thachvd-kit 1.0.28 → 1.0.30

package/.agent/rules/GEMINI.md

@@ -1,61 +0,0 @@
----
-trigger: always_on
----
-
-# GEMINI.md
-
-Antigravity-compatible entry rules for thachvd-kit projects.
-
-## Startup
-
-1. Read `AGENTS.md` at the project root.
-2. Read `.agent/docs/project.md` for stack, commands, and routing.
-3. Read `.agent/docs/workflow.md` before editing.
-4. Read `.agent/docs/architecture.md` and `.agent/docs/conventions.md` before planning non-trivial code changes.
-5. If any `.agent/docs/*.md` file contains `TODO: refine`, update that doc from the real code before product code changes.
-
-## Routing
-
-- Frontend/UI: `.agent/agents/frontend-specialist.md`
-- Backend/API: `.agent/agents/backend-specialist.md`
-- Database/schema: `.agent/agents/database-architect.md`
-- Mobile/desktop: `.agent/agents/mobile-developer.md`
-- DevOps/CI/deploy: `.agent/agents/devops-engineer.md`
-- Debug/RCA: `.agent/agents/debugger.md`
-- Security: `.agent/agents/security-auditor.md`
-- Multi-domain: `.agent/agents/orchestrator.md`
-
-Load only the agent, skill, or workflow files relevant to the current task.
-
-## Execution
-
-- Route every task before editing. Use `/task <request>` when the correct path is not obvious.
-- Workspace workflows are available as `/task`, `/simple`, `/debug`, `/spec`, and `/release` from `.agent/workflows/`.
-- Questions and analysis: answer directly; do not edit code.
-- Simple fix: use `/simple <request>` only for one-file, unambiguous changes with no behavior or contract change.
-- Bug or failing behavior: use `/debug <symptom>` and follow the evidence-first root-cause flow.
-- Feature or refactor: use `/brainstorm` for discovery, `/spec` for ambiguous or multi-file scope, then `/plan`, wait for approval, implement, test, and `/review`.
-- Pre-merge review: use `/review`.
-- Release or npm publish: use `/release`; never use the simple fast path.
-- UI work: use relevant frontend design skills before editing.
-- Security or deploy work: run the matching checklist before claiming done.
-
-### Fast Path (`/simple`)
-
-The fast path bypasses only Spec, Plan, and the feature/refactor Review gate for a trivial change. It never bypasses inspection or verification. State `FAST_PATH: simple-fix`, the reason, and the narrow scope before editing. Re-route with `/task` if the scope expands.
-
-### Gated Flow (feature or refactor)
-
-1. **Spec** — `.agent/workflows/spec.md` when scope is ambiguous, multi-file, or >~30 min. Skip only for single-line/self-contained fixes. Wait for human confirmation at its exit criteria.
-2. **Plan** — `.agent/workflows/plan.md`. Wait for explicit user approval before implementing.
-3. **Implement** — smallest coherent change per the approved plan, with focused tests.
-4. **Review** — `.agent/workflows/review.md` (five-axis). All 🔴 BLOCKING items resolved or explicitly accepted before calling the task done.
-
-## Standards
-
-- Respond in the user's language.
-- Keep code, identifiers, and code comments in English.
-- Prefer existing project patterns over new abstractions.
-- Keep changes surgical.
-- Tests or equivalent verification are mandatory.
-- Update `.agent/docs/*` when stack, architecture, workflow, or conventions change.

