@ysk-kit/cli 1.4.0 → 1.5.1

package/dist/doctor.js

@@ -235,13 +235,13 @@ const enginesCheck = (productRoot, nodeVersion, pnpmVersion) => {
     if (problems.length > 0) {
         const message = [...problems, ...warnings].join('; ');
         return check('engines', 'error', message, pinned
-            ? `Install Node 24 and run \`corepack enable && corepack prepare pnpm@${pinned} --activate\`.`
-            : 'Install Node 24 and pnpm 12 (`corepack enable && corepack prepare pnpm@12 --activate`).');
+            ? `Install Node 26 and run \`corepack enable && corepack prepare pnpm@${pinned} --activate\`.`
+            : 'Install Node 26 and pnpm 12 (`corepack enable && corepack prepare pnpm@12 --activate`).');
     }
     if (warnings.length > 0) {
         return check('engines', 'warn', warnings.join('; '), pinned
             ? `Run \`corepack prepare pnpm@${pinned} --activate\` so the packageManager pin matches.`
-            : 'Add engines.node >=24.0.0 and engines.pnpm >=12.0.0 to package.json.');
+            : 'Add engines.node >=26.0.0 and engines.pnpm >=12.0.0 to package.json.');
     }
     const nodeMsg = nodeRange ? `Node ${nodeVersion} satisfies ${nodeRange}` : `Node ${nodeVersion}`;
     const pnpmMsg = pnpmVersion === null

package/package.json

@@ -1,18 +1,18 @@
 {
   "name": "@ysk-kit/cli",
-  "version": "1.4.0",
+  "version": "1.5.1",
   "type": "module",
   "bin": {
     "ysk-kit": "./dist/index.js",
     "yskk": "./dist/index.js"
   },
   "dependencies": {
-    "@ysk-kit/api-http": "1.4.0",
-    "@ysk-kit/contracts": "1.4.0",
+    "@ysk-kit/api-http": "1.5.1",
+    "@ysk-kit/contracts": "1.5.1",
     "zod": "^4.6.5"
   },
   "devDependencies": {
-    "@types/node": "^24.19.1",
+    "@types/node": "^26.6.5",
     "tsx": "^4.23.15",
     "typescript": "^6.0.3",
     "vitest": "^5.0.3"

package/templates/agent/nested/clients.md

@@ -5,4 +5,4 @@ Local notes for this client app. Root law: `AGENTS.md`. The same rule applies to
 - Call the API only through `@ysk-kit/sdk` (React Query via `@ysk-kit/web-sdk`).
 - No raw `fetch` to kit paths. No `@prisma/client`, `@ysk-kit/db-prisma`, or `apps/api/src/generated`.
 - Do not import `@ysk-kit/observability`, Express, Fastify, jobs, mail, push, or the AWS SDK.
-- Screens: `docs/skills/ui-design.md`. Not done until `docs/skills/ui-review.md` is green.
+- Screens: complex structure via `docs/skills/layout-system.md`, then `docs/skills/ui-design.md`. Not done until `docs/skills/ui-review.md` is green.

package/templates/agent/rules/tests.mdc

@@ -6,4 +6,4 @@ alwaysApply: false
 
 Local reminder. Law: `AGENTS.md`.
 
-Plan with `docs/skills/test-plan.md`, then write with `docs/skills/write-tests.md`. Red CI or a user report: `docs/skills/debug-issue.md`. In-memory ports only. Assert `{ ok, data }` / `{ ok, error }`. Do not start Redis, Stripe, Twilio, FCM, Jaeger, or Grafana.
+Plan with `docs/skills/test-plan.md`, then write with `docs/skills/write-tests.md` (one red `it()` per feature slice). Red CI or a user report: `docs/skills/debug-issue.md` (hypotheses first). In-memory ports only. Assert `{ ok, data }` / `{ ok, error }`. Do not start Redis, Stripe, Twilio, FCM, Jaeger, or Grafana.

package/templates/agent/rules/ui.mdc

@@ -6,4 +6,4 @@ alwaysApply: false
 
 Local reminder. Law: `AGENTS.md`.
 
-Reuse `@ysk-kit/ui` and the zinc theme (`docs/skills/ui-design.md`). Do not invent a parallel design system. A screen is not done until `docs/skills/ui-review.md` is green. No raw `fetch`.
+Reuse `@ysk-kit/ui` and the zinc theme (`docs/skills/ui-design.md`). Complex structure: `docs/skills/layout-system.md` first. Do not invent a parallel design system. A screen is not done until `docs/skills/ui-review.md` is green. No raw `fetch`.

package/templates/agent/skills/debug-issue/SKILL.md

@@ -11,8 +11,8 @@ description: >
 Read `docs/skills/debug-issue.md`. Law: `AGENTS.md`.
 
 1. Write or isolate a red test first (memory-port, then Express+Fastify HTTP).
-2. Triage by error code. Fix the cause. Keep the regression test.
-3. Climb to SDK / e2e / git bisect only if the lower loop cannot see it.
+2. Fill a 3–5 row hypotheses table; falsify one row at a time before changing code.
+3. Climb to SDK / e2e / git bisect only if the lower loop cannot see it. Keep the regression test.
 Gotcha: do not log OTP/sk_/whsec_. Do not set RATE_LIMIT_MAX=0 in production.
 Verify: the named Vitest is green, then the five verify commands.
 Full steps: `docs/skills/debug-issue.md`.

