@cubis/foundry 0.3.63 → 0.3.64

package/workflows/workflows/agent-environment-setup/platforms/cursor/skills/nestjs-expert/references/secure-sessions.md

@@ -52,5 +52,5 @@ Do not store tokens, passwords, raw PII, or authorization policy blobs.
 
 ## Related
 
-- `references/authentication.md`
-- `references/services-di.md`
+- [authentication.md](authentication.md)
+- [services-di.md](services-di.md)

package/workflows/workflows/agent-environment-setup/platforms/cursor/skills/nestjs-expert/references/strangler-fig-pattern.md

@@ -43,5 +43,5 @@ Move route groups from legacy to NestJS in controlled slices while preserving be
 
 ## Related
 
-- `references/migration-from-express.md`
-- `references/authentication.md`
+- [migration-from-express.md](migration-from-express.md)
+- [authentication.md](authentication.md)

package/workflows/workflows/agent-environment-setup/platforms/cursor/skills/next-best-practices/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: next-best-practices
 description: "Rulebook for reviewing/generating Next.js code against Vercel best practices (conventions, RSC boundaries, async APIs, metadata, bundling). Not a migration or feature-implementation skill by itself."
-user-invocable: false
+metadata:
+  user-invocable: false
 ---
 
 # Next.js Best Practices
@@ -10,7 +11,7 @@ Apply these rules when writing or reviewing Next.js code.
 
 ## File Conventions
 
-See [file-conventions.md](./file-conventions.md) for:
+See [file-conventions.md](references/file-conventions.md) for:
 - Project structure and special files
 - Route segments (dynamic, catch-all, groups)
 - Parallel and intercepting routes
@@ -20,7 +21,7 @@ See [file-conventions.md](./file-conventions.md) for:
 
 Detect invalid React Server Component patterns.
 
-See [rsc-boundaries.md](./rsc-boundaries.md) for:
+See [rsc-boundaries.md](references/rsc-boundaries.md) for:
 - Async client component detection (invalid)
 - Non-serializable props detection
 - Server Action exceptions
@@ -29,33 +30,33 @@ See [rsc-boundaries.md](./rsc-boundaries.md) for:
 
 Next.js 15+ async API changes.
 
-See [async-patterns.md](./async-patterns.md) for:
+See [async-patterns.md](references/async-patterns.md) for:
 - Async `params` and `searchParams`
 - Async `cookies()` and `headers()`
 - Migration codemod
 
 ## Runtime Selection
 
-See [runtime-selection.md](./runtime-selection.md) for:
+See [runtime-selection.md](references/runtime-selection.md) for:
 - Default to Node.js runtime
 - When Edge runtime is appropriate
 
 ## Directives
 
-See [directives.md](./directives.md) for:
+See [directives.md](references/directives.md) for:
 - `'use client'`, `'use server'` (React)
 - `'use cache'` (Next.js)
 
 ## Functions
 
-See [functions.md](./functions.md) for:
+See [functions.md](references/functions.md) for:
 - Navigation hooks: `useRouter`, `usePathname`, `useSearchParams`, `useParams`
 - Server functions: `cookies`, `headers`, `draftMode`, `after`
 - Generate functions: `generateStaticParams`, `generateMetadata`
 
 ## Error Handling
 
-See [error-handling.md](./error-handling.md) for:
+See [error-handling.md](references/error-handling.md) for:
 - `error.tsx`, `global-error.tsx`, `not-found.tsx`
 - `redirect`, `permanentRedirect`, `notFound`
 - `forbidden`, `unauthorized` (auth errors)
@@ -63,14 +64,14 @@ See [error-handling.md](./error-handling.md) for:
 
 ## Data Patterns
 
-See [data-patterns.md](./data-patterns.md) for:
+See [data-patterns.md](references/data-patterns.md) for:
 - Server Components vs Server Actions vs Route Handlers
 - Avoiding data waterfalls (`Promise.all`, Suspense, preload)
 - Client component data fetching
 
 ## Route Handlers
 
-See [route-handlers.md](./route-handlers.md) for:
+See [route-handlers.md](references/route-handlers.md) for:
 - `route.ts` basics
 - GET handler conflicts with `page.tsx`
 - Environment behavior (no React DOM)
@@ -78,7 +79,7 @@ See [route-handlers.md](./route-handlers.md) for:
 
