noah-cursor 1.1.0 → 1.3.0

package/dist/noah-registry/manifest.json

@@ -0,0 +1,85 @@
+{
+  "name": "noah-registry",
+  "version": "1.1.0",
+  "description": "Noah Cursor registry — add your skills, rules, prompts, MCP configs, and presets here",
+  "author": "Noah Poli",
+  "skills": [
+    {
+      "id": "test",
+      "version": "1.0.0",
+      "description": "Sample skill for verifying noah-cursor installs",
+      "tags": ["test", "sample"]
+    },
+    {
+      "id": "commit-push",
+      "version": "1.0.0",
+      "description": "Stage all changes, group by category, draft a linepush-style commit, commit, and push",
+      "tags": ["git", "commit", "push", "conventional-commits"]
+    },
+    {
+      "id": "react-doctor-fix",
+      "version": "1.0.0",
+      "description": "Run react-doctor, fix all findings, and verify features still work",
+      "tags": ["react", "react-doctor", "lint", "refactor", "qa"]
+    },
+    {
+      "id": "larastan-fix",
+      "version": "1.0.0",
+      "description": "Run Larastan on Laravel, fix all findings, and verify features still work",
+      "tags": ["laravel", "php", "larastan", "phpstan", "qa"]
+    },
+    {
+      "id": "nestjs-knip-fix",
+      "version": "1.0.0",
+      "description": "Run Knip on NestJS, fix unused code/deps, and verify features still work",
+      "tags": ["nestjs", "knip", "node", "typescript", "qa"]
+    },
+    {
+      "id": "node-doctor-fix",
+      "version": "1.0.0",
+      "description": "Run bundled node-doctor (Knip + hygiene), fix findings, verify features still work",
+      "tags": ["node", "knip", "doctor", "qa", "cli"]
+    }
+  ],
+  "rules": [
+    {
+      "id": "test",
+      "version": "1.0.0",
+      "description": "Sample rule for verifying noah-cursor installs",
+      "tags": ["test", "sample"]
+    },
+    {
+      "id": "stack-architecture",
+      "version": "1.0.0",
+      "description": "When to use React SPA dashboards, Laravel APIs, and Next/Nuxt marketing sites",
+      "tags": ["architecture", "stack"]
+    },
+    {
+      "id": "react-spa-dashboard",
+      "version": "1.0.0",
+      "description": "React client-side SPA rules for dashboards consuming a Laravel API",
+      "tags": ["react", "spa", "dashboard", "typescript", "tanstack-query"]
+    },
+    {
+      "id": "laravel-api",
+      "version": "1.0.0",
+      "description": "Laravel API-only backend rules for headless SPA clients",
+      "tags": ["laravel", "php", "api", "sanctum"]
+    },
+    {
+      "id": "nextjs-marketing",
+      "version": "1.0.0",
+      "description": "Next.js App Router rules for marketing and branding websites",
+      "tags": ["nextjs", "marketing", "seo", "branding"]
+    },
+    {
+      "id": "nuxt-marketing",
+      "version": "1.0.0",
+      "description": "Nuxt 3+ rules for marketing and branding websites",
+      "tags": ["nuxt", "vue", "marketing", "seo", "branding"]
+    }
+  ],
+  "prompts": [],
+  "mcp": [],
+  "presets": []
+}

