@ysk-kit/cli 1.2.0 → 1.2.2

package/dist/upgrade.js.map

@@ -1 +1 @@
-{"version":3,"file":"upgrade.js","sourceRoot":"","sources":["../src/upgrade.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,WAAW;IACX,cAAc;IACd,WAAW;IACX,WAAW;IACX,yBAAyB;IACzB,4BAA4B;IAC5B,uBAAuB;IACvB,aAAa;IACb,YAAY;IACZ,SAAS;IACT,SAAS;IACT,iCAAiC;IACjC,sBAAsB;CACd,CAAC;AAEX,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;AAgBvD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAe,EAAU,EAAE;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAEzE,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrE,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,GAAW,EAAW,EAAE,CAC7C,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACtC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;IAC5C,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;AAErC,MAAM,UAAU,GAAG,CAAC,WAAmB,EAA4B,EAAE;IACnE,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IAChD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,OAAO;QACL,GAAG,EAAE,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QACtD,OAAO,EAAE,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QAClE,MAAM,EAAE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAC/D,MAAM,EAAE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAC/D,EAAE,EAAE,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;KACpD,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAU,EAAQ,EAAE;IACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACvB,SAAS,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YACrC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO;IACT,CAAC;IACD,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAoB,EAAY,EAAE;IACxD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,gBAAgB,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAEnF,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,mBAAmB,CAAC,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC;YACzB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG,EAAE,CAAC,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;IAC7B,CAAC;IAED,IAAI,gBAAgB,EAAE,CAAC;QACrB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,MAAM,GAAiB;QAC3B,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,SAAS;QAC/B,OAAO,EAAE,UAAU;QACnB,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,SAAS;QACrC,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,SAAS;QACrC,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,SAAS;KAC9B,CAAC;IAEF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/F,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC;AACd,CAAC,CAAC"}
+{"version":3,"file":"upgrade.js","sourceRoot":"","sources":["../src/upgrade.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,WAAW;IACX,cAAc;IACd,WAAW;IACX,WAAW;IACX,yBAAyB;IACzB,4BAA4B;IAC5B,uBAAuB;IACvB,aAAa;IACb,YAAY;IACZ,SAAS;IACT,SAAS;IACT,iCAAiC;IACjC,sBAAsB;CACd,CAAC;AAEX,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;AAgBvD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAe,EAAU,EAAE;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAEzE,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrE,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,GAAW,EAAW,EAAE,CAC7C,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACtC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;IAC5C,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;AAErC,MAAM,UAAU,GAAG,CAAC,WAAmB,EAA4B,EAAE;IACnE,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IAChD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,OAAO;QACL,GAAG,EAAE,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QACtD,OAAO,EAAE,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QAClE,MAAM,EAAE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAC/D,MAAM,EAAE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAC/D,EAAE,EAAE,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;KACpD,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAU,EAAQ,EAAE;IACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACvB,SAAS,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YACrC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO;IACT,CAAC;IACD,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAoB,EAAY,EAAE;IACxD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,gBAAgB,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAEnF,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,mBAAmB,CAAC,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC;YACzB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG,EAAE,CAAC,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;IAC7B,CAAC;IAED,IAAI,gBAAgB,EAAE,CAAC;QACrB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,MAAM,GAAiB;QAC3B,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,SAAS;QAC/B,OAAO,EAAE,UAAU;QACnB,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,SAAS;QACrC,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,SAAS;QACrC,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,SAAS;KAC9B,CAAC;IAEF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/F,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC;AACd,CAAC,CAAC"}

package/package.json

@@ -1,14 +1,14 @@
 {
   "name": "@ysk-kit/cli",
-  "version": "1.2.0",
+  "version": "1.2.2",
   "type": "module",
   "bin": {
     "ysk-kit": "./dist/index.js",
     "yskk": "./dist/index.js"
   },
   "dependencies": {
-    "@ysk-kit/api-http": "1.2.0",
-    "@ysk-kit/contracts": "1.2.0",
+    "@ysk-kit/api-http": "1.2.2",
+    "@ysk-kit/contracts": "1.2.2",
     "zod": "^4.6.5"
   },
   "devDependencies": {
@@ -37,7 +37,7 @@
     "start": "tsx src/index.ts",
     "typecheck": "tsc --noEmit -p tsconfig.json",
     "test": "vitest run --passWithNoTests",
-    "build": "tsc -p tsconfig.build.json"
+    "build": "tsc -p tsconfig.build.json && chmod +x dist/index.js"
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/templates/agent/nested/api.md

