packwise-skills 1.0.0

package/.cursorrules

@@ -0,0 +1,23 @@
+# Packwise — Build & Packaging Skill
+
+## Context
+
+This project contains a universal build & packaging skill set for AI-assisted development. When asked to build, package, distribute, or ship software, follow the workflow in `skill.md`.
+
+## Instructions
+
+1. Read `skill.md` — it contains the complete 8-step workflow
+2. Scan the user's project first (framework, language, dependencies)
+3. Ask the user key questions (platform, architecture, signing, protection)
+4. Recommend the BEST approach with reasoning + alternatives
+5. Execute only after user confirms
+6. Always run the mandatory security audit after build
+7. Output results to `./release/` unless user specifies otherwise
+
+## Constraints
+
+- Never assume — always ask
+- Recommend with clear reasoning
+- Security checks are mandatory (credentials, .env, source maps)
+- If unsure about a platform, check `sub-skills/` for the matching guide
+- If no sub-skill matches, research online (time-boxed to 2-3 min)

package/CLAUDE.md

@@ -0,0 +1,25 @@
+# Claude Code — Packwise Skill
+
+## How to use this skill
+
+When the user asks to **build, package, distribute, or ship** any software project:
+
+1. Read `skill.md` for the complete 8-step workflow
+2. Follow the workflow exactly — do not skip steps
+3. After building, always run the mandatory security audit
+
+## Trigger phrases
+
+- "package my app"
+- "build for Windows/macOS/Linux"
+- "create an installer"
+- "ship this project"
+- "distribute my app"
+- "bundle for production"
+
+## Key rules
+
+- **Ask questions first** — never assume platform, architecture, or encryption needs
+- **Recommend with reasoning** — explain WHY, not just WHAT
+- **Security is mandatory** — always check for .env files, credentials, source maps
+- **Confirm before executing** — never build without user approval

package/README.md

@@ -0,0 +1,295 @@
+# packwise-skills
+
+> One skill that turns your AI into a build consultant — scan, recommend, package, and audit any project.
+
+<p align="center">
+  <a href="https://github.com/Thomas520TOM/packwise-skills/commits/main">
+    <img src="https://img.shields.io/github/last-commit/Thomas520TOM/packwise-skills?style=flat-square&logo=github" alt="last commit">
+  </a>
+  <a href="https://github.com/Thomas520TOM/packwise-skills/blob/main/LICENSE">
+    <img src="https://img.shields.io/badge/license-MIT-blue?style=flat-square&logo=github" alt="license">
+  </a>
+  <a href="https://github.com/Thomas520TOM/packwise-skills/tree/main/sub-skills">
+    <img src="https://img.shields.io/badge/skills-44-brightgreen?style=flat-square" alt="skills">
+  </a>
+  <a href="#supported-platforms">
+    <img src="https://img.shields.io/badge/platforms-20%2B-orange?style=flat-square" alt="platforms">
+  </a>
+  <a href="#supported-platforms">
+    <img src="https://img.shields.io/badge/frameworks-40%2B-purple?style=flat-square" alt="frameworks">
+  </a>
+  <a href="#tested-framework-versions">
+    <img src="https://img.shields.io/badge/tested-10-success?style=flat-square" alt="tested">
+  </a>
+  <a href="#installation">
+    <img src="https://img.shields.io/badge/works%20with-Claude%20Code%20%7C%20OpenCode%20%7C%20Cursor-yellow?style=flat-square" alt="works with">
+  </a>
+</p>
+
+---
+
+**Packwise** is a universal build & packaging skill for AI-assisted development.  Instead of your AI guessing at build commands and hoping for the best, Packwise gives it a structured, consultant-grade workflow that scans your project, asks the right questions, recommends solutions with reasoning, and executes builds with mandatory security audits — across 20+ platforms and 40+ frameworks.
+
+---
+
+## Why This Exists
+
+Packaging software is where most AI coding assistants fail. They suggest outdated flags, forget platform-specific quirks, skip credential scans, and have no concept of a proper build plan. **Packwise fixes this** by turning your AI into a structured build consultant with real domain knowledge.
