@nanmicoder/dsh-skills-hub 0.0.2 → 0.0.4

package/lib/types/client/components/FilterBar.d.ts

@@ -8,6 +8,10 @@ import type { MarketFilters } from '../state.ts';
  * platform keyboard behaviour, a real label association, and renders inside a
  * 720px panel without a portal.
  *
+ * The search field is a draft: typing only edits local state, and the query is
+ * submitted on Enter (or when the field is emptied/cleared). Enter during IME
+ * composition confirms the candidate and must not submit.
+ *
  * The result count is announced through a visually hidden live region instead
  * of being printed twice: the visible count lives in the home header, and a
  * screen reader still hears it change when a filter narrows the list.

package/lib/types/client/components/InstallConfirmDialog.d.ts

@@ -1,12 +1,18 @@
-import type { MarketSource, SecurityStatus } from '../../market/types.ts';
+import type { MarketSource, NormalizedSkillDetail, SecurityStatus } from '../../market/types.ts';
 /** The subset of a skill the confirmation needs; the caller owns the source object. */
 export interface InstallConfirmSkill {
     id: string;
     name: string;
     source: MarketSource;
     version?: string;
+    iconUrl?: string;
     securityStatus: SecurityStatus;
     authorName: string;
+    /**
+     * The loaded detail, when the dialog was opened from the detail page: only
+     * then are the skill's files known, and with them what it will be able to do.
+     */
+    detail?: NormalizedSkillDetail;
     /**
      * When the catalogue data behind this dialog was read from upstream, if it
      * came from a snapshot. Installing is a trust decision, so the confirmation
@@ -15,17 +21,14 @@ export interface InstallConfirmSkill {
     snapshotAt?: number;
 }
 /**
- * Install confirmation.
- *
- * Mounted only while a confirmation is pending — the frozen props carry no
- * `skill | null` and no `open`, so the caller's conditional render *is* the
- * open state (the optional `open` prop exists only for a caller that prefers
- * to keep the element mounted).
+ * Install confirmation (design: install dialog of the detail page).
  *
- * Escape and mask-click closing come from `Modal` itself; while `busy` both
- * are neutralised and the buttons are disabled, because an install already in
- * flight cannot be recalled and a dialog that vanishes mid-request reads as a
- * cancel that never happened.
+ * Mounted only while a confirmation is pending. A skill that is not scanned
+ * clean (flagged or unknown) needs an explicit acknowledgement before the
+ * confirm button arms: installing is a trust decision about a third party, and
+ * the dialog says so instead of making it a reflex click. Escape and mask-click
+ * come from `Modal`; while `busy` both are neutralised, because an install in
+ * flight cannot be recalled.
  */
 export declare function InstallConfirmDialog(props: {
     skill: InstallConfirmSkill;

package/lib/types/client/components/InstalledSkillDetail.d.ts

@@ -20,5 +20,5 @@ export declare function InstalledSkillDetail(props: {
     onBack: () => void;
     onUninstall: (item: InstalledSkillRecord) => void;
     /** Open the same skill's market page; only offered for market provenance. */
-    onOpenMarket: (id: string) => void;
+    onOpenMarket: (id: string, owner?: string) => void;
 }): JSX.Element;

package/lib/types/client/components/InstalledSkills.d.ts

@@ -16,5 +16,5 @@ export declare function InstalledSkills(props: {
     /** A removal changed the local inventory; the market half refreshes too. */
     onChanged: () => void;
     /** Open the market page of a skill that came from a market. */
-    onOpenMarket: (id: string) => void;
+    onOpenMarket: (id: string, owner?: string) => void;
 }): JSX.Element;