package/templates/agent/skills/layout-system/SKILL.md

@@ -0,0 +1,19 @@
+---
+name: layout-system
+description: >
+  Design predictable layout inside existing zinc + @ysk-kit/ui: ASCII wireframe,
+  AppShell, grid, alignment, 375/768/1280, zh-HK width. Use when adding a shell,
+  dashboard columns, nav/sidebar, list+detail, or multi-column form.
+  中文：版面系統、殼、分欄、閱讀順序、響應式結構。
+  Do not use to change the palette, invent a second component library, or for
+  API-only work (use ui-design for components; ui-review when finishing).
+---
+
+Read `docs/skills/layout-system.md`. Law: `AGENTS.md`.
+
+1. ASCII wireframe (desktop + 375): grouping and reading order.
+2. AppShell + PageHeader; sidebar vs top-nav; 1-col max-w-4xl or md:grid-cols-2.
+3. Rhythm space-y-4|6; numbers right, text left; zh-HK 1.5× width; then ui-design.
+Gotcha: no hero/gradient, no card-in-card, no DOM @ysk-kit/ui on mobile.
+Verify: 375/768/1280 clean, then ui-review visual+responsive.
+Full steps: `docs/skills/layout-system.md`.

package/templates/agent/skills/security-review/SKILL.md

@@ -15,6 +15,6 @@ Read `docs/skills/security-review.md`. Law: `AGENTS.md`.
 
 1. Diff is the report scope; the repo is research. HIGH confidence only.
 2. AuthZ in `application/` (membership + role). Cross-tenant memory tests.
-3. No secrets in logs. Webhook signatures. Client token stores.
+3. No secrets in logs. Webhook signatures. Client token stores. Supply chain: ask before new runtime deps; do not `npx skills add` unknown sources.
 4. Threat-model sub-mode only when the user asks or a new trust boundary lands.
 Full steps: `docs/skills/security-review.md`.

package/templates/agent/skills/test-plan/SKILL.md

@@ -12,8 +12,8 @@ description: >
 Read `docs/skills/test-plan.md`. Law: `AGENTS.md`.
 
 1. Restate the change. Rank data loss, auth, money, tenancy, secrets first.
-2. Map each risk to a layer and file. Write given/when/then cases.
-3. Name in-memory fixtures and explicit out of scope. Then write-tests.
-Gotcha: do not start Redis or Stripe to plan tests. E2E stays thin.
+2. Map each risk to a layer and file (those rows are TDD seams). Write given/when/then cases.
+3. Name in-memory fixtures and explicit out of scope. Mark the first red `it()`. Then write-tests.
+Gotcha: do not start Redis or Stripe to plan tests. E2E stays thin. Do not dump every test before code.
 Verify: every case has layer + file; out of scope is written.
 Full steps: `docs/skills/test-plan.md`.

package/templates/agent/skills/ui-design/SKILL.md

@@ -13,6 +13,6 @@ Read `docs/skills/ui-design.md`. Law: `AGENTS.md`.
 1. Reuse `@ysk-kit/ui` zinc tokens (`rounded-md`, `h-9`). No new palette.
 2. Loading / empty / error / disabled. Forms: FormField + contracts Zod.
 3. WCAG 2.2 AA, `zh-HK` length, no raw fetch. Then ui-review.
-Gotcha: no purple gradients, no placeholder-as-label, no `div` buttons.
+Gotcha: complex layout → layout-system first. No purple gradients, no placeholder-as-label, no `div` buttons.
 Verify: ui-review checklist, then verify-change.
 Full steps: `docs/skills/ui-design.md`.

package/templates/agent/skills/ui-review/SKILL.md

@@ -13,6 +13,6 @@ Read `docs/skills/ui-review.md`. Law: `AGENTS.md`.
 1. Walk visual, a11y, states, copy. Fail if any required box is unchecked.
 2. Keyboard-only on web/admin/desktop. Check 375 / 768 / 1280.
 3. Exercise the flow (click, type, submit). Screenshot is not proof.
-Gotcha: do not add axe or screenshot diffs to CI unless asked.
+Gotcha: reading order / optical alignment; complex layout must have used layout-system. Do not add axe or screenshot diffs to CI unless asked.
 Verify: checklist + `pnpm e2e` when login/shell changed.
 Full steps: `docs/skills/ui-review.md`.

package/templates/agent/skills/verify-change/SKILL.md

@@ -11,7 +11,7 @@ Read `docs/skills/verify-change.md`. Law: `AGENTS.md`.
 
 1. Run `pnpm layers && pnpm typecheck && pnpm test && pnpm gen:openapi && pnpm ysk-kit check agent`.
 2. `git diff --exit-code docs/openapi.yaml` (commit YAML if HTTP changed).
-3. Conditional: lint, check:links, zh pair, lockstep changeset, e2e.
-Gotcha: never claim done without running the five commands in this turn.
+3. Conditional: lint, check:links, zh pair, lockstep changeset, e2e. Behaviour change: at least one new/updated Vitest.
+Gotcha: never claim done without fresh successful output of the five commands in this turn.
 Verify: emit the verification report in the skill output format.
 Full steps: `docs/skills/verify-change.md`.

package/templates/agent/skills/write-tests/SKILL.md

@@ -12,7 +12,7 @@ Read `docs/skills/write-tests.md`. Law: `AGENTS.md`.
 
 1. Put the case at the lowest layer that can fail it. Extend the generator test file.
 2. given/when/then; envelope `ok` / `error.code`; other-tenant negative when owned.
-3. Bug fixes: red regression test first. Express and Fastify for HTTP.
-Gotcha: in-memory ports only. Never mock Prisma from a client.
+3. Features: one red `it()` per TDD slice, then minimum code. Bugs: red regression first. Express and Fastify for HTTP.
+Gotcha: in-memory ports only. Never mock Prisma from a client. Do not write all tests then all code.
 Verify: `pnpm --filter @ysk-kit/<pkg> exec vitest run <file>`
 Full steps: `docs/skills/write-tests.md`.