 ## Metadata & OG Images
 
-See [metadata.md](./metadata.md) for:
+See [metadata.md](references/metadata.md) for:
 - Static and dynamic metadata
 - `generateMetadata` function
 - OG image generation with `next/og`
@@ -86,7 +87,7 @@ See [metadata.md](./metadata.md) for:
 
 ## Image Optimization
 
-See [image.md](./image.md) for:
+See [image.md](references/image.md) for:
 - Always use `next/image` over `<img>`
 - Remote images configuration
 - Responsive `sizes` attribute
@@ -95,7 +96,7 @@ See [image.md](./image.md) for:
 
 ## Font Optimization
 
-See [font.md](./font.md) for:
+See [font.md](references/font.md) for:
 - `next/font` setup
 - Google Fonts, local fonts
 - Tailwind CSS integration
@@ -103,7 +104,7 @@ See [font.md](./font.md) for:
 
 ## Bundling
 
-See [bundling.md](./bundling.md) for:
+See [bundling.md](references/bundling.md) for:
 - Server-incompatible packages
 - CSS imports (not link tags)
 - Polyfills (already included)
@@ -112,7 +113,7 @@ See [bundling.md](./bundling.md) for:
 
 ## Scripts
 
-See [scripts.md](./scripts.md) for:
+See [scripts.md](references/scripts.md) for:
 - `next/script` vs native script tags
 - Inline scripts need `id`
 - Loading strategies
@@ -120,34 +121,33 @@ See [scripts.md](./scripts.md) for:
 
 ## Hydration Errors
 
-See [hydration-error.md](./hydration-error.md) for:
+See [hydration-error.md](references/hydration-error.md) for:
 - Common causes (browser APIs, dates, invalid HTML)
 - Debugging with error overlay
 - Fixes for each cause
 
 ## Suspense Boundaries
 
-See [suspense-boundaries.md](./suspense-boundaries.md) for:
+See [suspense-boundaries.md](references/suspense-boundaries.md) for:
 - CSR bailout with `useSearchParams` and `usePathname`
 - Which hooks require Suspense boundaries
 
 ## Parallel & Intercepting Routes
 
-See [parallel-routes.md](./parallel-routes.md) for:
+See [parallel-routes.md](references/parallel-routes.md) for:
 - Modal patterns with `@slot` and `(.)` interceptors
 - `default.tsx` for fallbacks
 - Closing modals correctly with `router.back()`
 
 ## Self-Hosting
 
-See [self-hosting.md](./self-hosting.md) for:
+See [self-hosting.md](references/self-hosting.md) for:
 - `output: 'standalone'` for Docker
 - Cache handlers for multi-instance ISR
 - What works vs needs extra setup
 
 ## Debug Tricks
 
-See [debug-tricks.md](./debug-tricks.md) for:
+See [debug-tricks.md](references/debug-tricks.md) for:
 - MCP endpoint for AI-assisted debugging
 - Rebuild specific routes with `--debug-build-paths`
-

package/workflows/workflows/agent-environment-setup/platforms/cursor/skills/next-upgrade/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: next-upgrade
 description: "Use only for upgrading Next.js versions with official migration guides and codemods; includes dependency/version planning and upgrade validation."
-argument-hint: "[target-version]"
+metadata:
+  argument-hint: "[target-version]"
 ---
 
 # Upgrade Next.js

package/workflows/workflows/agent-environment-setup/platforms/cursor/skills/oneup-design/SKILL.md

@@ -16,9 +16,11 @@ import '../../../../core/design_system/one_design_system.dart';
 
 ## When to Load Steering Files
 
-- Working with colors → `colors.md`
-- Working with spacing/padding → `spacing.md`
-- Using One* components → `components.md`
+| File | Load when |
+| --- | --- |
+| `references/colors.md` | Choosing semantic colors, surface roles, and token-safe palette usage. |
+| `references/spacing.md` | Replacing hard-coded spacing/padding and aligning with token spacing rules. |
+| `references/components.md` | Selecting or reviewing One* components and their expected usage patterns. |
 
 ## MCP Tools (Use Before Writing UI)
 

package/workflows/workflows/agent-environment-setup/platforms/cursor/skills/plan-writing/SKILL.md