@@ -7,3 +7,4 @@ Local notes for `apps/api`. Root law: `AGENTS.md`.
 - JSON routes return `{ ok: true, data }` / `{ ok: false, error }`.
 - Envelope exceptions stay listed in the root guide. Do not add one silently.
 - Tests use in-memory ports. Do not start Redis, Stripe, Twilio, FCM, Jaeger, or Grafana.
+- Plan cases with `docs/skills/test-plan.md`. Write them with `docs/skills/write-tests.md`.

package/templates/agent/nested/clients.md

@@ -5,3 +5,4 @@ Local notes for this client app. Root law: `AGENTS.md`. The same rule applies to
 - Call the API only through `@ysk-kit/sdk` (React Query via `@ysk-kit/web-sdk`).
 - No raw `fetch` to kit paths. No `@prisma/client`, `@ysk-kit/db-prisma`, or `apps/api/src/generated`.
 - Do not import `@ysk-kit/observability`, Express, Fastify, jobs, mail, push, or the AWS SDK.
+- Screens: `docs/skills/ui-design.md`. Not done until `docs/skills/ui-review.md` is green.

package/templates/agent/nested/contracts.md

@@ -7,3 +7,4 @@ Local notes for `@ysk-kit/contracts`. Root law: `AGENTS.md`.
 - No TypeScript `enum`. Use `as const` + Zod.
 - Do not import apps, Prisma, Express, Fastify, React, or BullMQ.
 - After path changes run `pnpm gen:openapi`. Still call paths through `@ysk-kit/sdk`.
+- Contract tests live in this package. Follow `docs/skills/write-tests.md`.

package/templates/agent/rules/api-modules.mdc

@@ -6,4 +6,4 @@ alwaysApply: false
 
 Local reminder. Law: `AGENTS.md` (also `apps/api/AGENTS.md`).
 
-Prisma stays in `src/modules/*/infra` and shared `src/infra`. Domain and application do not import Express, Fastify, Prisma, React, or BullMQ. JSON uses `{ ok: true, data }` / `{ ok: false, error }`. Tests use in-memory ports.
+Prisma stays in `src/modules/*/infra` and shared `src/infra`. Domain and application do not import Express, Fastify, Prisma, React, or BullMQ. JSON uses `{ ok: true, data }` / `{ ok: false, error }`. Tests use in-memory ports. Schema changes: `docs/skills/db-migration.md`.

package/templates/agent/rules/desktop.mdc

@@ -0,0 +1,9 @@
+---
+description: Electron desktop — isolation, CSP, IPC, safeStorage
+globs: apps/desktop/**/*
+alwaysApply: false
+---
+
+Local reminder. Law: `AGENTS.md`.
+
+Procedure: `docs/skills/desktop-electron.md`. Keep `contextIsolation` and `nodeIntegration: false`. Add sandbox, CSP, navigation guards, IPC `senderFrame` checks. `safeStorage` with no plaintext fallback. Renderer still uses `@ysk-kit/sdk` only.

package/templates/agent/rules/security.mdc

@@ -0,0 +1,9 @@
+---
+description: Security review — authz, tenancy, secrets, webhooks
+globs: apps/api/**/*,packages/logger/**/*,packages/config/**/*
+alwaysApply: false
+---
+
+Local reminder. Law: `AGENTS.md`.
+
+Procedure: `docs/skills/security-review.md`. Org-scoped use cases check membership in `application/` (template: `requireBiller`). Never log OTP, JWT, Stripe `sk_`, or webhook secrets. Inbound webhooks: `docs/skills/webhook-handling.md`.

package/templates/agent/rules/tests.mdc

@@ -0,0 +1,9 @@
+---
+description: Tests — in-memory ports, envelope, given/when/then
+globs: "**/*.test.ts,**/*.test.tsx,**/*.spec.ts,apps/web/e2e/**/*"
+alwaysApply: false
+---
+
+Local reminder. Law: `AGENTS.md`.
+
+Plan with `docs/skills/test-plan.md`, then write with `docs/skills/write-tests.md`. In-memory ports only. Assert `{ ok, data }` / `{ ok, error }`. Do not start Redis, Stripe, Twilio, FCM, Jaeger, or Grafana.

