get-tbd 0.1.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (60) hide show
  1. package/README.md +508 -0
  2. package/dist/bin-bootstrap.cjs +25 -0
  3. package/dist/bin-bootstrap.cjs.map +1 -0
  4. package/dist/bin.d.mts +2 -0
  5. package/dist/bin.mjs +106320 -0
  6. package/dist/bin.mjs.map +1 -0
  7. package/dist/cli.d.mts +13 -0
  8. package/dist/cli.mjs +9711 -0
  9. package/dist/cli.mjs.map +1 -0
  10. package/dist/docs/README.md +508 -0
  11. package/dist/docs/SKILL.md +222 -0
  12. package/dist/docs/guidelines/backward-compatibility-rules.md +78 -0
  13. package/dist/docs/guidelines/commit-conventions.md +78 -0
  14. package/dist/docs/guidelines/convex-limits-best-practices.md +170 -0
  15. package/dist/docs/guidelines/convex-rules.md +942 -0
  16. package/dist/docs/guidelines/general-coding-rules.md +36 -0
  17. package/dist/docs/guidelines/general-comment-rules.md +45 -0
  18. package/dist/docs/guidelines/general-eng-assistant-rules.md +54 -0
  19. package/dist/docs/guidelines/general-style-rules.md +37 -0
  20. package/dist/docs/guidelines/general-tdd-guidelines.md +52 -0
  21. package/dist/docs/guidelines/general-testing-rules.md +26 -0
  22. package/dist/docs/guidelines/golden-testing-guidelines.md +72 -0
  23. package/dist/docs/guidelines/python-cli-patterns.md +84 -0
  24. package/dist/docs/guidelines/python-rules.md +60 -0
  25. package/dist/docs/guidelines/typescript-cli-tool-rules.md +346 -0
  26. package/dist/docs/guidelines/typescript-code-coverage.md +171 -0
  27. package/dist/docs/guidelines/typescript-monorepo-patterns.md +71 -0
  28. package/dist/docs/guidelines/typescript-rules.md +55 -0
  29. package/dist/docs/install/claude-header.md +12 -0
  30. package/dist/docs/install/ensure-gh-cli.sh +88 -0
  31. package/dist/docs/shortcuts/standard/commit-code.md +23 -0
  32. package/dist/docs/shortcuts/standard/create-or-update-pr-simple.md +29 -0
  33. package/dist/docs/shortcuts/standard/create-or-update-pr-with-validation-plan.md +48 -0
  34. package/dist/docs/shortcuts/standard/implement-beads.md +31 -0
  35. package/dist/docs/shortcuts/standard/new-architecture-doc.md +31 -0
  36. package/dist/docs/shortcuts/standard/new-implementation-beads-from-spec.md +28 -0
  37. package/dist/docs/shortcuts/standard/new-plan-spec.md +49 -0
  38. package/dist/docs/shortcuts/standard/new-research-brief.md +30 -0
  39. package/dist/docs/shortcuts/standard/new-validation-plan.md +51 -0
  40. package/dist/docs/shortcuts/standard/precommit-process.md +88 -0
  41. package/dist/docs/shortcuts/standard/review-code-python.md +47 -0
  42. package/dist/docs/shortcuts/standard/review-code-typescript.md +46 -0
  43. package/dist/docs/shortcuts/standard/welcome-user.md +65 -0
  44. package/dist/docs/shortcuts/system/shortcut-explanation.md +61 -0
  45. package/dist/docs/shortcuts/system/skill-brief.md +40 -0
  46. package/dist/docs/shortcuts/system/skill.md +210 -0
  47. package/dist/docs/skill-brief.md +40 -0
  48. package/dist/docs/tbd-closing.md +31 -0
  49. package/dist/docs/tbd-design.md +5308 -0
  50. package/dist/docs/tbd-docs.md +1113 -0
  51. package/dist/docs/tbd-prime.md +119 -0
  52. package/dist/docs/templates/architecture-doc.md +117 -0
  53. package/dist/docs/templates/plan-spec.md +69 -0
  54. package/dist/docs/templates/research-brief.md +71 -0
  55. package/dist/index.d.mts +567 -0
  56. package/dist/index.mjs +3 -0
  57. package/dist/src-CWD4YCBk.mjs +319 -0
  58. package/dist/src-CWD4YCBk.mjs.map +1 -0
  59. package/dist/tbd +106320 -0
  60. package/package.json +92 -0
@@ -0,0 +1,36 @@
1
+ ---
2
+ title: General Coding Rules
3
+ description: Rules for constants, magic numbers, and general coding practices
4
+ ---
5
+ # General Coding Rules
6
+
7
+ ## Constants and Magic Numbers
8
+
9
+ - NEVER hardcode numeric values directly in code.
