agent-skill-kit 3.9.135

package/.agent/skills/vercel-deploy/scripts/deploy.sh

@@ -0,0 +1,310 @@
+#!/bin/bash
+
+# Vercel Deployment Script — Zero-Auth Deploy
+# Version: 2.0.0
+# Contract: vercel-deploy v2.0.0
+# See: references/engineering-spec.md
+# Skill: vercel-deploy
+#
+# Package → Detect Framework → Upload → Preview URL + Claim URL
+#
+# Usage: bash deploy.sh [path] [options]
+# Returns: JSON with previewUrl, claimUrl, deploymentId, projectId
+
+VERSION="2.0.0"
+DEPLOY_ENDPOINT="https://claude-skills-deploy.vercel.com/api/deploy"
+UPLOAD_TIMEOUT=300  # seconds
+MAX_RETRIES=1       # 1 retry on timeout (per SKILL.md)
+
+set -e
+
+# --- Help ---
+if [[ "$1" == "--help" || "$1" == "-h" ]]; then
+    cat <<EOF
+
+Vercel Deploy v${VERSION}
+
+Usage:
+  bash deploy.sh [path]            Deploy directory to Vercel
+  bash deploy.sh file.tgz          Deploy existing tarball
+  bash deploy.sh --help            Show this help
+
+Arguments:
+  path    Directory or .tgz file (default: current directory)
+
+What it does:
+  1. Check prerequisites (bash, tar, curl)
+  2. Package project (exclude node_modules, .git, .env*, dist, .next)
+  3. Detect framework from package.json (40+ frameworks)
+  4. Upload to Vercel → get preview URL + claim URL
+
+Output (JSON to stdout):
+  {
+    "previewUrl": "https://skill-deploy-abc123.vercel.app",
+    "claimUrl": "https://vercel.com/claim-deployment?code=...",
+    "deploymentId": "dpl_...",
+    "projectId": "prj_..."
+  }
+
+Exit Codes:
+  0  SUCCESS  — Deployed, URL returned
+  1  ERROR    — Deployment failed
+
+EOF
+    exit 0
+fi
+
+if [[ "$1" == "--version" || "$1" == "-v" ]]; then
+    echo "Vercel Deploy v${VERSION}"
+    exit 0
+fi
+
+# --- Prerequisite Check ---
+check_prereqs() {
+    local missing=()
+    for cmd in tar curl; do
+        if ! command -v "$cmd" &>/dev/null; then
+            missing+=("$cmd")
+        fi
+    done
+
+    if [ ${#missing[@]} -gt 0 ]; then
+        emit_error "ERR_MISSING_PREREQ" "Missing required commands: ${missing[*]}. Install them and retry." >&2
+        exit 1
+    fi
+}
+
+# --- Structured JSON Error Output ---
+emit_error() {
+    local code="$1"
+    local message="$2"
+    echo "{\"success\":false,\"error\":{\"code\":\"$code\",\"message\":\"$message\",\"recoverable\":true}}" >&2
+}
+
+check_prereqs
+
+# --- Framework Detection ---
+detect_framework() {
+    local pkg_json="$1"
+
+    if [ ! -f "$pkg_json" ]; then
+        echo "null"
+        return
+    fi
+
+    local content=$(cat "$pkg_json")
+
+    has_dep() {
+        echo "$content" | grep -q "\"$1\""
+    }
+
+    # Order matters — check more specific frameworks first
+
+    # Meta-frameworks
+    if has_dep "blitz"; then echo "blitzjs"; return; fi
+    if has_dep "next"; then echo "nextjs"; return; fi
+    if has_dep "gatsby"; then echo "gatsby"; return; fi
+    if has_dep "@remix-run/"; then echo "remix"; return; fi
+    if has_dep "@react-router/"; then echo "react-router"; return; fi
+    if has_dep "@tanstack/start"; then echo "tanstack-start"; return; fi
+    if has_dep "astro"; then echo "astro"; return; fi
+
