@oriro/orirocli 0.1.11 → 0.3.1

package/skills/technical/saas-builder/SKILL.md

@@ -1,138 +1,138 @@
----
-watermark: ORIRO
-name: saas-builder
-provider: ORIRO.ai
-copyright: Copyright (c) 2026 ORIRO.ai
-description: >
-  SaaS product development — multi-tenancy, subscription billing, onboarding, feature flags, and SaaS architecture patterns.
-
-
-
-
-
-  Sources: Stripe docs, Anthropic docs, Sanity/Contentful docs, industry-specific technical resources.
----
-
-# SaaS Product Development
-
-## Multi-tenancy architecture
-
-### Models
-
-**Single database, shared schema:** All tenants in same tables. `tenant_id` column on every table. Simplest. RLS (Row-Level Security) enforces isolation.
-**Database per tenant:** Full isolation. More complex. Higher cost. Required for data residency requirements.
-**Schema per tenant (PostgreSQL):** Middle ground. Isolated but in same database.
-
-### Row Level Security (PostgreSQL)
-
-```sql
-ALTER TABLE posts ENABLE ROW LEVEL SECURITY;
-CREATE POLICY tenant_isolation ON posts
-  USING (tenant_id = current_setting('app.tenant_id')::uuid);
-```
-
-Set `app.tenant_id` in your connection before queries. Postgres enforces the policy.
-
-### Tenant resolution
-
-**Subdomain:** `acme.yourapp.com` → tenant = acme. Common for B2B.
-**URL path:** `yourapp.com/org/acme` → tenant from URL.
-**Custom domain:** `app.acme.com` → custom domain mapped to tenant in DB.
-
-```ts
-// Middleware for subdomain resolution
-function getTenantFromRequest(req: Request): string {
-  const host = req.headers.get("host") ?? "";
-  const subdomain = host.split(".")[0];
-  if (subdomain && subdomain !== "www" && subdomain !== "app") return subdomain;
-  return req.headers.get("x-tenant-id") ?? ""; // fallback for custom domains
-}
-```
-
-## Subscription billing (Stripe)
-
-### Products and prices
-
-```ts
-// Create product and price in Stripe
-const product = await stripe.products.create({ name: "Pro Plan" });
-const price = await stripe.prices.create({
-  product: product.id,
-  unit_amount: 2900, // $29.00 in cents
-  currency: "usd",
-  recurring: { interval: "month" },
-});
-```
-
-### Checkout flow
-
-```ts
-// Create checkout session
-const session = await stripe.checkout.sessions.create({
-  customer_email: user.email,
-  payment_method_types: ["card"],
-  line_items: [{ price: priceId, quantity: 1 }],
-  mode: "subscription",
-  success_url: `${baseUrl}/dashboard?session_id={CHECKOUT_SESSION_ID}`,
-  cancel_url: `${baseUrl}/pricing`,
-  metadata: { userId: user.id },
-});
-return redirect(session.url);
-```
-
-### Webhook handling (always verify signature)
-
-```ts
-app.post("/webhooks/stripe", express.raw({ type: "application/json" }), async (req, res) => {
-  const sig = req.headers["stripe-signature"];
-  let event;
-  try {
-    event = stripe.webhooks.constructEvent(req.body, sig, webhookSecret);
-  } catch (err) {
-    return res.status(400).send(`Webhook Error: ${err.message}`);
-  }
-
-  switch (event.type) {
-    case "customer.subscription.created":
-    case "customer.subscription.updated":
-      await syncSubscription(event.data.object);
-      break;
-    case "customer.subscription.deleted":
-      await cancelSubscription(event.data.object.customer);
-      break;
-    case "invoice.payment_failed":
-      await handlePaymentFailure(event.data.object);
-      break;
-  }
-  res.json({ received: true });
-});
-```
-
-## Feature flags
-
-```ts
-// Simple feature flag check
-function isFeatureEnabled(feature: string, user: User): boolean {
-  // Check: override table → plan features → percentage rollout
-  const override = featureOverrides[user.id]?.[feature];
-  if (override !== undefined) return override;
-
-  const planFeatures = planConfig[user.subscription.plan];
-  if (feature in planFeatures) return planFeatures[feature];
-
-  return defaultFeatures[feature] ?? false;
-}
-```
-
-For production: LaunchDarkly, Unleash (self-hosted), or Statsig.
