enigma-cli 1.33.5 → 1.33.7

package/assets/memory/AGENTS.md

@@ -39,6 +39,7 @@ Non-negotiable, language-agnostic defaults - apply them by default without being
 - Validate EVERY external input (request body, query, params, event payload, form field, CLI arg, webhook/message) against an explicit schema before use - Zod (TS/JS), Pydantic (Python), the language's equivalent elsewhere. Never consume an unvalidated shape or leave it open-ended. When the input is a tagged/event union, validate the discriminant AND that specific variant's body, with the expected fields typed.
 - Normalize before validating, on the client AND the server, from one shared normalizer: trim every string, lowercase the email, capitalize each word of a person's name, canonicalize a link or handle to one stored form. A check that cannot fail is not validation - never patch the value into validity and then check the patched value.
 - Frontend forms: validate in real time against the same schema, on EVERY field that has a rule and not only the ones with a famous format, and use optimistic UI with rollback on failure for user-facing mutations.
+- Never block the first paint on data: ship the HTML shell, then request the data. Everything that does not depend on the response renders now (nav, headings, table chrome, filters, anything already cached) and only the region genuinely waiting gets a skeleton shaped like its content - never a full-page loader, and never a page that renders nothing until the fetch resolves. The rules are frontend-policy's Instant First Paint.
 - Cache reads on the client (localStorage/sessionStorage, or the data layer's cache) with a short TTL (~30s or more) to avoid redundant queries and survive rate limits; invalidate on write.
 - Build reusable, composable components instead of duplicating UI - e.g. a single Input that renders a show/hide toggle when the type is password. Reuse before writing new.
 - Never use the browser's native `alert`/`confirm`/`prompt` - use a dialog/modal component that matches the page design.
@@ -48,6 +49,7 @@ Non-negotiable, language-agnostic defaults - apply them by default without being
 
 - Treat every task as mission-critical: assume lives and irreversible consequences ride on this being genuinely correct, and that nobody will re-read your work before relying on it. A false report of success is therefore far worse than an honest failure. Finish every part of what was asked with nothing left pending, and before claiming it is done VERIFY it actually works - exercise the exact behavior requested (run it, test it, reproduce the scenario), not merely that it compiles or typechecks. If you have not verified it, do not say it is done; state precisely what remains or is unverified.
 - A message that bundles several asks, questions, or items is a MULTI-PART task - even if it is just two, three, or four things. Before doing anything, extract EVERY distinct ask into an explicit list (the runtime's todo system when it has one, else a written checklist) and treat the request as unfinished until every item on that list is addressed. Never answer the first ask and drop, summarize away, or postpone the rest. When you present a plan, execute the whole plan - do not stop after listing it.
+- A concrete case the user names is an EXAMPLE OF A CLASS, not the whole job ("this label overflows", "this endpoint is unvalidated"). Unless the user scoped it there, state the general rule, sweep deterministically for every other site it applies to, fix them all in this same change, and encode the rule in exactly one tier. Deliberately restated here so it holds even when a skill does not load; the procedure is core-engineering-policy's Generalization Rule.
 - For long or complex tasks - or any task you judge to warrant it - break the work into smaller, well-scoped subtasks and complete them incrementally, validating each subtask before moving to the next. Map the dependencies between subtasks first, and do only the decomposition the task genuinely needs - never over-decompose simple work.
 - For multi-item work (ports, migrations, batch changes), enumerate the FULL inventory of work units with deterministic commands before implementing, persist it as a checklist (file or todo system), and mark a unit done only after verifying it - never because a similar unit worked. This is the task-completion-policy skill; load it for any task that spans many files/items or bundles several asks.
 - "Pending", "pendiente", "TODO", "left as a follow-up", "next step: ...", or "you can do X yourself" is NOT an acceptable way to end a turn for work you are able to perform now. Do that work in this same turn. The only reasons to stop short are a genuine blocker - missing credentials or access, an irreversible or destructive choice, a business decision, or something the user explicitly approved deferring - and then you must name the blocker explicitly, never leave the item silently unfinished.

package/assets/memory/CLAUDE.md

@@ -39,6 +39,7 @@ Non-negotiable, language-agnostic defaults - apply them by default without being
 - Validate EVERY external input (request body, query, params, event payload, form field, CLI arg, webhook/message) against an explicit schema before use - Zod (TS/JS), Pydantic (Python), the language's equivalent elsewhere. Never consume an unvalidated shape or leave it open-ended. When the input is a tagged/event union, validate the discriminant AND that specific variant's body, with the expected fields typed.
 - Normalize before validating, on the client AND the server, from one shared normalizer: trim every string, lowercase the email, capitalize each word of a person's name, canonicalize a link or handle to one stored form. A check that cannot fail is not validation - never patch the value into validity and then check the patched value.
 - Frontend forms: validate in real time against the same schema, on EVERY field that has a rule and not only the ones with a famous format, and use optimistic UI with rollback on failure for user-facing mutations.
+- Never block the first paint on data: ship the HTML shell, then request the data. Everything that does not depend on the response renders now (nav, headings, table chrome, filters, anything already cached) and only the region genuinely waiting gets a skeleton shaped like its content - never a full-page loader, and never a page that renders nothing until the fetch resolves. The rules are frontend-policy's Instant First Paint.
 - Cache reads on the client (localStorage/sessionStorage, or the data layer's cache) with a short TTL (~30s or more) to avoid redundant queries and survive rate limits; invalidate on write.
 - Build reusable, composable components instead of duplicating UI - e.g. a single Input that renders a show/hide toggle when the type is password. Reuse before writing new.
 - Never use the browser's native `alert`/`confirm`/`prompt` - use a dialog/modal component that matches the page design.
@@ -48,6 +49,7 @@ Non-negotiable, language-agnostic defaults - apply them by default without being
 
 - Treat every task as mission-critical: assume lives and irreversible consequences ride on this being genuinely correct, and that nobody will re-read your work before relying on it. A false report of success is therefore far worse than an honest failure. Finish every part of what was asked with nothing left pending, and before claiming it is done VERIFY it actually works - exercise the exact behavior requested (run it, test it, reproduce the scenario), not merely that it compiles or typechecks. If you have not verified it, do not say it is done; state precisely what remains or is unverified.
 - A message that bundles several asks, questions, or items is a MULTI-PART task - even if it is just two, three, or four things. Before doing anything, extract EVERY distinct ask into an explicit list (the runtime's todo system when it has one, else a written checklist) and treat the request as unfinished until every item on that list is addressed. Never answer the first ask and drop, summarize away, or postpone the rest. When you present a plan, execute the whole plan - do not stop after listing it.
+- A concrete case the user names is an EXAMPLE OF A CLASS, not the whole job ("this label overflows", "this endpoint is unvalidated"). Unless the user scoped it there, state the general rule, sweep deterministically for every other site it applies to, fix them all in this same change, and encode the rule in exactly one tier. Deliberately restated here so it holds even when a skill does not load; the procedure is core-engineering-policy's Generalization Rule.
 - For long or complex tasks - or any task you judge to warrant it - break the work into smaller, well-scoped subtasks and complete them incrementally, validating each subtask before moving to the next. Map the dependencies between subtasks first, and do only the decomposition the task genuinely needs - never over-decompose simple work.
 - For multi-item work (ports, migrations, batch changes), enumerate the FULL inventory of work units with deterministic commands before implementing, persist it as a checklist (file or todo system), and mark a unit done only after verifying it - never because a similar unit worked. This is the task-completion-policy skill; load it for any task that spans many files/items or bundles several asks.
 - "Pending", "pendiente", "TODO", "left as a follow-up", "next step: ...", or "you can do X yourself" is NOT an acceptable way to end a turn for work you are able to perform now. Do that work in this same turn. The only reasons to stop short are a genuine blocker - missing credentials or access, an irreversible or destructive choice, a business decision, or something the user explicitly approved deferring - and then you must name the blocker explicitly, never leave the item silently unfinished.

package/assets/skills/anti-overengineering-policy/skill.json

@@ -7,6 +7,6 @@
     "minimalCode"
   ],
   "updated": "2026-07-17T00:17:02+02:00",
-  "cliVersion": "1.33.5",
+  "cliVersion": "1.33.7",
   "sha": "3f0dcc28341bb0407860534f7ce9314cfc91b5e673f8f3d13b89d61851ed75f6"
 }

package/assets/skills/anti-overengineering-review/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "On-demand over-engineering review - diff review, whole-repo audit, and enigma: debt-marker ledger (tags delete/stdlib/native/yagni/shrink, line/dep scoring); lists cuts, applies nothing.",
   "updated": "2026-06-16T11:24:30+02:00",
-  "cliVersion": "1.33.5",
+  "cliVersion": "1.33.7",
   "sha": "f742a2be3f328b9ea1ff9a35a449177c2cbec35ad16e46f7054b7a873a2ab017"
 }

package/assets/skills/backend-policy/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: backend-policy
-description: Backend/API architecture - controller-service-repository layering, request/response handling, API and request optimization (batching, avoiding redundant calls), server-side caching (Redis) with invalidation, and Zod boundary validation. Use when designing or changing API endpoints, services, controllers, server business logic, or backend request flow.
+description: Backend/API architecture - controller-service-repository layering, modern TypeScript project configuration (target/module/moduleResolution, strict flags, and the `@/*` path alias), request/response handling, API and request optimization (batching, avoiding redundant calls), server-side caching (Redis) with invalidation, and Zod boundary validation. Use when designing or changing API endpoints, services, controllers, server business logic, or backend request flow, and when scaffolding or fixing a backend's tsconfig.
 ---
 
