thachvd-kit 1.0.14 → 1.0.16

package/.agent/agents/seo-specialist.md

@@ -0,0 +1,111 @@
+---
+name: seo-specialist
+description: SEO and GEO (Generative Engine Optimization) expert. Handles SEO audits, Core Web Vitals, E-E-A-T optimization, AI search visibility. Use for SEO improvements, content optimization, or AI citation strategies.
+tools: Read, Grep, Glob, Bash, Write
+model: inherit
+skills: clean-code, seo-fundamentals, geo-fundamentals
+---
+
+# SEO Specialist
+
+Expert in SEO and GEO (Generative Engine Optimization) for traditional and AI-powered search engines.
+
+## Core Philosophy
+
+> "Content for humans, structured for machines. Win both Google and ChatGPT."
+
+## Your Mindset
+
+- **User-first**: Content quality over tricks
+- **Dual-target**: SEO + GEO simultaneously
+- **Data-driven**: Measure, test, iterate
+- **Future-proof**: AI search is growing
+
+---
+
+## SEO vs GEO
+
+| Aspect | SEO | GEO |
+|--------|-----|-----|
+| Goal | Rank #1 in Google | Be cited in AI responses |
+| Platform | Google, Bing | ChatGPT, Claude, Perplexity |
+| Metrics | Rankings, CTR | Citation rate, appearances |
+| Focus | Keywords, backlinks | Entities, data, credentials |
+
+---
+
+## Core Web Vitals Targets
+
+| Metric | Good | Poor |
+|--------|------|------|
+| **LCP** | < 2.5s | > 4.0s |
+| **INP** | < 200ms | > 500ms |
+| **CLS** | < 0.1 | > 0.25 |
+
+---
+
+## E-E-A-T Framework
+
+| Principle | How to Demonstrate |
+|-----------|-------------------|
+| **Experience** | First-hand knowledge, real stories |
+| **Expertise** | Credentials, certifications |
+| **Authoritativeness** | Backlinks, mentions, recognition |
+| **Trustworthiness** | HTTPS, transparency, reviews |
+
+---
+
+## Technical SEO Checklist
+
+- [ ] XML sitemap submitted
+- [ ] robots.txt configured
+- [ ] Canonical tags correct
+- [ ] HTTPS enabled
+- [ ] Mobile-friendly
+- [ ] Core Web Vitals passing
+- [ ] Schema markup valid
+
+## Content SEO Checklist
+
+- [ ] Title tags optimized (50-60 chars)
+- [ ] Meta descriptions (150-160 chars)
+- [ ] H1-H6 hierarchy correct
+- [ ] Internal linking structure
+- [ ] Image alt texts
+
+## GEO Checklist
+
+- [ ] FAQ sections present
+- [ ] Author credentials visible
+- [ ] Statistics with sources
+- [ ] Clear definitions
+- [ ] Expert quotes attributed
+- [ ] "Last updated" timestamps
+
+---
+
+## Content That Gets Cited
+
+| Element | Why AI Cites It |
+|---------|-----------------|
+| Original statistics | Unique data |
+| Expert quotes | Authority |
+| Clear definitions | Extractable |
+| Step-by-step guides | Useful |
+| Comparison tables | Structured |
+
+---
+
+## When You Should Be Used
+
+- SEO audits
+- Core Web Vitals optimization
+- E-E-A-T improvement
+- AI search visibility
+- Schema markup implementation
+- Content optimization
+- GEO strategy
+
+---
+
+> **Remember:** The best SEO is great content that answers questions clearly and authoritatively.

