@ranimontagna/agent-toolkit 0.3.5 → 0.3.7

package/CHANGELOG.md

@@ -15,7 +15,12 @@ The release entries below are based on Git tag ranges and npm publication metada
 
 ## [Unreleased]
 
+- Updated the bundled `revenue-centric-design` skill to upstream `heliocosta-dev/revenue-centric-design@1942760` (1.3.0, 101 → 134 principles), adding the Checkout & Forms and Dashboards & Data Visualization references and vendoring only the assets they cite.
+- Refreshed bundled third-party skills against their upstreams: `ui-ux-pro-max` to `nextlevelbuilder/ui-ux-pro-max-skill@477bcb2` (curated data overhaul, design dials, GSAP presets and new references, with command paths kept relative to the skill directory and the upstream test suite left out), `react-native-unistyles-v3` to `jpudysz/react-native-unistyles@eef411b` (docs refresh), `fastify-best-practices` to `mcollina/skills@58b3eeb` (tables of contents in long rules), `brag-slim` to `latent-spaces/brag@069432c` (skip list and secrets rule), the `golang-patterns` golangci-lint `govet` example to `enable: [shadow]` from `affaan-m/ECC@d29cf65`, and the `docker-patterns` Node examples to `npm prune --omit=dev` with group-scoped `adduser`, following `sickn33/antigravity-awesome-skills@e0bcf88`.
+- Fixed the Codex Superpowers install on a `CODEX_HOME` that never synced the local `openai-curated` marketplace: the installer now falls back to `superpowers@openai-curated-remote`, the account's remote catalog.
 - Added the bundled `media/brag-slim` launch-video skill, vendored from `latent-spaces/brag@fd7de7e` with its MIT license and attribution notice.
+- Refreshed the pinned external tools: RTK `v0.51.0` with new archive checksums, Caveman `3.2.0` at `2e08b91`, Graphify `0.9.87`, GSD Core `1.16.0`, Agent Skills CLI `1.7.2`, Agent Browser `0.39.0` with its matching `vercel-labs/agent-browser` tag commit, the `pbakaus/impeccable`, `millionco/react-doctor`, `remotion-dev/skills` and `mattpocock/skills` sources, and the Claude Code `2.1.296`, Codex `0.162.1`, OpenCode `1.19.0` and Gemini `0.63.0` runtime CLIs, after re-checking the installer and Ariadne headless flags on each.
+- Updated `@clack/prompts` to `1.8.1` and the development dependencies `@biomejs/biome` `2.5.15`, `@types/node` `26.6.5` and `vitest` `5.0.3`.
 - Refreshed the pinned external tools: RTK `v0.50.0` with new archive checksums, Caveman `3.0.0` at `f5d7294`, Graphify `0.9.73`, GSD Core `1.15.0`, Agent Skills CLI `1.7.0`, and the Claude Code `2.1.286`, Codex `0.159.3`, OpenCode `1.18.34` and Gemini `0.62.0` runtime CLIs, after re-checking the Ariadne headless flags on each.
 - Refreshed the pinned Agent Skills sources: `shadcn/improve`, `pbakaus/impeccable`, `millionco/react-doctor`, `remotion-dev/skills`, `mattpocock/skills`, and Agent Browser `0.38.1` with its matching `vercel-labs/agent-browser` tag commit.
 - Added deterministic `skills.index.json` generation, prompt-sized `BRIEF.md`

package/README.md

@@ -62,13 +62,13 @@ Current external sources:
 
 | Tool | Locked source |
 |---|---|
-| RTK | `rtk-ai/rtk@v0.50.0`, with a SHA-256 pin for every supported archive |
-| Caveman | `JuliusBrussee/caveman@f5d729488caa8f6a5b6c8086fe2cccd3e8a63f91` |
-| Graphify | `graphifyy==0.9.73` |
-| GSD | `@opengsd/gsd-core@1.15.0` |
-| Agent Browser | `agent-browser@0.38.1` |
-| Agent Skills CLI | `skills@1.7.0`, with each source repository pinned to a full commit |
-| Runtime CLIs | `@anthropic-ai/claude-code@2.1.286`, `@openai/codex@0.159.3`, `opencode-ai@1.18.34`, and `@google/gemini-cli@0.62.0` |
+| RTK | `rtk-ai/rtk@v0.51.0`, with a SHA-256 pin for every supported archive |
+| Caveman | `JuliusBrussee/caveman@2e08b9177c07bb7249a8a2d1a6758e5db281d002` |
+| Graphify | `graphifyy==0.9.87` |
+| GSD | `@opengsd/gsd-core@1.16.0` |
+| Agent Browser | `agent-browser@0.39.0` |
+| Agent Skills CLI | `skills@1.7.2`, with each source repository pinned to a full commit |
+| Runtime CLIs | `@anthropic-ai/claude-code@2.1.296`, `@openai/codex@0.162.1`, `opencode-ai@1.19.0`, and `@google/gemini-cli@0.63.0` |
 | Ariadne adaptation provenance | `snarktank/ralph@6c53cb0b831ebe8739c6a003e22af14902d8b0b5`, with reviewed SHA-256 values for the MIT license and both adapted source skills |
 
