tribunal-kit 6.0.1 → 7.0.0

package/.agent/skills/agentic-patterns/SKILL.md

@@ -20,6 +20,7 @@ scripts-binding:
 ## Mandatory Pre-Flight Context Inspection
 
 Before designing agentic loops, tool schemas, or memory architectures, you MUST inspect:
+
 1. `package.json` / LLM SDK definitions → Check tool calling syntax (Zod schemas, OpenAI/Anthropic function calling API)
 2. Agent Loop boundaries (Section 1) → Define hard caps on `MAX_STEPS` (default: 10) and explicit termination reasons
 3. Human-in-the-loop gates (Section 5) → Ensure approval gates for destructive, data-deleting, or high-cost API calls
@@ -45,7 +46,7 @@ PERCEIVE → PLAN → ACT → OBSERVE → (repeat or terminate)
 ```ts
 // The three termination conditions — always define all three
 type AgentResult = {
-  reason: "goal_reached" | "max_steps_exceeded" | "human_escalation";
+  reason: 'goal_reached' | 'max_steps_exceeded' | 'human_escalation';
   steps: number;
   result: string;
 };
@@ -63,23 +64,24 @@ Tools are the agent's interface to the real world. Design them defensively:
 // Tool definition — what the LLM sees and how to call it
 const tools = [
   {
-    type: "function",
+    type: 'function',
     function: {
-      name: "search_database",
-      description: "Search the product database. Use this before creating a new record to avoid duplicates.",
+      name: 'search_database',
+      description:
+        'Search the product database. Use this before creating a new record to avoid duplicates.',
       parameters: {
-        type: "object",
+        type: 'object',
         properties: {
           query: {
-            type: "string",
-            description: "Search terms — be specific",
+            type: 'string',
+            description: 'Search terms — be specific',
           },
           limit: {
-            type: "number",
-            description: "Max results to return. Default: 5, max: 20",
+            type: 'number',
+            description: 'Max results to return. Default: 5, max: 20',
           },
         },
-        required: ["query"],
+        required: ['query'],
       },
     },
   },
@@ -145,10 +147,13 @@ async function buildContext(userId: string, currentQuery: string) {
   });
 
   return [
-    { role: "system", content: systemPrompt },
+    { role: 'system', content: systemPrompt },
     // Inject relevant past context — NOT entire history
-    { role: "system", content: `Relevant past context:\n${pastMemories.map((m) => m.content).join("\n")}` },
-    { role: "user", content: currentQuery },
+    {
+      role: 'system',
+      content: `Relevant past context:\n${pastMemories.map(m => m.content).join('\n')}`,
+    },
+    { role: 'user', content: currentQuery },
   ];
 }
 ```
@@ -175,7 +180,10 @@ Supervisor agent ─→ breaks task into subtasks
 
 ```ts
 // Two independent agents answer the same question — supervisor resolves disagreement
-const [answerA, answerB] = await Promise.all([agentA.complete(question), agentB.complete(question)]);
+const [answerA, answerB] = await Promise.all([
+  agentA.complete(question),
+  agentB.complete(question),
+]);
 
 if (answerA.answer === answerB.answer) {
   return answerA; // Agreement — high confidence
@@ -209,13 +217,13 @@ async function agentLoop(task: string) {
         reason: planned.reasoning,
         confidence: planned.confidence,
       });
-      if (!approved) return { reason: "human_rejected", step };
+      if (!approved) return { reason: 'human_rejected', step };
     }
 
     // ✅ Confidence gate — don't act when uncertain
     if (planned.confidence < 0.7) {
       return {
-        reason: "human_escalation",
+        reason: 'human_escalation',
         message: `Low confidence (${planned.confidence}) on: ${planned.action.description}`,
       };
     }
@@ -238,23 +246,23 @@ Every production agent needs:
 const guardrails = {
   // Input guardrails — reject bad prompts before they reach the agent
   input: [
-    { check: "no_prompt_injection", action: "reject" },
-    { check: "within_scope", action: "reject" }, // Off-topic requests
-    { check: "pii_detection", action: "redact" }, // Redact before processing
+    { check: 'no_prompt_injection', action: 'reject' },
+    { check: 'within_scope', action: 'reject' }, // Off-topic requests
+    { check: 'pii_detection', action: 'redact' }, // Redact before processing
   ],
 
   // Output guardrails — validate before returning
   output: [
-    { check: "no_hallucinated_citations", action: "flag" },
-    { check: "schema_valid", action: "retry_once" },
-    { check: "no_pii_leaked", action: "reject" },
+    { check: 'no_hallucinated_citations', action: 'flag' },
+    { check: 'schema_valid', action: 'retry_once' },
+    { check: 'no_pii_leaked', action: 'reject' },
   ],
 
   // Resource guardrails — prevent runaway cost/loops
   resource: [
-    { check: "max_tokens_per_session", limit: 100_000 },
-    { check: "max_tool_calls_per_session", limit: 50 },
-    { check: "max_cost_per_session_usd", limit: 1.0 },
+    { check: 'max_tokens_per_session', limit: 100_000 },
+    { check: 'max_tool_calls_per_session', limit: 50 },
+    { check: 'max_cost_per_session_usd', limit: 1.0 },
   ],
 };
 ```

