aigroup-workflow 2.1.2 → 2.2.0

package/skills/flutter-expert/references/widget-patterns.md

@@ -1,123 +0,0 @@
-# Widget Patterns
-
-## Optimized Widget Pattern
-
-```dart
-// Use const constructors
-class OptimizedCard extends StatelessWidget {
-  final String title;
-  final VoidCallback onTap;
-
-  const OptimizedCard({
-    super.key,
-    required this.title,
-    required this.onTap,
-  });
-
-  @override
-  Widget build(BuildContext context) {
-    return Card(
-      child: InkWell(
-        onTap: onTap,
-        child: Padding(
-          padding: const EdgeInsets.all(16),
-          child: Text(title, style: Theme.of(context).textTheme.titleMedium),
-        ),
-      ),
-    );
-  }
-}
-```
-
-## Responsive Layout
-
-```dart
-class ResponsiveLayout extends StatelessWidget {
-  final Widget mobile;
-  final Widget? tablet;
-  final Widget desktop;
-
-  const ResponsiveLayout({
-    super.key,
-    required this.mobile,
-    this.tablet,
-    required this.desktop,
-  });
-
-  @override
-  Widget build(BuildContext context) {
-    return LayoutBuilder(
-      builder: (context, constraints) {
-        if (constraints.maxWidth >= 1100) return desktop;
-        if (constraints.maxWidth >= 650) return tablet ?? mobile;
-        return mobile;
-      },
-    );
-  }
-}
-```
-
-## Custom Hooks (flutter_hooks)
-
-```dart
-import 'package:flutter_hooks/flutter_hooks.dart';
-
-class CounterWidget extends HookWidget {
-  @override
-  Widget build(BuildContext context) {
-    final counter = useState(0);
-    final controller = useTextEditingController();
-
-    useEffect(() {
-      // Setup
-      return () {
-        // Cleanup
-      };
-    }, []);
-
-    return Column(
-      children: [
-        Text('Count: ${counter.value}'),
-        ElevatedButton(
-          onPressed: () => counter.value++,
-          child: const Text('Increment'),
-        ),
-      ],
-    );
-  }
-}
-```
-
-## Sliver Patterns
-
-```dart
-CustomScrollView(
-  slivers: [
-    SliverAppBar(
-      expandedHeight: 200,
-      pinned: true,
-      flexibleSpace: FlexibleSpaceBar(
-        title: const Text('Title'),
-        background: Image.network(imageUrl, fit: BoxFit.cover),
-      ),
-    ),
-    SliverList(
-      delegate: SliverChildBuilderDelegate(
-        (context, index) => ListTile(title: Text('Item $index')),
-        childCount: 100,
-      ),
-    ),
-  ],
-)
-```
-
-## Key Optimization Patterns
-
-| Pattern | Implementation |
-|---------|----------------|
-| **const widgets** | Add `const` to static widgets |
-| **keys** | Use `Key` for list items |
-| **select** | `ref.watch(provider.select(...))` |
-| **RepaintBoundary** | Isolate expensive repaints |
-| **ListView.builder** | Lazy loading for lists |
-| **const constructors** | Always use when possible |

package/skills/fullstack-guardian/SKILL.md

@@ -1,105 +0,0 @@
----
-name: fullstack-guardian
-description: Builds security-focused full-stack web applications by implementing integrated frontend and backend components with layered security at every level. Covers the complete stack from database to UI, enforcing auth, input validation, output encoding, and parameterized queries across all layers. Use when implementing features across frontend and backend, building REST APIs with corresponding UI, connecting frontend components to backend endpoints, creating end-to-end data flows from database to UI, or implementing CRUD operations with UI forms. Distinct from frontend-only, backend-only, or API-only skills in that it simultaneously addresses all three perspectives—Frontend, Backend, and Security—within a single implementation workflow. Invoke for full-stack feature work, web app development, authenticated API routes with views, microservices, real-time features, monorepo architecture, or technology selection decisions.
-license: MIT
-metadata:
-  author: https://github.com/Jeffallan
-  version: "1.1.1"
-  domain: security
-  triggers: fullstack, implement feature, build feature, create API, frontend and backend, full stack, new feature, implement, microservices, websocket, real-time, deployment pipeline, monorepo, architecture decision, technology selection, end-to-end
-  role: expert
-  scope: implementation
-  output-format: code
-  related-skills: feature-forge, test-master, devops-engineer, secure-code-guardian, architecture-designer, react-expert, typescript-pro
----
-
-# Fullstack Guardian
-
-Security-focused full-stack developer implementing features across the entire application stack.
