@dsalazardev/ai-hub-cli 0.0.0-stage → 0.1.0

package/skills/shared/nestjs/evals/README.md

@@ -0,0 +1,3 @@
+# nestjs evals
+
+Trigger and capability checks for NestJS backend work.

package/skills/shared/nestjs/evals/cases.yaml

@@ -0,0 +1,38 @@
+skill: nestjs
+
+should_trigger:
+  - prompt: "Create a NestJS module with a controller, provider and repository provider."
+    why: "Feature modules/controllers/providers are core NestJS mechanics."
+  - prompt: "Should this auth guard be APP_GUARD or @UseGuards on the controller?"
+    why: "Guard binding scope is a Nest-specific cross-cutting decision."
+  - prompt: "My request-scoped provider is undefined inside a Nest guard."
+    why: "DI scope and lifecycle issues belong to NestJS."
+  - prompt: "Mock a repository provider with overrideProvider in a Nest test."
+    why: "TestingModule and overrideProvider are Nest-specific testing APIs."
+  - prompt: "Monta un modulo de Nest con JWT guard y pipes de validacion."
+    why: "Spanish Nest module plus guards/pipes triggers this skill."
+
+should_not_trigger:
+  - prompt: "Build a bare Express route with no DI container."
+    route_to: "nodejs"
+    why: "Bare Express without Nest modules/providers is Node.js, not NestJS."
+  - prompt: "Design REST status codes and idempotency for this API."
+    route_to: "api-design"
+    why: "Framework-agnostic API design belongs elsewhere."
+  - prompt: "Design the Postgres schema for orders."
+    route_to: "postgresdb"
+    why: "Database schema design is not a Nest DI/module concern."
+  - prompt: "Fix a generic TypeScript conditional type."
+    route_to: "typescript"
+    why: "Pure TypeScript typing belongs to the TypeScript skill."
+
+capability:
+  - scenario: "A user asks to add a NestJS Orders module with a service, controller, injected repository, validation pipe and tests."
+    must_include:
+      - "Defines a feature module boundary and keeps AppModule thin."
+      - "Wires providers through Nest DI rather than manually new-ing dependencies."
+      - "Chooses provider form (useClass/useValue/useFactory/useExisting) by intent."
+      - "Places guards/pipes/interceptors at the right scope and respects request lifecycle order."
+      - "Uses Test.createTestingModule and overrideProvider for unit tests."
+      - "Routes schema/query design to database skills when needed."
+      - "Avoids circular dependencies or uses forwardRef only as a last resort."