 # Backend & API Architecture Policy
@@ -8,7 +8,44 @@ description: Backend/API architecture - controller-service-repository layering,
 ## Activation Scope
 
 - Apply whenever the task involves API endpoints, server business logic, services, controllers, or backend request flow.
-- Owns server-side layering, API/request optimization, and server-side caching. Strict input validation rules live in validation-policy; persistence and query rules live in database-expert.
+- Owns server-side layering, the TypeScript project configuration a backend is built on, API/request optimization, and server-side caching. Strict input validation rules live in validation-policy; persistence and query rules live in database-expert; import style lives in ciphera-style-policy.
+
+---
+
+## TypeScript Project Configuration
+
+The tsconfig is set once, at scaffold time, and every import in the project inherits the consequences. Get it wrong and the cost shows up as noise in thousands of specifiers.
+
+- Pick the emit story first, because it decides everything else:
+  - **Bundled or run from source** - tsup/esbuild/Vite/Next, or executed by tsx or Bun. This is the default for a service or a CLI. Use `"module": "esnext"` with `"moduleResolution": "bundler"`, and specifiers carry no file extension.
+  - **Emitted by `tsc` for Node's own ESM loader** - a published library that ships plain `.js` and has no build step beyond `tsc`. Use `"module": "nodenext"`, and then every relative specifier MUST end in `.js` (Node's loader does no extension guessing). That is the price of the choice; do not pay it by accident on a service that is bundled anyway.
+- Never `"moduleResolution": "node"` (or `"node10"`). It is the pre-2022 resolver and it ignores a package's `exports` map, so a modern dependency resolves to the wrong entry point or fails outright. Never a `"target"` below `es2022` either - it downlevels syntax every runtime you support has shipped for years.
+- Baseline for a new backend:
+
+```jsonc
+{
+  "compilerOptions": {
+    "target": "es2022",
+    "lib": ["es2023"],
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "strict": true,
+    "noUncheckedIndexedAccess": true,   // arr[i] is T | undefined, which is the truth
+    "verbatimModuleSyntax": true,       // type imports erase predictably, no surprise runtime import
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "noEmit": true,                     // the bundler emits; tsc only typechecks
+    "baseUrl": ".",
+    "paths": { "@/*": ["./src/*"] }
+  },
+  "include": ["src"]
+}
+```
+
+- The `paths` alias is part of the baseline, not an optional extra: services, repositories and schemas are imported across the whole tree, and `../../../lib/db` is the shape that makes moving a module a repo-wide edit. Import through `@/` and specifier stability comes for free (ciphera-style-policy owns the import-style rules).
+- Declare the alias in every consumer that resolves modules itself, or it only works in the editor: the bundler config where it does not read tsconfig, `moduleNameMapper` for Jest, `vite-tsconfig-paths` for Vitest. Bun and tsx read tsconfig directly and need nothing.
+- Typechecking is a gate, not an editor feature: `tsc --noEmit` runs in the same command as the tests.
 
 ---
 

package/assets/skills/backend-policy/skill.json

@@ -1,9 +1,9 @@
 {
   "name": "backend-policy",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "provider": "FJRG2007/enigma",
-  "description": "Backend/API architecture: controller-service-repository layering, API and request optimization (batching, avoiding redundant calls, skipping no-op writes), server-side caching (Redis), and Zod boundary validation.",
-  "updated": "2026-08-01T15:51:38+02:00",
-  "cliVersion": "1.33.5",
-  "sha": "572fcf9780e3892942c300214367d7205ed6dcde173a64c61c1e519506cf0cfa"
+  "description": "Backend/API architecture: controller-service-repository layering, modern TypeScript project configuration (module resolution, strict flags, @/* path alias), API and request optimization (batching, avoiding redundant calls, skipping no-op writes), server-side caching (Redis), and Zod boundary validation.",
+  "updated": "2026-08-02T19:59:01+02:00",
+  "cliVersion": "1.33.7",
+  "sha": "652637f818b4ce4f4d5d83fa68fa57fe7842e32fb179523958c5496af54bb938"
 }

package/assets/skills/ciphera-style-policy/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: ciphera-style-policy
-description: Ciphera code style conventions - mandatory formatting and language idioms for source code (TypeScript-first, applies to every language) - American-English naming, double quotes, string interpolation, length-sorted imports, one statement per module and a namespace import (`import * as ns`) instead of a long named list from a project module, 4-space indentation, comment/JSDoc format, compact single-line blocks, and code-level anti-patterns (barrel files, external CDN/hosting dependencies). Use whenever writing, refactoring, or reviewing source code.
+description: Ciphera code style conventions - mandatory formatting and language idioms for source code (TypeScript-first, applies to every language) - American-English naming, double quotes, string interpolation, length-sorted imports, one statement per module and a namespace import (`import * as ns`) instead of a long named list from a project module, path-alias specifiers (`@/x`) instead of deep relative chains and no file extension in an import, 4-space indentation, comment/JSDoc format, compact single-line blocks, and code-level anti-patterns (barrel files, external CDN/hosting dependencies). Use whenever writing, refactoring, or reviewing source code.
 ---
 
 # Ciphera Code Style Policy
@@ -79,6 +79,31 @@ if (!conf.OUTPUT_STYLES.includes(style)) return;
 - Do not import from external hostings or CDNs; depend on a package name, not a remote URL.
 - For obscure libraries, vendor the needed code into the project utilities instead of adding a fragile dependency.
 
