@prave/shared 1.4.16 → 1.5.1

package/dist/schemas/advisor.schema.d.ts

@@ -0,0 +1,167 @@
+import { z } from 'zod';
+/**
+ * Contextual Skill Advisor — prose recommendations behind a tiered
+ * freemium quota. See `apps/api/src/services/advisor.service.ts` for
+ * the orchestrator; the schemas below pin the request, response, and
+ * LLM-output shapes so a model drift on the Haiku side gets caught at
+ * the Zod boundary, not in the UI.
+ */
+export declare const advisorModeSchema: z.ZodEnum<["manual", "auto"]>;
+export type AdvisorMode = z.infer<typeof advisorModeSchema>;
+export declare const advisorRequestSchema: z.ZodEffects<z.ZodObject<{
+    mode: z.ZodDefault<z.ZodEnum<["manual", "auto"]>>;
+    /**
+     * Task description for manual mode. Required when `mode === 'manual'`,
+     * ignored when `mode === 'auto'`. We cap at 1200 chars so a long
+     * paste can't blow the Haiku prompt window — the input field on the
+     * web side enforces the same limit.
+     */
+    task: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    mode: "manual" | "auto";
+    task?: string | undefined;
+}, {
+    mode?: "manual" | "auto" | undefined;
+    task?: string | undefined;
+}>, {
+    mode: "manual" | "auto";
+    task?: string | undefined;
+}, {
+    mode?: "manual" | "auto" | undefined;
+    task?: string | undefined;
+}>;
+export type AdvisorRequest = z.infer<typeof advisorRequestSchema>;
+/**
+ * One recommended skill in the advisor's response. `slug` is always a
+ * real catalogue slug — the service drops anything Haiku invented
+ * before the response leaves the API.
+ */
+export declare const advisorRecommendationSchema: z.ZodObject<{
+    slug: z.ZodString;
+    reason: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    slug: string;
+    reason: string;
+}, {
+    slug: string;
+    reason: string;
+}>;
+export type AdvisorRecommendation = z.infer<typeof advisorRecommendationSchema>;
+export declare const advisorResponseSchema: z.ZodObject<{
+    /**
+     * Prose paragraph the model writes. Calmly-cased, no markdown
+     * fences, no emoji. The web result block renders this verbatim.
+     */
+    prose: z.ZodString;
+    recommendations: z.ZodArray<z.ZodObject<{
+        slug: z.ZodString;
+        reason: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        slug: string;
+        reason: string;
+    }, {
+        slug: string;
+        reason: string;
+    }>, "many">;
+    /**
+     * Echoed for telemetry + cache-bust debugging. The UI doesn't render
+     * this but the analytics layer does.
+     */
+    mode: z.ZodEnum<["manual", "auto"]>;
+    /**
+     * After-this-call quota snapshot — saves the web UI a round-trip
+     * back to `GET /advisor/quota` immediately after a success.
+     */
+    quota: z.ZodObject<{
+        plan: z.ZodEnum<["free", "pro", "max"]>;
+        limit: z.ZodNumber;
+        used: z.ZodNumber;
+        remaining: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        limit: number;
+        plan: "free" | "pro" | "max";
+        used: number;
+        remaining: number;
+    }, {
+        limit: number;
+        plan: "free" | "pro" | "max";
+        used: number;
+        remaining: number;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    mode: "manual" | "auto";
+    prose: string;
+    recommendations: {
+        slug: string;
+        reason: string;
+    }[];
+    quota: {
+        limit: number;
+        plan: "free" | "pro" | "max";
+        used: number;
+        remaining: number;
+    };
+}, {
+    mode: "manual" | "auto";
+    prose: string;
+    recommendations: {
+        slug: string;
+        reason: string;
+    }[];
+    quota: {
+        limit: number;
+        plan: "free" | "pro" | "max";
+        used: number;
+        remaining: number;
+    };
+}>;
+export type AdvisorResponse = z.infer<typeof advisorResponseSchema>;
+export declare const advisorQuotaResponseSchema: z.ZodObject<{
+    plan: z.ZodEnum<["free", "pro", "max"]>;
+    limit: z.ZodNumber;
+    used: z.ZodNumber;
+    remaining: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    limit: number;
+    plan: "free" | "pro" | "max";
+    used: number;
+    remaining: number;
+}, {
+    limit: number;
+    plan: "free" | "pro" | "max";
+    used: number;
+    remaining: number;
+}>;
+export type AdvisorQuotaResponse = z.infer<typeof advisorQuotaResponseSchema>;
+/**
+ * Raw Haiku JSON shape — what the model is told to produce. Validated
+ * inside the service; mismatches throw `HttpError.internal` so the
+ * caller gets a clean 500 rather than half-rendered garbage.
+ */
+export declare const advisorLlmOutputSchema: z.ZodObject<{
+    prose: z.ZodString;
+    recommendations: z.ZodArray<z.ZodObject<{
+        slug: z.ZodString;
+        reason: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        slug: string;
+        reason: string;
+    }, {
+        slug: string;
+        reason: string;
+    }>, "many">;
+}, "strip", z.ZodTypeAny, {
+    prose: string;
+    recommendations: {
+        slug: string;
+        reason: string;
+    }[];
+}, {
+    prose: string;
+    recommendations: {
+        slug: string;
+        reason: string;
+    }[];
+}>;
+export type AdvisorLlmOutput = z.infer<typeof advisorLlmOutputSchema>;
+//# sourceMappingURL=advisor.schema.d.ts.map

package/dist/schemas/advisor.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"advisor.schema.d.ts","sourceRoot":"","sources":["../../src/schemas/advisor.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;;;GAMG;AAEH,eAAO,MAAM,iBAAiB,+BAA6B,CAAA;AAC3D,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAE3D,eAAO,MAAM,oBAAoB;;IAG7B;;;;;OAKG;;;;;;;;;;;;;;EAWH,CAAA;AACJ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAEjE;;;;GAIG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;EAGtC,CAAA;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAE/E,eAAO,MAAM,qBAAqB;IAChC;;;OAGG;;;;;;;;;;;;IAGH;;;OAGG;;IAEH;;;OAGG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAOH,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEnE,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;EAAoC,CAAA;AAC3E,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAA;AAE7E;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;EAUjC,CAAA;AACF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA"}