+
+<div align="center">
+
+| Without Packwise | With Packwise |
+|:---:|:---:|
+| `"Try running npm run build"` | Scans project → identifies framework/version → recommends with reasoning |
+| No security checks | Mandatory credential scan, `.env` detection, source map cleanup |
+| Guesses platform differences | Asks target platform, arch, signing, output — all upfront |
+| One-shot answer | Full workflow: recommend → alternatives → confirm → execute |
+| No post-build verification | Mandatory audit: credentials, integrity, file structure |
+
+</div>
+
+---
+
+## How It Works
+
+Packwise runs a **consultant-style 8-step workflow** — the same process a human build engineer would follow:
+
+| Step | Action | Result |
+|:----:|--------|--------|
+| **1** | **Scan** — detect framework, language, dependencies, `.env` files | Project analysis |
+| **2** | **Intake** — report findings, ask 12 structured questions | User preferences |
+| **3** | **Analyze** — combine scan + answers + online research (if needed) | Strategy options |
+| **4** | **Recommend** — present best approach with reasoning + alternatives | Decision support |
+| **5** | **Confirm** — user selects, final build plan generated | Confirmed plan |
+| **6** | **Execute** — load sub-skill, run build commands | Installers / packages |
+| **7** | **Audit** — credentials, `.env`, `.map`, package integrity | Security report |
+| **8** | **Report** — structured final build report | Delivery |
+
+---
+
+## Key Advantages
+
+Packwise is more than a build script. It's a **complete packaging intelligence layer** that works across your entire stack.
+
+| Capability | What It Means |
+|------------|---------------|
+| **44 sub-skills** | Deep, platform-specific knowledge — not generic advice |
+| **20+ platforms** | Desktop, mobile, web, backend, AI/ML, CLI, plugins, embedded, cloud |
+| **Mandatory security** | Every build ends with a credential and integrity audit |
+| **Consultant workflow** | Recommend → confirm → execute, never auto-builds without approval |
+| **Version-verified** | Build commands checked against npm, PyPI, crates.io, official registries |
+| **CI/CD templates** | GitHub Actions and GitLab CI configs included in every sub-skill |
+| **Cross-tool support** | Works with Claude Code, OpenCode, Cursor, Codex CLI, and more |
+
+---
+
+## Installation
+
+### npm (Recommended)
+
+```bash
+npm install -g packwise-skills
+```
+
+Then invoke in your AI agent:
+
+```
+> package my Electron app for Windows
+```
+
+<details>
+<summary><strong>Git clone</strong> — install from source</summary>
+
+```bash
+# User-level (all projects)
+cd ~/.claude/
+git clone https://github.com/Thomas520TOM/packwise-skills.git skills/packwise
+
+# Project-level (this project only)
+cd your-project/
+mkdir -p .claude/skills/
+git clone https://github.com/Thomas520TOM/packwise-skills.git .claude/skills/packwise
+```
+</details>
+
+<details>
+<summary><strong>Curl one-liner</strong> — install with a single command</summary>
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/Thomas520TOM/packwise-skills/main/install.sh | bash
+```
+</details>
+
+<details>
+<summary><strong>Other AI tools</strong> — OpenCode, Cursor, Hermes, Codex CLI, WorkBuddy</summary>
+
+**OpenCode** — copy to `.opencode/skills/packwise/` and reference in prompts:
+```bash
+mkdir -p .opencode/skills/packwise/
+cp skill.md audit.md .opencode/skills/packwise/
+cp -r sub-skills/ .opencode/skills/packwise/
+```
+
+**Cursor** — add to `.cursor/skills/` or reference via `@packwise` in prompts.
+
+**Hermes / LangChain Agents** — add to `hermes.config.yaml`:
+```yaml
+skills:
+  - path: /path/to/packwise/
+    name: packwise
+```
+
+**Codex CLI** — copy to project root as `PACKWISE.md` (auto-read as context).
+
+**WorkBuddy** — copy to `~/.workbuddy/skills/` or use `/project:packwise`.
+
+**Any LLM agent** — copy `skill.md` + `sub-skills/` to your project and prompt:
+```
+Read skills/package-skill.md and help me package this project
+```
+
+Full instructions: [INSTALL.md](INSTALL.md)
+</details>
+
+---
+
+## Supported Platforms
+
+| Category | Frameworks | Build Verified |
+|----------|-----------|:--------------:|
+| **Desktop** | Electron 43, Tauri 2.11, Qt, Flutter Desktop, Pake, Neutralinojs | Electron, Tauri |
+| **Mobile** | Android (Kotlin), iOS/iPadOS, HarmonyOS NEXT, Flutter 3.44, React Native 0.86, Capacitor 8 | — |
+| **Web** | Vite 8, Next.js 16, PWA, Serverless/Edge, Monorepo, WebAssembly | Vite, Next.js |
+| **Backend** | Node.js 26, Python 3.12, Go 1.26, Rust, Java/Spring Boot 3.5, PHP/Laravel | Node, Python, Rust, Java |
+| **AI/ML** | PyTorch, TensorFlow, ONNX Runtime, Ollama, llama.cpp, vLLM | — |
+| **CLI/SDK** | PyInstaller, Nuitka, npm/PyPI/crates.io publishing | PyInstaller |
+| **Plugins** | Chrome/Firefox Extensions, VS Code, JetBrains | — |
+| **Embedded** | ESP32, STM32, ROS/ROS2, Car Infotainment | — |
+| **Cloud** | Docker, Kubernetes, CI/CD (GitHub Actions) | — |
+| **Wearables** | watchOS, Wear OS, Galaxy Watch | — |
+
+> Checked = build tested on real projects. — = documentation verified against official sources.