+    # Shopify
+    if has_dep "@shopify/hydrogen"; then echo "hydrogen"; return; fi
+
+    # Svelte
+    if has_dep "@sveltejs/kit"; then echo "sveltekit-1"; return; fi
+    if has_dep "svelte"; then echo "svelte"; return; fi
+
+    # Vue
+    if has_dep "nuxt"; then echo "nuxtjs"; return; fi
+    if has_dep "vitepress"; then echo "vitepress"; return; fi
+    if has_dep "vuepress"; then echo "vuepress"; return; fi
+    if has_dep "gridsome"; then echo "gridsome"; return; fi
+
+    # Solid / Docusaurus / Redwood
+    if has_dep "@solidjs/start"; then echo "solidstart-1"; return; fi
+    if has_dep "@docusaurus/core"; then echo "docusaurus-2"; return; fi
+    if has_dep "@redwoodjs/"; then echo "redwoodjs"; return; fi
+
+    # Static site generators
+    if has_dep "hexo"; then echo "hexo"; return; fi
+    if has_dep "@11ty/eleventy"; then echo "eleventy"; return; fi
+
+    # Angular / Ionic
+    if has_dep "@ionic/angular"; then echo "ionic-angular"; return; fi
+    if has_dep "@angular/core"; then echo "angular"; return; fi
+    if has_dep "@ionic/react"; then echo "ionic-react"; return; fi
+
+    # React
+    if has_dep "react-scripts"; then echo "create-react-app"; return; fi
+
+    # Other frameworks
+    if has_dep "ember-cli" || has_dep "ember-source"; then echo "ember"; return; fi
+    if has_dep "@dojo/framework"; then echo "dojo"; return; fi
+    if has_dep "@polymer/"; then echo "polymer"; return; fi
+    if has_dep "preact"; then echo "preact"; return; fi
+    if has_dep "@stencil/core"; then echo "stencil"; return; fi
+    if has_dep "umi"; then echo "umijs"; return; fi
+    if has_dep "sapper"; then echo "sapper"; return; fi
+    if has_dep "saber"; then echo "saber"; return; fi
+
+    # Sanity / Storybook
+    if has_dep "sanity"; then echo "sanity-v3"; return; fi
+    if has_dep "@sanity/"; then echo "sanity"; return; fi
+    if has_dep "@storybook/"; then echo "storybook"; return; fi
+
+    # Backend frameworks
+    if has_dep "@nestjs/core"; then echo "nestjs"; return; fi
+    if has_dep "elysia"; then echo "elysia"; return; fi
+    if has_dep "hono"; then echo "hono"; return; fi
+    if has_dep "fastify"; then echo "fastify"; return; fi
+    if has_dep "h3"; then echo "h3"; return; fi
+    if has_dep "nitropack"; then echo "nitro"; return; fi
+    if has_dep "express"; then echo "express"; return; fi
+
+    # Build tools (check last)
+    if has_dep "vite"; then echo "vite"; return; fi
+    if has_dep "parcel"; then echo "parcel"; return; fi
+
+    echo "null"
+}
+
+# --- Upload with Retry ---
+upload_with_retry() {
+    local tarball="$1"
+    local framework="$2"
+    local attempt=0
+    local response=""
+    local curl_exit=0
+
+    while [ $attempt -le $MAX_RETRIES ]; do
+        if [ $attempt -gt 0 ]; then
+            echo "Retrying upload (attempt $((attempt + 1))/$((MAX_RETRIES + 1)))..." >&2
+            sleep 2
+        fi
+
+        response=$(curl -s --max-time "$UPLOAD_TIMEOUT" \
+            -X POST "$DEPLOY_ENDPOINT" \
+            -F "file=@$tarball" \
+            -F "framework=$framework" 2>&1) && curl_exit=0 || curl_exit=$?
