agent-enderun 1.10.4 → 1.11.0

package/src/cli/utils/pkg.ts

@@ -1,6 +1,6 @@
 import fs from "fs";
 import path from "path";
-import { writeTextFile, writeJsonFile } from "./fs.js";
+import { writeJsonFile, writeTextFile } from "./fs.js";
 
 export function getPackageVersion() {
     const root = getPackageRoot();
@@ -21,7 +21,7 @@ export function getPackageManager() {
     // Check for lockfiles in target directory
     if (fs.existsSync(path.join(process.cwd(), "pnpm-lock.yaml")) || fs.existsSync(path.join(process.cwd(), "pnpm-workspace.yaml"))) return "pnpm";
     if (fs.existsSync(path.join(process.cwd(), "yarn.lock"))) return "yarn";
-  
+
     return "npm";
 }
 
@@ -74,28 +74,57 @@ export function getDependencyVersions() {
     const dependencies = pkg.dependencies || {};
 
     return {
-        // Backend dependencies
+        // ── Backend Core ──────────────────────────────────────────
         "fastify": dependencies["fastify"] || "^5.0.0",
         "@fastify/cors": dependencies["@fastify/cors"] || "^11.0.0",
+        "@fastify/swagger": dependencies["@fastify/swagger"] || "^9.0.0",
+        "@fastify/swagger-ui": dependencies["@fastify/swagger-ui"] || "^5.0.0",
+        "@fastify/rate-limit": dependencies["@fastify/rate-limit"] || "^10.0.0",
+        "@fastify/static": dependencies["@fastify/static"] || "^8.0.0",
         "zod": dependencies["zod"] || "^3.24.2",
 
+        // ── Database / ORM ────────────────────────────────────────
+        "kysely": dependencies["kysely"] || "^0.27.0",
+        "typeorm": dependencies["typeorm"] || "^0.3.0",
+        "reflect-metadata": dependencies["reflect-metadata"] || "^0.2.0",
+        "pg": dependencies["pg"] || "^8.13.0",
+        "better-sqlite3": dependencies["better-sqlite3"] || "^11.0.0",
+
+        // ── Authentication ────────────────────────────────────────
+        "bcrypt": dependencies["bcrypt"] || "^5.1.0",
+        "@types/bcrypt": devDependencies["@types/bcrypt"] || "^5.0.0",
+        "jsonwebtoken": dependencies["jsonwebtoken"] || "^9.0.0",
+        "@types/jsonwebtoken": devDependencies["@types/jsonwebtoken"] || "^9.0.0",
+
+        // ── Logging ───────────────────────────────────────────────
+        "pino": dependencies["pino"] || "^9.0.0",
+        "pino-pretty": devDependencies["pino-pretty"] || "^12.0.0",
+
+        // ── Validation ────────────────────────────────────────────
+        "@fastify/type-provider-typebox": dependencies["@fastify/type-provider-typebox"] || "^5.0.0",
+
         // Backend devDependencies
         "@types/node": devDependencies["@types/node"] || "^22.13.4",
         "tsx": devDependencies["tsx"] || "^4.19.4",
         "typescript": devDependencies["typescript"] || "^5.9.3",
-        "vitest-backend": devDependencies["vitest"] || "^3.0.5", // Renamed to avoid conflict
+        "vitest-backend": devDependencies["vitest"] || "^3.0.5",
 
-        // Frontend dependencies
+        // ── Frontend Core ─────────────────────────────────────────
         "@vitejs/plugin-react": dependencies["@vitejs/plugin-react"] || "^5.0.0",
         "vite": dependencies["vite"] || "^7.0.0",
         "react": dependencies["react"] || "^19.0.0",
         "react-dom": dependencies["react-dom"] || "^19.0.0",
         "lucide-react": dependencies["lucide-react"] || "^0.468.0",
-        
+        "react-router-dom": dependencies["react-router-dom"] || "^7.0.0",
+        "@tanstack/react-query": dependencies["@tanstack/react-query"] || "^5.0.0",
+
         // Frontend devDependencies
         "@types/react": devDependencies["@types/react"] || "^19.0.0",
         "@types/react-dom": devDependencies["@types/react-dom"] || "^19.0.0",
-        "vitest-frontend": devDependencies["vitest"] || "^3.0.5", // Renamed to avoid conflict
+        "vitest-frontend": devDependencies["vitest"] || "^3.0.5",
+
+        // ── Testing ───────────────────────────────────────────────
+        "@playwright/test": devDependencies["@playwright/test"] || "^1.50.0",
     };
 }
 
