@1aboveio/skills 0.0.0-stage → 1.0.0

package/skills/app-dev/shadcn/rules/icons.md

@@ -0,0 +1,103 @@
+# Icons
+
+**Always use the project's configured `iconLibrary` for imports.** Check the `iconLibrary` field from project context: `lucide` → `lucide-react`, `tabler` → `@tabler/icons-react`, etc. Never assume `lucide-react`.
+
+---
+
+## Icons in Button use data-icon attribute
+
+Add `data-icon="inline-start"` (prefix) or `data-icon="inline-end"` (suffix) to the icon. No sizing classes on the icon.
+
+**Incorrect:**
+
+```tsx
+<Button>
+  <SearchIcon className="mr-2 size-4" />
+  Search
+</Button>
+```
+
+**Correct:**
+
+```tsx
+<Button>
+  <SearchIcon data-icon="inline-start"/>
+  Search
+</Button>
+
+<Button>
+  Next
+  <ArrowRightIcon data-icon="inline-end"/>
+</Button>
+```
+
+---
+
+## No sizing classes on icons inside components
+
+Components handle icon sizing via CSS. Don't add `size-4`, `w-4 h-4`, or other sizing classes to icons inside `Button`, `DropdownMenuItem`, `Alert`, `Sidebar*`, or other shadcn components. Unless the user explicitly asks for custom icon sizes.
+
+**A sizing class doesn't just duplicate the default — it disables it.** The rule components ship is `[&_svg:not([class*='size-'])]:size-4`: the component sizes any descendant `svg` *that does not already carry a `size-` class*. So writing `size-4` opts that icon out of the component's sizing entirely and pins it, which is why it looks harmless at the default size and then fails to scale. `Button`'s smaller variants set `size-3` / `size-3.5` through the same selector, so a hardcoded `size-4` inside a `size="sm"` button is visibly wrong.
+
+**Incorrect:**
+
+```tsx
+<Button>
+  <SearchIcon className="size-4" data-icon="inline-start" />
+  Search
+</Button>
+
+<DropdownMenuItem>
+  <SettingsIcon className="mr-2 size-4" />
+  Settings
+</DropdownMenuItem>
+```
+
+**Correct:**
+
+```tsx
+<Button>
+  <SearchIcon data-icon="inline-start" />
+  Search
+</Button>
+
+<DropdownMenuItem>
+  <SettingsIcon />
+  Settings
+</DropdownMenuItem>
+```
+
+---
+
+## Pass icons as component objects, not string keys
+
+Use `icon={CheckIcon}`, not a string key to a lookup map.
+
+**Incorrect:**
+
+```tsx
+const iconMap = {
+  check: CheckIcon,
+  alert: AlertIcon,
+}
+
+function StatusBadge({ icon }: { icon: string }) {
+  const Icon = iconMap[icon]
+  return <Icon />
+}
+
+<StatusBadge icon="check" />
+```
+
+**Correct:**
+
+```tsx
+// Import from the project's configured iconLibrary (e.g. lucide-react, @tabler/icons-react).
+import { CheckIcon } from "lucide-react"
+
+function StatusBadge({ icon: Icon }: { icon: React.ComponentType }) {
+  return <Icon />
+}
+
+<StatusBadge icon={CheckIcon} />
+```