package/dist/schemas/advisor.schema.js

@@ -0,0 +1,76 @@
+import { z } from 'zod';
+/**
+ * Contextual Skill Advisor — prose recommendations behind a tiered
+ * freemium quota. See `apps/api/src/services/advisor.service.ts` for
+ * the orchestrator; the schemas below pin the request, response, and
+ * LLM-output shapes so a model drift on the Haiku side gets caught at
+ * the Zod boundary, not in the UI.
+ */
+export const advisorModeSchema = z.enum(['manual', 'auto']);
+export const advisorRequestSchema = z
+    .object({
+    mode: advisorModeSchema.default('manual'),
+    /**
+     * Task description for manual mode. Required when `mode === 'manual'`,
+     * ignored when `mode === 'auto'`. We cap at 1200 chars so a long
+     * paste can't blow the Haiku prompt window — the input field on the
+     * web side enforces the same limit.
+     */
+    task: z.string().trim().min(8).max(1200).optional(),
+})
+    .superRefine((val, ctx) => {
+    if (val.mode === 'manual' && (!val.task || val.task.length < 8)) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ['task'],
+            message: 'Manual mode needs at least 8 characters of task description.',
+        });
+    }
+});
+/**
+ * One recommended skill in the advisor's response. `slug` is always a
+ * real catalogue slug — the service drops anything Haiku invented
+ * before the response leaves the API.
+ */
+export const advisorRecommendationSchema = z.object({
+    slug: z.string().min(1).max(120),
+    reason: z.string().min(1).max(400),
+});
+export const advisorResponseSchema = z.object({
+    /**
+     * Prose paragraph the model writes. Calmly-cased, no markdown
+     * fences, no emoji. The web result block renders this verbatim.
+     */
+    prose: z.string().min(1).max(2400),
+    recommendations: z.array(advisorRecommendationSchema).max(5),
+    /**
+     * Echoed for telemetry + cache-bust debugging. The UI doesn't render
+     * this but the analytics layer does.
+     */
+    mode: advisorModeSchema,
+    /**
+     * After-this-call quota snapshot — saves the web UI a round-trip
+     * back to `GET /advisor/quota` immediately after a success.
+     */
+    quota: z.object({
+        plan: z.enum(['free', 'pro', 'max']),
+        limit: z.number().int().nonnegative(),
+        used: z.number().int().nonnegative(),
+        remaining: z.number().int().nonnegative(),
+    }),
+});
+export const advisorQuotaResponseSchema = advisorResponseSchema.shape.quota;
+/**
+ * Raw Haiku JSON shape — what the model is told to produce. Validated
+ * inside the service; mismatches throw `HttpError.internal` so the
+ * caller gets a clean 500 rather than half-rendered garbage.
+ */
+export const advisorLlmOutputSchema = z.object({
+    prose: z.string().min(1).max(2400),
+    recommendations: z
+        .array(z.object({
+        slug: z.string().min(1).max(120),
+        reason: z.string().min(1).max(400),
+    }))
+        .max(8), // accept up to 8 so we can drop hallucinations before capping to 5
+});

package/dist/schemas/hook.schema.d.ts

@@ -0,0 +1,246 @@
+import { z } from 'zod';
+/**
+ * Claude Code Hook registry shape — the parallel-to-Skills primitive.
+ *
+ * V1 is **scraper-only**: rows arrive from the worker's
+ * scan-github-hook job. The web UI does not author hooks; the
+ * "Suggest a hook" modal calls `POST /api/v1/hooks/submit` with a
+ * GitHub URL, which enqueues a scan job. End-users never POST/PUT/
+ * DELETE the hook content itself.
+ */
+export declare const hookEventSchema: z.ZodEnum<["PreToolUse", "PostToolUse", "UserPromptSubmit", "Stop", "SubagentStop", "Notification", "PreCompact", "SessionStart"]>;
+export type HookEvent = z.infer<typeof hookEventSchema>;
+export declare const hookVisibilitySchema: z.ZodEnum<["public", "private"]>;
+export type HookVisibility = z.infer<typeof hookVisibilitySchema>;
+export declare const hookSchema: z.ZodObject<{
+    id: z.ZodString;
+    owner_id: z.ZodNullable<z.ZodString>;
+    name: z.ZodString;
+    slug: z.ZodString;
+    description: z.ZodNullable<z.ZodString>;
+    /** Claude Code lifecycle event the hook listens on. */
+    event: z.ZodEnum<["PreToolUse", "PostToolUse", "UserPromptSubmit", "Stop", "SubagentStop", "Notification", "PreCompact", "SessionStart"]>;
+    /**
+     * Tool-name glob — only relevant on the tool-events
+     * (`Pre/PostToolUse`). `null` means "any tool" and Claude Code
+     * treats it as the universal matcher.
+     */
+    matcher: z.ZodNullable<z.ZodString>;
+    /** Shell command Claude Code spawns when the event fires. */
+    command: z.ZodString;
+    /** Optional per-hook timeout in seconds (1–600). */
+    timeout_seconds: z.ZodNullable<z.ZodNumber>;
+    visibility: z.ZodDefault<z.ZodEnum<["public", "private"]>>;
+    source_repo: z.ZodNullable<z.ZodString>;
+    license: z.ZodDefault<z.ZodString>;
+    tags: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    install_count: z.ZodDefault<z.ZodNumber>;
+    is_verified: z.ZodDefault<z.ZodBoolean>;
+    version: z.ZodDefault<z.ZodNumber>;
+    /** Same enum as Feature 1's security_rating; opt-in for hooks. */
+    security_rating: z.ZodOptional<z.ZodNullable<z.ZodEnum<["trusted", "low_risk", "med_risk", "critical", "pending"]>>>;
+    /** Attached by the API on GET when authenticated. */
+    bookmarked: z.ZodOptional<z.ZodBoolean>;
+    /** Attached by the API on GET when authenticated. */
+    installed: z.ZodOptional<z.ZodBoolean>;
+    /** Attached by the API: public slice of the owner profile. */
+    owner: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        username: z.ZodNullable<z.ZodString>;
+        display_name: z.ZodNullable<z.ZodString>;
+        avatar_url: z.ZodNullable<z.ZodString>;
+        is_creator: z.ZodBoolean;
+        is_partner: z.ZodBoolean;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
+        username: string | null;
+        display_name: string | null;
+        avatar_url: string | null;
+        is_creator: boolean;
+        is_partner: boolean;
+    }, {
+        id: string;
+        username: string | null;
+        display_name: string | null;
+        avatar_url: string | null;
+        is_creator: boolean;
+        is_partner: boolean;
+    }>>>;
+    created_at: z.ZodString;
+    updated_at: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    id: string;
+    created_at: string;
+    updated_at: string;
+    slug: string;
+    name: string;
+    description: string | null;
+    install_count: number;
+    owner_id: string | null;
+    visibility: "public" | "private";
+    source_repo: string | null;
+    license: string;
+    tags: string[];
+    is_verified: boolean;
+    version: number;
+    event: "PreToolUse" | "PostToolUse" | "UserPromptSubmit" | "Stop" | "SubagentStop" | "Notification" | "PreCompact" | "SessionStart";
+    matcher: string | null;
+    command: string;
+    timeout_seconds: number | null;
+    bookmarked?: boolean | undefined;
+    owner?: {
+        id: string;
+        username: string | null;
+        display_name: string | null;
+        avatar_url: string | null;
+        is_creator: boolean;
+        is_partner: boolean;
+    } | null | undefined;
+    security_rating?: "trusted" | "low_risk" | "med_risk" | "critical" | "pending" | null | undefined;
+    installed?: boolean | undefined;
+}, {
+    id: string;
+    created_at: string;
+    updated_at: string;
+    slug: string;
+    name: string;
+    description: string | null;
+    owner_id: string | null;
+    source_repo: string | null;
+    event: "PreToolUse" | "PostToolUse" | "UserPromptSubmit" | "Stop" | "SubagentStop" | "Notification" | "PreCompact" | "SessionStart";
+    matcher: string | null;
+    command: string;
+    timeout_seconds: number | null;
+    install_count?: number | undefined;
+    visibility?: "public" | "private" | undefined;
+    license?: string | undefined;
+    tags?: string[] | undefined;
+    is_verified?: boolean | undefined;
+    bookmarked?: boolean | undefined;
+    owner?: {
+        id: string;
+        username: string | null;
+        display_name: string | null;
+        avatar_url: string | null;
+        is_creator: boolean;
+        is_partner: boolean;
+    } | null | undefined;
+    security_rating?: "trusted" | "low_risk" | "med_risk" | "critical" | "pending" | null | undefined;
+    version?: number | undefined;
+    installed?: boolean | undefined;
+}>;
+export type Hook = z.infer<typeof hookSchema>;
+export declare const hookSortSchema: z.ZodEnum<["trending", "popular", "newest", "relevance"]>;
+export type HookSort = z.infer<typeof hookSortSchema>;
+export declare const hookSearchQuerySchema: z.ZodObject<{
+    q: z.ZodOptional<z.ZodString>;
+    event: z.ZodOptional<z.ZodEnum<["PreToolUse", "PostToolUse", "UserPromptSubmit", "Stop", "SubagentStop", "Notification", "PreCompact", "SessionStart"]>>;
+    tag: z.ZodOptional<z.ZodString>;
+    sort: z.ZodDefault<z.ZodEnum<["trending", "popular", "newest", "relevance"]>>;
+    limit: z.ZodDefault<z.ZodNumber>;
+    offset: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    sort: "trending" | "popular" | "newest" | "relevance";
+    limit: number;
+    offset: number;
+    q?: string | undefined;
+    tag?: string | undefined;
+    event?: "PreToolUse" | "PostToolUse" | "UserPromptSubmit" | "Stop" | "SubagentStop" | "Notification" | "PreCompact" | "SessionStart" | undefined;
+}, {
+    sort?: "trending" | "popular" | "newest" | "relevance" | undefined;
+    q?: string | undefined;
+    tag?: string | undefined;
+    limit?: number | undefined;
+    offset?: number | undefined;
+    event?: "PreToolUse" | "PostToolUse" | "UserPromptSubmit" | "Stop" | "SubagentStop" | "Notification" | "PreCompact" | "SessionStart" | undefined;
+}>;
+export type HookSearchQuery = z.infer<typeof hookSearchQuerySchema>;
+/**
+ * `POST /api/v1/hooks/submit` body — a user proposes a GitHub URL,
+ * the worker scans it. The endpoint dedupes pending scans by repo URL
+ * so spamming the form is harmless.
+ */
+export declare const submitHookByUrlSchema: z.ZodObject<{
+    repo_url: z.ZodEffects<z.ZodString, string, string>;
+}, "strip", z.ZodTypeAny, {
+    repo_url: string;
+}, {
+    repo_url: string;
+}>;
+export type SubmitHookByUrlInput = z.infer<typeof submitHookByUrlSchema>;
+/**
+ * `github-hook-scan` queue payload. Scans one GitHub repo for
+ * `hook.json` files + sibling `claude/hooks/*.json`, validates them
+ * against `hookSchema`, secret-scans the command, upserts.
+ */
+export declare const scanGithubHookJobSchema: z.ZodObject<{
+    repo_url: z.ZodString;
+    source: z.ZodEnum<["manual", "seed", "cron", "submit"]>;
+    submitted_by: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    repo_url: string;
+    source: "seed" | "manual" | "cron" | "submit";
+    submitted_by?: string | undefined;
+}, {
+    repo_url: string;
+    source: "seed" | "manual" | "cron" | "submit";
+    submitted_by?: string | undefined;
+}>;
+export type ScanGithubHookJob = z.infer<typeof scanGithubHookJobSchema>;
+/**
+ * `discover-github-hook` queue payload. Wide-scope GitHub code-search
+ * to find any public repo with a `hook.json` we don't already know.
+ */
+export declare const discoverGithubHookJobSchema: z.ZodObject<{
+    query: z.ZodString;
+    max_repos: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    max_repos: number;
+    query: string;
+}, {
+    query: string;
+    max_repos?: number | undefined;
+}>;
+export type DiscoverGithubHookJob = z.infer<typeof discoverGithubHookJobSchema>;
+/** `index-hook` queue payload. */
+export declare const indexHookJobSchema: z.ZodObject<{
+    hook_id: z.ZodString;
+    op: z.ZodEnum<["upsert", "delete"]>;
+}, "strip", z.ZodTypeAny, {
+    op: "upsert" | "delete";
+    hook_id: string;
+}, {
+    op: "upsert" | "delete";
+    hook_id: string;
+}>;
+export type IndexHookJob = z.infer<typeof indexHookJobSchema>;
+/** `describe-hook` queue payload — Haiku-generated description. */
+export declare const describeHookJobSchema: z.ZodObject<{
+    hook_id: z.ZodString;
+    force: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    hook_id: string;
+    force?: boolean | undefined;
+}, {
+    hook_id: string;
+    force?: boolean | undefined;
+}>;
+export type DescribeHookJob = z.infer<typeof describeHookJobSchema>;
+export declare const hookBulkSyncInputSchema: z.ZodObject<{
+    slugs: z.ZodArray<z.ZodString, "many">;
+}, "strip", z.ZodTypeAny, {
+    slugs: string[];
+}, {
+    slugs: string[];
+}>;
+export type HookBulkSyncInput = z.infer<typeof hookBulkSyncInputSchema>;
+export interface HookBulkSyncItem {
+    slug: string;
+    hook: Hook | null;
+    error: string | null;
+}
+export interface HookBulkSyncResponse {
+    items: HookBulkSyncItem[];
+    missing: string[];
+}
+//# sourceMappingURL=hook.schema.d.ts.map

