@hivehub/rulebook 1.2.0

package/templates/frameworks/ANGULAR.md

@@ -0,0 +1,36 @@
+<!-- ANGULAR:START -->
+# Angular Framework Rules
+
+**CRITICAL**: Angular projects must meet these standards before delivery.
+
+## Quality Commands
+- Lint: `npm run lint`
+- Unit tests: `npm run test -- --watch=false --code-coverage`
+- e2e tests: `npm run e2e`
+- Build: `npm run build -- --configuration production`
+
+## Project Structure
+- Colocate features inside `src/app/<feature>/`
+- Keep shared modules in `src/app/shared`
+- Avoid `providedIn: 'root'` unless service truly global
+- Leverage `OnPush` change detection for performance-critical components
+
+## Implementation Guidelines
+- Define interfaces for component inputs/outputs
+- Use `HttpClient` interceptors for auth/logging
+- Isolate environment variables in `src/environments/`
+- Prefer Reactive Forms and RxJS operators over manual subscriptions
+
+## Pre-Commit Sequence
+```bash
+npm run lint
+npm run test -- --watch=false
+npm run build -- --configuration production
+```
+
+## Documentation
+- Update `/docs/angular-architecture.md` with new modules and routes
+- Record shared component APIs in Storybook or `/docs/ui-components.md`
+- Version major route changes in `/docs/roadmap.md`
+
+<!-- ANGULAR:END -->

package/templates/frameworks/DJANGO.md

@@ -0,0 +1,83 @@
+<!-- DJANGO:START -->
+# Django Framework Rules
+
+**Language**: Python  
+**Version**: Django 4.2+ (LTS) or 5.0+
+
+## Setup & Configuration
+
+```python
+# settings.py
+SECRET_KEY = env('SECRET_KEY')  # Never hardcode
+DEBUG = env.bool('DEBUG', default=False)
+ALLOWED_HOSTS = env.list('ALLOWED_HOSTS')
+
+INSTALLED_APPS = [
+    # Django apps
+    'django.contrib.admin',
+    'django.contrib.auth',
+    # Third-party
+    'rest_framework',
+    'corsheaders',
+    # Local apps
+    'apps.users',
+]
+
+DATABASES = {
+    'default': env.db('DATABASE_URL')  # Use django-environ
+}
+```
+
+## Quality Gates
+
+```bash
+# Code quality
+black .                          # Format
+ruff check .                     # Lint
+mypy .                          # Type check
+
+# Tests
+python manage.py test            # Run tests
+pytest --cov=apps --cov-report=html  # With coverage
+
+# Security
+python manage.py check --deploy  # Production checks
+bandit -r apps/                  # Security scan
+```
+
+## Best Practices
+
+✅ **DO:**
+- Use Class-Based Views (CBVs) or Django REST Framework ViewSets
+- Implement custom User model from start
+- Use Django ORM properly (select_related, prefetch_related)
+- Enable CSRF protection
+- Use environment variables for secrets
+- Write tests for views, models, and forms
+
+❌ **DON'T:**
+- Use `DEBUG=True` in production
+- Store secrets in settings.py
+- Use raw SQL without parameterization
+- Skip migrations
+- Ignore security middleware
+
+## Project Structure
+
+```
+project/
+├── manage.py
+├── requirements.txt
+├── apps/
+│   ├── users/
+│   ├── api/
+│   └── core/
+├── config/
+│   ├── settings.py
+│   ├── urls.py
+│   └── wsgi.py
+└── tests/
+```
+
+<!-- DJANGO:END -->
+

