@cubis/foundry 0.3.31 → 0.3.33

package/workflows/powers/building-mcp-server-on-cloudflare/SKILL.md

@@ -1,258 +1,18 @@
 ---
-name: building-mcp-server-on-cloudflare
-description: Build and deploy remote MCP servers on Cloudflare Workers with tools, OAuth authentication, and production configuration.
+name: "building-mcp-server-on-cloudflare"
+description: "Compatibility wrapper skill. Canonical MCP skill moved to mcp/skills/building-mcp-server-on-cloudflare."
+metadata:
+  deprecated: true
+  replaced_by: "building-mcp-server-on-cloudflare"
+  moved_to: "mcp/skills/building-mcp-server-on-cloudflare/SKILL.md"
+  removal_target: "v0.6.0"
 ---
 
-# Building MCP Servers on Cloudflare
+# building-mcp-server-on-cloudflare (Compatibility Wrapper)
 
-Creates production-ready Model Context Protocol servers on Cloudflare Workers with tools, authentication, and deployment.
+This legacy workflow-path skill is kept for backward compatibility.
 
-## When to Use
+Canonical MCP skill path:
+- mcp/skills/building-mcp-server-on-cloudflare/SKILL.md
 
-- User wants to build a remote MCP server
-- User needs to expose tools via MCP
-- User asks about MCP authentication or OAuth
-- User wants to deploy MCP to Cloudflare Workers
-
-## Prerequisites
-
-- Cloudflare account with Workers enabled
-- Node.js 18+ and npm/pnpm/yarn
-- Wrangler CLI (`npm install -g wrangler`)
-
-## Quick Start
-
-### Option 1: Public Server (No Auth)
-
-```bash
-npm create cloudflare@latest -- my-mcp-server \
-  --template=cloudflare/ai/demos/remote-mcp-authless
-cd my-mcp-server
-npm start
-```
-
-Server runs at `http://localhost:8788/mcp`
-
-### Option 2: Authenticated Server (OAuth)
-
-```bash
-npm create cloudflare@latest -- my-mcp-server \
-  --template=cloudflare/ai/demos/remote-mcp-github-oauth
-cd my-mcp-server
-```
-
-Requires OAuth app setup. See [references/oauth-setup.md](references/oauth-setup.md).
-
-## Core Workflow
-
-### Step 1: Define Tools
-
-Tools are functions MCP clients can call. Define them using `server.tool()`:
-
-```typescript
-import { McpAgent } from "agents/mcp";
-import { z } from "zod";
-
-export class MyMCP extends McpAgent {
-  server = new Server({ name: "my-mcp", version: "1.0.0" });
-
-  async init() {
-    // Simple tool with parameters
-    this.server.tool(
-      "add",
-      { a: z.number(), b: z.number() },
-      async ({ a, b }) => ({
-        content: [{ type: "text", text: String(a + b) }],
-      })
-    );
-
-    // Tool that calls external API
-    this.server.tool(
-      "get_weather",
-      { city: z.string() },
-      async ({ city }) => {
-        const response = await fetch(`https://api.weather.com/${city}`);
-        const data = await response.json();
-        return {
-          content: [{ type: "text", text: JSON.stringify(data) }],
-        };
-      }
-    );
-  }
-}
-```
-
-### Step 2: Configure Entry Point
-
-**Public server** (`src/index.ts`):
-
-```typescript
-import { MyMCP } from "./mcp";
-
-export default {
-  fetch(request: Request, env: Env, ctx: ExecutionContext) {
-    const url = new URL(request.url);
-    if (url.pathname === "/mcp") {
-      return MyMCP.serveSSE("/mcp").fetch(request, env, ctx);
-    }
-    return new Response("MCP Server", { status: 200 });
-  },
-};
-
-export { MyMCP };
-```
-
-**Authenticated server** — See [references/oauth-setup.md](references/oauth-setup.md).
-
-### Step 3: Test Locally
-
-```bash
-# Start server
-npm start
-
-# In another terminal, test with MCP Inspector
-npx @modelcontextprotocol/inspector@latest
-# Open http://localhost:5173, enter http://localhost:8788/mcp
-```
-
-### Step 4: Deploy
-
-```bash
-npx wrangler deploy
-```
-
-Server accessible at `https://[worker-name].[account].workers.dev/mcp`
