ai-developer-skill-os 7.5.0 → 8.1.4

package/.qk-ai-skill-os/skills/_archive_old_skills/qk-api-integration/SKILL.md

@@ -1,389 +0,0 @@
----
-name: qk-api-integration
-description: >-
-  Chuyển đổi tài liệu API (curl, swagger...) thành code tích hợp frontend chuẩn xác, có type an toàn và xử lý lỗi.
-version: 2.0.0
-category: engineering
-tags: [api, integration, rest, graphql, axios, fetch, react-query, typescript]
-platforms: [antigravity, claude-code, kilo-code, cursor, windsurf]
----
-
-# API Integration Engineer
-
-> **Language rule:**
-> Use English for: code, identifiers, file names, architecture terms, technical decisions.
-> Use the user's language for: explanations, questions, summaries, and feedback.
-> The user may write in any language — detect and match it automatically.
-
----
-
-## Trigger
-
-Activate this skill when the user provides any of:
-- `curl` command
-- Swagger 2.0 / OpenAPI 3.0 (YAML or JSON)
-- Postman collection or HAR file
-- API documentation (endpoint, method, request/response)
-- Code snippet to reverse-engineer (fetch/axios/custom client)
-- Backend controller or route handler to mirror on the frontend
-
----
-
-## Scope
-
-- ✅ Parse and understand any API input format
-- ✅ Extract the full API contract (request + response + errors)
-- ✅ Detect existing project patterns (HTTP client, state layer, conventions)
-- ✅ Generate typed service/client, hooks/queries, and TypeScript types
-- ✅ Follow and extend existing architecture — never duplicate it
-- ✅ Handle special cases: file upload, file download, pagination, auth, WebSocket
-
----
-
-## Non-goals
-
-- ❌ Do NOT create a new HTTP client if one already exists
-- ❌ Do NOT introduce a new state system if one is already in use
-- ❌ Do NOT hardcode URLs, tokens, or secrets
-- ❌ Do NOT use `any` when types can be inferred
-- ❌ Do NOT overwrite existing files without explicit user approval
-
----
-
-## Severity Levels
-
-| Level | Meaning |
-|-------|---------|
-| P0 | Conflict with existing endpoint or type — must resolve before generating |
-| P1 | Missing critical info (auth, response schema) — ask before proceeding |
-| P2 | Naming or structure inconsistency — warn and apply best guess |
-| P3 | Missing optional fields — document assumption and proceed |
-
----
-
-## Workflow
-
-### Phase 1 — Input Validation
-
-Before parsing, verify:
-- URL is valid and method is correct (GET/POST/PUT/PATCH/DELETE)
-- Auth format is identifiable (Bearer, API Key, OAuth2, Basic, Cookie)
-- Request info is present (path params, query params, body)
-- Response structure is clear (JSON, binary, stream, paginated)
-- Error cases are documented
-
-If critical info is missing → **stop and ask**. Do not guess.
-
-```json
-{
-  "validation": {
-    "status": "VALID | INVALID | INCOMPLETE",
-    "confidence": 0.95,
-    "errors": [],
-    "warnings": [],
-    "input_type": "curl | openapi | postman | docs | code"
-  }
-}
-```
-
----
-
-### Phase 2 — API Contract Extraction
-
-Extract the full contract:
-
-```
-metadata:
-  name, domain, endpoint, method, version, description
-
-request:
-  pathParams:    { name, type, required }
-  queryParams:   { name, type, required, default }
-  headers:       { name, value, required }
-  body:          { contentType, schema { field, type, required, nullable } }
-  auth:          { type, location, name }
-
-response:
-  success:       { statusCode, contentType, schema, pagination? }
-  errors:        [ { statusCode, message, businessCode? } ]
-
-special:
-  rateLimit, timeout, retryable, streaming
-```
-
-Map each field: `type`, `required`, `nullable`, `enum`, `example`.