package/.agent/skills/api-design/SKILL.md

@@ -1,156 +0,0 @@
----
-name: api-design
-description: REST API design patterns. Use when designing new API endpoints, reviewing API contracts, choosing pagination strategies, error response formats, versioning, or HTTP status codes.
-allowed-tools: Read, Edit, Write
----
-
-# API Design Patterns
-
-## URL Structure
-
-```
-# Resources: plural nouns, lowercase, kebab-case, no verbs
-GET    /api/v1/users
-POST   /api/v1/users
-GET    /api/v1/users/:id
-PUT    /api/v1/users/:id
-PATCH  /api/v1/users/:id
-DELETE /api/v1/users/:id
-
-# Sub-resources for relationships
-GET    /api/v1/users/:id/orders
-POST   /api/v1/users/:id/orders
-
-# Actions that don't map to CRUD
-POST   /api/v1/orders/:id/cancel
-POST   /api/v1/auth/refresh
-```
-
-**Naming rules:**
-```
-✅ /api/v1/team-members          kebab-case
-✅ /api/v1/orders?status=active  query params for filtering
-✅ /api/v1/users/123/orders      nested for ownership
-
-❌ /api/v1/getUsers              verb in URL
-❌ /api/v1/user                  singular
-❌ /api/v1/team_members          snake_case in URLs
-```
-
-## HTTP Methods and Status Codes
-
-| Method | Idempotent | Use For |
-|--------|-----------|---------|
-| GET | Yes | Retrieve |
-| POST | No | Create / trigger actions |
-| PUT | Yes | Full replacement |
-| PATCH | No | Partial update |
-| DELETE | Yes | Remove |
-
-```
-# Success
-200 OK                    GET, PUT, PATCH (with body)
-201 Created               POST (add Location header)
-204 No Content            DELETE, PUT (no body)
-
-# Client Errors
-400 Bad Request           Validation failure, malformed JSON
-401 Unauthorized          Missing or invalid auth
-403 Forbidden             Authenticated, not authorized
-404 Not Found             Resource doesn't exist
-409 Conflict              Duplicate entry, state conflict
-422 Unprocessable Entity  Valid JSON, semantically invalid
-429 Too Many Requests     Rate limit exceeded
-
-# Server Errors
-500 Internal Server Error Never expose internal details
-503 Service Unavailable   Include Retry-After header
-```
-
-## Response Format
-
-```json
-// Success
-{ "data": { "id": "abc-123", "email": "alice@example.com", "created_at": "2025-01-15T10:30:00Z" } }
-
-// Collection with pagination
-{
-  "data": [{ "id": "abc-123", "name": "Alice" }],
-  "meta": { "total": 142, "page": 1, "per_page": 20, "total_pages": 8 },
-  "links": { "next": "/api/v1/users?page=2&per_page=20" }
-}
-
-// Error
-{
-  "error": {
-    "code": "validation_error",
-    "message": "Request validation failed",
-    "details": [
-      { "field": "email", "message": "Must be a valid email", "code": "invalid_format" }
-    ]
-  }
-}
-```
-
-## Pagination
-
-| Use Case | Type |
-|----------|------|
-| Admin dashboards, small datasets (<10K) | Offset |
-| Infinite scroll, feeds, large datasets | **Cursor** |
-| Public APIs | Cursor (default) |
-| Search results | Offset (users expect page numbers) |
-
-```
-# Offset
-GET /api/v1/users?page=2&per_page=20
-
-# Cursor
-GET /api/v1/users?cursor=eyJpZCI6MTIzfQ&limit=20
-→ { "data": [...], "meta": { "has_next": true, "next_cursor": "eyJpZCI6MTQzfQ" } }
-```
-
-## Versioning
-
-```
-/api/v1/users     ← recommended
-/api/v2/users     ← when breaking changes needed
-```
-
-**Breaking changes** (require new version): removing fields, changing types, changing URL structure.
-**Non-breaking** (no new version): adding optional fields/params, adding endpoints.
-
-Deprecation: 6-month notice, add `Sunset` header, return `410 Gone` after.
-
-## Filtering, Sorting, Search
-
-```
-GET /api/v1/orders?status=active&created_after=2025-01-01
-GET /api/v1/users?sort=created_at&order=desc
-GET /api/v1/products?q=widget
-GET /api/v1/users?fields=id,email,name      # Sparse fieldsets
-```
-
-## Rate Limiting Headers
-
-```
-X-RateLimit-Limit: 100
-X-RateLimit-Remaining: 45
-X-RateLimit-Reset: 1640995200
-Retry-After: 30    # on 429
-```
-
-## API Design Checklist
-
-Before shipping a new endpoint:
-
-- [ ] URL: plural noun, kebab-case, no verbs
-- [ ] Correct HTTP method and status code
-- [ ] Input validated with schema (Zod, Pydantic, Go validator)
-- [ ] Error response follows standard format with field-level details
-- [ ] Pagination implemented for list endpoints
-- [ ] Authentication required (or explicitly marked public)
-- [ ] Authorization checked (user can only access their own resources)
-- [ ] Rate limiting configured
-- [ ] Response does not leak internal details (stack traces, SQL errors)
-- [ ] OpenAPI spec updated

