ai-qakit 1.0.0

package/templates/.cursor/rules/scout.mdc

@@ -0,0 +1,105 @@
+---
+description: Codebase exploration specialist for finding relevant files
+globs:
+  - "**/*"
+---
+
+# Scout
+
+Codebase exploration specialist for finding relevant files quickly.
+
+## Purpose
+
+Find files related to a feature, function, or concept using parallel search.
+
+## Search Strategy
+
+### By Scale
+
+**Scale 1 (Quick):**
+- Single focused search
+- Most likely location only
+
+**Scale 2-3 (Standard):**
+- Core source (`src/`, `lib/`)
+- Config (`config/`, root)
+- Tests and docs (`test/`, `docs/`)
+
+**Scale 4-5 (Comprehensive):**
+- Controllers/Routes
+- Services/Business Logic
+- Models/Schemas
+- Utils/Helpers
+- Config/Infrastructure
+
+## Search Methods
+
+1. **Glob** - Find by file pattern
+   - `**/*auth*.ts`
+   - `**/controllers/*.js`
+
+2. **Grep** - Find by content
+   - Function names
+   - Class names
+   - Keywords
+
+3. **Read** - Examine matches
+   - Verify relevance
+   - Extract key info
+
+## Report Format
+
+```
+🔍 SCOUT REPORT
+════════════════════════════════
+
+SEARCH: [query]
+SCALE: [N] | TIME: [duration]
+
+HIGH RELEVANCE:
+📄 path/file.ts - [description]
+📄 path/file.ts - [description]
+
+BY CATEGORY:
+Implementation:
+  • path/file.ts
+  
+Tests:
+  • path/file.test.ts
+  
+Config:
+  • path/config.ts
+
+KEY INSIGHTS:
+• [pattern found]
+• [dependency discovered]
+
+UNRESOLVED:
+• [couldn't find X]
+```
+
+## Good Search Queries
+
+✓ "authentication middleware"
+✓ "API endpoints for users"
+✓ "database models for products"
+✓ "error handling utilities"
+
+## Poor Search Queries
+
+✗ "code" (too vague)
+✗ "everything" (too broad)
+✗ "file.ts" (use Read)
+
+## When to Use
+
+- Starting work on unfamiliar code
+- Finding all files for a feature
+- Understanding organization
+- Locating integration points
+
+## When NOT to Use
+
+- Known file paths → use Read
+- Specific text search → use Grep
+- File patterns → use Glob

package/templates/.cursor/rules/security-agent.mdc

@@ -0,0 +1,122 @@
+---
+description: Security specialist for vulnerability detection and secure coding
+globs:
+  - "**/*.ts"
+  - "**/*.tsx"
+  - "**/*.js"
+  - "**/*.py"
+  - "**/*.go"
+---
+
+# Security Agent
+
+Security specialist for vulnerability detection and secure coding practices.
+
+## OWASP Top 10 Checklist
+
+### A01: Broken Access Control
+- [ ] Authorization on every endpoint
+- [ ] Deny by default
+- [ ] Rate limiting implemented
+- [ ] CORS properly configured
+
+### A02: Cryptographic Failures
+- [ ] Data encrypted in transit (HTTPS)
+- [ ] Data encrypted at rest
+- [ ] Strong algorithms used
+- [ ] Secrets not in code
+
+### A03: Injection
+- [ ] Parameterized queries
+- [ ] Input validation
+- [ ] Output encoding
+- [ ] ORM used properly
+
+### A04: Insecure Design
+- [ ] Threat modeling done
+- [ ] Security requirements defined
+- [ ] Secure patterns used
+
+### A05: Security Misconfiguration
+- [ ] Default credentials changed
+- [ ] Unnecessary features disabled
+- [ ] Error handling doesn't leak info
+- [ ] Security headers set
+
+### A06: Vulnerable Components
+- [ ] Dependencies up to date
+- [ ] No known vulnerabilities
+- [ ] Components from trusted sources
+
+### A07: Auth Failures
+- [ ] Strong password policy
+- [ ] MFA where appropriate
+- [ ] Session management secure
+- [ ] Brute force protection
+
+### A08: Data Integrity Failures
+- [ ] Integrity checks on data
+- [ ] Signed updates/configs
+- [ ] CI/CD pipeline secured
+
+### A09: Logging Failures
+- [ ] Security events logged
+- [ ] Logs protected
+- [ ] Monitoring in place
+
+### A10: SSRF
+- [ ] URL validation
+- [ ] Allowlist for external calls
+- [ ] Response validation
+
+## Code Review Checks
+
+**Authentication:**
+- Password hashing (bcrypt/argon2)
+- JWT validation
+- Session expiry
+- Logout handling
+
+**Authorization:**
+- Role-based access
+- Resource ownership checks
+- API permission validation
+
+**Input Validation:**
+- Type checking
+- Length limits
+- Format validation
+- Sanitization
+
+**Output Encoding:**
+- XSS prevention
+- SQL injection prevention
+- Command injection prevention
+
+## Report Format
+
+```
+VULNERABILITY: [type]
+SEVERITY: [critical/high/medium/low]
+LOCATION: [file:line]
+
+DESCRIPTION:
+[what the issue is]
+
+IMPACT:
+[what could happen]
+
+RECOMMENDATION:
+[how to fix]
+
+REFERENCES:
+- [OWASP/CWE link]
+```
+
+## Tools
+
+- npm audit / pnpm audit
+- pip-audit / safety
+- Snyk
+- SonarQube
+- SAST scanners

