@dewtech/dare-cli 2.16.0 → 3.0.0

package/templates/ide/claude/.claude/commands/skill-mcp-server.md

@@ -0,0 +1,228 @@
+# /skill-mcp-server
+
+Padrões DARE para servidores MCP (Model Context Protocol) em TypeScript ou Python. Tools, resources, prompts; transports stdio/SSE/HTTP; validação Zod/Pydantic; autorização por tool; tracing; testes; publicação.
+
+## Como usar
+
+```
+/skill-mcp-server                            # audita server MCP atual
+/skill-mcp-server scaffold ts                # scaffold TypeScript stdio
+/skill-mcp-server scaffold py                # scaffold Python stdio
+```
+
+## O que é MCP
+
+Protocolo aberto da Anthropic para conectar agentes a fontes de dados e ações. Server expõe:
+- **Tools** — funções chamáveis (ex: `create_issue`)
+- **Resources** — dados leitáveis (ex: schemas)
+- **Prompts** — templates parametrizados
+
+Transports: **stdio** (local), **SSE** (remoto streaming), **HTTP** (remoto stateless).
+
+## Stack (TypeScript)
+
+- Node 20+ + TS 5.5+
+- `@modelcontextprotocol/sdk`
+- Zod para schemas
+- vitest
+
+## Stack (Python)
+
+- Python 3.11+
+- `mcp` (SDK oficial)
+- Pydantic v2
+- pytest + pytest-asyncio
+
+## Estrutura
+
+```
+mcp-server/
+├── src/
+│   ├── index.ts            ← stdio entrypoint
+│   ├── server.ts
+│   ├── tools/
+│   ├── resources/
+│   ├── prompts/
+│   └── schemas/
+└── tests/
+```
+
+## Exemplo (TypeScript stdio)
+
+```typescript
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { z } from 'zod';
+
+const CreateIssueInput = z.object({
+  title: z.string().min(1).max(255),
+  description: z.string().optional(),
+  priority: z.enum(['low', 'medium', 'high']).default('medium'),
+  team_id: z.string().uuid(),
+});
+
+const server = new Server(
+  { name: 'meu-server', version: '1.0.0' },
+  { capabilities: { tools: {} } }
+);
+
+server.setRequestHandler(ListToolsRequestSchema, async () => ({
+  tools: [{
+    name: 'create_issue',
+    description: 'Create a new issue in Linear',
+    inputSchema: CreateIssueInput.shape,
+  }],
+}));
+
+server.setRequestHandler(CallToolRequestSchema, async (req) => {
+  const input = CreateIssueInput.parse(req.params.arguments);
+  const result = await linearClient.createIssue(input);
+  return { content: [{ type: 'text', text: JSON.stringify(result) }] };
+});
+
+const transport = new StdioServerTransport();
+await server.connect(transport);
+```
+
+## Exemplo (Python stdio)
+
+```python
+from mcp.server import Server
+from mcp.server.stdio import stdio_server
+from mcp.types import Tool, TextContent
+from pydantic import BaseModel, Field
+import asyncio
+
+app = Server("meu-server")
+
+class CreateIssueInput(BaseModel):
+    title: str = Field(min_length=1, max_length=255)
+    description: str | None = None
+    priority: str = Field(default="medium", pattern="^(low|medium|high)$")
+    team_id: str
+
+@app.list_tools()
+async def list_tools():
+    return [Tool(
+        name="create_issue",
+        description="Create a new issue",
+        inputSchema=CreateIssueInput.model_json_schema(),
+    )]
+
+@app.call_tool()
+async def call_tool(name: str, arguments: dict):
+    input_data = CreateIssueInput.model_validate(arguments)
+    result = await linear_client.create_issue(input_data)
+    return [TextContent(type="text", text=result.model_dump_json())]
+
+async def main():
+    async with stdio_server() as (read, write):
+        await app.run(read, write, app.create_initialization_options())
+
+if __name__ == "__main__":
+    asyncio.run(main())
+```
+
+## Resources e Prompts
+
+```typescript
+server.setRequestHandler(ListResourcesRequestSchema, async () => ({
+  resources: [{ uri: 'linear://schema', name: 'Schema', mimeType: 'application/json' }],
+}));
+
+server.setRequestHandler(ListPromptsRequestSchema, async () => ({
+  prompts: [{
+    name: 'triage_issue',
+    description: 'Triage and assign priority',
+    arguments: [{ name: 'description', required: true }],
+  }],
+}));
+```
+
+## Autorização por tool
+
+```typescript
+if (input.confirm !== 'YES_I_AM_SURE') throw new Error('confirm required');
+if (!callerHasRole('admin')) throw new Error('admin only');
+```
+
+## Observabilidade
+
+**stdio: logs em stderr SEMPRE** (stdout é o protocolo).
