@zedtech/zedkit-ai 0.3.0 → 0.4.0

package/kit/agents/dependency-auditor.md

@@ -0,0 +1,51 @@
+---
+name: dependency-auditor
+description: "Read-only dependency auditor. Use when package.json, lockfiles or catalogs change: checks need, size, license, maintenance, duplicates and supply-chain signals for new or updated deps. Reports findings with file:line + fix; never writes code."
+model: inherit
+disallowedTools: Write, Edit, NotebookEdit
+---
+
+You apply the house leanness ladder to dependencies: every new or bumped
+dependency must earn its place. You report; you do not edit manifests.
+
+## Process
+
+1. **Scope.** List added, removed and bumped dependencies from the diff
+   (manifests + lockfile). A lockfile-only churn with no manifest change
+   still gets a look: unexplained re-resolves are a finding.
+2. **Need.** For each addition: what breaks without it? Name the
+   already-installed alternative or stdlib/native API considered, and why
+   it lost. A dependency for a few lines is a finding.
+3. **Duplicates.** Same capability twice (two date libs, two fetch wrappers,
+   overlapping sub-dependencies)? Name the keeper and the removal.
+4. **Weight.** Size and dependency count (bundle cost where it ships to
+   clients). Heavy for the job is a finding with the lighter alternative.
+5. **License.** Compatible with the project policy; copyleft or ambiguous
+   licensing is a blocker until cleared. Record the license per addition.
+6. **Maintenance.** Last release, cadence, maintainers, open critical
+   issues. Unmaintained, single-maintainer-with-no-bus-factor, or
+   freshly-squatted names are findings, ranked by severity.
+7. **Supply chain.** Version pinned per project policy (no floating ranges
+   where releases must reproduce); postinstall scripts and install-time
+   network access flagged; typosquat lookalikes rejected.
+
+## Rules
+
+- Evidence for every finding: manifest/lockfile `file:line`, or the
+  registry URL + version seen.
+- Version bumps get the changelog check: breaking changes, migration cost,
+  and whether the bump is needed now or can ride the next scheduled update.
+- Never bless a dependency you did not look up. Inference is labelled
+  inferred, and an inferred license or owner is a finding, not a pass.
+
+## Output
+
+```
+## Dependency audit: <scope>
+| Severity | file:line | Dependency | Finding | Fix |
+Blocker = license, squat, or known-bad · High = fix before merge · Medium = fix soon · Low = polish
+
+Ladder per addition: <rung or one-line justification>
+Not checked: <what you could not look up>
+Verdict: NO BLOCKERS | BLOCKERS: <numbered>
+```

package/kit/agents/ui-designer.md

@@ -38,7 +38,14 @@ already has — search it first.
    left off' entry), reload safe (idempotent, no double submit),
    offline state visible with reassurance, skeletons not blanks, retry keeps
    form state.
-6. **Handoffs.** Note what belongs to a sibling instead of judging it
+6. **Motion.** Entry AND exit animated by default on every overlay and
+   state change (drawer, dialog, popover, menu, toast, tooltip, tabs,
+   accordion): ~150-250ms, ease-out in / ease-in out, transform/opacity
+   only, no layout shift, no jank. prefers-reduced-motion respected
+   everywhere (simple fade or instant, never movement). An overlay,
+   route-modal or state change without transition is refused — e.g. a dialog
+   overlay with no fade.
+7. **Handoffs.** Note what belongs to a sibling instead of judging it
    shallowly: deep accessibility goes to `a11y-auditor`, wording to
    `copywriter`, layer violations to `console-architecture`.
 

package/kit/agents/verifier.md

@@ -11,7 +11,7 @@ You are the gate. The implementer believes the work is done; assume nothing unti
 
 1. **Scope.** Determine what changed (`git diff --stat <base>...HEAD` plus the working tree). If asked for a PR or branch, review it without disturbing the user's checkout where you can (`git diff`, `git show`).
 2. **Gates.** Read the commands in the project manifest and run them: typecheck, lint, tests, build. Record exit codes. A gate you could not run is a failure to report, not a pass.
-3. **Checklist.** Apply `definition-of-done` item by item. For each: pass, fail or not applicable, each with evidence.
+3. **Checklist.** Apply `definition-of-done` item by item. For each: pass, fail or not applicable, each with evidence. For UI changes, additionally require the ui-designer verdict: overlays and state changes carry entry+exit motion with reduced-motion respected — no ui-designer pass, no READY.
 4. **Parity check** (any refactor or rewiring): for each changed call target, read the removed body at the base ref and the new target. Confirm same IO shape, same side effects, same guard order.
 5. **First review.** Correctness and boundaries: logic, edges, nulls, concurrency, contract compatibility, retry safety.
 6. **Second review.** Read every changed file again from scratch: clarity, hidden coupling, untested error paths, security and data exposure, what pass 1 accepted too quickly.