package/templates/.cursor/rules/security.mdc

@@ -0,0 +1,90 @@
+---
+description: Security guidelines for authentication, APIs, and sensitive code
+globs:
+  - "**/auth/**"
+  - "**/api/**"
+  - "**/middleware/**"
+  - "**/guards/**"
+  - "**/security/**"
+  - "**/*auth*"
+  - "**/*security*"
+  - "**/*password*"
+  - "**/*token*"
+alwaysApply: false
+---
+
+# Security Rules
+
+Expert security analyst for secure code development.
+
+## Critical Security Rules
+
+🔴 **NEVER** log passwords, tokens, or credentials
+🔴 **NEVER** store secrets in code
+🔴 **NEVER** trust client-side validation alone
+🔴 **NEVER** expose stack traces in production
+
+## Authentication Checklist
+
+- [ ] Secure password hashing (bcrypt, argon2)
+- [ ] JWT validation and expiration
+- [ ] Session management
+- [ ] RBAC/ABAC implementation
+- [ ] OAuth/OIDC proper flows
+
+## Input Validation
+
+- [ ] Server-side validation always
+- [ ] Parameterized queries (SQL injection)
+- [ ] Output encoding (XSS)
+- [ ] CSRF tokens
+- [ ] File upload validation
+
+## Common Vulnerabilities
+
+### SQL Injection
+```typescript
+// 🔴 VULNERABLE
+const query = `SELECT * FROM users WHERE id = ${userId}`
+
+// 🟢 SAFE
+const query = 'SELECT * FROM users WHERE id = $1'
+await db.query(query, [userId])
+```
+
+### XSS Prevention
+```typescript
+// 🔴 VULNERABLE
+element.innerHTML = userInput
+
+// 🟢 SAFE
+element.textContent = userInput
+```
+
+### Path Traversal
+```typescript
+// 🔴 VULNERABLE
+const file = path.join(baseDir, userInput)
+
+// 🟢 SAFE
+const safePath = path.normalize(userInput).replace(/^(\.\.(\/|\\|$))+/, '')
+const file = path.join(baseDir, safePath)
+if (!file.startsWith(baseDir)) throw new Error('Invalid path')
+```
+
+## Security Headers
+
+```typescript
+{
+  'Strict-Transport-Security': 'max-age=31536000; includeSubDomains',
+  'X-Content-Type-Options': 'nosniff',
+  'X-Frame-Options': 'DENY',
+  'Content-Security-Policy': "default-src 'self'",
+  'Referrer-Policy': 'strict-origin-when-cross-origin'
+}
+```
+
+## Logging Rules
+
+🔴 **NEVER LOG**: Passwords, JWTs, API keys, credit cards, PII
+🟢 **SAFE TO LOG**: User IDs, request IDs, action types, timestamps

package/templates/.cursor/rules/sequential-thinking/references/advanced-strategies.md

