@imfusion/web-ui 0.5.1-dev.1.g3f7b7ce0 → 0.5.1-dev.11.g2e949f6d

package/bin/install-skill.js

@@ -1,180 +0,0 @@
-#!/usr/bin/env node
-
-// Installs the consumer skill family (../src/llms/skills/imf-web-ui*/)
-// into the consumer project's agent skill directories. Runs in the
-// CONSUMER's environment, so it may only use this package's real runtime
-// dependencies (@clack/prompts). Never wire this into a postinstall hook:
-// ambient script execution on `npm install` is a live supply-chain attack
-// vector — install stays an explicit, user-run command.
-//
-// The skills cross-reference each other, so they install as one bundle.
-// When both targets are selected, .agents/skills/ holds the real copy and
-// .claude/skills/ symlinks it (this repo's own convention) so the two
-// can't drift apart.
-
-import {
-  cpSync,
-  existsSync,
-  lstatSync,
-  mkdirSync,
-  readdirSync,
-  readFileSync,
-  rmSync,
-  symlinkSync,
-  writeFileSync
-} from "node:fs";
-import { dirname, relative, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-import * as p from "@clack/prompts";
-
-const SKILL_PREFIX = "imf-web-ui";
-const VERSION_MARKER = ".imf-web-ui-skill-version.json";
-
-const here = dirname(fileURLToPath(import.meta.url));
-// Source is relative to THIS SCRIPT's location (inside node_modules), not
-// the consumer's cwd — the script is invoked from the consumer's project
-// root, but the skills it copies ship alongside this file in the package.
-const skillsRoot = resolve(here, "..", "src", "llms", "skills");
-const packageJson = JSON.parse(readFileSync(resolve(here, "..", "package.json"), "utf-8"));
-const currentVersion = packageJson.version;
-
-// Destination is relative to the consumer's project root (cwd), since
-// that's where their `.claude/` or `.agents/` directory lives.
-const projectRoot = process.cwd();
-
-const TARGETS = {
-  claude: { label: "Claude Code", root: resolve(projectRoot, ".claude", "skills") },
-  agents: { label: "Vendor-neutral (.agents/)", root: resolve(projectRoot, ".agents", "skills") }
-};
-
-function discoverSkills() {
-  if (!existsSync(skillsRoot)) return [];
-  return readdirSync(skillsRoot, { withFileTypes: true })
-    .filter(entry => entry.isDirectory() && entry.name.startsWith(SKILL_PREFIX))
-    .map(entry => entry.name)
-    .sort();
-}
-
-function displayPath(absPath) {
-  return `./${relative(projectRoot, absPath)}`;
-}
-
-function readInstalledVersion(dir) {
-  const markerPath = resolve(dir, VERSION_MARKER);
-  if (!existsSync(markerPath)) return null;
-  try {
-    return JSON.parse(readFileSync(markerPath, "utf-8")).version ?? null;
-  } catch {
-    return null;
-  }
-}
-
-function writeRealCopy(sourceDir, destDir) {
-  mkdirSync(dirname(destDir), { recursive: true });
-  // force: true makes re-running after a version bump overwrite cleanly.
-  cpSync(sourceDir, destDir, { recursive: true, force: true });
-  writeFileSync(resolve(destDir, VERSION_MARKER), JSON.stringify({ version: currentVersion }, null, 2) + "\n");
-}
-
-function writeSymlink(linkPath, targetPath) {
-  mkdirSync(dirname(linkPath), { recursive: true });
-  // lstat (not existsSync, which follows symlinks) catches a broken/stale
-  // symlink left over from a prior run, not just a real file or directory.
-  if (lstatSync(linkPath, { throwIfNoEntry: false })) {
-    rmSync(linkPath, { recursive: true, force: true });
-  }
-  symlinkSync(relative(dirname(linkPath), targetPath), linkPath);
-}
-
-// --target claude|agents (repeatable) selects targets without the
-// interactive prompt — for CI and scripted installs.
