@jigyasudham/veto 3.0.0 → 3.1.1

package/dist/skills/memory/skill-decision-log.js

@@ -1,103 +0,0 @@
-// Skill: decision-log — guide to logging architectural and design decisions
-const TEMPLATE = `
-// ── Decision Log Entry ────────────────────────────────────────────────────
-//
-// Use this template for any decision that is:
-//   - Non-obvious (a reasonable engineer could choose differently)
-//   - Hard to reverse (schema changes, API contracts, auth architecture)
-//   - Frequently re-discussed (keeps relitigating the same debate)
-//   - A deliberate trade-off (performance vs correctness, simplicity vs flexibility)
-//
-{
-  "id": "ADR-001",                        // Sequential ID for referencing
-  "title": "Use JWT with rotating refresh tokens for authentication",
-  "status": "accepted",                   // proposed | accepted | deprecated | superseded-by:ADR-xxx
-  "date": "2026-05-01",
-  "deciders": ["agent:auth", "human:alice"],
-
-  "context": "We need an authentication mechanism for a stateless REST API that will be consumed by a mobile app and a web SPA. Session cookies are not ideal for the mobile client.",
-
-  "decision": "Implement stateless JWTs for access (15-minute TTL) with rotating refresh tokens stored server-side in a database table.",
-
-  "rationale": "JWTs allow stateless verification on every request without a DB lookup. Refresh token rotation limits the window of token theft. httpOnly cookies for refresh tokens prevent XSS access.",
-
-  "alternatives": [
-    {
-      "option": "Server-side sessions with Redis",
-      "pros": ["Instant revocation", "No JWT complexity"],
-      "cons": ["Requires Redis infrastructure", "Not stateless — every request hits Redis", "Mobile clients struggle with cookie-based sessions"],
-      "rejected_because": "Adds Redis dependency; poor fit for mobile client"
-    },
-    {
-      "option": "Long-lived JWTs with no refresh",
-      "pros": ["Simple implementation"],
-      "cons": ["Cannot revoke without infrastructure", "Long-lived tokens are a large attack window"],
-      "rejected_because": "Unacceptable security risk if token is stolen"
-    }
-  ],
-
-  "consequences": {
-    "positive": [
-      "Stateless verification — no DB lookup per request",
-      "Refresh token rotation limits theft window to 15 minutes",
-      "Mobile and web clients use the same auth mechanism"
-    ],
-    "negative": [
-      "Access tokens cannot be revoked before expiry (15-minute window)",
-      "Requires refresh token table with periodic cleanup job",
-      "More complex than simple sessions"
-    ],
-    "neutral": [
-      "JWT library (jsonwebtoken) must be kept up to date for security patches"
-    ]
-  },
-
-  "references": [
-    "OWASP Authentication Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html",
-    "RFC 6749 OAuth 2.0 Bearer Tokens",
-    "Related implementation: src/services/auth.service.ts"
-  ]
-}
-`.trim();
-export function run(input) {
-    return {
-        skill: 'decision-log',
-        template: TEMPLATE,
-        checklist: [
-            'Log the decision as soon as it is made — memory fades quickly and context is lost',
-            'Assign a sequential ID (ADR-001, ADR-002) to enable referencing in code comments and PRs',
-            'Write the context section first: describe the forces and constraints that made a choice necessary',
-            'State the decision explicitly and unambiguously — one clear sentence of what was decided',
-            'Document the rationale: why this option over the alternatives?',
-            'List at least two alternatives that were genuinely considered, not just strawmen',
-            'For each alternative, record pros, cons, and the specific reason it was rejected',
-            'Document positive, negative, and neutral consequences of the chosen option',
-            'Set the status field: proposed → accepted → deprecated or superseded-by:ADR-xxx',
-            'Add file references so future engineers can find the implementation',
-            'Reference the decision ID in relevant code comments: // See ADR-001',
-            'Store the decision log in docs/decisions/ or as a session memory entry',
-            'Update the status to "deprecated" or "superseded" when the decision changes — never delete',
-            'Review the decision log when revisiting a design — check if the original constraints still apply',
-        ],
-        patterns: [
-            'Architecture Decision Record (ADR) format: context → decision → rationale → alternatives → consequences',
-            'Decision-in-context: link from code to the decision that explains the design choice',
-            'Living document: update status when decisions change rather than deleting entries',
-            'Lightweight ADR: one file per decision, stored in git alongside the code it describes',
-        ],
-        gotchas: [
-            'Writing the decision without the rationale — future engineers will not know why, only what',
-            'Only documenting the chosen option without listing alternatives — looks like no thought went into it',
-            'Not updating stale decisions — a deprecated decision still marked "accepted" causes confusion',
-            'Writing the ADR after the fact with the benefit of hindsight — capture the original thinking at decision time',
-            'Logging trivial decisions — reserve the log for non-obvious choices; not every variable name needs an ADR',
-        ],
-        resources: [
-            'https://adr.github.io/ (Architectural Decision Records overview)',
-            'https://github.com/joelparkerhenderson/architecture-decision-record (templates and examples)',
-            'https://cognitect.com/blog/2011/11/15/documenting-architecture-decisions (original Michael Nygard post)',
-            'https://www.thoughtworks.com/radar/techniques/lightweight-architecture-decision-records',
-        ],
-    };
-}
-//# sourceMappingURL=skill-decision-log.js.map

