@cometchat/skills 5.0.0 → 5.0.1

package/registry/sdk-jsv4.json

@@ -24,6 +24,16 @@
       "version": "1.1.0",
       "role": "router"
     },
+    {
+      "name": "cometchat-a11y",
+      "version": "1.0.0",
+      "role": "skill"
+    },
+    {
+      "name": "cometchat-analytics",
+      "version": "1.0.0",
+      "role": "skill"
+    },
     {
       "name": "cometchat-android-v5-calls-sdk",
       "version": "1.0.0",
@@ -34,20 +44,50 @@
       "version": "1.0.0",
       "role": "skill"
     },
+    {
+      "name": "cometchat-audit",
+      "version": "1.0.0",
+      "role": "skill"
+    },
+    {
+      "name": "cometchat-compliance",
+      "version": "1.0.0",
+      "role": "skill"
+    },
     {
       "name": "cometchat-flutter-v5-sdk",
       "version": "1.0.0",
       "role": "skill"
     },
+    {
+      "name": "cometchat-i18n",
+      "version": "1.0.0",
+      "role": "skill"
+    },
     {
       "name": "cometchat-js-v5-sdk",
       "version": "1.0.0",
       "role": "skill"
     },
+    {
+      "name": "cometchat-moderation",
+      "version": "1.0.0",
+      "role": "skill"
+    },
     {
       "name": "cometchat-onboarding",
       "version": "1.0.0",
       "role": "skill"
+    },
+    {
+      "name": "cometchat-security",
+      "version": "1.0.0",
+      "role": "skill"
+    },
+    {
+      "name": "cometchat-self-host",
+      "version": "1.0.0",
+      "role": "skill"
     }
   ]
 }

package/registry/web-calls-v5.json

@@ -25,6 +25,16 @@
       "version": "1.1.0",
       "role": "router"
     },
+    {
+      "name": "cometchat-a11y",
+      "version": "1.0.0",
+      "role": "skill"
+    },
+    {
+      "name": "cometchat-analytics",
+      "version": "1.0.0",
+      "role": "skill"
+    },
     {
       "name": "cometchat-android-v5-calls-sdk",
       "version": "1.0.0",
@@ -35,20 +45,50 @@
       "version": "1.0.0",
       "role": "skill"
     },
+    {
+      "name": "cometchat-audit",
+      "version": "1.0.0",
+      "role": "skill"
+    },
+    {
+      "name": "cometchat-compliance",
+      "version": "1.0.0",
+      "role": "skill"
+    },
     {
       "name": "cometchat-flutter-v5-sdk",
       "version": "1.0.0",
       "role": "skill"
     },
+    {
+      "name": "cometchat-i18n",
+      "version": "1.0.0",
+      "role": "skill"
+    },
     {
       "name": "cometchat-js-v5-sdk",
       "version": "1.0.0",
       "role": "skill"
     },
+    {
+      "name": "cometchat-moderation",
+      "version": "1.0.0",
+      "role": "skill"
+    },
     {
       "name": "cometchat-onboarding",
       "version": "1.0.0",
       "role": "skill"
+    },
+    {
+      "name": "cometchat-security",
+      "version": "1.0.0",
+      "role": "skill"
+    },
+    {
+      "name": "cometchat-self-host",
+      "version": "1.0.0",
+      "role": "skill"
     }
   ]
 }

package/registry/web-v7.json

@@ -25,6 +25,16 @@
       "version": "1.1.0",
       "role": "router"
     },
+    {
+      "name": "cometchat-a11y",
+      "version": "1.0.0",
+      "role": "skill"
+    },
+    {
+      "name": "cometchat-analytics",
+      "version": "1.0.0",
+      "role": "skill"
+    },
     {
       "name": "cometchat-android-v5-calls-sdk",
       "version": "1.0.0",
@@ -35,16 +45,36 @@
       "version": "1.0.0",
       "role": "skill"
     },
+    {
+      "name": "cometchat-audit",
+      "version": "1.0.0",
+      "role": "skill"
+    },
+    {
+      "name": "cometchat-compliance",
+      "version": "1.0.0",
+      "role": "skill"
+    },
     {
       "name": "cometchat-flutter-v5-sdk",
       "version": "1.0.0",
       "role": "skill"
     },
+    {
+      "name": "cometchat-i18n",
+      "version": "1.0.0",
+      "role": "skill"
+    },
     {
       "name": "cometchat-js-v5-sdk",
       "version": "1.0.0",
       "role": "skill"
     },
+    {
+      "name": "cometchat-moderation",
+      "version": "1.0.0",
+      "role": "skill"
+    },
     {
       "name": "cometchat-onboarding",
       "version": "1.0.0",
@@ -90,10 +120,35 @@
       "version": "1.1.0",
       "role": "skill"
     },
+    {
+      "name": "cometchat-react-v7-production",
+      "version": "1.0.0",
+      "role": "skill"
+    },
     {
       "name": "cometchat-react-v7-push",
       "version": "1.0.0",
       "role": "skill"
+    },
+    {
+      "name": "cometchat-react-v7-testing",
+      "version": "1.0.0",
+      "role": "skill"
+    },
+    {
+      "name": "cometchat-react-v7-troubleshooting",
+      "version": "1.0.0",
+      "role": "skill"
+    },
+    {
+      "name": "cometchat-security",
+      "version": "1.0.0",
+      "role": "skill"
+    },
+    {
+      "name": "cometchat-self-host",
+      "version": "1.0.0",
+      "role": "skill"
     }
   ]
 }

