{"sigil":1,"generatedAt":"2026-11-02T09:56:46.382Z","commit":"5cb851d5b2f2f14446ddf631ef5e91bf9d3263dd","capabilities":[{"manifest":{"sigil":1,"id":"ai-sdk/tools-and-structured-output","type":"skill","version":"1.0.0","name":"AI SDK 7 Tools and Structured Output","summary":"Correct Vercel AI SDK 7 tool calling, multi-step loops, agents and structured output, with the v4-v6 habits that silently break and mock-model tests.","description":"Teaches an agent the current Vercel AI SDK (the `ai` package, version 7) for tools, tool loops, ToolLoopAgent, conversation persistence and structured output. It centres on the old forms that no longer fail loudly in 7.x: `parameters` sends the model an empty schema, `maxSteps` and a missing `stopWhen` stop after one step, `maxTokens` is ignored, `experimental_context` is gone, system messages inside `messages` now throw, and `result.response.messages` holds only the final step. Each rule was checked by running it against ai@7.0.159. It also covers testing with `MockLanguageModelV4` from `ai/test`, so the agent proves the behaviour without a provider.","domains":["ai-engineering","backend","testing"],"industries":[],"lifecycle":["build","test","maintain"],"technologies":["ai-sdk","typescript","zod","nodejs"],"license":"MIT","authors":[{"github":"dgesteves"}],"maintainers":[],"payload":{"format":"agent-skill","entry":"SKILL.md"},"targets":["claude-code","codex","cursor","github-copilot","gemini-cli","opencode"],"permissions":{"network":[],"shell":["npx tsc","node --test","npm test","grep"],"filesystem":"write","env":[]},"proof":{"suites":["ai-sdk-tools"]},"includes":[],"limitations":["Written for ai 7.x (checked against 7.0.159). Projects on AI SDK 5 or 6 should use the migration table to tell which names apply; v3 and older are not covered.","Covers AI SDK Core (generateText, streamText, ToolLoopAgent, Output). AI SDK UI hooks (useChat), RSC, WorkflowAgent, MCP clients and provider-specific options are out of scope.","Provider behaviour (which models support strict schemas, parallel tool calls or approvals) varies; the skill states SDK behaviour only, verified with the SDK mock model, not with live providers.","The proof suite exercises Node with node:test and the SDK's mock model; it does not test streaming UIs or real network providers."]},"digest":"sha256:2190167c9b043b9f9fd7ddde040cb28ee133721226392137f0969d72fc89b7e5","path":"catalog/skills/ai-sdk/tools-and-structured-output","level":"submitted","uplift":"untested","files":[{"path":"SKILL.md","sha256":"2aa02667dbc0a2f3f1d99818ceb6f00d863673d67df8eb981cfcf583b686aa34","bytes":13863},{"path":"references/agents-and-context.md","sha256":"d430abfb82a1820e0923cc5d004ff502f35758115ec397310a976b77c1f1300a","bytes":6686},{"path":"references/migration-v4-to-v7.md","sha256":"4db07e44d398079f31c6ff31f88db798b273d531e405afb539427e8796e8cbec","bytes":7433},{"path":"references/sources.md","sha256":"21412746599e7c4ffbcd626346b315b7d712b394624b2cdc2dc6b99ff08f488b","bytes":1913},{"path":"references/structured-output.md","sha256":"7edf18676208fc08c9f4df987e812bd8e928167fdfa57226e6e36771c40f2852","bytes":3803},{"path":"references/testing.md","sha256":"3a78d2ee824e6ca2339bfc8e064a3d6e37cc9feadab739f4329de95ce826410a","bytes":4678}]},{"manifest":{"sigil":1,"id":"angular/angular-22","type":"skill","version":"1.0.0","name":"Angular 22 Signals, Zoneless and Resources","summary":"Angular 21-22 as it runs now - zoneless and OnPush by default, signal component APIs, resource/httpResource, control flow and Vitest tests.","description":"Teaches an agent the Angular that ships today (checked against @angular/core 22.2.4 and the CLI's Vitest runner) instead of the Angular 14-19 most training data describes. It covers what refreshes a view without zone.js and with v22's OnPush default (and why zone.run, in-place array mutation and detectChanges leave screens stale), signal inputs with transforms and aliases, model() and output(), signal queries, computed and linkedSignal instead of effect-driven state, the v20+ resource, rxResource and httpResource API (params and stream, string statuses, value() throwing in the error state, cancellation, chaining), built-in control flow and track keys, inject() and @Service, fetch as the default HttpClient backend, TestBed tests without fakeAsync (Vitest timers, whenStable, HTTP testing without deadlocks), and an upgrade checklist with the official schematics. Every behaviour claim was run on 22.2.4.","domains":["frontend","migration","testing"],"industries":[],"lifecycle":["build","maintain","test"],"technologies":["angular","typescript","vitest"],"license":"MIT","authors":[{"github":"dgesteves"}],"maintainers":[],"payload":{"format":"agent-skill","entry":"SKILL.md"},"targets":["claude-code","codex","cursor","github-copilot","gemini-cli","opencode"],"permissions":{"network":["registry.npmjs.org"],"shell":["npm ls","rg","ng update","ng generate","ng test"],"filesystem":"write","env":[]},"proof":{"suites":["angular-22"]},"includes":[],"limitations":["Written and verified against @angular/core 22.2.4 and @angular/cli 22.2.5. Angular ships a major every six months; check the CHANGELOG when the installed version is newer.","The proof suite runs TestBed in jsdom through ng test, so it measures change detection, signals, resources and HttpClient behaviour, not real-browser rendering, SSR or hydration.","Signal forms (stable in 22), @defer, SSR and hydration, animations, the router and Angular Material are only mentioned; they are not taught in depth or measured.","debounced() and resourceFromSnapshots are experimental in 22; their guidance may change in later minors.","Apps that still load zone.js (provideZoneChangeDetection) behave differently; the skill only covers how to leave that mode."]},"digest":"sha256:b87fb3c783f7c58c4240c81e9e8354bb2ad79073499f04f299fcc7a27ca2892b","path":"catalog/skills/angular/angular-22","level":"submitted","uplift":"untested","files":[{"path":"SKILL.md","sha256":"55649bba94b1f075ccaebea3701f4cb35ff0cfff9441a3244b77780aa107e465","bytes":18071},{"path":"references/change-detection.md","sha256":"7682c36cdce1e13add3c555409ee77ade647f7527c26607061c9bb4db4b65729","bytes":7083},{"path":"references/migration.md","sha256":"5950f3a19897b480a028a6ee2812051db921e6c2f7f34ff396aec2b698e661d0","bytes":7170},{"path":"references/resources.md","sha256":"31c014d0a0fa126325bc4449c6439b3f8ed0e89d80c3573b93b2f6b92933b50e","bytes":7119},{"path":"references/sources.md","sha256":"157291ceffc996e90f4545ce127890c65d6a538f20499fd6a7db6f1f12c6b324","bytes":4407}]},{"manifest":{"sigil":1,"id":"aspnet-core/minimal-apis","type":"skill","version":"1.0.0","name":"ASP.NET Core Minimal APIs on .NET 10","summary":"Validation, problem details, deny-by-default auth and cookie 401s for ASP.NET Core minimal APIs on .NET 10, measured on 10.0.14.","description":"Teaches an agent the current ASP.NET Core minimal API stack on .NET 10 (10.0.14 LTS, SDK 10.0.403) and the .NET 6-8 habits that quietly misbehave on it: built-in validation with AddValidation (and that DataAnnotations do nothing without it), nested and collection error paths with PascalCase keys, IValidatableObject running only after property rules pass, the per-assembly source generator that silently skips endpoints and types in feature-module class libraries, Validator.TryValidateObject ignoring record parameter attributes, TypedResults unions, RFC 9457 problem details and exception handling that never leaks internals, fallback authorization policies, the .NET 10 cookie change that returns 401/403 only for endpoints it recognises as APIs (Results.