code-ai-installer 2.5.0 → 4.0.0

package/locales/en/.agents/skills/api-contract-compliance-review/SKILL.md

@@ -1,224 +0,0 @@
----
-name: api-contract-compliance-review
-description: API implementation contract compliance review — schemas, error codes, validation, authorization, idempotency, pagination.
----
-
-# Skill: API Contract Compliance Review
-
-Review: API implementation conforms to the declared contracts.
-
-**Sections:**
-1. [Workflow](#1-workflow)
-2. [Checklist](#2-checklist)
-3. [Verification Methods](#3-methods)
-4. [Common Mismatches](#4-mismatches)
-5. [Output Template](#5-output)
-
----
-
-## 1. Workflow
-
-```
-1. Load API Contracts (from $api-contracts)
-   └── List of endpoints, schemas, error codes
-
-2. For each endpoint:
-   a. Find the implementation file (route → controller → service)
-   b. Compare: method, path, request schema, response schema
-   c. Check: error format, status codes, auth, validation
-
-3. Check cross-cutting concerns:
-   └── Error format, pagination, auth, rate limiting
-
-4. Formulate compliance report
-```
-
----
-
-## 2. Checklist
-
-### 2.1 Endpoint Compliance
-
-| # | Check | Severity | Status |
-|---|-------|----------|--------|
-| API-01 | Every documented endpoint exists in code | 🔴 P0 | ☐ |
-| API-02 | HTTP method matches contract (POST, not PUT for create) | 🔴 P0 | ☐ |
-| API-03 | URL path matches contract (naming, params) | 🔴 P0 | ☐ |
-| API-04 | Request body schema validates with Zod (matches contract fields) | 🔴 P0 | ☐ |
-| API-05 | Response body matches contract shape | 🔴 P0 | ☐ |
-| API-06 | No undocumented endpoints exist | 🟠 P1 | ☐ |
-
-### 2.2 Error Format
-
-| # | Check | Severity | Status |
-|---|-------|----------|--------|
-| API-07 | Error responses use unified format `{ error: { code, message } }` | 🔴 P0 | ☐ |
-| API-08 | Error codes match registry (VALIDATION_ERROR, NOT_FOUND, etc.) | 🟠 P1 | ☐ |
-| API-09 | No stack traces in error responses | 🔴 P0 | ☐ |
-| API-10 | Validation errors include `details` with field names | 🟠 P1 | ☐ |
-
-### 2.3 Status Codes
-
-| # | Check | Severity | Status |
-|---|-------|----------|--------|
-| API-11 | 200 for successful GET/PUT | 🟠 P1 | ☐ |
-| API-12 | 201 for successful POST (create) | 🟠 P1 | ☐ |
-| API-13 | 204 for successful DELETE | 🟠 P1 | ☐ |
-| API-14 | 400 for validation errors | 🟠 P1 | ☐ |
-| API-15 | 401 for missing auth, 403 for insufficient permissions | 🔴 P0 | ☐ |
-| API-16 | 404 for not found | 🟠 P1 | ☐ |
-| API-17 | 409 for conflict/duplicate | 🟠 P1 | ☐ |
-| API-18 | 500 only for unexpected errors (not for validation/auth!) | 🟠 P1 | ☐ |
-
-### 2.4 Auth & AuthZ
-
-| # | Check | Severity | Status |
-|---|-------|----------|--------|
-| API-19 | Protected endpoints have auth middleware | 🔴 P0 | ☐ |
-| API-20 | Public endpoints are intentionally public (documented) | 🟠 P1 | ☐ |
-| API-21 | IDOR protection: ownership check on data access | 🔴 P0 | ☐ |
-
-### 2.5 Pagination & Filtering
-
-| # | Check | Severity | Status |
-|---|-------|----------|--------|
-| API-22 | List endpoints have pagination (cursor or offset) | 🔴 P0 | ☐ |
-| API-23 | Pagination params match contract (limit, cursor/page) | 🟠 P1 | ☐ |
-| API-24 | Response includes pagination metadata (totalCount, hasMore) | 🟠 P1 | ☐ |
-| API-25 | Filter params documented and validated | 🟡 P2 | ☐ |
-
-### 2.6 Idempotency
-
-| # | Check | Severity | Status |
-|---|-------|----------|--------|
-| API-26 | Safe methods (GET) are idempotent | 🟠 P1 | ☐ |
-| API-27 | Risky create/charge operations support Idempotency-Key (if contract requires) | 🟡 P2 | ☐ |
-
----
-
-## 3. Verification Methods
-
-### Endpoint comparison table
-
-For each documented endpoint, fill in:
-
-```markdown
-| Contract | Implementation | Match? |
-|----------|---------------|:------:|
-| POST /api/v1/coupons | routes/coupons.js:12 → couponController.create | ✅ |
-| GET /api/v1/coupons | routes/coupons.js:8 → couponController.list | ✅ |
-| PUT /api/v1/settings/:id | routes/settings.js:15 → settingsController.update | ⚠️ PATCH vs PUT |
-| DELETE /api/v1/coupons/:id | — | ❌ NOT IMPLEMENTED |
-```
-
-### Schema comparison
-
-```javascript
-// Contract says:
-// POST /coupons → { code: string, discount: number, expiresAt: string(ISO) }
