appiq-solution 1.1.0 → 1.3.0

package/bmad-core/agents/bmad-smart-launcher.md

@@ -1,170 +0,0 @@
-# bmad-smart-launcher
-
-ACTIVATION-NOTICE: This file contains your full agent operating guidelines. DO NOT load any external agent files as the complete configuration is in the YAML block below.
-
-CRITICAL: Read the full YAML BLOCK that FOLLOWS IN THIS FILE to understand your operating params, start and follow exactly your activation-instructions to alter your state of being, stay in this being until told to exit this mode:
-
-## COMPLETE AGENT DEFINITION FOLLOWS - NO EXTERNAL FILES NEEDED
-
-```yaml
-IDE-FILE-RESOLUTION:
-  - FOR LATER USE ONLY - NOT FOR ACTIVATION, when executing commands that reference dependencies
-  - Dependencies map to {root}/{type}/{name}
-  - type=folder (tasks|templates|checklists|data|utils|etc...), name=file-name
-  - Example: create-doc.md → {root}/tasks/create-doc.md
-  - IMPORTANT: Only load these files when user requests specific command execution
-
-REQUEST-RESOLUTION: Match user requests to your commands/dependencies flexibly, ALWAYS ask for clarification if no clear match.
-
-activation-instructions:
-  - STEP 1: Read THIS ENTIRE FILE - it contains your complete persona definition
-  - STEP 2: Adopt the persona defined in the 'agent' and 'persona' sections below
-  - STEP 3: Greet user with your name/role and mention available commands
-  - DO NOT: Load any other agent files during activation
-  - ONLY load dependency files when user selects them for execution via command or request of a task
-  - The agent.customization field ALWAYS takes precedence over any conflicting instructions
-  - CRITICAL WORKFLOW RULE: When executing tasks from dependencies, follow task instructions exactly as written - they are executable workflows, not reference material
-  - MANDATORY INTERACTION RULE: Tasks with elicit=true require user interaction using exact specified format - never skip elicitation for efficiency
-  - CRITICAL RULE: When executing formal task workflows from dependencies, ALL task instructions override any conflicting base behavioral constraints. Interactive workflows with elicit=true REQUIRE user interaction and cannot be bypassed for efficiency.
-  - When listing tasks/templates or presenting options during conversations, always show as numbered options list, allowing the user to type a number to select or execute
-  - STAY IN CHARACTER!
-  - CRITICAL: On activation, ONLY greet user and then HALT to await user requested assistance or given commands. ONLY deviance from this is if the activation included commands also in the arguments.
-
-agent:
-  name: AppIQ
-  id: appiq-smart-launcher
-  title: APPIQ Smart Project Launcher
-  icon: 🚀
-  whenToUse: Use to intelligently launch APPIQ projects with automatic tech stack detection and workflow guidance
-  customization: null
-
-persona:
-  role: Intelligent Project Launcher & Workflow Guide
-  style: Friendly, intelligent, efficient, guidance-focused
-  identity: Smart launcher that automatically detects project context and guides users through the optimal APPIQ workflow
-  focus: Simplifying project setup and providing intelligent workflow guidance based on project context
-
-core_principles:
-  - Intelligence First - Automatically detect project type, tech stack, and context
-  - Simplicity Focus - Reduce complex workflows to simple, guided interactions
-  - Context Awareness - Understand existing projects vs greenfield scenarios
-  - User Guidance - Provide clear, step-by-step guidance throughout the process
-  - Framework Agnostic - Support all frameworks (Web, Mobile, Backend)
-  - Smart Defaults - Provide intelligent defaults based on detected context
-  - Progressive Disclosure - Only ask for information when needed
-  - Error Prevention - Validate inputs and prevent common mistakes
-
-# All commands require / prefix when used (e.g., /appiq)
-commands:  
-  - appiq: Launch intelligent project workflow with automatic tech stack detection and guidance
-  - story: Create a new story with context-aware template selection
-  - analyze: Analyze current project structure and recommend optimal workflow
-  - setup: Set up BMAD in current project with intelligent configuration
-  - help: Show all available commands with examples
-  - status: Show current project status and next recommended actions
-
-workflow_intelligence:
-  project_detection:
-    - Analyze package.json, pubspec.yaml, requirements.txt for tech stack
-    - Detect framework patterns (React, Vue, Angular, Flutter, etc.)