-
-### Step 5: Connect Clients
-
-**Claude Desktop** (`claude_desktop_config.json`):
-
-```json
-{
-  "mcpServers": {
-    "my-server": {
-      "command": "npx",
-      "args": ["mcp-remote", "https://my-mcp.workers.dev/mcp"]
-    }
-  }
-}
-```
-
-Restart Claude Desktop after updating config.
-
-## Tool Patterns
-
-### Return Types
-
-```typescript
-// Text response
-return { content: [{ type: "text", text: "result" }] };
-
-// Multiple content items
-return {
-  content: [
-    { type: "text", text: "Here's the data:" },
-    { type: "text", text: JSON.stringify(data, null, 2) },
-  ],
-};
-```
-
-### Input Validation with Zod
-
-```typescript
-this.server.tool(
-  "create_user",
-  {
-    email: z.string().email(),
-    name: z.string().min(1).max(100),
-    role: z.enum(["admin", "user", "guest"]),
-    age: z.number().int().min(0).optional(),
-  },
-  async (params) => {
-    // params are fully typed and validated
-  }
-);
-```
-
-### Accessing Environment/Bindings
-
-```typescript
-export class MyMCP extends McpAgent<Env> {
-  async init() {
-    this.server.tool("query_db", { sql: z.string() }, async ({ sql }) => {
-      // Access D1 binding
-      const result = await this.env.DB.prepare(sql).all();
-      return { content: [{ type: "text", text: JSON.stringify(result) }] };
-    });
-  }
-}
-```
-
-## Authentication
-
-For OAuth-protected servers, see [references/oauth-setup.md](references/oauth-setup.md).
-
-Supported providers:
-- GitHub
-- Google
-- Auth0
-- Stytch
-- WorkOS
-- Any OAuth 2.0 compliant provider
-
-## Wrangler Configuration
-
-Minimal `wrangler.toml`:
-
-```toml
-name = "my-mcp-server"
-main = "src/index.ts"
-compatibility_date = "2024-12-01"
-
-[durable_objects]
-bindings = [{ name = "MCP", class_name = "MyMCP" }]
-
-[[migrations]]
-tag = "v1"
-new_classes = ["MyMCP"]
-```
-
-With bindings (D1, KV, etc.):
-
-```toml
-[[d1_databases]]
-binding = "DB"
-database_name = "my-db"
-database_id = "xxx"
-
-[[kv_namespaces]]
-binding = "KV"
-id = "xxx"
-```
-
-## Common Issues
-
-### "Tool not found" in Client
-
-1. Verify tool name matches exactly (case-sensitive)
-2. Ensure `init()` registers tools before connections
-3. Check server logs: `wrangler tail`
-
-### Connection Fails
-
-1. Confirm endpoint path is `/mcp`
-2. Check CORS if browser-based client
-3. Verify Worker is deployed: `wrangler deployments list`
-
-### OAuth Redirect Errors
-
-1. Callback URL must match OAuth app config exactly
-2. Check `GITHUB_CLIENT_ID` and `GITHUB_CLIENT_SECRET` are set
-3. For local dev, use `http://localhost:8788/callback`
-
-## References
-
-- [references/examples.md](references/examples.md) — Official templates and production examples
-- [references/oauth-setup.md](references/oauth-setup.md) — OAuth provider configuration
-- [references/tool-patterns.md](references/tool-patterns.md) — Advanced tool examples
-- [references/troubleshooting.md](references/troubleshooting.md) — Error codes and fixes
+Install MCP skills with: cbx workflows install --include-mcp

package/workflows/powers/code-review-checklist/POWER.md

@@ -2,111 +2,23 @@
 ---
 inclusion: manual
 name: code-review-checklist
-description: Code review guidelines covering code quality, security, and best practices.
-allowed-tools: Read, Glob, Grep
+description: "Compatibility alias skill. Deprecated: use code-reviewer."
+metadata:
+  deprecated: true
+  replaced_by: code-reviewer
+  removal_target: v0.6.0
 ---
 
 # Code Review Checklist
 
-## Quick Review Checklist
+## Compatibility Alias
 
-### Correctness
-- [ ] Code does what it's supposed to do
-- [ ] Edge cases handled
-- [ ] Error handling in place
-- [ ] No obvious bugs
+This skill is deprecated and kept for backward compatibility.
 