-function parseTargetFlags(argv) {
-  const targets = [];
-  for (let i = 0; i < argv.length; i++) {
-    if (argv[i] !== "--target") continue;
-    const value = argv[i + 1];
-    if (!value || !(value in TARGETS)) {
-      console.error(`--target expects one of: ${Object.keys(TARGETS).join(", ")}`);
-      process.exit(1);
-    }
-    targets.push(value);
-    i++;
-  }
-  return targets;
-}
-
-async function main() {
-  const skills = discoverSkills();
-  const flagTargets = parseTargetFlags(process.argv.slice(2));
-
-  p.intro(`@imfusion/web-ui — install the ${SKILL_PREFIX} skills (${skills.length})`);
-
-  if (skills.length === 0) {
-    p.log.error(`No skills found at ${skillsRoot}. Reinstall @imfusion/web-ui and try again.`);
-    p.outro("Nothing installed.");
-    process.exitCode = 1;
-    return;
-  }
-
-  const existingVersions = Object.values(TARGETS)
-    .flatMap(({ root }) => skills.map(name => readInstalledVersion(resolve(root, name))))
-    .filter(Boolean);
-  if (existingVersions.length > 0 && existingVersions.every(v => v === currentVersion)) {
-    p.log.info(`Already up to date (v${currentVersion}). Re-running will overwrite with the same content.`);
-  } else if (existingVersions.some(v => v !== currentVersion)) {
-    const from = existingVersions.find(v => v !== currentVersion);
-    p.log.info(`Updating installed skills from v${from} to v${currentVersion}.`);
-  }
-
-  p.log.message(`Skills in this bundle:\n${skills.map(name => `  - ${name}`).join("\n")}`);
-
-  let selected;
-  if (flagTargets.length > 0) {
-    selected = flagTargets;
-    p.log.info(`Targets from --target flags: ${selected.join(", ")}`);
-  } else {
-    selected = await p.multiselect({
-      message: "Install into which skill directory (or directories)?",
-      options: Object.entries(TARGETS).map(([key, { label, root }]) => ({
-        value: key,
-        label,
-        hint: displayPath(root)
-      })),
-      required: true
-    });
-
-    if (p.isCancel(selected)) {
-      p.cancel("Cancelled — nothing installed.");
-      return;
-    }
-  }
-
-  const both = selected.includes("claude") && selected.includes("agents");
-
-  for (const name of skills) {
-    const sourceDir = resolve(skillsRoot, name);
-    if (both) {
-      // .agents/ is the canonical real copy; .claude/ aliases it via symlink.
-      const realDir = resolve(TARGETS.agents.root, name);
-      writeRealCopy(sourceDir, realDir);
-      writeSymlink(resolve(TARGETS.claude.root, name), realDir);
-    } else {
-      for (const key of selected) {
-        writeRealCopy(sourceDir, resolve(TARGETS[key].root, name));
-      }
-    }
-  }
-
-  if (both) {
-    p.log.success(`Vendor-neutral (.agents/) -> ${displayPath(TARGETS.agents.root)}/${SKILL_PREFIX}*`);
-    p.log.success(`Claude Code -> ${displayPath(TARGETS.claude.root)}/${SKILL_PREFIX}* (symlinks -> .agents/)`);
-  } else {
-    for (const key of selected) {
-      p.log.success(`${TARGETS[key].label} -> ${displayPath(TARGETS[key].root)}/${SKILL_PREFIX}*`);
-    }
-  }
-
-  p.outro(`Done — ${skills.length} skills installed.`);
-}
-
-await main();

package/src/llms/skills/imf-web-ui-frontend-patterns/SKILL.md

@@ -1,93 +0,0 @@
----
-name: imf-web-ui-frontend-patterns
-description:
-  "Raise the quality of frontend code written around @imfusion/web-ui — including quickly vibe-coded frontends. Library
-  boundary contract (tokens, CSS layers, type derivation), component roles, state placement, effects discipline, code
-  conventions (TypeScript, naming, file organisation, testing), and stack defaults. Load when writing wrapper components,
-  custom UI, styling beyond the defaults, adding new files to a consumer app, or choosing a routing, data-fetching, form, or
-  table library."
----
-
-# imf-web-ui-frontend-patterns
-
-One guard, once: **if the host project already has a convention — a styling system, a state library, a folder shape — the
-project wins.** These defaults fill vacuums. They are not a license to refactor a consumer codebase toward this document.
-
-Everything else below is how to build.