package/dist/noah-registry/rules/laravel-api/RULE.md

@@ -0,0 +1,62 @@
+---
+description: Laravel API-only backend rules for SPA dashboards and headless clients
+globs: "**/*.php"
+alwaysApply: false
+---
+
+# Laravel API
+
+Use this rule when Laravel is an **API-only** backend serving a React SPA (or other clients). Prefer JSON APIs over Blade/Livewire/Inertia unless the user explicitly asks for them.
+
+Sources synthesized from [PatrickJS/awesome-cursorrules](https://github.com/PatrickJS/awesome-cursorrules) (`laravel-php-83`) plus Laravel API conventions (Sanctum, Form Requests, Resources).
+
+## Role of this app
+
+- Laravel exposes **REST/JSON endpoints** (or thin action controllers).
+- The React dashboard is the primary UI client.
+- Marketing sites (Next/Nuxt) may call public read-only endpoints when needed.
+- Do not build admin UIs in Blade unless requested.
+
+## PHP & Laravel conventions
+
+- PHP 8.2+ features where appropriate (typed properties, enums, readonly, constructor promotion).
+- Follow PSR-12 and Laravel naming:
+  - Classes: PascalCase
+  - Methods: camelCase
+  - DB columns / request keys: snake_case (or consistently camelCase in API resources — pick one and stick to it)
+- Prefer helpers when clearer; keep controllers thin.
+- Pint for formatting.
+
+## HTTP layer
+
+- Validate with **Form Request** classes — not ad-hoc `$request->validate()` in fat controllers.
+- Return **API Resources** / Resource collections for JSON shaping.
+- Use API route files (`routes/api.php`) and version when needed (`/api/v1/...`).
+- Prefer invokable / single-action controllers for complex endpoints when it improves clarity.
+- Consistent error JSON shape for `401`, `403`, `404`, `422`, `500`.
+
+## Auth
+
+- Prefer **Laravel Sanctum** for SPA cookie auth (same-site) or token auth for mobile/third-party.
+- Protect routes with `auth:sanctum` (or project guard).
+- Authorize with Policies / Gates — never “check role in controller ad hoc” without a policy when domain rules grow.
+
+## Domain & data
+
+- Eloquent models stay focused; push heavy workflows to Actions/Services.
+- Use migrations for schema; factories/seeders for local data.
+- Eager-load relations to avoid N+1 (`with`, `loadMissing`).
+- Database transactions around multi-model writes.
+- Queues for email, webhooks, and slow side effects.
+
+## Testing
+
+- Feature tests for API endpoints (`postJson`, `getJson`, assert JSON structure).
+- Cover auth boundaries and validation failures.
+- Prefer Pest or PHPUnit per project norm.
+
+## Do not
+
+- Do not default to Livewire / Inertia / Blade admin panels for this stack.
+- Do not return unfiltered Eloquent models when a Resource is safer.
+- Do not put React/Next/Nuxt frontend code into the Laravel repo unless the monorepo already does that by convention.

package/dist/noah-registry/rules/nextjs-marketing/RULE.md

@@ -0,0 +1,52 @@
+---
+description: Next.js rules for marketing and branding websites (SEO, App Router, content pages)
+globs: "**/*.{tsx,ts,jsx,js,mdx}"
+alwaysApply: false
+---
+
+# Next.js Marketing / Branding
+
+Use this rule for **marketing and branding websites** built with Next.js (App Router). Optimize for SEO, performance, and content-driven pages — not authenticated SPA dashboards.
+
+Sources synthesized from [PatrickJS/awesome-cursorrules](https://github.com/PatrickJS/awesome-cursorrules) (`nextjs-app-router`, `nextjs-14-tailwind-seo`).
+
+## When to use Next.js here
+
+- Marketing sites, landing pages, brand storytelling, blogs, campaigns.
+- Prefer SSG/SSR and strong SEO.
+- Dashboard/admin apps should use the **React SPA** rule + Laravel API instead.
+
+## App Router defaults
+
+- Server Components by default; add `'use client'` only for interactivity.
+- Use `layout.tsx`, `page.tsx`, `loading.tsx`, `error.tsx`, `not-found.tsx`.
+- Colocate route UI under `app/`; keep shared UI in `components/`.
+- Use `next/image` and `next/font`.
+- Prefer Tailwind (or the project design system) over ad-hoc CSS.
+
+## SEO & content
+
+- Define `metadata` / `generateMetadata` per page (title, description, Open Graph, Twitter).
+- Semantic HTML (`main`, `header`, `nav`, `section`, `article`).
+- Accessible landmarks, focus states, and image `alt` text.
+- Static generation for mostly-static pages; revalidate when CMS/API content changes.
+- Sitemap and `robots.txt` when the site is public.
+
+## Performance
+
+- Avoid shipping large client bundles on marketing pages.
+- Lazy-load below-the-fold interactive widgets.
+- Keep third-party scripts minimal (analytics via Next script strategy).
+- Optimize LCP: hero image priority, restrained font loading.
+
+## Data
+
+- Fetch in Server Components with caching/`revalidate` as appropriate.
+- If calling the Laravel API for public content, keep tokens server-side only.
+- Do not expose admin credentials to the browser.
+
+## Do not
+
+- Do not turn a marketing site into a full authenticated dashboard SPA inside Next unless explicitly requested.
+- Do not use client components for purely static content.
+- Do not skip metadata on public pages.