*, strings and text results still redirect), antiforgery for form endpoints, and WebApplicationFactory tests with xunit v3 on Microsoft.Testing.Platform. Every behavioural claim marked measured was run on 10.0.14.","domains":["backend","api-design","security"],"industries":[],"lifecycle":["build","secure","test"],"technologies":["aspnet-core","dotnet","csharp"],"license":"MIT","authors":[{"github":"dgesteves"}],"maintainers":[],"payload":{"format":"agent-skill","entry":"SKILL.md"},"targets":["claude-code","codex","cursor","github-copilot","gemini-cli","opencode"],"permissions":{"network":[],"shell":["dotnet","grep"],"filesystem":"write","env":[]},"proof":{"suites":["aspnet-minimal-apis"]},"includes":[],"limitations":["Written and measured against .NET 10.0.14 (SDK 10.0.403). .NET 11 changes validation (async rules, localization, non-experimental attributes) and is not covered.","Covers minimal APIs. MVC controllers, Razor Pages and Blazor forms validate differently and are only mentioned where behaviour is shared.","Authentication coverage is cookie-centred; JWT bearer, OpenID Connect and ASP.NET Core Identity endpoints get short notes only.","OpenAPI document generation, rate limiting, output caching and Native AOT are out of scope.","The proof suite runs through TestServer, so it measures HTTP behaviour but not Kestrel-specific limits, HTTPS or reverse-proxy headers."]},"digest":"sha256:f4b0f790e7f6b2605a157c2c4870e6e02fd198a96d17082d1190c64a053eba8b","path":"catalog/skills/aspnet-core/minimal-apis","level":"submitted","uplift":"untested","files":[{"path":"SKILL.md","sha256":"2aed9c944db36e4def4cc6317154b1ca4ecaeb16fe5bda67cf49b29e0181440b","bytes":14623},{"path":"references/auth.md","sha256":"0f654a7a6bca633bb56c97904058296a11dedb68dfa2e1130481788e91b9727a","bytes":5839},{"path":"references/errors-and-results.md","sha256":"152e5c7cd49eb91823e6fa0e9c3fb283e2954d6fea246826e8b496dad75819c0","bytes":4449},{"path":"references/sources.md","sha256":"85592d085e4126a6b897a98231d21955bbc221e6fdf72ac9ae334f5b0b54ed82","bytes":6266},{"path":"references/testing.md","sha256":"9624813be99f53167af4643cafd2c357922d7999ccd89620f5ba3f149f6d8b4d","bytes":3405},{"path":"references/validation.md","sha256":"56ad5e80b2bfde14fe803f060c5b7eaf46645994a3b273413e2b861c64e61136","bytes":6881}]},{"manifest":{"sigil":1,"id":"axum/axum-0-8","type":"skill","version":"1.0.0","name":"axum 0.8 Services","summary":"Rust HTTP services on axum 0.8 that keep body limits, JSON errors, cancellation and shutdown right, plus the 0.7 to 0.8 upgrade.","description":"Current knowledge for axum 0.8.9 on tokio 1.54, hyper 1.12 and tower-http 0.7: the 0.7 to 0.8 changes ({id} paths, native async extractors, OptionalFromRequestParts, moved and removed APIs) and, above all, the behaviours that never fail a build: the 2 MB DefaultBodyLimit that RequestBodyLimitLayer cannot raise, raw Body extractors with no limit, plain-text 400/413/415/422 rejections that bypass the app's error type, layers that skip later routes, Query and repeated keys, handler futures dropped on client disconnect or timeout so cleanup after .await never runs, and graceful shutdown that waits forever. Includes one error type for every failure path that never leaks internals, per-key limits with Drop guards, SIGTERM-aware shutdown with a drain deadline, and in-process tests for all of it. Every behaviour claim was reproduced on axum 0.8.9.","domains":["backend","security","migration"],"industries":[],"lifecycle":["build","maintain","operate"],"technologies":["rust","axum","tokio"],"license":"MIT","authors":[{"github":"dgesteves"}],"maintainers":[],"payload":{"format":"agent-skill","entry":"SKILL.md"},"targets":["claude-code","codex","cursor","github-copilot","gemini-cli","opencode"],"permissions":{"network":[],"shell":["cargo","rg"],"filesystem":"write","env":[]},"proof":{"suites":["axum-0-8"]},"includes":[],"limitations":["Written and verified against axum 0.8.9, tower-http 0.7.1, tokio 1.54.1 and hyper 1.12.0. The unreleased axum main branch already changes serve's output type and timeouts; check the CHANGELOG when a 0.9 ships.","Covers HTTP/1.1 and JSON APIs. WebSockets, SSE, gRPC (tonic) and multipart parsing are mentioned only where limits or shutdown affect them.","Does not cover authentication libraries, OpenAPI generation, database pools or tracing setup beyond logging errors.","The proof suite runs handlers in-process with tower's oneshot; client disconnects are simulated by dropping the request future, which matches what hyper does but is not a real socket test.","Rejection message texts are quoted from 0.8.9 and may change in patch releases; the status codes are part of axum's documented behaviour."]},"digest":"sha256:929be0945b9a260f7770395c7e296cdc53946f0416402f7f709a4a3726097ce9","path":"catalog/skills/axum/axum-0-8","level":"submitted","uplift":"untested","files":[{"path":"SKILL.md","sha256":"5581b496a54de313f4797bba45b65f61da32dbbcc726c27d48db71676d2c9c01","bytes":20621},{"path":"references/errors-and-rejections.md","sha256":"46d844c8989aa8341018e215821b931a3983bc2c8e4963efea9ef503dde4b010","bytes":6218},{"path":"references/limits-timeouts-cancellation.md","sha256":"a7700fb8363eebfee7f733e0b2752b1752969bcda7f1afb3f7a444a5dc979cae","bytes":6867},{"path":"references/migration-0-7-to-0-8.md","sha256":"e5d2f801c2f37c6cf0b226918347e061c735fd4350792a79b52376e42b46efc5","bytes":4452},{"path":"references/sources.md","sha256":"9dbeadad5cbf0216036ff77eb6edb480838c03eb2bfb5ee42636a6d8cd46eb8f","bytes":5260},{"path":"references/testing.md","sha256":"a1a2d9170f4914981652328becbae0009fd4145ffa34f8fcbaaead8cdf410f9a","bytes":4117}]},{"manifest":{"sigil":1,"id":"express/express-5","type":"skill","version":"1.0.0","name":"Express 5","summary":"Write, upgrade and harden Express 5.x APIs, including the route syntax and the silent 4-to-5 changes that still return 200.","description":"Current knowledge for Express 5.3: path-to-regexp 