aigroup-workflow 2.1.2 → 2.2.1

package/skills/fullstack-guardian/references/common-patterns.md

@@ -1,134 +0,0 @@
-# Common Patterns
-
-## API + Frontend Flow
-
-```
-User Action → Frontend Validation → API Call → Backend Validation
-→ Business Logic → Database → Response → UI Update
-```
-
-## CRUD Implementation
-
-### Create
-
-```typescript
-// Frontend
-const createUser = async (data: CreateUserDto) => {
-  const response = await fetch('/api/users', {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify(data),
-  });
-  if (!response.ok) throw await response.json();
-  return response.json();
-};
-
-// Backend (NestJS)
-@Post()
-async create(@Body() dto: CreateUserDto): Promise<User> {
-  return this.userService.create(dto);
-}
-```
-
-### Read (List with Pagination)
-
-```typescript
-// Frontend
-const { data, isLoading } = useQuery({
-  queryKey: ['users', page, limit],
-  queryFn: () => fetch(`/api/users?page=${page}&limit=${limit}`).then(r => r.json()),
-});
-
-// Backend
-@Get()
-async findAll(
-  @Query('page', new DefaultValuePipe(1), ParseIntPipe) page: number,
-  @Query('limit', new DefaultValuePipe(20), ParseIntPipe) limit: number,
-): Promise<PaginatedResponse<User>> {
-  return this.userService.findAll({ page, limit });
-}
-```
-
-### Update
-
-```typescript
-// Frontend with optimistic update
-const updateUser = useMutation({
-  mutationFn: (data: UpdateUserDto) => api.patch(`/users/${id}`, data),
-  onMutate: async (newData) => {
-    await queryClient.cancelQueries(['user', id]);
-    const previous = queryClient.getQueryData(['user', id]);
-    queryClient.setQueryData(['user', id], (old) => ({ ...old, ...newData }));
-    return { previous };
-  },
-  onError: (err, newData, context) => {
-    queryClient.setQueryData(['user', id], context.previous);
-  },
-});
-
-// Backend
-@Patch(':id')
-async update(
-  @Param('id') id: string,
-  @Body() dto: UpdateUserDto,
-): Promise<User> {
-  return this.userService.update(id, dto);
-}
-```
-
-### Delete
-
-```typescript
-// Frontend with confirmation
-const handleDelete = async () => {
-  if (!confirm('Are you sure?')) return;
-  await api.delete(`/users/${id}`);
-  router.push('/users');
-};
-
-// Backend (soft delete)
-@Delete(':id')
-@HttpCode(204)
-async remove(@Param('id') id: string): Promise<void> {
-  await this.userService.softDelete(id);
-}
-```
-
-## Form Handling
-
-```typescript
-// React Hook Form + Zod
-const schema = z.object({
-  name: z.string().min(1, 'Required'),
-  email: z.string().email('Invalid email'),
-});
-
-function UserForm({ onSubmit }: Props) {
-  const { register, handleSubmit, formState: { errors } } = useForm({
-    resolver: zodResolver(schema),
-  });
-
-  return (
-    <form onSubmit={handleSubmit(onSubmit)}>
-      <input {...register('name')} />
-      {errors.name && <span>{errors.name.message}</span>}
-
-      <input {...register('email')} />
-      {errors.email && <span>{errors.email.message}</span>}
-
-      <button type="submit">Save</button>
-    </form>
-  );
-}
-```
-
-## Quick Reference
-
-| Pattern | Frontend | Backend |
-|---------|----------|---------|
-| Create | POST + form | Validate + insert |
-| Read | GET + query | Paginate + filter |
-| Update | PATCH + optimistic | Validate + update |
-| Delete | DELETE + confirm | Soft delete |
-| Auth | Token storage | JWT middleware |
-| Upload | FormData | Multer/streaming |

package/skills/fullstack-guardian/references/deliverables-checklist.md

@@ -1,354 +0,0 @@
-# Deliverables Checklist
-
-## Code Deliverables
-
-### Backend Files
