@yashasvi9199/vibefix 0.0.0-stage → 1.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Yash Haldiya
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,237 @@
-# Temporary Holding Version
+<p align="center">
+  <img src="./assets/banner.png" alt="VibeFix Banner" width="100%" />
+</p>
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+<h1 align="center">VibeFix</h1>
+
+<p align="center">
+  <strong>Stealth architecture rules, zero-trust security standards, and agent workflows for Antigravity IDE.</strong>
+</p>
+
+<p align="center">
+  <a href="https://github.com/yashasvi9199/vibefix/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue.svg?style=flat-square" alt="MIT License" /></a>
+  <a href="https://www.typescriptlang.org/"><img src="https://img.shields.io/badge/TypeScript-5.0+-3178C6?style=flat-square&logo=typescript&logoColor=white" alt="TypeScript" /></a>
+  <a href="https://pnpm.io/"><img src="https://img.shields.io/badge/pnpm-ready-F69220?style=flat-square&logo=pnpm&logoColor=white" alt="pnpm" /></a>
+  <a href="https://github.com/yashasvi9199/vibefix/stargazers"><img src="https://img.shields.io/github/stars/yashasvi9199/vibefix?style=flat-square" alt="GitHub Stars" /></a>
+  <a href="https://github.com/yashasvi9199/vibefix/issues"><img src="https://img.shields.io/github/issues/yashasvi9199/vibefix?style=flat-square" alt="Open Issues" /></a>
+</p>
+
+---
+
+## ⚡ Overview
+
+**VibeFix** automates the injection of battle-tested software engineering standards, security guardrails, and AI agent slash commands into any codebase. Designed natively for **Google Antigravity IDE**, it bridges the gap between autonomous AI coding agents and hardened, production-grade architecture.
+
+With a single command, VibeFix scaffolds modular system prompts, DPDP compliance standards, zero-trust validation rules, and executable `.agent/workflows/` that turn your IDE assistant into an elite senior staff engineer.
+
+---
+
+## 🚀 Quick Start (Zero Install)
+
+Run VibeFix directly in your project root using your package manager of choice:
+
+### **pnpm** (Recommended)
+```bash
+# Run directly via GitHub repository
+pnpm dlx github:yashasvi9199/vibefix init
+
+# Or via npm package registry
+pnpm dlx vibefix init
+```
+
+### **npm / npx**
+```bash
+# Run directly via GitHub repository
+npx github:yashasvi9199/vibefix init
+
+# Or via npm package registry
+npx vibefix init
+```
+
+### **bun**
+```bash
+# Run directly via GitHub repository
+bunx --bun github:yashasvi9199/vibefix init
+
+# Or via npm package registry
+bunx vibefix init
+```
+
+### **yarn**
+```bash
+# Run directly via GitHub repository
+yarn dlx github:yashasvi9199/vibefix init
+
+# Or via npm package registry
+yarn dlx vibefix init
+```
+
+---
+
+## 📦 Global Installation
+
+Install VibeFix globally to use the `vibefix` command anywhere across your system:
+
+| Package Manager | Global Install Command | Project Init Command |
+|---|---|---|
+| **pnpm** | `pnpm add -g github:yashasvi9199/vibefix` | `vibefix init` |
+| **npm** | `npm install -g github:yashasvi9199/vibefix` | `vibefix init` |
+| **bun** | `bun add -g github:yashasvi9199/vibefix` | `vibefix init` |
+| **yarn** | `yarn global add github:yashasvi9199/vibefix` | `vibefix init` |
+
+> [!TIP]
+> Once installed globally, navigate to any workspace and run `vibefix init`.
+
+---
+
+## 🛠️ Project Dev Dependency Installation
+
+If you prefer pinning VibeFix inside your repository's `package.json`:
+
+### 1. Install as dev dependency
+```bash
+# pnpm
+pnpm add -D github:yashasvi9199/vibefix
+
+# npm
+npm install -D github:yashasvi9199/vibefix
+
+# bun
+bun add -d github:yashasvi9199/vibefix
+
+# yarn
+yarn add -D github:yashasvi9199/vibefix
+```
+
+### 2. Run initialization
+```bash
+pnpm vibefix init
+# or: npx vibefix init / bunx vibefix init / yarn vibefix init
+```
+
+---
+
+## 💻 CLI Usage & Flags
+
+```
+Usage: vibefix [options] [command]
+
+Scaffold rules, GEMINI.md, and Antigravity slash commands
+
+Options:
+  -V, --version   output the version number
+  -h, --help      display help for command
+
+Commands:
+  init [options]  Scaffold rules/, .agent/workflows/, and GEMINI.md into project
+  help [command]  display help for command
+```
+
+### Command Options: `vibefix init`
+
+| Option | Shorthand | Description | Default |
+|---|---|---|---|