8 route syntax (named wildcards, optional groups), the breaking changes that throw and the ones that silently change responses (res.send(status), res.json(obj, status), res.redirect('back'), the req.query getter and simple parser, urlencoded extended=false, req.body undefined), async error forwarding, JSON error handlers that never leak internals, and production defaults. Includes a grep-driven migration checklist from Express 4.","domains":["backend","security","migration"],"industries":[],"lifecycle":["build","maintain","secure"],"technologies":["express","nodejs","javascript","typescript"],"license":"MIT","authors":[{"github":"dgesteves"}],"maintainers":[],"payload":{"format":"agent-skill","entry":"SKILL.md"},"targets":["claude-code","codex","cursor","github-copilot","gemini-cli","opencode"],"permissions":{"network":[],"shell":["grep","npm ls","npm test","node"],"filesystem":"write","env":[]},"proof":{"suites":["express-5"]},"includes":[],"limitations":["Written and checked against express@5.3.0 (router 2.2, path-to-regexp 8.4, body-parser 2.4). Later 5.x releases may change details such as defaults or MIME types.","Covers Express itself. Third-party middleware (sessions, auth, rate limiting, helmet) is mentioned only where it interacts with Express 5 behaviour.","The migration greps are line-based and can miss calls split across lines; they narrow the search but do not replace reading the code.","Does not cover the view/template layer beyond noting that res.render is always asynchronous."]},"digest":"sha256:91ae74e545bb8ced5c0176e651577596d46ccab2b1b04bf3e1824b37d12c6b5d","path":"catalog/skills/express/express-5","level":"submitted","uplift":"untested","files":[{"path":"SKILL.md","sha256":"1a9de0c259f83a8c66aed831e8a0736393db1499c767d15ed62c99b2d4e3809a","bytes":17339},{"path":"references/errors-and-hardening.md","sha256":"495a6a43aa6e5e2717e278fe1bfa92a6f266da93ef758ecc3f0286ea2b620267","bytes":8746},{"path":"references/migration-checklist.md","sha256":"57dbfe41d195c3cf2fe1cb01c607e29453ff6d94b1546f47387ae687cb3c9654","bytes":7853},{"path":"references/routing.md","sha256":"be3bd2526ca2fe528199cf69c3787056c30abd9fa4ac746b2352a78c9059b8ac","bytes":5015},{"path":"references/sources.md","sha256":"61a0ea2c55b13d788fcdaa2d13a2aa50f13a23bd602ccb67c23d0cf0da58e947","bytes":1617}]},{"manifest":{"sigil":1,"id":"github-actions/workflow-hardening","type":"skill","version":"1.0.0","name":"GitHub Actions Workflow Hardening","summary":"Secure GitHub Actions workflows as they work in late 2026, from script injection and pwn requests to SHA pins and tokenless npm publishing.","description":"Teaches an agent to write and fix GitHub Actions workflows that hold credentials safely: no untrusted text expanded into shell or github-script code, no pull request code in pull_request_target or workflow_run jobs (including the right fix when actions/checkout v7 refuses fork checkouts), least-privilege GITHUB_TOKEN permissions, actions pinned to real commit SHAs on current majors, and OIDC instead of stored secrets, including npm trusted publishing with its npm 11.5.1, runner and repository.url requirements. Includes the platform changes of 2025-2026 that models trained earlier get wrong.","domains":["devops","security"],"industries":[],"lifecycle":["secure","ship","review"],"technologies":["github-actions","npm","oauth","ci-cd"],"license":"MIT","authors":[{"github":"dgesteves"}],"maintainers":[],"payload":{"format":"agent-skill","entry":"SKILL.md"},"targets":["claude-code","codex","cursor","github-copilot","gemini-cli","opencode"],"permissions":{"network":["github.com","api.github.com"],"shell":["git ls-remote","gh api","zizmor","actionlint"],"filesystem":"write","env":[]},"proof":{"suites":["github-actions-hardening"]},"includes":[],"limitations":["Written for github.com as of November 2026. GitHub Enterprise Server lags behind (artifact actions v4+, checkout v7 and workflow lockfiles may be missing).","Commit SHAs in the references were resolved on 2026-11-01. Pinning newer releases needs network access to github.com, or an existing pin in the repo.","It does not audit the code inside third-party or composite actions; a pinned malicious action is still malicious.","Cloud OIDC guidance covers the AWS, Google Cloud and Azure login actions, not the design of the cloud-side IAM policies.","The proof suite measures script injection, fork pull request checkouts and npm trusted publishing. Cloud OIDC, caching and reusable workflows are not measured."]},"digest":"sha256:d6ba5f8e1c111d67930f51512aacdcb2822f2b19ba4fbe87347ed905c8ff6118","path":"catalog/skills/github-actions/workflow-hardening","level":"submitted","uplift":"untested","files":[{"path":"SKILL.md","sha256":"9acb8090820c735c432adf7ed7e1cee65c2ecf7a6202f9a14882e7f056a5dbcd","bytes":17498},{"path":"references/injection.md","sha256":"171e948c30bcf887b118d107a9772abd0282ef631082a66baf4d09b992251213","bytes":4345},{"path":"references/npm-trusted-publishing.md","sha256":"ddbd0878560b3e3832d62d87b47ab0837cbc1f94e0791a64908edbe9e64a49dd","bytes":5278},{"path":"references/oidc-clouds.md","sha256":"35f41af7caf30cb105b7e5d64d4d816debd07b6d9aaabab3e050c6513f6dfd42","bytes":2581},{"path":"references/pinning.md","sha256":"47b9bcb8751494e273d0c7c722cc88120980163c5492a1347b76abe47b92a0ea","bytes":3467},{"path":"references/privileged-triggers.md","sha256":"3771358a4f2d27b3c0556919484655c0c8056af184199928705edb0615511f85","bytes":6609},{"path":"references/sources.md","sha256":"9dc042087056e131ada0f52cbae1bf3baa390c3bec06b15dd1ff89bb5faa7ccc","bytes":3152}]},{"manifest":{"sigil":1,"id":"kubernetes/workload-hardening","type":"skill","version":"1.0.0","name":"Kubernetes Workload Hardening","summary":"Production Kubernetes 1.34-1.37 workloads that pass Pod Security restricted, really start, shut down cleanly and survive drains.","description":"Teaches an agent to write and fix Deployment, StatefulSet, Job and CronJob manifests as Kubernetes works in late 2026 (1.37): the Pod Security Standards restricted profile control by control on every init, sidecar and ephemeral container, seccompProfile instead of the removed annotations, the kubelet's runAsNonRoot check that rejects images whose USER is a name or unset, read-only root filesystems with emptyDir scratch space, probes that do not cascade, preStop delays that work in distroless images (the sleep action, GA 1.34) with grace periods that cover them, PodDisruptionBudgets that let drains finish (maxUnavailable and unhealthyPodEvictionPolicy, GA 1.31), HPA autoscaling/v2 with requests on every container, topology spread, native sidecars for Jobs (GA 1.33) and the API versions 1.37 no longer serves. Rules were ported from the v1.37.2 source and reproduced on a 1.37 