@diottodev/runic 1.0.0 → 1.1.0

package/engineering-team/skills/skill-authoring/SKILL.md

@@ -0,0 +1,125 @@
+---
+name: skill-authoring
+description: "Use this to write a new skill, review an existing skill against the 10-Pattern Framework, or understand the skill authoring standard. Covers frontmatter, patterns, quality scoring, and publishing. Triggers: 'write a skill', 'create skill', 'new skill', 'skill authoring', '10-pattern', 'skill standard'."
+---
+
+You are a senior skill architect with expertise in the 10-Pattern Framework. Your goal is to author or review skills that are consistent, reliable, and production-grade — not just a collection of prompts.
+
+## Context Detection
+
+Before authoring, check for:
+- `SKILL-AUTHORING-STANDARD.md` at project root — the canonical standard
+- Existing skills in `engineering-team/skills/` or domain directories for reference
+- `references/` directory inside the skill's folder for heavy content
+
+## Available Modes
+
+| Mode | When |
+|------|------|
+| **Author new skill** | User wants to create a new skill from scratch |
+| **Review existing skill** | User wants to validate or improve an existing skill |
+| **Understand the standard** | User asks about the 10-Pattern Framework or quality criteria |
+
+## Related Skills
+
+**Use this skill when:** the user wants to create, review, or understand skill authoring standards.
+**Don't use this skill when:** the user wants to use an existing skill for a domain task (e.g., code review, debugging).
+**Instead use:** `senior-prompt-engineer` → for prompt engineering work; `write-a-skill` → for quick skill scaffolding; `runic-list` → to discover existing skills.
+
+## Quality Loop
+
+After drafting or reviewing a skill:
+1. Does the SKILL.md have valid YAML frontmatter with `name` and `description`?
+2. Does it open with the practitioner voice ("You are a senior...")?
+3. Does it offer at least 2 workflow modes?
+4. Does it include a "Related Skills" section with when/not/instead?
+5. Is SKILL.md ≤ 10 KB (heavy content in references/)?
+6. Does it list 4-6 proactive triggers?
+7. Does it define 4-6 output artifacts?
+8. Does it include a quality loop section?
+9. Does it use bottom-line-first communication structure?
+10. (Bonus) Does it include a stdlib-only Python tool?
+
+---
+
+## Proactive Triggers
+
+Surface these even when not explicitly asked:
+- SKILL.md missing frontmatter → flag and propose the required fields
+- Skill exceeds 10 KB → suggest splitting content into references/
+- Skill scores below 75/100 on the quality checklist → suggest specific improvements
+- Missing "Related Skills" section → add disambiguation
+- No proactive triggers defined → recommend adding 4-6 conditions
+
+## Output Artifacts
+
+| Request | Deliverable |
+|---------|-------------|
+| "create a new skill" | Complete SKILL.md following the 10-Pattern Framework |
+| "review my skill" | Scored quality report with improvement suggestions |
+| "what is the standard?" | Explanation of the 10-Pattern Framework with examples |
+| "score this skill" | Quality score out of 100 with per-pattern breakdown |
+
+## 10-Pattern Framework
+
+### Pattern 1 — Context-First
+Before doing anything, check for a context file (CLAUDE.md, .cursor/context.md, etc.).
+
+### Pattern 2 — Practitioner Voice
+Open every skill with: "You are a senior [role] with expertise in [domain]."
+
+### Pattern 3 — Multi-Mode Workflows
+Every skill offers ≥2 modes (build from scratch, optimize existing, situation-specific).
+
+### Pattern 4 — Related Skills Navigation
+Include a disambiguation section: when to use, when not to use, what to use instead.
+
+### Pattern 5 — Reference Separation
+SKILL.md stays ≤10 KB. Heavy content goes in `references/`, loaded on demand.
+
+### Pattern 6 — Proactive Triggers
+List 4-6 conditions where the skill surfaces issues without being asked.
+
+### Pattern 7 — Output Artifacts
+Map requests to concrete deliverables in a table.
+
+### Pattern 8 — Quality Loop
+Self-verify before presenting: root cause? complete? verified? proportional?
+
+### Pattern 9 — Communication Standard
+Bottom line first → What → Why → How → Decision.
+
+### Pattern 10 — Python Tools (optional)
+For audit/analysis tooling: stdlib-only Python scripts with `--json` and `--help`.
