code-ai-installer 1.3.1 → 1.4.0

package/locales/en/.agents/skills/adr_log/agents/gemini.json

@@ -0,0 +1,17 @@
+{
+  "name": "adr_log",
+  "display_name": "ADR Log",
+  "description": "Capture key architectural decisions (ADR) with trade-offs - pros, cons, alternatives, decision, status, and date.",
+  "default_prompt": "Use $adr_log when the task matches the \"ADR Log\" skill.",
+  "triggers": [
+    "adr_log",
+    "adr log",
+    "Capture key architectural decisions (ADR) with trade-offs - pros, cons, alternatives, decision, status, and date"
+  ],
+  "capabilities": [
+    "adr",
+    "log"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/locales/en/.agents/skills/adr_log/agents/openai.yaml

@@ -0,0 +1,8 @@
+interface:
+  display_name: "ADR Log"
+  short_description: "Capture key architectural decisions (ADR) with trade-offs - pros, cons, alternatives, decision,…"
+  default_prompt: "Use $adr_log when the task matches the \"ADR Log\" skill."
+dependencies:
+  tools: []
+policy:
+  allow_implicit_invocation: true

package/locales/en/.agents/skills/adr_log/agents/qwen.json

@@ -0,0 +1,17 @@
+{
+  "name": "adr_log",
+  "display_name": "ADR Log",
+  "description": "Capture key architectural decisions (ADR) with trade-offs - pros, cons, alternatives, decision, status, and date.",
+  "default_prompt": "Use $adr_log when the task matches the \"ADR Log\" skill.",
+  "triggers": [
+    "adr_log",
+    "adr log",
+    "Capture key architectural decisions (ADR) with trade-offs - pros, cons, alternatives, decision, status, and date"
+  ],
+  "capabilities": [
+    "adr",
+    "log"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/locales/en/.agents/skills/adr_log/agents/skill.yaml

@@ -0,0 +1,21 @@
+version: 1
+name: "adr_log"
+display_name: "ADR Log"
+description: "Capture key architectural decisions (ADR) with trade-offs - pros, cons, alternatives, decision, status, and date."
+default_prompt: "Use $adr_log when the task matches the \"ADR Log\" skill."
+triggers:
+  - "adr_log"
+  - "adr log"
+  - "Capture key architectural decisions (ADR) with trade-offs - pros, cons, alternatives, decision, status, and date"
+capabilities:
+  - "adr"
+  - "log"
+tools: []
+invocation:
+  explicit: true
+  implicit: true
+localization:
+  default_locale: "en"
+  available_locales:
+    - "ru"
+    - "en"