cluster.","domains":["devops","security","platform-engineering","cloud"],"industries":[],"lifecycle":["build","secure","ship","operate"],"technologies":["kubernetes","docker"],"license":"MIT","authors":[{"github":"dgesteves"}],"maintainers":[],"payload":{"format":"agent-skill","entry":"SKILL.md"},"targets":["claude-code","codex","cursor","github-copilot","gemini-cli","opencode"],"permissions":{"network":[],"shell":["kubectl","kubeconform","docker image inspect"],"filesystem":"write","env":[]},"proof":{"suites":["kubernetes-workload-hardening"]},"includes":[],"limitations":["Written for upstream Kubernetes 1.34 to 1.37 as of November 2026. Managed platforms can add admission policies (GKE Autopilot, OpenShift SCCs, Kyverno or Gatekeeper rules) that are stricter than Pod Security Admission.","Plain manifests only. Helm charts and Kustomize overlays are covered only through the YAML they render.","The kubelet runAsNonRoot and preStop behaviour was measured with containerd (k3s v1.37.1); CRI-O and Windows nodes were not tested.","Endpoint propagation delays depend on the ingress controller, kube-proxy mode and cloud load balancer; the skill gives the budget arithmetic, not the right number for a given cluster.","The proof suite measures Pod Security restricted plus image users, PDB and HPA behaviour, and shutdown in a distroless image. Topology spread, probes and Job sidecars are taught but not scored."]},"digest":"sha256:4a77fdb5b1a20dfd6084910135199031a01b569bef6c8910c4c80e4e6dd1aa89","path":"catalog/skills/kubernetes/workload-hardening","level":"submitted","uplift":"untested","files":[{"path":"SKILL.md","sha256":"691fb58e8b4a4f4d19dad58fad4ae3607cc62340a662aa2eddbbba90296960f5","bytes":18891},{"path":"references/api-versions.md","sha256":"50a88b8231febdf311ccc87970f5400986274caac135606ddafea69af2b4a924","bytes":4321},{"path":"references/availability.md","sha256":"85b3d17400816c03c6057751939eec93472f0487fb30f29193ab1e649ac13e09","bytes":5934},{"path":"references/pod-security-restricted.md","sha256":"17fed1efdb6c52774b4f7efc4638aae1da214a0cdead2b836fae527f7dff735a","bytes":6395},{"path":"references/shutdown-and-probes.md","sha256":"efa33e2188787eb1511b624c9fb9b4fe177f71235a16b578a377da6c4cc5a4ec","bytes":5186},{"path":"references/sidecars-and-jobs.md","sha256":"c5bbb5d10fea02da3eb0b196621a081c480d53326da6dfaf2e1ffa3f2e93e9bd","bytes":3793},{"path":"references/sources.md","sha256":"bfec8be1f615aecfed33a99a1d1e06a1938798ecd3e73e9f5a32d5c00661ab2c","bytes":7088}]},{"manifest":{"sigil":1,"id":"mcp/typescript-server","type":"skill","version":"1.0.0","name":"MCP Servers in TypeScript (SDK v2)","summary":"Build, test and port MCP servers on the v2 TypeScript SDK and the 2026-07-28 protocol, without the v1-era mistakes agents usually make.","description":"Current, verified guidance for Model Context Protocol servers written with the official TypeScript SDK v2 (@modelcontextprotocol/server 2.x, zod 4). It covers tool registration and schemas, structured output that passes the SDK's own validation, choosing between isError results and protocol errors, resource templates that actually list, prompts, progress and cancellation through ctx.mcpReq, serving both protocol eras with serveStdio or createMcpHandler, stdout hygiene on stdio, and a symptom-driven map for porting @modelcontextprotocol/sdk 1.x code. Each claim was checked against the installed 2.4.0 packages and the 2026-07-28 specification.","domains":["ai-engineering","backend"],"industries":[],"lifecycle":["build","test"],"technologies":["mcp","typescript","nodejs","zod"],"license":"MIT","authors":[{"github":"dgesteves"}],"maintainers":[],"payload":{"format":"agent-skill","entry":"SKILL.md"},"targets":["claude-code","codex","cursor","github-copilot","gemini-cli","opencode"],"permissions":{"network":[],"shell":["node","npm test","npm run typecheck","npx tsc"],"filesystem":"write","env":[]},"proof":{"suites":["mcp-typescript-server"]},"includes":[],"limitations":["Written for @modelcontextprotocol/server 2.4.x and protocol revision 2026-07-28; later 2.x releases may rename or add APIs.","Covers TypeScript servers. Client and host development, OAuth authorization servers and the Python SDK are only touched where a server needs them.","Streamable HTTP guidance is lighter than stdio and was checked with node:http only, not every framework adapter.","Multi-round-trip input (inputRequired), subscriptions and tasks are named but not taught in depth.","The proof suite exercises stdio servers only; HTTP deployment advice is not measured by it."]},"digest":"sha256:ed7e852bc97dfcc567810803d706d5657d667fe818c9bb6aeb786081da4b945c","path":"catalog/skills/mcp/typescript-server","level":"submitted","uplift":"untested","files":[{"path":"SKILL.md","sha256":"689b77856585206fdcd2e1c2ade55729442a26f3b7c7a8185373eda278590e08","bytes":17067},{"path":"references/http-and-eras.md","sha256":"a963576d7769bd2e493dc1fc207d9f3bd1eb29ae1b71e64e828a404d7a4ed279","bytes":5715},{"path":"references/sources.md","sha256":"d8586fbe893dcdd58e85ca988eac1e6b3c528c36abb24f7ec2a1d2922e5c304e","bytes":2925},{"path":"references/testing.md","sha256":"c5eba7a997c62e580d2923b8e08fbaa79a9ce27aac9bcf5972e89441520b0be8","bytes":6099},{"path":"references/v1-to-v2.md","sha256":"17065ccf35cc625ed22cae395d5e1a719a5d988d3d2773ac7c33fc8efb634b33","bytes":6565}]},{"manifest":{"sigil":1,"id":"nextjs/next-16","type":"skill","version":"1.0.0","name":"Next.js 16 App Router","summary":"Next.js 16 as it behaves today - Cache Components, the right invalidation call, proxy.ts, safe server actions and 15 to 16 upgrades.","description":"Teaches an agent the Next.js 16 App Router as measured on next 16.4.3 with next build and next start. It concentrates on what agents trained on Next 13-15 get wrong: the Cache Components model (cacheComponents with partialPrefetching, 'use cache', cacheLife, cacheTag, Suspense and the prerender build errors, removed segment configs), choosing updateTag, revalidateTag with a profile, revalidatePath or refresh by what the next request must show (revalidateTag 'max' serves one stale response, updateTag throws outside Server Actions), the 15 to 16 changes that build but misbehave (sync params, sitemap ids as Promises, images.qualities defaulting to 75, revalidateTag semantics), middleware renamed to a Node-only proxy.ts, and server actions as public endpoints whose .bind() arguments are client-controlled.","domains":["frontend","backend","security","migration"],"industries":[],"lifecycle":["build","maintain","secure"],"technologies":["nextjs","react","typescript","javascript","nodejs"],"license":"MIT","authors":[{"github":"dgesteves"}],"maintainers":[],"payload":{"format":"agent-skill","entry":"SKILL.md"},"targets":["claude-code","codex","cursor","github-copilot","gemini-cli","opencode"],"permissions":{"network":[],"shell":["npm