package/dist/skills/memory/skill-decision-log.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"skill-decision-log.js","sourceRoot":"","sources":["../../../src/skills/memory/skill-decision-log.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAiB5E,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2DhB,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,UAAU,GAAG,CAAC,KAAiB;IACnC,OAAO;QACL,KAAK,EAAE,cAAc;QACrB,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE;YACT,mFAAmF;YACnF,0FAA0F;YAC1F,mGAAmG;YACnG,0FAA0F;YAC1F,gEAAgE;YAChE,kFAAkF;YAClF,kFAAkF;YAClF,4EAA4E;YAC5E,iFAAiF;YACjF,qEAAqE;YACrE,qEAAqE;YACrE,wEAAwE;YACxE,4FAA4F;YAC5F,kGAAkG;SACnG;QACD,QAAQ,EAAE;YACR,yGAAyG;YACzG,qFAAqF;YACrF,mFAAmF;YACnF,uFAAuF;SACxF;QACD,OAAO,EAAE;YACP,4FAA4F;YAC5F,sGAAsG;YACtG,+FAA+F;YAC/F,+GAA+G;YAC/G,2GAA2G;SAC5G;QACD,SAAS,EAAE;YACT,kEAAkE;YAClE,8FAA8F;YAC9F,yGAAyG;YACzG,yFAAyF;SAC1F;KACF,CAAC;AACJ,CAAC"}

package/dist/skills/memory/skill-session-restore.d.ts

@@ -1,15 +0,0 @@
-export interface SkillInput {
-    task: string;
-    context?: string;
-    options?: Record<string, unknown>;
-}
-export interface SkillOutput {
-    skill: string;
-    template?: string;
-    checklist: string[];
-    patterns: string[];
-    gotchas: string[];
-    resources: string[];
-}
-export declare function run(input: SkillInput): SkillOutput;
-//# sourceMappingURL=skill-session-restore.d.ts.map

package/dist/skills/memory/skill-session-restore.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"skill-session-restore.d.ts","sourceRoot":"","sources":["../../../src/skills/memory/skill-session-restore.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,wBAAgB,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,WAAW,CAoClD"}