+
+```typescript
+console.error(JSON.stringify({
+  ts: new Date().toISOString(),
+  tool: req.params.name,
+  duration_ms: Date.now() - start,
+  success: true,
+}));
+```
+
+## Antipatterns
+
+| AP | Antipattern | Por quê |
+|---|---|---|
+| AP-01 | Logs no stdout (stdio) | Quebra o protocolo |
+| AP-02 | Tool sem schema | Cliente passa lixo |
+| AP-03 | Sem validação no server | Confia no client (errado) |
+| AP-04 | Tool destrutiva sem confirm | Agente apaga sem querer |
+| AP-05 | Secrets em código | Use env vars |
+| AP-06 | Tool name vago (`do_thing`) | Agente não sabe quando usar |
+| AP-07 | Description vago | Erra na escolha |
+| AP-08 | Resource sem mimeType | Cliente não parseia |
+
+## Testes
+
+```typescript
+// Unit
+test('valida input', () => {
+  const valid = CreateIssueInput.parse({ title: 'Test', team_id: '550e8400-e29b-41d4-a716-446655440000' });
+  expect(valid.priority).toBe('medium');
+});
+
+// E2E com client MCP
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+const client = new Client({ name: 'test', version: '0.0.0' }, { capabilities: {} });
+await client.connect(transport);
+const tools = await client.listTools();
+expect(tools.tools.map(t => t.name)).toContain('create_issue');
+```
+
+## Configuração no Claude Desktop
+
+```json
+{
+  "mcpServers": {
+    "meu-server": {
+      "command": "node",
+      "args": ["/abs/path/dist/index.js"],
+      "env": { "LINEAR_API_KEY": "lin_api_..." }
+    }
+  }
+}
+```
+
+## Publicação
+
+- README com tools, env vars, exemplo de config
+- LICENSE MIT
+- `package.json` ou `pyproject.toml` versionado
+- npm publish (TS) ou PyPI (Python)
+- Para SSE/HTTP: Docker multi-stage
+
+## O que fazer
+
+1. Decidir transport (stdio para local; SSE/HTTP para remoto)
+2. Listar tools/resources/prompts no DESIGN.md
+3. Scaffold com SDK oficial
+4. Schema Zod/Pydantic para cada tool
+5. Logs em stderr, JSON estruturado
+6. Testes vitest/pytest + E2E com client MCP
+7. README + LICENSE MIT + publicação
+
+$ARGUMENTS
+
+---
+
+Skill MIT — parte do DARE Method.

package/templates/ide/claude/.claude/commands/skill-nestjs-api.md

@@ -0,0 +1,210 @@
+# /skill-nestjs-api
+
+Padrões DARE para APIs REST em NestJS + TypeScript + Prisma + Swagger. Modules, Controllers, Services, DTOs com class-validator, Guards JWT, throttler, exceções globais, Jest + Supertest, OpenAPI auto-gerado.