package/dist/noah-registry/rules/nuxt-marketing/RULE.md

@@ -0,0 +1,50 @@
+---
+description: Nuxt rules for marketing and branding websites (SEO, content, Vue Composition API)
+globs: "**/*.{vue,ts,js,mjs}"
+alwaysApply: false
+---
+
+# Nuxt Marketing / Branding
+
+Use this rule for **marketing and branding websites** built with Nuxt 3+. Optimize for SEO, content pages, and brand experiences — not authenticated SPA dashboards.
+
+Sources synthesized from [PatrickJS/awesome-cursorrules](https://github.com/PatrickJS/awesome-cursorrules) (`vue-3-nuxt-3-typescript`, `vue3-composition-api`).
+
+## When to use Nuxt here
+
+- Marketing sites, landings, brand sites, content-heavy Vue stacks.
+- Prefer Nuxt's SSR/SSG and SEO utilities.
+- Dashboard/admin apps should use the **React SPA** rule + Laravel API instead (unless the team explicitly chooses a Nuxt SPA dashboard).
+
+## Nuxt conventions
+
+- Vue 3 **Composition API** with `<script setup lang="ts">`.
+- Use Nuxt file-based routing, layouts, plugins, and middleware.
+- Prefer auto-imported composables; keep shared logic in `composables/`.
+- Runtime config for public/private env (`useRuntimeConfig`) — never hardcode secrets.
+- Tailwind (or project design system) for styling; keep utility usage consistent.
+
+## SEO & content
+
+- Use `useSeoMeta` / `useHead` (or Nuxt SEO module) on every public page.
+- Semantic HTML and accessible navigation.
+- Prefer SSG/ISR-style rendering for mostly static marketing pages.
+- Optimize images (Nuxt Image) and fonts.
+
+## Data fetching
+
+- Prefer `useAsyncData` / `useFetch` with clear keys.
+- Cache and refresh intentionally; avoid waterfall client fetches for hero content.
+- If consuming the Laravel API for public content, keep private credentials on the server.
+
+## Performance
+
+- Lazy-load non-critical client islands.
+- Keep marketing pages lean — minimize client-only plugins.
+- Review payload size for route data.
+
+## Do not
+
+- Do not default to a client-only SPA mode for public brand pages.
+- Do not mix React dashboard patterns into Nuxt marketing code.
+- Do not skip SEO meta on indexable pages.

package/dist/noah-registry/rules/react-spa-dashboard/RULE.md

@@ -0,0 +1,75 @@
+---
+description: React client-side SPA rules for dashboards and admin apps that talk to a Laravel API
+globs: "**/*.{tsx,ts,jsx,js}"
+alwaysApply: false
+---
+
+# React SPA Dashboard
+
+Use this rule for **client-side SPA dashboards** (Vite + React + TypeScript). The UI is a SPA; the backend is a separate **Laravel API**. Do not introduce Next.js App Router, SSR, or server components here.
+
+Sources synthesized from [PatrickJS/awesome-cursorrules](https://github.com/PatrickJS/awesome-cursorrules) (`react.mdc`, `typescript-react`, `react-query`) and modern SPA practice.
+
+## Architecture
+
+- Treat this app as a **browser SPA** only — no SSR, no `app/` router, no RSC.
+- Call the Laravel API over HTTPS with a typed client (`fetch` / axios / ky).
+- Prefer feature folders over dumping everything in `components/`.
+
+Suggested structure:
+
+```text
+src/
+  app/              # providers, router, layout shell
+  features/         # domain features (auth, users, billing…)
+    <feature>/
+      api/
+      components/
+      hooks/
+      types.ts
+  shared/           # ui primitives, utils, config
+  pages/ or routes/ # route-level screens
+```
+
+## Components & TypeScript
+
+- Functional components only; keep them small and focused.
+- Prefer explicit props interfaces; avoid `React.FC` unless needed.
+- Extract reusable logic into custom hooks.
+- Use composition over inheritance; co-locate feature UI with its hooks/api.
+- Strict TypeScript; avoid `any`.
+
+## Data fetching (dashboard)
+
+- Use **TanStack Query (React Query)** for server state.
+- Put `QueryClientProvider` at the root.
+- Custom hooks for queries/mutations (`useUsersQuery`, `useUpdateUserMutation`).
+- Stable query keys; invalidate after mutations.
+- Handle loading, empty, and error states explicitly.
+- Prefer optimistic updates only when rollback is safe.
+
+## Auth & API boundary
+
+- Store tokens/session per project convention (httpOnly cookie preferred when Laravel Sanctum SPA cookie auth is used; otherwise Bearer token with secure storage).
+- Centralize API base URL via `import.meta.env`.
+- Never hardcode secrets; never commit `.env`.
+- Map Laravel validation errors (`422`) into form field errors.
+
+## UI & UX for dashboards
+
+- Tables, filters, and forms should be keyboard-accessible.
+- Use controlled forms; libraries (React Hook Form + Zod) for complex forms.
+- Show skeleton/loading states for slow endpoints.
+- Route-level code splitting with `React.lazy` / dynamic import when screens are heavy.
+
+## State
+
+- Local UI state: `useState` / `useReducer`.
+- Server state: TanStack Query — not Redux.
+- Cross-cutting client UI state (theme, sidebar): lightweight store (Zustand) or context — only when props become painful.
+
+## Do not
+
+- Do not add Next.js, Nuxt, or Laravel Blade into this SPA.
+- Do not put business rules that belong on the API into the client.
+- Do not fetch without caching strategy on list/detail dashboard screens.