package/locales/en/.agents/skills/api_contract_compliance_review/SKILL.md

@@ -0,0 +1,224 @@
+---
+name: api_contract_compliance_review
+description: API implementation contract compliance review — schemas, error codes, validation, authorization, idempotency, pagination.
+---
+
+# Skill: API Contract Compliance Review
+
+Review: API implementation conforms to the declared contracts.
+
+**Sections:**
+1. [Workflow](#1-workflow)
+2. [Checklist](#2-checklist)
+3. [Verification Methods](#3-methods)
+4. [Common Mismatches](#4-mismatches)
+5. [Output Template](#5-output)
+
+---
+
+## 1. Workflow
+
+```
+1. Load API Contracts (from $api_contracts)
+   └── List of endpoints, schemas, error codes
+
+2. For each endpoint:
+   a. Find the implementation file (route → controller → service)
+   b. Compare: method, path, request schema, response schema
+   c. Check: error format, status codes, auth, validation
+
+3. Check cross-cutting concerns:
+   └── Error format, pagination, auth, rate limiting
+
+4. Formulate compliance report
+```
+
+---
+
+## 2. Checklist
+
+### 2.1 Endpoint Compliance
+
+| # | Check | Severity | Status |
+|---|-------|----------|--------|
+| API-01 | Every documented endpoint exists in code | 🔴 P0 | ☐ |
+| API-02 | HTTP method matches contract (POST, not PUT for create) | 🔴 P0 | ☐ |
+| API-03 | URL path matches contract (naming, params) | 🔴 P0 | ☐ |
+| API-04 | Request body schema validates with Zod (matches contract fields) | 🔴 P0 | ☐ |
+| API-05 | Response body matches contract shape | 🔴 P0 | ☐ |
+| API-06 | No undocumented endpoints exist | 🟠 P1 | ☐ |
+
+### 2.2 Error Format
+
+| # | Check | Severity | Status |
+|---|-------|----------|--------|
+| API-07 | Error responses use unified format `{ error: { code, message } }` | 🔴 P0 | ☐ |
+| API-08 | Error codes match registry (VALIDATION_ERROR, NOT_FOUND, etc.) | 🟠 P1 | ☐ |
+| API-09 | No stack traces in error responses | 🔴 P0 | ☐ |
+| API-10 | Validation errors include `details` with field names | 🟠 P1 | ☐ |
+
+### 2.3 Status Codes
+
+| # | Check | Severity | Status |
+|---|-------|----------|--------|
+| API-11 | 200 for successful GET/PUT | 🟠 P1 | ☐ |
+| API-12 | 201 for successful POST (create) | 🟠 P1 | ☐ |
+| API-13 | 204 for successful DELETE | 🟠 P1 | ☐ |
+| API-14 | 400 for validation errors | 🟠 P1 | ☐ |
+| API-15 | 401 for missing auth, 403 for insufficient permissions | 🔴 P0 | ☐ |
+| API-16 | 404 for not found | 🟠 P1 | ☐ |
+| API-17 | 409 for conflict/duplicate | 🟠 P1 | ☐ |
+| API-18 | 500 only for unexpected errors (not for validation/auth!) | 🟠 P1 | ☐ |
+
+### 2.4 Auth & AuthZ
+
+| # | Check | Severity | Status |
+|---|-------|----------|--------|
+| API-19 | Protected endpoints have auth middleware | 🔴 P0 | ☐ |
+| API-20 | Public endpoints are intentionally public (documented) | 🟠 P1 | ☐ |
+| API-21 | IDOR protection: ownership check on data access | 🔴 P0 | ☐ |
+
+### 2.5 Pagination & Filtering
+
+| # | Check | Severity | Status |
+|---|-------|----------|--------|
+| API-22 | List endpoints have pagination (cursor or offset) | 🔴 P0 | ☐ |
+| API-23 | Pagination params match contract (limit, cursor/page) | 🟠 P1 | ☐ |
+| API-24 | Response includes pagination metadata (totalCount, hasMore) | 🟠 P1 | ☐ |
+| API-25 | Filter params documented and validated | 🟡 P2 | ☐ |
+
+### 2.6 Idempotency
+
+| # | Check | Severity | Status |
+|---|-------|----------|--------|
+| API-26 | Safe methods (GET) are idempotent | 🟠 P1 | ☐ |
+| API-27 | Risky create/charge operations support Idempotency-Key (if contract requires) | 🟡 P2 | ☐ |
+
+---
+
+## 3. Verification Methods
+
+### Endpoint comparison table
+
+For each documented endpoint, fill in:
+
+```markdown
+| Contract | Implementation | Match? |
+|----------|---------------|:------:|
+| POST /api/v1/coupons | routes/coupons.js:12 → couponController.create | ✅ |
+| GET /api/v1/coupons | routes/coupons.js:8 → couponController.list | ✅ |
+| PUT /api/v1/settings/:id | routes/settings.js:15 → settingsController.update | ⚠️ PATCH vs PUT |
+| DELETE /api/v1/coupons/:id | — | ❌ NOT IMPLEMENTED |
+```
+
+### Schema comparison
+
+```javascript
+// Contract says:
+// POST /coupons → { code: string, discount: number, expiresAt: string(ISO) }