-- [ ] API endpoint implementations
-- [ ] Database models and schemas
-- [ ] Validation schemas (Zod/Pydantic)
-- [ ] Business logic services
-- [ ] Middleware (auth, error handling, logging)
-- [ ] Database migrations with rollback
-- [ ] Environment configuration files
-- [ ] Docker/container configuration
-
-### Frontend Files
-- [ ] Component files with TypeScript interfaces
-- [ ] Custom hooks for data fetching
-- [ ] State management setup (Redux/Zustand/Context)
-- [ ] API client/service layer
-- [ ] Form components with validation
-- [ ] Error boundary components
-- [ ] Routing configuration
-- [ ] Style files (CSS/SCSS/styled-components)
-
-### Shared/Integration Files
-- [ ] Shared TypeScript types package
-- [ ] Shared validation schemas
-- [ ] API contract definitions
-- [ ] Utility functions used across stack
-- [ ] Configuration types
-- [ ] Constants and enums
-
-## Testing Deliverables
-
-### Unit Tests
-```typescript
-// Backend: Service layer tests
-describe('UserService', () => {
-  it('should create user with hashed password', async () => {
-    const user = await userService.create({
-      email: 'test@example.com',
-      password: 'SecurePass123!',
-    });
-    expect(user.password).not.toBe('SecurePass123!');
-    expect(user.email).toBe('test@example.com');
-  });
-});
-
-// Frontend: Component tests
-describe('UserForm', () => {
-  it('should validate email format', async () => {
-    render(<UserForm onSubmit={jest.fn()} />);
-    await userEvent.type(screen.getByLabelText('Email'), 'invalid');
-    await userEvent.click(screen.getByText('Submit'));
-    expect(screen.getByText(/invalid email/i)).toBeInTheDocument();
-  });
-});
-```
-
-### Integration Tests
-```typescript
-// API endpoint tests
-describe('POST /api/users', () => {
-  it('should create user and return 201', async () => {
-    const response = await request(app)
-      .post('/api/users')
-      .send({ email: 'new@example.com', password: 'Pass123!' });
-
-    expect(response.status).toBe(201);
-    expect(response.body).toHaveProperty('id');
-    expect(response.body.email).toBe('new@example.com');
-  });
-
-  it('should return 422 for duplicate email', async () => {
-    await createUser({ email: 'existing@example.com' });
-
-    const response = await request(app)
-      .post('/api/users')
-      .send({ email: 'existing@example.com', password: 'Pass123!' });
-
-    expect(response.status).toBe(422);
-    expect(response.body.error.code).toBe('DUPLICATE_EMAIL');
-  });
-});
-```
-
-### E2E Tests
-```typescript
-// Playwright test
-test('complete user registration flow', async ({ page }) => {
-  await page.goto('/register');
-  await page.fill('[name="email"]', 'newuser@example.com');
-  await page.fill('[name="password"]', 'SecurePass123!');
-  await page.click('button[type="submit"]');
-
-  await expect(page).toHaveURL('/dashboard');
-  await expect(page.locator('[data-testid="welcome-message"]'))
-    .toContainText('Welcome');
-});
-```
-
-### Test Coverage Requirements
-- [ ] Unit tests: >80% coverage
-- [ ] Integration tests: All critical paths
-- [ ] E2E tests: Main user journeys
-- [ ] Performance tests: Load/stress scenarios
-- [ ] Security tests: OWASP Top 10 validation
-
-## Documentation Deliverables
-
-### Technical Documentation
-```markdown
-# Feature: User Management API
-
-## Overview
-Complete CRUD API for user management with authentication and authorization.
-
-## Endpoints
-
-### Create User
-POST /api/v1/users
-
-Request:
-{
-  "email": "user@example.com",
-  "name": "John Doe",
-  "password": "SecurePass123!"