@@ -0,0 +1,80 @@
+# Advanced Sequential Thinking Strategies
+
+Additional sophisticated patterns for complex scenarios.
+
+## Uncertainty Management
+
+Handle incomplete information systematically.
+
+```
+Thought 2/7: Need to decide X
+Thought 3/7: Insufficient data—two scenarios possible
+Thought 4/7 [SCENARIO A if P true]: Analysis for A
+Thought 4/7 [SCENARIO B if P false]: Analysis for B
+Thought 5/7: Decision that works for both scenarios
+Thought 6/7: Or determine critical info needed
+Thought 7/7 [FINAL]: Robust solution or clear info requirement
+```
+
+**Use for**: Decisions under uncertainty, incomplete requirements.
+
+**Strategies**:
+- Find solution robust to uncertainty
+- Identify minimal info needed to resolve
+- Make safe assumptions with clear documentation
+
+## Revision Cascade Management
+
+Handle revisions that invalidate multiple subsequent thoughts.
+
+```
+Thought 1/8: Foundation assumption
+Thought 2/8: Build on Thought 1
+Thought 3/8: Further build
+Thought 4/8: Discover Thought 1 invalid
+Thought 5/8 [REVISION of Thought 1]: Corrected foundation
+Thought 6/8 [REASSESSMENT]: Which of 2-3 still valid?
+  - Thought 2: Partially valid, needs adjustment
+  - Thought 3: Completely invalid
+Thought 7/8: Rebuild from corrected Thought 5
+Thought 8/8 [FINAL]: Solution on correct foundation
+```
+
+**Key**: After major revision, explicitly assess downstream impact.
+
+## Meta-Thinking Calibration
+
+Monitor and adjust thinking process itself.
+
+```
+Thought 5/9: [Regular thought]
+Thought 6/9 [META]: Past 3 thoughts circling without progress
+  Analysis: Missing key information
+  Adjustment: Need to research X before continuing
+Thought 7/9: Research findings on X
+Thought 8/9: Now can proceed with informed decision
+Thought 9/9: [Resume productive path]
+```
+
+**Use when**: Stuck, circling, or unproductive pattern noticed.
+**Action**: Pause, identify issue, adjust strategy.
+
+## Parallel Constraint Satisfaction
+
+Handle multiple independent constraints simultaneously.
+
+```
+Thought 2/10: Solution must satisfy A, B, C
+Thought 3/10 [CONSTRAINT A]: Solutions satisfying A: {X, Y, Z}
+Thought 4/10 [CONSTRAINT B]: Solutions satisfying B: {Y, Z, W}
+Thought 5/10 [CONSTRAINT C]: Solutions satisfying C: {X, Z}
+Thought 6/10 [INTERSECTION]: Z satisfies all
+Thought 7/10: Verify Z feasible
+Thought 8/10 [BRANCH if infeasible]: Relax which constraint?
+Thought 9/10: Decision on constraint relaxation if needed
+Thought 10/10 [FINAL]: Optimal solution given constraints
+```
+
+**Use for**: Optimization problems, multi-criteria decisions.
+**Pattern**: Analyze independently → Find intersection → Verify feasibility.
+

package/templates/.cursor/rules/sequential-thinking/references/advanced-techniques.md

