@polymorphism-tech/morph-spec 4.10.9 → 4.11.0

package/framework/skills/level-0-meta/morph-code-review-nextjs/references/review-example-nextjs.md

@@ -1,254 +1,254 @@
-# Code Review Report — User Management Feature
-
-> Example of a well-structured Next.js code review output. Filled-in reference — not a template.
-
-**Scope:** `src/features/users/` + `src/app/(dashboard)/users/page.tsx`
-**Date:** 2026-02-23
-**Reviewer:** code-review-nextjs skill
-
----
-
-## Automated Scan Results
-
-```bash
-$ node scripts/scan-nextjs.mjs src/features/users/
-
-CRITICAL (1)
-  features/users/components/UserList.tsx:1  — React hooks used (useState) without 'use client'
-
-HIGH/MEDIUM (2)
-  features/users/components/UserList.tsx  — PascalCase filename (should be user-list.tsx)
-  features/users/components/user-form.tsx — 'use client' directive present but no interactivity detected
-
-Summary: 8 files scanned | 3 issues (1 critical, 2 high/medium)
-```
-
----
-
-## Findings by Severity
-
-| Severity | Count |
-|----------|-------|
-| CRITICAL | 2 |
-| HIGH | 3 |
-| MEDIUM | 2 |
-| LOW | 1 |
-
----
-
-### [CRITICAL] Missing 'use client' on interactive component
-
-**File:** `src/features/users/components/UserList.tsx:1`
-
-**Current code:**
-```tsx
-import { useState } from 'react';
-
-export function UserList() {
-  const [selected, setSelected] = useState<string | null>(null);
-  return <div onClick={() => setSelected('test')}>...</div>;
-}
-```
-
-**Suggested fix:**
-```tsx
-'use client';
-
-import { useState } from 'react';
-// ... rest unchanged
-```
-
-**Why:** React hooks (`useState`) require `'use client'`. Without it, Next.js treats this as a Server Component and the `useState` call fails at runtime.
-
----
-
-### [CRITICAL] useEffect for data fetching
-
-**File:** `src/features/users/components/user-list.tsx:8`
-
-**Current code:**
-```tsx
-'use client';
-import { useEffect, useState } from 'react';
-
-export function UserList() {
-  const [users, setUsers] = useState([]);
-  useEffect(() => {
-    fetch('/api/users').then(r => r.json()).then(setUsers);
-  }, []);
-  return <ul>{users.map(u => <li key={u.id}>{u.name}</li>)}</ul>;
-}
-```
-
-**Suggested fix:**
-```tsx
-// Option A — Server Component (no 'use client' needed)
-// app/(dashboard)/users/page.tsx
-async function getUsers() {
-  const res = await fetch(`${process.env.API_URL}/api/users`, { next: { revalidate: 30 } });
-  return res.json();
-}
-export default async function UsersPage() {
-  const users = await getUsers();
-  return <UserList initialData={users} />;
-}
-
-// Option B — TanStack Query (when client interactivity needed)
-'use client';
-import { useUsers } from '@/features/users/hooks/use-users';
-export function UserList() {
-  const { data: users = [], isLoading } = useUsers();
-  if (isLoading) return <div>Loading...</div>;
-  return <ul>{users.map(u => <li key={u.id}>{u.name}</li>)}</ul>;
-}
-```
-
-**Why:** `useEffect` + `useState` for fetching: (1) doubles renders, (2) no caching, (3) no SSR, (4) no error/loading states, (5) can't be cancelled. TanStack Query or Server Components solve all five.
-
----
-
-### [HIGH] PascalCase file name
-
-**File:** `src/features/users/components/UserList.tsx`
-
-**Suggested fix:** Rename to `user-list.tsx`
-
-**Why:** Linux servers are case-sensitive. `UserList.tsx` and `user-list.tsx` are different files on the server but the same on macOS/Windows, causing import failures in production.
-
----
-
-### [HIGH] Default export on non-page component
-
-**File:** `src/features/users/components/user-card.tsx:3`
-
-**Current code:**
-```tsx
-export default function UserCard({ user }: { user: User }) {
-```
-
-**Suggested fix:**
-```tsx
-export function UserCard({ user }: { user: User }) {
-```
-
-**Why:** Named exports are refactor-safe — IDEs track renames automatically. Default exports are anonymous in imports (`import X from './user-card'` allows `X` to be anything).
-
----
-
-### [HIGH] Type defined manually instead of deriving from Zod schema
-
-**File:** `src/features/users/types/user.types.ts:1`
-
-**Current code:**
-```ts
-export type User = {
-  id: string;
-  name: string;
-  email: string;
-  role: 'admin' | 'user';
-};
-```
-
-**Suggested fix:**
-```ts
-// user.schemas.ts — single source of truth
-export const userSchema = z.object({
-  id: z.string(),
-  name: z.string(),
-  email: z.string().email(),
-  role: z.enum(['admin', 'user']),
-});
-
-// user.types.ts — derived, never written manually
-export type User = z.infer<typeof userSchema>;
-```
-
-**Why:** Manually written types drift from API responses. `z.infer<>` ensures the TypeScript type is always in sync with the runtime validation.