package/templates/frameworks/ELECTRON.md

@@ -0,0 +1,147 @@
+<!-- ELECTRON:START -->
+# Electron Framework Rules
+
+**Language**: TypeScript, JavaScript  
+**Version**: Electron 28+
+
+## Setup & Configuration
+
+```typescript
+// main.ts (Main Process)
+import { app, BrowserWindow } from 'electron'
+import path from 'path'
+
+function createWindow() {
+  const win = new BrowserWindow({
+    width: 1200,
+    height: 800,
+    webPreferences: {
+      preload: path.join(__dirname, 'preload.js'),
+      contextIsolation: true,
+      nodeIntegration: false,
+    },
+  })
+
+  win.loadFile('index.html')
+}
+
+app.whenReady().then(createWindow)
+```
+
+## Quality Gates
+
+```bash
+# Type check
+npm run type-check
+
+# Lint
+npm run lint
+
+# Tests
+npm test
+
+# Build
+npm run build              # Compile TypeScript
+npm run package            # Package app
+npm run make               # Create distributables
+```
+
+## Best Practices
+
+✅ **DO:**
+- Use contextIsolation: true
+- Disable nodeIntegration
+- Use preload scripts for IPC
+- Implement auto-updates (electron-updater)
+- Sign and notarize apps (production)
+- Use Content Security Policy
+- Implement proper error handling
+- Separate main and renderer processes
+
+❌ **DON'T:**
+- Enable nodeIntegration in renderer
+- Skip contextIsolation
+- Use remote module (deprecated)
+- Ignore security warnings
+- Skip code signing
+- Load remote content without CSP
+- Use synchronous IPC
+- Hardcode credentials
+
+## Project Structure
+
+```
+src/
+├── main/
+│   ├── main.ts           # Main process
+│   ├── preload.ts        # Preload script
+│   └── ipc/              # IPC handlers
+├── renderer/
+│   ├── index.html
+│   ├── renderer.ts
+│   └── components/
+└── shared/
+    └── types.ts
+```
+
+## IPC Communication
+
+```typescript
+// preload.ts
+import { contextBridge, ipcRenderer } from 'electron'
+
+contextBridge.exposeInMainWorld('electronAPI', {
+  sendMessage: (message: string) => ipcRenderer.send('message', message),
+  onReply: (callback: (reply: string) => void) => 
+    ipcRenderer.on('reply', (_event, reply) => callback(reply)),
+})
+
+// main.ts
+import { ipcMain } from 'electron'
+
+ipcMain.on('message', (event, message) => {
+  console.log(message)
+  event.reply('reply', 'Message received')
+})
+
+// renderer.ts
+declare global {
+  interface Window {
+    electronAPI: {
+      sendMessage: (message: string) => void
+      onReply: (callback: (reply: string) => void) => void
+    }
+  }
+}
+
+window.electronAPI.sendMessage('Hello from renderer')
+window.electronAPI.onReply((reply) => console.log(reply))
+```
+
+## Security Checklist
+
+```typescript
+// ✅ Good security configuration
+const win = new BrowserWindow({
+  webPreferences: {
+    contextIsolation: true,        // ✅ MUST enable
+    nodeIntegration: false,        // ✅ MUST disable
+    sandbox: true,                 // ✅ Enable sandbox
+    webSecurity: true,            // ✅ Enable web security
+    allowRunningInsecureContent: false,  // ✅ Block insecure content
+  },
+})
+
+// Content Security Policy
+session.defaultSession.webRequest.onHeadersReceived((details, callback) => {
+  callback({
+    responseHeaders: {
+      ...details.responseHeaders,
+      'Content-Security-Policy': ["default-src 'self'"]
+    }
+  })
+})
+```
+
+<!-- ELECTRON:END -->
+

package/templates/frameworks/FLASK.md

@@ -0,0 +1,38 @@
+<!-- FLASK:START -->
+# Flask Framework Rules
+
+**Language**: Python  
+**Version**: Flask 3.0+
+
+## Setup
+
+```python
+from flask import Flask
+app = Flask(__name__)
+app.config.from_object('config.ProductionConfig')
+
+# Use Flask-SQLAlchemy for ORM
+# Use Flask-Migrate for migrations
+# Use Flask-Login for auth
+```
+
+## Quality Gates
+
+```bash
+black .
+ruff check .
+pytest --cov=app
+```
+
+## Best Practices
+
+✅ Use application factory pattern  
+✅ Enable CORS properly  
+✅ Use blueprints for organization  
+✅ Implement error handlers  
+
+❌ Don't use `debug=True` in production  
+❌ Don't store secrets in code  
+
+<!-- FLASK:END -->
+