package/lib/types/client/components/MarketSkillDetail.d.ts

@@ -0,0 +1,34 @@
+import type { NormalizedSkillDetail } from '../../market/types.ts';
+import type { MarketController, MarketState } from '../state.ts';
+import { type Translate } from '../locale-context.tsx';
+import { type Capability } from '../skill-insights.ts';
+/** Compact counts: 482069 → 482.1k. */
+export declare function formatCount(value: number): string;
+/** Upstream timestamps are epoch millis; render as an ISO date (stable across locales). */
+export declare function formatDate(timestamp: number | undefined): string;
+/** Only absolute http(s) links from upstream may become an `href`. */
+export declare function safeUrl(url: string | undefined): string | undefined;
+/** One capability, phrased with its evidence. */
+export declare function capabilityText(t: Translate, capability: Capability): {
+    title: string;
+    detail: string;
+};
+/** Capabilities and triggers, derived once per detail. */
+export declare function useSkillInsights(detail: NormalizedSkillDetail): {
+    capabilities: Capability[];
+    triggers: string[];
+};
+/**
+ * Market skill detail page.
+ *
+ * Owns no data: tab, selected file and file contents live in `MarketState`.
+ * Upstream facts (stats, version, scans, files) come from the live detail; the
+ * catalogue adds category and the Chinese summary. "What this skill does" and
+ * "when it triggers" are read off its own SKILL.md and file list by explicit
+ * rules (`skill-insights.ts`) and are hidden when no rule fires.
+ */
+export declare function MarketSkillDetail(props: {
+    detail: NormalizedSkillDetail;
+    state: MarketState;
+    controller: MarketController;
+}): JSX.Element;

package/lib/types/client/components/SkillDetailShell.d.ts

@@ -1,63 +1,86 @@
 /**
- * The detail surface shared by the market catalogue and the installed inventory.
+ * The detail surface shared by the market catalogue and the installed inventory
+ * (design: "技能市场重构 – 详情页").
  *
  * Both pages answer the same question — "what is inside this skill?" — and the
  * only real difference is where the facts come from: an upstream provider or the
- * filesystem. Everything that is *reading* rather than *fetching* therefore
- * lives here: the back affordance, the identity header, the two tabs, the
- * document column, the facts rail and the focus move that keeps a keyboard user
- * from being left at the top of the document when the list is replaced.
- *
- * The two pages are not identical, so the shell takes slots rather than a data
- * model: `badges`, `notice`, `overview`, `files` and `rail` are composed by the
- * caller, while each caller owns its own loading state and its own choice of tab
- * storage (the market page keeps it in `MarketState`, the local page in its own
- * component state).
+ * filesystem. The shell therefore owns everything that is *layout*: breadcrumb,
+ * identity header, stats strip, underlined tabs, the grey canvas, and the
+ * document/side-rail columns. Callers compose the header pieces and the active
+ * tab's content, and keep their own tab state (the market page in
+ * `MarketState`, the local page in component state).
  */
 import { type ReactNode } from 'react';
-/** Tab values every detail page offers, in render order. */
-export type SkillDetailTab = 'overview' | 'files';
-/**
- * The shell's stylesheet, re-exported for its callers.
- *
- * The pages built on this shell also render shell-shaped fragments (a report
- * row, a path line, a facts list) and reaching them through an import is more
- * honest than re-declaring near-copies of the same rules in a second module.
- */
+import type { SecurityStatus } from '../../market/types.ts';
+/** The shell's stylesheet, for callers composing shell-shaped fragments. */
 export declare const detailStyles: Record<string, string>;
-/** One label/value row of the facts rail. */
-export declare function Fact(props: {
+export interface DetailTab<K extends string> {
+    key: K;
     label: string;
-    children: ReactNode;
-}): JSX.Element;
-export declare function SkillDetailShell(props: {
-    /** Identity of the rendered subject; changing it moves focus back to the heading. */
+    /** Small trailing marker: a count, or a warning dot. */
+    badge?: ReactNode;
+}
+export declare function SkillDetailShell<K extends string>(props: {
+    /** Identity of the rendered subject; changing it moves focus to the heading. */
     focusKey: string;
     onBack: () => void;
+    /** Breadcrumb root: the list this page was opened from. */
     backLabel: string;
     avatar: ReactNode;
-    /** Small line above the name: source, version, provenance. */
-    eyebrow: ReactNode;
     name: string;
-    badges?: ReactNode;
+    version?: string;
+    /** One line of "by author · source · licence · updated" facts. */
+    meta?: ReactNode;
     summary?: string;
-    /** Full-width band under the header (warnings, security reports). */
+    chips?: ReactNode;
+    actions?: ReactNode;
+    stats?: Array<{
+        label: string;
+        value: string;
+    }>;
+    tabs: Array<DetailTab<K>>;
+    activeTab: K;
+    onTabChange: (tab: K) => void;
+    /** Notes above the tab content (snapshot age, location, warnings). */
     notice?: ReactNode;
-    overviewLabel: string;
-    filesLabel: string;
-    activeTab: SkillDetailTab;
-    onTabChange: (tab: SkillDetailTab) => void;
-    overview: ReactNode;
-    files: ReactNode;
-    rail: ReactNode;
+    children: ReactNode;
+}): JSX.Element;
+/** Document column plus side rail; the rail moves below on a narrow panel. */
+export declare function DetailColumns(props: {
+    main: ReactNode;
+    side: ReactNode;
+}): JSX.Element;
+export declare function SideCard(props: {
+    title: string;
+    extra?: ReactNode;
+    children: ReactNode;
+}): JSX.Element;
+export declare function InfoRow(props: {
+    label: string;
+    value: ReactNode;
+    mono?: boolean;
+}): JSX.Element;
+/** Count in a tab label ("文件 15"). */
+export declare function TabCount(props: {
+    value: number;
+}): JSX.Element;
+type ChipTone = 'plain' | 'ok' | 'warn' | 'blue';
+export declare function Chip(props: {
+    tone?: ChipTone;
+    title?: string;
+    children: ReactNode;
+}): JSX.Element;
+/** Upstream scan verdict, shared by the cards, the detail header and the install dialog. */
+export declare function SecurityChip(props: {
+    status: SecurityStatus;
+    short?: boolean;
 }): JSX.Element;
 /**
- * Keeps the detail layout stable while its request is in flight.
- *
- * It renders the same boxes as the real page rather than a spinner, because the
- * click that opens a detail is the moment the panel changes shape; a centered
- * "loading" line would make that change happen twice.
+ * Keeps the detail layout stable while its request is in flight: the same
+ * boxes as the real page rather than a spinner, so the page changes shape once.
  */
-export declare function SkillDetailSkeleton({ onBack }: {
+export declare function SkillDetailSkeleton({ onBack, backLabel }: {
     onBack: () => void;
+    backLabel?: string;
 }): JSX.Element;
+export {};