package/skills/shared/nestjs/references/cross-cutting.md

@@ -0,0 +1,135 @@
+# Cross-cutting layer: deep treatment
+
+Guards, interceptors, pipes, and filters share one base idea — they read the `ExecutionContext` and run at a fixed point in the request lifecycle — but each has a distinct job. This is the depth the SKILL body points to.
+
+## ExecutionContext
+
+Every cross-cutting primitive receives an `ExecutionContext` (a superset of `ArgumentsHost`). It abstracts the transport so the same guard works over HTTP, WebSockets, or microservices.
+
+```typescript
+@Injectable()
+export class AuthGuard implements CanActivate {
+  canActivate(context: ExecutionContext): boolean {
+    const req = context.switchToHttp().getRequest<Request>();
+    return Boolean(req.headers.authorization);
+  }
+}
+```
+
+Pull request data from the context here, not from an injected request-scoped provider — guards run before the scope you expect is settled.
+
+## Custom param decorators
+
+Extract repeated `req.user` plumbing into a decorator built on `createParamDecorator`:
+
+```typescript
+export const CurrentUser = createParamDecorator(
+  (_data: unknown, ctx: ExecutionContext) => {
+    return ctx.switchToHttp().getRequest().user;
+  },
+);
+
+// handler
+@Get('me')
+me(@CurrentUser() user: User) { return user; }
+```
+
+## Reflector + SetMetadata: role and @Public() guards
+
+Attach metadata at the route/controller with a decorator, read it in the guard with `Reflector`. This is how you build role checks and a `@Public()` opt-out for a global guard.
+
+```typescript
+export const IS_PUBLIC = 'isPublic';
+export const Public = () => SetMetadata(IS_PUBLIC, true);
+
+export const ROLES = 'roles';
+export const Roles = (...roles: string[]) => SetMetadata(ROLES, roles);
+```
+
+```typescript
+@Injectable()
+export class AuthGuard implements CanActivate {
+  constructor(private readonly reflector: Reflector) {}
+
+  canActivate(context: ExecutionContext): boolean {
+    const isPublic = this.reflector.getAllAndOverride<boolean>(IS_PUBLIC, [
+      context.getHandler(),
+      context.getClass(),
+    ]);
+    if (isPublic) return true;
+
+    const required = this.reflector.getAllAndOverride<string[]>(ROLES, [
+      context.getHandler(),
+      context.getClass(),
+    ]);
+    const req = context.switchToHttp().getRequest();
+    if (!required?.length) return Boolean(req.user);
+    return required.some((r) => req.user?.roles?.includes(r));
+  }
+}
+```
+
+`getAllAndOverride` merges handler-level over class-level metadata — route decorator wins over controller decorator. Bind this guard globally and DI-capable via `APP_GUARD` so `Reflector` is injected:
+
+```typescript
+@Module({ providers: [{ provide: APP_GUARD, useClass: AuthGuard }] })
+export class AppModule {}
+```
+
+## Interceptors (RxJS)
+
+Interceptors wrap the handler. The pre-handler code runs before `next.handle()`; the operators you pipe onto the returned stream run after. They are RxJS observables — use `map`, `tap`, `timeout`, `catchError`.
+
+Response transform:
+
+```typescript
+@Injectable()
+export class WrapResponseInterceptor implements NestInterceptor {
+  intercept(_ctx: ExecutionContext, next: CallHandler): Observable<unknown> {
+    return next.handle().pipe(map((data) => ({ data, ts: Date.now() })));
+  }
+}
+```
+
+Timeout:
+
+```typescript
+@Injectable()
+export class TimeoutInterceptor implements NestInterceptor {
+  intercept(_ctx: ExecutionContext, next: CallHandler): Observable<unknown> {
+    return next.handle().pipe(
+      timeout(5000),
+      catchError((err) =>
+        err instanceof TimeoutError
+          ? throwError(() => new RequestTimeoutException())
+          : throwError(() => err),
+      ),
+    );
+  }
+}
+```
+
+## Exception filters
+
+A filter catches thrown errors and shapes the response. Declare what it catches with `@Catch(...)`; an empty `@Catch()` catches everything.
+
+```typescript
+@Catch(HttpException)
+export class HttpExceptionFilter implements ExceptionFilter {
+  catch(exception: HttpException, host: ArgumentsHost) {
+    const res = host.switchToHttp().getResponse<Response>();
+    const status = exception.getStatus();
+    res.status(status).json({
+      statusCode: status,
+      message: exception.message,
+      timestamp: new Date().toISOString(),
+    });
+  }
+}
+```
+
+Bind globally and DI-capable via `APP_FILTER`. Filters run last in the lifecycle, so they see anything thrown by guards, pipes, interceptors, or the handler.
+
+## Order when multiple are bound
+
+Within a kind, binding order is global → controller → route. Across kinds, the lifecycle order holds: guards → interceptors(pre) → pipes → handler → interceptors(post) → filters. A pipe cannot see what a later interceptor does; a guard cannot read a pipe-transformed DTO. When you need data shaped before authorization, that is a sign the work belongs in a guard's own context read, not downstream.