-}
-
-Response (201):
-{
-  "id": "usr_abc123",
-  "email": "user@example.com",
-  "name": "John Doe",
-  "createdAt": "2025-01-15T10:00:00Z"
-}
-
-### Authentication
-All endpoints except POST /users require Bearer token:
-Authorization: Bearer <jwt_token>
-
-### Error Responses
-422 Validation Error:
-{
-  "error": {
-    "code": "VALIDATION_ERROR",
-    "message": "Invalid input",
-    "details": { "email": ["Must be valid email"] }
-  }
-}
-```
-
-### Component Documentation
-```typescript
-/**
- * UserProfileForm - Editable user profile form with validation
- *
- * @example
- * <UserProfileForm
- *   initialData={currentUser}
- *   onSubmit={handleUpdate}
- *   onCancel={() => router.back()}
- * />
- *
- * @param initialData - User data to pre-populate form
- * @param onSubmit - Callback when form is submitted with valid data
- * @param onCancel - Optional callback when user cancels editing
- */
-export function UserProfileForm({
-  initialData,
-  onSubmit,
-  onCancel
-}: UserProfileFormProps) {
-  // Component implementation
-}
-```
-
-### README Updates
-- [ ] Installation instructions
-- [ ] Environment variable configuration
-- [ ] Development setup steps
-- [ ] Build and deployment commands
-- [ ] Testing instructions
-- [ ] Troubleshooting guide
-
-### Storybook Documentation (Frontend)
-```typescript
-// UserCard.stories.tsx
-export default {
-  title: 'Components/UserCard',
-  component: UserCard,
-} as Meta;
-
-export const Default: Story = {
-  args: {
-    user: {
-      name: 'John Doe',
-      email: 'john@example.com',
-      avatar: 'https://example.com/avatar.jpg',
-    },
-  },
-};
-
-export const Loading: Story = {
-  args: { isLoading: true },
-};
-
-export const WithLongName: Story = {
-  args: {
-    user: {
-      name: 'Johnathan Alexander Wellington III',
-      email: 'johnathan@example.com',
-    },
-  },
-};
-```
-
-## Performance Deliverables
-
-### Metrics Report
-```markdown
-## Performance Metrics
-
-### Backend API
-- Average response time: 45ms
-- P95 response time: 120ms
-- P99 response time: 250ms
-- Throughput: 1000 req/s
-- Error rate: 0.02%
-
-### Frontend Bundle
-- Initial bundle size: 245 KB (gzipped)
-- Largest chunk: 180 KB
-- Time to Interactive: 1.2s
-- Lighthouse score: 95/100
-
-### Database Queries
-- Average query time: 15ms
-- Slowest query: 85ms (user search)
-- Index usage: 98%
-- Connection pool utilization: 60%
-```
-
-### Bundle Analysis
-- [ ] Webpack/Vite bundle analysis report
-- [ ] Lighthouse performance audit
-- [ ] Core Web Vitals measurements
-- [ ] Bundle size comparison (before/after)
-
-## Security Deliverables
-
-### Security Checklist
-- [ ] Input validation on all endpoints
-- [ ] Output sanitization (XSS prevention)
-- [ ] SQL injection prevention (parameterized queries)
-- [ ] CSRF protection enabled
-- [ ] Rate limiting configured
-- [ ] Authentication required where needed
-- [ ] Authorization checks implemented
-- [ ] Sensitive data excluded from responses
-- [ ] Secrets in environment variables
-- [ ] HTTPS enforced in production
-- [ ] Security headers configured (CSP, HSTS, etc.)