package/lib/types/client/locales.d.ts

@@ -74,6 +74,70 @@ declare const zhDictionary: {
     'installed.all': string;
     'installed.installed': string;
     'installed.installable': string;
+    'category.lang': string;
+    'category.label': string;
+    'category.all': string;
+    categoryTag: string;
+    breadcrumb: string;
+    updatedOn: string;
+    needsApiKey: string;
+    sourcePage: string;
+    securityReport: string;
+    changelog: string;
+    whenToUse: string;
+    info: string;
+    latestUpdate: string;
+    fullChangelog: string;
+    olderVersions: string;
+    openChangelogFile: string;
+    noChangelog: string;
+    scanReports: string;
+    noReports: string;
+    scanDisclaimer: string;
+    readingTime: string;
+    expand: string;
+    collapse: string;
+    capTitle: string;
+    viewFullReport: string;
+    capNote: string;
+    'cap.shell': string;
+    'cap.shell.detail': string;
+    'cap.hooks': string;
+    'cap.hooks.detail': string;
+    'cap.secrets': string;
+    'cap.secrets.detail': string;
+    'cap.network': string;
+    'cap.network.detail': string;
+    'cap.writes': string;
+    'cap.writes.detail': string;
+    'cap.binaries': string;
+    'cap.binaries.detail': string;
+    'scan.verified': string;
+    'scan.benign': string;
+    'scan.unknown': string;
+    'scan.flagged': string;
+    installTitle: string;
+    confirmInstall: string;
+    willGet: string;
+    'level.high': string;
+    'level.medium': string;
+    'level.low': string;
+    installWarnFlagged: string;
+    installWarnUnknown: string;
+    ack: string;
+    installedOn: string;
+    'scanShort.verified': string;
+    'scanShort.benign': string;
+    'scanShort.unknown': string;
+    'scanShort.flagged': string;
+    catalogSummary: string;
+    catalogUpdated: string;
+    liveResults: string;
+    featured: string;
+    'scope.catalogHint': string;
+    'scope.marketHint': string;
+    'scope.searchMarket': string;
+    'scope.backToCatalog': string;
     'filter.source': string;
     'filter.security': string;
     'filter.installed': string;

