flowstate-id-api Package Skill

Package: @epicdm/flowstate-id-api Repository: flowstate-platform Path: packages/worker-id-api Version: 0.0.1

Use this published Dojo skill as the package-level entrypoint. For detailed workflows, use the package-local skills listed below.

Primary Package Workflow

Identity API Tenant RBAC

Status: Active Purpose: Help agents modify identity API routes without breaking tenant isolation or admin gates. Scope: packages/worker-id-api Trigger: Route, schema, middleware, or test work for /auth/* identity endpoints. Input: Target route behavior, expected tenant collection, auth requirements. Output: Source and tests that preserve tenant-scoped RBAC behavior.

Workflow

1. Start at src/index.ts and confirm middleware order. /auth/* gets createTenantMiddleware(). Admin route groups also get requireAdminMiddleware() for exact and wildcard paths.
2. Edit the matching route factory under src/routes/ and the matching Zod/OpenAPI schemas under src/schemas/.
3. Use TenantClient methods from src/lib/tenant-client.ts; do not add direct D1 access in this package.
4. Preserve tenant selectors. Most reads and writes must include tenant.orgId, tenant.tenantUserId, active status, or collection-specific scope fields.
5. Return through ok, created, noContent, and err from @epicdm/flowstate-api-core where local route patterns already use them.
6. Add or update tests in test/routes/ and middleware tests when auth behavior changes.

Source Map

Example

For a membership route change:

1. Check src/routes/memberships.ts for collection names and active membership rules.
2. Check src/schemas/memberships.ts for request validation.
3. Add a test in test/routes/memberships.test.ts that asserts the tenant client query includes orgId.

Verification

• yarn test test/routes/<area>.test.ts
• yarn typecheck
• yarn generate:openapi when OpenAPI route metadata or schemas changed.

Composition

• Use flowstate-id-api-token-lifecycle for token routes.
• Use flowstate-rxdb-d1-rest-rbac when the failure is in tenant worker REST enforcement rather than this API wrapper.

Package Skill Inventory

worker-id-api Skill Inventory

Package: @epicdm/flowstate-id-api Purpose: Identity, RBAC, schema permission, invitation, service account, and token API over tenant worker collections.

Composition

• Compose with packages/worker-rxdb-d1/.flowstate/skills/flowstate-rxdb-d1-rest-rbac when a route bug crosses into tenant worker REST behavior.
• Compose with packages/worker-mcp/.flowstate/skills/flowstate-mcp-tenant-tool-proxy when MCP RBAC tools call identity data indirectly through tenant dispatch.

Exclusions

• Do not create one skill per route file. The route groups share the same middleware, tenant client, response helpers, and test pattern.
• Do not write Dojo output from this pass. Local package skills are the source of truth.

Review Gate

worker-id-api Skill Review

Reviewed: 2026-06-30 Result: Pass for local agent use.

Checks

• Skills are based on source files and tests, not generated feature lists.
• Each skill has YAML frontmatter with name and trigger-focused description.
• Skills identify concrete routes, schemas, middleware, commands, and cross-package composition.
• Scope is package-local and limited to .flowstate/skills.

Follow-up

• Re-run after any new route group is added to src/index.ts.
• If token format changes in src/lib/helpers.ts, update flowstate-id-api-token-lifecycle.

Start with this skill to understand the package purpose, then use the package-local focused skills for specific workflows. Keep this Dojo version aligned with packages/worker-id-api/package.json. Do not treat generated feature lists as lessons; use workflow evidence from CODE-REVIEW.md, SKILL-INVENTORY.md, and REVIEW.md.