+| `--force` | `-f` | Overwrite existing files if they already exist in destination | `false` |
+| `--help` | `-h` | Display help for the `init` command | - |
+
+```bash
+# Force overwrite existing configs
+vibefix init --force
+```
+
+---
+
+## 🏗️ What VibeFix Scaffolds
+
+Running `vibefix init` provisions three mission-critical subsystems in your repository:
+
+```
+your-project/
+├── GEMINI.md                     # Agent routing prompt & behavioral enforcement
+├── rules/                        # Modular architectural directives
+│   ├── CORE.md                   # Strict TypeScript, zero 'any', pnpm standards
+│   ├── API.md                    # REST, gRPC, SSE, Webhooks, idempotency & rate limits
+│   ├── SECURITY.md               # Zero-trust validation, Zod schemas, UUIDs, ReDoS/SSTI defense
+│   ├── FRONTEND.md               # SSR, Tailwind, Zustand, TanStack Query, Offline-first PWA
+│   ├── SEO.md                    # Canonical meta titles, dynamic Open Graph, sitemaps
+│   ├── COMPLIANCE.md             # India DPDP Act 2023, consent checkboxes & privacy policies
+│   ├── DOCS.md                   # Ephemeral staging docs, CHANGELOG, and DATABASE.sql ledgers
+│   └── CHECKLIST.md              # Pre-commit & pre-deployment verification matrix
+└── .agent/
+    └── workflows/                # Interactive slash commands for Antigravity IDE
+        ├── /audit-security       # Full zero-trust vulnerability & data exposure scan
+        ├── /audit-seo            # Meta tags, crawler indexability & Open Graph audit
+        ├── /dpdp-audit           # Verify statutory compliance with DPDP Act 2023
+        ├── /dpdp-cookies         # Scaffold GDPR/DPDP compliant consent banners
+        ├── /dpdp-scaffold        # Generate compliant Privacy Policy and Terms & Conditions
+        ├── /gen-conversion       # Scaffold high-conversion 'Thank You' post-purchase flows
+        ├── /gen-errors           # Generate standardized custom 404, 500 & maintenance views
+        ├── /gen-sitemap          # Auto-generate dynamic sitemap.xml and robots.txt
+        ├── /harden-headers       # Inject CSP, HSTS, X-Frame-Options, and CORS controls
+        ├── /open-graph           # Scaffold dynamic edge-rendered social preview cards
+        ├── /setup-pwa            # Generate offline-first service worker & web manifest
+        ├── /setup-telemetry      # Setup privacy-respecting client analytics
+        └── /task-sync            # Sync task completion to RELEASE.md & CHANGELOG.md
+```
+
+---
+
+## 🎯 Architectural Philosophy
+
+VibeFix enforces strict, production-first development rules:
+
+- **Strict Typing**: Ban on `any`, isolated `.types.ts` per feature domain, and strict compiler boundaries.
+- **Deterministic Tooling**: Standardized on `pnpm` exclusively; eliminates phantom dependencies and lockfile drift.
+- **Zero-Trust Input Validation**: Mandates Zod schemas, parameterized ORMs (Drizzle / Prisma), and UUID primary keys.
+- **Modern Edge & Frontend**: SSR architectures, TanStack Query / Zustand separation, and mobile breakpoint parity.
+- **Regulatory Compliance**: Built-in compliance mechanisms for modern data protection acts (DPDP 2023, GDPR).
+
+---
+
+## 🤖 Using with Antigravity IDE
+
+1. Run `vibefix init` in your project root.
+2. Open the project in **Google Antigravity IDE**.
+3. Open the chat panel and type `/` to see all injected agent workflows:
+
+```
+/audit-security   - Run security audit
+/setup-pwa        - Scaffold offline-first PWA
+/harden-headers   - Configure security headers
+/task-sync        - Update staging docs & changelog
+```
+
+Your AI assistant will immediately adhere to all guidelines defined in `GEMINI.md` and `rules/`.
+
+---
+
+## 🛠️ Local Development & Contribution
+
+Want to contribute new rules or workflows to VibeFix?
+
+```bash
+# 1. Clone the repository
+git clone https://github.com/yashasvi9199/vibefix.git
+cd vibefix
+
+# 2. Install dependencies
+pnpm install
+
+# 3. Build TypeScript source
+pnpm run build
+
+# 4. Test CLI locally
+pnpm run dev init
+```
+
+---
+
+## 📄 License
+
+Distributed under the **MIT License**. See [LICENSE](file:///home/drone/Programming/vibefix/LICENSE) for more information.
+
+---
+
+<p align="center">
+  Crafted by <a href="https://github.com/yashasvi9199"><strong>Yash Haldiya</strong></a>
+</p>

