everything-gemini 1.0.0 → 1.1.1

package/skills/stripe-integration/SKILL.md

@@ -0,0 +1,65 @@
+---
+name: stripe-integration
+description: >-
+  Use this skill when implementing Stripe checkout sessions, managing subscription billing lifecycles, verifying webhook signatures, or configuring customer billing portals.
+---
+
+# Stripe Payments & Subscription Architecture
+
+## Overview
+This skill guides the implementation of PCI-compliant payment flows, webhook signature verification, idempotent charge processing, and customer portal session generation using the official Stripe SDK.
+
+## Procedural Workflow
+
+### 1. Robust Webhook Signature Verification
+Never process webhooks without verifying the cryptographic signature against your endpoint secret:
+```typescript
+import Stripe from "stripe";
+
+const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!, {
+  apiVersion: "2024-06-20",
+});
+
+export async function handleStripeWebhook(rawBody: string | Buffer, signature: string) {
+  let event: Stripe.Event;
+  try {
+    event = stripe.webhooks.constructEvent(
+      rawBody,
+      signature,
+      process.env.STRIPE_WEBHOOK_SECRET!
+    );
+  } catch (err: any) {
+    throw new Error(`Webhook signature verification failed: ${err.message}`);
+  }
+
+  // Handle idempotent events using database transaction
+  switch (event.type) {
+    case "checkout.session.completed":
+      await handleCheckoutCompleted(event.data.object as Stripe.Checkout.Session);
+      break;
+    case "customer.subscription.updated":
+    case "customer.subscription.deleted":
+      await syncSubscriptionStatus(event.data.object as Stripe.Subscription);
+      break;
+  }
+}
+```
+
+### 2. Idempotency & Concurrency Safety
+- Always store `event.id` in an `idempotency_keys` table or set a unique constraint. If Stripe retries a webhook, discard duplicates immediately.
+- Use `client_reference_id` or `metadata` to link Stripe customers with your internal user IDs.
+
+### 3. Customer Billing Portal
+Generate pre-authenticated portal sessions so users can update payment methods and invoices self-service without custom frontend form logic:
+```typescript
+const portalSession = await stripe.billingPortal.sessions.create({
+  customer: stripeCustomerId,
+  return_url: `${process.env.NEXT_PUBLIC_APP_URL}/dashboard/billing`,
+});
+```
+
+## Verification Checklist
+- [ ] Raw body buffer preserved for webhook cryptographic verification
+- [ ] Idempotency key checked before applying database mutations
+- [ ] Webhook handler returns HTTP 200 promptly before long-running async tasks
+- [ ] Stripe secret keys read strictly from environment variables

package/skills/supabase-architect/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: supabase-architect
+description: >-
+  Use this skill when designing Supabase database schemas, writing Row Level Security (RLS) policies, setting up pgvector AI embeddings, or configuring Supabase Edge Functions.
+---
+
+# Supabase Architecture & Security Playbook
+
+## Overview
+Supabase provides a powerful managed backend powered by PostgreSQL. This skill guides the agent in crafting bulletproof Row Level Security (RLS) policies, configuring pgvector for semantic search and AI embeddings, and deploying performant Supabase Edge Functions.
+
+## Procedural Workflow
+
+### 1. Row Level Security (RLS) Defense-in-Depth
+Never leave a table with RLS disabled in production:
+```sql
+-- 1. Always enable RLS on newly created tables
+ALTER TABLE documents ENABLE ROW LEVEL SECURITY;
+
+-- 2. Enforce strict tenant isolation or user ownership
+CREATE POLICY "Users can only read their own documents"
+ON documents
+FOR SELECT
+USING (auth.uid() = user_id);
+
+CREATE POLICY "Users can only insert their own documents"
+ON documents
+FOR INSERT
+WITH CHECK (auth.uid() = user_id);
+```
+
+### 2. Semantic Search & Vector Embeddings (`pgvector`)
+When storing AI embeddings in PostgreSQL:
+1. Enable extension: `CREATE EXTENSION IF NOT EXISTS vector;`
+2. Create vector column matching model dimensions (e.g., 768 or 1536):
+   ```sql
+   ALTER TABLE documents ADD COLUMN embedding vector(768);
+   ```
+3. Create an HNSW index for fast similarity lookups:
+   ```sql
+   CREATE INDEX ON documents USING hnsw (embedding vector_cosine_ops);
+   ```
+4. Define match RPC functions with inner product or cosine distance queries.
+
+### 3. Realtime Channels & Subscriptions
+- Filter broadcasts server-side using Postgres row-level filters (`eq`, `in`) to prevent client-side data leaks.
+- Ensure sensitive columns are omitted or masked in realtime publication sets.
+
+## Verification Checklist
+- [ ] RLS explicitly enabled on every table
+- [ ] RLS policies tested against unauthenticated and cross-tenant tokens
+- [ ] Vector index created with appropriate similarity operator (`vector_cosine_ops`)
+- [ ] Edge functions handle CORS headers and verify JWT signatures

package/templates/full-power/AGENTS.md

@@ -0,0 +1,12 @@
+# Antigravity Enterprise Standards (Full-Power Profile)
+
+## 1. Prime Directives
+1. **Zero Hallucination & Evidence-First**: Never speculate on APIs, schemas, or dependencies. Always view code before proposing edits.
+2. **Subagent Delegation Discipline**: Defer heavy multi-file exploration to `planner`, adversarial audits to `security-auditor`, and UI verification to `browser-qa`.
+3. **Progressive Disclosure**: Keep prompt context lean (<3,500 tokens). Pull skills and schemas into context strictly on-demand.
+4. **Deterministic Verification Loop**: Code changes require passing automated tests (`npm test` / pytest) before concluding.
+5. **Continuous Learning**: When errors or user corrections occur, record the insight using `/learn` into permanent Knowledge Items.
+
+## 2. Security & Operational Policy
+- Strict zero-trust command execution: All raw shell commands must pass GeminiShield gating.
+- Webhooks, tokens, and credentials must be read from environment variables with no hardcoding.