@@ -31,7 +31,7 @@ This skill provides a framework for breaking down work into clear, actionable ta
 
 ### 4. Dynamic Naming in Project Root
 - Plan files are saved as `{task-slug}.md` in the PROJECT ROOT
-- Name derived from task (e.g., "add auth" → `auth-feature.md`)
+- Name derived from task (e.g., "add auth" -> auth-feature markdown plan in the project root)
 - **NEVER** inside `.claude/`, `docs/`, or temp folders
 
 ## Planning Principles (NOT Templates!)

package/workflows/workflows/agent-environment-setup/platforms/cursor/skills/prompt-engineer/SKILL.md

@@ -9,11 +9,13 @@ keywords: ["prompt", "llm", "ai", "chain-of-thought", "few-shot", "evaluation",
 
 ## When to Load Steering Files
 
-- Prompt patterns (zero-shot, few-shot, CoT) → `prompt-patterns.md`
-- Optimization techniques → `prompt-optimization.md`
-- Evaluation frameworks → `evaluation-frameworks.md`
-- Structured outputs (JSON, function calling) → `structured-outputs.md`
-- System prompt design → `system-prompts.md`
+| File | Load when |
+| --- | --- |
+| `references/prompt-patterns.md` | Choosing zero-shot, few-shot, chain-of-thought, or decomposition patterns. |
+| `references/prompt-optimization.md` | Iterating on failures, reducing ambiguity, or tightening prompts for latency/cost. |
+| `references/evaluation-frameworks.md` | Building prompt test cases, eval loops, or regression checks. |
+| `references/structured-outputs.md` | Designing JSON outputs, schema-constrained outputs, or tool/function calling prompts. |
+| `references/system-prompts.md` | Defining durable system prompts, role constraints, or behavioral guardrails. |
 
 ## Core Workflow
 

package/workflows/workflows/agent-environment-setup/platforms/cursor/skills/python-pro/SKILL.md

@@ -18,6 +18,12 @@ metadata:
 - Migrating legacy Python to typed and testable architecture.
 - Implementing async I/O with predictable behavior.
 
+## When not to use
+
+- Frontend-only tasks with no Python runtime involved.
+- Database-only tuning or migration work with no Python code change.
+- Tiny shell-first automation where Python adds unnecessary packaging/runtime cost.
+
 ## Core workflow
 
 1. Establish interpreter/runtime constraints.
@@ -41,6 +47,18 @@ metadata:
 - Keep I/O async and CPU work isolated where needed.
 - Treat free-threaded mode as opt-in until dependencies are validated.
 
+## Debugging and observability
+
+- Preserve exception context and structured log fields at service boundaries.
+- Reproduce async bugs with deterministic fixtures before widening scope.
+- Use profiling and trace tooling before speculative concurrency changes.
+
+## Performance and reliability
+
+- Set timeout/retry budgets explicitly for external I/O.
+- Isolate CPU-heavy work from event loops or request handlers.
+- Keep dependency and packaging state reproducible with `pyproject.toml` tooling.
+
 ## Avoid
 
 - Untyped public APIs in shared modules.
@@ -49,8 +67,10 @@ metadata:
 
 ## Reference files
 
-- `references/type-system.md`
-- `references/async-patterns.md`
-- `references/testing.md`
-- `references/packaging.md`
-- `references/standard-library.md`
+| File | Load when |
+| --- | --- |
+| `references/type-system.md` | Typing strategy, protocols, generics, or boundary models need detail. |
+| `references/async-patterns.md` | Async I/O, task groups, or cancellation semantics need detail. |
+| `references/testing.md` | Pytest strategy, fixtures, or concurrency-safe tests are needed. |
+| `references/packaging.md` | Packaging, dependency layout, or toolchain reproducibility is in scope. |
+| `references/standard-library.md` | Standard-library-first options need review before adding dependencies. |

package/workflows/workflows/agent-environment-setup/platforms/cursor/skills/react-expert/references/migration-class-to-modern.md

@@ -924,7 +924,7 @@ export default async function UserProfile({ params }: { params: { id: string } }
 - SEO-critical content? → Server Component
 - Large dependencies? → Server Component (smaller client bundle)
 
-See reference: `react-expert/references/server-components.md`
+See reference: [server-components.md](server-components.md)
 