package/dist/bin/cli.js

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+import { Command } from "commander";
+import chalk from "chalk";
+import { initProject } from "../src/commands/init.js";
+const program = new Command();
+program
+    .name("vibefix")
+    .description("Scaffold rules, GEMINI.md, and Antigravity slash commands")
+    .version("1.0.0");
+program
+    .command("init")
+    .description("Scaffold rules/, .agent/workflows/, and GEMINI.md into project")
+    .option("-f, --force", "Overwrite existing files if present")
+    .action(async (options) => {
+    console.log(chalk.cyan("🚀 Initializing VibeFix architecture..."));
+    await initProject(options);
+});
+program.parse(process.argv);

package/dist/src/commands/init.js

@@ -0,0 +1,67 @@
+import fs from "fs/promises";
+import path from "path";
+import { fileURLToPath } from "url";
+import chalk from "chalk";
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+// Resolves to package root whether running locally or inside node_modules
+const PACKAGE_ROOT = path.resolve(__dirname, "../../");
+const TEMPLATES_DIR = path.join(PACKAGE_ROOT, "templates");
+async function copyFolder(src, dest, force) {
+    await fs.mkdir(dest, { recursive: true });
+    const entries = await fs.readdir(src, { withFileTypes: true });
+    for (const entry of entries) {
+        const srcPath = path.join(src, entry.name);
+        const destPath = path.join(dest, entry.name);
+        if (entry.isDirectory()) {
+            await copyFolder(srcPath, destPath, force);
+        }
+        else {
+            if (!force) {
+                try {
+                    await fs.access(destPath);
+                    console.log(chalk.gray(`  - Skipping existing: ${entry.name}`));
+                    continue;
+                }
+                catch { }
+            }
+            await fs.copyFile(srcPath, destPath);
+            console.log(chalk.green(`  ✔ Injected: ${entry.name}`));
+        }
+    }
+}
+export async function initProject(options) {
+    const targetDir = process.cwd();
+    const force = !!options.force;
+    try {
+        // 1. Copy rules/
+        console.log(chalk.bold("\n📁 Deploying rules/ directory..."));
+        await copyFolder(path.join(TEMPLATES_DIR, "rules"), path.join(targetDir, "rules"), force);
+        // 2. Copy .agent/workflows/
+        console.log(chalk.bold("\n⚡ Deploying .agent/workflows/ slash commands..."));
+        await copyFolder(path.join(TEMPLATES_DIR, "workflows"), path.join(targetDir, ".agent", "workflows"), force);
+        // 3. Copy GEMINI.md to project root
+        console.log(chalk.bold("\n📄 Deploying GEMINI.md routing prompt..."));
+        const geminiSrc = path.join(TEMPLATES_DIR, "GEMINI.md");
+        const geminiDest = path.join(targetDir, "GEMINI.md");
+        let writeGemini = true;
+        if (!force) {
+            try {
+                await fs.access(geminiDest);
+                console.log(chalk.gray("  - GEMINI.md already exists, skipping"));
+                writeGemini = false;
+            }
+            catch { }
+        }
+        if (writeGemini) {
+            await fs.copyFile(geminiSrc, geminiDest);
+            console.log(chalk.green("  ✔ Injected: GEMINI.md"));
+        }
+        console.log(chalk.cyan.bold("\n✨ VibeFix initialized successfully!"));
+        console.log(chalk.yellow("Open Antigravity IDE and type '/' in chat to view your slash commands.\n"));
+    }
+    catch (err) {
+        console.error(chalk.red("Initialization failed:"), err);
+        process.exit(1);
+    }
+}

package/package.json

@@ -1,6 +1,26 @@
 {
   "name": "@yashasvi9199/vibefix",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "1.0.1",
+  "description": "Stealth architecture rules and agent workflows for Antigravity IDE",
+  "license": "MIT",
+  "author": "yashasvi9199",
+  "type": "module",
+  "bin": {
+    "vibefix": "./dist/bin/cli.js"
+  },
+  "files": [
+    "dist",
+    "templates"
+  ],
+  "scripts": {
+    "build": "tsc"
+  },
+  "dependencies": {
+    "chalk": "^5.3.0",
+    "commander": "^12.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "typescript": "^5.0.0"
+  }
 }

package/templates/GEMINI.md

@@ -0,0 +1,29 @@
+<antigravity_agent_context>
+Operate as an elite senior developer in an Arch Linux environment. Output production-grade, zero-fluff code. Ban AI boilerplate, conversational preamble, and hand-holding inline comments. Apply surgical line-by-line diffs—never re-dump or replace entire files.
+</antigravity_agent_context>
+
+<core_standards>
+* Enforce strict TypeScript types; absolute ban on the `any` datatype.
+* Co-locate isolated `.types.ts` and `.styles.css` per feature module; ban central `global.d.ts` and global monolithic stylesheets.
+* Standardize on `pnpm` exclusively across all workspaces and setup tasks; `npm` is strictly prohibited.
+* Wrap all asynchronous operations in defensive `try/catch` blocks.
+* Use 'Better Comments' formatting (`!`, `?`, `TODO`, `*`) for complex logic and edge cases; do not comment self-explanatory syntax.
+* Execute immediate micro-commits for minor changes authored under: `yashasvi9199` / `yashasvi9199@gmail.com`.
+* Enforce semantic commit prefixes strictly: `<prefix>(<scope>): <message>` (e.g., `feat:`, `fix:`, `chore:`, `refactor:`).
+</core_standards>
+
+<documentation_invariants>
+* Update documentation only upon explicit instruction or when `docs/CHANGELOG.md` increments version (`X.Y.Z`).
+* Maintain `docs/GUIDE.md` for onboarding steps, environment setup, and API keys.
+* Maintain an append-only, immutable `docs/DATABASE.sql` ledger logging every schema migration with timestamp and rationale.
+</documentation_invariants>
+
+<modular_rule_routing>
+Reference and load domain-specific rules on demand:
+* When building or modifying REST endpoints: Adhere to `@rules/API.md`
+* When handling authentication, inputs, uploads, or DB queries: Adhere to `@rules/SECURITY.md` (Trigger `/audit-security` or `/harden-headers` for audit and security scaffolding)
+* When styling, handling viewports, animations, or state: Adhere to `@rules/FRONTEND.md`
+* When configuring metadata, structured data, or crawl files: Adhere to `@rules/SEO.md`
+* When implementing legal routes, cookie banners, or intake forms: Adhere to `@rules/COMPLIANCE.md`
+* When tracking or completing feature debt: Synchronize via `@rules/CHECKLIST.md`
+</modular_rule_routing>

package/templates/rules/API.md

@@ -0,0 +1,9 @@
+# API & NETWORKING STANDARDS
+
+1. **REST Resource Semantics:** Use plural nouns for resources (e.g., `/users/42`). Nest paths to a maximum of 2 levels; pass deeper relationships via query parameters (e.g., `/tasks/4?project_id=3`).
+2. **Kebab-Case & Verb-Free Routing:** Keep all URLs lowercase and hyphenated. Strip action verbs from paths and let HTTP verbs dictate intent (`GET` reads, `POST` creates, `DELETE` removes).
+3. **Actionable Error Payloads:** Return human-readable, actionable error bodies indicating what the client must correct (e.g., `{"error": "email is required"}`). Never leak database errors or internal stack traces to the client.
+4. **Payload Size Boundaries:** Enforce strict body-size limits on all incoming request streams (rejecting payloads exceeding limits with `413 Payload Too Large`) to prevent memory exhaustion DoS.
+5. **Tiered Backend Rate Limiting:** Implement rate limiting strictly on the backend:
+   - **General endpoints:** Token bucket (30 req / 60s).
+   - **Strict/Auth endpoints (login, signup, reset):** Fixed window (1 req / 120s) with tight threshold tiers.

