[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6X6D0YG3DC2EB90FZTP8673":3,"skill-same:01M6X6D0YG3DC2EB90FZTP8673":77},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":49,"commitSha":50,"skillDirectory":51,"forksCount":52,"repositoryHtmlUrl":53,"repositoryHomepageUrl":54,"ownerHtmlUrl":55,"ownerBlogUrl":54,"ownerDescription":56,"updatedAt":57,"install":58,"resources":70},"01M6X6D0YG3DC2EB90FZTP8673","composer-packages",null,"Use when building or maintaining a Composer library — versioning, Laravel integration, autoloading, publishing to private registries — even when the user says 'release a new version'.","event4u-app\u002Fagent-config","event4u-app","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F199339632?v=4","01M6X5TWBNCQCE1VDKT4E9KF7N","event4u.app","01M6X5TWF4HRM266RG2Q5VVH1X",19,"MIT","https:\u002F\u002Fgithub.com\u002Fevent4u-app\u002Fagent-config\u002Fblob\u002Fmain\u002Fsrc\u002Fskills\u002Fcomposer-packages\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"composer packages","composer","packages","use","new","when","true","professional","false","publishing","version","user","versioning","laravel","php","engineering","integration","library","release","2026-11-10 10:12:30",false,"---\nmodel_tier: medium\nname: composer-packages\ndescription: \"Use when building or maintaining a Composer library — versioning, Laravel integration, autoloading, publishing to private registries — even when the user says 'release a new version'.\"\ndomain: engineering\nworkspaces:\n  - engineering\npacks:\n  - php\ntrust:\n  level: professional\ninstall:\n  default: false\n  removable: true\n---\n\n# composer-packages\n\n## When to use\n\nUse this skill when creating, maintaining, or publishing Composer library packages — including Laravel packages with service providers, Artisan commands, and config publishing.\n\n## Procedure: Work with Composer packages\n\n1. Read the package's `composer.json` for structure and dependencies.\n2. Check if it's a Laravel package (look for `extra.laravel.providers`).\n3. Read the package's `README.md` and `CHANGELOG.md`.\n4. Check the `agents\u002F` directory in the package for package-specific docs.\n\n## Known packages\n\nCheck the project's `composer.json` for organization-specific packages.\nCheck `agents\u002Foverrides\u002Fskills\u002Fcomposer-packages.md` for the package registry and known packages list.\n\n## Package structure\n\n```\nmy-package\u002F\n├── src\u002F                    # Source code\n│   ├── App\u002F\n│   │   └── Providers\u002F      # Laravel service providers\n│   └── ...\n├── config\u002F                 # Publishable config files\n├── tests\u002F                  # Package tests\n├── composer.json           # Package manifest\n├── README.md               # Documentation\n├── CHANGELOG.md            # Version history\n└── agents\u002F                 # Package-specific agent docs\n```\n\n## composer.json essentials\n\n### Required fields\n\n```json\n{\n    \"name\": \"vendor\u002Fmy-package\",\n    \"type\": \"library\",\n    \"description\": \"Clear, concise description\",\n    \"require\": {\n        \"php\": \"^8.2\"\n    },\n    \"autoload\": {\n        \"psr-4\": {\n            \"Vendor\\\\MyPackage\\\\\": \"src\u002F\"\n        }\n    }\n}\n```\n\n### Laravel package auto-discovery\n\n```json\n{\n    \"extra\": {\n        \"laravel\": {\n            \"providers\": [\n                \"Vendor\\\\MyPackage\\\\App\\\\Providers\\\\PackageServiceProvider\"\n            ]\n        }\n    }\n}\n```\n\n### Composer scripts \u002F plugins\n\nPackages can hook into Composer lifecycle events:\n\n```json\n{\n    \"scripts\": {\n        \"post-install-cmd\": [\n            \"MyNamespace\\\\ComposerScripts::onInstall\"\n        ]\n    }\n}\n```\n\n## Version constraints\n\nUse **wide version ranges** for library packages to maximize compatibility:\n\n```json\n{\n    \"require\": {\n        \"php\": \"^8.1 || ^8.2 || ^8.3 || ^8.4\",\n        \"illuminate\u002Fsupport\": \"^10.0 || ^11.0 || ^12.0\"\n    }\n}\n```\n\n**Libraries** should use `||` ranges. **Applications** should use `^` (caret).\n\n## Advisories, abandoned packages, audit\n\n- **`composer audit --locked`** checks the lockfile against the Packagist\n  advisory database; CI should run it so a known advisory is a red check, not a\n  surprise. It exits non-zero when it finds something — that is the answer, not\n  an error.