 ---
 

package/workflows/workflows/agent-environment-setup/platforms/cursor/skills/riverpod-3/SKILL.md

@@ -125,19 +125,25 @@ Avoid keepAlive for:
 
 ## Steering Files
 
-- `loop-avoidance.md` - Loop diagnostics and safe patterns
-- `minimal-rebuild.md` - `select`, widget splitting, item-level providers
-- `provider-layout.md` - Generic provider organization and boundaries
-- `refresh-cache-paging.md` - Refresh/paging/cache recipes
-- `testing.md` - ProviderContainer and widget test patterns
+| File | Load when |
+| --- | --- |
+| `references/loop-avoidance.md` | Diagnosing provider loops, invalidation storms, or notifier recursion. |
+| `references/minimal-rebuild.md` | Reducing rebuilds with `select`, widget splitting, or item-level providers. |
+| `references/provider-layout.md` | Organizing provider boundaries, layers, and ownership. |
+| `references/refresh-cache-paging.md` | Designing refresh, cache TTL, paging, or stale-while-revalidate flows. |
+| `references/testing.md` | Writing `ProviderContainer` or widget tests for Riverpod behavior. |
 
 ## Examples
 
-- `attendance_paging.md` - Complete paging example
-- `profile_edit.md` - Form workflow example
+| File | Load when |
+| --- | --- |
+| `examples/attendance_paging.md` | You need a concrete paginated list example. |
+| `examples/profile_edit.md` | You need a form/editing workflow example. |
 
 ## Templates
 
-- `cache_policy.dart` - TTL helper for repository cache policy
-- `paged_controller.dart` - Cursor/page-based infinite list controller
-- `riverpod_controller_test` - Provider/controller test template
+| File | Load when |
+| --- | --- |
+| `templates/cache_policy.dart.md` | Creating a TTL helper for repository caching. |
+| `templates/paged_controller.dart.md` | Bootstrapping a cursor/page-based controller. |
+| `templates/riverpod_controller_test.md` | Starting a provider/controller test template. |

package/workflows/workflows/agent-environment-setup/platforms/cursor/skills/rust-pro/SKILL.md

@@ -18,6 +18,12 @@ metadata:
 - Solving ownership/lifetime design problems.
 - Optimizing memory safety and runtime performance together.
 
+## When not to use
+
+- Browser/frontend-only work with no Rust component.
+- Database-only tuning without Rust service or library changes.
+- Small scripts where shell or existing project tooling is the intended path.
+
 ## Core workflow
 
 1. Define ownership and error model first.
@@ -42,6 +48,24 @@ metadata:
 - Keep borrow scopes tight to improve readability and compile times.
 - Separate transport DTOs from domain types.
 
+## Debugging and observability
+
+- Prefer reproducible failing tests and `tracing` instrumentation before redesigning ownership or async structure.
+- Make task cancellation, retries, and error chains visible in logs/telemetry.
+- Use `cargo test`, `clippy`, and targeted benchmarks to isolate regressions.
+
+## Performance and reliability
+
+- Keep async flows cancellation-safe and backpressure-aware.
+- Measure allocations, lock contention, and tail latency before unsafe or low-level tuning.
+- Bound work queues and connection pools explicitly.
+
+## References
+
+| File | Load when |
+| --- | --- |
+| `references/operational-baseline.md` | You need service-level guardrails for async, errors, tracing, and test discipline. |
+
 ## Avoid
 
 - Premature `unsafe` optimization.

package/workflows/workflows/agent-environment-setup/platforms/cursor/skills/rust-pro/references/operational-baseline.md

@@ -0,0 +1,9 @@
+## Operational baseline
+
+Load when: async service safety, tracing, error handling, or release guardrails need explicit guidance.
+
+- Keep error chains actionable and visible in logs/traces.
+- Use `cargo fmt`, `clippy`, and focused tests as a release baseline.
+- Make cancellation, queue bounds, and backpressure explicit.
+- Treat `unsafe` as an exception with documented invariants.
+- Profile before low-level optimization.

package/workflows/workflows/agent-environment-setup/platforms/cursor/skills/security-reviewer/SKILL.md

@@ -73,11 +73,3 @@ Provide: (1) Executive summary with risk, (2) Findings table with severity count
 ## Knowledge Reference
 