package/lib/types/client/skill-insights.d.ts

@@ -0,0 +1,30 @@
+/**
+ * What a skill will do, read off its own files — before anyone installs it.
+ *
+ * Everything here is rule-based and explainable: each finding points at the
+ * file, command, variable or host it came from, and nothing is inferred that
+ * the SKILL.md and file list do not show. When no rule fires, the panel is not
+ * rendered at all; an empty "this skill does nothing risky" claim would be a
+ * verdict this module cannot make.
+ */
+import type { MarketFileMeta } from '../market/types.ts';
+export type CapabilityKind = 'shell' | 'hooks' | 'network' | 'secrets' | 'binaries' | 'writes';
+export type CapabilityLevel = 'high' | 'medium' | 'low';
+export interface Capability {
+    kind: CapabilityKind;
+    level: CapabilityLevel;
+    /** The evidence, verbatim: paths, commands, variable names or hosts. */
+    evidence: string[];
+}
+export declare function detectCapabilities(input: {
+    markdown: string;
+    frontmatter?: Record<string, unknown>;
+    files: readonly Pick<MarketFileMeta, 'path'>[];
+}): Capability[];
+/**
+ * The "when to use" list a SKILL.md description usually carries:
+ * `Use when (1) …, (2) …` / `Use when: …; …` / `当……时使用`.
+ */
+export declare function extractTriggers(description: string | undefined): string[];
+/** Rough reading time: ~400 CJK characters or ~220 Latin words per minute. */
+export declare function readingMinutes(markdown: string): number;

package/lib/types/client/state.d.ts

@@ -23,7 +23,7 @@
  * requests on purpose, and `isAbortError` keeps those rejections out of
  * `state.error` / `state.notice`.
  */
-import type { MarketFileContent, MarketSource, NormalizedSkill, NormalizedSkillDetail, SecurityStatus, SourceStatusInfo } from '../market/types.ts';
+import type { MarketCategory, MarketFileContent, MarketSource, NormalizedSkill, NormalizedSkillDetail, SecurityStatus, SourceStatusInfo } from '../market/types.ts';
 /**
  * Notice values that are dictionary *codes* rather than literal text.
  *
@@ -36,9 +36,19 @@ export declare const MARKET_NOTICE_CODES: readonly ["installDone", "uninstallDon
 export type MarketNoticeCode = (typeof MARKET_NOTICE_CODES)[number];
 /** Whether a `state.notice` value is a dictionary code (as opposed to verbatim text). */
 export declare function isMarketNoticeCode(notice: string): notice is MarketNoticeCode;
+/** Tabs of the market detail page. */
+export type MarketDetailTab = 'overview' | 'files' | 'security' | 'changelog';
 /** Active catalogue filters. */
 export interface MarketFilters {
     q: string;
+    /**
+     * `catalog`: the curated list shipped with the plugin (default).
+     * `market`: live search across both registries, entered explicitly from a
+     * catalogue search; clearing the query returns to the catalogue.
+     */
+    scope: 'catalog' | 'market';
+    /** Catalogue category key, or `'all'`. */
+    category: string;
     source: 'all' | MarketSource;
     security: 'all' | SecurityStatus;
     installed: 'all' | 'installed' | 'installable';
@@ -46,8 +56,12 @@ export interface MarketFilters {
 /** Everything the panel renders from. Immutable: each commit publishes a new object. */
 export interface MarketState {
     filters: MarketFilters;
+    /** Category bar entries; empty until loaded. */
+    categories: MarketCategory[];
     items: NormalizedSkill[];
     nextCursor: string | null;
+    /** Matching skills in total, when the list knows it (the curated catalogue does). */
+    total: number | null;
     sources: Record<MarketSource, SourceStatusInfo>;
     /** Each card retains the provenance of its own page when more pages append. */
     itemStatuses: Record<string, SourceStatusInfo>;
@@ -65,7 +79,7 @@ export interface MarketState {
     detailStatus: SourceStatusInfo | null;
     detailLoading: boolean;
     detailError: string | null;
-    activeTab: 'overview' | 'files';
+    activeTab: MarketDetailTab;
     file: MarketFileContent | null;
     fileLoading: boolean;
     installingIds: ReadonlySet<string>;
@@ -83,14 +97,20 @@ export interface MarketController {
     }): Promise<void>;
     loadMore(): Promise<void>;
     setQuery(q: string): void;
+    setCategory(category: MarketFilters['category']): void;
+    setScope(scope: MarketFilters['scope']): void;
+    /** Load the category bar once per controller (repeat calls share it). */
+    loadCategories(): Promise<void>;
     setSource(source: MarketFilters['source']): void;
     setSecurity(security: MarketFilters['security']): void;
     setInstalledFilter(installed: MarketFilters['installed']): void;
+    /** `owner` names the registry author when the id alone is ambiguous (ClawHub). */
     openDetail(id: string, options?: {
         refresh?: boolean;
+        owner?: string;
     }): Promise<void>;
     closeDetail(): void;
-    setTab(tab: 'overview' | 'files'): void;
+    setTab(tab: MarketDetailTab): void;
     selectFile(path: string): Promise<void>;
     requestInstall(id: string): void;
     cancelInstall(): void;