10
+ Always use descriptive named constants.
11
+
12
+ - All numeric constants must have clear, descriptive names and docstrings explaining
13
+ their purpose.
14
+
15
+ - Constants should be defined in appropriate settings files (e.g., `settings.ts`) for
16
+ easy maintenance.
17
+
18
+ ```typescript
19
+ // BAD: Hardcoded numbers
20
+ const tradeCount = Math.min(trades.length, 50);
21
+
22
+ // GOOD: Named constants with documentation
23
+ /**
24
+ * Execution statistics counting limits for dialog tab display.
25
+ * These control the "X+" display thresholds and query performance.
26
+ */
27
+ export const EXECUTION_STATS_LIMITS = {
28
+ /** Maximum trades to count before showing "50+" */
29
+ maxTradeCount: 50,
30
+ /** Maximum conversation turns to count before showing "100+" */
31
+ maxConversationTurnCount: 100,
32
+ } as const;
33
+
34
+ // Usage:
35
+ const tradeCount = Math.min(trades.length, EXECUTION_STATS_LIMITS.maxTradeCount);
36
+ ```
@@ -0,0 +1,45 @@
1
+ ---
2
+ title: General Comment Rules
3
+ description: Language-agnostic rules for writing clean, maintainable comments
4
+ ---
5
+ # General Comment Rules
6
+
7
+ ## Comment Usage
8
+
9
+ - Keep all comments concise and clear and suitable for inclusion in final production.
10
+
11
+ - DO use comments whenever the intent of a given piece of code is subtle or confusing or
12
+ avoids a bug or is not obvious from the code itself.
13
+
14
+ - DO NOT repeat in comments what is obvious from the names of functions or variables or
15
+ types.
16
+
17
+ - DO NOT make any other obvious comments that duplicate messages, such as a comment that
18
+ repeats what is in a log message.
19
+
20
+ - DO NOT include comments that reflect what you did, such as “Added this function” as
21
+ this is meaningless to anyone reading the code later.
22
+
23
+ - DO NOT use fancy or needlessly decorated headings like “===== MIGRATION TOOLS =====”
24
+ in comments.
25
+
26
+ - DO NOT number steps in comments.
27
+ These are hard to maintain if the code changes.
28
+ NEVER: “// Step 3: Fetch the data from the cache” OK: “// Now fetch the data from the
29
+ cache”
30
+
31
+ - DO NOT use emojis or special unicode characters like ① or • or – or — in comments.
32
+
33
+ - DO NOT leave comments about code changes that have been completed.
34
+
35
+ - DO NOT put values of constants in comments (redundant and clutters the code).
36
+
37
+ - DO NOT leave straggling comments that refer to past implementations or refactors.
38
+
39
+ ## Comment Syntax
40
+
41
+ - Use appropriate syntax for IDE-compatible comments whenever possible, e.g. TypeScript,
42
+ prefer `/** ... */` comments wherever appropriate on variables, functions, methods,
43
+ and at the top of files.
44
+
45
+ - See language-specific comment rules for more details.
@@ -0,0 +1,54 @@
1
+ ---
2
+ title: General Engineering Assistant Rules
3
+ description: Rules for AI assistants acting as senior engineers, including objectivity and communication guidelines
4
+ ---
5
+ # General Engineering Assistant Rules
6
+
7
+ **Your responsibility:** Remember you are a senior engineer and have a serious
8
+ responsibility to be clear, factual, think step by step and be systematic.
9
+ Your fundamental responsibility is to achieve objectives and make use of the user’s
10
+ attention wisely.
11
+
12
+ **Rules must be followed:** It is your responsibility to carefully read these rules as
13
+ well as all other rules, such as language-specific rules in the `rules/` or `docs/`
14
+ folder or supplied by the user.