package/templates/full-power/GEMINI.md

@@ -0,0 +1,12 @@
+# Antigravity Enterprise Standards (Full-Power Profile)
+
+## 1. Prime Directives
+1. **Zero Hallucination & Evidence-First**: Never speculate on APIs, schemas, or dependencies. Always view code before proposing edits.
+2. **Subagent Delegation Discipline**: Defer heavy multi-file exploration to `planner`, adversarial audits to `security-auditor`, and UI verification to `browser-qa`.
+3. **Progressive Disclosure**: Keep prompt context lean (<3,500 tokens). Pull skills and schemas into context strictly on-demand.
+4. **Deterministic Verification Loop**: Code changes require passing automated tests (`npm test` / pytest) before concluding.
+5. **Continuous Learning**: When errors or user corrections occur, record the insight using `/learn` into permanent Knowledge Items.
+
+## 2. Security & Operational Policy
+- Strict zero-trust command execution: All raw shell commands must pass GeminiShield gating.
+- Webhooks, tokens, and credentials must be read from environment variables with no hardcoding.

package/templates/full-power/hooks.json

@@ -0,0 +1,56 @@
+{
+  "gemini-shield": {
+    "PreToolUse": [
+      {
+        "matcher": "run_command",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash ./hooks/gemini-shield/scripts/shield-gate.sh",
+            "timeout": 15
+          }
+        ]
+      }
+    ]
+  },
+  "auto-lint": {
+    "PostToolUse": [
+      {
+        "matcher": "replace_file_content|write_to_file",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash ./hooks/auto-lint-formatter/scripts/auto-format.sh",
+            "timeout": 10
+          }
+        ]
+      }
+    ]
+  },
+  "goal-verifier": {
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash ./hooks/goal-verifier/scripts/verify-goal.sh",
+            "timeout": 15
+          }
+        ]
+      }
+    ]
+  },
+  "learned-instincts": {
+    "PostInvocation": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash ./hooks/learned-instincts/scripts/save-instinct.sh",
+            "timeout": 10
+          }
+        ]
+      }
+    ]
+  }
+}

package/templates/full-power/mcp_config.json

@@ -0,0 +1,15 @@
+{
+  "mcpServers": {
+    "github": {
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-github"],
+      "env": {
+        "GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_TOKEN}"
+      }
+    },
+    "postgres": {
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-postgres", "${DATABASE_URL}"]
+    }
+  }
+}

package/templates/recommended/AGENTS.md

@@ -0,0 +1,11 @@
+# Antigravity Developer Standards (Recommended)
+
+## 1. Prime Directives
+1. **Zero Hallucination**: Always inspect file contents, exports, and signatures with `view_file` or `grep_search` before proposing or applying modifications.
+2. **Minimal Surgical Diffs**: Preserve all existing comments, docstrings, and formatting unrelated to your task.
+3. **Automated Verification Loop**: Every modification must be followed by automated verification (running unit tests, linters, or typecheckers).
+4. **Clickable Markdown Navigation**: Always format file paths and symbols as clickable links using the `file://` scheme: `[filename](file:///absolute/path/to/file)`.
+
+## 2. Terminal & Tool Safety
+- Never run unchecked destructive operations (`rm -rf *`, `git reset --hard`, `DROP TABLE`).
+- Run persistent processes and background servers with `IsDaemon: true`.

package/templates/recommended/GEMINI.md

@@ -0,0 +1,11 @@
+# Antigravity Developer Standards (Recommended)
+
+## 1. Prime Directives
+1. **Zero Hallucination**: Always inspect file contents, exports, and signatures with `view_file` or `grep_search` before proposing or applying modifications.
+2. **Minimal Surgical Diffs**: Preserve all existing comments, docstrings, and formatting unrelated to your task.
+3. **Automated Verification Loop**: Every modification must be followed by automated verification (running unit tests, linters, or typecheckers).
+4. **Clickable Markdown Navigation**: Always format file paths and symbols as clickable links using the `file://` scheme: `[filename](file:///absolute/path/to/file)`.
+
+## 2. Terminal & Tool Safety
+- Never run unchecked destructive operations (`rm -rf *`, `git reset --hard`, `DROP TABLE`).
+- Run persistent processes and background servers with `IsDaemon: true`.

package/templates/recommended/hooks.json

@@ -0,0 +1,43 @@
+{
+  "safety-shield": {
+    "PreToolUse": [
+      {
+        "matcher": "run_command",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash ./hooks/safety-shield/scripts/safety-gate.sh",
+            "timeout": 15
+          }
+        ]
+      }
+    ]
+  },
+  "auto-lint": {
+    "PostToolUse": [
+      {
+        "matcher": "replace_file_content|write_to_file",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash ./hooks/auto-lint-formatter/scripts/auto-format.sh",
+            "timeout": 10
+          }
+        ]
+      }
+    ]
+  },
+  "goal-verifier": {
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash ./hooks/goal-verifier/scripts/verify-goal.sh",
+            "timeout": 15
+          }
+        ]
+      }
+    ]
+  }
+}