brainstorm-prompt-optimizer

# [Core Action] — [Target Domain]

## Problem Statement
[What problem does this solve? Who has it?]

## Core Feature
[What should the system do? Focus on behavior, not implementation]

## Target Users
[Who will use this? What's their goal?]

 
---
 
## EARS Syntax Reference
 
Use EARS (Easy Approach to Requirements Syntax) for requirements:
 
| Form | Pattern | Example |
|------|---------|---------|
| **Event-driven** | `WHEN <event> THEN the system SHALL <action>` | `WHEN the user clicks "Submit" THEN the system SHALL validate the form data` |
| **State-driven** | `WHEN <system state> THEN the system SHALL <action>` | `WHEN the session expires THEN the system SHALL clear user data` |
| **Generic** | `The system SHALL <action>` | `The system SHALL encrypt all stored passwords with bcrypt` |
| **Feature** | `IF <feature> THEN the system SHALL <action>` | `IF multi-factor auth is enabled THEN the system SHALL require second factor` |
| **Negative** | `IF <unwanted condition> THEN the system SHALL NOT <action>` | `IF SQL input detected THEN the system SHALL reject with 400` |
 
Mandatory keywords: **SHALL**, **WILL**, **MAY**
Forbidden words: "robust", "intuitive", "fast", "scalable", "efficient", "user-friendly"
 
---
 
## Acceptance Criteria Taxonomy
 
Every success criterion MUST be tagged:
 
| Tag | Meaning | Generates Tasks? |
|-----|---------|------------------|
| `[IMP]` | Requires new code, configuration, or explicit behavior | **YES** |
| `[SEF]` | Natural automatic consequence of an `[IMP]` criterion | NO (verify in e2e) |
| `[EXT]` | Verified by external tools or user observation | NO (e2e checkpoint) |
 
