Cozy czync

Atlas Client Bundle / Proxy Guidance

Diagnosis

The current Atlas repo does not yet bundle undici into the client output, but it already has the same leak shape:

createServerFn modules are imported by client/query code.
Some of those modules statically import server/runtime exports from @atlas/context-layer.
The @atlas/context-layer public barrel re-exports server handlers, cache, logging, release notes, and runtime-only modules.
A production portal build shows browser externalization warnings for node:crypto and native/server dependencies, proving server-only modules are reachable from the client graph.

Page spec-extraction prompt

Use this to turn an existing page into a clean-room "replication spec" — structure and behavior only, no source code, no real commands/names/URLs. The output is safe to hand to another repo to rebuild the page from scratch.

请把这两个页面整理成一份"复刻规格说明"，只描述结构和行为，不要贴任何源码、不要真实命令/名称/URL。

页面：

/skills 列表页

# Amazon Textract — Phase 1 Enterprise Access Hardening (PrivateLink + Org Guardrails + Endpoint Policy)

**Scope (Phase 1 only):**
This design focuses on the *three foundational controls* required to expose Amazon Textract safely across application teams:

1) **Network boundary:** Interface VPC Endpoint (AWS PrivateLink) + Private DNS  
2) **Org-level enforcement:** SCP / Permission Boundary to **deny non-VPCE Textract calls**  
3) **Ingress gate:** VPC Endpoint Policy to control **who may use the endpoint**

	#!/usr/bin/env node
	/**
	* parser_spike.mjs — ONE-SHOT, THROWAWAY format probe for the Atlas parsers.
	*
	* WHAT THIS IS
	* A disposable spike that hits the live sources behind Atlas's resolvers and
	* re-implements each parser's exact logic inline, to answer, before/while
	* writing the real parsers:
	* 1. Does the current parser logic resolve against live data?
	* 2. What is the real upstream FORMAT/STRUCTURE (so the parser is built for it)?

	<#
	tk support — Windows URI-open spike (registry-free, no side effects by default)
	===============================================================================
	Answers two questions for `tk support`:

	Q1 (correctness): the opened URI ALWAYS contains '&' (subject&body, users&message)
	and percent-encoding (%20/%0A). Which Node spawn shape delivers it WHOLE, and
	which truncates at '&'? The defect is in stage 1: Node spawn -> cmd tokenises
	the line and an unquoted '&' becomes a command separator.
	Q4 (Teams reachability): does the Teams chat deep link actually open a usable 1:1

	<#
	tk-baseline-probe.ps1
	---------------------------------------------------------------------------
	Collects REFERENCE baseline numbers for tk runtime startup on a Windows box.

	PURPOSE: feed one real (corporate-AV) data point + magnitudes into a perf
	optimization plan. These numbers are REFERENCE ONLY — a single machine's
	Node version and a single box's AV behavior do NOT validate or size the
	field-wide result (the package is distributed across many Node versions and
	AV setups). They confirm correctness, relative ordering, and magnitudes.

	#!/usr/bin/env node
	// tgspike-hook.mjs — Token Guard hook protocol round-trip spike (throwaway).
	//
	// Goal: empirically verify, on a REAL host, whether GitHub Copilot honors the
	// hook outputs Token Guard plans to emit. Covers three hosts that share the
	// unified GitHub Copilot hooks system:
	// - Copilot CLI (PowerShell on Windows 11)
	// - VS Code Copilot Chat
	// - JetBrains / IntelliJ IDEA Copilot
	//

	# Manager 1:1 Notes

	## Purpose

	Use this note as a speaking guide for a manager 1:1.
	It is intentionally written around two things that are true right now:

	- the current `SharePoint` task
	- the current `service enablement` work

	# 企业级 AI 工作流自动化系统 PRD

	## 1. 文档信息

	- 产品名称：Enterprise Action Runtime
	- 中文名称：企业级 AI 工作流自动化系统
	- 文档版本：v0.1
	- 文档状态：初版 PRD
	- 目标读者：
	- 产品经理