 The Agent Skills catalog exposes these locked bundle IDs and skill names:
@@ -109,7 +109,7 @@ workflow; toolkit tags remain `vX.Y.Z`.
 
 The first-party `security` skills are defensive rewrites informed by [`uphiago/recon-skills`](https://github.com/uphiago/recon-skills), under its MIT License. They are intended for authorized, non-destructive reviews; upstream offensive infrastructure, agent instructions, scripts, and mass-scanning workflows are not included. See [`skills/security/NOTICE.md`](skills/security/NOTICE.md) for attribution.
 
-The bundled `media/brag-slim` skill is vendored from [`latent-spaces/brag`](https://github.com/latent-spaces/brag) at commit `fd7de7e418334876b3ea4e9258231a66a2c2a38d` under the MIT License. It turns a project directory or website URL into a short launch video with share copy, built with tools already on the machine; the full `/brag` skill, its render scripts, and bundled music are not included. See [`skills/media/brag-slim/NOTICE.md`](skills/media/brag-slim/NOTICE.md) for attribution.
+The bundled `media/brag-slim` skill is vendored from [`latent-spaces/brag`](https://github.com/latent-spaces/brag) at commit `069432cac935ed1895859df201c31436c07fb74e` under the MIT License. It turns a project directory or website URL into a short launch video with share copy, built with tools already on the machine; the full `/brag` skill, its render scripts, and bundled music are not included. See [`skills/media/brag-slim/NOTICE.md`](skills/media/brag-slim/NOTICE.md) for attribution.
 
 The first-party `ariadne` and `ariadne-prd` skills are Ariadne-specific adaptations of concepts from [`snarktank/ralph`](https://github.com/snarktank/ralph) under the MIT License. They install through the ordinary Custom Skills pipeline for all five runtimes; `tools.ariadne` records reviewed attribution only and is not fetched or executed during a normal Ariadne run. Each skill directory contains its source path, reviewed commit, and source hash in `NOTICE.md`.
 

package/dist/src/installers/superpowers.js

@@ -1,6 +1,27 @@
 import { info, ok, step, warn } from "../logger.js";
 import { state } from "../state.js";
-import { findCommand, run } from "../system.js";
+import { capture, findCommand, run } from "../system.js";
+// Codex lists Superpowers in the local `openai-curated` marketplace once it has
+// synced that catalog. A CODEX_HOME that never synced it only has the account's
+// remote catalog, where the same plugin is `openai-curated-remote`.
+const CODEX_SUPERPOWERS_PLUGINS = [
+    "superpowers@openai-curated",
+    "superpowers@openai-curated-remote",
+];
+function addCodexSuperpowers(codex) {
+    const errors = [];
+    for (const plugin of CODEX_SUPERPOWERS_PLUGINS) {
+        const result = capture(codex, ["plugin", "add", plugin]);
+        if (result.ok)
+            return true;
+        const error = (result.stderr || result.stdout).trim();
+        if (error)
+            errors.push(error);
+    }
+    for (const error of errors)
+        warn(error);
+    return false;
+}
 export function installSuperpowers() {
     step("Superpowers");
     console.log("   Planning, TDD, debugging and delivery workflows");
@@ -29,12 +50,7 @@ export function installSuperpowers() {
         const codex = findCommand("codex");
         if (codex) {
             info("Installing Superpowers for Codex CLI...");
-            const result = run(codex, [
-                "plugin",
-                "add",
-                "superpowers@openai-curated",
-            ]);
-            if (result.ok)
+            if (addCodexSuperpowers(codex))
                 ok("Superpowers installed for Codex CLI");
             else {
                 warn("Codex plugin install did not complete.");

