@polymorphism-tech/morph-spec 3.2.0 → 4.3.0

package/stacks/blazor-azure/.claude/skills/level-2-domains/integrations/clerk-auth.md

@@ -1,108 +0,0 @@
-# Clerk Auth
-
-> **Layer:** 2 | **Load:** on-keyword | **Keywords:** clerk, auth, login, signup, authentication, session, jwt, user
-
-Autenticação SaaS com Clerk para .NET/Blazor. SDK: `Clerk.Net.AspNetCore.Security`.
-
-## Setup
-
-```csharp
-// appsettings.json
-{ "Clerk": { "SecretKey": "${CLERK_SECRET_KEY}", "PublishableKey": "pk_test_xxx" } }
-
-// Program.cs
-builder.Services.AddClerk(builder.Configuration);
-builder.Services.AddAuthentication(ClerkAuthenticationDefaults.AuthenticationScheme)
-    .AddClerk(o => { o.Authority = "https://clerk.{instance}.com"; o.ValidAudiences = ["your-app-id"]; });
-builder.Services.AddAuthorization();
-app.UseAuthentication();
-app.UseAuthorization();
-```
-
-## Protected Endpoints
-
-```csharp
-// Minimal API
-app.MapGet("/api/profile", async (ClaimsPrincipal user, IClerkClient clerk) =>
-{
-    var userId = user.FindFirstValue(ClaimTypes.NameIdentifier);
-    if (userId is null) return Results.Unauthorized();
-    var u = await clerk.Users.GetUserAsync(userId);
-    return Results.Ok(new { u.Id, Email = u.EmailAddresses.FirstOrDefault()?.EmailAddress });
-}).RequireAuthorization();
-
-// Controller: same pattern with [Authorize] + User.FindFirstValue()
-// Role-based: [Authorize(Roles = "admin")]
-```
-
-## Blazor Server
-
-> **Ref:** Same `CascadingAuthenticationState` + `AuthorizeRouteView` pattern as `azure-identity.md`
-
-```razor
-@* RedirectToLogin.razor *@
-@inject NavigationManager Nav
-@code {
-    protected override void OnInitialized() =>
-        Nav.NavigateTo($"/sign-in?redirect_url={Uri.EscapeDataString(Nav.Uri)}", forceLoad: true);
-}
-
-@* Protected page *@
-@page "/dashboard"
-@attribute [Authorize]
-<AuthorizeView><Authorized>Welcome, @context.User.Identity?.Name!</Authorized></AuthorizeView>
-<AuthorizeView Roles="admin"><Authorized><AdminPanel /></Authorized></AuthorizeView>
-```
-
-## Client Operations
-
-```csharp
-var user = await _clerk.Users.GetUserAsync(userId);                    // Get
-var users = await _clerk.Users.GetUserListAsync(new() { Limit = 10 }); // List
-await _clerk.Users.UpdateUserMetadataAsync(userId, new()               // Update metadata
-    { PublicMetadata = new Dictionary<string, object> { ["plan"] = "pro" } });
-await _clerk.Users.DeleteUserAsync(userId);                            // Delete
-```
-
-## Webhooks
-
-```csharp
-[ApiController, Route("api/webhooks/clerk")]
-public class ClerkWebhookController(IUserService users) : ControllerBase
-{
-    [HttpPost]
-    public async Task<IActionResult> Handle([FromBody] ClerkWebhookPayload payload)
-    {
-        switch (payload.Type)
-        {
-            case "user.created": await users.SyncUserAsync(payload.Data); break;
-            case "user.updated": await users.UpdateUserAsync(payload.Data); break;
-            case "user.deleted": await users.DeleteUserAsync(payload.Data.Id); break;
-        }
-        return Ok();
-    }
-}
-```
-
-## Clerk vs Azure Identity
-
-| Aspecto | Clerk | Azure Identity |
-|---------|-------|----------------|
-| Setup | Faster | More complex |
-| Cost | Freemium (5k MAU free) | Free (Azure AD) |
-| Social login | 20+ providers | Limited |
-| UI components | Pre-built | Build your own |
-| Best for | SaaS B2C, MVPs | Enterprise/Azure |
-
-## Checklist
-
-- [ ] Secret Key in Key Vault (not hardcoded)
-- [ ] Authentication scheme configured
-- [ ] Authorization policies defined
-- [ ] Webhook endpoint + signature validation
-- [ ] Redirect after login configured
-- [ ] Error handling for expired sessions
-
----
-
-*MORPH-SPEC by Polymorphism Tech*

package/stacks/blazor-azure/.claude/skills/level-2-domains/integrations/resend-email.md