**60% Rule**: At least 60% of criteria should be `[IMP]`.
 
---
 
## Prompt Templates by Category
 
### Authentication & User Management
 
```optimized-prompt
# Add [Feature] — User Management
 
## Problem Statement
[Describe the problem users face without this feature]
 
## Core Feature
The system SHALL [describe what the feature does, focus on behavior]
 
## Target Users
- **Primary**: [main user type]
- **Secondary**: [other affected users]
 
## User Flows
1. **Primary Flow**: [Step by step from user perspective]
2. **Alternative Flow**: [If applicable]
 
## Data Requirements
- User entity: [fields]
- [Other entities involved]
 
## Success Criteria
- [IMP] [Criterion 1 — testable outcome requiring code]
- [IMP] [Criterion 2]
- [SEF] [Criterion 3 — automatic consequence]
- [EXT] [Criterion 4 — verified externally]
 
## Non-Goals
- **Social Login**: No OAuth providers (Google, GitHub, etc.)
- **Password Reset**: Not included in this specification
- **Two-Factor Auth**: Not included in this specification
 
## Negative Requirements
- REQ-NR001: The system SHALL NOT store passwords in plain text; it SHALL use bcrypt with cost factor ≥12
- REQ-NR002: The system SHALL NOT expose user existence through login error messages

# [Feature Name] — API Layer
 
## Problem Statement
[What integration need or capability gap exists]
 
## Core Feature
The system SHALL provide [describe the API behavior]
 
## Target Users
- **Primary**: [API consumers]
- **Secondary**: [administrators]
 
## User Flows
1. **Happy Path**: [Request → Validation → Response]
2. **Error Path**: [Invalid input → Error response]
 
## API Contract
- Endpoint: [path and method]
- Input: [what the API receives]
- Output: [what the API returns]
- Error cases: [failure modes with codes]
 
## Data Model
- [Entities involved]
- [Relationships]
 
## Success Criteria
- [IMP] [Criterion 1]
- [IMP] [Criterion 2]
- [SEF] [Criterion 3]
 
## Non-Goals
- **GraphQL**: REST only
- **Async Processing**: Synchronous only
- **Caching**: Not included
 
## Negative Requirements
- REQ-NR001: IF user input is used in SQL query THEN the system SHALL NOT concatenate directly
- REQ-NR002: The system SHALL NOT expose internal error details to clients

# [Feature Name] — User Interface
 
## Problem Statement
[What user experience gap exists]
 
## Core Feature
The user SHALL be able to [describe user action and system response]
 
## Target Users
- **Primary**: [end users]
- **Secondary**: [admin users if applicable]
 
## User Flows
1. **Entry**: [How user accesses this feature]
2. **Interaction**: [Primary user action]
3. **Outcome**: [Result user sees]
4. **Error**: [Error handling for invalid input]
 
## UI Requirements
- Layout: [description]
- Components: [key UI elements]
- Feedback: [success/error/loading states]
 
## Responsive Behavior
- Desktop: [behavior]
- Mobile: [behavior]
 
## Success Criteria
- [IMP] [Criterion 1 — visible behavior]
- [IMP] [Criterion 2]
- [IMP] [Criterion 3]
- [SEF] [Criterion 4 — automatic]
 
## Non-Goals
- **Real-time Updates**: No WebSocket or SSE
- **Offline Mode**: Not included
- **Accessibility Features**: [specific exclusions]
 
## Negative Requirements
- REQ-NR001: The system SHALL NOT display raw error messages to users
- REQ-NR002: The system SHALL NOT allow XSS through user input fields

# [Feature Name] — Data Processing
 
## Problem Statement
[What data challenge exists]
 
## Core Feature
The system SHALL [describe data transformation/processing behavior]
 
## Target Users
- **Primary**: [who benefits]
- **Secondary**: [who monitors]
 
## User Flows
1. **Data Input**: [Source and format]
2. **Processing**: [Transformation steps]
3. **Output**: [Result destination and format]
 
## Data Quality
- Validation: [rules]
- Error handling: [for bad data]
 
## Performance Constraints
- Volume: [expected data size]
- Latency: [expected processing time]
 
## Success Criteria
- [IMP] [Criterion 1]
- [IMP] [Criterion 2]
- [EXT] [Criterion 3 — external verification]
 
## Non-Goals
- **Real-time Processing**: Batch only
- **Data Export**: Not included
- **Backup/Restore**: Not included
 
## Negative Requirements
- REQ-NR001: The system SHALL NOT lose data on processing failure
- REQ-NR002: The system SHALL NOT process unbounded data without pagination

Add user authentication

# Add User Authentication — Authentication Layer
 
## Problem Statement
Users cannot securely access the system. They need a way to prove their identity and access their personalized content.
 
## Core Feature
The system SHALL provide email/password authentication that allows users to:
- Register with a valid email address and secure password
- Log in with registered credentials
- Maintain an authenticated session across requests
- Log out to terminate their session
 
## Target Users
- **Primary**: End users who need to access personalized features
- **Secondary**: Administrators who manage user accounts
 
## User Flows
1. **Registration**: User enters email → receives confirmation → sets password → account created
2. **Login**: User enters credentials → validated → session established → redirected to dashboard
3. **Logout**: User clicks logout → session terminated → redirected to login page
 
## Data Requirements
- User entity: email, hashed_password, created_at, updated_at
- Session entity: user_id, token, expiration
 
## Success Criteria
- [IMP] Users can register with email/password
- [IMP] Users can log in with valid credentials
- [IMP] Invalid credentials show generic error message