-
-## Core Workflow
-
-1. **Gather requirements** - Understand feature scope and acceptance criteria
-2. **Design solution** - Consider all three perspectives (Frontend/Backend/Security)
-3. **Write technical design** - Document approach in `specs/{feature}_design.md`
-4. **Security checkpoint** - Run through `references/security-checklist.md` before writing any code; confirm auth, authz, validation, and output encoding are addressed
-5. **Implement** - Build incrementally, testing each component as you go
-6. **Hand off** - Pass to Test Master for QA, DevOps for deployment
-
-## Reference Guide
-
-Load detailed guidance based on context:
-
-| Topic | Reference | Load When |
-|-------|-----------|-----------|
-| Design Template | `references/design-template.md` | Starting feature, three-perspective design |
-| Security Checklist | `references/security-checklist.md` | Every feature - auth, authz, validation |
-| Error Handling | `references/error-handling.md` | Implementing error flows |
-| Common Patterns | `references/common-patterns.md` | CRUD, forms, API flows |
-| Backend Patterns | `references/backend-patterns.md` | Microservices, queues, observability, Docker |
-| Frontend Patterns | `references/frontend-patterns.md` | Real-time, optimization, accessibility, testing |
-| Integration Patterns | `references/integration-patterns.md` | Type sharing, deployment, architecture decisions |
-| API Design | `references/api-design-standards.md` | REST/GraphQL APIs, versioning, CORS, validation |
-| Architecture Decisions | `references/architecture-decisions.md` | Tech selection, monolith vs microservices |
-| Deliverables Checklist | `references/deliverables-checklist.md` | Completing features, preparing handoff |
-
-## Constraints
-
-### MUST DO
-- Address all three perspectives (Frontend, Backend, Security)
-- Validate input on both client and server
-- Use parameterized queries (prevent SQL injection)
-- Sanitize output (prevent XSS)
-- Implement proper error handling at every layer
-- Log security-relevant events
-- Write the implementation plan before coding
-- Test each component as you build
-
-### MUST NOT DO
-- Skip security considerations
-- Trust client-side validation alone
-- Expose sensitive data in API responses
-- Hardcode credentials or secrets
-- Implement features without acceptance criteria
-- Skip error handling for "happy path only"
-
-## Three-Perspective Example
-
-A minimal authenticated endpoint illustrating all three layers:
-
-**[Backend]** — Authenticated route with parameterized query and scoped response:
-```python
-@router.get("/users/{user_id}/profile", dependencies=[Depends(require_auth)])
-async def get_profile(user_id: int, current_user: User = Depends(get_current_user)):
-    if current_user.id != user_id:
-        raise HTTPException(status_code=403, detail="Forbidden")
-    # Parameterized query — no raw string interpolation
-    row = await db.fetchone("SELECT id, name, email FROM users WHERE id = ?", (user_id,))
-    if not row:
-        raise HTTPException(status_code=404, detail="Not found")
-    return ProfileResponse(**row)   # explicit schema — no password/token leakage
-```
-
-**[Frontend]** — Component calls the endpoint and handles errors gracefully:
-```typescript
-async function fetchProfile(userId: number): Promise<Profile> {
-  const res = await apiFetch(`/users/${userId}/profile`);   // apiFetch attaches auth header
-  if (!res.ok) throw new Error(await res.text());
-  return res.json();
-}
-// Client-side input guard (never the only guard)
-if (!Number.isInteger(userId) || userId <= 0) throw new Error("Invalid user ID");
-```
-
-**[Security]**
-- Auth enforced server-side via `require_auth` dependency; client header is a convenience, not the gate.
-- Response schema (`ProfileResponse`) explicitly excludes sensitive fields.
-- 403 returned before any DB access when IDs don't match — no timing leak via 404.