package/templates/frameworks/FLUTTER.md

@@ -0,0 +1,55 @@
+<!-- FLUTTER:START -->
+# Flutter Framework Rules
+
+**Language**: Dart  
+**Version**: Flutter 3.10+
+
+## Setup
+
+```yaml
+# pubspec.yaml
+dependencies:
+  flutter:
+    sdk: flutter
+  cupertino_icons: ^1.0.2
+
+dev_dependencies:
+  flutter_test:
+    sdk: flutter
+  flutter_lints: ^2.0.0
+```
+
+## Quality Gates
+
+```bash
+dart format --set-exit-if-changed .
+dart analyze --fatal-infos
+flutter test
+flutter build apk --release  # Test build
+```
+
+## Best Practices
+
+✅ Use StatelessWidget when possible  
+✅ Implement proper state management (Provider, Riverpod, Bloc)  
+✅ Use const constructors  
+✅ Optimize widget rebuilds  
+✅ Test on multiple devices  
+
+❌ Don't use `print()` in production  
+❌ Don't skip null safety  
+❌ Don't ignore platform differences  
+
+## Project Structure
+
+```
+lib/
+├── main.dart
+├── models/
+├── screens/
+├── widgets/
+└── services/
+```
+
+<!-- FLUTTER:END -->
+

package/templates/frameworks/JQUERY.md

@@ -0,0 +1,32 @@
+<!-- JQUERY:START -->
+# jQuery Framework Rules
+
+**Language**: JavaScript  
+**Version**: jQuery 3.x+
+
+## Setup
+
+```html
+<script src="https://code.jquery.com/jquery-3.7.1.min.js"></script>
+```
+
+## Best Practices
+
+✅ Use modern JS alongside jQuery  
+✅ Minimize DOM manipulation  
+✅ Cache jQuery selectors  
+✅ Use event delegation  
+
+❌ Don't use jQuery for everything  
+❌ Don't pollute global scope  
+❌ Don't skip CSP headers  
+
+## Quality Gates
+
+```bash
+eslint src/**/*.js
+jest
+```
+
+<!-- JQUERY:END -->
+

package/templates/frameworks/LARAVEL.md

@@ -0,0 +1,38 @@
+<!-- LARAVEL:START -->
+# Laravel Framework Rules
+
+**CRITICAL**: Laravel services must respect these conventions and quality checks.
+
+## Quality Commands
+- Static analysis: `./vendor/bin/pint --test`
+- Lint style: `./vendor/bin/phpcs --standard=PSR12 app/`
+- Unit tests: `php artisan test`
+- Feature tests: `php artisan test --testsuite=Feature`
+- Coverage: ensure `php artisan test --coverage` ≥ 80%
+
+## Project Structure
+- Keep HTTP controllers in `app/Http/Controllers`
+- Use form requests for validation in `app/Http/Requests`
+- Organize business logic in `app/Services`
+- Leverage repositories for data persistence where appropriate
+- Store queued jobs in `app/Jobs`
+
+## Implementation Guidelines
+- Use migrations for every schema change (`php artisan make:migration`)
+- Keep Eloquent models lean; move heavy logic into services
+- Cache configuration after deployment (`php artisan config:cache`)
+- Register scheduled tasks in `app/Console/Kernel.php`
+- Ensure `app/Providers` registers new bindings/events
+
+## Composer Hygiene
+```bash
+composer install --no-dev --prefer-dist
+composer dump-autoload
+```
+
+## Additional Checks
+- Sync `.env.example` whenever new variables are introduced
+- Document API changes in `/docs/laravel-api.md`
+- Generate API resources via `php artisan make:resource`
+
+<!-- LARAVEL:END -->