package/skills/cometchat/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: cometchat
-description: "Entry point for any CometChat task on any platform. Detects the framework + UI Kit version (React, Angular, iOS, Android, React Native, Flutter), then routes to that family's skills — for a NEW integration or a change to an existing one. Triggers: 'add chat', 'add cometchat', 'add chat to my app', 'add calling', 'change something in my chat', 'my chat is already set up', 'add a feature to the chat', 'add chat to my android app', 'integrate cometchat android', 'add chat to my ios app', 'integrate cometchat ios', 'add chat to my swift app'."
+description: "Entry point for any CometChat task on any platform. Detects the framework + UI Kit version (React, Angular, iOS, Android, React Native, Flutter), then routes to that family's skills — for a NEW integration or a change to an existing one. Triggers: 'add chat', 'add cometchat', 'add chat to my app', 'add calling', 'change something in my chat', 'my chat is already set up', 'add a feature to the chat', 'add chat to my android app', 'integrate cometchat android', 'add chat to my ios app', 'integrate cometchat ios', 'add chat to my swift app', 'migrate my app to cometchat', 'migrate from sendbird', 'migrate from getstream / stream', 'replace sendbird / stream chat with cometchat'."
 license: "MIT"
 metadata:
   author: "CometChat"
@@ -11,7 +11,7 @@ metadata:
 > **Ground truth:** routing is `peers.yaml` (data); shared rules are `RULES.md`. This is a THIN classifier — detect + dispatch only. No workflows, credential logic, or component detail here; those live in `cometchat-onboarding` + the resolved family's skills + `RULES.md`.
 
 ## Use when
-User wants to add CometChat to a project, or upgrade an existing one. Triggers: "add chat", "add cometchat", "add voice/video calling", "upgrade my v6 UI Kit to v7", "add chat to my iOS app", "add chat in Swift", "upgrade my v4 iOS UI Kit to v5".
+User wants to add CometChat to a project, upgrade an existing one, or migrate one off Sendbird / Stream. Triggers: "add chat", "add cometchat", "add voice/video calling", "upgrade my v6 UI Kit to v7", "add chat to my iOS app", "add chat in Swift", "upgrade my v4 iOS UI Kit to v5".
 
 ## If you cannot find it here — FETCH, never guess
 This applies to EVERY agent and EVERY install mode, whether or not a row above matched.
@@ -24,6 +24,7 @@ This applies to EVERY agent and EVERY install mode, whether or not a row above m
 Full text: `RULES.md` -> "Fetch discipline".
 
 ## Do only this
+0. **Migration OFF Sendbird or Stream (GetStream) → straight to that vendor's skill. No onboarding.** Triggers: "migrate my app to CometChat", "migrate / switch / move from Sendbird|Stream|GetStream|Twilio", "replace Sendbird|Stream Chat with CometChat". Run `npx @cometchat/skills detect --json`: each `migrate_from` entry names the vendor's `skill` (`cometchat-migrate-from-{sendbird,getstream,twilio}`, routed in `peers.yaml` `migrations:`); a vendor the user NAMES counts even if detect misses it. That skill runs the whole migration in one prompt (detect → replace → remove what CometChat lacks → verify → final list of removed features) and lands on the `<family>` core itself. "Migrate to CometChat" with neither vendor detected nor named → say no Sendbird/Stream usage was found, then continue at rule 1/2. A plain "add chat" on a repo where `migrate_from` is set → onboarding, which names the vendor in its plan and offers the migration.
 1. **ALREADY INTEGRATED + a specific request → go STRAIGHT to the task skill. Do NOT run onboarding.** Run `npx @cometchat/skills detect --json` — the authority: `existing_cometchat: true` means a CometChat UI Kit/SDK dependency is present (`@cometchat/chat-uikit-*`/`chat-sdk-*`/`calls-sdk-*`, `com.cometchat:*`, `cometchat_*`, `CometChatUIKitSwift`). If it can't run, READ the repo for that same dependency. A `.cometchat/` folder is NOT evidence — the installer and the dashboard CLI create it. (The dashboard CLI `@cometchat/skills-cli` has no `detect`; `RULES.md` → "The CLI is a dashboard/API client only".) Present ⇒ the plan/approve journey has already happened. Treat the ask as a TASK, not an integration: resolve `<family>` (rule 4), pick the `<type>` from the map in rule 5, open that skill directly. This is the COMMON case in a live app — "change my avatar", "add a logout button", "add polls", "restyle the bubble", "my custom view isn't showing" — and none of it is onboarding. Routing it through the gate re-asks questions the user already answered; having NO branch for it is worse, because the agent then falls out of the flow and guesses from `node_modules` (AUDIT-106).