package/skills/app-dev/shadcn/rules/styling.md

@@ -0,0 +1,167 @@
+# Styling & Customization
+
+See [customization.md](../customization.md) for theming, CSS variables, and adding custom colors.
+
+## Contents
+
+- Semantic colors
+- No raw color values for status/state indicators (and the real Badge variant list)
+- Built-in variants first
+- className for layout only
+- No space-x-* / space-y-*
+- Prefer size-* over w-* h-* when equal
+- Prefer truncate shorthand
+- No manual dark: color overrides
+- Use cn() for conditional classes
+- No manual z-index on overlay components
+
+---
+
+## Semantic colors
+
+**Incorrect:**
+
+```tsx
+<div className="bg-blue-500 text-white">
+  <p className="text-gray-600">Secondary text</p>
+</div>
+```
+
+**Correct:**
+
+```tsx
+<div className="bg-primary text-primary-foreground">
+  <p className="text-muted-foreground">Secondary text</p>
+</div>
+```
+
+---
+
+## No raw color values for status/state indicators
+
+For positive, negative, or status indicators, use Badge variants, semantic tokens like `text-destructive`, or define custom CSS variables — don't reach for raw Tailwind colors.
+
+**Incorrect:**
+
+```tsx
+<span className="text-emerald-600">+20.1%</span>
+<span className="text-green-500">Active</span>
+<span className="text-red-600">-3.2%</span>
+```
+
+**Correct:**
+
+```tsx
+<Badge variant="secondary">+20.1%</Badge>
+<Badge>Active</Badge>
+<span className="text-destructive">-3.2%</span>
+```
+
+**`Badge` ships exactly five variants: `default`, `secondary`, `destructive`, `outline`, `ghost`.** There is no `success` or `warning` variant — writing `<Badge variant="success">` silently falls back to the default styling, which is why it's such an easy mistake to ship. Negative states have a real token (`destructive`); positive ones don't.
+
+So for a success/positive color: use `variant="secondary"` if the color isn't carrying meaning on its own, or add a `--success` CSS variable to the theme and a matching variant (see [customization.md](../customization.md)) if it is. Ask the user before adding the variable — it's a theme change, not a local one.
+
+---
+
+## Built-in variants first
+
+**Incorrect:**
+
+```tsx
+<Button className="border border-input bg-transparent hover:bg-accent">
+  Click me
+</Button>
+```
+
+**Correct:**
+
+```tsx
+<Button variant="outline">Click me</Button>
+```
+
+---
+
+## className for layout only
+
+Use `className` for layout (e.g. `max-w-md`, `mx-auto`, `mt-4`), **not** for overriding component colors or typography. To change colors, use semantic tokens, built-in variants, or CSS variables.
+
+**Incorrect:**
+
+```tsx
+<Card className="bg-blue-100 text-blue-900 font-bold">
+  <CardContent>Dashboard</CardContent>
+</Card>
+```
+
+**Correct:**
+
+```tsx
+<Card className="max-w-md mx-auto">
+  <CardContent>Dashboard</CardContent>
+</Card>
+```
+
+To customize a component's appearance, prefer these approaches in order:
+1. **Built-in variants** — `variant="outline"`, `variant="destructive"`, etc.
+2. **Semantic color tokens** — `bg-primary`, `text-muted-foreground`.
+3. **CSS variables** — define custom colors in the global CSS file (see [customization.md](../customization.md)).
+
+---
+
+## No space-x-* / space-y-*
+
+Use `gap-*` instead. `space-y-4` → `flex flex-col gap-4`. `space-x-2` → `flex gap-2`.
+
+```tsx
+<div className="flex flex-col gap-4">
+  <Input />
+  <Input />
+  <Button>Submit</Button>
+</div>
+```
+
+---
+
+## Prefer size-* over w-* h-* when equal
+
+`size-10` not `w-10 h-10`. Applies to icons, avatars, skeletons, etc.
+
+---
+
+## Prefer truncate shorthand
+
+`truncate` not `overflow-hidden text-ellipsis whitespace-nowrap`.
+
+---
+
+## No manual dark: color overrides
+
+Use semantic tokens — they handle light/dark via CSS variables. `bg-background text-foreground` not `bg-white dark:bg-gray-950`.
+
+---
+
+## Use cn() for conditional classes
+
+Use the `cn()` utility from the project for conditional or merged class names. Don't write manual ternaries in className strings.
+
+**Incorrect:**
+
+```tsx
+<div className={`flex items-center ${isActive ? "bg-primary text-primary-foreground" : "bg-muted"}`}>
+```
+
+**Correct:**
+
+```tsx
+import { cn } from "@/lib/utils"   // the project's aliases.utils — don't assume this path
+
+<div className={cn("flex items-center", isActive ? "bg-primary text-primary-foreground" : "bg-muted")}>
+```
+
+`cn()` also merges conflicting Tailwind classes rather than concatenating them, so a caller's `className` reliably wins over a component's default. Template-literal concatenation leaves both classes in the string and lets specificity decide — which is why overrides "randomly" fail without it.
+
+---
+
+## No manual z-index on overlay components
+
+`Dialog`, `Sheet`, `Drawer`, `AlertDialog`, `DropdownMenu`, `Popover`, `Tooltip`, `HoverCard` handle their own stacking. Never add `z-50` or `z-[999]`.