package/templates/frameworks/NESTJS.md

@@ -0,0 +1,43 @@
+<!-- NESTJS:START -->
+# NestJS Framework Rules
+
+**CRITICAL**: Align all NestJS services, modules, and controllers with these conventions.
+
+## Project Structure
+- Maintain feature-first modules under `src/<feature>/`
+- Keep global providers in `src/common/`
+- Register new modules in `AppModule` and ensure dependency injection consistency
+- Prefer `@nestjs/config` for environment configuration
+
+## Quality Gates
+- Lint: `npm run lint`
+- Unit tests: `npm run test`
+- e2e tests: `npm run test:e2e`
+- Build validation: `npm run build`
+- Coverage threshold: **80%+** for service and controller layers
+
+## Implementation Guidelines
+- Use DTOs with `class-validator` and `class-transformer`
+- Encapsulate database access in providers (avoid direct repository use in controllers)
+- Document routes with `@nestjs/swagger` when OpenAPI is enabled
+- Keep asynchronous logic wrapped with `try/catch` and map errors to HTTP exceptions
+
+## Scripts to Run Before Commit
+```bash
+npm run lint
+npm run test
+npm run test:e2e
+npm run build
+```
+
+## Additional Checks
+- Ensure Circular Dependency detection is clean (`npm run lint -- --max-warnings=0`)
+- Synchronize `.env.example` with actual required variables
+- Maintain aligned versions for Nest core packages (`@nestjs/*`)
+
+## Documentation
+- Update `/docs/architecture.md` with new modules and providers
+- Keep OpenAPI spec regenerated via `npm run swagger:generate`
+- Log breaking changes in `CHANGELOG.md`
+
+<!-- NESTJS:END -->

package/templates/frameworks/NEXTJS.md

@@ -0,0 +1,127 @@
+<!-- NEXTJS:START -->
+# Next.js Framework Rules
+
+**Language**: TypeScript, JavaScript  
+**Version**: Next.js 14+ (App Router)
+
+## Setup & Configuration
+
+```typescript
+// next.config.ts
+import type { NextConfig } from 'next'
+
+const nextConfig: NextConfig = {
+  reactStrictMode: true,
+  images: {
+    domains: ['your-domain.com'],
+  },
+  env: {
+    CUSTOM_KEY: process.env.CUSTOM_KEY,
+  },
+}
+
+export default nextConfig
+```
+
+## Quality Gates
+
+```bash
+# Type check
+npm run type-check  # or: tsc --noEmit
+
+# Lint
+npm run lint        # Next.js ESLint
+
+# Format
+npx prettier --check "**/*.{ts,tsx}"
+
+# Tests
+npm test            # Vitest or Jest
+
+# Build
+npm run build       # Must succeed
+
+# Check bundle size
+npm run build && npx @next/bundle-analyzer
+```
+
+## Best Practices
+
+✅ **DO:**
+- Use App Router (app/) for new projects
+- Implement Server Components by default
+- Use Client Components ('use client') only when needed
+- Optimize images with next/image
+- Use dynamic imports for code splitting
+- Implement proper metadata/SEO
+- Use Server Actions for mutations
+- Enable React Strict Mode
+
+❌ **DON'T:**
+- Use getServerSideProps/getStaticProps in App Router
+- Fetch on client when server fetch is better
+- Skip image optimization
+- Ignore bundle size
+- Use 'use client' everywhere
+- Hardcode API URLs
+- Skip error boundaries
+
+## Project Structure (App Router)
+
+```
+app/
+├── layout.tsx         # Root layout
+├── page.tsx           # Home page
+├── (routes)/
+│   ├── dashboard/
+│   │   ├── layout.tsx
+│   │   └── page.tsx
+│   └── api/
+│       └── users/
+│           └── route.ts
+├── components/
+├── lib/
+└── types/
+```
+
+## Server vs Client Components
+
+```typescript
+// Server Component (default)
+async function ServerComponent() {
+  const data = await fetch('https://api.example.com/data')
+  return <div>{data}</div>
+}
+
+// Client Component
+'use client'
+import { useState } from 'react'
+
+function ClientComponent() {
+  const [count, setCount] = useState(0)
+  return <button onClick={() => setCount(count + 1)}>{count}</button>
+}
+```
+
+## Route Handlers (API Routes)
+
+```typescript
+// app/api/users/route.ts
+import { NextRequest, NextResponse } from 'next/server'
+
+export async function GET(request: NextRequest) {
+  const searchParams = request.nextUrl.searchParams
+  const id = searchParams.get('id')
+  
+  return NextResponse.json({ id })
+}
+
+export async function POST(request: NextRequest) {
+  const body = await request.json()
+  // Handle POST
+  return NextResponse.json({ success: true })
+}
+```
+
+<!-- NEXTJS:END -->
+