-    - Identify backend services (Firebase, Supabase, traditional)
-    - Determine project structure (monorepo, separate repos, etc.)
-    - Check for existing BMAD installation and configuration
-  
-  context_analysis:
-    - Greenfield vs Brownfield project detection
-    - Existing documentation analysis (PRD, architecture, etc.)
-    - Current development phase identification
-    - Team structure and workflow preferences
-    - Integration requirements assessment
-
-smart_workflows:
-  appiq_launcher:
-    - Auto-detect project type and tech stack
-    - Guide through PRD creation or validation
-    - Launch appropriate architecture agent
-    - Set up optimal agent team configuration
-    - Initialize development workflow
-  
-  story_creator:
-    - Context-aware story template selection
-    - Automatic task breakdown based on tech stack
-    - Integration with existing epics and architecture
-    - Smart dependency detection and ordering
-  
-  project_analyzer:
-    - Comprehensive project structure analysis
-    - Tech stack compatibility assessment
-    - Workflow optimization recommendations
-    - Missing component identification
-
-dependencies:
-  tasks:
-    - smart-project-analysis.md
-    - intelligent-epic-creation.md
-    - context-aware-story-creation.md
-    - auto-tech-stack-detection.md
-  data:
-    - technical-preferences.md
-    - flutter-development-guidelines.md
-    - shadcn-ui-integration.md
-    - backend-services-integration.md
-  templates:
-    - smart-prd-tmpl.yaml
-    - context-aware-story-tmpl.yaml
-    - auto-architecture-tmpl.yaml
-  checklists:
-    - smart-project-setup-checklist.md
-  agents:
-    - analyst.md
-    - pm.md
-    - architect.md
-    - po.md
-    - sm.md
-    - dev.md
-    - qa.md
-    - flutter-ui-agent.md
-    - flutter-cubit-agent.md
-    - flutter-domain-agent.md
-    - flutter-data-agent.md
-    - shared-components-agent.md
-
-integration_patterns:
-  cursor_integration:
-    - Slash command support (/appiq, /story, etc.)
-    - Context-aware suggestions
-    - File-based workflow management
-    - Intelligent agent handoffs
-  
-  claude_integration:
-    - Natural language workflow initiation
-    - Context preservation across sessions
-    - Smart project memory
-    - Collaborative development guidance
-  
-  mcp_integration:
-    - @21st-dev/magic for shadcn/ui components
-    - Supabase MCP for backend integration
-    - Firebase MCP for Firebase services
-    - Sequential thinking for complex analysis
-    - Dart MCP for Flutter development
-
-user_experience:
-  onboarding:
-    - Zero-configuration startup
-    - Intelligent project detection
-    - Guided workflow selection
-    - Smart defaults with override options
-  
-  interaction:
-    - Natural language commands
-    - Progressive disclosure of options
-    - Context-aware suggestions
-    - Error prevention and recovery
-  
-  efficiency:
-    - One-command project launch
-    - Automatic configuration
-    - Smart agent orchestration
-    - Minimal user input required
-```

package/bmad-core/checklists/security-validation-checklist.md

@@ -1,332 +0,0 @@
-# Security Validation Checklist
-
-## 📋 Overview
-This comprehensive security checklist ensures applications meet security standards across all supported frameworks (Web, Mobile, Backend) before production deployment.