package/dist/skills/memory/skill-session-restore.js

@@ -1,39 +0,0 @@
-// Skill: session-restore — guide to restoring context from a saved session
-export function run(input) {
-    return {
-        skill: 'session-restore',
-        template: undefined,
-        checklist: [
-            'Call veto_sessions_list to find available sessions; pick the most recent one matching your task',
-            'Call veto_session_restore with the session_id — read the resume_instructions field first',
-            'Trust the restored context. Do NOT re-read source files to orient yourself — that defeats session restore and wastes tokens',
-            'Read task_state.nextAction (or context.nextAction) — that is your starting instruction, execute it directly',
-            'Read decisions[] to understand constraints already made — do not revisit them without cause',
-            'Read progress.completed to know what is done — do not redo this work',
-            'Read progress.remaining to know what is left before you start',
-            'Only open a file if you are about to EDIT it — not to "familiarize yourself" or "verify" it',
-            'If you find a file has changed since the save (e.g. a function is missing), read only that file, note the discrepancy, and continue',
-            'Save a new checkpoint after restore so future sessions start from your updated state, not the old one',
-        ],
-        patterns: [
-            'Trust-then-act: the saved session is your context — start working from nextAction immediately',
-            'Read-only-to-edit: only read a file when you are about to change it, never for orientation',
-            'Stale-signal: if restored context mentions a symbol that does not exist, read only that file to reconcile',
-            'Checkpoint-on-restore: always save a new session immediately after restoring so the next session is current',
-        ],
-        gotchas: [
-            'Re-reading the whole codebase after restore — this is the token-waste the tool exists to prevent; do not do it',
-            'Ignoring resume_instructions and falling back to default "read all files" behavior',
-            'Picking the wrong session when multiple tasks are in progress — check the task/summary field carefully',
-            'Not saving a new checkpoint after restore — the next session will start from the old stale state',
-            'Acting on a session saved in "blocked" state without first resolving the listed blocker',
-        ],
-        resources: [
-            'Use the veto_session_restore MCP tool: { sessionId } → returns full session object',
-            'Use the veto_sessions_list MCP tool: returns all sessions sorted by updatedAt',
-            'Use the veto_session_save MCP tool after restoration to record the new starting point',
-            'MCP Session spec: https://modelcontextprotocol.io/docs/concepts/resources',
-        ],
-    };
-}
-//# sourceMappingURL=skill-session-restore.js.map

package/dist/skills/memory/skill-session-restore.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"skill-session-restore.js","sourceRoot":"","sources":["../../../src/skills/memory/skill-session-restore.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAiB3E,MAAM,UAAU,GAAG,CAAC,KAAiB;IACnC,OAAO;QACL,KAAK,EAAE,iBAAiB;QACxB,QAAQ,EAAE,SAAS;QACnB,SAAS,EAAE;YACT,iGAAiG;YACjG,0FAA0F;YAC1F,6HAA6H;YAC7H,6GAA6G;YAC7G,6FAA6F;YAC7F,sEAAsE;YACtE,+DAA+D;YAC/D,6FAA6F;YAC7F,qIAAqI;YACrI,uGAAuG;SACxG;QACD,QAAQ,EAAE;YACR,+FAA+F;YAC/F,4FAA4F;YAC5F,2GAA2G;YAC3G,6GAA6G;SAC9G;QACD,OAAO,EAAE;YACP,gHAAgH;YAChH,oFAAoF;YACpF,wGAAwG;YACxG,kGAAkG;YAClG,yFAAyF;SAC1F;QACD,SAAS,EAAE;YACT,oFAAoF;YACpF,+EAA+E;YAC/E,uFAAuF;YACvF,2EAA2E;SAC5E;KACF,CAAC;AACJ,CAAC"}

package/dist/skills/memory/skill-session-save.d.ts

@@ -1,15 +0,0 @@
-export interface SkillInput {
-    task: string;
-    context?: string;
-    options?: Record<string, unknown>;
-}
-export interface SkillOutput {
-    skill: string;
-    template?: string;
-    checklist: string[];
-    patterns: string[];
-    gotchas: string[];
-    resources: string[];
-}
-export declare function run(input: SkillInput): SkillOutput;
-//# sourceMappingURL=skill-session-save.d.ts.map

package/dist/skills/memory/skill-session-save.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"skill-session-save.d.ts","sourceRoot":"","sources":["../../../src/skills/memory/skill-session-save.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAqCD,wBAAgB,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,WAAW,CAqClD"}

