@prave/shared 1.4.15 → 1.5.0

package/dist/schemas/hook.schema.d.ts

@@ -0,0 +1,246 @@
+import { z } from 'zod';
+/**
+ * Claude Code Hook registry shape — the parallel-to-Skills primitive.
+ *
+ * V1 is **scraper-only**: rows arrive from the worker's
+ * scan-github-hook job. The web UI does not author hooks; the
+ * "Suggest a hook" modal calls `POST /api/v1/hooks/submit` with a
+ * GitHub URL, which enqueues a scan job. End-users never POST/PUT/
+ * DELETE the hook content itself.
+ */
+export declare const hookEventSchema: z.ZodEnum<["PreToolUse", "PostToolUse", "UserPromptSubmit", "Stop", "SubagentStop", "Notification", "PreCompact", "SessionStart"]>;
+export type HookEvent = z.infer<typeof hookEventSchema>;
+export declare const hookVisibilitySchema: z.ZodEnum<["public", "private"]>;
+export type HookVisibility = z.infer<typeof hookVisibilitySchema>;
+export declare const hookSchema: z.ZodObject<{
+    id: z.ZodString;
+    owner_id: z.ZodNullable<z.ZodString>;
+    name: z.ZodString;
+    slug: z.ZodString;
+    description: z.ZodNullable<z.ZodString>;
+    /** Claude Code lifecycle event the hook listens on. */
+    event: z.ZodEnum<["PreToolUse", "PostToolUse", "UserPromptSubmit", "Stop", "SubagentStop", "Notification", "PreCompact", "SessionStart"]>;
+    /**
+     * Tool-name glob — only relevant on the tool-events
+     * (`Pre/PostToolUse`). `null` means "any tool" and Claude Code
+     * treats it as the universal matcher.
+     */
+    matcher: z.ZodNullable<z.ZodString>;
+    /** Shell command Claude Code spawns when the event fires. */
+    command: z.ZodString;
+    /** Optional per-hook timeout in seconds (1–600). */
+    timeout_seconds: z.ZodNullable<z.ZodNumber>;
+    visibility: z.ZodDefault<z.ZodEnum<["public", "private"]>>;
+    source_repo: z.ZodNullable<z.ZodString>;
+    license: z.ZodDefault<z.ZodString>;
+    tags: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    install_count: z.ZodDefault<z.ZodNumber>;
+    is_verified: z.ZodDefault<z.ZodBoolean>;
+    version: z.ZodDefault<z.ZodNumber>;
+    /** Same enum as Feature 1's security_rating; opt-in for hooks. */
+    security_rating: z.ZodOptional<z.ZodNullable<z.ZodEnum<["trusted", "low_risk", "med_risk", "critical", "pending"]>>>;
+    /** Attached by the API on GET when authenticated. */
+    bookmarked: z.ZodOptional<z.ZodBoolean>;
+    /** Attached by the API on GET when authenticated. */
+    installed: z.ZodOptional<z.ZodBoolean>;
+    /** Attached by the API: public slice of the owner profile. */
+    owner: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        username: z.ZodNullable<z.ZodString>;
+        display_name: z.ZodNullable<z.ZodString>;
+        avatar_url: z.ZodNullable<z.ZodString>;
+        is_creator: z.ZodBoolean;
+        is_partner: z.ZodBoolean;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
+        username: string | null;
+        display_name: string | null;
+        avatar_url: string | null;
+        is_creator: boolean;
+        is_partner: boolean;
+    }, {
+        id: string;
+        username: string | null;
+        display_name: string | null;
+        avatar_url: string | null;
+        is_creator: boolean;
+        is_partner: boolean;
+    }>>>;
+    created_at: z.ZodString;
+    updated_at: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    id: string;
+    created_at: string;
+    updated_at: string;
+    slug: string;
+    name: string;
+    description: string | null;
+    install_count: number;
+    owner_id: string | null;
+    visibility: "public" | "private";
+    source_repo: string | null;
+    license: string;
+    tags: string[];
+    is_verified: boolean;
+    version: number;
+    event: "PreToolUse" | "PostToolUse" | "UserPromptSubmit" | "Stop" | "SubagentStop" | "Notification" | "PreCompact" | "SessionStart";
+    matcher: string | null;
+    command: string;
+    timeout_seconds: number | null;
+    bookmarked?: boolean | undefined;
+    owner?: {
+        id: string;
+        username: string | null;
+        display_name: string | null;
+        avatar_url: string | null;
+        is_creator: boolean;
+        is_partner: boolean;
+    } | null | undefined;
+    security_rating?: "trusted" | "low_risk" | "med_risk" | "critical" | "pending" | null | undefined;
+    installed?: boolean | undefined;
+}, {
+    id: string;
+    created_at: string;
+    updated_at: string;
+    slug: string;
+    name: string;
+    description: string | null;
+    owner_id: string | null;
+    source_repo: string | null;
+    event: "PreToolUse" | "PostToolUse" | "UserPromptSubmit" | "Stop" | "SubagentStop" | "Notification" | "PreCompact" | "SessionStart";
+    matcher: string | null;
+    command: string;
+    timeout_seconds: number | null;
+    install_count?: number | undefined;
+    visibility?: "public" | "private" | undefined;
+    license?: string | undefined;
+    tags?: string[] | undefined;
+    is_verified?: boolean | undefined;
+    bookmarked?: boolean | undefined;
+    owner?: {
+        id: string;
+        username: string | null;
+        display_name: string | null;
+        avatar_url: string | null;
+        is_creator: boolean;
+        is_partner: boolean;
+    } | null | undefined;
+    security_rating?: "trusted" | "low_risk" | "med_risk" | "critical" | "pending" | null | undefined;
+    version?: number | undefined;
+    installed?: boolean | undefined;
+}>;
+export type Hook = z.infer<typeof hookSchema>;
+export declare const hookSortSchema: z.ZodEnum<["trending", "popular", "newest", "relevance"]>;
+export type HookSort = z.infer<typeof hookSortSchema>;
+export declare const hookSearchQuerySchema: z.ZodObject<{
+    q: z.ZodOptional<z.ZodString>;
+    event: z.ZodOptional<z.ZodEnum<["PreToolUse", "PostToolUse", "UserPromptSubmit", "Stop", "SubagentStop", "Notification", "PreCompact", "SessionStart"]>>;
+    tag: z.ZodOptional<z.ZodString>;
+    sort: z.ZodDefault<z.ZodEnum<["trending", "popular", "newest", "relevance"]>>;
+    limit: z.ZodDefault<z.ZodNumber>;
+    offset: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    sort: "trending" | "popular" | "newest" | "relevance";
+    limit: number;
+    offset: number;
+    q?: string | undefined;
+    tag?: string | undefined;
+    event?: "PreToolUse" | "PostToolUse" | "UserPromptSubmit" | "Stop" | "SubagentStop" | "Notification" | "PreCompact" | "SessionStart" | undefined;
+}, {
+    sort?: "trending" | "popular" | "newest" | "relevance" | undefined;
+    q?: string | undefined;
+    tag?: string | undefined;
+    limit?: number | undefined;
+    offset?: number | undefined;
+    event?: "PreToolUse" | "PostToolUse" | "UserPromptSubmit" | "Stop" | "SubagentStop" | "Notification" | "PreCompact" | "SessionStart" | undefined;
+}>;
+export type HookSearchQuery = z.infer<typeof hookSearchQuerySchema>;
+/**
+ * `POST /api/v1/hooks/submit` body — a user proposes a GitHub URL,
+ * the worker scans it. The endpoint dedupes pending scans by repo URL
+ * so spamming the form is harmless.
+ */
+export declare const submitHookByUrlSchema: z.ZodObject<{
+    repo_url: z.ZodEffects<z.ZodString, string, string>;
+}, "strip", z.ZodTypeAny, {
+    repo_url: string;
+}, {
+    repo_url: string;
+}>;
+export type SubmitHookByUrlInput = z.infer<typeof submitHookByUrlSchema>;
+/**
+ * `github-hook-scan` queue payload. Scans one GitHub repo for
+ * `hook.json` files + sibling `claude/hooks/*.json`, validates them
+ * against `hookSchema`, secret-scans the command, upserts.
+ */
+export declare const scanGithubHookJobSchema: z.ZodObject<{
+    repo_url: z.ZodString;
+    source: z.ZodEnum<["manual", "seed", "cron", "submit"]>;
+    submitted_by: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    repo_url: string;
+    source: "seed" | "manual" | "cron" | "submit";
+    submitted_by?: string | undefined;
+}, {
+    repo_url: string;
+    source: "seed" | "manual" | "cron" | "submit";
+    submitted_by?: string | undefined;
+}>;
+export type ScanGithubHookJob = z.infer<typeof scanGithubHookJobSchema>;
+/**
+ * `discover-github-hook` queue payload. Wide-scope GitHub code-search
+ * to find any public repo with a `hook.json` we don't already know.
+ */
+export declare const discoverGithubHookJobSchema: z.ZodObject<{
+    query: z.ZodString;
+    max_repos: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    max_repos: number;
+    query: string;
+}, {
+    query: string;
+    max_repos?: number | undefined;
+}>;
+export type DiscoverGithubHookJob = z.infer<typeof discoverGithubHookJobSchema>;
+/** `index-hook` queue payload. */
+export declare const indexHookJobSchema: z.ZodObject<{
+    hook_id: z.ZodString;
+    op: z.ZodEnum<["upsert", "delete"]>;
+}, "strip", z.ZodTypeAny, {
+    op: "upsert" | "delete";
+    hook_id: string;
+}, {
+    op: "upsert" | "delete";
+    hook_id: string;
+}>;
+export type IndexHookJob = z.infer<typeof indexHookJobSchema>;
+/** `describe-hook` queue payload — Haiku-generated description. */
+export declare const describeHookJobSchema: z.ZodObject<{
+    hook_id: z.ZodString;
+    force: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    hook_id: string;
+    force?: boolean | undefined;
+}, {
+    hook_id: string;
+    force?: boolean | undefined;
+}>;
+export type DescribeHookJob = z.infer<typeof describeHookJobSchema>;
+export declare const hookBulkSyncInputSchema: z.ZodObject<{
+    slugs: z.ZodArray<z.ZodString, "many">;
+}, "strip", z.ZodTypeAny, {
+    slugs: string[];
+}, {
+    slugs: string[];
+}>;
+export type HookBulkSyncInput = z.infer<typeof hookBulkSyncInputSchema>;
+export interface HookBulkSyncItem {
+    slug: string;
+    hook: Hook | null;
+    error: string | null;
+}
+export interface HookBulkSyncResponse {
+    items: HookBulkSyncItem[];
+    missing: string[];
+}
+//# sourceMappingURL=hook.schema.d.ts.map