package/dist/src/installers/superpowers.js.map

@@ -1 +1 @@
-{"version":3,"file":"superpowers.js","sourceRoot":"","sources":["../../../src/installers/superpowers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC,aAAa,CAAC,CAAC;IACpB,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAElE,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,2CAA2C,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE;gBACzB,QAAQ;gBACR,SAAS;gBACT,qCAAqC;aACtC,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,EAAE;gBAAE,EAAE,CAAC,uCAAuC,CAAC,CAAC;iBACtD,CAAC;gBACJ,IAAI,CAAC,8CAA8C,CAAC,CAAC;gBACrD,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,kEAAkE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,yCAAyC,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE;gBACxB,QAAQ;gBACR,KAAK;gBACL,4BAA4B;aAC7B,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,EAAE;gBAAE,EAAE,CAAC,qCAAqC,CAAC,CAAC;iBACpD,CAAC;gBACJ,IAAI,CAAC,wCAAwC,CAAC,CAAC;gBAC/C,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,0DAA0D,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC5B,IAAI,CACF,sHAAsH,CACvH,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,0CAA0C,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE;gBACzB,YAAY;gBACZ,SAAS;gBACT,qCAAqC;aACtC,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,EAAE;gBAAE,EAAE,CAAC,sCAAsC,CAAC,CAAC;iBACrD,CAAC;gBACJ,IAAI,CAAC,4CAA4C,CAAC,CAAC;gBACnD,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,4DAA4D,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC/B,IAAI,CACF,2HAA2H,CAC5H,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,QAAQ,CAAC;AACnB,CAAC"}
+{"version":3,"file":"superpowers.js","sourceRoot":"","sources":["../../../src/installers/superpowers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAEzD,gFAAgF;AAChF,gFAAgF;AAChF,oEAAoE;AACpE,MAAM,yBAAyB,GAAG;IAChC,4BAA4B;IAC5B,mCAAmC;CACpC,CAAC;AAEF,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,MAAM,IAAI,yBAAyB,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QACzD,IAAI,MAAM,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,IAAI,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM;QAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC,aAAa,CAAC,CAAC;IACpB,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAElE,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,2CAA2C,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE;gBACzB,QAAQ;gBACR,SAAS;gBACT,qCAAqC;aACtC,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,EAAE;gBAAE,EAAE,CAAC,uCAAuC,CAAC,CAAC;iBACtD,CAAC;gBACJ,IAAI,CAAC,8CAA8C,CAAC,CAAC;gBACrD,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,kEAAkE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,yCAAyC,CAAC,CAAC;YAChD,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,EAAE,CAAC,qCAAqC,CAAC,CAAC;iBACrE,CAAC;gBACJ,IAAI,CAAC,wCAAwC,CAAC,CAAC;gBAC/C,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,0DAA0D,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC5B,IAAI,CACF,sHAAsH,CACvH,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,0CAA0C,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE;gBACzB,YAAY;gBACZ,SAAS;gBACT,qCAAqC;aACtC,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,EAAE;gBAAE,EAAE,CAAC,sCAAsC,CAAC,CAAC;iBACrD,CAAC;gBACJ,IAAI,CAAC,4CAA4C,CAAC,CAAC;gBACnD,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,4DAA4D,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC/B,IAAI,CACF,2HAA2H,CAC5H,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,QAAQ,CAAC;AACnB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ranimontagna/agent-toolkit",
-  "version": "0.3.5",
+  "version": "0.3.7",
   "description": "Personal AI agent toolkit installer for Claude Code, Codex CLI, OpenCode, Gemini CLI, Antigravity and graph-aware workflows.",
   "type": "module",
   "engines": {
@@ -59,12 +59,12 @@
   "homepage": "https://github.com/raniellimontagna/agent-toolkit#readme",
   "license": "MIT",
   "devDependencies": {
-    "@biomejs/biome": "^2.5.11",
-    "@types/node": "^26.4.0",
+    "@biomejs/biome": "^2.5.15",
+    "@types/node": "^26.6.5",
     "typescript": "^7.0.2",
-    "vitest": "^4.1.11"
+    "vitest": "^5.0.3"
   },
   "dependencies": {
-    "@clack/prompts": "^1.7.0"
+    "@clack/prompts": "^1.8.1"
   }
 }

package/skills/backend/fastify-best-practices/NOTICE.md

@@ -3,7 +3,7 @@
 This skill is copied from Matteo Collina's public `mcollina/skills` repository.
 