package/skills/app-dev/zod-v4/LICENSE

@@ -0,0 +1,3 @@
+MIT License
+
+Copyright (c) 2026 1AboveIO

package/skills/app-dev/zod-v4/SKILL.md

@@ -0,0 +1,286 @@
+---
+name: zod-v4
+description: Zod v4 schema conventions and v3 migration for errors, validators, objects, enums, records, and async parsing.
+release-version: 0.36.0
+---
+**Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
+# Zod v3 to v4 Migration
+
+## Related Skills
+
+Use these skills by name when the Zod change is part of a larger stack-specific task:
+
+- `nextjs-fullstack` for App Router, Server Actions, and form boundaries
+- `better-auth` for auth/session schemas and validation flow updates
+- `prisma-setup` for schema-adjacent validation and DAL changes
+- `python-backend` for backend request/response validation patterns
+- `feishu-betterauth` for Feishu OAuth validation and callback payload handling
+- `monorepo` for shared schema packages and workspace structure
+- `code-validate` for post-change validation and checks
+- `e2e-test` for E2E coverage when validation changes affect user flows
+- `web-design-guidelines` for UI review after validation-driven form changes
+- `vercel-react-best-practices` for React/Next.js performance-sensitive form patterns
+- `app-debug` for runtime failures caused by validation or payload mismatches
+- `airflow` only when Zod-related config or payload contracts affect DAG tooling
+
+---
+
+## 1. Error Customization (Unified API)
+
+Zod v4 consolidates error handling into a single `error` parameter.
+
+### Remove These
+
+- `invalid_type_error`
+- `required_error`
+- `description` (if used for error messages)
+
+### Replace `message` with `error`
+
+```typescript
+// v3
+z.string({ message: "Required" })
+
+// v4
+z.string({ error: "Required" })
+```
+
+### Replace `errorMap` with `error` callback
+
+```typescript
+// v3
+z.string({
+  required_error: "Required",
+  invalid_type_error: "Bad type",
+})
+
+// v4
+z.string({
+  error: (issue) => issue.input === undefined ? "Required" : "Bad type"
+})
+```
+
+The error callback can return a string or `undefined` (to fall back to next error map).
+
+---
+
+## 2. String Validators (Top-Level)
+
+Many string refinements moved to top-level `z` namespace for better tree-shaking.
+
+| v3 | v4 |
+|----|-----|
+| `z.string().email()` | `z.email()` |
+| `z.string().uuid()` | `z.uuid()` |
+| `z.string().url()` | `z.url()` |
+| `z.string().cuid()` | `z.cuid()` |
+
+### IP/CIDR Changes
+
+```typescript
+// v3
+z.string().ip()
+z.string().cidr()
+
+// v4 - removed, use specific versions
+z.ipv4()
+z.ipv6()
+z.union([z.ipv4(), z.ipv6()])
+z.cidrv4()
+z.cidrv6()
+```
+
+**Note:** `z.uuid()` in v4 is stricter regarding RFC 9562 variant bits.
+
+---
+
+## 3. Object & Schema Definition
+
+### Strict/Passthrough
+
+```typescript
+// v3 - chaining
+z.object({ ... }).strict()
+z.object({ ... }).passthrough()
+
+// v4 - factories
+z.strictObject({ ... })
+z.looseObject({ ... })
+```
+
+### Extending Objects
+
+```typescript
+// v3
+Schema1.merge(Schema2)
+