package/dist/schemas/hook.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook.schema.d.ts","sourceRoot":"","sources":["../../src/schemas/hook.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;;;;;GAQG;AAEH,eAAO,MAAM,eAAe,oIAS1B,CAAA;AACF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;AAEvD,eAAO,MAAM,oBAAoB,kCAAgC,CAAA;AACjE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAEjE,eAAO,MAAM,UAAU;;;;;;IAWrB,uDAAuD;;IAEvD;;;;OAIG;;IAEH,6DAA6D;;IAE7D,oDAAoD;;;;;;;;;IAWpD,kEAAkE;;IAMlE,qDAAqD;;IAErD,qDAAqD;;IAErD,8DAA8D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAe9D,CAAA;AACF,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAA;AAI7C,eAAO,MAAM,cAAc,2DAAyD,CAAA;AACpF,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAA;AAErD,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;EAOhC,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAInE;;;;GAIG;AACH,eAAO,MAAM,qBAAqB;;;;;;EAQhC,CAAA;AACF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAIxE;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;EAIlC,CAAA;AACF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAEvE;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;EAGtC,CAAA;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAE/E,kCAAkC;AAClC,eAAO,MAAM,kBAAkB;;;;;;;;;EAG7B,CAAA;AACF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAE7D,mEAAmE;AACnE,eAAO,MAAM,qBAAqB;;;;;;;;;EAGhC,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAInE,eAAO,MAAM,uBAAuB;;;;;;EAElC,CAAA;AACF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAEvE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,gBAAgB,EAAE,CAAA;IACzB,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB"}