+
+## Quality Checklist
+
+| Pattern | Check | Points |
+|---------|-------|--------|
+| 1 | YAML frontmatter (name, description) | 10 |
+| 2 | Practitioner voice opener | 10 |
+| 3 | ≥2 workflow modes | 10 |
+| 4 | Related skills with WHEN/NOT | 10 |
+| 5 | SKILL.md ≤ 10 KB | 10 |
+| 6 | 4-6 proactive triggers | 10 |
+| 7 | 4-6 output artifacts | 10 |
+| 8 | Quality loop section | 10 |
+| 9 | Bottom-line-first structure | 10 |
+| 10 | (bonus) stdlib-only Python tool | 10 |
+
+**Minimum to merge: 75/100**
+
+## Common Commands
+
+```bash
+# Create a new skill directory
+mkdir -p engineering-team/skills/my-skill/references
+
+# Initialize SKILL.md with frontmatter template
+cat > engineering-team/skills/my-skill/SKILL.md << 'EOF'
+---
+name: my-skill
+description: "Brief description of when to use this skill."
+---
+EOF
+```

package/engineering-team/skills/stripe-integration-expert/SKILL.md

@@ -0,0 +1,476 @@
+---
+name: "stripe-integration-expert"
+description: "Production-grade Stripe integrations: subscriptions with trials and proration, one-time payments, usage-based billing, checkout sessions, idempotent webhook handlers, customer portal, and invoicing. Covers Next.js, Express, and Django patterns. Use when integrating Stripe for the first time, debugging webhook reliability issues, migrating from a different payment provider, or adding usage-based billing to an existing subscription product."
+---
+
+# Stripe Integration Expert
+
+**Tier:** POWERFUL  
+**Category:** Engineering Team  
+**Domain:** Payments / Billing Infrastructure
+
+---
+
+## Overview
+
+Implement production-grade Stripe integrations: subscriptions with trials and proration, one-time payments, usage-based billing, checkout sessions, idempotent webhook handlers, customer portal, and invoicing. Covers Next.js, Express, and Django patterns.
+
+---
+
+## Core Capabilities
+
+- Subscription lifecycle management (create, upgrade, downgrade, cancel, pause)
+- Trial handling and conversion tracking
+- Proration calculation and credit application
+- Usage-based billing with metered pricing
+- Idempotent webhook handlers with signature verification
+- Customer portal integration
+- Invoice generation and PDF access
+- Full Stripe CLI local testing setup
+
+---
+
+## When to Use
+
+- Adding subscription billing to any web app
+- Implementing plan upgrades/downgrades with proration
+- Building usage-based or seat-based billing
+- Debugging webhook delivery failures
+- Migrating from one billing model to another
+
+---
+
+## Subscription Lifecycle State Machine
+
+```
+FREE_TRIAL ──paid──► ACTIVE ──cancel──► CANCEL_PENDING ──period_end──► CANCELED
+     │                  │                                                    │
+     │               downgrade                                            reactivate
+     │                  ▼                                                    │
+     │             DOWNGRADING ──period_end──► ACTIVE (lower plan)           │
+     │                                                                        │
+     └──trial_end without payment──► PAST_DUE ──payment_failed 3x──► CANCELED
+                                          │
+                                     payment_success
+                                          │
+                                          ▼
+                                        ACTIVE
+```
+
+### DB subscription status values:
+`trialing | active | past_due | canceled | cancel_pending | paused | unpaid`
+
+---
+
+## Stripe Client Setup
+
+```typescript
+// lib/stripe.ts
+import Stripe from "stripe"
+
+export const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!, {
+  apiVersion: "2024-04-10",
+  typescript: true,
+  appInfo: {
+    name: "myapp",
+    version: "1.0.0",
+  },
+})
+
+// Price IDs by plan (set in env)
+export const PLANS = {
+  starter: {
+    monthly: process.env.STRIPE_STARTER_MONTHLY_PRICE_ID!,
+    yearly: process.env.STRIPE_STARTER_YEARLY_PRICE_ID!,
+    features: ["5 projects", "10k events"],
+  },
+  pro: {
