chore(deps): bump fast-uri from 3.1.8 to 3.1.9

.agents/settings.json

@@ -0,0 +1,70 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(cat:*)",
+      "Bash(deno bench:*)",
+      "Bash(deno check:*)",
+      "Bash(deno fmt:*)",
+      "Bash(deno lint:*)",
+      "Bash(deno run:*)",
+      "Bash(deno task:*)",
+      "Bash(deno test:*)",
+      "Bash(docker:*)",
+      "Bash(docker compose:*)",
+      "Bash(find:*)",
+      "Bash(gh:*)",
+      "Bash(head:*)",
+      "Bash(git diff:*)",
+      "Bash(git log:*)",
+      "Bash(git show:*)",
+      "Bash(git status:*)",
+      "Bash(grep:*)",
+      "Bash(ls:*)",
+      "Bash(make:*)",
+      "Bash(sort:*)",
+      "Bash(tail:*)",
+      "Bash(test:*)",
+      "Bash(tree:*)",
+      "Bash(uniq:*)",
+      "Bash(wc:*)",
+      "mcp__plugin_context7_context7__get-library-docs",
+      "mcp__plugin_context7_context7__query-docs",
+      "mcp__plugin_context7_context7__resolve-library-id",
+      "Skill(architecture-guidelines)",
+      "Skill(coding-practices)",
+      "Skill(design-principles)",
+      "Skill(enrichment)",
+      "Skill(eser-rules-manager)",
+      "Skill(go-practices)",
+      "Skill(javascript-practices)",
+      "Skill(release-and-ci)",
+      "Skill(security-practices)",
+      "Skill(tooling-standards)",
+      "Skill(workflow-practices)",
+      "WebFetch(domain:api.github.com)",
+      "WebFetch(domain:github.com)",
+      "WebFetch(domain:raw.githubusercontent.com)",
+      "WebSearch"
+    ],
+    "deny": [
+      "Bash(git add:*)",
+      "Bash(git branch:*)",
+      "Bash(git checkout:*)",
+      "Bash(git commit:*)",
+      "Bash(git fetch:*)",
+      "Bash(git merge:*)",
+      "Bash(git pull:*)",
+      "Bash(git push:*)",
+      "Bash(git rebase:*)",
+      "Bash(git reset:*)",
+      "Bash(git revert:*)",
+      "Bash(git stash:*)",
+      "Bash(git tag:*)"
+    ]
+  },
+  "enabledPlugins": {
+    "context7@claude-plugins-official": true,
+    "frontend-design@claude-plugins-official": true
+  },
+  "alwaysThinkingEnabled": true
+}

.agents/skills/architecture-guidelines/SKILL.md

@@ -0,0 +1,35 @@
+---
+name: architecture-guidelines
+description: "System design in eserstack: double-layered hexagonal architecture, explicit adapter composition, public API and CLI surface, request metadata, testing strategy, ADRs. Use when designing a package or service, adding options or flags, planning tests or writing an ADR. Not for file naming (use tooling-standards)."
+---
+
+# Architecture Guidelines
+
+How packages and services are structured, composed, tested and documented as
+decisions.
+
+## Always
+
+- Domain logic and its port types live together in `domain/`; adapters live in
+  `adapters/`. No `ports/` directory.
+- Callers import adapters explicitly and pass them in. No string-selected
+  adapters, no convenience factories, no dynamic imports inside a package.
+- Library code reaches the runtime through `@eserstack/standards/cross-runtime`,
+  never `Deno.*`.
+- Every option has a safe default; add an option only for a named case; no
+  positional booleans.
+- Request ids and trace state travel in the request context, never as extra
+  parameters.
+- Unit tests with fakes for logic, integration tests for adapters; failure paths
+  tested; coverage never drops.
+- Validator and codebase-tool design lives in
+  `pkg/@eserstack/codebase/AGENTS.md`
+- A lasting architectural decision gets an ADR in `docs/adr/`.
+
+## References
+
+| File                                                              | Read when                                                                   |
+| ----------------------------------------------------------------- | --------------------------------------------------------------------------- |
+| [hexagonal-architecture.md](references/hexagonal-architecture.md) | Structuring a package, adding an adapter, adding options, flags or env vars |
+| [testing.md](references/testing.md)                               | Deciding what and how to test, choosing the runner, coverage                |
+| [adrs.md](references/adrs.md)                                     | Recording an architectural decision                                         |