package/.agent/agents/test-engineer.md

@@ -0,0 +1,158 @@
+---
+name: test-engineer
+description: Expert in testing, TDD, and test automation. Use for writing tests, improving coverage, debugging test failures. Triggers on test, spec, coverage, jest, pytest, playwright, e2e, unit test.
+tools: Read, Grep, Glob, Bash, Edit, Write
+model: inherit
+skills: clean-code, testing-patterns, tdd-workflow, webapp-testing, code-review-checklist, lint-and-validate
+---
+
+# Test Engineer
+
+Expert in test automation, TDD, and comprehensive testing strategies.
+
+## Core Philosophy
+
+> "Find what the developer forgot. Test behavior, not implementation."
+
+## Your Mindset
+
+- **Proactive**: Discover untested paths
+- **Systematic**: Follow testing pyramid
+- **Behavior-focused**: Test what matters to users
+- **Quality-driven**: Coverage is a guide, not a goal
+
+---
+
+## Testing Pyramid
+
+```
+        /\          E2E (Few)
+       /  \         Critical user flows
+      /----\
+     /      \       Integration (Some)
+    /--------\      API, DB, services
+   /          \
+  /------------\    Unit (Many)
+                    Functions, logic
+```
+
+---
+
+## Framework Selection
+
+| Language | Unit | Integration | E2E |
+|----------|------|-------------|-----|
+| TypeScript | Vitest, Jest | Supertest | Playwright |
+| Python | Pytest | Pytest | Playwright |
+| React | Testing Library | MSW | Playwright |
+
+---
+
+## TDD Workflow
+
+```
+🔴 RED    → Write failing test
+🟢 GREEN  → Minimal code to pass
+🔵 REFACTOR → Improve code quality
+```
+
+---
+
+## Test Type Selection
+
+| Scenario | Test Type |
+|----------|-----------|
+| Business logic | Unit |
+| API endpoints | Integration |
+| User flows | E2E |
+| Components | Component/Unit |
+
+---
+
+## AAA Pattern
+
+| Step | Purpose |
+|------|---------|
+| **Arrange** | Set up test data |
+| **Act** | Execute code |
+| **Assert** | Verify outcome |
+
+---
+
+## Coverage Strategy
+
+| Area | Target |
+|------|--------|
+| Critical paths | 100% |
+| Business logic | 80%+ |
+| Utilities | 70%+ |
+| UI layout | As needed |
+
+---
+
+## Deep Audit Approach
+
+### Discovery
+
+| Target | Find |
+|--------|------|
+| Routes | Scan app directories |
+| APIs | Grep HTTP methods |
+| Components | Find UI files |
+
+### Systematic Testing
+
+1. Map all endpoints
+2. Verify responses
+3. Cover critical paths
+
+---
+
+## Mocking Principles
+
+| Mock | Don't Mock |
+|------|------------|
+| External APIs | Code under test |
+| Database (unit) | Simple deps |
+| Network | Pure functions |
+
+---
+
+## Review Checklist
+
+- [ ] Coverage 80%+ on critical paths
+- [ ] AAA pattern followed
+- [ ] Tests are isolated
+- [ ] Descriptive naming
+- [ ] Edge cases covered
+- [ ] External deps mocked
+- [ ] Cleanup after tests
+- [ ] Fast unit tests (<100ms)
+
+---
+
+## Anti-Patterns
+
+| ❌ Don't | ✅ Do |
+|----------|-------|
+| Test implementation | Test behavior |
+| Multiple asserts | One per test |
+| Dependent tests | Independent |
+| Ignore flaky | Fix root cause |
+| Skip cleanup | Always reset |
+
+---
+
+## When You Should Be Used
+
+- Writing unit tests
+- TDD implementation
+- E2E test creation
+- Improving coverage
+- Debugging test failures
+- Test infrastructure setup
+- API integration tests
+
+---
+
+> **Remember:** Good tests are documentation. They explain what the code should do.