package/.agent/skills/agentic-workflows-2026/SKILL.md

@@ -19,6 +19,7 @@ skills:
 ## Mandatory Pre-Flight Context Inspection
 
 Before designing autonomous agent loops:
+
 1. Tool Contract Validation → Enforce strict JSON Schema / Zod validation for every tool call
 2. Hard Execution Limit → Enforce a maximum iteration cap (max 10 turns) to prevent infinite loops
 3. Human-in-the-Loop Gate → Require human approval for destructive operations (file deletion, production deploy, DB writes)
@@ -44,9 +45,12 @@ export async function runAgentLoop(task: string, maxTurns = 10) {
     turn++;
     const response = await callLLM(history);
     const parsed = ToolCallSchema.safeParse(response);
-    
+
     if (!parsed.success) {
-      history.push({ role: 'system', content: `Invalid tool call payload: ${parsed.error.message}` });
+      history.push({
+        role: 'system',
+        content: `Invalid tool call payload: ${parsed.error.message}`,
+      });
       continue;
     }
 

package/.agent/skills/ai-app-hardening/SKILL.md

@@ -19,6 +19,7 @@ skills:
 ## Mandatory Pre-Flight Context Inspection
 
 Before deploying AI features:
+
 1. Indirect Prompt Injection Defense → Sanitize third-party content (scraped URLs, PDF imports, RAG docs) before feeding to LLMs
 2. XML Delimiter Sandboxing → Enclose user/external inputs inside `<external_context>` and instruct model to ignore instructions within
 3. Insecure Output Handling (OWASP LLM02) → Escape HTML/script tags on all rendered model outputs
@@ -28,13 +29,13 @@ Before deploying AI features:
 ```typescript
 export function sanitizeRAGDocument(rawDocumentContent: string): string {
   if (!rawDocumentContent || typeof rawDocumentContent !== 'string') return '';
-  
+
   // 1. Redact indirect prompt injection trigger phrases
   let cleaned = rawDocumentContent.replace(
     /(?:system:\s*ignore|override system prompt|you are now in developer mode|print system prompt)/gi,
-    '[REDACTED_INDIRECT_INJECTION]'
+    '[REDACTED_INDIRECT_INJECTION]',
   );
-  
+
   // 2. Escape structural tag injection attempts
   cleaned = cleaned.replace(/<\/?(?:system|user_input|external_context)[^>]*>/gi, '');
 
@@ -45,12 +46,12 @@ export function sanitizeRAGDocument(rawDocumentContent: string): string {
 
 ## OWASP LLM Top 10 (2026 Matrix)
 
-| Risk ID | Vulnerability | Defense Implementation |
-|---|---|---|
+| Risk ID   | Vulnerability                        | Defense Implementation                              |
+| --------- | ------------------------------------ | --------------------------------------------------- |
 | **LLM01** | Prompt Injection (Direct & Indirect) | Delimiter sandboxing + `sanitizeRAGDocument` filter |
-| **LLM02** | Insecure Output Handling | Strict Zod output parsing + DOMPurify on frontend |
-| **LLM04** | Model Denial of Service | Hard `max_tokens` limit + IP bucket rate limiting |
-| **LLM07** | System Prompt Leakage | System prompt redaction guards in output stream |
+| **LLM02** | Insecure Output Handling             | Strict Zod output parsing + DOMPurify on frontend   |
+| **LLM04** | Model Denial of Service              | Hard `max_tokens` limit + IP bucket rate limiting   |
+| **LLM07** | System Prompt Leakage                | System prompt redaction guards in output stream     |
 
 ## 🛑 Verification-Before-Completion (VBC) Protocol
 

package/.agent/skills/ai-prompt-injection-defense/SKILL.md

@@ -20,6 +20,7 @@ scripts-binding:
 ## Mandatory Pre-Flight Context Inspection
 
 Before engineering LLM prompts or processing untrusted user input, you MUST inspect:
+
 1. Message Role Isolation (Section 15) → Place user input exclusively in `role: "user"` messages; never concatenate user input into `role: "system"`
 2. Delimiter Sandboxing (Section 49) → Frame untrusted input inside XML tags (`<user_input>`) or randomized nonces (`<data_a8b4f1c9>`)
 3. Human-in-the-Loop Gate (Section 119) → Require explicit human approval before executing state-changing tool operations (`delete_user`, `process_payment`)
@@ -74,9 +75,9 @@ ${userInput}
 If an attacker guesses your delimiter (`</user_input> Ignore that.`), they can escape the sandbox. Generating random delimit tokens prevents this.
 