@@ -113,7 +142,7 @@ interface PackageJson {
   }
 
 export function mergePackageJson(targetPath: string, sourcePath: string): void {
-    let targetPkg: PackageJson = {}; 
+    let targetPkg: PackageJson = {};
     if (fs.existsSync(targetPath)) {
         try {
             targetPkg = JSON.parse(fs.readFileSync(targetPath, "utf8"));
@@ -123,7 +152,7 @@ export function mergePackageJson(targetPath: string, sourcePath: string): void {
     }
 
     const sourcePkg: PackageJson = JSON.parse(fs.readFileSync(sourcePath, "utf8"));
-  
+
   type PackageMap = Record<string, string>;
   const sanitizeDeps = (deps: PackageMap | Record<string, unknown> | undefined): Record<string, string> | undefined => {
       if (!deps) return deps as undefined;
@@ -159,7 +188,7 @@ export function mergePackageJson(targetPath: string, sourcePath: string): void {
   // Merge scripts
   const pkgMgr = getPackageManager();
   const runCmd = pkgMgr === "yarn" ? "yarn" : (pkgMgr === "pnpm" ? "pnpm" : "npm run");
-  
+
   targetPkg.scripts = {
       ...targetPkg.scripts,
       "enderun:status": "agent-enderun status",
@@ -242,12 +271,12 @@ export function sanitizeJson(obj: unknown, targetScope = ""): unknown {
             if (typeof value === "string" && value.startsWith("agent-enderun-")) {
                 finalValue = value.replace("agent-enderun-", `${scopeName}-`);
             }
-      
+
             // Handle agent-enderun -> target (ONLY for the package name)
             if (key === "name" && value === "agent-enderun") {
                 finalValue = scopeName;
             }
-      
+
             // Preserve agent-enderun in dependencies and bin
             // (No action needed as finalKey/finalValue default to original)
 
@@ -265,7 +294,7 @@ export function sanitizeJson(obj: unknown, targetScope = ""): unknown {
 
 export function deepCleanProtocols(dir: string, targetScope = ""): void {
     if (!fs.existsSync(dir)) return;
-  
+
     const entries = fs.readdirSync(dir, { withFileTypes: true });
     for (const entry of entries) {
         const fullPath = path.join(dir, entry.name);

package/src/modules/agents/registry/analyst.ts

@@ -10,7 +10,7 @@ export const analyst: AgentDefinition = {
   "Specs verification and Contract Audit specialist. " +
   "Audits truth and contracts within the Army.",
     capability: 9,
-    tier: "core",
+    tier: "recon",
     tags: ["core", "strategy"],
     stateMachine: STATE_MACHINE,
     tools: [

