fix: update vendored skills to latest versions

plugins/ai-sdk/.agents/skills/ai-sdk/SKILL.md

@@ -20,9 +20,9 @@ Whatever you remember about the AI SDK is likely outdated. The SDK changes frequ
 
 The `ai` package ships its full documentation and source code inside `node_modules`. These always match the installed version, so trust them over anything you remember.
 
-1. Ensure `ai` is installed. If `node_modules/ai/` does not exist, install **only** the `ai` package using the project's package manager (e.g. `pnpm add ai`). Install provider packages (e.g. `@ai-sdk/openai`) and framework packages (e.g. `@ai-sdk/react`) later, when the task requires them.
-2. Read and grep the bundled docs at `node_modules/ai/docs/` and the source at `node_modules/ai/src/`.
-3. Provider and framework packages bundle their own docs at `node_modules/@ai-sdk/<name>/docs/`.
+1. Ensure `ai` is installed. Check `node_modules/ai/` or locate the workspace package in a monorepo that depends on `ai` (e.g. `apps/<name>/node_modules/ai/`). If `ai` is not installed anywhere in the project, install **only** the `ai` package into the target package using the project's package manager (e.g. `pnpm add ai --filter <pkg>` or `npm install ai`). Install provider packages (e.g. `@ai-sdk/openai`) and framework packages (e.g. `@ai-sdk/react`) later, when the task requires them.
+2. Read and grep the bundled docs at `node_modules/ai/docs/` (or `<package>/node_modules/ai/docs/`) and the source at `node_modules/ai/src/`.
+3. Provider and framework packages bundle their own docs at `node_modules/@ai-sdk/<name>/docs/` (or `<package>/node_modules/@ai-sdk/<name>/docs/`).
 4. If something isn't in the bundled docs, search https://ai-sdk.dev/docs. You can append `.md` to any docs page URL to get its markdown, and search via `https://ai-sdk.dev/api/search-docs?q=your_query`.
 5. If you cannot find support for an answer in the docs or source, say so explicitly — do not guess.
 

plugins/ai-sdk/agent/skills/ai-sdk/SKILL.md

@@ -1,5 +1,14 @@
 ---
-description: "Answer questions about the AI SDK and help build AI-powered features. Use when developers: (1) Ask about AI SDK functions like generateText, streamText, ToolLoopAgent, embed, or tools, (2) Want to build AI agents, chatbots, RAG systems, or text generation features, (3) Have questions about AI providers (OpenAI, Anthropic, Google, etc.), streaming, tool calling, structured output, or embeddings, (4) Use React hooks like useChat or useCompletion. Triggers on: \"AI SDK\", \"Vercel AI SDK\", \"generateText\", \"streamText\", \"add AI to my app\", \"build an agent\", \"tool calling\", \"structured output\", \"useChat\"."
+name: ai-sdk
+description: 'Answer questions about the AI SDK and help build AI-powered
+  features. Use when developers: (1) Ask about AI SDK functions like
+  generateText, streamText, ToolLoopAgent, embed, or tools, (2) Want to build AI
+  agents, chatbots, RAG systems, or text generation features, (3) Have questions
+  about AI providers (OpenAI, Anthropic, Google, etc.), streaming, tool calling,
+  structured output, or embeddings, (4) Use React hooks like useChat or
+  useCompletion. Triggers on: "AI SDK", "Vercel AI SDK", "generateText",
+  "streamText", "add AI to my app", "build an agent", "tool calling",
+  "structured output", "useChat".'
 ---
 ## What the AI SDK Is
 
@@ -18,9 +27,9 @@ Whatever you remember about the AI SDK is likely outdated. The SDK changes frequ
 
 The `ai` package ships its full documentation and source code inside `node_modules`. These always match the installed version, so trust them over anything you remember.
 