+    monthly: process.env.STRIPE_PRO_MONTHLY_PRICE_ID!,
+    yearly: process.env.STRIPE_PRO_YEARLY_PRICE_ID!,
+    features: ["Unlimited projects", "1M events"],
+  },
+} as const
+```
+
+---
+
+## Checkout Session (Next.js App Router)
+
+```typescript
+// app/api/billing/checkout/route.ts
+import { NextResponse } from "next/server"
+import { stripe } from "@/lib/stripe"
+import { getAuthUser } from "@/lib/auth"
+import { db } from "@/lib/db"
+
+export async function POST(req: Request) {
+  const user = await getAuthUser()
+  if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+
+  const { priceId, interval = "monthly" } = await req.json()
+
+  // Get or create Stripe customer
+  let stripeCustomerId = user.stripeCustomerId
+  if (!stripeCustomerId) {
+    const customer = await stripe.customers.create({
+      email: user.email,
+      name: "username-undefined"
+      metadata: { userId: user.id },
+    })
+    stripeCustomerId = customer.id
+    await db.user.update({ where: { id: user.id }, data: { stripeCustomerId } })
+  }
+
+  const session = await stripe.checkout.sessions.create({
+    customer: stripeCustomerId,
+    mode: "subscription",
+    payment_method_types: ["card"],
+    line_items: [{ price: priceId, quantity: 1 }],
+    allow_promotion_codes: true,
+    subscription_data: {
+      trial_period_days: user.hasHadTrial ? undefined : 14,
+      metadata: { userId: user.id },
+    },
+    success_url: `${process.env.NEXT_PUBLIC_APP_URL}/dashboard?session_id={CHECKOUT_SESSION_ID}`,
+    cancel_url: `${process.env.NEXT_PUBLIC_APP_URL}/pricing`,
+    metadata: { userId: user.id },
+  })
+
+  return NextResponse.json({ url: session.url })
+}
+```
+
+---
+
+## Subscription Upgrade/Downgrade
+
+```typescript
+// lib/billing.ts
+export async function changeSubscriptionPlan(
+  subscriptionId: string,
+  newPriceId: string,
+  immediate = false
+) {
+  const subscription = await stripe.subscriptions.retrieve(subscriptionId)
+  const currentItem = subscription.items.data[0]
+
+  if (immediate) {
+    // Upgrade: apply immediately with proration
+    return stripe.subscriptions.update(subscriptionId, {
+      items: [{ id: currentItem.id, price: newPriceId }],
+      proration_behavior: "always_invoice",
+      billing_cycle_anchor: "unchanged",
+    })
+  } else {
+    // Downgrade: apply at period end, no proration
+    return stripe.subscriptions.update(subscriptionId, {
+      items: [{ id: currentItem.id, price: newPriceId }],
+      proration_behavior: "none",
+      billing_cycle_anchor: "unchanged",
+    })
+  }
+}
+
+// Preview proration before confirming upgrade
+export async function previewProration(subscriptionId: string, newPriceId: string) {
+  const subscription = await stripe.subscriptions.retrieve(subscriptionId)
+  const prorationDate = Math.floor(Date.now() / 1000)
+
+  const invoice = await stripe.invoices.retrieveUpcoming({
+    customer: subscription.customer as string,
+    subscription: subscriptionId,
+    subscription_items: [{ id: subscription.items.data[0].id, price: newPriceId }],
+    subscription_proration_date: prorationDate,
+  })
+
+  return {
+    amountDue: invoice.amount_due,
+    prorationDate,
+    lineItems: invoice.lines.data,
+  }
+}
+```
+
+---
+
+## Complete Webhook Handler (Idempotent)
+
+```typescript
+// app/api/webhooks/stripe/route.ts
+import { NextResponse } from "next/server"
+import { headers } from "next/headers"
+import { stripe } from "@/lib/stripe"
+import { db } from "@/lib/db"
+import Stripe from "stripe"
+
+// Processed events table to ensure idempotency
+async function hasProcessedEvent(eventId: string): Promise<boolean> {
+  const existing = await db.stripeEvent.findUnique({ where: { id: eventId } })
+  return !!existing
+}
+
+async function markEventProcessed(eventId: string, type: string) {
+  await db.stripeEvent.create({ data: { id: eventId, type, processedAt: new Date() } })
+}
+
+export async function POST(req: Request) {
+  const body = await req.text()
+  const signature = headers().get("stripe-signature")!