-
-## SaaS metrics to track
-
-- MRR/ARR, MRR movements (new/expansion/contraction/churn)
-- Churn rate (customer and revenue)
-- NRR (Net Revenue Retention)
-- CAC and LTV by acquisition channel
-- Feature adoption rates
-- Time to value (time from signup to first meaningful action)
-
-Sources: Stripe documentation (stripe.com/docs — free), PGTune (for PostgreSQL config), Christoph Nakazawa SaaS patterns
+---
+watermark: ORIRO
+name: saas-builder
+provider: ORIRO.ai
+copyright: Copyright (c) 2026 ORIRO.ai
+description: >
+  SaaS product development — multi-tenancy, subscription billing, onboarding, feature flags, and SaaS architecture patterns.
+
+
+
+
+
+  Sources: Stripe docs, Anthropic docs, Sanity/Contentful docs, industry-specific technical resources.
+---
+
+# SaaS Product Development
+
+## Multi-tenancy architecture
+
+### Models
+
+**Single database, shared schema:** All tenants in same tables. `tenant_id` column on every table. Simplest. RLS (Row-Level Security) enforces isolation.
+**Database per tenant:** Full isolation. More complex. Higher cost. Required for data residency requirements.
+**Schema per tenant (PostgreSQL):** Middle ground. Isolated but in same database.
+
+### Row Level Security (PostgreSQL)
+
+```sql
+ALTER TABLE posts ENABLE ROW LEVEL SECURITY;
+CREATE POLICY tenant_isolation ON posts
+  USING (tenant_id = current_setting('app.tenant_id')::uuid);
+```
+
+Set `app.tenant_id` in your connection before queries. Postgres enforces the policy.
+
+### Tenant resolution
+
+**Subdomain:** `acme.yourapp.com` → tenant = acme. Common for B2B.
+**URL path:** `yourapp.com/org/acme` → tenant from URL.
+**Custom domain:** `app.acme.com` → custom domain mapped to tenant in DB.
+
+```ts
+// Middleware for subdomain resolution
+function getTenantFromRequest(req: Request): string {
+  const host = req.headers.get("host") ?? "";
+  const subdomain = host.split(".")[0];
+  if (subdomain && subdomain !== "www" && subdomain !== "app") return subdomain;
+  return req.headers.get("x-tenant-id") ?? ""; // fallback for custom domains
+}
+```
+
+## Subscription billing (Stripe)
+
+### Products and prices
+
+```ts
+// Create product and price in Stripe
+const product = await stripe.products.create({ name: "Pro Plan" });
+const price = await stripe.prices.create({
+  product: product.id,
+  unit_amount: 2900, // $29.00 in cents
+  currency: "usd",
+  recurring: { interval: "month" },
+});
+```
+
+### Checkout flow
+
+```ts
+// Create checkout session
+const session = await stripe.checkout.sessions.create({
+  customer_email: user.email,
+  payment_method_types: ["card"],
+  line_items: [{ price: priceId, quantity: 1 }],
+  mode: "subscription",
+  success_url: `${baseUrl}/dashboard?session_id={CHECKOUT_SESSION_ID}`,
+  cancel_url: `${baseUrl}/pricing`,
+  metadata: { userId: user.id },
+});
+return redirect(session.url);
+```
+
+### Webhook handling (always verify signature)
+
+```ts
+app.post("/webhooks/stripe", express.raw({ type: "application/json" }), async (req, res) => {
+  const sig = req.headers["stripe-signature"];
+  let event;
+  try {
+    event = stripe.webhooks.constructEvent(req.body, sig, webhookSecret);
+  } catch (err) {
+    return res.status(400).send(`Webhook Error: ${err.message}`);
+  }
+
+  switch (event.type) {
+    case "customer.subscription.created":
+    case "customer.subscription.updated":
+      await syncSubscription(event.data.object);
+      break;
+    case "customer.subscription.deleted":
+      await cancelSubscription(event.data.object.customer);
+      break;
+    case "invoice.payment_failed":
+      await handlePaymentFailure(event.data.object);
+      break;
+  }
+  res.json({ received: true });
+});
+```
+
+## Feature flags
+
+```ts
+// Simple feature flag check
+function isFeatureEnabled(feature: string, user: User): boolean {
+  // Check: override table → plan features → percentage rollout
+  const override = featureOverrides[user.id]?.[feature];
+  if (override !== undefined) return override;
+
+  const planFeatures = planConfig[user.subscription.plan];
+  if (feature in planFeatures) return planFeatures[feature];
+
+  return defaultFeatures[feature] ?? false;
+}
+```
+
+For production: LaunchDarkly, Unleash (self-hosted), or Statsig.