-1. Ensure `ai` is installed. If `node_modules/ai/` does not exist, install **only** the `ai` package using the project's package manager (e.g. `pnpm add ai`). Install provider packages (e.g. `@ai-sdk/openai`) and framework packages (e.g. `@ai-sdk/react`) later, when the task requires them.
-2. Read and grep the bundled docs at `node_modules/ai/docs/` and the source at `node_modules/ai/src/`.
-3. Provider and framework packages bundle their own docs at `node_modules/@ai-sdk/<name>/docs/`.
+1. Ensure `ai` is installed. Check `node_modules/ai/` or locate the workspace package in a monorepo that depends on `ai` (e.g. `apps/<name>/node_modules/ai/`). If `ai` is not installed anywhere in the project, install **only** the `ai` package into the target package using the project's package manager (e.g. `pnpm add ai --filter <pkg>` or `npm install ai`). Install provider packages (e.g. `@ai-sdk/openai`) and framework packages (e.g. `@ai-sdk/react`) later, when the task requires them.
+2. Read and grep the bundled docs at `node_modules/ai/docs/` (or `<package>/node_modules/ai/docs/`) and the source at `node_modules/ai/src/`.
+3. Provider and framework packages bundle their own docs at `node_modules/@ai-sdk/<name>/docs/` (or `<package>/node_modules/@ai-sdk/<name>/docs/`).
 4. If something isn't in the bundled docs, search https://ai-sdk.dev/docs. You can append `.md` to any docs page URL to get its markdown, and search via `https://ai-sdk.dev/api/search-docs?q=your_query`.
 5. If you cannot find support for an answer in the docs or source, say so explicitly — do not guess.
 

plugins/ai-sdk/skills-lock.json

@@ -5,7 +5,7 @@
       "source": "vercel/ai",
       "sourceType": "github",
       "skillPath": "skills/use-ai-sdk/SKILL.md",
-      "computedHash": "0883204d11b055e968dee697c5858e68064c27dfd4deb6310212895daa65c5ad"
+      "computedHash": "aee5bf7ecb066b54eae76799610fa8a9be9ff1ca9a000ea92d17c14ec862938b"
     }
   }
 }

plugins/antfu/.agents/skills/antfu/SKILL.md

@@ -3,9 +3,11 @@ name: antfu
 description: Anthony Fu's opinionated tooling and conventions for JavaScript/TypeScript projects. Use when setting up new projects, configuring ESLint/Prettier alternatives, monorepos, library publishing, or when the user mentions Anthony Fu's preferences.
 metadata:
   author: Anthony Fu
-  version: "2026.06.22"
+  version: "2026.09.30"
 ---
 
+> Reference template: [antfu/starter-ts](https://github.com/antfu/starter-ts). When scaffolding a new TypeScript project, mirror its `package.json` scripts, `eslint.config.js`, `knip.json`, `tsdown.config.ts` and workflows rather than inventing a new layout.
+
 ## Coding Practices
 
 ### Code Organization
@@ -100,31 +102,82 @@ Prefer this over `npm view <pkg> version` when you only need the latest version,
 ### ESLint Setup
 
 ```js
-// eslint.config.mjs
+// eslint.config.js
 import antfu from '@antfu/eslint-config'
 
-export default antfu()
+export default antfu({
+  type: 'lib', // or 'app' (default)
+  pnpm: true, // enforce pnpm catalogs in package.json
+  antislop: true, // flag redundant/duplicated AI-style code, ban explicit `any`
+})
 ```
 
-
-When completing tasks, run `pnpm run lint --fix` to format the code and fix coding style.
+Always enable `antislop: true`. It requires `eslint-plugin-slop` and `eslint-plugin-sonarjs` as dev dependencies.
 