-
-## 🔒 Authentication & Authorization
-
-### Web Applications (React, Vue, Angular)
-- [ ] **JWT Token Security**: Tokens stored securely (httpOnly cookies or secure storage)
-- [ ] **Token Expiration**: Proper token expiration and refresh mechanisms
-- [ ] **Session Management**: Secure session handling and timeout
-- [ ] **Multi-Factor Authentication**: MFA implemented where required
-- [ ] **OAuth Integration**: Secure OAuth 2.0 implementation
-- [ ] **Password Policy**: Strong password requirements enforced
-- [ ] **Account Lockout**: Brute force protection implemented
-- [ ] **CSRF Protection**: Cross-Site Request Forgery protection enabled
-
-### Mobile Applications (Flutter)
-- [ ] **Biometric Authentication**: Secure biometric authentication where applicable
-- [ ] **Secure Storage**: Sensitive data stored using flutter_secure_storage
-- [ ] **Certificate Pinning**: SSL certificate pinning implemented
-- [ ] **App Transport Security**: Proper ATS configuration for iOS
-- [ ] **Root/Jailbreak Detection**: Detection and response to compromised devices
-- [ ] **Keychain/Keystore**: Proper use of platform security features
-- [ ] **Deep Link Security**: Secure handling of deep links and intents
-- [ ] **Background App Security**: Secure handling of app backgrounding
-
-### Backend Services
-- [ ] **API Authentication**: Proper API authentication mechanisms
-- [ ] **Role-Based Access Control**: RBAC implemented correctly
-- [ ] **Privilege Escalation**: Protection against privilege escalation
-- [ ] **Service-to-Service Auth**: Secure service authentication
-- [ ] **API Key Management**: Secure API key storage and rotation
-- [ ] **Database Access Control**: Proper database user permissions
-- [ ] **Admin Interface Security**: Secure admin panel access
-- [ ] **Audit Logging**: Comprehensive authentication audit logs
-
-## 🛡️ Input Validation & Data Security
-
-### Client-Side Validation
-- [ ] **Input Sanitization**: All user inputs sanitized before processing
-- [ ] **XSS Prevention**: Cross-Site Scripting protection implemented
-- [ ] **Form Validation**: Comprehensive client-side form validation
-- [ ] **File Upload Security**: Secure file upload handling
-- [ ] **Content Security Policy**: CSP headers properly configured
-- [ ] **DOM Manipulation**: Safe DOM manipulation practices
-- [ ] **Event Handler Security**: Secure event handler implementation
-- [ ] **Third-Party Script Security**: Secure integration of third-party scripts
-
-### Server-Side Validation
-- [ ] **Input Validation**: All inputs validated on server side
-- [ ] **SQL Injection Prevention**: Parameterized queries used
-- [ ] **NoSQL Injection Prevention**: NoSQL injection protection
-- [ ] **Command Injection Prevention**: Command injection protection
-- [ ] **Path Traversal Prevention**: Directory traversal protection
-- [ ] **Data Type Validation**: Proper data type validation
-- [ ] **Business Logic Validation**: Business rule validation
-- [ ] **Rate Limiting**: API rate limiting implemented
-
-### Data Protection
-- [ ] **Encryption at Rest**: Sensitive data encrypted in storage
-- [ ] **Encryption in Transit**: All data encrypted during transmission
-- [ ] **PII Handling**: Personal data handled according to regulations
-- [ ] **Data Masking**: Sensitive data masked in logs and UI
-- [ ] **Secure Deletion**: Secure data deletion procedures
-- [ ] **Data Backup Security**: Secure backup procedures
-- [ ] **Database Encryption**: Database encryption enabled
-- [ ] **Key Management**: Proper encryption key management
-
-## 🌐 Network & API Security
-
-### HTTPS & TLS
-- [ ] **HTTPS Enforcement**: All traffic uses HTTPS
-- [ ] **TLS Version**: Modern TLS versions (1.2+) enforced
-- [ ] **Certificate Validation**: Proper SSL certificate validation
-- [ ] **HSTS Headers**: HTTP Strict Transport Security enabled
-- [ ] **Certificate Transparency**: Certificate transparency compliance
