@tanstack/intent 0.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (37) hide show
  1. package/README.md +66 -0
  2. package/dist/cli.d.mts +1 -0
  3. package/dist/cli.mjs +327 -0
  4. package/dist/feedback-DKreHfB1.mjs +300 -0
  5. package/dist/feedback-FIUBOL0g.mjs +3 -0
  6. package/dist/index.d.mts +61 -0
  7. package/dist/index.mjs +8 -0
  8. package/dist/init-DEzzXm9j.mjs +3 -0
  9. package/dist/init-DNxmjQfU.mjs +70 -0
  10. package/dist/intent-library.d.mts +1 -0
  11. package/dist/intent-library.mjs +123 -0
  12. package/dist/library-scanner-BrznE00j.mjs +111 -0
  13. package/dist/library-scanner.d.mts +16 -0
  14. package/dist/library-scanner.mjs +4 -0
  15. package/dist/scanner-BuWPDJ4P.mjs +4 -0
  16. package/dist/scanner-CpsJAHXT.mjs +147 -0
  17. package/dist/setup-CNGz26qL.mjs +116 -0
  18. package/dist/setup-N5dttGp_.d.mts +10 -0
  19. package/dist/setup.d.mts +2 -0
  20. package/dist/setup.mjs +3 -0
  21. package/dist/staleness-CnomT9Hm.mjs +72 -0
  22. package/dist/staleness-DyhsrqQ5.mjs +4 -0
  23. package/dist/types-kbQfN_is.d.mts +70 -0
  24. package/dist/utils-DjkEPBxu.mjs +39 -0
  25. package/meta/domain-discovery/SKILL.md +681 -0
  26. package/meta/generate-skill/SKILL.md +419 -0
  27. package/meta/skill-staleness-check/SKILL.md +282 -0
  28. package/meta/templates/oz/domain-discovery.md +53 -0
  29. package/meta/templates/oz/feedback-collection.md +69 -0
  30. package/meta/templates/oz/skill-update.md +47 -0
  31. package/meta/templates/oz/tree-generation.md +48 -0
  32. package/meta/templates/workflows/generate-skills-oz.yml +86 -0
  33. package/meta/templates/workflows/notify-playbooks.yml +52 -0
  34. package/meta/templates/workflows/update-skills-oz.yml +98 -0
  35. package/meta/templates/workflows/validate-skills.yml +52 -0
  36. package/meta/tree-generator/SKILL.md +859 -0
  37. package/package.json +38 -0
@@ -0,0 +1,859 @@
1
+ ---
2
+ name: skill-tree-generator
3
+ description: >
4
+ Generate, update, and version a complete skill tree (collection of SKILL.md
5
+ files) for any JavaScript or TypeScript library. Produces core skills
6
+ (framework-agnostic) and framework skills (React, Solid, Vue bindings)
7
+ with dependency linking. Activate when producing skill files from a domain
8
+ map, updating existing skills after a library version change, or auditing
9
+ skill accuracy. Takes domain_map.yaml and skill_spec.md from
10
+ skill-domain-discovery as primary inputs.
11
+ metadata:
12
+ version: '3.0'
13
+ category: meta-tooling
14
+ input_artifacts:
15
+ - skills/_artifacts/domain_map.yaml
16
+ - skills/_artifacts/skill_spec.md
17
+ output_artifacts:
18
+ - skills/_artifacts/skill_tree.yaml
19
+ skills:
20
+ - skill-domain-discovery
21
+ ---
22
+
23
+ # Skill Tree Generator
24
+
25
+ You produce and maintain a tree of SKILL.md files for a library. Every file
26
+ you create is read directly by AI coding agents across Claude, GPT-4+,
27
+ Gemini, Cursor, Copilot, Codex, and open-source models. Your output must
28
+ be portable, concise, and grounded in actual library behavior.
29
+
30
+ ### Skill types
31
+
32
+ Every skill has a `type` field in its frontmatter. Valid types:
33
+
34
+ | Type | Purpose | Example |
35
+ | ------------- | ---------------------------------------------------------- | ------------------------- |
36
+ | `core` | Framework-agnostic concepts, configuration, patterns | `db-core` |
37
+ | `sub-skill` | A focused sub-topic within a core or framework skill | `db-core/live-queries` |
38
+ | `framework` | Framework-specific bindings, hooks, components | `react-db` |
39
+ | `lifecycle` | Cross-cutting developer journey (getting started, go-live) | `electric-quickstart` |
40
+ | `composition` | Integration between two or more libraries | `electric-drizzle` |
41
+ | `security` | Audit checklist or security validation | `electric-security-check` |
42
+
43
+ Agents discover skills via `tanstack intent list` and read them directly
44
+ from `node_modules`. Framework skills declare a `requires` dependency on
45
+ their core skill so agents load them in the right order.