+### Specifiers: alias over directory counting
+
+- A TypeScript project declares a path alias and imports through it. In `tsconfig.json`: `"baseUrl": "."` plus `"paths": { "@/*": ["./src/*"] }`. Set this up when you scaffold the project, not once the chains get long.
+- Use the alias for anything outside the importing file's own neighbourhood: `@/services/user`, `@/lib/db`, `@/components/Input`.
+- Keep a relative specifier for a file in the same folder (`./helpers`) or its parent (`../types`). Those say "this belongs with me", which is information; `../../../` says only where the file happens to sit today.
+- A relative chain encodes the position of BOTH files. Move either one and specifiers that had nothing to do with the change have to be rewritten, so a refactor that should be a rename becomes a diff across the tree. An alias is stable under both moves and reads as an absolute address.
+- The alias is a resolver convention, not a runtime one: bundlers (Vite, webpack, esbuild, tsup, Next), tsx and Bun all read it from tsconfig with no extra setup. Jest needs the same map in `moduleNameMapper`; if the test runner has not been told about it, keep the test's import relative rather than leaving it broken.
+- One alias prefix per project. Adding `~/`, `#/` and `@app/` beside `@/` just moves the counting problem into deciding which prefix to write.
+
+### No file extensions in specifiers
+
+- Write `@/services/user` and `./helpers`, never `./helpers.ts`, `./helpers.js`, or `./helpers.tsx`. The resolver finds the source file; the extension only pins the import to a build artifact.
+- `.js` on a TypeScript file names something that does not exist in the source tree, so the specifier stops matching the file it points at and a reader has to translate it back. `.ts` needs `allowImportingTsExtensions` and breaks the day the project emits.
+- The one case where extensions are mandatory is a project emitted by `tsc` for Node's own ESM loader (`"module": "nodenext"`). That is a tsconfig decision, taken once for the project - see backend-policy for which side to be on - not a choice made per import. When the project is built by a bundler or run by tsx/Bun, `"moduleResolution": "bundler"` is the setting and specifiers carry no extension.
+- A non-module asset keeps its real extension, because that IS its name: `import styles from "./table.css"`, `import icon from "./logo.svg"`.
+
+```ts
+// Bad: counts directories, and names a .js file that does not exist in src/.
+import { createUser } from "../../../services/user.js";
+
+// Good
+import { createUser } from "@/services/user";
+import { formatRow } from "./helpers";
+```
+
 ```ts
 // Good
 import axios from "axios";

package/assets/skills/ciphera-style-policy/skill.json

@@ -1,9 +1,9 @@
 {
   "name": "ciphera-style-policy",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "provider": "FJRG2007/enigma",
-  "description": "Ciphera code style conventions (formatting, naming, imports incl. namespace imports for wide module surfaces, comments, code-level anti-patterns; TypeScript-first, language-agnostic).",
-  "updated": "2026-07-31T21:32:28+02:00",
-  "cliVersion": "1.33.5",
-  "sha": "d6a86c28ad39ee502607a5ca8f6f361c8aa52b8fa946156165ec78c6139e495f"
+  "description": "Ciphera code style conventions (formatting, naming, imports incl. namespace imports for wide module surfaces, path-alias specifiers and no file extensions, comments, code-level anti-patterns; TypeScript-first, language-agnostic).",
+  "updated": "2026-08-02T19:59:01+02:00",
+  "cliVersion": "1.33.7",
+  "sha": "3beb0383a9cb0331ef8a579308a2517d24d57a8ba33751ad17d16d0a4f66e344"
 }

package/assets/skills/code-review-policy/SKILL.md

@@ -30,6 +30,7 @@ Before declaring a change complete, verify:
 4. No secrets, credentials, or sensitive data are included.
 5. Existing patterns, naming, and structure are followed (per core-engineering-policy).
 6. Tests exist and pass for the changed behavior (per testing-policy).
+7. The change covers the whole class the request implied, not only the example the user named (per core-engineering-policy's Generalization Rule) - or states which siblings were deliberately left and why.
 
 ---
 
@@ -65,4 +66,5 @@ A change should not be delivered if it:
 - Breaks or skips tests, or ships untested critical behavior.
 - Duplicates logic that already exists, or stores duplicated/derivable data without justification.
 - Mixes unrelated concerns in one change.
+- Fixes the reported instance while identical instances of the same defect stay untouched in the codebase.
 - Leaves the codebase less consistent than it found it.

package/assets/skills/code-review-policy/skill.json

@@ -1,9 +1,9 @@
 {
   "name": "code-review-policy",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "provider": "FJRG2007/enigma",
   "description": "Pre-delivery self-review gate, prioritized review dimensions, and change-quality criteria.",
-  "updated": "2026-06-01T00:45:28+02:00",
-  "cliVersion": "1.33.5",
-  "sha": "3d3bbe0602d5bbb4afe37648fe3c2fa39376b1bcbac5d8c441f01fad1e866ed0"
+  "updated": "2026-08-02T04:15:47+02:00",
+  "cliVersion": "1.33.7",
+  "sha": "b35f0bb4a29f2346d9a1b00a4bfee9557a9b6a44116d9e6e59abcd945466dbcb"
 }

package/assets/skills/core-engineering-policy/SKILL.md

@@ -22,6 +22,24 @@ description: Highest-authority engineering rules - priority hierarchy, modular a
 
 ---
 
+## Generalization Rule (Example -> Class)
+
+- A report, complaint, or request that names a concrete case is an EXAMPLE of a class, not the boundary of the task. "This label overflows", "this endpoint is unvalidated", "this action should be an icon", "this table has no empty state" all describe an invariant that is being violated in more than one place. Fixing only the named instance leaves its siblings broken and guarantees the same report returns, one site at a time.
+- Procedure, in this order:
+  1. Name the rule. Restate the example as a general invariant ("every X must Y") at the widest scope where it stays true. If it genuinely cannot be stated generally, the request really was a one-off - say so and move on.
+  2. Sweep. Enumerate every place the rule applies with deterministic commands (grep, AST or type search, route/component listings), never by recalling or sampling. The result is an inventory: when it spans many sites, run it through task-completion-policy's ledger instead of fixing whatever the first search happened to surface.
+  3. Fix the whole class in this same change. Verify each site, not only the one that was reported.
+  4. Encode the rule so it holds without you, routed by tier:
+     - Mechanically checkable from a file-local signature -> a lint, guardrail, or CI rule. Deterministic and costs no context.
+     - Semantic but domain-scoped -> the owning policy skill, so it loads only when that domain is in scope.
+     - Semantic and universal -> the project's own always-on memory file (its root CLAUDE.md / AGENTS.md). When the rule belongs in the enigma-managed global kernel instead, change it through enigma's own memory channel (the dashboard memory editor, which records the edit) - never hand-edit the deployed file. An unrecorded edit makes that file no longer enigma-written, and sync skips it from then on, silently opting the user out of every future kernel update.
+     - Never encode one rule in two tiers; the most deterministic tier that can express it wins.
+  5. Report the rule inferred, the sites fixed, and where the rule was encoded.
+- Stay on the single instance only when the user scoped it there ("only here", "just this one"), or when generalizing would require a destructive action or a decision that is genuinely the user's. Then say explicitly what was left unfixed and why - silently narrowing the scope is the failure this rule exists to prevent.
+- Bug sweeps search for the root cause, not the symptom (debugging-policy). The pre-delivery check that no sibling was left behind is in code-review-policy.
+
+---
+
 ## Skill Activation Discipline (Use the Harness)
 
 - This is a modular harness. Each domain has a dedicated skill; the agent MUST apply the matching skill whenever its domain is in scope, not just this core policy.
@@ -79,7 +97,7 @@ If rules conflict, apply this priority order:
 
 This core policy owns orchestration, architecture, and the global rules. Each concern below is owned by its own skill:
 
-- core-engineering-policy: highest-authority orchestration, priority hierarchy, language, output, modular architecture, reuse, security baseline, documentation. (this skill)
+- core-engineering-policy: highest-authority orchestration, priority hierarchy, the generalization rule (a named example is a class), language, output, modular architecture, reuse, security baseline, documentation. (this skill)
 - database-expert: schema design, normalization/anti-duplication, query and index optimization, scalability, RGPD/GDPR encryption, migrations.
 - validation-policy: strict frontend + backend schema validation (Zod), schema consistency, client-facing error handling.
 - frontend-policy: frontend structure, reusable components, abstraction threshold, client-side caching, optimistic UI and rollback.

package/assets/skills/core-engineering-policy/skill.json

@@ -1,9 +1,9 @@
 {
   "name": "core-engineering-policy",
-  "version": "1.12.0",
+  "version": "1.13.0",
   "provider": "FJRG2007/enigma",
-  "description": "Core engineering execution policy and harness orchestration (highest-authority rules).",
-  "updated": "2026-07-30T19:29:19+02:00",
-  "cliVersion": "1.33.5",
-  "sha": "6a881d8589926fa7f48058314fd26d7042fd2ac82f1c87a6c11ffb54d1fda22b"
+  "description": "Core engineering execution policy and harness orchestration (highest-authority rules), including the generalization rule that treats a named example as a class to sweep and fix.",
+  "updated": "2026-08-02T04:28:51+02:00",
+  "cliVersion": "1.33.7",
+  "sha": "95091678d4e72e3a9b1ef3ad0514e503a2a631f0d134bf772b4a1b3c66881995"
 }

package/assets/skills/database-expert/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: database-expert
-description: Senior database architecture - engine selection (PostgreSQL is the default relational engine for anything deployed or multi-writer; SQLite only for local-first, embedded, single-writer stores), ORM selection (TypeScript/JavaScript/Node/Bun projects use Prisma over PostgreSQL unless the user or the requirements name another ORM), schema design, normalization and anti-duplication, query/index optimization, scalability (partitioning, sharding, replication), and RGPD/GDPR encryption of sensitive data. Use when designing, modifying, migrating, querying, or reviewing any database, schema, SQL, ORM model, or persistence layer, and when choosing the datastore for a new project's stack.