package/templates/agent/rules/ui.mdc

@@ -0,0 +1,9 @@
+---
+description: UI — kit tokens, @ysk-kit/ui, ui-review before done
+globs: "packages/ui/**/*,packages/ui-logic/**/*,apps/web/src/**/*.tsx,apps/admin/src/**/*.tsx,apps/mobile/src/**/*.tsx,apps/desktop/src/renderer/**/*.tsx"
+alwaysApply: false
+---
+
+Local reminder. Law: `AGENTS.md`.
+
+Reuse `@ysk-kit/ui` and the zinc theme (`docs/skills/ui-design.md`). Do not invent a parallel design system. A screen is not done until `docs/skills/ui-review.md` is green. No raw `fetch`.

package/templates/agent/skills/db-migration/SKILL.md

@@ -0,0 +1,17 @@
+---
+name: db-migration
+description: >
+  Apply Prisma 7.10 migrations in YSK Kit: review generated SQL, expand/contract
+  for breaking changes, backfills, never migrate reset without explicit consent.
+  Use when schema.prisma changes, after add-module --prisma or add <capability>
+  with Prisma, or the user says migrate / rename column / backfill / reset.
+  中文：資料庫遷移、改欄位、改名、回填、migrate reset。
+  Do not use for Prisma 8 commands or for application rules with no schema change.
+---
+
+Read `docs/skills/db-migration.md`. Law: `AGENTS.md`.
+
+1. Pin Prisma 7.10: `migrate dev --create-only`, `migrate deploy`. No Prisma 8 CLI.
+2. Read generated SQL. Breaking changes use expand/contract + backfill.
+3. Update Prisma **and** memory repositories. Never `migrate reset` without this-turn consent.
+Full steps: `docs/skills/db-migration.md`.

package/templates/agent/skills/desktop-electron/SKILL.md

@@ -0,0 +1,18 @@
+---
+name: desktop-electron
+description: >
+  Harden the YSK Kit Electron desktop app: contextIsolation, sandbox, CSP,
+  navigation and new-window restrictions, IPC sender validation, safeStorage
+  with no plaintext fallback, auto-update signing.
+  Use when changing apps/desktop/src/main or preload, adding an IPC channel,
+  opening external URLs, filesystem access, auto-update, or packaging.
+  中文：Electron 安全、CSP、IPC、safeStorage、自動更新。
+  Do not use for renderer-only UI or web/admin token storage with no main-process change.
+---
+
+Read `docs/skills/desktop-electron.md`. Law: `AGENTS.md`.
+
+1. Keep contextIsolation, nodeIntegration false, sandbox, webSecurity. Add CSP.
+2. Deny navigation / new windows by default; allowlist `https:` for openExternal.
+3. Validate IPC `senderFrame`. `safeStorage` only — no plaintext token fallback.
+Full steps: `docs/skills/desktop-electron.md`.

package/templates/agent/skills/security-review/SKILL.md

@@ -0,0 +1,20 @@
+---
+name: security-review
+description: >
+  Review YSK Kit authz, tenant isolation, secrets, logging redaction, token
+  storage, webhook signatures, and LLM input against hexagonal modules and
+  the {ok,data}/{ok,error} envelope. Optional lightweight threat-model mode.
+  Use when the user asks for a security review or audit; the diff touches
+  auth, apikey, organizations, billing, files, crypto, webhooks, env/secrets,
+  or a new capability; or the plan's security section is not "none".
+  中文：安全審查、權限、跨租戶、密鑰、日誌遮罩、webhook 簽名。
+  Do not use for pure UI styling, docs typos, or generic dependency bumps.
+---
+
+Read `docs/skills/security-review.md`. Law: `AGENTS.md`.
+
+1. Diff is the report scope; the repo is research. HIGH confidence only.
+2. AuthZ in `application/` (membership + role). Cross-tenant memory tests.
+3. No secrets in logs. Webhook signatures. Client token stores.
+4. Threat-model sub-mode only when the user asks or a new trust boundary lands.
+Full steps: `docs/skills/security-review.md`.

package/templates/agent/skills/test-plan/SKILL.md

@@ -0,0 +1,10 @@
+---
+name: test-plan
+description: >
+  Produce a risk-ranked YSK Kit test plan (given/when/then, fixtures, out of scope)
+  mapped to contract, memory-port, API, SDK, client, and Playwright layers.
+  Use when the user asks how to test a feature, what cases to cover, or for a QA
+  checklist before writing tests or shipping.
+---
+
+Read `docs/skills/test-plan.md`. Law: `AGENTS.md`.

package/templates/agent/skills/ui-design/SKILL.md

@@ -0,0 +1,9 @@
+---
+name: ui-design
+description: >
+  Design and implement YSK Kit UI with existing tokens, @ysk-kit/ui, WCAG 2.2 AA,
+  forms mapped from the API envelope, and no generic AI-slop chrome.
+  Use when adding or changing web, admin, mobile, or desktop screens.
+---
+
+Read `docs/skills/ui-design.md`. Law: `AGENTS.md`.

package/templates/agent/skills/ui-review/SKILL.md

@@ -0,0 +1,9 @@
+---
+name: ui-review
+description: >
+  QA checklist before declaring YSK Kit UI work done: visual, a11y, responsive,
+  states, copy, performance — with Playwright, keyboard, and axe verification.
+  Use when finishing a screen or when the user asks to review UI / UX / a11y.
+---
+
+Read `docs/skills/ui-review.md`. Law: `AGENTS.md`.

package/templates/agent/skills/webhook-handling/SKILL.md

@@ -0,0 +1,18 @@
+---
+name: webhook-handling
+description: >
+  Handle inbound webhooks in YSK Kit: verify signature on the raw body, ack
+  fast, idempotency by event id, out-of-order events, retries, replay tests.
+  Stripe is the main example; the same rules apply to other providers.
+  Use when adding or changing /v1/*/webhook, adding billing, or debugging
+  "paid but not activated" / duplicate fulfilments.
+  中文：webhook、驗簽、冪等、Stripe 回調、重送。
+  Do not use for outbound HTTP or a general security audit with no webhook route.
+---
+
+Read `docs/skills/webhook-handling.md`. Law: `AGENTS.md`.
+
+1. Mount raw body before JSON parsers (Express + Fastify). Verify signature.
+2. Persist event id, return `{ ok: true, data: { received: true } }`, fulfil via jobs.
+3. Do not trust event order. Replay tests in memory; never call Stripe in CI.
+Full steps: `docs/skills/webhook-handling.md`.

package/templates/agent/skills/write-tests/SKILL.md

@@ -0,0 +1,9 @@
+---
+name: write-tests
+description: >
+  Write professional YSK Kit tests: trophy per layer, in-memory ports, given/when/then,
+  deterministic fixtures, envelope and authz cases, exact Vitest/Playwright commands.
+  Use when adding tests, fixing a bug, or after test-plan.
+---
+
+Read `docs/skills/write-tests.md`. Law: `AGENTS.md`.

package/templates/agent/ysk-kit.mdc

@@ -3,4 +3,4 @@ description: YSK Kit agent law — follow root AGENTS.md
 alwaysApply: true
 ---
 
-Follow `AGENTS.md` at the repo root (Chinese: `AGENTS.zh.md`). Do not copy that file here. Procedures: `docs/skills/`. Plan first when required: `pnpm ysk-kit plan <slug>` → `docs/plans/<yyyy-mm-dd>-<slug>.md`. New HTTP features start with `pnpm ysk-kit add module <kebab-name> --prisma --web`. Verify with `pnpm layers && pnpm typecheck && pnpm test && pnpm gen:openapi && pnpm ysk-kit check agent`.
+Follow `AGENTS.md` at the repo root (Chinese: `AGENTS.zh.md`). Do not copy that file here. Procedures: `docs/skills/`. Plan first when required: `pnpm ysk-kit plan <slug>` → `docs/plans/<yyyy-mm-dd>-<slug>.md`. New HTTP features start with `pnpm ysk-kit add module <kebab-name> --prisma --web`. Verify with `pnpm layers && pnpm typecheck && pnpm test && pnpm gen:openapi && pnpm ysk-kit check agent`. Security / Prisma / webhooks / Electron: `docs/skills/security-review.md`, `db-migration.md`, `webhook-handling.md`, `desktop-electron.md`.