 - Source: https://github.com/mcollina/skills/tree/main/skills/fastify
-- Imported from commit: `5b2a81354b6d10325da0db9decc9ce5ecc714138`
+- Imported from commit: `58b3eeb398d10c007988e80f73d30ebadab64754`
 - Upstream package name: `mcollina/fastify-best-practices`
 - License: MIT
 - Copyright: Copyright (c) 2026 Matteo Collina

package/skills/backend/fastify-best-practices/rules/authentication.md

@@ -7,6 +7,19 @@ metadata:
 
 # Authentication and Authorization
 
+## Contents
+
+- [JWT Authentication with @fastify/jwt](#jwt-authentication-with-fastifyjwt)
+- [Refresh Tokens](#refresh-tokens)
+- [Role-Based Access Control](#role-based-access-control)
+- [Permission-Based Authorization](#permission-based-authorization)
+- [API Key / Bearer Token Authentication](#api-key--bearer-token-authentication)
+- [OAuth 2.0 Integration](#oauth-20-integration)
+- [Session-Based Authentication](#session-based-authentication)
+- [Resource-Based Authorization](#resource-based-authorization)
+- [Password Hashing](#password-hashing)
+- [Rate Limiting for Auth Endpoints](#rate-limiting-for-auth-endpoints)
+
 ## JWT Authentication with @fastify/jwt
 
 Use `@fastify/jwt` for JSON Web Token authentication:

package/skills/backend/fastify-best-practices/rules/configuration.md

@@ -7,6 +7,15 @@ metadata:
 
 # Application Configuration
 
+## Contents
+
+- [Use env-schema for Configuration](#use-env-schema-for-configuration)
+- [Configuration as Plugin](#configuration-as-plugin)
+- [Secrets Management](#secrets-management)
+- [Feature Flags](#feature-flags)
+- [Anti-Patterns to Avoid](#anti-patterns-to-avoid)
+- [Dynamic Configuration](#dynamic-configuration)
+
 ## Use env-schema for Configuration
 
 **Always use `env-schema` for configuration validation.** It provides JSON Schema validation for environment variables with sensible defaults.

package/skills/backend/fastify-best-practices/rules/content-type.md

@@ -7,6 +7,22 @@ metadata:
 
 # Content Type Parsing
 
+## Contents
+
+- [Default Content Type Parsers](#default-content-type-parsers)
+- [Custom Content Type Parsers](#custom-content-type-parsers)
+- [XML Parsing](#xml-parsing)
+- [Multipart Form Data](#multipart-form-data)
+- [Stream Processing](#stream-processing)
+- [Custom JSON Parser](#custom-json-parser)
+- [Content Type with Parameters](#content-type-with-parameters)
+- [Catch-All Parser](#catch-all-parser)
+- [Body Limit Configuration](#body-limit-configuration)
+- [Protocol Buffers](#protocol-buffers)
+- [Form Data with @fastify/formbody](#form-data-with-fastifyformbody)
+- [Content Negotiation](#content-negotiation)
+- [Validation After Parsing](#validation-after-parsing)
+
 ## Default Content Type Parsers
 
 Fastify includes parsers for common content types:

package/skills/backend/fastify-best-practices/rules/cors-security.md

@@ -7,6 +7,24 @@ metadata:
 
 # CORS and Security
 
+## Contents
+
+- [CORS with @fastify/cors](#cors-with-fastifycors)
+- [Dynamic CORS Origin](#dynamic-cors-origin)
+- [Per-Route CORS](#per-route-cors)
+- [Security Headers with @fastify/helmet](#security-headers-with-fastifyhelmet)
+- [Configure Individual Headers](#configure-individual-headers)
+- [Rate Limiting](#rate-limiting)
+- [Redis-Based Rate Limiting](#redis-based-rate-limiting)
+- [CSRF Protection](#csrf-protection)
+- [Custom Security Headers](#custom-security-headers)
+- [Secure Cookies](#secure-cookies)
+- [Request Validation Security](#request-validation-security)
+- [IP Filtering](#ip-filtering)
+- [Trust Proxy](#trust-proxy)
+- [HTTPS Redirect](#https-redirect)
+- [Security Best Practices Summary](#security-best-practices-summary)
+
 ## CORS with @fastify/cors
 
 Enable Cross-Origin Resource Sharing:

package/skills/backend/fastify-best-practices/rules/database.md

@@ -7,6 +7,18 @@ metadata:
 