 ```typescript
-import crypto from "crypto";
+import crypto from 'crypto';
 
-const nonce = crypto.randomBytes(8).toString("hex"); // e.g., "a8b4f1c9"
+const nonce = crypto.randomBytes(8).toString('hex'); // e.g., "a8b4f1c9"
 const startTag = `<data_${nonce}>`;
 const endTag = `</data_${nonce}>`;
 
@@ -106,12 +107,12 @@ ${userInput}
 </text>`;
 
   const response = await scanWithFastModel(checkPrompt);
-  return response.trim().includes("MALICIOUS");
+  return response.trim().includes('MALICIOUS');
 }
 
 // Flow:
 if (await detectInjection(req.body.text)) {
-  return res.status(400).json({ error: "Input violates security policy." });
+  return res.status(400).json({ error: 'Input violates security policy.' });
 }
 // Proceed to main agent
 ```
@@ -136,8 +137,8 @@ If the LLM has tools (Function Calling):
 ```typescript
 // ❌ VULNERABLE TOOL DEFINITION
 const deleteUserTool = {
-  name: "delete_user",
-  description: "Deletes a user account from the DB",
+  name: 'delete_user',
+  description: 'Deletes a user account from the DB',
 }; // An injected prompt can trigger this autonomously
 
 // ✅ PREVENTATIVE ARCHITECTURE

package/.agent/skills/animation-on-scroll/SKILL.md

@@ -20,6 +20,7 @@ scripts-binding:
 ## Mandatory Pre-Flight Context Inspection
 
 Before implementing scroll-driven animations, you MUST inspect:
+
 1. Target browser support → Prefer pure CSS `animation-timeline: view()` / `scroll()` when possible
 2. Pinning & Scrubbing rules (Section 45) → Use `scrub: 1` in GSAP ScrollTrigger timelines for smooth inertia
 3. Anti-Scrolljacking rule (Section 88) → Never hijack native scroll wheel momentum or override browser scrolling velocity
@@ -31,6 +32,7 @@ Architect performant scroll-linked motion and scrollytelling sequences that feel
 ## 3 Scroll-Driven Architecture Patterns
 
 ### 1. Modern Pure CSS `view-timeline` (No JavaScript Required)
+
 ```css
 @keyframes reveal-on-scroll {
   from {
@@ -51,30 +53,37 @@ Architect performant scroll-linked motion and scrollytelling sequences that feel
 ```
 
 ### 2. Sticky Canvas / Section Pinned Storytelling (GSAP ScrollTrigger)
+
 ```javascript
-import { gsap } from "gsap";
-import { ScrollTrigger } from "gsap/ScrollTrigger";
+import { gsap } from 'gsap';
+import { ScrollTrigger } from 'gsap/ScrollTrigger';
 
 gsap.registerPlugin(ScrollTrigger);
 
-gsap.timeline({
-  scrollTrigger: {
-    trigger: ".story-container",
-    start: "top top",
-    end: "+=200%",
-    pin: true,
-    scrub: 1, // Smooth scrub delay
-  }
-})
-.to(".story-step-1", { opacity: 0, y: -20 })
-.from(".story-step-2", { opacity: 0, y: 20 });
+gsap
+  .timeline({
+    scrollTrigger: {
+      trigger: '.story-container',
+      start: 'top top',
+      end: '+=200%',
+      pin: true,
+      scrub: 1, // Smooth scrub delay
+    },
+  })
+  .to('.story-step-1', { opacity: 0, y: -20 })
+  .from('.story-step-2', { opacity: 0, y: 20 });
 ```
 