package/dist/schemas/hook.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook.schema.d.ts","sourceRoot":"","sources":["../../src/schemas/hook.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;;;;;GAQG;AAEH,eAAO,MAAM,eAAe,oIAS1B,CAAA;AACF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;AAEvD,eAAO,MAAM,oBAAoB,kCAAgC,CAAA;AACjE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAEjE,eAAO,MAAM,UAAU;;;;;;IAWrB,uDAAuD;;IAEvD;;;;OAIG;;IAEH,6DAA6D;;IAE7D,oDAAoD;;;;;;;;;IAWpD,kEAAkE;;IAMlE,qDAAqD;;IAErD,qDAAqD;;IAErD,8DAA8D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAe9D,CAAA;AACF,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAA;AAI7C,eAAO,MAAM,cAAc,2DAAyD,CAAA;AACpF,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAA;AAErD,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;EAOhC,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAInE;;;;GAIG;AACH,eAAO,MAAM,qBAAqB;;;;;;EAQhC,CAAA;AACF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAIxE;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;EAIlC,CAAA;AACF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAEvE;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;EAGtC,CAAA;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAE/E,kCAAkC;AAClC,eAAO,MAAM,kBAAkB;;;;;;;;;EAG7B,CAAA;AACF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAE7D,mEAAmE;AACnE,eAAO,MAAM,qBAAqB;;;;;;;;;EAGhC,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAInE,eAAO,MAAM,uBAAuB;;;;;;EAElC,CAAA;AACF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAEvE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,gBAAgB,EAAE,CAAA;IACzB,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB"}

package/dist/schemas/hook.schema.js

@@ -0,0 +1,129 @@
+import { z } from 'zod';
+/**
+ * Claude Code Hook registry shape — the parallel-to-Skills primitive.
+ *
+ * V1 is **scraper-only**: rows arrive from the worker's
+ * scan-github-hook job. The web UI does not author hooks; the
+ * "Suggest a hook" modal calls `POST /api/v1/hooks/submit` with a
+ * GitHub URL, which enqueues a scan job. End-users never POST/PUT/
+ * DELETE the hook content itself.
+ */
+export const hookEventSchema = z.enum([
+    'PreToolUse',
+    'PostToolUse',
+    'UserPromptSubmit',
+    'Stop',
+    'SubagentStop',
+    'Notification',
+    'PreCompact',
+    'SessionStart',
+]);
+export const hookVisibilitySchema = z.enum(['public', 'private']);
+export const hookSchema = z.object({
+    id: z.string().uuid(),
+    owner_id: z.string().uuid().nullable(),
+    name: z.string().min(1).max(120),
+    slug: z
+        .string()
+        .min(1)
+        .max(120)
+        .regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, 'slug must be kebab-case'),
+    description: z.string().max(500).nullable(),
+    /** Claude Code lifecycle event the hook listens on. */
+    event: hookEventSchema,
+    /**
+     * Tool-name glob — only relevant on the tool-events
+     * (`Pre/PostToolUse`). `null` means "any tool" and Claude Code
+     * treats it as the universal matcher.
+     */
+    matcher: z.string().max(120).nullable(),
+    /** Shell command Claude Code spawns when the event fires. */
+    command: z.string().min(1).max(4000),
+    /** Optional per-hook timeout in seconds (1–600). */
+    timeout_seconds: z.number().int().min(1).max(600).nullable(),
+    visibility: hookVisibilitySchema.default('public'),
+    source_repo: z.string().url().nullable(),
+    license: z.string().default('MIT'),
+    tags: z.array(z.string()).default([]),
+    install_count: z.number().int().nonnegative().default(0),
+    is_verified: z.boolean().default(false),
+    version: z.number().int().positive().default(1),
+    /** Same enum as Feature 1's security_rating; opt-in for hooks. */
+    security_rating: z
+        .enum(['trusted', 'low_risk', 'med_risk', 'critical', 'pending'])
+        .nullable()
+        .optional(),
+    /** Attached by the API on GET when authenticated. */
+    bookmarked: z.boolean().optional(),
+    /** Attached by the API on GET when authenticated. */
+    installed: z.boolean().optional(),
+    /** Attached by the API: public slice of the owner profile. */
+    owner: z
+        .object({
+        id: z.string().uuid(),
+        username: z.string().nullable(),
+        display_name: z.string().nullable(),
+        avatar_url: z.string().nullable(),
+        is_creator: z.boolean(),
+        is_partner: z.boolean(),
+    })
+        .nullable()
+        .optional(),
+    created_at: z.string().datetime(),
+    updated_at: z.string().datetime(),
+});
+/* ─── Discovery query ──────────────────────────────────────────── */
+export const hookSortSchema = z.enum(['trending', 'popular', 'newest', 'relevance']);
+export const hookSearchQuerySchema = z.object({
+    q: z.string().trim().max(200).optional(),
+    event: hookEventSchema.optional(),
+    tag: z.string().optional(),
+    sort: hookSortSchema.default('trending'),
+    limit: z.coerce.number().int().min(1).max(100).default(24),
+    offset: z.coerce.number().int().nonnegative().default(0),
+});
+/* ─── Submit-by-URL ────────────────────────────────────────────── */
+/**
+ * `POST /api/v1/hooks/submit` body — a user proposes a GitHub URL,
+ * the worker scans it. The endpoint dedupes pending scans by repo URL
+ * so spamming the form is harmless.
+ */
+export const submitHookByUrlSchema = z.object({
+    repo_url: z
+        .string()
+        .url()
+        .refine((s) => /^https?:\/\/(www\.)?github\.com\//i.test(s), 'Only GitHub repository URLs are supported'),
+});
+/* ─── Worker job payloads ──────────────────────────────────────── */
+/**
+ * `github-hook-scan` queue payload. Scans one GitHub repo for
+ * `hook.json` files + sibling `claude/hooks/*.json`, validates them
+ * against `hookSchema`, secret-scans the command, upserts.
+ */
+export const scanGithubHookJobSchema = z.object({
+    repo_url: z.string().url(),
+    source: z.enum(['manual', 'seed', 'cron', 'submit']),
+    submitted_by: z.string().uuid().optional(),
+});
+/**
+ * `discover-github-hook` queue payload. Wide-scope GitHub code-search
+ * to find any public repo with a `hook.json` we don't already know.
+ */
+export const discoverGithubHookJobSchema = z.object({
+    query: z.string(),
+    max_repos: z.number().int().min(1).max(1000).default(300),
+});
+/** `index-hook` queue payload. */
+export const indexHookJobSchema = z.object({
+    hook_id: z.string().uuid(),
+    op: z.enum(['upsert', 'delete']),
+});
+/** `describe-hook` queue payload — Haiku-generated description. */
+export const describeHookJobSchema = z.object({
+    hook_id: z.string().uuid(),
+    force: z.boolean().optional(),
+});
+/* ─── Bulk sync (mirror of skills bulk sync) ───────────────────── */
+export const hookBulkSyncInputSchema = z.object({
+    slugs: z.array(z.string().min(1).max(120)).min(1).max(250),
+});

package/dist/schemas/index.d.ts

@@ -10,4 +10,7 @@ export * from './install.schema.js';
 export * from './intelligence.schema.js';
 export * from './api-keys.schema.js';
 export * from './skill-report.schema.js';
+export * from './security-audit.schema.js';
+export * from './hook.schema.js';
+export * from './advisor.schema.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/schemas/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/schemas/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,8BAA8B,CAAA;AAC5C,cAAc,yBAAyB,CAAA;AACvC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/schemas/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,8BAA8B,CAAA;AAC5C,cAAc,yBAAyB,CAAA;AACvC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,kBAAkB,CAAA;AAChC,cAAc,qBAAqB,CAAA"}

package/dist/schemas/index.js

@@ -10,3 +10,6 @@ export * from './install.schema.js';
 export * from './intelligence.schema.js';
 export * from './api-keys.schema.js';
 export * from './skill-report.schema.js';
+export * from './security-audit.schema.js';
+export * from './hook.schema.js';
+export * from './advisor.schema.js';

package/dist/schemas/install.schema.d.ts

@@ -124,6 +124,7 @@ export declare const installRowSchema: z.ZodObject<{
             is_creator: boolean;
             is_partner: boolean;
         }>>>;
+        security_rating: z.ZodOptional<z.ZodNullable<z.ZodEnum<["trusted", "low_risk", "med_risk", "critical", "pending"]>>>;
         created_at: z.ZodString;
         updated_at: z.ZodString;
     }, "id" | "updated_at" | "slug" | "name" | "description" | "visibility" | "license">, "strip", z.ZodTypeAny, {

package/dist/schemas/install.schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install.schema.d.ts","sourceRoot":"","sources":["../../src/schemas/install.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,4DAA4D;AAC5D,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;EAMxB,CAAA;AACF,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAA;AAEnD,wDAAwD;AACxD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAU3B,iEAAiE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEjE,CAAA;AACF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAEzD,eAAO,MAAM,wBAAwB;IACnC,0EAA0E;;;;;;EAE1E,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAA"}
+{"version":3,"file":"install.schema.d.ts","sourceRoot":"","sources":["../../src/schemas/install.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,4DAA4D;AAC5D,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;EAMxB,CAAA;AACF,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAA;AAEnD,wDAAwD;AACxD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAU3B,iEAAiE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEjE,CAAA;AACF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAEzD,eAAO,MAAM,wBAAwB;IACnC,0EAA0E;;;;;;EAE1E,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAA"}

package/dist/schemas/search.schema.d.ts

@@ -99,6 +99,7 @@ export declare const skillSearchHitSchema: z.ZodObject<{
         is_creator: boolean;
         is_partner: boolean;
     }>>>;
+    security_rating: z.ZodOptional<z.ZodNullable<z.ZodEnum<["trusted", "low_risk", "med_risk", "critical", "pending"]>>>;
     created_at: z.ZodString;
     updated_at: z.ZodString;
 } & {
@@ -156,6 +157,7 @@ export declare const skillSearchHitSchema: z.ZodObject<{
         is_creator: boolean;
         is_partner: boolean;
     } | null | undefined;
+    security_rating?: "trusted" | "low_risk" | "med_risk" | "critical" | "pending" | null | undefined;
     score?: number | undefined;
     highlight?: Record<string, string[]> | undefined;
 }, {
@@ -210,6 +212,7 @@ export declare const skillSearchHitSchema: z.ZodObject<{
         is_creator: boolean;
         is_partner: boolean;
     } | null | undefined;
+    security_rating?: "trusted" | "low_risk" | "med_risk" | "critical" | "pending" | null | undefined;
     score?: number | undefined;
     highlight?: Record<string, string[]> | undefined;
 }>;