package/dist/skills/memory/skill-session-save.js

@@ -1,74 +0,0 @@
-// Skill: session-save — when and how to save MCP sessions
-const TEMPLATE = `
-// ── What to include in a session save ────────────────────────────────────
-//
-// A session save should capture enough context so that a future agent
-// can resume work without re-reading all the source files.
-//
-// Recommended session object shape:
-{
-  "task": "The original task description in one sentence",
-  "phase": "planning | implementing | reviewing | blocked | complete",
-  "progress": {
-    "completed": ["List of finished subtasks or files written"],
-    "inProgress": ["Current subtask being worked on"],
-    "remaining": ["Subtasks still to do"]
-  },
-  "decisions": [
-    {
-      "decision": "What was decided",
-      "rationale": "Why this approach was chosen",
-      "alternatives": ["Other options that were considered"],
-      "timestamp": "ISO 8601 timestamp"
-    }
-  ],
-  "findings": [
-    "Any important discoveries that affect future work",
-    "File paths of key files that were read or modified",
-    "Patterns or constraints discovered in the codebase"
-  ],
-  "blockers": [
-    "Anything preventing progress that needs human input"
-  ],
-  "nextAction": "The single most important next step to resume work"
-}
-`.trim();
-export function run(input) {
-    return {
-        skill: 'session-save',
-        template: TEMPLATE,
-        checklist: [
-            'Preferred: call veto_session_save { auto_summarize: true } — Veto reads the full conversation and generates the structured summary, context, and task_state for you. No manual writing needed.',
-            'Save at the start of every new significant phase: planning, implementing, reviewing',
-            'Save after completing each major file or subtask — checkpoint before moving to the next',
-            'Save before any risky operation (file overwrites, schema migrations, destructive commands)',
-            'Save immediately when a blocker is encountered that requires human input',
-            'Save when token context is getting large — a compact save enables a fresh continuation',
-            'If writing manually (auto_summarize: false): nextAction MUST be a concrete, file-specific instruction the NEXT AI can execute WITHOUT reading any files first — e.g. "Edit src/server.ts line 302 — add zod .max(2000) on summary field"',
-            'If writing manually: include only the specific file paths you actually modified, not a general codebase list',
-            'If writing manually: include enough inline context that the restoring AI does not need to re-read those files',
-            'Include blockers: anything requiring human action before work can continue',
-            'Verify the save succeeded — check auto_summarized: true in the response if you used auto_summarize',
-        ],
-        patterns: [
-            'Checkpoint pattern: save after each completed unit of work, not only at the end',
-            'Progressive detail: early saves capture intent; later saves add findings and decisions',
-            'Minimal viable context: save enough to resume, not a full transcript of every action',
-            'Blocker-first save: when stuck, save immediately with the blocker clearly stated',
-        ],
-        gotchas: [
-            'Not saving before a context switch — the next session starts blind without a save',
-            'Saving too much detail — a 5,000-token session save is expensive to restore and read',
-            'Forgetting to include nextAction — the restoring agent does not know where to start',
-            'Saving only at the very end — if the task fails partway through, the intermediate work is lost',
-            'Using vague phase descriptions ("working") instead of concrete phases (implementing step 3 of 7)',
-        ],
-        resources: [
-            'Use the veto_session_save MCP tool: { sessionId, task, phase, progress, decisions, findings }',
-            'Use the veto_sessions_list MCP tool to verify saves and list available sessions',
-            'Use the veto_session_restore MCP tool to reload a previous session',
-            'MCP Session spec: https://modelcontextprotocol.io/docs/concepts/resources',
-        ],
-    };
-}
-//# sourceMappingURL=skill-session-save.js.map

package/dist/skills/memory/skill-session-save.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"skill-session-save.js","sourceRoot":"","sources":["../../../src/skills/memory/skill-session-save.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAiB1D,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiChB,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,UAAU,GAAG,CAAC,KAAiB;IACnC,OAAO;QACL,KAAK,EAAE,cAAc;QACrB,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE;YACT,gMAAgM;YAChM,qFAAqF;YACrF,yFAAyF;YACzF,4FAA4F;YAC5F,0EAA0E;YAC1E,wFAAwF;YACxF,0OAA0O;YAC1O,8GAA8G;YAC9G,+GAA+G;YAC/G,4EAA4E;YAC5E,oGAAoG;SACrG;QACD,QAAQ,EAAE;YACR,iFAAiF;YACjF,wFAAwF;YACxF,sFAAsF;YACtF,kFAAkF;SACnF;QACD,OAAO,EAAE;YACP,mFAAmF;YACnF,sFAAsF;YACtF,qFAAqF;YACrF,gGAAgG;YAChG,kGAAkG;SACnG;QACD,SAAS,EAAE;YACT,+FAA+F;YAC/F,iFAAiF;YACjF,oEAAoE;YACpE,2EAA2E;SAC5E;KACF,CAAC;AACJ,CAAC"}

package/dist/skills/quality/skill-accessibility.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=skill-accessibility.d.ts.map