package/src/modules/agents/registry/backend.ts

@@ -28,20 +28,21 @@ export const backend: AgentDefinition = {
     instructions: {
         identity: "Backend Domain Engineer and Database Management Owner",
         mission:
-    "Deliver reliable, type-safe server logic that upholds Kysley-only " +
+    "Deliver reliable, type-safe server logic that upholds Kysely/TypeORM " +
     "data access and strict repository/service separation.",
         chainOfThought: "1. Analyze: Read the task, context, and relevant governance documents.\n" +
                         "2. Validate: Cross-reference with project rules, contracts, and architecture standards.\n" +
                         "3. Plan: Break down the task into small, atomic, and verifiable steps.\n" +
                         "4. Execute: Perform the task using approved tools, adhering to quality and security constraints.",
         rules: [
-            "BRANDED TYPES: Use branded types for all domain IDs — never raw string or number.",
-            "KYSELY ONLY: All database access via Kysely — raw SQL strings are unconditionally forbidden.",
+            "STRICT BRANDED TYPES: Absolute enforcement of branded types for ALL domain IDs (e.g., UserId, ProjectId). Raw 'string' or 'number' for IDs is a Nizam violation and will cause task rejection.",
+            "KYSELY ONLY: All database access via Kysely — raw SQL strings are unconditionally forbidden. No exceptions.",
             "LAYER SEPARATION: Isolate queries in repository/service layers — direct DB calls in controllers are forbidden.",
             "ERROR HANDLING: Wrap all async logic in robust try/catch blocks with typed error responses.",
+            "PII PROTECTION: Never log or store real user data. Use anonymized hashes for debugging tasks.",
             "HIGH-RISK OPS: Refuse User/Role management, bulk deletes, schema alterations, and billing changes autonomously. " +
       "Return a standard refusal, send a managerApproval request to @manager, and shift to WAITING status.",
         ],
-        knowledgeFiles: ["crud-governance.md"],
+        knowledgeFiles: ["crud-governance.md", "kysely-standards.md", "typeorm-standards.md"],
     },
 };

package/src/modules/agents/registry/database.ts

@@ -21,6 +21,7 @@ export const database: AgentDefinition = {
         "list_dir",
         "grep_search",
         "read_project_memory",
+        "send_agent_message",
     ],
     instructions: {
         identity: "Database Architect and Migration Integrity Owner",
@@ -37,6 +38,6 @@ export const database: AgentDefinition = {
             "DETERMINISTIC MIGRATIONS: Every migration must be reversible and produce identical results across environments.",
             "PERFORMANCE FIRST: Design indexes proactively — never retroactively after a performance incident.",
         ],
-        knowledgeFiles: ["performance-standards.md", "quality-standards.md"],
+        knowledgeFiles: ["kysely-standards.md", "typeorm-standards.md", "quality-standards.md"],
     },
 };

package/src/modules/agents/registry/git.ts

@@ -10,7 +10,7 @@ export const git: AgentDefinition = {
   "Git flow, Branching, and Atomic Commit master. " +
   "Manages the scrolls of history.",
     capability: 9,
-    tier: "core",
+    tier: "recon",
     tags: ["core", "logistics"],
     stateMachine: STATE_MACHINE,
     tools: [

package/src/modules/agents/registry/manager.ts

@@ -40,8 +40,9 @@ export const manager: AgentDefinition = {
                         "4. Execute: Delegate sub-tasks to appropriate specialists and verify compliance at each step.",
         rules: [
             "ABSOLUTE COMPLIANCE: Freeze project and block task on any Nizam violation " +
-      "(e.g. 'any' type, 'console.log', file overwrite). No further action until breach is purged.",
-            "PHASE WALL: Gate every phase transition — reject if even one TODO or lint error exists in scope.",
+      "(e.g. 'any' type, 'console.log', PII leakage, or raw ID usage). No further action until breach is purged.",
+            "PII AUDIT: Proactively scan all specialist logs and memories for PII (Emails, Names). Purge immediately if detected.",
+            "PHASE WALL: Gate every phase transition — reject if even one TODO, lint error, or unbranded ID exists in scope.",
             "ORCHESTRATION AUDIT: Audit every specialist message for constitutional compliance before delegating next sub-task.",
             "STRATEGIC RECIPES: Direct specialists to '.enderun/prompts/' for all refactor, bug-fix, or feature tasks.",
             "SURGICAL PRECISION: Reject any full-file overwrite proposal unless the file is under 50 lines.",

package/src/modules/agents/registry/native.ts

@@ -10,7 +10,7 @@ export const native: AgentDefinition = {
   "Desktop apps and system-level logic specialist. " +
   "Handles OS deep layers with paramount security.",
     capability: 9,
-    tier: "core",
+    tier: "recon",
     tags: ["core", "native"],
     stateMachine: STATE_MACHINE,
     tools: [

package/src/modules/agents/registry/security.ts

@@ -17,6 +17,7 @@ export const security: AgentDefinition = {
         "read_file",
         "replace_text",
         "grep_search",
+        "send_agent_message",
         "read_project_memory",
         "get_memory_insights",
         "log_agent_action",