 ### 3. Scroll Progress Indicator Bar
+
 ```css
 @keyframes grow-progress {
-  from { transform: scaleX(0); }
-  to { transform: scaleX(1); }
+  from {
+    transform: scaleX(0);
+  }
+  to {
+    transform: scaleX(1);
+  }
 }
 
 .scroll-progress-bar {

package/.agent/skills/animation-systems/SKILL.md

@@ -20,6 +20,7 @@ scripts-binding:
 ## Mandatory Pre-Flight Context Inspection
 
 Before defining animation tokens or styling transitions, you MUST inspect:
+
 1. `index.css` / `DESIGN.md` → Verify presence of centralized `--duration-*` and `--ease-*` CSS custom properties
 2. Centralized Motion Tokens Schema (Section 26) → Enforce standardized duration tiers (80ms instant to 500ms delight)
 3. Anti-Ad-Hoc Easing Rule (Section 48) → Strictly prohibit inline custom cubic-bezier curves; reference motion tokens instead
@@ -35,18 +36,18 @@ Define standardized design tokens for motion in global CSS or Tailwind config:
 ```css
 :root {
   /* Duration Scale */
-  --duration-instant:  80ms;  /* Micro feedback, toggle switches */
-  --duration-fast:    150ms;  /* Tooltips, hover states, press feedback */
-  --duration-normal:  220ms;  /* Dropdowns, menus, tab switching */
-  --duration-slow:    320ms;  /* Modals, drawers, page reveals */
-  --duration-delight: 500ms;  /* Milestone celebrations, toasts */
+  --duration-instant: 80ms; /* Micro feedback, toggle switches */
+  --duration-fast: 150ms; /* Tooltips, hover states, press feedback */
+  --duration-normal: 220ms; /* Dropdowns, menus, tab switching */
+  --duration-slow: 320ms; /* Modals, drawers, page reveals */
+  --duration-delight: 500ms; /* Milestone celebrations, toasts */
 
   /* Standardized Easing Curves */
-  --ease-snappy:  cubic-bezier(0.2, 0, 0, 1);       /* Quick response for press/active */
-  --ease-out-ui:  cubic-bezier(0.16, 1, 0.3, 1);     /* Smooth entrance for popovers/modals */
-  --ease-in-ui:   cubic-bezier(0.7, 0, 0.84, 0);     /* Smooth exit for modals */
-  --ease-spring:  cubic-bezier(0.34, 1.56, 0.64, 1);/* Subtle spring overshoot */
-  --ease-in-out:  cubic-bezier(0.65, 0, 0.35, 1);    /* Morphing layout changes */
+  --ease-snappy: cubic-bezier(0.2, 0, 0, 1); /* Quick response for press/active */
+  --ease-out-ui: cubic-bezier(0.16, 1, 0.3, 1); /* Smooth entrance for popovers/modals */
+  --ease-in-ui: cubic-bezier(0.7, 0, 0.84, 0); /* Smooth exit for modals */
+  --ease-spring: cubic-bezier(0.34, 1.56, 0.64, 1); /* Subtle spring overshoot */
+  --ease-in-out: cubic-bezier(0.65, 0, 0.35, 1); /* Morphing layout changes */
 }
 ```
 

package/.agent/skills/antfu-conventions/SKILL.md

@@ -20,6 +20,7 @@ scripts-binding:
 ## Mandatory Pre-Flight Context Inspection
 
 Before configuring JS/TS tooling or lint rules, you MUST inspect:
+
 1. Pure ESM-First Requirement (Section 24) → Set `"type": "module"` in `package.json`; ban CommonJS `require()` or `module.exports`
 2. ESLint Flat Config (`eslint.config.js`) (Section 28) → Use `@antfu/eslint-config` with flat config format; ban legacy `.eslintrc.json`
 3. Explicit Type Imports (`import type`) (Section 45) → Enforce `import type` for type-only symbols to allow clean tree-shaking compilation
@@ -33,27 +34,31 @@ Enforce Anthony Fu's modern JavaScript/TypeScript engineering conventions: ESM-f
 ## 4 Core Tooling Conventions
 
 ### 1. ESM-First Standards
+
 - Use pure ES Modules (`"type": "module"` in `package.json`).
 - Avoid CommonJS `require()` or `module.exports`. Use explicit `.js` extension in relative imports when building Node ESM modules.
 
 ### 2. Single ESLint Flat Config (`eslint.config.js`)
+
 - Use `@antfu/eslint-config` for unified linting across TypeScript, Vue, React, JSON, and Markdown in 1 simple config file.
 