package/dist/skills/quality/skill-accessibility.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"skill-accessibility.d.ts","sourceRoot":"","sources":["../../../src/skills/quality/skill-accessibility.ts"],"names":[],"mappings":""}

package/dist/skills/quality/skill-accessibility.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=skill-accessibility.js.map

package/dist/skills/quality/skill-accessibility.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"skill-accessibility.js","sourceRoot":"","sources":["../../../src/skills/quality/skill-accessibility.ts"],"names":[],"mappings":""}

package/dist/skills/quality/skill-code-review.d.ts

@@ -1,15 +0,0 @@
-export interface SkillInput {
-    task: string;
-    context?: string;
-    options?: Record<string, unknown>;
-}
-export interface SkillOutput {
-    skill: string;
-    template?: string;
-    checklist: string[];
-    patterns: string[];
-    gotchas: string[];
-    resources: string[];
-}
-export declare function run(input: SkillInput): SkillOutput;
-//# sourceMappingURL=skill-code-review.d.ts.map

package/dist/skills/quality/skill-code-review.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"skill-code-review.d.ts","sourceRoot":"","sources":["../../../src/skills/quality/skill-code-review.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,wBAAgB,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,WAAW,CAkElD"}

package/dist/skills/quality/skill-code-review.js

@@ -1,60 +0,0 @@
-// Skill: code-review — 20-point code review checklist
-export function run(input) {
-    return {
-        skill: 'code-review',
-        template: undefined,
-        checklist: [
-            // Correctness (1-4)
-            '1. CORRECTNESS — Does the code do what the PR description says? Walk through the logic manually with a concrete example.',
-            '2. EDGE CASES — Does it handle null/undefined, empty collections, zero, negative numbers, very large inputs, and concurrent calls correctly?',
-            '3. ERROR HANDLING — Are all errors caught, typed, and handled? No silent swallowed errors, no bare catch blocks that discard the error.',
-            '4. CONCURRENCY — Does shared mutable state have proper synchronisation? Are async operations correctly awaited? No floating promises.',
-            // Security (5-7)
-            '5. INPUT VALIDATION — Is all user-supplied input validated with a schema library (zod/joi) before use? No raw string concatenation into queries.',
-            '6. AUTHENTICATION & AUTHORISATION — Does every data-access path check that the requesting user owns the resource? Is auth middleware applied?',
-            '7. SECRETS — No hardcoded credentials, API keys, or tokens in the diff. No sensitive values logged or included in error responses.',
-            // Performance (8-9)
-            '8. N+1 QUERIES — Are list endpoints fetching related records in a loop? Use batch/include/join instead.',
-            '9. COMPLEXITY — Are there any O(n²) or worse algorithms on large datasets? Is database access inside a loop?',
-            // Types and naming (10-12)
-            '10. TYPES — Is TypeScript used strictly (no `any`, no type assertions without comment)? Are interfaces and return types explicit on public functions?',
-            '11. NAMING — Are variables, functions, and classes named clearly and consistently? Do boolean variables use is/has/should prefixes?',
-            '12. MAGIC VALUES — Are all magic numbers and magic strings replaced with named constants or enums?',
-            // Style and complexity (13-14)
-            '13. COMPLEXITY — Are functions short (< 30 lines) and single-purpose? If a function requires a long comment to explain it, refactor instead.',
-            '14. DUPLICATION — Is the same logic copy-pasted from elsewhere? Extract a shared utility or extend an existing one.',
-            // Tests (15-16)
-            '15. TEST COVERAGE — Are there tests for the new code? Do they cover the happy path, error paths, and at least one edge case?',
-            '16. TEST QUALITY — Do the tests assert on the right things? Are mocks minimal and purposeful? Tests should not duplicate implementation logic.',
-            // Documentation (17)
-            '17. DOCUMENTATION — Do complex functions have a JSDoc comment explaining the why (not just the what)? Are public API changes reflected in the OpenAPI spec?',
-            // Dependencies and build (18)
-            '18. DEPENDENCIES — Are new npm packages justified? Check for license compatibility, maintenance status, and security advisories (npm audit).',
-            // Observability (19)
-            '19. OBSERVABILITY — Are significant operations logged at the appropriate level? Are errors logged with enough context to diagnose? No passwords in logs.',
-            // Review hygiene (20)
-            '20. BREAKING CHANGES — Does the change break any existing API contracts, DB schemas, or public interfaces? If so, is it properly versioned or migrated?',
-        ],
-        patterns: [
-            'Review the diff, not the file — focus on what changed and why',
-            'Ask questions instead of issuing commands: "Could this be null here?" vs "Fix this"',
-            'Distinguish blocking issues (must fix) from suggestions (nice to have) in comments',
-            'Approve with comments for minor non-blocking issues rather than blocking for style',
-            'Check the tests before the implementation — tests reveal the intended behaviour',
-        ],
-        gotchas: [
-            'Approving without running or reading the tests — tests are part of the code',
-            'Nitpicking style when an auto-formatter (Prettier/ESLint) should enforce it',
-            'Missing the forest for the trees: reviewing individual lines but missing a design flaw',
-            'Not reviewing DB migrations for data safety (missing IF NOT EXISTS, backfill plan)',
-            'Forgetting to check error message text — "null pointer exception" leaking to the user',
-        ],
-        resources: [
-            'https://google.github.io/eng-practices/review/reviewer/',
-            'https://mtlynch.io/code-review-love/',
-            'https://www.conventionalcommits.org/ (PR title / commit message style)',
-            'https://cheatsheetseries.owasp.org/cheatsheets/Code_Review_Guide_Introduction_Cheat_Sheet.html',
-        ],
-    };
-}
-//# sourceMappingURL=skill-code-review.js.map