-
----
-
-### Phase 3 — Project Profile Detection
-
-1. Check for `.api-config.json` at project root → use if present
-2. Otherwise infer from:
-   - Framework: `package.json`, config files, imports
-   - HTTP client: existing axios instance, fetch wrapper, custom client
-   - State management: React Query, Redux, Zustand, Pinia, Apollo, Vuex
-   - Type system: `tsconfig.json`, JSDoc, plain JS
-   - Folder conventions: `services/`, `hooks/`, `api/`, `types/`, `adapters/`
-   - Naming: camelCase, PascalCase, snake_case, file patterns
-3. Read 1-2 existing API files to capture exact patterns for imports, typing, error handling, naming
-
-If project context is ambiguous → use conservative defaults and document all assumptions.
-
----
-
-### Phase 4 — Conflict Detection
-
-Before generating code, check for:
-
-| Conflict | Action |
-|----------|--------|
-| `ENDPOINT_DUPLICATE` — endpoint already exists | Reuse if same, warn if different |
-| `FUNCTION_DUPLICATE` — function name conflicts | Warn, propose new name |
-| `TYPE_DUPLICATE` — type already defined | Extend or reuse existing |
-| `LOGIC_OVERLAP` — logic exists in another service | Consolidate, don't duplicate |
-| `IMPORT_CONFLICT` — import path conflicts | Resolve before generating |
-
-**P0 conflict → stop, report, wait for user decision before proceeding.**
-
----
-
-### Phase 5 — Code Generation
-
-Generate the minimum necessary set for the task:
-
-#### TypeScript Types
-```typescript
-// Request types
-export interface CreateUserRequest {
-  name: string;
-  email: string;
-  role?: UserRole;
-}
-
-// Response types
-export interface CreateUserResponse {
-  id: string;
-  name: string;
-  email: string;
-  createdAt: string;
-}
-
-// Error types
-export interface ApiError {
-  code: string;
-  message: string;
-  details?: Record<string, unknown>;
-}
-```
-
-#### Service / API Layer
-```typescript
-// Thin layer: HTTP + mapping only. No UI, no business logic.
-export const createUser = async (
-  data: CreateUserRequest
-): Promise<CreateUserResponse> => {
-  const response = await apiClient.post<CreateUserResponse>('/users', data);
-  return response.data;
-};
-```
-
-#### Hook / Query (if project uses React Query)
-```typescript
-export const useCreateUser = () => {
-  return useMutation<CreateUserResponse, ApiError, CreateUserRequest>({
-    mutationFn: createUser,
-    onSuccess: () => {
-      queryClient.invalidateQueries({ queryKey: ['users'] });
-    },
-  });
-};
-```
-
-**If project uses Redux** → follow existing slice/thunk pattern.
-**If project uses Zustand** → follow existing store pattern.
-**If project uses Pinia/Vuex** → follow existing composable/action pattern.
-
-Do NOT mix patterns.
-
----
-
-### Phase 6 — Special Case Handling
-
-#### File Upload (`multipart/form-data`)
-```typescript
-// Always use FormData — never send File object in JSON
-const formData = new FormData();
-formData.append('file', file);
-formData.append('name', name);
-await apiClient.post('/upload', formData, {
-  headers: { 'Content-Type': 'multipart/form-data' },
-});
-```
-
-#### File Download (binary response)
-```typescript
-const response = await apiClient.get('/export', { responseType: 'blob' });
-const url = URL.createObjectURL(response.data);
-const a = document.createElement('a');
-a.href = url;
-a.download = filename;
-a.click();
-URL.revokeObjectURL(url);
-```
-
-#### Pagination
-```typescript
-interface PaginatedResponse<T> {
-  items: T[];
-  total: number;
-  page: number;
-  limit: number;
-}
-// Implement consistently with existing project pagination pattern
-```
-
-#### Authentication
-- Follow existing auth mechanism (interceptor, header injection, cookie)
-- Never hardcode tokens or credentials
-- Refresh token logic belongs in the existing interceptor
-
----
-
-### Phase 7 — Quality Validation
-
-Before marking as ready:
-
-- [ ] TypeScript strict — compiles clean, no `any` without justification
-- [ ] All functions/params have explicit types and return types
-- [ ] No unused imports, no debug code
-- [ ] Error handling complete (try/catch, `.catch`, fallback)
-- [ ] No hardcoded URLs, tokens, or secrets — use env vars
-- [ ] Naming matches project conventions
-- [ ] Reuses existing HTTP client, interceptors, and query client
-- [ ] JSDoc added for public API if project convention requires it
-- [ ] React: dependency arrays correct, cleanup present, no race conditions
-
----
-
-### Phase 8 — End-to-End UI Integration (Optional / On-Demand)
-
-If the user explicitly requests to integrate the API directly into the UI (End-to-End):
-1. **Find Target Component:** Identify the UI component where the API should be called.
