@polymorphism-tech/morph-spec 4.16.0 → 4.18.0

package/src/lib/installers/mcp-installer.js

@@ -26,7 +26,7 @@ export function loadMcpRegistry() {
 /**
  * Filter MCPs by stack relevance
  * @param {Object} registry - Full MCP registry
- * @param {string} stack - Detected project stack (e.g., 'nextjs-supabase', 'blazor')
+ * @param {string} stack - Detected project stack (e.g., 'nextjs-neon', 'blazor')
  * @returns {Object} Filtered map of mcpName → mcpEntry
  */
 export function filterByStack(registry, stack) {

package/src/lib/tasks/task-classifier.js

@@ -1,5 +1,5 @@
 /**
- * Task classifier — identifies test/validation tasks by title.
+ * Task classifier — identifies test/validation and infrastructure tasks by title.
  */
 
 const TEST_TASK_PATTERN = /\b(tests?|testing|specs?|coverage|e2e|unit|integration|integra[cç][aã]o|valida[cç][aã]o|cobertura|testes?)\b/i;
@@ -14,3 +14,17 @@ export function isTestTask(taskTitle) {
   if (!taskTitle) return false;
   return TEST_TASK_PATTERN.test(taskTitle);
 }
+
+const INFRA_TASK_PATTERN = /\b(infrastructure|infra|cleanup|migration|migra[cç][aã]o|config|setup|ci\/cd|devops|deploy|docker|packages?|dependencies|tags)\b/i;
+
+/**
+ * Returns true if the task title indicates an infrastructure/cleanup/migration task.
+ * Used to skip contract validation and suppress breaking change warnings.
+ *
+ * @param {string} taskTitle
+ * @returns {boolean}
+ */
+export function isInfrastructureTask(taskTitle) {
+  if (!taskTitle) return false;
+  return INFRA_TASK_PATTERN.test(taskTitle);
+}

package/src/lib/tasks/test-runner.js

@@ -68,9 +68,13 @@ export function runTestSuite(projectPath = '.', opts = {}) {
     });
     return { passed: true, output: output ?? '', exitCode: 0 };
   } catch (err) {
+    const output = (err.stdout || '') + (err.stderr || '');
+    const BUILD_FAIL = /Build FAILED|error MSB\d+|error CS\d+|Could not find.*\.csproj/i;
+    const buildFailed = BUILD_FAIL.test(output);
     return {
       passed: false,
-      output: (err.stdout || '') + (err.stderr || ''),
+      buildFailed,
+      output,
       exitCode: err.status ?? 1
     };
   }

package/src/lib/validators/content/content-validator.js

@@ -23,18 +23,17 @@ export function validateSpecContent(specPath) {
 
   const content = readFileSync(specPath, 'utf8');
 
-  // Required sections for a complete spec (prefix-match to handle variants like
-  // "## Functional Requirements" and "## Technical Architecture")
+  // Required sections (flexible regex handles numbered variants like '## 1. Overview')
   const requiredSections = [
-    '## Overview',
-    '## Functional Requirements',
-    '## Technical',
-    '## Data Model',
+    { label: '## Overview',                pattern: /^##\s+(?:\d+\.?\s+)?Overview/i },
+    { label: '## Functional Requirements', pattern: /^##\s+(?:\d+\.?\s+)?Functional Requirements/i },
+    { label: '## Technical',              pattern: /^##\s+(?:\d+\.?\s+)?Technical/i },
+    { label: '## Data Model',             pattern: /^##\s+(?:\d+\.?\s+)?Data Model/i },
   ];
 
   const lines = content.split('\n');
-  const missing = requiredSections.filter(section =>
-    !lines.some(line => line.startsWith(section))
+  const missing = requiredSections.filter(s =>
+    !lines.some(line => s.pattern.test(line))
   );
 
   // Additional quality checks
@@ -44,8 +43,8 @@ export function validateSpecContent(specPath) {
   // Missing sections are warnings, not errors — not every spec needs all sections
   // (e.g., frontend-only features may not have Data Model, CLI tools may not have Technical Architecture)
   if (missing.length > 0) {
-    missing.forEach(section => {
-      warnings.push(`Missing recommended section: ${section}`);
+    missing.forEach(s => {
+      warnings.push(`Missing recommended section: ${s.label}`);
     });
   }
 

package/src/lib/validators/validation-runner.js

@@ -119,11 +119,13 @@ export async function runValidation(projectPath, featureName, options = {}) {
   }
 