package/skills/shared/nestjs/references/testing-recipes.md

@@ -0,0 +1,105 @@
+# Testing recipes
+
+The Nest-specific harness. For generic JS/TS test craft (runner config, coverage gates), that is `../../testing-web/SKILL.md`.
+
+## The harness
+
+`Test.createTestingModule({...})` builds a module exactly like a real `@Module`, then `.compile()` resolves it into a `TestingModule`. You pull instances with `.get(Token)` (singleton) or `.resolve(Token)` (scoped). Override providers, guards, interceptors, pipes, and filters before compiling.
+
+## Unit: mock a repository provider
+
+Unit-test a service in isolation — provide only the unit under test, mock its collaborators with `overrideProvider`.
+
+```typescript
+describe('OrdersService', () => {
+  let service: OrdersService;
+  const repo = { findById: vi.fn(), save: vi.fn() };
+
+  beforeEach(async () => {
+    const moduleRef = await Test.createTestingModule({
+      providers: [
+        OrdersService,
+        { provide: OrderRepository, useValue: repo },
+      ],
+    }).compile();
+
+    service = moduleRef.get(OrdersService);
+  });
+
+  it('returns the order', async () => {
+    repo.findById.mockResolvedValue({ id: '1', sku: 'A' });
+    await expect(service.get('1')).resolves.toMatchObject({ id: '1' });
+  });
+});
+```
+
+`overrideProvider(X).useValue(mock)` is the alternative when the provider is already declared by an imported module:
+
+```typescript
+const moduleRef = await Test.createTestingModule({ imports: [OrdersModule] })
+  .overrideProvider(OrderRepository)
+  .useValue(repo)
+  .compile();
+```
+
+## e2e: boot the app + Supertest
+
+e2e-test the wired app over HTTP. The trap: a `TestingModule` does **not** apply the globals you set in `main.ts`. Replicate them or the test diverges from production.
+
+```typescript
+describe('Orders (e2e)', () => {
+  let app: INestApplication;
+
+  beforeAll(async () => {
+    const moduleRef = await Test.createTestingModule({
+      imports: [AppModule],
+    })
+      .overrideGuard(AuthGuard)
+      .useValue({ canActivate: () => true }) // bypass auth for the route under test
+      .compile();
+
+    app = moduleRef.createNestApplication();
+    // MIRROR main.ts — without this, validation never runs in the test
+    app.useGlobalPipes(new ValidationPipe({ whitelist: true, forbidNonWhitelisted: true, transform: true }));
+    app.useGlobalFilters(new HttpExceptionFilter());
+    await app.init();
+  });
+
+  afterAll(async () => app.close());
+
+  it('rejects an unknown property', () =>
+    request(app.getHttpServer())
+      .post('/orders')
+      .send({ sku: 'A', quantity: 1, hacker: true })
+      .expect(400));
+});
+```
+
+## overrideGuard / override others
+
+`overrideGuard`, `overrideInterceptor`, `overridePipe`, `overrideFilter` mirror `overrideProvider`. Use them to neutralize auth or wrap-response behavior that would otherwise complicate the assertion.
+
+## Testing a request-scoped provider
+
+Singletons come from `.get()`; a request-scoped provider must come from `.resolve()`, which returns a Promise and gives a fresh instance per call (per DI sub-tree).
+
+```typescript
+const ctx = await moduleRef.resolve(RequestContext);
+```
+
+Each `resolve()` is a distinct instance — assert on the one you resolved, not on a `.get()` that would throw for a scoped provider.
+
+## ConfigModule in tests
+
+Provide config explicitly instead of relying on `.env` files leaking into CI:
+
+```typescript
+await Test.createTestingModule({
+  imports: [ConfigModule.forRoot({ ignoreEnvFile: true, load: [() => ({ JWT_SECRET: 'test' })] })],
+  providers: [AuthService],
+}).compile();
+```
+
+## Vitest vs Jest
+
+NestJS 11's harness moved toward **Vitest** (SWC-powered, fast), and these recipes use `vi.fn()`. Swap to `jest.fn()` if your project is on Jest — Jest is still fully supported and is what `nest new` scaffolds historically. The `Test.createTestingModule` API is identical under both.