-
-// Check Zod schema in middleware:
-const createCouponSchema = z.object({
-  code: z.string().min(1).max(50),      // ✅ matches
-  discount: z.number().min(0).max(100),  // ✅ matches
-  expiresAt: z.string().datetime(),      // ✅ matches
-  // ❌ Missing: 'description' field from contract
-});
-```
-
-### Error format validation
-
-```javascript
-// Contract says: { error: { code: string, message: string, details?: object } }
-
-// Check actual error handler:
-grep_search: Query="res.status(4" Includes=["*/controllers/*"]
-grep_search: Query="res.status(5" Includes=["*/controllers/*"]
-// For each: does response match { error: { code, message } } format?
-```
-
-### Grep patterns
-
-```bash
-# Find all route definitions
-grep_search: Query="router\.(get|post|put|patch|delete)" Includes=["*/routes/*"] IsRegex=true
-
-# Find status codes used
-grep_search: Query="res.status(" Includes=["*.js"]
-
-# Find error responses
-grep_search: Query="error.*code" Includes=["*/controllers/*","*/middleware/*"]
-
-# Find auth middleware usage
-grep_search: Query="auth" Includes=["*/routes/*"]
-```
-
----
-
-## 4. Common Mismatches
-
-| Mismatch | Example | Severity | Fix |
-|----------|---------|----------|-----|
-| **Wrong status code** | POST returns 200 instead of 201 | 🟠 P1 | `res.status(201)` |
-| **Wrong method** | PUT for partial update (should be PATCH) | 🟠 P1 | Change to PATCH or justify in ADR |
-| **Error format inconsistent** | Some endpoints return `{ message }`, others `{ error: { code } }` | 🔴 P0 | Unify via error handler middleware |
-| **Missing validation** | Endpoint accepts any body shape | 🔴 P0 | Add Zod middleware |
-| **Missing fields in response** | Contract says `{ data, meta }` but returns only `{ data }` | 🟠 P1 | Add `meta` to response |
-| **Undocumented endpoint** | New endpoint exists without contract update | 🟠 P1 | Update API contracts doc |
-| **Auth on public endpoint** | Widget endpoint requires auth (should be public) | 🔴 P0 | Remove auth, verify contract |
-| **No pagination** | List returns all records | 🔴 P0 | Add pagination params |
-| **Mixed error details** | Some 400 include field errors, some don't | 🟠 P1 | Standardize `details` shape |
-
----
-
-## 5. Output Template
-
-```markdown
-# API Contract Compliance Review
-
-**Scope:** <module/PR>
-**Reviewer:** Reviewer Agent
-**Date:** YYYY-MM-DD
-**Contract reference:** docs/api-contracts.md
-
-## Endpoint Compliance
-
-| # | Contract Endpoint | Implementation | Method | Path | Schema | Auth | Status |
-|---|------------------|---------------|:------:|:----:|:------:|:----:|:------:|
-| 1 | POST /api/v1/coupons | couponController.create | ✅ | ✅ | ✅ | ✅ | ✅ |
-| 2 | GET /api/v1/coupons | couponController.list | ✅ | ✅ | ⚠️ | ✅ | ⚠️ |
-| 3 | PUT /api/v1/settings/:id | settingsController.update | ⚠️ | ✅ | ✅ | ✅ | ⚠️ |
-| 4 | DELETE /api/v1/coupons/:id | — | — | — | — | — | ❌ |
-
-## Findings
-
-| # | Severity | Check | File:Line | Mismatch | Fix |
-|---|----------|-------|-----------|----------|-----|
-| 1 | 🔴 P0 | API-01 | — | DELETE /coupons/:id not implemented | Implement or remove from contract |
-| 2 | 🟠 P1 | API-12 | `controllers/coupon.js:35` | POST returns 200 instead of 201 | Change to `res.status(201)` |
-| 3 | 🟠 P1 | API-02 | `routes/settings.js:15` | PUT used for partial update | Change to PATCH or update contract |
-
-## Error Format Compliance
-| Endpoint | Expected Format | Actual Format | Status |
-|----------|----------------|--------------|:------:|
-| POST /coupons (400) | `{ error: { code, message, details } }` | ✅ | Pass |
-| GET /coupons (500) | `{ error: { code, message } }` | `{ message: err.message }` | ❌ Fail |
-
-## Summary
-- Endpoints: X/Y compliant (Z% coverage)
-- P0 mismatches: N
-- P1 mismatches: M
-
-## Verdict
-- ✅ COMPLIANT — all endpoints match contract
-- ⚠️ DEVIATIONS — minor mismatches to fix
-- ❌ NON-COMPLIANT — critical contract violations
-```
-
----
-
-## See also
-- `$api-contracts` — API contract definitions (source of truth)
-- `$code-review-checklist` — general review (API section)
-- `$security-review` — auth/validation depth (SEC-06..SEC-17)
-- `$review-reference-snippets` — DO/DON'T snippets (section M)