package/.agent/docs/architecture.md

@@ -0,0 +1,22 @@
+# Architecture Notes
+
+## Current Map
+
+- `bin/cli.js`: Main Node.js CLI. Handles scan detection, prompts, file generation, and `.agent/` copy.
+- `.agent/`: Installed kit content copied into target projects.
+- `agents/`, `skills/`, `workflows/`, `rules/`: Source mirrors for kit content.
+- `kit/`: Human-facing kit docs and prompt recipes.
+- `scripts/`: Helper scripts used by generated workflows.
+
+## Output Model
+
+`thachvd-kit init` creates thin root entry files and puts project-specific knowledge in `.agent/docs/`:
+
+- `AGENTS.md`: shared instructions for Codex, Antigravity, and Claude Code.
+- `CLAUDE.md`: imports `AGENTS.md` for Claude Code.
+- `GEMINI.md`: Antigravity entry that points to `AGENTS.md`.
+- `.agent/docs/*.md`: stack, architecture, conventions, and workflow.
+
+## Maintenance Rule
+
+Keep root entry files short. Add project-specific details to `.agent/docs/*` and reusable behavior to `.agent/skills/*` or `.agent/workflows/*`.

package/.agent/docs/conventions.md

@@ -0,0 +1,21 @@
+# Coding Conventions
+
+## JavaScript CLI
+
+- Keep CLI behavior in `bin/cli.js` unless a helper becomes clearly reusable.
+- Prefer simple filesystem APIs from Node.js standard library.
+- Keep generated Markdown ASCII-only unless the target file already requires non-ASCII.
+- Avoid adding dependencies for small formatting or path operations.
+
+## Docs And Rules
+
+- Root `AGENTS.md`, `CLAUDE.md`, and `GEMINI.md` should stay concise.
+- Put scan-specific or project-specific detail in `.agent/docs/`.
+- Keep `.agent/rules/GEMINI.md` and `rules/GEMINI.md` aligned.
+- Keep mirrored source folders and `.agent/` content aligned when changing kit assets.
+
+## Verification
+
+- Syntax-check `bin/cli.js` after edits.
+- Run `npm test`.
+- Run `npm pack --dry-run` for package output changes.

package/.agent/docs/project.md

@@ -0,0 +1,40 @@
+# Project Rules
+
+Generated by thachvd-kit.
+
+## Summary
+
+- Name: thachvd-kit
+- Description: Project rules bootstrap kit for Codex, Antigravity, and Claude Code.
+- Type: CLI package
+- App root: `.`
+
+## Stack
+
+- Language: JavaScript
+- Runtime: Node.js
+- Package manager: npm
+- CLI entry: `bin/cli.js`
+- Published package files: `.agent`, `agents`, `bin`, `kit`, `rules`, `scripts`, `skills`, `workflows`, `README.md`, `LICENSE`
+
+## Commands
+
+- Install: `npm install`
+- Test: `npm test`
+- Package dry run: `npm pack --dry-run`
+- Publish: `npm publish`
+
+## Agent Routing
+
+| Task Type | Agent | Primary Skills |
+|-----------|-------|----------------|
+| CLI behavior | `backend-specialist` | `nodejs-best-practices`, `clean-code` |
+| Docs/rules | `documentation-writer` | `documentation-templates` |
+| Workflow design | `project-planner` | `plan-writing`, `executing-plans` |
+| Security/release | `security-auditor` / `devops-engineer` | `vulnerability-scanner`, `deployment-procedures` |
+
+## Verification
+
+- Run `node --check bin/cli.js` after CLI edits.
+- Run `npm test` before claiming code changes are complete.
+- Run `npm pack --dry-run` before release-oriented changes.

package/.agent/docs/workflow.md

@@ -0,0 +1,24 @@
+# Agent Workflow
+
+## Before Every Task
+
+1. Read `AGENTS.md`.
+2. Read `.agent/docs/project.md`.
+3. Classify the request.
+4. Load only the relevant agent, skill, or workflow docs.
+
+## Implementation Flow
+
+1. State assumptions and success criteria when the task is not trivial.
+2. Inspect dependent files before editing.
+3. Make the smallest coherent change.
+4. Add or update focused tests when behavior changes.
+5. Run verification.
+6. Summarize changed files and verification evidence.
+
+## Release Flow
+
+1. Update package metadata when changing publish behavior.
+2. Run `npm test`.
+3. Run `npm pack --dry-run`.
+4. Review tarball contents before publish.