-2. **Wire State:** Inject the generated Hook/Query/Service into the component.
-3. **Handle States:** Implement Loading (spinners, skeletons), Error (toast, alert), and Success (redirect, form reset, table refetch) states in the UI.
-4. **Data Binding:** Bind the API response data to the UI elements (Table rows, Dropdowns, etc.) and bind UI inputs to the API request payload.
-
----
-
-## Decision Tree
-
-```
-Is required info complete?
-  ├── No  → Ask for missing info (auth, response schema, base URL)
-  └── Yes → Check for conflicts
-              ├── P0 conflict → Stop, report, wait for user decision
-              └── No P0 → Generate code following project patterns
-```
-
-```
-Does project have existing HTTP client?
-  ├── Yes → Extend it
-  └── No  → Create minimal axios/fetch wrapper following project style
-```
-
-```
-Does project use state management?
-  ├── React Query → useMutation / useQuery pattern
-  ├── Redux       → slice + thunk / RTK Query
-  ├── Zustand     → store action
-  ├── Pinia       → action in store
-  └── None        → Service function only
-```
-
----
-
-## Output Format
-
-```
-📋 API Contract
-─────────────────────────────────────────────────
-Name:     [API name]
-Endpoint: [METHOD /path]
-Auth:     [type]
-Input:    [brief description]
-Output:   [brief description]
-
-🔍 Project Pattern Detected
-─────────────────────────────────────────────────
-HTTP client:    [axios instance at src/lib/axios.ts]
-State:          [React Query]
-Types path:     [src/types/]
-Service path:   [src/services/]
-Hook path:      [src/hooks/]
-
-⚠️  Assumptions
-─────────────────────────────────────────────────
-  • [Assumption 1]
-  • [Assumption 2]
-
-📁 Files Generated
-─────────────────────────────────────────────────
-  [NEW]    src/types/user.types.ts
-  [NEW]    src/services/user.service.ts
-  [NEW]    src/hooks/useCreateUser.ts
-  [EXTEND] src/services/index.ts
-
-🔗 Next steps:
-  → Import hook in your component
-  → Add env var: VITE_API_BASE_URL
-  → Test with: [example usage snippet]
-```
-
----
-
-## Validation Checklist
-
-- [ ] All 7 phases completed
-- [ ] Input validated — no missing critical fields
-- [ ] Conflicts checked — none unresolved
-- [ ] Types generated and strict
-- [ ] Existing HTTP client reused
-- [ ] Existing state pattern followed
-- [ ] Special cases handled if applicable (upload, download, pagination, auth)
-- [ ] No hardcoded secrets
-- [ ] Output format produced with files listed
-
----
-
-## Project Config Reference (`.api-config.json`)
-
-```json
-{
-  "framework": "React",
-  "httpClient": "axios",
-  "stateManagement": "react-query",
-  "typing": "typescript",
-  "conventions": {
-    "servicePath": "src/services/",
-    "typePath": "src/types/",
-    "hookPath": "src/hooks/",
-    "naming": "camelCase",
-    "fileNaming": "{name}.service.ts",
-    "typeFileNaming": "{Name}.types.ts",
-    "hookFileNaming": "use{Name}.ts"
-  },
-  "httpConfig": {
-    "baseURL": "process.env.VITE_API_URL",
-    "interceptor": "src/lib/axios.ts",
-    "authHeader": "Authorization",
-    "timeout": 30000
-  }
-}
-```
-
----
-
-## Examples
-
-See `examples/` folder.