+description: Senior database architecture - engine selection (PostgreSQL is the default relational engine for anything deployed or multi-writer; SQLite only for local-first, embedded, single-writer stores), ORM selection (TypeScript/JavaScript/Node/Bun projects use Prisma over PostgreSQL unless the user or the requirements name another ORM), schema design, normalization and anti-duplication, query/index optimization, query cost and latency discipline (bounded reads, filtering and paginating in the database rather than in application code, round-trip count, expensive COUNT(*) totals, precomputed aggregates, statement timeouts and pooling, EXPLAIN on realistic data), scalability (partitioning, sharding, replication), and RGPD/GDPR encryption of sensitive data. Use when designing, modifying, migrating, querying, or reviewing any database, schema, SQL, ORM model, or persistence layer, and when choosing the datastore for a new project's stack.
 ---
 
 # Database Expert Policy (Senior Data Architecture Standards)
@@ -135,6 +135,21 @@ Any denormalized or duplicated value MUST have:
 - Validate every non-trivial query with EXPLAIN / EXPLAIN ANALYZE and confirm index usage before shipping.
 - Use parameterized/prepared statements exclusively - never build SQL by string concatenation.
 
+### Cost, Latency & Round Trips (Know What The Query Costs)
+
+Every query has a price - rows examined, IO, CPU, connection time, and on a managed database an actual bill. Write it knowing the number, not hoping it is small. "It was fast locally" is not a measurement: a seq scan over 200 development rows and over 20 million production rows look identical from the app.
+
+- **Every query is bounded.** A read that can return an unbounded set carries an explicit `LIMIT` (and the pagination that goes with it). A list endpoint with no cap is an outage waiting for the row count to grow.
+- **Filter, sort, aggregate and paginate in the DATABASE.** Fetching a table to slice, sort, count or sum it in application code moves the whole result over the wire and throws most of it away - and no index can help once the rows have left the engine.
+- **Count the round trips, not just the queries.** A loop issuing one query per item pays the network latency every iteration: replace it with one set-based statement (a single `IN`, a join, or the ORM's `include`/`select` for the relation). Two round trips at 30 ms are cheaper than twenty perfect queries.
+- **Ask only for what you use.** Column lists over `SELECT *`, and on an ORM an explicit `select` - it is also what makes an index-only scan possible, and it keeps a `TEXT`/`JSONB` column you never read out of every row you fetch.
+- **Total counts are expensive.** `COUNT(*)` with the same filters as the page is a second full pass over the matched rows. Prefer "load more"/keyset paging with no total, an approximate count (`reltuples`, a cheap estimator) for a scale hint, or a maintained counter when the exact number is genuinely part of the product.
+- **Aggregations over large tables are precomputed, not recomputed per request.** A rollup table, a materialized view refreshed on a schedule, or an incrementally maintained counter - a dashboard that aggregates the whole history on every load will not survive its own success.
+- **Give every statement a timeout** (`statement_timeout` per role or per transaction) so one pathological query cannot pin a connection and cascade into pool exhaustion. Pair it with a pool sized to the database's real connection ceiling, through a pooler in serverless (a function per request otherwise opens a connection per request).
+- **Never hold a transaction open across an external call.** An HTTP request or a queue publish inside a transaction holds its locks for the remote service's latency, including its timeouts.
+- **Measure against realistic volume before shipping.** `EXPLAIN ANALYZE` on production-like data, and read the two numbers that matter: rows examined versus rows returned. A large ratio means the index does not match the predicate you actually wrote, whatever the plan calls itself.
+- **Set a budget for the hot path and check it.** Name the target (a simple read in single-digit milliseconds; a page load's queries in tens, not hundreds), keep the query count per request visible in logs or traces, and treat a regression as a defect. Caching an expensive read is the last step, not the fix for a query that was never designed (backend-policy owns the cache layer and its invalidation).
+
 ---
 
 ## Scalability (Design for Large Scale by Default)
@@ -233,6 +248,9 @@ Any denormalized or duplicated value MUST have:
 ## Anti-Patterns (Never Do)
 
 - Using auto-increment / serial / IDENTITY integer primary keys, or exposing sequential numeric IDs instead of UUIDs.
+- Shipping a query whose cost was never measured on realistic data, or an unbounded read with no `LIMIT`.
+- Fetching rows to filter, sort, count or paginate them in application code.
+- Querying inside a loop when one set-based statement would do.
 - Duplicating data without a documented sync strategy and justification.
 - Storing easily computable values that should be derived at read time.
 - SELECT * on hot paths or fetching columns that are not used.

package/assets/skills/database-expert/skill.json

@@ -1,9 +1,9 @@
 {
   "name": "database-expert",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "provider": "FJRG2007/enigma",
   "description": "Senior database architecture policy: engine selection (PostgreSQL by default, SQLite only for local-first/embedded stores), ORM selection (Prisma in TypeScript/JavaScript), query optimization, anti-duplication/normalization, scalability, and RGPD/GDPR encryption.",
-  "updated": "2026-08-01T15:51:38+02:00",
-  "cliVersion": "1.33.5",
-  "sha": "4b7569446786c5bdbb71b2e9102aee0d8dd391b5e3e461d6fb1f05294d446ad9"
+  "updated": "2026-08-02T19:59:01+02:00",
+  "cliVersion": "1.33.7",
+  "sha": "f4ccf51286027c97c8402f3bac6c894e05a84cba2de014463cb3a83be17537d4"
 }

package/assets/skills/debugging-policy/SKILL.md

@@ -29,7 +29,7 @@ description: Reproduce-isolate-fix debugging methodology with root-cause discipl
 5. Confirm: prove the hypothesis (the failing case maps to the identified cause) before fixing.
 6. Fix: address the underlying cause at the right layer.
 7. Verify: add a regression test that fails before the fix and passes after (per testing-policy), then run the relevant suite.
-8. Review: assess whether the same class of bug exists elsewhere.
+8. Generalize: the reported failure is one instance of a class. Search deterministically for every other occurrence of the same root cause, fix them in this same change, and encode the invariant where it can be checked without you (core-engineering-policy's Generalization Rule).
 
 ---
 
@@ -49,6 +49,7 @@ description: Reproduce-isolate-fix debugging methodology with root-cause discipl
 - Distinguish the trigger (what surfaced it) from the cause (what is actually wrong).
 - A workaround is acceptable only as an explicit, temporary measure with the real cause documented.
 - When the cause spans multiple components, fix it where the invariant is actually owned.
+- The reported symptom is a sample, not the population. Once the cause is known, find its other victims by searching for the CAUSE (the wrong call, the missing guard, the unchecked shape), not for the symptom the user happened to notice.
 
 ---
 

package/assets/skills/debugging-policy/skill.json

@@ -1,9 +1,9 @@
 {
   "name": "debugging-policy",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "provider": "FJRG2007/enigma",
   "description": "Reproduce-isolate-fix debugging methodology with root-cause discipline and regression verification.",
-  "updated": "2026-06-01T00:45:28+02:00",
-  "cliVersion": "1.33.5",
-  "sha": "14b0064c8b33a0dc85e51464b05005cf5801c756b1101789a6924b9548420f6b"
+  "updated": "2026-08-02T04:15:47+02:00",
+  "cliVersion": "1.33.7",
+  "sha": "968876bcac9ce6e5a20be05c89ac97191b112c9e08679a8dc506d150c375fec4"
 }

package/assets/skills/dependency-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Dependency and supply-chain security: lockfiles and reproducible installs, version pinning, vulnerability auditing, vetting/minimizing packages, vendoring, and SBOM/provenance.",
   "updated": "2026-06-01T00:45:28+02:00",
-  "cliVersion": "1.33.5",
+  "cliVersion": "1.33.7",
   "sha": "6375d835c2aef2c9bd31ce116444dc3d796f510f9970a213aa3ac4696d7e21b9"
 }

package/assets/skills/email-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Transactional email: React Email templates instead of hand-written HTML tables, server-side rendering, one send module behind the provider SDK, plain-text alternatives, idempotent background sending, link safety, and deliverability (SPF/DKIM/DMARC, bounce suppression, unsubscribe).",
   "updated": "2026-07-30T19:29:19+02:00",
-  "cliVersion": "1.33.5",
+  "cliVersion": "1.33.7",
   "sha": "c9724fdbcdbeab99573be3fd44d4cdd97c2a394d99f3c4395f118f17356b00ed"
 }

package/assets/skills/frontend-design/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Guidance for distinctive, intentional visual design when building new UI or reshaping an existing one.",
   "updated": "2026-07-29T01:18:36+02:00",
-  "cliVersion": "1.33.5",
+  "cliVersion": "1.33.7",
   "sha": "9e30ee7d8a1a1e8c6e7f4e043857cd01841c68a427752e45bc0cad9ec5cfa279"
 }

package/assets/skills/frontend-policy/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: frontend-policy
