contextos-agents 2.0.0 → 2.1.1

package/catalog/skills/terraform/EXAMPLES.md

@@ -0,0 +1,74 @@
+# Terraform - Examples & Refactoring Scenarios
+
+## Example 1: Zero-Downtime Address Refactoring with `moved` Blocks
+
+When moving an inline resource into a dedicated child module, never allow Terraform to destroy and recreate it:
+
+```hcl
+# Before refactor (in root main.tf):
+# resource "aws_s3_bucket" "assets" {
+#   bucket = "company-production-assets"
+# }
+
+# After refactor:
+module "storage" {
+  source      = "../../modules/storage"
+  bucket_name = "company-production-assets"
+}
+
+# Refactor migration declaration (prevents destructive delete/recreate):
+moved {
+  from = aws_s3_bucket.assets
+  to   = module.storage.aws_s3_bucket.this
+}
+```
+
+---
+
+## Example 2: Safe Environment Module Pattern
+
+```hcl
+# environments/prod/versions.tf
+terraform {
+  required_version = ">= 1.9.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.50.0"
+    }
+  }
+
+  backend "s3" {
+    bucket         = "tf-state-prod-lock"
+    key            = "core/terraform.tfstate"
+    region         = "us-east-1"
+    dynamodb_table = "tf-state-locks"
+    encrypt        = true
+  }
+}
+```
+
+---
+
+## Example 3: Safe Destroy Verification Script
+
+```bash
+#!/usr/bin/env bash
+set -euo pipefail
+
+TARGET_RESOURCE="${1:-}"
+
+if [[ -z "$TARGET_RESOURCE" ]]; then
+  echo "Error: Target resource address must be specified."
+  exit 1
+fi
+
+echo "Running safe destroy inspection for: $TARGET_RESOURCE"
+terraform plan -destroy -target="$TARGET_RESOURCE" -out="destroy.tfplan"
+
+# Display affected resources
+terraform show -json destroy.tfplan | jq -r '.resource_changes[] | select(.change.actions[] == "delete") | .address'
+
+echo "Carefully inspect the resources above. Run terraform apply destroy.tfplan only after manual confirmation."
+```

package/catalog/skills/terraform/SKILL.md

@@ -0,0 +1,55 @@
+---
+name: terraform
+description: Production-grade Terraform and OpenTofu IaC guidance. Enforces diagnose-first failure mode analysis, Safe Destroy Protocol, state management, and modular architecture.
+---
+
+# Terraform and OpenTofu
+
+Diagnose-first guidance for Terraform and OpenTofu infrastructure as code, inspired by Anton Babenko's engineering standards.
+
+## Response Contract
+
+Every Terraform or OpenTofu modification must declare:
+1. **Assumptions & Version Floor**: Runtime (`terraform` or `tofu`), exact version, providers, backend type, and environment criticality.
+2. **Risk Category Addressed**: Identify whether the change impacts identity churn, secret exposure, blast radius, destroy cascades, or CI drift.
+3. **Chosen Remediation & Trade-offs**: Why this approach was selected over alternatives.
+4. **Validation Plan**: Exact commands (`terraform fmt -check`, `validate`, `plan -out=tfplan`) tailored to the change.
+5. **Rollback Notes**: Clear procedure for reverting any state or resource mutation.
+
+## Safe Destroy Protocol
+
+Never run `terraform destroy` or remove state without strict guards:
+- **Mandatory Plan-Destroy**: Never execute a destroy operation without first running `terraform plan -destroy` and displaying every single resource marked for deletion.
+- **Check Implicit Dependents**: Review `locals` and `for_each` consumers referencing targeted resources to ensure no unexpected cascading deletions occur.
+- **Zero Auto-Approve on Destroy**: The `-auto-approve` flag is strictly forbidden on destroy operations.
+
+## Diagnose Before Generating
+
+| Failure Category | Symptoms | Prevention Strategy |
+|------------------|----------|---------------------|
+| **Identity Churn** | Resource addresses shift after refactoring, recreation of stateful resources | Use `for_each` instead of numeric `count`; apply `moved` blocks for refactored addresses |
+| **Secret Exposure** | Sensitive tokens in variables, plan outputs, or unencrypted state | Mark outputs/variables with `sensitive = true`; use KMS-encrypted remote backends |
+| **Blast Radius** | Oversized monolithic state files, shared dev/prod configurations | Isolate state per environment and bounded context; keep modules focused |
+| **Destroy Cascade** | Targeted destruction deletes dependent databases or networks | Run `plan -destroy` first; inspect dependency DAG |
+| **CI Drift** | Local plan differs from CI runner; unpinned providers | Pin exact provider and module versions; run plans strictly against reviewed commit SHA |
+
+## Module Hierarchy & Directory Layout
+
+Structure infrastructure into three distinct layers:
+1. **Resource Module**: Single logical grouping of closely connected resources (e.g. VPC + subnets, or S3 bucket + bucket policy).
+2. **Infrastructure Module**: Collection of resource modules fulfilling a sub-system (e.g. multi-region compute cluster with monitoring).
+3. **Composition**: Environment-level assembly tying modules together for a specific environment (`dev`, `staging`, `prod`).
+
+```
+environments/
+  prod/
+    main.tf           # Calls reusable modules
+    variables.tf
+    outputs.tf
+    versions.tf       # Exact provider pins & backend configuration
+modules/
+  networking/
+    main.tf
+    variables.tf
+    outputs.tf
+```