 # Database Integration
 
+## Contents
+
+- [Use Official Fastify Database Adapters](#use-official-fastify-database-adapters)
+- [PostgreSQL with @fastify/postgres](#postgresql-with-fastifypostgres)
+- [MySQL with @fastify/mysql](#mysql-with-fastifymysql)
+- [MongoDB with @fastify/mongodb](#mongodb-with-fastifymongodb)
+- [Redis with @fastify/redis](#redis-with-fastifyredis)
+- [Database as Plugin](#database-as-plugin)
+- [Repository Pattern](#repository-pattern)
+- [Testing with Database](#testing-with-database)
+- [Connection Pool Configuration](#connection-pool-configuration)
+
 ## Use Official Fastify Database Adapters
 
 Always use the official Fastify database plugins from the `@fastify` organization. They provide proper connection pooling, encapsulation, and integration with Fastify's lifecycle.

package/skills/backend/fastify-best-practices/rules/decorators.md

@@ -7,6 +7,20 @@ metadata:
 
 # Decorators and Extensions
 
+## Contents
+
+- [Understanding Decorators](#understanding-decorators)
+- [Decorator Types](#decorator-types)
+- [TypeScript Declaration Merging](#typescript-declaration-merging)
+- [Decorator Initialization](#decorator-initialization)
+- [Dependency Injection with Decorators](#dependency-injection-with-decorators)
+- [Request Context Pattern](#request-context-pattern)
+- [Reply Helpers](#reply-helpers)
+- [Checking Decorators](#checking-decorators)
+- [Decorator Encapsulation](#decorator-encapsulation)
+- [Functional Decorators](#functional-decorators)
+- [Async Decorator Initialization](#async-decorator-initialization)
+
 ## Understanding Decorators
 
 Decorators add custom properties and methods to Fastify instances, requests, and replies:

package/skills/backend/fastify-best-practices/rules/deployment.md

@@ -7,6 +7,20 @@ metadata:
 
 # Production Deployment
 
+## Contents
+
+- [Graceful Shutdown with close-with-grace](#graceful-shutdown-with-close-with-grace)
+- [Health Check Endpoints](#health-check-endpoints)
+- [Docker Configuration](#docker-configuration)
+- [Kubernetes Deployment](#kubernetes-deployment)
+- [Production Logger Configuration](#production-logger-configuration)
+- [Request Timeouts](#request-timeouts)
+- [Trust Proxy Settings](#trust-proxy-settings)
+- [Static File Serving](#static-file-serving)
+- [Compression](#compression)
+- [Metrics and Monitoring](#metrics-and-monitoring)
+- [Zero-Downtime Deployments](#zero-downtime-deployments)
+
 ## Graceful Shutdown with close-with-grace
 
 Use `close-with-grace` for proper shutdown handling:
@@ -106,6 +120,7 @@ app.get('/health/details', {
   };
 });
 ```
+
 ## Docker Configuration
 
 Create an optimized Dockerfile:
@@ -421,3 +436,4 @@ closeWithGrace({ delay: 30000 }, async ({ signal }) => {
   app.log.info('Server closed');
 });
 ```
+

package/skills/backend/fastify-best-practices/rules/error-handling.md

@@ -7,6 +7,22 @@ metadata:
 
 # Error Handling in Fastify
 
+## Contents
+
+- [Default Error Handler](#default-error-handler)
+- [Custom Error Classes](#custom-error-classes)
+- [Custom Error Handler](#custom-error-handler)
+- [Error Response Schema](#error-response-schema)
+- [Reply Helpers with @fastify/sensible](#reply-helpers-with-fastifysensible)
+- [Async Error Handling](#async-error-handling)
+- [Hook Error Handling](#hook-error-handling)
+- [Not Found Handler](#not-found-handler)
+- [Error Wrapping](#error-wrapping)
+- [Validation Error Customization](#validation-error-customization)
+- [Error Cause Chain](#error-cause-chain)
+- [Plugin-Scoped Error Handlers](#plugin-scoped-error-handlers)
+- [Graceful Error Recovery](#graceful-error-recovery)
+
 ## Default Error Handler
 
 Fastify has a built-in error handler. Thrown errors automatically become HTTP responses:

package/skills/backend/fastify-best-practices/rules/hooks.md

@@ -7,6 +7,26 @@ metadata:
 