package/dist/noah-registry/rules/stack-architecture/RULE.md

@@ -0,0 +1,28 @@
+---
+description: Stack selection rule for React SPA dashboards, Laravel APIs, and Next/Nuxt marketing sites
+alwaysApply: false
+---
+
+# Noah Stack Architecture
+
+Use this when choosing or mixing frontends and backends in Noah Poli projects.
+
+## Default split
+
+| Surface | Stack | Rule to apply |
+|---------|-------|---------------|
+| Dashboard / admin (authenticated SPA) | **React** client-side SPA (Vite) | `react-spa-dashboard` |
+| Backend API | **Laravel** API-only | `laravel-api` |
+| Marketing / branding / content site | **Next.js** *or* **Nuxt** | `nextjs-marketing` / `nuxt-marketing` |
+
+## Principles
+
+1. Dashboards are **SPAs** talking to Laravel over JSON — not Inertia/Livewire unless requested.
+2. Marketing sites prioritize **SEO and content**; pick Next or Nuxt per team preference, not both in one site.
+3. Keep API contracts stable; version when breaking.
+4. Do not force dashboard auth patterns onto public marketing pages.
+5. Share design tokens/brand guidelines across marketing and dashboard when possible, but keep codebases/boundaries clear.
+
+## Sources
+
+Curated from community Cursor rules (notably [PatrickJS/awesome-cursorrules](https://github.com/PatrickJS/awesome-cursorrules)) and adapted to this architecture.

package/dist/noah-registry/rules/test/RULE.md

@@ -0,0 +1,16 @@
+---
+description: Sample rule for verifying noah-cursor installs
+alwaysApply: false
+---
+
+# Test Rule
+
+This is a sample Cursor rule used to verify `noah-cursor` installation.
+
+Replace this with your own rules when you are ready.
+
+## Guidelines
+
+- Prefer clear, direct answers
+- Keep changes focused on the requested task
+- Do not invent requirements that were not asked for