\n- **`config.audit`** in `composer.json` (`abandoned: fail`, `ignore` with a\n  reason per advisory ID) makes Composer itself refuse on install; an `ignore`\n  without a reason is a silenced finding, not an accepted one.\n- **Abandoned packages** show in `composer outdated --direct` and in\n  `composer audit`; pick the suggested replacement before the abandonment\n  becomes an unpatched advisory.\n- **The Composer binary is a dependency too** — it has had its own advisories;\n  keep it on a supported release (`composer self-update --stable`).\n- Ongoing monitoring between changes: `agent-config audit:deps refresh` reads the\n  lockfile, the declared PHP version and the PHP release feed, and names what\n  needs action today.\n\n## Local development\n\n### Path repositories\n\nIn the consuming project's `composer.json`:\n\n```json\n{\n    \"repositories\": [\n        { \"type\": \"path\", \"url\": \"..\u002Fpackages\u002Fmy-package\" }\n    ]\n}\n```\n\nThen: `composer require vendor\u002Fmy-package:@dev`\n\n### Development project\n\nIf the organization has a dedicated development sandbox for testing packages, use it for local testing.\n\n## Publishing\n\n### Private registry (GitHub Packages \u002F Satis)\n\nPackages are published to a private Composer registry. Check the organization's Satis or GitHub Packages setup.\n\n### Pre-publish checklist\n\n1. `composer validate` — verify `composer.json` is valid.\n2. `composer dump-autoload` — verify autoloading works.\n3. Run tests: `vendor\u002Fbin\u002Fphpunit` or `vendor\u002Fbin\u002Fpest`.\n4. Run quality tools: PHPStan, ECS, Rector.\n5. Update `CHANGELOG.md` with the new version.\n6. Tag the release: `git tag v1.2.3`.\n\n## Conventions\n\n- Follow the organization's namespace convention (check existing packages).\n- Use `declare(strict_types=1)` in all PHP files.\n- Use typed properties, parameters, and return types.\n- Follow the same coding standards as the main projects (see `php-coder` skill).\n- Include `agents\u002F` directory for package-specific documentation.\n\n\n## Output format\n\n1. Package files following standard Composer structure\n2. Updated composer.json with correct autoloading and dependencies\n3. Service provider and config publishing (if Laravel package)\n\n## Auto-trigger keywords\n\n- Composer package\n- library development\n- package versioning\n\n## Gotcha\n\n- Don't add `composer.lock` to library packages — it should be in `.gitignore` for libraries (not apps).\n- Minimum stability must be explicit — don't assume `stable`.\n- The model tends to set overly restrictive version constraints — use `^` (caret) not `=` (exact).\n\n## Do NOT\n\n- Do NOT use `*` version constraints in library packages.\n- Do NOT require specific patch versions — use `^` or `||` ranges.\n- Do NOT include dev dependencies in `require` — use `require-dev`.\n- Do NOT forget to run `composer validate` before publishing.\n- Do NOT publish without updating the changelog and tagging.\n","# composer-packages\n\n## When to use\n\nUse this skill when creating, maintaining, or publishing Composer library packages — including Laravel packages with service providers, Artisan commands, and config publishing.\n\n## Procedure: Work with Composer packages\n\n1. Read the package's `composer.json` for structure and dependencies.\n2. Check if it's a Laravel package (look for `extra.laravel.providers`).\n3. Read the package's `README.md` and `CHANGELOG.md`.\n4. Check the `agents\u002F` directory in the package for package-specific docs.\n\n## Known packages\n\nCheck the project's `composer.json` for organization-specific packages.\nCheck `agents\u002Foverrides\u002Fskills\u002Fcomposer-packages.md` for the package registry and known packages list.\n\n## Package structure\n\n```\nmy-package\u002F\n├── src\u002F                    # Source code\n│   ├── App\u002F\n│   │   └── Providers\u002F      # Laravel service providers\n│   └── ...