Ship the stack upgrade in the published migration skill

.changeset/stack-upgrade-skill.md

@@ -0,0 +1,5 @@
+---
+"@toruslabs/torus-scripts": patch
+---
+
+Ship the Web3Auth stack upgrade steps in the migration skill so one published skill covers both.

.cursor/skills/migrating-to-torus-cli/reference.md

@@ -0,0 +1 @@
+../../../packages/torus-scripts/skills/migrating-to-torus-cli/reference.md

packages/torus-scripts/README.md

@@ -60,7 +60,7 @@ The old `@toruslabs/eslint-config-*` packages are removed. Do not treat an Oxlin
 
 ## Upgrade from the old CLI
 
-The package includes an agent skill at `skills/migrating-to-torus-cli/SKILL.md`. In a consumer project, read it at `node_modules/@toruslabs/torus-scripts/skills/migrating-to-torus-cli/SKILL.md`. To make it available as a project skill in Cursor, copy it to `.cursor/skills/migrating-to-torus-cli/SKILL.md` in that project, but do not commit that copy. The skill belongs to this package; a committed copy goes stale and the consumer repository then carries two versions. Keep the skill and this README from the same package version.
+The package includes an agent skill at `skills/migrating-to-torus-cli/`. In a consumer project, read it at `node_modules/@toruslabs/torus-scripts/skills/migrating-to-torus-cli/SKILL.md`. To make it available as a project skill in Cursor, copy that directory to `.cursor/skills/migrating-to-torus-cli/` in that project, but do not commit that copy. The skill belongs to this package; a committed copy goes stale and the consumer repository then carries two versions. Keep the skill and this README from the same package version. The same skill plans a Web3Auth stack upgrade. `reference.md` in that directory holds the CODEOWNERS, Dependabot, and `.npmrc` lookup tables.
 
 Run `torus-scripts-upgrade <path>` to inspect an old project without changing files. It reports unsupported custom behavior and exits nonzero for those cases. Run `vp migrate` at the workspace root, not inside each package, and review its changes. The diagnostic does not run `vp migrate` for you.
 

packages/torus-scripts/package.json

@@ -8,7 +8,8 @@
   },
   "files": [
     "dist",
-    "skills/migrating-to-torus-cli/SKILL.md"
+    "skills/migrating-to-torus-cli/SKILL.md",
+    "skills/migrating-to-torus-cli/reference.md"
   ],
   "scripts": {
     "build": "vp pack",

packages/torus-scripts/skills/migrating-to-torus-cli/reference.md

@@ -0,0 +1,77 @@
+# Stack upgrade reference
+
+Read this when writing CODEOWNERS, Dependabot, `.npmrc`, or the PR body. CODEOWNERS follows `origin`'s org. A single package copies file shape and action SHAs from [eccrypto](https://github.com/torusresearch/eccrypto), including when `origin` is MetaMask. A monorepo copies file shape and action SHAs from the newest completed sibling on `origin`'s org at execution time.
+
+## CODEOWNERS
+
+Match `origin`.
+
+MetaMask:
+
+```
+*                               @MetaMask/Web3Auth-Admins
+src/                            @MetaMask/Web3Auth-Product
+test/                           @MetaMask/Web3Auth-Product
+.github/CODEOWNERS              @MetaMask/Web3Auth-Admins
+```
+
+torusresearch:
+
+```
+*                               @torusresearch/Admins
+src/                            @torusresearch/Web3Auth-Product
+test/                           @torusresearch/Web3Auth-Product
+.github/CODEOWNERS              @torusresearch/Admins
+```
+
+Add `packages/`, `demo/`, or `examples/` with the product team only when those directories exist. Keep the guideline comment block from the sibling file.
+
+For a monorepo, do not give the product team a bare `packages/` line. That also covers `package.json` and other files at the package root. When each package has `src/` and `test/`, use `packages/*/src/` and `packages/*/test/`, as wallet-services does. When product code lives in other folders, use `packages/*/*/` so only directories under the package, and the files inside them, go to the product team.
+
+## Dependabot
+
+```yaml
+version: 2
+
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 3
+    open-pull-requests-limit: 10
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 3
+```
+
+Use `package-ecosystem: yarn` when the repo stays on Yarn. The 3-day cooldown stays. Packages named in the story's **Sequence and prerequisites** section still install at their latest published release inside that window.
+
+## npmrc
+
+```
+min-release-age=3
+allow-git=none
+allow-remote=none
+allow-scripts-pin=true
+```
+
+## Pull request template sections
+
+Motivation and Context, Jira Link, Description, How has this been tested, Screenshots, Types of changes, Checklist.
+
+Jira Link always includes the story the user named and EMBED-573.
+
+## Evidence to record on the story
+
+- Branch and PR link. Nothing published. `release-packages` stays manual.
+- Majors taken, and majors skipped.
+- `main`, `module`, and `types` before and after. Packed files.
+- `npm audit` counts versus Dependabot. Alerts left open and why.
+- Scanners that ran. CodeQL left on default setup. KICS, Trivy, AWS, and Wiz omitted or added.
+- Node 24 and 26 results. Browser or service checks.
+- Settings the token could not change, including Actions creating pull requests.