package/lib/types/market/clawhub-provider.d.ts

@@ -7,6 +7,9 @@
  *  - GET /api/v1/skills/{slug}                        → {skill, latestVersion, owner, metadata, moderation}
  *  - GET /api/v1/skills/{slug}/versions/{v}           → {version:{license, files[], security}}
  *  - GET /api/v1/skills/{slug}/file?path=             → raw file text
+ *
+ * Slugs are not unique: every endpoint accepts `?owner=`, and without it a
+ * shared slug answers 409 AMBIGUOUS_SKILL_SLUG. See `clawhubOwnerFor`.
  */
 import { type MarketProvider } from './types.ts';
 export type ParsedFrontmatter = {
@@ -23,6 +26,18 @@ export type ParsedFrontmatter = {
  * value it cannot understand is dropped rather than throwing.
  */
 export declare function parseFrontmatter(markdown: string): ParsedFrontmatter;
+/** Shape of a ClawHub owner handle (also the route's validation rule). */
+export declare const CLAWHUB_OWNER_PATTERN: RegExp;
+export declare function setClawhubOwnerHints(hints: Iterable<readonly [string, string]>): void;
+/**
+ * Run one operation pinned to `owner` for `slug`. Without an owner the
+ * operation runs unpinned and falls back to the hint/cache/probe order.
+ */
+export declare function withClawhubOwner<T>(slug: string, owner: string | undefined, operation: () => Promise<T>): Promise<T>;
+/** The owner a read of `slug` will use right now, if one is known before asking upstream. */
+export declare function clawhubOwnerFor(slug: string): string | undefined;
+/** A release note worth showing: registries stamp placeholders on synced versions. */
+export declare function meaningfulChangelog(text: unknown): string | undefined;
 /** Test hook: forget which owner disambiguated an ambiguous slug. */
 export declare function resetClawhubOwnerCache(): void;
 export declare const clawhubProvider: MarketProvider;

package/lib/types/market/install-service.d.ts

@@ -56,6 +56,7 @@ export declare class MarketInstallError extends Error {
 export declare function installMarketSkill(source: MarketSource, slug: string, options: {
     skillsRoot: string;
     allowUninstall: boolean;
+    owner?: string;
 }): Promise<InstallResult>;
 /**
  * Remove one skill this plugin installed.