+
+## Como usar
+
+```
+/skill-nestjs-api                          # audita projeto NestJS
+/skill-nestjs-api scaffold users           # gera CRUD com módulo + camadas
+/skill-nestjs-api migrate-validation       # extrai @Body any para DTOs com class-validator
+```
+
+## Stack canônica
+
+- TypeScript 5.5+ com `strict: true`
+- NestJS 11.x
+- Prisma 5.x (PostgreSQL)
+- class-validator + class-transformer
+- @nestjs/swagger (OpenAPI auto)
+- @nestjs/throttler (rate limit)
+- @nestjs/passport + @nestjs/jwt
+- Jest + Supertest
+
+## Estrutura por módulo
+
+```
+src/<feature>/
+├── <feature>.module.ts
+├── <feature>.controller.ts      ← Handler
+├── <feature>.service.ts         ← Service
+├── <feature>.repository.ts      ← Repository (Prisma)
+├── dto/
+├── entities/
+└── tests/
+```
+
+## Controllers
+
+```typescript
+@ApiTags('users')
+@Controller('users')
+@UseGuards(JwtAuthGuard)
+export class UsersController {
+  constructor(private readonly register: RegisterUserService) {}
+
+  @Post()
+  @ApiOperation({ summary: 'Criar usuário' })
+  @ApiCreatedResponse({ type: UserResponseDto })
+  async create(@Body() dto: CreateUserDto): Promise<UserResponseDto> {
+    const user = await this.register.execute(dto);
+    return UserResponseDto.from(user);
+  }
+}
+```
+
+## DTOs (class-validator)
+
+```typescript
+export class CreateUserDto {
+  @ApiProperty({ example: 'jane@example.com' })
+  @IsEmail() email!: string;
+
+  @ApiProperty({ minLength: 12 })
+  @IsString() @MinLength(12) password!: string;
+}
+```
+
+`main.ts`:
+```typescript
+app.useGlobalPipes(new ValidationPipe({ whitelist: true, forbidNonWhitelisted: true, transform: true }));
+```
+
+## Services
+
+```typescript
+@Injectable()
+export class RegisterUserService {
+  constructor(private readonly repo: UsersRepository) {}
+
+  async execute(dto: CreateUserDto): Promise<User> {
+    if (await this.repo.existsByEmail(dto.email)) throw new UserAlreadyExistsError();
+    return this.repo.create({ ...dto, password: await hash(dto.password) });
+  }
+}
+```
+
+## Repositories
+
+```typescript
+@Injectable()
+export class UsersRepository {
+  constructor(private readonly prisma: PrismaService) {}
+
+  async existsByEmail(email: string): Promise<boolean> {
+    return !!(await this.prisma.user.findUnique({ where: { email } }));
+  }
+}
+```
+
+## OpenAPI + Swagger
+
+```typescript
+const config = new DocumentBuilder()
+  .setTitle('Projeto API').setVersion('1.0').addBearerAuth().build();
+const document = SwaggerModule.createDocument(app, config);
+SwaggerModule.setup('docs', app, document);
+writeFileSync('./public/openapi.json', JSON.stringify(document));
+```
+
+## Rate limiting
+
+```typescript
+ThrottlerModule.forRoot([{ ttl: 60_000, limit: 100 }]),
+
+// Login: 5/15min
+@Throttle({ default: { limit: 5, ttl: 900_000 } })
+@Post('login')
+async login() {...}
+```
+
+## Filter global de exceções
+
+```typescript
+@Catch()
+export class AllExceptionsFilter implements ExceptionFilter {
+  catch(exception: unknown, host: ArgumentsHost) {
+    const response = host.switchToHttp().getResponse<Response>();
+    if (exception instanceof UserAlreadyExistsError) {
+      return response.status(409).json({ error: 'USER_EXISTS' });
+    }
+    if (exception instanceof HttpException) {
+      return response.status(exception.getStatus()).json(exception.getResponse());
+    }
+    return response.status(500).json({ error: 'INTERNAL' });
+  }
+}
+```
+
+## Testes
+
+```typescript
+// Unit
+describe('RegisterUserService', () => {
+  it('falha se email já existe', async () => {
+    const repo = { existsByEmail: jest.fn().mockResolvedValue(true) } as any;
+    const sut = new RegisterUserService(repo);
+    await expect(sut.execute({...})).rejects.toThrow(UserAlreadyExistsError);
+  });
+});
+
+// E2E (Supertest)
+it('POST /users cria com sucesso', async () => {
+  const res = await request(app.getHttpServer())
+    .post('/users')
+    .set('Authorization', `Bearer ${token}`)
+    .send({ email: 'jane@example.com', name: 'Jane', password: 'longsecret123' });
+  expect(res.status).toBe(201);
+});
+```
+
+## Antipatterns
+
+| AP | Antipattern | Correção |
+|---|---|---|
+| AP-01 | Validação inline | DTO + ValidationPipe |
+| AP-02 | Prisma no Controller | Repository |
+| AP-03 | Lógica no Controller | Service |
+| AP-04 | Sem DTO de saída | `UserResponseDto.from(user)` |
+| AP-05 | Secret hardcoded | `ConfigService.getOrThrow` |
+| AP-06 | Login sem throttler | rate limit obrigatório |
+| AP-07 | OpenAPI à mão | `@nestjs/swagger` |
+| AP-08 | Erros sem filter global | inconsistência |
+
+## Segurança (com `/dare-security`)
+
+- Hash com `@node-rs/argon2` (Argon2id)
+- JWT RS256 público, HS256+secret≥256bits interno
+- `helmet` middleware
+- CORS específico
+- Rate limit em login (5/15min)
+- Refresh token com rotação
+
+## CI
+
+```bash
+npm run lint
+npm run test
+npm run test:e2e
+npm run build
+npx prisma migrate deploy --dry-run
+npm audit --audit-level=high
+```
+
+## O que fazer
+
+1. Audit:
+   ```bash
+   grep -rn "@Body()" src/ | grep -v "Dto"
+   grep -rn "prisma\." src/*/controllers/
+   ```
+2. Migrar `@Body() body: any` → DTO com class-validator
+3. Extrair lógica de Controllers → Services
+4. Encapsular Prisma em Repositories
+5. Configurar Swagger + ThrottlerModule + global filter
+
+$ARGUMENTS
+
+---
+
+Skill MIT — parte do DARE Method.