package/templates/rules/CHECKLIST.md

@@ -0,0 +1,17 @@
+# PENDING TASKS & LEDGER INVARIANTS
+
+1. **Single Source of Truth:**
+   - All pending implementations, rule debts, and architectural gaps must be tracked in `.pending-tasks/checklist.md`.
+   - The `.pending-tasks/` directory must be committed to git to persist state across sessions.
+
+2. **Status Notation:**
+   - `[ ]` Pending Task: Unstarted item with domain scope and rule reference.
+   - `[-]` In Progress: Task actively being executed.
+   - `[x]` Completed: Verified via build/typecheck (`tsc --noEmit`).
+   - `[!]` Blocked: Awaiting external credentials, packages, or user input.
+
+3. **Task Entry Format:**
+   `- [ ] [<CATEGORY>] <Task Description> (@rules/<RULE_FILE>.md#<RuleNumber>) [Priority: High|Med|Low]`
+
+4. **Verification Gate:**
+   - Tasks must never be marked `[x]` without verifying that code compiles without type errors (`pnpm tsc --noEmit`).

package/templates/rules/COMPLIANCE.md

@@ -0,0 +1,16 @@
+# DPDP & REGULATORY COMPLIANCE INVARIANTS
+
+1. **Explicit Affirmative Consent Gate:**
+   - Every user registration, signup, contact, and data-intake form must include an explicit consent checkbox for the DPDP Act.
+   - Checkboxes must remain unticked by default. Form submission must be blocked until checked.
+   - The checkbox label must explicitly link to `/privacy` and `/terms`.
+
+2. **Statutory Grievance Redressal:**
+   - The application must maintain an accessible `/grievance` route detailing the Grievance Officer's contact details and a direct inquiry form.
+   - The form must provide explicit action categories: "Erase/Delete My Data", "Correct Personal Data", and "General Privacy Concern".
+
+3. **Consent-Gated Cookie Telemetry:**
+   - Non-essential cookies, localStorage analytics markers, and telemetry SDKs must remain completely dormant until explicit consent is given via the cookie banner.
+
+4. **Public Entity & Address Verification:**
+   - The primary footer and legal pages must display a verified physical or registered business address to satisfy regulatory transparency requirements.

package/templates/rules/CORE.md

@@ -0,0 +1,19 @@
+# CORE STANDARDS
+
+1. **Elite Stealth Persona & Zero Fluff:** Act as an elite senior engineer in an Arch Linux environment producing production-grade code. Never output chain-of-thought rambling, conversational preamble, or process explanations. Apply surgical diffs and modify only the necessary lines—strictly avoid replacing or re-dumping entire files.
+
+2. **Absolute Ban on `any` Datatype:** Enforce strict, uncompromising TypeScript types across all application logic. The `any` escape hatch is strictly banned in favor of explicit interfaces, generics, or `unknown` with runtime type narrowing.
+
+3. **Isolated Feature Types (`.types.ts`):** Co-locate all type declarations inside dedicated `.types.ts` files within their respective feature modules. Never create or rely on monolithic, centralized `global.d.ts` or root type buckets.
+
+4. **Exclusive `pnpm` Package Management:** Standardize on `pnpm` exclusively across all workspaces, monorepos, and setup commands. Standard `npm` is strictly prohibited to guarantee deterministic builds and eliminate disk bloat.
+
+5. **Native 'Better Comments' Formatting:** Use standard visual prefix tokens (`!`, `?`, `TODO`, `*`) for inline annotations. Add pragmatic, human-like comments before complex business logic, edge-case conditions, custom hooks, or non-obvious algorithms. Do not comment on self-explanatory syntax or basic primitives.
+
+6. **Defensive Async Operations:** Wrap all asynchronous operations, network requests, and Promise chains in strict `try/catch` blocks to ensure errors are captured and handled predictably without crashing the runtime.
+
+7. **Immediate Micro-Commits with Personal Credentials:** Execute an immediate Git commit following even minor file changes. All commits must strictly be authored under:
+   - `user.name`: `yashasvi9199`
+   - `user.email`: `yashasvi9199@gmail.com`
+
+8. **Semantic Conventional Commits:** Enforce conventional commit prefixes strictly. Commits must follow the format `<prefix>(<scope>): <message>` (or `<prefix>[<scope>]: <message>`), where prefix is one of: `feat`, `fix`, `build`, `chore`, `ci`, `docs`, `style`, `refactor`, `perf`, `test`, `nit`, `minor`, `bin`, or `dist`.