-
----
-
-### [MEDIUM] Deep path import instead of feature index
-
-**File:** `src/app/(dashboard)/users/page.tsx:2`
-
-**Current code:**
-```tsx
-import { UserList } from '@/features/users/components/user-list';
-```
-
-**Suggested fix:**
-```tsx
-import { UserList } from '@/features/users';
-```
-
-**Why:** Deep path imports expose internal structure. When `user-list.tsx` moves or is renamed, every consumer breaks. The feature index is the stable public API.
-
----
-
-### [MEDIUM] Query key not using factory pattern
-
-**File:** `src/features/users/hooks/use-users.ts:8`
-
-**Current code:**
-```ts
-return useQuery({
-  queryKey: ['users'],
-```
-
-**Suggested fix:**
-```ts
-// query-keys.ts
-export const userKeys = {
-  all: ['users'] as const,
-  lists: () => [...userKeys.all, 'list'] as const,
-};
-
-// use-users.ts
-return useQuery({
-  queryKey: userKeys.lists(),
-```
-
-**Why:** Hardcoded `['users']` cannot be selectively invalidated. `queryClient.invalidateQueries({ queryKey: userKeys.lists() })` correctly invalidates only list queries, not detail queries with the same prefix.
-
----
-
-### [LOW] Test uses fireEvent instead of userEvent
-
-**File:** `src/features/users/components/user-card.test.tsx:14`
-
-**Current code:**
-```tsx
-fireEvent.click(screen.getByRole('button', { name: /edit/i }));
-```
-
-**Suggested fix:**
-```tsx
-await userEvent.click(screen.getByRole('button', { name: /edit/i }));
-```
-
-**Why:** `fireEvent.click` dispatches a synthetic event. `userEvent.click` simulates the full browser interaction sequence (pointerdown, mousedown, focus, click, etc.) — closer to real user behaviour.
-
----
-
-## Top Priorities
-
-1. `UserList.tsx:1` — CRITICAL missing `'use client'` (2 min fix)
-2. `user-list.tsx:8` — CRITICAL useEffect fetch → useQuery (15 min)
-3. `UserList.tsx` — HIGH rename to `user-list.tsx` (2 min)
-4. `user-card.tsx:3` — HIGH named export (2 min)
-5. `user.types.ts:1` — HIGH derive from Zod (10 min)
-
----
-
-## Passed Checks ✅
-
-- `components/ui/` files untouched
-- `zodResolver` correctly wired in `user-form.tsx`
-- `isPending` used (v5 correct — not `isLoading`)
-- `loading.tsx` and `error.tsx` present in `app/(dashboard)/users/`
-- Feature has `index.ts` re-exporting public API
-- Test file co-located with component
-
----
-
-*MORPH-SPEC by Polymorphism Tech*
+# Code Review Report — User Management Feature
+
+> Example of a well-structured Next.js code review output. Filled-in reference — not a template.
+
+**Scope:** `src/features/users/` + `src/app/(dashboard)/users/page.tsx`
+**Date:** 2026-02-23
+**Reviewer:** code-review-nextjs skill
+
+---
+
+## Automated Scan Results
+
+```bash
+$ node scripts/scan-nextjs.mjs src/features/users/
+
+CRITICAL (1)
+  features/users/components/UserList.tsx:1  — React hooks used (useState) without 'use client'
+
+HIGH/MEDIUM (2)
+  features/users/components/UserList.tsx  — PascalCase filename (should be user-list.tsx)
+  features/users/components/user-form.tsx — 'use client' directive present but no interactivity detected
+
+Summary: 8 files scanned | 3 issues (1 critical, 2 high/medium)
+```
+
+---
+
+## Findings by Severity
+
+| Severity | Count |
+|----------|-------|
+| CRITICAL | 2 |
+| HIGH | 3 |
+| MEDIUM | 2 |
+| LOW | 1 |
+
+---
+
+### [CRITICAL] Missing 'use client' on interactive component
+
+**File:** `src/features/users/components/UserList.tsx:1`
+
+**Current code:**
+```tsx
+import { useState } from 'react';
+
+export function UserList() {
+  const [selected, setSelected] = useState<string | null>(null);
+  return <div onClick={() => setSelected('test')}>...</div>;
+}
+```
+
+**Suggested fix:**
+```tsx
+'use client';
+
+import { useState } from 'react';
+// ... rest unchanged
+```
+
+**Why:** React hooks (`useState`) require `'use client'`. Without it, Next.js treats this as a Server Component and the `useState` call fails at runtime.
+
+---
+
+### [CRITICAL] useEffect for data fetching
+
+**File:** `src/features/users/components/user-list.tsx:8`
+
+**Current code:**
+```tsx
+'use client';
+import { useEffect, useState } from 'react';
+
+export function UserList() {
+  const [users, setUsers] = useState([]);
+  useEffect(() => {
+    fetch('/api/users').then(r => r.json()).then(setUsers);
+  }, []);
+  return <ul>{users.map(u => <li key={u.id}>{u.name}</li>)}</ul>;
+}
+```
+
+**Suggested fix:**
+```tsx
+// Option A — Server Component (no 'use client' needed)
+// app/(dashboard)/users/page.tsx
+async function getUsers() {
+  const res = await fetch(`${process.env.API_URL}/api/users`, { next: { revalidate: 30 } });