package/.agent/skills/api-patterns/SKILL.md

@@ -1,81 +0,0 @@
----
-name: api-patterns
-description: API design principles and decision-making. REST vs GraphQL vs tRPC selection, response formats, versioning, pagination.
-allowed-tools: Read, Write, Edit, Glob, Grep
----
-
-# API Patterns
-
-> API design principles and decision-making for 2025.
-> **Learn to THINK, not copy fixed patterns.**
-
-## 🎯 Selective Reading Rule
-
-**Read ONLY files relevant to the request!** Check the content map, find what you need.
-
----
-
-## 📑 Content Map
-
-| File | Description | When to Read |
-|------|-------------|--------------|
-| `api-style.md` | REST vs GraphQL vs tRPC decision tree | Choosing API type |
-| `rest.md` | Resource naming, HTTP methods, status codes | Designing REST API |
-| `response.md` | Envelope pattern, error format, pagination | Response structure |
-| `graphql.md` | Schema design, when to use, security | Considering GraphQL |
-| `trpc.md` | TypeScript monorepo, type safety | TS fullstack projects |
-| `versioning.md` | URI/Header/Query versioning | API evolution planning |
-| `auth.md` | JWT, OAuth, Passkey, API Keys | Auth pattern selection |
-| `rate-limiting.md` | Token bucket, sliding window | API protection |
-| `documentation.md` | OpenAPI/Swagger best practices | Documentation |
-| `security-testing.md` | OWASP API Top 10, auth/authz testing | Security audits |
-
----
-
-## 🔗 Related Skills
-
-| Need | Skill |
-|------|-------|
-| API implementation | `@[skills/backend-development]` |
-| Data structure | `@[skills/database-design]` |
-| Security details | `@[skills/security-hardening]` |
-
----
-
-## ✅ Decision Checklist
-
-Before designing an API:
-
-- [ ] **Asked user about API consumers?**
-- [ ] **Chosen API style for THIS context?** (REST/GraphQL/tRPC)
-- [ ] **Defined consistent response format?**
-- [ ] **Planned versioning strategy?**
-- [ ] **Considered authentication needs?**
-- [ ] **Planned rate limiting?**
-- [ ] **Documentation approach defined?**
-
----
-
-## ❌ Anti-Patterns
-
-**DON'T:**
-- Default to REST for everything
-- Use verbs in REST endpoints (/getUsers)
-- Return inconsistent response formats
-- Expose internal errors to clients
-- Skip rate limiting
-
-**DO:**
-- Choose API style based on context
-- Ask about client requirements
-- Document thoroughly
-- Use appropriate status codes
-
----
-
-## Script
-
-| Script | Purpose | Command |
-|--------|---------|---------|
-| `scripts/api_validator.py` | API endpoint validation | `python scripts/api_validator.py <project_path>` |
-

package/.agent/skills/api-patterns/api-style.md

@@ -1,42 +0,0 @@
-# API Style Selection (2025)
-
-> REST vs GraphQL vs tRPC - Hangi durumda hangisi?
-
-## Decision Tree
-
-```
-Who are the API consumers?
-│
-├── Public API / Multiple platforms
-│   └── REST + OpenAPI (widest compatibility)
-│
-├── Complex data needs / Multiple frontends
-│   └── GraphQL (flexible queries)
-│
-├── TypeScript frontend + backend (monorepo)
-│   └── tRPC (end-to-end type safety)
-│
-├── Real-time / Event-driven
-│   └── WebSocket + AsyncAPI
-│
-└── Internal microservices
-    └── gRPC (performance) or REST (simplicity)
-```
-
-## Comparison
-
-| Factor | REST | GraphQL | tRPC |
-|--------|------|---------|------|
-| **Best for** | Public APIs | Complex apps | TS monorepos |
-| **Learning curve** | Low | Medium | Low (if TS) |
-| **Over/under fetching** | Common | Solved | Solved |
-| **Type safety** | Manual (OpenAPI) | Schema-based | Automatic |
-| **Caching** | HTTP native | Complex | Client-based |
-
-## Selection Questions
-
-1. Who are the API consumers?
-2. Is the frontend TypeScript?
-3. How complex are the data relationships?
-4. Is caching critical?
-5. Public or internal API?

package/.agent/skills/api-patterns/auth.md

@@ -1,24 +0,0 @@
-# Authentication Patterns
-
-> Choose auth pattern based on use case.
-
-## Selection Guide
-
-| Pattern | Best For |
-|---------|----------|
-| **JWT** | Stateless, microservices |
-| **Session** | Traditional web, simple |
-| **OAuth 2.0** | Third-party integration |
-| **API Keys** | Server-to-server, public APIs |
-| **Passkey** | Modern passwordless (2025+) |
-
-## JWT Principles
-
-```
-Important:
-├── Always verify signature
-├── Check expiration
-├── Include minimal claims
-├── Use short expiry + refresh tokens
-└── Never store sensitive data in JWT
-```

package/.agent/skills/api-patterns/documentation.md

@@ -1,26 +0,0 @@
-# API Documentation Principles
-
-> Good docs = happy developers = API adoption.
-
-## OpenAPI/Swagger Essentials
-
-```
-Include:
-├── All endpoints with examples
-├── Request/response schemas
-├── Authentication requirements
-├── Error response formats
-└── Rate limiting info
-```
-
-## Good Documentation Has
-
-```
-Essentials:
-├── Quick start / Getting started
-├── Authentication guide
-├── Complete API reference
-├── Error handling guide
-├── Code examples (multiple languages)
-└── Changelog
-```