+
+---
+
+## Architecture
+
+```
+skill.md (Main Orchestrator)
+│
+├─ Step 1: Project Scan ─────── Detect framework, language, deps, env
+│
+├─ Step 2: Intake ───────────── Ask 12 questions (platform, arch, signing...)
+│  ├─ Part A: Project Summary    ← scan results displayed
+│  ├─ Part B: Questions          ← interactive options with defaults
+│  └─ Part C: Confirmation       ← summary table for user approval
+│
+├─ Step 3: Analyze & Research ── Combine data + online research if needed
+│
+├─ Step 4: Recommend ⭐ ──────── Best solution + alternatives + reasoning
+│
+├─ Step 5: Confirm ───────────── User selects → final build plan
+│
+├─ Step 6: Execute ───────────── Load sub-skill → run build commands
+│  ├─ sub-skills/desktop/       Electron, Tauri, Qt, games, VR...
+│  ├─ sub-skills/mobile/        Android, iOS, Flutter, RN, watchOS...
+│  ├─ sub-skills/web/           Vite, Next.js, PWA, WASM...
+│  ├─ sub-skills/backend/       Node, Python, Go, Rust, Java, PHP
+│  ├─ sub-skills/ai/            PyTorch, Ollama, llama.cpp
+│  ├─ sub-skills/cli/           PyInstaller, npm/PyPI publishing
+│  ├─ sub-skills/plugins/       Chrome, VS Code, JetBrains
+│  ├─ sub-skills/embedded/      ESP32, STM32, ROS, car
+│  ├─ sub-skills/security/      Pentest tools, scanners
+│  ├─ sub-skills/cloud/         Docker, K8s, CI/CD
+│  └─ sub-skills/cross-platform/ .NET MAUI, KMP
+│
+├─ Step 7: Audit (mandatory) ── Credentials, .env, .map, package check
+│
+└─ Step 8: Final Report ─────── Build report with all results
+```
+
+---
+
+## Security Model
+
+Packwise enforces security at every stage — no build completes without a clean audit.
+
+| Stage | Check |
+|-------|-------|
+| **Pre-build scan** | Detect `.env` files, hardcoded API keys, secrets in source |
+| **Build execution** | Delete source maps, exclude `.env` from package, clean test data |
+| **Post-build audit** | Verify no credentials, `.map` files, or `.env` in final package |
+| **Network check** | Optional: verify no unexpected outbound connections |
+
+---
+
+## What's Inside
+
+### 44 Sub-Skills — Every Major Platform Covered
+
+Each sub-skill contains:
+- **Version-verified** build commands (checked against official registries)
+- **Step-by-step** packaging workflows with copy-paste examples
+- **Common pitfalls** table with solutions (from real build testing)
+- **CI/CD** configuration templates (GitHub Actions, GitLab CI)
+- **Security** best practices specific to the platform
+
+### Tested Framework Versions
+
+| Framework | Version | Verified |
+|-----------|:-------:|:--------:|
+| Electron | 43.x | ✅ |
+| Tauri | 2.11.x | ✅ |
+| Vite | 8.1.3 | ✅ |
+| Next.js | 16.2.10 | ✅ |
+| Node.js | 26 LTS | ✅ |
+| Python | 3.12 | ✅ |
+| Rust | 1.96 | ✅ |
+| Java | 21 LTS | ✅ |
+| React Native | 0.86.x | — |
+| Flutter | 3.44.x | — |
+| Capacitor | 8.x | — |
+| Go | 1.26 | — |
+
+---
+
+## Contributing
+
+Contributions are welcome. Before submitting, please:
+
+1. Write all instructions in **English** only
+2. Verify framework versions against **official registries** (npm, PyPI, GitHub Releases)
+3. Include a **Common Pitfalls** table in every new sub-skill
+4. Test build commands when possible
+5. Never commit secrets, API keys, or credentials
+
+```bash
+git clone https://github.com/YOUR_USER/packwise-skills.git
+cd packwise-skills
+git checkout -b feat/my-improvement
+# edit skill.md or sub-skills/
+git commit -m "feat: add [framework] support"
+git push origin feat/my-improvement
+# open a PR against main
+```
+
+---
+
+## License
+
+<div align="center">
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue?style=flat-square&logo=github)](https://opensource.org/licenses/MIT)
+
+This project is licensed under the [MIT License](LICENSE).