+
+        # Check if curl timed out (exit code 28)
+        if [ $curl_exit -eq 28 ] && [ $attempt -lt $MAX_RETRIES ]; then
+            echo "Upload timed out after ${UPLOAD_TIMEOUT}s" >&2
+            attempt=$((attempt + 1))
+            continue
+        fi
+
+        # Non-timeout curl error
+        if [ $curl_exit -ne 0 ]; then
+            emit_error "ERR_UPLOAD_FAILED" "curl failed with exit code $curl_exit"
+            return 1
+        fi
+
+        # Got a response (success or error)
+        echo "$response"
+        return 0
+    done
+
+    emit_error "ERR_UPLOAD_TIMEOUT" "Upload timed out after $((MAX_RETRIES + 1)) attempts"
+    return 1
+}
+
+# --- Main ---
+INPUT_PATH="${1:-.}"
+
+# Create temp directory for packaging
+TEMP_DIR=$(mktemp -d)
+TARBALL="$TEMP_DIR/project.tgz"
+CLEANUP_TEMP=true
+
+cleanup() {
+    if [ "$CLEANUP_TEMP" = true ]; then
+        rm -rf "$TEMP_DIR"
+    fi
+}
+trap cleanup EXIT
+
+echo "Preparing deployment..." >&2
+
+# Check if input is a .tgz file or a directory
+FRAMEWORK="null"
+
+if [ -f "$INPUT_PATH" ] && [[ "$INPUT_PATH" == *.tgz ]]; then
+    echo "Using provided tarball..." >&2
+    TARBALL="$INPUT_PATH"
+    CLEANUP_TEMP=false
+elif [ -d "$INPUT_PATH" ]; then
+    PROJECT_PATH=$(cd "$INPUT_PATH" && pwd)
+
+    # Detect framework
+    FRAMEWORK=$(detect_framework "$PROJECT_PATH/package.json")
+
+    # Static HTML: rename single non-index.html to index.html
+    if [ ! -f "$PROJECT_PATH/package.json" ]; then
+        HTML_FILES=$(find "$PROJECT_PATH" -maxdepth 1 -name "*.html" -type f)
+        HTML_COUNT=$(echo "$HTML_FILES" | grep -c . || echo 0)
+
+        if [ "$HTML_COUNT" -eq 1 ]; then
+            HTML_FILE=$(echo "$HTML_FILES" | head -1)
+            BASENAME=$(basename "$HTML_FILE")
+            if [ "$BASENAME" != "index.html" ]; then
+                echo "Renaming $BASENAME to index.html..." >&2
+                mv "$HTML_FILE" "$PROJECT_PATH/index.html"
+            fi
+        fi
+    fi
+
+    # Create tarball (exclude sensitive + build artifacts)
+    echo "Creating deployment package..." >&2
+    tar -czf "$TARBALL" -C "$PROJECT_PATH" \
+        --exclude='node_modules' \
+        --exclude='.git' \
+        --exclude='.env' \
+        --exclude='.env.*' \
+        --exclude='.env.local' \
+        --exclude='.next' \
+        --exclude='dist' \
+        --exclude='build' \
+        --exclude='coverage' \
+        .
+else
+    emit_error "ERR_NO_PROJECT" "Input must be a directory or a .tgz file: $INPUT_PATH"
+    exit 1
+fi
+
+if [ "$FRAMEWORK" != "null" ]; then
+    echo "Detected framework: $FRAMEWORK" >&2
+fi
+
+# Deploy with retry
+echo "Deploying..." >&2
+RESPONSE=$(upload_with_retry "$TARBALL" "$FRAMEWORK")
+
+# Check for error
+if echo "$RESPONSE" | grep -q '"error"'; then
+    ERROR_MSG=$(echo "$RESPONSE" | grep -o '"error":"[^"]*"' | cut -d'"' -f4)
+    emit_error "ERR_UPLOAD_FAILED" "$ERROR_MSG"
+    exit 1
+fi
+
+# Extract URLs
+PREVIEW_URL=$(echo "$RESPONSE" | grep -o '"previewUrl":"[^"]*"' | cut -d'"' -f4)
+CLAIM_URL=$(echo "$RESPONSE" | grep -o '"claimUrl":"[^"]*"' | cut -d'"' -f4)
+
+if [ -z "$PREVIEW_URL" ]; then
+    emit_error "ERR_UPLOAD_FAILED" "Could not extract preview URL from response"
+    echo "$RESPONSE" >&2
+    exit 1
+fi
+
+echo "" >&2
+echo "✅ Deployment successful!" >&2
+echo "" >&2
+echo "Preview URL: $PREVIEW_URL" >&2
+echo "Claim URL:   $CLAIM_URL" >&2
+echo "" >&2
+
+# Output JSON for programmatic use (stdout only)
+echo "$RESPONSE"

package/.agent/workflows/api.md

@@ -0,0 +1,377 @@
+---
+description: End-to-end API development pipeline — design, implement, and ship production-grade REST, GraphQL, or tRPC services with OpenAPI specs, Prisma ORM, and full test coverage.