   // Always run contract compliance if the contracts file exists (stack-aware)
-  const _profileForContracts = getStackProfile(projectPath);
-  const contractsType = resolveContractsOutputType(_profileForContracts.stack);
-  const contractsPath = getAbsoluteOutputPath(projectPath, featureName, contractsType);
-  if (existsSync(contractsPath) && !_profileForContracts.isNextjs) {
-    validatorIds.push('contract-compliance');
+  if (!options.skipContracts) {
+    const _profileForContracts = getStackProfile(projectPath);
+    const contractsType = resolveContractsOutputType(_profileForContracts.stack);
+    const contractsPath = getAbsoluteOutputPath(projectPath, featureName, contractsType);
+    if (existsSync(contractsPath) && !_profileForContracts.isNextjs) {
+      validatorIds.push('contract-compliance');
+    }
   }
 
   // Deduplicate

package/framework/agents/backend/supabase-expert.md

@@ -1,256 +0,0 @@
----
-name: supabase-expert
-description: Supabase & PostgreSQL specialist for RLS policies, auth integration, pgvector, Realtime subscriptions, Edge Functions, and migration management. Use when designing database schemas, implementing Row Level Security, setting up auth flows, or working with pgvector embeddings.
-allowed-tools: Read, Write, Edit, Bash, Glob, Grep
-stacks:
-  - supabase
-color: teal
-effort: medium
----
-
-# Supabase & PostgreSQL Specialist
-
-Expert in Supabase auth, Row Level Security, Realtime, Edge Functions, and pgvector.
-
-> **Ref:** `framework/standards/infrastructure/supabase/` — RLS, auth, storage, pgvector standards
-
-## Connection Pooling
-
-```
-# Direct connection (migrations only)
-postgresql://postgres:[password]@db.[project].supabase.co:5432/postgres
-
-# PgBouncer (application — ALWAYS use this)
-postgresql://postgres.[project]:[password]@aws-0-[region].pooler.supabase.com:6543/postgres
-```
-
-**Rule:** Application code ALWAYS connects via PgBouncer (port 6543). Direct connections (port 5432) only for migrations and schema changes.
-
----
-
-## Row Level Security (RLS)
-
-### Enable RLS on every table
-
-```sql
-ALTER TABLE public.documents ENABLE ROW LEVEL SECURITY;
-```
-
-### Common RLS Patterns
-
-```sql
--- User owns the row
-CREATE POLICY "Users can view own documents"
-  ON public.documents FOR SELECT
-  USING (auth.uid() = user_id);
-
--- User can insert own rows
-CREATE POLICY "Users can insert own documents"
-  ON public.documents FOR INSERT
-  WITH CHECK (auth.uid() = user_id);
-
--- User can update own rows
-CREATE POLICY "Users can update own documents"
-  ON public.documents FOR UPDATE
-  USING (auth.uid() = user_id)
-  WITH CHECK (auth.uid() = user_id);
-
--- User can delete own rows
-CREATE POLICY "Users can delete own documents"
-  ON public.documents FOR DELETE
-  USING (auth.uid() = user_id);
-
--- Service role bypass (for backend API)
-CREATE POLICY "Service role full access"
-  ON public.documents FOR ALL
-  USING (auth.role() = 'service_role');
-
--- Team-based access
-CREATE POLICY "Team members can view"
-  ON public.documents FOR SELECT
-  USING (
-    team_id IN (
-      SELECT team_id FROM public.team_members
-      WHERE user_id = auth.uid()
-    )
-  );
-```
-
-### RLS with Clerk JWT (custom claims)
-
-```sql
--- Extract Clerk user ID from JWT
-CREATE OR REPLACE FUNCTION auth.clerk_user_id()
-RETURNS TEXT AS $$
-  SELECT coalesce(
-    current_setting('request.jwt.claims', true)::json->>'sub',
-    ''
-  );
-$$ LANGUAGE sql STABLE;
-
--- Use in RLS policies
-CREATE POLICY "Clerk users own rows"
-  ON public.documents FOR ALL
-  USING (clerk_user_id = auth.clerk_user_id());
-```
-
----
-
-## Migrations
-
-```bash
-# Create new migration
-npx supabase migration new create_documents_table
-
-# Apply locally