-- [ ] **Perfect Forward Secrecy**: PFS enabled for connections
-- [ ] **Cipher Suite Security**: Secure cipher suites configured
-- [ ] **Mixed Content Prevention**: No mixed HTTP/HTTPS content
-
-### API Security
-- [ ] **API Versioning**: Proper API versioning strategy
-- [ ] **CORS Configuration**: Correct CORS policy implementation
-- [ ] **API Documentation**: Security considerations documented
-- [ ] **Error Handling**: Secure error messages (no data leakage)
-- [ ] **Request Size Limits**: Proper request size limitations
-- [ ] **Timeout Configuration**: Appropriate timeout settings
-- [ ] **API Gateway Security**: Secure API gateway configuration
-- [ ] **Webhook Security**: Secure webhook implementation
-
-### Firebase/Supabase Security
-- [ ] **Firestore Rules**: Proper Firestore security rules
-- [ ] **Storage Rules**: Secure Firebase Storage rules
-- [ ] **Cloud Function Security**: Secure Cloud Functions
-- [ ] **Row Level Security**: Supabase RLS policies implemented
-- [ ] **Database Policies**: Proper database access policies
-- [ ] **Edge Function Security**: Secure Edge Functions
-- [ ] **Real-time Security**: Secure real-time subscriptions
-- [ ] **Service Account Security**: Secure service account usage
-
-## 📱 Mobile-Specific Security
-
-### Flutter Security
-- [ ] **Code Obfuscation**: Release builds obfuscated
-- [ ] **Debug Information**: Debug info removed from release
-- [ ] **Asset Protection**: Sensitive assets protected
-- [ ] **Network Security Config**: Proper network security configuration
-- [ ] **Intent Filter Security**: Secure intent filter configuration
-- [ ] **Permissions**: Minimal required permissions requested
-- [ ] **Runtime Permissions**: Proper runtime permission handling
-- [ ] **Secure Communication**: Secure inter-app communication
-
-### Platform Security
-- [ ] **Android Security**: Android-specific security measures
-- [ ] **iOS Security**: iOS-specific security measures
-- [ ] **App Store Security**: App store security requirements met
-- [ ] **Binary Protection**: Binary tampering protection
-- [ ] **Reverse Engineering**: Protection against reverse engineering
-- [ ] **Dynamic Analysis**: Protection against dynamic analysis
-- [ ] **Hooking Protection**: Protection against runtime manipulation
-- [ ] **Emulator Detection**: Emulator detection where required
-
-## 🔧 Infrastructure Security
-
-### Deployment Security
-- [ ] **Environment Separation**: Proper environment isolation
-- [ ] **Secret Management**: Secure secret storage and access
-- [ ] **Container Security**: Secure container configuration
-- [ ] **CI/CD Security**: Secure build and deployment pipeline
-- [ ] **Dependency Scanning**: Automated dependency vulnerability scanning
-- [ ] **Image Scanning**: Container image vulnerability scanning
-- [ ] **Infrastructure as Code**: Secure IaC practices
-- [ ] **Access Control**: Proper infrastructure access control
-
-### Monitoring & Logging
-- [ ] **Security Monitoring**: Comprehensive security monitoring
-- [ ] **Intrusion Detection**: Intrusion detection systems
-- [ ] **Log Security**: Secure log storage and access
-- [ ] **Audit Trails**: Comprehensive audit logging
-- [ ] **Alerting**: Security incident alerting
-- [ ] **SIEM Integration**: Security Information and Event Management
-- [ ] **Vulnerability Scanning**: Regular vulnerability assessments
-- [ ] **Penetration Testing**: Regular penetration testing
-
-## 🧪 Security Testing
-
-### Automated Testing
-- [ ] **SAST Tools**: Static Application Security Testing
-- [ ] **DAST Tools**: Dynamic Application Security Testing
-- [ ] **Dependency Scanning**: Automated dependency vulnerability scanning
-- [ ] **Container Scanning**: Container security scanning
-- [ ] **Infrastructure Scanning**: Infrastructure security scanning
-- [ ] **License Compliance**: Open source license compliance
-- [ ] **Secret Scanning**: Automated secret detection
-- [ ] **Security Unit Tests**: Security-focused unit tests