+chain: api-development
+skills: [api-architect, data-modeler, nodejs-pro, test-architect, security-scanner, auth-patterns, context-engineering, problem-checker, knowledge-compiler]
+agents: [orchestrator, assessor, recovery, learner, backend-specialist, test-engineer]
+---
+
+# /api - API Development Pipeline
+
+$ARGUMENTS
+
+---
+
+## Purpose
+
+Build well-architected APIs from specification to implementation — covering design, database schema, route handlers, authentication, testing, and OpenAPI documentation. **Combines `nodejs-pro` for implementation with `test-architect` for validation, using `api-architect` for design decisions and `data-modeler` for schema design.** Differs from `/build` by focusing exclusively on API/backend without frontend.
+
+---
+
+## ?? Meta-Agents Integration
+
+| Phase | Agent | Action |
+| ----- | ----- | ------ |
+| **Pre-Flight** | `assessor` | Evaluate API complexity and knowledge-compiler backend patterns |
+| **Execution** | `orchestrator` | Coordinate API design, schema generation, and routing |
+| **Safety** | `recovery` | Save state and recover from dangling migrations |
+| **Post-Build** | `learner` | Log API architecture patterns for downstream reuse |
+
+```
+Flow:
+assessor.evaluate(api_scope) ? risk level
+       ?
+recovery.save(existing_api) ? backup
+       ?
+design ? implement ? test ? secure
+       ?
+learner.log(patterns)
+```
+
+---
+
+## ?? MANDATORY: API Development Protocol
+
+### Phase 1: Pre-flight & knowledge-compiler Context
+
+> **Rule 0.5-K:** knowledge-compiler pattern check.
+
+1. Read `.agent/skills/knowledge-compiler/patterns/` for past failures before proceeding.
+2. Trigger `recovery` agent to run Checkpoint (`git commit -m "chore(checkpoint): pre-api"`).
+
+### Phase 2: Requirements & API Design
+
+| Field | Value |
+|-------|-------|
+| **INPUT** | $ARGUMENTS (user request — API description, tech stack, requirements) |
+| **OUTPUT** | API design spec: endpoints/schema, data models, auth strategy |
+| **AGENTS** | `nodejs-pro`, `assessor` |
+| **SKILLS** | `api-architect`, `context-engineering` |
+
+// turbo — telemetry: phase-2-design
+
+1. Clarify requirements if vague:
+
+```
+ASK if not specified:
+? API type (REST / GraphQL / tRPC)
+? Framework (Express / Fastify / NestJS / Hono)
+? Database (PostgreSQL / MySQL / MongoDB / SQLite)
+? ORM (Prisma / Drizzle / TypeORM)
+? Auth strategy (JWT / Session / OAuth2 / API Key)
+? Testing approach (unit + integration + E2E)
+```
+
+2. Design endpoints/schema using `api-architect` decision framework:
+
+| Scenario | Recommendation |
+|----------|----------------|
+| Standard CRUD API | **REST** with Express/Fastify + Prisma |
+| Complex data relationships, flexible queries | **GraphQL** with Apollo/Yoga |
+| Full-stack TypeScript monorepo | **tRPC** with Next.js |
+| High-performance, low-overhead | **Hono** or **Fastify** |
+
+3. Define request/response formats, error contracts, status codes
+4. Plan pagination, filtering, and sorting strategies
+
+### Phase 3: Database Schema Design
+
+| Field | Value |
+|-------|-------|
+| **INPUT** | API design spec from Phase 2 |
+| **OUTPUT** | Database schema: `prisma/schema.prisma` or equivalent, migration files |
+| **AGENTS** | `nodejs-pro`, `orchestrator` |
+| **SKILLS** | `data-modeler` |
+
+// turbo — telemetry: phase-3-schema
+
+1. Design data models with relationships (1:1, 1:N, M:N)
+2. Define indexes for query optimization
+3. Plan migration strategy (incremental, reversible)
+4. Generate Prisma schema or equivalent ORM config
+
+// turbo — telemetry: phase-2-schema-generate
+```bash
+npx cross-env OTEL_SERVICE_NAME="workflow:api" TRACE_ID="$TRACE_ID" npx prisma generate
+```
+
+### Phase 4: API Implementation
+
+| Field | Value |
+|-------|-------|
+| **INPUT** | API design spec + database schema from Phases 2-3 |
+| **OUTPUT** | Route handlers in `src/routes/`, service layer in `src/services/`, middleware in `src/middleware/` |
+| **AGENTS** | `nodejs-pro` |