+
+  let event: Stripe.Event
+  try {
+    event = stripe.webhooks.constructEvent(body, signature, process.env.STRIPE_WEBHOOK_SECRET!)
+  } catch (err) {
+    console.error("Webhook signature verification failed:", err)
+    return NextResponse.json({ error: "Invalid signature" }, { status: 400 })
+  }
+
+  // Idempotency check
+  if (await hasProcessedEvent(event.id)) {
+    return NextResponse.json({ received: true, skipped: true })
+  }
+
+  try {
+    switch (event.type) {
+      case "checkout.session.completed":
+        await handleCheckoutCompleted(event.data.object as Stripe.Checkout.Session)
+        break
+
+      case "customer.subscription.created":
+      case "customer.subscription.updated":
+        await handleSubscriptionUpdated(event.data.object as Stripe.Subscription)
+        break
+
+      case "customer.subscription.deleted":
+        await handleSubscriptionDeleted(event.data.object as Stripe.Subscription)
+        break
+
+      case "invoice.payment_succeeded":
+        await handleInvoicePaymentSucceeded(event.data.object as Stripe.Invoice)
+        break
+
+      case "invoice.payment_failed":
+        await handleInvoicePaymentFailed(event.data.object as Stripe.Invoice)
+        break
+
+      default:
+        console.log(`Unhandled event type: ${event.type}`)
+    }
+
+    await markEventProcessed(event.id, event.type)
+    return NextResponse.json({ received: true })
+  } catch (err) {
+    console.error(`Error processing webhook ${event.type}:`, err)
+    // Return 500 so Stripe retries — don't mark as processed
+    return NextResponse.json({ error: "Processing failed" }, { status: 500 })
+  }
+}
+
+async function handleCheckoutCompleted(session: Stripe.Checkout.Session) {
+  if (session.mode !== "subscription") return
+  
+  const userId = session.metadata?.userId
+  if (!userId) throw new Error("No userId in checkout session metadata")
+
+  const subscription = await stripe.subscriptions.retrieve(session.subscription as string)
+  
+  await db.user.update({
+    where: { id: userId },
+    data: {
+      stripeCustomerId: session.customer as string,
+      stripeSubscriptionId: subscription.id,
+      stripePriceId: subscription.items.data[0].price.id,
+      stripeCurrentPeriodEnd: new Date(subscription.current_period_end * 1000),
+      subscriptionStatus: subscription.status,
+      hasHadTrial: true,
+    },
+  })
+}
+
+async function handleSubscriptionUpdated(subscription: Stripe.Subscription) {
+  const user = await db.user.findUnique({
+    where: { stripeSubscriptionId: subscription.id },
+  })
+  if (!user) {
+    // Look up by customer ID as fallback
+    const customer = await db.user.findUnique({
+      where: { stripeCustomerId: subscription.customer as string },
+    })
+    if (!customer) throw new Error(`No user found for subscription ${subscription.id}`)
+  }
+
+  await db.user.update({
+    where: { stripeSubscriptionId: subscription.id },
+    data: {
+      stripePriceId: subscription.items.data[0].price.id,
+      stripeCurrentPeriodEnd: new Date(subscription.current_period_end * 1000),
+      subscriptionStatus: subscription.status,
+      cancelAtPeriodEnd: subscription.cancel_at_period_end,
+    },
+  })
+}
+
+async function handleSubscriptionDeleted(subscription: Stripe.Subscription) {
+  await db.user.update({
+    where: { stripeSubscriptionId: subscription.id },
+    data: {
+      stripeSubscriptionId: null,
+      stripePriceId: null,
+      stripeCurrentPeriodEnd: null,
+      subscriptionStatus: "canceled",
+    },
+  })
+}
+
+async function handleInvoicePaymentFailed(invoice: Stripe.Invoice) {
+  if (!invoice.subscription) return
+  const attemptCount = invoice.attempt_count
+  
+  await db.user.update({
+    where: { stripeSubscriptionId: invoice.subscription as string },
+    data: { subscriptionStatus: "past_due" },
+  })
+
+  if (attemptCount >= 3) {
+    // Send final dunning email
+    await sendDunningEmail(invoice.customer_email!, "final")
+  } else {
+    await sendDunningEmail(invoice.customer_email!, "retry")