package/catalog/skills/terraform/TROUBLESHOOTING.md

@@ -0,0 +1,53 @@
+# Terraform - Troubleshooting & Common Edge Cases
+
+## Common Diagnostic Scenarios
+
+### 1. Stuck Remote State Lock (`Error acquiring the state lock`)
+
+- **Symptom**: Terraform commands abort with `Error message: ConditionalCheckFailedException: The conditional request failed` or `Lock Info: ID: <lock-id>`.
+- **Root Cause**: A previous CI runner or local process crashed, timed out, or was killed before releasing the DynamoDB or backend lock.
+- **Fix Protocol**:
+  1. Inspect the Lock Info: verify the lock owner and creation timestamp.
+  2. Confirm that no active pipeline or engineer is running an apply on this workspace.
+  3. Force-unlock using the exact Lock ID:
+     ```bash
+     terraform force-unlock <lock-id>
+     ```
+  4. Never disable locks by setting `-lock=false`.
+
+---
+
+### 2. Cascading Destruction of Dependent Resources via `for_each` / `locals`
+
+- **Symptom**: Destroying a single resource triggers planned deletion of dozens of downstream resources.
+- **Root Cause**: Downstream resources reference the targeted resource in a `for_each` map or local projection. Removing the upstream resource causes keys in `for_each` to disappear, queueing destruction of all instances.
+- **Fix Protocol**:
+  1. Always run `terraform plan -destroy -target=<resource>` first.
+  2. Inspect the resource changes list for unexpected deletions.
+  3. Decouple downstream configurations or provide static placeholder values in `locals` before attempting targeted deletion.
+
+---
+
+### 3. Identity Churn on Refactoring Module Paths
+
+- **Symptom**: After restructuring modules, `terraform plan` reports: `Plan: 5 to add, 0 to change, 5 to destroy` for existing stateful resources.
+- **Root Cause**: Changing module names or nesting paths changes the resource addresses in the Terraform state file.
+- **Fix Protocol**:
+  - Use `moved` blocks to cleanly inform Terraform of the address change:
+    ```hcl
+    moved {
+      from = module.old_network.aws_vpc.main
+      to   = module.vpc.aws_vpc.this
+    }
+    ```
+  - Re-run `terraform plan`. It should now report `Plan: 0 to add, 0 to change, 0 to destroy` with a clear notice of moved resource addresses.
+
+---
+
+### 4. Cyclic Dependency Errors (`Cycle: module.a, module.b`)
+
+- **Symptom**: Terraform graph computation aborts with a cyclic dependency error.
+- **Root Cause**: Module A references outputs from Module B, while Module B references outputs from Module A.
+- **Fix Protocol**:
+  1. Break bidirectional coupling by extracting the shared configuration or data resource into a dedicated upstream module (e.g. `module.shared_networking`).
+  2. Pass IDs downward; never allow lower-tier modules to depend on upper-tier compositions.