 2. **First-contact "add CometChat" (add chat / add calling / integrate cometchat) → ALWAYS route to `cometchat-onboarding` FIRST.** This is a mandatory gate, not optional: onboarding runs the framework-agnostic DISCOVER → UNDERSTAND → PLAN journey (whole-repo detect, intent questions with recommended defaults, the full plan artifact, the modify/approve gate) BEFORE any framework core. It then hands a scoped build directive down to the framework core. Do NOT route straight to a `-core` skill for a first-contact add request — onboarding gates it. (Onboarding short-circuits on an already-integrated repo — see its Re-entry section.)
 3. **Upgrade request** ("upgrade v6 to v7", "v4 to v5", "v5 to v6 Android") is reconciliation, NOT onboarding → route straight to `cometchat-<family>-migration` (that IS the reconciliation). The `version_conflict` STOP still applies to *add* requests; onboarding surfaces it in the plan and reconciles before hand-off.
@@ -37,7 +38,11 @@ Full text: `RULES.md` -> "Fetch discipline".
    - push notifications → `cometchat-<family>-push` (THIN + docs-first — fetches the notifications docs; live delivery is a manual device check)
    - upgrade an existing major → `cometchat-<family>-migration`
    - framework glue (env, SSR/islands, routing, native build config) → `cometchat-<family>-patterns` on `react-v7` (Vite/Next/CRA/React Router/Astro), `angular-v5`, `flutter-v6`. `react-native`: the split pair `cometchat-react-native-expo-patterns` (Expo) / `cometchat-react-native-bare-patterns` (RN CLI/bare) — pick by whether `expo` is a dependency. iOS and Android have NO `patterns` skill.
-   - production hardening / testing / troubleshooting → `cometchat-<family>-{production,testing,troubleshooting}` on `angular-v5`, `react-native`, `android-v6`, `flutter-v6` (none on `react-v7`/`ios` — use `core` + its `docs-map.md`). `events` → `android-v6`, `flutter-v6`.
+   - **analytics / metrics / observability / monitor / dashboards / send events to Datadog·Segment·BigQuery** → `cometchat-analytics`.
+   - **audit / review / health-check an EXISTING integration** → `cometchat-audit` (read-only; routes fixes to the owning skills).
+   - **accessibility / WCAG / screen-reader / keyboard** → `cometchat-a11y`. **localization / i18n / translate the UI / RTL** → `cometchat-i18n`. (Cross-family, installed for every family.)
+   - **enterprise security / SSO / RBAC / session revocation / multi-tenant** → `cometchat-security` (cross-family: server + access-control model; client login stays in the family core/production). **data residency / GDPR / retention / audit logs / eDiscovery** → `cometchat-compliance`. **on-prem / self-host / private cloud** → `cometchat-self-host`. **moderation / safety / profanity / image moderation** → `cometchat-moderation`. These four are installed for every family (like onboarding).
+   - production hardening / testing / troubleshooting → `cometchat-<family>-{production,testing,troubleshooting}` on every UI family (`react-v7`, `angular-v5`, `react-native`, `ios`, `android-v6`, `flutter-v6`). `events` → `android-v6`, `flutter-v6`.
    - **`react-native` only** — `cometchat-react-native-sdk` (the method→contract fallback map; kit v5 removed the detail/management screens, so SDK calls are on the main road for RN, not an escape hatch).
    - **`android-v6` only** — cohort-split skills (pick cohort from gradle files: `kotlin-*` = XML Views, `compose-*` = Jetpack Compose): `cometchat-android-v6-{kotlin,compose}-{components,placement,customization}`; also `builder-settings`, `extensions`. Headless Chat SDK v5 (build-your-own-UI) → `cometchat-android-v5-sdk`.
    - **Headless Calls SDK v5** (from-scratch calling, NO UI Kit — meet-style or 1:1 ringing; via onboarding's calling-first tree) → `cometchat-js-v5-sdk` (web) · `cometchat-react-native-v5-sdk` · `cometchat-ios-v5-sdk` · `cometchat-android-v5-calls-sdk` · `cometchat-flutter-v5-sdk`. Not installed? `npx @cometchat/skills add --family <js|react-native|ios|android|flutter>-calls` adds it alongside the UI Kit skills. The prebuilt call UI stays `cometchat-<family>-calls`.