+
+</div>
+
+---
+
+<div align="center">
+  Built with care for the AI-assisted development community.
+  <br><br>
+  <a href="https://github.com/Thomas520TOM/packwise-skills">GitHub</a> · <a href="https://github.com/Thomas520TOM/packwise-skills/issues">Issues</a> · <a href="https://github.com/Thomas520TOM/packwise-skills/blob/main/INSTALL.md">Install Guide</a>
+  <br>
+</div>

package/audit.md

@@ -0,0 +1,224 @@
+# Post-Build Audit — Mandatory Verification
+
+Top-level document. Must be executed after every build. Cannot be skipped.
+
+---
+
+## Audit Procedure
+
+After packaging, the AI **must** load this document and execute all checks below. Any failure blocks delivery.
+
+### 1. Build Artifact Integrity
+
+```bash
+# TypeScript compilation (if applicable)
+npx tsc --noEmit 2>&1 | head -5
+
+# Syntax check (if CJS bundle exists)
+node -c dist/server.cjs 2>/dev/null && echo "Syntax OK" || echo "Syntax ERROR"
+
+# Encryption files (if applicable)
+ls data-encrypted/*.enc 2>/dev/null | head -5
+head -c 50 data-encrypted/*.enc 2>/dev/null  # Should be hex format
+
+# Package exists and reasonable size
+ls -lh release/*.exe release/*.dmg release/*.AppImage release/*.apk 2>/dev/null
+```
+
+### 2. Package Validation
+
+| Check | Method | Pass Criteria |
+|-------|--------|--------------|
+| Package executable | Double-click to run installer | No errors, wizard displays correctly |
+| Logo correct | Check desktop shortcut and installer | Shows user-provided logo |
+| License correct | View license in installer | Version, email, copyright correct |
+| Install path | Confirm installation directory | Default or user-selected path |
+
+### 3. Application Launch
+
+| Check | Method | Pass Criteria |
+|-------|--------|--------------|
+| No startup errors | Double-click to open app | No black/white screen, no Error dialog |
+| Server ready | Check console logs | Server listening on port |
+| Frontend loads | UI displays correctly | No blank page, no 404 |
+| Database created | Check userData directory | Database file exists at expected path |
+| First launch | Fresh install and open | Welcome screen or normal initial state |
+
+### 4. Data Persistence
+
+| Check | Method | Pass Criteria |
+|-------|--------|--------------|
+| Data saves | Create data → close → reopen | Data persists correctly |
+| Database writes | Perform multiple operations | Database file size increases |
+| Config saves | Modify settings → save → reopen | Settings restored correctly |
+| Data clear | Clear data → reopen | No residual data, clean initial state |
+
+### 5. Encryption & Decryption
+
+| Check | Method | Pass Criteria |
+|-------|--------|--------------|
+| Encrypted files correct | Check .enc file content | Hex format (`iv:encrypted_data`) |
+| Decryption functional | App uses encrypted data at runtime | Data loads and processes correctly |
+| No functional regression | Compare with/without encryption | Core functionality identical |
+| Keys not in artifacts | Search build output | 0 matches for key seed/salt |
+
+### 6. Credential Security
+
+```bash
+# Search build artifacts for sensitive information
+grep -r "sk-\|apiKey\|secret\|token\|password\|appKey\|accessKey\|SecretKey" dist/ release/ 2>/dev/null
+
+# Check for source map files (SECURITY: these contain full unobfuscated source)
+find dist/ release/ -name '*.map' -type f 2>/dev/null
+# Expected: 0 results
+
+# Check for .env files in build output (SECURITY: may contain secrets)
+find dist/ release/ -name '.env*' -type f 2>/dev/null
+# Expected: 0 results
+
+# Check app-specific config files are clean (replace <APP_CONFIG_DIR> with actual path)
+cat <APP_CONFIG_DIR>/config.json 2>/dev/null  # Should be empty if cleared
+cat <APP_CONFIG_DIR>/tts.json 2>/dev/null     # Should be empty if cleared
+```
+
+| Check | Pass Criteria |
+|-------|--------------|
+| No real keys in build artifacts | Only placeholder text (e.g., `sk-...`) |
+| Config files cleared | apiKey/secretKey/appId all empty |
+| No source map files in build | `find dist/ release/ -name '*.map'` returns 0 results |
+| No .env files in package | `find dist/ release/ -name '.env*'` returns 0 results |
+| .gitignore covers sensitive dirs | App config dir, `dist/`, `data-encrypted/`, `.env` all ignored |
+
+### 7. File Architecture Validation
+
+**Electron projects**:
+```
+resources/
+├── app.asar (read-only: code + frontend)
+├── app.asar.unpacked/ (native modules)
+├── data/ (encrypted data)
+└── public/ (static resources)
+
+%APPDATA%/<APP_NAME>/<APP_NAME>/.<app-name>/
+├── config.json
+├── tts.json
+├── database.db (SQLite)
+├── saves/
+└── memory/
+```
+
+**Other frameworks**: Check against the architecture defined in the corresponding sub-skill.