package/.agent/rules/GEMINI.md

@@ -0,0 +1,45 @@
+---
+trigger: always_on
+---
+
+# GEMINI.md
+
+Antigravity-compatible entry rules for thachvd-kit projects.
+
+## Startup
+
+1. Read `AGENTS.md` at the project root.
+2. Read `.agent/docs/project.md` for stack, commands, and routing.
+3. Read `.agent/docs/workflow.md` before editing.
+4. Read `.agent/docs/architecture.md` and `.agent/docs/conventions.md` before planning non-trivial code changes.
+5. If any `.agent/docs/*.md` file contains `TODO: refine`, update that doc from the real code before product code changes.
+
+## Routing
+
+- Frontend/UI: `.agent/agents/frontend-specialist.md`
+- Backend/API: `.agent/agents/backend-specialist.md`
+- Database/schema: `.agent/agents/database-architect.md`
+- Mobile/desktop: `.agent/agents/mobile-developer.md`
+- DevOps/CI/deploy: `.agent/agents/devops-engineer.md`
+- Debug/RCA: `.agent/agents/debugger.md`
+- Security: `.agent/agents/security-auditor.md`
+- Multi-domain: `.agent/agents/orchestrator.md`
+
+Load only the agent, skill, or workflow files relevant to the current task.
+
+## Execution
+
+- Questions and analysis: answer directly; do not edit code.
+- Simple fix: inspect dependencies, make the smallest change, verify.
+- Feature or refactor: state assumptions, define success criteria, plan, implement, verify.
+- UI work: use relevant frontend design skills before editing.
+- Security or deploy work: run the matching checklist before claiming done.
+
+## Standards
+
+- Respond in the user's language.
+- Keep code, identifiers, and code comments in English.
+- Prefer existing project patterns over new abstractions.
+- Keep changes surgical.
+- Tests or equivalent verification are mandatory.
+- Update `.agent/docs/*` when stack, architecture, workflow, or conventions change.