packages/torus-scripts/test/contracts.test.mjs

@@ -32,6 +32,7 @@ function packWorkspace(workspace, destination) {
 
 describe("packed torus-scripts", () => {
   const skillPath = "skills/migrating-to-torus-cli/SKILL.md";
+  const referencePath = "skills/migrating-to-torus-cli/reference.md";
   let temporaryDirectory;
   let tarball;
   let files;
@@ -64,7 +65,8 @@ describe("packed torus-scripts", () => {
   test("contains only the manifest, README, skill, and freshly built output", () => {
     assert.ok(files.includes("dist/migrate/cli.mjs"), "pack must contain freshly built output");
     assert.ok(files.includes(skillPath), "pack must contain the agent migration skill");
-    assert.ok(files.every((filePath) => ["package.json", "README.md", skillPath].includes(filePath) || filePath.startsWith("dist/")));
+    assert.ok(files.includes(referencePath), "pack must contain the skill reference");
+    assert.ok(files.every((filePath) => ["package.json", "README.md", skillPath, referencePath].includes(filePath) || filePath.startsWith("dist/")));
     assert.ok(files.every((filePath) => !/\b(?:rollup|release-it|babel|torus-scripts\.js)\b/i.test(filePath)));
     assert.ok(files.every((filePath) => !filePath.startsWith("dist/migrate/") || /^dist\/migrate\/cli\.(?:mjs|d\.mts)(?:\.map)?$/.test(filePath)));
 
@@ -75,13 +77,20 @@ describe("packed torus-scripts", () => {
 
   test("ships the source skill and a README without repository links", async () => {
     const sourceSkill = await readFile(path.join(packageDirectory, skillPath), "utf8");
+    const sourceReference = await readFile(path.join(packageDirectory, referencePath), "utf8");
     assert.equal(readPacked(skillPath), sourceSkill, "the packed skill must match the source skill");
+    assert.equal(readPacked(referencePath), sourceReference, "the packed reference must match the source reference");
     assert.match(sourceSkill, /README\.md/);
     assert.equal(
       await readFile(path.join(consumer, "node_modules", "@toruslabs", "torus-scripts", skillPath), "utf8"),
       sourceSkill,
       "an installed consumer must be able to read the skill"
     );
+    assert.equal(
+      await readFile(path.join(consumer, "node_modules", "@toruslabs", "torus-scripts", referencePath), "utf8"),
+      sourceReference,
+      "an installed consumer must be able to read the skill reference"
+    );
     assert.doesNotMatch(readPacked("README.md"), /\]\(\.\.\/\.\.\/docs\//);
   });
 
@@ -205,7 +214,7 @@ test("library export packs a plain ESM SDK value and declaration", async () => {
   const torusScriptsPackage = JSON.parse(await readFile(path.join(packageDirectory, "package.json"), "utf8"));
 
   assert.deepEqual(Object.keys(torusScriptsPackage.exports).sort(), ["./fmt", "./library", "./node", "./react"]);
-  assert.deepEqual(torusScriptsPackage.files, ["dist", "skills/migrating-to-torus-cli/SKILL.md"]);
+  assert.deepEqual(torusScriptsPackage.files, ["dist", "skills/migrating-to-torus-cli/SKILL.md", "skills/migrating-to-torus-cli/reference.md"]);
   assert.deepEqual(torusScriptsPackage.bin, { "torus-scripts-upgrade": "./dist/migrate/cli.mjs" });
   for (const [subpath, exportName] of Object.entries({
     library: "libraryPreset",