+| **SKILLS** | `nodejs-pro`, `api-architect`, `auth-patterns` |
+
+// turbo — telemetry: phase-4-implement
+
+1. Scaffold project structure:
+
+```
+src/
++-- routes/          # Route handlers (thin — delegate to services)
++-- controllers/     # Request parsing, response formatting
++-- services/        # Business logic (pure, testable)
++-- middleware/       # Auth, validation, rate limiting, error handling
++-- validators/      # Input validation schemas (Zod)
++-- types/           # TypeScript types and interfaces
+prisma/
++-- schema.prisma    # Database schema
+```
+
+2. Implement route handlers with input validation (Zod)
+3. Create service layer with business logic (pure functions)
+4. Add authentication middleware (JWT/OAuth2 per spec)
+5. Implement error handling with consistent error response format
+6. Add rate limiting middleware
+7. Implement pagination, filtering, sorting
+
+// turbo — telemetry: phase-3-typecheck
+```bash
+npx cross-env OTEL_SERVICE_NAME="workflow:api" TRACE_ID="$TRACE_ID" npx tsc --noEmit
+```
+
+### Phase 5: Testing
+
+| Field | Value |
+|-------|-------|
+| **INPUT** | Implemented API from Phase 4 |
+| **OUTPUT** | Test suite: `src/__tests__/` with unit + integration tests passing |
+| **AGENTS** | `test-architect` |
+| **SKILLS** | `test-architect` |
+
+// turbo — telemetry: phase-5-test
+
+1. **Unit tests** — Service layer, validators, utilities (AAA pattern)
+2. **Integration tests** — API endpoints with Supertest (actual HTTP calls)
+3. **Auth tests** — Protected routes, token validation, role-based access
+4. **Error path tests** — Invalid input, not found, unauthorized, rate limiting
+
+// turbo — telemetry: phase-4-test-coverage
+```bash
+npx cross-env OTEL_SERVICE_NAME="workflow:api" TRACE_ID="$TRACE_ID" npm test -- --coverage
+```
+
+Coverage targets:
+
+| Code Area | Target |
+|-----------|--------|
+| Business logic (services) | = 80% |
+| Auth/security middleware | 100% |
+| Route handlers | = 70% |
+| Validators | = 90% |
+
+### Phase 6: Security & Documentation
+
+| Field | Value |
+|-------|-------|
+| **INPUT** | Tested API from Phase 5 |
+| **OUTPUT** | Security validation report + OpenAPI spec + README |
+| **AGENTS** | `nodejs-pro`, `learner` |
+| **SKILLS** | `security-scanner`, `api-architect`, `problem-checker`, `knowledge-compiler` |
+
+// turbo — telemetry: phase-6-secure
+
+1. **Security validation** (OWASP Top 10):
+   - SQL injection protection (parameterized queries via ORM)
+   - XSS prevention (output encoding)
+   - CSRF protection (where applicable)
+   - Rate limiting configured
+   - Input validation on all endpoints
+   - Authentication on protected routes
+   - Secrets not hardcoded
+
+2. **OpenAPI/Swagger documentation**:
+   - Generate OpenAPI 3.0 spec from routes
+   - Include request/response examples
+   - Document error responses with status codes
+   - Add authentication requirements
+
+3. **README generation**:
+   - Quick start (get running < 5 min)
+   - Environment variables
+   - API endpoint reference
+   - Testing instructions
+
+// turbo — telemetry: phase-5-lint-typecheck
+```bash
+npx cross-env OTEL_SERVICE_NAME="workflow:api" TRACE_ID="$TRACE_ID" npm run lint; npx cross-env OTEL_SERVICE_NAME="workflow:api" TRACE_ID="$TRACE_ID" npx tsc --noEmit
+```
+
+---
+
+## ?? Supported Patterns
+
+### REST APIs
+
+- Express.js, Fastify, Hono, NestJS
+- OpenAPI/Swagger auto-generation
+- Versioning: URL path (`/v1/`), header, query param
+
+### GraphQL
+
+- Apollo Server, GraphQL Yoga
+- Schema-first or code-first approach
+- DataLoader for N+1 query prevention
+
+### tRPC
+
+- Type-safe end-to-end APIs
+- Next.js App Router integration
+- Full inference without code generation
+
+### Real-time
+
+- WebSocket (Socket.io, ws)
+- Server-Sent Events (SSE)
+- Polling with ETag caching
+
+---
+
+## ? MANDATORY: Problem Verification Before Completion
+
+> **CRITICAL:** This check MUST be performed before any `notify_user` or task completion.