+// v4 - prefer extend or destructuring
+Schema1.extend(Schema2.shape)
+
+// Best practice for TypeScript performance
+z.object({
+  ...Base.shape,
+  ...Additions.shape,
+})
+```
+
+### Deep Partial
+
+```typescript
+// v3
+z.deepPartial(schema)
+
+// v4 - REMOVED
+// Refactor or implement manual recursive partials
+```
+
+### Defaults Behavior Change
+
+`.default()` now short-circuits on `undefined`. Defaults inside optional fields are applied even if parent object is parsed.
+
+---
+
+## 4. Numbers & Coercion
+
+### Integers
+
+```typescript
+// v4: z.number().int() now only accepts SAFE integers
+z.number().int() // Rejects numbers outside safe integer range
+```
+
+### Floats
+
+```typescript
+// v4: z.number().safe() no longer accepts floats
+// Behaves like .int()
+```
+
+### Coercion
+
+```typescript
+// v4: z.coerce.string() treats input as unknown, not string
+z.coerce.string() // Input type is unknown
+```
+
+---
+
+## 5. Enums & Records
+
+### Native Enums
+
+```typescript
+// v3
+z.nativeEnum(MyEnum)
+
+// v4 - deprecated, use z.enum() directly
+z.enum(MyEnum) // Now supports native enum objects
+```
+
+### Records
+
+```typescript
+// v3 - single arg
+z.record(ValueSchema)
+
+// v4 - REMOVED, must specify key schema
+z.record(z.string(), ValueSchema)
+```
+
+### Record Exhaustiveness
+
+```typescript
+// v4: z.record(EnumSchema, ValueSchema) enforces ALL keys present
+z.record(StatusEnum, z.number()) // All enum values required
+
+// For optional keys, use partialRecord
+z.partialRecord(StatusEnum, z.number())
+```
+
+---
+
+## 6. Arrays & Tuples
+
+### Non-empty Arrays
+
+```typescript
+// v3: infers [T, ...T[]]
+z.array(T).nonempty()
+
+// v4: infers T[]
+z.array(T).nonempty()
+
+// For tuple type, use
+z.tuple([T], T) // [T, ...T[]]
+```
+
+---
+
+## 7. Async & Functions
+
+### Promises
+
+```typescript
+// v3
+z.promise(z.string())
+
+// v4 - DEPRECATED
+// Await values before parsing instead
+```
+
+### Functions
+
+```typescript
+// v3
+z.function().args(z.string()).returns(z.number())
+
+// v4 - factory function
+z.function({
+  input: [z.string()],
+  output: z.number(),
+})
+```
+
+---
+
+## 8. Error Handling Utilities
+
+### Formatting Errors
+
+```typescript
+// v3
+error.format()
+error.flatten()
+
+// v4 - DEPRECATED, use top-level
+z.treeifyError(error)
+```
+
+### Pushing Issues
+
+```typescript
+// v3
+ctx.addIssue({ ... })
+
+// v4 - DEPRECATED, push directly
+issues.push({ ... })
+```
+
+---
+
+## Quick Reference
+
+| v3 Pattern | v4 Replacement |
+|------------|----------------|
+| `z.string().email()` | `z.email()` |
+| `z.string().uuid()` | `z.uuid()` |
+| `z.string().url()` | `z.url()` |
+| `z.string().ip()` | `z.ipv4()` / `z.ipv6()` |
+| `z.nativeEnum()` | `z.enum()` |
+| `z.record(Schema)` | `z.record(z.string(), Schema)` |
+| `z.promise()` | Await before parsing |
+| `error.format()` | `z.treeifyError(error)` |
+| `ctx.addIssue()` | `issues.push()` |
+| `.strict()` | `z.strictObject()` |
+| `.passthrough()` | `z.looseObject()` |
+| `.merge()` | `.extend()` or spread |