\n├── config\u002F                 # Publishable config files\n├── tests\u002F                  # Package tests\n├── composer.json           # Package manifest\n├── README.md               # Documentation\n├── CHANGELOG.md            # Version history\n└── agents\u002F                 # Package-specific agent docs\n```\n\n## composer.json essentials\n\n### Required fields\n\n```json\n{\n    \"name\": \"vendor\u002Fmy-package\",\n    \"type\": \"library\",\n    \"description\": \"Clear, concise description\",\n    \"require\": {\n        \"php\": \"^8.2\"\n    },\n    \"autoload\": {\n        \"psr-4\": {\n            \"Vendor\\\\MyPackage\\\\\": \"src\u002F\"\n        }\n    }\n}\n```\n\n### Laravel package auto-discovery\n\n```json\n{\n    \"extra\": {\n        \"laravel\": {\n            \"providers\": [\n                \"Vendor\\\\MyPackage\\\\App\\\\Providers\\\\PackageServiceProvider\"\n            ]\n        }\n    }\n}\n```\n\n### Composer scripts \u002F plugins\n\nPackages can hook into Composer lifecycle events:\n\n```json\n{\n    \"scripts\": {\n        \"post-install-cmd\": [\n            \"MyNamespace\\\\ComposerScripts::onInstall\"\n        ]\n    }\n}\n```\n\n## Version constraints\n\nUse **wide version ranges** for library packages to maximize compatibility:\n\n```json\n{\n    \"require\": {\n        \"php\": \"^8.1 || ^8.2 || ^8.3 || ^8.4\",\n        \"illuminate\u002Fsupport\": \"^10.0 || ^11.0 || ^12.0\"\n    }\n}\n```\n\n**Libraries** should use `||` ranges. **Applications** should use `^` (caret).\n\n## Advisories, abandoned packages, audit\n\n- **`composer audit --locked`** checks the lockfile against the Packagist\n  advisory database; CI should run it so a known advisory is a red check, not a\n  surprise. It exits non-zero when it finds something — that is the answer, not\n  an error.\n- **`config.audit`** in `composer.json` (`abandoned: fail`, `ignore` with a\n  reason per advisory ID) makes Composer itself refuse on install; an `ignore`\n  without a reason is a silenced finding, not an accepted one.\n- **Abandoned packages** show in `composer outdated --direct` and in\n  `composer audit`; pick the suggested replacement before the abandonment\n  becomes an unpatched advisory.\n- **The Composer binary is a dependency too** — it has had its own advisories;\n  keep it on a supported release (`composer self-update --stable`).\n- Ongoing monitoring between changes: `agent-config audit:deps refresh` reads the\n  lockfile, the declared PHP version and the PHP release feed, and names what\n  needs action today.\n\n## Local development\n\n### Path repositories\n\nIn the consuming project's `composer.json`:\n\n```json\n{\n    \"repositories\": [\n        { \"type\": \"path\", \"url\": \"..\u002Fpackages\u002Fmy-package\" }\n    ]\n}\n```\n\nThen: `composer require vendor\u002Fmy-package:@dev`\n\n### Development project\n\nIf the organization has a dedicated development sandbox for testing packages, use it for local testing.\n\n## Publishing\n\n### Private registry (GitHub Packages \u002F Satis)\n\nPackages are published to a private Composer registry. Check the organization's Satis or GitHub Packages setup.\n\n### Pre-publish checklist\n\n1. `composer validate` — verify `composer.json` is valid.\n2. `composer dump-autoload` — verify autoloading works.\n3. Run tests: `vendor\u002Fbin\u002Fphpunit` or `vendor\u002Fbin\u002Fpest`.\n4. Run quality tools: PHPStan, ECS, Rector.\n5. Update `CHANGELOG.md` with the new version.\n6. Tag the release: `git tag v1.2.3`.\n\n## Conventions\n\n- Follow the organization's namespace convention (check existing packages).\n- Use `declare(strict_types=1)` in all PHP files.\n- Use typed properties, parameters, and return types.\n- Follow the same coding standards as the main projects (see `php-coder` skill).\n- Include `agents\u002F` directory for package-specific documentation.\n\n\n## Output format\n\n1. Package files following standard Composer structure\n2. Updated composer.json with correct autoloading and dependencies\n3. Service provider and config publishing (if Laravel package)\n\n## Auto-trigger keywords\n\n- Composer package\n- library development\n- package versioning\n\n## Gotcha\n\n- Don't add `composer.lock` to library packages — it should be in `.gitignore` for libraries (not apps).\n- Minimum stability must be explicit — don't assume `stable`.\n- The model tends to set overly restrictive version constraints — use `^` (caret) not `=` (exact).\n\n## Do NOT\n\n- Do NOT use `*` version constraints in library packages.\n- Do NOT require specific patch versions — use `^` or `||` ranges.\n- Do NOT include dev dependencies in `require` — use `require-dev`.\n- Do NOT forget to run `composer validate` before publishing.\n- Do NOT publish without updating the changelog and tagging.