Laravel 13 upgrade

.agents/skills/blatui-development/SKILL.md

@@ -0,0 +1,84 @@
+---
+name: blatui-development
+description: Build UIs with BlatUI — shadcn/ui for the Laravel BLAT stack (Blade, Alpine.js, Tailwind v4). Use when adding or composing UI components, blocks, charts, or theming in a Blade app.
+---
+
+# BlatUI Development
+
+## When to use this skill
+
+Use this skill when building or editing UI in a Laravel Blade app that has BlatUI
+installed (the `anousss007/blatui` package, with components in
+`resources/views/components/ui/`). Prefer BlatUI components over hand-written markup.
+
+## Core model
+
+BlatUI is **copy-paste, own-the-code**: components are Blade files copied into
+`resources/views/components/ui/` and used under the `x-ui.` namespace. They are styled
+with Tailwind v4 tokens and use a little Alpine.js for interactivity. There is no runtime
+component package — editing a component file is the supported way to customize it.
+
+## Workflow
+
+1. **Check before adding.** A component is usable only if its file exists in
+   `resources/views/components/ui/`. Glob that directory first.
+2. **Add missing components** (copies source + prints required composer/npm peers):
+   ```shell
+   php artisan blatui:add <name> [<name> ...]
+   php artisan blatui:list          # all available families
+
+   ```
+3. **Use them** in Blade:
+   ```blade
+   <x-ui.button variant="default">Save</x-ui.button>
+   <x-ui.input type="email" placeholder="you@example.com" />
+   <x-ui.card>
+       <x-ui.card-header>
+           <x-ui.card-title>Title</x-ui.card-title>
+           <x-ui.card-description>Subtitle</x-ui.card-description>
+       </x-ui.card-header>
+       <x-ui.card-content>...</x-ui.card-content>
+   </x-ui.card>
+   ```
+4. **Verify wiring** once with `php artisan blatui:init` (theme CSS, Alpine, imports).
+
+## Catalog (55+ component families)
+
+Forms: button, input, textarea, select, combobox, checkbox, radio-group, switch,
+slider, toggle, label, field, calendar, date-picker, datetime-picker, time-field,
+input-otp. Overlays: dialog, alert-dialog, sheet, drawer, popover, dropdown-menu,
+context-menu, menubar, command. Data: table, avatar, badge, carousel, chart, progress,
+skeleton, tooltip, hover-card. Layout: card, sidebar, resizable, scroll-area, separator,
+tabs, accordion, collapsible, breadcrumb, pagination, navigation-menu. Feedback: alert,
+sonner (toasts), empty, spinner.
+
+## Blocks and charts
+
+Full-page **blocks** (dashboards, auth, marketing, pricing, sidebars, calendars) and
+**charts** (ApexCharts) are not bundled with the CLI but are installable from the registry:
+
+```shell
+
+# Read a block/chart and write each files[].content to its files[].target:
+
+curl https://blatui.remix-it.com/r/blocks/dashboard-01.json
+curl https://blatui.remix-it.com/r/charts/chart-area-default.json
+```
+
+Then run `php artisan blatui:add` for the block's `registryDependencies` (the components
+it uses).
+
+## Theming
+
+All tokens are CSS variables in `resources/css/blatui.css` (`:root`, `.dark`, and
+`[data-base]` / `[data-theme]` / `[data-radius]` …). To restyle: edit tokens, or build a
+theme at https://blatui.remix-it.com/themes and paste the exported CSS as
+`resources/css/app.css`. Use Tailwind token utilities (`bg-background`, `text-foreground`,
+`border-input`, `rounded-lg`) — never hard-code hex colors.
+
+## Discovery for agents
+
+- Registry index: `https://blatui.remix-it.com/registry.json`
+- Item with source inlined: `https://blatui.remix-it.com/r/<name>.json`
+- Hosted MCP: `POST https://blatui.remix-it.com/mcp` · local MCP: `php artisan blatui:mcp`
+  (tools: search_registry, get_component, get_example, install_command).