package/skills/shared/nestjs/scripts/verify.sh

@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+# verify.sh — static checks for NestJS DI hygiene. No Nest install required.
+# Read-only. Hard-fails ONLY on a DI bypass (`new XxxService(`/`new XxxRepository(`)
+# outside test files. Everything else is a warning. Exits 0 on a clean/empty target.
+#
+# Usage: scripts/verify.sh [dir]   (defaults to current directory)
+set -euo pipefail
+
+DIR="${1:-.}"
+HARD_FAIL=0
+
+if [ ! -d "$DIR" ]; then
+  echo "verify.sh: '$DIR' is not a directory" >&2
+  exit 2
+fi
+
+# Collect TypeScript source files, skipping deps and build output.
+# Portable to bash 3.2 (macOS) — no mapfile; newline-delimited list.
+TS_FILES="$(
+  find "$DIR" -type f -name '*.ts' \
+    -not -path '*/node_modules/*' \
+    -not -path '*/dist/*' \
+    -not -path '*/build/*' \
+    2>/dev/null
+)"
+
+if [ -z "$TS_FILES" ]; then
+  echo "verify.sh: no .ts files found under '$DIR' — nothing to check."
+  exit 0
+fi
+
+is_test_file() {
+  case "$1" in
+    *.spec.ts|*.e2e-spec.ts|*.test.ts|*/test/*|*/__tests__/*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+SPEC_PRESENT=0
+TESTING_MODULE_PRESENT=0
+MAIN_HAS_GLOBALS=0
+
+# main.ts global config detection (any file named main.ts).
+while IFS= read -r f; do
+  [ -z "$f" ] && continue
+  case "$f" in
+    */main.ts|main.ts)
+      if grep -Eq 'useGlobal(Pipes|Filters|Guards|Interceptors)\(' "$f"; then
+        MAIN_HAS_GLOBALS=1
+      fi
+      ;;
+  esac
+done <<EOF
+$TS_FILES
+EOF
+
+while IFS= read -r f; do
+  [ -z "$f" ] && continue
+  if is_test_file "$f"; then
+    SPEC_PRESENT=1
+    if grep -q 'Test.createTestingModule' "$f"; then
+      TESTING_MODULE_PRESENT=1
+    fi
+    # e2e bootstrap that does not replicate main.ts globals.
+    if [ "$MAIN_HAS_GLOBALS" -eq 1 ] && grep -q 'createNestApplication' "$f"; then
+      if ! grep -Eq 'useGlobal(Pipes|Filters|Guards|Interceptors)\(' "$f"; then
+        echo "WARN  $f: createNestApplication() but no useGlobal* — main.ts sets globals; replicate them or the e2e diverges from prod."
+      fi
+    fi
+    continue
+  fi
+
+  # HARD: manual instantiation of a Service/Repository bypasses DI.
+  while IFS=: read -r ln _; do
+    [ -z "$ln" ] && continue
+    echo "FAIL  $f:$ln: 'new ...Service('/'new ...Repository(' bypasses the DI container — constructor-inject instead."
+    HARD_FAIL=1
+  done < <(grep -nE 'new [A-Za-z0-9_]+(Service|Repository)\(' "$f" | cut -d: -f1 | sed 's/$/:/')
+
+  # WARN: useGlobalPipes/Guards(new X(...)) — cannot inject deps; prefer APP_* token.
+  if grep -Eq 'useGlobal(Pipes|Guards|Interceptors|Filters)\(\s*new ' "$f"; then
+    echo "WARN  $f: useGlobal*(new X()) cannot inject dependencies — if the pipe/guard needs DI, bind it via an APP_* token in a module's providers."
+  fi
+done <<EOF
+$TS_FILES
+EOF
+
+if [ "$SPEC_PRESENT" -eq 1 ] && [ "$TESTING_MODULE_PRESENT" -eq 0 ]; then
+  echo "WARN  spec files present but no Test.createTestingModule found — Nest tests should build a TestingModule."
+fi
+
+if [ "$HARD_FAIL" -ne 0 ]; then
+  echo "verify.sh: DI bypass detected — see FAIL lines above." >&2
+  exit 1
+fi
+
+echo "verify.sh: OK (warnings above are advisory)."
+exit 0