+
+// Check Zod schema in middleware:
+const createCouponSchema = z.object({
+  code: z.string().min(1).max(50),      // ✅ matches
+  discount: z.number().min(0).max(100),  // ✅ matches
+  expiresAt: z.string().datetime(),      // ✅ matches
+  // ❌ Missing: 'description' field from contract
+});
+```
+
+### Error format validation
+
+```javascript
+// Contract says: { error: { code: string, message: string, details?: object } }
+
+// Check actual error handler:
+grep_search: Query="res.status(4" Includes=["*/controllers/*"]
+grep_search: Query="res.status(5" Includes=["*/controllers/*"]
+// For each: does response match { error: { code, message } } format?
+```
+
+### Grep patterns
+
+```bash
+# Find all route definitions
+grep_search: Query="router\.(get|post|put|patch|delete)" Includes=["*/routes/*"] IsRegex=true
+
+# Find status codes used
+grep_search: Query="res.status(" Includes=["*.js"]
+
+# Find error responses
+grep_search: Query="error.*code" Includes=["*/controllers/*","*/middleware/*"]
+
+# Find auth middleware usage
+grep_search: Query="auth" Includes=["*/routes/*"]
+```
+
+---
+
+## 4. Common Mismatches
+
+| Mismatch | Example | Severity | Fix |
+|----------|---------|----------|-----|
+| **Wrong status code** | POST returns 200 instead of 201 | 🟠 P1 | `res.status(201)` |
+| **Wrong method** | PUT for partial update (should be PATCH) | 🟠 P1 | Change to PATCH or justify in ADR |
+| **Error format inconsistent** | Some endpoints return `{ message }`, others `{ error: { code } }` | 🔴 P0 | Unify via error handler middleware |
+| **Missing validation** | Endpoint accepts any body shape | 🔴 P0 | Add Zod middleware |
+| **Missing fields in response** | Contract says `{ data, meta }` but returns only `{ data }` | 🟠 P1 | Add `meta` to response |
+| **Undocumented endpoint** | New endpoint exists without contract update | 🟠 P1 | Update API contracts doc |
+| **Auth on public endpoint** | Widget endpoint requires auth (should be public) | 🔴 P0 | Remove auth, verify contract |
+| **No pagination** | List returns all records | 🔴 P0 | Add pagination params |
+| **Mixed error details** | Some 400 include field errors, some don't | 🟠 P1 | Standardize `details` shape |
+
+---
+
+## 5. Output Template
+
+```markdown
+# API Contract Compliance Review
+
+**Scope:** <module/PR>
+**Reviewer:** Reviewer Agent
+**Date:** YYYY-MM-DD
+**Contract reference:** docs/api-contracts.md
+
+## Endpoint Compliance
+
+| # | Contract Endpoint | Implementation | Method | Path | Schema | Auth | Status |
+|---|------------------|---------------|:------:|:----:|:------:|:----:|:------:|
+| 1 | POST /api/v1/coupons | couponController.create | ✅ | ✅ | ✅ | ✅ | ✅ |
+| 2 | GET /api/v1/coupons | couponController.list | ✅ | ✅ | ⚠️ | ✅ | ⚠️ |
+| 3 | PUT /api/v1/settings/:id | settingsController.update | ⚠️ | ✅ | ✅ | ✅ | ⚠️ |
+| 4 | DELETE /api/v1/coupons/:id | — | — | — | — | — | ❌ |
+
+## Findings
+
+| # | Severity | Check | File:Line | Mismatch | Fix |
+|---|----------|-------|-----------|----------|-----|
+| 1 | 🔴 P0 | API-01 | — | DELETE /coupons/:id not implemented | Implement or remove from contract |
+| 2 | 🟠 P1 | API-12 | `controllers/coupon.js:35` | POST returns 200 instead of 201 | Change to `res.status(201)` |
+| 3 | 🟠 P1 | API-02 | `routes/settings.js:15` | PUT used for partial update | Change to PATCH or update contract |
+
+## Error Format Compliance
+| Endpoint | Expected Format | Actual Format | Status |
+|----------|----------------|--------------|:------:|
+| POST /coupons (400) | `{ error: { code, message, details } }` | ✅ | Pass |
+| GET /coupons (500) | `{ error: { code, message } }` | `{ message: err.message }` | ❌ Fail |
+
+## Summary
+- Endpoints: X/Y compliant (Z% coverage)
+- P0 mismatches: N
+- P1 mismatches: M
+
+## Verdict
+- ✅ COMPLIANT — all endpoints match contract
+- ⚠️ DEVIATIONS — minor mismatches to fix
+- ❌ NON-COMPLIANT — critical contract violations
+```
+
+---
+
+## See also
+- `$api_contracts` — API contract definitions (source of truth)
+- `$code_review_checklist` — general review (API section)
+- `$security_review` — auth/validation depth (SEC-06..SEC-17)
+- `$review_reference_snippets` — DO/DON'T snippets (section M)