- [IMP] Users can log out
- [IMP] Session persists across page navigation
- [IMP] Expired sessions require re-login
 
## Non-Goals
- **Social Login**: No OAuth providers (Google, GitHub, etc.)
- **Password Reset**: Not included in this specification
- **Two-Factor Authentication**: Not included in this specification
 
## Negative Requirements
- REQ-NR001: The system SHALL NOT store passwords in plain text; it SHALL use bcrypt with cost factor ≥12
- REQ-NR002: The system SHALL NOT expose user existence through login error messages; it SHALL use generic "invalid credentials" for both cases
- REQ-NR003: The system SHALL NOT allow weak passwords (minimum 8 characters, mixed case, number)

Better search for products

# Improve Product Search — Product Discovery
 
## Problem Statement
Users cannot find products they are looking for using the current search. Results are not relevant, don't match user intent, and sorting is not useful.
 
## Core Feature
The system SHALL provide enhanced product search that allows users to:
- Search products by name, description, and category
- Receive results ranked by relevance to search terms
- Filter results by category, price range, and availability
- Sort results by relevance, price, or newest
 
## Target Users
- **Primary**: Shoppers looking for specific products
- **Secondary**: Browsers exploring product catalog
 
## User Flows
1. **Direct Search**: User enters search terms → results displayed → user selects product
2. **Filtered Search**: User enters terms → applies filters → refined results → user selects product
3. **Empty Results**: User enters terms → no results → suggestion displayed
 
## Search Behavior
- Minimum 2 characters to trigger search
- Partial word matching for product names
- Search across: product name, description, category name, tags
- Results limited to 50 per page with pagination
 
## Filtering Options
- Category: single or multiple selection
- Price range: min/max with validation
- Availability: in-stock only toggle
 
## Sorting Options
- Relevance (default): based on search term match score
- Price: low-to-high or high-to-low
- Newest: by creation date descending
 
## Success Criteria
- [IMP] Search returns products matching the query terms
- [IMP] Search supports partial word matching
- [IMP] Category filter limits results to selected category
- [IMP] Price range filter shows products within min/max bounds
- [IMP] Results can be sorted by relevance, price, or date
- [IMP] Pagination allows navigation through large result sets
- [IMP] Empty search shows appropriate message with suggestions
 
## Non-Goals
- **Autocomplete**: Not included in this specification
- **Search Analytics**: Not included in this specification
- **Personalized Results**: Results are the same for all users
- **Image Search**: Not included in this specification
 
## Negative Requirements
- REQ-NR001: The system SHALL NOT expose product inventory details in search results unless explicitly needed
- REQ-NR002: The system SHALL NOT allow SQL injection through search terms; it SHALL sanitize all input
- REQ-NR003: The system SHALL NOT return results beyond configured pagination limits per request

Implement Redis caching for API responses

# Implement API Response Caching — Performance Optimization
 
## Problem Statement
The API is slow for frequently requested data. Repeated requests for the same resources consume unnecessary server resources and increase response times for users.
 
## Core Feature
The system SHALL cache frequently accessed API responses to reduce response times and server load:
- Cache GET requests for defined intervals
- Return cached responses when data hasn't changed
- Invalidate cache when underlying data changes
- Provide cache statistics for monitoring
 
## Target Users
- **Primary**: API consumers (frontend applications, mobile apps)
- **Secondary**: System administrators monitoring performance
 
## Cache Behavior
- Cache key based on request URL and parameters
- Default TTL: 5 minutes (configurable per endpoint)
- Cache stores: response body, status code, headers
- Cache miss: fetch from source, store, return
 
## Invalidation Rules
- Cache invalidated when source data is modified via POST/PUT/PATCH/DELETE
- Manual invalidation available via admin endpoint
- Bulk invalidation by cache key pattern
 
## Success Criteria
- [IMP] Cached requests return within 50ms
- [IMP] Cache hit rate visible in metrics
- [IMP] Manual cache invalidation works
- [IMP] Automatic invalidation on data changes
- [IMP] Cache can be disabled per request via header
- [SEF] Cache reduces database load for repeated requests
- [EXT] Response time improvement measurable via APM
 
## Non-Goals
- **Distributed Cache**: Single Redis instance only
- **Cache Warming**: Not included
- **Cache Partitioning**: Not included
- **Multi-Tenant Isolation**: Not included in this specification
 
## Negative Requirements
- REQ-NR001: The system SHALL NOT cache responses containing user-specific data
- REQ-NR002: The system SHALL NOT serve stale cache beyond configured TTL
- REQ-NR003: The system SHALL NOT expose cache internals in API responses
- REQ-NR004: IF cache connection fails THEN the system SHALL fall back to direct database access without error

# Copy the optimized prompt and use it with brainstorm
/specs.brainstorm [paste optimized prompt here]

Raw Idea → brainstorm-prompt-optimizer → Optimized Prompt → /specs.brainstorm → Functional Spec → /specs.spec-to-tasks → Tasks