package/skills/shared/netlify/SKILL.md

@@ -0,0 +1,208 @@
+---
+name: netlify
+description: "Use when deploying or operating a site on Netlify — writing or fixing netlify.toml, authoring Functions or Edge Functions, redirects, rewrites and headers, env vars per deploy context, and shipping via the Netlify CLI. NOT deploying to Vercel (that is `vercel`)."
+tags: [netlify, deployment, serverless-functions, edge-functions, netlify-toml, redirects]
+recommends: [vercel, cloudflare, nextjs, domains-dns, github-actions]
+origin: ai-hub
+---
+
+# Netlify — netlify.toml, Functions, Edge Functions, redirects & the CLI
+
+> The platform-mechanics layer for Netlify: config, function handlers, routing, env
+> contexts, and the deploy CLI. Not framework code, not generic CI.
+
+## What this owns
+
+You own the Netlify adapter/config surface — `netlify.toml`, `netlify/functions/`,
+`netlify/edge-functions/`, `_redirects`, `_headers`, and `netlify <cmd>`. You do **not** own
+the app's routing or data layer (that is `../nextjs/SKILL.md` / a React skill), DNS records
+(`../domains-dns/SKILL.md`), or another platform's config — Vercel is `../vercel/SKILL.md`,
+Cloudflare is `../cloudflare/SKILL.md`. Their config files and function models differ; never
+cross-apply.
+
+## The 5-minute happy path
+
+```bash
+netlify link                 # link the cwd to a site (or `netlify init` to create one)
+# write/edit netlify.toml (see skeleton below)
+netlify dev                  # local emulation: build, functions, redirects, env injection
+netlify deploy --prod        # build + push straight to production
+```
+
+`netlify deploy` with no flag creates a **draft** deploy (preview URL, not live). `--prod`
+publishes. Test with `netlify dev` first — it is the only local runtime that emulates
+redirects and function routing together.
+
+## Where does each piece of config live?
+
+Two rules decide everything below: **`_redirects`/`_headers` files are processed before the
+`netlify.toml` equivalents**, and a function's own `config` export beats dashboard guesses.
+
+| Concern | Put it in | Why |
+| --- | --- | --- |
+| Redirects / rewrites / SPA fallback | `[[redirects]]` in toml **or** `_redirects` file | One source. File rules run first; pick one and stay consistent. |
+| Response headers (CSP, caching) | `[[headers]]` in toml **or** `_headers` file | Same precedence; keep security headers in version control, not the UI. |
+| Build command / publish dir / functions dir | `[build]` in toml | Single declarative source the build picks up; survives UI drift. |
+| A function's URL path | `export const config = { path }` in the function | Co-located with the handler; deterministic, no dashboard mapping. |
+| Edge function path + ordering | `[[edge_functions]]` in toml | Declaration order in toml is deterministic (inline config is not). |
+| Secrets / API keys / per-context vars | dashboard or `netlify env:set` | Never commit secrets — build-time secrets scanning fails the build if it finds one. |
+
+## netlify.toml skeleton
+
+```toml
+[build]
+  command  = "npm run build"
+  publish  = "dist"            # the directory you deploy; relative to base
+  functions = "netlify/functions"
+  [build.environment]
+    NODE_VERSION = "22"
+
+[functions]
+  node_bundler = "esbuild"
+  # included_files = ["data/**"]   # bundle extra files a function reads at runtime
+
+# SPA fallback — note status 200, NOT 301 (see Redirects)
+[[redirects]]
+  from   = "/*"
+  to     = "/index.html"
+  status = 200
+
+[[headers]]
+  for = "/*"
+  [headers.values]
+    X-Frame-Options = "DENY"
+    Content-Security-Policy = "default-src 'self'"
+
+# per-context override: deploy previews build differently
+[context.deploy-preview]
+  command = "npm run build:preview"
+  [context.deploy-preview.environment]
+    SHOW_PREVIEW_BANNER = "true"
+```
+
+Contexts are `production`, `deploy-preview`, `branch-deploy`, and `branch."name"`. Each can
+override `command`, `publish`, `environment`, etc. The full key-by-key reference (every
+`[build]`/`[functions]`/`[[plugins]]` option, all header/redirect fields) lives in
+[references/netlify-toml.md](references/netlify-toml.md) — link there instead of inlining it.
+
+## Functions (Node runtime)
+
+Default directory is `netlify/functions/`. TypeScript files are `.mts`, JS is `.mjs` (ES
+modules). Use the **modern Web-platform handler** — `Request` in, `Response` out — and route
+with a `config` export, not a dashboard mapping.
+
+```typescript
+// netlify/functions/hello.mts
+import type { Config, Context } from "@netlify/functions";
+
+export default async (req: Request, context: Context) => {
+  const name = new URL(req.url).searchParams.get("name") ?? "world";
+  return Response.json({ hello: name });
+};
+
+export const config: Config = { path: "/api/hello" };
+```
+
+Read secrets from the environment; never hardcode them:
+
+```typescript