package/templates/frameworks/NUXT.md

@@ -0,0 +1,40 @@
+<!-- NUXT:START -->
+# Nuxt Framework Rules
+
+**CRITICAL**: Nuxt 3 applications must keep these standards to ensure SSR quality.
+
+## Quality Commands
+- Lint: `npm run lint`
+- Type check: `npm run type-check`
+- Unit tests: `npm run test`
+- Build for production: `npm run build`
+- Generate static output (if applicable): `npm run generate`
+
+## Project Structure
+- Define routes with file-based routing under `pages/`
+- Keep server API handlers within `server/api/`
+- Organize composables in `composables/`
+- Place reusable UI components in `components/`
+- Store state via Pinia modules in `stores/`
+
+## Implementation Guidelines
+- Use runtime config via `useRuntimeConfig()` for secrets
+- SSR-safe operations only inside `onServerPrefetch`/server routes
+- Prefer `definePageMeta` to control page-level features
+- Maintain i18n messages in `/locales`
+- Cache heavy computations with Nitro storage if needed
+
+## Pre-Commit Commands
+```bash
+npm run lint
+npm run type-check
+npm run test
+npm run build
+```
+
+## Documentation
+- Keep `/docs/nuxt-architecture.md` current with route layout and middleware
+- Document server API contracts in `/docs/api.md`
+- Capture deployment steps (SSR vs static) in `/docs/deployment.md`
+
+<!-- NUXT:END -->

package/templates/frameworks/RAILS.md

@@ -0,0 +1,66 @@
+<!-- RAILS:START -->
+# Ruby on Rails Framework Rules
+
+**Language**: Ruby  
+**Version**: Rails 7.0+
+
+## Setup & Configuration
+
+```ruby
+# config/database.yml
+production:
+  url: <%= ENV['DATABASE_URL'] %>
+
+# config/environments/production.rb
+config.force_ssl = true
+config.log_level = :info
+```
+
+## Quality Gates
+
+```bash
+# Code quality
+bundle exec rubocop             # Lint
+bundle exec brakeman           # Security scan
+
+# Tests
+bundle exec rspec              # Run tests
+bundle exec rspec --format documentation  # Verbose
+
+# Type check (optional)
+bundle exec steep check        # Static typing
+```
+
+## Best Practices
+
+✅ **DO:**
+- Use strong parameters
+- Implement authentication (Devise/custom)
+- Use ActiveRecord callbacks sparingly
+- Write RSpec/Minitest tests
+- Use database migrations
+- Enable CSRF protection
+
+❌ **DON'T:**
+- Skip validations in models
+- Use `params` without permit
+- Store secrets in code
+- Skip database indexes
+- Ignore N+1 queries
+
+## Project Structure
+
+```
+app/
+├── controllers/
+├── models/
+├── views/
+├── jobs/
+└── mailers/
+config/
+db/
+spec/
+```
+
+<!-- RAILS:END -->
+