package/.agent/skills/api-design/SKILL.md

@@ -0,0 +1,156 @@
+---
+name: api-design
+description: REST API design patterns. Use when designing new API endpoints, reviewing API contracts, choosing pagination strategies, error response formats, versioning, or HTTP status codes.
+allowed-tools: Read, Edit, Write
+---
+
+# API Design Patterns
+
+## URL Structure
+
+```
+# Resources: plural nouns, lowercase, kebab-case, no verbs
+GET    /api/v1/users
+POST   /api/v1/users
+GET    /api/v1/users/:id
+PUT    /api/v1/users/:id
+PATCH  /api/v1/users/:id
+DELETE /api/v1/users/:id
+
+# Sub-resources for relationships
+GET    /api/v1/users/:id/orders
+POST   /api/v1/users/:id/orders
+
+# Actions that don't map to CRUD
+POST   /api/v1/orders/:id/cancel
+POST   /api/v1/auth/refresh
+```
+
+**Naming rules:**
+```
+✅ /api/v1/team-members          kebab-case
+✅ /api/v1/orders?status=active  query params for filtering
+✅ /api/v1/users/123/orders      nested for ownership
+
+❌ /api/v1/getUsers              verb in URL
+❌ /api/v1/user                  singular
+❌ /api/v1/team_members          snake_case in URLs
+```
+
+## HTTP Methods and Status Codes
+
+| Method | Idempotent | Use For |
+|--------|-----------|---------|
+| GET | Yes | Retrieve |
+| POST | No | Create / trigger actions |
+| PUT | Yes | Full replacement |
+| PATCH | No | Partial update |
+| DELETE | Yes | Remove |
+
+```
+# Success
+200 OK                    GET, PUT, PATCH (with body)
+201 Created               POST (add Location header)
+204 No Content            DELETE, PUT (no body)
+
+# Client Errors
+400 Bad Request           Validation failure, malformed JSON
+401 Unauthorized          Missing or invalid auth
+403 Forbidden             Authenticated, not authorized
+404 Not Found             Resource doesn't exist
+409 Conflict              Duplicate entry, state conflict
+422 Unprocessable Entity  Valid JSON, semantically invalid
+429 Too Many Requests     Rate limit exceeded
+
+# Server Errors
+500 Internal Server Error Never expose internal details
+503 Service Unavailable   Include Retry-After header
+```
+
+## Response Format
+
+```json
+// Success
+{ "data": { "id": "abc-123", "email": "alice@example.com", "created_at": "2025-01-15T10:30:00Z" } }
+
+// Collection with pagination
+{
+  "data": [{ "id": "abc-123", "name": "Alice" }],
+  "meta": { "total": 142, "page": 1, "per_page": 20, "total_pages": 8 },
+  "links": { "next": "/api/v1/users?page=2&per_page=20" }
+}
+
+// Error
+{
+  "error": {
+    "code": "validation_error",
+    "message": "Request validation failed",
+    "details": [
+      { "field": "email", "message": "Must be a valid email", "code": "invalid_format" }
+    ]
+  }
+}
+```
+
+## Pagination
+
+| Use Case | Type |
+|----------|------|
+| Admin dashboards, small datasets (<10K) | Offset |
+| Infinite scroll, feeds, large datasets | **Cursor** |
+| Public APIs | Cursor (default) |
+| Search results | Offset (users expect page numbers) |
+
+```
+# Offset
+GET /api/v1/users?page=2&per_page=20
+
+# Cursor
+GET /api/v1/users?cursor=eyJpZCI6MTIzfQ&limit=20
+→ { "data": [...], "meta": { "has_next": true, "next_cursor": "eyJpZCI6MTQzfQ" } }
+```
+
+## Versioning
+
+```
+/api/v1/users     ← recommended
+/api/v2/users     ← when breaking changes needed
+```
+
+**Breaking changes** (require new version): removing fields, changing types, changing URL structure.
+**Non-breaking** (no new version): adding optional fields/params, adding endpoints.
+
+Deprecation: 6-month notice, add `Sunset` header, return `410 Gone` after.
+
+## Filtering, Sorting, Search
+
+```
+GET /api/v1/orders?status=active&created_after=2025-01-01
+GET /api/v1/users?sort=created_at&order=desc
+GET /api/v1/products?q=widget
+GET /api/v1/users?fields=id,email,name      # Sparse fieldsets
+```
+
+## Rate Limiting Headers
+
+```
+X-RateLimit-Limit: 100
+X-RateLimit-Remaining: 45
+X-RateLimit-Reset: 1640995200
+Retry-After: 30    # on 429
+```
+
+## API Design Checklist
+
+Before shipping a new endpoint:
+
+- [ ] URL: plural noun, kebab-case, no verbs
+- [ ] Correct HTTP method and status code
+- [ ] Input validated with schema (Zod, Pydantic, Go validator)
+- [ ] Error response follows standard format with field-level details
+- [ ] Pagination implemented for list endpoints
+- [ ] Authentication required (or explicitly marked public)
+- [ ] Authorization checked (user can only access their own resources)
+- [ ] Rate limiting configured
+- [ ] Response does not leak internal details (stack traces, SQL errors)
+- [ ] OpenAPI spec updated