+
+### Check @[current_problems]
+
+```
+1. Read @[current_problems] from IDE
+2. If errors/warnings > 0:
+   a. Auto-fix: imports, types, lint errors
+   b. Re-check @[current_problems]
+   c. If still > 0 ? STOP ? Notify user
+3. If count = 0 ? Proceed to completion
+```
+
+### Auto-Fixable
+
+| Type | Fix |
+|------|-----|
+| Missing import | Add import statement |
+| Unused variable | Remove or prefix `_` |
+| Type mismatch | Fix type annotation |
+| Lint errors | Run eslint --fix |
+
+> **Rule:** Never mark complete with errors in `@[current_problems]`.
+
+---
+
+## ?? Rollback & Recovery
+
+If the Exit Gates fail and cannot be resolved automatically:
+1. Restore to pre-api checkpoint (`git checkout -- .` or `git stash pop`).
+2. Log failure via `learner` meta-agent.
+3. Notify user with failure context and recovery options.
+
+---
+
+## Output Format
+
+```markdown
+## ?? API Development Complete
+
+### API Summary
+
+| Aspect | Value |
+|--------|-------|
+| Type | REST / GraphQL / tRPC |
+| Framework | Express / Fastify / Hono |
+| Database | PostgreSQL + Prisma |
+| Auth | JWT / OAuth2 |
+
+### Deliverables
+
+| Item | Status | Path |
+|------|--------|------|
+| Routes | ? [X] endpoints | `src/routes/` |
+| Services | ? [X] services | `src/services/` |
+| Tests | ? [X] passing | `src/__tests__/` |
+| Schema | ? [X] models | `prisma/schema.prisma` |
+| OpenAPI | ? Generated | `docs/openapi.yaml` |
+| Security | ? OWASP validated | — |
+
+### Test Coverage
+
+| Area | Coverage |
+|------|----------|
+| Business Logic | XX% |
+| Auth/Security | XX% |
+| Overall | XX% |
+
+### Next Steps
+
+- [ ] Review generated code and adjust business logic
+- [ ] Run integration tests: `npm test`
+- [ ] Configure environment variables for staging
+- [ ] Deploy to staging: `/launch`
+```
+
+---
+
+## Examples
+
+```
+/api user management REST API with Express and Prisma
+/api GraphQL API for e-commerce with Apollo Server and PostgreSQL
+/api payments microservice with Stripe integration and JWT auth
+/api blog API with RESTful design, PostgreSQL, Prisma, JWT auth, rate limiting
+/api real-time chat API with WebSocket and Redis pub/sub
+```
+
+---
+
+## Key Principles
+
+- **Design first** — plan endpoints, schemas, and auth before writing code
+- **Type safety throughout** — TypeScript on every layer, Zod for runtime validation
+- **Test at boundaries** — integration tests for endpoints, unit tests for logic
+- **Security by default** — auth, validation, rate limiting from the start, not bolted on
+- **Thin controllers, fat services** — route handlers parse/respond, services contain logic
+
+---
+
+## ?? Workflow Chain
+
+**Skills Loaded (9):**
+
+- `api-architect` - REST/GraphQL/tRPC design patterns and endpoint design
+- `data-modeler` - Database schema design, Prisma ORM, migration strategy
+- `nodejs-pro` - Node.js best practices, async patterns, framework selection
+- `test-architect` - API testing strategies (unit, integration, coverage)
+- `security-scanner` - OWASP Top 10 validation, security audit
+- `auth-patterns` - Authentication/authorization strategies (JWT, OAuth2, API Key)
+- `context-engineering` - Codebase parsing and framework detection
+- `problem-checker` - Code problem verification
+- `knowledge-compiler` - Learning and logging backend patterns
+
+```mermaid
+graph LR
+    A["/plan"] --> B["/api"]
+    B --> C["/validate"]
+    C --> D["/launch"]
+    style B fill:#10b981
+```
+
+| After /api | Run | Purpose |
+|------------|-----|---------|
+| Need tests or CI | `/validate` | Run full test suite with coverage |
+| Ready to deploy | `/launch` | Deploy API to production |
+| Need frontend too | `/build` | Full-stack app with API + frontend |
+| Security audit needed | `/inspect` | Deep security review (OWASP) |
+
+**Handoff to /validate:**
+
+```markdown
+? API built with [X] endpoints, [Y] tests passing, OpenAPI docs generated.
+Run `/validate` to execute full test suite with coverage report.
+```