flowstate-epic-flowstate-apps-epicdm-flowstate-app-vault
Package-local agent skill for @epicdm/flowstate-app-vault.
Tags
Publisher
Versions
1 version published — latest: 1.0.0
- 1.0.0publishedInvalid Date
Skill
flowstate-app-vault Package Skill
Package: @epicdm/flowstate-app-vault
Repository: epic-flowstate-apps
Path: packages/flowstate-app-vault
Version: 1.0.0
Use this published Dojo skill as the package-level entrypoint. For detailed workflows, use the package-local skills listed below.
Primary Package Workflow
FlowState Vault App
Status: Active
Purpose: Maintain Vault app changes without weakening crypto, access, or MCP boundaries.
Scope: packages/flowstate-app-vault.
Trigger: Use when changing Vault app routing, pages, hooks, plugin metadata, setup, items, service keys, sharing, audit, or rotation.
Input: src/plugin.ts, flowstate.plugin.json, src/index.ts, touched pages/hooks/context/tests.
Output: Vault changes with explicit security workflow and verification.
Workflow
1. Check App Integration
Confirm vaultPlugin id vault, route /apps/vault, base path /vault, and sidebar links for /home and /service-keys.
2. Route By Safety Boundary
Use vault-crypto-unlock for setup, unlock, auto-lock, key ring, or recovery. Use vault-items-service-keys for encrypted items and service keys. Use vault-sharing-audit-rotation for members, roles, audit logs, and key rotation.
3. Verify Tests Exist For The Area
Vault has Jest tests for crypto context, setup, unlock/recovery, rotation banner, service keys, vault pages, members, and item hooks. Prefer targeted tests plus package typecheck.
Verification
Run yarn workspace @epicdm/flowstate-app-vault typecheck and yarn workspace @epicdm/flowstate-app-vault test. Build after plugin/page changes.
Composition
Composes with @epicdm/flowstate-crypto, collection model skills, and MCP gateway/server skills.
Pitfalls
- Do not edit
.flowstate/dojo. - Do not persist plaintext payloads.
- Do not bypass membership access checks for locked users.
- Do not treat MCP calls as available without
useMcpClientconfig.
Done When
App integration, selected safety workflow, tests, and security assumptions are all documented and verified.
Package Skill Inventory
Package Skill Inventory: @epicdm/flowstate-app-vault
Package Context
Vault skills must be workflow- and safety-oriented. The package has security boundaries that should not be flattened into feature lists.
Skill Map
| Skill | Type | Trigger | Teaches | Evidence | Depends On | Dojo |
|---|---|---|---|---|---|---|
flowstate-app-vault | orchestrator | Maintaining Vault app package | Plugin, pages, hooks, verification, safety routing | src/plugin.ts, flowstate.plugin.json, src/index.ts | crypto, collections | ready-after-review |
vault-crypto-unlock | workflow | Changing setup, master password, unlock, auto-lock, or recovery | CryptoProvider, setup config, recovery PDF | CryptoContext.tsx, setup/*, RecoveryUnlock.tsx, tests | flowstate-crypto | ready-after-review |
vault-items-service-keys | workflow | Changing encrypted items or service keys | Encrypt/decrypt/create/update/delete flows | useVaultItems.ts, useServiceKeys.ts, pages/tests | collections, crypto | ready-after-review |
vault-sharing-audit-rotation | workflow | Changing members, sharing, audit, or key rotation | MCP tools, membership access, wrapped keys | useVaultMembers.ts, useVaultSharing.ts, useVaultAudit.ts, useKeyRotation.ts | MCP gateway, crypto | ready-after-review |
Anti-Sprawl Decision: Four skills match distinct safety domains; splitting further would duplicate setup and verification.
Feature Coverage
| Feature Group | Source Evidence | Covered By | Notes |
|---|---|---|---|
| Plugin/app/pages | source plugin, manifest, pages | flowstate-app-vault | No manifest commands. |
| Crypto/setup/unlock/recovery | context/setup/components/utils/tests | vault-crypto-unlock | Security-critical. |
| Items/service keys | hooks/pages/tests | vault-items-service-keys | Encrypt before persist. |
| Members/sharing/audit/rotation | hooks/MCP utils/tests | vault-sharing-audit-rotation | Runtime MCP dependency. |
Composition Model
Use orchestrator first. Use crypto skill before any workflow that touches plaintext or unlock state. Use sharing/audit/rotation for access-control and MCP workflows.
Deferred Skills
- Presentation metadata reference deferred;
src/lib/presentation.tsxis display-only unless status/type semantics change. - Gap-analysis skill deferred; consult
VAULT_GAP_ANALYSIS.mdmanually for roadmap work.
Review Questions
- Which MCP gateway base URL should tests/smokes use?
- Should plugin manifest eventually declare Vault commands?
Review Gate
Package Skills Review: @epicdm/flowstate-app-vault
Verdict
Pass
Findings
| Severity | Skill | Issue | Evidence | Required Fix |
|---|---|---|---|---|
| Minor | vault-sharing-audit-rotation | MCP behavior is partly external to this package. | utils/mcpClient.ts, MCP tool names in hooks. | Keep external dependency noted in future edits. |
Coverage
| Feature Group | Status | Skill | Notes |
|---|---|---|---|
| Plugin/app | Covered | flowstate-app-vault | No manifest commands. |
| Crypto/setup/unlock | Covered | vault-crypto-unlock | Tests exist. |
| Items/service keys | Covered | vault-items-service-keys | Encryption rules explicit. |
| Sharing/audit/rotation | Covered | vault-sharing-audit-rotation | MCP dependency noted. |
Drift and Contract Risks
| Area | Risk | Evidence | Decision |
|---|---|---|---|
| MCP | Tool behavior lives outside package. | Hook tool calls. | Record dependency. |
| Legacy items | Old payload formats rejected. | useVaultItems.ts. | Skill warns agents. |
| Dojo | Generated prototype. | .flowstate/dojo/*. | Leave untouched. |
Dojo Publication Decision
Ready after local review, with MCP dependency called out. Do not publish generated Dojo prototypes.
Follow-Up Work
- Add MCP contract tests or mocks for audit and rotation hooks.
- Review
VAULT_GAP_ANALYSIS.mdbefore roadmap-driven skill expansion.
Usage
Start with this skill to understand the package purpose, then use the package-local focused skills for specific workflows. Keep this Dojo version aligned with packages/flowstate-app-vault/package.json. Do not treat generated feature lists as lessons; use workflow evidence from CODE-REVIEW.md, SKILL-INVENTORY.md, and REVIEW.md.
Install
Run this in your project to install via CLI:
fscloud dojo skill install flowstate-epic-flowstate-apps-epicdm-flowstate-app-vault --target <target> --out ./skillsReplace <target> with your agent target identifier. See the CLI docs for details.