+
+## SaaS metrics to track
+
+- MRR/ARR, MRR movements (new/expansion/contraction/churn)
+- Churn rate (customer and revenue)
+- NRR (Net Revenue Retention)
+- CAC and LTV by acquisition channel
+- Feature adoption rates
+- Time to value (time from signup to first meaningful action)
+
+Sources: Stripe documentation (stripe.com/docs — free), PGTune (for PostgreSQL config), Christoph Nakazawa SaaS patterns

package/skills/technical/scope-estimation/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 ORIRO.ai
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 ORIRO.ai
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/skills/technical/scope-estimation/SKILL.md

@@ -1,99 +1,99 @@
----
-watermark: ORIRO
-name: scope-estimation
-provider: ORIRO.ai
-copyright: Copyright (c) 2026 ORIRO.ai
-description: >
-
-
-
-
-
-
-
-  Engineering scope estimation — breaking down work, estimating complexity, communicating uncertainty, and avoiding common estimation traps.
-
-
-
-
-  Sources: Google Search Central, GDPR text, AWS security documentation, Stripe API docs.
----
-
-# Engineering Scope Estimation
-
-## Why estimation is hard
-
-**Hofstadter's Law:** It always takes longer than you expect, even when you take into account Hofstadter's Law.
-**Core problem:** You're estimating work that's never been done before. If it had been done before, you wouldn't need to estimate.
-**Uncertainty types:** Technical uncertainty (how to build it), scope uncertainty (what exactly), dependency uncertainty (what else needs to happen).
-
-## The three-point estimation method
-
-Don't give a single number. Give a range.
-**Optimistic (O):** Best case — everything goes right.
-**Most Likely (M):** Normal case — some issues encountered.
-**Pessimistic (P):** Worst case — major problems arise.
-
-PERT estimate: (O + 4M + P) / 6
-Standard deviation: (P - O) / 6
-
-Example: Feature estimate
-O = 3 days, M = 5 days, P = 12 days
-PERT = (3 + 20 + 12) / 6 = 5.8 days ≈ 6 days
-σ = (12 - 3) / 6 = 1.5 days
-90% confidence interval: ~6 ± 2.5 days = 3.5 to 8.5 days
-
-**Communicate the range:** "This will take 5-8 days, with 90% confidence."
-
-## Breaking down work
-
-**The 2-day rule:** No task should be estimated longer than 2 days. If it is, break it down further.
-**Tasks must be verifiable:** "Implement auth" is not a task. "Implement JWT login endpoint that returns access and refresh tokens" is a task.
-
-**Decomposition framework:**
-
-1. Design/planning (often underestimated): ER diagram, API design, state machine.
-2. Core implementation: The main feature work.
-3. Error handling and edge cases (often 30% of total).
-4. Tests: Unit, integration, E2E.
-5. Documentation: Code comments, API docs, README updates.
-6. Code review and feedback incorporation.
-7. Deployment and verification.
-
-**Missing from most estimates:**
-
-- Integration work (connecting to other services)
-- Security considerations (auth, input validation, rate limiting)
-- Logging and observability
-- Performance optimization to meet SLA
-- Edge cases (what happens when X is null? When the network fails?)
-
-## Common estimation traps
-
-**The planning fallacy:** Optimism bias. People consistently underestimate time.
-**Fix:** Reference class forecasting. How long did similar past tasks actually take?
-
-**Anchoring:** First estimate mentioned becomes anchor. People adjust insufficiently from anchor.
-**Fix:** Estimate independently before sharing. Reveal simultaneously (planning poker).
-
-**Scope creep acceptance:** Saying yes to small additions without resetting estimate.
-**Fix:** Any change to scope = new estimate or explicit acknowledgment of trade-offs.
-
-**Integration tax:** Connecting two systems always takes longer than expected.
-**Rule:** Add 30% to any estimate involving integration with external systems.
-
-## Communicating estimates
-
-**Confidence levels:**
-High confidence (well-understood work): ±25%
-Medium confidence (some unknowns): ±50%
-Low confidence (significant unknowns): ±100%
-
-**What to say:**
-"Based on what I understand, this will take X days. My confidence level is [high/medium/low] because [reason]. The main unknowns are [X, Y, Z]. If we discover [major risk], the estimate could increase to [worst case]."
