# Build & Test
- Build: `npm run build`
- Test all: `npm test`
- Test single: `npm test -- --grep "test name"`
- Lint: `npm run lint`

# Code Style
- Use TypeScript strict mode
- Prefer async/await over .then() chains
- Use Zod for request validation, not manual checks
- Error responses follow RFC 7807 (Problem Details)

# Architecture
- Routes go in src/routes/, services in src/services/
- Every route must have a corresponding OpenAPI spec in api/
- Lambda handlers are in src/handlers/ — use claudia.js conventions
- Never import from src/handlers/ in src/services/

# Git
- Use Conventional Commits: feat|fix|chore|docs|refactor(scope): message
- Always squash-merge PRs to main
- Branch naming: feat/*, fix/*, chore/*

# Testing
- Use Vitest for unit tests, Supertest for API integration tests
- Every new endpoint needs at least: happy path, 400, 401, 404 tests
- Mock external services using msw (Mock Service Worker)
- Test files live next to source: foo.ts → foo.test.ts

# Personal Preferences
- I prefer concise explanations — skip the preamble
- Always show the file path before code changes
- When writing commit messages, include the ticket number from the branch name

# Environment
- I use VSCode with Prettier (format on save)
- After editing a file, no need to run formatters — it happens automatically
- My terminal is iTerm2 with Zsh

# Communication
- When unsure, ask before making changes
- If a change touches more than 5 files, show me the plan first
- Explain trade-offs when suggesting architectural decisions

# Tools
- Use gh CLI for all GitHub operations
- Prefer npx over global installs
- Use jq for JSON processing in bash

# Security
- Never commit .env files or secrets
- Always check for hardcoded credentials before committing
- Flag any use of eval() or unsanitised user input

# Frontend Stack
- Framework: Vue 3 with Composition API (<script setup>)
- State: Pinia stores in src/stores/
- Styling: Tailwind CSS — no custom CSS unless absolutely necessary
- Testing: Vitest + Vue Test Utils
- Always use TypeScript, never plain JS in .vue files

# Mobile Stack
- Framework: React Native 0.74+ with TypeScript
- Navigation: React Navigation v6
- State: Zustand for local, React Query for server state
- Testing: Jest + React Native Testing Library
- Always handle both iOS and Android edge cases

# .claude/commands/review-security.md
Perform a security review of the current changes:
1. Check for SQL injection, XSS, CSRF vulnerabilities
2. Verify all user inputs are validated with Zod
3. Ensure no secrets are hardcoded
4. Check auth middleware is applied to protected routes
Focus on: $ARGUMENTS

# .claude/commands/new-endpoint.md
Create a new API endpoint following our conventions:
1. Add the OpenAPI spec to api/openapi.yaml
2. Generate the route in src/routes/
3. Create the service in src/services/
4. Write tests covering 200, 400, 401, 404
Endpoint: $ARGUMENTS

// .claude/settings.json
{ "hooks": { "PostToolUse": [
  { "matcher": "Write|Edit",
    "hooks": [{ "type": "command",
      "command": "npx eslint --fix $CLAUDE_FILE_PATH",
      "timeout": 15 }] }
] } }

// PreToolUse hook: exit code 2 = BLOCK the action
{ "matcher": "Bash",
  "hooks": [{ "type": "command",
    "command": "echo $CLAUDE_TOOL_INPUT | grep -qE 'rm -rf|drop table' && exit 2 || exit 0" }] }

{ "matcher": "Write|Edit",
  "hooks": [{ "type": "command",
    "command": "npm test -- --related $CLAUDE_FILE_PATH",
    "timeout": 60 }] }

{
  "mcpServers": {
    "browser": {
      "command": "npx",
      "args": ["@anthropic-ai/mcp-server-browser"]
    },
    "postgres": {
      "command": "npx",
      "args": ["@anthropic-ai/mcp-server-postgres", "postgresql://..."]
    }
  }
}

.claude/skills/
  deploy-checker/
    SKILL.md         # Main instructions
    scripts/
      check-deploy.sh  # Helper script
    reference/
      deploy-checklist.md  # Reference doc

/plugin install anthropic/code-review
/plugin install anthropic/memory

# .claude/agents/security-reviewer.md
---
description: "Reviews code changes for security vulnerabilities"
allowed-tools: Read, Grep, Glob
model: opus
---
You are a security reviewer. Analyse the given code for:
- Injection vulnerabilities (SQL, NoSQL, command, XSS)
- Authentication/authorization flaws
- Sensitive data exposure
- Insecure dependencies

"Implement the user notifications feature:
1. Read the spec in docs/notifications-spec.md
2. Implement the backend endpoints
3. Write comprehensive tests
4. Review for security issues
5. Update the OpenAPI spec
6. Create the PR with a full description"

import { claude } from "@anthropic-ai/claude-code";

const result = await claude({
  prompt: "Run tests and fix any failures",
  workingDirectory: "./my-project",
  allowedTools: ["Bash", "Read", "Write", "Edit"],
  model: "sonnet"
});

# .github/workflows/claude-review.yml
- name: Claude Code Review
  uses: anthropics/claude-code-action@v1
  with:
    prompt: "Review this PR for bugs, security, and style"
    allowed_tools: "Read,Grep,Glob"

claude -p "Verify this branch is ready to merge:
  1. All tests pass
  2. No TODO/FIXME markers
  3. OpenAPI spec matches implementation
  4. No console.log statements in production code"
  --allowedTools Bash,Read,Grep

# Every morning at 9am — pull latest, run tests, report failures
claude -p "Pull main, run full test suite, and if anything fails, create a GitHub issue with the details"

# Weekly on Monday — dependency audit
claude -p "Run npm audit and create a PR fixing critical vulnerabilities"

# Nightly — code quality report
claude -p "Analyse code quality metrics and post a summary to #engineering Slack"