package/.agent/skills/api-patterns/graphql.md

@@ -1,41 +0,0 @@
-# GraphQL Principles
-
-> Flexible queries for complex, interconnected data.
-
-## When to Use
-
-```
-✅ Good fit:
-├── Complex, interconnected data
-├── Multiple frontend platforms
-├── Clients need flexible queries
-├── Evolving data requirements
-└── Reducing over-fetching matters
-
-❌ Poor fit:
-├── Simple CRUD operations
-├── File upload heavy
-├── HTTP caching important
-└── Team unfamiliar with GraphQL
-```
-
-## Schema Design Principles
-
-```
-Principles:
-├── Think in graphs, not endpoints
-├── Design for evolvability (no versions)
-├── Use connections for pagination
-├── Be specific with types (not generic "data")
-└── Handle nullability thoughtfully
-```
-
-## Security Considerations
-
-```
-Protect against:
-├── Query depth attacks → Set max depth
-├── Query complexity → Calculate cost
-├── Batching abuse → Limit batch size
-├── Introspection → Disable in production
-```

package/.agent/skills/api-patterns/rate-limiting.md

@@ -1,31 +0,0 @@
-# Rate Limiting Principles
-
-> Protect your API from abuse and overload.
-
-## Why Rate Limit
-
-```
-Protect against:
-├── Brute force attacks
-├── Resource exhaustion
-├── Cost overruns (if pay-per-use)
-└── Unfair usage
-```
-
-## Strategy Selection
-
-| Type | How | When |
-|------|-----|------|
-| **Token bucket** | Burst allowed, refills over time | Most APIs |
-| **Sliding window** | Smooth distribution | Strict limits |
-| **Fixed window** | Simple counters per window | Basic needs |
-
-## Response Headers
-
-```
-Include in headers:
-├── X-RateLimit-Limit (max requests)
-├── X-RateLimit-Remaining (requests left)
-├── X-RateLimit-Reset (when limit resets)
-└── Return 429 when exceeded
-```

package/.agent/skills/api-patterns/response.md

@@ -1,37 +0,0 @@
-# Response Format Principles
-
-> Consistency is key - choose a format and stick to it.
-
-## Common Patterns
-
-```
-Choose one:
-├── Envelope pattern ({ success, data, error })
-├── Direct data (just return the resource)
-└── HAL/JSON:API (hypermedia)
-```
-
-## Error Response
-
-```
-Include:
-├── Error code (for programmatic handling)
-├── User message (for display)
-├── Details (for debugging, field-level errors)
-├── Request ID (for support)
-└── NOT internal details (security!)
-```
-
-## Pagination Types
-
-| Type | Best For | Trade-offs |
-|------|----------|------------|
-| **Offset** | Simple, jumpable | Performance on large datasets |
-| **Cursor** | Large datasets | Can't jump to page |
-| **Keyset** | Performance critical | Requires sortable key |
-
-### Selection Questions
-
-1. How large is the dataset?
-2. Do users need to jump to specific pages?
-3. Is data frequently changing?

package/.agent/skills/api-patterns/rest.md

@@ -1,40 +0,0 @@
-# REST Principles
-
-> Resource-based API design - nouns not verbs.
-
-## Resource Naming Rules
-
-```
-Principles:
-├── Use NOUNS, not verbs (resources, not actions)
-├── Use PLURAL forms (/users not /user)
-├── Use lowercase with hyphens (/user-profiles)
-├── Nest for relationships (/users/123/posts)
-└── Keep shallow (max 3 levels deep)
-```
-
-## HTTP Method Selection
-
-| Method | Purpose | Idempotent? | Body? |
-|--------|---------|-------------|-------|
-| **GET** | Read resource(s) | Yes | No |
-| **POST** | Create new resource | No | Yes |
-| **PUT** | Replace entire resource | Yes | Yes |
-| **PATCH** | Partial update | No | Yes |
-| **DELETE** | Remove resource | Yes | No |
-
-## Status Code Selection
-
-| Situation | Code | Why |
-|-----------|------|-----|
-| Success (read) | 200 | Standard success |
-| Created | 201 | New resource created |
-| No content | 204 | Success, nothing to return |
-| Bad request | 400 | Malformed request |
-| Unauthorized | 401 | Missing/invalid auth |
-| Forbidden | 403 | Valid auth, no permission |
-| Not found | 404 | Resource doesn't exist |
-| Conflict | 409 | State conflict (duplicate) |
-| Validation error | 422 | Valid syntax, invalid data |
-| Rate limited | 429 | Too many requests |
-| Server error | 500 | Our fault |