46
+
47
+ There are two workflows. Detect which applies.
48
+
49
+ **Workflow A — Generate:** Build a complete skill tree from a domain map.
50
+ **Workflow B — Update:** Diff a library version change and update skills.
51
+
52
+ ---
53
+
54
+ ## Workflow A — Generate skill tree
55
+
56
+ ### Prerequisites
57
+
58
+ You need one of:
59
+
60
+ - `skills/_artifacts/domain_map.yaml` and `skills/_artifacts/skill_spec.md`
61
+ from skill-domain-discovery
62
+ - Raw library documentation and source code (run a compressed domain
63
+ discovery first)
64
+
65
+ If starting from raw docs without a domain map, run a compressed
66
+ discovery. This produces lower-fidelity output than the full
67
+ skill-domain-discovery skill — prefer running that when time permits.
68
+
69
+ 1. Build a concept inventory (every export, config key, constraint, warning)
70
+ 2. Group into 4–7 capability domains using work-oriented names
71
+ 3. Enumerate 10–20 task-focused skills from the intersection of domains
72
+ and developer tasks
73
+ 4. Extract 3+ failure modes per skill (plausible, silent, grounded)
74
+ 5. Proceed to Step 1 below
75
+
76
+ ### Scaffold flow output
77
+
78
+ If the maintainer uses a custom skills root, replace `skills/` in the paths
79
+ below with their chosen directory.
80
+
81
+ For the scaffold workflow, produce a single artifact before writing any
82
+ SKILL.md files:
83
+
84
+ - `skills/_artifacts/skill_tree.yaml`
85
+
86
+ This file enumerates every skill that must be generated in the next step.
87
+ Do not write SKILL.md files yet unless explicitly asked.
88
+
89
+ Use this format:
90
+
91
+ ```yaml
92
+ # skills/_artifacts/skill_tree.yaml
93
+ library:
94
+ name: '[package-name]'
95
+ version: '[version]'
96
+ repository: '[repo URL]'
97
+ description: '[one line]'
98
+ generated_from:
99
+ domain_map: 'skills/_artifacts/domain_map.yaml'
100
+ skill_spec: 'skills/_artifacts/skill_spec.md'
101
+ generated_at: '[ISO date]'
102
+
103
+ skills:
104
+ - name: '[task-focused skill name]'
105
+ slug: '[kebab-case]'
106
+ type: 'core | sub-skill | framework | lifecycle | composition | security'
107
+ domain: '[domain slug]'
108
+ path: 'skills/[path]/SKILL.md'
109
+ description: '[1–2 sentence agent-facing routing key]'
110
+ requires:
111
+ - '[other skill slugs]' # omit if none
112
+ sources:
113
+ - '[Owner/repo]:docs/[path].md'
114
+ - '[Owner/repo]:src/[path].ts'
115
+ subsystems:
116
+ - '[adapter/backend name]' # omit if none
117
+ references:
118
+ - 'references/[file].md' # omit if none
119
+ ```
120
+
121
+ ### Step 1 — Plan the file tree
122
+
123
+ From the domain map, each entry in the `skills` list becomes a SKILL.md
124
+ file. The `type` field on each skill (`core`, `framework`, `lifecycle`,
125
+ `composition`) determines where it goes. Determine the file tree:
126
+
127
+ **Core vs framework decision:**
128
+
129
+ | Content | Goes in... |
130
+ | ---------------------------------------------- | ---------- |
131
+ | Mental models, concepts, lifecycle | Core |
132
+ | Configuration options and their effects | Core |
133
+ | Type system, generics, inference | Core |
134
+ | Common mistakes that apply to all frameworks | Core |
135
+ | Hooks (`useX`, `createX`) | Framework |
136
+ | Components (`<Link>`, `<Outlet>`) | Framework |
137
+ | Provider setup and wiring | Framework |
138
+ | SSR/hydration patterns specific to a framework | Framework |
139
+ | Framework-specific gotchas | Framework |
140
+
141
+ If a library has no framework adapters (e.g. Store, DB), produce only
142
+ core skills.
143
+
144
+ **Framework-integration domain decomposition:** If the domain map from
145
+ skill-domain-discovery contains a single "Framework Integration" domain
146
+ and the library has separate framework adapter packages, decompose it
147
+ into per-framework skills co-located with each adapter package. Do not
148
+ produce a single monolithic framework-integration skill that covers
149
+ React, Vue, Solid, etc. in one file.