package/catalog/skills/terraform/VALIDATION.json

@@ -0,0 +1,11 @@
+{
+  "skill": "terraform",
+  "version": "1.0.0",
+  "checks": [
+    "Response contract declared with assumptions, risk category, and rollback plan",
+    "Safe destroy protocol strictly enforced without -auto-approve",
+    "Module hierarchy maintained (resource -> infrastructure -> composition)",
+    "Remote backend configured with state locking and encryption at rest",
+    "Resource refactoring uses moved blocks to prevent identity churn"
+  ]
+}

package/catalog/skills/terraform/skill.yaml

@@ -0,0 +1,14 @@
+schemaVersion: 2
+name: terraform
+description: Production-grade Terraform and OpenTofu IaC guidance inspired by Anton Babenko. Enforces diagnose-first failure mode analysis, Safe Destroy Protocol, and modular composition.
+version: 1.0.0
+category: devops
+type: instruction-only
+requires:
+  - engineering-workflow
+  - decisions
+resources:
+  - EXAMPLES.md
+  - SKILL.md
+  - TROUBLESHOOTING.md
+  - VALIDATION.json

package/catalog/skills/testing/EXAMPLES.md

@@ -0,0 +1,122 @@
+# Testing Examples - Anti-patterns vs ContextOS Standard
+
+## Example 1: React Component Testing
+
+### Anti-pattern: Anti-pattern (Brittle query & implementation coupling)
+
+```typescript
+// BAD: querying by CSS class or test-id and testing internal state
+test('submits form', async () => {
+  const wrapper = render(<LoginForm />);
+  const input = wrapper.container.querySelector('.email-input');
+  fireEvent.change(input, { target: { value: 'user@test.com' } });
+  fireEvent.click(wrapper.container.querySelector('#submit-btn'));
+  expect(wrapper.state().isSubmitted).toBe(true); // Brittle!
+});
+```
+
+### Best practice: ContextOS Standard (User-centric role queries & userEvent)
+
+```typescript
+// GOOD: user-facing roles, userEvent, async wait
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { LoginForm } from './LoginForm';
+
+test('submits form with valid user credentials', async () => {
+  const user = userEvent.setup();
+  const onSubmit = vi.fn();
+  render(<LoginForm onSubmit={onSubmit} />);
+
+  await user.type(screen.getByLabelText(/email address/i), 'user@test.com');
+  await user.type(screen.getByLabelText(/password/i), 'SecureP@ss123!');
+  await user.click(screen.getByRole('button', { name: /sign in/i }));
+
+  expect(onSubmit).toHaveBeenCalledWith({
+    email: 'user@test.com',
+    password: 'SecureP@ss123!'
+  });
+  expect(screen.queryByRole('alert')).not.toBeInTheDocument();
+});
+```
+
+---
+
+## Example 2: API Mocking with MSW (Mock Service Worker)
+
+### Anti-pattern: Anti-pattern (Hardcoded global fetch monkey-patching)
+
+```typescript
+// BAD: globally overwriting fetch breaks other tests and hides actual contract
+global.fetch = vi.fn().mockResolvedValue({
+  json: () => Promise.resolve({ data: 'ok' })
+});
+```
+
+### Best practice: ContextOS Standard (Network boundary mocking)
+
+```typescript
+// GOOD: declarative MSW network handler
+import { http, HttpResponse } from 'msw';
+import { setupServer } from 'msw/node';
+
+export const server = setupServer(
+  http.get('/api/users/:id', ({ params }) => {
+    if (params.id === '404') {
+      return new HttpResponse(null, { status: 404 });
+    }
+    return HttpResponse.json({ id: params.id, name: 'Alice Smith' });
+  })
+);
+```
+
+---
+
+## Example 3: End-to-End User Journey with Playwright
+
+### Anti-pattern (Brittle CSS selectors and explicit sleeps)
+
+```typescript
+// BAD: XPath / brittle class selectors and fixed timer sleeps
+test('creates new task', async ({ page }) => {
+  await page.goto('http://localhost:3000');
+  await page.waitForTimeout(5000); // Brittle!
+  await page.click('.btn-primary-small'); // Class name will change with CSS refactoring
+});
+```
+
+### Best practice: ContextOS Standard (Accessible locators & auto-waiting)
+
+```typescript
+import { test, expect } from '@playwright/test';
+
+test.describe('Task Management Journey', () => {
+  test.beforeEach(async ({ page }) => {
+    // Navigate using baseURL configured in playwright.config.ts
+    await page.goto('/tasks');
+  });
+
+  test('creates, completes, and deletes a task', async ({ page }) => {
+    // 1. Fill input using accessible label
+    const input = page.getByRole('textbox', { name: /new task title/i });
+    await input.fill('Deploy production release');
+
+    // 2. Click button using accessible role
+    await page.getByRole('button', { name: /add task/i }).click();
+
+    // 3. Auto-waiting assertion for item appearance
+    const taskItem = page.getByRole('listitem').filter({ hasText: 'Deploy production release' });
+    await expect(taskItem).toBeVisible();
+
+    // 4. Toggle completion checkbox
+    const checkbox = taskItem.getByRole('checkbox', { name: /mark as done/i });
+    await checkbox.check();
+    await expect(checkbox).toBeChecked();
+
+    // 5. Delete task and verify disappearance
+    await taskItem.getByRole('button', { name: /delete task/i }).click();
+    await expect(taskItem).not.toBeVisible();
+  });
+});
+```
+