.agents/skills/filament-activitylog-pro/SKILL.md

@@ -0,0 +1,31 @@
+---
+name: filament-activitylog-pro
+description: Use when working with Filament Activitylog Pro — installing or configuring it, its components, fields, inputs, columns, actions, widgets, or any of its APIs. Fetches the official, version-matched documentation so you write correct code instead of guessing.
+---
+
+# Filament Activitylog Pro documentation
+
+The full Filament Activitylog Pro documentation is available to you as machine-readable Markdown. Consult it before writing or changing any code that uses this package — do not guess its API, class names, or configuration.
+
+Docs base URL: `https://filamentplugins.com/filament-activitylog-pro/docs/v2/llm/`
+
+## Workflow
+
+> **The remote docs are ALWAYS the starting point for any Filament Activitylog Pro feature** — capability check, config option, API shape, or "how do I X". This holds even when the package source is available locally (e.g. symlinked into `vendor/`). Read the relevant `.md` page first; only drop to source to confirm a detail the docs leave ambiguous, never as the entry point.
+
+1. **Fetch the index first.** Request `https://filamentplugins.com/filament-activitylog-pro/docs/v2/llm/llms.txt`. It lists every page, grouped by topic, each with a one-line description. It is small — read it before fetching anything else, and re-read it in the same task whenever you need another page.
+2. **Pick the relevant pages from the links in `llms.txt`.** Only fetch paths that appear **literally** in the index — **never construct, infer, or guess a page path** (the group and slug are rarely what you'd assume). Don't fetch pages you do not need.
+3. **Fetch each page as raw Markdown** using the exact URL from the index (each page link already ends in `.md`). Each page is fully assembled — it already includes its sub-sections, steps, and tabs.
+4. **Apply what you read.** Match the documented APIs, class names, and configuration exactly.
+
+**If a fetch returns 404, the path was wrong — go back and re-read `llms.txt`, then fetch the correct link.** Do not retry a guessed URL, and do not fall back to `llms-full.txt` just to recover a single page.
+
+**Use `llms-full.txt` only as a last resort.** `https://filamentplugins.com/filament-activitylog-pro/docs/v2/llm/llms-full.txt` returns the entire documentation in one (large) request. Reach for it only when the index plus selective pages genuinely cannot answer the task — never to recover from a wrong path, and never as the default. The index plus a few `.md` pages is almost always the right, far cheaper approach.
+
+The `llms.txt` preamble explains any package-specific Markdown directives (e.g. driver-specific content) you may encounter — read it.
+
+## Efficiency
+
+- Read `llms.txt` once per task and reuse it; do not re-fetch it for every page.
+- Fetch only the pages you need.
+- The raw `.md` is the source of truth — prefer it over the rendered HTML documentation site.

.agents/skills/fluxui-development/SKILL.md

@@ -0,0 +1,84 @@
+---
+name: fluxui-development
+description: "Use this skill for Flux UI development in Livewire applications only. Trigger when working with <flux:*> components, building or customizing Livewire component UIs, creating forms, modals, tables, or other interactive elements. Covers: flux: components (buttons, inputs, modals, forms, tables, date-pickers, kanban, badges, tooltips, etc.), component composition, Tailwind CSS styling, Heroicons/Lucide icon integration, validation patterns, responsive design, and theming. Do not use for non-Livewire frameworks or non-component styling."
+license: MIT
+metadata:
+  author: laravel
+---
+
+# Flux UI Development
+
+## Documentation
+
+Use `search-docs` for detailed Flux UI patterns and documentation.
+
+## Basic Usage
+
+This project uses the Pro version of Flux UI, which includes all free and Pro components and variants.
+
+Flux UI is a component library for Livewire built with Tailwind CSS. It provides components that are easy to use and customize.
+
+Use Flux UI components when available. Fall back to standard Blade components when no Flux component exists for your needs.
+
+<!-- Basic Button -->
+```blade
+<flux:button variant="primary">Click me</flux:button>
+```
+
+## Available Components (Pro Edition)
+
+Available: accordion, autocomplete, avatar, badge, brand, breadcrumbs, button, calendar, callout, card, chart, checkbox, color-picker, command, composer, context, date-picker, dropdown, editor, field, file-upload, heading, icon, input, kanban, modal, navbar, otp-input, pagination, pillbox, popover, profile, progress, radio, select, separator, skeleton, slider, switch, table, tabs, text, textarea, time-picker, timeline, toast, tooltip
+
+## Icons
+
+Flux includes [Heroicons](https://heroicons.com/) as its default icon set. Search for exact icon names on the Heroicons site - do not guess or invent icon names.
+
+<!-- Icon Button -->
+```blade
+<flux:button icon="arrow-down-tray">Export</flux:button>
+```
+
+For icons not available in Heroicons, use [Lucide](https://lucide.dev/). Import the icons you need with the Artisan command:
+
+```bash
+php artisan flux:icon crown grip-vertical github
+```
+
+## Common Patterns
+
+### Form Fields
+
+<!-- Form Field -->
+```blade
+<flux:field>
+    <flux:label>Email</flux:label>
+    <flux:input type="email" wire:model="email" />
+    <flux:error name="email" />
+</flux:field>
+```
+
+### Tables
+
+<!-- Table -->
+```blade
+<flux:table>
+    <flux:table.columns>
+        <flux:table.cell>Column Name</flux:table.cell>
+    </flux:table.columns>
+    <flux:table.row>
+        <flux:table.cell>Value</flux:table.cell>
+    </flux:table.row>
+</flux:table>
+```
+
+## Verification
+
+1. Check component renders correctly
+2. Test interactive states
+3. Verify mobile responsiveness
+
+## Common Pitfalls
+
+- Not checking if a Flux component exists before creating custom implementations
+- Forgetting to use the `search-docs` tool for component-specific documentation
+- Not following existing project patterns for Flux usage