package/dist/noah-registry/skills/commit-push/SKILL.md

@@ -0,0 +1,193 @@
+---
+name: commit-push
+description: >-
+  Stages all changes, groups files by category, drafts a linepush-style
+  conventional commit message, commits, and pushes. Use when the user runs
+  /commit-push, asks to commit and push, or wants an AI-generated commit from
+  the current working tree.
+disable-model-invocation: true
+---
+
+# /commit-push
+
+Stage everything, categorize the changeset, write a **linepush-style** commit
+message, commit, then push.
+
+## Workflow
+
+Copy this checklist and track progress:
+
+```
+Commit-Push Progress:
+- [ ] 1. Inspect repo state
+- [ ] 2. Stage all changes
+- [ ] 3. Categorize / group files
+- [ ] 4. Draft commit message
+- [ ] 5. Commit
+- [ ] 6. Push
+```
+
+### 1. Inspect repo state
+
+Run in parallel:
+
+```bash
+git status --short
+git diff
+git diff --cached
+git log -5 --oneline
+git branch -vv
+```
+
+Abort early if:
+
+- Not a git repository
+- No changes to commit (clean working tree and empty index)
+- Secrets are about to be committed (`.env`, credentials, private keys, tokens) — warn and exclude them unless the user explicitly insists
+
+### 2. Stage all changes
+
+```bash
+git add -A
+```
+
+Re-check:
+
+```bash
+git status --short
+git diff --cached --stat
+```
+
+Do **not** use `--no-verify`, amend, force-push, or rewrite history unless the user explicitly asks.
+
+### 3. Categorize / group files
+
+Group every staged path into one or more of these buckets (a file may only belong to one primary bucket):
+
+| Bucket | Match hints |
+|--------|-------------|
+| `feat` | New user-facing capability, new modules/commands |
+| `fix` | Bug fixes, regressions, error handling corrections |
+| `refactor` | Restructures with no intended behavior change |
+| `docs` | README, markdown, comments-only docs |
+| `test` | `*.test.*`, `*.spec.*`, `__tests__`, `src/tests` |
+| `style` | Formatting, lint autofix, whitespace-only |
+| `chore` | Tooling, configs, ignore files, housekeeping |
+| `ci` | `.github/`, workflows, CI scripts |
+| `build` | `package.json`, lockfiles, tsconfig, bundler config |
+| `perf` | Performance-only changes |
+| `ui` | TUI/CLI presentation, banners, styling assets |
+| `assets` | Images, static media |
+
+Also infer a **scope** from paths when clear, e.g.:
+
+- `src/commands/` → `cli`
+- `src/ui/` → `ui`
+- `src/services/` → `services`
+- `skills/` → `skills`
+- `rules/` → `rules`
+- root config / package → `repo`
+
+Present a short grouping summary to the user before committing, for example:
+
+```text
+Grouped changes
+  feat (cli): src/commands/browse.ts, src/ui/*
+  docs: README.md
+  assets: assets/noah-cursor-banner.png
+  build: package.json, package-lock.json
+```
+
+### 4. Draft commit message (linepush style)
+
+Use **Conventional Commits**, inspired by [linepush](https://www.npmjs.com/package/linepush):
+
+```text
+type(scope): imperative summary
+
+- grouped change bullet
+- grouped change bullet
+```
+
+Rules:
+
+1. Pick the **primary** `type` from the dominant bucket (or the highest-impact user-facing change).
+2. `scope` is optional but preferred when one area dominates; omit rather than invent noise.
+3. Summary: imperative, ≤72 chars, no trailing period, focus on **why/impact** not file lists.
+4. Body: bullets grouped by category when multiple buckets exist.
+5. Match the repository’s recent `git log` tone when possible.
+6. Never commit secrets.
+
+**Examples:**
+
+Single-focus:
+
+```text
+feat(browse): add interactive registry browse TUI
+
+- add category and asset multi-select menus
+- wire installFromSelections into browse flow
+```
+
+Multi-group:
+
+```text
+feat(cli): ship browse TUI and README branding
+
+- feat: interactive browse command and UI modules
+- docs: document browse usage in README
+- assets: add NOAH Cursor README banner
+- build: add figlet, boxen, and gradient-string
+```
+
+### 5. Commit
+
+Show the drafted message, then commit with a HEREDOC:
+
+```bash
+git commit -m "$(cat <<'EOF'
+type(scope): summary
+
+- bullet
+- bullet
+EOF
+)"
+```
+
+If a pre-commit hook fails, fix the issue and create a **new** commit (do not amend unless the user explicitly asks and amend rules allow it).
+
+Verify:
+
+```bash
+git status
+```
+
+### 6. Push
+
+Push the current branch to its upstream:
+
+```bash
+git push -u origin HEAD
+```
+
+If upstream already tracks the branch:
+
+```bash
+git push
+```
+
+Do **not** `push --force` unless the user explicitly requests it.
+
+On success, report:
+
+- commit hash / subject
+- grouping summary
+- remote branch URL if available (`gh` / remote)
+
+## Safety
+
+- Never update git config
+- Never skip hooks unless explicitly requested
+- Never force-push `main` / `master`
+- Warn before committing `.env`, key files, or credential JSON
+- If push needs auth, stop and tell the user what to run locally