15
+
16
+ **Do not be overly agreeable:** You should offer expert opinions, not blindly follow
17
+ common practices. You must be willing to disagree with common practice when that is the
18
+ best course of action for a given situation.
19
+ You must be willing to express disagreement with the user and suggest alternative
20
+ solutions if they are technically relevant.
21
+
22
+ **Do not be a people-pleaser:** Do not try to make the user happy or give positive spin
23
+ on technical issues: Even if the user might be happier if you exaggerate quality or talk
24
+ about your work in subjective, positive terms, *this is dishonest and not the job of a
25
+ professional engineer*. Your responsibility is to be insightful, accurate, and fair.
26
+
27
+ Therefore:
28
+
29
+ - Be concise. State answers or responses directly, without extra commentary.
30
+ Or (if it is clear) directly do what is asked.
31
+
32
+ - If instructions are unclear or there are two or more ways to fulfill the request that
33
+ are substantially different, make a tentative plan (or offer options) and ask for
34
+ confirmation.
35
+
36
+ - If you can think of a much better approach that the user requests, be sure to mention
37
+ it. It’s your responsibility to suggest approaches that lead to better, simpler
38
+ solutions.
39
+
40
+ - Give thoughtful opinions on better/worse approaches, but NEVER say “great idea!”
41
+ or “good job” or other compliments, encouragement, or non-essential banter.
42
+ Your job is to give expert opinions and to solve problems, not to motivate the user.
43
+
44
+ - Do not say code is “production-ready” if you have no direct factual basis for this.
45
+ Say it passes the tests and describe the tests, but if it’s not been tested in
46
+ production-like situations it is not production ready.
47
+
48
+ - Avoid gratuitous enthusiasm or generalizations.
49
+ Use thoughtful comparisons like saying which code is “cleaner” but don’t congratulate
50
+ yourself. Avoid subjective descriptions.
51
+ For example, don’t say “I’ve meticulously improved the code and it is in great shape!”
52
+ That is useless generalization.
53
+ Instead, specifically say what you’ve done, e.g., "I’ve added types, including
54
+ generics, to all the methods in `Foo` and fixed all linter errors."
@@ -0,0 +1,37 @@
1
+ ---
2
+ title: General Style Rules
3
+ description: Style guidelines for auto-formatting, emoji usage, and output formatting
4
+ ---
5
+ # General Style Rules
6
+
7
+ ## Always Auto-Format
8
+
9
+ Always use auto-formatting on every file type possible.
10
+ Defer to rules on auto-formatting for exact coding style in each language.
11
+
12
+ ## Use of Emojis
13
+
14
+ These rules apply to output and other messages, comments, log messages, user messages,
15
+ and UI messages.
16
+
17
+ - **Use of emojis:**
18
+
19
+ - **Do not use emojis gratuitously:** Use emojis in output only if it enhances the
20
+ clarity and can be done with a consistent semantic vocabulary.
21
+
22
+ - DO use ✅ and ❌ (or if the codebase already uses them, ✔︎ and ✘) to indicate success
23
+ and failure and ⚠️ and ‼️ (or if the codebase already uses them, ∆ and ‼︎)
24
+ user-facing warnings and errors.
25
+ Whatever you use, just be sure to do it consistently across the codebase.
26
+
27
+ - You MAY use the following emojis if you use them consistently:
28
+
29
+ - 📈 for reports and quantitative summaries
30
+
31
+ - ⏰ for timings and scheduling
32
+
33
+ - 🧪 for tests and experiments
34
+
35
+ - DO NOT use emojis in comments or output just because they are fun or cute.
36
+ Unless the user says otherwise, avoid emojis and Unicode in comments as it adds
37
+ distraction without the benefit of systematic meaning.
@@ -0,0 +1,52 @@
1
+ ---
2
+ title: TDD Guidelines
3
+ description: Test-Driven Development methodology and best practices
4
+ ---
5
+ # Test-Driven Development (TDD) Guidelines
6
+
7
+ ## Core Development Principles
8
+
9
+ - Run Red -> Green -> Refactor in small slices.
10
+ - Start with the simplest failing test that describes behavior.
11
+ - Write only the code needed to pass; defer polish until Green.
12
+ - Separate structural vs behavioral work; tidy first when both are needed.
13
+ - Keep quality high at every step; avoid speculative work.