package/catalog/skills/testing/SKILL.md

@@ -0,0 +1,70 @@
+---
+name: testing
+description: Vitest, React Testing Library, and Playwright testing standards. Enforces TDD/BDD, test pyramid, zero brittle mocks, and complete assertion coverage.
+---
+
+# Testing
+
+## Overview
+
+Testing strategy across unit, component, integration, and end-to-end testing suites using Vitest, React Testing Library, and Playwright.
+
+## When to Use
+
+Activate for any task involving unit tests, integration tests, E2E testing, TDD/BDD workflows, or fixing regression bugs.
+
+## Rules & Patterns
+
+### ️ The ContextOS Testing Pyramid
+
+```
+      /\
+     /E2E\       10% - Playwright (Critical user journeys, auth, checkout)
+    /-----\
+   / Integ \     20% - API & Component Integration (RTL + MSW / Supertest)
+  /---------\
+ /   Unit    \   70% - Pure functions, Domain Entities, Utils (Vitest)
+/-------------\
+```
+
+### Negative Constraints (What NOT to Do)
+
+1. **NEVER mock internal implementation details**: Mock ONLY external I/O boundaries (HTTP network requests via MSW, Database via test containers or in-memory DB).
+2. **NEVER test implementation details**: In React Testing Library, query by user-facing roles (`getByRole`, `getByLabelText`), NEVER by CSS selectors or internal component state.
+3. **NEVER write assertions without an expected failure mode**: Each test must test a single logical behavior and fail if that behavior breaks.
+4. **NEVER leave flaky tests or arbitrary sleep (`await delay(1000)`)**: Always use `waitFor()` or explicit event triggers with timeouts.
+5. **NEVER share mutable state between tests**: Every test must have isolated state via `beforeEach()` setup and clean reset.
+
+### AAA Standard Pattern
+
+```typescript
+describe('Feature / Unit', () => {
+  it('should achieve expected outcome when given specific condition', async () => {
+    // 1. ARRANGE
+    const user = createTestUser({ role: 'admin' });
+    // 2. ACT
+    const result = await processOrder(user, sampleCart);
+    // 3. ASSERT
+    expect(result.status).toBe('confirmed');
+  });
+});
+```
+
+## Code Examples
+
+See `EXAMPLES.md` for detailed anti-patterns and production testing code.
+
+## Validation Checklist
+
+- [ ] Tests follow Arrange-Act-Assert (AAA) structure
+- [ ] No brittle CSS selectors or private state inspections
+- [ ] Mocks isolated strictly to network/IO boundaries (MSW)
+- [ ] Fast execution (< 5s for unit suite) with zero flaky sleeps
+
+## Common Mistakes
+
+- Over-mocking modules instead of running real pure logic. See `TROUBLESHOOTING.md`.
+
+## Integration Notes
+
+Interacts directly with `engineering-workflow` (Verify phase), `react`, and `typescript`.

package/catalog/skills/testing/TROUBLESHOOTING.md

@@ -0,0 +1,18 @@
+# Testing Troubleshooting Guide
+
+## Common Issues & Fixes
+
+### 1. `act(...)` warning in React Testing Library
+
+- **Cause**: An asynchronous state update triggered after the test completed.
+- **Fix**: Ensure all async operations are awaited using `await waitFor(() => ...)` or `await screen.findByRole(...)`.
+
+### 2. Tests pass in isolation but fail in concurrent test runs
+
+- **Cause**: Shared in-memory state or un-reset singleton.
+- **Fix**: Reset all mocks and in-memory databases in `beforeEach(() => vi.clearAllMocks())` and `afterEach(() => cleanup())`.
+
+### 3. Playwright timeout waiting for selector
+
+- **Cause**: Element is animating or blocked behind a modal/overlay.
+- **Fix**: Use web-first assertions like `await expect(page.getByRole('button')).toBeVisible()` which automatically retry until timeout.