150
+
151
+ **Adapter-heavy domains:** When a domain covers multiple backends or
152
+ adapters with distinct config interfaces (e.g. 5 sync adapters, 3
153
+ database drivers), keep one SKILL.md for the shared patterns but
154
+ produce one reference file per adapter with its specific config,
155
+ setup, and gotchas. The SKILL.md covers what's common; each
156
+ `references/[adapter].md` covers what's unique.
157
+
158
+ **Flat vs nested structure:**
159
+
160
+ Choose the structure that matches how the domain map's skills are shaped.
161
+
162
+ Use **nested** (`[lib]-core/[domain]/SKILL.md`) when:
163
+
164
+ - Developer tasks cluster cleanly into 3–5 conceptual domains
165
+ - The library has a clear core + framework adapter split
166
+ - Skills build on each other in a layered way
167
+
168
+ Use **flat** (`skills/[skill-name]/SKILL.md`) when:
169
+
170
+ - Developer tasks are task-focused and don't nest into domains
171
+ - The domain discovery process recommended task-focused skills
172
+ - Skills map 1:1 to distinct developer intents with minimal overlap
173
+
174
+ Both are valid. The domain map's `type` field and structure will signal
175
+ which fits. When in doubt, prefer flat — it's simpler and each skill
176
+ is independently discoverable.
177
+
178
+ **Nested structure:**
179
+
180
+ ```
181
+ skills/
182
+ ├── [lib]-core/ # Core skill for the library
183
+ │ ├── SKILL.md # Core overview + sub-skill registry
184
+ │ ├── [domain-1]/
185
+ │ │ └── SKILL.md # Core sub-skill
186
+ │ ├── [domain-2]/
187
+ │ │ └── SKILL.md
188
+ │ └── references/ # Optional overflow content
189
+ │ └── options.md
190
+ ├── react-[lib]/ # React framework skill
191
+ │ ├── SKILL.md # React overview + sub-skill registry
192
+ │ ├── [domain-1]/
193
+ │ │ └── SKILL.md # React-specific sub-skill
194
+ │ └── references/
195
+ ├── solid-[lib]/ # Solid framework skill (if applicable)
196
+ │ └── SKILL.md
197
+ ├── vue-[lib]/ # Vue framework skill (if applicable)
198
+ │ └── SKILL.md
199
+ ```
200
+
201
+ **Flat structure:**
202
+
203
+ ```
204
+ skills/
205
+ ├── [lib]-shapes/ # Task-focused skill
206
+ │ ├── SKILL.md
207
+ │ └── references/
208
+ │ └── shape-options.md
209
+ ├── [lib]-auth/ # Another task skill
210
+ │ └── SKILL.md
211
+ ├── [lib]-proxy/
212
+ │ └── SKILL.md
213
+ ├── [lib]-quickstart/ # Lifecycle skill
214
+ │ └── SKILL.md
215
+ ├── [lib]-go-live/ # Lifecycle skill
216
+ │ └── SKILL.md
217
+ ├── [lib]-drizzle/ # Composition skill
218
+ │ └── SKILL.md
219
+ ```
220
+
221
+ **Router skill:** A router skill (lightweight entry point with a decision
222
+ table) is optional. If the intent CLI provides `list` and `show`
223
+ commands, agents can discover skills directly without a router. Only
224
+ create a router skill if the skill set is large enough (15+) that
225
+ browsing the list is insufficient, or if the nested structure needs
226
+ an entry point to guide agents to the right sub-skill.
227
+
228
+ **Source repository layout for npm distribution:**
229
+
230
+ Skills must ship with their respective packages so they're available in
231
+ `node_modules` after install. In a monorepo, co-locate skills with the
232
+ package they document:
233
+
234
+ ```
235
+ packages/
236
+ ├── [lib]/ # Core package
237
+ │ ├── src/
238
+ │ ├── skills/ # Core skills live here
239
+ │ │ ├── [lib]-core/
240
+ │ │ │ ├── SKILL.md
241
+ │ │ │ └── [domain]/SKILL.md
242
+ │ │ └── compositions/ # Composition skills with co-used libs
243
+ │ └── package.json # Add "skills" to files array
244
+ ├── react-[lib]/ # React adapter package
245
+ │ ├── src/
246
+ │ ├── skills/ # React framework skills live here
247
+ │ │ └── react-[lib]/
248
+ │ │ └── SKILL.md
249
+ │ └── package.json # Add "skills" to files array
250
+ ```
251
+
252
+ Add `"skills"` to each package's `files` array in `package.json` so
253
+ skill files are included in the published npm tarball:
254
+
255
+ ```json
256
+ {
257
+ "files": ["dist", "src", "skills"]
258
+ }
259
+ ```
260
+
261
+ ### Step 2 — Write the core skill
262
+
263
+ The core skill is the foundational overview for the library. It covers
264
+ framework-agnostic concepts and contains the sub-skill registry.