package/templates/ide/claude/.claude/commands/skill-rails-api.md

@@ -0,0 +1,236 @@
+# /skill-rails-api
+
+Padrões DARE para APIs em Ruby on Rails 8 — API mode, ActiveRecord, Solid Queue, Solid Cable, Action Cable, strong params, Services, serializers (Blueprinter/Alba), Devise/JWT, rack-attack, rswag.
+
+## Como usar
+
+```
+/skill-rails-api                          # audita projeto Rails
+/skill-rails-api scaffold users           # gera controller + service + blueprint + tests
+/skill-rails-api migrate-controllers      # extrai lógica de controllers para services
+```
+
+## Stack canônica
+
+- Ruby 3.3+
+- Rails 8.x (`rails new --api`)
+- PostgreSQL 16
+- Solid Queue (jobs) + Solid Cable (websockets) — built-in Rails 8
+- Devise + devise-jwt (ou JWT puro)
+- Pundit ou CanCanCan (autorização)
+- Blueprinter ou Alba (serializers)
+- rack-attack (rate limit)
+- rswag (OpenAPI)
+- RSpec + FactoryBot + Faker
+- Rubocop rails-omakase
+- bundler-audit (CVEs)
+
+## Layered Design
+
+| Camada | Pasta Rails |
+|---|---|
+| Handler | `app/controllers/api/v1/` |
+| Service | `app/services/` |
+| Repository | `app/repositories/` (opcional) |
+| Model | `app/models/` |
+| Presenter | `app/blueprints/` ou `app/serializers/` |
+
+## Controllers
+
+```ruby
+module Api::V1
+  class UsersController < ApplicationController
+    before_action :authenticate_user!
+
+    def create
+      result = RegisterUser.new(user_params).call
+      if result.success?
+        render json: UserBlueprint.render(result.user), status: :created
+      else
+        render json: { error: result.error_code }, status: :conflict
+      end
+    end
+
+    private
+
+    def user_params
+      params.require(:user).permit(:email, :name, :password)
+    end
+  end
+end
+```
+
+## Service Object
+
+```ruby
+class RegisterUser
+  Result = Struct.new(:success?, :user, :error_code)
+
+  def initialize(params)
+    @params = params
+  end
+
+  def call
+    return Result.new(false, nil, 'USER_EXISTS') if User.exists?(email: @params[:email])
+    user = User.create!(@params)
+    Result.new(true, user, nil)
+  end
+end
+```
+
+## Model
+
+```ruby
+class User < ApplicationRecord
+  has_secure_password
+  validates :email, presence: true, uniqueness: true, format: URI::MailTo::EMAIL_REGEXP
+  validates :name, presence: true
+  validates :password, length: { minimum: 12 }, if: :password_required?
+end
+```
+
+## Blueprinter (serializer)
+
+```ruby
+class UserBlueprint < Blueprinter::Base
+  identifier :id
+  fields :email, :name
+  field :created_at do |u| u.created_at.iso8601 end
+end
+```
+
+## Auth (devise-jwt)
+
+```ruby
+# config/initializers/devise.rb
+config.jwt do |jwt|
+  jwt.secret = Rails.application.credentials.devise_jwt_secret_key!