-
-## Output Templates
-
-When implementing features, provide:
-1. Technical design document (if non-trivial)
-2. Backend code (models, schemas, endpoints)
-3. Frontend code (components, hooks, API calls)
-4. Brief security notes

package/skills/fullstack-guardian/references/api-design-standards.md

@@ -1,307 +0,0 @@
-# API Design Standards
-
-## RESTful API Conventions
-
-### URL Structure
-```
-# Collection vs Resource
-GET    /api/users          # List all users
-POST   /api/users          # Create user
-GET    /api/users/:id      # Get single user
-PUT    /api/users/:id      # Full update
-PATCH  /api/users/:id      # Partial update
-DELETE /api/users/:id      # Delete user
-
-# Nested resources
-GET    /api/users/:id/posts        # User's posts
-POST   /api/users/:id/posts        # Create post for user
-GET    /api/posts/:id/comments     # Comments on post
-```
-
-### HTTP Status Codes
-```typescript
-// Success codes
-200 OK              // GET, PUT, PATCH successful
-201 Created         // POST successful, resource created
-204 No Content      // DELETE successful, no body
-202 Accepted        // Async operation queued
-
-// Client error codes
-400 Bad Request     // Malformed request
-401 Unauthorized    // Authentication required
-403 Forbidden       // Authenticated but not authorized
-404 Not Found       // Resource doesn't exist
-409 Conflict        // Resource conflict (e.g., duplicate)
-422 Unprocessable   // Validation failed
-429 Too Many Requests // Rate limit exceeded
-
-// Server error codes
-500 Internal Server Error  // Unhandled exception
-502 Bad Gateway           // Upstream service failed
-503 Service Unavailable   // Temporary downtime
-```
-
-### Standardized Error Responses
-```typescript
-interface ApiError {
-  error: {
-    code: string;           // Machine-readable error code
-    message: string;        // Human-readable message
-    details?: {             // Field-level validation errors
-      [field: string]: string[];
-    };
-    requestId: string;      // For support/debugging
-    timestamp: string;      // ISO 8601 timestamp
-  };
-}
-
-// Examples
-{
-  "error": {
-    "code": "VALIDATION_ERROR",
-    "message": "Invalid input data",
-    "details": {
-      "email": ["Must be a valid email address"],
-      "password": ["Must be at least 12 characters"]
-    },
-    "requestId": "req_abc123",
-    "timestamp": "2025-01-15T10:30:00Z"
-  }
-}
-
-{
-  "error": {
-    "code": "RESOURCE_NOT_FOUND",
-    "message": "User not found",
-    "requestId": "req_def456",
-    "timestamp": "2025-01-15T10:31:00Z"
-  }
-}
-```
-
-### Pagination
-```typescript
-// Query parameters
-GET /api/users?page=1&limit=20&sort=-createdAt&filter[role]=admin
-
-// Response format
-interface PaginatedResponse<T> {
-  data: T[];
-  meta: {
-    page: number;
-    limit: number;
-    total: number;
-    totalPages: number;
-  };
-  links?: {
-    first: string;
-    prev?: string;
-    next?: string;
-    last: string;
-  };
-}
-
-// Implementation
-@Get()
-async findAll(
-  @Query('page', new DefaultValuePipe(1), ParseIntPipe) page: number,
-  @Query('limit', new DefaultValuePipe(20), ParseIntPipe) limit: number,
-) {
-  const [data, total] = await this.service.findAndCount({ page, limit });
-  return {
-    data,
-    meta: {
-      page,
-      limit,
-      total,
-      totalPages: Math.ceil(total / limit),
-    },
-    links: {
-      first: `/api/users?page=1&limit=${limit}`,
-      next: page < totalPages ? `/api/users?page=${page + 1}&limit=${limit}` : undefined,
-      last: `/api/users?page=${totalPages}&limit=${limit}`,
-    },
-  };
-}
-```
-
-## API Versioning
-
-### URL Path Versioning (Recommended)
-```typescript
-// Version in URL path
-GET /api/v1/users
-GET /api/v2/users
-
-// Express routing
-app.use('/api/v1', v1Router);
-app.use('/api/v2', v2Router);
-
-// NestJS versioning
-@Controller({ version: '1', path: 'users' })
-export class UsersV1Controller {}
-
-@Controller({ version: '2', path: 'users' })
-export class UsersV2Controller {}
-```
-
-### Header Versioning (Alternative)
-```typescript
-// Request header
-GET /api/users
-Accept-Version: v2
-
-// Middleware
-app.use((req, res, next) => {