package/dist/schemas/hook.schema.js

@@ -0,0 +1,129 @@
+import { z } from 'zod';
+/**
+ * Claude Code Hook registry shape — the parallel-to-Skills primitive.
+ *
+ * V1 is **scraper-only**: rows arrive from the worker's
+ * scan-github-hook job. The web UI does not author hooks; the
+ * "Suggest a hook" modal calls `POST /api/v1/hooks/submit` with a
+ * GitHub URL, which enqueues a scan job. End-users never POST/PUT/
+ * DELETE the hook content itself.
+ */
+export const hookEventSchema = z.enum([
+    'PreToolUse',
+    'PostToolUse',
+    'UserPromptSubmit',
+    'Stop',
+    'SubagentStop',
+    'Notification',
+    'PreCompact',
+    'SessionStart',
+]);
+export const hookVisibilitySchema = z.enum(['public', 'private']);
+export const hookSchema = z.object({
+    id: z.string().uuid(),
+    owner_id: z.string().uuid().nullable(),
+    name: z.string().min(1).max(120),
+    slug: z
+        .string()
+        .min(1)
+        .max(120)
+        .regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, 'slug must be kebab-case'),
+    description: z.string().max(500).nullable(),
+    /** Claude Code lifecycle event the hook listens on. */
+    event: hookEventSchema,
+    /**
+     * Tool-name glob — only relevant on the tool-events
+     * (`Pre/PostToolUse`). `null` means "any tool" and Claude Code
+     * treats it as the universal matcher.
+     */
+    matcher: z.string().max(120).nullable(),
+    /** Shell command Claude Code spawns when the event fires. */
+    command: z.string().min(1).max(4000),
+    /** Optional per-hook timeout in seconds (1–600). */
+    timeout_seconds: z.number().int().min(1).max(600).nullable(),
+    visibility: hookVisibilitySchema.default('public'),
+    source_repo: z.string().url().nullable(),
+    license: z.string().default('MIT'),
+    tags: z.array(z.string()).default([]),
+    install_count: z.number().int().nonnegative().default(0),
+    is_verified: z.boolean().default(false),
+    version: z.number().int().positive().default(1),
+    /** Same enum as Feature 1's security_rating; opt-in for hooks. */
+    security_rating: z
+        .enum(['trusted', 'low_risk', 'med_risk', 'critical', 'pending'])
+        .nullable()
+        .optional(),
+    /** Attached by the API on GET when authenticated. */
+    bookmarked: z.boolean().optional(),
+    /** Attached by the API on GET when authenticated. */
+    installed: z.boolean().optional(),
+    /** Attached by the API: public slice of the owner profile. */
+    owner: z
+        .object({
+        id: z.string().uuid(),
+        username: z.string().nullable(),
+        display_name: z.string().nullable(),
+        avatar_url: z.string().nullable(),
+        is_creator: z.boolean(),
+        is_partner: z.boolean(),
+    })
+        .nullable()
+        .optional(),
+    created_at: z.string().datetime(),
+    updated_at: z.string().datetime(),
+});
+/* ─── Discovery query ──────────────────────────────────────────── */
+export const hookSortSchema = z.enum(['trending', 'popular', 'newest', 'relevance']);
+export const hookSearchQuerySchema = z.object({
+    q: z.string().trim().max(200).optional(),
+    event: hookEventSchema.optional(),
+    tag: z.string().optional(),
+    sort: hookSortSchema.default('trending'),
+    limit: z.coerce.number().int().min(1).max(100).default(24),
+    offset: z.coerce.number().int().nonnegative().default(0),
+});
+/* ─── Submit-by-URL ────────────────────────────────────────────── */
+/**
+ * `POST /api/v1/hooks/submit` body — a user proposes a GitHub URL,
+ * the worker scans it. The endpoint dedupes pending scans by repo URL
+ * so spamming the form is harmless.
+ */
+export const submitHookByUrlSchema = z.object({
+    repo_url: z
+        .string()
+        .url()
+        .refine((s) => /^https?:\/\/(www\.)?github\.com\//i.test(s), 'Only GitHub repository URLs are supported'),
+});
+/* ─── Worker job payloads ──────────────────────────────────────── */
+/**
+ * `github-hook-scan` queue payload. Scans one GitHub repo for
+ * `hook.json` files + sibling `claude/hooks/*.json`, validates them
+ * against `hookSchema`, secret-scans the command, upserts.
+ */
+export const scanGithubHookJobSchema = z.object({
+    repo_url: z.string().url(),
+    source: z.enum(['manual', 'seed', 'cron', 'submit']),
+    submitted_by: z.string().uuid().optional(),
+});
+/**
+ * `discover-github-hook` queue payload. Wide-scope GitHub code-search
+ * to find any public repo with a `hook.json` we don't already know.
+ */
+export const discoverGithubHookJobSchema = z.object({
+    query: z.string(),
+    max_repos: z.number().int().min(1).max(1000).default(300),
+});
+/** `index-hook` queue payload. */
+export const indexHookJobSchema = z.object({
+    hook_id: z.string().uuid(),
+    op: z.enum(['upsert', 'delete']),
+});
+/** `describe-hook` queue payload — Haiku-generated description. */
+export const describeHookJobSchema = z.object({
+    hook_id: z.string().uuid(),
+    force: z.boolean().optional(),
+});
+/* ─── Bulk sync (mirror of skills bulk sync) ───────────────────── */
+export const hookBulkSyncInputSchema = z.object({
+    slugs: z.array(z.string().min(1).max(120)).min(1).max(250),
+});

package/dist/schemas/index.d.ts

@@ -10,4 +10,6 @@ export * from './install.schema.js';
 export * from './intelligence.schema.js';
 export * from './api-keys.schema.js';
 export * from './skill-report.schema.js';
+export * from './security-audit.schema.js';
+export * from './hook.schema.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/schemas/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/schemas/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,8BAA8B,CAAA;AAC5C,cAAc,yBAAyB,CAAA;AACvC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/schemas/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,8BAA8B,CAAA;AAC5C,cAAc,yBAAyB,CAAA;AACvC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,kBAAkB,CAAA"}