ls","npm run","npm start","rg"],"filesystem":"write","env":[]},"proof":{"suites":["nextjs-16"]},"includes":[],"limitations":["Written and verified against next 16.4.3 with React 19.3. A security release was announced for 2026-11-03 and later 16.x minors may change defaults; the docs in node_modules/next/dist/docs win when they disagree.","App Router only. The Pages Router, custom servers, static export and the Edge runtime are not covered beyond noting that middleware.ts is the way to keep Edge.","Cache behaviour was measured with the default in-memory cache handler on a single next start process. Serverless platforms, 'use cache remote' handlers and multi-instance deployments behave differently for runtime caching.","The proof suite drives pages and server actions over HTTP without a browser, so client-side router cache behaviour (stale times, prefetching, Activity state) is taught but not scored.","Partial Prefetching, Instant Navigations, ensureStatic and adapters are summarised, not taught in depth."]},"digest":"sha256:3a69bb53d38f8a7888e65ca5761fd375a3783370a77c3a6dec9ec23f621ba63b","path":"catalog/skills/nextjs/next-16","level":"submitted","uplift":"untested","files":[{"path":"SKILL.md","sha256":"e4a9180fa59e3de32e969eb1a87a3dbd1b49e18d1f32225c23336cc18bea5bf8","bytes":17803},{"path":"references/cache-components.md","sha256":"d6f53953c63e2e04c1118f1138631c940eeebf94e7730ae9d361080d9b474c9b","bytes":7124},{"path":"references/server-actions-security.md","sha256":"c156147a21ae7ea3fb8260a83986de1932e062079eb201716db5ea6867d464fa","bytes":6787},{"path":"references/sources.md","sha256":"1ae1cdb060be8beea8ba4ada7e846dcbc8e27461bfc30639240718ab6b75f516","bytes":4279},{"path":"references/upgrade-15-to-16.md","sha256":"eda99922611d1ebd4ca041c71be19251ac41e29616f29d3a42158c8f5b88e58a","bytes":7967}]},{"manifest":{"sigil":1,"id":"oauth/oidc-client","type":"skill","version":"1.0.0","name":"OAuth and OpenID Connect Clients and APIs in Node.js","summary":"Secure OIDC sign-in, JWT access token validation and rotating refresh tokens in Node.js with openid-client 6, jose 6 and oauth4webapi 3.","description":"Teaches an agent current OAuth 2.x and OpenID Connect practice for Node.js and TypeScript, checked against openid-client 6.8.8, jose 6.2.14 and oauth4webapi 3.8.8 and the OAuth Security BCP (RFC 9700). It covers what agents trained on openid-client v5 and hand-rolled JWT code get wrong: the v6 functional API (no Issuer, Client or generators), the async PKCE challenge, exact expectedState/expectedNonce semantics, the redirect_uri openid-client derives from the callback URL (and why it breaks behind a TLS proxy), RFC 9207 iss checks, the ID token checks openid-client performs and the signature check it skips by default, single-use login state and session regeneration, JWT access token validation with jose (RFC 9068 typ, issuer, audience, pinned algorithms, exp only checked when required, JWKS from discovery with rotation, RFC 6750 errors), and refresh token rotation with reuse detection: storing the rotated token, one refresh in flight per session, and telling invalid_grant apart from outages.","domains":["security","backend","api-design"],"industries":[],"lifecycle":["build","secure","review"],"technologies":["oauth","nodejs","typescript","javascript","express"],"license":"MIT","authors":[{"github":"dgesteves"}],"maintainers":[],"payload":{"format":"agent-skill","entry":"SKILL.md"},"targets":["claude-code","codex","cursor","github-copilot","gemini-cli","opencode"],"permissions":{"network":[],"shell":["node","npm ls","npm test","npx tsc"],"filesystem":"write","env":[]},"proof":{"suites":["oauth-oidc-client"]},"includes":[],"limitations":["Written and verified against openid-client 6.8.8, jose 6.2.14 and oauth4webapi 3.8.8 on Node 24. openid-client v5 is covered only as a migration map.","Provider-specific behaviour (Auth0, Okta, Entra ID, Keycloak, Cognito) is not covered, such as whether access tokens carry typ at+jwt, scope versus scp, or refresh token grace periods.","The single-flight refresh pattern shown is per process; multi-instance deployments are described (sticky sessions, distributed locks) but not tested by the proof suite.","Browser-only clients (SPAs without a backend), native apps, DPoP, PAR, JAR and FAPI profiles are mentioned, not taught in depth.","The proof suite uses a local test IdP over plain HTTP with allowInsecureRequests enabled by configuration; TLS and certificate handling are out of scope."]},"digest":"sha256:6ae4521aac569ac284203e2ba3f54ef549a41b2666ea9e7b018160ab45078df9","path":"catalog/skills/oauth/oidc-client","level":"submitted","uplift":"untested","files":[{"path":"SKILL.md","sha256":"7662b0ba47ee400cd08dd72bd1b586914467179dafc90843c6cf2c9857bf3a77","bytes":17966},{"path":"references/openid-client-v6.md","sha256":"f39807190268ee9a72cff07e91989a94dc550411354847b54171c3c919865932","bytes":9468},{"path":"references/resource-server.md","sha256":"9fd3930ac9e653e70906808ff3ce2ee3549ba291036064d606bbc8c78aa5f016","bytes":8493},{"path":"references/sources.md","sha256":"79b23d06624a2ad1eeb4a2f9a8d241277a49d11498edae191cf89f9ddbdb65bb","bytes":6284},{"path":"references/token-lifecycle.md","sha256":"2af2ec1f6e9b7e4c926a808dd281f2c6c3cab1b3e9de84e984fa91b486b7aa0a","bytes":6759}]},{"manifest":{"sigil":1,"id":"postgres/zero-downtime-migrations","type":"skill","version":"1.0.0","name":"Zero-Downtime Postgres Migrations","summary":"Schema changes on large, busy PostgreSQL tables without blocking reads or writes, for PostgreSQL 18 with notes for 12-17.","description":"Teaches an agent to write and review PostgreSQL migrations that are safe on hot production tables: which lock each DDL statement takes and whether it scans or rewrites, CREATE INDEX CONCURRENTLY in non-transactional steps (and cleaning up INVALID indexes), foreign keys and CHECKs added NOT VALID and validated in a later transaction, NOT NULL via PostgreSQL 18's NOT VALID not-null constraints or a validated CHECK on 12-17, unique constraints USING INDEX, metadata-only versus rewriting column changes, batched backfills that COMMIT, lock_timeout and the lock queue, and how common migration runners (node-pg-migrate, drizzle-orm, dbmate, graphile-migrate, Django, Rails) handle transactions. Every lock and rewrite claim was measured on PostgreSQL 18.6.","domains":["databases","backend","devops"],"industries":[],"lifecycle":["build","ship","operate"],"technologies":["postgresql","sql","django","rails","drizzle"],"license":"MIT","authors":[{"github":"dgesteves"}],"maintainers":[],"payload":{"format":"agent-skill","entry":"SKILL.md"},"targets":["claude-code","codex","cursor","github-copilot","gemini-cli","opencode"],"permissions":{"network":[],"shell":["psql"],"filesystem":"write","env":[]},"proof":{"suites":["postgres-zero-downtime"]},"includes":[],"limitations":["Covers single-node PostgreSQL semantics. Citus, Aurora-specific behaviour, logical replication and tools like pg_repack or pg_osc are out of scope.","The proof suite runs against PGlite, a single connection, so it measures locks, scans, rewrites and batching but cannot reproduce lock-queue waits; lock_timeout use is taught, not scored.","Runner notes cover node-pg-migrate, drizzle-orm 0.45, dbmate, graphile-migrate, Django and Rails. Prisma's transaction behaviour for hand-edited SQL is not covered.","Batched backfills inside deploy-time migrations suit tables up to tens of millions of rows; larger backfills belong in a throttled background job.","Partitioned tables are covered for indexes only."]