cfsa-antigravity 1.0.1 → 2.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 RepairYourTech
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -10,13 +10,6 @@ A pipeline that turns a raw idea into exhaustively specified, test-driven, produ
 npx cfsa-antigravity init
 ```
 
-Or install globally:
-
-```bash
-npm install -g cfsa-antigravity
-cfsa-antigravity init
-```
-
 This installs the `.agent/` folder, `docs/` structure, and agent config files into your project.
 
 ## CLI
@@ -37,6 +30,20 @@ This installs the `.agent/` folder, `docs/` structure, and agent config files in
 
 The pipeline tells you what to run next at every step. You never have to guess.
 
+## Keeping Up to Date
+
+The kit evolves independently of your project. To pull improvements into an existing project:
+
+```
+/sync-kit
+```
+
+This performs a **semantic merge** — it applies new workflows, skills, and rules from the upstream kit while preserving your project-specific values (tech stack, validation commands, filled placeholders). It will never overwrite your project decisions.
+
+- First sync does a full comparison; subsequent syncs are incremental (commit-scoped)
+- Tracks sync state in `.agent/kit-sync.md` so it knows what changed since last update
+- Flags any structural migrations needed (e.g., ideation format changes)
+
 ## Documentation
 
 | Document | Contents |
@@ -52,6 +59,10 @@ The pipeline tells you what to run next at every step. You never have to guess.
 4. **Progressive decision locking** — each stage locks decisions for downstream
 5. **TDD as the implementation contract** — Red → Green → Refactor, every slice
 
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for how to set up, make changes, and submit PRs.
+
 ## License
 
-MIT
+[MIT](LICENSE)

package/package.json

@@ -1,34 +1,48 @@
 {
-    "name": "cfsa-antigravity",
-    "version": "1.0.1",
-    "description": "CFSA Pipeline — Constraint-First Specification Architecture for AI agents. Production-grade from line one.",
-    "bin": {
-        "cfsa-antigravity": "./bin/cli.mjs"
-    },
-    "files": [
-        "bin/",
-        "template/"
-    ],
-    "keywords": [
-        "ai",
-        "agent",
-        "cfsa",
-        "specification",
-        "pipeline",
-        "tdd",
-        "antigravity",
-        "production",
-        "workflows",
-        "skills"
-    ],
-    "author": "RepairYourTech",
-    "license": "MIT",
-    "repository": {
-        "type": "git",
-        "url": "https://github.com/RepairYourTech/cfsa-antigravity"
-    },
-    "homepage": "https://github.com/RepairYourTech/cfsa-antigravity#readme",
-    "engines": {
-        "node": ">=18.0.0"
-    }
+  "name": "cfsa-antigravity",
+  "version": "2.1.0",
+  "description": "CFSA Pipeline — Constraint-First Specification Architecture for AI agents. Production-grade from line one.",
+  "scripts": {
+    "changeset": "changeset",
+    "version": "changeset version",
+    "build": "./scripts/build-template.sh",
+    "check": "./scripts/check-template-integrity.sh",
+    "prepare": "husky || true"
+  },
+  "bin": {
+    "cfsa-antigravity": "./bin/cli.mjs"
+  },
+  "files": [
+    "bin/",
+    "template/"
+  ],
+  "keywords": [
+    "ai",
+    "agent",
+    "cfsa",
+    "specification",
+    "pipeline",
+    "tdd",
+    "antigravity",
+    "production",
+    "workflows",
+    "skills"
+  ],
+  "author": "RepairYourTech",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/RepairYourTech/cfsa-antigravity"
+  },
+  "homepage": "https://github.com/RepairYourTech/cfsa-antigravity#readme",
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "devDependencies": {
+    "@changesets/changelog-github": "^0.6.0",
+    "@changesets/cli": "^2.30.0",
+    "@commitlint/cli": "^20.4.4",
+    "@commitlint/config-conventional": "^20.4.4",
+    "husky": "^9.1.7"
+  }
 }

package/template/.agent/instructions/commands.md

@@ -2,44 +2,20 @@
 
 <!-- 
   THIS FILE IS A TEMPLATE.
-  The /bootstrap-agents workflow will fill in your project-specific commands.
-  Replace {{PLACEHOLDERS}} with your actual commands.
+  The /bootstrap-agents workflow fills per-surface command sections below.
+  For single-surface projects, one flat section is written.
+  For multi-surface projects, one section per surface.
 -->
 
-## Package Manager: {{PACKAGE_MANAGER}}
+<!-- Bootstrap writes command sections here. Each surface from the map gets its own section. -->
+<!-- Single-surface projects get a flat layout (no surface header). -->
 
-## Development
-
-```bash
-{{DEV_COMMAND}}                    # Start dev server
-```
-
-## Testing
-
-```bash
-{{TEST_COMMAND}}                   # Run all tests
-{{TEST_WATCH_COMMAND}}             # Watch mode
-{{TEST_COVERAGE_COMMAND}}          # With coverage report
-```
-
-## Linting & Formatting
-
-```bash
-{{LINT_COMMAND}}                   # Lint check
-{{LINT_FIX_COMMAND}}               # Lint with auto-fix
-{{FORMAT_COMMAND}}                 # Format check
-{{TYPE_CHECK_COMMAND}}             # TypeScript type validation
-```
-
-## Build & Preview
-
-```bash
-{{BUILD_COMMAND}}                  # Production build
-{{PREVIEW_COMMAND}}                # Preview production build locally
-```
+{{COMMAND_SECTIONS}}
 
 ## Validation (run after every code change)
 
+The validation command runs all checks for the primary surface. For multi-surface projects, run each surface's validation command.
+
 // turbo
 ```bash
 {{VALIDATION_COMMAND}}