package/dist/schemas/search.schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"search.schema.d.ts","sourceRoot":"","sources":["../../src/schemas/search.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB;;;GAGG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAG/B,CAAA;AACF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAEjE,gDAAgD;AAChD,eAAO,MAAM,mBAAmB;;;;;;;;;EAG9B,CAAA;AACF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAE/D,gDAAgD;AAChD,eAAO,MAAM,mBAAmB;;;;;;;;;EAG9B,CAAA;AACF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAE/D;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB;;IAEjC,iFAAiF;;;;;;;;EAEjF,CAAA;AACF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB;IAClC,kFAAkF;;IAElF,0EAA0E;;;;;;;;EAE1E,CAAA;AACF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA"}
+{"version":3,"file":"search.schema.d.ts","sourceRoot":"","sources":["../../src/schemas/search.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB;;;GAGG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAG/B,CAAA;AACF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAEjE,gDAAgD;AAChD,eAAO,MAAM,mBAAmB;;;;;;;;;EAG9B,CAAA;AACF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAE/D,gDAAgD;AAChD,eAAO,MAAM,mBAAmB;;;;;;;;;EAG9B,CAAA;AACF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAE/D;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB;;IAEjC,iFAAiF;;;;;;;;EAEjF,CAAA;AACF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB;IAClC,kFAAkF;;IAElF,0EAA0E;;;;;;;;EAE1E,CAAA;AACF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA"}

package/dist/schemas/security-audit.schema.d.ts

@@ -0,0 +1,231 @@
+import { z } from 'zod';
+/**
+ * Per-skill security audit shape returned by
+ * `GET /api/v1/skills/:slug/security`. Three independent sources
+ * (GEN · Socket · Snyk) are aggregated into a single overall_rating
+ * using a worst-source-wins rule (see worker `security-audit.job.ts`).
+ *
+ * Missing API keys for Socket/Snyk surface as `unavailable` rather
+ * than crashing the audit — the UI renders them as a hairline-ringed
+ * pill labelled "Audit unavailable" without affecting the trusted/
+ * critical signal from the sources that did run.
+ *
+ * GEN always runs (no external dependency); a `trusted` overall_rating
+ * still requires gen_status = 'safe' even when both vendors are
+ * unavailable.
+ */
+export declare const securityFindingSeveritySchema: z.ZodEnum<["low", "medium", "high", "critical"]>;
+export type SecurityFindingSeverity = z.infer<typeof securityFindingSeveritySchema>;
+export declare const genFindingSchema: z.ZodObject<{
+    pattern: z.ZodString;
+    severity: z.ZodEnum<["warning", "danger"]>;
+    file: z.ZodString;
+    line: z.ZodNumber;
+    snippet: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    pattern: string;
+    severity: "warning" | "danger";
+    file: string;
+    line: number;
+    snippet: string;
+}, {
+    pattern: string;
+    severity: "warning" | "danger";
+    file: string;
+    line: number;
+    snippet: string;
+}>;
+export type GenFinding = z.infer<typeof genFindingSchema>;
+export declare const socketAlertSchema: z.ZodObject<{
+    package: z.ZodString;
+    version: z.ZodOptional<z.ZodString>;
+    type: z.ZodString;
+    severity: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    type: string;
+    package: string;
+    description?: string | undefined;
+    version?: string | undefined;
+    severity?: string | undefined;
+}, {
+    type: string;
+    package: string;
+    description?: string | undefined;
+    version?: string | undefined;
+    severity?: string | undefined;
+}>;
+export type SocketAlert = z.infer<typeof socketAlertSchema>;
+export declare const snykVulnSchema: z.ZodObject<{
+    package: z.ZodString;
+    version: z.ZodOptional<z.ZodString>;
+    id: z.ZodString;
+    severity: z.ZodEnum<["low", "medium", "high", "critical"]>;
+    title: z.ZodString;
+    url: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    id: string;
+    severity: "critical" | "medium" | "low" | "high";
+    package: string;
+    title: string;
+    url?: string | undefined;
+    version?: string | undefined;
+}, {
+    id: string;
+    severity: "critical" | "medium" | "low" | "high";
+    package: string;
+    title: string;
+    url?: string | undefined;
+    version?: string | undefined;
+}>;
+export type SnykVuln = z.infer<typeof snykVulnSchema>;
+export declare const genStatusSchema: z.ZodEnum<["pending", "safe", "warning", "danger", "failed"]>;
+export declare const socketStatusSchema: z.ZodEnum<["pending", "ok", "alerts", "unavailable", "failed"]>;
+export declare const snykStatusSchema: z.ZodEnum<["pending", "ok", "low", "medium", "high", "critical", "unavailable", "failed"]>;
+export declare const overallRatingSchema: z.ZodEnum<["pending", "trusted", "low_risk", "med_risk", "critical"]>;
+export type GenStatus = z.infer<typeof genStatusSchema>;
+export type SocketStatus = z.infer<typeof socketStatusSchema>;
+export type SnykStatus = z.infer<typeof snykStatusSchema>;
+export type OverallRating = z.infer<typeof overallRatingSchema>;
+export declare const skillSecurityAuditSchema: z.ZodObject<{
+    skill_id: z.ZodString;
+    gen_status: z.ZodEnum<["pending", "safe", "warning", "danger", "failed"]>;
+    gen_findings: z.ZodArray<z.ZodObject<{
+        pattern: z.ZodString;
+        severity: z.ZodEnum<["warning", "danger"]>;
+        file: z.ZodString;
+        line: z.ZodNumber;
+        snippet: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        pattern: string;
+        severity: "warning" | "danger";
+        file: string;
+        line: number;
+        snippet: string;
+    }, {
+        pattern: string;
+        severity: "warning" | "danger";
+        file: string;
+        line: number;
+        snippet: string;
+    }>, "many">;
+    socket_status: z.ZodEnum<["pending", "ok", "alerts", "unavailable", "failed"]>;
+    socket_alerts: z.ZodArray<z.ZodObject<{
+        package: z.ZodString;
+        version: z.ZodOptional<z.ZodString>;
+        type: z.ZodString;
+        severity: z.ZodOptional<z.ZodString>;
+        description: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        type: string;
+        package: string;
+        description?: string | undefined;
+        version?: string | undefined;
+        severity?: string | undefined;
+    }, {
+        type: string;
+        package: string;
+        description?: string | undefined;
+        version?: string | undefined;
+        severity?: string | undefined;
+    }>, "many">;
+    snyk_status: z.ZodEnum<["pending", "ok", "low", "medium", "high", "critical", "unavailable", "failed"]>;
+    snyk_vulns: z.ZodArray<z.ZodObject<{
+        package: z.ZodString;
+        version: z.ZodOptional<z.ZodString>;
+        id: z.ZodString;
+        severity: z.ZodEnum<["low", "medium", "high", "critical"]>;
+        title: z.ZodString;
+        url: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
+        severity: "critical" | "medium" | "low" | "high";
+        package: string;
+        title: string;
+        url?: string | undefined;
+        version?: string | undefined;
+    }, {
+        id: string;
+        severity: "critical" | "medium" | "low" | "high";
+        package: string;
+        title: string;
+        url?: string | undefined;
+        version?: string | undefined;
+    }>, "many">;
+    overall_rating: z.ZodEnum<["pending", "trusted", "low_risk", "med_risk", "critical"]>;
+    audited_at: z.ZodNullable<z.ZodString>;
+    updated_at: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    skill_id: string;
+    updated_at: string;
+    gen_status: "pending" | "failed" | "warning" | "danger" | "safe";
+    gen_findings: {
+        pattern: string;
+        severity: "warning" | "danger";
+        file: string;
+        line: number;
+        snippet: string;
+    }[];
+    socket_status: "pending" | "failed" | "ok" | "alerts" | "unavailable";
+    socket_alerts: {
+        type: string;
+        package: string;
+        description?: string | undefined;
+        version?: string | undefined;
+        severity?: string | undefined;
+    }[];
+    snyk_status: "critical" | "pending" | "failed" | "medium" | "low" | "high" | "ok" | "unavailable";
+    snyk_vulns: {
+        id: string;
+        severity: "critical" | "medium" | "low" | "high";
+        package: string;
+        title: string;
+        url?: string | undefined;
+        version?: string | undefined;
+    }[];
+    overall_rating: "trusted" | "low_risk" | "med_risk" | "critical" | "pending";
+    audited_at: string | null;
+}, {
+    skill_id: string;
+    updated_at: string;
+    gen_status: "pending" | "failed" | "warning" | "danger" | "safe";
+    gen_findings: {
+        pattern: string;
+        severity: "warning" | "danger";
+        file: string;
+        line: number;
+        snippet: string;
+    }[];
+    socket_status: "pending" | "failed" | "ok" | "alerts" | "unavailable";
+    socket_alerts: {
+        type: string;
+        package: string;
+        description?: string | undefined;
+        version?: string | undefined;
+        severity?: string | undefined;
+    }[];
+    snyk_status: "critical" | "pending" | "failed" | "medium" | "low" | "high" | "ok" | "unavailable";
+    snyk_vulns: {
+        id: string;
+        severity: "critical" | "medium" | "low" | "high";
+        package: string;
+        title: string;
+        url?: string | undefined;
+        version?: string | undefined;
+    }[];
+    overall_rating: "trusted" | "low_risk" | "med_risk" | "critical" | "pending";
+    audited_at: string | null;
+}>;
+export type SkillSecurityAudit = z.infer<typeof skillSecurityAuditSchema>;
+/**
+ * BullMQ job payload for the worker's `security-audit` queue.
+ * Enqueued from three places:
+ *   • the Postgres trigger (via the outbox-style pending row)
+ *   • scan-github-repo, immediately after a skill upsert
+ *   • the API's manual `POST /skills/:slug/security/rescan`
+ */
+export interface SecurityAuditJob {
+    skill_id: string;
+    trigger?: 'scan' | 'trigger' | 'rescan' | 'backfill' | 'cron';
+}
+//# sourceMappingURL=security-audit.schema.d.ts.map