@@ -1,119 +0,0 @@
-# Resend Email
-
-> **Layer:** 2 | **Load:** on-keyword | **Keywords:** resend, email, envio, transactional, notification, send email, template
-
-Transactional email via Resend for .NET. REST API, no official SDK. Simple, developer-friendly.
-
-## Setup
-
-```csharp
-// appsettings.json
-{ "Resend": { "BaseUrl": "https://api.resend.com", "ApiKey": "${RESEND_API_KEY}", "FromEmail": "noreply@yourdomain.com" } }
-
-// Program.cs
-builder.Services.Configure<ResendOptions>(builder.Configuration.GetSection("Resend"));
-builder.Services.AddHttpClient<IResendClient, ResendClient>((sp, client) =>
-{
-    var options = sp.GetRequiredService<IOptions<ResendOptions>>().Value;
-    client.BaseAddress = new Uri(options.BaseUrl);
-    client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", options.ApiKey);
-});
-```
-
-## Client Interface
-
-```csharp
-public interface IResendClient
-{
-    Task<EmailResponse> SendAsync(SendEmailRequest request, CancellationToken ct = default);
-    Task<EmailResponse> SendBatchAsync(IEnumerable<SendEmailRequest> requests, CancellationToken ct = default);
-    Task<EmailDetails> GetEmailAsync(string emailId, CancellationToken ct = default);
-}
-```
-
-Implementation: `HttpClient.PostAsJsonAsync("/emails")` + `ReadFromJsonAsync<EmailResponse>`. Log errors, throw `ResendException` on failure.
-
-## DTOs
-
-```csharp
-public record SendEmailRequest
-{
-    [JsonPropertyName("from")] public required string From { get; init; }
-    [JsonPropertyName("to")] public required string[] To { get; init; }
-    [JsonPropertyName("subject")] public required string Subject { get; init; }
-    [JsonPropertyName("html")] public string? Html { get; init; }
-    [JsonPropertyName("text")] public string? Text { get; init; }
-    [JsonPropertyName("reply_to")] public string? ReplyTo { get; init; }
-    [JsonPropertyName("tags")] public Tag[]? Tags { get; init; }
-}
-
-public record EmailResponse
-{
-    [JsonPropertyName("id")] public string Id { get; init; } = "";
-}
-
-public record Tag
-{
-    [JsonPropertyName("name")] public required string Name { get; init; }
-    [JsonPropertyName("value")] public required string Value { get; init; }
-}
-```
-
-## Webhooks
-
-```csharp
-[ApiController, Route("api/webhooks/resend")]
-public class ResendWebhookController(IEmailTrackingService tracking, ILogger<ResendWebhookController> logger) : ControllerBase
-{
-    [HttpPost]
-    public async Task<IActionResult> Handle([FromBody] ResendWebhookPayload payload)
-    {
-        logger.LogInformation("Resend webhook: {Type} for {EmailId}", payload.Type, payload.Data?.EmailId);
-        switch (payload.Type)
-        {
-            case "email.delivered": await tracking.MarkDeliveredAsync(payload.Data!.EmailId); break;
-            case "email.bounced": await tracking.MarkBouncedAsync(payload.Data!.EmailId); break;
-            case "email.complained": await tracking.MarkComplainedAsync(payload.Data!.EmailId); break;
-        }
-        return Ok();
-    }
-}
-```
-
-## Abstraction Pattern
-
-```csharp
-// Use IEmailService abstraction over IResendClient for testability
-public interface IEmailService
-{
-    Task<string> SendTransactionalAsync(string to, string subject, string htmlBody, CancellationToken ct = default);
-}
-
-// ResendEmailService implements IEmailService using IResendClient
-// FakeEmailClient implements IEmailService for simulation mode
-```
-
-## Gotchas
-
-| Issue | Fix |
-|-------|-----|
-| Rate limit: 100 req/sec (free), 1000 (pro) | Queue emails via Hangfire for bulk sends |
-| Domain verification required for production | Verify in Resend dashboard, add DNS records |
-| `from` must match verified domain | Use `noreply@yourdomain.com` |
-| HTML email rendering varies | Test with Litmus/Email on Acid, use MJML |
-| Webhook signature validation | Verify `svix-signature` header in production |
-
-## Checklist
-
-- [ ] API Key in Key Vault (not hardcoded)
-- [ ] HttpClient with `Authorization: Bearer` header
-- [ ] Domain verified in Resend dashboard
-- [ ] `IEmailService` abstraction for testability
-- [ ] Webhook endpoint + signature validation
-- [ ] Rate limiting handled (queue for bulk)
-- [ ] Tags used for tracking/analytics
-- [ ] Simulation mode (`FakeEmailClient`) for dev
-
----
-
-*MORPH-SPEC by Polymorphism Tech*