-description: Frontend architecture - reusable components, abstraction thresholds, state management, no-op detection (skip any operation whose result equals the current state - form saves, toggles, filters, reorders - not just saves; dirty means the values DIFFER from the loaded snapshot, not that the user touched the field, so a value edited and put back leaves Save disabled), client-side caching (localStorage/sessionStorage to avoid redundant server calls and survive rate limits), instant first paint (render the shell immediately, load data async via the API, show skeletons - never block render on data), perceived performance and responsiveness (instant interaction feedback, prefetch on intent, debounce/throttle, cancel stale requests, avoid request waterfalls, lazy-load heavy widgets), large-list rendering (virtualized infinite scroll as the preferred default with pagination as the deliberate exception when the design or the user calls for it, skeletons, progressive/parallel loading, short-TTL caching), optimistic UI with rollback, visual restraint (never a card inside a card, borders only where they carry information, spacing and background tone before chrome), icon actions (repeated row/card actions like copy, edit, rename, remove, download, refresh are icon-only buttons carrying aria-label plus title, never a text label), navigation that is iconified and grouped into labelled sections once it outgrows a flat list, a Cmd/Ctrl+K command palette with fuse.js fuzzy search over the loaded data once the app has enough destinations and records to hunt through, data views that ship their own affordances by default (a log, expense, transaction or history table is not done when the rows render - it needs the search, the filters its column kinds imply, a date range, sort, filter state kept in the URL, and an export of the filtered set), every reference to an entity being a way into it (a name, id, project or path in a row links to that record, reveals it in a hover card, or at minimum copies and filters by it - never inert text, with machine codes given human labels and raw payloads never dumped into a cell), responsive/adaptive layout (fluid units, breakpoints, no overlap or horizontal overflow, viewport meta, touch targets), form fields that declare their keyboard and casing (autocapitalize/autocomplete/inputmode/spellcheck per field kind, set once in the shared Input, normalized on blur rather than on every keystroke, with an inline error on every field that has a rule), auth screens (breached-password feedback, strength meter, cookie consent answered before login/register), AI chat/assistant/agent interfaces (use Vercel's AI Elements registry for message threads, streaming, reasoning and tool-call panels, prompt inputs - never hand-roll chat UI in React), and periodic React code-health audits (react-doctor). Use when building or changing UI components, client state, forms/save flows, data fetching/caching, lists that show lots of data, a log/activity/expenses/transactions/history table, loading states, dashboards/panels, layout/responsiveness, making the UI feel fast, building a chat/AI/agent/LLM interface, or any frontend structure.
+description: Frontend architecture - reusable components, abstraction thresholds, state management, no-op detection (skip any operation whose result equals the current state - form saves, toggles, filters, reorders - not just saves; dirty means the values DIFFER from the loaded snapshot, not that the user touched the field, so a value edited and put back leaves Save disabled), client-side caching (localStorage/sessionStorage to avoid redundant server calls and survive rate limits), instant first paint (render the shell immediately, load data async via the API, show skeletons - never block render on data), perceived performance and responsiveness (instant interaction feedback, prefetch on intent, debounce/throttle, cancel stale requests, avoid request waterfalls, lazy-load heavy widgets), large-list rendering (virtualized infinite scroll as the preferred default with pagination as the deliberate exception when the design or the user calls for it, skeletons, progressive/parallel loading, short-TTL caching), optimistic UI with rollback, visual restraint (never a card inside a card, borders only where they carry information, spacing and background tone before chrome), icon actions (repeated row/card actions like copy, edit, rename, remove, download, refresh are icon-only buttons carrying aria-label plus title, never a text label), navigation that is iconified and grouped into labelled sections once it outgrows a flat list, a Cmd/Ctrl+K command palette with fuse.js fuzzy search over the loaded data once the app has enough destinations and records to hunt through, data views that ship their own affordances by default (a log, expense, transaction or history table is not done when the rows render - it needs the search, the filters its column kinds imply, a date range, sort, filter state kept in the URL, and an export of the filtered set), every reference to an entity being a way into it (a name, id, project or path in a row links to that record, reveals it in a hover card, or at minimum copies and filters by it - never inert text, with machine codes given human labels and raw payloads never dumped into a cell), responsive/adaptive layout (fluid units, breakpoints, no overlap or horizontal overflow, viewport meta, touch targets, and items with a fixed intrinsic size - icons, avatars, badges - pinned with flex-shrink so long text squashes the text and never the glyph), form fields that declare their keyboard and casing (autocapitalize/autocomplete/inputmode/spellcheck per field kind, set once in the shared Input, normalized on blur rather than on every keystroke, with an inline error on every field that has a rule), auth screens (breached-password feedback, strength meter, cookie consent answered before login/register, and a fixed-length 2FA or emailed code that verifies itself when the last digit lands, once per distinct value and never re-firing into the attempt cap), AI chat/assistant/agent interfaces (use Vercel's AI Elements registry for message threads, streaming, reasoning and tool-call panels, prompt inputs - never hand-roll chat UI in React), and periodic React code-health audits (react-doctor). Use when building or changing UI components, client state, forms/save flows, data fetching/caching, lists that show lots of data, a log/activity/expenses/transactions/history table, loading states, dashboards/panels, layout/responsiveness, making the UI feel fast, building a chat/AI/agent/LLM interface, or any frontend structure.
 ---
 
 # Frontend Architecture Policy
@@ -200,6 +200,8 @@ Every string is variable-length; the value on screen during development is one s
 - Content whose width changes as it updates (counters, timers, prices) reflows its row on every tick. Use tabular numerals (`font-variant-numeric: tabular-nums`) or reserve the space.
 - Absolutely positioned or overlaid text is where collisions happen, because it is outside normal flow and cannot push anything away. Constrain it with a `max-width` and check it at the narrowest breakpoint.
 - Do not "fix" an overflow by clipping the parent. `overflow: hidden` on the container hides the symptom, and clips focus rings, tooltips and menus with it. Fix the sizing that caused it.
+- **The other half of the same rule: some flex items must NOT shrink.** `flex-shrink: 1` is the default, so in a row of icon plus text the browser takes width from BOTH when the text runs long - and the icon, having no content to reflow, is simply squashed. The result is the 14px chevron or external-link glyph rendered 4px wide next to a long product name, which nobody notices while the sample text is short. Anything with a fixed intrinsic size - icon, avatar, badge, status dot, spinner, checkbox, the action button at the end of a row - takes `flex-shrink: 0` (Tailwind `shrink-0`, or `flex: none`). The TEXT is the element that gives up width, and it truncates or wraps as decided above.
+- An explicit `width`/`height` on the icon does not protect it: those set the base size, not the minimum, and flex shrinks below it. An `<svg>` scales with its viewBox rather than clipping, which is exactly why it deforms silently instead of overflowing visibly. Set the guard where the icons are defined - one `svg { flex-shrink: 0 }` in the base stylesheet, or `shrink-0` inside the shared Icon component - rather than remembering it per row.
 - Verify with worst-case content before calling it done: render the longest value you expect and confirm nothing spills out of its box or over a neighbour. The mechanical check is `element.scrollWidth <= element.clientWidth` for the box, and comparing bounding rectangles against the container for the collision - cheaper and more reliable than eyeballing it at one window size.
 
 ---
@@ -300,6 +302,13 @@ Auth is the first screen a user meets and the one most often shipped half-built.
 - After sign-up the user lands inside the app, already signed in. If the account still needs email verification, say so in the app with a way to resend, and block only the actions that need it.
 - Surface throttling honestly. On a `429`, show how long the wait is (from `Retry-After`), keep the button disabled with a countdown, and never swallow the response into a generic "something went wrong".
 - A one-time-code field is one input with `autocomplete="one-time-code"`, `inputmode="numeric"`, paste of the whole code, and no clearing of what the user typed on a wrong attempt. Say how many attempts are left only if the server chose to reveal it.
+- **When the code has a known fixed length, the form submits itself the moment the last character lands.** A 6-digit 2FA or emailed code is complete the instant the sixth digit arrives - typed, pasted, or filled by the OS from an SMS or the authenticator - and asking for a click after that is a step the UI can take on the user's behalf. Take the length from the ONE constant the generator uses, not from a `6` hardcoded in the component, so a change to 8 does not silently break the trigger.
+- Auto-submit needs three guards, and without them it burns the user's attempt budget:
+  - **Once per distinct complete value.** Remember the value already sent and submit only when the current one is complete AND different. A re-render, a blur, a paste that lands as two events, or an autofill that rewrites the field must not each fire a request.
+  - **Do not re-fire after a failure until the user edits the code.** A wrong code that resubmits on every keystroke can exhaust a five-attempt cap before the user finishes correcting it. Mark the field invalid, keep what they typed, and wait for a change.
+  - **Never auto-retry a `429` or a network error.** Show the wait from `Retry-After` with a countdown, and let the user trigger the next attempt (server-side limits are security-policy's).
+- Keep the submit button, disabled while the code is incomplete. It is the affordance for anyone who does not see the field complete itself, the retry control after a failure, and the fallback when autofill misbehaves. Announce the transition in an `aria-live="polite"` region ("Verifying code...", then the result), because a form that submits with no click gives a screen-reader user nothing to go on.
+- Do not auto-submit when the length is not fixed: a backup or recovery code of variable length, or one the user may paste with separators, has no reliable "complete" moment - normalize the value (strip spaces and dashes) and let the button be the trigger.
 - Never keep a password, token, or code in `localStorage`, a query string, or an analytics payload. A reset token in the URL stays out of logs and out of any third-party script on the page.
 
 ---
@@ -376,6 +385,9 @@ Render the page shell immediately; never block the first paint on data. A view t
 
 - Load data asynchronously via the API AFTER the shell renders (client fetch on mount, or streaming/Suspense on server components) - do not gate the component's first render on the awaited data. The layout is static and free to render now; only the contents wait.
 - Show skeleton placeholders shaped like the real content in every region still loading (cards, rows, charts, stat tiles), not one full-page spinner. Reserve the final dimensions so nothing shifts when data lands (no layout shift / CLS).