package/template/.agent/instructions/patterns.md

@@ -9,9 +9,9 @@
 ## TypeScript → skills: `clean-code`, `typescript-advanced-patterns`
 - **Strict mode** everywhere — `strict: true` in tsconfig
 - **Explicit types** — No `any`, no implicit returns
-- **Zod validation** — All API inputs validated with Zod schemas
+- **{{CONTRACT_LIBRARY}} validation** — All API inputs validated with {{CONTRACT_LIBRARY}} schemas
 - **Self-documenting** — Clear naming over comments
-- **Zod inference** — Derive TypeScript types from Zod schemas with `z.infer<typeof schema>`
+- **{{CONTRACT_LIBRARY}} inference** — Derive types from {{CONTRACT_LIBRARY}} schemas (e.g., `z.infer<typeof schema>` for Zod, type inference for Pydantic)
 
 ## File Organization → skill: `clean-code`
 - **File size limits** — Per-type limits (enforced by extensibility rule): 200 lines for components (.tsx), 300 for utilities (.ts), 150 for schemas (.schema.ts), 400 for tests (.test.ts), 100 for config files
@@ -24,7 +24,7 @@
 > ⚠️ **Framework component patterns not yet configured.** Run /bootstrap-agents with FRAMEWORK_PATTERNS to fill this section. Until then, follow the framework's official documentation for component conventions and apply the naming and file organisation rules above.
 
 ## API & Data → skill: `rest-api-design`
-- **Input validation** — Zod schemas on every endpoint
+- **Input validation** — {{CONTRACT_LIBRARY}} schemas on every endpoint
 - **Error format** — Consistent: `{ success: boolean, data?: T, error?: { code, message } }`
 - **No magic strings** — Constants and enums for repeated values
 - **Rate limiting** — On all public-facing endpoints

package/template/.agent/instructions/tech-stack.md

@@ -2,39 +2,87 @@
 
 <!-- 
   THIS FILE IS A TEMPLATE.
-  The /bootstrap-agents workflow will fill in your project-specific stack.
-  Sections marked with {{PLACEHOLDER}} will be replaced.
+  The /bootstrap-agents workflow fills the Surface Stack Map and Global Settings below.
+  Empty cells are marked with — (not applicable) or ⚠️ (not yet resolved).
 -->
 
-## Stack Summary
+## Surface Stack Map
 
-**{{TECH_STACK_SUMMARY}}**
+The surface stack map is the **single source of truth** for all per-surface stack decisions and cross-cutting project-wide skills. Every workflow that needs to load skills or run commands resolves them from this map — NOT from scattered placeholders.
 