 ```javascript
 // eslint.config.js
-import antfu from '@antfu/eslint-config'
+import antfu from '@antfu/eslint-config';
 
 export default antfu({
   typescript: true,
   vue: true,
   react: true,
-})
+});
 ```
 
 ### 3. PNPM Catalog & Workspace Monorepo
+
 - Use `pnpm-workspace.yaml` with PNPM catalogs (`catalog:`) to lock unified dependency versions across monorepos.
 
 ### 4. Explicit Type Imports (`import type`)
+
 - Enforce `import type { User } from './types'` to allow tree-shaking compilers (esbuild/tsdown) to strip type imports cleanly without runtime side effects.
 
 ---

package/.agent/skills/api-patterns/SKILL.md

@@ -20,6 +20,7 @@ scripts-binding:
 ## Mandatory Pre-Flight Context Inspection
 
 Before designing or implementing API endpoints, you MUST inspect:
+
 1. Authorization Header Token Passing (Section 17) → Pass JWTs in `Authorization: Bearer` headers; strictly ban tokens in URL query params
 2. Cursor-Based Pagination (Section 19) → Use cursor pagination for datasets >10K rows to eliminate `OFFSET N` performance degradation
 3. Idempotency Header for Mutations (Section 21) → Require `Idempotency-Key` headers for state-changing `POST` or `PATCH` retry operations
@@ -108,7 +109,7 @@ interface ApiError {
 // GET /api/v1/posts?cursor=eyJpZCI6MTAwfQ&limit=20
 const posts = await db.post.findMany({
   where: { id: { lt: decodeCursor(req.query.cursor).id } },
-  orderBy: { id: "desc" },
+  orderBy: { id: 'desc' },
   take: limit + 1, // fetch one extra to determine hasMore
 });
 const hasMore = posts.length > limit;
@@ -126,15 +127,15 @@ return { data: posts, meta: { hasMore, nextCursor: encodeCursor(posts.at(-1)) }
 
 ```typescript
 // POST /api/v1/payments with header: Idempotency-Key: <uuid>
-app.post("/api/v1/payments", async (req, res) => {
-  const key = req.headers["idempotency-key"];
-  if (!key) return res.status(400).json({ error: "Missing Idempotency-Key" });
+app.post('/api/v1/payments', async (req, res) => {
+  const key = req.headers['idempotency-key'];
+  if (!key) return res.status(400).json({ error: 'Missing Idempotency-Key' });
 
   const cached = await redis.get(`idempotency:${key}`);
   if (cached) return res.status(200).json(JSON.parse(cached));
 