package/lib/types/market/market-service.d.ts

@@ -10,7 +10,7 @@
  * `InstalledLookup` (see `setInstalledLookup`), so this file can be unit-tested
  * by pointing the providers at a stub server.
  */
-import { type MarketFileContent, type MarketListResult, type MarketSource, type NormalizedSkill, type NormalizedSkillDetail, type SecurityStatus, type SourceStatusInfo } from './types.ts';
+import { type MarketCategoriesResult, type MarketFileContent, type MarketListResult, type MarketSource, type NormalizedSkill, type NormalizedSkillDetail, type SecurityStatus, type SourceStatusInfo } from './types.ts';
 /**
  * Local install state, injected by the plugin host (which owns the skills
  * directory). Both methods are synchronous: the host keeps an in-memory index
@@ -55,6 +55,13 @@ export declare function applyFileLimits(detail: NormalizedSkillDetail): Normaliz
 export declare function dedupeSkills(items: NormalizedSkill[]): NormalizedSkill[];
 export interface ListMarketSkillsParams {
     q?: string;
+    /**
+     * `catalog` (default): the curated snapshot shipped with the plugin.
+     * `market`: live upstream list/search across both registries.
+     */
+    scope?: 'catalog' | 'market';
+    /** Catalogue category key; ignored by the live market scope. */
+    category?: string;
     source: 'all' | MarketSource;
     security: 'all' | SecurityStatus;
     installed: 'all' | 'installed' | 'installable';
@@ -64,15 +71,30 @@ export interface ListMarketSkillsParams {
     refresh?: boolean;
 }
 export declare function listMarketSkills(params: ListMarketSkillsParams): Promise<MarketListResult>;
+/**
+ * One page of the curated catalogue.
+ *
+ * Everything is local, so every filter — security and installed included — runs
+ * before pagination: a page is always full until the list is exhausted, which
+ * is what keeps infinite scroll from stalling on a filtered-out page.
+ */
+export declare function listCatalogSkills(params: ListMarketSkillsParams): MarketListResult;
+export declare function listMarketCategories(): MarketCategoriesResult;
 export declare function getMarketSkillDetail(source: MarketSource, slug: string, options?: {
     force?: boolean;
     allowStale?: boolean;
+    owner?: string;
 }): Promise<{
     skill: NormalizedSkillDetail;
     sourceStatus: SourceStatusInfo;
 }>;
 export declare function isValidMarketFilePath(filePath: string): boolean;
-export declare function getMarketFileContent(source: MarketSource, slug: string, filePath: string): Promise<MarketFileContent>;
+export declare function getMarketFileContent(source: MarketSource, slug: string, filePath: string, owner?: string): Promise<MarketFileContent>;
+/**
+ * Pin a ClawHub read to the owner the reader asked for. ClawHub slugs are
+ * shared across authors, so `clawhub:<slug>` alone does not name one skill.
+ */
+export declare function withMarketOwner<T>(source: MarketSource, slug: string, owner: string | undefined, operation: () => Promise<T>): Promise<T>;
 export declare function getMarketStatus(): Record<MarketSource, SourceStatusInfo>;
 /**
  * Look up a single skill for an install (the detail path, bypassing the list).
@@ -82,5 +104,5 @@ export declare function getMarketStatus(): Record<MarketSource, SourceStatusInfo
  * right now — the file bytes are fetched fresh and hash-verified against the
  * list, so the list must come from the same generation as those bytes.
  */
-export declare function resolveMarketSkill(source: MarketSource, slug: string): Promise<NormalizedSkillDetail>;
+export declare function resolveMarketSkill(source: MarketSource, slug: string, owner?: string): Promise<NormalizedSkillDetail>;
 export {};