.agents/skills/architecture-guidelines/evals/triggers.json

@@ -0,0 +1,62 @@
+[
+  {
+    "query": "design a new package for background jobs, where do ports and adapters go",
+    "should_trigger": true
+  },
+  {
+    "query": "should this CLI flag be public or hidden",
+    "should_trigger": true
+  },
+  {
+    "query": "write an ADR for switching the bundler",
+    "should_trigger": true
+  },
+  {
+    "query": "what should we unit test vs integration test for the http package",
+    "should_trigger": true
+  },
+  {
+    "query": "how do request ids travel between the noskills server and worker",
+    "should_trigger": true
+  },
+  {
+    "query": "yeni bir servis tasarlıyorum, katmanları nasıl ayırayım",
+    "should_trigger": true
+  },
+  {
+    "query": "we're adding an option to the public API of @eserstack/config, is that ok",
+    "should_trigger": true
+  },
+  {
+    "query": "the Go tests fail with a data race",
+    "should_trigger": false
+  },
+  {
+    "query": "use namespace import here",
+    "should_trigger": false
+  },
+  {
+    "query": "bump all packages to the next minor",
+    "should_trigger": false
+  },
+  {
+    "query": "write a README for laroux",
+    "should_trigger": false
+  },
+  {
+    "query": "set the GitHub workflow timeout",
+    "should_trigger": false
+  },
+  {
+    "query": "should this function take a pointer or a value",
+    "should_trigger": false
+  },
+  {
+    "query": "secret key is in the logs, fix it",
+    "should_trigger": false
+  },
+  {
+    "query": "commit and push",
+    "should_trigger": false
+  }
+]

.agents/skills/architecture-guidelines/references/adrs.md

@@ -0,0 +1,29 @@
+# Architectural Decision Records
+
+When to write an ADR and what it contains.
+
+---
+
+## Architectural Decision Records
+
+Scope: Decisions that change a package's architecture, a public contract, a
+dependency with lasting cost, or a product target
+
+Rule: Record the decision in `docs/adr/NNNN-kebab-title.md`, numbered after the
+highest existing file (`0001-http3-and-webtransport.md` through
+`0004-bundler-external-import-specifiers.md` exist). An ADR is written before or
+with the change, not after. It states:
+
+- `## Status`: Proposed, Accepted, or Superseded by a named ADR.
+- `## Context and Problem Statement`: the forces and the question being decided.
+- `## Decision Drivers`: what the decision optimizes for.
+- `## Considered Options`, with the trade-offs of each.
+- `## Decision Outcome`: the choice and why it beat the others.
+- `## Consequences`: what becomes easier and what becomes harder.
+- `## Links` and related files, when there are any.
+
+An accepted ADR is not rewritten to match a later decision. A new ADR supersedes
+it, and the old one's status names the new one.
+
+**Why:** the reasoning behind a structure is what a later change needs, and it
+is the part the code cannot show.