-
-## Stay behind the library
-
-Never import Base UI (or any other upstream this library wraps) directly — no upstream stylesheets, no upstream components,
-even when upstream docs show it that way. Everything a component needs ships in `@imfusion/web-ui`. If the library is missing
-something upstream has, report the gap (see `imf-web-ui-components`); don't reach around it.
-
-## Style through the sanctioned seams
-
-All library styles live in the `imf-ui.components` CSS layer, so **any plain selector you write wins** — that's the whole
-override contract:
-
-- Target the stable hooks: `data-imf-ui-component` attributes and your own classes/wrappers.
-- Never target the library's internal class names — they are generated and change without notice.
-- Never `!important` — if you think you need it, you're targeting the wrong thing.
-
-## Build custom UI from tokens
-
-Anything you build that the library doesn't cover — a stat widget, a custom panel — uses `--imf-ui-*` variables for color,
-spacing, radius, and type instead of hardcoded values. That's what makes custom UI look native next to library components,
-and what keeps it correct when the theme changes. A hex code or a magic `px` next to a concept the tokens already name is a
-defect.
-
-## Derive types, don't import them
-
-Prop types come from the components themselves: `React.ComponentProps<typeof Button>`. The library deliberately exports no
-`Props` types — don't look for them, and don't re-declare prop shapes by hand.
-
-## Integrations own their peers
-
-Components under `@imfusion/web-ui/integrations/*` depend on optional peers (e.g. `@tanstack/highlight` for `CodeHighlight`).
-Add the peer explicitly to the consumer's `package.json` — never rely on hoisting.
-
-## React patterns
-
-The full treatment — component roles with an example, state placement, effects discipline, and the react.dev sources to
-consult while building — lives in [references/react-patterns.md](references/react-patterns.md). Read it before writing new
-screens or wrappers. The core in one breath:
-
-- **Three roles.** Dumb components own how things look, layout components own arrangement, smart containers own data and
-  logic. Styling never lives in containers.
-- **State lives where its truth lives.** URL → query cache → context → store → local state; walk the list, stop at the first
-  match.
-- **Effects are a last resort**, and always extracted into purpose-named hooks.
-- **Compose, don't configure.** If a component's prop list reads like a settings page, it wanted to be two or three
-  components.
-
-## Everything else about the code
-
-TypeScript, naming, where files go, and what's worth testing live in
-[references/code-conventions.md](references/code-conventions.md). Read it when you're adding files rather than editing
-existing ones — that's when these choices get made and then inherited by everything after.
-
-The split between the two references: `react-patterns.md` covers **writing React** — component roles, where state lives,
-effects discipline, composition. `code-conventions.md` covers **the code around it** — TypeScript, JS style, naming, file
-layout, testing. Starting a new feature usually wants both.
-
-## Stack defaults
-
-TanStack is the default for the tooling around web-ui, whether the app is greenfield or you're adding one screen to something
-that already exists. The ones you'll reach for most: **Router** (URL state, type-safe search params), **Query** (server
-state), **Form** (form state), and **Table** for data grids, which you pair with web-ui's styled `Table` parts
-(`Table.SortableHeaderCell` carries the sort glue). The suite goes wider than those four — check what exists before adding a
-non-TanStack dependency. This is the stack the state ladder assumes.
-
-`useState` is the right tool for local UI state, and most of it is local: whether a panel is open, which tab is active, a
-draft value being typed, a hover flag. Keep those in the component and don't reach for a library.
-
-The line is what the state is _for_, not how much of it there is. A library owns the layer once you find yourself rebuilding
-what it does: validation timing and cross-field rules (**Form**), caching and refetching (**Query**), URL as the source of
-truth (**Router**), sorting and pagination over rows (**Table**). web-ui ships none of that logic, and that absence is not an
-argument for writing it yourself. Adding the library mid-project is normal and cheap; unpicking a hand-rolled version of it
-later is not.
-
-For best practices and patterns within any of these libraries, go to the library's own guidance rather than working from
-memory: `npx @tanstack/cli` for docs. Where a project has wired up `@tanstack/intent`, use it to reach the Agent Skills its
-TanStack dependencies ship, and read those too.