package/dist/skills/quality/skill-code-review.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"skill-code-review.js","sourceRoot":"","sources":["../../../src/skills/quality/skill-code-review.ts"],"names":[],"mappings":"AAAA,sDAAsD;AAiBtD,MAAM,UAAU,GAAG,CAAC,KAAiB;IACnC,OAAO;QACL,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,SAAS;QACnB,SAAS,EAAE;YACT,oBAAoB;YACpB,0HAA0H;YAC1H,8IAA8I;YAC9I,yIAAyI;YACzI,uIAAuI;YAEvI,iBAAiB;YACjB,kJAAkJ;YAClJ,+IAA+I;YAC/I,oIAAoI;YAEpI,oBAAoB;YACpB,yGAAyG;YACzG,8GAA8G;YAE9G,2BAA2B;YAC3B,uJAAuJ;YACvJ,qIAAqI;YACrI,oGAAoG;YAEpG,+BAA+B;YAC/B,8IAA8I;YAC9I,qHAAqH;YAErH,gBAAgB;YAChB,8HAA8H;YAC9H,gJAAgJ;YAEhJ,qBAAqB;YACrB,6JAA6J;YAE7J,8BAA8B;YAC9B,8IAA8I;YAE9I,qBAAqB;YACrB,0JAA0J;YAE1J,sBAAsB;YACtB,yJAAyJ;SAC1J;QACD,QAAQ,EAAE;YACR,+DAA+D;YAC/D,qFAAqF;YACrF,oFAAoF;YACpF,oFAAoF;YACpF,iFAAiF;SAClF;QACD,OAAO,EAAE;YACP,6EAA6E;YAC7E,6EAA6E;YAC7E,wFAAwF;YACxF,oFAAoF;YACpF,uFAAuF;SACxF;QACD,SAAS,EAAE;YACT,yDAAyD;YACzD,sCAAsC;YACtC,wEAAwE;YACxE,gGAAgG;SACjG;KACF,CAAC;AACJ,CAAC"}

package/dist/skills/quality/skill-docs-gen.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=skill-docs-gen.d.ts.map

package/dist/skills/quality/skill-docs-gen.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"skill-docs-gen.d.ts","sourceRoot":"","sources":["../../../src/skills/quality/skill-docs-gen.ts"],"names":[],"mappings":""}

package/dist/skills/quality/skill-docs-gen.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=skill-docs-gen.js.map

package/dist/skills/quality/skill-docs-gen.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"skill-docs-gen.js","sourceRoot":"","sources":["../../../src/skills/quality/skill-docs-gen.ts"],"names":[],"mappings":""}

package/dist/skills/quality/skill-perf-audit.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=skill-perf-audit.d.ts.map

package/dist/skills/quality/skill-perf-audit.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"skill-perf-audit.d.ts","sourceRoot":"","sources":["../../../src/skills/quality/skill-perf-audit.ts"],"names":[],"mappings":""}