265
+
266
+ **Frontmatter:**
267
+
268
+ ```yaml
269
+ ---
270
+ name: [lib]-core
271
+ description: >
272
+ [1–3 sentences. What this library does and the framework-agnostic
273
+ concepts it provides. Pack with keywords: function names, config
274
+ options, concepts. This is a routing key, not a human summary.]
275
+ type: core
276
+ library: [lib]
277
+ library_version: "[version this targets]"
278
+ ---
279
+ ```
280
+
281
+ **Body template:**
282
+
283
+ ```markdown
284
+ # [Library Name] — Core Concepts
285
+
286
+ [One paragraph: what this library is, what problem it solves. Factual,
287
+ not promotional. Framework-agnostic.]
288
+
289
+ ## Sub-Skills
290
+
291
+ | Need to... | Read |
292
+ | ---------- | ------------------------------ |
293
+ | [task 1] | [lib]-core/[domain-1]/SKILL.md |
294
+ | [task 2] | [lib]-core/[domain-2]/SKILL.md |
295
+
296
+ ## Quick Decision Tree
297
+
298
+ - Setting up for the first time? → [lib]-core/[setup-domain]
299
+ - Working with [concept]? → [lib]-core/[concept-domain]
300
+ - Debugging [issue]? → [lib]-core/[domain] § Common Mistakes
301
+
302
+ ## Version
303
+
304
+ Targets [library] v[X.Y.Z].
305
+ ```
306
+
307
+ ### Step 3 — Write core sub-skills
308
+
309
+ One SKILL.md per domain. Follow this structure exactly.
310
+
311
+ **Frontmatter:**
312
+
313
+ ```yaml
314
+ ---
315
+ name: [lib]-core/[domain-slug]
316
+ description: >
317
+ [1–3 sentences. What this domain covers AND when to load it. Name
318
+ specific functions, options, or APIs. Dense routing key.]
319
+ type: sub-skill
320
+ library: [lib]
321
+ library_version: "[version]"
322
+ sources:
323
+ - "[repo]:docs/[path].md"
324
+ - "[repo]:src/[path].ts"
325
+ ---
326
+ ```
327
+
328
+ **Body sections — in this order:**
329
+
330
+ **1. Setup**
331
+
332
+ Minimum working example for this domain.
333
+
334
+ - Use the library's core API, not framework-specific hooks
335
+ - Real package imports with exact names
336
+ - No `// ...` or `[your code here]` — complete and copy-pasteable
337
+ - If a concept is better explained with a framework hook, reference the
338
+ framework skill: "For React usage, see `react-[lib]/SKILL.md`"
339
+
340
+ **2. Core Patterns**
341
+
342
+ 2–4 patterns. For each:
343
+
344
+ - One-line heading: what it accomplishes
345
+ - Complete code block using core API
346
+ - One sentence of explanation only if not self-explanatory
347
+ - No framework-specific code — use core abstractions
348
+
349
+ **3. Common Mistakes**
350
+
351
+ Each `failure_mode` entry from the domain map becomes a Common Mistake
352
+ entry in the SKILL file. Minimum 3 entries. Complex domains target 5–6.
353
+
354
+ **Cross-skill failure modes:** The domain map may contain failure modes
355
+ with a `skills` list naming multiple skill slugs. Write these into
356
+ every SKILL file whose skill is listed. A developer loading the SSR
357
+ skill and a developer loading the state management skill both need to
358
+ see "stale state during hydration" — the same advice must appear in
359
+ both files. Do not deduplicate across skills at the cost of coverage.
360
+
361
+ Format:
362
+
363
+ ````markdown
364
+ ### [PRIORITY] [What goes wrong — 5–8 word phrase]
365
+
366
+ Wrong:
367
+
368
+ ```[lang]
369
+ // code that looks correct but isn't
370
+ ```
371
+ ````
372
+
373
+ Correct:
374
+
375
+ ```[lang]
376
+ // code that works
377
+ ```
378
+
379
+ [One sentence: the specific mechanism by which the wrong version fails.]
380
+
381
+ Source: [doc page or source file:line]
382
+
383
+ ````
384
+
385
+ Priority levels:
386
+ - **CRITICAL** — Breaks in production. Security risk or data loss.
387
+ - **HIGH** — Incorrect behavior under common conditions.
388
+ - **MEDIUM** — Incorrect under specific conditions or edge cases.