package/locales/en/.agents/skills/api-contract-compliance-review/agents/claude.json

@@ -1,19 +0,0 @@
-{
-  "name": "api-contract-compliance-review",
-  "display_name": "API Contract Compliance Review",
-  "description": "API implementation contract compliance review — schemas, error codes, validation, authorization, idempotency, pagination.",
-  "default_prompt": "Use $api-contract-compliance-review when the task matches the \"API Contract Compliance Review\" skill.",
-  "triggers": [
-    "api-contract-compliance-review",
-    "api contract compliance review",
-    "API implementation contract compliance review — schemas, error codes, validation, authorization, idempotency, pagination"
-  ],
-  "capabilities": [
-    "api",
-    "contract",
-    "compliance",
-    "review"
-  ],
-  "tools": [],
-  "implicit_invocation": true
-}

package/locales/en/.agents/skills/api-contract-compliance-review/agents/copilot.json

@@ -1,19 +0,0 @@
-{
-  "name": "api-contract-compliance-review",
-  "display_name": "API Contract Compliance Review",
-  "description": "API implementation contract compliance review — schemas, error codes, validation, authorization, idempotency, pagination.",
-  "default_prompt": "Use $api-contract-compliance-review when the task matches the \"API Contract Compliance Review\" skill.",
-  "triggers": [
-    "api-contract-compliance-review",
-    "api contract compliance review",
-    "API implementation contract compliance review — schemas, error codes, validation, authorization, idempotency, pagination"
-  ],
-  "capabilities": [
-    "api",
-    "contract",
-    "compliance",
-    "review"
-  ],
-  "tools": [],
-  "implicit_invocation": true
-}

package/locales/en/.agents/skills/api-contract-compliance-review/agents/gemini.json

@@ -1,19 +0,0 @@
-{
-  "name": "api-contract-compliance-review",
-  "display_name": "API Contract Compliance Review",
-  "description": "API implementation contract compliance review — schemas, error codes, validation, authorization, idempotency, pagination.",
-  "default_prompt": "Use $api-contract-compliance-review when the task matches the \"API Contract Compliance Review\" skill.",
-  "triggers": [
-    "api-contract-compliance-review",
-    "api contract compliance review",
-    "API implementation contract compliance review — schemas, error codes, validation, authorization, idempotency, pagination"
-  ],
-  "capabilities": [
-    "api",
-    "contract",
-    "compliance",
-    "review"
-  ],
-  "tools": [],
-  "implicit_invocation": true
-}

package/locales/en/.agents/skills/api-contract-compliance-review/agents/kimi.yaml

@@ -1,15 +0,0 @@
-name: "api-contract-compliance-review"
-display_name: "API Contract Compliance Review"
-description: "API implementation contract compliance review — schemas, error codes, validation, authorization, idempotency, pagination."
-default_prompt: "Use $api-contract-compliance-review when the task matches the \"API Contract Compliance Review\" skill."
-triggers:
-  - "api-contract-compliance-review"
-  - "api contract compliance review"
-  - "API implementation contract compliance review — schemas, error codes, validation, authorization, idempotency, pagination"
-capabilities:
-  - "api"
-  - "contract"
-  - "compliance"
-  - "review"
-tools: []
-implicit_invocation: true

package/locales/en/.agents/skills/api-contract-compliance-review/agents/openai.yaml