.agents/skills/fortify-development/SKILL.md

@@ -0,0 +1,151 @@
+---
+name: fortify-development
+description: 'ACTIVATE when the user works on authentication in Laravel. This includes login, registration, password reset, email verification, two-factor authentication (2FA/TOTP/QR codes/recovery codes), passkeys, profile updates, password confirmation, or any auth-related routes and controllers. Activate when the user mentions Fortify, auth, authentication, login, register, signup, forgot password, verify email, 2FA, passkeys, WebAuthn, or references app/Actions/Fortify/, CreateNewUser, UpdateUserProfileInformation, FortifyServiceProvider, config/fortify.php, or auth guards. Fortify is the frontend-agnostic authentication backend for Laravel that registers all auth routes and controllers. Also activate when building SPA or headless authentication, customizing login redirects, overriding response contracts like LoginResponse, or configuring login throttling. Do NOT activate for Laravel Passport (OAuth2 API tokens), Socialite (OAuth social login), or non-auth Laravel features.'
+license: MIT
+metadata:
+  author: laravel
+---
+
+# Laravel Fortify Development
+
+Fortify is a headless authentication backend that provides authentication routes and controllers for Laravel applications.
+
+## Documentation
+
+Use `search-docs` for detailed Laravel Fortify patterns and documentation.
+
+## Usage
+
+- **Routes**: Use `list-routes` with `only_vendor: true` and `action: "Fortify"` to see all registered endpoints
+- **Actions**: Check `app/Actions/Fortify/` for customizable business logic (user creation, password validation, etc.)
+- **Config**: See `config/fortify.php` for all options including features, guards, rate limiters, and username field
+- **Contracts**: Look in `Laravel\Fortify\Contracts\` for overridable response classes (`LoginResponse`, `LogoutResponse`, etc.)
+- **Views**: All view callbacks are set in `FortifyServiceProvider::boot()` using `Fortify::loginView()`, `Fortify::registerView()`, etc.
+
+## Available Features
+
+Enable in `config/fortify.php` features array:
+
+- `Features::registration()` - User registration
+- `Features::resetPasswords()` - Password reset via email
+- `Features::emailVerification()` - Requires User to implement `MustVerifyEmail`
+- `Features::updateProfileInformation()` - Profile updates
+- `Features::updatePasswords()` - Password changes
+- `Features::twoFactorAuthentication()` - 2FA with QR codes and recovery codes
+- `Features::passkeys()` - Passwordless authentication with WebAuthn passkeys
+
+> Use `search-docs` for feature configuration options and customization patterns.
+
+## Setup Workflows
+
+### Two-Factor Authentication Setup
+
+```
+- [ ] Add TwoFactorAuthenticatable trait to User model
+- [ ] Enable feature in config/fortify.php
+- [ ] If the `*_add_two_factor_columns_to_users_table.php` migration is missing, publish via `php artisan vendor:publish --tag=fortify-migrations` and migrate
+- [ ] Set up view callbacks in FortifyServiceProvider
+- [ ] Create 2FA management UI
+- [ ] Test QR code and recovery codes
+```
+
+> Use `search-docs` for TOTP implementation and recovery code handling patterns.
+
+### Passkeys Setup
+
+```
+- [ ] Add PasskeyAuthenticatable trait to User model and implement PasskeyUser
+- [ ] Enable passkeys feature in config/fortify.php
+- [ ] If the passkeys table migration is missing, publish via `php artisan vendor:publish --tag=fortify-migrations` and migrate
+- [ ] Configure passkeys relying_party_id, allowed_origins, user_handle_secret, and timeout if defaults are not suitable
+- [ ] Build UI with @laravel/passkeys for registration, login, confirmation, and deletion
+```
+
+> Use `search-docs` for passkey configuration options. For `@laravel/passkeys` frontend usage, refer to the package's README on npm.
+
+### Email Verification Setup
+
+```