package/skills/cometchat-a11y/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: cometchat-a11y
+description: "Keep a CometChat integration accessible — the UI Kit is designed targeting WCAG 2.1 AA with keyboard navigation (verify per component in its docs; full conformance still needs manual testing), and this skill makes sure the HOST app doesn't break that, covering contrast, focus, screen-reader context, reduced motion, RTL, and calls accessibility. Cross-family. Triggers: 'is cometchat accessible', 'WCAG / 508 / ADA compliance', 'screen reader support', 'keyboard navigation', 'a11y audit', 'accessible chat', 'contrast/focus issues in chat'."
+license: "MIT"
+compatibility: "CometChat UI Kits (React v7 · Angular v5 · React Native v5 · iOS v5 · Android v6 · Flutter v6). Kit components are designed targeting WCAG 2.1 AA + keyboard navigation (the Angular docs state this explicitly; other families are not individually documented, and full conformance needs manual testing / a VPAT). Host wiring is per platform."
+metadata:
+  author: "CometChat"
+  version: "1.0.0"
+  tags: "cometchat a11y accessibility wcag screen-reader keyboard focus contrast rtl section508"
+---
+
+> **Ground truth:** the UI Kit components are documented as **designed targeting WCAG 2.1 Level AA** with **keyboard navigation** built in (the Angular component docs state this most explicitly; note the docs' own caveat that full conformance still requires manual testing — do not assert a blanket AA/VPAT claim to the user without it). Treat AA as the design target, not a certified guarantee. Accessibility failures in a CometChat app are almost always **host-side regressions** — global CSS, a broken focus order, a container with no accessible name, or motion that ignores the user's preference. Verify component-level a11y claims against the component's own docs page (`cometchat-<family>-components` → docs-map); this skill owns the host-side discipline the kit can't control.
+
+## Use this skill when
+An accessibility review (WCAG / Section 508 / ADA / EN 301 549), a screen-reader or keyboard complaint, or "make our chat accessible." Procurement for public-sector, education, healthcare and large enterprises requires this.
+
+## Start from what the kit gives you
+The kit ships accessible components: keyboard-operable lists/composer, focus handling, and semantics **designed targeting** AA (the design target — not a certified guarantee; see above). On web it sets ARIA roles and names itself — the conversation/user rosters render as a labelled `listbox` and manage roving focus — so don't override or strip them. Your job is to **not break it** and to make the surrounding app equally accessible. Two rules first:
+1. **Don't let global CSS leak into the `.cometchat` subtree** (web) — a global `outline:none`, a low-contrast override, a `text-align`/flex reset, or a Tailwind base can strip focus rings or break contrast the kit set correctly. Scope your resets away from the kit (`RULES.md` → CSS isolation).
+2. **Give the chat container a real, labelled home** — a sized region (a11y needs a visible, non-collapsed surface too) with an accessible name (e.g. an `aria-label`/landmark on web, an accessibility label on native) so screen-reader users can find and enter it.
+
+## The checklist (host-side)
+- **Keyboard:** every path reachable and operable by keyboard — open a conversation, type, send, open thread, close. Don't trap focus; return focus sensibly when a panel/dialog closes. Don't remove focus outlines; if you restyle them, keep a visible focus indicator.
+- **Screen reader:** the surface and its regions have accessible names; your own buttons around the kit have labels (not icon-only with no `aria-label`/accessibility label). New-message announcements: verify the kit's live-region behavior on your target reader (VoiceOver/NVDA/TalkBack) and don't suppress it with `aria-hidden` on an ancestor.
+- **Contrast:** if you theme the kit (`cometchat-<family>-customization`), keep text/UI contrast at **AA** (4.5:1 text, 3:1 large text/UI). Check both light and dark themes — a brand color that passes on light can fail on dark.
+- **Reduced motion:** honor `prefers-reduced-motion` (web) / the OS "reduce motion" setting (native) in any animation you add around the chat; don't force motion the user opted out of.
+- **Text scaling / zoom:** the surface must remain usable at 200% zoom / large Dynamic Type — don't cap font sizes or clip at large text.
+- **RTL:** direction-correct for RTL locales (pairs with `cometchat-i18n`).
+- **Targets:** your custom controls meet the minimum touch-target size; don't shrink the kit's.
+
+## Calls accessibility (if you use calling)
+- Request camera/mic with clear, user-visible prompts and reasons.
+- Provide accessible labels for call controls you add (mute, end, camera).
+- Where available, surface captions/transcription; ensure incoming-call UI is announced and keyboard/AT-operable.
+
+## Test it
+- **Automated (web):** run `axe`/Lighthouse on the chat screen — fix contrast, missing names, and ARIA misuse it flags. (Automated tools catch ~a third of issues; do the manual pass too.)
+- **Manual:** tab through the whole flow with the mouse unplugged; drive it with VoiceOver / NVDA / TalkBack; zoom to 200%; toggle reduced motion; switch to dark. Fix what breaks in YOUR wiring; if a genuine kit-component gap appears, verify against the component docs and report it (don't hand-patch kit internals).
+
+## Common pitfalls
+1. **Global CSS stripping focus rings or contrast** inside `.cometchat` — scope resets away.
+2. **Icon-only custom buttons with no label** — add accessible names.
+3. **Unlabelled, collapsed, or unreachable chat container** — size it and name it.
+4. **Animations ignoring reduced-motion.**
+5. **Contrast checked in one theme only** — check light and dark.
+6. **Assuming automated tools are enough** — they miss keyboard/reader flow; test manually.
+
+## Verify it works
+The chat flow is fully keyboard-operable with a visible focus indicator · a screen reader announces the surface, messages, and your controls · contrast passes AA in light and dark · the UI holds at 200% zoom / large type · reduced-motion is honored · RTL mirrors correctly · axe/Lighthouse on the chat screen is clean of contrast/name/ARIA errors.