package/templates/capabilities/billing/apps/api/src/modules/billing/application/billing-service.test.ts

@@ -0,0 +1,56 @@
+import { describe, expect, it } from 'vitest';
+import { createMemoryOrganizationRepository } from '../../organizations/infra/memory-organization-repository';
+import { createLogBilling } from '../infra/log-billing';
+import { createMemorySubscriptionRepository } from '../infra/memory-subscription-repository';
+import { createMemoryWebhookEventRepository } from '../infra/memory-webhook-event-repository';
+import { createBillingService } from './billing-service';
+
+describe('createBillingService webhooks', () => {
+  it('activates once and skips a replay plus a stale event', async () => {
+    const orgs = createMemoryOrganizationRepository();
+    const subscriptions = createMemorySubscriptionRepository();
+    const service = createBillingService({
+      subscriptions,
+      billing: createLogBilling(),
+      orgs,
+      webhookEvents: createMemoryWebhookEventRepository(),
+    });
+    const owner = await orgs.createWithOwner({ name: 'Pay', ownerUserId: 'user-1' });
+    await service.handleStripeEvent({
+      id: 'evt_new',
+      type: 'checkout.session.completed',
+      created: 100,
+      data: {
+        object: {
+          customer: 'cus_1',
+          metadata: { organizationId: owner.id, planCode: 'pro', seatCount: '4' },
+        },
+      },
+    });
+    await service.handleStripeEvent({
+      id: 'evt_new',
+      type: 'checkout.session.completed',
+      created: 100,
+      data: {
+        object: {
+          customer: 'cus_1',
+          metadata: { organizationId: owner.id, planCode: 'pro', seatCount: '4' },
+        },
+      },
+    });
+    await service.handleStripeEvent({
+      id: 'evt_old',
+      type: 'checkout.session.completed',
+      created: 50,
+      data: {
+        object: {
+          customer: 'cus_1',
+          metadata: { organizationId: owner.id, planCode: 'pro', seatCount: '1' },
+        },
+      },
+    });
+    const row = await subscriptions.findByOrganizationId(owner.id);
+    expect(row?.seatCount).toBe(4);
+    expect(row?.status).toBe('active');
+  });
+});

package/templates/capabilities/billing/apps/api/src/modules/billing/application/billing-service.ts

@@ -3,7 +3,9 @@ import { BILLING_PLANS, orgRoleCan } from '@ysk-kit/contracts';
 import { AppError } from '@ysk-kit/domain-kernel';
 import type { IOrganizationRepository } from '../../organizations/domain/organization-repository';
 import type { IBillingPort } from '../domain/billing-port';
+import type { StripeWebhookEvent } from '../domain/stripe-webhook-event';
 import type { ISubscriptionRepository } from '../domain/subscription-repository';
+import type { IProcessedWebhookRepository } from '../domain/webhook-event-repository';
 
 const PERIOD_MS = 1000 * 60 * 60 * 24 * 30;
 
@@ -30,6 +32,7 @@ export const createBillingService = (opts: {
   subscriptions: ISubscriptionRepository;
   billing: IBillingPort;
   orgs: IOrganizationRepository;
+  webhookEvents: IProcessedWebhookRepository;
   now?: () => Date;
 }) => {
   const now = () => opts.now?.() ?? new Date();
@@ -44,6 +47,25 @@ export const createBillingService = (opts: {
     return org;
   };
 