package/dist/schemas/index.js

@@ -10,3 +10,5 @@ export * from './install.schema.js';
 export * from './intelligence.schema.js';
 export * from './api-keys.schema.js';
 export * from './skill-report.schema.js';
+export * from './security-audit.schema.js';
+export * from './hook.schema.js';

package/dist/schemas/install.schema.d.ts

@@ -40,6 +40,7 @@ export declare const installRowSchema: z.ZodObject<{
         license: z.ZodDefault<z.ZodString>;
         category: z.ZodNullable<z.ZodString>;
         tags: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        extracted_triggers: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
         install_count: z.ZodDefault<z.ZodNumber>;
         bookmark_count: z.ZodDefault<z.ZodNumber>;
         is_verified: z.ZodDefault<z.ZodBoolean>;
@@ -123,6 +124,7 @@ export declare const installRowSchema: z.ZodObject<{
             is_creator: boolean;
             is_partner: boolean;
         }>>>;
+        security_rating: z.ZodOptional<z.ZodNullable<z.ZodEnum<["trusted", "low_risk", "med_risk", "critical", "pending"]>>>;
         created_at: z.ZodString;
         updated_at: z.ZodString;
     }, "id" | "updated_at" | "slug" | "name" | "description" | "visibility" | "license">, "strip", z.ZodTypeAny, {

package/dist/schemas/install.schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install.schema.d.ts","sourceRoot":"","sources":["../../src/schemas/install.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,4DAA4D;AAC5D,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;EAMxB,CAAA;AACF,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAA;AAEnD,wDAAwD;AACxD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAU3B,iEAAiE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEjE,CAAA;AACF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAEzD,eAAO,MAAM,wBAAwB;IACnC,0EAA0E;;;;;;EAE1E,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAA"}
+{"version":3,"file":"install.schema.d.ts","sourceRoot":"","sources":["../../src/schemas/install.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,4DAA4D;AAC5D,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;EAMxB,CAAA;AACF,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAA;AAEnD,wDAAwD;AACxD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAU3B,iEAAiE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEjE,CAAA;AACF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAEzD,eAAO,MAAM,wBAAwB;IACnC,0EAA0E;;;;;;EAE1E,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAA"}

package/dist/schemas/search.schema.d.ts

@@ -15,6 +15,7 @@ export declare const skillSearchHitSchema: z.ZodObject<{
     license: z.ZodDefault<z.ZodString>;
     category: z.ZodNullable<z.ZodString>;
     tags: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    extracted_triggers: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
     install_count: z.ZodDefault<z.ZodNumber>;
     bookmark_count: z.ZodDefault<z.ZodNumber>;
     is_verified: z.ZodDefault<z.ZodBoolean>;
@@ -98,6 +99,7 @@ export declare const skillSearchHitSchema: z.ZodObject<{
         is_creator: boolean;
         is_partner: boolean;
     }>>>;
+    security_rating: z.ZodOptional<z.ZodNullable<z.ZodEnum<["trusted", "low_risk", "med_risk", "critical", "pending"]>>>;
     created_at: z.ZodString;
     updated_at: z.ZodString;
 } & {
@@ -118,6 +120,7 @@ export declare const skillSearchHitSchema: z.ZodObject<{
     source_repo: string | null;
     license: string;
     tags: string[];
+    extracted_triggers: string[];
     bookmark_count: number;
     is_verified: boolean;
     price_cents: number;
@@ -154,6 +157,7 @@ export declare const skillSearchHitSchema: z.ZodObject<{
         is_creator: boolean;
         is_partner: boolean;
     } | null | undefined;
+    security_rating?: "trusted" | "low_risk" | "med_risk" | "critical" | "pending" | null | undefined;
     score?: number | undefined;
     highlight?: Record<string, string[]> | undefined;
 }, {
@@ -171,6 +175,7 @@ export declare const skillSearchHitSchema: z.ZodObject<{
     visibility?: "public" | "private" | undefined;
     license?: string | undefined;
     tags?: string[] | undefined;
+    extracted_triggers?: string[] | undefined;
     bookmark_count?: number | undefined;
     is_verified?: boolean | undefined;
     price_cents?: number | undefined;
@@ -207,6 +212,7 @@ export declare const skillSearchHitSchema: z.ZodObject<{
         is_creator: boolean;
         is_partner: boolean;
     } | null | undefined;
+    security_rating?: "trusted" | "low_risk" | "med_risk" | "critical" | "pending" | null | undefined;
     score?: number | undefined;
     highlight?: Record<string, string[]> | undefined;
 }>;

package/dist/schemas/search.schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"search.schema.d.ts","sourceRoot":"","sources":["../../src/schemas/search.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB;;;GAGG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAG/B,CAAA;AACF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAEjE,gDAAgD;AAChD,eAAO,MAAM,mBAAmB;;;;;;;;;EAG9B,CAAA;AACF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAE/D,gDAAgD;AAChD,eAAO,MAAM,mBAAmB;;;;;;;;;EAG9B,CAAA;AACF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAE/D;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB;;IAEjC,iFAAiF;;;;;;;;EAEjF,CAAA;AACF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB;IAClC,kFAAkF;;IAElF,0EAA0E;;;;;;;;EAE1E,CAAA;AACF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA"}
+{"version":3,"file":"search.schema.d.ts","sourceRoot":"","sources":["../../src/schemas/search.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB;;;GAGG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAG/B,CAAA;AACF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAEjE,gDAAgD;AAChD,eAAO,MAAM,mBAAmB;;;;;;;;;EAG9B,CAAA;AACF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAE/D,gDAAgD;AAChD,eAAO,MAAM,mBAAmB;;;;;;;;;EAG9B,CAAA;AACF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAE/D;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB;;IAEjC,iFAAiF;;;;;;;;EAEjF,CAAA;AACF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB;IAClC,kFAAkF;;IAElF,0EAA0E;;;;;;;;EAE1E,CAAA;AACF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA"}

