aigroup-workflow 2.2.0 → 2.2.2

package/docs/rules/csharp/patterns.md

@@ -1,50 +1,50 @@
----
-paths:
-  - "**/*.cs"
-  - "**/*.csx"
----
-# C# Patterns
-
-> This file extends [common/patterns.md](../common/patterns.md) with C#-specific content.
-
-## API Response Pattern
-
-```csharp
-public sealed record ApiResponse<T>(
-    bool Success,
-    T? Data = default,
-    string? Error = null,
-    object? Meta = null);
-```
-
-## Repository Pattern
-
-```csharp
-public interface IRepository<T>
-{
-    Task<IReadOnlyList<T>> FindAllAsync(CancellationToken cancellationToken);
-    Task<T?> FindByIdAsync(Guid id, CancellationToken cancellationToken);
-    Task<T> CreateAsync(T entity, CancellationToken cancellationToken);
-    Task<T> UpdateAsync(T entity, CancellationToken cancellationToken);
-    Task DeleteAsync(Guid id, CancellationToken cancellationToken);
-}
-```
-
-## Options Pattern
-
-Use strongly typed options for config instead of reading raw strings throughout the codebase.
-
-```csharp
-public sealed class PaymentsOptions
-{
-    public const string SectionName = "Payments";
-    public required string BaseUrl { get; init; }
-    public required string ApiKeySecretName { get; init; }
-}
-```
-
-## Dependency Injection
-
-- Depend on interfaces at service boundaries
-- Keep constructors focused; if a service needs too many dependencies, split responsibilities
-- Register lifetimes intentionally: singleton for stateless/shared services, scoped for request data, transient for lightweight pure workers
+---
+paths:
+  - "**/*.cs"
+  - "**/*.csx"
+---
+# C# Patterns
+
+> This file extends [common/patterns.md](../common/patterns.md) with C#-specific content.
+
+## API Response Pattern
+
+```csharp
+public sealed record ApiResponse<T>(
+    bool Success,
+    T? Data = default,
+    string? Error = null,
+    object? Meta = null);
+```
+
+## Repository Pattern
+
+```csharp
+public interface IRepository<T>
+{
+    Task<IReadOnlyList<T>> FindAllAsync(CancellationToken cancellationToken);
+    Task<T?> FindByIdAsync(Guid id, CancellationToken cancellationToken);
+    Task<T> CreateAsync(T entity, CancellationToken cancellationToken);
+    Task<T> UpdateAsync(T entity, CancellationToken cancellationToken);
+    Task DeleteAsync(Guid id, CancellationToken cancellationToken);
+}
+```
+
+## Options Pattern
+
+Use strongly typed options for config instead of reading raw strings throughout the codebase.
+
+```csharp
+public sealed class PaymentsOptions
+{
+    public const string SectionName = "Payments";
+    public required string BaseUrl { get; init; }
+    public required string ApiKeySecretName { get; init; }
+}
+```
+
+## Dependency Injection
+
+- Depend on interfaces at service boundaries
+- Keep constructors focused; if a service needs too many dependencies, split responsibilities
+- Register lifetimes intentionally: singleton for stateless/shared services, scoped for request data, transient for lightweight pure workers

package/docs/rules/csharp/security.md

@@ -1,58 +1,58 @@
----
-paths:
-  - "**/*.cs"
-  - "**/*.csx"
-  - "**/*.csproj"
-  - "**/appsettings*.json"
----
-# C# Security
-
-> This file extends [common/security.md](../common/security.md) with C#-specific content.