package/skills/cometchat-analytics/SKILL.md

@@ -0,0 +1,61 @@
+---
+name: cometchat-analytics
+description: "See what your chat is doing — pull usage & message metrics via REST, stream real-time events to your data/observability stack via webhooks, monitor client-side errors & the init/login path, and read push/call logs. Cross-family: metrics/webhooks are server-side; client error monitoring wires per family. Triggers: 'chat analytics', 'usage metrics', 'message volume', 'monitor cometchat', 'observability', 'send chat events to datadog/segment/bigquery', 'track delivery', 'error monitoring for chat', 'dashboards for chat'."
+license: "MIT"
+compatibility: "CometChat Metrics REST API (usage · message) · Webhooks · Notification/Call logs · on-prem Prometheus/Grafana/Loki. Client error monitoring via each family's error boundary / listeners."
+metadata:
+  author: "CometChat"
+  version: "1.0.0"
+  tags: "cometchat analytics observability metrics webhooks monitoring datadog sentry dashboards"
+---
+
+> **Ground truth:** shapes are FETCHED from the live docs — `{DOCS_BASE}/rest-api/metrics/usage-metrics`, `/rest-api/metrics/message-metrics`, `/fundamentals/webhooks` (+ `/rest-api/management-apis/webhooks/overview`), `/notifications/logs`, `/rest-api/calls-apis/get-call`, and on-prem `/on-premise-deployment/docker/monitoring`. `DOCS_BASE = https://www.cometchat.com/docs`; append `.md`. Verify each metric field / event name against the docs before charting it; don't invent a metric.
+
+## Use this skill when
+You need visibility into chat: product analytics (DAU, messages, retention), an ops/observability signal (delivery, errors, latency), or feeding chat events into an existing warehouse/monitoring stack.
+
+## Three layers of visibility
+| Layer | Source | Use it for |
+| --- | --- | --- |
+| **Aggregate metrics** | Metrics REST API (usage + message) | dashboards, MAU/DAU, message volume, growth |
+| **Real-time events** | Webhooks | stream every message/user/group/call event to your pipeline |
+| **Client health** | your error monitor + the kit's error boundary/listeners | init/login failures, render errors, UX latency |
+
+## 1. Aggregate metrics (REST, server-side)
+- **Usage metrics** (`{DOCS_BASE}/rest-api/metrics/usage-metrics`) — active users and usage over time.
+- **Message metrics** (`{DOCS_BASE}/rest-api/metrics/message-metrics`) — message volume/counts.
+- **Call metrics** — per-call detail incl. participant metrics via `{DOCS_BASE}/rest-api/calls-apis/get-call`.
+Call these from a server job with the **REST API Key** (never client-side), on a schedule, into your BI tool. Fetch the exact query params + response fields from each page before building the report.
+
+## 2. Real-time events → your stack (webhooks)
+Webhooks POST an HTTPS notification to your server on message / user / group / call events (`{DOCS_BASE}/fundamentals/webhooks`; configure via `/rest-api/management-apis/webhooks/overview`). This is how you get chat into **Segment / BigQuery / Snowflake / Datadog / a data lake** in real time:
+1. Stand up an HTTPS endpoint (returns 200 to ack). Secure it with the **Basic Auth** credentials CometChat sends on every webhook request (`{DOCS_BASE}/fundamentals/webhooks` — the docs describe Basic Auth only, with no payload-signature scheme, so validate the `Authorization` header rather than looking for an HMAC signature).
+2. Subscribe to the events you need (don't fan out everything if you only need message.sent).
+3. Transform + forward to your warehouse/observability sink; make the handler idempotent and fast (queue heavy work).
+The same webhook stream doubles as a **tamper-evident audit log** for `cometchat-compliance`.
+
+## 3. Client-side error & performance monitoring (per family)
+The metrics API won't tell you a user's chat failed to load — instrument the client:
+- **Capture kit render errors** — on the React families via the error boundary's hook (React v7: `CometChatErrorBoundary` `onError`; Angular/RN have the equivalent); on iOS/Android/Flutter (no error-boundary construct) via the SDK error listeners / the kit's error-state views. Forward to Sentry/Datadog with context.
+- **Instrument the critical path** — wrap init, the token fetch, and login in spans/breadcrumbs; a spike in login failures is your earliest incident signal (often Region or token issues).
+- **Listen for connection state** — the SDK's connection/websocket listeners tell you when clients drop; count reconnects.
+- **Don't log secrets or message bodies** to your monitor — log UIDs/event types/latencies, not content (privacy + `cometchat-compliance`).
+Wire these through the resolved family's `-core`/`-production`/`-troubleshooting` skills.
+
+## 4. Delivery & call logs
+- **Push delivery logs** (`{DOCS_BASE}/notifications/logs`) — FCM/APNs/email/SMS delivery, ~14-day retention; enable when diagnosing "notifications not arriving" and export before they age out.
+- **Call logs** — the Calls REST APIs for per-call quality/participant metrics.
+
+## 5. Self-host observability
+On-prem ships **Prometheus + Grafana + Loki + Promtail** (`{DOCS_BASE}/on-premise-deployment/docker/monitoring`): service metrics, dashboards, alerts, and centralized logs — wire alerts (P95 latency, error rate, WS capacity) to your on-call. SaaS customers use the Metrics API + webhooks instead.
+
+## Common pitfalls
+1. **Metrics API called client-side** — it needs the REST API Key; server only.
+2. **Webhook handler slow or non-idempotent** — retries pile up; ack fast, queue the work, dedupe.
+3. **Charting an invented metric** — fetch the real fields from the metrics pages.
+4. **Logging message content to your monitor** — privacy/compliance risk; log metadata, not bodies.
+5. **No client error monitoring** — you'll hear about outages from users, not dashboards; wire the error boundary + login-path spans.
+6. **Relying on push logs after they age out** — export within the retention window.
+
+## Verify it works
+Usage/message metrics return real numbers into your dashboard · a test message triggers your webhook and lands in your warehouse/monitor · a forced init/login failure shows up in your error monitor with context · push/call logs are readable when needed · (on-prem) Grafana shows the services and alerts fire.