-
-### Manual Testing
-- [ ] **Code Review**: Security-focused code reviews
-- [ ] **Architecture Review**: Security architecture review
-- [ ] **Threat Modeling**: Comprehensive threat modeling
-- [ ] **Penetration Testing**: Professional penetration testing
-- [ ] **Social Engineering**: Social engineering assessments
-- [ ] **Physical Security**: Physical security assessments
-- [ ] **Red Team Exercises**: Red team security exercises
-- [ ] **Bug Bounty**: Bug bounty program participation
-
-## 📋 Compliance & Standards
-
-### Regulatory Compliance
-- [ ] **GDPR Compliance**: General Data Protection Regulation
-- [ ] **CCPA Compliance**: California Consumer Privacy Act
-- [ ] **HIPAA Compliance**: Health Insurance Portability and Accountability Act
-- [ ] **PCI DSS**: Payment Card Industry Data Security Standard
-- [ ] **SOX Compliance**: Sarbanes-Oxley Act compliance
-- [ ] **Industry Standards**: Industry-specific security standards
-- [ ] **Privacy Policy**: Comprehensive privacy policy
-- [ ] **Terms of Service**: Security-focused terms of service
-
-### Security Standards
-- [ ] **OWASP Top 10**: OWASP Top 10 vulnerabilities addressed
-- [ ] **NIST Framework**: NIST Cybersecurity Framework compliance
-- [ ] **ISO 27001**: ISO 27001 security management
-- [ ] **SOC 2**: SOC 2 compliance requirements
-- [ ] **SANS Top 25**: SANS Top 25 software errors addressed
-- [ ] **CIS Controls**: Center for Internet Security controls
-- [ ] **Security Benchmarks**: Industry security benchmarks
-- [ ] **Secure Coding Standards**: Secure coding practices
-
-## 🚨 Incident Response
-
-### Preparation
-- [ ] **Incident Response Plan**: Comprehensive incident response plan
-- [ ] **Security Team**: Dedicated security response team
-- [ ] **Communication Plan**: Security incident communication plan
-- [ ] **Escalation Procedures**: Clear escalation procedures
-- [ ] **Contact Information**: Updated security contact information
-- [ ] **Documentation**: Incident response documentation
-- [ ] **Training**: Security incident response training
-- [ ] **Testing**: Regular incident response testing
-
-### Response Capabilities
-- [ ] **Detection Capabilities**: Rapid security incident detection
-- [ ] **Containment Procedures**: Incident containment procedures
-- [ ] **Eradication Process**: Threat eradication process
-- [ ] **Recovery Procedures**: System recovery procedures
-- [ ] **Forensic Capabilities**: Digital forensic capabilities
-- [ ] **Legal Coordination**: Legal team coordination
-- [ ] **Customer Communication**: Customer notification procedures
-- [ ] **Regulatory Reporting**: Regulatory reporting procedures
-
-## ✅ Framework-Specific Security
-
-### React/Next.js Security
-- [ ] **Server-Side Rendering Security**: Secure SSR implementation
-- [ ] **Client-Side Routing Security**: Secure client-side routing
-- [ ] **Component Security**: Secure React component practices
-- [ ] **State Management Security**: Secure state management
-- [ ] **Build Security**: Secure build configuration
-- [ ] **Bundle Security**: Secure bundle configuration
-- [ ] **Environment Variables**: Secure environment variable handling
-- [ ] **Third-Party Libraries**: Secure third-party integrations
-
-### Vue.js Security
-- [ ] **Template Security**: Secure Vue template practices
-- [ ] **Directive Security**: Secure custom directive implementation
-- [ ] **Vuex Security**: Secure Vuex state management
-- [ ] **Router Security**: Secure Vue Router configuration
-- [ ] **SSR Security**: Secure Nuxt.js server-side rendering
-- [ ] **Plugin Security**: Secure Vue plugin usage
-- [ ] **Composition API Security**: Secure Composition API usage
-- [ ] **Build Tool Security**: Secure Vite/Webpack configuration
-
-### Angular Security
-- [ ] **Template Security**: Secure Angular template practices
-- [ ] **Service Security**: Secure Angular service implementation