package/dist/schemas/security-audit.schema.d.ts

@@ -0,0 +1,231 @@
+import { z } from 'zod';
+/**
+ * Per-skill security audit shape returned by
+ * `GET /api/v1/skills/:slug/security`. Three independent sources
+ * (GEN · Socket · Snyk) are aggregated into a single overall_rating
+ * using a worst-source-wins rule (see worker `security-audit.job.ts`).
+ *
+ * Missing API keys for Socket/Snyk surface as `unavailable` rather
+ * than crashing the audit — the UI renders them as a hairline-ringed
+ * pill labelled "Audit unavailable" without affecting the trusted/
+ * critical signal from the sources that did run.
+ *
+ * GEN always runs (no external dependency); a `trusted` overall_rating
+ * still requires gen_status = 'safe' even when both vendors are
+ * unavailable.
+ */
+export declare const securityFindingSeveritySchema: z.ZodEnum<["low", "medium", "high", "critical"]>;
+export type SecurityFindingSeverity = z.infer<typeof securityFindingSeveritySchema>;
+export declare const genFindingSchema: z.ZodObject<{
+    pattern: z.ZodString;
+    severity: z.ZodEnum<["warning", "danger"]>;
+    file: z.ZodString;
+    line: z.ZodNumber;
+    snippet: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    pattern: string;
+    severity: "warning" | "danger";
+    file: string;
+    line: number;
+    snippet: string;
+}, {
+    pattern: string;
+    severity: "warning" | "danger";
+    file: string;
+    line: number;
+    snippet: string;
+}>;
+export type GenFinding = z.infer<typeof genFindingSchema>;
+export declare const socketAlertSchema: z.ZodObject<{
+    package: z.ZodString;
+    version: z.ZodOptional<z.ZodString>;
+    type: z.ZodString;
+    severity: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    type: string;
+    package: string;
+    description?: string | undefined;
+    version?: string | undefined;
+    severity?: string | undefined;
+}, {
+    type: string;
+    package: string;
+    description?: string | undefined;
+    version?: string | undefined;
+    severity?: string | undefined;
+}>;
+export type SocketAlert = z.infer<typeof socketAlertSchema>;
+export declare const snykVulnSchema: z.ZodObject<{
+    package: z.ZodString;
+    version: z.ZodOptional<z.ZodString>;
+    id: z.ZodString;
+    severity: z.ZodEnum<["low", "medium", "high", "critical"]>;
+    title: z.ZodString;
+    url: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    id: string;
+    severity: "critical" | "medium" | "low" | "high";
+    package: string;
+    title: string;
+    url?: string | undefined;
+    version?: string | undefined;
+}, {
+    id: string;
+    severity: "critical" | "medium" | "low" | "high";
+    package: string;
+    title: string;
+    url?: string | undefined;
+    version?: string | undefined;
+}>;
+export type SnykVuln = z.infer<typeof snykVulnSchema>;
+export declare const genStatusSchema: z.ZodEnum<["pending", "safe", "warning", "danger", "failed"]>;
+export declare const socketStatusSchema: z.ZodEnum<["pending", "ok", "alerts", "unavailable", "failed"]>;
+export declare const snykStatusSchema: z.ZodEnum<["pending", "ok", "low", "medium", "high", "critical", "unavailable", "failed"]>;
+export declare const overallRatingSchema: z.ZodEnum<["pending", "trusted", "low_risk", "med_risk", "critical"]>;
+export type GenStatus = z.infer<typeof genStatusSchema>;
+export type SocketStatus = z.infer<typeof socketStatusSchema>;
+export type SnykStatus = z.infer<typeof snykStatusSchema>;
+export type OverallRating = z.infer<typeof overallRatingSchema>;
+export declare const skillSecurityAuditSchema: z.ZodObject<{
+    skill_id: z.ZodString;
+    gen_status: z.ZodEnum<["pending", "safe", "warning", "danger", "failed"]>;
+    gen_findings: z.ZodArray<z.ZodObject<{
+        pattern: z.ZodString;
+        severity: z.ZodEnum<["warning", "danger"]>;
+        file: z.ZodString;
+        line: z.ZodNumber;
+        snippet: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        pattern: string;
+        severity: "warning" | "danger";
+        file: string;
+        line: number;
+        snippet: string;
+    }, {
+        pattern: string;
+        severity: "warning" | "danger";
+        file: string;
+        line: number;
+        snippet: string;
+    }>, "many">;
+    socket_status: z.ZodEnum<["pending", "ok", "alerts", "unavailable", "failed"]>;
+    socket_alerts: z.ZodArray<z.ZodObject<{
+        package: z.ZodString;
+        version: z.ZodOptional<z.ZodString>;
+        type: z.ZodString;
+        severity: z.ZodOptional<z.ZodString>;
+        description: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        type: string;
+        package: string;
+        description?: string | undefined;
+        version?: string | undefined;
+        severity?: string | undefined;
+    }, {
+        type: string;
+        package: string;
+        description?: string | undefined;
+        version?: string | undefined;
+        severity?: string | undefined;
+    }>, "many">;
+    snyk_status: z.ZodEnum<["pending", "ok", "low", "medium", "high", "critical", "unavailable", "failed"]>;
+    snyk_vulns: z.ZodArray<z.ZodObject<{
+        package: z.ZodString;
+        version: z.ZodOptional<z.ZodString>;
+        id: z.ZodString;
+        severity: z.ZodEnum<["low", "medium", "high", "critical"]>;
+        title: z.ZodString;
+        url: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
+        severity: "critical" | "medium" | "low" | "high";
+        package: string;
+        title: string;
+        url?: string | undefined;
+        version?: string | undefined;
+    }, {
+        id: string;
+        severity: "critical" | "medium" | "low" | "high";
+        package: string;
+        title: string;
+        url?: string | undefined;
+        version?: string | undefined;
+    }>, "many">;
+    overall_rating: z.ZodEnum<["pending", "trusted", "low_risk", "med_risk", "critical"]>;
+    audited_at: z.ZodNullable<z.ZodString>;
+    updated_at: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    skill_id: string;
+    updated_at: string;
+    gen_status: "pending" | "failed" | "warning" | "danger" | "safe";
+    gen_findings: {
+        pattern: string;
+        severity: "warning" | "danger";
+        file: string;
+        line: number;
+        snippet: string;
+    }[];
+    socket_status: "pending" | "failed" | "ok" | "alerts" | "unavailable";
+    socket_alerts: {
+        type: string;
+        package: string;
+        description?: string | undefined;
+        version?: string | undefined;
+        severity?: string | undefined;
+    }[];
+    snyk_status: "critical" | "pending" | "failed" | "medium" | "low" | "high" | "ok" | "unavailable";
+    snyk_vulns: {
+        id: string;
+        severity: "critical" | "medium" | "low" | "high";
+        package: string;
+        title: string;
+        url?: string | undefined;
+        version?: string | undefined;
+    }[];
+    overall_rating: "trusted" | "low_risk" | "med_risk" | "critical" | "pending";
+    audited_at: string | null;
+}, {
+    skill_id: string;
+    updated_at: string;
+    gen_status: "pending" | "failed" | "warning" | "danger" | "safe";
+    gen_findings: {
+        pattern: string;
+        severity: "warning" | "danger";
+        file: string;
+        line: number;
+        snippet: string;
+    }[];
+    socket_status: "pending" | "failed" | "ok" | "alerts" | "unavailable";
+    socket_alerts: {
+        type: string;
+        package: string;
+        description?: string | undefined;
+        version?: string | undefined;
+        severity?: string | undefined;
+    }[];
+    snyk_status: "critical" | "pending" | "failed" | "medium" | "low" | "high" | "ok" | "unavailable";
+    snyk_vulns: {
+        id: string;
+        severity: "critical" | "medium" | "low" | "high";
+        package: string;
+        title: string;
+        url?: string | undefined;
+        version?: string | undefined;
+    }[];
+    overall_rating: "trusted" | "low_risk" | "med_risk" | "critical" | "pending";
+    audited_at: string | null;
+}>;
+export type SkillSecurityAudit = z.infer<typeof skillSecurityAuditSchema>;
+/**
+ * BullMQ job payload for the worker's `security-audit` queue.
+ * Enqueued from three places:
+ *   • the Postgres trigger (via the outbox-style pending row)
+ *   • scan-github-repo, immediately after a skill upsert
+ *   • the API's manual `POST /skills/:slug/security/rescan`
+ */
+export interface SecurityAuditJob {
+    skill_id: string;
+    trigger?: 'scan' | 'trigger' | 'rescan' | 'backfill' | 'cron';
+}
+//# sourceMappingURL=security-audit.schema.d.ts.map