package/skills/cometchat-android-v6-core/references/docs-map.md

@@ -40,8 +40,8 @@ Fallback order: `.md` twin → if it 404s, the same URL **without** `.md` (HTML)
 ```
 An Android-v6-only index of every page as a `.md` link — use it to discover any page not in the
 table below. Global all-products index (large; last resort): `{DOCS_BASE}/llms.txt`.
-> **DOCS-GAP note:** this scoped index ships with docs branch `docs/android-llms-indexes`; until that
-> merges, the per-page `.md` twins below already work — fall back to the table + the global `llms.txt`.
+> **Scoped index:** `{DOCS_BASE}/ui-kit/android/llms-android-v6.md` is live (the `docs/android-llms-indexes`
+> branch merged). Use it to find pages; the per-page `.md` twins below + the global `llms.txt` remain fallbacks.
 
 ## SDK docs — the FALLBACK reference (a feature the UI Kit has NO component for)
 The rule of the pack: **for every feature, first check whether the UI Kit has a component/param for it

package/skills/cometchat-android-v6-production/SKILL.md

@@ -14,6 +14,7 @@ metadata:
 ## Companion skills (read first)
 - `cometchat-android-v6-core` — install, credentials, `initFromSettings → login`, lifecycle. Assumed here, never repeated.
 - `cometchat-android-v6-builder-settings` — the settings file + auth method reference · `cometchat-android-v6-testing` — pre-release verification · `cometchat-android-v6-push` (unregister on logout).
+- `cometchat-security` — the enterprise auth model this client-side hardening plugs into: wiring your IdP / SSO into the token flow (your IdP → your server → mint the CometChat auth token; CometChat is **not** an IdP), token expiry/refresh + re-login, RBAC roles + group (SBAC) scopes, and Auth Key vs auth token vs REST API Key. Load it for a security review or any SSO question.
 
 ## Use this skill when
 "are we production ready?", "switch from the Auth Key to auth tokens", "prepare the release build", "does CometChat need ProGuard rules?", "what are the rate limits?", "anything to do before Play Store submission?".

package/skills/cometchat-angular-v5-production/SKILL.md

@@ -13,6 +13,7 @@ metadata:
 
 ## Companion skills (read first)
 - `cometchat-angular-v5-core` — `references/setup-credentials.md` covers the dev credential flow this replaces.
+- `cometchat-security` — the enterprise auth model this client-side hardening plugs into: wiring your IdP / SSO into the token flow (your IdP → your server → mint the CometChat auth token; CometChat is **not** an IdP), token expiry/refresh + re-login, RBAC roles + group (SBAC) scopes, and Auth Key vs auth token vs REST API Key. Load it for a security review or any SSO question.
 
 ## Use this skill when
 Moving off the development setup: going live, a security review, or "is this safe to ship".

package/skills/cometchat-audit/SKILL.md

@@ -0,0 +1,61 @@
+---
+name: cometchat-audit
+description: "Review an EXISTING CometChat integration and report what's wrong or risky — security (no client Auth Key, server tokens), correctness (init→login→render order, no raw localization keys, no dead affordances), version drift (version_conflict), production-readiness, accessibility & localization gaps — ranked, with fixes routed to the right skill. Read-only: it reports, it doesn't rewrite unless you ask. Triggers: 'audit my cometchat integration', 'review my chat setup', 'is my cometchat secure / production ready', 'check my cometchat code', 'health check', 'what's wrong with my chat'."
+license: "MIT"
+compatibility: "Any CometChat integration (React v7 · Angular v5 · React Native v5 · iOS v5 · Android v6 · Flutter v6 · headless SDK). Read-only review; fixes route to the family skills."
+metadata:
+  author: "CometChat"
+  version: "1.0.0"
+  tags: "cometchat audit review health-check security production-readiness diagnostics"
+---
+
+> **Ground truth:** the authority for "correct" is `RULES.md` + the resolved family's skills (`cometchat-<family>-core`/`-production`/`-troubleshooting`) and the offline probe `npx @cometchat/skills detect --json`. Verify every symbol/prop you flag against the family catalog + docs (via `-core/references/docs-map.md`); never flag from memory. This is a **read-only** review — produce the report first; only change code if the user says so (then hand each fix to the owning skill).
+
+## Use this skill when
+Someone wants an existing CometChat integration checked — before a launch, a security review, an upgrade, or a "why is this flaky / is this safe" question. It is the proactive complement to the per-family troubleshooting skills (`cometchat-<family>-troubleshooting`, which react to a specific symptom).
+
+## How to run the audit
+1. **Detect** — `npx @cometchat/skills detect --json`: framework, installed UI Kit, `version_conflict`, `existing_cometchat`. Resolve `<family>` from `peers.yaml`. If nothing is detected, say so and stop (nothing to audit).
+2. **Read the integration** — the init/login/lifecycle file, where the surface renders, the env/secret files, the server token endpoint (if any), and any custom message/theme/feature code. Do NOT read `node_modules`/`.d.ts`.
+3. **Score each check below**, gather evidence (`file:line`), and write a **ranked report** — most severe first — with, per finding, the fix and the skill that owns it. Then offer to apply fixes; don't auto-edit.
+
+## The checklist
+**Security (highest severity)**
+- Auth Key present in client code / bundle / binary? → critical; must move to server-minted tokens (`cometchat-security`, `cometchat-<family>-production`).
+- Token endpoint deriving the UID from a client parameter (`?uid=`)? → impersonation.
+- REST API Key anywhere client-side or in the repo? → critical.
+- Sessions revocable on offboarding (flush tokens)? RBAC roles configured, or everyone on `default`? (`cometchat-security`.)
+
+**Correctness**
+- `init() → login() → render` order honored; no component rendered before login resolves; no init during SSR; StrictMode/double-invoke guarded.
+- `initFromSettings` used (ai-agent attribution), not the classic builder init.
+- Surface has real dimensions (not a collapsed 0-height box); host CSS not leaking into `.cometchat`.
+- No raw localization keys rendered (`group_info` etc.).
+- No dead affordances — every default-on control wired or hidden.
+- Listeners removed on unmount/dispose (no duplicate messages/leaks).
+
+**Version & drift**
+- `version_conflict` from detect (UI Kit major ≠ the family's target)? → route to `cometchat-<family>-migration`.
+- Kit/SDK versions pinned (not a floating major)? iOS: the exact kit+SDK+Calls pins.
+
+**Production-readiness**