-### Security
-- [ ] Input validated and sanitized
-- [ ] No SQL/NoSQL injection vulnerabilities
-- [ ] No XSS or CSRF vulnerabilities
-- [ ] No hardcoded secrets or sensitive credentials
-- [ ] **AI-Specific:** Protection against Prompt Injection (if applicable)
-- [ ] **AI-Specific:** Outputs are sanitized before being used in critical sinks
+Use `code-reviewer` as the canonical skill.
 
-### Performance
-- [ ] No N+1 queries
-- [ ] No unnecessary loops
-- [ ] Appropriate caching
-- [ ] Bundle size impact considered
+## Migration
 
-### Code Quality
-- [ ] Clear naming
-- [ ] DRY - no duplicate code
-- [ ] SOLID principles followed
-- [ ] Appropriate abstraction level
-
-### Testing
-- [ ] Unit tests for new code
-- [ ] Edge cases tested
-- [ ] Tests readable and maintainable
-
-### Documentation
-- [ ] Complex logic commented
-- [ ] Public APIs documented
-- [ ] README updated if needed
-
-## AI & LLM Review Patterns (2025)
-
-### Logic & Hallucinations
-- [ ] **Chain of Thought:** Does the logic follow a verifiable path?
-- [ ] **Edge Cases:** Did the AI account for empty states, timeouts, and partial failures?
-- [ ] **External State:** Is the code making safe assumptions about file systems or networks?
-
-### Prompt Engineering Review
-```markdown
-// ❌ Vague prompt in code
-const response = await ai.generate(userInput);
-
-// ✅ Structured & Safe prompt
-const response = await ai.generate({
-  system: "You are a specialized parser...",
-  input: sanitize(userInput),
-  schema: ResponseSchema
-});
-```
-
-## Anti-Patterns to Flag
-
-```typescript
-// ❌ Magic numbers
-if (status === 3) { ... }
-
-// ✅ Named constants
-if (status === Status.ACTIVE) { ... }
-
-// ❌ Deep nesting
-if (a) { if (b) { if (c) { ... } } }
-
-// ✅ Early returns
-if (!a) return;
-if (!b) return;
-if (!c) return;
-// do work
-
-// ❌ Long functions (100+ lines)
-// ✅ Small, focused functions
-
-// ❌ any type
-const data: any = ...
-
-// ✅ Proper types
-const data: UserData = ...
-```
-
-## Review Comments Guide
-
-```
-// Blocking issues use 🔴
-🔴 BLOCKING: SQL injection vulnerability here
-
-// Important suggestions use 🟡
-🟡 SUGGESTION: Consider using useMemo for performance
-
-// Minor nits use 🟢
-🟢 NIT: Prefer const over let for immutable variable
-
-// Questions use ❓
-❓ QUESTION: What happens if user is null here?
-```
+1. Replace direct references to `code-review-checklist` with `code-reviewer`.
+2. Apply the full workflow from `code-reviewer` for new work.
 ````

package/workflows/powers/code-review-checklist/SKILL.md

@@ -1,109 +1,21 @@
 ---
 name: code-review-checklist
-description: Code review guidelines covering code quality, security, and best practices.
-allowed-tools: Read, Glob, Grep
+description: "Compatibility alias skill. Deprecated: use code-reviewer."
+metadata:
+  deprecated: true
+  replaced_by: code-reviewer
+  removal_target: v0.6.0
 ---
 
 # Code Review Checklist
 
-## Quick Review Checklist
+## Compatibility Alias
 
-### Correctness
-- [ ] Code does what it's supposed to do
-- [ ] Edge cases handled
-- [ ] Error handling in place
-- [ ] No obvious bugs
+This skill is deprecated and kept for backward compatibility.
 
-### Security
-- [ ] Input validated and sanitized
-- [ ] No SQL/NoSQL injection vulnerabilities
-- [ ] No XSS or CSRF vulnerabilities
-- [ ] No hardcoded secrets or sensitive credentials
-- [ ] **AI-Specific:** Protection against Prompt Injection (if applicable)