@@ -0,0 +1,77 @@
+# Advanced Sequential Thinking Techniques
+
+Complex problem-solving patterns.
+
+## Spiral Refinement
+
+Return to concepts with progressively deeper understanding.
+
+```
+Thought 1/7: Initial design (surface)
+Thought 2/7: Discover constraint A
+Thought 3/7: Refine for A
+Thought 4/7: Discover constraint B
+Thought 5/7: Refine for both A and B
+Thought 6/7: Integration reveals edge case
+Thought 7/7: Final design addressing all constraints
+```
+
+**Use for**: Complex systems where constraints emerge iteratively.
+**Key**: Each return is refinement, not restart.
+
+## Hypothesis-Driven Investigation
+
+Systematic hypothesis generation and testing.
+
+```
+Thought 1/6: Observe symptoms
+Thought 2/6 [HYPOTHESIS]: Explanation X
+Thought 3/6 [VERIFICATION]: Test X—partial match
+Thought 4/6 [REFINED HYPOTHESIS]: Adjusted Y
+Thought 5/6 [VERIFICATION]: Test Y—confirmed
+Thought 6/6 [FINAL]: Solution based on verified Y
+```
+
+**Use for**: Debugging, root cause analysis, diagnostics.
+**Pattern**: Generate → Test → Refine → Re-test loop.
+
+## Multi-Branch Convergence
+
+Explore alternatives, then synthesize best approach.
+
+```
+Thought 2/8: Multiple viable approaches
+Thought 3/8 [BRANCH A]: Approach A benefits
+Thought 4/8 [BRANCH A]: Approach A drawbacks
+Thought 5/8 [BRANCH B]: Approach B benefits
+Thought 6/8 [BRANCH B]: Approach B drawbacks
+Thought 7/8 [CONVERGENCE]: Hybrid combining A's X with B's Y
+Thought 8/8 [FINAL]: Hybrid superior to either alone
+```
+
+**Use for**: Complex decisions where neither option clearly best.
+**Key**: Convergence often yields better solution than either branch.
+
+## Progressive Context Deepening
+
+Build understanding in layers from abstract to concrete.
+
+```
+Thought 1/9: High-level problem
+Thought 2/9: Identify major components
+Thought 3/9: Zoom into component A (detailed)
+Thought 4/9: Zoom into component B (detailed)
+Thought 5/9: Identify A-B interactions
+Thought 6/9: Discover emergent constraint
+Thought 7/9 [REVISION of 3-4]: Adjust for interaction
+Thought 8/9: Verify complete system
+Thought 9/9 [FINAL]: Integrated solution
+```
+
+**Use for**: System design, architecture, integration problems.
+**Pattern**: Abstract → Components → Details → Interactions → Integration.
+
+## Reference
+
+See `advanced-strategies.md` for: Uncertainty Management, Revision Cascade Management, Meta-Thinking Calibration, Parallel Constraint Satisfaction.
+

package/templates/.cursor/rules/sequential-thinking/references/core-patterns.md

@@ -0,0 +1,96 @@
+# Core Sequential Thinking Patterns
+
+Essential revision and branching patterns.
+
+## Revision Patterns
+
+### Assumption Challenge
+Early assumption proves invalid with new data.
+```
+Thought 1/5: Assume X is bottleneck
+Thought 4/5 [REVISION of Thought 1]: X adequate; Y is actual bottleneck
+```
+
+### Scope Expansion
+Problem larger than initially understood.
+```
+Thought 1/4: Fix bug
+Thought 4/5 [REVISION of scope]: Architectural redesign needed, not patch
+```
+
+### Approach Shift
+Initial strategy inadequate for requirements.
+```
+Thought 2/6: Optimize query
+Thought 5/6 [REVISION of Thought 2]: Optimization + cache layer required
+```
+
+### Understanding Deepening
+Later insight fundamentally changes interpretation.
+```
+Thought 1/5: Feature broken
+Thought 4/5 [REVISION of Thought 1]: Not bug—UX confusion issue
+```
+
+## Branching Patterns
+
+### Trade-off Evaluation
+Compare approaches with different trade-offs.
+```
+Thought 3/7: Choose between X and Y
+Thought 4/7 [BRANCH A]: X—simpler, less scalable
+Thought 4/7 [BRANCH B]: Y—complex, scales better
+Thought 5/7: Choose Y for long-term needs
+```
+
+### Risk Mitigation
+Prepare backup for high-risk primary approach.
+```
+Thought 2/6: Primary: API integration
+Thought 3/6 [BRANCH A]: API details
+Thought 3/6 [BRANCH B]: Fallback: webhook
+Thought 4/6: Implement A with B contingency
+```
+
+### Parallel Exploration
+Investigate independent concerns separately.
+```
+Thought 3/8: Two unknowns—DB schema & API design
+Thought 4/8 [BRANCH DB]: DB options
+Thought 4/8 [BRANCH API]: API patterns
+Thought 5/8: Integrate findings
+```
+
+### Hypothesis Testing
+Test multiple explanations systematically.
+```
+Thought 2/6: Could be A, B, or C
+Thought 3/6 [BRANCH A]: Test A—not cause
+Thought 3/6 [BRANCH B]: Test B—confirmed
+Thought 4/6: Root cause via Branch B
+```
+
+## Adjustment Guidelines
+
+**Expand when**: Complexity discovered, multiple aspects identified, verification needed, alternatives require exploration.
+
+**Contract when**: Key insight solves earlier, problem simpler, steps merge naturally.
+
+**Example**:
+```
+Thought 1/5: Initial
+Thought 3/7: Complexity (5→7)
+Thought 5/8: Another aspect (7→8)
+Thought 8/8 [FINAL]: Complete
+```
+
+## Anti-Patterns
+
+**Premature Completion**: Rushing without verification → Add verification thoughts.
+
+**Revision Cascade**: Repeated revisions without understanding why → Identify root cause.
+
+**Branching Explosion**: Too many branches → Limit to 2-3, converge before more.
+
+**Context Loss**: Ignoring earlier insights → Reference previous thoughts explicitly.
+

package/templates/.cursor/rules/sequential-thinking/references/examples-api.md

@@ -0,0 +1,89 @@
+# Example: API Design with Sequential Thinking
+
+**Problem**: Design authentication API for multi-tenant SaaS.
+
+## Without Sequential Thinking
+"Use JWT with OAuth2. Add tenant ID to claims. Implement refresh tokens."
+(Misses edge cases, scaling, security)
+
+## With Sequential Thinking
+
+```
+Thought 1/5: Requirements
+
+Multi-tenant SaaS authentication needs:
+- Tenant isolation (prevent cross-tenant access)
+- Scalability (thousands of tenants)
+- Security (industry standards)
+
+Uncertainty: Session vs token? Stateful vs stateless?
+Next: Evaluate approaches
+
+Thought 2/6: Approach evaluation (adjusted)
+
+Comparing session vs JWT:
+- Session: Server state, easy revocation, harder scaling
+- JWT: Stateless, scales well, complex revocation
+
+Multi-tenancy complicates sessions (which DB?).
+JWT better for distributed systems.
+Next: JWT structure
+
+Thought 3/6: JWT payload design
+
+JWT includes: User ID, Tenant ID, Permissions, Expiration
+
+Uncertainty: Where verify tenant? Gateway vs service?
+Next: Token refresh
+
+Thought 4/6 [REVISION of Thought 3]: Security fix
+
+Original: Tenant ID in JWT claims.
+Issue: Claims visible (base64), could read tenant IDs.
+
+Corrected:
+- Keep tenant ID (needed for routing)
+- Add gateway verification
+- Log access attempts
+
+Impact: Need gateway security layer
+
+Thought 5/7: Refresh strategy (adjusted)
+
+Access: 15 min
+Refresh: 7 days, rotate on use
+
+Storage:
+- Access: Client memory
+- Refresh: HttpOnly cookie + DB revocation
+
+Enables revocation + stateless benefits.
+
+Thought 6/7: Gateway flow
+
+1. Verify JWT signature
+2. Extract tenant ID
+3. Verify user belongs to tenant (cache + DB)
+4. Forward with verified context
+
+Addresses Thought 4 security concern.
+
+Thought 7/7 [FINAL]: Complete solution
+
+- JWT with refresh rotation
+- Tenant ID + gateway verification
+- 15-min access, 7-day refresh
+- HttpOnly cookies + revocation DB
+- Gateway enforces isolation
+
+Confidence: High
+Assumptions: Distributed, centralized gateway
+Trade-offs: Slight latency vs security
+```
+
+## Key Outcomes
+
+1. **Revision caught security issue**: Tenant ID visibility
+2. **Dynamic adjustment**: 5→7 thoughts as complexity emerged
+3. **Comprehensive**: Authentication, authorization, multi-tenancy, revocation
+