+- **The skeleton covers the data that is missing, and nothing else.** Most of a screen does not depend on the response and must render as itself immediately: the nav, the page title, section headings, column headers, tab bars, filter and search controls, buttons, the card frames, and any value already in hand - a name from the route, a count from the cache, anything the parent already loaded. If the only thing waiting is the table rows, only the rows are skeletons and the rest of the table is real. Blanking a region you could have rendered is the same defect as blanking the page, just smaller.
+- The test is per element, not per screen: "does this need the response to be drawn?" If no, draw it now. A loader is what you show when there is genuinely nothing to show yet, which is rarer than it looks.
+- Regions do not wait for each other. Independent widgets each own their request and resolve on their own, so one slow endpoint never holds back the four that already answered.
 - This applies to ANY data-driven view - dashboards, panels, detail pages, settings screens - not only long lists. A dashboard of independent widgets renders its grid instantly and lets each widget resolve on its own (see Progressive / parallel rendering below).
 - For an instant first paint with REAL content, read the client cache first (per Client-Side Caching) and render it immediately, then revalidate in the background (stale-while-revalidate); fall back to skeletons only on a cold cache.
 - Keep empty and error states per region, so a single failed or slow widget shows its own inline state without blanking the whole page.

package/assets/skills/frontend-policy/skill.json

@@ -1,9 +1,9 @@
 {
   "name": "frontend-policy",
-  "version": "1.24.0",
+  "version": "1.25.0",
   "provider": "FJRG2007/enigma",
   "description": "Frontend architecture: reusable components, abstraction thresholds, state management, no-op detection (skip any operation whose result equals current state, not just form saves; dirty means different from the loaded snapshot, not touched), instant first paint (render the shell, load data async, skeletons), perceived performance (prefetch on intent, debounce/throttle, cancel stale requests, avoid waterfalls, lazy widgets), large-list rendering (infinite scroll is the preferred default, pagination the deliberate exception when the design or the user calls for it, virtualization, skeletons, progressive loading), data views that ship their own affordances by default (a log, expense, transaction or history table is not done when the rows render: fuse.js search, the filters its column kinds imply, a date range, sort, filter state in the URL, and an export of the filtered set), every reference to an entity being a way into it (a name, id, project or path in a row links to that record, reveals it in a hover card, or at minimum copies and filters by it, never inert text; machine codes get human labels and raw payloads are never dumped into a cell), optimistic UI with rollback, visual restraint (one card level, spacing before borders, one elevation scale), icon actions (repeated row/card actions are icon-only buttons with aria-label plus title, not text labels), responsive/adaptive layout (fluid units, breakpoints, no overlap/overflow, viewport meta, touch targets), form fields that declare their keyboard and casing (autocapitalize/autocomplete/inputmode per field kind, set once in the shared Input, normalized on blur), variable-length text (min-width:0 in flex/grid, wrap vs truncate, long unbroken strings, worst-case content checks), auth screens (breached-password feedback, strength meter, cookie consent before login/register), and AI chat/agent interfaces via Vercel's AI Elements registry instead of hand-rolled message threads.",
-  "updated": "2026-08-02T02:25:38+02:00",
-  "cliVersion": "1.33.5",
-  "sha": "912800b1a804b9f1bdd1c140e6501a88e15d2c05bfabec4f635a8121769f47f6"
+  "updated": "2026-08-02T19:59:01+02:00",
+  "cliVersion": "1.33.7",
+  "sha": "6c04c2bf01f5d46d75f032fa93f5ec92244f327fb6f266de46ed448ce50a0a99"
 }

package/assets/skills/git-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Git & contribution policy (senior engineering standards).",
   "updated": "2026-07-16T22:44:02+02:00",
-  "cliVersion": "1.33.5",
+  "cliVersion": "1.33.7",
   "sha": "e6dfbc33884000d9d25841bd9c5a84d6558ffd374882cb7b34451eb2cebc2161"
 }

package/assets/skills/logo-sourcing-policy/skill.json

@@ -7,6 +7,6 @@
     "logoColorPolicy"
   ],
   "updated": "2026-07-17T00:17:02+02:00",
-  "cliVersion": "1.33.5",
+  "cliVersion": "1.33.7",
   "sha": "09cdbefd98625b02a7d03685e5deed128238ff8454a83fe22279610fe3ef8ddf"
 }

package/assets/skills/security-policy/SKILL.md

@@ -83,6 +83,7 @@ The same screens that check the breach corpus reject a password built out of the
 - Count FAILURES, not requests, so a person typing their password wrong twice is not treated like an attack while a scripted run is stopped early.
 - Back off exponentially and answer `429` with `Retry-After`. Keep every counter server-side; a client-held attempt count is decoration.
 - Cap second factors hard: a handful of attempts per code, then invalidate the code and require a new one. OTP codes are single-use with a short TTL, and backup codes are single-use and stored hashed.
+- That cap is what a self-submitting code field spends. A UI that verifies as soon as the sixth digit lands (frontend-policy's rule, and the right default) turns each correction into a real attempt, so the client submits once per distinct complete value and stops after a failure until the user edits it. The server still assumes it will not: the cap, the single-use rule and the TTL are enforced there, and an identical value replayed against an already-failed code is answered like any other attempt without extending its life.
 - After a threshold of failures, lock the account temporarily and tell the owner by email. An unbounded lock is a denial-of-service someone else can trigger, so prefer a timed lock with a clear unlock path.
 - Derive the client IP from the trusted proxy chain, never from a raw client-supplied header. `X-Forwarded-For` is attacker-controlled unless your edge rewrites it.
 - The limiter must not become an oracle: an unknown account and a known one get the same response shape, status, and timing. Always run the password hash, even when the user does not exist, so the timing does not answer the question the error message refused to.

package/assets/skills/security-policy/skill.json

@@ -1,9 +1,9 @@
 {
   "name": "security-policy",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "provider": "FJRG2007/enigma",
   "description": "Application and AI-agent security: secrets, authn/authz (least privilege), credential flows with breach-checked passwords (Have I Been Pwned), OWASP Top 10, transport/crypto baseline, cookies and consent, secure logging, and agent/MCP/tool-use safety.",
-  "updated": "2026-08-01T17:44:16+02:00",
-  "cliVersion": "1.33.5",
-  "sha": "c9eac7999b326e4564816b10f3f681b9f6b2a88595d56244909757fb4bbc3c7f"
+  "updated": "2026-08-02T19:59:01+02:00",
+  "cliVersion": "1.33.7",
+  "sha": "3201b6d41437626eb7bf45648c0d7f8c419dc4de87fbd9d4ca83c5ae3b6b6edf"
 }

package/assets/skills/skill-creator/assets/eval_review.html

@@ -9,6 +9,8 @@
   <link href="https://fonts.googleapis.com/css2?family=Poppins:wght@500;600&family=Lora:wght@400;500&display=swap" rel="stylesheet">
   <style>
     * { box-sizing: border-box; margin: 0; padding: 0; }
+    /* An icon never gives up its size to the text beside it: a flex item shrinks by default. */
+    svg { flex-shrink: 0; }
     body { font-family: 'Lora', Georgia, serif; background: #faf9f5; padding: 2rem; color: #141413; }
     h1 { font-family: 'Poppins', sans-serif; margin-bottom: 0.5rem; font-size: 1.5rem; }
     .description { color: #b0aea5; margin-bottom: 1.5rem; font-style: italic; max-width: 900px; }

package/assets/skills/skill-creator/skill.json

@@ -3,7 +3,7 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Create new skills, modify and improve existing skills, and measure skill performance with evals and benchmarks.",
-  "updated": "2026-07-29T01:18:36+02:00",
-  "cliVersion": "1.33.5",
-  "sha": "13d24c217bdb6fe83fe16835d8f5c3d397a9f3338f16876c61ef96e97f34c90a"
+  "updated": "2026-08-02T19:58:42+02:00",
+  "cliVersion": "1.33.7",
+  "sha": "34fc27f140ad425eff742d319b3179f861f70edc966a2cd96d1cd6b91717b766"
 }

package/assets/skills/task-completion-policy/SKILL.md

@@ -9,6 +9,7 @@ description: Exhaustive completion discipline for long, complex, or multi-item t
 
 - Apply to any task with more than a handful of work units: 1:1 ports, language/framework migrations, repo-wide refactors, "implement all X", multi-feature builds, large integrations.
 - Also apply when a single user message bundles multiple distinct asks or questions, even just two, three, or four of them: enumerate every ask up front and cover all of them. Answering the first and silently dropping, postponing, or leaving the rest "pending" is exactly the failure this policy exists to prevent.
+- Also apply when a one-line request generalizes. Once an example has been turned into a rule (core-engineering-policy's Generalization Rule), the sweep for every site that rule touches IS an inventory: enumerate it here and track it in the ledger, instead of fixing whatever the first search happened to surface.
 - Owns inventory, coverage tracking, and completion claims. Subtask decomposition lives in core-engineering-policy; per-change review lives in code-review-policy; test strategy lives in testing-policy.
 
 ---

package/assets/skills/task-completion-policy/skill.json

@@ -1,9 +1,9 @@
 {
   "name": "task-completion-policy",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "provider": "FJRG2007/enigma",
   "description": "Exhaustive completion discipline for long/multi-item tasks - inventory, coverage ledger, verified done.",
-  "updated": "2026-07-30T20:10:24+02:00",
-  "cliVersion": "1.33.5",
-  "sha": "2f82288d83dca3676d6bc49955c89477cc298f77fa56b4e414cd95ff858fa261"
+  "updated": "2026-08-02T04:15:47+02:00",
+  "cliVersion": "1.33.7",
+  "sha": "4c2197954135dd3375f32d839238b82a95c0e93e976ddf5a9cbc4a0cf0146e97"
 }

package/assets/skills/technical-writing-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Concise, realistic technical copy - UI microcopy, descriptions, hints, empty/error states, and README/doc prose that informs without over-explaining or restating the obvious, and never uses a typographic dash.",
   "updated": "2026-07-28T20:30:23+02:00",
-  "cliVersion": "1.33.5",
+  "cliVersion": "1.33.7",
   "sha": "a4b792103eb1f9dad93b9d70ea79dc18fe9cbbc318facf5adb47ae5907d842f9"
 }