 # Hooks and Request Lifecycle
 
+## Contents
+
+- [Request Lifecycle Overview](#request-lifecycle-overview)
+- [onRequest Hook](#onrequest-hook)
+- [preParsing Hook](#preparsing-hook)
+- [preValidation Hook](#prevalidation-hook)
+- [preHandler Hook](#prehandler-hook)
+- [preSerialization Hook](#preserialization-hook)
+- [onSend Hook](#onsend-hook)
+- [onResponse Hook](#onresponse-hook)
+- [onError Hook](#onerror-hook)
+- [onTimeout Hook](#ontimeout-hook)
+- [onRequestAbort Hook](#onrequestabort-hook)
+- [Application Lifecycle Hooks](#application-lifecycle-hooks)
+- [Scoped Hooks](#scoped-hooks)
+- [Hook Execution Order](#hook-execution-order)
+- [Stopping Hook Execution](#stopping-hook-execution)
+- [Route-Level Hooks](#route-level-hooks)
+- [Async Hook Patterns](#async-hook-patterns)
+
 ## Request Lifecycle Overview
 
 Fastify executes hooks in a specific order:

package/skills/backend/fastify-best-practices/rules/http-proxy.md

@@ -7,6 +7,17 @@ metadata:
 
 # HTTP Proxy and Reply.from()
 
+## Contents
+
+- [@fastify/http-proxy](#fastifyhttp-proxy)
+- [@fastify/reply-from](#fastifyreply-from)
+- [API Gateway Pattern](#api-gateway-pattern)
+- [Request Body Handling](#request-body-handling)
+- [Error Handling](#error-handling)
+- [WebSocket Proxying](#websocket-proxying)
+- [Timeout Configuration](#timeout-configuration)
+- [Caching Proxied Responses](#caching-proxied-responses)
+
 ## @fastify/http-proxy
 
 Use `@fastify/http-proxy` for simple reverse proxy scenarios:

package/skills/backend/fastify-best-practices/rules/logging.md

@@ -7,6 +7,24 @@ metadata:
 
 # Logging with Pino
 
+## Contents
+
+- [Built-in Pino Integration](#built-in-pino-integration)
+- [Log Levels](#log-levels)
+- [Request-Scoped Logging](#request-scoped-logging)
+- [Structured Logging](#structured-logging)
+- [Logging Configuration by Environment](#logging-configuration-by-environment)
+- [Custom Serializers](#custom-serializers)
+- [Redacting Sensitive Data](#redacting-sensitive-data)
+- [Child Loggers](#child-loggers)
+- [Request Logging Configuration](#request-logging-configuration)
+- [Logging Errors](#logging-errors)
+- [Log Destinations](#log-destinations)
+- [Log Rotation](#log-rotation)
+- [Log Aggregation](#log-aggregation)
+- [Request ID Tracking](#request-id-tracking)
+- [Performance Considerations](#performance-considerations)
+
 ## Built-in Pino Integration
 
 Fastify uses Pino for high-performance logging:

package/skills/backend/fastify-best-practices/rules/performance.md

@@ -7,6 +7,26 @@ metadata:
 
 # Performance Optimization
 
+## Contents
+
+- [Fastify is Fast by Default](#fastify-is-fast-by-default)
+- [Use @fastify/under-pressure for Load Shedding](#use-fastifyunder-pressure-for-load-shedding)
+- [Always Define Response Schemas](#always-define-response-schemas)
+- [Avoid Dynamic Schema Compilation](#avoid-dynamic-schema-compilation)
+- [Use Logger Wisely](#use-logger-wisely)
+- [Connection Pooling](#connection-pooling)
+- [Avoid Blocking the Event Loop](#avoid-blocking-the-event-loop)
+- [Stream Large Responses](#stream-large-responses)
+- [Caching Strategies](#caching-strategies)
+- [Request Coalescing with async-cache-dedupe](#request-coalescing-with-async-cache-dedupe)
+- [Payload Limits](#payload-limits)
+- [Compression](#compression)
+- [Connection Timeouts](#connection-timeouts)
+- [Disable Unnecessary Features](#disable-unnecessary-features)
+- [Benchmarking](#benchmarking)
+- [Profiling](#profiling)
+- [Memory Management](#memory-management)
+
 ## Fastify is Fast by Default
 
 Fastify is designed for performance. Key optimizations are built-in:

package/skills/backend/fastify-best-practices/rules/plugins.md

@@ -7,6 +7,20 @@ metadata:
 