package/lib/types/market/types.d.ts

@@ -16,6 +16,8 @@ export type SecurityReport = {
     status: string;
     statusText: string;
     reportUrl?: string;
+    /** The scanner's own explanation of its verdict, when it gives one */
+    summary?: string;
 };
 export type NormalizedSkill = {
     /** `${source}:${slug}` — globally unique */
@@ -35,7 +37,10 @@ export type NormalizedSkill = {
         stars?: number;
     };
     tags: string[];
+    /** Curated-catalogue category key, e.g. `dev` (absent for live upstream results) */
     category?: string;
+    /** Editor's pick in the curated catalogue */
+    featured?: boolean;
     version?: string;
     updatedAt?: number;
     iconUrl?: string;
@@ -47,6 +52,7 @@ export type NormalizedSkill = {
     upstream?: {
         source: MarketSource;
         slug: string;
+        owner?: string;
     };
     /** After dedupe: ids of merged duplicate entries from other sources */
     mirrors?: string[];
@@ -75,6 +81,14 @@ export type NormalizedSkillDetail = NormalizedSkill & {
     license?: string;
     files: MarketFileMeta[];
     totalSize: number;
+    /** Release note of the latest version, when upstream has a meaningful one */
+    changelog?: {
+        version?: string;
+        text: string;
+        publishedAt?: number;
+    };
+    /** The skill's page on its registry (http(s) only) */
+    pageUrl?: string;
 };
 export type MarketFileContent = {
     path: string;
@@ -89,9 +103,24 @@ export type SourceStatusInfo = {
     fromCache?: boolean;
     error?: string;
 };
+/** One curated-catalogue category. */
+export type MarketCategory = {
+    key: string;
+    name: string;
+    nameEn?: string;
+    sortOrder: number;
+    /** Skills the catalogue holds in this category */
+    count?: number;
+};
+export type MarketCategoriesResult = {
+    items: MarketCategory[];
+    status: SourceStatusInfo;
+};
 export type MarketListResult = {
     items: NormalizedSkill[];
     nextCursor: string | null;
+    /** Matching skills in total, when known (the curated catalogue always knows) */
+    total?: number;
     sources: Record<MarketSource, SourceStatusInfo>;
 };
 export type ProviderListPage = {

package/lib/types/skills/installed.d.ts

@@ -30,6 +30,8 @@ export interface InstalledMetaFile {
     id: string;
     source: MarketSource;
     slug: string;
+    /** Registry author (ClawHub slugs are shared across authors); absent in older sidecars. */
+    owner?: string;
     version?: string;
     installedAt: string;
     files: Array<{
@@ -47,6 +49,8 @@ export interface InstalledSkillRecord {
     id: string;
     source: MarketSource | 'local';
     slug: string;
+    /** Registry author recorded at install time, when known */
+    owner?: string;
     name: string;
     dirName: string;
     /**

package/lib/types/web-routes.d.ts

@@ -1,7 +1,7 @@
 /**
  * Skills Hub HTTP surface.
  *
- * One `prefix` route (`/api/skills-hub`) owns the seven endpoints the panel
+ * One `prefix` route (`/api/skills-hub`) owns the endpoints the panel
  * needs; every response is JSON with `Cache-Control: no-store`, because the
  * panel polls and every payload is either live upstream data or live disk state.
  *
@@ -16,6 +16,7 @@
  *    otherwise be reachable by a cross-site request or a DNS-rebound page.
  */
 import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { HostConnectionService } from '@deepseek-ai/dsh-client-connection';
 /** Path prefix of the whole Skills Hub API. */
 export declare const ROUTE_PREFIX = "/api/skills-hub";
 /** Structural Web server contract (mirrors `WebServer.register`). */
@@ -33,18 +34,8 @@ export interface SkillsHubRoutesDeps {
     /** Initial local inventory scan, required before annotating persisted data. */
     ready?: () => Promise<void>;
 }
-/**
- * Browser-trust gate, structurally equal to the frozen contract's predicate.
- *
- * The real `HostConnectionService.requestRejection` returns `401 | 403 |
- * undefined` rather than a boolean (see
- * `@deepseek-ai/dsh-client-connection/lib/types/rpc.d.ts`), so this plugin
- * accepts both shapes: see {@link evaluateGate} for why the numeric form is
- * worth preserving.
- */
-export interface SkillsHubRequestGate {
-    requestRejection(req: IncomingMessage, res: ServerResponse): boolean;
-}
+/** Use the host's actual trust predicate; this import is erased from the runtime. */
+export type SkillsHubRequestGate = Pick<HostConnectionService, 'requestRejection'>;
 /**
  * Resolves the gate for one request.
  *