 For detailed configuration options: [antfu-eslint-config](references/antfu-eslint-config.md)
 
+### Knip
+
+Use [Knip](https://knip.dev) to catch unused files, exports and dependencies — the linter only sees one file at a time.
+
+```json
+// knip.json
+{
+  "$schema": "https://unpkg.com/knip@6/schema.json",
+  "project": ["src/**/*.ts"],
+  "ignoreDependencies": []
+}
+```
+
+Fix what Knip reports by deleting; only add to `ignoreDependencies` for tools invoked outside `package.json` scripts (e.g. `taze`).
+
+### Scripts and the `ci` Gate
+
+Every project exposes a `ci` script that runs all checks in one command:
+
+```json
+{
+  "scripts": {
+    "build": "tsdown",
+    "lint": "eslint --cache",
+    "typecheck": "tsc",
+    "knip": "knip",
+    "test": "pnpm run build && vitest",
+    "ci": "pnpm run lint && pnpm run typecheck && pnpm run knip && pnpm run test --run"
+  }
+}
+```
+
+**Before every commit, run `nr lint --fix` to format, then `nr ci` and make sure it passes.** Do not commit with a failing `ci`; fix the root cause instead of silencing rules or adding ignores.
+
 ### Git Hooks
 
+`simple-git-hooks` + `nano-staged`. The pre-commit hook runs the full `ci` gate; `prepare` also installs agent skills via `skills-npm`:
+
 ```json
 {
+  "scripts": {
+    "prepare": "git config core.hooksPath .githooks && simple-git-hooks && skills-npm"
+  },
   "simple-git-hooks": {
-    "pre-commit": "pnpm i --frozen-lockfile --ignore-scripts --offline && npx lint-staged"
+    "pre-commit": "pnpm i --frozen-lockfile --ignore-scripts --offline && pnpm run ci && pnpx nano-staged"
   },
-  "lint-staged": { "*": "eslint --fix" },
-  "scripts": {
-    "prepare": "npx simple-git-hooks"
+  "nano-staged": {
+    "*": "eslint --fix --no-warn-ignored"
   }
 }
 ```
 
+Add `.githooks` to `.gitignore` and `simple-git-hooks: true` under `allowBuilds` in `pnpm-workspace.yaml`.
+
+### skills-npm
+
+[`skills-npm`](https://github.com/antfu/skills-npm) symlinks agent skills shipped inside installed npm packages (and fetches those declared in a `skills` field) into the agent's skills directory on every install. Install as a dev dependency and wire it into `prepare` as above; add `skills/npm-*` to `.gitignore`. Commit the generated `skills-npm-lock.json`.
+
+### Publishing
+
+Prefer npm Trusted Publishing (OIDC) over `NPM_TOKEN` secrets: releases run on CI from a `v*` tag via `release.yml` with `id-token: write`, and `nr release` (`bumpp`) only bumps, tags and pushes. Details: [setting-up](references/setting-up.md#publishing-with-npm-trusted-publishing-oidc).
+
 ### pnpm Catalogs
 
 Use named catalogs in `pnpm-workspace.yaml` for version management:
@@ -144,8 +197,8 @@ Avoid the default catalog. Catalog names can be adjusted per project needs.
 
 | Topic | Description | Reference |
 |-------|-------------|-----------|
-| ESLint Config | Framework support, formatters, rule overrides, VS Code settings | [antfu-eslint-config](references/antfu-eslint-config.md) |
-| Project Setup | .gitignore, GitHub Actions, VS Code extensions | [setting-up](references/setting-up.md) |
+| ESLint Config | Framework support, antislop, formatters, rule overrides, VS Code settings | [antfu-eslint-config](references/antfu-eslint-config.md) |
+| Project Setup | .gitignore, GitHub Actions, OIDC trusted publishing, VS Code extensions | [setting-up](references/setting-up.md) |
 | App Development | Vue/Nuxt/UnoCSS conventions, auto-import control, Storybook component testing | [app-development](references/app-development.md) |
-| Library Development | tsdown bundling, pure ESM publishing | [library-development](references/library-development.md) |
+| Library Development | tsdown bundling, pure ESM publishing, publint, API snapshots | [library-development](references/library-development.md) |
 | Monorepo | pnpm workspaces, centralized alias, Turborepo | [monorepo](references/monorepo.md) |

plugins/antfu/.agents/skills/antfu/references/antfu-eslint-config.md

@@ -18,6 +18,12 @@ export default antfu({
   // Project type: 'lib' for libraries, 'app' (default) for applications
   type: 'lib',
 