-
-## Secret Management
-
-- Never hardcode API keys, tokens, or connection strings in source code
-- Use environment variables, user secrets for local development, and a secret manager in production
-- Keep `appsettings.*.json` free of real credentials
-
-```csharp
-// BAD
-const string ApiKey = "sk-live-123";
-
-// GOOD
-var apiKey = builder.Configuration["OpenAI:ApiKey"]
-    ?? throw new InvalidOperationException("OpenAI:ApiKey is not configured.");
-```
-
-## SQL Injection Prevention
-
-- Always use parameterized queries with ADO.NET, Dapper, or EF Core
-- Never concatenate user input into SQL strings
-- Validate sort fields and filter operators before using dynamic query composition
-
-```csharp
-const string sql = "SELECT * FROM Orders WHERE CustomerId = @customerId";
-await connection.QueryAsync<Order>(sql, new { customerId });
-```
-
-## Input Validation
-
-- Validate DTOs at the application boundary
-- Use data annotations, FluentValidation, or explicit guard clauses
-- Reject invalid model state before running business logic
-
-## Authentication and Authorization
-
-- Prefer framework auth handlers instead of custom token parsing
-- Enforce authorization policies at endpoint or handler boundaries
-- Never log raw tokens, passwords, or PII
-
-## Error Handling
-
-- Return safe client-facing messages
-- Log detailed exceptions with structured context server-side
-- Do not expose stack traces, SQL text, or filesystem paths in API responses
-
-## References
-
-See skill: `security-review` for broader application security review checklists.
+---
+paths:
+  - "**/*.cs"
+  - "**/*.csx"
+  - "**/*.csproj"
+  - "**/appsettings*.json"
+---
+# C# Security
+
+> This file extends [common/security.md](../common/security.md) with C#-specific content.
+
+## Secret Management
+
+- Never hardcode API keys, tokens, or connection strings in source code
+- Use environment variables, user secrets for local development, and a secret manager in production
+- Keep `appsettings.*.json` free of real credentials
+
+```csharp
+// BAD
+const string ApiKey = "sk-live-123";
+
+// GOOD
+var apiKey = builder.Configuration["OpenAI:ApiKey"]
+    ?? throw new InvalidOperationException("OpenAI:ApiKey is not configured.");
+```
+
+## SQL Injection Prevention
+
+- Always use parameterized queries with ADO.NET, Dapper, or EF Core
+- Never concatenate user input into SQL strings
+- Validate sort fields and filter operators before using dynamic query composition
+
+```csharp
+const string sql = "SELECT * FROM Orders WHERE CustomerId = @customerId";
+await connection.QueryAsync<Order>(sql, new { customerId });
+```
+
+## Input Validation
+
+- Validate DTOs at the application boundary
+- Use data annotations, FluentValidation, or explicit guard clauses
+- Reject invalid model state before running business logic
+
+## Authentication and Authorization
+
+- Prefer framework auth handlers instead of custom token parsing
+- Enforce authorization policies at endpoint or handler boundaries
+- Never log raw tokens, passwords, or PII
+
+## Error Handling
+
+- Return safe client-facing messages
+- Log detailed exceptions with structured context server-side
+- Do not expose stack traces, SQL text, or filesystem paths in API responses
+
+## References
+
+See skill: `security-review` for broader application security review checklists.

package/docs/rules/csharp/testing.md

@@ -1,46 +1,46 @@
----
-paths:
-  - "**/*.cs"
-  - "**/*.csx"
-  - "**/*.csproj"
----
-# C# Testing
-
-> This file extends [common/testing.md](../common/testing.md) with C#-specific content.
-
-## Test Framework
-
-- Prefer **xUnit** for unit and integration tests
-- Use **FluentAssertions** for readable assertions
-- Use **Moq** or **NSubstitute** for mocking dependencies
-- Use **Testcontainers** when integration tests need real infrastructure
-
-## Test Organization
-
-- Mirror `src/` structure under `tests/`
-- Separate unit, integration, and end-to-end coverage clearly
-- Name tests by behavior, not implementation details
-
-```csharp
-public sealed class OrderServiceTests
-{
-    [Fact]
-    public async Task FindByIdAsync_ReturnsOrder_WhenOrderExists()
-    {
-        // Arrange
-        // Act
-        // Assert
-    }
-}
-```
-
-## ASP.NET Core Integration Tests
-
-- Use `WebApplicationFactory<TEntryPoint>` for API integration coverage
-- Test auth, validation, and serialization through HTTP, not by bypassing middleware
-
-## Coverage
-
-- Target 80%+ line coverage
-- Focus coverage on domain logic, validation, auth, and failure paths
-- Run `dotnet test` in CI with coverage collection enabled where available
+---
+paths:
+  - "**/*.cs"
+  - "**/*.csx"
+  - "**/*.csproj"
+---
+# C# Testing
+
+> This file extends [common/testing.md](../common/testing.md) with C#-specific content.