-npx supabase db reset
-
-# Push to remote
-npx supabase db push
-
-# Diff local vs remote
-npx supabase db diff --use-migra
-
-# Lint for common issues
-npx supabase db lint --level warning
-```
-
-### Migration file structure
-
-```sql
--- supabase/migrations/20240101000000_create_documents_table.sql
-
-CREATE TABLE public.documents (
-  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
-  user_id UUID NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
-  title TEXT NOT NULL,
-  content TEXT,
-  created_at TIMESTAMPTZ DEFAULT now() NOT NULL,
-  updated_at TIMESTAMPTZ DEFAULT now() NOT NULL
-);
-
--- Always enable RLS
-ALTER TABLE public.documents ENABLE ROW LEVEL SECURITY;
-
--- Always add indexes for filtered columns
-CREATE INDEX idx_documents_user_id ON public.documents(user_id);
-CREATE INDEX idx_documents_created_at ON public.documents(created_at DESC);
-
--- RLS policies
-CREATE POLICY "Users manage own documents"
-  ON public.documents FOR ALL
-  USING (auth.uid() = user_id)
-  WITH CHECK (auth.uid() = user_id);
-```
-
----
-
-## pgvector (Embeddings)
-
-### Setup
-
-```sql
-CREATE EXTENSION IF NOT EXISTS vector;
-
-CREATE TABLE public.embeddings (
-  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
-  document_id UUID REFERENCES public.documents(id) ON DELETE CASCADE,
-  content TEXT NOT NULL,
-  embedding vector(1536) NOT NULL,  -- OpenAI text-embedding-3-small
-  metadata JSONB DEFAULT '{}'::jsonb,
-  created_at TIMESTAMPTZ DEFAULT now() NOT NULL
-);
-
--- HNSW index for fast similarity search (cosine distance)
-CREATE INDEX idx_embeddings_vector ON public.embeddings
-  USING hnsw (embedding vector_cosine_ops)
-  WITH (m = 16, ef_construction = 64);
-```
-
-### Similarity search function
-
-```sql
-CREATE OR REPLACE FUNCTION match_embeddings(
-  query_embedding vector(1536),
-  match_threshold FLOAT DEFAULT 0.78,
-  match_count INT DEFAULT 5
-)
-RETURNS TABLE (
-  id UUID,
-  content TEXT,
-  metadata JSONB,
-  similarity FLOAT
-)
-LANGUAGE plpgsql AS $$
-BEGIN
-  RETURN QUERY
-  SELECT
-    e.id,
-    e.content,
-    e.metadata,
-    1 - (e.embedding <=> query_embedding) AS similarity
-  FROM public.embeddings e
-  WHERE 1 - (e.embedding <=> query_embedding) > match_threshold
-  ORDER BY e.embedding <=> query_embedding
-  LIMIT match_count;
-END;
-$$;
-```
-
----
-
-## Realtime Subscriptions
-
-```typescript
-// Subscribe to changes on a table
-const channel = supabase
-  .channel('documents-changes')
-  .on('postgres_changes',
-    { event: '*', schema: 'public', table: 'documents', filter: `user_id=eq.${userId}` },
-    (payload) => {
-      console.log('Change:', payload.eventType, payload.new);
-    }
-  )
-  .subscribe();
-
-// Cleanup
-channel.unsubscribe();
-```
-
-**Rule:** Always filter subscriptions by user/team — never subscribe to full table changes.
-
----
-
-## Storage (File Uploads)
-
-```sql
--- Create bucket
-INSERT INTO storage.buckets (id, name, public)
-VALUES ('avatars', 'avatars', true);
-
--- RLS for storage
-CREATE POLICY "Users upload own avatar"
-  ON storage.objects FOR INSERT
-  WITH CHECK (
-    bucket_id = 'avatars' AND
-    auth.uid()::text = (storage.foldername(name))[1]
-  );
-```
-
----
-
-## Checklist
-
-- [ ] PgBouncer (port 6543) used for all application connections
-- [ ] RLS enabled on ALL public tables
-- [ ] RLS policies cover SELECT, INSERT, UPDATE, DELETE
-- [ ] Service role policy exists for backend API access
-- [ ] Migrations use `npx supabase migration new` (not manual SQL)
-- [ ] Indexes on all frequently filtered columns
-- [ ] pgvector: HNSW index with appropriate m/ef_construction values
-- [ ] Realtime subscriptions filtered by user/team
-- [ ] Storage buckets have RLS policies
-
----
-
-*MORPH-SPEC by Polymorphism Tech*