-  const version = req.headers['accept-version'] || 'v1';
-  req.apiVersion = version;
-  next();
-});
-```
-
-## Rate Limiting
-
-### Per-Endpoint Configuration
-```typescript
-// Express with express-rate-limit
-import rateLimit from 'express-rate-limit';
-
-const generalLimiter = rateLimit({
-  windowMs: 15 * 60 * 1000, // 15 minutes
-  max: 100,                 // 100 requests per window
-  message: 'Too many requests from this IP',
-});
-
-const authLimiter = rateLimit({
-  windowMs: 15 * 60 * 1000,
-  max: 5,                   // Stricter for auth endpoints
-  skipSuccessfulRequests: true,
-});
-
-app.use('/api/', generalLimiter);
-app.use('/api/auth/', authLimiter);
-```
-
-### Redis-backed Rate Limiting
-```typescript
-import { RateLimiterRedis } from 'rate-limiter-flexible';
-
-const rateLimiter = new RateLimiterRedis({
-  storeClient: redisClient,
-  keyPrefix: 'rate-limit',
-  points: 100,              // Number of requests
-  duration: 60,             // Per 60 seconds
-});
-
-app.use(async (req, res, next) => {
-  try {
-    await rateLimiter.consume(req.ip);
-    next();
-  } catch (error) {
-    res.status(429).json({ error: 'Too Many Requests' });
-  }
-});
-```
-
-## CORS Configuration
-
-### Production-ready CORS
-```typescript
-import cors from 'cors';
-
-const corsOptions = {
-  origin: (origin, callback) => {
-    const allowedOrigins = [
-      'https://app.example.com',
-      'https://admin.example.com',
-    ];
-
-    if (!origin || allowedOrigins.includes(origin)) {
-      callback(null, true);
-    } else {
-      callback(new Error('Not allowed by CORS'));
-    }
-  },
-  credentials: true,                    // Allow cookies
-  methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
-  allowedHeaders: ['Content-Type', 'Authorization'],
-  exposedHeaders: ['X-Total-Count'],
-  maxAge: 86400,                        // 24 hours preflight cache
-};
-
-app.use(cors(corsOptions));
-```
-
-## Request/Response Validation
-
-### Input Validation with Zod
-```typescript
-import { z } from 'zod';
-
-const createUserSchema = z.object({
-  email: z.string().email(),
-  name: z.string().min(1).max(100),
-  age: z.number().int().min(18).max(120).optional(),
-  role: z.enum(['user', 'admin']).default('user'),
-});
-
-// Middleware
-const validate = (schema: z.ZodSchema) => (req, res, next) => {
-  try {
-    req.validatedBody = schema.parse(req.body);
-    next();
-  } catch (error) {
-    res.status(422).json({
-      error: {
-        code: 'VALIDATION_ERROR',
-        message: 'Invalid request data',
-        details: error.errors,
-      },
-    });
-  }
-};
-
-app.post('/api/users', validate(createUserSchema), createUserHandler);
-```
-
-## API Documentation
-
-### OpenAPI/Swagger Setup
-```typescript
-// NestJS with Swagger
-import { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';
-
-const config = new DocumentBuilder()
-  .setTitle('API Documentation')
-  .setDescription('The API description')
-  .setVersion('1.0')
-  .addBearerAuth()
-  .build();
-
-const document = SwaggerModule.createDocument(app, config);
-SwaggerModule.setup('api/docs', app, document);
-
-// Decorate endpoints
-@ApiOperation({ summary: 'Create a new user' })
-@ApiResponse({ status: 201, description: 'User created successfully' })
-@ApiResponse({ status: 422, description: 'Validation failed' })
-@Post()
-async create(@Body() dto: CreateUserDto) {
-  return this.service.create(dto);
-}
-```
-
-## Quick Reference
-
-| Aspect | Standard | Example |
-|--------|----------|---------|
-| URL naming | Plural nouns | `/api/users` not `/api/user` |
-| HTTP methods | RESTful semantics | GET (read), POST (create), PUT/PATCH (update), DELETE |
-| Status codes | Semantic usage | 200 (success), 201 (created), 422 (validation) |
-| Errors | Consistent format | `{ error: { code, message, details } }` |
-| Pagination | Meta + links | `{ data, meta: { page, total }, links }` |
-| Versioning | URL path | `/api/v1/users` |
-| Rate limiting | Per-endpoint | Auth: 5/min, General: 100/15min |
-| CORS | Whitelist origins | Production domains only |
-| Validation | Schema-based | Zod/Pydantic with detailed errors |
-| Documentation | OpenAPI | Auto-generated from decorators |