package/dist/schemas/security-audit.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-audit.schema.d.ts","sourceRoot":"","sources":["../../src/schemas/security-audit.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;;;;;;;;;;;GAcG;AAEH,eAAO,MAAM,6BAA6B,kDAAgD,CAAA;AAC1F,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAA;AAEnF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;EAM3B,CAAA;AACF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAEzD,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;EAM5B,CAAA;AACF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAE3D,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;EAOzB,CAAA;AACF,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAA;AAErD,eAAO,MAAM,eAAe,+DAA6D,CAAA;AACzF,eAAO,MAAM,kBAAkB,iEAM7B,CAAA;AACF,eAAO,MAAM,gBAAgB,4FAS3B,CAAA;AACF,eAAO,MAAM,mBAAmB,uEAM9B,CAAA;AAEF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;AACvD,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAC7D,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AACzD,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAE/D,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAWnC,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAA;AAEzE;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAA;CAC9D"}

package/dist/schemas/security-audit.schema.js

@@ -0,0 +1,76 @@
+import { z } from 'zod';
+/**
+ * Per-skill security audit shape returned by
+ * `GET /api/v1/skills/:slug/security`. Three independent sources
+ * (GEN · Socket · Snyk) are aggregated into a single overall_rating
+ * using a worst-source-wins rule (see worker `security-audit.job.ts`).
+ *
+ * Missing API keys for Socket/Snyk surface as `unavailable` rather
+ * than crashing the audit — the UI renders them as a hairline-ringed
+ * pill labelled "Audit unavailable" without affecting the trusted/
+ * critical signal from the sources that did run.
+ *
+ * GEN always runs (no external dependency); a `trusted` overall_rating
+ * still requires gen_status = 'safe' even when both vendors are
+ * unavailable.
+ */
+export const securityFindingSeveritySchema = z.enum(['low', 'medium', 'high', 'critical']);
+export const genFindingSchema = z.object({
+    pattern: z.string(),
+    severity: z.enum(['warning', 'danger']),
+    file: z.string(),
+    line: z.number().int().nonnegative(),
+    snippet: z.string().max(240),
+});
+export const socketAlertSchema = z.object({
+    package: z.string(),
+    version: z.string().optional(),
+    type: z.string(),
+    severity: z.string().optional(),
+    description: z.string().optional(),
+});
+export const snykVulnSchema = z.object({
+    package: z.string(),
+    version: z.string().optional(),
+    id: z.string(),
+    severity: securityFindingSeveritySchema,
+    title: z.string(),
+    url: z.string().url().optional(),
+});
+export const genStatusSchema = z.enum(['pending', 'safe', 'warning', 'danger', 'failed']);
+export const socketStatusSchema = z.enum([
+    'pending',
+    'ok',
+    'alerts',
+    'unavailable',
+    'failed',
+]);
+export const snykStatusSchema = z.enum([
+    'pending',
+    'ok',
+    'low',
+    'medium',
+    'high',
+    'critical',
+    'unavailable',
+    'failed',
+]);
+export const overallRatingSchema = z.enum([
+    'pending',
+    'trusted',
+    'low_risk',
+    'med_risk',
+    'critical',
+]);
+export const skillSecurityAuditSchema = z.object({
+    skill_id: z.string().uuid(),
+    gen_status: genStatusSchema,
+    gen_findings: z.array(genFindingSchema),
+    socket_status: socketStatusSchema,
+    socket_alerts: z.array(socketAlertSchema),
+    snyk_status: snykStatusSchema,
+    snyk_vulns: z.array(snykVulnSchema),
+    overall_rating: overallRatingSchema,
+    audited_at: z.string().datetime().nullable(),
+    updated_at: z.string().datetime(),
+});