package/templates/rules/DOCS.md

@@ -0,0 +1,24 @@
+# DOCUMENTATION & LEDGER INVARIANTS
+
+1. **Explicit Trigger & SemVer Sync:**
+   - Update documentation files only when explicitly requested, or immediately following any Semantic Version increment in `docs/CHANGELOG.md`.
+   - Never generate unsolicited documentation files during standard feature edits.
+
+2. **Semantic Versioning Ledger (`docs/CHANGELOG.md`):**
+   - Strictly follow Semantic Versioning (`X.Y.Z`):
+     - `X` (Major): Breaking API/architectural changes or foundational feature overhauls.
+     - `Y` (Minor): Backward-compatible new features, new endpoints, or UI additions.
+     - `Z` (Patch): Backward-compatible bug fixes, UI styling tweaks, or minor refactors.
+   - Categorize entries under clear SemVer subheadings: `### Added`, `### Changed`, `### Fixed`, or `### Removed`.
+
+3. **Developer Onboarding Manual (`docs/GUIDE.md`):**
+   - Maintain a practical, reproducible guide for onboarding new developers.
+   - Detail project setup commands (`pnpm install`, `pnpm dev`), system prerequisites, all required environment variable keys (with explanations for how to obtain them), and local build scripts.
+
+4. **Immutable Database Ledger (`docs/DATABASE.sql`):**
+   - Maintain an append-only transaction ledger of all database schema changes.
+   - Every entry must append to the bottom of the file with:
+     - ISO Timestamp and Date.
+     - Target table/entity and operational objective (Rationale).
+     - The exact executable SQL mutation query (`CREATE TABLE`, `ALTER TABLE`, `CREATE INDEX`).
+   - Entries written to this file are strictly immutable: past queries must never be edited, refactored, or deleted.

package/templates/rules/FRONTEND.md

@@ -0,0 +1,33 @@
+# FRONTEND UI/UX, MOTION & MOBILE STANDARDS
+
+1. **Architecture & State Partitioning:**
+   - Standardize on Vite + React SPA/PWA architecture.
+   - Use Zustand strictly for global client UI state (modals, drawers, navigation, local user flags).
+   - Use TanStack Query / SWR for all server state, mutations, and caching. Never duplicate server cache into Zustand.
+
+2. **Responsive Styling & Feature Scope:**
+   - Standardize on Tailwind CSS for layouts and primitives. Ban arbitrary inline style overrides and dark/light mode toggle complexity.
+   - Prohibit monolithic global stylesheets. Each feature module must maintain a dedicated `.styles.css` file for scoped animations or complex pseudo-selectors.
+
+3. **Desktop vs. Mobile View Separation:**
+   - **Static / Standard UI:** Implement responsive Tailwind breakpoint classes within a single component.
+   - **Motion / 3D / Complex Scroll Pages:** Maintain dedicated UI views (`View.desktop.tsx` vs `View.mobile.tsx`). Isolate mouse/wheel-based GSAP ScrollTriggers to Desktop, and touch-optimized pointer gestures to Mobile.
+   - Explicitly configure CSS `touch-action: pan-y` and gesture recognizers on touch views to prevent inverted or fighting scroll axis states.
+
+4. **Conversion & Visual Hierarchy:**
+   - Place the primary Call to Action (CTA) above the fold on all initial viewports.
+   - Implement an explicit sticky mobile CTA bar for viewports under `768px`.
+
+5. **Interface State Feedback:**
+   - Every interactive form, async mutation, and data fetch must include explicit loading states (skeletons or disabled spinner states) and localized inline form validation error states.
+
+6. **Browser Storage Strategy:**
+   - **Cookies (`httpOnly`, `Secure`, `SameSite`):** Strictly reserved for authentication tokens and session identifiers. Never store auth tokens in LocalStorage.
+   - **LocalStorage:** Reserved exclusively for non-sensitive, persistent preferences (e.g., drawer collapsed, language).
+   - **SessionStorage:** Reserved for transient, tab-specific multi-step form data.
+   - **IndexedDB:** Reserved for heavy structured payloads, offline caching, and PWA synchronization.
+
+7. **Capacitor Android Integration:**
+   - Store auth tokens in Native Secure Storage on Capacitor builds.
+   - Explicitly handle Android hardware back-button listeners (`App.addListener('backButton')`), app pause/resume state listeners, and graceful native permissions.
+   - Deploy dynamic runtime URL resolution using ternary fallback: Deployment Platform Variable -> `.env`/`dev.vars` -> `localhost`.