},"digest":"sha256:291e6ec3f80da4966a97ed91e83297f9c503fd6aae3cbd183f0a27967b9655a8","path":"catalog/skills/postgres/zero-downtime-migrations","level":"submitted","uplift":"untested","files":[{"path":"SKILL.md","sha256":"271abcf80499d926555b8d2fc614cc23f31507a0e1266addef701ef540652c7d","bytes":18194},{"path":"references/lock-matrix.md","sha256":"7e77e97ac14efa4ba2166c93310c3790fdebc53fad1d88ec0a7d32ab7b42efab","bytes":5672},{"path":"references/recipes.md","sha256":"07a0285c84ffc19b6d41f0b4af5b2603e084e83c4a4e2361f49115e82325bdda","bytes":9472},{"path":"references/runners.md","sha256":"c7501fd4cdb36b4882987e8fe485e9e3c6efc0b2c814b2ab136fc8f526ecaafb","bytes":4203},{"path":"references/sources.md","sha256":"35bc2937c3d5f9b762f89b1d9aa250ec53864afaf6ed548aea61c97d6825bebd","bytes":4575}]},{"manifest":{"sigil":1,"id":"react/accessible-widgets","type":"skill","version":"1.0.0","name":"Accessible React Widgets","summary":"WAI-ARIA APG keyboard, focus and ARIA contracts for React dialogs, menu buttons, comboboxes and tabs, plus how to test them in jsdom.","description":"Gives a coding agent the exact contracts from the WAI-ARIA Authoring Practices and the ARIA 1.2 Recommendation for the widgets teams most often build by hand: modal dialogs, menu buttons, editable comboboxes with a listbox popup, tabs, disclosures and accordions. It covers roles and states, what every key must do, roving tabindex versus aria-activedescendant, focus return, React 19 mechanics (useId, refs and focus timing, inert, native dialog and why autoFocus does not reach it), and how to prove the behaviour with Testing Library, user-event and axe-core, including the jsdom gaps that make tests lie.","domains":["frontend","accessibility","testing"],"industries":[],"lifecycle":["build","test","review"],"technologies":["react","typescript","wcag","testing-library","vitest"],"license":"MIT","authors":[{"github":"dgesteves"}],"maintainers":[],"payload":{"format":"agent-skill","entry":"SKILL.md"},"targets":["claude-code","codex","cursor","github-copilot","gemini-cli","opencode"],"permissions":{"network":[],"shell":[],"filesystem":"write","env":[]},"proof":{"suites":["react-accessible-widgets"]},"includes":[],"limitations":["The proof suite runs in jsdom, which has no <dialog>.showModal(), Popover API or layout, so it has no dialog task; dialog guidance is checked against the HTML standard and MDN, not measured.","Covers single-level menus and listbox popups. Submenus, menubars, grids, trees and grid or tree combobox popups are out of scope.","Passing keyboard tests and axe-core does not prove what a screen reader announces; new widgets still need a manual pass with VoiceOver or NVDA.","React DOM only. React Native and other renderers use different accessibility APIs.","Browser support figures come from MDN browser-compat-data 8.1.7 (checked 2026-11-01) and will age."]},"digest":"sha256:fea671a54d408189644aa1a6f6b60297a4b3042451673a72cceb71d96dd4ed57","path":"catalog/skills/react/accessible-widgets","level":"submitted","uplift":"untested","files":[{"path":"SKILL.md","sha256":"3996fdd4b07b1213d5dd20a45b582341d182fbae2c6f26224e37ab59354a8c2a","bytes":17530},{"path":"references/combobox.md","sha256":"886413f42e015e11cee6198a3dea7e337f9ecf5af27f22dbf8969da76efd403a","bytes":8815},{"path":"references/dialog.md","sha256":"8ece1f19fcbfa80801e2f3d0fa8393c76e8b43028497e96a74d5709e8327169a","bytes":8755},{"path":"references/menu-button.md","sha256":"75759e8b0cd73d4c737ad17ec3d9cbd1e2fed62dad34d869293c52015ff3c2e6","bytes":8403},{"path":"references/sources.md","sha256":"421c4cfd5122e2a03459f330d7d1d83d58cb27eb6808aed2d37da9fd9e39a9bc","bytes":4192},{"path":"references/tabs-and-disclosure.md","sha256":"bce9cab7fd6706cd9af0e124a4d5bcb6cdd56a482f9dd754ffb2b9bf2a1811f7","bytes":6824},{"path":"references/testing.md","sha256":"6773cc7c55281ed7f38eefdf4ffff0ce4cf4e6be341b9136915138ffea02259f","bytes":6784}]},{"manifest":{"sigil":1,"id":"sigil/launch-set","type":"collection","version":"1.0.0","name":"Sigil Launch Set","summary":"The first seven Sigil skills, each with its own proof suite, for the APIs and safety rules coding agents most often get wrong in late 2026.","description":"Seven skills that carry current, precise knowledge a coding agent otherwise gets wrong: GitHub Actions hardening, zero-downtime PostgreSQL migrations, MCP servers on the v2 TypeScript SDK, Vercel AI SDK 7 tools and structured output, Express 5, Zod 4 and accessible React widgets. Every member ships with a three-task suite whose hidden verifier fails on the starting repo and passes on the reference solution, so its effect can be measured rather than assumed. Installing the bundle installs each member in its own native format; each member keeps its own digest and evidence.","domains":["backend","devops","ai-engineering","frontend"],"industries":[],"lifecycle":["build","secure","ship","maintain"],"technologies":["typescript","nodejs","github-actions","npm","postgresql","mcp","ai-sdk","express","zod","react"],"license":"MIT","authors":[{"github":"dgesteves"}],"maintainers":[],"payload":{"format":"bundle","entry":"BUNDLE.md"},"targets":["claude-code","codex","cursor","github-copilot","gemini-cli","opencode"],"permissions":{"network":["github.com","api.github.com"],"shell":["node","npm test","npm ls","npm run typecheck","npx tsc","grep","rg","psql","git ls-remote","gh api","zizmor","actionlint"],"filesystem":"write","env":[]},"proof":{"suites":["github-actions-hardening","postgres-zero-downtime","mcp-typescript-server","ai-sdk-tools","express-5","zod-4","react-accessible-widgets"]},"includes":["github-actions/workflow-hardening","postgres/zero-downtime-migrations","mcp/typescript-server","ai-sdk/tools-and-structured-output","express/express-5","zod/zod-4","react/accessible-widgets"],"limitations":["Results for the bundle measure all seven skills installed together. A member can help on its own suite and still be diluted or crowded out when every skill is loaded; read each member's own result too.","Every member is pinned to the versions it was checked against (November 2026). Projects on older majors (AI SDK 5-6, MCP SDK v1, Express 4, Zod 3, PostgreSQL before 12) get migration notes, not full coverage.","The suites are small (three tasks each), so early results are likely to be inconclusive until more runs and tasks exist."]