+  jwt.dispatch_requests = [['POST', %r{^/api/v1/login$}]]
+  jwt.revocation_requests = [['DELETE', %r{^/api/v1/logout$}]]
+  jwt.expiration_time = 15.minutes.to_i
+end
+```
+
+## rack-attack
+
+```ruby
+class Rack::Attack
+  throttle('login/ip', limit: 5, period: 15.minutes) do |req|
+    req.ip if req.path == '/api/v1/login' && req.post?
+  end
+  throttle('api/ip', limit: 100, period: 1.minute) do |req|
+    req.ip if req.path.start_with?('/api/')
+  end
+end
+```
+
+## Solid Queue (jobs)
+
+```ruby
+class SendWelcomeEmailJob < ApplicationJob
+  queue_as :default
+  def perform(user_id)
+    user = User.find(user_id)
+    UserMailer.welcome(user).deliver_now
+  end
+end
+```
+
+## Solid Cable + Action Cable
+
+```ruby
+class NotificationsChannel < ApplicationCable::Channel
+  def subscribed
+    stream_for current_user
+  end
+end
+
+# Broadcast
+NotificationsChannel.broadcast_to(user, type: 'message.sent.v1', payload: {...})
+```
+
+## OpenAPI (rswag)
+
+```ruby
+# spec/integration/users_spec.rb
+path '/api/v1/users' do
+  post 'Creates a user' do
+    parameter name: :user, in: :body, schema: { ... }
+    response '201', 'user created' do ... end
+  end
+end
+
+# rake rswag:specs:swaggerize  →  swagger/v1/swagger.yaml
+```
+
+## Testes RSpec
+
+```ruby
+# Service
+RSpec.describe RegisterUser do
+  it 'falha se email já existe' do
+    User.create!(email: 'x@y.com', name: 'X', password: 'longsecret123')
+    result = described_class.new(email: 'x@y.com', name: 'Y', password: 'longsecret123').call
+    expect(result.error_code).to eq 'USER_EXISTS'
+  end
+end
+
+# Request
+RSpec.describe 'POST /api/v1/users', type: :request do
+  it 'cria com sucesso' do
+    post '/api/v1/users', params: { user: {...} }, headers: auth_headers
+    expect(response).to have_http_status(:created)
+  end
+end
+```
+
+## Antipatterns
+
+| AP | Antipattern | Correção |
+|---|---|---|
+| AP-01 | Query AR no controller | Service object |
+| AP-02 | Lógica no controller | Service object |
+| AP-03 | `render json: user` | Blueprinter/Alba |
+| AP-04 | Fat Model | Concerns + Services |
+| AP-05 | Skip strong params | `permit(...)` sempre |
+| AP-06 | Sem rack-attack em login | rate limit obrigatório |
+| AP-07 | JWT secret em código | `credentials.yml.enc` |
+| AP-08 | Logs com PII | `filter_parameters` |
+| AP-09 | N+1 sem `includes` | `bullet` gem em dev |
+| AP-10 | Sem `--api` no Rails new | use modo API |
+
+## Segurança
+
+- `has_secure_password` (BCrypt default Rails OK; trocar para Argon2 se quiser)
+- `force_ssl = true` em prod
+- `secure_headers` gem ou nativo Rails 8
+- `rack-cors` com origens específicas
+- `filter_parameters` para password/token/secret
+- bundler-audit no CI
+
+## CI
+
+```bash
+bundle exec rubocop
+bundle exec rspec
+bundle exec bundler-audit check --update
+```
+
+## O que fazer
+
+1. Audit:
+   ```bash
+   grep -rn "\.where\|\.create" app/controllers/
+   grep -rn "render json: @" app/controllers/
+   grep -rn "params\[:" app/controllers/ | grep -v "permit"
+   ```
+2. Lógica > 10 linhas no controller → Service `.call`
+3. `render json: object` → `BlueprintRender(object)`
+4. Configurar rack-attack + filter_parameters
+5. Documentar endpoints com rswag + gerar OpenAPI
+
+$ARGUMENTS
+
+---
+
+Skill MIT — parte do DARE Method.