389
+
390
+ Every mistake must be plausible (an agent would generate it), silent
391
+ (no immediate crash), and grounded (traceable to doc or source).
392
+
393
+ **Failure mode status from domain map:** The domain map may include a
394
+ `status` field on failure modes. Handle as follows:
395
+ - `active` — Include as a normal Common Mistake entry
396
+ - `fixed-but-legacy-risk` — Include with a note: "Fixed in v[X] but
397
+ agents trained on older code may still generate this pattern"
398
+ - `removed` — Do not include. The bug is fixed and the pattern is no
399
+ longer relevant.
400
+
401
+ **4. References** (only when needed)
402
+
403
+ ```markdown
404
+ ## References
405
+
406
+ - [Complete option reference](references/options.md)
407
+ ````
408
+
409
+ Create reference files when any of these apply — not just length overflow:
410
+
411
+ - **Length:** The skill would exceed 500 lines without them
412
+ - **Multiple subsystems:** The domain covers 3+ independent backends,
413
+ adapters, or providers with distinct config interfaces. Create one
414
+ reference file per subsystem (e.g. `references/electric-adapter.md`,
415
+ `references/query-adapter.md`)
416
+ - **Dense API surface:** A topic has >10 distinct API patterns, operators,
417
+ or option shapes that agents need for implementation. Move the full
418
+ reference to `references/` and keep only the most common 2–3 in the
419
+ SKILL.md
420
+ - **Deep validation/schema patterns:** If the library has schema
421
+ validation, type transforms (TInput/TOutput), or similar deep
422
+ configuration surfaces, give them a dedicated reference file even if
423
+ they technically fit in the parent skill
424
+
425
+ ### Step 4 — Write framework skills
426
+
427
+ Framework skills build on their core skill. They cover only what is
428
+ specific to the framework — hooks, components, providers, and
429
+ framework-specific patterns and mistakes.
430
+
431
+ **Frontmatter:**
432
+
433
+ ```yaml
434
+ ---
435
+ name: react-[lib]
436
+ description: >
437
+ [1–3 sentences. React-specific bindings for [library]. Name the hooks,
438
+ components, and providers. Mention React-specific patterns like SSR
439
+ hydration if applicable.]
440
+ type: framework
441
+ library: [lib]
442
+ framework: react
443
+ library_version: "[version]"
444
+ requires:
445
+ - [lib]-core
446
+ ---
447
+ ```
448
+
449
+ **Body template:**
450
+
451
+ ```markdown
452
+ This skill builds on [lib]-core. Read [lib]-core first for foundational
453
+ concepts before applying React-specific patterns.
454
+
455
+ # [Library Name] — React
456
+
457
+ ## Setup
458
+
459
+ [React-specific setup: provider, hook wiring, app entry point]
460
+
461
+ ## Hooks and Components
462
+
463
+ [React hooks and components with complete examples]
464
+
465
+ ## React-Specific Patterns
466
+
467
+ [Patterns that only apply in React: concurrent features, Suspense
468
+ integration, SSR/hydration, etc.]
469
+
470
+ ## Common Mistakes
471
+
472
+ [Only React-specific mistakes. Do not repeat core mistakes. Examples:
473
+ calling hooks outside provider, missing Suspense boundary, hydration
474
+ mismatch, etc.]
475
+ ```
476
+
477
+ **Framework sub-skills** follow the same pattern as core sub-skills but
478
+ with the framework frontmatter:
479
+
480
+ ```yaml
481
+ ---
482
+ name: react-[lib]/[domain-slug]
483
+ description: >
484
+ [React-specific description for this domain.]
485
+ type: sub-skill
486
+ library: [lib]
487
+ framework: react
488
+ library_version: "[version]"
489
+ requires:
490
+ - [lib]-core
491
+ - [lib]-core/[domain-slug]
492
+ ---
493
+
494
+ This skill builds on [lib]-core/[domain-slug]. Read the core skill first.
495
+ ```
496
+
497
+ ### Step 5 — Write cross-domain tension notes
498
+
499
+ The domain map may contain a `tensions` section listing design conflicts
500
+ between domains. For each tension, add a brief note to the Common
501
+ Mistakes section of every SKILL file whose domain is involved. Format:
502
+
503
+ ```markdown
504
+ ### HIGH Tension: [short phrase]
505
+
506
+ This domain's patterns conflict with [other domain]. [One sentence
507
+ describing the pull.] Agents optimizing for [this domain's goal]
508
+ tend to [specific mistake] because they don't account for [other
509
+ domain's constraint].