+  // Enforce pnpm catalogs / workspace settings in package.json
+  pnpm: true,
+
+  // Always on: catch redundant, duplicated, AI-style code
+  antislop: true,
+
   // Global ignores (extends defaults, doesn't override)
   ignores: ['**/fixtures', '**/dist'],
 
@@ -37,6 +43,32 @@ export default antfu({
 })
 ```
 
+## Antislop
+
+```js
+export default antfu({
+  antislop: true,
+})
+// Requires: pnpm add -D eslint-plugin-slop eslint-plugin-sonarjs
+```
+
+Enables [`eslint-plugin-slop`](https://github.com/antfu/eslint-plugin-slop) plus a curated subset of `eslint-plugin-sonarjs` targeting redundant and duplicated code, and bans explicit `any` when TypeScript is enabled. Enable it on every project; when it flags code, simplify the code rather than disabling the rule.
+
+To toggle a plugin or scope inspection to recent changes:
+
+```js
+export default antfu({
+  antislop: {
+    sonarjs: false,
+    slop: {
+      inspection: { mode: 'recent-changes', tracebackCommits: 5 },
+    },
+  },
+})
+```
+
+Linters see one file at a time, so pair it with [Knip](https://knip.dev) for unused files/exports/dependencies (and `jscpd` for cross-file duplication when needed).
+
 ## Framework Support
 
 ### Vue
@@ -230,24 +262,28 @@ export default antfu({
 })
 ```
 
-## Lint-Staged Setup
+## Pre-commit Setup
 
 ```json
 {
+  "scripts": {
+    "prepare": "git config core.hooksPath .githooks && simple-git-hooks && skills-npm"
+  },
   "simple-git-hooks": {
-    "pre-commit": "pnpm lint-staged"
+    "pre-commit": "pnpm i --frozen-lockfile --ignore-scripts --offline && pnpm run ci && pnpx nano-staged"
   },
-  "lint-staged": {
-    "*": "eslint --fix"
+  "nano-staged": {
+    "*": "eslint --fix --no-warn-ignored"
   }
 }
 ```
 
 ```bash
-pnpm add -D lint-staged simple-git-hooks
-npx simple-git-hooks
+pnpm add -D nano-staged simple-git-hooks skills-npm
 ```
 
+The hook runs the full `ci` script (lint, typecheck, knip, tests) before auto-fixing staged files, so a commit never lands with a red check.
+
 ## VS Code Settings
 
 Add to `.vscode/settings.json`:

plugins/antfu/.agents/skills/antfu/references/library-development.md

@@ -11,6 +11,8 @@ description: Building and publishing TypeScript libraries with tsdown. Use when
 | Output | Pure ESM only (no CJS) |
 | DTS | Generated via tsdown |
 | Exports | Auto-generated via tsdown |
+| Package validation | publint (via tsdown) |
+| Publishing | npm Trusted Publishing (OIDC) from CI |
 