-## Core Decisions
+### How Workflows Use This Map
 
-| Axis | Decision |
-|------|----------|
-| **Frontend framework** | {{FRONTEND_FRAMEWORK}} |
-| **Backend runtime** | {{BACKEND_RUNTIME}} |
-| **Database** | {{DATABASE}} |
-| **Auth provider** | {{AUTH_PROVIDER}} |
-| **Hosting** | {{HOSTING}} |
-| **CDN / Assets** | {{CDN_ASSETS}} |
-| **CI/CD** | {{CICD}} |
-| **Monitoring** | {{MONITORING}} |
+**Surface-aware workflows** (spec-writing, implementation):
+1. Determine the shard/slice's surface from its directory path or surface tag
+2. Look up the row for that surface in the Per-Surface table below
+3. Load all skills listed in the required column(s) — cells are comma-separated lists
+4. Skip cells marked `—` (not applicable for this surface)
 
-## Development Tooling
+**Cross-cutting workflows** (validation, infrastructure verification):
+1. Read the Cross-Cutting Skills table below
+2. Load all skills listed in the required category
 
-| Tool | Value |
-|------|-------|
-| Package manager | {{PACKAGE_MANAGER}} |
-| Test runner | {{TEST_RUNNER}} |
-| Linter | {{LINTER}} |
-| Type checker | {{TYPE_CHECKER}} |
+**Single-surface projects**: The Per-Surface table has exactly one row. All lookups resolve identically to a flat scalar model. No conditional logic needed.
+
+### Per-Surface Skills
+
+Each cell is a comma-separated list of skill directory names from `.agent/skills/`. Use `—` for "not applicable."
+
+<!-- Bootstrap fills this table. One row per confirmed surface + a `shared` row for cross-surface backend. -->
+
+| Surface | Languages | BE Frameworks | FE Frameworks | FE Design | ORMs | State Mgmt | Databases | Unit Tests | E2E Tests | Test Cmd | Validation Cmd | Lint Cmd | Build Cmd | Dev Cmd | Package Mgr |
+|---------|-----------|---------------|---------------|-----------|------|------------|-----------|------------|-----------|----------|----------------|----------|-----------|---------|-------------|
+| {{SURFACE_ROW}} |
+
+> **Multi-value cells**: A surface can list multiple skills per column (e.g., `tailwind, vanilla-css` or `supabase, surrealdb, pglite`). Workflows iterate and load ALL listed skills.
+
+> **Shared row**: The `shared` surface represents cross-surface backend infrastructure (API layer, shared database, etc.). Shards in `docs/plans/shared/` resolve against this row.
+
+### Cross-Cutting Skills
+
+Project-wide skills that don't vary per surface. Each value column is also comma-separated.
+
+<!-- Bootstrap fills this table from project-wide tech stack decisions. -->
+
+| Category | Skills |
+|----------|--------|
+| Auth | {{AUTH}} |
+| CI/CD | {{CI_CD}} |
+| Hosting | {{HOSTING}} |
+| Security | {{SECURITY}} |
+| API Design | {{API_DESIGN}} |
+| Accessibility | {{ACCESSIBILITY}} |
+| Contract Library | {{CONTRACT_LIBRARY}} |
+
+### Map Verification
+
+A valid surface stack map must satisfy:
+1. **At least one row** in the Per-Surface table (even single-surface projects)
+2. **Languages column is never empty** — every surface has at least one language
+3. **Test Cmd column is never empty** — every surface must be testable
+4. **No `⚠️` cells** — all skill resolution must be complete before implementation begins
+
+Verification gates in `plan-phase` and `implement-slice` check these conditions. See `.agent/skills/session-continuity/protocols/10-placeholder-verification-gate.md` for the full verification procedure.
+
+---
+
+## Global Settings
+
+<!-- These are project-wide values, not per-surface. Bootstrap fills them. -->
+
+| Setting | Value |
+|---------|-------|
+| Project Name | {{PROJECT_NAME}} |
+| Description | {{DESCRIPTION}} |
+| Stack Summary | {{TECH_STACK_SUMMARY}} |
+| Surfaces | {{SURFACES}} |
+| Architecture Doc | {{ARCHITECTURE_DOC}} |
+
+---
 