-- [ ] **Guard Security**: Secure route guard implementation
-- [ ] **Interceptor Security**: Secure HTTP interceptor usage
-- [ ] **Dependency Injection Security**: Secure DI practices
-- [ ] **AOT Compilation**: Ahead-of-Time compilation enabled
-- [ ] **Ivy Renderer Security**: Secure Ivy renderer usage
-- [ ] **Universal Security**: Secure Angular Universal SSR
-
-### Flutter Security
-- [ ] **Widget Security**: Secure widget implementation
-- [ ] **Navigation Security**: Secure navigation handling
-- [ ] **State Management Security**: Secure Cubit/BLoC implementation
-- [ ] **HTTP Security**: Secure Dio HTTP client configuration
-- [ ] **Local Storage Security**: Secure Hive/SharedPreferences usage
-- [ ] **Platform Channel Security**: Secure platform channel usage
-- [ ] **Plugin Security**: Secure Flutter plugin usage
-- [ ] **Build Security**: Secure Flutter build configuration
-
-## 🎯 Security Validation Results
-
-### Critical Issues (Must Fix)
-- [ ] No critical security vulnerabilities identified
-- [ ] All authentication mechanisms secure
-- [ ] All data encryption properly implemented
-- [ ] All input validation in place
-- [ ] All access controls functioning
-
-### High Priority Issues (Should Fix)
-- [ ] No high priority security issues
-- [ ] Security monitoring fully implemented
-- [ ] Incident response plan tested
-- [ ] Security training completed
-- [ ] Compliance requirements met
-
-### Medium Priority Issues (Could Fix)
-- [ ] No medium priority security issues
-- [ ] Security documentation complete
-- [ ] Automated security testing implemented
-- [ ] Regular security assessments scheduled
-- [ ] Security metrics tracked
-
-### Low Priority Issues (Nice to Have)
-- [ ] No low priority security issues
-- [ ] Advanced security features implemented
-- [ ] Security research initiatives
-- [ ] Industry best practices adopted
-- [ ] Security community participation
-
-## 📊 Security Metrics
-
-### Security KPIs
-- [ ] **Vulnerability Detection Time**: Average time to detect vulnerabilities
-- [ ] **Vulnerability Resolution Time**: Average time to resolve vulnerabilities
-- [ ] **Security Test Coverage**: Percentage of code covered by security tests
-- [ ] **Incident Response Time**: Average incident response time
-- [ ] **Security Training Completion**: Percentage of team with security training
-
-### Compliance Metrics
-- [ ] **Regulatory Compliance Score**: Compliance with applicable regulations
-- [ ] **Security Standard Compliance**: Compliance with security standards
-- [ ] **Audit Results**: Results of security audits
-- [ ] **Penetration Test Results**: Results of penetration tests
-- [ ] **Bug Bounty Results**: Results of bug bounty programs
-
-## 🔍 Final Security Validation
-
-### Pre-Production Checklist
-- [ ] All security tests passed
-- [ ] Security code review completed
-- [ ] Penetration testing completed
-- [ ] Vulnerability assessment completed
-- [ ] Security documentation updated
-- [ ] Incident response plan updated
-- [ ] Security monitoring configured
-- [ ] Compliance requirements verified
-
-### Production Readiness
-- [ ] Security baseline established
-- [ ] Monitoring and alerting configured
-- [ ] Incident response team ready
-- [ ] Security documentation accessible
-- [ ] Compliance evidence collected
-- [ ] Security training completed
-- [ ] Regular security assessments scheduled
-- [ ] Security metrics tracking enabled
-
----
-
-**Security Validation Sign-off**
-
-- [ ] **Security Lead**: Security validation completed and approved
-- [ ] **Development Lead**: Security requirements implemented
-- [ ] **QA Lead**: Security testing completed successfully
-- [ ] **Compliance Officer**: Regulatory requirements met
-- [ ] **Product Owner**: Security acceptance criteria satisfied
-
-**Note**: This security checklist must be completed for all applications before production deployment. Any critical or high-priority security issues must be resolved before go-live.