package/framework/agents/integrations/clerk-auth.md

@@ -1,109 +0,0 @@
----
-name: clerk-auth
-description: Clerk Auth specialist for Clerk SDK integration, social login, JWT session management, and user management in Next.js and .NET projects. Use when integrating Clerk authentication, implementing social login flows, managing user sessions with Clerk JWT, or protecting routes with Clerk middleware.
-allowed-tools: Read, Write, Edit, Bash, Glob, Grep
-stacks:
-  - clerk
-color: teal
-effort: medium
----
-
-# Clerk Auth
-
-Autenticação SaaS com Clerk para .NET e Next.js. SDK: `Clerk.Net.AspNetCore.Security` (.NET) / `@clerk/nextjs` (Next.js).
-
-## Setup
-
-```csharp
-// appsettings.json
-{ "Clerk": { "SecretKey": "${CLERK_SECRET_KEY}", "PublishableKey": "pk_test_xxx" } }
-
-// Program.cs
-builder.Services.AddClerk(builder.Configuration);
-builder.Services.AddAuthentication(ClerkAuthenticationDefaults.AuthenticationScheme)
-    .AddClerk(o => { o.Authority = "https://clerk.{instance}.com"; o.ValidAudiences = ["your-app-id"]; });
-builder.Services.AddAuthorization();
-app.UseAuthentication();
-app.UseAuthorization();
-```
-
-## Protected Endpoints
-
-```csharp
-// Minimal API
-app.MapGet("/api/profile", async (ClaimsPrincipal user, IClerkClient clerk) =>
-{
-    var userId = user.FindFirstValue(ClaimTypes.NameIdentifier);
-    if (userId is null) return Results.Unauthorized();
-    var u = await clerk.Users.GetUserAsync(userId);
-    return Results.Ok(new { u.Id, Email = u.EmailAddresses.FirstOrDefault()?.EmailAddress });
-}).RequireAuthorization();
-
-// Controller: same pattern with [Authorize] + User.FindFirstValue()
-// Role-based: [Authorize(Roles = "admin")]
-```
-
-## Next.js Integration
-
-```tsx
-// middleware.ts
-import { clerkMiddleware } from '@clerk/nextjs/server';
-export default clerkMiddleware();
-export const config = { matcher: ['/((?!.*\\..*|_next).*)', '/'] };
-
-// Protected page
-import { auth } from '@clerk/nextjs/server';
-export default async function DashboardPage() {
-  const { userId } = await auth();
-  if (!userId) redirect('/sign-in');
-  return <Dashboard />;
-}
-
-// Client component
-'use client';
-import { useUser } from '@clerk/nextjs';
-const { user, isLoaded } = useUser();
-```
-
-## Client Operations (.NET)
-
-```csharp
-var user = await _clerk.Users.GetUserAsync(userId);                    // Get
-var users = await _clerk.Users.GetUserListAsync(new() { Limit = 10 }); // List
-await _clerk.Users.UpdateUserMetadataAsync(userId, new()               // Update metadata
-    { PublicMetadata = new Dictionary<string, object> { ["plan"] = "pro" } });
-await _clerk.Users.DeleteUserAsync(userId);                            // Delete
-```
-
-## Webhooks
-
-```csharp
-[ApiController, Route("api/webhooks/clerk")]
-public class ClerkWebhookController(IUserService users) : ControllerBase
-{
-    [HttpPost]
-    public async Task<IActionResult> Handle([FromBody] ClerkWebhookPayload payload)
-    {
-        switch (payload.Type)
-        {
-            case "user.created": await users.SyncUserAsync(payload.Data); break;
-            case "user.updated": await users.UpdateUserAsync(payload.Data); break;
-            case "user.deleted": await users.DeleteUserAsync(payload.Data.Id); break;
-        }
-        return Ok();
-    }
-}
-```
-
-## Checklist
-
-- [ ] Secret Key in environment variables (not hardcoded)
-- [ ] Authentication scheme configured
-- [ ] Authorization policies defined
-- [ ] Webhook endpoint + signature validation
-- [ ] Redirect after login configured
-- [ ] Error handling for expired sessions
-
----
-
-*MORPH-SPEC by Polymorphism Tech*

package/framework/rules/clerk-standards.md

@@ -1,13 +0,0 @@
----
-paths:
-  - "**/Auth/**"
-  - "**/auth/**"
-  - "**/Identity/**"
-  - "**/Clerk/**"
-stacks:
-  - dotnet
----
-
-# Clerk Authentication Standards
-
-@.morph/framework/standards/backend/integrations/clerk/clerk-auth.md

package/framework/rules/supabase-standards.md

@@ -1,29 +0,0 @@
----
-paths:
-  - "**/*.sql"
-  - "**/supabase/**"
-  - "**/migrations/**"
-stacks:
-  - supabase
----
-
-# Supabase & PostgreSQL Standards
-
-@.morph/framework/standards/infrastructure/supabase/supabase-auth.md
-@.morph/framework/standards/infrastructure/supabase/supabase-rls.md
-@.morph/framework/standards/infrastructure/supabase/supabase-storage.md
-@.morph/framework/standards/infrastructure/supabase/supabase-pgvector.md
-@.morph/framework/standards/infrastructure/supabase/mcp-setup.md
-@.morph/framework/standards/infrastructure/supabase/supabase-custom-jwt.md
-@.morph/framework/standards/backend/database/postgresql/database.md
-
-## SQL & Migration Templates
-
-| Template | Path | Purpose |
-|----------|------|---------|
-| Migration (full) | `.morph/framework/templates/code/sql/supabase-migration.template.sql` | RLS + indexes |
-| Migration (simple) | `.morph/framework/templates/code/sql/supabase-migration.sql` | Basic migration |
-| RLS Policy | `.morph/framework/templates/code/sql/rls-policy.sql` | Row Level Security |
-| TS Types | `.morph/framework/templates/code/typescript/contracts.ts` | Supabase DB types |
-
-Read the template to see the exact pattern for migrations, RLS policies, and type generation.