+- [ ] Enable emailVerification feature in config
+- [ ] Implement MustVerifyEmail interface on User model
+- [ ] Set up verifyEmailView callback
+- [ ] Add verified middleware to protected routes
+- [ ] Test verification email flow
+```
+
+> Use `search-docs` for MustVerifyEmail implementation patterns.
+
+### Password Reset Setup
+
+```
+- [ ] Enable resetPasswords feature in config
+- [ ] Set up requestPasswordResetLinkView callback
+- [ ] Set up resetPasswordView callback
+- [ ] Define password.reset named route (if views disabled)
+- [ ] Test reset email and link flow
+```
+
+> Use `search-docs` for custom password reset flow patterns.
+
+### SPA Authentication Setup
+
+```
+- [ ] Set 'views' => false in config/fortify.php
+- [ ] Install and configure Laravel Sanctum for session-based SPA authentication
+- [ ] Use the 'web' guard in config/fortify.php (required for session-based authentication)
+- [ ] Set up CSRF token handling
+- [ ] Test XHR authentication flows
+```
+
+> Use `search-docs` for integration and SPA authentication patterns.
+
+#### Two-Factor Authentication in SPA Mode
+
+When `views` is set to `false`, Fortify returns JSON responses instead of redirects.
+
+If a user attempts to log in and two-factor authentication is enabled, the login request will return a JSON response indicating that a two-factor challenge is required:
+
+```json
+{
+    "two_factor": true
+}
+```
+
+## Best Practices
+
+### Custom Authentication Logic
+
+Override authentication behavior using `Fortify::authenticateUsing()` for custom user retrieval or `Fortify::authenticateThrough()` to customize the authentication pipeline. Override response contracts in `AppServiceProvider` for custom redirects.
+
+### Registration Customization
+
+Modify `app/Actions/Fortify/CreateNewUser.php` to customize user creation logic, validation rules, and additional fields.
+
+### Rate Limiting
+
+Configure via `fortify.limiters.login` in config. Default configuration throttles by username + IP combination.
+
+## Key Endpoints
+
+| Feature                | Method   | Endpoint                                    |
+|------------------------|----------|---------------------------------------------|
+| Login                  | POST     | `/login`                                    |
+| Logout                 | POST     | `/logout`                                   |
+| Register               | POST     | `/register`                                 |
+| Password Reset Request | POST     | `/forgot-password`                          |
+| Password Reset         | POST     | `/reset-password`                           |
+| Email Verify Notice    | GET      | `/email/verify`                             |
+| Resend Verification    | POST     | `/email/verification-notification`          |
+| Password Confirm       | POST     | `/user/confirm-password`                    |
+| Enable 2FA             | POST     | `/user/two-factor-authentication`           |
+| Confirm 2FA            | POST     | `/user/confirmed-two-factor-authentication` |
+| 2FA Challenge          | POST     | `/two-factor-challenge`                     |
+| Get QR Code            | GET      | `/user/two-factor-qr-code`                  |
+| Recovery Codes         | GET/POST | `/user/two-factor-recovery-codes`           |
+| Passkey Login Options  | GET      | `/passkeys/login/options`                   |
+| Passkey Login          | POST     | `/passkeys/login`                           |
+| Passkey Confirm Options| GET      | `/passkeys/confirm/options`                 |
+| Passkey Confirm        | POST     | `/passkeys/confirm`                         |
+| Passkey Options        | GET      | `/user/passkeys/options`                    |
+| Register Passkey       | POST     | `/user/passkeys`                            |
+| Delete Passkey         | DELETE   | `/user/passkeys/{passkey}`                  |