db-migrationGenerate a Flyway or Liquibase migration in lockstep with an entity change. Detects which migration tool the project uses and the next version number. Invoked by jpa-entity after a schema change, or directly. Trigger phrases: "create migration", "add db migration", "new flyway migration", "add liqui
idempotent-endpointScaffold idempotency-key handling for unsafe POSTs — read an Idempotency-Key header, replay the stored response on a retry instead of re-processing, otherwise process once and store the response keyed by (key, request fingerprint). Ships a servlet filter plus a storage SPI the project implements wit
integration-testScaffold a Spring Boot integration test against REAL infrastructure via Testcontainers — a throwaway Postgres (Kafka optional), wired with Spring Boot 3.1+ @ServiceConnection so there's no manual datasource config. Async assertions use Awaitility, never Thread.sleep. Trigger phrases: "integration te
jpa-entityScaffold a Spring Data JPA @Entity correct-by-default so the guardrails never fire: @Version optimistic locking, business-key equals/hashCode (never the generated @Id), JPA auditing fields, optional soft-delete, plus a matching repository — all matching this project's conventions. Trigger phrases: "
jwt-authScaffold JWT bearer authentication for a stateless JSON API. Recommends Spring Security's resource server (framework verifies signature + exp); also ships a custom OncePerRequestFilter using jjwt for teams that need it — it verifies the signature, rejects alg=none, checks exp/nbf, and returns 401 JS
rest-error-handlerScaffold a global REST error contract — a @RestControllerAdvice that maps every exception to an RFC 7807 ProblemDetail (Spring 6): validation errors → 400 with field details, a domain NotFoundException → 404, and a fallback 500 that never leaks stack traces. This is the fix the entity-in-controller
security-filter-chainScaffold a Spring Security 6 SecurityFilterChain @Bean baseline — deny-by-default authorizeHttpRequests, a BCryptPasswordEncoder, explicit CORS, and CSRF guidance (kept for cookie/session auth, disabled only for stateless token APIs). Lambda DSL, Jakarta, no deprecated .and() chaining. Trigger phras
setupWire the Spring Boot guardrails into this project — install the jpa-guardrail PostToolUse hook + ruleset, register it in settings.json, copy the springboot-reviewer agent, and inject the Spring Boot rule block into CLAUDE.md. Short interview fills project slots (base entity, migration tool, strict m
spring-rest-endpointScaffold a Spring Web REST endpoint correct-by-default — controller + request/ response DTOs + service method + mapper. Never exposes a JPA entity (satisfies the entity-in-controller guardrail). Request bodies are @Valid DTOs. Trigger phrases: "add endpoint", "scaffold rest controller", "new REST en
springboot-conventionsFine-grained Spring Boot 3.x + JPA conventions and the rationale behind the toolkit's guardrail rules. Split by domain — load the reference for what you're touching. Use when working on persistence, controllers, transactions, or tests and you want the why, not just the what. Trigger phrases: "spring
test-sliceScaffold focused Spring slice tests — @DataJpaTest for the persistence layer (rolls back per test) and @WebMvcTest for the web layer (MockMvc + mocked services). Pick the narrowest slice that proves the behavior; reach for full @SpringBootTest only for cross-layer flows. Trigger phrases: "datajpates