package/src/llms/skills/imf-web-ui-frontend-patterns/references/code-conventions.md

@@ -1,133 +0,0 @@
-# Code conventions
-
-The ImFusion defaults for everyday code around `@imfusion/web-ui` — the parts that aren't React-specific. TypeScript, file
-organisation, naming, and testing. React component structure lives in [react-patterns.md](react-patterns.md); the two are
-read together when starting new code.
-
-These fill vacuums. Where the host project has already decided, the project wins.
-
-## TypeScript
-
-- **`any` is forbidden.** `unknown` at a boundary you genuinely can't type, narrowed before use. An `any` that silences an
-  error moves the failure from compile time to runtime, which is the opposite of the trade you wanted.
-- **Lean on inference for locals; annotate the contract.** Restating a type the compiler already knows inside a function body
-  is a second thing to keep in sync. An **explicit return type on an exported function is worth writing**: it's the promise
-  the module makes, it stops an internal refactor silently widening the public shape, and it makes the error surface at the
-  function rather than at every call site.
-- **No temporal coupling.** Don't initialise to `null` and fill the value in later — model the states instead, so "not loaded
-  yet" and "loaded, empty" aren't the same value.
-- **Avoid `as`.** A type assertion tells the compiler to stop checking exactly where checking is worth most. Fix the type.
-  Assertions at an untyped third-party boundary are the honest exception; keep them at the boundary, not spread through call
-  sites.
-
-**Derive types, don't duplicate them.** One source of truth, everything else follows from it:
-
-```ts
-const sizes = ["sm", "md", "lg"] as const;
-type Size = (typeof sizes)[number];
-
-const labels: Record<Size, string> = { sm: "S", md: "M", lg: "L" }; // compiler breaks if `sizes` changes
-```
-
-The same rule crosses the library boundary: prop types come from the components themselves
-(`React.ComponentProps<typeof Button>`), never re-declared by hand.
-
-**Function signatures.** One or two positional arguments read fine. At three or more, take a single object and destructure —
-call sites stop depending on argument order, and adding a parameter stops being a breaking change.
-
-## Expressions over statements
-
-Reach for the array methods before the loop. `map`, `filter`, `find`, `some`, `every`, `flatMap`, `reduce` — each names what
-it's doing, where a `for` loop makes you read the body to find out.
-
-```ts
-// The name is the documentation
-const activeNames = users.filter(u => u.isActive).map(u => u.name);
-
-// vs. a loop you have to read to understand
-const activeNames = [];
-for (const u of users) {
-  if (u.isActive) activeNames.push(u.name);
-}
-```
-
-The deeper reason is mutation: the method chain produces a new value, so nothing else can observe a half-built array. Prefer
-spreads and `structuredClone` over in-place edits, and `toSorted`/`toReversed` over `sort`/`reverse`, which mutate their
-receiver and have surprised everyone at least once.
-
-Two honest exceptions: a genuine early exit (`for` with `break` beats `find` returning a sentinel) and a hot loop over
-thousands of items where the intermediate arrays actually measure. Neither is the common case, so reach for the method first
-and justify the loop.
-
-Keep the chain flat. Three or four steps read well; ten want intermediate named constants, and a `reduce` doing four things
-at once wants to be a loop after all.
-
-## Naming
-
-- Say what it is, not what it is made of. `useUserQuery`, not `useUserHook`. `retryDelay`, not `num`.
-- Booleans read as assertions: `isOpen`, `hasAccess`, `canSubmit`. A boolean called `status` will end up holding a string.
-- Handlers are `onX` as props, `handleX` as implementations — the prop names the event, the function names the response.
-- Match the vocabulary the product and the API already use. Inventing a synonym for a term the backend already named costs a
-  translation step on every read.
-
-## File and folder organisation
-
-Kebab-case throughout, folders and files.
-
-```
-src/
-  routes/          # TanStack Router file-based routes; routing only
-  api/<topic>/     # <topic>.ts (queries/mutations), query-key.ts, types.ts
-  components/      # grouped by kind of component — layouts/, primitives/, or a domain name
-  http/            # client, error normalisation
-  lib/             # framework-free helpers
-```
-
-`api/` groups by topic: a query lives next to its key factory and its types, so a query key is never spelled out at a call
-site. Routes compose and don't fetch inline. Transport concerns live in `http/` and nowhere else.