package/stacks/blazor-azure/.claude/skills/level-2-domains/quality/code-analyzer.md

@@ -1,235 +0,0 @@
-# Code Analyzer
-
-> **Layer:** 2 | **Load:** on-keyword | **Keywords:** analyze, review, refactor, clean, smell, duplicate, architecture, quality, debt, unused, dead code, code review, code quality
-
-Deep code analysis specialist. Automates architecture review, clean code checks, and duplication detection.
-
-> **Ref:** `framework/standards/coding.md` for naming conventions.
-> **Ref:** `framework/standards/architecture.md` for architectural patterns.
-> **Ref:** `.claude/skills/checklists/code-review.md` for runtime pattern checks.
-
----
-
-## When to Run
-
-| Trigger | Automatic? | Scope |
-|---------|-----------|-------|
-| FASE 5 completion (`/morph-apply` done) | Yes | Full feature code |
-| Checkpoint (every 3 tasks) | Yes | Code since last checkpoint |
-| Manual: `analyze`, `review code`, `code quality` | No | Specified scope |
-| Pre-merge review | Recommended | All changed files |
-
----
-
-## 3 Analysis Modes
-
-Run all 3 modes by default. Use `--mode architecture`, `--mode clean`, or `--mode duplication` for targeted analysis.
-
----
-
-### Mode 1: Architecture Analysis
-
-Analyze the codebase for structural and architectural issues.
-
-#### Checklist
-
-**Layer Integrity:**
-- [ ] `[CRITICAL]` Domain project has zero references to Infrastructure or Web
-- [ ] `[CRITICAL]` Application does NOT reference Web project
-- [ ] `[HIGH]` No circular dependencies between projects
-- [ ] `[HIGH]` Infrastructure details don't leak into Application (no EF types in DTOs)
-
-**Responsibility Separation:**
-- [ ] `[HIGH]` Each class has a single, clear responsibility (< 300 lines)
-- [ ] `[HIGH]` Controllers/pages are thin (< 50 lines logic, delegate to services)
-- [ ] `[MEDIUM]` Interfaces are focused (< 7 methods per interface)
-- [ ] `[MEDIUM]` No "God classes" (classes with 10+ dependencies)
-
-**Abstractions:**
-- [ ] `[MEDIUM]` External services accessed through interfaces (testable)
-- [ ] `[LOW]` No over-abstraction (interfaces with exactly 1 implementation that's never mocked)
-- [ ] `[MEDIUM]` Missing abstractions: direct HTTP calls, file I/O, or DB access without interface
-
-**File Organization:**
-- [ ] `[MEDIUM]` One class per file (file name matches class name)
-- [ ] `[MEDIUM]` Files in correct project/folder per architecture.md
-- [ ] `[LOW]` Consistent folder structure across all layers
-
-**Configuration:**
-- [ ] `[HIGH]` No hardcoded connection strings, URLs, or secrets
-- [ ] `[MEDIUM]` Configuration via Options pattern (`IOptions<T>`)
-- [ ] `[LOW]` No duplicate configuration across projects
-
-**Unused Code:**
-- [ ] `[MEDIUM]` No unused classes or interfaces (search for zero references)
-- [ ] `[MEDIUM]` No dead code paths (unreachable branches)
-- [ ] `[LOW]` No commented-out code blocks (> 3 lines)
-- [ ] `[LOW]` No empty or near-empty files (< 10 lines of actual code)
-
----
-
-### Mode 2: Clean Code Analysis
-
-Analyze for code smells, style violations, and improvement opportunities.
-
-#### Checklist
-
-**Naming (ref: coding.md):**
-- [ ] `[HIGH]` All naming follows coding.md conventions (PascalCase constants, _camelCase fields, etc.)
-- [ ] `[HIGH]` No Hungarian notation (`strName`, `iCount`, `btnSubmit`)
-- [ ] `[HIGH]` No ALL_CAPS constants (`MAX_RETRY` -> `MaxRetry`)
-- [ ] `[MEDIUM]` Descriptive names (no `data`, `info`, `item`, `result` without context)
-- [ ] `[MEDIUM]` No abbreviations in public APIs (`repo` -> `repository`)
-
-**Method Quality:**
-- [ ] `[HIGH]` No methods > 30 lines (extract sub-methods)
-- [ ] `[HIGH]` No methods with > 4 parameters (use request object)
-- [ ] `[MEDIUM]` No nested conditionals > 3 levels (extract or use early return)
-- [ ] `[MEDIUM]` No complex conditionals (> 3 conditions in one `if` — extract to named bool or method)
-
-**Class Quality:**
-- [ ] `[HIGH]` No classes > 300 lines (SRP violation — split)
-- [ ] `[HIGH]` No classes with > 7 constructor dependencies (God class — split)
-- [ ] `[MEDIUM]` Classes are `sealed` unless designed for inheritance
-
-**Magic Values:**
-- [ ] `[HIGH]` No magic strings in comparisons (`if (status == "active")` -> use enum or constant)