 ## Installed Skills
 
-<!-- Updated by /create-prd after skill discovery -->
+<!-- Updated by /bootstrap-agents-provision after skill discovery and provisioning -->
 {{INSTALLED_SKILLS}}
 
 ## Reference

package/template/.agent/instructions/workflow.md

@@ -6,6 +6,7 @@ Before taking any action on a task:
 - Read the agent config file at project root (`AGENTS.md` for Antigravity, `GEMINI.md` for Gemini CLI, or equivalent for your agent)
 - Read relevant `.agent/instructions/` files for the task type
 - Check [Engineering Standards](../../docs/plans/ENGINEERING-STANDARDS.md) for quality bar — if this file doesn't exist yet, the pipeline hasn't reached /create-prd; run /ideate then /create-prd first
+- **Session Resumption**: If `.agent/progress/index.md` exists, read `.agent/skills/session-continuity/protocols/01-session-resumption.md` and follow the **Session Resumption Protocol** to load cross-session context and identify the resumption point
 
 ## 2. Check Skills
 - Scan `.agent/skills/` for applicable skills
@@ -27,11 +28,21 @@ Before taking any action on a task:
 ## 4. Validate (MANDATORY)
 After **every** code change, run:
 ```bash
-{{VALIDATION_COMMAND}}
+See `.agent/instructions/commands.md` for the validation command.
 ```
 
 Do NOT mark a task complete until all validations pass.
 
+## 5. Learn (MANDATORY)
+
+After completing a workflow or substantial task:
+
+- **Pattern Extraction**: Read `.agent/skills/session-continuity/protocols/04-pattern-extraction.md` and follow the **Pattern Extraction Protocol**. Reflect on what worked, what didn't, and log reusable patterns to `memory/patterns.md`. Skip only if the task was trivial (routine, nothing new learned).
+- **Session Close**: Read `.agent/skills/session-continuity/protocols/05-session-close.md` and follow the **Session Close Protocol**. Write a session log to `.agent/progress/sessions/` so the next session can resume cleanly.
+
+> These steps are **not optional**. They are what differentiate a pipeline that gets
+> smarter over time from one that repeats the same mistakes.
+
 ## Principles
 
 - **Ask before assuming** — Clarify ambiguous requirements

package/template/.agent/rules/completion-checklist.md

@@ -38,6 +38,11 @@ A unit of work is only DONE when:
    - Overall progress fractions updated
 4. **The Locks**: All task claims (`[!]` flags and `files:` blocks) are removed.
 5. **The Memory**: Blockers and patterns are logged to `.agent/progress/memory/`.
+   - Follow `.agent/skills/session-continuity/protocols/04-pattern-extraction.md` — reflect on what worked, what didn't, classify, and write to `memory/patterns.md`
+   - Log any new blockers or resolutions to `memory/blockers.md`
+   - If decisions were made using Protocol 6 (Decision Effect Analysis), verify they're recorded in `memory/decisions.md`
+6. **The Session Log**: A session close log exists in `.agent/progress/sessions/`.
+   - Follow `.agent/skills/session-continuity/protocols/05-session-close.md` — write what was accomplished, deferred, and where the next session should start
 
 ## Enforcement
 
@@ -46,3 +51,4 @@ updating progress files, **you may not skip it**.
 