package/dist/skills/quality/skill-perf-audit.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=skill-perf-audit.js.map

package/dist/skills/quality/skill-perf-audit.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"skill-perf-audit.js","sourceRoot":"","sources":["../../../src/skills/quality/skill-perf-audit.ts"],"names":[],"mappings":""}

package/dist/skills/quality/skill-security-scan.d.ts

@@ -1,15 +0,0 @@
-export interface SkillInput {
-    task: string;
-    context?: string;
-    options?: Record<string, unknown>;
-}
-export interface SkillOutput {
-    skill: string;
-    template?: string;
-    checklist: string[];
-    patterns: string[];
-    gotchas: string[];
-    resources: string[];
-}
-export declare function run(input: SkillInput): SkillOutput;
-//# sourceMappingURL=skill-security-scan.d.ts.map

package/dist/skills/quality/skill-security-scan.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"skill-security-scan.d.ts","sourceRoot":"","sources":["../../../src/skills/quality/skill-security-scan.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,wBAAgB,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,WAAW,CAyElD"}

package/dist/skills/quality/skill-security-scan.js

@@ -1,67 +0,0 @@
-// Skill: security-scan — OWASP Top 10 scan process with tool commands
-export function run(input) {
-    return {
-        skill: 'security-scan',
-        template: undefined,
-        checklist: [
-            // Dependency scanning
-            '1. Run npm audit: npx npm audit --audit-level=high (fail CI if high/critical found)',
-            '2. Run Snyk for deeper CVE analysis: npx snyk test --severity-threshold=high',
-            '3. Check for outdated packages: npx npm-check-updates (review before upgrading)',
-            '4. Verify lockfile integrity: npm ci (uses lockfile exactly; fails if lockfile is dirty)',
-            // Secrets scanning
-            '5. Scan for hardcoded secrets: npx gitleaks detect --source . --verbose',
-            '6. Run trufflehog on git history: trufflehog git file://. --since-commit HEAD~20',
-            '7. Verify .gitignore covers .env, *.key, *.pem, secrets.json, credentials.json',
-            // Static analysis
-            '8. Run ESLint security plugin: eslint --plugin security --rule "security/detect-eval-with-expression: error"',
-            '9. Run Semgrep OWASP ruleset: semgrep --config=p/owasp-top-ten --error .',
-            '10. Run CodeQL (GitHub Actions): use codeql-action/analyze with javascript/typescript queries',
-            // A01 – Broken Access Control
-            '11. A01 – Review every route handler: confirm auth middleware precedes data access',
-            '12. A01 – Search for direct object references: grep -r "req.params.id" src/ — verify ownership check in each',
-            // A02 – Cryptographic Failures
-            '13. A02 – Search for weak hashes: grep -r "md5\\|sha1\\|DES\\|RC4" src/ (flag any match)',
-            '14. A02 – Verify HTTPS enforcement: check for HSTS header and HTTP→HTTPS redirect in server config',
-            // A03 – Injection
-            '15. A03 – Search for SQL concatenation: grep -r "SELECT.*+" src/ — all DB calls should use parameterised queries',
-            '16. A03 – Search for eval: grep -rn "eval(" src/ — no eval() in production code',
-            // A05 – Misconfiguration
-            '17. A05 – Run security headers check: curl -I https://your-domain.com | grep -E "Content-Security|X-Frame|Strict-Transport|X-Content"',
-            '18. A05 – Verify no debug routes in production: grep -r "/debug\\|/__admin" src/routes/',
-            // A07 – Auth failures
-            '19. A07 – Confirm rate limiting on auth endpoints: grep -r "rateLimit" src/routes/auth',
-            '20. A07 – Verify account lockout logic exists: grep -r "lockedUntil\\|failedAttempts" src/services/auth',
-            // DAST
-            '21. Run OWASP ZAP baseline scan: docker run -t owasp/zap2docker-stable zap-baseline.py -t https://staging.example.com',
-            '22. Check Content-Security-Policy with observatory: npx observatory-cli your-domain.com --format report',
-            // Final gate
-            '23. Review all HIGH/CRITICAL findings; create tickets for each; do not ship with open criticals',
-            '24. Add security scan steps to CI pipeline so every PR is checked automatically',
-        ],
-        patterns: [
-            'Shift-left security: scan in CI on every PR, not only before release',
-            'Defence in depth: layered scanning (dependency + static + dynamic)',
-            'Fail-fast: non-zero CI exit code on any high/critical finding',
-            'Security-as-code: Semgrep rules and ZAP configs version-controlled alongside application',
-        ],
-        gotchas: [
-            'npm audit reports transitive dependency vulnerabilities — check if exploitable in your code path before panicking',
-            'Semgrep false positives on test files — add --exclude "tests/" to production scans',
-            'ZAP baseline scan covers only unauthenticated paths — run a full scan with an auth script for coverage',
-            'Gitleaks detects secrets committed at any point in history, not just HEAD — clean git history with git-filter-repo if needed',
-            'Snyk requires authentication for full CVE database access — set SNYK_TOKEN in CI secrets',
-        ],
-        resources: [
-            'https://owasp.org/www-project-top-ten/',
-            'https://owasp.org/www-project-zap/',
-            'https://semgrep.dev/p/owasp-top-ten',
-            'https://github.com/gitleaks/gitleaks',
-            'https://snyk.io/docs/snyk-cli/',
-            'https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html',
-            'https://docs.npmjs.com/cli/v10/commands/npm-audit',
-            'https://observatory.mozilla.org/',
-        ],
-    };
-}
-//# sourceMappingURL=skill-security-scan.js.map