-
-### Security Audit Report
-```markdown
-## Security Review
-
-### Authentication
-- JWT with RS256 algorithm
-- 15-minute access tokens
-- 7-day refresh tokens
-- Secure cookie storage
-
-### Authorization
-- Role-based access control (RBAC)
-- Resource ownership validation
-- Permission checks on all mutations
-
-### Data Protection
-- Passwords hashed with bcrypt (12 rounds)
-- Sensitive data encrypted at rest
-- PII excluded from logs
-- Rate limiting: 100 req/15min per IP
-```
-
-## Deployment Deliverables
-
-### Configuration Files
-- [ ] `Dockerfile` with multi-stage build
-- [ ] `docker-compose.yml` for local dev
-- [ ] CI/CD pipeline configuration
-- [ ] Environment-specific configs
-- [ ] Database migration scripts
-- [ ] Health check endpoints
-- [ ] Kubernetes manifests (if applicable)
-
-### Deployment Guide
-```markdown
-## Deployment Steps
-
-### Prerequisites
-- Node.js 18+
-- PostgreSQL 15+
-- Redis 7+
-
-### Environment Variables
-DATABASE_URL=postgresql://user:pass@host:5432/dbname
-REDIS_URL=redis://localhost:6379
-JWT_SECRET=<generate-secure-secret>
-API_PORT=3000
-
-### Build & Deploy
-npm run build
-npm run migrate
-npm run start:prod
-
-### Health Check
-GET /api/health
-Expected: { "status": "ok", "database": "connected" }
-```
-
-## Handoff Checklist
-
-### Before Handoff
-- [ ] All tests passing
-- [ ] Code reviewed and approved
-- [ ] Documentation complete
-- [ ] Performance validated
-- [ ] Security reviewed
-- [ ] Deployed to staging
-- [ ] E2E tests pass in staging
-- [ ] Accessibility audit complete
-
-### Handoff Package
-- [ ] Links to merged PRs
-- [ ] Deployment instructions
-- [ ] Database migration notes
-- [ ] Known issues/limitations
-- [ ] Monitoring dashboard URLs
-- [ ] Rollback procedure
-- [ ] Support contact information
-
-## Quick Reference
-
-| Category | Key Deliverables | Coverage Target |
-|----------|-----------------|-----------------|
-| Backend | API, models, migrations | 80% test coverage |
-| Frontend | Components, hooks, routes | 85% test coverage |
-| Tests | Unit, integration, E2E | All critical paths |
-| Docs | API, components, setup | Complete |
-| Performance | Metrics, bundle analysis | <200ms P95 API, <2s TTI |
-| Security | Audit, OWASP validation | All vulnerabilities addressed |
-| Deployment | Docker, CI/CD, guides | Zero-downtime capable |

package/skills/fullstack-guardian/references/design-template.md

@@ -1,91 +0,0 @@
-# Three-Perspective Design
-
-## Design Template
-
-For every feature, address all three layers:
-
-```markdown
-## Feature: [Feature Name]
-
-### [Frontend]
-- UI components needed
-- Client-side validation
-- Loading/error states
-- Optimistic UI updates
-- Accessibility considerations
-
-### [Backend]
-- API endpoints (method, path)
-- Request/response schemas
-- Database operations
-- Business logic
-- External service calls
-
-### [Security]
-- Authentication requirements
-- Authorization rules
-- Input sanitization
-- Rate limiting
-- Audit logging
-```
-
-## Example: User Profile Update
-
-```markdown
-## Feature: User Profile Update
-
-### [Frontend]
-- Form with name, email, bio, avatar fields
-- Client-side validation with real-time feedback
-- Loading states during submission
-- Error/success message display
-- Optimistic UI updates
-
-### [Backend]
-- PUT /api/users/:id endpoint
-- Pydantic/Zod schema validation
-- Database transaction with rollback on error
-- Audit logging for profile changes
-- Email verification if email changes
-
-### [Security]
-- Authorization: users can only update own profile
-- Input sanitization against XSS
-- Rate limiting (10 req/min per user)
-- File upload validation for avatar (type, size)
-- CSRF protection on form submission
-```
-
-## Technical Design Document
-
-Create `specs/{feature_name}_design.md` with:
-
-```markdown
-# Feature: {Name}
-
-## Requirements (EARS Format)
-While <precondition>, when <trigger>, the system shall <response>.
-
-Example: While a user is logged in, when they click Save, the system shall
-persist the form data and display a success message.
