tomevault-io Technical Specification Writer Skill
Instructions
- Analyze requirements and determine technical approach
- Design system architecture and components
- Define data models and schemas
- Specify API contracts (endpoints, request/response formats)
- Identify technology stack and libraries
- Document integration points and interfaces
- Define configuration and deployment requirements
- Include code examples and patterns when helpful
Examples
Input: "User authentication system" Output:
## Technical Specifications
### Architecture
- **Pattern**: RESTful API with JWT authentication
- **Framework**: Express.js (Node.js)
- **Database**: PostgreSQL with Prisma ORM
- **Authentication**: JWT tokens stored in HTTP-only cookies
### Data Models
#### User Model
```typescript
{
id: string (UUID, primary key)
email: string (unique, indexed)
passwordHash: string (bcrypt, 60 chars)
createdAt: DateTime
updatedAt: DateTime
emailVerified: boolean
}
PasswordResetToken Model
{
id: string (UUID, primary key)
userId: string (foreign key -> User.id)
token: string (random 32-char hex, indexed)
expiresAt: DateTime
used: boolean
createdAt: DateTime
}
API Endpoints
POST /api/auth/register
Request:
{
"email": "user@example.com",
"password": "SecurePass123!"
}
Response (201):
{
"user": {
"id": "uuid",
"email": "user@example.com",
"emailVerified": false
}
}
Errors:
- 400: Invalid email format or weak password
- 409: Email already exists
POST /api/auth/login
Request:
{
"email": "user@example.com",
"password": "SecurePass123!"
}
Response (200):
{
"user": {
"id": "uuid",
"email": "user@example.com"
},
"token": "jwt.token.here"
}
Errors:
- 401: Invalid credentials
Technology Stack
- Runtime: Node.js 18+
- Framework: Express.js 4.x
- Database: PostgreSQL 14+
- ORM: Prisma 5.x
- Authentication: jsonwebtoken, bcrypt
- Validation: zod
- Testing: Jest, Supertest
Security Considerations
- Passwords hashed with bcrypt (10+ rounds)
- JWT tokens expire after 24 hours
- Password reset tokens expire after 1 hour
- Rate limiting: 5 requests/minute for auth endpoints
- CORS configured for specific origins only
## Format Guidelines
- Use clear section headers
- Include code examples for data models and APIs
- Specify exact versions for libraries when important
- Document error responses and status codes
- Include security and performance considerations
- Use standard formats (OpenAPI for APIs, ERD for data models)
---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/lexicalninja) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-16 -->