package/templates/rules/SECURITY.md

@@ -0,0 +1,24 @@
+# SECURITY & DATA VALIDATION INVARIANTS
+
+1. **Zero-Trust Schema Validation:** Every incoming API payload, query param, and path variable must be validated against a strict schema (e.g., Zod, Valibot) checking type, length, and format. Reject non-matching data immediately; do not rely on loose sanitization.
+2. **Sequential ID Masking:** Never expose raw, auto-incrementing database integers to clients or public routes. Use cryptographically secure UUIDs, ULIDs, or NanoIDs to prevent resource enumeration.
+3. **Universal Injection Defense:**
+   - **SQL:** Strictly enforce parameterized queries via type-safe ORMs/query builders (e.g., Drizzle, Prisma, Kysely). Manual string concatenation and raw template interpolation are strictly banned.
+   - **NoSQL / Document:** Strictly map and type-cast incoming properties field-by-field. Never pass raw request objects into query filters to prevent operator injection.
+4. **Mass-Assignment Defense:** Never spread raw request bodies directly into database inserts or updates (`...req.body`). Explicitly pick whitelisted attributes matching the table schema.
+5. **Anti-DoS Input Capping:**
+   - Enforce hard character limits (e.g., 64–72 characters) on password fields before hashing to neutralize CPU-exhaustion attacks against bcrypt/argon2.
+   - Enforce execution timeouts or use pre-vetted standard patterns for regular expressions to prevent catastrophic backtracking (ReDoS).
+6. **SSTI & Template Isolation:** Never concatenate user-supplied input into template strings, server renderers, or dynamic evaluators. Pass dynamic values strictly as data parameters.
+7. **Storage & Binary File Isolation:**
+   - Discard client-provided filenames; rename uploaded assets with server-generated UUIDs.
+   - Offload binary transfers using short-lived pre-signed/signed upload URLs rather than streaming large files through application memory.
+   - Validate true MIME types via binary magic numbers (file headers), not file extensions. Store uploads outside executable paths.
+8. **Dynamic CORS & Transport:** 
+   - Never use wildcard (`*`) origins on endpoints that exchange credentials, cookies, or auth headers.
+   - Resolve allowed origins dynamically from runtime environment variables.
+9. **Cryptographic Entropy:** Prohibit `Math.random()` for any security context. Always utilize the Web Crypto API (`crypto.getRandomValues`, `crypto.randomUUID`) or platform-native cryptographic libraries.
+
+## Actionable Security Workflows
+- **Dependency & Secret Leak Auditing:** Trigger `/audit-security` to run `pnpm audit` and verify `.env` secrecy.
+- **HTTP Header Hardening:** Trigger `/harden-headers` to configure CSP, HSTS, frame options, and dynamic CORS middleware.

package/templates/rules/SEO.md

@@ -0,0 +1,15 @@
+# SEO, CORE WEB VITALS & TELEMETRY STANDARDS
+
+1. **Page Metadata & Structured Data:**
+   - Every routable view must expose a unique `<title>` and `<meta name="description">`.
+   - Indexable views must include a `<link rel="canonical">` tag pointing to the production domain, stripping marketing/tracking query parameters to prevent duplicate content indexing.
+   - Every key indexable page must inject validated JSON-LD schema (`<script type="application/ld+json">`) defining standard entities (`WebSite`, `SoftwareApplication`, `Organization`).
+
+2. **Core Web Vitals & Cumulative Layout Shift (CLS):**
+   - All `<img>`, `<video>`, `<iframe>`, and canvas containers must specify explicit `width`/`height` or CSS `aspect-ratio` properties.
+   - Dynamic UI elements rendered above the fold must reserve layout height using skeletons or fixed min-height containers to keep Cumulative Layout Shift below 0.1.
+
+3. **Telemetry Privacy & Event Contracts:**
+   - Telemetry and analytics pings must remain strictly disabled until explicit user consent is confirmed.
+   - All analytics events must adhere to a strict, centralized TypeScript dictionary (`event_name`, `timestamp`, `session_id`, typed properties). Caching or transmitting personally identifiable information (PII), plain passwords, or form inputs is banned.
+   - In SPA routing (React/Vite), attach a router-level observer to dispatch a virtual `page_view` telemetry event on every route transition.

package/templates/workflows/audit-security.md

@@ -0,0 +1,9 @@
+---
+description: Run dependency audit and scan project for secret leaks or gitignore flaws
+---
+
+# Security Audit Task
+1. Execute `pnpm audit` in the terminal and report vulnerabilities by severity.
+2. Inspect `.gitignore` to ensure `.env`, `.env.local`, and custom secret files are excluded.
+3. Search the workspace tree for hardcoded API keys, JWT secrets, or unparameterized queries.
+4. Confirm `.env.example` contains variable placeholders with dummy data only.

package/templates/workflows/audit-seo.md

@@ -0,0 +1,11 @@
+---
+description: Audit metadata, JSON-LD, canonical tags, heading hierarchy, and image alt attributes
+---
+
+# SEO Compliance Audit Task
+
+1. Scan all page routes to ensure unique `<title>`, `<meta name="description">`, and `<link rel="canonical">` tags exist.
+2. Verify that indexable landing views render valid JSON-LD structured data.
+3. Check headings for strict unbroken hierarchy (single H1 per page, sequential H2/H3).
+4. Inspect all `<img>` tags for descriptive, non-empty `alt` text and explicit width/height dimensions.
+5. Print a structured pass/fail compliance checklist with file links.

package/templates/workflows/dpdp-audit.md

@@ -0,0 +1,20 @@
+---
+description: Audit forms for mandatory unticked DPDP checkboxes, policy links, and public footer address
+---
+
+# DPDP Act Compliance Audit Task
+
+1. **Form Consent Scan:**
+   - Search the workspace for all form components (`<form>`, `handleSubmit`, auth views).
+   - Verify every user-facing intake form includes an unticked `DPDPCheckbox`.
+   - Flag any form where the consent checkbox defaults to pre-checked (`checked={true}`).
+
+2. **Routing & Legal Page Verification:**
+   - Verify `/privacy`, `/terms`, and `/grievance` routes exist and render complete content.
+   - Confirm the grievance form includes data erasure/removal options.
+
+3. **Footer & Entity Identity Verification:**
+   - Inspect public footer templates to ensure a registered contact address and legal links are rendered.
+
+4. **Output Structured Report:**
+   - Print a pass/fail table of all scanned forms and views with exact file paths.

package/templates/workflows/dpdp-cookies.md

@@ -0,0 +1,19 @@
+---
+description: Scaffold interactive cookie consent banner and wire it to localStorage and telemetry gating
+---
+
+# DPDP / GDPR Cookie Consent Banner Task
+
+1. **Scaffold Banner Component (`src/components/common/CookieBanner.tsx`):**
+   - Design a fixed bottom modal or drawer responsive across desktop and mobile viewports.
+   - Include clear explanatory text regarding essential vs. non-essential analytics cookies.
+   - Provide explicit "Accept All", "Reject Non-Essential", and "Customize" action buttons.
+
+2. **State & Storage Binding:**
+   - Store user preference in `localStorage` under `dpdp_cookie_consent` (`"granted"` | `"denied"`).
+   - Ensure banner does not re-render if a valid preference is already stored.
+
+3. **Link to Telemetry Engine:**
+   - Connect the consent status to the telemetry gate (`src/lib/telemetry.ts`):
+     - If `"granted"`, initialize analytics and trigger pending page views.
+     - If `"denied"` or unselected, prevent any outbound tracking pings.

package/templates/workflows/dpdp-scaffold.md

@@ -0,0 +1,27 @@
+---
+description: Scaffold complete DPDP compliance pages (Privacy Policy, Terms, Grievance route) and Consent Checkbox component
+---
+
+# DPDP Legal Route & Component Scaffolding Task
+
+1. **Scaffold Shared Legal Views:**
+   - Inspect existing routing setup (`react-router-dom`, TanStack Router, etc.).
+   - Create or update the following views:
+     - `src/pages/legal/PrivacyPolicyView.tsx`: Comprehensive policy covering collection purposes, third-party services, retention windows, and user rights.
+     - `src/pages/legal/TermsView.tsx`: Standard platform terms, acceptable use, liability limits, and dispute jurisdiction.
+     - `src/pages/legal/GrievanceView.tsx`: Displays statutory Grievance Officer email/address with an interactive form containing action reasons:
+       - "Delete / Erase My Personal Data"
+       - "Rectify / Update Outdated Information"
+       - "Revoke Consent"
+       - "General Inquiry"
+
+2. **Scaffold Consent Checkbox Component:**
+   - Create `src/components/common/DPDPCheckbox.tsx`:
+     - Native `<input type="checkbox">` defaulted strictly to `checked={false}`.
+     - Descriptive label with clickable routing links to `/privacy` and `/terms`.
+     - Required validation hook integration (e.g., React Hook Form / Zod).
+
+3. **Verify Routing & Footer Links:**
+   - Register the three views in the main application router.
+   - Inject footer anchor links pointing to `/privacy`, `/terms`, and `/grievance`.
+   

package/templates/workflows/gen-conversion.md

@@ -0,0 +1,20 @@
+---
+description: Scaffold a dedicated Post-Conversion Thank You and confirmation view with analytics triggers
+---
+
+# Post-Conversion UI Scaffolding Task
+
+1. **Locate Target Feature Module:**
+   - Identify which feature or route requires the conversion transition (e.g., `features/checkout`, `features/auth`, or `features/lead-gen`).
+
+2. **Scaffold the Confirmation View (`ThankYouView.tsx`):**
+   - Place primary confirmation elements above the fold:
+     - Success confirmation banner/check animation.
+     - Dynamic transaction ID or account reference identifier.
+     - Clear summary of the user's action and explicit next steps.
+     - Primary and secondary navigation buttons (e.g., "Go to Dashboard", "Download Receipt").
+   - Ensure the layout is responsive and contains a sticky CTA bar on mobile screens.
+
+3. **Attach Analytics & State Handlers:**
+   - Inject an event dispatch hook for analytics tracking (reading track IDs conditionally from environment variables).
+   - Ensure back-button navigation is handled cleanly so users cannot accidentally re-submit the previous conversion form.

package/templates/workflows/gen-errors.md

@@ -0,0 +1,20 @@
+---
+description: Scaffold production-ready responsive UI routes for 404, 500, downtime, and redirect fallbacks
+---
+
+# Edge-Case UI Scaffolding Task
+
+1. **Verify Project Structure:**
+   - Inspect the current routing setup (`react-router-dom`, TanStack Router, etc.) to determine the routing convention.
+   - Identify the primary UI library/Tailwind tokens already configured in the workspace.
+
+2. **Generate Standardized View Templates:**
+   - Create or update the following dedicated route components inside the project's view/page directory:
+     - `NotFoundView.tsx` (Custom 404): Include a clear error statement, primary home button, search/navigation fallback, and an above-the-fold CTA.
+     - `ErrorBoundaryView.tsx` (Generic 500): Implement a React Error Boundary fallback view that captures crash metrics, presents a user-friendly error payload without leaking internal stack traces, and provides an immediate refresh/retry CTA.
+     - `MaintenanceView.tsx` (Downtime): Create a clean, static, standalone downtime splash view detailing service status and estimated recovery.
+     - `RedirectView.tsx`: Build an animated redirection interstitial component featuring a fallback link in case automatic redirection is delayed.
+
+3. **Enforce Responsive Layouts:**
+   - Ensure all scaffolded templates are fully responsive with sticky action buttons on mobile screens.
+   - Verify that all visual assets referenced have descriptive `alt` tags and contain no missing dependencies.

package/templates/workflows/gen-sitemap.md

@@ -0,0 +1,10 @@
+---
+description: Scan router tree and regenerate public/sitemap.xml and public/robots.txt
+---
+
+# Sitemap & Robots Generation Task
+
+1. Inspect router configuration to extract all public, indexable route paths.
+2. Exclude private routes, authenticated dashboards, API paths, and error fallback pages.
+3. Generate `public/sitemap.xml` conforming to standard Sitemaps XML protocol with current ISO timestamps.
+4. Generate `public/robots.txt` referencing the sitemap URL and blocking restricted directories.