14
+
15
+ ## TDD Methodology
16
+
17
+ - Write one failing test at a time; keep the failure clear and specific.
18
+ - Name tests by observable behavior (e.g., `should_sum_two_positive_numbers`).
19
+ - Prefer state-based assertions; only mock external boundaries.
20
+ - Keep tests fast, deterministic, and isolated (no real time, network, randomness).
21
+ - Minimize test setup; use simple helpers/builders when they improve clarity.
22
+ - When a test passes, refactor code and tests to remove duplication and reveal intent.
23
+ - Grow functionality by adding the next smallest behavior-focused test.
24
+
25
+ ## Tidy First Approach
26
+
27
+ - Structural change: only reshape code (rename, extract, move) without altering
28
+ behavior.
29
+ - Behavioral change: add or modify functionality.
30
+ - Do not mix structural and behavioral changes in one commit.
31
+ - When both are needed, tidy first, then implement behavior; run tests before and after.
32
+
33
+ ## Commit Discipline
34
+
35
+ - Commit only when all tests pass and linters are clean.
36
+ - Each commit should be a single logical unit; prefer small, frequent commits.
37
+ - State in the message whether the commit is structural or behavioral.
38
+
39
+ ## Code Quality Standards
40
+
41
+ - Remove duplication aggressively in both code and tests.
42
+ - Make intent obvious through naming and small, focused functions.
43
+ - Keep dependencies explicit; prefer pure functions where practical.
44
+ - Use the simplest solution that works; avoid premature abstractions.
45
+ - Keep side effects contained at boundaries.
46
+
47
+ ## Refactoring Guidelines
48
+
49
+ - Refactor only in Green; keep steps reversible.
50
+ - Apply one refactoring at a time, with known patterns when appropriate.
51
+ - Re-run tests after each refactor and resolve errors or ambiguities.
52
+ - Prioritize refactors that simplify design, clarify intent, or remove duplication.
@@ -0,0 +1,26 @@
1
+ ---
2
+ title: General Testing Rules
3
+ description: Rules for writing minimal, effective tests with maximum coverage
4
+ ---
5
+ ## General Testing Rules
6
+
7
+ - Write the minimal set of tests with the maximal coverage.
8
+ Write as few tests as possible that *also* cover the desired functionality.
9
+ If you see many similar tests, review to see if any can be removed or rewritten to be
10
+ shorter without reducing test coverage.
11
+
12
+ - Do NOT write unit tests that are obviously going to pass (like creating objects and
13
+ validating they are set on an object).
14
+ These needlessly clutter the codebase.
15
+ For example:
16
+ - Do not write a test that simply instantiates a class and the object’s fields are
17
+ set.
18
+
19
+ - Do NOT write a test that is trivial enough it is obviously tested as part of another
20
+ test in the same codebase.
21
+
22
+ - Don’t test implementation details: Focus on behavior and outcomes, not internal
23
+ mechanics, so tests remain valid when you refactor.
24
+
25
+ - Test edge cases and boundaries: Include tests for empty inputs, nulls, maximums,
26
+ minimums, and error conditions—not just happy paths.
@@ -0,0 +1,72 @@
1
+ ---
2
+ title: Golden Testing Guidelines
3
+ description: Guidelines for implementing golden/snapshot testing for complex systems
4
+ ---
5
+ # Golden Testing Guidelines
6
+
7
+ ## TL;DR
8
+
9
+ - Define a session schema (events) with stable vs unstable fields.
10
+ - Capture full execution for scenarios (inputs, outputs, side effects) as YAML.
11
+ - Normalize or remove unstable fields at serialization time.
12
+ - Provide a mock mode for all nondeterminism and slow dependencies.
13
+ - Add a CLI to run scenarios, update goldens, and print diffs.
14
+ - Keep scenarios few but end-to-end; tests must run fast in CI (<100ms each).
15
+ - Prefer many small artifacts (shard by scenario/phase) over monolithic traces.
16
+ - Layer domain-focused assertions alongside raw diffs for critical invariants.
17
+ - Review and commit session files with code; treat them as behavioral specs.
18
+
19
+ ## When to Use Golden Tests
20
+
21
+ Golden session testing excels for complex systems where writing and maintaining hundreds
22
+ of unit or integration tests is burdensome.