510
+
511
+ See also: [lib]-core/[other-domain]/SKILL.md § Common Mistakes
512
+ ```
513
+
514
+ The cross-reference ensures agents that load one skill are pointed
515
+ toward the related skill where the other side of the tension lives.
516
+
517
+ ### Step 6 — Write composition skills (if applicable)
518
+
519
+ Use the `compositions` entries from `domain_map.yaml` (populated during
520
+ skill-domain-discovery Phase 2h) to identify which composition skills
521
+ to produce.
522
+
523
+ Composition skills cover how two or more libraries work together. These
524
+ are framework-specific by default (the integration patterns depend on
525
+ framework hooks and providers).
526
+
527
+ **Frontmatter:**
528
+
529
+ ```yaml
530
+ ---
531
+ name: compositions/[lib-a]-[lib-b]
532
+ description: >
533
+ [How lib-a and lib-b wire together. Name the specific integration
534
+ points: functions, hooks, patterns.]
535
+ type: composition
536
+ library_version: "[version of primary lib]"
537
+ requires:
538
+ - [lib-a]-core
539
+ - react-[lib-a]
540
+ - [lib-b]-core
541
+ - react-[lib-b]
542
+ ---
543
+
544
+ This skill requires familiarity with both [lib-a] and [lib-b].
545
+ Read their core and framework skills first.
546
+ ```
547
+
548
+ **Body structure:**
549
+
550
+ 1. **Integration Setup** — How to wire the two libraries together
551
+ 2. **Core Integration Patterns** — 2–4 patterns showing them working in concert
552
+ 3. **Common Mistakes** — Mistakes that only occur at the integration boundary
553
+
554
+ Do not duplicate content from either library's individual skills. Focus
555
+ exclusively on the seam between them.
556
+
557
+ ### Step 7 — Write checklist/audit skills (where applicable)
558
+
559
+ Some skills don't fit the standard body structure (Setup → Core Patterns
560
+ → Common Mistakes). Security, go-live, and some lifecycle skills are
561
+ audit-oriented — the agent runs through a checklist to verify correctness
562
+ rather than learning patterns. Use the alternative body structure below
563
+ for these skill types.
564
+
565
+ **When to use the checklist body:**
566
+
567
+ - `security` type skills — pre-deploy security validation
568
+ - `lifecycle` type skills focused on verification (go-live, migration)
569
+ - Any skill where the primary action is "check these things" not "learn
570
+ these patterns"
571
+
572
+ **Frontmatter:**
573
+
574
+ ```yaml
575
+ ---
576
+ name: react-[lib]/security
577
+ description: >
578
+ Go-live security validation for [library]. Checks [specific concerns].
579
+ type: security
580
+ library: [lib]
581
+ framework: react
582
+ library_version: '[version]'
583
+ requires:
584
+ - react-[lib]
585
+ ---
586
+ ```
587
+
588
+ **Alternative body template (checklist/audit):**
589
+
590
+ ````markdown
591
+ # [Library Name] — [Security | Go-Live | Migration] Checklist
592
+
593
+ Run through each section before [deploying | releasing | migrating].
594
+
595
+ ## [Category 1] Checks
596
+
597
+ ### Check: [what to verify]
598
+
599
+ Expected:
600
+
601
+ ```[lang]
602
+ // correct configuration or code
603
+ ```
604
+ ````
605
+
606
+ Fail condition: [what indicates this check failed]
607
+ Fix: [one-line remediation]
608
+
609
+ ### Check: [what to verify]
610
+
611
+ [same structure]
612
+
613
+ ## [Category 2] Checks
614
+
615
+ [same structure]
616
+
617
+ ## Common Security Mistakes
618
+
619
+ [Wrong/correct pairs specific to this library, same format as
620
+ Common Mistakes in standard skills]
621
+
622
+ ## Pre-Deploy Summary
623
+
624
+ - [ ] [Verification 1]
625
+ - [ ] [Verification 2]
626
+ - [ ] [Verification 3]
627
+
628
+ ````
629
+
630
+ The key differences from the standard body:
631
+ - No "Setup" section — the agent already has the app running
632
+ - Checks replace "Core Patterns" — each check is a verification, not a
633
+ teaching pattern
634
+ - The summary checklist at the end gives agents a quick pass/fail list
635
+ - Common Mistakes section is still present for wrong/correct pairs
636
+
637
+ ### Step 8 — Validate the complete tree
638
+
639
+ Run every check before outputting. Fix any failures before proceeding.