-
-## Architecture
-- Frontend: [Components, state management]
-- Backend: [Endpoints, data models]
-- Security: [Auth, validation, protection]
-
-## Implementation Plan
-- [ ] Step 1: Create Pydantic/Zod schemas
-- [ ] Step 2: Implement API endpoint
-- [ ] Step 3: Build UI component
-- [ ] Step 4: Add error handling
-- [ ] Step 5: Write tests
-```
-
-## Quick Reference
-
-| Layer | Key Concerns |
-|-------|--------------|
-| Frontend | UX, validation, states, accessibility |
-| Backend | API, data, logic, performance |
-| Security | Auth, authz, sanitization, logging |

package/skills/fullstack-guardian/references/error-handling.md

@@ -1,135 +0,0 @@
-# Error Handling Patterns
-
-## Frontend Error Handling
-
-```typescript
-// React with async/await
-async function handleSubmit(data: FormData) {
-  setLoading(true);
-  setError(null);
-
-  try {
-    const result = await api.updateProfile(data);
-    showSuccess('Profile updated');
-    return result;
-  } catch (error) {
-    if (error.status === 401) {
-      redirect('/login');
-    } else if (error.status === 403) {
-      showError('Not authorized');
-    } else if (error.status === 422) {
-      setValidationErrors(error.errors);
-    } else {
-      showError('Something went wrong');
-      reportError(error); // Send to error tracking
-    }
-  } finally {
-    setLoading(false);
-  }
-}
-```
-
-```typescript
-// Custom hook for API calls
-function useApi<T>(fn: () => Promise<T>) {
-  const [data, setData] = useState<T | null>(null);
-  const [error, setError] = useState<Error | null>(null);
-  const [loading, setLoading] = useState(false);
-
-  const execute = useCallback(async () => {
-    setLoading(true);
-    setError(null);
-    try {
-      const result = await fn();
-      setData(result);
-      return result;
-    } catch (e) {
-      setError(e as Error);
-      throw e;
-    } finally {
-      setLoading(false);
-    }
-  }, [fn]);
-
-  return { data, error, loading, execute };
-}
-```
-
-## Backend Error Handling
-
-```python
-# FastAPI
-from fastapi import HTTPException
-
-@router.put("/users/{user_id}")
-async def update_user(
-    user_id: int,
-    data: UserUpdate,
-    current_user: User = Depends(get_current_user)
-):
-    if current_user.id != user_id and not current_user.is_admin:
-        raise HTTPException(status_code=403, detail="Not authorized")
-
-    try:
-        return await user_service.update(user_id, data)
-    except UserNotFound:
-        raise HTTPException(status_code=404, detail="User not found")
-    except EmailTaken:
-        raise HTTPException(status_code=422, detail="Email already in use")
-```
-
-```typescript
-// NestJS
-@Put(':id')
-async updateUser(
-  @Param('id') id: string,
-  @Body() dto: UpdateUserDto,
-  @CurrentUser() user: User,
-) {
-  if (user.id !== id && !user.isAdmin) {
-    throw new ForbiddenException('Not authorized');
-  }
-
-  try {
-    return await this.userService.update(id, dto);
-  } catch (error) {
-    if (error instanceof UserNotFoundError) {
-      throw new NotFoundException('User not found');
-    }
-    if (error instanceof EmailTakenError) {
-      throw new UnprocessableEntityException('Email already in use');
-    }
-    throw error;
-  }
-}
-```
-
-## Error Response Format
-
-```typescript
-// Consistent error shape
-interface ApiError {
-  error: string;
-  message: string;
-  details?: Record<string, string[]>;
-  requestId?: string;
-}
-
-// Example responses
-{ "error": "VALIDATION_ERROR", "message": "Invalid input", "details": { "email": ["Invalid format"] } }
-{ "error": "NOT_FOUND", "message": "User not found" }
-{ "error": "FORBIDDEN", "message": "Not authorized to perform this action" }
-```
-
-## Quick Reference
-
-| HTTP Code | When to Use | Example |
-|-----------|-------------|---------|
-| 400 | Invalid request format | Malformed JSON |
-| 401 | Not authenticated | Missing/invalid token |
-| 403 | Not authorized | Wrong permissions |
-| 404 | Resource not found | User doesn't exist |
-| 409 | Conflict | Duplicate email |
-| 422 | Validation failed | Invalid email format |
-| 429 | Rate limited | Too many requests |
-| 500 | Server error | Unhandled exception |