+
+### 8. Build Artifact Cleanup
+
+```bash
+# release/ directory should only contain the installer
+ls release/
+# Expected: only *.exe / *.dmg / *.AppImage / *.apk
+# Should NOT contain: win-unpacked/, *.blockmap, builder-debug.yml, latest.yml
+
+# dist/ should not contain standalone images (if embedded)
+ls dist/images/ dist/*.png 2>/dev/null && echo "WARNING: standalone images" || echo "PASS"
+```
+
+### 9. Network Verification (Desktop Apps)
+
+Launch the application with a network monitoring tool active (Wireshark, Fiddler, Charles Proxy, or `netstat`).
+
+| Check | Method | Pass Criteria |
+|-------|--------|--------------|
+| No unexpected outbound connections | Monitor network traffic for 60 seconds after launch | Only expected connections (user-configured API, license server, update server) |
+| No telemetry without consent | Check for analytics/telemetry endpoints | User explicitly opted in, or none present |
+| DNS requests match expected domains | Filter DNS queries | Only configured domains appear |
+
+### 10. Performance Assessment
+
+| Metric | Method | Reference |
+|--------|--------|-----------|
+| Package size | `ls -lh` | Electron: 130-180MB / Tauri: 3-10MB |
+| Startup time | Double-click to UI display | < 5 seconds |
+| Memory usage | Task Manager | Electron: 200-500MB |
+
+### 10. User Requirements Completeness
+
+Review all requirements collected before packaging:
+
+| Requirement Category | Check Item |
+|---------------------|------------|
+| Platform | Target platforms correct? |
+| Architecture | Target architectures correct? |
+| Info | App name/version correct? |
+| Logo | Logo displays correctly? |
+| Output | Package at correct location? |
+| Encryption | Encryption functional? |
+| Cleanup | Test data cleared? |
+| Security | API keys cleared? |
+| Corners | Logo corners handled correctly? |
+| Signing | Platform signing correct? (macOS mandatory) |
+
+### 11. Platform-Specific Checks
+
+**Windows**:
+- NSIS installer wizard works
+- Desktop shortcut created
+- Start menu entry exists
+- Uninstall works correctly
+
+**macOS**:
+- DMG opens correctly
+- Drag-to-install works
+- Code signature valid (`codesign -v App.app`)
+- Gatekeeper does not block
+
+**Linux**:
+- AppImage is executable (`chmod +x *.AppImage && ./AppImage`)
+- deb installs correctly (`dpkg -i *.deb`)
+
+---
+
+## Audit Report Template
+
+```
+═══════════════════════════════════════
+          POST-BUILD AUDIT
+═══════════════════════════════════════
+
+[BUILD ARTIFACTS]
+✅ TypeScript compilation 0 errors
+✅ Syntax check passed
+✅ Encryption files format correct
+✅ No credential leaks
+
+[PACKAGE]
+✅ Package valid (XXX MB)
+✅ Logo displays correctly
+✅ License info correct
+
+[APPLICATION]
+✅ Launches normally
+✅ Database created correctly
+✅ Data persistence works
+✅ Data clear leaves no residue
+
+[SECURITY]
+✅ Credentials cleared
+✅ No source map files in package
+✅ No .env files in package
+✅ Source code obfuscated
+✅ Content encrypted
+✅ Images embedded (anti-theft)
+✅ No unexpected network connections
+
+[CLEANUP]
+✅ No residual build artifacts
+
+[USER REQUIREMENTS]
+✅ All requirements met
+
+[CONCLUSION]
+All checks passed. Ready for delivery.
+
+[PACKAGE LOCATION]
+release/<filename> (<size>MB)
+═══════════════════════════════════════
+```