+const key = Netlify.env.get("RESEND_API_KEY") ?? process.env.RESEND_API_KEY;
+```
+
+Do **not** revive the legacy AWS-Lambda signature in new functions:
+
+```javascript
+// Bad — legacy handler/event/statusCode shape
+exports.handler = async (event) => ({ statusCode: 200, body: "ok" });
+```
+
+```typescript
+// Good — Web-API handler + Config.path
+export default async (req: Request) => new Response("ok");
+export const config: Config = { path: "/ok" };
+```
+
+Scheduled (`config.schedule` cron), background (`-background` suffix), and streaming
+responses are covered in [references/functions.md](references/functions.md).
+
+## Edge Functions (Deno runtime)
+
+Live in `netlify/edge-functions/`, run on Deno at the edge. Declare them in toml so ordering
+is explicit:
+
+```toml
+[[edge_functions]]
+  function = "geo-rewrite"
+  path     = "/*"
+  # excludedPath = "/assets/*"
+```
+
+When **multiple** edge functions match one path, they run **top-to-bottom in declaration
+order** — declaring in `netlify.toml` is deterministic; relying on each function's inline
+`config` for ordering is not. Pick edge functions for latency-sensitive rewrites,
+geolocation, and A/B routing. Avoid them for heavy npm dependencies or Node-only APIs — use a
+regular Function there.
+
+## Redirects & rewrites
+
+```text
+# _redirects (or the [[redirects]] equivalent)
+/api/*   https://api.example.com/:splat   200   # proxy/rewrite: keep the URL, fetch remote
+/old/*   /new/:splat                       301   # permanent redirect (default status)
+/*       /index.html                        200   # SPA fallback
+```
+
+Three things people get wrong:
+
+- **SPA fallback must be `status = 200`**, not 301. 200 *serves* `index.html` at the original
+  URL so the client router can read the path; a 301 changes the URL and breaks deep links.
+- **Proxy/rewrite = `status = 200`** to a remote URL (add `force = true` to override an
+  existing file at that path).
+- **Processing order**: Edge Functions run first, then `_redirects` rules, then `netlify.toml`
+  redirects; within the set the **first matching rule wins** (top-to-bottom). Put specific
+  rules above the `/*` catch-all.
+
+## Env vars & deploy contexts
+
+```bash
+netlify env:set RESEND_API_KEY "xxxx" --context production
+netlify env:set SHOW_BANNER "true" --context deploy-preview
+netlify env:list --context deploy-preview
+netlify env:import .env            # bulk import (do not commit .env)
+```
+
+Variables are scoped to deploy contexts, so a key can differ between production and previews.
+Build-time **secrets scanning** inspects build output; if a value you marked secret leaks into
+the bundle, the build **fails** — fix the leak, don't disable the scan blindly.
+
+## Deploy & local dev
+
+| Command | Use it for |
+| --- | --- |
+| `netlify dev` | Local: build + functions + redirects + env injection. The truth before deploy. |
+| `netlify deploy` | Draft deploy → preview URL, not live. |
+| `netlify deploy --prod` | Build + publish to production. |
+| `netlify deploy --prod --no-build` | Publish an **already-built** dir; skips the build command. |
+| `netlify deploy --skip-functions-cache` | Force re-bundle functions when a stale cache bites. |
+
+`--no-build` is the classic foot-gun: if you didn't actually build (or built into the wrong
+`publish` dir), you ship a stale or empty site. Only use it when the artifact is fresh.
+
+## Anti-patterns
+
+| Anti-pattern | Why it breaks | Do instead |
+| --- | --- | --- |
+| SPA fallback as `status = 301` | URL rewrites; deep-link refresh 404s or loops | `status = 200` to `/index.html` |
+| Hardcoding API keys in a function | Leaks in bundle; secrets scan fails the build | `Netlify.env.get(...)` / `process.env`, set via `netlify env:set` |
+| Legacy `exports.handler = (event) => ({statusCode})` | Old Lambda shape, mismatched runtime expectations | Web-API `export default (req) => Response` + `config.path` |
+| Relying on inline edge `config` for run order | Ordering is non-deterministic across functions | Declare order in `[[edge_functions]]` in toml |
+| `netlify deploy --prod --no-build` without building | Ships stale/empty `publish` dir | Build first, or drop `--no-build` |
+| Pasting Vercel/Cloudflare config into Netlify | Different files & function models; nothing wires up | Use `netlify.toml` + `netlify/functions`; see `../vercel/SKILL.md` for Vercel |
+| `functions` dir in toml ≠ actual folder on disk | Functions silently not bundled → 404 | Make `[build].functions` match `netlify/functions/` exactly |
+| `/*` redirect above a specific rule | Catch-all wins first; specific rule never matches | Order specific rules before the `/*` fallback |
+
+## Verify
+
+Run `scripts/verify.sh [target-dir]` (default cwd). It confirms a `netlify.toml` exists,
+parses, that any SPA fallback is `status = 200`, and that every `[[redirects]]` has both
+`from` and `to`. Read-only; exits 0 on a clean or empty target.