package/locales/en/.agents/skills/api_contracts/SKILL.md

@@ -0,0 +1,328 @@
+---
+name: api_contracts
+description: API contracts for UX flows — endpoints, schemas, errors, validation, authorization, perf/scalability considerations, idempotency, and integration patterns.
+---
+
+# Skill: API Contracts
+
+Complete API description: from endpoint definition to error format.
+
+**Sections:**
+1. [General rules](#1-general-rules)
+2. [Endpoint Definition Template](#2-endpoint-template)
+3. [Error Format](#3-error-format)
+4. [Pagination & Filtering](#4-pagination)
+5. [Auth Convention](#5-auth)
+6. [Integration Contracts](#6-integrations)
+7. [Example: complete contract](#7-example)
+8. [Output Template](#8-output)
+
+---
+
+## 1. General rules
+
+| Rule | Convention |
+|---------|-----------|
+| **Base path** | `/api/v1/<resource>` |
+| **Naming** | kebab-case, plural nouns: `/api/v1/products` |
+| **Methods** | GET (read), POST (create), PUT (full update), PATCH (partial), DELETE |
+| **Status codes** | 200 (OK), 201 (Created), 204 (No Content), 400, 401, 403, 404, 409, 422, 500 |
+| **Content-Type** | `application/json` (request & response) |
+| **Error format** | Unified (see section 3) |
+| **Validation** | Zod schemas for each endpoint, at the boundary (middleware) |
+| **Auth** | Token in header or httpOnly cookie. Check on every protected endpoint |
+| **Idempotency** | PUT = idempotent. POST create = idempotent key (if needed) |
+| **Versioning** | URL prefix: `/api/v1/`, `/api/v2/` (for breaking changes) |
+
+---
+
+## 2. Endpoint Definition Template
+
+For each endpoint, fill in:
+
+```markdown
+### POST /api/v1/products
+
+**Summary:** Create a new product for the tenant.
+
+**Auth:** Required (tenantId in path or JWT)
+
+**Request:**
+| Field | Type | Required | Constraints | Example |
+|-------|------|----------|------------|---------|
+| name | string | ✅ | 3-100 chars | "Premium Widget" |
+| price | number | ✅ | 0.01-99999 | 29.99 |
+| category | string | ✅ | enum: digital, physical, subscription | "digital" |
+| active | boolean | ⬜ | default: true | true |
+
+**Request example:**
+\`\`\`json
+{
+  "name": "Premium Widget",
+  "price": 29.99,
+  "category": "digital"
+}
+\`\`\`
+
+**Response (201):**
+\`\`\`json
+{
+  "data": {
+    "id": "p-abc123",
+    "name": "Premium Widget",
+    "price": 29.99,
+    "category": "digital",
+    "active": true,
+    "createdAt": "2026-03-13T03:00:00Z",
+    "updatedAt": "2026-03-13T03:00:00Z"
+  }
+}
+\`\`\`
+
+**Errors:**
+| Status | Code | When |
+|--------|------|------|
+| 400 | VALIDATION_ERROR | Invalid input (see details) |
+| 409 | DUPLICATE | Product name already exists for this tenant |
+| 401 | UNAUTHORIZED | Missing or invalid auth |
+
+**Perf notes:**
+- Unique index on (tenantId, name) — O(log n) lookup
+- No pagination needed (single resource create)
+```
+
+### Zod Schema (for validation)
+
+```js
+import { z } from 'zod';
+
+/**
+ * Schema for creating a product.
+ */
+export const createProductSchema = z.object({
+  name: z.string()
+    .min(3, 'Name must be at least 3 characters')
+    .max(100, 'Name must be at most 100 characters')
+    .trim(),
+  price: z.number()
+    .min(0.01, 'Price must be at least 0.01')
+    .max(99999, 'Price cannot exceed 99999'),
+  category: z.enum(['digital', 'physical', 'subscription']),
+  active: z.boolean().optional().default(true),
+});
+```
+
+---
+
+## 3. Error Format
+
+### Unified format (all endpoints)
+
+```json
+{
+  "error": {
+    "code": "VALIDATION_ERROR",
+    "message": "Invalid input",
+    "details": [
+      { "field": "code", "message": "Must be at least 3 characters" },
+      { "field": "discount", "message": "Must be at least 1" }
+    ]
+  }
+}
+```
+
+### Error codes (registry)
+
+| HTTP | Code | Description | When |
+|------|------|-------------|------|
+| 400 | `VALIDATION_ERROR` | Input validation failed | Zod parse error |
+| 400 | `BAD_REQUEST` | Malformed request | Missing body, bad JSON |
+| 401 | `UNAUTHORIZED` | No auth or expired token | Missing/invalid JWT |
+| 403 | `FORBIDDEN` | Authenticated but not allowed | Wrong role/scope |
+| 404 | `NOT_FOUND` | Resource doesn't exist | ID not in DB |
+| 409 | `DUPLICATE` | Unique constraint violation | Duplicate key |
+| 409 | `CONFLICT` | Optimistic concurrency | Version mismatch |
+| 422 | `UNPROCESSABLE` | Business rule violation | Item expired, limit reached |
+| 429 | `RATE_LIMITED` | Too many requests | Rate limit exceeded |
+| 500 | `INTERNAL_ERROR` | Unexpected server error | Bug, DB down |
+
+### Rules
+
+- **Never** return stack trace, DB error, internal path
+- `code` = machine-readable (for the client)
+- `message` = human-readable (for toast/UI)
+- `details` = field-level errors (for form validation)