package/templates/prompts/bug-fix-recipe.md

@@ -0,0 +1,20 @@
+# 🐞 Scientific Debugging (Bug-Fix) Recipe
+
+This recipe defines how to autonomously detect and permanently resolve a bug.
+
+## 1. Reproduction
+- Analyze the logs (`audit_log.md`) that reported the error.
+- Write the smallest test case (failing test) that triggers the error.
+
+## 2. Root Cause Analysis
+- Check system resources with `get_system_health`.
+- Verify the status of services with `check_active_ports`.
+- Examine relevant code blocks line by line using `read_file`.
+
+## 3. Surgical Fix
+- Perform only the surgical intervention that will fix the error.
+- Check if there is a missing variable in ".env".
+
+## 4. Permanent Solution
+- Verify that the test you wrote passes.
+- If `quality-standards.md` needs to be updated to prevent similar errors, submit a proposal.

package/templates/prompts/contract-design-recipe.md

@@ -0,0 +1,21 @@
+# 📜 Engineering Recipe: Contract-First Design
+
+This recipe governs the @architect agent's protocol for creating type-safe agreements between system layers.
+
+## 🏁 Phase 1: Requirement Alignment
+1.  **Analysis:** Read user requirements and Business Analyst (@analyst) reports.
+2.  **Scope Discovery:** Identify the domain objects, actions, and events required for the feature.
+
+## 📐 Phase 2: Technical Modeling
+1.  **Branded Types:** Define semantic IDs in `src/types/brands.ts` (e.g., `OrderId`, `ProductSKU`).
+2.  **Domain Models:** Create or update interfaces in `src/types/models.ts`. Ensure they extend `BaseEntity`.
+3.  **Constants:** Update `src/types/constants.ts` for enums and fixed state values.
+
+## 🔏 Phase 3: Hash Sealing
+1.  **Integrity Check:** Run `agent-enderun verify-contract` to check existing state.
+2.  **Commitment:** Run `agent-enderun update-contract` to generate new SHA-256 signatures for the updated types.
+3.  **Audit:** Verify that `contract.version.json` accurately reflects the new architecture.
+
+## 📡 Phase 4: Synchronization
+1.  **Distribution:** Ensure the updated `src/types` directory is correctly linked or copied to both Frontend and Backend projects.
+2.  **Verification:** Trigger @backend and @frontend agents to read the new contract and plan their implementations.

package/templates/prompts/db-management-recipe.md

@@ -0,0 +1,25 @@
+# 🗄️ Engineering Recipe: Database Management & Migrations
+
+This recipe governs the @database agent's protocol for schema creation, table modifications, and data integrity.
+
+## 📐 Phase 1: Contract-First Definition
+1.  **Type Mapping:** Define the new table or column in `src/types/models.ts` using Branded Types for IDs.
+2.  **Validation:** Ensure the interface extends `BaseEntity` (id, createdAt, updatedAt).
+
+## 🚀 Phase 2: Migration Generation
+1.  **Scripting:** Write a reversible migration (up/down) using the project's migration tool (e.g., Kysely or SQL).
+2.  **Atomic Changes:** One migration per logical feature. Never bundle unrelated schema changes.
+3.  **Naming:** Use timestamp-prefixed naming (e.g., `20240101_add_customers_table.ts`).
+
+## 🧱 Phase 3: Infrastructure Setup (If New DB)
+1.  **Initialization:** Verify the connection string in `.env`.
+2.  **Health Check:** Run `check_active_ports` to ensure the DB engine is reachable.
+
+## 🛠️ Phase 4: Implementation & Repository Update
+1.  **Repo Layer:** Create or update the Repository class to include the new query logic.
+2.  **Strict Mode:** Ensure no raw SQL is used; leverage the query builder exclusively.
+
+## ✅ Phase 5: Verification & Zero-Downtime Audit
+1.  **Dry Run:** If supported, dry-run the migration to check for locking issues.
+2.  **Validation:** Run `agent-enderun verify-contract` to ensure code and schema are synced.
+3.  **Handoff:** Update `PROJECT_MEMORY.md` with the new schema version.