package/skills/app-dev/zod-v4/release-check.mjs

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+import { spawnSync } from 'node:child_process';
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+const WEEK_MS = 7 * DAY_MS;
+const here = dirname(fileURLToPath(import.meta.url));
+
+function readJson(path, fallback = {}) {
+  try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return fallback; }
+}
+
+function frontmatterValue(text, key) {
+  const frontmatter = /^---\n([\s\S]*?)\n---/.exec(text)?.[1] ?? '';
+  const match = new RegExp('^' + key + ':\\s*([^\\n]+)$', 'm').exec(frontmatter);
+  return match?.[1].trim().replace(/^['"]|['"]$/g, '') ?? null;
+}
+
+function repositoryOf(source) {
+  const value = String(source ?? '').trim();
+  const match = /^(?:git@github\.com:|https:\/\/github\.com\/)?([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+?)(?:\.git)?$/.exec(value);
+  return match?.[1] ?? null;
+}
+
+function stableVersion(value) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)$/.exec(String(value ?? '').trim());
+  return match ? match.slice(1).map(Number) : null;
+}
+
+function newer(left, right) {
+  for (let index = 0; index < 3; index += 1) {
+    if (left[index] !== right[index]) return left[index] > right[index];
+  }
+  return false;
+}
+
+function writeCache(path, value) {
+  try {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, JSON.stringify(value));
+  } catch { /* A read-only cache must not block skill use. */ }
+}
+
+function main(now = Date.now()) {
+  if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
+  const name = frontmatterValue(skill, 'name');
+  const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));
+  if (!name || !localVersion) return;
+
+  const lock = readJson(join(process.env.HOME || homedir(), '.agents', '.skill-lock.json'));
+  const entry = lock.skills?.[name];
+  const repository = repositoryOf(entry?.sourceUrl || entry?.source);
+  if (!repository) return;
+
+  const cacheRoot = process.env.XDG_CACHE_HOME || join(process.env.HOME || homedir(), '.cache');
+  const cachePath = join(cacheRoot, '1aboveio-skills', 'release-check.json');
+  const all = readJson(cachePath);
+  const cache = all[repository] && typeof all[repository] === 'object' ? all[repository] : {};
+
+  if (!cache.lastCheck || now - cache.lastCheck >= DAY_MS) {
+    const result = spawnSync('gh', ['api', 'repos/' + repository + '/releases/latest', '--jq', '.tag_name'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+      timeout: 1500,
+    });
+    cache.lastCheck = now;
+    if (result.status === 0 && stableVersion(result.stdout)) cache.latestTag = result.stdout.trim();
+    else delete cache.latestTag;
+    all[repository] = cache;
+    writeCache(cachePath, all);
+  }
+
+  const latestVersion = stableVersion(cache.latestTag);
+  if (!latestVersion || !newer(latestVersion, localVersion)) return;
+  if (cache.notifiedTag === cache.latestTag && cache.notifiedAt && now - cache.notifiedAt < WEEK_MS) return;
+
+  cache.notifiedTag = cache.latestTag;
+  cache.notifiedAt = now;
+  all[repository] = cache;
+  writeCache(cachePath, all);
+  const command = `npx skills@1.5.23 add '${repository}#${cache.latestTag}' --global --agent universal claude-code --skill ${name} --yes`;
+  process.stdout.write(
+    `UPDATE_AVAILABLE: A newer 1AboveIO skills release (${cache.latestTag}) is available; this skill is `
+      + `v${localVersion.join('.')}. Ask once whether to refresh ${name}. On approval run \`${command}\`. `
+      + 'The refreshed instructions apply next session. Either way, continue the current task and do not ask again this session.\n',
+  );
+}
+
+try { main(); } catch { /* Update checks are advisory and always fail silent. */ }

package/skills/cicd/cloud-build/LICENSE

@@ -0,0 +1,3 @@
+MIT License
+
+Copyright (c) 2026 1AboveIO