-
-`components/` groups by kind — a layout component under `layouts/`, not beside a domain widget. Flat is fine while there are
-few; let the grouping follow what the project has rather than imposing it up front. The kinds worth separating are the
-component roles in [react-patterns.md](react-patterns.md): dumb components, layout components, smart containers.
-
-A component gets a folder once it has more than one file, with an `index.ts` that only re-exports:
-
-```
-components/data-table/
-  data-table.tsx
-  data-table-row.tsx
-  data-table.module.css
-  index.ts
-```
-
-Colocate tests, styles, and types with their subject. A file you have to hunt for in a parallel tree gets edited less
-carefully.
-
-## Styling
-
-**CSS Modules by default**, colocated as `<component>.module.css`. No CSS-in-JS, no utility-class framework. Compose from
-`--imf-ui-*` tokens so custom UI stays consistent with library components and follows the theme; the override contract (CSS
-layers, `data-imf-ui-component`, never the library's generated class names) is in the parent skill.
-
-`imf-web-ui-imfusion-frontend-setup` sets up or audits this structure on an ImFusion project.
-
-## Testing
-
-Test the **decisions**, not the rendering.
-
-- **Pure logic gets unit tests** — pricing, permissions, date math, parsing, reducers. These are cheap, fast, and the place
-  bugs actually hide.
-- **Presentational components generally don't.** A component that maps props onto web-ui primitives has no logic of its own;
-  asserting that it rendered a `<Button>` tests React, not your code.
-- **Behaviour a user performs gets an interaction test** — a form that validates, a flow with steps. Test it through the
-  interface the user has (roles, labels, visible text), not through internals.
-- **Extract the decision out of a hook and test that.** A hook whose interesting part is a plain function is easier to test
-  as a plain function than through a render harness. A hook that only wraps a browser API has no decision to extract.
-
-The measure isn't coverage percentage. It's whether a test failing tells you something you didn't already know.
-
-## Formatting and linting
-
-Don't argue about it in review — the tooling decides, and it runs before the commit lands. A formatter, a linter, and a
-pre-commit hook wired so none of them is optional. On an ImFusion project, `imf-web-ui-imfusion-frontend-setup` carries the
-baseline and the setup steps.

package/src/llms/skills/imf-web-ui-imfusion-frontend-setup/SKILL.md

@@ -1,202 +0,0 @@
----
-name: imf-web-ui-imfusion-frontend-setup
-description:
-  "Set up or audit an ImFusion frontend's project tooling: the stack, package.json scripts, formatting, linting, typecheck,
-  staged-file and pre-commit hooks, verification scopes, dependency pinning, tsconfig, folder structure. House conventions,
-  not industry standards. Load when starting a new ImFusion frontend, or when asked what an existing one's setup is missing.
-  Not for adding one config file on request — that's just the edit. Not for wiring the library itself (imf-web-ui-setup)."
----
-
-# imf-web-ui-imfusion-frontend-setup
-
-ImFusion house conventions, **not** industry standards. Report as "missing against the ImFusion baseline", never "against
-best practice". Only apply to an ImFusion frontend.
-
-Two modes, same list:
-
-- **New project** — work down the list and set each piece up.
-- **Existing project** — audit. Read the repo (don't ask what it has), report present / missing / broken, change nothing
-  until the human picks. An established repo is where a forgotten piece hides.
-
-**The project wins.** Where the repo already decided, that stands. Report what's _absent_; a working convention you'd have
-chosen differently is not a finding.
-
-## The stack
-
-| Concern      | Tool                                                      | Notes                                                                               |
-| ------------ | --------------------------------------------------------- | ----------------------------------------------------------------------------------- |
-| Format       | [Prettier](https://prettier.io)                           | Values below are shared across repos                                                |
-| Lint         | [ESLint](https://eslint.org) flat config                  | `--cache --max-warnings=0`                                                          |
-| Types        | `tsc --noEmit`                                            | Own script, own CI step                                                             |
-| Staged files | [lint-staged](https://github.com/lint-staged/lint-staged) | [nano-staged](https://github.com/usmanyunusov/nano-staged) is a drop-in alternative |
-| Routing      | [TanStack Router](https://tanstack.com/router)            | File-based, `src/routes/`                                                           |
-| Server state | [TanStack Query](https://tanstack.com/query)              | Query keys colocated per API topic                                                  |
-| Client state | [TanStack Store](https://tanstack.com/store)              | Only for state that isn't URL- or server-owned                                      |
-| Styling      | CSS Modules                                               | Colocated `<component>.module.css`                                                  |
-| Dead code    | [knip](https://knipjs.dev)                                | Needs per-repo config                                                               |
-| Build        | [Vite](https://vite.dev)                                  |                                                                                     |
-| Test         | [Vitest](https://vitest.dev)                              |                                                                                     |
-
-Either staged-file runner is fine; lint-staged is the larger project and the safer default when one misbehaves.