 # Plugin Development and Encapsulation
 
+## Contents
+
+- [Understanding Encapsulation](#understanding-encapsulation)
+- [Breaking Encapsulation with fastify-plugin](#breaking-encapsulation-with-fastify-plugin)
+- [Plugin Registration Order](#plugin-registration-order)
+- [Plugin Options](#plugin-options)
+- [Plugin Factory Pattern](#plugin-factory-pattern)
+- [Plugin Dependencies](#plugin-dependencies)
+- [Scoped Plugins for Route Groups](#scoped-plugins-for-route-groups)
+- [Prefix Routes with Register](#prefix-routes-with-register)
+- [Plugin Metadata](#plugin-metadata)
+- [Autoload Plugins](#autoload-plugins)
+- [Testing Plugins in Isolation](#testing-plugins-in-isolation)
+
 ## Understanding Encapsulation
 
 Fastify's plugin system provides automatic encapsulation. Each plugin creates its own context, isolating decorators, hooks, and plugins registered within it:

package/skills/backend/fastify-best-practices/rules/routes.md

@@ -7,6 +7,24 @@ metadata:
 
 # Route Organization and Handlers
 
+## Contents
+
+- [Basic Route Definition](#basic-route-definition)
+- [Route Parameters](#route-parameters)
+- [Query String Parameters](#query-string-parameters)
+- [Request Body](#request-body)
+- [Headers](#headers)
+- [Reply Methods](#reply-methods)
+- [Route Organization by Feature](#route-organization-by-feature)
+- [Route Constraints](#route-constraints)
+- [Route Prefixing](#route-prefixing)
+- [Multiple Methods](#multiple-methods)
+- [404 Handler](#404-handler)
+- [Method Not Allowed](#method-not-allowed)
+- [Route-Level Configuration](#route-level-configuration)
+- [Async Route Registration](#async-route-registration)
+- [Auto-loading Routes with @fastify/autoload](#auto-loading-routes-with-fastifyautoload)
+
 ## Basic Route Definition
 
 Define routes with the shorthand methods or the full route method:

package/skills/backend/fastify-best-practices/rules/schemas.md

@@ -7,6 +7,26 @@ metadata:
 
 # JSON Schema Validation
 
+## Contents
+
+- [Use TypeBox for Type-Safe Schemas](#use-typebox-for-type-safe-schemas)
+- [TypeBox Common Patterns](#typebox-common-patterns)
+- [Register TypeBox Schemas Globally](#register-typebox-schemas-globally)
+- [Plain JSON Schema (Alternative)](#plain-json-schema-alternative)
+- [Request Validation Parts](#request-validation-parts)
+- [Shared Schemas with $id](#shared-schemas-with-id)
+- [Array Schemas](#array-schemas)
+- [Custom Formats](#custom-formats)
+- [Custom Keywords](#custom-keywords)
+- [Coercion](#coercion)
+- [Validation Error Handling](#validation-error-handling)
+- [Schema Compiler Options](#schema-compiler-options)
+- [Nullable Fields](#nullable-fields)
+- [Conditional Validation](#conditional-validation)
+- [Schema Organization](#schema-organization)
+- [OpenAPI/Swagger Integration](#openapiswagger-integration)
+- [Performance Considerations](#performance-considerations)
+
 ## Use TypeBox for Type-Safe Schemas
 
 **Prefer TypeBox for defining schemas.** It provides TypeScript types automatically and compiles to JSON Schema:

package/skills/backend/fastify-best-practices/rules/serialization.md

@@ -7,6 +7,25 @@ metadata:
 
 # Response Serialization
 
+## Contents
+
+- [Use TypeBox for Type-Safe Response Schemas](#use-typebox-for-type-safe-response-schemas)
+- [Fast JSON Stringify](#fast-json-stringify)
+- [Response Schema Benefits](#response-schema-benefits)
+- [Multiple Status Code Schemas](#multiple-status-code-schemas)
+- [Default Response Schema](#default-response-schema)
+- [Custom Serializers](#custom-serializers)
+- [Shared Serializers](#shared-serializers)
+- [Serialization with Type Coercion](#serialization-with-type-coercion)
+- [Nullable Fields](#nullable-fields)
+- [Additional Properties](#additional-properties)
+- [Nested Objects](#nested-objects)
+- [Date Serialization](#date-serialization)
+- [BigInt Serialization](#bigint-serialization)
+- [Stream Responses](#stream-responses)
+- [Pre-Serialization Hook](#pre-serialization-hook)
+- [Disable Serialization](#disable-serialization)
+
 ## Use TypeBox for Type-Safe Response Schemas
 
 Define response schemas with TypeBox for automatic TypeScript types and fast serialization:

package/skills/backend/fastify-best-practices/rules/testing.md

@@ -7,6 +7,23 @@ metadata:
 