640
+
641
+ | Check | Rule |
642
+ |-------|------|
643
+ | Every skill from domain_map has a SKILL.md | No orphaned skills |
644
+ | Core/framework split is clean | No framework hooks in core skills |
645
+ | Every framework skill has `requires` | Links to its core skill |
646
+ | Framework skill opens with dependency note | "builds on [core]" prose line |
647
+ | Every skill under 500 lines | Move excess to references/ |
648
+ | Every code block has real imports | Exact package name, correct adapter |
649
+ | No concept explanations | No "TypeScript is...", no "React hooks are..." |
650
+ | No marketing prose | First body line is heading or dependency note |
651
+ | Every code block is complete | Works without modification when pasted |
652
+ | Common Mistakes are silent | Not obvious compile errors |
653
+ | Common Mistakes are library-specific | Not generic TS/React mistakes |
654
+ | Common Mistakes are sourced | Every mistake traceable to doc or source |
655
+ | Core skills reference framework skills | "For React usage, see..." |
656
+ | Framework skills don't repeat core content | Only framework-specific |
657
+ | Composition skills don't repeat individual skills | Only the seam |
658
+ | `name` matches directory path | `router-core/search-params` → `router-core/search-params/SKILL.md` |
659
+ | `sources` filled in sub-skills | At least one repo:path per sub-skill |
660
+ | Cross-skill failures in all relevant files | Failure modes with multiple `skills` appear in each listed SKILL.md |
661
+ | Tensions noted in affected skills | Each tension has notes in all involved domain skills |
662
+ | Framework domains decomposed per-package | No single skill covering multiple framework adapters |
663
+ | Adapter-heavy domains have references | 3+ adapters/backends → one reference file per adapter |
664
+ | Dense API surfaces in references | >10 distinct patterns → reference file, not inline |
665
+ | Checklist skills use audit body | Security/go-live skills use checklist template, not Setup → Core Patterns → Common Mistakes |
666
+
667
+ ---
668
+
669
+ ## Workflow B — Update existing skills
670
+
671
+ ### Trigger conditions
672
+
673
+ Run when:
674
+ - The library has released a new version
675
+ - A maintainer reports skills produce outdated code
676
+ - A changelog or migration guide has been published since skill creation
677
+ - Feedback reports indicate skill content is inaccurate
678
+
679
+ ### Step 1 — Detect staleness
680
+
681
+ Compare each skill's `library_version` against the current library version.
682
+
683
+ 1. Read changelog entries between the two versions
684
+ 2. Read migration guide (if one exists)
685
+ 3. For each skill, check if its `sources` files have changed
686
+
687
+ Produce a staleness report:
688
+
689
+ ```yaml
690
+ # staleness_report.yaml
691
+ library: "[name]"
692
+ library_version_in_skills: "[old]"
693
+ library_version_current: "[new]"
694
+
695
+ stale_skills:
696
+ - skill: "[skill name]"
697
+ reason: "[what changed]"
698
+ severity: "[BREAKING | DEPRECATION | BEHAVIORAL | ADDITIVE]"
699
+ changelog_entry: "[relevant entry]"
700
+ affected_sections:
701
+ - "[Setup | Core Patterns | Common Mistakes]"
702
+
703
+ current_skills:
704
+ - skill: "[skill name]"
705
+ reason: "[no changes affect this domain]"
706
+ ````
707
+
708
+ ### Step 2 — Update stale skills
709
+
710
+ **BREAKING changes:**
711
+
712
+ 1. Old pattern becomes a new Common Mistake entry (wrong/correct pair)
713
+ 2. Update Setup if initialization changed
714
+ 3. Update Core Patterns if idiomatic approach changed
715
+ 4. Bump `library_version` in frontmatter
716
+ 5. Check both core AND framework skills — breaking changes may affect both
717
+
718
+ **DEPRECATION changes:**
719
+
720
+ 1. Add Common Mistake: deprecated API as wrong, replacement as correct
721
+ 2. Update Core Patterns to use non-deprecated API
722
+ 3. Bump `library_version`
723
+
724
+ **BEHAVIORAL changes:**
725
+
726
+ 1. Default value changed → add Common Mistake entry
727
+ 2. Type signature more restrictive → add Common Mistake entry
728
+ 3. Update affected code blocks
729
+ 4. Bump `library_version`
730
+
731
+ **ADDITIVE changes:**
732
+
733
+ 1. Evaluate if new feature belongs in existing domain or needs a new skill
734
+ 2. If existing: add to Core Patterns or references/
735
+ 3. If new skill needed: create it and update the parent skill's sub-skill
736
+ registry
737
+ 4. Bump `library_version`
738
+
739
+ ### Step 3 — Produce a changelog entry
740
+
741
+ ```markdown
742