 If you skip the progress tracking steps, you have failed the task, regardless of how
 good the code is.
+

package/template/.agent/rules/security-first.md

@@ -14,15 +14,15 @@ trigger: always_on
 | Rule | Implementation |
 |------|---------------|
 | **No PII in AI payloads** | User data (email, name, DOB, payment info) is NEVER included in AI model requests |
-| **PII fields tagged in schemas** | Zod schemas mark sensitive fields with `.describe('PII')` for automated auditing |
+| **PII fields tagged in schemas** | {{CONTRACT_LIBRARY}} schemas mark sensitive fields for automated auditing |
 | **No PII in logs** | Structured logging with automatic PII redaction |
 | **No PII in error messages** | Error responses never include user data — use IDs and codes only |
 | **Encrypted at rest** | All PII fields encrypted in database |
 
 ## Input Validation
 
-- **Every** API endpoint validates input with Zod — no exceptions
-- **Every** form validates client-side with Zod AND server-side with the same schema
+- **Every** API endpoint validates input with {{CONTRACT_LIBRARY}} — no exceptions
+- **Every** form validates client-side with {{CONTRACT_LIBRARY}} AND server-side with the same schema
 - **No** raw user input reaches a database query — always parameterized
 - **No** user input is rendered as HTML — always escaped
 - **Rate limiting** — Every public-facing endpoint must have rate limiting configured. No exceptions. Use the project's configured rate limiting utility (see `patterns.md` for the approach). Unauthenticated endpoints must have stricter limits than authenticated ones.

package/template/.agent/rules/vertical-slices.md

@@ -25,7 +25,7 @@ trigger: always_on
 A feature slice is complete when:
 
 - [ ] Data layer: schema defined, permissions set, seed data exists
-- [ ] API layer: endpoints exist, validated with Zod, tested
+- [ ] API layer: endpoints exist, validated with {{CONTRACT_LIBRARY}}, tested
 - [ ] User-facing: component renders, handles loading/error/empty states
 - [ ] Admin: can create/read/update/delete the resource
 - [ ] Tests pass at all levels (contract, unit, integration, E2E)

package/template/.agent/skill-library/MANIFEST.md

@@ -75,6 +75,8 @@ When a stack key matches a value pattern (case-insensitive), install the listed
 | `API_LAYER` | `*trpc*` | `stack/api/trpc` | `trpc` |
 | `API_LAYER` | `*graphql*` | `stack/api/graphql` | `graphql` |
 
+> **`{{API_DESIGN_SKILL}}` provision**: When `API_LAYER` is set, bootstrap fills `{{API_DESIGN_SKILL}}` with the matching API skill name (e.g., `trpc`, `graphql`). When `API_LAYER` is not set (REST is the default API style), `{{API_DESIGN_SKILL}}` defaults to `api-design-principles` (pre-installed). This replaces the former hardcoded `rest-api-design` reference.
+
 ### ORM / Data Layer
 