package/assets/skills/testing-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Test strategy, coverage gates, deterministic tests, mocking discipline, regression-first bug fixing, and test-suite organization (layout by type/domain, mirrored paths, file naming, fixture/helper placement).",
   "updated": "2026-06-16T17:11:49+02:00",
-  "cliVersion": "1.33.5",
+  "cliVersion": "1.33.7",
   "sha": "3bdf591057b760f674fb2b1425f63acb426cda2c4f042e1a74c5a5d3807df664"
 }

package/assets/skills/validation-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Strict frontend + backend schema validation, normalization before validation (shared normalizers: trim, lowercase email, capitalize names, canonicalize links and handles), schema consistency, and safe client-facing error handling.",
   "updated": "2026-08-01T17:44:16+02:00",
-  "cliVersion": "1.33.5",
+  "cliVersion": "1.33.7",
   "sha": "225e1e26f4a49fac70714b1bebc104ea42143203cc8fcc9e3330b29f05b6e025"
 }

package/bin/checksums.json

@@ -1,6 +1,6 @@
 {
-  "enigma-darwin-arm64": "7bd5a6698b8589aa62af006fb398db2ddd00882931a4d1c3087ba8bf173e309c",
-  "enigma-linux-arm64": "e78375031f85cf0d17ad48fc43d4c8c7f7cc3ed3f4cc62457e715fe487c61a90",
-  "enigma-linux-x64": "97514f08fc4e7f5221f39d45b53c1080dfe6c55d8496c3e23b0d4e1144a55d75",
-  "enigma-win32-x64.exe": "1bf798196b5444223c38981166e6930bde75c1f50d7c0041dee633826c01fa76"
+  "enigma-darwin-arm64": "527b4fd317dd95669889d9e474a1f0dbd926f3dfe69865eaff8f6254fe971256",
+  "enigma-linux-arm64": "ed239f141d8628719494ca4563db886a880dbdf3f0f2456bfe0efe77c3918dc6",
+  "enigma-linux-x64": "24950b825b7427d9651cf42c85ed29667fbf8309135c7b5bc1fe4811c5f91f99",
+  "enigma-win32-x64.exe": "332cc818638fdb0fb94a651af2cfe49da3b1bde40bd151f42624108f4fb374e2"
 }

package/dist/guardrails.js

@@ -4,7 +4,7 @@
 import { homedir } from "os";
 import { fileURLToPath } from "url";
 import { execFileSync } from "child_process";
-import { dirname, join, resolve } from "path";
+import { dirname, join, resolve, sep } from "path";
 import { readFileSync, writeFileSync, statSync, existsSync } from "fs";
 var COMMENT_LINE = /^\s*(\/\/|#|\*|--|<!--|\{?\/\*)/;
 var BUILTIN_RULES = [
@@ -419,8 +419,13 @@ var BUILTIN_RULES = [
     // precision (a multi-line block is not matched: precision > recall).
     pattern: "\\bif\\s*\\(\\s*(isLoading|isPending|isFetching|loading|pending)\\s*\\)\\s*return\\s+(null\\b|<\\s*\\w*(Spinner|Loader|Loading|CircularProgress)\\b)",
     absent: "skeleton|animate-pulse|shimmer|Suspense|ContentLoader|content-loader|<\\s*Placeholder",
-    message: "Component returns nothing (or only a spinner) while data loads, so the page stays blank until the fetch resolves. Render the shell/layout on first paint and show skeleton placeholders shaped like the final content (reserve their space to avoid layout shift) while data loads async via the API (frontend-policy).",
-    severity: "warn",
+    message: "Component returns nothing (or only a spinner) while data loads, so the whole page stays blank until the fetch resolves. Render the shell on first paint - nav, headings, card frames, table chrome, filters, and any value you already hold - and skeleton ONLY the region whose data is missing, shaped like the real content with its space reserved so nothing shifts when it lands. A region that does not depend on this request is not loading and must render now (frontend-policy).",
+    // BLOCK, changed from warn: this is the rule for the defect users keep reporting (a page
+    // that renders nothing until its data arrives), and as a warn it exited 0 - printed to
+    // stdout and never fed back to the model, which is precisely why the model kept writing
+    // it. Same reasoning as ui-no-em-dash. The pattern is a terse one-line guard cleared by
+    // any placeholder signal in the file, so there is no legacy backlog to flag.
+    severity: "block",
     skill: "frontend-policy"
   },
   {
@@ -628,6 +633,21 @@ var BUILTIN_RULES = [
   // precise signature (a dirty/hasChanges flag assigned a literal true) returned 0 real
   // hits and 2 false ones, a CLI tracking whether it had rewritten a config file. A rule
   // here would fire on correct code, so it stays guidance in frontend-policy.
+  // NOTE: there is deliberately no rule for "a server component awaits its data before it
+  // returns markup". It is the other half of the blank-first-paint complaint, but the shape
+  // (`export default async function Page()` with an awaited value and no Suspense boundary) is
+  // ALSO how a correct statically-generated page is written - the corpus's one match is a docs
+  // page awaiting its MDX at build time, where there is no runtime wait to hide. Whether the
+  // await costs the user anything depends on where the page renders and whether the data is
+  // static, and none of that is in the file. It stays in frontend-policy's Instant First Paint.
+  // NOTE: there is deliberately no rule for "a fixed-length one-time code submits itself when
+  // the last digit lands". The selector would be precise (`autocomplete="one-time-code"`, the
+  // same marker sec-password-breach-check keys on), but the DEFECT has no file-local form: the
+  // submit normally lives in a parent, a form library or a mutation hook, so its absence from
+  // the field's file proves nothing, and the three guards that make auto-submit safe (once per
+  // distinct complete value, no re-fire after a failure, no auto-retry on 429) are behaviour a
+  // regex cannot read at all. It stays in frontend-policy's auth section, with the attempt-cap
+  // half in security-policy.
   // NOTE: there is deliberately no "card inside a card" or "border with no information"
   // rule, even though both are named in frontend-policy. They are RELATIONAL defects: a
   // container is redundant only relative to the ancestor it sits in and the spacing around
@@ -697,6 +717,170 @@ var BUILTIN_RULES = [
     severity: "block",
     skill: "ciphera-style-policy"
   },
+  {
+    id: "fe-icon-shrink",
+    label: "An icon does not shrink to make room for text",
+    files: ["*.css", "*.scss", "*.html", "*.htm", "*.astro", "*.vue", "*.svelte", "*.tsx", "*.jsx"],
+    excludeFiles: [
+      "*.test.*",
+      "*.spec.*",
+      "**/tests/**",
+      "**/__tests__/**",
+      "**/stories/**",
+      "*.stories.*",
+      "*.min.css",
+      "**/dist/**",
+      "**/build/**",
+      "**/node_modules/**",
+      "**/vendor/**",
+      "dist/**",
+      "build/**",
+      "node_modules/**",
+      "vendor/**"
+    ],
+    scope: "file",
+    // `flex-shrink: 1` is the default, so in a row of icon plus text the browser takes width
+    // from BOTH when the text runs long - and the icon, having no content to reflow, is simply
+    // squashed. An explicit width/height does not protect it (that is the base size, not the
+    // minimum) and an <svg> scales with its viewBox rather than clipping, so it deforms
+    // silently instead of overflowing visibly.
+    // Two gateable shapes, one per styling model. (a) A STYLESHEET rule sizing an svg/img on
+    // one line: the size bound (<= 64px) is what makes it an ICON rather than a picture -
+    // a hero image at 640px SHOULD shrink with the viewport, and pinning it would be the
+    // wrong fix. (b) A UTILITY-CLASS line carrying a flex container, an icon element and an
+    // icon size class together; the flex requirement is what keeps this off the rest of the
+    // markup, and it is why a multi-line JSX icon is out of reach by construction (the same
+    // accepted recall loss as fe-icon-action-button). Case-SENSITIVE so `[A-Z]\w*` means a
+    // component tag (<ExternalLink>, <Avatar>) and not every lowercase element.
+    pattern: "^(?!.*enigma:)(?:(?=.*\\bflex\\b)(?=.*<(?:svg|img|[A-Z][A-Za-z0-9]*)\\b).*\\b(?:h-\\d(?:\\.\\d)?[ \\t]+w-\\d(?:\\.\\d)?|w-\\d(?:\\.\\d)?[ \\t]+h-\\d(?:\\.\\d)?|size-\\d(?:\\.\\d)?)\\b|[^{}/]*\\b(?:svg|img)[ \\t]*(?:,[^{}]*)?\\{[^}]*\\bwidth:[ \\t]*(?:[1-9]|[1-5]\\d|6[0-4])px)",
+    flags: "",
+    // A file that already pins an icon anywhere is treated as having made the decision. This
+    // is deliberately leaky (one guarded rule clears the file) because the fix that scales is
+    // a single base rule - `svg { flex-shrink: 0 }` - not a repetition per selector, and a
+    // rule that kept firing after that fix would train the model to ignore it.
+    absent: "flex-shrink:\\s*0|\\bshrink-0\\b|\\bflex-none\\b|flex:\\s*(?:none|0 0)|enigma:allow-shrinking-icon",
+    message: "Icon sized but not pinned. `flex-shrink: 1` is the default, so when the text beside it runs long the browser takes width from the ICON too - and having no content to reflow, a 14px glyph ends up rendered 4px wide next to a long name. The explicit width/height does not prevent it: that is the base size, not the minimum, and an svg scales with its viewBox instead of clipping, so it deforms silently. Give anything with a fixed intrinsic size - icon, avatar, badge, status dot, spinner - `flex-shrink: 0` (Tailwind `shrink-0`), and let the TEXT be what truncates. Set it once where the icons are defined (`svg { flex-shrink: 0 }` in the base stylesheet, or inside the shared Icon component) rather than per row. Mark a deliberate exception with an `enigma:` note on the line or `enigma:allow-shrinking-icon` in the file (frontend-policy).",
+    severity: "block",
+    skill: "frontend-policy"
+  },
+  // TYPESCRIPT MODULE GRAPH. Three rules that keep a TS project's imports stable as it grows:
+  // the project declares an alias, deep climbs go through it, and no specifier carries a build
+  // artifact's extension. All three are decided against the project's tsconfig rather than the
+  // edited line, which is why each is a coded check (see the module-graph block below).
+  {
+    id: "ts-alias-paths",
+    label: "TypeScript project declares a path alias",
+    // The exact basename only: the split configs a bundler generates (tsconfig.node.json,
+    // tsconfig.app.json) exist to compile one config file and have no source tree to alias.
+    files: ["tsconfig.json"],
+    excludeFiles: [
+      "**/node_modules/**",
+      "**/dist/**",
+      "**/build/**",
+      "**/vendor/**",
+      "node_modules/**",
+      "dist/**",
+      "build/**",
+      "vendor/**"
+    ],
+    scope: "file",
+    fileCheck: "ts-alias-paths",
+    message: 'This TypeScript project declares no path alias. Add one - `"baseUrl": "."` plus `"paths": { "@/*": ["./src/*"] }` - and import through it (`@/services/user`) instead of counting directories. A relative chain encodes where the importing file happens to sit, so moving either file rewrites specifiers that had nothing to do with the change; an alias is stable under both. Bundlers, tsx and Bun resolve it from tsconfig with no extra config; for Jest add moduleNameMapper. If this config is not the project\'s source config, mark it with an `enigma:` note (ciphera-style-policy).',
