packwise-skills 1.0.0

package/sub-skills/cloud/kubernetes.md

@@ -0,0 +1,277 @@
+# Kubernetes Build Sub-Skill
+
+Package and deploy applications to Kubernetes clusters (K8s, K3s, EKS, GKE, AKS).
+
+**Current version**: Kubernetes 1.31 / Helm 3.x / Kustomize 5.x (2025-2026)
+
+## When to Use
+
+- Multi-container applications (Web + DB + Cache + Worker)
+- Microservices architecture
+- Auto-scaling requirements
+- Multi-cloud or hybrid-cloud deployment
+- Need rolling updates and zero-downtime deployments
+
+## Core Concepts
+
+| Concept | What It Does |
+|---------|-------------|
+| **Pod** | Smallest unit — runs one or more containers |
+| **Deployment** | Manages pod replicas, rolling updates |
+| **Service** | Network endpoint — stable IP/DNS for pods |
+| **Ingress** | HTTP routing — domain → service mapping |
+| **ConfigMap** | Non-secret configuration data |
+| **Secret** | Sensitive data (passwords, tokens) |
+| **PersistentVolume** | Durable storage (databases, uploads) |
+| **Namespace** | Virtual cluster isolation |
+
+## K8s Manifests
+
+### Deployment + Service
+
+```yaml
+# k8s/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myapp
+  labels:
+    app: myapp
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: myapp
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0  # Zero downtime
+  template:
+    metadata:
+      labels:
+        app: myapp
+    spec:
+      containers:
+        - name: myapp
+          image: registry.example.com/myapp:1.0.0
+          ports:
+            - containerPort: 3000
+          env:
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: myapp-secrets
+                  key: database-url
+          resources:
+            requests:
+              cpu: "100m"
+              memory: "128Mi"
+            limits:
+              cpu: "500m"
+              memory: "512Mi"
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 3000
+            initialDelaySeconds: 10
+            periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 3000
+            initialDelaySeconds: 5
+            periodSeconds: 10
+```
+
+```yaml
+# k8s/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: myapp
+spec:
+  selector:
+    app: myapp
+  ports:
+    - port: 80
+      targetPort: 3000
+  type: ClusterIP
+```
+
+```yaml
+# k8s/ingress.yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: myapp
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+spec:
+  tls:
+    - hosts: [myapp.example.com]
+      secretName: myapp-tls
+  rules:
+    - host: myapp.example.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: myapp
+                port:
+                  number: 80
+```
+
+```yaml
+# k8s/configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: myapp-config
+data:
+  NODE_ENV: "production"
+  LOG_LEVEL: "info"
+```
+
+```yaml
+# k8s/secret.yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: myapp-secrets
+type: Opaque
+stringData:
+  database-url: "postgres://user:pass@db:5432/myapp"
+```
+
+## K3s (Lightweight Kubernetes)
+
+```bash
+# Install K3s (single-node, production-ready)
+curl -sfL https://get.k3s.io | sh -
+
+# Verify
+kubectl get nodes
+
+# Deploy
+kubectl apply -f k8s/
+
+# K3s is ideal for:
+# - Edge computing
+# - IoT
+# - Development/staging
+# - Small production clusters
+```
+
+## Helm (Package Manager for K8s)
+
+```bash
+# Install
+curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
+
+# Create chart
+helm create myapp-chart
+```
+
+```
+myapp-chart/
+├── Chart.yaml          ← Chart metadata
+├── values.yaml         ← Default values
+├── templates/
+│   ├── deployment.yaml ← Template with {{ .Values.xxx }}
+│   ├── service.yaml
+│   ├── ingress.yaml
+│   └── _helpers.tpl    ← Template helpers
+└── charts/             ← Sub-charts (dependencies)
+```
+
+```yaml
+# values.yaml
+replicaCount: 3
+image:
+  repository: registry.example.com/myapp
+  tag: "1.0.0"
+  pullPolicy: IfNotPresent
+service:
+  type: ClusterIP
+  port: 80
+ingress:
+  enabled: true
+  host: myapp.example.com
+  tls: true
+resources:
+  requests:
+    cpu: 100m
+    memory: 128Mi
+  limits:
+    cpu: 500m
+    memory: 512Mi
+```
+
+```bash
+# Install
+helm install myapp ./myapp-chart -f values.yaml
+
+# Upgrade
+helm upgrade myapp ./myapp-chart --set image.tag=1.1.0
+
+# Rollback
+helm rollback myapp 1
+
+# Uninstall
+helm uninstall myapp
+```
+
+## Kustomize (Template-Free Config)
+
+```yaml
+# kustomization.yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml
+commonLabels:
+  app: myapp
+images:
+  - name: registry.example.com/myapp
+    newTag: "1.0.0"
+patches:
+  - path: patches/replicas.yaml
+```
+
+```bash
+# Apply
+kubectl apply -k .