+
+## Test Framework
+
+- Prefer **xUnit** for unit and integration tests
+- Use **FluentAssertions** for readable assertions
+- Use **Moq** or **NSubstitute** for mocking dependencies
+- Use **Testcontainers** when integration tests need real infrastructure
+
+## Test Organization
+
+- Mirror `src/` structure under `tests/`
+- Separate unit, integration, and end-to-end coverage clearly
+- Name tests by behavior, not implementation details
+
+```csharp
+public sealed class OrderServiceTests
+{
+    [Fact]
+    public async Task FindByIdAsync_ReturnsOrder_WhenOrderExists()
+    {
+        // Arrange
+        // Act
+        // Assert
+    }
+}
+```
+
+## ASP.NET Core Integration Tests
+
+- Use `WebApplicationFactory<TEntryPoint>` for API integration coverage
+- Test auth, validation, and serialization through HTTP, not by bypassing middleware
+
+## Coverage
+
+- Target 80%+ line coverage
+- Focus coverage on domain logic, validation, auth, and failure paths
+- Run `dotnet test` in CI with coverage collection enabled where available

package/docs/rules/dart/coding-style.md

@@ -1,159 +1,159 @@
----
-paths:
-  - "**/*.dart"
-  - "**/pubspec.yaml"
-  - "**/analysis_options.yaml"
----
-# Dart/Flutter Coding Style
-
-> This file extends [common/coding-style.md](../common/coding-style.md) with Dart and Flutter-specific content.
-
-## Formatting
-
-- **dart format** for all `.dart` files — enforced in CI (`dart format --set-exit-if-changed .`)
-- Line length: 80 characters (dart format default)
-- Trailing commas on multi-line argument/parameter lists to improve diffs and formatting
-
-## Immutability
-
-- Prefer `final` for local variables and `const` for compile-time constants
-- Use `const` constructors wherever all fields are `final`
-- Return unmodifiable collections from public APIs (`List.unmodifiable`, `Map.unmodifiable`)
-- Use `copyWith()` for state mutations in immutable state classes
-
-```dart
-// BAD
-var count = 0;
-List<String> items = ['a', 'b'];
-
-// GOOD
-final count = 0;
-const items = ['a', 'b'];
-```
-
-## Naming
-
-Follow Dart conventions:
-- `camelCase` for variables, parameters, and named constructors
-- `PascalCase` for classes, enums, typedefs, and extensions
-- `snake_case` for file names and library names
-- `SCREAMING_SNAKE_CASE` for constants declared with `const` at top level
-- Prefix private members with `_`
-- Extension names describe the type they extend: `StringExtensions`, not `MyHelpers`
-
-## Null Safety
-
-- Avoid `!` (bang operator) — prefer `?.`, `??`, `if (x != null)`, or Dart 3 pattern matching; reserve `!` only where a null value is a programming error and crashing is the right behaviour
-- Avoid `late` unless initialization is guaranteed before first use (prefer nullable or constructor init)
-- Use `required` for constructor parameters that must always be provided
-
-```dart
-// BAD — crashes at runtime if user is null
-final name = user!.name;
-
-// GOOD — null-aware operators
-final name = user?.name ?? 'Unknown';
-