 OWASP Top 10, CWE, Semgrep, Bandit, ESLint Security, gosec, npm audit, gitleaks, trufflehog, CVSS scoring, nmap, Burp Suite, sqlmap, Trivy, Checkov, HashiCorp Vault, AWS Security Hub, CIS benchmarks, SOC2, ISO27001
-
-## Related Powers
-
-- **Secure Code Guardian** - Implementing fixes
-- **Code Reviewer** - General code review
-- **DevOps Engineer** - Security in CI/CD
-- **Cloud Architect** - Cloud security architecture
-- **Kubernetes Specialist** - Container security

package/workflows/workflows/agent-environment-setup/platforms/cursor/skills/skill-authoring/SKILL.md

@@ -0,0 +1,75 @@
+---
+name: "skill-authoring"
+description: "Use when creating a new Foundry skill or updating an existing one: scaffolding SKILL.md, fixing metadata, wiring references and scripts, removing legacy power files, and making the package work across Codex, Antigravity, Copilot, Cursor, and Windsurf. Do not use for prompt tuning without a skill package change or for editing only one generated mirror."
+metadata:
+  provenance:
+    source: "https://github.com/anthropics/skills/tree/main/skills/skill-creator"
+    snapshot: "Adapted from the local Codex system skill on 2026-03-06"
+  maintenance: "Pinned snapshot; refresh manually when upstream changes are intentionally adopted."
+---
+
+# Skill Authoring
+
+## Overview
+
+Use this skill to create or repair Foundry skills from the canonical source layer. It is adapted from Anthropic's `skill-creator`, but rewritten for Foundry's cross-platform model and packaging rules.
+
+## When to Use
+
+- Creating a new skill under `workflows/skills/<id>`
+- Updating `name`, `description`, `metadata`, or `compatibility` in `SKILL.md`
+- Repairing broken `references/`, `steering/`, or `templates/` links
+- Replacing legacy power-file patterns with canonical skill packaging
+- Adapting a skill so its generated Codex, Antigravity, Copilot, Cursor, and Windsurf bundles stay valid
+- Adding or updating helper scripts that make a skill deterministic and reusable
+
+## When Not to Use
+
+- Pure prompt tuning with no skill package changes
+- Editing only a generated mirror when the canonical source is unchanged
+- General feature work that should route to an implementation, review, or domain skill instead
+
+## Core Workflow
+
+1. Clarify the trigger boundary and package scope with concrete examples.
+2. Edit the canonical skill only. Never hand-edit platform mirrors first.
+3. Keep `SKILL.md` concise and move variant detail into one-level-deep sidecar files.
+4. Add scripts only when they remove repetition or make execution more reliable.
+5. Validate frontmatter, links, sidecar content, and platform packaging before finishing.
+6. Regenerate mirrors and rule assets, then verify the skill is discoverable and readable at runtime.
+
+## Foundry Skill Contract
+
+- Required file: `SKILL.md`
+- Optional folders: `references/`, `steering/`, `templates/`, `scripts/`, `assets/`
+- Keep only `SKILL.md` at the skill root. Do not leave extra top-level markdown files.
+- Use relative paths from the skill root, not platform-specific absolute paths.
+- Reference files must be loaded selectively with explicit `Load when` guidance.
+- Do not ship legacy power files in canonical or platform-facing skill bundles.
+- Canonical metadata can stay richer, but platform mirrors are generated and sanitized automatically.
+
+## References
+
+Load on demand. Do not preload all reference files.
+
+| File | Load when |
+| --- | --- |
+| `references/foundry-platform-parity.md` | Adapting a skill for Codex, Antigravity, Copilot, Cursor, or Windsurf packaging and metadata rules. |
+| `references/foundry-skill-checklist.md` | Verifying naming, frontmatter, sidecars, routing, and validation before shipping a skill update. |
+
+## Helper Scripts
+
+Load or run only when the task needs them.
+
+| File | Load when |
+| --- | --- |
+| `scripts/init_skill.py` | Scaffolding a new canonical skill directory and starter `SKILL.md`. |
+| `scripts/quick_validate.py` | Checking frontmatter, broken markdown references, empty sidecars, and packaging safety for a skill directory. |
+
+## Rules
+
+- Prefer one canonical skill package that generates clean mirrors on every platform.
+- Keep references one level deep from `SKILL.md`.
+- Never bulk-load `references/` or `steering/`; pick only the file needed for the current step.
+- If a task is clearly about skill creation or maintenance, load this skill directly instead of starting with `skill_search`.
+- When cross-platform behavior changes, verify the generated outputs instead of assuming canonical text alone is enough.

