foundry-dev

Plugin foundry-dev from marketplace foundry in fedcal/foundry. Commands read from the repo's manifest — 1 month ago.

Skills (17)

• angular-component

  Scaffold or refactor an Angular component so it matches the project's real conventions. Detects standalone vs NgModule, signal APIs vs decorators, built-in control flow vs structural directives, the test framework in use and whether Storybook is present, then generates component + spec (+ story) acc

• api-deprecation

  Run a full API deprecation cycle — mark, announce, measure usage, sunset, remove — with the RFC 9745 Deprecation and RFC 8594 Sunset headers, the OpenAPI and changelog artefacts, the per-consumer telemetry that gates each step, and the removal migration. Use when an endpoint, field, parameter, statu

• audit-accessibility

  Run a repeatable WCAG 2.2 Level AA audit of a page, route or component and emit a review.v1 artifact. Automated axe pass first, then the manual checks automation provably cannot do — focus order, reflow at 320 CSS px and 400% zoom, 24x24 target size, focus obscuring, and screen reader announcements

• decompose-service

  Decide whether to extract a service from a monolith or leave it in place, using measured coupling and cohesion, data ownership, transactional boundaries and team topology rather than fashion. Includes the hard do-not-split gates that stop a decomposition before it starts, and the extraction sequence

• design-api-contract

  Contract-first design of an HTTP API (OpenAPI 3.1) or an event-driven API (AsyncAPI 3) — resource and channel modelling, RFC 9457 problem-details error model, pagination, idempotency keys, conditional requests, versioning and the CI gates that keep the contract honest. Use before writing any handler

• design-tokens

  Establish or refactor a design token system for a web/Angular codebase — three-tier naming (primitive, semantic, component), theming and dark mode, contrast validation of every semantic pair, and wiring into Angular Material or a custom stylesheet architecture. Use when colours and spacing are hard-

• evolve-schema

  Change an API or event schema without breaking consumers — classify the change against backward/forward compatibility, run an expand-contract (parallel change) migration, and apply the deprecation policy with dated timelines and brownouts. Use before editing any published OpenAPI, AsyncAPI, JSON Sch

• harden-headers

  Set HTTP security headers and cookie flags correctly - a Content-Security-Policy without unsafe-inline including the nonce or hash migration path, HSTS, COOP/COEP/CORP, Referrer-Policy, Permissions-Policy, and SameSite/__Host- cookies - and roll CSP out in report-only mode, read the violation report

• optimise-query

  Diagnose and fix a slow database query or a slow ORM-backed endpoint with a disciplined loop — reproduce, measure with EXPLAIN (ANALYZE, BUFFERS), form one hypothesis, change one thing, re-measure, keep or revert, and record the outcome as a metric fact in Foundry memory. Use when an endpoint is slo

• python-service

  Create or review a Python/FastAPI service end-to-end — project layout and packaging tool, Pydantic settings validated at startup, async SQLAlchemy session wiring with an Alembic baseline, one working vertical-slice route (schema, dependency, service function, error handling), a pytest/httpx test har

• secret-hygiene

  Detect, rotate and remove leaked secrets - scan the working tree and the full git history, rotate in the correct order so nothing breaks, migrate to a secret manager or short-lived workload identity, and prevent recurrence with pre-commit and CI gates. Use when a scanner or review finds a credential

• security-review

  Adversarial application-security review pass over a diff, a module or a whole service, producing a review.v1 artifact with finding.v1 entries mapped to OWASP ASVS 5.0 and CWE. Includes the mandatory verification gate that kills speculative findings before they reach the user. Use before merging a ch

• spring-endpoint

  Add or change a Spring Boot HTTP endpoint end-to-end, following the conventions already present in this codebase — controller, request/response DTOs, Bean Validation, application service with an explicit transaction boundary, repository, RFC 9457 error mapping, Testcontainers integration test and Op

• threat-model

  Run a threat modelling session against a real codebase - enumerate entry points from source, draw trust boundaries, apply STRIDE per boundary, rank threats by exploitability x impact, and emit risk.v1 artifacts plus a mitigation checklist in which every mitigation is bound to a named test. Use befor

• ux-review

  Run a heuristic plus task-based usability review of a flow and emit a review.v1 artifact whose finding severities are tied to user impact — task failure, data loss, error rate, abandonment — never to aesthetics. Use before building a flow, when a funnel leaks, when support tickets cluster on one scr

• write-adr

  Produce a validated adr.v1 artifact and render the matching docs/adr/NNNN-slug.md file from the Foundry MADR-derived template. Use when a decision is expensive to reverse, when superseding an earlier ADR, when a review finds an undocumented architectural choice, or when onboarding asks "why is it bu

• write-migration

  Produce a reviewed database migration that is safe to run against a live PostgreSQL database — expand/migrate/contract phasing, Flyway or Liquibase file conventions, lock avoidance, a batched backfill plan, an honest reversibility statement, and the exact commands to rehearse it against a Testcontai

Subagents (19)

• accessibility-engineer

  Verifies and fixes accessibility against WCAG 2.2 Level AA, the ARIA Authoring Practices patterns and EN 301 549. Owns keyboard operability, focus management across SPA route changes, focus traps, screen reader behaviour, reflow and zoom, target size, and accessible names. Use before shipping any UI