   const result = await processPayment(req.body);
-  await redis.set(`idempotency:${key}`, JSON.stringify(result), "EX", 86400);
+  await redis.set(`idempotency:${key}`, JSON.stringify(result), 'EX', 86400);
   return res.status(201).json(result);
 });
 // GET, PUT, DELETE → naturally idempotent (safe to retry without a key)
@@ -147,15 +148,18 @@ app.post("/api/v1/payments", async (req, res) => {
 
 ```typescript
 // HMAC signature verification (always verify — never trust unsigned webhooks)
-import { createHmac, timingSafeEqual } from "node:crypto";
+import { createHmac, timingSafeEqual } from 'node:crypto';
 function verify(payload: string, signature: string, secret: string): boolean {
-  const expected = createHmac("sha256", secret).update(payload).digest("hex");
+  const expected = createHmac('sha256', secret).update(payload).digest('hex');
   return timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
 }
 
-app.post("/webhooks", (req, res) => {
-  if (!verify(JSON.stringify(req.body), req.headers["x-webhook-signature"] as string, WEBHOOK_SECRET)) return res.status(401).send("Invalid signature");
-  res.status(200).send("OK"); // respond immediately
+app.post('/webhooks', (req, res) => {
+  if (
+    !verify(JSON.stringify(req.body), req.headers['x-webhook-signature'] as string, WEBHOOK_SECRET)
+  )
+    return res.status(401).send('Invalid signature');
+  res.status(200).send('OK'); // respond immediately
   processWebhookAsync(req.body); // process asynchronously
 });
 // Retry policy: 3 retries with exponential backoff (1s → 10s → 100s)

package/.agent/skills/api-security-auditor/SKILL.md

@@ -20,6 +20,7 @@ scripts-binding:
 ## Mandatory Pre-Flight Context Inspection
 
 Before auditing or hardening API endpoints, you MUST inspect:
+
 1. IDOR Prevention (Section 17) → Perform explicit tenancy checks (`receipt.userId === req.user.id`) and prefer UUIDv4/CUID over sequential integer IDs
 2. Mass Assignment Mitigations (Section 47) → Enforce strict Zod schemas (`.strict()`) to prevent parameter overposting into DB updates
 3. Distributed Rate Limiting (Section 80) → Store rate limit state in Redis for multi-pod load balanced environments to prevent limit bypasses
@@ -34,19 +35,19 @@ IDOR occurs when an application provides direct access to objects based on user-
 
 ```typescript
 // ❌ VULNERABLE: Trusting the requested ID blindly
-app.get("/api/receipts/:id", async (req, res) => {
+app.get('/api/receipts/:id', async (req, res) => {
   const receipt = await db.receipts.findById(req.params.id);
   res.json(receipt); // Attack: Increment ID to view others' receipts
 });
 
 // ✅ SAFE: Verifying ownership
-app.get("/api/receipts/:id", async (req, res) => {
+app.get('/api/receipts/:id', async (req, res) => {
   const receipt = await db.receipts.findById(req.params.id);
   if (!receipt) return res.status(404).send();
 
   // Explicit tenancy check
-  if (receipt.userId !== req.user.id && req.user.role !== "admin") {
-    return res.status(403).json({ error: "Access denied" });
+  if (receipt.userId !== req.user.id && req.user.role !== 'admin') {
+    return res.status(403).json({ error: 'Access denied' });
   }
 
   res.json(receipt);
@@ -64,20 +65,20 @@ Occurs when web frameworks automatically bind HTTP request parameters to applica
 
 ```typescript
 // ❌ VULNERABLE: Direct object binding
-app.put("/api/users/:id", async (req, res) => {
+app.put('/api/users/:id', async (req, res) => {
   // Attack: req.body = { name: "Bob", role: "admin", isPaid: true }
   await db.users.update({ id: req.params.id }, req.body);
-  res.send("Updated");
+  res.send('Updated');
 });
 
 // ✅ SAFE: Explicit property selection (DTOs)
-app.put("/api/users/:id", async (req, res) => {
+app.put('/api/users/:id', async (req, res) => {
   // Only extract explicitly allowed fields
   const { name, email, bio } = req.body;
   const safeData = { name, email, bio };
 
   await db.users.update({ id: req.params.id }, safeData);
-  res.send("Updated");
+  res.send('Updated');
 });
 
 // ✅ BEST: Validation libraries (Zod, Joi) handling stripping
@@ -95,8 +96,8 @@ const UpdateUserSchema = z
 
 ```typescript
 // Basic Rate Limiting (Express)
-import rateLimit from "express-rate-limit";
-import RedisStore from "rate-limit-redis";
+import rateLimit from 'express-rate-limit';
+import RedisStore from 'rate-limit-redis';
 
 // Global baseline limit
 export const globalLimiter = rateLimit({
@@ -111,7 +112,7 @@ export const authLimiter = rateLimit({
   store: new RedisStore({ client: redisClient }),
   windowMs: 60 * 60 * 1000, // 1 Hour
   max: 5, // 5 login attempts per IP per hour
-  message: "Too many login attempts, please try again later",
+  message: 'Too many login attempts, please try again later',
 });
 