-// GOOD — Dart 3 pattern matching (exhaustive, compiler-checked)
-final name = switch (user) {
-  User(:final name) => name,
-  null => 'Unknown',
-};
-
-// GOOD — early-return null guard
-String getUserName(User? user) {
-  if (user == null) return 'Unknown';
-  return user.name; // promoted to non-null after the guard
-}
-```
-
-## Sealed Types and Pattern Matching (Dart 3+)
-
-Use sealed classes to model closed state hierarchies:
-
-```dart
-sealed class AsyncState<T> {
-  const AsyncState();
-}
-
-final class Loading<T> extends AsyncState<T> {
-  const Loading();
-}
-
-final class Success<T> extends AsyncState<T> {
-  const Success(this.data);
-  final T data;
-}
-
-final class Failure<T> extends AsyncState<T> {
-  const Failure(this.error);
-  final Object error;
-}
-```
-
-Always use exhaustive `switch` with sealed types — no default/wildcard:
-
-```dart
-// BAD
-if (state is Loading) { ... }
-
-// GOOD
-return switch (state) {
-  Loading() => const CircularProgressIndicator(),
-  Success(:final data) => DataWidget(data),
-  Failure(:final error) => ErrorWidget(error.toString()),
-};
-```
-
-## Error Handling
-
-- Specify exception types in `on` clauses — never use bare `catch (e)`
-- Never catch `Error` subtypes — they indicate programming bugs
-- Use `Result`-style types or sealed classes for recoverable errors
-- Avoid using exceptions for control flow
-
-```dart
-// BAD
-try {
-  await fetchUser();
-} catch (e) {
-  log(e.toString());
-}
-
-// GOOD
-try {
-  await fetchUser();
-} on NetworkException catch (e) {
-  log('Network error: ${e.message}');
-} on NotFoundException {
-  handleNotFound();
-}
-```
-
-## Async / Futures
-
-- Always `await` Futures or explicitly call `unawaited()` to signal intentional fire-and-forget
-- Never mark a function `async` if it never `await`s anything
-- Use `Future.wait` / `Future.any` for concurrent operations
-- Check `context.mounted` before using `BuildContext` after any `await` (Flutter 3.7+)
-
-```dart
-// BAD — ignoring Future
-fetchData(); // fire-and-forget without marking intent
-
-// GOOD
-unawaited(fetchData()); // explicit fire-and-forget
-await fetchData();      // or properly awaited
-```
-
-## Imports
-
-- Use `package:` imports throughout — never relative imports (`../`) for cross-feature or cross-layer code
-- Order: `dart:` → external `package:` → internal `package:` (same package)
-- No unused imports — `dart analyze` enforces this with `unused_import`
-
-## Code Generation
-
-- Generated files (`.g.dart`, `.freezed.dart`, `.gr.dart`) must be committed or gitignored consistently — pick one strategy per project
-- Never manually edit generated files
-- Keep generator annotations (`@JsonSerializable`, `@freezed`, `@riverpod`, etc.) on the canonical source file only
+---
+paths:
+  - "**/*.dart"
+  - "**/pubspec.yaml"
+  - "**/analysis_options.yaml"
+---
+# Dart/Flutter Coding Style
+
+> This file extends [common/coding-style.md](../common/coding-style.md) with Dart and Flutter-specific content.