package/dist/schemas/skill-dependency.schema.d.ts

@@ -44,6 +44,7 @@ export declare const dependencyRowSchema: z.ZodObject<{
         license: z.ZodDefault<z.ZodString>;
         category: z.ZodNullable<z.ZodString>;
         tags: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        extracted_triggers: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
         install_count: z.ZodDefault<z.ZodNumber>;
         bookmark_count: z.ZodDefault<z.ZodNumber>;
         is_verified: z.ZodDefault<z.ZodBoolean>;
@@ -127,6 +128,7 @@ export declare const dependencyRowSchema: z.ZodObject<{
             is_creator: boolean;
             is_partner: boolean;
         }>>>;
+        security_rating: z.ZodOptional<z.ZodNullable<z.ZodEnum<["trusted", "low_risk", "med_risk", "critical", "pending"]>>>;
         created_at: z.ZodString;
         updated_at: z.ZodString;
     }, "id" | "slug" | "name" | "description" | "visibility">, "strip", z.ZodTypeAny, {

package/dist/schemas/skill-dependency.schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-dependency.schema.d.ts","sourceRoot":"","sources":["../../src/schemas/skill-dependency.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,4EAA4E;AAC5E,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;EAMhC,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEnE;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQ9B,CAAA;AACF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAE/D,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,+DAA+D;AAC/D,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE,kBAAkB,EAAE,CAAA;IAC3B,SAAS,EAAE,kBAAkB,EAAE,CAAA;CAChC;AAED,yEAAyE;AACzE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,GAAG,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAA;CAC3D;AAED,eAAO,MAAM,wBAAwB;;;;;;;;;;;;EAOnC,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAA"}
+{"version":3,"file":"skill-dependency.schema.d.ts","sourceRoot":"","sources":["../../src/schemas/skill-dependency.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,4EAA4E;AAC5E,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;EAMhC,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEnE;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQ9B,CAAA;AACF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAE/D,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,+DAA+D;AAC/D,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE,kBAAkB,EAAE,CAAA;IAC3B,SAAS,EAAE,kBAAkB,EAAE,CAAA;CAChC;AAED,yEAAyE;AACzE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,GAAG,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAA;CAC3D;AAED,eAAO,MAAM,wBAAwB;;;;;;;;;;;;EAOnC,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAA"}

package/dist/schemas/skill.schema.d.ts

@@ -70,6 +70,17 @@ export declare const skillSchema: z.ZodObject<{
     license: z.ZodDefault<z.ZodString>;
     category: z.ZodNullable<z.ZodString>;
     tags: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /**
+     * Server-extracted triggers — parsed from the SKILL.md content by
+     * `extract_triggers_from_md()` (migration 057). Frontmatter
+     * `triggers:` list plus prose patterns ("Load on …", "Triggers: …",
+     * "Auto-loads when …"). Recomputed on every content write via the
+     * `skills_refresh_extracted_triggers` trigger so the value never
+     * drifts. The Discover detail page renders these as chips and only
+     * falls back to tags / "Claude reads the description" when this
+     * array is empty.
+     */
+    extracted_triggers: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
     install_count: z.ZodDefault<z.ZodNumber>;
     bookmark_count: z.ZodDefault<z.ZodNumber>;
     is_verified: z.ZodDefault<z.ZodBoolean>;
@@ -165,6 +176,14 @@ export declare const skillSchema: z.ZodObject<{
         is_creator: boolean;
         is_partner: boolean;
     }>>>;
+    /**
+     * Attached by the API on list + detail GETs once the worker has
+     * audited this skill. `null` = audit row exists but is still
+     * pending; `undefined` = no audit row at all (pre-trigger backlog).
+     * Cards + the detail page render a `SecurityBadge` from this value
+     * so the user can see the rating before opening anything.
+     */
+    security_rating: z.ZodOptional<z.ZodNullable<z.ZodEnum<["trusted", "low_risk", "med_risk", "critical", "pending"]>>>;
     created_at: z.ZodString;
     updated_at: z.ZodString;
 }, "strip", z.ZodTypeAny, {
@@ -182,6 +201,7 @@ export declare const skillSchema: z.ZodObject<{
     source_repo: string | null;
     license: string;
     tags: string[];
+    extracted_triggers: string[];
     bookmark_count: number;
     is_verified: boolean;
     price_cents: number;
@@ -218,6 +238,7 @@ export declare const skillSchema: z.ZodObject<{
         is_creator: boolean;
         is_partner: boolean;
     } | null | undefined;
+    security_rating?: "trusted" | "low_risk" | "med_risk" | "critical" | "pending" | null | undefined;
 }, {
     id: string;
     content: string | null;
@@ -233,6 +254,7 @@ export declare const skillSchema: z.ZodObject<{
     visibility?: "public" | "private" | undefined;
     license?: string | undefined;
     tags?: string[] | undefined;
+    extracted_triggers?: string[] | undefined;
     bookmark_count?: number | undefined;
     is_verified?: boolean | undefined;
     price_cents?: number | undefined;
@@ -269,6 +291,7 @@ export declare const skillSchema: z.ZodObject<{
         is_creator: boolean;
         is_partner: boolean;
     } | null | undefined;
+    security_rating?: "trusted" | "low_risk" | "med_risk" | "critical" | "pending" | null | undefined;
 }>;
 export type Skill = z.infer<typeof skillSchema>;
 export declare const createSkillInputSchema: z.ZodObject<{
@@ -494,14 +517,26 @@ export declare const autoSkillFromRepoRequestSchema: z.ZodObject<{
      * behind an "Advanced" disclosure in the wizard.
      */
     custom_instructions: z.ZodOptional<z.ZodString>;
+    /**
+     * Optional display name override. When empty, the generator picks
+     * a name from the README / repo title — which historically went
+     * long ("Testing Node/TypeScript API and React Web Apps") and
+     * looked terrible in the sidebar / project switcher. The wizard
+     * surfaces this on step 1 as a soft suggestion so users can
+     * shorten the title up front without round-tripping through the
+     * editor settings drawer.
+     */
+    name: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     repo_url: string;
+    name?: string | undefined;
     category?: string | undefined;
     focus?: string | undefined;
     triggers?: string[] | undefined;
     custom_instructions?: string | undefined;
 }, {
     repo_url: string;
+    name?: string | undefined;
     category?: string | undefined;
     focus?: string | undefined;
     triggers?: string[] | undefined;