-
-**What NOT to commit to:**
-Exact dates when you have significant unknowns.
-"We can definitely finish by [date]" when you're already behind.
-
-Sources: McConnell "Software Estimation: Demystifying the Black Art" (principles), Steve McConnell cone of uncertainty, PERT estimation method (USAF, public domain), Kahneman planning fallacy research
+---
+watermark: ORIRO
+name: scope-estimation
+provider: ORIRO.ai
+copyright: Copyright (c) 2026 ORIRO.ai
+description: >
+
+
+
+
+
+
+
+  Engineering scope estimation — breaking down work, estimating complexity, communicating uncertainty, and avoiding common estimation traps.
+
+
+
+
+  Sources: Google Search Central, GDPR text, AWS security documentation, Stripe API docs.
+---
+
+# Engineering Scope Estimation
+
+## Why estimation is hard
+
+**Hofstadter's Law:** It always takes longer than you expect, even when you take into account Hofstadter's Law.
+**Core problem:** You're estimating work that's never been done before. If it had been done before, you wouldn't need to estimate.
+**Uncertainty types:** Technical uncertainty (how to build it), scope uncertainty (what exactly), dependency uncertainty (what else needs to happen).
+
+## The three-point estimation method
+
+Don't give a single number. Give a range.
+**Optimistic (O):** Best case — everything goes right.
+**Most Likely (M):** Normal case — some issues encountered.
+**Pessimistic (P):** Worst case — major problems arise.
+
+PERT estimate: (O + 4M + P) / 6
+Standard deviation: (P - O) / 6
+
+Example: Feature estimate
+O = 3 days, M = 5 days, P = 12 days
+PERT = (3 + 20 + 12) / 6 = 5.8 days ≈ 6 days
+σ = (12 - 3) / 6 = 1.5 days
+90% confidence interval: ~6 ± 2.5 days = 3.5 to 8.5 days
+
+**Communicate the range:** "This will take 5-8 days, with 90% confidence."
+
+## Breaking down work
+
+**The 2-day rule:** No task should be estimated longer than 2 days. If it is, break it down further.
+**Tasks must be verifiable:** "Implement auth" is not a task. "Implement JWT login endpoint that returns access and refresh tokens" is a task.
+
+**Decomposition framework:**
+
+1. Design/planning (often underestimated): ER diagram, API design, state machine.
+2. Core implementation: The main feature work.
+3. Error handling and edge cases (often 30% of total).
+4. Tests: Unit, integration, E2E.
+5. Documentation: Code comments, API docs, README updates.
+6. Code review and feedback incorporation.
+7. Deployment and verification.
+
+**Missing from most estimates:**
+
+- Integration work (connecting to other services)
+- Security considerations (auth, input validation, rate limiting)
+- Logging and observability
+- Performance optimization to meet SLA
+- Edge cases (what happens when X is null? When the network fails?)
+
+## Common estimation traps
+
+**The planning fallacy:** Optimism bias. People consistently underestimate time.
+**Fix:** Reference class forecasting. How long did similar past tasks actually take?
+
+**Anchoring:** First estimate mentioned becomes anchor. People adjust insufficiently from anchor.
+**Fix:** Estimate independently before sharing. Reveal simultaneously (planning poker).
+
+**Scope creep acceptance:** Saying yes to small additions without resetting estimate.
+**Fix:** Any change to scope = new estimate or explicit acknowledgment of trade-offs.
+
+**Integration tax:** Connecting two systems always takes longer than expected.
+**Rule:** Add 30% to any estimate involving integration with external systems.
+
+## Communicating estimates
+
+**Confidence levels:**
+High confidence (well-understood work): ±25%
+Medium confidence (some unknowns): ±50%
+Low confidence (significant unknowns): ±100%
+
+**What to say:**
+"Based on what I understand, this will take X days. My confidence level is [high/medium/low] because [reason]. The main unknowns are [X, Y, Z]. If we discover [major risk], the estimate could increase to [worst case]."
+
+**What NOT to commit to:**
+Exact dates when you have significant unknowns.
+"We can definitely finish by [date]" when you're already behind.
+
+Sources: McConnell "Software Estimation: Demystifying the Black Art" (principles), Steve McConnell cone of uncertainty, PERT estimation method (USAF, public domain), Kahneman planning fallacy research

package/skills/technical/secrets-management/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 ORIRO.ai
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 ORIRO.ai
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.