package/catalog/skills/testing/VALIDATION.json

@@ -0,0 +1,11 @@
+{
+  "skill": "testing",
+  "version": "1.0.0",
+  "checks": [
+    "Test pyramid ratio enforced (70% unit/integration)",
+    "AAA (Arrange-Act-Assert) pattern implemented",
+    "No internal state inspection or brittle selectors",
+    "MSW used for network boundaries",
+    "Zero shared state between test executions"
+  ]
+}

package/catalog/skills/testing/skill.yaml

@@ -0,0 +1,14 @@
+schemaVersion: 2
+name: testing
+description: Vitest, React Testing Library, and Playwright testing standards. Enforces TDD/BDD, test pyramid, zero brittle mocks, and complete assertion coverage.
+version: 1.0.0
+category: engineering
+type: instruction-only
+requires:
+  - engineering-workflow
+  - typescript
+resources:
+  - EXAMPLES.md
+  - SKILL.md
+  - TROUBLESHOOTING.md
+  - VALIDATION.json

package/catalog/skills/typescript/EXAMPLES.md

@@ -0,0 +1,64 @@
+# TypeScript Examples - Anti-patterns vs ContextOS Standard
+
+## Example 1: Type-Safe Parsing with Zod (No `any`)
+
+### Anti-pattern: Anti-pattern (Blind type assertion with `as`)
+
+```typescript
+// BAD: using 'as User' bypasses runtime validation completely
+async function fetchUser(id: string): Promise<User> {
+  const res = await fetch(`/api/users/${id}`);
+  const data = await res.json();
+  return data as User; // Runtime crash if payload changes!
+}
+```
+
+### Best practice: ContextOS Standard (Runtime schema validation with Zod)
+
+```typescript
+// GOOD: guaranteed runtime and compile-time type safety
+import { z } from 'zod';
+
+export const UserSchema = z.object({
+  id: z.string().uuid(),
+  name: z.string().min(1),
+  email: z.string().email(),
+  role: z.enum(['admin', 'member', 'guest']),
+  createdAt: z.string().datetime(),
+});
+
+export type User = z.infer<typeof UserSchema>;
+
+export async function fetchUser(id: string): Promise<User> {
+  const res = await fetch(`/api/users/${id}`);
+  if (!res.ok) throw new Error(`Fetch failed with status ${res.status}`);
+  const raw: unknown = await res.json();
+  return UserSchema.parse(raw);
+}
+```
+
+---
+
+## Example 2: Discriminated Unions for State Handling
+
+### Anti-pattern: Anti-pattern (Optional soup with boolean flags)
+
+```typescript
+// BAD: impossible states can be represented (e.g. isLoading: true AND error: 'Failed')
+interface AsyncState<T> {
+  data?: T;
+  isLoading: boolean;
+  error?: string;
+}
+```
+
+### Best practice: ContextOS Standard (Discriminated Union)
+
+```typescript
+// GOOD: impossible states are impossible at compile-time
+export type AsyncState<T> =
+  | { readonly status: 'idle' }
+  | { readonly status: 'loading' }
+  | { readonly status: 'success'; readonly data: T }
+  | { readonly status: 'error'; readonly error: Error };
+```