\n",{"name":5,"packs":43,"trust":44,"domain":34,"install":45,"model_tier":47,"workspaces":48,"description":7},[33],{"level":26},{"default":39,"removable":46},true,"medium",[34],"main","12bd765ce1d800501d45dfb8232102793af01290","src\u002Fskills\u002Fcomposer-packages",1,"https:\u002F\u002Fgithub.com\u002Fevent4u-app\u002Fagent-config","https:\u002F\u002Fevent4u.app","https:\u002F\u002Fgithub.com\u002Fevent4u-app","Your events in your hand","2026-11-11 22:25:41",{"source":8,"skillName":5,"commands":59,"prompt":69,"zipAvailable":46},[60,63,66],{"tool":61,"command":62},"npx","npx skills add event4u-app\u002Fagent-config --skill composer-packages",{"tool":64,"command":65},"bunx","bunx skills add event4u-app\u002Fagent-config --skill composer-packages",{"tool":67,"command":68},"pnpm","pnpm dlx skills add event4u-app\u002Fagent-config --skill composer-packages","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fevent4u-app\u002Fagent-config\u002Fblob\u002Fmain\u002Fsrc\u002Fskills\u002Fcomposer-packages\u002FSKILL.md",[71],{"path":72,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":75,"sourceHtmlUrl":76},"evals\u002Ftriggers.json","REFERENCE","参考文档",2870,"https:\u002F\u002Fgithub.com\u002Fevent4u-app\u002Fagent-config\u002Fblob\u002Fmain\u002Fsrc\u002Fskills\u002Fcomposer-packages\u002Fevals\u002Ftriggers.json",[78,96,109,121,133,142],{"skillNo":79,"name":80,"nameZh":6,"description":81,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":82,"categories":83,"keywords":89,"publishedAt":38},"01M6X84PK96XBPENXH66JCTSD1","unknown-key-fixture","Declares a key the schema does not know.","https:\u002F\u002Fgithub.com\u002Fevent4u-app\u002Fagent-config\u002Fblob\u002Fmain\u002Ftests\u002Fscripts\u002Ffixtures\u002Fbody-portable\u002Funknown-key\u002FSKILL.md",[84],{"categoryNo":85,"categoryName":86,"taxonomyType":87,"taxonomyTypeDesc":88},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[90,91,92,93,94,95],"unknown key fixture","Unknown key","fixture","unknown","schema","package",{"skillNo":97,"name":98,"nameZh":6,"description":99,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":100,"categories":101,"keywords":103,"publishedAt":38},"01M6X84HW7NAHZ7GZMQ9RXK1XJ","portable-fixture","Declares only semantics the MCP-lite carrier transports whole.","https:\u002F\u002Fgithub.com\u002Fevent4u-app\u002Fagent-config\u002Fblob\u002Fmain\u002Ftests\u002Fscripts\u002Ffixtures\u002Fbody-portable\u002Fportable\u002FSKILL.md",[102],{"categoryNo":85,"categoryName":86,"taxonomyType":87,"taxonomyTypeDesc":88},[92,104,105,106,107,95,108],"portable","portable fixture","engineer","only","MCP",{"skillNo":110,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":116,"publishedAt":38},"01M6X84F29FE0RGGZ1ZTFGZTX2","non-portable-fixture","Declares a runtime semantic the carrier drops.","https:\u002F\u002Fgithub.com\u002Fevent4u-app\u002Fagent-config\u002Fblob\u002Fmain\u002Ftests\u002Fscripts\u002Ffixtures\u002Fbody-portable\u002Fnon-portable\u002FSKILL.md",[115],{"categoryNo":85,"categoryName":86,"taxonomyType":87,"taxonomyTypeDesc":88},[105,117,104,92,118,119,120,95],"non portable fixture","semantic","high","runtime",{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":128,"publishedAt":38},"01M6X848F706PT9MDCX75JKJ6B","candidate-zero-width","A candidate whose prose carries an invisible joiner.","https:\u002F\u002Fgithub.com\u002Fevent4u-app\u002Fagent-config\u002Fblob\u002Fmain\u002Ftests\u002Ffixtures\u002Fskill-scout-candidates\u002Fzero-width-injection\u002FSKILL.md",[127],{"categoryNo":85,"categoryName":86,"taxonomyType":87,"taxonomyTypeDesc":88},[129,130,131,132],"candidate zero width","candidate","ZeRO","prose",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":140,"publishedAt":38},"01M6X841SSC2T31VDF41SA6DG1","candidate-disclosure-suppression","A candidate whose prose tells the agent to withhold from the user.","https:\u002F\u002Fgithub.com\u002Fevent4u-app\u002Fagent-config\u002Fblob\u002Fmain\u002Ftests\u002Ffixtures\u002Fskill-scout-candidates\u002Fdisclosure-suppression\u002FSKILL.md",[139],{"categoryNo":85,"categoryName":86,"taxonomyType":87,"taxonomyTypeDesc":88},[141,130,132,30],"candidate disclosure suppression",{"skillNo":143,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":149,"publishedAt":38},"01M6X83TFS5AGPBPVTQNWP0BB3","candidate-dangerous-frontmatter","A candidate claiming an unscoped tool grant and a permission bypass.","https:\u002F\u002Fgithub.com\u002Fevent4u-app\u002Fagent-config\u002Fblob\u002Fmain\u002Ftests\u002Ffixtures\u002Fskill-scout-candidates\u002Fdangerous-frontmatter\u002FSKILL.md",[148],{"categoryNo":85,"categoryName":86,"taxonomyType":87,"taxonomyTypeDesc":88},[150,130,151,152,153,154],"candidate dangerous frontmatter","frontmatter","shell","permission","tool"]