+
+---
+
+## 4. Pagination & Filtering
+
+### Cursor pagination (default for lists)
+
+```markdown
+### GET /api/v1/products
+
+**Query params:**
+| Param | Type | Default | Description |
+|-------|------|---------|-------------|
+| limit | number | 20 | Max items per page (1-100) |
+| cursor | string | — | Cursor from previous response |
+| status | string | — | Filter: "active" or "inactive" |
+| q | string | — | Search by name (case-insensitive) |
+| sort | string | -createdAt | Sort field with direction prefix |
+
+**Response (200):**
+\`\`\`json
+{
+  "data": [...],
+  "pagination": {
+    "nextCursor": "eyJpZCI6ImMtYWJjMTIzIn0=",
+    "hasMore": true,
+    "total": 42
+  }
+}
+\`\`\`
+```
+
+### Convention
+
+| Pattern | When | Example |
+|---------|-------|--------|
+| **Cursor** | Large collections (> 1K), real-time data | Products list, activity log |
+| **Offset** | Small collections, admin UI | Settings list (< 100 items) |
+| **No pagination** | Single resource, bounded data | Config, user profile |
+
+---
+
+## 5. Auth
+
+### Convention
+
+```markdown
+**Auth header:**
+Authorization: Bearer <jwt_token>
+
+**Or httpOnly cookie:**
+Cookie: token=<jwt_token>
+
+**Auth check middleware:**
+1. Extract token (header → cookie fallback)
+2. Verify JWT signature + expiration
+3. Attach user/tenantId to req
+4. Check required role/scope (if endpoint needs it)
+
+**Protected endpoints:** All /api/v1/* except:
+- GET /health/live
+- GET /health/ready
+- POST /api/webhooks/* (verified by webhook signature)
+```
+
+### Auth table (per endpoint)
+
+| Endpoint | Auth | Role | Notes |
+|----------|------|------|-------|
+| `GET /api/v1/content/:id` | ⬜ Public | — | Public content endpoint |
+| `GET /api/v1/settings/:id` | ✅ Required | owner | Dashboard only |
+| `PUT /api/v1/settings/:id` | ✅ Required | owner | Dashboard only |
+| `POST /api/v1/products` | ✅ Required | owner | Dashboard only |
+| `POST /api/webhooks/install` | 🔑 Webhook sig | — | Platform signs with JWT |
+
+---
+
+## 6. Integration Contracts
+
+### Webhook contract
+
+```markdown
+### POST /api/webhooks/v1/install
+
+**Source:** External Platform
+**Auth:** JWT signature verification (not Bearer token)
+**Content-Type:** text/plain (JWT string)
+
+**Processing:**
+1. Decode JWT (verify signature in production)
+2. Extract tenantId from payload
+3. Upsert tenant + default settings
+4. Call Platform registration API
+5. Return 200 { success: true }
+
+**Idempotent:** Yes (upsert)
+**Retry:** Platform retries on timeout/5xx
+**Timeout:** Must respond within 10s
+```
+
+### External API call contract
+
+```markdown
+### External Platform API
+
+**Endpoint:** POST https://api.example.com/v1/register
+**Auth:** OAuth access token
+**Timeout:** 5s
+**Retry:** 2x with exponential backoff (1s, 3s)
+**Idempotent:** Yes (same registration = no-op)
+**Failure handling:** Log error, don't fail webhook (retry manually)
+```
+
+---
+
+## 7. Example: complete contract
+
+```markdown
+# API Contracts: SaaS Admin Panel
+
+## Endpoints
+
+| Method | Path | Auth | Summary |
+|--------|------|------|---------|
+| GET | /api/v1/content/:tenantId | Public | Public content payload |
+| GET | /api/v1/content/resolve-tenant | Public | Resolve tenantId from origin |
+| GET | /api/v1/settings/:tenantId | Owner | Get settings |
+| PUT | /api/v1/settings/:tenantId | Owner | Update settings |
+| GET | /api/v1/products | Owner | List products (paginated) |
+| POST | /api/v1/products | Owner | Create product |
+| PUT | /api/v1/products/:id | Owner | Update product |
+| DELETE | /api/v1/products/:id | Owner | Delete product |
+| POST | /api/webhooks/v1/install | Webhook | Platform install webhook |
+| POST | /api/webhooks/v1/uninstall | Webhook | Platform uninstall webhook |
+| GET | /health/live | Public | Liveness probe |
+| GET | /health/ready | Public | Readiness probe |
+```
+
+---
+
+## 8. Output Template
+
+```markdown
+# API Contracts: <project-name>
+
+**Date:** YYYY-MM-DD
+**Version:** v1
+**Base URL:** https://<host>/api/v1
+
+## General Rules
+- Error format: { error: { code, message, details } }
+- Auth: Bearer JWT or httpOnly cookie
+- Pagination: cursor-based (limit, cursor, hasMore)
+
+## Endpoints
+<for each endpoint: section 2 template>
+
+## Error Codes
+<section 3 registry table>
+
+## Auth Table
+<section 5 per-endpoint table>
+
+## Integration Contracts
+<section 6 for each external integration>
+```
+
+---
+
+## See also
+- `$architecture_doc` — Architecture Document (references API contracts)
+- `$data_model` — Data model (entities match request/response schemas)
+- `$security_baseline_dev` — Zod validation, auth patterns
+- `$node_express_beast_practices` — Express implementation patterns

