Review/browser native

.markdownlint.json

@@ -1,6 +1,7 @@
 {
   "MD013": false,
   "MD022": false,
+  "MD024": { "siblings_only": true },
   "MD032": false,
   "MD033": false,
   "MD060": false

CHANGELOG.md

@@ -0,0 +1,130 @@
+# Changelog
+
+All notable changes to this skills repository are documented here.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
+The repository is not versioned as a whole; individual skills carry their own
+version in their frontmatter, so entries below are grouped by date.
+
+## [Unreleased]
+
+### Added
+
+- browser-native: Baseline status (`widely` / `newly` / `limited`) on replacement
+  entries, surfaced alongside confidence in the table, markdown, and JSON output.
+- browser-native: new replaceable packages — `timeago.js`, `pluralize`, `numeral`,
+  `accounting`, `humanize-duration`, `lodash.groupby`,
+  `lodash.union`/`intersection`/`difference`, and a UI Primitives cluster
+  (`a11y-dialog`, `focus-trap`, `body-scroll-lock`, `tippy.js`).
+- browser-native: three-question decision framework and progressive-enhancement
+  guidance in SKILL.md, plus a "keep for now" Temporal note explaining why
+  `dayjs`/`date-fns` are not flagged.
+
+### Changed
+
+- browser-native: skill version bumped to 1.2.0.
+
+## [2026-08-08]
+
+### Added
+
+- CI: discovery index is built and committed by CI as the source of truth.
+
+### Changed
+
+- prepare-wordpress: installs agent skills from WordPress/agent-skills; default
+  install trimmed to essentials with block/performance/router skills optional
+  (plugin 1.2.0).
+- prepare-wordpress: Brain Monkey PHP tests, `phpcs.xml`, and ESLint scaffolding;
+  Composer/npm hardening (plugin 1.1.0).
+- CI: bumped checkout/setup-node to v7 (Node 24), clearing the Node 20 deprecation.
+
+### Fixed
+
+- CI: gzip non-reproducibility in the discovery index build.
+
+## [2026-08-07]
+
+### Added
+
+- wordpress-skills Agent Plugin with a mirror workflow, bundled CHANGELOG, and
+  README describing the bundled skills.
+
+## [2026-08-03]
+
+### Added
+
+- Published the agent-skills discovery index with an inline determinism checklist.
+
+### Changed
+
+- README: grouped Available Skills by category, reworked tables, and rewrote the
+  install and introduction sections.
+
+### Fixed
+
+- Portable script paths and consistent skill frontmatter.
+
+## [2026-08-02]
+
+### Added
+
+- wp-mutate: WordPress mutation-testing skill.
+
+## [2026-07-27]
+
+### Added
+
+- document-architecture and pre-launch-security-audit skills.
+
+## [2026-07-16]
+
+### Added
+
+- Cross-link to the just-bash-runner skill.
+
+## [2026-07-15]
+
+### Added
+
+- wp-pcp-local: Plugin Check skill for Local by Flywheel.
+
+### Fixed
+
+- wp-pcp-local: multisite handling and argument parsing.
+
+## [2026-06-30]
+
+### Fixed
+
+- wp-bump: detect tests from `package.json` and `composer.json` scripts.
+
+## [2026-06-26]
+
+### Added
+
+- add-apim-api skill with Bicep patterns reference.
+- `skills.sh.json` for repo page customization and a skills.sh README badge.
+- Version 1.1.0 frontmatter across all skills.
+
+### Security
+
+- Fixed a prompt-injection vulnerability in prepare-wordpress.
+- Removed the third-party `jeffallan/claude-skills` skill to reduce risk.
+
+## [2026-06-20]
+
+### Added
+
+- browser-native skill set.
+
+### Changed
+
+- Hardened skill scripts, improved planner detection, and tightened invocation
+  semantics with determinism guardrails.
+
+## [2026-05-10]
+
+### Added
+
+- Initial skills repository with skills.sh page links and CLI discoverability.

skills/browser-native/SKILL.md

@@ -1,8 +1,8 @@
 ---
 name: browser-native
-description: "Scan JavaScript dependencies for packages replaceable by browser/runtime native APIs. Use for dependency-modernization audits, or when another skill needs a native-replacement report with confidence and examples."
+description: "Scan JavaScript dependencies for packages replaceable by browser/runtime native APIs. Use for dependency-modernization audits, or when another skill needs a native-replacement report with confidence, Baseline status, and examples."
 compatibility: "Node.js 18+. Filesystem-based — reads package.json. No network or browser access required."
-version: "1.1.0"
+version: "1.2.0"
 ---
 