+
+# Different overlays for environments
+# overlays/production/kustomization.yaml
+# overlays/staging/kustomization.yaml
+```
+
+## Helm vs Kustomize
+
+| Feature | Helm | Kustomize |
+|---------|------|-----------|
+| Approach | Template-based (Go templates) | Overlay/patch based |
+| Complexity | Higher (chart structure) | Lower (plain YAML) |
+| Package registry | ArtifactHub (thousands of charts) | No registry |
+| Best for | Distributable packages | Environment overlays |
+| Secret management | External (Vault, Sealed Secrets) | External |
+
+## Common Pitfalls
+
+| Issue | Fix |
+|-------|-----|
+| Pod CrashLoopBackOff | Check logs: `kubectl logs pod-name`; verify health endpoint |
+| ImagePullBackOff | Check image name/tag; verify registry credentials (`imagePullSecrets`) |
+| Service not reachable | Check selector labels match; verify port mapping |
+| ConfigMap/Secret not updating | K8s caches them; restart pods or use `--force` |
+| Out of memory | Increase `resources.limits.memory`; check for memory leaks |
+| PersistentVolume not mounting | Check PVC status; verify storage class exists |
+| DNS not resolving | Check CoreDNS pods running; use fully qualified names |
+| Ingress 404 | Verify Ingress controller installed; check host and path rules |

package/sub-skills/cloud/payment-integration.md

@@ -0,0 +1,307 @@
+# Payment Integration Build Sub-Skill
+
+Integrate payment systems into applications during build and packaging.
+
+**Current versions**: Stripe API 2024-12 / Alipay / WeChat Pay / Apple IAP / Google Play Billing (2025-2026)
+
+## When to Use
+
+- SaaS applications with subscription billing
+- E-commerce applications
+- Mobile apps with in-app purchases
+- Marketplace / platform payments
+- Donations / tipping
+
+## Payment Platform Comparison
+
+| Platform | Coverage | Fee | Best For |
+|----------|----------|-----|---------|
+| Stripe | Global (46+ countries) | 2.9% + $0.30/txn | Global SaaS, web apps |
+| Alipay | China | 0.6% | China market |
+| WeChat Pay | China | 0.6% | China market, mini-programs |
+| PayPal | Global | 2.9% + $0.30/txn | Broad consumer reach |
+| Apple IAP | iOS/macOS | 15–30% | iOS in-app purchases (required) |
+| Google Play Billing | Android | 15–30% | Android in-app purchases (required) |
+| Paddle | Global | 5% + fee | SaaS (handles tax/compliance) |
+| LemonSqueezy | Global | 5% + fee | Digital products, indie SaaS |
+
+---
+
+## Stripe Integration
+
+### Web (Node.js Backend)
+
+```bash
+npm install stripe
+```
+
+```javascript
+// server/stripe.js
+const stripe = require('stripe')(process.env.STRIPE_SECRET_KEY);
+
+// Create checkout session
+app.post('/create-checkout', async (req, res) => {
+  const session = await stripe.checkout.sessions.create({
+    payment_method_types: ['card'],
+    line_items: [{
+      price_data: {
+        currency: 'usd',
+        product_data: { name: 'My Product' },
+        unit_amount: 2000, // $20.00
+      },
+      quantity: 1,
+    }],
+    mode: 'payment',
+    success_url: `${process.env.APP_URL}/success?session_id={CHECKOUT_SESSION_ID}`,
+    cancel_url: `${process.env.APP_URL}/cancel`,
+  });
+  res.json({ url: session.url });
+});
+
+// Webhook handler (required for production)
+app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
+  const sig = req.headers['stripe-signature'];
+  const event = stripe.webhooks.constructEvent(req.body, sig, process.env.STRIPE_WEBHOOK_SECRET);
+
+  switch (event.type) {
+    case 'checkout.session.completed':
+      // Fulfill order