+- HTTPS everywhere; logout teardown (session + push tokens); dashboard extensions/AI enabled on the PRODUCTION app; error handling in place (React families: an error boundary such as `CometChatErrorBoundary`; iOS/Android/Flutter: SDK error listeners / kit error-state views). (`cometchat-<family>-production`.)
+
+**Accessibility & localization (enterprise procurement)**
+- Focus rings / contrast not stripped by global CSS; chat container labelled; reduced-motion honored (`cometchat-a11y`).
+- Locale set before render; no raw keys; RTL handled if targeted (`cometchat-i18n`).
+
+**Compliance (if in scope)**
+- App in the right data-residency region; a data-deletion path exists (`cometchat-compliance`); moderation enabled if the product needs T&S (`cometchat-moderation`).
+
+## The report format
+Lead with a one-line verdict (ship / fix-first / not-ready) and counts by severity. Then a table: `Severity · Finding · Evidence (file:line) · Fix · Owning skill`. List what PASSED too, so the reader knows it was checked. End with the top 3 things to fix first. Do not inflate severity, and do not flag a "problem" you didn't verify against docs/catalog.
+
+## Common pitfalls (of the auditor)
+1. **Flagging from memory** — verify each symbol/prop against the catalog + docs before calling it wrong.
+2. **Auto-editing** — this is read-only; report, then ask.
+3. **Reading `node_modules`/`.d.ts`** — audit the user's code + docs, not kit internals.
+4. **Severity inflation** — a dev-only Auth Key in a local `.env` is not the same as one shipped in production; judge by what actually reaches users.
+
+## Verify it works
+The report names the framework + family, lists ranked findings each with `file:line` + a fix + an owning skill, states what passed, and gives a clear verdict — and nothing was edited unless the user approved.

package/skills/cometchat-compliance/SKILL.md

@@ -0,0 +1,63 @@
+---
+name: cometchat-compliance
+description: "Data governance & compliance for CometChat — pick the data-residency region, satisfy GDPR/CCPA (right-to-erasure and data export), plan message retention & purge, and produce audit / eDiscovery records. Cross-family: all server/REST/dashboard-side. Triggers: 'is cometchat GDPR compliant', 'delete a user and their data', 'right to be forgotten', 'export a user's data', 'data residency EU', 'which region', 'message retention policy', 'audit log', 'eDiscovery', 'HIPAA/SOC2 chat', 'compliance review'."
+license: "MIT"
+compatibility: "CometChat REST API v3 (users · messages · conversations) + dashboard (regions, moderation records). Server-side over HTTPS."
+metadata:
+  author: "CometChat"
+  version: "1.0.0"
+  tags: "cometchat compliance gdpr ccpa hipaa data-residency retention audit ediscovery erasure region"
+---
+
+> **Ground truth:** REST shapes are FETCHED from the live docs — `{DOCS_BASE}/rest-api/users/delete` (erasure), `/rest-api/messages`, `/rest-api/conversations` (access/export), `/articles/properties-and-constraints` (regions, retention behaviour), `/moderation/reviewed-messages` (audit). `DOCS_BASE = https://www.cometchat.com/docs`; append `.md`. Where a control is a **dashboard setting or a sales/plan item** (a managed retention policy, a signed BAA, certifications), this skill says so plainly rather than inventing an API. Certification status (SOC 2, ISO 27001, HIPAA) is a business fact — confirm current scope at `{DOCS_BASE}`/the trust page, don't assert it from here.
+
+## Use this skill when
+A privacy/security/compliance review, a data-subject request (delete/export), choosing where data lives, or planning retention and audit. All actions here are server-side; there is no client code to write.
+
+## 1. Data residency — choose the region up front
+CometChat hosts each app in one region: **`us`, `eu`, or `in`** (`{DOCS_BASE}/rest-api/chat-apis` → Data Center Hosting — re-fetch before quoting to a customer; regions can be added). The region is fixed to the app and is part of every API/SDK endpoint (`https://{APP_ID}.api-{REGION}.cometchat.io/v3`, and the SDK init `region`). To keep EU data in the EU (GDPR) or meet a residency clause, **create the app in that region** — you cannot silently move an app's region afterward; migrating regions means a new app + a data migration (`cometchat-migrate-from-*` machinery / CometChat support). For full data sovereignty (your own infrastructure), see `cometchat-self-host`.
+
+## 2. Right to erasure (GDPR Art. 17 / CCPA delete)
+Call the REST **Delete User** endpoint (`DELETE https://{APP_ID}.api-{REGION}.cometchat.io/v3/users/{uid}`; see the docs at `{DOCS_BASE}/rest-api/users`) with the **REST API Key**:
+- **Default** (no body) → **deactivates** the user (recoverable; keeps data).
+- **`{ "permanent": true }`** → **permanently deletes the user with all their messages, conversations and associated data. Irreversible.**
+
+```http
+DELETE https://{APP_ID}.api-{REGION}.cometchat.io/v3/users/{uid}
+apikey: {REST_API_KEY}
+content-type: application/json
+
+{ "permanent": true }
+```
+Wire this to your account-deletion flow so a "delete my account" request erases the user in CometChat too. Also flush their auth tokens (`cometchat-security`) so no session lingers.
+
+## 3. Right of access / portability (data export)
+To answer a data-subject *access* request, export the user's data server-side via REST and hand it over in a portable format:
+- their messages — the Messages REST collection (`{DOCS_BASE}/rest-api/messages`, filtered by the user);
+- their conversations — `{DOCS_BASE}/rest-api/conversations`;
+- their profile — the Users API.
+Run it with the REST API Key from a server job; never expose these to the client. Fetch the exact filter params from the docs before writing the exporter.
+
+## 4. Retention & purge
+CometChat keeps messages until they are deleted. Behaviour to know (`/articles/properties-and-constraints`): **soft-deleted** messages are retained; messages **permanently deleted via the API are not**. To enforce a retention window:
+- run a scheduled server job that deletes messages/conversations older than your policy via the REST APIs (delete-message / delete-conversation / user permanent-delete);
+- a **managed/automatic retention policy** (auto-purge at N days) is a dashboard/plan capability — confirm availability and configure it with CometChat rather than assuming an API. Do not invent a retention endpoint.
+- **on-prem** gives you full control of storage lifecycle and backups (`cometchat-self-host`).
+
+## 5. Audit & eDiscovery
+- **Moderation audit trail:** the dashboard's **Moderation → Reviewed Messages** records moderator activity and decisions for compliance (`{DOCS_BASE}/moderation/reviewed-messages`); pair with `cometchat-moderation`.