 # Browser-Native Dependency Scanner
@@ -73,7 +73,9 @@ Use this quick category map while reviewing:
 | --- | --- | --- |
 | HTTP | axios, node-fetch | `fetch()` |
 | URL / Query | query-string, qs | `URL`, `URLSearchParams` |
-| Object / Array utils | lodash.* helpers | `structuredClone()`, `Object.*`, array methods |
+| Object / Array utils | lodash.* helpers | `structuredClone()`, `Object.*`, `Object.groupBy()`, `Set` methods, array methods |
+| Internationalization | numeral, pluralize, timeago.js, humanize-duration | `Intl.*` (`NumberFormat`, `PluralRules`, `RelativeTimeFormat`, `DurationFormat`) |
+| UI primitives | tippy.js, focus-trap, body-scroll-lock, a11y-dialog | `<dialog>`, Popover API, CSS anchor positioning |
 | UUID / Date | uuid, moment | `crypto.randomUUID()`, `Intl.*` |
 | Polyfills / APIs | abort-controller, resize-observer-polyfill | Native globals and browser APIs |
 
@@ -94,20 +96,49 @@ For detailed reference on each replacement including before/after code and brows
 
 Completion criterion: Every recommendation in the user-facing output includes a confidence label and caveat handling for `partial` replacements.
 
+### 3b) Interpret Baseline status
+
+Some replacements carry a `baseline` tag describing how safe the native API is to adopt across browsers ([webstatus.dev](https://webstatus.dev) / MDN Baseline badges):
+
+- **widely** — in all major engines for 30+ months. Adopt without much thought.
+- **newly** — recently in all major engines. Works on up-to-date browsers, but check your audience or add a fallback before shipping to a broad audience.
+- **limited** — not yet in all engines. Keep the library or polyfill for now.
+
+Confidence answers *"does the native API do what the library does?"*; Baseline answers *"can my users run it?"*. Treat them as independent — a `full` replacement can still be `newly` available (e.g. `Object.groupBy`), which means safe *functionally* but audience-dependent.
+
+Before recommending a swap, run the article's three questions:
+
+1. **Is it Baseline-safe for my audience?** `widely` is usually yes; for `newly`, check `browserslist`/analytics.
+2. **What does the swap actually cost?** A heavier polyfill than the library it replaces is a net loss unless loaded conditionally (e.g. Temporal vs `dayjs`).
+3. **Does the platform feature cover my real use case?** Libraries often do more (e.g. `axios` interceptors/retries). Check actual usage before assuming a drop-in.
+
+Completion criterion: `newly`/`limited` recommendations are gated on audience/cost, not presented as free wins.
+
 ### 4) Present findings to the user
 
 When showing results:
 
 1. Lead with the summary count (e.g., "14 of 42 dependencies can be replaced")
 2. Group by confidence: list full replacements first (easy wins), then partial
 3. For each flagged package, show the before/after code snippet
-4. Note any caveats from the `notes` field  
+4. Note any caveats from the `notes` field, and surface the `baseline` tag (`widely`/`newly`/`limited`)
 5. If asked for a migration plan, prioritize:
    - Polyfills first (safest to remove — they just provide what's already built-in)
-   - Full confidence replacements next
-   - Partial replacements last (require careful review)
+   - `widely` + `full` confidence replacements next (easy wins)
+   - `newly` replacements behind an audience check or a feature-detect fallback
+   - `partial` replacements last (require careful usage review)
+
+For `newly`-available features, recommend shipping behind progressive enhancement rather than a hard swap:
+
+```js
+if (typeof Intl.DurationFormat === "function") {
+  // use the native API
+} else {
+  // keep the library, or a simpler fallback
+}
+```
 
-Completion criterion: Final response includes summary count, confidence-grouped findings, and explicit next migration priorities.
+Completion criterion: Final response includes summary count, confidence- and Baseline-grouped findings, and explicit next migration priorities.
 
 ### 5) Monorepo support
 
@@ -122,7 +153,7 @@ After presenting recommendations, the user can verify by:
 1. Removing the flagged package from `package.json`
 2. Replacing imports with the native API (using the "after" code example)
 3. Running the project's test suite
-4. Checking browser compatibility against their targets
+4. Checking browser compatibility against their targets (compare the API's Baseline status on [webstatus.dev](https://webstatus.dev) against their `browserslist`)
 
 ## Failure modes