package/workflows/workflows/agent-environment-setup/platforms/cursor/skills/skill-authoring/references/foundry-platform-parity.md

@@ -0,0 +1,50 @@
+# Foundry Platform Parity
+
+Use this reference when a skill has to work cleanly across generated platform bundles.
+
+## Canonical Authoring Rule
+
+- Author the real skill only under `workflows/skills/<id>`.
+- Generated mirrors are derived artifacts, not the source of truth.
+- If a mirror looks wrong, fix the canonical skill or the generator, then regenerate.
+
+## Packaging Rules
+
+- Keep `SKILL.md` as the only top-level markdown entry file.
+- Place sidecars under `references/`, `steering/`, or `templates/`.
+- Do not keep `POWER.md` in canonical skills or mirrored bundles.
+- Keep links relative to the skill root so the same content survives mirror relocation.
+
+## Platform Notes
+
+### Codex
+
+- Full canonical skill content is mirrored into `.agents/skills`.
+- Compatibility wrappers may exist for workflows and agents, but skills remain normal packages.
+
+### Antigravity
+
+- Skills are mirrored into `.agent/skills`.
+- Route-first rule text still expects the same `SKILL.md` plus selective sidecar loading.
+
+### Copilot
+
+- Copilot-facing skills must keep only supported frontmatter keys after sanitization.
+- The canonical skill may keep richer `metadata`, but the generated mirror should rely on Foundry's sanitization rather than hand-authored Copilot-only fields.
+- Workspace MCP should stay in `.vscode/mcp.json`.
+
+### Cursor and Windsurf
+
+- These mirrors follow the same filtered bundle rules as Copilot.
+- Duplicate top-level markdown files and stale sidecars will show up here too if the canonical package is sloppy.
+
+## Metadata Guidance
+
+- Required everywhere: `name`, `description`
+- Allowed canonical extensions: `license`, `allowed-tools`, `metadata`, `compatibility`
+- Keep the trigger boundary in `description` sharp enough that route-first loading can direct-load the skill when intent is obvious.
+
+## Routing Guidance
+
+- Do not create platform-specific aliases just to shadow a built-in skill.
+- If a built-in name collides with a Foundry skill, prefer a distinct canonical ID and route authoring intent to it explicitly.

package/workflows/workflows/agent-environment-setup/platforms/cursor/skills/skill-authoring/references/foundry-skill-checklist.md

@@ -0,0 +1,45 @@
+# Foundry Skill Checklist
+
+Use this checklist before finishing a skill creation or maintenance task.
+
+## Canonical Package
+
+- Skill folder name is lowercase hyphen-case and under 64 characters.
+- `SKILL.md` exists and has `name` plus `description`.
+- `description` states both when to use the skill and when not to use it.
+- No `POWER.md` exists in the skill directory.
+- No extra top-level markdown files exist besides `SKILL.md`.
+
+## Sidecars
+
+- Every referenced markdown file exists.
+- Referenced markdown files are non-empty.
+- Links are relative from the skill root.
+- `SKILL.md` tells the agent when to load each sidecar instead of listing files without context.
+
+## Scripts
+
+- Only keep scripts that actually remove repetition or improve reliability.
+- Scripts should prefer standard-library dependencies when possible.
+- Script usage is described briefly in `SKILL.md`.
+
+## Routing and Generation
+
+- If the skill changes route behavior, update shared workflow or agent guidance too.
+- Do not edit platform mirrors directly unless the task is fixing the generator itself.
+- Regenerate mirrors and rule assets after canonical changes.
+
+## Validation
+
+Run the smallest relevant validation set:
+
+- `python workflows/skills/<id>/scripts/quick_validate.py workflows/skills/<id>`
+- `npm run test:attributes`
+- `npm run generate:platform-assets`
+- `npm run sync:skill-mirrors`
+
+If the task changes MCP or runtime routing:
+
+- `npm --prefix mcp test`
+- `npm --prefix mcp run build`
+- `node scripts/mcp-http-smoke.mjs <mcp-url>` when a live endpoint is available