@@ -1,8 +0,0 @@
-interface:
-  display_name: "API Contract Compliance Review"
-  short_description: "API implementation contract compliance review — schemas, error codes, validation, authorization…"
-  default_prompt: "Use $api-contract-compliance-review when the task matches the \"API Contract Compliance Review\" skill."
-dependencies:
-  tools: []
-policy:
-  allow_implicit_invocation: true

package/locales/en/.agents/skills/api-contract-compliance-review/agents/qwen.json

@@ -1,19 +0,0 @@
-{
-  "name": "api-contract-compliance-review",
-  "display_name": "API Contract Compliance Review",
-  "description": "API implementation contract compliance review — schemas, error codes, validation, authorization, idempotency, pagination.",
-  "default_prompt": "Use $api-contract-compliance-review when the task matches the \"API Contract Compliance Review\" skill.",
-  "triggers": [
-    "api-contract-compliance-review",
-    "api contract compliance review",
-    "API implementation contract compliance review — schemas, error codes, validation, authorization, idempotency, pagination"
-  ],
-  "capabilities": [
-    "api",
-    "contract",
-    "compliance",
-    "review"
-  ],
-  "tools": [],
-  "implicit_invocation": true
-}

package/locales/en/.agents/skills/api-contract-compliance-review/agents/skill.yaml

@@ -1,23 +0,0 @@
-version: 1
-name: "api-contract-compliance-review"
-display_name: "API Contract Compliance Review"
-description: "API implementation contract compliance review — schemas, error codes, validation, authorization, idempotency, pagination."
-default_prompt: "Use $api-contract-compliance-review when the task matches the \"API Contract Compliance Review\" skill."
-triggers:
-  - "api-contract-compliance-review"
-  - "api contract compliance review"
-  - "API implementation contract compliance review — schemas, error codes, validation, authorization, idempotency, pagination"
-capabilities:
-  - "api"
-  - "contract"
-  - "compliance"
-  - "review"
-tools: []
-invocation:
-  explicit: true
-  implicit: true
-localization:
-  default_locale: "en"
-  available_locales:
-    - "ru"
-    - "en"

package/locales/en/.agents/skills/api-contracts/SKILL.md

@@ -1,328 +0,0 @@
----
-name: api-contracts
-description: API contracts for UX flows — endpoints, schemas, errors, validation, authorization, perf/scalability considerations, idempotency, and integration patterns.
----
-
-# Skill: API Contracts
-
-Complete API description: from endpoint definition to error format.
-
-**Sections:**
-1. [General rules](#1-general-rules)
-2. [Endpoint Definition Template](#2-endpoint-template)
-3. [Error Format](#3-error-format)
-4. [Pagination & Filtering](#4-pagination)
-5. [Auth Convention](#5-auth)
-6. [Integration Contracts](#6-integrations)
-7. [Example: complete contract](#7-example)
-8. [Output Template](#8-output)
-
----
-
-## 1. General rules
-
-| Rule | Convention |
-|---------|-----------|
-| **Base path** | `/api/v1/<resource>` |
-| **Naming** | kebab-case, plural nouns: `/api/v1/products` |
-| **Methods** | GET (read), POST (create), PUT (full update), PATCH (partial), DELETE |
-| **Status codes** | 200 (OK), 201 (Created), 204 (No Content), 400, 401, 403, 404, 409, 422, 500 |
-| **Content-Type** | `application/json` (request & response) |
-| **Error format** | Unified (see section 3) |
-| **Validation** | Zod schemas for each endpoint, at the boundary (middleware) |
-| **Auth** | Token in header or httpOnly cookie. Check on every protected endpoint |
-| **Idempotency** | PUT = idempotent. POST create = idempotent key (if needed) |
-| **Versioning** | URL prefix: `/api/v1/`, `/api/v2/` (for breaking changes) |
-
----
-
-## 2. Endpoint Definition Template
-
-For each endpoint, fill in:
-
-```markdown
-### POST /api/v1/products
-
-**Summary:** Create a new product for the tenant.
-
-**Auth:** Required (tenantId in path or JWT)
-
-**Request:**
-| Field | Type | Required | Constraints | Example |
-|-------|------|----------|------------|---------|
-| name | string | ✅ | 3-100 chars | "Premium Widget" |
-| price | number | ✅ | 0.01-99999 | 29.99 |
-| category | string | ✅ | enum: digital, physical, subscription | "digital" |
-| active | boolean | ⬜ | default: true | true |
-
-**Request example:**
-\`\`\`json
-{
-  "name": "Premium Widget",
-  "price": 29.99,
-  "category": "digital"
-}
-\`\`\`
-
-**Response (201):**
-\`\`\`json
-{
-  "data": {
-    "id": "p-abc123",
-    "name": "Premium Widget",
-    "price": 29.99,
-    "category": "digital",
-    "active": true,
-    "createdAt": "2026-03-13T03:00:00Z",
-    "updatedAt": "2026-03-13T03:00:00Z"
-  }
-}
-\`\`\`
-
-**Errors:**
-| Status | Code | When |
-|--------|------|------|
-| 400 | VALIDATION_ERROR | Invalid input (see details) |
-| 409 | DUPLICATE | Product name already exists for this tenant |
-| 401 | UNAUTHORIZED | Missing or invalid auth |
-
-**Perf notes:**
-- Unique index on (tenantId, name) — O(log n) lookup
-- No pagination needed (single resource create)
-```
-
-### Zod Schema (for validation)
-
-```js
-import { z } from 'zod';
-
-/**
- * Schema for creating a product.
- */
-export const createProductSchema = z.object({
-  name: z.string()
-    .min(3, 'Name must be at least 3 characters')
-    .max(100, 'Name must be at most 100 characters')
-    .trim(),
-  price: z.number()
-    .min(0.01, 'Price must be at least 0.01')
-    .max(99999, 'Price cannot exceed 99999'),
-  category: z.enum(['digital', 'physical', 'subscription']),
-  active: z.boolean().optional().default(true),
-});
-```
-
----
-
-## 3. Error Format
-
-### Unified format (all endpoints)
-
-```json
-{
-  "error": {
-    "code": "VALIDATION_ERROR",
-    "message": "Invalid input",
-    "details": [
-      { "field": "code", "message": "Must be at least 3 characters" },
-      { "field": "discount", "message": "Must be at least 1" }
-    ]
-  }
-}
-```
-
-### Error codes (registry)
-
-| HTTP | Code | Description | When |
-|------|------|-------------|------|
-| 400 | `VALIDATION_ERROR` | Input validation failed | Zod parse error |
-| 400 | `BAD_REQUEST` | Malformed request | Missing body, bad JSON |
-| 401 | `UNAUTHORIZED` | No auth or expired token | Missing/invalid JWT |
-| 403 | `FORBIDDEN` | Authenticated but not allowed | Wrong role/scope |
-| 404 | `NOT_FOUND` | Resource doesn't exist | ID not in DB |
-| 409 | `DUPLICATE` | Unique constraint violation | Duplicate key |
-| 409 | `CONFLICT` | Optimistic concurrency | Version mismatch |
-| 422 | `UNPROCESSABLE` | Business rule violation | Item expired, limit reached |
-| 429 | `RATE_LIMITED` | Too many requests | Rate limit exceeded |
-| 500 | `INTERNAL_ERROR` | Unexpected server error | Bug, DB down |
-
-### Rules
-
-- **Never** return stack trace, DB error, internal path
-- `code` = machine-readable (for the client)
-- `message` = human-readable (for toast/UI)
-- `details` = field-level errors (for form validation)