package/catalog/skills/typescript/SKILL.md

@@ -0,0 +1,112 @@
+---
+name: TypeScript
+description: >
+  ContextOS skill for TypeScript
+---
+
+# TypeScript
+
+## Overview
+
+Strict TypeScript engineering standard. Enforces noImplicitAny, discriminated unions, branded types, immutability, exhaustive switch checks, and zero unsafe any or as unknown as T casts.
+
+## When to Use
+
+Activate on all TypeScript and JavaScript codebases to ensure compile-time type safety, robust domain modeling, and foolproof function contracts.
+
+## Negative Constraints (What NOT to Do)
+
+1. **NEVER use `any`**: Use `unknown` with type guards, discriminated unions, or Zod schemas.
+2. **NEVER use type assertions (`as Type` or `as unknown as Type`) to bypass safety**: Fix the underlying type signature or use runtime narrowing (`instanceof`, `typeof`, `in`).
+3. **NEVER use non-null assertions (`foo!.bar`)**: Handle `null` and `undefined` with optional chaining (`?.`) or explicit error guards.
+4. **NEVER export mutable global arrays or object constants**: Always mark constant objects and arrays with `as const` and `readonly`.
+5. **NEVER omit explicit return types on exported functions**: Exported public APIs must declare explicit return types to protect consumers.
+
+## Rules & Patterns
+
+## Strict Mode
+
+Always use strict TypeScript configuration:
+
+```json
+{
+  "compilerOptions": {
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "noImplicitReturns": true,
+    "noFallthroughCasesInSwitch": true
+  }
+}
+```
+
+## Types
+
+- **Prefer `interface`** for object shapes, `type` for unions/intersections
+- **No `any`** - use `unknown` if type is truly unknown, then narrow
+- **Explicit return types** for exported functions
+- **Const assertions** - `as const` for literal types
+
+```typescript
+// Good
+interface User {
+  id: string;
+  name: string;
+  role: 'admin' | 'user';
+}
+
+// Unions
+type Result<T> = { ok: true; data: T } | { ok: false; error: string };
+```
+
+## Utility Types
+
+- `Partial<T>` - all properties optional
+- `Required<T>` - all properties required
+- `Pick<T, K>` - select specific properties
+- `Omit<T, K>` - remove specific properties
+- `Record<K, V>` - key-value map
+
+## Type Guards
+
+```typescript
+function isUser(value: unknown): value is User {
+  return typeof value === 'object' && value !== null && 'id' in value;
+}
+```
+
+## Generic Patterns
+
+```typescript
+// Repository pattern
+interface Repository<T extends { id: string }> {
+  findById(id: string): Promise<T | null>;
+  create(data: Omit<T, 'id'>): Promise<T>;
+  update(id: string, data: Partial<T>): Promise<T>;
+  delete(id: string): Promise<void>;
+}
+```
+
+## Anti-Patterns
+
+- [FAIL] `any` - use `unknown` + type guards
+- [FAIL] Type assertions (`as`) - prefer type guards
+- [FAIL] Non-null assertions (`!`) - handle null explicitly
+- [FAIL] Enums - prefer union types or `as const` objects
+- [FAIL] Complex generics without JSDoc - document intent
+
+
+## Code Examples
+
+See `EXAMPLES.md` for detailed code examples.
+
+## Validation Checklist
+
+What to verify during the review phase before completing the task.
+
+## Common Mistakes
+
+Anti-patterns and things to explicitly avoid. See `TROUBLESHOOTING.md`.
+
+## Integration Notes
+
+How this skill interacts with other skills.

package/catalog/skills/typescript/TROUBLESHOOTING.md

@@ -0,0 +1,19 @@
+# typescript Troubleshooting & Common Mistakes
+
+## 1. Excessive Use of `any` or `as unknown as T`
+
+- **Symptom**: Runtime `TypeError: Cannot read properties of undefined` in supposedly typed TypeScript code.
+- **Root Cause**: Bypassing type checking with `any` or forceful type assertions.
+- **Fix**: Use `unknown` with type guards, Zod schemas, or discriminated unions.
+
+## 2. Non-Exhaustive Switch on Unions
+
+- **Symptom**: New union member added but some switch statements fail to handle it, producing bugs.
+- **Root Cause**: Missing exhaustive type checking in `default:` case.
+- **Fix**: Add `default: const _exhaustive: never = action; throw new Error(_exhaustive);` to let the compiler catch missing branches.
+
+## 3. Inaccurate Generics Constraints
+
+- **Symptom**: Generic functions that lose type inference and resolve to `unknown`.
+- **Root Cause**: Over-specifying generics or missing `extends` constraints.
+- **Fix**: Constrain generics narrowly: `function get<T, K extends keyof T>(obj: T, key: K): T[K]`.

package/catalog/skills/typescript/VALIDATION.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "type": "object",
+  "properties": {
+    "rules_followed": {
+      "type": "boolean"
+    }
+  },
+  "required": [
+    "rules_followed"
+  ]
+}

package/catalog/skills/typescript/skill.yaml

@@ -0,0 +1,14 @@
+schemaVersion: 2
+id: typescript
+name: TypeScript
+category: frontend
+type: instruction-only
+requires: []
+optional: [zod, prisma]
+conflicts: []
+weight: 9
+resources:
+  - EXAMPLES.md
+  - SKILL.md
+  - TROUBLESHOOTING.md
+  - VALIDATION.json