package/dist/schemas/security-audit.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-audit.schema.d.ts","sourceRoot":"","sources":["../../src/schemas/security-audit.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;;;;;;;;;;;GAcG;AAEH,eAAO,MAAM,6BAA6B,kDAAgD,CAAA;AAC1F,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAA;AAEnF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;EAM3B,CAAA;AACF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAEzD,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;EAM5B,CAAA;AACF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAE3D,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;EAOzB,CAAA;AACF,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAA;AAErD,eAAO,MAAM,eAAe,+DAA6D,CAAA;AACzF,eAAO,MAAM,kBAAkB,iEAM7B,CAAA;AACF,eAAO,MAAM,gBAAgB,4FAS3B,CAAA;AACF,eAAO,MAAM,mBAAmB,uEAM9B,CAAA;AAEF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;AACvD,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAC7D,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AACzD,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAE/D,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAWnC,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAA;AAEzE;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAA;CAC9D"}

package/dist/schemas/security-audit.schema.js

@@ -0,0 +1,76 @@
+import { z } from 'zod';
+/**
+ * Per-skill security audit shape returned by
+ * `GET /api/v1/skills/:slug/security`. Three independent sources
+ * (GEN · Socket · Snyk) are aggregated into a single overall_rating
+ * using a worst-source-wins rule (see worker `security-audit.job.ts`).
+ *
+ * Missing API keys for Socket/Snyk surface as `unavailable` rather
+ * than crashing the audit — the UI renders them as a hairline-ringed
+ * pill labelled "Audit unavailable" without affecting the trusted/
+ * critical signal from the sources that did run.
+ *
+ * GEN always runs (no external dependency); a `trusted` overall_rating
+ * still requires gen_status = 'safe' even when both vendors are
+ * unavailable.
+ */
+export const securityFindingSeveritySchema = z.enum(['low', 'medium', 'high', 'critical']);
+export const genFindingSchema = z.object({
+    pattern: z.string(),
+    severity: z.enum(['warning', 'danger']),
+    file: z.string(),
+    line: z.number().int().nonnegative(),
+    snippet: z.string().max(240),
+});
+export const socketAlertSchema = z.object({
+    package: z.string(),
+    version: z.string().optional(),
+    type: z.string(),
+    severity: z.string().optional(),
+    description: z.string().optional(),
+});
+export const snykVulnSchema = z.object({
+    package: z.string(),
+    version: z.string().optional(),
+    id: z.string(),
+    severity: securityFindingSeveritySchema,
+    title: z.string(),
+    url: z.string().url().optional(),
+});
+export const genStatusSchema = z.enum(['pending', 'safe', 'warning', 'danger', 'failed']);
+export const socketStatusSchema = z.enum([
+    'pending',
+    'ok',
+    'alerts',
+    'unavailable',
+    'failed',
+]);
+export const snykStatusSchema = z.enum([
+    'pending',
+    'ok',
+    'low',
+    'medium',
+    'high',
+    'critical',
+    'unavailable',
+    'failed',
+]);
+export const overallRatingSchema = z.enum([
+    'pending',
+    'trusted',
+    'low_risk',
+    'med_risk',
+    'critical',
+]);
+export const skillSecurityAuditSchema = z.object({
+    skill_id: z.string().uuid(),
+    gen_status: genStatusSchema,
+    gen_findings: z.array(genFindingSchema),
+    socket_status: socketStatusSchema,
+    socket_alerts: z.array(socketAlertSchema),
+    snyk_status: snykStatusSchema,
+    snyk_vulns: z.array(snykVulnSchema),
+    overall_rating: overallRatingSchema,
+    audited_at: z.string().datetime().nullable(),
+    updated_at: z.string().datetime(),
+});

package/dist/schemas/skill-dependency.schema.d.ts

@@ -128,6 +128,7 @@ export declare const dependencyRowSchema: z.ZodObject<{
             is_creator: boolean;
             is_partner: boolean;
         }>>>;
+        security_rating: z.ZodOptional<z.ZodNullable<z.ZodEnum<["trusted", "low_risk", "med_risk", "critical", "pending"]>>>;
         created_at: z.ZodString;
         updated_at: z.ZodString;
     }, "id" | "slug" | "name" | "description" | "visibility">, "strip", z.ZodTypeAny, {

package/dist/schemas/skill-dependency.schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-dependency.schema.d.ts","sourceRoot":"","sources":["../../src/schemas/skill-dependency.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,4EAA4E;AAC5E,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;EAMhC,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEnE;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQ9B,CAAA;AACF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAE/D,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,+DAA+D;AAC/D,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE,kBAAkB,EAAE,CAAA;IAC3B,SAAS,EAAE,kBAAkB,EAAE,CAAA;CAChC;AAED,yEAAyE;AACzE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,GAAG,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAA;CAC3D;AAED,eAAO,MAAM,wBAAwB;;;;;;;;;;;;EAOnC,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAA"}
+{"version":3,"file":"skill-dependency.schema.d.ts","sourceRoot":"","sources":["../../src/schemas/skill-dependency.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,4EAA4E;AAC5E,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;EAMhC,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEnE;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQ9B,CAAA;AACF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAE/D,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,+DAA+D;AAC/D,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE,kBAAkB,EAAE,CAAA;IAC3B,SAAS,EAAE,kBAAkB,EAAE,CAAA;CAChC;AAED,yEAAyE;AACzE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,GAAG,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAA;CAC3D;AAED,eAAO,MAAM,wBAAwB;;;;;;;;;;;;EAOnC,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAA"}

