diff --git a/.changeset/intent-skill-cross-package-links.md b/.changeset/intent-skill-cross-package-links.md new file mode 100644 index 00000000000..9d655e9e754 --- /dev/null +++ b/.changeset/intent-skill-cross-package-links.md @@ -0,0 +1,14 @@ +--- +'@tanstack/react-router': patch +'@tanstack/react-start': patch +'@tanstack/router-core': patch +'@tanstack/router-plugin': patch +'@tanstack/solid-router': patch +'@tanstack/solid-start': patch +'@tanstack/start-client-core': patch +'@tanstack/start-server-core': patch +'@tanstack/vue-router': patch +'@tanstack/vue-start': patch +--- + +Reference agent skills in other packages by their `intent load` identifier (`@tanstack/#`) instead of relative file links that break once packages are installed. diff --git a/packages/react-router/skills/compositions/router-query/SKILL.md b/packages/react-router/skills/compositions/router-query/SKILL.md index ce634b5068c..4fdd74fc302 100644 --- a/packages/react-router/skills/compositions/router-query/SKILL.md +++ b/packages/react-router/skills/compositions/router-query/SKILL.md @@ -21,7 +21,7 @@ sources: # TanStack Router + TanStack Query Integration -This skill requires familiarity with both TanStack Router and TanStack Query. Read [router-core](../../../../router-core/skills/router-core/SKILL.md) and [react-router](../../react-router/SKILL.md) first. +This skill requires familiarity with both TanStack Router and TanStack Query. Read `@tanstack/router-core#router-core` and [react-router](../../react-router/SKILL.md) first. This skill covers coordinating TanStack Query as an external data cache with TanStack Router's loader system. The router acts as a **coordinator** — it triggers data fetching during navigation, while Query manages caching, background refetching, and data lifecycle. @@ -437,5 +437,5 @@ TanStack Router has its own SWR cache (`staleTime`, `gcTime`, `defaultPreloadSta ## Cross-References -- [router-core/data-loading](../../../../router-core/skills/router-core/data-loading/SKILL.md) — built-in loader caching fundamentals -- [router-core/ssr](../../../../router-core/skills/router-core/ssr/SKILL.md) — SSR setup for dehydration/hydration +- `@tanstack/router-core#router-core/data-loading` — built-in loader caching fundamentals +- `@tanstack/router-core#router-core/ssr` — SSR setup for dehydration/hydration diff --git a/packages/react-router/skills/react-router/SKILL.md b/packages/react-router/skills/react-router/SKILL.md index ba628f70031..f8df76df02b 100644 --- a/packages/react-router/skills/react-router/SKILL.md +++ b/packages/react-router/skills/react-router/SKILL.md @@ -23,7 +23,7 @@ sources: # React Router (`@tanstack/react-router`) -This skill builds on router-core. Read [router-core](../../../router-core/skills/router-core/SKILL.md) first for foundational concepts. +This skill builds on router-core. Read `@tanstack/router-core#router-core` first for foundational concepts. > **CRITICAL**: TanStack Router types are FULLY INFERRED. Never cast, never annotate inferred values. > **CRITICAL**: TanStack Router is CLIENT-FIRST. Loaders run on the client by default, not on the server. @@ -495,4 +495,4 @@ function App() { ## Cross-References -- [router-core/SKILL.md](../../../router-core/skills/router-core/SKILL.md) — all sub-skills for domain-specific patterns (search params, data loading, navigation, auth, SSR, etc.) +- `@tanstack/router-core#router-core` — all sub-skills for domain-specific patterns (search params, data loading, navigation, auth, SSR, etc.) diff --git a/packages/react-start/skills/lifecycle/migrate-from-nextjs/SKILL.md b/packages/react-start/skills/lifecycle/migrate-from-nextjs/SKILL.md index d59292bc4b1..81b020713b5 100644 --- a/packages/react-start/skills/lifecycle/migrate-from-nextjs/SKILL.md +++ b/packages/react-start/skills/lifecycle/migrate-from-nextjs/SKILL.md @@ -432,5 +432,5 @@ export const myAction = createServerFn({ method: 'POST' }) ## Cross-References - [react-start](../../react-start/SKILL.md) — full React Start setup -- [start-core/server-functions](../../../../start-client-core/skills/start-core/server-functions/SKILL.md) — server function patterns -- [start-core/execution-model](../../../../start-client-core/skills/start-core/execution-model/SKILL.md) — isomorphic execution +- `@tanstack/start-client-core#start-core/server-functions` — server function patterns +- `@tanstack/start-client-core#start-core/execution-model` — isomorphic execution diff --git a/packages/react-start/skills/react-start/SKILL.md b/packages/react-start/skills/react-start/SKILL.md index b0f69009e10..988373f1072 100644 --- a/packages/react-start/skills/react-start/SKILL.md +++ b/packages/react-start/skills/react-start/SKILL.md @@ -291,6 +291,6 @@ Without `` in the root route's ``, client JavaScript doesn't lo ## Cross-References -- [start-core](../../../start-client-core/skills/start-core/SKILL.md) — core Start concepts -- [router-core](../../../router-core/skills/router-core/SKILL.md) — routing fundamentals -- [react-router](../../../react-router/skills/react-router/SKILL.md) — React Router hooks and components +- `@tanstack/start-client-core#start-core` — core Start concepts +- `@tanstack/router-core#router-core` — routing fundamentals +- `@tanstack/react-router#react-router` — React Router hooks and components diff --git a/packages/router-core/skills/router-core/auth-and-guards/SKILL.md b/packages/router-core/skills/router-core/auth-and-guards/SKILL.md index 1f8bcb7a196..4d1a6a3b6e0 100644 --- a/packages/router-core/skills/router-core/auth-and-guards/SKILL.md +++ b/packages/router-core/skills/router-core/auth-and-guards/SKILL.md @@ -21,7 +21,7 @@ sources: # Auth and Guards -> **This skill covers the routing side of auth.** Route guards are UX and navigation control; the data/API boundary still belongs in the server function, server route, or API endpoint that reads or mutates private data. For the **server-side primitives** — session cookies (`HttpOnly`/`Secure`/`SameSite`), external session helpers, OAuth `state` + PKCE, password-reset enumeration defense, CSRF, rate limiting — see [start-core/auth-server-primitives](../../../../start-client-core/skills/start-core/auth-server-primitives/SKILL.md). +> **This skill covers the routing side of auth.** Route guards are UX and navigation control; the data/API boundary still belongs in the server function, server route, or API endpoint that reads or mutates private data. For the **server-side primitives** — session cookies (`HttpOnly`/`Secure`/`SameSite`), external session helpers, OAuth `state` + PKCE, password-reset enumeration defense, CSRF, rate limiting — see `@tanstack/start-client-core#start-core/auth-server-primitives`. > > **CRITICAL**: A route guard (`beforeLoad`) does NOT protect a `createServerFn` declared on that route. Server functions are API endpoints reachable independently of the route that calls them. See "Route guards do not protect server functions" below. @@ -408,7 +408,7 @@ const getMyOrders = createServerFn({ method: 'GET' }) }) ``` -Rule of thumb: every `createServerFn`, server route, or API endpoint that touches user data needs `authMiddleware` (or an equivalent in-handler check). The route guard is for the page experience; the endpoint guard is for the data. See [start-core/auth-server-primitives](../../../../start-client-core/skills/start-core/auth-server-primitives/SKILL.md) for the full session/middleware pattern. +Rule of thumb: every `createServerFn`, server route, or API endpoint that touches user data needs `authMiddleware` (or an equivalent in-handler check). The route guard is for the page experience; the endpoint guard is for the data. See `@tanstack/start-client-core#start-core/auth-server-primitives` for the full session/middleware pattern. ### CRITICAL: The anonymous destination can still disclose protected data diff --git a/packages/router-core/skills/router-core/ssr/SKILL.md b/packages/router-core/skills/router-core/ssr/SKILL.md index d1e0524f139..752fb837a5f 100644 --- a/packages/router-core/skills/router-core/ssr/SKILL.md +++ b/packages/router-core/skills/router-core/ssr/SKILL.md @@ -489,4 +489,4 @@ See [router-core/data-loading](../data-loading/SKILL.md) for loader fundamentals ## Cross-References - [router-core/data-loading](../data-loading/SKILL.md) — SSR changes where loaders execute -- [compositions/router-query](../../../../react-router/skills/compositions/router-query/SKILL.md) — SSR dehydration/hydration with TanStack Query +- `@tanstack/react-router#compositions/router-query` — SSR dehydration/hydration with TanStack Query diff --git a/packages/router-plugin/skills/router-plugin/SKILL.md b/packages/router-plugin/skills/router-plugin/SKILL.md index 972584dc963..b6a7fccef6d 100644 --- a/packages/router-plugin/skills/router-plugin/SKILL.md +++ b/packages/router-plugin/skills/router-plugin/SKILL.md @@ -246,5 +246,5 @@ Changes to `routeTree.gen.ts` are overwritten and can leave source routes, gener ## Cross-References -- [router-core/code-splitting](../../../router-core/skills/router-core/code-splitting/SKILL.md) — manual code splitting concepts -- [virtual-file-routes](../../../virtual-file-routes/skills/virtual-file-routes/SKILL.md) — programmatic route trees +- `@tanstack/router-core#router-core/code-splitting` — manual code splitting concepts +- `@tanstack/virtual-file-routes#virtual-file-routes` — programmatic route trees diff --git a/packages/solid-router/skills/solid-router/SKILL.md b/packages/solid-router/skills/solid-router/SKILL.md index 0cfd22ad730..e6bff33a420 100644 --- a/packages/solid-router/skills/solid-router/SKILL.md +++ b/packages/solid-router/skills/solid-router/SKILL.md @@ -21,7 +21,7 @@ sources: # Solid Router (`@tanstack/solid-router`) -This skill builds on router-core. Read [router-core](../../../router-core/skills/router-core/SKILL.md) first for foundational concepts. +This skill builds on router-core. Read `@tanstack/router-core#router-core` first for foundational concepts. > **CRITICAL**: TanStack Router types are FULLY INFERRED. Never cast, never annotate inferred values. > **CRITICAL**: TanStack Router is CLIENT-FIRST. Loaders run on the client by default, not on the server. @@ -495,4 +495,4 @@ Must set `target: 'solid'` in the router plugin config. Default is `'react'`. ## Cross-References -- [router-core/SKILL.md](../../../router-core/skills/router-core/SKILL.md) — all sub-skills for domain-specific patterns (search params, data loading, navigation, auth, SSR, etc.) +- `@tanstack/router-core#router-core` — all sub-skills for domain-specific patterns (search params, data loading, navigation, auth, SSR, etc.) diff --git a/packages/solid-start/skills/solid-start/SKILL.md b/packages/solid-start/skills/solid-start/SKILL.md index ccd1322d05d..6c56711e0b8 100644 --- a/packages/solid-start/skills/solid-start/SKILL.md +++ b/packages/solid-start/skills/solid-start/SKILL.md @@ -19,7 +19,7 @@ sources: # Solid Start (`@tanstack/solid-start`) -This skill builds on start-core. Read [start-core](../../../start-client-core/skills/start-core/SKILL.md) first for foundational concepts. +This skill builds on start-core. Read `@tanstack/start-client-core#start-core` first for foundational concepts. This skill covers the Solid-specific bindings, setup, and patterns for TanStack Start. @@ -276,6 +276,6 @@ plugins: [tanstackStart(), solidPlugin()] ## Cross-References -- [start-core](../../../start-client-core/skills/start-core/SKILL.md) — core Start concepts -- [router-core](../../../router-core/skills/router-core/SKILL.md) — routing fundamentals -- [solid-router](../../../solid-router/skills/solid-router/SKILL.md) — Solid Router hooks and components +- `@tanstack/start-client-core#start-core` — core Start concepts +- `@tanstack/router-core#router-core` — routing fundamentals +- `@tanstack/solid-router#solid-router` — Solid Router hooks and components diff --git a/packages/start-client-core/skills/start-core/auth-server-primitives/SKILL.md b/packages/start-client-core/skills/start-core/auth-server-primitives/SKILL.md index f088496ece3..eb50266b004 100644 --- a/packages/start-client-core/skills/start-core/auth-server-primitives/SKILL.md +++ b/packages/start-client-core/skills/start-core/auth-server-primitives/SKILL.md @@ -23,7 +23,7 @@ sources: # Auth Server Primitives -This skill covers the **server half** of authentication: session storage, cookie issuance, OAuth flow, password-reset hardening, CSRF, rate limiting. For the **routing half** (`_authenticated` layout, `beforeLoad` redirects, RBAC checks), see [router-core/auth-and-guards](../../../../router-core/skills/router-core/auth-and-guards/SKILL.md). +This skill covers the **server half** of authentication: session storage, cookie issuance, OAuth flow, password-reset hardening, CSRF, rate limiting. For the **routing half** (`_authenticated` layout, `beforeLoad` redirects, RBAC checks), see `@tanstack/router-core#router-core/auth-and-guards`. > **CRITICAL**: Protect the data/API boundary first. Server functions, server routes, and other API endpoints that touch private data must enforce auth **inside the handler** or middleware. Route guards are route UX, not the data security boundary. > **CRITICAL**: Validating the _shape_ of a client-supplied identifier (`z.string().uuid().parse(...)`) is not authorization. A parsed UUID is still _some_ tenant — re-check membership against the session principal before using it. @@ -409,7 +409,7 @@ A session token that never rotates is functionally a long-lived credential. Rota ## Cross-References -- [router-core/auth-and-guards](../../../../router-core/skills/router-core/auth-and-guards/SKILL.md) — the routing side: `_authenticated` layout, `beforeLoad`, `redirect`, RBAC checks. +- `@tanstack/router-core#router-core/auth-and-guards` — the routing side: `_authenticated` layout, `beforeLoad`, `redirect`, RBAC checks. - [start-core/server-functions](../server-functions/SKILL.md) — how to expose RPCs (and how the route guard does NOT cover them). - [start-core/middleware](../middleware/SKILL.md) — composing `authMiddleware` and others. - [start-core/execution-model](../execution-model/SKILL.md) — why module-level env/secret reads are wrong. diff --git a/packages/start-client-core/skills/start-core/middleware/SKILL.md b/packages/start-client-core/skills/start-core/middleware/SKILL.md index 972ed474af5..f98d8b1852e 100644 --- a/packages/start-client-core/skills/start-core/middleware/SKILL.md +++ b/packages/start-client-core/skills/start-core/middleware/SKILL.md @@ -244,7 +244,7 @@ const authMiddleware = createMiddleware().server(async ({ next, request }) => { }) ``` -> **Attach `authMiddleware` to every `createServerFn` that needs auth.** Server functions are API endpoints; a route `beforeLoad` does not protect their data, only the route's UI. Protect the endpoint that reads or mutates private data. See [router-core/auth-and-guards](../../../../router-core/skills/router-core/auth-and-guards/SKILL.md) and [start-core/auth-server-primitives](../auth-server-primitives/SKILL.md). +> **Attach `authMiddleware` to every `createServerFn` that needs auth.** Server functions are API endpoints; a route `beforeLoad` does not protect their data, only the route's UI. Protect the endpoint that reads or mutates private data. See `@tanstack/router-core#router-core/auth-and-guards` and [start-core/auth-server-primitives](../auth-server-primitives/SKILL.md). ```tsx type Permissions = Record @@ -396,4 +396,4 @@ createMiddleware({ type: 'function' }) - [start-core/server-functions](../server-functions/SKILL.md) — what middleware wraps - [start-core/server-routes](../server-routes/SKILL.md) — middleware on API endpoints - [start-core/auth-server-primitives](../auth-server-primitives/SKILL.md) — building the `authMiddleware` factory itself: session cookie reads, OAuth state, CSRF -- [router-core/auth-and-guards](../../../../router-core/skills/router-core/auth-and-guards/SKILL.md) — routing-side UX guards; data auth belongs in the server function, server route, or API endpoint handler/middleware +- `@tanstack/router-core#router-core/auth-and-guards` — routing-side UX guards; data auth belongs in the server function, server route, or API endpoint handler/middleware diff --git a/packages/start-client-core/skills/start-core/server-functions/SKILL.md b/packages/start-client-core/skills/start-core/server-functions/SKILL.md index 199adfb8bc4..881e76b873a 100644 --- a/packages/start-client-core/skills/start-core/server-functions/SKILL.md +++ b/packages/start-client-core/skills/start-core/server-functions/SKILL.md @@ -495,4 +495,4 @@ Relative `fetch` is fine in a browser-only event handler. It is not a universal - [start-core/execution-model](../execution-model/SKILL.md) — understanding where code runs - [start-core/middleware](../middleware/SKILL.md) — composing server functions with middleware - [start-core/auth-server-primitives](../auth-server-primitives/SKILL.md) — sessions, cookies, OAuth, CSRF, rate limiting (the server-side half of auth; `getCurrentUser` and external session helpers belong here, not at module scope) -- [router-core/auth-and-guards](../../../../router-core/skills/router-core/auth-and-guards/SKILL.md) — routing-side UX guards; data auth belongs in the server function, server route, or API endpoint handler/middleware +- `@tanstack/router-core#router-core/auth-and-guards` — routing-side UX guards; data auth belongs in the server function, server route, or API endpoint handler/middleware diff --git a/packages/start-server-core/skills/start-server-core/SKILL.md b/packages/start-server-core/skills/start-server-core/SKILL.md index 9428b04e3e7..2e37e7b7ffd 100644 --- a/packages/start-server-core/skills/start-server-core/SKILL.md +++ b/packages/start-server-core/skills/start-server-core/SKILL.md @@ -247,6 +247,6 @@ Do not create session config from `process.env` at module load or cache `getRequ ## Cross-References -- [start-core/server-functions](../../../start-client-core/skills/start-core/server-functions/SKILL.md) — creating server functions that use these utilities -- [start-core/middleware](../../../start-client-core/skills/start-core/middleware/SKILL.md) — request middleware -- [start-core/server-routes](../../../start-client-core/skills/start-core/server-routes/SKILL.md) — server route handlers +- `@tanstack/start-client-core#start-core/server-functions` — creating server functions that use these utilities +- `@tanstack/start-client-core#start-core/middleware` — request middleware +- `@tanstack/start-client-core#start-core/server-routes` — server route handlers diff --git a/packages/vue-router/skills/vue-router/SKILL.md b/packages/vue-router/skills/vue-router/SKILL.md index 5fea4fef7a0..61c13bef1fc 100644 --- a/packages/vue-router/skills/vue-router/SKILL.md +++ b/packages/vue-router/skills/vue-router/SKILL.md @@ -21,7 +21,7 @@ sources: # Vue Router (`@tanstack/vue-router`) -This skill builds on router-core. Read [router-core](../../../router-core/skills/router-core/SKILL.md) first for foundational concepts. +This skill builds on router-core. Read `@tanstack/router-core#router-core` first for foundational concepts. This skill covers the Vue-specific bindings, components, composables, and setup for TanStack Router. @@ -390,4 +390,4 @@ Must set `target: 'vue'` in the router plugin config. Default is `'react'`. ## Cross-References -- [router-core/SKILL.md](../../../router-core/skills/router-core/SKILL.md) — all sub-skills for domain-specific patterns (search params, data loading, navigation, auth, SSR, etc.) +- `@tanstack/router-core#router-core` — all sub-skills for domain-specific patterns (search params, data loading, navigation, auth, SSR, etc.) diff --git a/packages/vue-start/skills/vue-start/SKILL.md b/packages/vue-start/skills/vue-start/SKILL.md index 9c84ee5c2dd..3a32dc169a5 100644 --- a/packages/vue-start/skills/vue-start/SKILL.md +++ b/packages/vue-start/skills/vue-start/SKILL.md @@ -18,7 +18,7 @@ sources: # Vue Start (`@tanstack/vue-start`) -This skill builds on start-core. Read [start-core](../../../start-client-core/skills/start-core/SKILL.md) first for foundational concepts. +This skill builds on start-core. Read `@tanstack/start-client-core#start-core` first for foundational concepts. This skill covers the Vue-specific bindings, setup, and patterns for TanStack Start. @@ -303,6 +303,6 @@ function RootComponent() { ## Cross-References -- [start-core](../../../start-client-core/skills/start-core/SKILL.md) — core Start concepts -- [router-core](../../../router-core/skills/router-core/SKILL.md) — routing fundamentals -- [vue-router](../../../vue-router/skills/vue-router/SKILL.md) — Vue Router composables and components +- `@tanstack/start-client-core#start-core` — core Start concepts +- `@tanstack/router-core#router-core` — routing fundamentals +- `@tanstack/vue-router#vue-router` — Vue Router composables and components