package/templates/prompts/deployment-recipe.md

@@ -0,0 +1,23 @@
+# 🚀 Engineering Recipe: Infrastructure Deployment
+
+This recipe governs the @devops agent's protocol for safe, traceable, and reversible system rollouts.
+
+## 🏁 Phase 1: Pre-Deployment Environment Audit
+1.  **Integrity Check:** Run `agent-enderun check` to ensure all discipline rules are met.
+2.  **Health Scan:** Execute `get_system_health` and `check_active_ports` on the target environment.
+3.  **Config Sync:** Verify that all keys in `.env.example` are present in the target environment's secrets manager.
+
+## 🧱 Phase 2: Build & Validation
+1.  **Compilation:** Run `npm run build` and capture any stderr.
+2.  **Contract Verify:** Run `agent-enderun verify-contract` to ensure FE/BE synchronization.
+3.  **Test Suite:** Execute the full test battery. Failure in a single test blocks deployment.
+
+## 📡 Phase 3: Controlled Rollout
+1.  **Atomic Swap:** Deploy the new bundle/service using the project's orchestration scripts.
+2.  **Database Sync:** If migrations are pending, follow the `db-management-recipe.md` first.
+3.  **Log Monitoring:** Tail `logs/manager.json` for immediate post-deploy spikes in errors.
+
+## ✅ Phase 4: Post-Deploy & Rollback Readiness
+1.  **Observability:** Verify system metrics stabilize within 5 minutes.
+2.  **Traceability:** Record the deployment Trace ID and commit hash in `PROJECT_MEMORY.md`.
+3.  **Rollback Check:** Ensure the previous stable version is tagged and reachable in Git.

package/templates/prompts/new-feature-recipe.md

@@ -0,0 +1,19 @@
+# ✨ New Feature Development Recipe
+
+The "Nizam-ı Enderun" steps to follow when adding a new module or feature.
+
+## 1. Contract Design (Phase 1)
+- First, update the `contract.version.json` file and the relevant TypeScript types.
+- Do not start writing code without getting approval from `@architect`.
+
+## 2. Mock-Free Development (Phase 2)
+- Add the new feature to the correct directory under `apps/backend` or `apps/web`.
+- If database changes are required, coordinate with the `@database` agent.
+
+## 3. Responsive & i18n (Phase 3)
+- Use `{ base: '...', md: '...' }` responsive syntax in frontend developments.
+- Move all texts to the `locales/` directory immediately.
+
+## 4. Completion (Phase 4)
+- Ensure no TODOs remain using `get_project_gaps`.
+- Verify that you haven't created any new package pollution with `audit_dependencies`.

package/templates/prompts/performance-optimization-recipe.md

@@ -0,0 +1,23 @@
+# ⚡ Engineering Recipe: Performance Optimization
+
+This recipe governs the protocol for identifying and resolving system bottlenecks (Frontend, Backend, or Database).
+
+## 📊 Phase 1: Profiling & Bottleneck Identification
+1.  **Metric Collection:** Read `observability/metrics.json` or run `get_system_health`.
+2.  **Log Audit:** Scan `logs/manager.json` for slow actions or timeouts.
+3.  **Trace Analysis:** Use `TraceID` to follow a slow request through all layers.
+
+## 🧠 Phase 2: Root Cause Analysis
+1.  **SQL Audit:** Check for N+1 query patterns or missing indexes in `repository/` files.
+2.  **Algorithm Audit:** Scan for O(n²) loops or heavy synchronous operations.
+3.  **Frontend Audit:** Check for unnecessary re-renders or massive bundle sizes.
+
+## 🛠️ Phase 3: Surgical Optimization
+1.  **DB Level:** Add missing indexes or refactor complex joins.
+2.  **Logic Level:** Implement caching (e.g., Redis or in-memory) for frequent read operations.
+3.  **UI Level:** Apply memoization, virtualization (FlashList), or code-splitting.
+
+## ✅ Phase 4: Validation & Comparison
+1.  **Benchmarking:** Re-run the action and compare new metrics with the baseline.
+2.  **Regression Check:** Run `agent-enderun check` and existing tests to ensure logic is intact.
+3.  **Knowledge Update:** Record the optimization strategy in `knowledge/performance-history.md`.

package/templates/prompts/pull-request-template.md

@@ -0,0 +1,21 @@
+# 📦 Pull Request Title: [TRC-{TraceId}] Brief Description
+
+## 📝 Summary
+<!-- What did you change and why? -->
+
+## 🔗 Related Tasks
+- **Trace ID:** [Link to Trace/Task or ID]
+- **Issue:** [Link to issue if applicable]
+
+## 🛡️ Governance & Compliance Checklist
+- [ ] Code passes `npm run enderun:test`.
+- [ ] Code passes `npm run enderun:check` (Compliance Scanner).
+- [ ] No `any` type usage added.
+- [ ] No secrets or hardcoded API keys.
+- [ ] New functionality is registered in `src/modules/agents/definitions.ts` (if applicable).
+
+## 🧪 Testing Notes
+<!-- How did you verify the fix? -->
+
+## 🛠️ Risk Assessment
+<!-- Any potential side effects? -->

package/templates/prompts/refactoring-recipe.md

@@ -0,0 +1,21 @@
+# 🛠️ Surgical Refactoring Recipe
+
+This recipe defines how to modernize existing code without breaking other parts of the project.
+
+## 1. Reconnaissance
+- Use `grep_search` to find all references to the function to be refactored.
+- Understand the module's dependency graph with `get_project_map`.
+- Verify the baseline by running existing tests (`run_tests`).
+
+## 2. Planning (Strategy)
+- Break the change into small, atomic steps.
+- Define new types and interfaces first.
+
+## 3. Surgical Execution
+- **RULE:** Never delete a file completely. Only use `replace_text` or `batch_surgical_edit`.
+- Maintain type safety (ban on `any`) at every step.
+- Update `PROJECT_MEMORY.md` after every major change.
+
+## 4. Validation
+- Ensure no regressions occurred using `run_tests`.
+- Audit code quality with the `@quality` agent.

package/templates/prompts/security-audit-recipe.md

@@ -0,0 +1,20 @@
+# 🛡️ Engineering Recipe: Advanced Security Audit
+
+This recipe governs the @security agent's protocol for identifying and mitigating vulnerabilities within the Agent Enderun framework.
+
+## 🏁 Phase 1: Automated Reconnaissance
+1.  **Secret Scan:** Run `grep_search` for keywords: `apiKey`, `secret`, `password`, `token`, `private_key`.
+2.  **SQL Injection Audit:** Scan for `raw SQL` or template literals bypassing the query builder.
+3.  **Auth Check:** Verify that all sensitive routes have active `auth` guards and Role-Based Access Control (RBAC).
+
+## 🧠 Phase 2: Contextual Analysis
+1.  **Impact Mapping:** For every identified risk, read the surrounding code to determine if it's exposed to the public internet.
+2.  **Configuration Check:** Verify `.env.example` contains all required keys and no real secrets are committed to Git.
+
+## 🛠️ Phase 3: Surgical Mitigation
+1.  **Fix:** Use `replace_text` to move hardcoded secrets to `.env` or refactor raw SQL to Kysely.
+2.  **Sanitization:** Apply input validation using Zod schemas for all external data.
+
+## ✅ Phase 4: Verification & Logging
+1.  **Discipline Check:** Run `agent-enderun check` to ensure no new violations were introduced.
+2.  **Action Log:** Execute `log_agent_action` with a summary of found vs. fixed vulnerabilities.