-
----
-
-## 4. Pagination & Filtering
-
-### Cursor pagination (default for lists)
-
-```markdown
-### GET /api/v1/products
-
-**Query params:**
-| Param | Type | Default | Description |
-|-------|------|---------|-------------|
-| limit | number | 20 | Max items per page (1-100) |
-| cursor | string | — | Cursor from previous response |
-| status | string | — | Filter: "active" or "inactive" |
-| q | string | — | Search by name (case-insensitive) |
-| sort | string | -createdAt | Sort field with direction prefix |
-
-**Response (200):**
-\`\`\`json
-{
-  "data": [...],
-  "pagination": {
-    "nextCursor": "eyJpZCI6ImMtYWJjMTIzIn0=",
-    "hasMore": true,
-    "total": 42
-  }
-}
-\`\`\`
-```
-
-### Convention
-
-| Pattern | When | Example |
-|---------|-------|--------|
-| **Cursor** | Large collections (> 1K), real-time data | Products list, activity log |
-| **Offset** | Small collections, admin UI | Settings list (< 100 items) |
-| **No pagination** | Single resource, bounded data | Config, user profile |
-
----
-
-## 5. Auth
-
-### Convention
-
-```markdown
-**Auth header:**
-Authorization: Bearer <jwt_token>
-
-**Or httpOnly cookie:**
-Cookie: token=<jwt_token>
-
-**Auth check middleware:**
-1. Extract token (header → cookie fallback)
-2. Verify JWT signature + expiration
-3. Attach user/tenantId to req
-4. Check required role/scope (if endpoint needs it)
-
-**Protected endpoints:** All /api/v1/* except:
-- GET /health/live
-- GET /health/ready
-- POST /api/webhooks/* (verified by webhook signature)
-```
-
-### Auth table (per endpoint)
-
-| Endpoint | Auth | Role | Notes |
-|----------|------|------|-------|
-| `GET /api/v1/content/:id` | ⬜ Public | — | Public content endpoint |
-| `GET /api/v1/settings/:id` | ✅ Required | owner | Dashboard only |
-| `PUT /api/v1/settings/:id` | ✅ Required | owner | Dashboard only |
-| `POST /api/v1/products` | ✅ Required | owner | Dashboard only |
-| `POST /api/webhooks/install` | 🔑 Webhook sig | — | Platform signs with JWT |
-
----
-
-## 6. Integration Contracts
-
-### Webhook contract
-
-```markdown
-### POST /api/webhooks/v1/install
-
-**Source:** External Platform
-**Auth:** JWT signature verification (not Bearer token)
-**Content-Type:** text/plain (JWT string)
-
-**Processing:**
-1. Decode JWT (verify signature in production)
-2. Extract tenantId from payload
-3. Upsert tenant + default settings
-4. Call Platform registration API
-5. Return 200 { success: true }
-
-**Idempotent:** Yes (upsert)
-**Retry:** Platform retries on timeout/5xx
-**Timeout:** Must respond within 10s
-```
-
-### External API call contract
-
-```markdown
-### External Platform API
-
-**Endpoint:** POST https://api.example.com/v1/register
-**Auth:** OAuth access token
-**Timeout:** 5s
-**Retry:** 2x with exponential backoff (1s, 3s)
-**Idempotent:** Yes (same registration = no-op)
-**Failure handling:** Log error, don't fail webhook (retry manually)
-```
-
----
-
-## 7. Example: complete contract
-
-```markdown
-# API Contracts: SaaS Admin Panel
-
-## Endpoints
-
-| Method | Path | Auth | Summary |
-|--------|------|------|---------|
-| GET | /api/v1/content/:tenantId | Public | Public content payload |
-| GET | /api/v1/content/resolve-tenant | Public | Resolve tenantId from origin |
-| GET | /api/v1/settings/:tenantId | Owner | Get settings |
-| PUT | /api/v1/settings/:tenantId | Owner | Update settings |
-| GET | /api/v1/products | Owner | List products (paginated) |
-| POST | /api/v1/products | Owner | Create product |
-| PUT | /api/v1/products/:id | Owner | Update product |
-| DELETE | /api/v1/products/:id | Owner | Delete product |
-| POST | /api/webhooks/v1/install | Webhook | Platform install webhook |
-| POST | /api/webhooks/v1/uninstall | Webhook | Platform uninstall webhook |
-| GET | /health/live | Public | Liveness probe |
-| GET | /health/ready | Public | Readiness probe |
-```
-
----
-
-## 8. Output Template
-
-```markdown
-# API Contracts: <project-name>
-
-**Date:** YYYY-MM-DD
-**Version:** v1
-**Base URL:** https://<host>/api/v1
-
-## General Rules
-- Error format: { error: { code, message, details } }
-- Auth: Bearer JWT or httpOnly cookie
-- Pagination: cursor-based (limit, cursor, hasMore)
-
-## Endpoints
-<for each endpoint: section 2 template>
-
-## Error Codes
-<section 3 registry table>
-
-## Auth Table
-<section 5 per-endpoint table>
-
-## Integration Contracts
-<section 6 for each external integration>
-```
-
----
-
-## See also
-- `$architecture-doc` — Architecture Document (references API contracts)
-- `$data-model` — Data model (entities match request/response schemas)
-- `$security-baseline-dev` — Zod validation, auth patterns
-- `$node-express-beast-practices` — Express implementation patterns