 | Stack Key | Value Pattern | Library Path | Installed As |
@@ -164,7 +166,7 @@ Note: `DESIGN_DIRECTION` does not copy a skill from the library — it fills pla
 |-----------|--------------|-------------|-------------|
 | `OBSERVABILITY` | `*opentelemetry*` OR `*otel*` | `stack/observability/opentelemetry` | `opentelemetry` |
 | `OBSERVABILITY` | `*distributed-tracing*` OR `*jaeger*` OR `*zipkin*` | `stack/observability/distributed-tracing` | `distributed-tracing` |
-| `OBSERVABILITY` | `*structured-logging*` OR `*pino*` OR `*winston*` | `stack/observability/logging-best-practices` | `logging-best-practices` |
+| `OBSERVABILITY` | `*structured-logging*` OR `*pino*` OR `*winston*` | Pre-installed: `.agent/skills/logging-best-practices` | `logging-best-practices` (pre-installed) |
 | `OBSERVABILITY` | `*python*` | `stack/observability/python-observability` | `python-observability` |
 | `OBSERVABILITY` | `*datadog*` | `stack/observability/datadog` | `datadog` |
 | `OBSERVABILITY` | `*prometheus*` OR `*grafana*` | `stack/observability/prometheus-grafana` | `prometheus-grafana` |
@@ -218,7 +220,13 @@ Note: `DESIGN_DIRECTION` does not copy a skill from the library — it fills pla
 | Stack Key | Value Pattern | Library Path | Installed As |
 |-----------|--------------|-------------|-------------|
 | `CI_CD` | `*github*` | `stack/devops/github-actions` | `github-actions` |
+| `CI_CD` | `*github*` | `stack/devops/git-workflow` | `git-workflow` |
+| `CI_CD` | `*github*` | `stack/devops/git-advanced` | `git-advanced` |
 | `CI_CD` | `*terraform*` | `stack/devops/terraform` | `terraform` |
+| `CI_CD` | `*gitlab*` | `stack/devops/git-workflow` | `git-workflow` |
+| `CI_CD` | `*gitlab*` | `stack/devops/git-advanced` | `git-advanced` |
+| `CI_CD` | `*bitbucket*` | `stack/devops/git-workflow` | `git-workflow` |
+| `CI_CD` | `*bitbucket*` | `stack/devops/git-advanced` | `git-advanced` |
 
 ### DevOps / Infrastructure
 
@@ -232,6 +240,7 @@ Note: `DESIGN_DIRECTION` does not copy a skill from the library — it fills pla
 | Stack Key | Value Pattern | Library Path | Installed As |
 |-----------|--------------|-------------|-------------|
 | `MOBILE_FRAMEWORK` | `*expo*` OR `*react-native*` OR `*react native*` | `stack/mobile/react-native` | `react-native` |
+| `MOBILE_FRAMEWORK` | `*expo*` | `stack/mobile/expo-react-native` | `expo-react-native` |
 | `MOBILE_FRAMEWORK` | `*flutter*` | `stack/mobile/flutter` | `flutter` |
 | `MOBILE_FRAMEWORK` | `*swiftui*` OR `*swift*` | `stack/mobile/swiftui` | `swiftui` |
 | `MOBILE_FRAMEWORK` | `*kotlin*` OR `*compose*` OR `*jetpack*` | `stack/mobile/kotlin-compose` | `kotlin-compose` |
@@ -261,10 +270,8 @@ Note: `DESIGN_DIRECTION` does not copy a skill from the library — it fills pla
 
 | Stack Key | Value Pattern | Library Path | Installed As |
 |-----------|--------------|-------------|-------------|
-| `GAME_ENGINE` | `*godot*` | `stack/engines/godot` | `godot` |
-| `GAME_ENGINE` | `*unity*` | `stack/engines/unity` | `unity` |
-| `GAME_ENGINE` | `*unreal*` OR `*ue5*` | `stack/engines/unreal` | `unreal` |
-| `GAME_ENGINE` | `*bevy*` | `stack/engines/bevy` | `bevy` |
+| `GAME_ENGINE` | `*godot*` | `stack/gamedev/godot` | `godot` |
+| `GAME_ENGINE` | `*unity*` | `stack/gamedev/unity` | `unity` |
 
 ### Security
 
@@ -353,7 +360,7 @@ When the project includes a surface type, install the listed skills.
 | `api` | `surface/api/api-caching` | `api-caching` |
 | `api` | `surface/api/api-documentation-openapi` | `api-documentation-openapi` |
 | `api` | `surface/api/webhook-design` | `webhook-design` |
-| `api` | `surface/api/rest-api-design` | `rest-api-design` |
+| `api` | Pre-installed: `.agent/skills/api-design-principles` | `api-design-principles` (pre-installed) |
 | `api` | `surface/api/api-security-checklist` | `api-security-checklist` |
 | `api` | `stack/security/input-sanitization` | `input-sanitization` |
 