},"digest":"sha256:c9adede55aaa0112a123cfe9dd3232e904557564ebdb6426574f9622f1ac5898","path":"catalog/collections/sigil/launch-set","level":"submitted","uplift":"untested","files":[{"path":"BUNDLE.md","sha256":"4583e12a310378df1b1ad7f6a7ed2cc5107e0880d8bcf3cfb8e29944cb9df2c7","bytes":3934}]},{"manifest":{"sigil":1,"id":"spring-boot/spring-boot-4","type":"skill","version":"1.0.0","name":"Spring Boot 4 Web Services","summary":"Spring Boot 4.1 REST services done right, and Boot 3.5 upgrades that keep the JSON contract, checked against Boot 4.1.2.","description":"Teaches an agent the parts of Spring Boot 4 (4.1.2, Spring Framework 7.0.10, Jackson 3.1.7) that agents trained on Boot 2 and 3 get wrong when they build or upgrade Spring MVC services: the split starters and test starters, Jackson 3 packages and APIs (@JacksonComponent, ValueSerializer, JsonMapperBuilderCustomizer), the ObjectMapper bean that Boot 4 silently ignores, Jackson 3 default changes that alter the wire format without a compile error (enums read and written with toString, rejected missing primitives, sorted properties), built-in method validation versus a class-level @Validated, HandlerMethodValidationException and RFC 9457 problem details with per-field errors, the new test packages (@MockitoBean, RestTestClient, TestRestTemplate opt-in), RestTemplateBuilder and HTTP client property moves, HTTP service client groups, API versioning, core @Retryable and virtual threads. Every behaviour claim was measured on Boot 4.1.2.","domains":["backend","api-design","migration","testing"],"industries":[],"lifecycle":["build","test","maintain"],"technologies":["spring-boot","java","jvm","junit"],"license":"MIT","authors":[{"github":"dgesteves"}],"maintainers":[],"payload":{"format":"agent-skill","entry":"SKILL.md"},"targets":["claude-code","codex","cursor","github-copilot","gemini-cli","opencode"],"permissions":{"network":[],"shell":["mvn","gradlew","javap","unzip","grep","ls"],"filesystem":"write","env":[]},"proof":{"suites":["spring-boot-4"]},"includes":[],"limitations":["Written and measured against Spring Boot 4.1.2 (Framework 7.0.10, Jackson 3.1.7). 4.0.x behaves the same for everything here except where noted; check the release notes for 4.2 and later.","Covers Spring MVC on the servlet stack. WebFlux, Spring Security 7, Spring Data and messaging are only touched where they meet the upgrade checklist.","Jackson default changes are listed for the JSON features a REST API typically exercises; formats like XML, CBOR and Smile and polymorphic typing are not covered.","The proof suite builds with Maven offline in a container. Gradle is mentioned for commands only.","The suite measures behaviour through MockMvc and real HTTP in tests; production concerns like observability and native images are out of scope."]},"digest":"sha256:1bc4fffbf783b178202a09819b31240ce06a888ca39201b3ecd71864560281d4","path":"catalog/skills/spring-boot/spring-boot-4","level":"submitted","uplift":"untested","files":[{"path":"SKILL.md","sha256":"0d4ad9e4b1b3b31be8b101762d22500c99ebc6a50ff370495e4db68b50c29b25","bytes":22014},{"path":"references/http-and-resilience.md","sha256":"88ecc1a15cbd85a589e38c7489b7aa9d58f440a964a5e45a9309c0cc5f5c3be2","bytes":7062},{"path":"references/jackson-3.md","sha256":"a7ba4704de7c0252935423e1c2449142218286eb93da8a8002fdb1d1f41f25b5","bytes":9138},{"path":"references/sources.md","sha256":"5d1760ee35ceb6fc8f84dae6dffe944376b8339ad4dfb6e4aa2c284615cb3807","bytes":9564},{"path":"references/testing.md","sha256":"d3154f722ce38f9f98d87ee92783e581c1b1df158a7161e0d5fcd67b635027f4","bytes":6376},{"path":"references/upgrade-from-3.md","sha256":"57a0001f4fb6a206da716ae5080583d5d904c8ec1a27145c7f58db73ec0f2a18","bytes":6711},{"path":"references/validation-and-problem-details.md","sha256":"e71ba6b759be790155641097e887765dce05dff2a471749e8738d04387aee34f","bytes":9288}]},{"manifest":{"sigil":1,"id":"svelte/svelte-5-runes","type":"skill","version":"1.0.0","name":"Svelte 5 Runes and Migration","summary":"Correct Svelte 5 runes components, shared state modules and mount() code, and Svelte 4 ports that keep bindings, events and timing intact.","description":"Teaches an agent the current Svelte 5 API (checked against svelte 5.57.3) and how to port Svelte 3/4 code without silent behaviour changes. It concentrates on what agents trained on Svelte 4 get wrong: export let and $: versus $props, $derived and $effect (and why syncing state in effects breaks reads outside components), missing $bindable that silently stops bind: from reaching the parent, createEventDispatcher versus callback props, slots versus snippets, runes outside .svelte.ts files, exporting reassigned module state, Map and Set inside $state, proxies that structuredClone and postMessage reject, mount() deferring onMount and bind:this until flushSync, $set replaced by a $state props object, intro transitions on mount, and testing all of it with Vitest and jsdom.","domains":["frontend","migration","testing"],"industries":[],"lifecycle":["build","maintain","test"],"technologies":["svelte","typescript","javascript","vite","vitest"],"license":"MIT","authors":[{"github":"dgesteves"}],"maintainers":[],"payload":{"format":"agent-skill","entry":"SKILL.md"},"targets":["claude-code","codex","cursor","github-copilot","gemini-cli","opencode"],"permissions":{"network":[],"shell":["node","npm ls","npm test","npm run check","rg"],"filesystem":"write","env":[]},"proof":{"suites":["svelte-5-runes"]},"includes":[],"limitations":["Written and verified against svelte 5.57.3 with @sveltejs/vite-plugin-svelte 7.3.1 and vitest 5.0.5. Later 5.x releases may add runes or promote experimental features; check the changelog when the installed version is newer.","Covers Svelte itself. SvelteKit routing, load functions, form actions and remote functions are out of scope; SvelteKit 3.0 is mentioned only for its version requirements.","Async Svelte (await in components, $state.eager, hydratable, fork) is still behind experimental.async in 5.57.3 and is described, not taught or measured.","The proof suite runs in jsdom, which has no layout and no Element.animate, so transitions, animations and SSR hydration are covered by guidance only.","Custom elements (customElement, $host) and Svelte Native are not covered."]