (data export/deletion)
+- Audit logging per tenant
+- Data residency support
+- Encryption at rest and in transit

package/workflows/workflows/agent-environment-setup/platforms/copilot/skills/saas-builder/SKILL.md

@@ -0,0 +1,85 @@
+---
+name: "saas-builder"
+description: "Build or review production-ready multi-tenant SaaS systems on AWS serverless architecture with React + TypeScript frontend, tenant-isolated DynamoDB data models, JWT/RBAC authorization, Stripe subscriptions, and usage-based billing. Use for SaaS architecture design, implementation planning, API/Lambda patterns, billing workflows, and tenant isolation audits."
+---
+
+# SaaS Builder
+
+Implement multi-tenant SaaS systems with serverless-first architecture, strict tenant isolation, and billing-grade data handling.
+
+## Core Workflow
+
+1. Define tenant model, subscription tiers, quotas, and billable events before API design.
+2. Set repository layout using `steering/repository-structure.md`.
+3. Implement authentication first: Lambda authorizer, tenant claims, and role extraction.
+4. Implement tenant-scoped data access: all keys prefixed by tenant ID.
+5. Implement API endpoints with validation, RBAC checks, and tenant-aware logging.
+6. Implement billing integration: idempotent payment operations, webhook verification, usage metering.
+7. Implement frontend tenant context, quota handling, and feature-flagged UI.
+8. Validate cross-tenant isolation, billing edge cases, and operational monitoring before release.
+
+## Load Steering Files On Demand
+
+- `steering/architecture-principles.md`
+Purpose: Multi-tenancy, cost model, auth/authorization, compliance, and scalability constraints.
+Load when: Defining architecture decisions and non-functional requirements.
+
+- `steering/implementation-patterns.md`
+Purpose: API conventions, Lambda function sequence, DynamoDB keys, frontend/backend code style.
+Load when: Implementing endpoints, handlers, data access, and UI integration.
+
+- `steering/billing-and-payments.md`
+Purpose: Money representation, webhook/idempotency rules, subscription lifecycle, invoicing, tax, fraud, and testing.
+Load when: Implementing payments, usage metering, and financial reporting.
+
+- `steering/repository-structure.md`
+Purpose: Target monorepo layout and ownership boundaries for frontend/backend/schema/infrastructure.
+Load when: Bootstrapping or refactoring project structure.
+
+## Non-Negotiable Guardrails
+
+### Tenant Isolation
+
+- Read tenant ID only from authorizer claims, never from request body.
+- Prefix all partition keys with tenant context.
+- Reject any operation that can return cross-tenant data.
+- Enforce RBAC checks at function entry for sensitive operations.
+
+### Money and Billing
+
+- Store money as integer cents only.
+- Attach currency code to every monetary value.
+- Use idempotency keys for charge/refund/subscription mutations.
+- Verify webhook signatures and support retry-safe processing.
+
+### API and Lambda
+
+- Use versioned REST endpoints and proper HTTP status codes.
+- Validate request inputs at API boundary.
+- Keep handlers thin and move business logic into shared modules.
+- Log failures with tenant context while avoiding sensitive data leaks.
+
+### Security and Compliance
+
+- Use managed authentication providers (Cognito/Auth0).
+- Never store card numbers; use provider tokens only.
+- Encrypt data at rest and in transit.
+- Keep immutable financial audit trails.
+
+## MCP Setup
+
+Use `mcp.json` as baseline MCP configuration:
+
+- Set `AWS_PROFILE` and `AWS_REGION` for `awslabs.aws-serverless-mcp`.
+- Enable `stripe` (`"disabled": false`) when payment integration is required.
+- Enable `playwright` when browser automation tests are required.
+
+## Output Expectations
+
+When producing architecture or implementation deliverables, include:
+
+1. Tenant isolation strategy and key schema.
+2. API contract plan (or OpenAPI updates).
+3. Billing flow and failure-handling behavior.
+4. Security/compliance controls.
+5. Testing plan including cross-tenant leakage and billing edge cases.

package/workflows/workflows/agent-environment-setup/platforms/copilot/skills/saas-builder/mcp.json

@@ -0,0 +1,51 @@
+{
+  "mcpServers": {
+    "fetch": {
+      "command": "uvx",
+      "args": [
+        "mcp-server-fetch"
+      ],
+      "env": {},
+      "disabled": false,
+      "autoApprove": []
+    },
+    "stripe": {
+      "url": "https://mcp.stripe.com",
+      "disabled": true
+    },
+    "aws-knowledge-mcp-server": {
+      "url": "https://knowledge-mcp.global.api.aws",
+      "disabled": false
+    },
+    "awslabs.dynamodb-mcp-server": {
+      "command": "uvx",
+      "args": [
+        "awslabs.dynamodb-mcp-server@latest"
+      ],
+      "env": {
+        "FASTMCP_LOG_LEVEL": "ERROR"
+      },
+      "disabled": false,
+      "autoApprove": []
+    },
+    "awslabs.aws-serverless-mcp": {
+      "command": "uvx",
+      "args": [
+        "awslabs.aws-serverless-mcp-server@latest"
+      ],
+      "env": {
+        "AWS_PROFILE": "<PROFILE>",
+        "AWS_REGION": "<REGION>",
+        "FASTMCP_LOG_LEVEL": "ERROR"
+      }
+    },
+    "playwright": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@executeautomation/playwright-mcp-server"
+      ],
+      "disabled": true
+    }
+  }
+}