-
-### Devtools come with the library
-
-Every TanStack library that ships a devtools package gets it as a dev dependency alongside the library itself, mounted in
-development only. Router is a given in any ImFusion frontend, so `@tanstack/react-router-devtools` is a given too; Query's
-goes in when Query does, and so on. Look for a `-devtools` sibling whenever you add a TanStack dependency rather than working
-from a fixed list — the set grows, and not every library has one yet (Store doesn't). Once a project has several,
-`@tanstack/devtools` hosts them in one panel.
-
-## package.json
-
-`"type": "module"`, `"private": true`. Scripts — these names, in every repo:
-
-| Script             | Runs                                                     |
-| ------------------ | -------------------------------------------------------- |
-| `dev`              | dev server                                               |
-| `build`            | production build                                         |
-| `verify:lint`      | `eslint . --cache --max-warnings=0`                      |
-| `verify:format`    | `prettier --check .`                                     |
-| `verify:typecheck` | `tsc --noEmit`                                           |
-| `verify:tests`     | `vitest run`                                             |
-| `verify:staged`    | staged-file subset, called by the pre-commit hook        |
-| `verify:full`      | every check above plus the build; what CI runs           |
-| `format`           | `prettier --write .`                                     |
-| `lint:fix`         | `eslint . --cache --fix`                                 |
-| `git:config`       | `git config core.hooksPath …` + `pull.rebase`/`merge.ff` |
-| `prepare`          | `npm run git:config`                                     |
-
-**Every check is `verify:*`.** One namespace, so "what can I run to check this?" is answered by tab-completion. Write-mode
-scripts keep tool names — `format` and `lint:fix` change files, which isn't verifying. Same name, same meaning, every repo.
-
-**Git config gets its own script.** `git:config` holds the real command so it's greppable and runnable by hand; `prepare` is
-a one-line delegator to it. `prepare` can't be renamed away — npm reserves it and runs it after install — but it shouldn't be
-where the logic lives either, since lifecycle scripts get disabled and an invisible setup step then silently stops happening.
-
-**Dependencies pinned exactly.** No `^`, `~`, or `latest`, in `dependencies` and `devDependencies` alike. A check script in
-the verify chain enforces it, but that only catches drift after it lands — `save-exact=true` in `.npmrc` stops `npm install`
-reintroducing ranges in the first place.
-
-## Config
-
-**Prettier** — config file shape is free (`.prettierrc`, `prettier.config.ts`); the values are not:
-
-```
-printWidth: 125   tabWidth: 2   useTabs: false   trailingComma: "none"
-arrowParens: "avoid"   semi: true   singleQuote: false   proseWrap: "always"
-```
-
-No config file at all means Prettier runs on defaults — flag it, the values silently differ.
-
-**ESLint** — flat config (`eslint.config.ts`), `strictTypeChecked` + `stylisticTypeChecked` with `projectService: true`, `as`
-and `!` banned outside tests, and `.gitignore` as the ignore source (`includeIgnoreFile` from `@eslint/compat`) so ignores
-aren't maintained twice.
-
-**tsconfig** — defaults:
-
-```jsonc
-{
-  "compilerOptions": {
-    "strict": true,
-    "moduleResolution": "bundler",
-    "verbatimModuleSyntax": true, // import type stays import type
-    "noUnusedLocals": true,
-    "noUnusedParameters": true,
-    "noFallthroughCasesInSwitch": true,
-    "noUncheckedSideEffectImports": true,
-    "skipLibCheck": true,
-    "paths": { "#/*": ["./src/*"] }
-  }
-}
-```
-
-The alias is always `#/` → `src/`. `#` is Node's own subpath-import prefix, so it resolves without a bundler-specific
-convention, and it can't collide with an npm scope the way `@/` does.