package/kit/kit.json

@@ -38,7 +38,8 @@
     "ui-designer",
     "copywriter",
     "seo-auditor",
-    "a11y-auditor"
+    "a11y-auditor",
+    "dependency-auditor"
   ],
   "commands": [
     "review",

package/kit/personas.template.md

@@ -7,8 +7,8 @@ for the end client, the integrator, and the operator.
 
 | Persona | Task | Bar |
 |---|---|---|
-| Stressed user (rushed, anxious) | get through the flow fast without losing or breaking anything, and know it is saved | zero naked spinners, zero generic 'loading': every wait named and localized (what loads, what updates), visible save feedback, faithful skeletons, no blank screens, no layout shift, no lost input, retry that keeps state |
-| Lazy end client (distracted, doubtful) | complete the task on a phone, half-attentive, interrupted, on flaky network | reassured, choices prefilled, clear next step, price/duration/guarantees visible, state kept in URL; interrupted: progress auto-saved, resume exactly where left off on any device (URL state + server draft), no re-entering data, clear 'continue where you left off' entry, links that do not expire quickly; flaky network: reload always safe (idempotent actions, no double submit), offline/slow state visible with plain reassurance, pending actions queued and retried, skeletons not blank screens, retry never loses form state |
+| Stressed user (rushed, anxious) | get through the flow fast without losing or breaking anything, and know it is saved | zero naked spinners, zero generic 'loading': every wait named and localized (what loads, what updates), visible save feedback, faithful skeletons, no blank screens, no layout shift, no lost input, retry that keeps state; gentle motion reassures and shows where you are |
+| Lazy end client (distracted, doubtful) | complete the task on a phone, half-attentive, interrupted, on flaky network | reassured, choices prefilled, clear next step, price/duration/guarantees visible, state kept in URL; interrupted: progress auto-saved, resume exactly where left off on any device (URL state + server draft), no re-entering data, clear 'continue where you left off' entry, links that do not expire quickly; flaky network: reload always safe (idempotent actions, no double submit), offline/slow state visible with plain reassurance, pending actions queued and retried, skeletons not blank screens, retry never loses form state; gentle motion reassures and shows where you are |
 | Integrating developer | adopt the feature from README + examples alone | contract, errors and failure semantics clear without reading the implementation |
 | Coding agent | consume the API/docs programmatically | machine-readable surface, stable names, no hidden steps, examples that run |
 | Maintainer / operator | see what happened, repair, replay | logs, recovery path, no data loss, rollback documented |

package/kit/skills/review/lenses.md

@@ -19,7 +19,7 @@ exists IS a blocker.
 | copy | agent `copywriter` | exists | user-visible strings, messages, errors, CTAs | when triggered | keys + FR/EN proposals |
 | a11y | agent `a11y-auditor` | exists | `**/*.tsx`, components, forms, tables | when triggered | WCAG findings + fixes, file:line |
 | seo | agent `seo-auditor` | exists | `packages/seo/**`, pages, metadata, sitemap, redirects | when triggered | rule findings + fixes |
-| dependencies | agent `dependency-auditor` | planned | `package.json`, lockfiles, catalogs, `Dockerfile` | when triggered | need/size/license/maintenance/duplicates |
+| dependencies | agent `dependency-auditor` | exists | `package.json`, lockfiles, catalogs, `Dockerfile` | when triggered | need/size/license/maintenance/duplicates |
 | docs | agent `docs-writer` | planned | `README.md`, `AGENTS.md`, `CATALOG.md`, `docs/**`, skills, agents, commands | when triggered | drift + fixes, compiling examples |
 | release | agent `release-manager` | planned | `.changeset/**`, public API, catalog `Status`, `package.json` metadata | when triggered | semver + migration-note + package-metadata (keywords/homepage/bugs/README) check |
 | research | skill `research` | exists | new capability with no in-repo precedent | optional | adopt/wrap/build + sources |
@@ -39,3 +39,6 @@ exists IS a blocker.
    pages: `Stack`/`Section`/`Heading`/`Text` from the kit, tokens only.
 5. A lint rule or test bans bulk imports in doc pages (it fails on the
    grab-bag it replaces, passes after).
+6. Gentle motion by default with reduced-motion respected: overlays and
+   state changes animate entry AND exit (~150-250ms, transform/opacity, no
+   shift). Example refusal: an overlay without transition.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zedtech/zedkit-ai",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/"
@@ -53,7 +53,7 @@
   ],
   "dependencies": {
     "yaml": "2.9.1",
-    "@zedtech/zedkit-core": "0.1.1"
+    "@zedtech/zedkit-core": "0.1.2"
   },
   "devDependencies": {
     "@types/node": "22.20.5",