package/templates/standards/architecture-standards.md

@@ -0,0 +1,23 @@
+# 📐 Corporate Architecture Standards (AL Framework)
+
+This project is developed in accordance with the "Nizam-ı Mimari" (Architectural Order) rules defined by Agent Enderun.
+
+## 1. Directory Structure (Monorepo Standard)
+- `apps/backend/`: Business logic, API, and database layers.
+- `apps/web/`: Frontend (React/Next.js) layer.
+- `packages/shared/`: Type definitions and helpers shared between Backend and Frontend.
+
+## 2. Layered Architecture
+All business logic must follow this hierarchy:
+1. **Routes/Controllers:** API entry points and request validation.
+2. **Services:** Where business logic is coordinated.
+3. **Repositories/Models:** Database access and raw data mutations.
+
+## 3. Type Safety and Contracts
+- The hash in the `contract.version.json` file must always match the active code.
+- The use of the `any` type is strictly forbidden.
+- All asynchronous operations must be wrapped in `try-catch` blocks and proper error management (ErrorHandler).
+
+## 4. AL (Agent Lifecycle) Phase Discipline
+- Development progresses sequentially from Phase 0 to Phase 4.
+- Application code (Phase 2) cannot be written before contracts are approved (Phase 1).

package/templates/standards/auth-standards.md

@@ -0,0 +1,125 @@
+# Authentication & Authorization Standards
+
+> JWT + bcrypt authentication and role-based access control for Fastify APIs.
+
+## Overview
+
+Enterprise-grade authentication system using JSON Web Tokens (JWT) for stateless authentication and bcrypt for secure password hashing.
+
+## Setup
+
+```bash
+# Required dependencies
+npm install bcrypt jsonwebtoken
+npm install -D @types/bcrypt @types/jsonwebtoken
+```
+
+## Token Management
+
+```typescript
+import jwt from "jsonwebtoken";
+
+const JWT_SECRET = process.env.JWT_SECRET || "change-me-in-production";
+const JWT_EXPIRES_IN = process.env.JWT_EXPIRES_IN || "24h";
+
+interface AuthPayload {
+  sub: string;     // User ID
+  email: string;   // User email
+  role: string;    // User role (ADMIN, DEVELOPER, VIEWER)
+  iat?: number;    // Issued at
+  exp?: number;    // Expires at
+}
+
+export function generateToken(payload: AuthPayload): string {
+    return jwt.sign(payload, JWT_SECRET, { expiresIn: JWT_EXPIRES_IN });
+}
+
+export function verifyToken(token: string): AuthPayload {
+    return jwt.verify(token, JWT_SECRET) as AuthPayload;
+}
+```
+
+## Middleware
+
+```typescript
+import type { FastifyRequest, FastifyReply } from "fastify";
+
+export async function authenticate(
+    request: FastifyRequest,
+    reply: FastifyReply,
+): Promise<void> {
+    const authHeader = request.headers.authorization;
+    if (!authHeader?.startsWith("Bearer ")) {
+        throw new UnauthorizedError("Missing authorization header");
+    }
+    const token = authHeader.slice(7);
+    const payload = verifyToken(token);
+    (request as any).user = payload;
+}
+
+export function requireRole(...roles: string[]) {
+    return async (request: FastifyRequest, reply: FastifyReply) => {
+        const user = (request as any).user as AuthPayload;
+        if (!user || !roles.includes(user.role)) {
+            throw new ForbiddenError("Insufficient permissions");
+        }
+    };
+}
+```
+
+## Password Security
+
+```typescript
+import bcrypt from "bcrypt";
+
+const SALT_ROUNDS = 12;
+
+// Hash password for storage
+export async function hashPassword(password: string): Promise<string> {
+    return bcrypt.hash(password, SALT_ROUNDS);
+}
+
+// Verify password against hash
+export async function verifyPassword(
+    password: string,
+    hash: string,
+): Promise<boolean> {
+    return bcrypt.compare(password, hash);
+}
+```
+
+## CRUD Governance Integration
+
+Admin-level mutations (user creation, role changes, schema modifications) **MUST** follow the CRUD Governance protocol:
+- Route through `@manager` for approval
+- Require human sign-off via `agent-enderun approve <traceId>`
+- Log all authorization decisions
+
+## API Endpoints
+
+| Method | Path | Auth Required | Role Required | Description |
+|--------|------|:------------:|:------------:|-------------|
+| POST | `/api/v1/auth/register` | No | No | Create new user |
+| POST | `/api/v1/auth/login` | No | No | Login & get token |
+| GET | `/api/v1/auth/me` | Yes | No | Get current user |
+| PUT | `/api/v1/auth/password` | Yes | No | Change password |
+
+## Environment Variables
+
+```bash
+JWT_SECRET=your-secret-key-at-least-32-chars-long
+JWT_EXPIRES_IN=24h
+```
+
+## Best Practices
+
+1. **Password Hashing**: Always use bcrypt with minimum 12 salt rounds
+2. **Token Expiry**: Use short-lived tokens (24h max). Implement refresh tokens for longer sessions
+3. **Secret Rotation**: Rotate JWT_SECRET periodically in production
+4. **Rate Limiting**: Apply rate limiting on login/register endpoints to prevent brute force
+5. **HTTPS Only**: Never transmit tokens over unencrypted connections
+6. **Password Strength**: Enforce minimum password requirements (8+ chars, mixed case, numbers)
+7. **Audit Logging**: Log all authentication attempts (success/failure) for security monitoring
+8. **No Plain Text**: Never log or store passwords in plain text
+9. **Token Storage**: Store tokens securely (httpOnly cookies for web, secure storage for mobile)
+10. **Role Hierarchy**: ADMIN > MANAGER > DEVELOPER > VIEWER — validate permissions at each level