+  return res.json();
+}
+export default async function UsersPage() {
+  const users = await getUsers();
+  return <UserList initialData={users} />;
+}
+
+// Option B — TanStack Query (when client interactivity needed)
+'use client';
+import { useUsers } from '@/features/users/hooks/use-users';
+export function UserList() {
+  const { data: users = [], isLoading } = useUsers();
+  if (isLoading) return <div>Loading...</div>;
+  return <ul>{users.map(u => <li key={u.id}>{u.name}</li>)}</ul>;
+}
+```
+
+**Why:** `useEffect` + `useState` for fetching: (1) doubles renders, (2) no caching, (3) no SSR, (4) no error/loading states, (5) can't be cancelled. TanStack Query or Server Components solve all five.
+
+---
+
+### [HIGH] PascalCase file name
+
+**File:** `src/features/users/components/UserList.tsx`
+
+**Suggested fix:** Rename to `user-list.tsx`
+
+**Why:** Linux servers are case-sensitive. `UserList.tsx` and `user-list.tsx` are different files on the server but the same on macOS/Windows, causing import failures in production.
+
+---
+
+### [HIGH] Default export on non-page component
+
+**File:** `src/features/users/components/user-card.tsx:3`
+
+**Current code:**
+```tsx
+export default function UserCard({ user }: { user: User }) {
+```
+
+**Suggested fix:**
+```tsx
+export function UserCard({ user }: { user: User }) {
+```
+
+**Why:** Named exports are refactor-safe — IDEs track renames automatically. Default exports are anonymous in imports (`import X from './user-card'` allows `X` to be anything).
+
+---
+
+### [HIGH] Type defined manually instead of deriving from Zod schema
+
+**File:** `src/features/users/types/user.types.ts:1`
+
+**Current code:**
+```ts
+export type User = {
+  id: string;
+  name: string;
+  email: string;
+  role: 'admin' | 'user';
+};
+```
+
+**Suggested fix:**
+```ts
+// user.schemas.ts — single source of truth
+export const userSchema = z.object({
+  id: z.string(),
+  name: z.string(),
+  email: z.string().email(),
+  role: z.enum(['admin', 'user']),
+});
+
+// user.types.ts — derived, never written manually
+export type User = z.infer<typeof userSchema>;
+```
+
+**Why:** Manually written types drift from API responses. `z.infer<>` ensures the TypeScript type is always in sync with the runtime validation.
+
+---
+
+### [MEDIUM] Deep path import instead of feature index
+
+**File:** `src/app/(dashboard)/users/page.tsx:2`
+
+**Current code:**
+```tsx
+import { UserList } from '@/features/users/components/user-list';
+```
+
+**Suggested fix:**
+```tsx
+import { UserList } from '@/features/users';
+```
+
+**Why:** Deep path imports expose internal structure. When `user-list.tsx` moves or is renamed, every consumer breaks. The feature index is the stable public API.
+
+---
+
+### [MEDIUM] Query key not using factory pattern
+
+**File:** `src/features/users/hooks/use-users.ts:8`
+
+**Current code:**
+```ts
+return useQuery({
+  queryKey: ['users'],
+```
+
+**Suggested fix:**
+```ts
+// query-keys.ts
+export const userKeys = {
+  all: ['users'] as const,
+  lists: () => [...userKeys.all, 'list'] as const,
+};
+
+// use-users.ts
+return useQuery({
+  queryKey: userKeys.lists(),
+```
+
+**Why:** Hardcoded `['users']` cannot be selectively invalidated. `queryClient.invalidateQueries({ queryKey: userKeys.lists() })` correctly invalidates only list queries, not detail queries with the same prefix.
+
+---
+
+### [LOW] Test uses fireEvent instead of userEvent
+
+**File:** `src/features/users/components/user-card.test.tsx:14`
+
+**Current code:**
+```tsx
+fireEvent.click(screen.getByRole('button', { name: /edit/i }));
+```
+
+**Suggested fix:**
+```tsx
+await userEvent.click(screen.getByRole('button', { name: /edit/i }));
+```
+
+**Why:** `fireEvent.click` dispatches a synthetic event. `userEvent.click` simulates the full browser interaction sequence (pointerdown, mousedown, focus, click, etc.) — closer to real user behaviour.
+
+---
+
+## Top Priorities
+
+1. `UserList.tsx:1` — CRITICAL missing `'use client'` (2 min fix)
+2. `user-list.tsx:8` — CRITICAL useEffect fetch → useQuery (15 min)
+3. `UserList.tsx` — HIGH rename to `user-list.tsx` (2 min)
+4. `user-card.tsx:3` — HIGH named export (2 min)
+5. `user.types.ts:1` — HIGH derive from Zod (10 min)
+
+---
+
+## Passed Checks ✅
+
+- `components/ui/` files untouched
+- `zodResolver` correctly wired in `user-form.tsx`
+- `isPending` used (v5 correct — not `isLoading`)
+- `loading.tsx` and `error.tsx` present in `app/(dashboard)/users/`
+- Feature has `index.ts` re-exporting public API
+- Test file co-located with component
+
+---
+
+*MORPH-SPEC by Polymorphism Tech*