-- [ ] `[HIGH]` No magic numbers (`if (items.Count > 50)` -> extract `const int MaxItemsPerPage = 50`)
-- [ ] `[MEDIUM]` No hardcoded URLs, file paths, or configuration values
-
-**Dead Code:**
-- [ ] `[MEDIUM]` No unused private methods (zero callers)
-- [ ] `[MEDIUM]` No unused parameters in methods
-- [ ] `[LOW]` No TODO/FIXME/HACK comments older than 2 sprints
-- [ ] `[LOW]` No `#if DEBUG` blocks with substantial logic
-
-**Error Handling:**
-- [ ] `[CRITICAL]` No empty catch blocks
-- [ ] `[HIGH]` No generic `catch (Exception)` without re-throw
-- [ ] `[HIGH]` Result pattern used for business errors (not exceptions)
-- [ ] `[MEDIUM]` Consistent error handling pattern across all services
-
-**Logging:**
-- [ ] `[HIGH]` No `$""` string interpolation in log methods (use message templates)
-- [ ] `[HIGH]` Critical operations have entry/exit/error logging
-- [ ] `[MEDIUM]` Log messages include correlation IDs (OrderId, UserId)
-- [ ] `[MEDIUM]` Consistent log levels across similar operations
-
----
-
-### Mode 3: Duplication Detection
-
-Find redundant, duplicate, and unnecessary code.
-
-#### Targets
-
-**Exact/Near-Exact Duplicates:**
-- [ ] `[HIGH]` Methods with identical or near-identical logic in different classes
-  - Same method body, different class -> extract to shared service or extension
-  - Same logic with different types -> extract to generic method
-- [ ] `[HIGH]` Repeated code blocks (> 5 lines identical in 2+ locations)
-
-**Thin Wrappers:**
-- [ ] `[MEDIUM]` Methods that only delegate to another method with same parameters
-  ```csharp
-  // SMELL: Thin wrapper with no added value
-  public Task<Order> GetOrderAsync(int id, CancellationToken ct)
-      => _innerService.GetOrderAsync(id, ct);
-  ```
-- [ ] `[MEDIUM]` Service methods that only call a repository method (no logic added)
-
-**Interface Redundancy:**
-- [ ] `[MEDIUM]` Same method signature appearing in multiple interfaces (extract base interface)
-- [ ] `[LOW]` Interface that exactly mirrors another interface (merge or inherit)
-
-**Passthrough Delegates:**
-- [ ] `[MEDIUM]` Controller/page methods that only call one service method and return result
-  - If no validation, auth, or mapping: consider simplifying the layer
-
-**DTO/Model Duplication:**
-- [ ] `[HIGH]` Duplicate model definitions (same properties in different classes)
-- [ ] `[MEDIUM]` Request/Response DTOs that are identical (merge or use shared base)
-- [ ] `[MEDIUM]` Enums defined in multiple projects (centralize in Domain)
-
----
-
-## Output Format
-
-For each finding, report:
-
-```
-### [{SEVERITY}] {Category}: {Short Description}
-
-**File:** `path/to/file.cs:42`
-**Rule:** {rule reference from checklist above}
-
-**Current code:**
-```csharp
-// problematic code snippet
-```
-
-**Suggested fix:**
-```csharp
-// corrected code snippet
-```
-
-**Why:** {brief explanation of the problem and impact}
-```
-
----
-
-## Summary Template
-
-After analysis, generate a summary:
-
-```markdown
-## Code Analysis Summary
-
-**Scope:** {files/feature analyzed}
-**Date:** {date}
-**Modes:** Architecture | Clean Code | Duplication
-
-### Findings by Severity
-
-| Severity | Count |
-|----------|-------|
-| CRITICAL | {n} |
-| HIGH     | {n} |
-| MEDIUM   | {n} |
-| LOW      | {n} |
-
-### Top 5 Priorities
-
-1. {Most critical finding with file:line}
-2. {Second most critical}
-3. ...
-
-### Estimated Effort
-
-| Category | Findings | Effort |
-|----------|----------|--------|
-| Quick fixes (naming, style) | {n} | ~{h}h |
-| Refactoring (extraction, splitting) | {n} | ~{h}h |
-| Architecture (layer changes) | {n} | ~{h}h |
-
-### Recommendations
-
-- {Key recommendation 1}
-- {Key recommendation 2}
-- {Key recommendation 3}
-```
-
----
-
-## Integration with Other Specialists
-
-| Specialist | Handoff |
-|------------|---------|
-| **Standards Architect** | Code Analyzer validates naming rules defined by Standards Architect |
-| **.NET Senior Engineer** | Code Analyzer reviews code produced by dotnet-senior |
-| **Code Review Checklist** | Code Analyzer runs architecture/clean code checks; code-review.md covers runtime patterns |
-| **Testing Specialist** | Findings may generate new test requirements |
-
----
-
-*MORPH-SPEC by Polymorphism Tech*