package/templates/standards/crud-governance.md

@@ -0,0 +1,21 @@
+# 🏛️ Corporate CRUD and Governance Standards
+
+This document defines the strict rules applicable to data mutation and administrative operations in projects managed by the Agent Enderun army.
+
+## 1. High-Risk Operations
+The following operations are considered "High-Risk" and cannot be performed autonomously by specialist agents (@backend, @database, etc.):
+- Database schema changes (DDL).
+- Bulk data deletion or purging (Bulk Delete/Purge).
+- User authorization and role assignment systems.
+- Payment system (Billing) integrations.
+- PII (Personal Data) export.
+
+## 2. Approval Flow
+- When a specialist agent receives a high-risk operation request, they must reject the operation and report the status to `@manager`.
+- `@manager` analyzes the request and creates a task awaiting `managerApproval`.
+- The operation is held until a human overseer (Human-in-the-Loop) grants approval via the `agent-enderun approve [TraceID]` command.
+
+## 3. Data Discipline
+- **Branded Types:** All IDs (UserID, OrderID, etc.) must strictly follow the branded types format.
+- **Kysely Only:** Raw SQL queries are forbidden. Only the type-safe Kysely query builder may be used.
+- **Repository Pattern:** Database operations cannot be performed directly within controllers; they must pass through the service and repository layers.

package/templates/standards/deployment-standards.md

@@ -0,0 +1,21 @@
+# 🚀 Deployment and Release Standards
+
+This document outlines the protocols for deploying, updating, and rolling back services managed by Agent Enderun.
+
+## 1. Release Strategy
+- **Version Control:** All releases must follow Semantic Versioning (SemVer) and be tagged in Git with the format `vX.Y.Z`.
+- **Atomic Commits:** Each deployment must be linked to a specific Git commit, which itself must contain a `Trace ID` in the commit message.
+
+## 2. Deployment Workflow
+- **CI/CD Integration:** Every deployment must pass the `npm run enderun:test` and `npm run enderun:check` pipeline.
+- **Environment Isolation:** Deployments must use environment-specific configurations (.env.{env}) and never cross-pollinate variables.
+
+## 3. Rollback Procedures (The Hermes Safety Valve)
+- **Immediate Rollback:** If a deployment causes an escalation alert from an agent or a production failure, a rollback must be initiated within 5 minutes.
+- **Git Revert Strategy:** 
+    - Rollbacks are executed by checking out the previous stable tag (e.g., `git checkout v1.0.9`).
+    - A "Fix-Forward" approach is only allowed for P0 security patches; otherwise, "Revert-First" is the law.
+- **Database Safety:** 
+    - Every Migration script must strictly include a corresponding `down()` or `revert()` path.
+    - Database rollbacks must be tested in the staging environment before production execution.
+- **Post-Mortem Requirement:** Every rollback triggers an automatic `@manager` task to create a `docs/post-mortems/TRACE_ID.md` report.