-
-**Staged files** — runner config applying eslint `--fix` and prettier `--write` to staged files only.
-
-**Pre-commit** — the hook installs itself via `prepare` → `git:config`, which sets `core.hooksPath` to a tracked directory
-plus `pull.rebase true` and `merge.ff only`, so history strategy doesn't depend on personal git config. Two silent failure
-modes: no `prepare` at all (hooks exist only on the machine that ran `git config` by hand), and `core.hooksPath` pointing at
-a directory that doesn't exist. Check config **and** directory.
-
-**Verify scopes** — two blocking, one advisory:
-
-- **staged** — `verify:staged`, called by the pre-commit hook: lint, format, restage. Fast. A passing commit is not CI green.
-- **full** — `verify:full`: the build plus every `verify:*` check. What CI runs.
-- **files** — optional post-edit agent hook. Advisory, never exits non-zero, so a mid-flight refactor can't trap the agent.
-
-One script owns each scope's step list; npm scripts and hooks only launch them. Name by depth, not by occasion — a name like
-`preflight` needs explaining and invites a second, near-identical script beside it. Two of those drift, and the drift reads
-as "passes locally, fails in CI".
-
-**Node pinning** — `.nvmrc` or `engines.node`. Not a personal version manager's config; that pins it for you alone.
-
-## Folder structure
-
-```
-src/
-  routes/                    # TanStack Router file-based routes; nothing but routing
-  api/<topic>/               # one folder per API topic
-    <topic>.ts               #   queries/mutations
-    query-key.ts             #   key factory
-    types.ts                 #   request/response types
-  components/                # see below
-  http/                      # client, error normalisation — the only transport-aware place
-  lib/                       # framework-free helpers
-```
-
-Everything is kebab-case, folders and files alike.
-
-**Inside `components/`, group by what kind of component it is** — `layouts/`, `primitives/`, `forms/`, or a domain name. Not
-a hard rule: a handful of components reads fine flat, and the grouping should follow what the project actually has rather
-than a structure imposed up front. But most codebases grow past flat, and a clear layout component belongs under `layouts/`
-rather than beside a domain widget.
-
-```
-components/
-  page-header/               # flat is fine
-  layouts/
-    page-shell/
-  data-table/                # a component with sub-component files
-    data-table.tsx
-    data-table-row.tsx
-    data-table.module.css
-    index.ts
-```
-
-A component gets a folder when it has more than one file — sub-components, styles, tests. Single-file components can stay
-single files. The folder's `index.ts` only re-exports, so imports read `#/components/data-table` and the inside can be
-restructured without touching call sites.
-
-Routes stay thin: they compose, they don't fetch inline. `api/<topic>/` holds the query and its key factory together so a key
-is never spelled out at a call site. Anything transport-level (base client, error normalisation) lives in `http/` and nowhere
-else.
-
-## Styling
-
-CSS Modules by default, colocated as `<component>.module.css` next to the component. No CSS-in-JS, no utility-class
-framework.
-
-On a project using `@imfusion/web-ui`, style through the sanctioned seams — `--imf-ui-*` tokens and `data-imf-ui-component`
-attributes, never the library's generated class names. `imf-web-ui-frontend-patterns` covers that contract.
-
-If more than one tool compiles the CSS (app build plus Storybook), the generated class-name pattern must be defined **once**
-and imported by both, or the same source file gets different class names in each and styles silently don't apply.
-`build/css-modules-config.ts` in web-ui is the reference shape; pick your own prefix.
-
-## Optional
-
-Recommend when the shape calls for it; absence is not a finding.
-
-- **knip** — once several people delete things independently.
-- **`ignore-scripts=true` in `.npmrc`** — blocks most supply-chain worm payloads; costs an explicit `npm rebuild` for native
-  deps.
-- **`eslint-plugin-jsx-a11y`** — anything user-facing.
-
-Out of scope, project-specific: CI, env and secrets, error tracking, deploy, dependency updates.
-
-## Not this skill
-
-- Library wiring (styles import, provider) → `imf-web-ui-setup`
-- Code conventions (TypeScript, naming, testing) → `imf-web-ui-frontend-patterns`, `references/code-conventions.md`