package/stacks/blazor-azure/.claude/skills/level-2-domains/quality/testing-specialist.md

@@ -1,126 +0,0 @@
-# Testing Specialist
-
-> **Layer:** 2 | **Load:** on-keyword | **Keywords:** test, testing, mock, fake, simulation, unit test, integration test
-
-Especialista em testes, mocking e simulação para projetos .NET.
-
-## Strategy
-
-| Level | What | Tools |
-|-------|------|-------|
-| **Unit** | Business logic, domain, handlers | xUnit + Moq + FluentAssertions |
-| **Integration** | API flows, DB operations | WebApplicationFactory + TestContainers |
-| **Component** | Blazor rendering, events | bUnit |
-| **E2E** | Critical user journeys | Playwright (if needed) |
-
-**Focus:** Critical/complex code. Don't aim for 100%, aim for value. Cover edge cases and error paths.
-
----
-
-## Core Patterns
-
-### AAA (Arrange-Act-Assert)
-
-```csharp
-[Fact]
-public async Task CreateOrder_Should_ReturnSuccess_When_ValidInput()
-{
-    // Arrange
-    var command = new CreateOrderCommand { CustomerId = 1, Items = [...] };
-    var handler = new CreateOrderHandler(_mockRepo.Object);
-    // Act
-    var result = await handler.Handle(command, CancellationToken.None);
-    // Assert
-    result.IsSuccess.Should().BeTrue();
-}
-```
-
-### Naming Convention
-```
-[Method]_Should_[ExpectedResult]_When_[Condition]
-```
-
-### Test Data Builders
-Use builder pattern for complex test entities: `new OrderBuilder().WithCustomer(123).WithStatus(Completed).Build()`
-
-### Mocking (Moq)
-```csharp
-var mockRepo = new Mock<IOrderRepository>();
-mockRepo.Setup(r => r.GetByIdAsync(It.IsAny<int>())).ReturnsAsync(new Order { Id = 1 });
-mockRepo.Verify(r => r.SaveAsync(It.IsAny<Order>()), Times.Once);
-```
-
-### Integration Tests (WebApplicationFactory)
-Replace real DB with in-memory in `ConfigureServices`, use `CreateClient()` for HTTP calls.
-
-### bUnit (Blazor)
-`RenderComponent<Counter>()` → `Find("button").Click()` → assert `TextContent`.
-
----
-
-## Libraries
-
-| Library | Purpose | NuGet |
-|---------|---------|-------|
-| xUnit | Test framework | `xunit` |
-| Moq | Mocking | `Moq` |
-| FluentAssertions | Readable assertions | `FluentAssertions` |
-| Bogus | Fake data | `Bogus` |
-| TestContainers | DB containers | `Testcontainers` |
-| Respawn | DB reset | `Respawn` |
-| WireMock | HTTP mocking | `WireMock.Net` |
-| bUnit | Blazor testing | `bunit` |
-
-## Folder Structure
-
-```
-tests/
-├── Unit/{Domain,Application,Builders}/
-├── Integration/{Api,Fixtures}/
-└── E2E/
-```
-
-## Anti-Patterns
-1. **Fragile tests** — test behavior, not implementation