+      break;
+    case 'invoice.paid':
+      // Update subscription status
+      break;
+  }
+  res.json({ received: true });
+});
+```
+
+### React Frontend
+
+```bash
+npm install @stripe/stripe-js @stripe/react-stripe-js
+```
+
+```javascript
+import { loadStripe } from '@stripe/stripe-js';
+import { Elements, CardElement, useStripe, useElements } from '@stripe/react-stripe-js';
+
+const stripePromise = loadStripe(process.env.REACT_APP_STRIPE_PUBLISHABLE_KEY);
+```
+
+### Subscription Billing
+
+```javascript
+// Create subscription
+const subscription = await stripe.subscriptions.create({
+  customer: customerId,
+  items: [{ price: 'price_monthly_xxx' }],
+  payment_behavior: 'default_incomplete',
+  expand: ['latest_invoice.payment_intent'],
+});
+```
+
+---
+
+## Alipay & WeChat Pay
+
+### Stripe + Alipay/WeChat (Recommended for international)
+
+```javascript
+// Stripe supports Alipay and WeChat Pay as payment methods
+const session = await stripe.checkout.sessions.create({
+  payment_method_types: ['card', 'alipay', 'wechat_pay'],
+  // ...
+});
+```
+
+### Native Alipay SDK
+
+```bash
+pip install alipay-sdk-python
+```
+
+```python
+from alipay.aop.api.AlipayClientConfig import AlipayClientConfig
+from alipay.aop.api.DefaultAlipayClient import DefaultAlipayClient
+
+config = AlipayClientConfig()
+config.app_id = "your_app_id"
+config.app_private_key = "your_private_key"
+config.alipay_public_key = "alipay_public_key"
+
+client = DefaultAlipayClient(config)
+```
+
+### Native WeChat Pay SDK
+
+```xml
+<!-- Java/Maven -->
+<dependency>
+    <groupId>com.github.wxpay</groupId>
+    <artifactId>wxpay-sdk</artifactId>
+    <version>3.4.0</version>
+</dependency>
+```
+
+---
+
+## Apple In-App Purchase (IAP)
+
+### When Required
+
+- Digital content consumed in the app (subscriptions, premium features, virtual goods)
+- **Physical goods**: Use Stripe/PayPal instead
+- **External links**: Apple allows external payment links in some regions (EU, US)
+
+### Swift Implementation
+
+```swift
+import StoreKit
+
+class StoreManager: ObservableObject {
+    @Published var products: [Product] = []
+
+    func loadProducts() async {
+        do {
+            products = try await Product.products(for: ["com.app.premium_monthly", "com.app.premium_yearly"])
+        } catch {
+            print("Failed to load products: \(error)")
+        }
+    }
+
+    func purchase(_ product: Product) async throws -> Transaction? {
+        let result = try await product.purchase()
+        switch result {
+        case .success(let verification):
+            let transaction = try checkVerified(verification)
+            await transaction.finish()
+            return transaction
+        case .userCancelled:
+            return nil
+        case .pending:
+            return nil
+        @unknown default:
+            return nil
+        }
+    }
+}
+```
+
+### App Store Configuration
+
+```
+1. App Store Connect → In-App Purchases → Create
+2. Set product ID, price, localization
+3. Submit for review (can take 24-48 hours)
+4. Implement receipt validation on server (recommended)
+```
+
+---
+
+## Google Play Billing
+
+### Kotlin Implementation
+
+```kotlin
+// build.gradle.kts
+dependencies {
+    implementation("com.android.billingclient:billing-ktx:7.0.0")
+}
+
+// BillingManager.kt
+class BillingManager(context: Context) {
+    private val billingClient = BillingClient.newBuilder(context)
+        .setListener { billingResult, purchases ->