-- [ ] **AI-Specific:** Outputs are sanitized before being used in critical sinks
+Use `code-reviewer` as the canonical skill.
 
-### Performance
-- [ ] No N+1 queries
-- [ ] No unnecessary loops
-- [ ] Appropriate caching
-- [ ] Bundle size impact considered
+## Migration
 
-### Code Quality
-- [ ] Clear naming
-- [ ] DRY - no duplicate code
-- [ ] SOLID principles followed
-- [ ] Appropriate abstraction level
-
-### Testing
-- [ ] Unit tests for new code
-- [ ] Edge cases tested
-- [ ] Tests readable and maintainable
-
-### Documentation
-- [ ] Complex logic commented
-- [ ] Public APIs documented
-- [ ] README updated if needed
-
-## AI & LLM Review Patterns (2025)
-
-### Logic & Hallucinations
-- [ ] **Chain of Thought:** Does the logic follow a verifiable path?
-- [ ] **Edge Cases:** Did the AI account for empty states, timeouts, and partial failures?
-- [ ] **External State:** Is the code making safe assumptions about file systems or networks?
-
-### Prompt Engineering Review
-```markdown
-// ❌ Vague prompt in code
-const response = await ai.generate(userInput);
-
-// ✅ Structured & Safe prompt
-const response = await ai.generate({
-  system: "You are a specialized parser...",
-  input: sanitize(userInput),
-  schema: ResponseSchema
-});
-```
-
-## Anti-Patterns to Flag
-
-```typescript
-// ❌ Magic numbers
-if (status === 3) { ... }
-
-// ✅ Named constants
-if (status === Status.ACTIVE) { ... }
-
-// ❌ Deep nesting
-if (a) { if (b) { if (c) { ... } } }
-
-// ✅ Early returns
-if (!a) return;
-if (!b) return;
-if (!c) return;
-// do work
-
-// ❌ Long functions (100+ lines)
-// ✅ Small, focused functions
-
-// ❌ any type
-const data: any = ...
-
-// ✅ Proper types
-const data: UserData = ...
-```
-
-## Review Comments Guide
-
-```
-// Blocking issues use 🔴
-🔴 BLOCKING: SQL injection vulnerability here
-
-// Important suggestions use 🟡
-🟡 SUGGESTION: Consider using useMemo for performance
-
-// Minor nits use 🟢
-🟢 NIT: Prefer const over let for immutable variable
-
-// Questions use ❓
-❓ QUESTION: What happens if user is null here?
-```
+1. Replace direct references to `code-review-checklist` with `code-reviewer`.
+2. Apply the full workflow from `code-reviewer` for new work.

package/workflows/powers/csharp-pro/POWER.md

@@ -0,0 +1,43 @@
+````markdown
+---
+inclusion: manual
+name: "csharp-pro"
+description: "Use for modern C# backend/application engineering with C# 14 and .NET 10-era production practices."
+license: MIT
+metadata:
+  version: "1.0.0"
+  domain: "language"
+  role: "specialist"
+  stack: "csharp"
+  baseline: "C# 14 / .NET 10"
+---
+
+# C# Pro
+
+## When to use
+
+- Building APIs, workers, and services in .NET.
+- Refactoring legacy C# into modern, testable architecture.
+- Improving async correctness and operational resilience.
+
+## Core workflow
+
+1. Confirm target framework/runtime constraints.
+2. Define clean contracts (DTOs, domain, persistence boundaries).
+3. Implement async-first I/O and cancellation-aware flows.
+4. Validate with tests, analyzers, and profiling.
+
+## Baseline standards
+
+- Use nullable reference types and treat warnings as actionable.
+- Use `async`/`await` with `CancellationToken` in public async APIs.
+- Keep exception handling consistent and observable.
+- Use dependency injection with explicit lifetimes.
+- Keep API contracts versioned and backward-compatible.
