bdaylist

Use ao implementar ou revisar QUALQUER feature de backend do BdayList no Supabase (Postgres + RLS + Edge Functions). Cobre motor de reserva atômico/idempotente, modelo de dados, contratos de RPC/endpoint, notificações e enriquecimento de link. Invoque para reserva/cancelamento de presente, RSVP, recados, jobs/cron, e quando o frontend precisar do shape correto dos payloads.

Use ao criar/alterar tabelas, policies RLS, Edge Functions ou qualquer superfície que toque PII de convidados, token de compartilhamento, ou enriquecimento de link no BdayList. Garante RLS fail-closed, privacidade da opção "surpresa", anti-SSRF/XSS e conformidade LGPD (dados em São Paulo). Invoque antes de mergear qualquer mudança de schema ou de autorização.

Specialize Blue Spec in a specific security area, from a source or topic you give it. It reads the material and distills it into a focused, defense-only sub-skill, shaped exactly like the built-in ones, so `/bluespec.skills` loads it afterwards like any other. It only audits and explains — it never writes attack inputs or exploits, and it never touches your code.

Establish or update the project's security charter, the safe-by-default principles every later Blue Spec phase must respect. Proposes a charter when run with no input, or follows the input when given.

Detect what the system actually does by reading the code, and map the security-relevant findings (login, uploads, payments, data exposure, and so on) with the evidence later phases need. Scans the whole project, specific files, or a focused scope, depending on the input.

Apply the defense plan's fixes to the code, safely and one at a time, then record what was applied and what is left. Reads the defense plan and the charter, then hardens every fix, just the fixes, files, or directories you name, or the priorities you choose.

List the findings Blue Spec is tracking, by name. It reads `.bluespec/tracking.json` through a hook and prints each tracked finding's name. It has no dependency on any phase and changes nothing, it only reads and reports. If nothing is tracked yet, it says so.

Turn what detect found into the defense plan, with a fix for each finding, its priority, and the charter principle it upholds. Reads the detect map and the charter, then plans every finding, just the files or directories you name, or a specific concern you describe.

Repair Blue Spec's internal tracking so each item stays whole when files are renamed or moved. This is a maintenance pass, not a security phase. It reads every artifact and the project's current code, works out the truth, and rewrites the tracking map across all phases at once. The other commands run it for you when they notice the tracking is inconsistent. It never edits your artifacts and never authors security content.

Load an on-demand security sub-skill and apply it to your code. Sub-skills are focused, language-agnostic knowledge modules that are not loaded by default and are never invoked directly. This command is the single door to them, name a sub-skill to run it, or run it with no input to see what is available. It reads and reports, the calling phase decides what to record.

Prove each applied control holds by reading the code and confronting it with the hardening record, then stand the findings proven closed down out of the chain. Reads the hardening record and the charter, then verifies every applied control, just the controls, files, or directories you name, or the priorities you choose. Read-only on your code, it only writes Blue Spec's own chain.