-

package/.qk-ai-skill-os/skills/_archive_old_skills/qk-auth-security/SKILL.md

@@ -1,96 +0,0 @@
----
-name: qk-
-description: >-
-  Triển khai tính năng đăng nhập (JWT, OAuth), phân quyền (RBAC) và bảo vệ app khỏi các lỗ hổng OWASP.
-version: 1.0.0
-category: backend
-tags: [auth, security, jwt, oauth, rbac, owasp]
-platforms: [antigravity, claude-code, kilo-code, cursor, windsurf]
----
-
-# Auth & Security Engineer
-
-> **Language rule:**
-> Use English for: code, identifiers, file names, architecture terms, technical decisions.
-> Use the user's language for: explanations, questions, summaries, and feedback.
-> The user may write in any language — detect and match it automatically.
-
----
-
-## Trigger
-
-Activate this skill when:
-- User asks to "add login", "protect this route", or "implement OAuth"
-- Defining user roles and permissions (Admin vs User)
-- Project audit flags security vulnerabilities (P0/P1)
-- Handling sensitive data (passwords, PII, API keys)
-
----
-
-## Scope
-
-- ✅ **Authentication:** JWT, Session Cookies, OAuth2 (Google, GitHub, etc.), Magic Links.
-- ✅ **Authorization:** Role-Based Access Control (RBAC), Middleware guards.
-- ✅ **Data Protection:** Hashing passwords (bcrypt, Argon2), encrypting sensitive fields.
-- ✅ **Vulnerability Prevention:** CSRF protection, Rate Limiting, CORS config, input sanitization (SQLi/XSS).
-
----
-
-## Non-goals
-
-- ❌ Do NOT store passwords in plain text. Ever.
-- ❌ Do NOT hardcode secrets or private keys in the code (use `.env`).
-- ❌ Do NOT store JWTs in `localStorage` if cookies (`httpOnly`) are an option, unless explicitly requested.
-
----
-
-## Workflow
-
-### Phase 1 — Strategy Selection
-
-Determine the auth mechanism:
-1. **Stateless (JWT):** Good for mobile/SPAs, distributed systems.
-2. **Stateful (Sessions):** Good for traditional web apps, easier revocation.
-3. **Third-party (OAuth / Auth0 / NextAuth / Supabase):** Offload auth complexity.
-
-### Phase 2 — Implementation
-
-**For JWT + Cookies (Recommended Web Pattern):**
-1. Create Login endpoint: Verify password → Generate JWT → Set `httpOnly` cookie.
-2. Create Middleware: Extract cookie → Verify JWT signature → Attach user to request.
-3. Create Logout endpoint: Clear the cookie.
-
-**For Authorization:**
-1. Define roles (e.g., `enum Role { ADMIN, USER }`).
-2. Create Role Middleware: Check `req.user.role`.
-
-### Phase 3 — Security Audit
-
-Verify:
-- Passwords are hashed with a salt (e.g., `bcrypt.hash(password, 10)`).
-- Cookies are `httpOnly`, `Secure` (in prod), and `SameSite`.
-- CORS is configured to only allow trusted origins.
-
----
-
-## Output Format
-
-```
-🛡️ Auth & Security Report
-─────────────────────────────────────────────────
-Mechanism:  [JWT in httpOnly Cookie / OAuth / Session]
-Roles:      [Admin, User]
-
-Components Implemented:
-  ✅ Login/Logout handlers
-  ✅ Auth Middleware (Guard)
-  ✅ Password hashing (bcrypt)
-
-Security measures enforced:
-  • `httpOnly`, `Secure`, `SameSite=Strict` on cookies
-  • CORS restricted to frontend origin
-
-🔗 Next Steps:
-  Remember to add `JWT_SECRET` to your production environment variables.
-```
-

package/.qk-ai-skill-os/skills/_archive_old_skills/qk-backend-architecture/SKILL.md

@@ -1,125 +0,0 @@
----
-name: qk-
-description: >-
-  Kiểm soát cấu trúc backend, ép buộc tuân thủ mô hình Layer (Controller/Service/Repository) và vị trí file.
