[1.0.0] - 2026-07-18
Added
- Routing-focused Hermes skill for tldraw SDK, Editor/store, custom shapes/tools/bindings/UI, persistence/assets/files/export/Mermaid, Driver, sync, AI starters, migrations, security, licensing, and upstream workflows.
- Standard-library project inspector, doctor, and official-doc cache helpers.
- Source manifest and capability map pinned and validated against tldraw 5.2.5.
- Browser evaluation app with official
.tldrround trips, custom schema migrations, diagram generation, real Driver operations, IndexedDB reload/cross-tab checks, export, Mermaid, accessibility, production bridge exclusion, and a reproducible 3,999-shape baseline. - Repository-owned two-client sync harness with token rejection, presence, room isolation, SQLite persistence, and restart recovery.
- Credential-free agent/starter and legacy migration harness with input sanitization, server action allowlisting, custom prompt/action examples, build/typecheck checks, and bundle secret scanning.
- Fresh-profile activation evaluation, copied-distribution checks, and machine-readable workflow aggregation.
- GitHub Actions validation and Dependabot configuration.
Security
- Development bridge is gated to localhost and development builds and is checked absent from production output.
- Provider credentials are never embedded in browser bundles; unavailable live provider execution is labeled unverified rather than simulated.
Verification
- GitHub Actions: https://github.com/r0b0tlab/tldraw-skill/actions/runs/29668112571
- Hermes community scan: SAFE
- Clean-profile bundle: 19/19 files with exact hash parity
- Provider-backed AI remains explicitly unverified; six low-severity transitive AI SDK advisories are documented.