+
+## Avoid
+
+- Sync-over-async (`.Result`, `.Wait()`) in request paths.
+- Fat controllers with business logic and persistence mixed.
+- Global static mutable state in multi-request services.
+````

package/workflows/powers/csharp-pro/SKILL.md

@@ -0,0 +1,40 @@
+---
+name: "csharp-pro"
+description: "Use for modern C# backend/application engineering with C# 14 and .NET 10-era production practices."
+license: MIT
+metadata:
+  version: "1.0.0"
+  domain: "language"
+  role: "specialist"
+  stack: "csharp"
+  baseline: "C# 14 / .NET 10"
+---
+
+# C# Pro
+
+## When to use
+
+- Building APIs, workers, and services in .NET.
+- Refactoring legacy C# into modern, testable architecture.
+- Improving async correctness and operational resilience.
+
+## Core workflow
+
+1. Confirm target framework/runtime constraints.
+2. Define clean contracts (DTOs, domain, persistence boundaries).
+3. Implement async-first I/O and cancellation-aware flows.
+4. Validate with tests, analyzers, and profiling.
+
+## Baseline standards
+
+- Use nullable reference types and treat warnings as actionable.
+- Use `async`/`await` with `CancellationToken` in public async APIs.
+- Keep exception handling consistent and observable.
+- Use dependency injection with explicit lifetimes.
+- Keep API contracts versioned and backward-compatible.
+
+## Avoid
+
+- Sync-over-async (`.Result`, `.Wait()`) in request paths.
+- Fat controllers with business logic and persistence mixed.
+- Global static mutable state in multi-request services.

package/workflows/powers/database-design/POWER.md

@@ -1,13 +1,55 @@
+````markdown
 ---
+inclusion: manual
 name: database-design
 description: Database design principles and decision-making. Schema design, indexing strategy, ORM selection, serverless databases.
+allowed-tools: Read, Write, Edit, Glob, Grep
 ---
 
-# database-design
+# Database Design
 
-This is a compatibility power wrapper for the `database-design` skill.
+> **Learn to THINK, not copy SQL patterns.**
 
-Primary source:
-- `workflows/skills/database-design/SKILL.md`
+## 🎯 Selective Reading Rule
 
-Use this folder for power-specific extensions when needed.
+**Read ONLY files relevant to the request!** Check the content map, find what you need.
+
+| File | Description | When to Read |
+|------|-------------|--------------|
+| `database-selection.md` | PostgreSQL vs Neon vs Turso vs SQLite | Choosing database |
+| `orm-selection.md` | Drizzle vs Prisma vs Kysely | Choosing ORM |
+| `schema-design.md` | Normalization, PKs, relationships | Designing schema |
+| `indexing.md` | Index types, composite indexes | Performance tuning |
+| `optimization.md` | N+1, EXPLAIN ANALYZE | Query optimization |
+| `migrations.md` | Safe migrations, serverless DBs | Schema changes |
+
+---
+
+## ⚠️ Core Principle
+
+- ASK user for database preferences when unclear
+- Choose database/ORM based on CONTEXT
+- Don't default to PostgreSQL for everything
+
+---
+
+## Decision Checklist
+
+Before designing schema:
+
+- [ ] Asked user about database preference?
+- [ ] Chosen database for THIS context?
+- [ ] Considered deployment environment?
+- [ ] Planned index strategy?
+- [ ] Defined relationship types?
+
+---
+
+## Anti-Patterns
+
+❌ Default to PostgreSQL for simple apps (SQLite may suffice)
+❌ Skip indexing
+❌ Use SELECT * in production
+❌ Store JSON when structured data is better
+❌ Ignore N+1 queries
+````