.agents/skills/architecture-guidelines/references/hexagonal-architecture.md

@@ -0,0 +1,175 @@
+# Hexagonal Architecture and Public Surface
+
+How packages separate domain logic from adapters, how callers compose them, and
+how public APIs and request metadata are shaped.
+
+## Contents
+
+- Hexagonal Architecture (Double-Layered)
+- Runtime Access Through cross-runtime
+- Public API and CLI Surface
+- Request-Scoped Metadata Across Boundaries
+
+---
+
+## Hexagonal Architecture (Double-Layered)
+
+Scope: Packages with external dependencies (TypeScript; the Go form is in
+go-practices)
+
+Rule: The domain layer holds business logic and its port types together; there
+is no separate `ports/` directory. Adapters implement the domain types and live
+in `adapters/`. The caller composes by importing the adapters it wants and
+passing them in as parameters. No string-based adapter selection, no convenience
+factories that pick adapters for the caller, no dynamic imports inside the
+package.
+
+```
+package/
+├── domain/                    # Business logic + port types
+│   ├── mod.ts
+│   ├── bundler.ts             # Bundler type + BundleData
+│   ├── framework-plugin.ts    # FrameworkPlugin type + noopPlugin
+│   └── build-cache.ts         # BuildCache type + implementation
+├── adapters/
+│   ├── react/                 # implements FrameworkPlugin
+│   ├── tailwindcss/           # implements CssPlugin
+│   └── prebuilt-bundler/      # implements Bundler
+└── mod.ts
+```
+
+Correct:
+
+```typescript
+import * as bundler from "@eserstack/laroux-bundler";
+import * as react from "@eserstack/laroux-bundler/adapters/react";
+import * as tailwind from "@eserstack/laroux-bundler/adapters/tailwindcss";
+import * as prebuilt from "@eserstack/laroux-bundler/adapters/prebuilt-bundler";
+
+await bundler.bundle(config, {
+  framework: react.reactPlugin,
+  css: tailwind.tailwindPlugin,
+  bundler: new prebuilt.PrebuiltBundler(bundlerConfig),
+});
+```
+
+Incorrect:
+
+```typescript
+await bundle({ framework: "react", css: "tailwindcss" }); // dynamic imports inside
+
+const plugins = await createReactTailwindPlugins(); // hides which adapters load
+
+import type { Plugin } from "./ports/plugin.ts"; // ports split from the domain
+```
+
+A domain type ships with a noop implementation for callers that do not need the
+capability:
+
+```typescript
+// domain/framework-plugin.ts
+export type FrameworkPlugin = {
+  name: string;
+  analyzeClientComponents?: (srcDir: string) => Promise<ClientComponent[]>;
+};
+
+export const noopPlugin: FrameworkPlugin = {
+  name: "noop",
+  analyzeClientComponents: () => Promise.resolve([]),
+};
+```
+
+**Why:** explicit imports keep the dependency graph visible and tree-shakable,
+and let a caller swap one adapter without touching the others.
+
+---
+
+## Runtime Access Through cross-runtime
+
+Scope: All `@eserstack/*` library code
+
+Rule: Filesystem, process, exec and environment access goes through
+`@eserstack/standards/cross-runtime`, never `Deno.*` directly. The runtime is an
+adapter like any other, so the same code runs on Deno, Node and Bun and can be
+tested with a fake. CLI-only code may call `Deno.*` when cross-runtime does not
+expose the API it needs (for example `Deno.makeTempDir()`).
+
+Correct:
+
+```typescript
+import { runtime } from "@eserstack/standards/cross-runtime";
+
+const content = await runtime.fs.readTextFile(path);
+```
+
+Incorrect:
+
+```typescript
+const content = await Deno.readTextFile(path); // ties the library to Deno
+```
+
+---
+
+## Public API and CLI Surface
+
+Scope: Exported functions and types, CLI commands and flags, config keys,
+environment variables
+
+Rule:
+
+- The common case works with no configuration. Every option has a default that
+  is safe and correct for production.
+- A fixed policy value a caller may need to change (a timeout, a size limit, a
+  path, a retry count) is a parameter, flag or environment variable with that
+  default, not a hardcoded constant.
+- Do not add options for hypothetical needs. Each new option names the case that
+  requires it; an edge case gets documentation, not a required setting.
+- No positional boolean parameters. Use an options object or a string union.
+- Defaults come from parameter defaults and noop adapters, not from convenience
+  factories.
+
+Correct:
+
+```typescript
+export function connect(url: string, options: { timeoutMs?: number } = {}) {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+}
+
+render(tree, { mode: "stream" });
+```
+
+Incorrect:
+
+```typescript
+export function connect(url: string) {
+  const timeoutMs = 5000; // caller cannot change it
+}
+
+render(tree, true, false); // what are true and false?
+```
+
+---
+
+## Request-Scoped Metadata Across Boundaries
+
+Scope: HTTP and RPC servers and clients, the noskills daemon, services that call
+each other
+
+Rule: Metadata that identifies a request (trace and span ids, a request or
+correlation id, the authenticated principal) travels with the request's context
+(`context.Context` in Go, the request or an explicit context object in
+TypeScript), not as extra function parameters. Business inputs and dependencies
+never travel that way: inputs are parameters, dependencies come from the
+composition root.
+
+- At an entry point, middleware reads incoming metadata or creates it, and
+  stores it in the context.
+- On every outbound call, the client writes it back out, so logs and traces on
+  both sides join up.
+- Trace state uses OpenTelemetry propagation (the `traceparent` header), not
+  hand-written headers. Other ids use typed accessors owned by one package.
+- Logs include these ids (coding-practices: Structured Logging).
+
+**Why:** a request that loses its ids at one hop cannot be followed across the
+system, and a dependency hidden in a context is invisible in every signature
+that needs it.