package/templates/workflows/harden-headers.md

@@ -0,0 +1,13 @@
+---
+description: Scaffold and verify strict HTTP browser security headers
+---
+
+# Security Header Hardening Task
+1. Inspect the server or middleware layer (Node, Express, Hono, Edge functions).
+2. Configure standard defensive headers:
+   - `Content-Security-Policy` (CSP)
+   - `X-Frame-Options: DENY`
+   - `X-Content-Type-Options: nosniff`
+   - `Referrer-Policy: strict-origin-when-cross-origin`
+3. Ensure CORS policies resolve whitelisted origins dynamically from environment variables.
+   - `Strict-Transport-Security` (HSTS for HTTPS)

package/templates/workflows/open-graph.md

@@ -0,0 +1,19 @@
+---
+description: Generate optimized Open Graph preview assets (1200x630), favicons, and social cards
+---
+
+# Open Graph & Asset Generation Task
+
+1. **Context Ingestion:**
+   - Inspect user arguments passed to the command (e.g., `/open-graph generate images based on README and UI`).
+   - If no arguments are provided, read `README.md`, `package.json`, and the main landing page UI to determine app theme, brand name, primary colors, and tagline.
+
+2. **Asset Generation:**
+   - **Open Graph Social Card (1200x630):** Generate an SVG template incorporating brand title, category tag, product illustration/mockup layout, and tagline. Export or convert to high-contrast social image specifications.
+   - **Favicon Suite:** Generate `public/icon.svg` (scalable vector), `public/favicon.ico`, and `public/apple-touch-icon.png` (180x180) following the primary visual mark.
+
+3. **HTML Metadata Integration:**
+   - Ensure `index.html` (or the root `<head>` component) includes matching Open Graph tags:
+     - `og:image` pointing to the generated preview card.
+     - `og:image:width` (1200) and `og:image:height` (630).
+     - Standard favicon `<link rel="icon">` references.

package/templates/workflows/setup-pwa.md

@@ -0,0 +1,25 @@
+---
+description: Configure an offline-first Progressive Web App (PWA) with Service Worker, Web App Manifest, and Cache Storage
+---
+
+# Offline-First PWA Setup Task
+
+1. **Generate Web App Manifest:**
+   - Create `public/manifest.json` (or `manifest.webmanifest`) declaring:
+     - `name`, `short_name`, `theme_color`, and `background_color`.
+     - `display: "standalone"`, `start_url: "/"`, and `orientation: "portrait"`.
+     - Standard icon mappings for `192x192` and `512x512` resolutions.
+   - Link the manifest inside `index.html`.
+
+2. **Implement Service Worker & Offline Cache:**
+   - Create the Service Worker file (e.g., `public/sw.js` or via a Vite PWA plugin like `vite-plugin-pwa`).
+   - Configure cache versioning and implement Cache-First / Stale-While-Revalidate strategies for:
+     - Static assets (HTML, compiled CSS, JS chunks, and favicons).
+     - Standard offline application shell fallback.
+
+3. **Register Service Worker:**
+   - Create a registration utility (e.g., `src/utils/registerSW.ts`) that executes on window load.
+   - Add an update-detection event listener to notify the client when a new version of the app shell is waiting to activate.
+
+4. **Verify Offline Data Storage:**
+   - Ensure utilities are available to persist API data into `IndexedDB` when network calls fail, enabling offline-first browsing.

package/templates/workflows/setup-telemetry.md

@@ -0,0 +1,10 @@
+---
+description: Scaffold type-safe analytics taxonomy, consent gate, and SPA route change listeners
+---
+
+# Telemetry Setup Task
+
+1. Create `src/types/telemetry.types.ts` defining strict event unions without PII.
+2. Scaffold `src/lib/telemetry.ts` with runtime environment checks (suppressing pings on localhost).
+3. Bind consent-checking middleware so events drop silently until consent is granted.
+4. Inject an SPA route observer into the top-level router to trigger virtual page views on route changes.

package/templates/workflows/task-sync.md

@@ -0,0 +1,30 @@
+---
+description: Scan codebase against rules/ and specs, initialize .pending-tasks/, and synchronize checklist.md
+---
+
+# Task Synchronization & Audit Task
+
+1. **Initialize Task Storage:**
+   - Verify if `.pending-tasks/` directory exists. If not, create it.
+   - Verify if `.pending-tasks/checklist.md` exists. If not, initialize with standard category headers:
+     - `## Core & Types`
+     - `## API & Backend`
+     - `## Security & Validation`
+     - `## Frontend & UI States`
+     - `## SEO & Analytics`
+     - `## Compliance & Legal`
+
+2. **Audit Workspace Compliance:**
+   - Inspect recent changes against active rule files in `rules/`.
+   - Scan for:
+     - Missing error boundaries or fallback views (`404`, `500`)
+     - Missing `alt` attributes or uncompressed assets
+     - Routes missing meta titles, descriptions, or canonical tags
+     - Unused or loose `any` types in `.types.ts`
+     - Pending OpenSpec changes (`openspec/changes/`)
+     - Pending security checks: unhardened headers (run `/harden-headers`) or unverified dependencies (run `/audit-security`)
+
+3. **Update `.pending-tasks/checklist.md`:**
+   - Append newly identified gaps under appropriate category headers.
+   - Retain existing tasks; do not overwrite in-progress items.
+   - Display a concise markdown summary in chat: total pending items, high-priority count, and next suggested action.