package/dist/schemas/skill.schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill.schema.d.ts","sourceRoot":"","sources":["../../src/schemas/skill.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,qBAAqB,kCAAgC,CAAA;AAClE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEnE;;;GAGG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;EAS1B,CAAA;AACF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;AAEvD,iFAAiF;AACjF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;EAO5B,CAAA;AACF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAE3D,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;IAsBtB;;;;;OAKG;;;;IAIH,kEAAkE;;;;;;;;;;;;;;;;;;;;;;;IAElE,6DAA6D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAE7D,6EAA6E;;IAE7E,mEAAmE;;IAEnE,+EAA+E;;IAE/E,gGAAgG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAchG,CAAA;AACF,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAA;AAE/C,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;IA4B/B,2EAA2E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAW3E,CAAA;AACJ,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAErE,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEjC,CAAA;AACF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAErE,eAAO,MAAM,eAAe,2DAAyD,CAAA;AACrF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;AAEvD,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;EAOjC,CAAA;AACF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAErE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;EAE9B,CAAA;AACF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAI/D;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B;;IAQzC;;;OAGG;;IAEH;;;;;;;OAOG;;IAEH;;;;;OAKG;;IAEH;;;;;;OAMG;;;;;;;;;;;;;;EAEH,CAAA;AACF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAA;AAIrF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB;;;;;;EAE9B,CAAA;AACF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAE/D;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,OAAO,CAAA;IAClB,QAAQ,EAAE,OAAO,CAAA;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,YAAY,EAAE,CAAA;IACrB,6EAA6E;IAC7E,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB"}
+{"version":3,"file":"skill.schema.d.ts","sourceRoot":"","sources":["../../src/schemas/skill.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,qBAAqB,kCAAgC,CAAA;AAClE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEnE;;;GAGG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;EAS1B,CAAA;AACF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;AAEvD,iFAAiF;AACjF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;EAO5B,CAAA;AACF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAE3D,eAAO,MAAM,WAAW;;;;;;;;;;;;IAgBtB;;;;;;;;;OASG;;;;;;;IAQH;;;;;OAKG;;;;IAIH,kEAAkE;;;;;;;;;;;;;;;;;;;;;;;IAElE,6DAA6D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAE7D,6EAA6E;;IAE7E,mEAAmE;;IAEnE,+EAA+E;;IAE/E,gGAAgG;;;;;;;;;;;;;;;;;;;;;;;IAYhG;;;;;;OAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAOH,CAAA;AACF,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAA;AAE/C,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;IA4B/B,2EAA2E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAW3E,CAAA;AACJ,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAErE,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEjC,CAAA;AACF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAErE,eAAO,MAAM,eAAe,2DAAyD,CAAA;AACrF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;AAEvD,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;EAOjC,CAAA;AACF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAErE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;EAE9B,CAAA;AACF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAI/D;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B;;IAQzC;;;OAGG;;IAEH;;;;;;;OAOG;;IAEH;;;;;OAKG;;IAEH;;;;;;OAMG;;IAEH;;;;;;;;OAQG;;;;;;;;;;;;;;;;EAEH,CAAA;AACF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAA;AAIrF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB;;;;;;EAE9B,CAAA;AACF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAE/D;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,OAAO,CAAA;IAClB,QAAQ,EAAE,OAAO,CAAA;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,YAAY,EAAE,CAAA;IACrB,6EAA6E;IAC7E,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB"}

package/dist/schemas/skill.schema.js

@@ -39,6 +39,17 @@ export const skillSchema = z.object({
     license: z.string().default('MIT'),
     category: z.string().nullable(),
     tags: z.array(z.string()).default([]),
+    /**
+     * Server-extracted triggers — parsed from the SKILL.md content by
+     * `extract_triggers_from_md()` (migration 057). Frontmatter
+     * `triggers:` list plus prose patterns ("Load on …", "Triggers: …",
+     * "Auto-loads when …"). Recomputed on every content write via the
+     * `skills_refresh_extracted_triggers` trigger so the value never
+     * drifts. The Discover detail page renders these as chips and only
+     * falls back to tags / "Claude reads the description" when this
+     * array is empty.
+     */
+    extracted_triggers: z.array(z.string()).default([]),
     install_count: z.number().int().nonnegative().default(0),
     bookmark_count: z.number().int().nonnegative().default(0),
     is_verified: z.boolean().default(false),
@@ -75,6 +86,17 @@ export const skillSchema = z.object({
     })
         .nullable()
         .optional(),
+    /**
+     * Attached by the API on list + detail GETs once the worker has
+     * audited this skill. `null` = audit row exists but is still
+     * pending; `undefined` = no audit row at all (pre-trigger backlog).
+     * Cards + the detail page render a `SecurityBadge` from this value
+     * so the user can see the rating before opening anything.
+     */
+    security_rating: z
+        .enum(['trusted', 'low_risk', 'med_risk', 'critical', 'pending'])
+        .nullable()
+        .optional(),
     created_at: z.string().datetime(),
     updated_at: z.string().datetime(),
 });
@@ -172,6 +194,16 @@ export const autoSkillFromRepoRequestSchema = z.object({
      * behind an "Advanced" disclosure in the wizard.
      */
     custom_instructions: z.string().min(1).max(800).optional(),
+    /**
+     * Optional display name override. When empty, the generator picks
+     * a name from the README / repo title — which historically went
+     * long ("Testing Node/TypeScript API and React Web Apps") and
+     * looked terrible in the sidebar / project switcher. The wizard
+     * surfaces this on step 1 as a soft suggestion so users can
+     * shorten the title up front without round-tripping through the
+     * editor settings drawer.
+     */
+    name: z.string().trim().min(1).max(60).optional(),
 });
 /* ─── Bulk sync — used by `prave sync` ─────────────────────────── */
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prave/shared",
-  "version": "1.4.15",
+  "version": "1.5.0",
   "type": "module",
   "publishConfig": {
     "access": "public"