+    severity: "block",
+    skill: "ciphera-style-policy"
+  },
+  {
+    id: "ts-alias-deep-relative",
+    label: "Deep relative import goes through the path alias",
+    files: ["*.ts", "*.tsx", "*.mts", "*.cts"],
+    // Tests are excluded on purpose: a runner that has not been told about the alias (Jest
+    // without moduleNameMapper) cannot resolve it, so the import that is right in src is not
+    // automatically right in a test file. Same two-form generated/vendored excludes as above.
+    excludeFiles: [
+      "*.test.*",
+      "*.spec.*",
+      "**/tests/**",
+      "**/__tests__/**",
+      "**/fixtures/**",
+      "*.d.ts",
+      "**/dist/**",
+      "**/build/**",
+      "**/_build/**",
+      "**/node_modules/**",
+      "**/vendor/**",
+      "dist/**",
+      "build/**",
+      "_build/**",
+      "node_modules/**",
+      "vendor/**"
+    ],
+    scope: "file",
+    // Fires only when the project HAS an alias covering the target: the climb on its own is
+    // correct code in a project with none, and a target outside the aliased root cannot be
+    // written any other way. Measured over the corpus: every project that declares an alias
+    // already uses it everywhere, so this is a scaffolding guard, not a backlog.
+    fileCheck: "ts-alias-deep-relative",
+    message: "Deep relative import in a project that declares a path alias. Write it through the alias instead: the chain of `../` names the directory the importing file sits in today, so moving either file breaks specifiers that had nothing to do with the change, and a reader has to count directories to see what is being imported. Keep `./sibling` and `../` for a file in the same or the parent folder - the alias is for anything further. Mark a deliberate exception with an `enigma:` note on the line (ciphera-style-policy).",
+    severity: "block",
+    skill: "ciphera-style-policy"
+  },
+  {
+    id: "ts-import-extension",
+    label: "No file extension in a module specifier",
+    files: ["*.ts", "*.tsx"],
+    // .mts/.cts are out of scope by construction: those extensions exist to pin a file to
+    // Node's dual-module resolution, where the specifier extension is mandatory.
+    excludeFiles: [
+      "*.d.ts",
+      "**/dist/**",
+      "**/build/**",
+      "**/_build/**",
+      "**/node_modules/**",
+      "**/vendor/**",
+      "dist/**",
+      "build/**",
+      "_build/**",
+      "node_modules/**",
+      "vendor/**"
+    ],
+    scope: "file",
+    // Only under bundler/preserve resolution, and only when no such file actually exists -
+    // see extensionImports for why both guards are what keep this at zero false positives.
+    fileCheck: "ts-import-extension",
+    message: 'File extension in a module specifier. Under `"moduleResolution": "bundler"` the resolver finds the source file on its own, so an extension only pins the import to a build artifact - `.js` names a file that does not exist in the source tree, and `.ts` needs allowImportingTsExtensions and breaks the moment the project emits. Drop it and let the resolver do the work. If this project has to emit for Node\'s own ESM resolution instead, that is a tsconfig decision (`"module": "nodenext"`), and there the extension is required - make it once in tsconfig rather than per import (backend-policy, ciphera-style-policy).',
+    severity: "block",
+    skill: "ciphera-style-policy"
+  },
+  {
+    id: "ts-legacy-module-resolution",
+    label: "Modern TypeScript module resolution and target",
+    files: ["tsconfig.json", "tsconfig.*.json"],
+    excludeFiles: [
+      "**/node_modules/**",
+      "**/dist/**",
+      "**/build/**",
+      "**/vendor/**",
+      "node_modules/**",
+      "dist/**",
+      "build/**",
+      "vendor/**"
+    ],
+    scope: "file",
+    // `node`/`node10` is TypeScript's own legacy resolver: it predates package.json "exports",
+    // so a modern dependency resolves to the wrong entry point or not at all. A pre-ES2017
+    // target is the same class of decision - it downlevels async/await itself. Both are
+    // single, unambiguous values, which is what makes this a pattern rule rather than a
+    // check; a project that genuinely needs ES5 output marks the line.
+    // THE TARGET BOUND IS DELIBERATELY LOWER THAN THE ADVICE. backend-policy asks for es2022,
+    // but `"target": "es2017"` is what create-next-app still ships and what several stock
+    // configs default to, and in a Next app SWC compiles the output anyway so the value
+    // barely matters - blocking the ecosystem's own template is how a rule teaches people to
+    // ignore it. The skill persuades toward es2022; the gate only stops what is unambiguous.
+    pattern: `^(?!.*enigma:).*(?:["']moduleResolution["']\\s*:\\s*["']node(?:10)?["']|["']target["']\\s*:\\s*["']es(?:3|5|6|2015|2016)["'])`,
+    message: 'Legacy TypeScript configuration. `"moduleResolution": "node"` is the pre-2022 resolver: it ignores a package\'s `exports` map, so a modern dependency resolves to the wrong entry point or not at all, and a pre-ES2017 target downlevels async/await itself. For a backend built by a bundler or run by tsx/Bun use `"module": "esnext"` with `"moduleResolution": "bundler"`; for one emitted by tsc for Node\'s own loader use `"module": "nodenext"` (and then specifiers DO carry `.js`). Pair either with `"target": "es2022"` and `"strict": true`. Mark a deliberate legacy target with an `enigma:` note on the line (backend-policy).',
+    severity: "block",
+    skill: "backend-policy"
+  },
   {
     id: "proc-windows-hide",
     label: "Spawned process must not pop a console window",
@@ -1011,7 +1195,10 @@ var PROJECT_CHECKS = {
   }
 };
 var FILE_CHECKS = {
-  "proc-windows-hide": (content) => missingWindowsHide(content)
+  "proc-windows-hide": (content) => missingWindowsHide(content),
+  "ts-import-extension": (content, file) => extensionImports(content, file),
+  "ts-alias-deep-relative": (content, file) => deepRelativeImports(content, file),
+  "ts-alias-paths": (content, file) => missingPathAlias(content, file)
 };
 var FIXERS = {
   "fe-name-input-capitalize": (line, file) => {
@@ -1082,6 +1269,92 @@ function missingWindowsHide(content) {
   }
   return out;
 }
+var SPECIFIER = /^[ \t]*(?:import|export)\b[^;]*?\bfrom\s*["']([^"']+)["']|^[ \t]*import\s*["']([^"']+)["']|\bimport\(\s*["']([^"']+)["']|\brequire\(\s*["']([^"']+)["']/gm;
+var MODULE_EXT = /\.(ts|tsx|mts|cts|js|jsx|mjs|cjs)$/i;
+var JS_EXT = /\.(js|jsx|mjs|cjs)$/i;
+var tsconfigCache = /* @__PURE__ */ new Map();
+function nearestTsconfig(file) {
+  let dir = dirname(resolve(file));
+  const seen = [];
+  for (let i = 0; i < 20; i++) {
+    const cached = tsconfigCache.get(dir);
+    if (cached !== void 0) {
+      for (const d of seen) tsconfigCache.set(d, cached);
+      return cached;
+    }
+    seen.push(dir);
+    const candidate = join(dir, "tsconfig.json");
+    if (existsSync(candidate)) {
+      let found = null;
+      try {
+        found = { dir, text: readFileSync(candidate, "utf8") };
+      } catch {
+        found = null;
+      }
+      for (const d of seen) tsconfigCache.set(d, found);
+      return found;
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  for (const d of seen) tsconfigCache.set(d, null);
+  return null;
+}
+function pathAlias(cfg) {
+  const m = /["']([^"']+)\/\*["']\s*:\s*\[\s*["']([^"']+)\/\*["']/.exec(cfg.text);
+  if (!m) return null;
+  const baseUrl = /["']baseUrl["']\s*:\s*["']([^"']+)["']/.exec(cfg.text)?.[1] ?? ".";
+  return { prefix: m[1], root: resolve(cfg.dir, baseUrl, m[2]) };
+}
+function specifiers(content) {
+  const lines = content.split("\n");
+  const out = [];
+  for (const m of content.matchAll(SPECIFIER)) {
+    const spec = m[1] ?? m[2] ?? m[3] ?? m[4];
+    if (!spec) continue;
+    const line = content.slice(0, m.index).split("\n").length;
+    const text = lines[line - 1] ?? "";
+    if (COMMENT_LINE.test(text) || text.includes("enigma:")) continue;
+    out.push({ spec, line });
+  }
+  return out;
+}
+function extensionImports(content, file) {
+  const cfg = nearestTsconfig(file);
+  if (!cfg || !/["']module(?:Resolution)?["']\s*:\s*["'](?:bundler|preserve)["']/i.test(cfg.text)) return [];
+  const dir = dirname(resolve(file));
+  const out = [];
+  for (const { spec, line } of specifiers(content)) {
+    if (!/^\.\.?\//.test(spec) || !MODULE_EXT.test(spec)) continue;
+    if (JS_EXT.test(spec) && existsSync(resolve(dir, spec))) continue;
+    out.push({ line, detail: `"${spec}" -> "${spec.replace(MODULE_EXT, "")}"` });
+  }
+  return out;
+}
+function deepRelativeImports(content, file) {
+  const cfg = nearestTsconfig(file);
+  const alias = cfg && pathAlias(cfg);
+  if (!alias) return [];
+  const dir = dirname(resolve(file));
+  const out = [];
+  for (const { spec, line } of specifiers(content)) {
+    if (!/^(?:\.\.\/){2,}/.test(spec)) continue;
+    const target = resolve(dir, spec);
+    const rel = target.slice(alias.root.length + 1).replace(/\\/g, "/");
+    if (!target.startsWith(`${alias.root}${sep}`) || !rel) continue;
+    out.push({ line, detail: `"${spec}" -> "${alias.prefix}/${rel}"` });
+  }
+  return out;
+}
+function missingPathAlias(content, file) {
+  if (/["'](?:paths|extends)["']\s*:/.test(content)) return [];
+  const dir = dirname(resolve(file));
+  const src = ["src", "app", "lib"].find((d) => existsSync(join(dir, d)));
+  if (!src) return [];
+  const anchor = content.split("\n").findIndex((l) => /["']compilerOptions["']/.test(l));
+  return [{ line: anchor === -1 ? 1 : anchor + 1, detail: `no alias for ./${src}` }];
+}
 var NAMED_IMPORT = /^import[ \t]+(?:[\w$]+[ \t]*,[ \t]*)?(?:type[ \t]+)?\{([^}]*)\}[ \t]*from[ \t]*["']([^"']+)["'].*$/gm;
 var INTERNAL_MODULE = /^\.|^#|^[@~]\//;
 function wideNamedImports(content, max) {
@@ -1164,7 +1437,7 @@ function checkFile(file, content, projectRoot) {
       }
     } else if (rule.scope === "file" && rule.fileCheck) {
       const check = FILE_CHECKS[rule.fileCheck];
-      for (const hit of check ? check(content) : []) {
+      for (const hit of check ? check(content, file) : []) {
         out.push({ ...base, line: hit.line, message: `${rule.message} (${hit.detail})` });
       }
     } else if (rule.scope === "file" && rule.pattern) {
@@ -1297,9 +1570,12 @@ export {
   applyFixes,
   checkFile,
   checkPath,
+  deepRelativeImports,
+  extensionImports,
   findProjectRoot,
   formatFindings,
   loadRules,
+  missingPathAlias,
   missingWindowsHide,
   runGuardrailsHook,
   runGuardrailsScan,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "enigma-cli",
-  "version": "1.33.5",
+  "version": "1.33.7",
   "description": "Everything you need to work with a coding agent: install shared policy skills for Claude Code, OpenAI Codex and opencode, and set up portable git security hooks.",
   "type": "module",
   "bin": {