• angular-engineer

  Implements and refactors Angular application code using the modern stack — standalone components, signals, the built-in control flow, deferrable views, typed reactive forms, lazy routing, SSR/hydration and zoneless change detection. Use when writing or reviewing Angular components, services, routes,

• appsec-reviewer

  Adversarial application-security code review against OWASP ASVS 5.0 and the OWASP Top 10 - injection, broken access control including IDOR and mass assignment, SSRF, unsafe deserialisation, XXE, path traversal, authorisation race conditions, JWT misuse, CORS misconfiguration and secret handling. Use

• database-architect

  Use for PostgreSQL-first schema design decisions — normalisation and deliberate denormalisation, primary key strategy (UUIDv7 vs bigint identity), index design and EXPLAIN-driven verification, partitioning, constraints as the last line of defence, multi-tenancy isolation models, and retention/archiv

• domain-modeler

  Use before any boundary decision, to turn a fuzzy problem domain into named bounded contexts, a context map with explicit relationship patterns, aggregates with stated invariants, a ubiquitous language glossary and event-storming output — then translate all of it into traceable requirement.v1 artifa

• fastapi-engineer

  Use for FastAPI service code — dependency injection with Depends(), Pydantic v2 request/response schemas, async SQLAlchemy 2.0 sessions and Alembic migrations, OAuth2/JWT wiring, exception handlers, OpenAPI generation, pytest/httpx testing, and uvicorn deployment readiness (lifespan events, health v

• frontend-performance-engineer

  Sets and enforces frontend performance budgets for Angular apps — Core Web Vitals (LCP, INP, CLS) with numeric targets, angular.json bundle budgets, image and font strategy, hydration cost, third-party script governance, and Lighthouse CI gating. Use when a page feels slow, before a launch, when add

• identity-engineer

  Designs and reviews authentication and authorisation - OAuth 2.1 / OIDC flow selection per client type, PKCE, token lifetimes and rotation, refresh-token reuse detection, session fixation and session lifecycle, RBAC vs ABAC vs ReBAC selection, multi-tenant isolation, and service-to-service auth with

• integration-architect

  Use when two systems must exchange data across a process, team or vendor boundary. Decides sync vs async, delivery semantics, idempotency, transactional outbox, saga and compensation, anti-corruption layer, backpressure, retry policy and dead-letter handling, then emits an adr.v1 decision or a revie

• migration-engineer

  Use for changing a database schema without downtime — expand/migrate/contract sequencing, Flyway or Liquibase conventions, backfilling large tables in batches, PostgreSQL lock avoidance (CREATE INDEX CONCURRENTLY, SET lock_timeout, NOT VALID constraints), and honest reversibility analysis. Delegate

• persistence-engineer

  Use for JPA/Hibernate correctness and performance — fetch strategies, N+1 detection, entity graphs, projections and DTO queries, optimistic locking, JDBC batching, second-level cache decisions, and knowing when to abandon JPA for jOOQ or plain SQL. Delegate here whenever an entity mapping, a reposit

• protocol-engineer

  Use to pick a wire protocol and use it correctly — HTTP/1.1 vs HTTP/2 vs HTTP/3, REST maturity, gRPC, GraphQL, WebSocket, SSE, AMQP, Kafka, MQTT, CoAP — and to get transport and authorization mechanics right (TLS, mTLS, OAuth 2.x/OIDC flows, token binding). Cites the governing RFC or standard for ev

• python-engineer

  Use for general-purpose Python application and library code that is not a FastAPI service — type hints and static typing with mypy/pyright, packaging and dependency management with pyproject.toml (uv, Poetry, Hatch, pip-tools), async/await and structured concurrency, error-handling architecture, per

• security-architect

  Threat-models a system - greenfield design or an existing codebase - by decomposing it into data flows, applying STRIDE per trust boundary, ranking threats by exploitability x impact, and binding every threat to one concrete mitigation and one test that proves the mitigation exists. Use before freez

• service-versioning-engineer

  Use for compatibility across service boundaries — SemVer applied to services versus APIs, choosing between URI, media-type and header versioning, consumer-driven contract testing, deprecation windows with RFC 8594 Sunset and RFC 9745 Deprecation headers, coordinating a release that spans several ser

• solution-architect

  Use for decisions that are expensive to reverse — component boundaries, consistency and state models, runtime and deployment topology, build-vs-buy, technology selection. Drives backwards from ISO/IEC 25010 quality attributes to structure, forces at least two genuinely different options, scores them

• spring-engineer

  Use for Spring Boot 3 application code — package structure, dependency injection, configuration binding, transaction boundaries, Bean Validation, RFC 9457 error handling, Testcontainers integration tests, virtual-threads vs reactive choices, Actuator and graceful shutdown. Delegate here before writi

• supply-chain-guardian

  Guards dependency and build integrity - generates and checks SBOMs (CycloneDX/SPDX), triages vulnerabilities by distinguishing reachable from unreachable, enforces pinning and lockfile integrity, detects typosquatting and dependency-confusion exposure, verifies provenance and attestations against SL

• ux-architect

  Designs and critiques interaction, not decoration. Owns task flows, information architecture, cognitive load, error prevention and recovery, form design, empty/loading/error states, microcopy, Nielsen heuristic evaluation, and design token / design system governance. Use before building a flow, when

Similar plugins