package/dist/schemas/skill.schema.d.ts

@@ -176,6 +176,14 @@ export declare const skillSchema: z.ZodObject<{
         is_creator: boolean;
         is_partner: boolean;
     }>>>;
+    /**
+     * Attached by the API on list + detail GETs once the worker has
+     * audited this skill. `null` = audit row exists but is still
+     * pending; `undefined` = no audit row at all (pre-trigger backlog).
+     * Cards + the detail page render a `SecurityBadge` from this value
+     * so the user can see the rating before opening anything.
+     */
+    security_rating: z.ZodOptional<z.ZodNullable<z.ZodEnum<["trusted", "low_risk", "med_risk", "critical", "pending"]>>>;
     created_at: z.ZodString;
     updated_at: z.ZodString;
 }, "strip", z.ZodTypeAny, {
@@ -230,6 +238,7 @@ export declare const skillSchema: z.ZodObject<{
         is_creator: boolean;
         is_partner: boolean;
     } | null | undefined;
+    security_rating?: "trusted" | "low_risk" | "med_risk" | "critical" | "pending" | null | undefined;
 }, {
     id: string;
     content: string | null;
@@ -282,6 +291,7 @@ export declare const skillSchema: z.ZodObject<{
         is_creator: boolean;
         is_partner: boolean;
     } | null | undefined;
+    security_rating?: "trusted" | "low_risk" | "med_risk" | "critical" | "pending" | null | undefined;
 }>;
 export type Skill = z.infer<typeof skillSchema>;
 export declare const createSkillInputSchema: z.ZodObject<{

package/dist/schemas/skill.schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill.schema.d.ts","sourceRoot":"","sources":["../../src/schemas/skill.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,qBAAqB,kCAAgC,CAAA;AAClE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEnE;;;GAGG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;EAS1B,CAAA;AACF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;AAEvD,iFAAiF;AACjF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;EAO5B,CAAA;AACF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAE3D,eAAO,MAAM,WAAW;;;;;;;;;;;;IAgBtB;;;;;;;;;OASG;;;;;;;IAQH;;;;;OAKG;;;;IAIH,kEAAkE;;;;;;;;;;;;;;;;;;;;;;;IAElE,6DAA6D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAE7D,6EAA6E;;IAE7E,mEAAmE;;IAEnE,+EAA+E;;IAE/E,gGAAgG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAchG,CAAA;AACF,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAA;AAE/C,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;IA4B/B,2EAA2E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAW3E,CAAA;AACJ,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAErE,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEjC,CAAA;AACF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAErE,eAAO,MAAM,eAAe,2DAAyD,CAAA;AACrF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;AAEvD,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;EAOjC,CAAA;AACF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAErE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;EAE9B,CAAA;AACF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAI/D;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B;;IAQzC;;;OAGG;;IAEH;;;;;;;OAOG;;IAEH;;;;;OAKG;;IAEH;;;;;;OAMG;;IAEH;;;;;;;;OAQG;;;;;;;;;;;;;;;;EAEH,CAAA;AACF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAA;AAIrF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB;;;;;;EAE9B,CAAA;AACF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAE/D;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,OAAO,CAAA;IAClB,QAAQ,EAAE,OAAO,CAAA;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,YAAY,EAAE,CAAA;IACrB,6EAA6E;IAC7E,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB"}
+{"version":3,"file":"skill.schema.d.ts","sourceRoot":"","sources":["../../src/schemas/skill.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,qBAAqB,kCAAgC,CAAA;AAClE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEnE;;;GAGG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;EAS1B,CAAA;AACF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;AAEvD,iFAAiF;AACjF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;EAO5B,CAAA;AACF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAE3D,eAAO,MAAM,WAAW;;;;;;;;;;;;IAgBtB;;;;;;;;;OASG;;;;;;;IAQH;;;;;OAKG;;;;IAIH,kEAAkE;;;;;;;;;;;;;;;;;;;;;;;IAElE,6DAA6D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAE7D,6EAA6E;;IAE7E,mEAAmE;;IAEnE,+EAA+E;;IAE/E,gGAAgG;;;;;;;;;;;;;;;;;;;;;;;IAYhG;;;;;;OAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAOH,CAAA;AACF,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAA;AAE/C,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;IA4B/B,2EAA2E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAW3E,CAAA;AACJ,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAErE,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEjC,CAAA;AACF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAErE,eAAO,MAAM,eAAe,2DAAyD,CAAA;AACrF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;AAEvD,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;EAOjC,CAAA;AACF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAErE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;EAE9B,CAAA;AACF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAI/D;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B;;IAQzC;;;OAGG;;IAEH;;;;;;;OAOG;;IAEH;;;;;OAKG;;IAEH;;;;;;OAMG;;IAEH;;;;;;;;OAQG;;;;;;;;;;;;;;;;EAEH,CAAA;AACF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAA;AAIrF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB;;;;;;EAE9B,CAAA;AACF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAE/D;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,OAAO,CAAA;IAClB,QAAQ,EAAE,OAAO,CAAA;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,YAAY,EAAE,CAAA;IACrB,6EAA6E;IAC7E,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB"}

package/dist/schemas/skill.schema.js

@@ -86,6 +86,17 @@ export const skillSchema = z.object({
     })
         .nullable()
         .optional(),
+    /**
+     * Attached by the API on list + detail GETs once the worker has
+     * audited this skill. `null` = audit row exists but is still
+     * pending; `undefined` = no audit row at all (pre-trigger backlog).
+     * Cards + the detail page render a `SecurityBadge` from this value
+     * so the user can see the rating before opening anything.
+     */
+    security_rating: z
+        .enum(['trusted', 'low_risk', 'med_risk', 'critical', 'pending'])
+        .nullable()
+        .optional(),
     created_at: z.string().datetime(),
     updated_at: z.string().datetime(),
 });

package/dist/types/plan-limits.d.ts

@@ -99,6 +99,14 @@ export interface PlanLimits {
     usage_history_days: number | null;
     /** CSV export of usage history. */
     can_usage_export: boolean;
+    /**
+     * Daily call cap on the Contextual Skill Advisor (the prose-
+     * recommendation endpoint). Tiered freemium — every plan can call
+     * the advisor, but Free runs out fast (3) and Max gets the most
+     * (30). Quota lives in Redis fixed-window buckets; see
+     * `apps/api/src/config/rate-limit-buckets.ts`.
+     */
+    advisor_calls_per_day: number;
     /** Public profile page at `/u/<username>`. */
     can_public_profile: boolean;
     /**