package/framework/skills/level-0-meta/morph-frontend-review/SKILL.md

@@ -57,7 +57,7 @@ Store `stack`, `frontendPath`, `startCommand` and the detected context — all s
 ## Step 1 — Design Outputs Validation (if context includes design validation)
 
 ```bash
-npx morph-spec validate-feature $ARGUMENTS
+morph-spec validate-feature $ARGUMENTS
 ```
 
 Verify existence and quality of the 4 mandatory outputs in `.morph/features/$ARGUMENTS/2-ui/`:

package/framework/skills/level-0-meta/morph-init/SKILL.md

@@ -25,10 +25,10 @@ Before running any `morph-spec` command, detect how to invoke the CLI:
 
 ```bash
 # Try local first (project dependency), then global
-npx morph-spec --version
+morph-spec --version
 ```
 
-- If `npx morph-spec --version` succeeds → use `npx morph-spec` as the CLI prefix for all commands.
+- If `morph-spec --version` succeeds → use `morph-spec` as the CLI prefix for all commands.
 - If it fails → try `morph-spec --version` (global install). If that works → use `morph-spec`.
 - If both fail → **STOP** and show:
   ```
@@ -36,7 +36,7 @@ npx morph-spec --version
     npm install @polymorphism-tech/morph-spec
   ```
 
-Use the resolved CLI prefix (e.g. `npx morph-spec`) for ALL bash commands in the following steps.
+Use the resolved CLI prefix (e.g. `morph-spec`) for ALL bash commands in the following steps.
 
 ---
 
@@ -78,19 +78,19 @@ Check if `.morph/` exists in the current directory.
 
 **If MISSING:**
 ```bash
-npx morph-spec setup-infra
+morph-spec setup-infra
 ```
 Output confirms: `✓ MORPH-SPEC infrastructure installed.`
 
 **If EXISTS and argument is `refresh`:**
 Re-run setup-infra to update framework files, then continue with context/config refresh:
 ```bash
-npx morph-spec setup-infra
+morph-spec setup-infra
 ```
 
 **If EXISTS and no argument:**
 Ask: *"MORPH already initialized. Refresh context and config? (y/n)"*
-If `y` → re-run `npx morph-spec setup-infra` then continue.
+If `y` → re-run `morph-spec setup-infra` then continue.
 If `n` → STOP.
 