+  }
+}
+
+async function handleInvoicePaymentSucceeded(invoice: Stripe.Invoice) {
+  if (!invoice.subscription) return
+
+  await db.user.update({
+    where: { stripeSubscriptionId: invoice.subscription as string },
+    data: {
+      subscriptionStatus: "active",
+      stripeCurrentPeriodEnd: new Date(invoice.period_end * 1000),
+    },
+  })
+}
+```
+
+---
+
+## Usage-Based Billing
+
+```typescript
+// Report usage for metered subscriptions
+export async function reportUsage(subscriptionItemId: string, quantity: number) {
+  await stripe.subscriptionItems.createUsageRecord(subscriptionItemId, {
+    quantity,
+    timestamp: Math.floor(Date.now() / 1000),
+    action: "increment",
+  })
+}
+
+// Example: report API calls in middleware
+export async function trackApiCall(userId: string) {
+  const user = await db.user.findUnique({ where: { id: userId } })
+  if (user?.stripeSubscriptionId) {
+    const subscription = await stripe.subscriptions.retrieve(user.stripeSubscriptionId)
+    const meteredItem = subscription.items.data.find(
+      (item) => item.price.recurring?.usage_type === "metered"
+    )
+    if (meteredItem) {
+      await reportUsage(meteredItem.id, 1)
+    }
+  }
+}
+```
+
+---
+
+## Customer Portal
+
+```typescript
+// app/api/billing/portal/route.ts
+import { NextResponse } from "next/server"
+import { stripe } from "@/lib/stripe"
+import { getAuthUser } from "@/lib/auth"
+
+export async function POST() {
+  const user = await getAuthUser()
+  if (!user?.stripeCustomerId) {
+    return NextResponse.json({ error: "No billing account" }, { status: 400 })
+  }
+
+  const portalSession = await stripe.billingPortal.sessions.create({
+    customer: user.stripeCustomerId,
+    return_url: `${process.env.NEXT_PUBLIC_APP_URL}/settings/billing`,
+  })
+
+  return NextResponse.json({ url: portalSession.url })
+}
+```
+
+---
+
+## Testing with Stripe CLI
+
+```bash
+# Install Stripe CLI
+brew install stripe/stripe-cli/stripe
+
+# Login
+stripe login
+
+# Forward webhooks to local dev
+stripe listen --forward-to localhost:3000/api/webhooks/stripe
+
+# Trigger specific events for testing
+stripe trigger checkout.session.completed
+stripe trigger customer.subscription.updated
+stripe trigger invoice.payment_failed
+
+# Test with specific customer
+stripe trigger customer.subscription.updated \
+  --override subscription:customer=cus_xxx
+
+# View recent events
+stripe events list --limit 10
+
+# Test cards
+# Success: 4242 4242 4242 4242
+# Requires auth: 4000 0025 0000 3155
+# Decline: 4000 0000 0000 9995
+# Insufficient funds: 4000 0000 0000 9995
+```
+
+---
+
+## Feature Gating Helper
+
+```typescript
+// lib/subscription.ts
+export function isSubscriptionActive(user: { subscriptionStatus: string | null, stripeCurrentPeriodEnd: Date | null }) {
+  if (!user.subscriptionStatus) return false
+  if (user.subscriptionStatus === "active" || user.subscriptionStatus === "trialing") return true
+  // Grace period: past_due but not yet expired
+  if (user.subscriptionStatus === "past_due" && user.stripeCurrentPeriodEnd) {
+    return user.stripeCurrentPeriodEnd > new Date()
+  }
+  return false
+}
+
+// Middleware usage
+export async function requireActiveSubscription() {
+  const user = await getAuthUser()
+  if (!isSubscriptionActive(user)) {
+    redirect("/billing?reason=subscription_required")
+  }
+}
+```
+
+---
+
+## Common Pitfalls
+
+- **Webhook delivery order not guaranteed** — always re-fetch from Stripe API, never trust event data alone for DB updates
+- **Double-processing webhooks** — Stripe retries on 500; always use idempotency table
+- **Trial conversion tracking** — store `hasHadTrial: true` in DB to prevent trial abuse
+- **Proration surprises** — always preview proration before upgrade; show user the amount before confirming
+- **Customer portal not configured** — must enable features in Stripe dashboard under Billing → Customer portal settings
+- **Missing metadata on checkout** — always pass `userId` in metadata; can't link subscription to user without it