@@ -411,7 +418,7 @@ These skills are NOT auto-installed. Install via `/find-skills` or manually copy
 | `meta/mcp-builder` | Building MCP servers |
 | `meta/tmux-processes` | Long-lived process management via tmux |
 | `meta/using-tmux-for-interactive-commands` | Interactive CLI tools via tmux |
-| `meta/brand-guidelines` | Brand color and typography application |
+| Pre-installed: `.agent/skills/brand-guidelines` | Brand color and typography application (pre-installed) |
 | `meta/product-marketing-context` | Marketing context document generator — run first before any SEO or CRO skill |
 
 ---
@@ -467,14 +474,23 @@ To add a new skill to the library:
 | `EMAIL` | Email service | Resend |
 | `QUEUE` | Job queue | Inngest, BullMQ |
 | `REALTIME` | Realtime communication | Socket.io |
-| `SEARCH` | Search engine | Meilisearch |
+| `SEARCH` | Search engine | Meilisearch, Algolia, Typesense, Elasticsearch |
 | `CMS` | Content management | Payload CMS, WordPress, Shopify |
-| `STORAGE` | File/object storage | AWS S3 |
+| `STORAGE` | File/object storage | AWS S3, Cloudflare R2, Google Cloud Storage |
 | `CI_CD` | CI/CD pipeline | GitHub Actions, Terraform |
-| `MOBILE_FRAMEWORK` | Mobile framework | Expo, React Native |
+| `MOBILE_FRAMEWORK` | Mobile framework | Expo, React Native, Flutter, SwiftUI, Kotlin/Compose |
 | `LANGUAGE` | Programming language | TypeScript, Python, Rust, Go, C/C++, Java, Kotlin, JavaScript, GDScript, Bash |
+| `MESSAGE_BROKER` | Message broker/queue | Kafka, RabbitMQ, NATS, AWS SQS |
+| `NOTIFICATIONS` | Notification service | Twilio, FCM, SendGrid |
+| `BROWSER_EXTENSION` | Browser extension framework | WXT, Plasmo, Chrome Extension |
+| `VSCODE_EXTENSION` | VS Code extension | VS Code Extension |
+| `FEATURE_FLAGS` | Feature flag service | LaunchDarkly, PostHog, Flagsmith |
+| `DATABASE_ANALYTICS` | Analytics database | ClickHouse |
 | `3D_FRAMEWORK` | 3D rendering | Three.js, React Three Fiber |
 | `GAME_ENGINE` | Game engine | Godot, Unity |
 | `SECURITY` | Security focus area | OWASP, Crypto, CSP/CORS, Dependency Auditing, Input Sanitization |
 | `SECURITY_SKILLS` | Accumulated list of all provisioned security skills (comma-separated, auto-filled by bootstrap) | e.g., `owasp-web-security,csp-cors-headers,input-sanitization,dependency-auditing` |
+| `API_DESIGN_SKILL` | API design skill for the project's API style (auto-filled by bootstrap, defaults to `api-design-principles`) | `api-design-principles`, `trpc`, `graphql` |
 | `DESIGN_DIRECTION` | Confirmed visual design direction | Minimal/Functional, Editorial, Luxury/Refined, Playful/Expressive, Technical/Brutalist, Cinematic/Immersive, or Hybrid |
+| `CDN_ASSETS` | CDN provider for static assets (no skill provisioned — handled by `HOSTING_SKILL`) | Cloudflare, AWS CloudFront, Vercel Edge |
+| `BACKEND_RUNTIME` | Backend runtime environment (no skill provisioned — handled by `LANGUAGE_SKILL` and `BACKEND_FRAMEWORK_SKILL`) | Node.js, Bun, Deno, Python |