+  const activate = async (
+    organizationId: string,
+    planCode: SubscriptionDto['planCode'],
+    customerId?: string,
+    seatCount = 1,
+  ) => {
+    if (planCode === 'free') return;
+    const org = await opts.orgs.findById(organizationId);
+    if (!org) throw new AppError('NOT_FOUND');
+    await opts.subscriptions.upsert({
+      organizationId,
+      planCode,
+      status: 'active',
+      currentPeriodEnd: new Date(now().getTime() + PERIOD_MS),
+      seatCount,
+    });
+    if (customerId) await opts.orgs.setStripeCustomerId(organizationId, customerId);
+  };
+
   return {
     plans: () => BILLING_PLANS,
     subscription: async (userId: string, organizationId: string): Promise<SubscriptionDto> => {
@@ -64,24 +86,7 @@ export const createBillingService = (opts: {
         invoiceId,
       });
     },
-    activate: async (
-      organizationId: string,
-      planCode: SubscriptionDto['planCode'],
-      customerId?: string,
-      seatCount = 1,
-    ) => {
-      if (planCode === 'free') return;
-      const org = await opts.orgs.findById(organizationId);
-      if (!org) throw new AppError('NOT_FOUND');
-      await opts.subscriptions.upsert({
-        organizationId,
-        planCode,
-        status: 'active',
-        currentPeriodEnd: new Date(now().getTime() + PERIOD_MS),
-        seatCount,
-      });
-      if (customerId) await opts.orgs.setStripeCustomerId(organizationId, customerId);
-    },
+    activate,
     portal: async (userId: string, organizationId: string, returnUrl: string) => {
       const org = await requireBiller(userId, organizationId);
       const customerId = org.stripeCustomerId;
@@ -120,6 +125,54 @@ export const createBillingService = (opts: {
       }
       return { url: result.url };
     },
+    handleStripeEvent: async (event: StripeWebhookEvent) => {
+      if (!event.id) throw new AppError('VALIDATION_FAILED', 'Stripe event id required');
+      const organizationId = event.data.object.metadata?.organizationId;
+      const eventCreatedAt = new Date((Number.isFinite(event.created) ? event.created : 0) * 1000);
+      const claim = await opts.webhookEvents.tryClaim({
+        provider: 'stripe',
+        eventId: event.id,
+        eventType: event.type,
+        eventCreatedAt,
+        ...(organizationId ? { organizationId } : {}),
+      });
+      if (claim === 'duplicate') return { received: true as const };
+
+      try {
+        if (organizationId) {
+          const latest = await opts.webhookEvents.maxEventCreatedAt(
+            'stripe',
+            organizationId,
+            event.id,
+          );
+          if (latest && eventCreatedAt < latest) return { received: true as const };
+        }
+        if (event.type === 'checkout.session.completed') {
+          const planCode = event.data.object.metadata?.planCode;
+          const seatRaw = Number(event.data.object.metadata?.seatCount ?? '1');
+          const seatCount = Number.isFinite(seatRaw) && seatRaw >= 1 ? Math.floor(seatRaw) : 1;
+          if (organizationId && (planCode === 'pro' || planCode === 'free')) {
+            const customer = event.data.object.customer;
+            await activate(
+              organizationId,
+              planCode,
+              typeof customer === 'string' ? customer : undefined,
+              seatCount,
+            );
+          }
+        }
+        return { received: true as const };
+      } catch (error) {
+        if (
+          error instanceof AppError &&
+          (error.code === 'NOT_FOUND' || error.code === 'VALIDATION_FAILED')
+        ) {
+          return { received: true as const };
+        }
+        await opts.webhookEvents.release('stripe', event.id);
+        throw error;
+      }
+    },
     cancel: async (userId: string, organizationId: string) => {
       await requireBiller(userId, organizationId);
       const row = await opts.subscriptions.findByOrganizationId(organizationId);

package/templates/capabilities/billing/apps/api/src/modules/billing/domain/stripe-webhook-event.ts

@@ -0,0 +1,12 @@
+export type StripeWebhookEvent = {
+  id: string;
+  type: string;
+  created: number;
+  data: {
+    object: {
+      metadata?: Record<string, string>;
+      customer?: string;
+      payment_status?: string;
+    };
+  };
+};

package/templates/capabilities/billing/apps/api/src/modules/billing/domain/webhook-event-repository.ts

@@ -0,0 +1,19 @@
+export type ProcessedWebhookClaim = 'claimed' | 'duplicate';
+
+export type ProcessedWebhookRecord = {
+  provider: string;
+  eventId: string;
+  eventType: string;
+  eventCreatedAt: Date;
+  organizationId?: string;
+};
+
+export interface IProcessedWebhookRepository {
+  tryClaim(input: ProcessedWebhookRecord): Promise<ProcessedWebhookClaim>;
+  maxEventCreatedAt(
+    provider: string,
+    organizationId: string,
+    exceptEventId: string,
+  ): Promise<Date | null>;
+  release(provider: string, eventId: string): Promise<void>;
+}