+
+## Formatting
+
+- **dart format** for all `.dart` files — enforced in CI (`dart format --set-exit-if-changed .`)
+- Line length: 80 characters (dart format default)
+- Trailing commas on multi-line argument/parameter lists to improve diffs and formatting
+
+## Immutability
+
+- Prefer `final` for local variables and `const` for compile-time constants
+- Use `const` constructors wherever all fields are `final`
+- Return unmodifiable collections from public APIs (`List.unmodifiable`, `Map.unmodifiable`)
+- Use `copyWith()` for state mutations in immutable state classes
+
+```dart
+// BAD
+var count = 0;
+List<String> items = ['a', 'b'];
+
+// GOOD
+final count = 0;
+const items = ['a', 'b'];
+```
+
+## Naming
+
+Follow Dart conventions:
+- `camelCase` for variables, parameters, and named constructors
+- `PascalCase` for classes, enums, typedefs, and extensions
+- `snake_case` for file names and library names
+- `SCREAMING_SNAKE_CASE` for constants declared with `const` at top level
+- Prefix private members with `_`
+- Extension names describe the type they extend: `StringExtensions`, not `MyHelpers`
+
+## Null Safety
+
+- Avoid `!` (bang operator) — prefer `?.`, `??`, `if (x != null)`, or Dart 3 pattern matching; reserve `!` only where a null value is a programming error and crashing is the right behaviour
+- Avoid `late` unless initialization is guaranteed before first use (prefer nullable or constructor init)
+- Use `required` for constructor parameters that must always be provided
+
+```dart
+// BAD — crashes at runtime if user is null
+final name = user!.name;
+
+// GOOD — null-aware operators
+final name = user?.name ?? 'Unknown';
+
+// GOOD — Dart 3 pattern matching (exhaustive, compiler-checked)
+final name = switch (user) {
+  User(:final name) => name,
+  null => 'Unknown',
+};
+
+// GOOD — early-return null guard
+String getUserName(User? user) {
+  if (user == null) return 'Unknown';
+  return user.name; // promoted to non-null after the guard
+}
+```
+
+## Sealed Types and Pattern Matching (Dart 3+)
+
+Use sealed classes to model closed state hierarchies:
+
+```dart
+sealed class AsyncState<T> {
+  const AsyncState();
+}
+
+final class Loading<T> extends AsyncState<T> {
+  const Loading();
+}
+
+final class Success<T> extends AsyncState<T> {
+  const Success(this.data);
+  final T data;
+}
+
+final class Failure<T> extends AsyncState<T> {
+  const Failure(this.error);
+  final Object error;
+}
+```
+
+Always use exhaustive `switch` with sealed types — no default/wildcard:
+
+```dart
+// BAD
+if (state is Loading) { ... }
+
+// GOOD
+return switch (state) {
+  Loading() => const CircularProgressIndicator(),
+  Success(:final data) => DataWidget(data),
+  Failure(:final error) => ErrorWidget(error.toString()),
+};
+```
+
+## Error Handling
+
+- Specify exception types in `on` clauses — never use bare `catch (e)`
+- Never catch `Error` subtypes — they indicate programming bugs
+- Use `Result`-style types or sealed classes for recoverable errors
+- Avoid using exceptions for control flow
+
+```dart
+// BAD
+try {
+  await fetchUser();
+} catch (e) {
+  log(e.toString());
+}
+
+// GOOD
+try {
+  await fetchUser();
+} on NetworkException catch (e) {
+  log('Network error: ${e.message}');
+} on NotFoundException {
+  handleNotFound();
+}
+```
+
+## Async / Futures
+
+- Always `await` Futures or explicitly call `unawaited()` to signal intentional fire-and-forget
+- Never mark a function `async` if it never `await`s anything
+- Use `Future.wait` / `Future.any` for concurrent operations
+- Check `context.mounted` before using `BuildContext` after any `await` (Flutter 3.7+)
+
+```dart
+// BAD — ignoring Future
+fetchData(); // fire-and-forget without marking intent
+
+// GOOD
+unawaited(fetchData()); // explicit fire-and-forget
+await fetchData();      // or properly awaited
+```
+
+## Imports
+
+- Use `package:` imports throughout — never relative imports (`../`) for cross-feature or cross-layer code
+- Order: `dart:` → external `package:` → internal `package:` (same package)
+- No unused imports — `dart analyze` enforces this with `unused_import`
+
+## Code Generation
+
+- Generated files (`.g.dart`, `.freezed.dart`, `.gr.dart`) must be committed or gitignored consistently — pick one strategy per project
+- Never manually edit generated files
+- Keep generator annotations (`@JsonSerializable`, `@freezed`, `@riverpod`, etc.) on the canonical source file only