package/dist/types/plan-limits.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plan-limits.d.ts","sourceRoot":"","sources":["../../src/types/plan-limits.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAA;AACxD,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAE/D;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,UAAU;IACzB,+EAA+E;IAC/E,KAAK,EAAE,MAAM,CAAA;IACb,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAA;IACf,2EAA2E;IAC3E,iBAAiB,EAAE,MAAM,CAAA;IACzB,gEAAgE;IAChE,gBAAgB,EAAE,MAAM,CAAA;IACxB,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAA;IACZ,0DAA0D;IAC1D,SAAS,EAAE,OAAO,CAAA;IAGlB,+EAA+E;IAC/E,YAAY,EAAE,OAAO,CAAA;IACrB,8BAA8B;IAC9B,YAAY,EAAE,OAAO,CAAA;IACrB;;;;;;;;OAQG;IACH,mBAAmB,EAAE,OAAO,CAAA;IAG5B;;;OAGG;IACH,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,4BAA4B;IAC5B,YAAY,EAAE,OAAO,CAAA;IACrB,wDAAwD;IACxD,cAAc,EAAE,OAAO,CAAA;IACvB,yCAAyC;IACzC,sBAAsB,EAAE,OAAO,CAAA;IAG/B,0CAA0C;IAC1C,oBAAoB,EAAE,OAAO,CAAA;IAC7B,0CAA0C;IAC1C,qBAAqB,EAAE,OAAO,CAAA;IAC9B;;OAEG;IACH,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,oDAAoD;IACpD,kBAAkB,EAAE,OAAO,CAAA;IAG3B,gDAAgD;IAChD,gBAAgB,EAAE,OAAO,CAAA;IACzB;;;;;OAKG;IACH,wBAAwB,EAAE,MAAM,GAAG,IAAI,CAAA;IACvC;;;;;;;;OAQG;IACH,wBAAwB,EAAE,MAAM,GAAG,IAAI,CAAA;IACvC;;;;;OAKG;IACH,yBAAyB,EAAE,OAAO,CAAA;IAClC,uDAAuD;IACvD,aAAa,EAAE,OAAO,CAAA;IACtB,qCAAqC;IACrC,kBAAkB,EAAE,OAAO,CAAA;IAC3B;;;OAGG;IACH,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,mCAAmC;IACnC,gBAAgB,EAAE,OAAO,CAAA;IAGzB,8CAA8C;IAC9C,kBAAkB,EAAE,OAAO,CAAA;IAC3B;;;OAGG;IACH,oBAAoB,EAAE,OAAO,CAAA;IAC7B,oDAAoD;IACpD,kBAAkB,EAAE,OAAO,CAAA;IAC3B,mEAAmE;IACnE,kBAAkB,EAAE,OAAO,CAAA;IAG3B,6CAA6C;IAC7C,oBAAoB,EAAE,OAAO,CAAA;IAC7B,+CAA+C;IAC/C,gBAAgB,EAAE,OAAO,CAAA;IAGzB;;;;;OAKG;IACH,mBAAmB,EAAE,SAAS,SAAS,EAAE,CAAA;CAC1C;AAKD,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,CAyJhD,CAAA;AAED,eAAO,MAAM,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAI1C,CAAA;AAED,8DAA8D;AAC9D,eAAO,MAAM,SAAS,GAAI,QAAQ,IAAI,EAAE,UAAU,IAAI,KAAG,OACf,CAAA;AAE1C;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,UAAU,KAAG,IAAI,GAAG,IAU7D,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,SAAS,GAAI,MAAM,IAAI,KAAG,MAAiC,CAAA;AAExE;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAAI,MAAM,IAAI,EAAE,eAAe,MAAM,KAAG,MAAM,GAAG,IAI9E,CAAA"}
+{"version":3,"file":"plan-limits.d.ts","sourceRoot":"","sources":["../../src/types/plan-limits.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAA;AACxD,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAE/D;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,UAAU;IACzB,+EAA+E;IAC/E,KAAK,EAAE,MAAM,CAAA;IACb,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAA;IACf,2EAA2E;IAC3E,iBAAiB,EAAE,MAAM,CAAA;IACzB,gEAAgE;IAChE,gBAAgB,EAAE,MAAM,CAAA;IACxB,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAA;IACZ,0DAA0D;IAC1D,SAAS,EAAE,OAAO,CAAA;IAGlB,+EAA+E;IAC/E,YAAY,EAAE,OAAO,CAAA;IACrB,8BAA8B;IAC9B,YAAY,EAAE,OAAO,CAAA;IACrB;;;;;;;;OAQG;IACH,mBAAmB,EAAE,OAAO,CAAA;IAG5B;;;OAGG;IACH,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,4BAA4B;IAC5B,YAAY,EAAE,OAAO,CAAA;IACrB,wDAAwD;IACxD,cAAc,EAAE,OAAO,CAAA;IACvB,yCAAyC;IACzC,sBAAsB,EAAE,OAAO,CAAA;IAG/B,0CAA0C;IAC1C,oBAAoB,EAAE,OAAO,CAAA;IAC7B,0CAA0C;IAC1C,qBAAqB,EAAE,OAAO,CAAA;IAC9B;;OAEG;IACH,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,oDAAoD;IACpD,kBAAkB,EAAE,OAAO,CAAA;IAG3B,gDAAgD;IAChD,gBAAgB,EAAE,OAAO,CAAA;IACzB;;;;;OAKG;IACH,wBAAwB,EAAE,MAAM,GAAG,IAAI,CAAA;IACvC;;;;;;;;OAQG;IACH,wBAAwB,EAAE,MAAM,GAAG,IAAI,CAAA;IACvC;;;;;OAKG;IACH,yBAAyB,EAAE,OAAO,CAAA;IAClC,uDAAuD;IACvD,aAAa,EAAE,OAAO,CAAA;IACtB,qCAAqC;IACrC,kBAAkB,EAAE,OAAO,CAAA;IAC3B;;;OAGG;IACH,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,mCAAmC;IACnC,gBAAgB,EAAE,OAAO,CAAA;IAGzB;;;;;;OAMG;IACH,qBAAqB,EAAE,MAAM,CAAA;IAG7B,8CAA8C;IAC9C,kBAAkB,EAAE,OAAO,CAAA;IAC3B;;;OAGG;IACH,oBAAoB,EAAE,OAAO,CAAA;IAC7B,oDAAoD;IACpD,kBAAkB,EAAE,OAAO,CAAA;IAC3B,mEAAmE;IACnE,kBAAkB,EAAE,OAAO,CAAA;IAG3B,6CAA6C;IAC7C,oBAAoB,EAAE,OAAO,CAAA;IAC7B,+CAA+C;IAC/C,gBAAgB,EAAE,OAAO,CAAA;IAGzB;;;;;OAKG;IACH,mBAAmB,EAAE,SAAS,SAAS,EAAE,CAAA;CAC1C;AAKD,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,CA+JhD,CAAA;AAED,eAAO,MAAM,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAI1C,CAAA;AAED,8DAA8D;AAC9D,eAAO,MAAM,SAAS,GAAI,QAAQ,IAAI,EAAE,UAAU,IAAI,KAAG,OACf,CAAA;AAE1C;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,UAAU,KAAG,IAAI,GAAG,IAU7D,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,SAAS,GAAI,MAAM,IAAI,KAAG,MAAiC,CAAA;AAExE;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAAI,MAAM,IAAI,EAAE,eAAe,MAAM,KAAG,MAAM,GAAG,IAI9E,CAAA"}

package/dist/types/plan-limits.js

@@ -37,6 +37,7 @@ export const PLAN_LIMITS = {
         can_usage_tracking: false,
         usage_history_days: 0,
         can_usage_export: false,
+        advisor_calls_per_day: 3,
         can_public_profile: false,
         can_magic_link_share: false,
         has_verified_badge: false,
@@ -80,6 +81,7 @@ export const PLAN_LIMITS = {
         can_usage_tracking: true,
         usage_history_days: 30,
         can_usage_export: false,
+        advisor_calls_per_day: 10,
         can_public_profile: true,
         can_magic_link_share: false,
         has_verified_badge: true,
@@ -121,6 +123,7 @@ export const PLAN_LIMITS = {
         can_usage_tracking: true,
         usage_history_days: null,
         can_usage_export: true,
+        advisor_calls_per_day: 30,
         can_public_profile: true,
         can_magic_link_share: true,
         has_verified_badge: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prave/shared",
-  "version": "1.4.16",
+  "version": "1.5.1",
   "type": "module",
   "publishConfig": {
     "access": "public"