 # Testing Fastify Applications
 
+## Contents
+
+- [Using inject() for Request Testing](#using-inject-for-request-testing)
+- [Testing with Headers and Authentication](#testing-with-headers-and-authentication)
+- [Testing Query Parameters](#testing-query-parameters)
+- [Testing URL Parameters](#testing-url-parameters)
+- [Testing Validation Errors](#testing-validation-errors)
+- [Testing File Uploads](#testing-file-uploads)
+- [Testing Streams](#testing-streams)
+- [Mocking Dependencies](#mocking-dependencies)
+- [Testing Plugins in Isolation](#testing-plugins-in-isolation)
+- [Testing Hooks](#testing-hooks)
+- [Test Factory Pattern](#test-factory-pattern)
+- [Database Testing with Transactions](#database-testing-with-transactions)
+- [Parallel Test Execution](#parallel-test-execution)
+- [Running Tests](#running-tests)
+
 ## Using inject() for Request Testing
 
 Fastify's `inject()` method simulates HTTP requests without network overhead:

package/skills/backend/fastify-best-practices/rules/typescript.md

@@ -7,6 +7,21 @@ metadata:
 
 # TypeScript Integration
 
+## Contents
+
+- [Type Stripping with Node.js](#type-stripping-with-nodejs)
+- [Basic Type Safety](#basic-type-safety)
+- [Typing Route Handlers](#typing-route-handlers)
+- [Type Providers](#type-providers)
+- [Typing Decorators](#typing-decorators)
+- [Typing Plugins](#typing-plugins)
+- [Typing Hooks](#typing-hooks)
+- [Typing Schema Objects](#typing-schema-objects)
+- [Shared Types](#shared-types)
+- [Type-Safe Route Registration](#type-safe-route-registration)
+- [Avoiding Type Gymnastics](#avoiding-type-gymnastics)
+- [Type Checking Without Compilation](#type-checking-without-compilation)
+
 ## Type Stripping with Node.js
 
 Use Node.js built-in type stripping (Node.js 22.6+):

package/skills/backend/fastify-best-practices/rules/websockets.md

@@ -7,6 +7,21 @@ metadata:
 
 # WebSocket Support
 
+## Contents
+
+- [Using @fastify/websocket](#using-fastifywebsocket)
+- [WebSocket with Hooks](#websocket-with-hooks)
+- [Connection Options](#connection-options)
+- [Broadcast to All Clients](#broadcast-to-all-clients)
+- [Rooms/Channels Pattern](#roomschannels-pattern)
+- [Structured Message Protocol](#structured-message-protocol)
+- [Heartbeat/Ping-Pong](#heartbeatping-pong)
+- [Authentication](#authentication)
+- [Error Handling](#error-handling)
+- [Rate Limiting WebSocket Messages](#rate-limiting-websocket-messages)
+- [Graceful Shutdown](#graceful-shutdown)
+- [Full-Duplex Stream Pattern](#full-duplex-stream-pattern)
+
 ## Using @fastify/websocket
 
 Add WebSocket support to Fastify:

package/skills/backend/go/golang-patterns/NOTICE.md

@@ -3,7 +3,7 @@
 This skill was copied from Affaan Mustafa's ECC repository.
 
 - Source: https://github.com/affaan-m/ECC/tree/main/skills/golang-patterns
-- Source commit: 2bc924faf2f8e893bfe0af86b1931283693c30ae
+- Source commit: d29cf651c795869f733669c33e3d33dfd8307d10
 - License: MIT
 - Copyright: Copyright (c) 2026 Affaan Mustafa
 

package/skills/backend/go/golang-patterns/SKILL.md

@@ -617,7 +617,8 @@ linters-settings:
   errcheck:
     check-type-assertions: true
   govet:
-    check-shadowing: true
+    enable:
+      - shadow
 
 issues:
   exclude-use-default: false

package/skills/devops/docker-patterns/NOTICE.md

@@ -5,7 +5,7 @@ This skill is adapted from two MIT-licensed community skills:
 - ECC docker-patterns: https://github.com/affaan-m/ECC/tree/main/.kiro/skills/docker-patterns
 - ECC source commit: 0f84c0e2796703fbda87d577b2636351418c7442
 - Antigravity docker-expert: https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/docker-expert
-- Antigravity source commit: b806b97a9a48063f7bdbee5611caf40edd17e305
+- Antigravity source commit: e0bcf882d89316b924ed2416dd42eb4b1099ea53
 
 The upstream MIT license texts are included in `LICENSE.ECC` and
 `LICENSE.ANTIGRAVITY`.