-2. **Slow tests** — use mocks, not real DB for unit tests
-3. **Coupled tests** — each test independent
-4. **Vague assertions** — use specific FluentAssertions
-5. **Giant setup** — extract to builders/fixtures
-
----
-
-## Simulation of External Services
-
-> **Ref:** `.claude/skills/checklists/simulation-checklist.md` for complete checklist
-
-### Key Rules
-
-| Mock Type | Characteristic | DI Lifetime |
-|-----------|---------------|-------------|
-| **Stateful** (Dictionary, List) | Keeps data between calls | `Singleton` |
-| **Stateless** | No state | `Scoped` |
-
-```csharp
-// ❌ Stateful with Scoped = loses state between requests
-services.AddScoped<IReplicateClient, FakeReplicateClient>();
-// ✅ Stateful with Singleton
-services.AddSingleton<IReplicateClient, FakeReplicateClient>();
-```
-
-**Before implementing mocks:** Map ALL dependencies (interfaces, transitive deps, lifetimes).
-
----
-
-## Checklists
-
-### Per Test Type
-| Target | Test |
-|--------|------|
-| Entity/Domain | Creation validation, state transitions (valid + invalid), invariants |
-| Handler/Service | Happy path, invalid input, not found (404), auth error, timeout |
-| API | Status codes, response body, request validation, auth |
-| Blazor Component | Initial render, user events, states (loading/error/empty), form validation |
-
----
-
-*MORPH-SPEC by Polymorphism Tech*

package/stacks/blazor-azure/.claude/skills/level-3-technologies/README.md

@@ -1,7 +0,0 @@
-# Level 3: Technologies
-
-Technology-specific implementation patterns.
-
-**Purpose:** Skills for specific technologies (EF Core, Blazor, Hangfire, SignalR, etc.).
-
-**To be populated in Phase 8/9.**

package/stacks/blazor-azure/.claude/skills/level-4-patterns/README.md

@@ -1,7 +0,0 @@
-# Level 4: Patterns
-
-Architectural and design patterns.
-
-**Purpose:** Skills for specific patterns (CQRS, Event Sourcing, DDD, Repository, etc.).
-
-**To be populated later.**

package/stacks/blazor-azure/.morph/archive/.gitkeep

@@ -1,25 +0,0 @@
-# Features Arquivadas
-
-Esta pasta contém o histórico de features CONCLUÍDAS.
-
-## Estrutura
-
-```
-archive/
-└── {feature-name}/
-    ├── proposal.md    # Proposta original
-    ├── spec.md        # Especificação final
-    ├── tasks.md       # Tasks completadas
-    ├── contracts.cs   # Contracts finais
-    ├── decisions.md   # ADRs
-    └── recap.md       # Resumo e métricas
-```
-
-## Por que arquivar?
-
-1. Manter histórico de decisões
-2. Referência para features similares
-3. Métricas de produtividade
-4. Lições aprendidas
-
-*Gerado pelo MORPH Framework*