+ ## [date]
743
+
744
+ ### Updated for [library] v[new version]
745
+
746
+ **Breaking changes:**
747
+
748
+ - [skill name]: [what changed and why]
749
+
750
+ **Deprecation updates:**
751
+
752
+ - [skill name]: [old API] → [new API]
753
+
754
+ **New skills:**
755
+
756
+ - [skill name]: [what it covers]
757
+ ```
758
+
759
+ ---
760
+
761
+ ## Constraints — verify for every file
762
+
763
+ | Check | Rule |
764
+ | ------------------------------------------- | ----------------------------------------------------------------------------------- |
765
+ | Under 500 lines per SKILL.md | Move excess to references/; also create references for content depth |
766
+ | Real imports in every code block | Exact package, correct adapter |
767
+ | No external concept explanations | No "TypeScript is...", no "React hooks are..." — library-specific concepts are fine |
768
+ | No marketing prose | First body line is heading, code, or dependency note |
769
+ | Complete code blocks | Every block works without modification |
770
+ | Common Mistakes are silent | Not obvious compile errors |
771
+ | Common Mistakes are library-specific | Not generic TS/React mistakes |
772
+ | Common Mistakes are sourced | Traceable to doc or source |
773
+ | Core skills are framework-agnostic | No hooks, no components, no providers |
774
+ | Framework skills have `requires` | Lists core dependency |
775
+ | Framework skills open with dependency note | First prose line references core |
776
+ | Composition skills require all dependencies | Lists all core + framework skills |
777
+ | `name` matches directory | `router-core/search-params` → file at that path |
778
+ | `library_version` in every frontmatter | Which version the skill targets |
779
+ | Cross-skill failures duplicated | Each listed skill gets the failure mode |
780
+ | Tensions cross-referenced | Tension notes in each involved skill point to the other |
781
+ | Skills ship with packages | `"skills"` in package.json `files` array |
782
+ | Checklist skills use audit template | Security/go-live skills use checklist body, not standard body |
783
+
784
+ ---
785
+
786
+ ## Cross-model compatibility
787
+
788
+ Output is consumed by all major AI coding agents. To ensure consistency:
789
+
790
+ - Markdown with YAML frontmatter — universally parsed
791
+ - No XML tags in generated skill content
792
+ - Code blocks use triple backticks with language annotation
793
+ - Section boundaries use ## headers
794
+ - Descriptions are keyword-packed for routing
795
+ - Examples show concrete values, never placeholders
796
+ - Positive instructions ("Use X") over negative ("Don't use Y")
797
+ - Critical info at start or end of sections (not buried in middle)
798
+ - Each SKILL.md is self-contained except for declared `requires`
799
+
800
+ ---
801
+
802
+ ## Output order
803
+
804
+ When generating a complete skill tree:
805
+
806
+ 1. Core overview SKILL.md — entry point for the library
807
+ 2. Core sub-skills in domain order
808
+ 3. Framework overview SKILL.md for each framework
809
+ 4. Framework sub-skills
810
+ 5. Composition skills (if applicable)
811
+ 6. Security skills (if applicable)
812
+ 7. references/ files for any skill that needs them
813
+ 8. CHANGELOG.md entry
814
+
815
+ When updating:
816
+
817
+ 1. staleness_report.yaml
818
+ 2. Updated SKILL.md files (core then framework)
819
+ 3. CHANGELOG.md entry
820
+
821
+ ---
822
+
823
+ ## Meta-skill feedback (alpha default)
824
+
825
+ After producing the skill tree artifact, update a single Markdown feedback
826
+ draft for all three meta skills used in scaffolding. If a draft exists from
827
+ Domain Discovery, keep it and fill only the **Tree Generator** section. If
828
+ no draft exists, create it using this exact template.
829
+
830
+ ```
831
+ # Intent Meta Skill Feedback
832
+
833
+ ## Domain Discovery
834
+ - What worked well:
835
+ - What was confusing or missing:
836
+ - Suggestions for improvement:
837
+ - Overall rating: good | mixed | bad
838
+
839
+ ## Tree Generator
840
+ - What worked well:
841
+ - What was confusing or missing:
842
+ - Suggestions for improvement:
843
+ - Overall rating: good | mixed | bad
844
+
845
+ ## Generate Skill
846
+ - What worked well:
847
+ - What was confusing or missing:
848
+ - Suggestions for improvement:
849
+ - Overall rating: good | mixed | bad
850
+
851
+ ## Context (optional)
852
+ - Library:
853
+ - Repo:
854
+ - Docs:
855
+ - Notes:
856
+ ```
857
+
858
+ Do not submit feedback yet. Carry this draft forward to the generate-skill
859
+ step.