23
+ Traditional unit tests struggle to capture the full behavior of systems with many
24
+ interacting components, non-deterministic outputs, and complex state transitions.
25
+
26
+ ## Core Principles
27
+
28
+ ### 1. Model Events Formally
29
+
30
+ All events should be modeled with type-safe schemas (Zod, Pydantic, TypeScript
31
+ interfaces). Events are serialized to YAML for human readability.
32
+
33
+ ### 2. Classify Fields as Stable or Unstable
34
+
35
+ - **Stable**: Deterministic values that must match exactly (symbols, actions,
36
+ quantities)
37
+ - **Unstable**: Non-deterministic values filtered during comparison (timestamps, IDs)
38
+
39
+ Filter unstable fields before writing session files by replacing with placeholders like
40
+ `"[TIMESTAMP]"` or omitting entirely.
41
+
42
+ ### 3. Use Switchable Mock Modes
43
+
44
+ - **Live mode**: Calls real external services for debugging and updating golden files
45
+ - **Mocked mode**: Uses recorded/stubbed responses for fast, deterministic CI
46
+
47
+ ### 4. Design for Fast CI
48
+
49
+ Golden tests should run in under 100ms per scenario:
50
+ - Run in mocked mode (no network, no external services)
51
+ - Use in-memory mocks over file-based fixtures
52
+ - Parallelize independent scenarios
53
+ - Cache expensive setup
54
+
55
+ ## Do / Don’t
56
+
57
+ - Do capture full payloads and side effects that influence behavior.
58
+ - Do normalize/remap unstable values at write time, not in comparisons.
59
+ - Do keep scenarios few, representative, and fast.
60
+ - Do prefer many small artifacts over monolithic traces.
61
+ - Don’t depend on real clocks, random, network, or database in CI.
62
+ - Don’t hide differences with overly broad placeholders.
63
+ - Don’t fork logic for tests vs production; share code paths.
64
+ - Don’t let artifacts grow unbounded.
65
+
66
+ ## Common Pitfalls
67
+
68
+ - Missing unstable field classification -> flaky diffs.
69
+ - File I/O captured without contents/checksums -> silent regressions.
70
+ - Slow or network-bound scenarios -> skipped in practice, regressions leak.
71
+ - LLM output not recorded or scrubbed -> non-deterministic sessions.
72
+ - Monolithic traces that grow unbounded -> hard to review, slow to diff.
@@ -0,0 +1,84 @@
1
+ ---
2
+ title: Python CLI Patterns
3
+ description: Modern patterns for Python CLI application architecture
4
+ ---
5
+ # Python CLI Patterns
6
+
7
+ ## Recommended Stack
8
+
9
+ - **uv** for package management, venvs, Python versions
10
+ - **Typer** or **argparse + rich_argparse** for CLI framework
11
+ - **Rich** for terminal output, tables, progress
12
+ - **Ruff** for linting and formatting
13
+ - **BasedPyright** for type checking
14
+ - **pytest** for testing
15
+
16
+ ## Key Patterns
17
+
18
+ ### Directory Structure
19
+
20
+ ```
21
+ src/myproject/
22
+ ├── __init__.py # Package entry, VERSION export
23
+ ├── cli.py # Main entry point, app setup
24
+ ├── commands/ # Command implementations
25
+ ├── lib/ # Shared utilities and base classes
26
+ │ ├── base_command.py # Base class for handlers
27
+ │ ├── output_manager.py # Unified output handling
28
+ │ └── formatters.py # Domain-specific formatters
29
+ └── types/
30
+ └── options.py # TypedDict for command options
31
+ ```
32
+
33
+ ### Agent & CI Compatibility
34
+
35
+ Support automation with explicit flags:
36
+ - `--non-interactive`: Disable prompts, fail if input required
37
+ - `--yes` / `-y`: Assume yes to confirmations
38
+ - `--format text|json|jsonl`: Output format
39
+ - `--no-progress`: Disable spinners (critical for AI agents)
40
+
41
+ Respect environment variables:
42
+ - `CI`: Set by GitHub Actions, GitLab CI, etc.