package/dist/skills/quality/skill-security-scan.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"skill-security-scan.js","sourceRoot":"","sources":["../../../src/skills/quality/skill-security-scan.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAiBtE,MAAM,UAAU,GAAG,CAAC,KAAiB;IACnC,OAAO;QACL,KAAK,EAAE,eAAe;QACtB,QAAQ,EAAE,SAAS;QACnB,SAAS,EAAE;YACT,sBAAsB;YACtB,qFAAqF;YACrF,8EAA8E;YAC9E,iFAAiF;YACjF,0FAA0F;YAE1F,mBAAmB;YACnB,yEAAyE;YACzE,kFAAkF;YAClF,gFAAgF;YAEhF,kBAAkB;YAClB,8GAA8G;YAC9G,0EAA0E;YAC1E,+FAA+F;YAE/F,8BAA8B;YAC9B,oFAAoF;YACpF,8GAA8G;YAE9G,+BAA+B;YAC/B,0FAA0F;YAC1F,oGAAoG;YAEpG,kBAAkB;YAClB,kHAAkH;YAClH,iFAAiF;YAEjF,yBAAyB;YACzB,uIAAuI;YACvI,yFAAyF;YAEzF,sBAAsB;YACtB,wFAAwF;YACxF,yGAAyG;YAEzG,OAAO;YACP,uHAAuH;YACvH,yGAAyG;YAEzG,aAAa;YACb,iGAAiG;YACjG,iFAAiF;SAClF;QACD,QAAQ,EAAE;YACR,sEAAsE;YACtE,oEAAoE;YACpE,+DAA+D;YAC/D,0FAA0F;SAC3F;QACD,OAAO,EAAE;YACP,mHAAmH;YACnH,oFAAoF;YACpF,wGAAwG;YACxG,8HAA8H;YAC9H,0FAA0F;SAC3F;QACD,SAAS,EAAE;YACT,wCAAwC;YACxC,oCAAoC;YACpC,qCAAqC;YACrC,sCAAsC;YACtC,gCAAgC;YAChC,iFAAiF;YACjF,mDAAmD;YACnD,kCAAkC;SACnC;KACF,CAAC;AACJ,CAAC"}

package/dist/skills/quality/skill-test-suite.d.ts

@@ -1,15 +0,0 @@
-export interface SkillInput {
-    task: string;
-    context?: string;
-    options?: Record<string, unknown>;
-}
-export interface SkillOutput {
-    skill: string;
-    template?: string;
-    checklist: string[];
-    patterns: string[];
-    gotchas: string[];
-    resources: string[];
-}
-export declare function run(input: SkillInput): SkillOutput;
-//# sourceMappingURL=skill-test-suite.d.ts.map

package/dist/skills/quality/skill-test-suite.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"skill-test-suite.d.ts","sourceRoot":"","sources":["../../../src/skills/quality/skill-test-suite.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAgOD,wBAAgB,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,WAAW,CAkDlD"}