package/.agent/skills/api-patterns/SKILL.md

@@ -0,0 +1,81 @@
+---
+name: api-patterns
+description: API design principles and decision-making. REST vs GraphQL vs tRPC selection, response formats, versioning, pagination.
+allowed-tools: Read, Write, Edit, Glob, Grep
+---
+
+# API Patterns
+
+> API design principles and decision-making for 2025.
+> **Learn to THINK, not copy fixed patterns.**
+
+## 🎯 Selective Reading Rule
+
+**Read ONLY files relevant to the request!** Check the content map, find what you need.
+
+---
+
+## 📑 Content Map
+
+| File | Description | When to Read |
+|------|-------------|--------------|
+| `api-style.md` | REST vs GraphQL vs tRPC decision tree | Choosing API type |
+| `rest.md` | Resource naming, HTTP methods, status codes | Designing REST API |
+| `response.md` | Envelope pattern, error format, pagination | Response structure |
+| `graphql.md` | Schema design, when to use, security | Considering GraphQL |
+| `trpc.md` | TypeScript monorepo, type safety | TS fullstack projects |
+| `versioning.md` | URI/Header/Query versioning | API evolution planning |
+| `auth.md` | JWT, OAuth, Passkey, API Keys | Auth pattern selection |
+| `rate-limiting.md` | Token bucket, sliding window | API protection |
+| `documentation.md` | OpenAPI/Swagger best practices | Documentation |
+| `security-testing.md` | OWASP API Top 10, auth/authz testing | Security audits |
+
+---
+
+## 🔗 Related Skills
+
+| Need | Skill |
+|------|-------|
+| API implementation | `@[skills/backend-development]` |
+| Data structure | `@[skills/database-design]` |
+| Security details | `@[skills/security-hardening]` |
+
+---
+
+## ✅ Decision Checklist
+
+Before designing an API:
+
+- [ ] **Asked user about API consumers?**
+- [ ] **Chosen API style for THIS context?** (REST/GraphQL/tRPC)
+- [ ] **Defined consistent response format?**
+- [ ] **Planned versioning strategy?**
+- [ ] **Considered authentication needs?**
+- [ ] **Planned rate limiting?**
+- [ ] **Documentation approach defined?**
+
+---
+
+## ❌ Anti-Patterns
+
+**DON'T:**
+- Default to REST for everything
+- Use verbs in REST endpoints (/getUsers)
+- Return inconsistent response formats
+- Expose internal errors to clients
+- Skip rate limiting
+
+**DO:**
+- Choose API style based on context
+- Ask about client requirements
+- Document thoroughly
+- Use appropriate status codes
+
+---
+
+## Script
+
+| Script | Purpose | Command |
+|--------|---------|---------|
+| `scripts/api_validator.py` | API endpoint validation | `python scripts/api_validator.py <project_path>` |
+

package/.agent/skills/api-patterns/api-style.md

@@ -0,0 +1,42 @@
+# API Style Selection (2025)
+
+> REST vs GraphQL vs tRPC - Hangi durumda hangisi?
+
+## Decision Tree
+
+```
+Who are the API consumers?
+│
+├── Public API / Multiple platforms
+│   └── REST + OpenAPI (widest compatibility)
+│
+├── Complex data needs / Multiple frontends
+│   └── GraphQL (flexible queries)
+│
+├── TypeScript frontend + backend (monorepo)
+│   └── tRPC (end-to-end type safety)
+│
+├── Real-time / Event-driven
+│   └── WebSocket + AsyncAPI
+│
+└── Internal microservices
+    └── gRPC (performance) or REST (simplicity)
+```
+
+## Comparison
+
+| Factor | REST | GraphQL | tRPC |
+|--------|------|---------|------|
+| **Best for** | Public APIs | Complex apps | TS monorepos |
+| **Learning curve** | Low | Medium | Low (if TS) |
+| **Over/under fetching** | Common | Solved | Solved |
+| **Type safety** | Manual (OpenAPI) | Schema-based | Automatic |
+| **Caching** | HTTP native | Complex | Client-based |
+
+## Selection Questions
+
+1. Who are the API consumers?
+2. Is the frontend TypeScript?
+3. How complex are the data relationships?
+4. Is caching critical?
+5. Public or internal API?