43
+ - `NO_COLOR`: Disable colors (https://no-color.org/)
44
+
45
+ ### Dual Output Mode (Text + JSON)
46
+
47
+ Use OutputManager for format switching:
48
+ - Data (results) -> stdout, always
49
+ - Success messages -> stdout, text mode only
50
+ - Errors/warnings -> stderr, always
51
+ - Spinners/progress -> stderr, TTY only
52
+
53
+ ### Base Command Pattern
54
+
55
+ Centralize common functionality:
56
+ - Context extraction from Typer context
57
+ - Output management initialization
58
+ - Error handling with consistent formatting
59
+ - Dry-run checking
60
+
61
+ ### Error Handling
62
+
63
+ Define custom exceptions with exit codes:
64
+ - `CLIError`: Base exception (exit code 1)
65
+ - `ValidationError`: Input validation failed (exit code 2)
66
+ - `UserCancelled`: User cancelled (exit code 0)
67
+
68
+ Exit codes: 0 success, 1 error, 2 validation, 130 interrupted (SIGINT)
69
+
70
+ ### Version Handling
71
+
72
+ Use `uv-dynamic-versioning` for git-based versions:
73
+ - Version derived from git tags
74
+ - No manual version bumping required
75
+ - Use `importlib.metadata.version()` for runtime lookup
76
+
77
+ ## Best Practices
78
+
79
+ 1. Disable spinners/progress in non-TTY contexts
80
+ 2. Route output correctly: data to stdout, errors to stderr
81
+ 3. Support `--dry-run` for safe testing of destructive commands
82
+ 4. Separate handlers from command definitions for testability
83
+ 5. Use TypedDict or dataclasses for type-safe options
84
+ 6. Test with Typer’s CliRunner for isolated, fast tests
@@ -0,0 +1,60 @@
1
+ ---
2
+ title: Python Rules
3
+ description: Python coding rules and best practices
4
+ ---
5
+ # Python Rules
6
+
7
+ ## Type Hints
8
+
9
+ - **Function signatures**: Always add type hints to function parameters and returns
10
+ - **Complex types**: Use `typing` module for generics, unions, optionals
11
+ - **Type aliases**: Create aliases for complex types
12
+ - **Runtime checking**: Use `isinstance()` for runtime type validation
13
+
14
+ ## Docstrings
15
+
16
+ - **All public functions**: Document with Google or NumPy style docstrings
17
+ - **Include types in docstrings**: When not using type hints
18
+ - **Document exceptions**: List exceptions that may be raised
19
+ - **Examples**: Include usage examples for complex functions
20
+
21
+ ## Exception Handling
22
+
23
+ - **Specific exceptions**: Catch specific exceptions, not bare `except:`
24
+ - **Context in errors**: Include helpful context in error messages
25
+ - **Re-raise properly**: Use `raise ... from e` to preserve stack trace
26
+ - **Custom exceptions**: Create domain-specific exception classes
27
+
28
+ ## Resource Management
29
+
30
+ - **Context managers**: Use `with` statements for files, connections, locks
31
+ - **Cleanup**: Ensure resources are released in finally blocks
32
+ - **Generator cleanup**: Use try/finally in generators that manage resources
33
+
34
+ ## Functions
35
+
36
+ - **No mutable defaults**: Never use `[]` or `{}` as default arguments
37
+ - **Single responsibility**: Keep functions focused on one task
38
+ - **Return early**: Exit early for error cases to reduce nesting
39
+ - **Keyword arguments**: Use for functions with many parameters
40
+
41
+ ## Imports
42
+
43
+ - **Organization**: stdlib, third-party, local (separated by blank lines)
44
+ - **Absolute imports**: Prefer absolute over relative imports
45
+ - **No star imports**: Never use `from module import *`
46
+ - **Import what you use**: Don’t import entire modules if using one function
47
+
48
+ ## Code Style
49
+
50
+ - **PEP 8**: Follow PEP 8 naming conventions
51
+ - **List comprehensions**: Use when clearer than loops
52
+ - **F-strings**: Prefer f-strings for string formatting
53
+ - **Pathlib**: Use `pathlib.Path` over `os.path`
54
+
55
+ ## Security
56
+
57
+ - **No eval/exec**: Never use with untrusted input
58
+ - **Parameterized queries**: Use placeholders for SQL/commands
59
+ - **Input validation**: Validate and sanitize all external input
60
+ - **Secrets management**: Use environment variables or secret managers