 ## tsdown Configuration
 
@@ -25,6 +27,7 @@ export default defineConfig({
   format: ['esm'],
   dts: true,
   exports: true,
+  publint: true,
 })
 ```
 
@@ -33,6 +36,7 @@ export default defineConfig({
 | `format` | `['esm']` | Pure ESM, no CommonJS |
 | `dts` | `true` | Generate `.d.ts` files |
 | `exports` | `true` | Auto-update `exports` field in `package.json` |
+| `publint` | `true` | Validate `package.json`/`exports` on every build (requires `publint` dev dependency) |
 
 ### Multiple Entry Points
 
@@ -129,21 +133,29 @@ Required fields for pure ESM library:
 ```json
 {
   "type": "module",
-  "main": "./dist/index.mjs",
-  "module": "./dist/index.mjs",
+  "sideEffects": false,
   "types": "./dist/index.d.mts",
   "files": ["dist"],
   "scripts": {
     "build": "tsdown",
-    "prepack": "pnpm build",
-    "test": "vitest",
-    "release": "bumpp -r"
+    "dev": "tsdown --watch",
+    "lint": "eslint --cache",
+    "typecheck": "tsc",
+    "knip": "knip",
+    "test": "pnpm run build && vitest",
+    "ci": "pnpm run lint && pnpm run typecheck && pnpm run knip && pnpm run test --run",
+    "prepack": "nr build",
+    "release": "bumpp"
   }
 }
 ```
 
-The `exports` field is managed by tsdown when `exports: true`.
+The `exports` field is managed by tsdown when `exports: true`. Use `bumpp -r` in monorepos.
 
 ### prepack Script
 
-For each public package, add `"prepack": "pnpm build"` to `scripts`. This ensures the package is automatically built before publishing (e.g., when running `npm publish` or `pnpm publish`). This prevents accidentally publishing stale or missing build artifacts.
+For each public package, add `"prepack": "nr build"` to `scripts`. This ensures the package is automatically built before publishing (e.g., when running `npm publish` or `pnpm publish`). This prevents accidentally publishing stale or missing build artifacts.
+
+### Releasing
+
+Run `nr ci` first — it must pass. Then `nr release`: `bumpp` bumps the version, commits, tags and pushes. The `v*` tag triggers `release.yml`, which builds and publishes via npm Trusted Publishing (OIDC). Do not publish from a local machine after the initial package creation; see [setting-up](setting-up.md#publishing-with-npm-trusted-publishing-oidc).

plugins/antfu/.agents/skills/antfu/references/setting-up.md

@@ -1,10 +1,12 @@
 ---
 name: setting-up
-description: Project setup files including .gitignore, GitHub Actions workflows, and VS Code extensions. Use when initializing new projects or adding CI/editor config.
+description: Project setup files including .gitignore, GitHub Actions workflows, npm OIDC trusted publishing, and VS Code extensions. Use when initializing new projects or adding CI/editor/release config.
 ---
 
 # Project Setup
 
+Start from [antfu/starter-ts](https://github.com/antfu/starter-ts); the files below mirror it.
+
 ## .gitignore
 
 Create when `.gitignore` is not present:
@@ -15,6 +17,7 @@ Create when `.gitignore` is not present:
 .cache
 .DS_Store
 .eslintcache
+.githooks
 .idea
 .env
 .nuxt
@@ -27,6 +30,7 @@ dist
 lib-cov
 logs
 node_modules
+skills/npm-*
 temp
 ```
 
@@ -50,12 +54,12 @@ jobs:
       contents: read
 ```
 
-### Unit Test Workflow
+### CI Workflow
 
-**`.github/workflows/unit-test.yml`** - Run tests on push/PR:
+**`.github/workflows/ci.yml`** - Run the checks on push/PR:
 
 ```yaml
-name: Unit Test
+name: CI
 
 on:
   push:
@@ -92,6 +96,17 @@ jobs:
       id-token: write
 ```
 
+## Publishing with npm Trusted Publishing (OIDC)
+
+Prefer [npm Trusted Publishing](https://docs.npmjs.com/trusted-publishers) over long-lived `NPM_TOKEN` secrets. The workflow above authenticates with a short-lived GitHub OIDC token (`id-token: write`), so there is nothing to leak or rotate, and every release is built on CI from a tagged commit.
+
+One-time setup per package:
+
+1. Run `pnpm publish` locally once so the package exists on npm.
+2. Open `https://www.npmjs.com/package/<name>/access` and link the GitHub repository + `release.yml` workflow as a trusted publisher.
+
+After that, `nr release` (`bumpp`) bumps the version, commits, tags and pushes; the tag triggers `release.yml`, which publishes. Never add an `NPM_TOKEN` secret to new projects, and don't run `npm publish` from a local machine for subsequent releases.
+
 ## VS Code Extensions
 
 Configure in `.vscode/extensions.json`: