@planu/cli 0.24.0 → 0.25.0

package/dist/engine/spec-templates/catalog-extra.js

@@ -0,0 +1,367 @@
+// engine/spec-templates/catalog-extra.ts — Additional built-in templates (data, security, performance).
+// Split from catalog.ts to keep file size within the 500-line limit.
+/** Extra built-in spec templates (data, security, performance). */
+export const EXTRA_TEMPLATES = [
+    {
+        id: 'data-migration',
+        name: 'Data Migration',
+        category: 'data',
+        description: 'Safe, reversible database or data migration with rollback support.',
+        tags: ['migration', 'database', 'schema', 'data'],
+        variables: [
+            {
+                key: 'MigrationName',
+                label: 'Migration name',
+                description: 'Short descriptive name for this migration',
+                example: 'Add email_verified column to users',
+                required: true,
+            },
+        ],
+        huTemplate: `# HU: Data Migration — {{MigrationName}}
+
+## User Story
+As a developer, I want to apply the migration "{{MigrationName}}" safely so that production data is not at risk.
+
+## Acceptance Criteria
+
+### AC-1: Migration script
+- [ ] Migration has an "up" (apply) and "down" (rollback) operation
+- [ ] Script is idempotent (safe to run multiple times)
+- [ ] Each step is transactional where supported by the database
+
+### AC-2: Data safety
+- [ ] Pre-migration backup documented in runbook
+- [ ] No destructive operation without a confirmed backup
+- [ ] Migration tested on a staging copy of production data
+
+### AC-3: Zero-downtime strategy
+- [ ] Migration can be applied while the application is running
+- [ ] Backward-compatible schema changes first (expand), then cleanup (contract)
+- [ ] Feature flag used if application code needs to switch behavior
+
+### AC-4: Rollback
+- [ ] Rollback procedure documented and tested
+- [ ] Rollback does not cause data loss
+- [ ] Time to rollback < 15 minutes
+
+### AC-5: Observability
+- [ ] Migration duration logged
+- [ ] Row counts before/after logged for verification
+- [ ] Anomalies (unexpected row counts) trigger alerts
+`,
+        fichaTecnicaTemplate: `# FICHA TÉCNICA: Data Migration — {{MigrationName}}
+
+## Affected Files
+- migrations/{{MigrationName}}/up
+- migrations/{{MigrationName}}/down
+- runbooks/{{MigrationName}}-rollback
+
+## Types / Entities
+- Migration metadata: id, name, appliedAt, duration, rolledBack
+
+## Risks
+- Data loss on rollback → mandatory backup before apply
+- Long-running migration → table locks in production
+- Missing idempotency → partial application leaves DB in bad state
+
+## Estimation (rough)
+- Dev: 4–12 hours
+- Review: 2–4 hours
+- Difficulty: 3/5
+`,
+        progressTemplate: `# PROGRESS: Data Migration — {{MigrationName}}
+
+## Status: draft
+
+## Criteria
+- [ ] AC-1: Migration script
+- [ ] AC-2: Data safety
+- [ ] AC-3: Zero-downtime strategy
+- [ ] AC-4: Rollback
+- [ ] AC-5: Observability
+`,
+    },
+    {
+        id: 'security-feature',
+        name: 'Security Feature',
+        category: 'security',
+        description: 'Security hardening: rate limiting, input sanitization, audit logging, etc.',
+        tags: ['security', 'hardening', 'audit', 'rate-limiting'],
+        variables: [
+            {
+                key: 'FeatureName',
+                label: 'Security feature name',
+                description: 'Name of the security feature being implemented',
+                example: 'Rate Limiting',
+                required: true,
+            },
+            {
+                key: 'ProtectedResource',
+                label: 'Protected resource or area',
+                description: 'What is being protected by this feature',
+                example: 'authentication endpoints',
+                required: true,
+            },
+        ],
+        huTemplate: `# HU: Security Feature — {{FeatureName}}
+
+## User Story
+As a security engineer, I want {{FeatureName}} applied to {{ProtectedResource}} so that attack vectors are reduced.
+
+## Acceptance Criteria
+
+### AC-1: Implementation
+- [ ] {{FeatureName}} implemented at the correct layer (edge, gateway, application)
+- [ ] Configuration externalized (not hardcoded)
+- [ ] Enabled in production, configurable in development
+
+### AC-2: Bypass prevention
+- [ ] Cannot be bypassed by manipulating headers or query parameters
+- [ ] Handles IPv4, IPv6, and forwarded IP headers correctly
+- [ ] Works behind reverse proxies and CDNs
+
+### AC-3: Observability
+- [ ] Blocked/throttled requests logged with reason
+- [ ] Metrics exported: blocked count, block rate, top blocked IPs
+- [ ] Alert triggers when block rate exceeds threshold
+
+### AC-4: Testing
+- [ ] Unit tests cover allowed and blocked cases
+- [ ] Integration tests simulate attack patterns
+- [ ] Penetration test checklist updated
+
+### AC-5: Documentation
+- [ ] Security runbook updated with new feature
+- [ ] Limits and thresholds documented with rationale
+- [ ] On-call playbook updated for incident response
+`,
+        fichaTecnicaTemplate: `# FICHA TÉCNICA: Security Feature — {{FeatureName}}
+
+## Affected Files
+- middleware/{{FeatureName}}
+- config/security-config
+- monitoring/security-alerts
+- runbooks/security-incident
+
+## Types / Entities
+- \`{{FeatureName}}Config\`: thresholds, enabled, dryRun
+- \`SecurityEvent\`: type, resource, ip, timestamp, blocked
+
+## Risks
+- False positives blocking legitimate users → dry-run mode first
+- Missing coverage for all entry points → security audit required
+- Misconfiguration under proxy → test in staging with proxy enabled
+
+## Estimation (rough)
+- Dev: 4–12 hours
+- Review: 2–4 hours
+- Difficulty: 3/5
+`,
+        progressTemplate: `# PROGRESS: Security Feature — {{FeatureName}}
+
+## Status: draft
+
+## Criteria
+- [ ] AC-1: Implementation
+- [ ] AC-2: Bypass prevention
+- [ ] AC-3: Observability
+- [ ] AC-4: Testing
+- [ ] AC-5: Documentation
+`,
+    },
+    {
+        id: 'performance-optimization',
+        name: 'Performance Optimization',
+        category: 'performance',
+        description: 'Measurable performance improvements with before/after benchmarks.',
+        tags: ['performance', 'optimization', 'caching', 'benchmarks'],
+        variables: [
+            {
+                key: 'TargetArea',
+                label: 'Target area',
+                description: 'The specific area to optimize (e.g. API response time, DB queries)',
+                example: 'API response time',
+                required: true,
+            },
+            {
+                key: 'CurrentBaseline',
+                label: 'Current baseline',
+                description: 'Current measured performance metric',
+                example: 'P95 latency: 800ms',
+                required: false,
+                defaultValue: 'TBD — measure before starting',
+            },
+            {
+                key: 'TargetGoal',
+                label: 'Target goal',
+                description: 'Desired performance metric after optimization',
+                example: 'P95 latency: < 200ms',
+                required: false,
+                defaultValue: 'TBD — define after baseline measurement',
+            },
+        ],
+        huTemplate: `# HU: Performance Optimization — {{TargetArea}}
+
+## User Story
+As a user, I want {{TargetArea}} to be faster so that the application feels responsive.
+
+## Baseline
+- Current: {{CurrentBaseline}}
+- Target: {{TargetGoal}}
+
+## Acceptance Criteria
+
+### AC-1: Baseline measurement
+- [ ] Benchmark suite established before any changes
+- [ ] Metrics captured: P50, P95, P99 latency, throughput, error rate
+- [ ] Benchmark results stored for comparison
+
+### AC-2: Optimization implementation
+- [ ] Root cause of performance issue identified and documented
+- [ ] Optimization applied at the correct layer
+- [ ] No correctness regression introduced by optimization
+
+### AC-3: Cache strategy (if applicable)
+- [ ] Cache invalidation strategy defined
+- [ ] Cache hit rate monitored
+- [ ] Cache warm-up procedure documented
+
+### AC-4: Validation
+- [ ] Post-optimization benchmark shows improvement vs baseline
+- [ ] Target goal reached or documented with explanation if not
+- [ ] Load test confirms improvement holds under concurrent traffic
+
+### AC-5: Observability
+- [ ] Performance metrics added to dashboard
+- [ ] Regression alert configured (auto-detect if P95 degrades)
+`,
+        fichaTecnicaTemplate: `# FICHA TÉCNICA: Performance Optimization — {{TargetArea}}
+
+## Affected Files
+- (determined during root-cause analysis)
+- monitoring/dashboards/{{TargetArea}}
+- benchmarks/{{TargetArea}}
+
+## Types / Entities
+- \`BenchmarkResult\`: timestamp, p50, p95, p99, throughput, errorRate
+- \`CacheEntry\` (if caching): key, value, ttl, hitCount
+
+## Risks
+- Optimization that breaks correctness → benchmark must include correctness tests
+- Cache inconsistency → strong consistency tests required
+- Performance regression after unrelated change → regression alert required
+
+## Estimation (rough)
+- Dev: 4–20 hours (highly variable by root cause)
+- Review: 2–4 hours
+- Difficulty: 3–4/5
+`,
+        progressTemplate: `# PROGRESS: Performance Optimization — {{TargetArea}}
+
+## Status: draft
+
+## Criteria
+- [ ] AC-1: Baseline measurement
+- [ ] AC-2: Optimization implementation
+- [ ] AC-3: Cache strategy
+- [ ] AC-4: Validation
+- [ ] AC-5: Observability
+`,
+    },
+    {
+        id: 'third-party-integration',
+        name: 'Third-Party Integration',
+        category: 'integration',
+        description: 'Integrating with an external service (payment, email, SMS, CRM, etc.).',
+        tags: ['integration', 'external', 'api', 'webhook'],
+        variables: [
+            {
+                key: 'ServiceName',
+                label: 'Service name',
+                description: 'Name of the external service to integrate',
+                example: 'Stripe',
+                required: true,
+            },
+            {
+                key: 'IntegrationPurpose',
+                label: 'Purpose',
+                description: 'What the integration enables',
+                example: 'payment processing',
+                required: true,
+            },
+        ],
+        huTemplate: `# HU: {{ServiceName}} Integration
+
+## User Story
+As a developer, I want to integrate {{ServiceName}} so that the platform can handle {{IntegrationPurpose}} reliably.
+
+## Acceptance Criteria
+
+### AC-1: Credentials management
+- [ ] API keys and secrets stored in environment variables (never hardcoded)
+- [ ] Separate credentials for development, staging, and production
+- [ ] Credential rotation documented in runbook
+
+### AC-2: Core integration
+- [ ] {{ServiceName}} SDK or HTTP client initialized with proper config
+- [ ] All calls wrapped in retry logic with exponential backoff
+- [ ] Timeouts configured (no infinite waits)
+
+### AC-3: Error handling
+- [ ] {{ServiceName}} API errors mapped to internal error types
+- [ ] Network failures do not crash the application
+- [ ] Errors logged with enough context for debugging
+
+### AC-4: Webhooks (if applicable)
+- [ ] Webhook endpoint validates signature before processing
+- [ ] Events processed idempotently (replay-safe)
+- [ ] Failed event processing alerts the on-call team
+
+### AC-5: Observability
+- [ ] All outbound calls logged (method, status, latency)
+- [ ] Circuit breaker implemented for high-traffic paths
+
+### AC-6: Testing
+- [ ] Unit tests mock {{ServiceName}} client
+- [ ] Integration tests use sandbox/test environment
+- [ ] Webhook tests replay recorded payloads
+`,
+        fichaTecnicaTemplate: `# FICHA TÉCNICA: {{ServiceName}} Integration
+
+## Affected Files
+- integrations/{{ServiceName}}/client
+- integrations/{{ServiceName}}/webhook-handler
+- integrations/{{ServiceName}}/error-mapper
+- config/{{ServiceName}}-config
+- tests/integrations/{{ServiceName}}
+
+## Types / Entities
+- \`{{ServiceName}}Config\`: apiKey, baseUrl, timeout, retries
+- \`{{ServiceName}}Error\`: code, message, retryable
+- \`WebhookEvent\`: id, type, payload, receivedAt
+
+## Risks
+- Vendor API changes without notice → pin SDK version, monitor changelogs
+- Rate limits exceeded → implement request queuing
+- Credentials leaked → secrets manager mandatory
+
+## Estimation (rough)
+- Dev: 8–20 hours
+- Review: 2–4 hours
+- Difficulty: 3/5
+`,
+        progressTemplate: `# PROGRESS: {{ServiceName}} Integration
+
+## Status: draft
+
+## Criteria
+- [ ] AC-1: Credentials management
+- [ ] AC-2: Core integration
+- [ ] AC-3: Error handling
+- [ ] AC-4: Webhooks
+- [ ] AC-5: Observability
+- [ ] AC-6: Testing
+`,
+    },
+];
+//# sourceMappingURL=catalog-extra.js.map

package/dist/engine/spec-templates/catalog-extra.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-extra.js","sourceRoot":"","sources":["../../../src/engine/spec-templates/catalog-extra.ts"],"names":[],"mappings":"AAAA,wGAAwG;AACxG,qEAAqE;AAIrE,mEAAmE;AACnE,MAAM,CAAC,MAAM,eAAe,GAAwB;IAClD;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,oEAAoE;QACjF,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC;QACjD,SAAS,EAAE;YACT;gBACE,GAAG,EAAE,eAAe;gBACpB,KAAK,EAAE,gBAAgB;gBACvB,WAAW,EAAE,2CAA2C;gBACxD,OAAO,EAAE,oCAAoC;gBAC7C,QAAQ,EAAE,IAAI;aACf;SACF;QACD,UAAU,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+Bf;QACG,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;CAmBzB;QACG,gBAAgB,EAAE;;;;;;;;;;CAUrB;KACE;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,4EAA4E;QACzF,IAAI,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,CAAC;QACzD,SAAS,EAAE;YACT;gBACE,GAAG,EAAE,aAAa;gBAClB,KAAK,EAAE,uBAAuB;gBAC9B,WAAW,EAAE,gDAAgD;gBAC7D,OAAO,EAAE,eAAe;gBACxB,QAAQ,EAAE,IAAI;aACf;YACD;gBACE,GAAG,EAAE,mBAAmB;gBACxB,KAAK,EAAE,4BAA4B;gBACnC,WAAW,EAAE,yCAAyC;gBACtD,OAAO,EAAE,0BAA0B;gBACnC,QAAQ,EAAE,IAAI;aACf;SACF;QACD,UAAU,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+Bf;QACG,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;CAqBzB;QACG,gBAAgB,EAAE;;;;;;;;;;CAUrB;KACE;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,IAAI,EAAE,0BAA0B;QAChC,QAAQ,EAAE,aAAa;QACvB,WAAW,EAAE,mEAAmE;QAChF,IAAI,EAAE,CAAC,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,CAAC;QAC9D,SAAS,EAAE;YACT;gBACE,GAAG,EAAE,YAAY;gBACjB,KAAK,EAAE,aAAa;gBACpB,WAAW,EAAE,oEAAoE;gBACjF,OAAO,EAAE,mBAAmB;gBAC5B,QAAQ,EAAE,IAAI;aACf;YACD;gBACE,GAAG,EAAE,iBAAiB;gBACtB,KAAK,EAAE,kBAAkB;gBACzB,WAAW,EAAE,qCAAqC;gBAClD,OAAO,EAAE,oBAAoB;gBAC7B,QAAQ,EAAE,KAAK;gBACf,YAAY,EAAE,+BAA+B;aAC9C;YACD;gBACE,GAAG,EAAE,YAAY;gBACjB,KAAK,EAAE,aAAa;gBACpB,WAAW,EAAE,+CAA+C;gBAC5D,OAAO,EAAE,sBAAsB;gBAC/B,QAAQ,EAAE,KAAK;gBACf,YAAY,EAAE,yCAAyC;aACxD;SACF;QACD,UAAU,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkCf;QACG,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;CAoBzB;QACG,gBAAgB,EAAE;;;;;;;;;;CAUrB;KACE;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,aAAa;QACvB,WAAW,EAAE,wEAAwE;QACrF,IAAI,EAAE,CAAC,aAAa,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,CAAC;QACnD,SAAS,EAAE;YACT;gBACE,GAAG,EAAE,aAAa;gBAClB,KAAK,EAAE,cAAc;gBACrB,WAAW,EAAE,2CAA2C;gBACxD,OAAO,EAAE,QAAQ;gBACjB,QAAQ,EAAE,IAAI;aACf;YACD;gBACE,GAAG,EAAE,oBAAoB;gBACzB,KAAK,EAAE,SAAS;gBAChB,WAAW,EAAE,8BAA8B;gBAC3C,OAAO,EAAE,oBAAoB;gBAC7B,QAAQ,EAAE,IAAI;aACf;SACF;QACD,UAAU,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmCf;QACG,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;CAuBzB;QACG,gBAAgB,EAAE;;;;;;;;;;;CAWrB;KACE;CACF,CAAC"}

package/dist/engine/spec-templates/catalog.d.ts

@@ -0,0 +1,4 @@
+import type { SpecTemplateEntry } from '../../types/spec-templates.js';
+/** Full catalog of built-in spec templates (core + extra). */
+export declare const BUILT_IN_TEMPLATES: SpecTemplateEntry[];
+//# sourceMappingURL=catalog.d.ts.map

package/dist/engine/spec-templates/catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../../src/engine/spec-templates/catalog.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AA+XvE,8DAA8D;AAC9D,eAAO,MAAM,kBAAkB,EAAE,iBAAiB,EAA4C,CAAC"}