 // ❌ HALLUCINATION TRAP: In-memory rate limiting across multiple server pods
@@ -144,8 +145,8 @@ Best Practices for issuance and storage:
 
 // 1. Query Depth Limiting (Prevent nested joins crushing the DB)
 // User -> Posts -> Comments -> Author -> Posts -> Comments...
-import depthLimit from "graphql-depth-limit";
-app.use("/graphql", graphqlHTTP({ validationRules: [depthLimit(5)] }));
+import depthLimit from 'graphql-depth-limit';
+app.use('/graphql', graphqlHTTP({ validationRules: [depthLimit(5)] }));
 
 // 2. Query Cost Analysis
 // Prevent attackers from requesting 100,000 items in a single query
@@ -155,7 +156,7 @@ app.use("/graphql", graphqlHTTP({ validationRules: [depthLimit(5)] }));
 // Introspection allows attackers to download your entire schema.
 const server = new ApolloServer({
   schema,
-  introspection: process.env.NODE_ENV !== "production",
+  introspection: process.env.NODE_ENV !== 'production',
 });
 ```
 

package/.agent/skills/app-builder/SKILL.md

@@ -20,6 +20,7 @@ scripts-binding:
 ## Mandatory Pre-Flight Context Inspection
 
 Before scaffolding or orchestrating application builds, you MUST inspect:
+
 1. Clarification Gate (Section 48) → Ask 4 core purpose/constraint questions before selecting stack or creating files
 2. Plan Verification (Section 220) → Ensure `{task-slug}.md` is created and verified in project root before invoking specialist agents
 3. Incremental Build Rule (Section 15) → Never generate entire applications in one shot; build and verify module by module

package/.agent/skills/app-builder/templates/nextjs-fullstack/TEMPLATE.md

@@ -93,11 +93,11 @@ project-name/
    Ensure `src/app/globals.css` uses the new import syntax instead of a config file:
 
    ```css
-   @import "tailwindcss";
+   @import 'tailwindcss';
 
    @theme {
      --color-primary: oklch(0.5 0.2 240);
-     --font-sans: "Inter", sans-serif;
+     --font-sans: 'Inter', sans-serif;
    }
    ```
 

package/.agent/skills/app-builder/templates/nextjs-saas/TEMPLATE.md

@@ -104,7 +104,7 @@ project-name/
 3. Install Tailwind v4 (Add to globals.css):
 
    ```css
-   @import "tailwindcss";
+   @import 'tailwindcss';
    ```
 
 4. Configure environment (.env.local)

package/.agent/skills/app-builder/templates/nextjs-static/TEMPLATE.md

@@ -52,10 +52,10 @@ Using `next.config.ts` instead of `.js` for better type safety.
 
 ```typescript
 // next.config.ts
-import type { NextConfig } from "next";
+import type { NextConfig } from 'next';
 
 const nextConfig: NextConfig = {
-  output: "export", // Required for Static Hosting (S3, GitHub Pages)
+  output: 'export', // Required for Static Hosting (S3, GitHub Pages)
   images: {
     unoptimized: true, // Required if not using Node.js server image optimization
   },
@@ -74,19 +74,19 @@ Deprecated next-seo. Configure directly in layout.tsx or page.tsx.
 
 ```typescript
 // src/app/layout.tsx
-import type { Metadata } from "next";
+import type { Metadata } from 'next';
 
 export const metadata: Metadata = {
   title: {
-    template: "%s | Product Name",
-    default: "Home - Product Name",
+    template: '%s | Product Name',
+    default: 'Home - Product Name',
   },
-  description: "SEO optimized description for the landing page.",
+  description: 'SEO optimized description for the landing page.',
   openGraph: {
-    type: "website",
-    locale: "en_US",
-    url: "https://mysite.com",
-    siteName: "My Brand",
+    type: 'website',
+    locale: 'en_US',
+    url: 'https://mysite.com',
+    siteName: 'My Brand',
   },
 };
 ```
@@ -138,11 +138,11 @@ export const metadata: Metadata = {
 3. Configure Tailwind v4 (in `src/app/globals.css`):
 
    ```css
-   @import "tailwindcss";
+   @import 'tailwindcss';
 
    @theme {
      --color-primary: #3b82f6;
-     --font-sans: "Inter", sans-serif;
+     --font-sans: 'Inter', sans-serif;
    }
    ```