package/skills/shared/netlify/evals/README.md

@@ -0,0 +1,13 @@
+# Evals — netlify
+
+`cases.yaml` holds three groups. `should_trigger` are prompts where this skill must fire
+(including non-obvious symptom phrasings like SPA-refresh 404s and secrets-scan build failures,
+plus a Catalan case). `should_not_trigger` are nearby prompts that belong to a sibling, each
+tagged with the `route_to` id that should win instead. `capability` is an end-to-end scenario
+with a `must_include` rubric.
+
+There is no automated runner here. To evaluate: feed each `should_trigger` / `should_not_trigger`
+prompt to the router and confirm the skill fires (or yields to the named sibling). For the
+`capability` case, have the agent produce the artifact and check the output covers every
+`must_include` bullet. The structural correctness of an emitted `netlify.toml` is separately
+checkable with `../scripts/verify.sh`.

package/skills/shared/netlify/evals/cases.yaml

@@ -0,0 +1,43 @@
+skill: netlify
+
+should_trigger:
+  - prompt: "My React SPA shows 'Page not found' when I refresh a deep link on Netlify."
+    why: "Non-obvious — the symptom is a missing SPA fallback redirect (status 200 to /index.html), a core Netlify routing config concern."
+  - prompt: "Set up a Netlify function at /api/hello that returns JSON."
+    why: "Direct Functions authoring — modern Web-API handler plus config.path routing in netlify/functions/."
+  - prompt: "Write a netlify.toml with different build commands for deploy previews vs production."
+    why: "Deploy-context overrides ([context.deploy-preview] vs [context.production]) live squarely in this skill."
+  - prompt: "Configura el netlify.toml i desplega-ho a producció amb la CLI."
+    why: "Catalan phrasing for writing netlify.toml and shipping with netlify deploy --prod."
+  - prompt: "My Netlify build passes locally but fails because it detected a secret in env."
+    why: "Non-obvious — Netlify build-time secrets scanning; resolution is env-context handling, a platform-mechanics concern."
+  - prompt: "Add an edge function that geolocates the request and rewrites the path."
+    why: "Edge Functions on Deno with [[edge_functions]] declaration and context.geo — Netlify edge surface."
+
+should_not_trigger:
+  - prompt: "Deploy my Next.js app to Vercel with ISR."
+    route_to: vercel
+    why: "Different platform; Vercel config and function model do not map onto Netlify."
+  - prompt: "Set up Cloudflare Workers with Wrangler and KV."
+    route_to: cloudflare
+    why: "Cloudflare Workers/Wrangler is a separate platform with its own config."
+  - prompt: "How do I implement the React Router routes themselves in my app?"
+    route_to: nextjs
+    why: "Application routing code, not the Netlify deploy/redirect config layer."
+  - prompt: "Point my domain's A and MX records at the right hosts."
+    route_to: domains-dns
+    why: "DNS record management, not Netlify build or redirect configuration."
+  - prompt: "Build a GitHub Actions matrix CI pipeline for tests."
+    route_to: github-actions
+    why: "Generic CI unrelated to Netlify's own build system."
+
+capability:
+  - scenario: "A Vite SPA with a contact form needs: SPA fallback so deep links work, a /api/contact serverless function that emails via an env-stored API key, and a deploy-preview-only banner via a context env var. Produce the netlify.toml plus the function."
+    must_include:
+      - "SPA redirect with status = 200 to /index.html (not 301)"
+      - "netlify/functions handler using Request/Response with export const config { path }"
+      - "import type from @netlify/functions"
+      - "API key read via Netlify.env.get or process.env, not hardcoded"
+      - "[context.deploy-preview] environment override for the banner var"
+      - "netlify deploy --prod mentioned as the ship step"
+      - "explicit note that the secret is set via netlify env:set / not committed"