+            if (billingResult.responseCode == BillingClient.BillingResponseCode.OK && purchases != null) {
+                for (purchase in purchases) handlePurchase(purchase)
+            }
+        }
+        .enablePendingPurchases()
+        .build()
+
+    fun startConnection() {
+        billingClient.startConnection(object : BillingClientStateListener {
+            override fun onBillingSetupFinished(result: BillingResult) {
+                if (result.responseCode == BillingClient.BillingResponseCode.OK) {
+                    queryProducts()
+                }
+            }
+            override fun onBillingServiceDisconnected() { /* retry */ }
+        })
+    }
+
+    private fun queryProducts() {
+        val productList = listOf(
+            QueryProductDetailsParams.Product.newBuilder()
+                .setProductId("premium_monthly")
+                .setProductType(BillingClient.ProductType.SUBS)
+                .build()
+        )
+        val params = QueryProductDetailsParams.newBuilder().setProductList(productList).build()
+        billingClient.queryProductDetailsAsync(params) { result, productDetailsList ->
+            // Display products to user
+        }
+    }
+}
+```
+
+### Google Play Console Configuration
+
+```
+1. Google Play Console → Monetize → Products → Subscriptions
+2. Create subscription product with base plan
+3. Set pricing, grace period, offers
+4. Upload app with billing permission
+5. Test with license testers
+```
+
+---
+
+## Server-Side Receipt Validation (Critical for Security)
+
+```javascript
+// Apple receipt validation
+const appleReceiptVerify = require('node-apple-receipt-verify');
+appleReceiptVerify.config({ secret: process.env.APPLE_SHARED_SECRET });
+
+const products = await appleReceiptVerify.validate({
+  receipt: receiptData,
+  verbose: true,
+});
+
+// Google Play receipt validation
+const { google } = require('googleapis');
+const androidpublisher = google.androidpublisher('v3');
+const purchase = await androidpublisher.purchases.subscriptions.get({
+  packageName: 'com.example.app',
+  subscriptionId: 'premium_monthly',
+  token: purchaseToken,
+});
+```
+
+---
+
+## Payment Security Checklist
+
+| Requirement | Implementation |
+|-------------|---------------|
+| **Never trust client-side** | Always validate payments server-side |
+| **Webhook signature verification** | Verify Stripe/Alipay webhook signatures |
+| **HTTPS only** | All payment pages must use HTTPS |
+| **PCI compliance** | Use Stripe Elements (no raw card data on your server) |
+| **Idempotency** | Use idempotency keys to prevent double charges |
+| **Receipt validation** | Validate IAP receipts server-side (Apple/Google) |
+| **Fraud detection** | Implement rate limiting; flag suspicious patterns |
+| **Secure key storage** | Use environment variables / secret managers; never commit keys |
+
+## Common Pitfalls
+
+| Issue | Fix |
+|-------|-----|
+| Apple IAP rejected | Ensure IAP is for digital content; physical goods use other processors |
+| Stripe webhook not receiving | Check webhook URL; verify signature; use Stripe CLI for testing |
+| Double charges | Implement idempotency keys; check payment status before fulfilling |
+| Currency mismatch | Use `currency` consistently; Stripe amounts are in cents |
+| Alipay/WeChat cross-border | Use Stripe's built-in support; or apply for merchant accounts directly |
+| Google Play billing crash | Handle `BillingClientStateListener` disconnection; retry logic |
+| Tax compliance | Use Stripe Tax or Paddle for automatic tax calculation |