 ---
@@ -359,7 +359,7 @@ And inform the user:
 To create a new VSA project:
    dotnet new install https://github.com/polymorphism-tech/Morph_Template_VerticalSliceArchitecture
    dotnet new vsa -n MyProject
-   cd MyProject && npx morph-spec init
+   cd MyProject && morph-spec init
 ```
 
 ---
@@ -374,7 +374,7 @@ For each detected integration with an available MCP:
   ```json
   "supabase": { "type": "http", "url": "https://mcp.supabase.com/mcp" }
   ```
-- NO → show snippet + `npx morph-spec mcp setup supabase`
+- NO → show snippet + `morph-spec mcp setup supabase`
 
 **GitHub:**
 > *"Configure GitHub MCP? Requires Docker + a `GITHUB_PERSONAL_ACCESS_TOKEN`."*
@@ -386,7 +386,7 @@ For each detected integration with an available MCP:
     "env": { "GITHUB_PERSONAL_ACCESS_TOKEN": "<token>" }
   }
   ```
-- NO → show snippet + `npx morph-spec mcp setup github`
+- NO → show snippet + `morph-spec mcp setup github`
 
 **Vercel detected** (vercel.json exists OR stack is nextjs):
 > *"Configure Vercel MCP? Uses OAuth — no credentials needed."*
@@ -394,7 +394,7 @@ For each detected integration with an available MCP:
   ```json
   "vercel": { "type": "http", "url": "https://mcp.vercel.com" }
   ```
-- NO → show snippet + `npx morph-spec mcp setup vercel`
+- NO → show snippet + `morph-spec mcp setup vercel`
 
 Only offer Docker, Azure if explicitly detected in `.env.example`.
 
@@ -462,7 +462,7 @@ Use `AskUserQuestion` with header `"{MCP} failed"` and these options:
 After all configuration is complete, run the health check to verify everything is properly installed:
 
 ```bash
-npx morph-spec doctor
+morph-spec doctor
 ```
 
 This validates: config.json integrity, agents.json presence, hooks installation, skills distribution, required command files, and state.json schema version. Fix any reported issues before proceeding.

package/framework/skills/level-0-meta/morph-post-implementation/SKILL.md

@@ -95,7 +95,7 @@ Do not proceed while tests are failing. Fix failures and re-run before continuin
 ## Step 4 — Framework Validation
 
 ```bash
-npx morph-spec validate-feature $ARGUMENTS
+morph-spec validate-feature $ARGUMENTS
 ```
 
 **🚫 BLOCK if it fails.**
@@ -251,10 +251,10 @@ Wait for both. **🚫 BLOCK if either returns unresolved CRITICAL.**
 
 ```bash
 # Save post-review checkpoint
-npx morph-spec checkpoint-save $ARGUMENTS --note "post-implementation review"
+morph-spec checkpoint-save $ARGUMENTS --note "post-implementation review"
 
 # Generate final recap
-npx morph-spec generate recap $ARGUMENTS
+morph-spec generate recap $ARGUMENTS
 ```
 
 ---

package/framework/skills/level-0-meta/morph-replicate/SKILL.md

@@ -152,7 +152,7 @@ All outputs go in `.morph/features/{feature-name}/5-implement/`:
 
 After completion, mark the output:
 ```bash
-npx morph-spec state mark-output {feature-name} recap
+morph-spec state mark-output {feature-name} recap
 ```
 
 **Does NOT generate:** proposal.md, spec.md, contracts.cs, tasks.md

package/framework/skills/level-0-meta/morph-simulation-checklist/SKILL.md

@@ -60,13 +60,13 @@ When implementing simulation as a morph-spec task:
 
 ```bash
 # Track the simulation setup task
-npx morph-spec task start {feature} {task-id}
+morph-spec task start {feature} {task-id}
 
 # After implementation, validate the feature
-npx morph-spec validate-feature {feature}
+morph-spec validate-feature {feature}
 
 # Complete the task (triggers Tier-4 validators)
-npx morph-spec task done {feature} {task-id}
+morph-spec task done {feature} {task-id}
 ```
 
 Reference the project's service lifetime patterns:
@@ -80,7 +80,7 @@ grep -r "AddSingleton\|AddScoped\|AddTransient" src/ --include="*.cs" -l
 - [ ] Validate DI: `dotnet build && dotnet run` + health check
 - [ ] Test full flow end-to-end (not just unit tests)
 - [ ] Verify simulation logs — confirm mocks are being called
-- [ ] Run `npx morph-spec validate-feature {feature}` to check architecture compliance
+- [ ] Run `morph-spec validate-feature {feature}` to check architecture compliance
 
 ## Common Errors