-version: 1.0.0
-category: backend
-tags: [architecture, backend, controller, service, repository, structure]
-platforms: [antigravity, claude-code, kilo-code, cursor, windsurf]
----
-
-# Backend Architecture
-
-> **Language rule:**
-> Use English for: code, identifiers, file names, architecture terms, technical decisions.
-> Use the user's language for: explanations, questions, summaries, and feedback.
-> The user may write in any language — detect and match it automatically.
-
----
-
-## Trigger
-
-Activate this skill when:
-- Creating new backend API endpoints, services, or models
-- User asks "where should I put this business logic?"
-- Project audit flags mixed concerns (e.g., SQL queries inside a controller)
-- Inheriting or setting up a Node.js, Python, or Go backend
-
----
-
-## Scope
-
-- ✅ Discover existing backend folder structure
-- ✅ Enforce Layered Architecture (Controller → Service → Data Access)
-- ✅ Enforce Domain/Module-based structure if applicable (`src/users/`, `src/orders/`)
-- ✅ Define where validation, mapping, and error handling should live
-- ✅ Validate file placement before code generation
-
----
-
-## Non-goals
-
-- ❌ Do NOT rewrite the architecture unless requested
-- ❌ Do NOT write the actual database queries (delegate to `database-engineer`)
-- ❌ Do NOT configure server infrastructure (delegate to `deployment`)
-
----
-
-## Severity Levels
-
-| Level | Meaning |
-|-------|---------|
-| P0 | Circular dependency or security bypass in architecture |
-| P1 | Mixed concerns (e.g., ORM logic in route handler) |
-| P2 | Inconsistent folder or file naming |
-| P3 | Minor deviation from convention |
-
----
-
-## Workflow
-
-### Phase 1 — Architecture Discovery
-
-Analyze the project structure:
-1. **Classic MVC / Layered:** `controllers/`, `services/`, `models/`, `routes/`
-2. **Domain-Driven (Module):** `src/modules/user/{controller, service, repository}`
-3. **Framework-specific:** NestJS (`.controller.ts`, `.service.ts`), Django apps, Express monolithic.
-4. **Serverless:** `functions/`, `handlers/`
-
----
-
-### Phase 2 — Rule Extraction
-
-Extract conventions:
-- **Routes/Controllers:** Should only handle HTTP req/res, params validation, and calling services. No business logic.
-- **Services:** Pure business logic. Does not know about HTTP (`req`/`res`).
-- **Repositories/Data Access:** Only layer that interacts with the DB.
-- **Error Handling:** Centralized error middleware vs local try/catch.
-
----
-
-### Phase 3 — File Placement & Routing
-
-Map a new requirement to the architecture:
-
-*Request: "Add an endpoint to update user profile"*
-- Route: `PUT /api/users/:id` mapped in `src/routes/user.routes.ts`
-- Controller: `updateProfile(req, res)` in `src/controllers/user.controller.ts`
-- Service: `updateUserProfile(userId, data)` in `src/services/user.service.ts`
-
----
-
-## Decision Tree
-
-```
-Does the project group files by Layer or by Domain?
-  ├── Layer  → Place in `src/controllers/` and `src/services/`
-  └── Domain → Place in `src/modules/users/`
-
-Where does data validation happen?
-  ├── Middleware → Add Zod/Joi validation at the router level
-  └── Controller → Validate inside the controller function before calling service
-```
-
----
-
-## Output Format
-
-```
-🏗️ Backend Architecture Plan
-─────────────────────────────────────────────────
-Structure Type: [Layered / Domain-based / Framework-specific]
-
-Layer Mapping:
-  ✅ Controller: [path/to/controller.ts] — handles HTTP
-  ✅ Service:    [path/to/service.ts] — business logic
-  ✅ Repo/DB:    [handled by database-engineer]
-
-⚠️ Constraints enforced:
-  • Do not pass `req` or `res` objects into the Service layer.
-  • Validate all inputs at the Controller/Route level.
-
-🔗 Next Steps:
-  Proceeding to implement the layers.
-```
-