+- **eDiscovery / legal hold:** export the relevant conversations and messages via the REST collections above (by user, group, or time range) — that is the supported way to produce chat records; there is no separate "eDiscovery API." For a legal hold, export before any retention purge runs.
+- **Webhooks** (`{DOCS_BASE}/rest-api/management-apis/webhooks/overview`) can stream message/user events to your own immutable audit store in real time if you need a tamper-evident log outside CometChat.
+
+## 6. Certifications & agreements (business, not code)
+SOC 2, ISO 27001, HIPAA (with a BAA), GDPR/CCPA posture, and pen-test reports are handled through CometChat's trust/compliance process, not the API. Point the reviewer to the current trust page and get agreements in writing; encryption in transit (TLS) is standard, and at-rest/e2e options + key management vary by plan/deployment — confirm the specifics for the customer's plan.
+
+## Common pitfalls
+1. **Region chosen by accident** — the default is `us`; an EU customer needs the app created in `eu` from day one.
+2. **"Delete" that only deactivates** — omitting `permanent: true` leaves the data; erasure requests need the flag.
+3. **Deleting the user but leaving live sessions** — also flush auth tokens (`cometchat-security`).
+4. **Assuming an automatic retention policy exists** — implement purge via REST/on-prem, or confirm the managed setting; don't invent it.
+5. **Asserting a certification from memory** — verify current SOC 2 / HIPAA / ISO scope with CometChat.
+
+## Verify it works
+A test user permanently deleted returns success and their messages/conversations are gone · an access-request export produces the user's profile + messages + conversations · the app's region matches the customer's residency requirement · a retention job (or the confirmed managed policy) removes data past the window · moderation decisions appear in Reviewed Messages · webhooks (if used) land audit events in your store.

package/skills/cometchat-flutter-v6-customization/SKILL.md

@@ -83,7 +83,7 @@ Widget themedHeader(User user) => CometChatMessageHeader(
 - **Text formatters** — `CometChatMentionsFormatter` and custom `CometChatTextFormatter` subclasses (`customization-text-formatters`, `custom-text-formatter-guide`). A subclass must implement `init`, `getMessageInputTextStyle`, `handlePreMessageSend`, `onChange` and `onScrollToBottom` — the class is abstract.
 - **Message templates** — custom message types and bubbles (`message-template`, → `-components`).
 - **Sounds** — the class is **`SoundManager`**, UN-prefixed (there is no `CometChatSoundManager`), a singleton: `SoundManager().play(sound: Sound.incomingMessage, customSound: "assets/ping.mp3")` / `.stop()`. Compiler-verified vs 6.1.0. It is absent from the catalog only because that tracks `CometChat*` symbols — same as `User`/`Group`. Page: `sound-manager`.
-- **Localization** — `Translations` from the **chat barrel**: `Translations.delegate` in `MaterialApp.localizationsDelegates`, `Translations.of(context)` for strings. v5's `package:cometchat_uikit_shared/l10n/translations.dart` is gone; the live `localize` page now documents the `Translations` path (DOCS-BACKLOG F7 corrected upstream — verified `cometchat/docs`@`2ebb1db`, 2026-09-09). `CometChatLocalize` does not resolve in 6.1.0.
+- **Localization** — via `CometChatLocalize`, the same localization class the other families use: register its delegate in `MaterialApp.localizationsDelegates` and read/override strings through it. Fetch the exact Flutter API from the live `localize` page (`references/docs-map.md` → Localization). **[STAGED — needs the UI Kit change]** `CometChatLocalize` requires a `cometchat_chat_uikit` version that exposes it; the pinned **6.1.0 does not** (it exposes `Translations`). Bump the pin + refresh `catalogs/flutter-v6.json` when that kit ships — until then Flutter localization emitted this way will not compile.
 
 ## Common pitfalls (BAKED)
 - **Inventing a CometChat dark-mode switch.** Use `ThemeData` + `themeMode`; register the palette on both themes.

package/skills/cometchat-flutter-v6-migration/references/migration-guide.md

@@ -64,13 +64,14 @@ Everything here is **compiled against the published `cometchat_chat_uikit` 6.1.0
 `SoundManager().play(sound: Sound.incomingMessage)` / `.stop()`, compiler-verified vs 6.1.0). It looked
 missing only because the catalog tracks `CometChat*` symbols; the class is public and importable.
 
-## Localization — use `Translations` from the chat barrel
-`CometChatLocalize` does not resolve in 6.1.0. The working entry point is **`Translations`, exported
-from the chat barrel**; `Translations.delegate` still goes in `MaterialApp.localizationsDelegates` and
-`Translations.of(context)` still resolves strings. A v5 app usually needs no change here beyond fixing
-which barrel its `as cc` prefix points at. (v5's `package:cometchat_uikit_shared/l10n/translations.dart`
-is gone; the live `localize` page now documents the `Translations` path — DOCS-BACKLOG F7 corrected
-upstream, verified `cometchat/docs`@`2ebb1db`, 2026-09-09.)
+## Localization — use `CometChatLocalize`
+Flutter localizes through **`CometChatLocalize`**, the same class as the other families: register its
+delegate in `MaterialApp.localizationsDelegates` and read/override strings through it. Fetch the exact
+Flutter API from the live `localize` page (`references/docs-map.md` → Localization).
+> **[STAGED — needs the UI Kit change]** `CometChatLocalize` requires a `cometchat_chat_uikit` version
+> that exposes it; the pinned **6.1.0 does not** (it exposes `Translations`). Bump the pin + refresh
+> `catalogs/flutter-v6.json` when that kit ships — until then Flutter localization emitted this way
+> will not compile. (The barrel-import notes below still describe the 6.1.0 shape.)
 
 ## Imports — expect this to break the MOST files
 - `package:cometchat_uikit_shared/...` → **gone**. Everything is `package:cometchat_chat_uikit/cometchat_chat_uikit.dart`.

package/skills/cometchat-flutter-v6-production/SKILL.md

@@ -14,6 +14,7 @@ metadata:
 ## Companion skills (read first)
 - `cometchat-flutter-v6-core` — install, credentials, `init→login→render`, `lifecycle.md`. This skill ASSUMES it.
 - `cometchat-flutter-v6-patterns` — where config comes from in your build pipeline.
+- `cometchat-security` — the enterprise auth model this client-side hardening plugs into: wiring your IdP / SSO into the token flow (your IdP → your server → mint the CometChat auth token; CometChat is **not** an IdP), token expiry/refresh + re-login, RBAC roles + group (SBAC) scopes, and Auth Key vs auth token vs REST API Key. Load it for a security review or any SSO question.
 
 ## Use this skill when
 Hardening before release: "is the Auth Key safe to ship", "set up production auth", "what do I check before shipping".