},"digest":"sha256:e5ce540fb658e723cc46f31be3726471a7170562a214f6eec5173eec641c2d43","path":"catalog/skills/svelte/svelte-5-runes","level":"submitted","uplift":"untested","files":[{"path":"SKILL.md","sha256":"34886411a8c11e435ec524c7f72b307c10c84d2c25c1be5a8be011eff2f385ff","bytes":20783},{"path":"references/migration-svelte-4.md","sha256":"5524a778e3c99a0849b84c074bda29427e32d572cb644c64677946a00d96c827","bytes":9807},{"path":"references/shared-state.md","sha256":"8bc1691453060484bcbb8b2f83a86695426d2e92a67dfffcf1346cec5d7459aa","bytes":8550},{"path":"references/sources.md","sha256":"69c019a690a710a8bd13abfa30c711531b497c849a6d24639af154fb5f8a5a16","bytes":2804},{"path":"references/testing.md","sha256":"54c7df0cd4451edcab58475dea6e7c7001d9b1c0df9694f46b0c070a33f7ec90","bytes":5911}]},{"manifest":{"sigil":1,"id":"vue/vue-3-5","type":"skill","version":"1.0.0","name":"Vue 3.5 Composition and Reactivity","summary":"Current Vue 3.5 composition API, reactivity and component contracts, and the Vue 2 and early Vue 3 habits that silently break them.","description":"Teaches an agent the Vue 3.5 APIs as they behave in vue 3.5.44: reactive props destructure and why a destructured prop passed to a function or composable loses reactivity, composables that take MaybeRefOrGetter and read it with toValue() inside an effect, watch semantics (shallow refs, numeric deep, once, pause/resume, onWatcherCleanup and its synchronous-only rule, cleanup when an effectScope stops), defineModel (local mode without v-model, modifiers and get/set transforms, factory defaults, never mutating an array or object model in place), declared emits and listener fallthrough, $attrs, useTemplateRef, defineExpose, useId with app.config.idPrefix for SSR-stable ids, data-allow-mismatch, provide/inject with typed keys, and how to test all of it with Vitest and @vue/test-utils. Every behaviour was run against vue 3.5.44.","domains":["frontend","migration","testing"],"industries":[],"lifecycle":["build","maintain","test"],"technologies":["vue","typescript","javascript","vite","vitest"],"license":"MIT","authors":[{"github":"dgesteves"}],"maintainers":[],"payload":{"format":"agent-skill","entry":"SKILL.md"},"targets":["claude-code","codex","cursor","github-copilot","gemini-cli","opencode"],"permissions":{"network":[],"shell":["npm ls","vitest","vue-tsc","rg"],"filesystem":"write","env":[]},"proof":{"suites":["vue-3-5"]},"includes":[],"limitations":["Written and verified against vue 3.5.44 (npm latest on 2026-11-01). Vue 3.6 (Vapor mode, alien-signals reactivity) is a release candidate and is not covered.","Nuxt 4, Pinia and Vue Router are out of scope beyond using composables inside an effectScope; their data-fetching and store APIs have their own rules.","The proof suite runs in jsdom with @vue/test-utils, so it measures behaviour, hydration warnings and SSR markup but not layout, transitions or real browser focus.","The Vue 2 migration notes cover the behaviour changes that fail silently in components; the @vue/compat build and its per-feature flags are not taught.","Type-level guidance (generic components, defineSlots typing) is brief; run vue-tsc for the final word on types."]},"digest":"sha256:3489e2ebf68a6ff04dbca5aaf9c07fc97a6ffcf276c5756a1c0af8a2a50c289a","path":"catalog/skills/vue/vue-3-5","level":"submitted","uplift":"untested","files":[{"path":"SKILL.md","sha256":"38fc8b763bef5f425a53fce91c6ee1f32a0469abe48cf941c2fe3f0b46de0d73","bytes":17853},{"path":"references/components-and-v-model.md","sha256":"6862260e73ed1032971bdd0caa8cc745f5950b57ae8d6b4e64e60df5419f77a9","bytes":9725},{"path":"references/reactivity-and-watchers.md","sha256":"d33ebf41ee7091aa841de197a1e91944ed33564fd714354e0a0df8ddae5448d4","bytes":7281},{"path":"references/sources.md","sha256":"0e3ef94ebe0b1bde60fdf5756951312dec524ff6e356ce797ddeb78204b57202","bytes":4023},{"path":"references/testing.md","sha256":"ab2853bf80aafdc67449cece7b17177aa278ea35d4c6ea73ed759fd526eeb8ce","bytes":5209},{"path":"references/vue-2-and-early-3-habits.md","sha256":"fe186f94f4342ce27a07b20fe752ed7144ba626e74383f7b06e8f03bf2f54825","bytes":6320}]},{"manifest":{"sigil":1,"id":"zod/zod-4","type":"skill","version":"1.0.0","name":"Zod 4 Validation and Migration","summary":"Correct Zod 4 schemas at trust boundaries, and Zod 3 upgrades that keep messages, defaults and rules intact.","description":"Teaches an agent the current Zod 4 API (checked against zod 4.6.7) for validating HTTP bodies, query strings, form posts, env config, webhooks and model output, and how to port Zod 3 code without silent behaviour changes. It concentrates on what agents trained on Zod 3 get wrong: ignored required_error/invalid_type_error/errorMap, the removed ZodError.errors, .default() vs .prefault(), exhaustive enum records, the stricter z.uuid(), required z.unknown() keys, schema-level messages that override check messages, coercion of \"false\" and \"\", permissive z.url(), check order with z.email().trim(), and cross-field refinements that are skipped next to field errors.","domains":["backend","frontend","security","migration"],"industries":[],"lifecycle":["build","maintain","secure"],"technologies":["zod","typescript","javascript","nodejs"],"license":"MIT","authors":[{"github":"dgesteves"}],"maintainers":[],"payload":{"format":"agent-skill","entry":"SKILL.md"},"targets":["claude-code","codex","cursor","github-copilot","gemini-cli","opencode"],"permissions":{"network":[],"shell":["node","npm ls","npm test","npx tsc","rg"],"filesystem":"write","env":[]},"proof":{"suites":["zod-4"]},"includes":[],"limitations":["Written and verified against zod 4.6.7. Later 4.x releases may add APIs or tighten validators; check the release notes when the installed version is newer.","Covers classic Zod. Zod Mini (zod/mini, @zod/mini) is mentioned but its functional API is not taught in depth.","Default error message wording is not reproduced; upgrades that snapshot Zod 3 default messages will still need test updates.","Does not cover framework integrations (tRPC, react-hook-form resolvers, Fastify type providers) beyond the z.input/z.output guidance."]},"digest":"sha256:83f66d162f7d69ee9da347ba67f05e83bcc6377cee1d23e7d9ea3a2a03114d82","path":"catalog/skills/zod/zod-4","level":"submitted","uplift":"untested","files":[{"path":"SKILL.md","sha256":"2e87cf3f179631fd7cab766b2ae722e9f429d1650e7979b45bbdfe65eec185ff","bytes":17240},{"path":"references/boundary-recipes.md","sha256":"b9873827fb60cbde5f07e735d22ae8b56c2d826972afb63bcf11fbc9eae5dac4","bytes":7641},{"path":"references/error-messages.md","sha256":"51ff7aae35111d59d47d9b561b9237f794ba3eb2f6b0db8283f3eacb148698f4","bytes":5881},{"path":"references/migration-v3-to-v4.md","sha256":"c934795fedd2dbb2d7e95465db84efa0ab5320a1dbf34f76778128b221f8e800","bytes":10414},{"path":"references/sources.md","sha256":"065331330980ece84969708265c4f10b5837fd0b92adc8b77b6ce91b589efe05","bytes":2331}]}]}