package/locales/en/.agents/skills/api_contracts/agents/claude.json

@@ -0,0 +1,17 @@
+{
+  "name": "api_contracts",
+  "display_name": "API Contracts",
+  "description": "Define API contracts from UX flows - endpoints, schemas, errors, validation, authorization, performance considerations, idempotency, and integration patterns.",
+  "default_prompt": "Use $api_contracts when the task matches the \"API Contracts\" skill.",
+  "triggers": [
+    "api_contracts",
+    "api contracts",
+    "Define API contracts from UX flows - endpoints, schemas, errors, validation, authorization, performance considerations, idempotency, and integration patterns"
+  ],
+  "capabilities": [
+    "api",
+    "contracts"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/locales/en/.agents/skills/api_contracts/agents/copilot.json

@@ -0,0 +1,17 @@
+{
+  "name": "api_contracts",
+  "display_name": "API Contracts",
+  "description": "Define API contracts from UX flows - endpoints, schemas, errors, validation, authorization, performance considerations, idempotency, and integration patterns.",
+  "default_prompt": "Use $api_contracts when the task matches the \"API Contracts\" skill.",
+  "triggers": [
+    "api_contracts",
+    "api contracts",
+    "Define API contracts from UX flows - endpoints, schemas, errors, validation, authorization, performance considerations, idempotency, and integration patterns"
+  ],
+  "capabilities": [
+    "api",
+    "contracts"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/locales/en/.agents/skills/api_contracts/agents/gemini.json

@@ -0,0 +1,17 @@
+{
+  "name": "api_contracts",
+  "display_name": "API Contracts",
+  "description": "Define API contracts from UX flows - endpoints, schemas, errors, validation, authorization, performance considerations, idempotency, and integration patterns.",
+  "default_prompt": "Use $api_contracts when the task matches the \"API Contracts\" skill.",
+  "triggers": [
+    "api_contracts",
+    "api contracts",
+    "Define API contracts from UX flows - endpoints, schemas, errors, validation, authorization, performance considerations, idempotency, and integration patterns"
+  ],
+  "capabilities": [
+    "api",
+    "contracts"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/locales/en/.agents/skills/api_contracts/agents/openai.yaml

@@ -0,0 +1,8 @@
+interface:
+  display_name: "API Contracts"
+  short_description: "Define API contracts from UX flows - endpoints, schemas, errors, validation, authorization, per…"
+  default_prompt: "Use $api_contracts when the task matches the \"API Contracts\" skill."
+dependencies:
+  tools: []
+policy:
+  allow_implicit_invocation: true