code-ai-installer 1.3.0 → 1.4.0

package/locales/en/.agents/data_model/SKILL.md

@@ -1,285 +0,0 @@
----
-name: data_model
-description: Model data and strategy store — normalization/denormalization, indexes, transactions, cache, (optional) event sourcing/eventual consistency — with trade-offs and tied to UX flows.
----
-
-# Skill: Data Model
-
-Model data: from entity definitions to query optimization.
-
-**Sections:**
-1. [Inputs](#1-inputs)
-2. [Entity Definition Template](#2-entity-template)
-3. [ER Diagram](#3-er-diagram)
-4. [Data Patterns](#4-data-patterns)
-5. [Index Strategy](#5-indexes)
-6. [Query Pattern Mapping](#6-query-mapping)
-7. [Transactions](#7-transactions)
-8. [Migrations](#8-migrations)
-9. [Example: full model](#9-example)
-10. [Output Template](#10-output)
-
----
-
-## 1. Inputs
-
-| Input | From | Why |
-|------|--------|-------|
-| PRD | PM gate | Acceptance criteria → entities, constraints |
-| UX Spec | UX gate | Screens/flows → query patterns |
-| API Contracts | Architect | Request/Response → fields, types |
-| NFR | System Design | Volume, latency, retention |
-
----
-
-## 2. Entity Definition Template
-
-For each entity:
-
-```markdown
-### Entity: Coupon
-
-**Collection:** `coupons`
-**Lifecycle:** Created by site owner, read by embedded script, deleted manually
-
-| Field | Type | Required | Default | Constraints | Description |
-|-------|------|----------|---------|-------------|-------------|
-| _id | ObjectId | auto | auto | unique | Primary key |
-| appInstanceId | string | ✅ | — | indexed | Installation reference |
-| code | string | ✅ | — | 3-20 chars, uppercase, alphanumeric | Coupon code |
-| discount | number | ✅ | — | 1-100 | Discount value |
-| type | string | ✅ | "percent" | enum: percent, fixed | Discount type |
-| active | boolean | ⬜ | true | — | Is coupon active |
-| usageCount | number | ⬜ | 0 | min: 0 | Times used |
-| createdAt | Date | auto | now | — | Timestamp |
-| updatedAt | Date | auto | now | — | Timestamp |
-
-**Unique constraints:** (appInstanceId, code)
-**Indexes:** See Index Strategy
-**Relationships:** belongs to Installation (via appInstanceId)
-**Storage pattern:** Reference (separate collection)
-**Rationale:** Coupons have independent lifecycle, unbounded per installation
-```
-
----
-
-## 3. ER Diagram
-
-```mermaid
-erDiagram
-    INSTALLATION ||--|| SETTINGS : "has one"
-    INSTALLATION ||--o{ COUPON : "has many"
-
-    INSTALLATION {
-        ObjectId _id PK
-        string appInstanceId UK
-        string instanceId
-        string siteUrl
-        string status
-        Date installedAt
-    }
-
-    SETTINGS {
-        ObjectId _id PK
-        string appInstanceId UK "FK → Installation"
-        object overlay
-        object cta
-        object tab
-        object timer
-        string designStyle
-        string templateId
-        object templateSettings
-    }
-
-    COUPON {
-        ObjectId _id PK
-        string appInstanceId "FK → Installation"
-        string code
-        number discount
-        string type
-        boolean active
-        number usageCount
-        Date createdAt
-    }
-```
-
----
-
-## 4. Data Patterns
-
-### Embed vs Reference Decision
-
-| Criterion | Embed ✅ | Reference ✅ |
-|---------|---------|-------------|
-| Are read together | Yes | No |
-| Independent lifecycle | No | Yes |
-| Bounded size | Yes (< 50 items) | Unbounded |
-| Atomic updates child | Needed | Not critical |
-
-### Decision table (for project)
-
-| Parent | Child | Pattern | Rationale |
-|--------|-------|---------|-----------|
-| Installation | Settings | **Embed** (or 1:1 ref) | Always are read together, 1 settings per install |
-| Installation | Coupons | **Reference** | Independent CRUD, unbounded, own pagination |
-| Settings | overlay/cta/tab | **Embed** | Bounded subdocuments, always read together |
-
-> Each choice embed/reference = a potential ADR. If it is not obvious — create `$adr_log`.
-
-### Caching (if applicable)
-
-| Data | Cache? | Strategy | TTL | Invalidation |
-|------|--------|----------|-----|-------------|
-| Widget config | ✅ | HTTP Cache-Control | 60s | PUT settings → purge |
-| Coupon list | ⬜ | No cache (small, dashboard only) | — | — |
-| Settings (dashboard) | ⬜ | No cache (always fresh) | — | — |
-
----
-
-## 5. Index Strategy
-
-### Index → Query Pattern Mapping
-
-| Index | Fields | Type | Serves Query |
-|-------|--------|------|-------------|
-| `installations_appInstanceId` | `{ appInstanceId: 1 }` | unique | Lookup by appInstanceId |
-| `settings_appInstanceId` | `{ appInstanceId: 1 }` | unique | Lookup settings by install |
-| `coupons_app_code` | `{ appInstanceId: 1, code: 1 }` | unique | Duplicate check on create |
-| `coupons_app_active_date` | `{ appInstanceId: 1, active: 1, createdAt: -1 }` | compound | List active coupons sorted by date |
-| `coupons_app_date` | `{ appInstanceId: 1, createdAt: -1 }` | compound | List all coupons sorted |
-
-### Index rules
-
-| Rule | Description |
-|---------|---------|
-| **ESR** | Equality → Sort → Range (order fields in compound) |
-| **Max 5-7** | Each index = write overhead |
-| **Verify** | `explain('executionStats')` → IXSCAN, not COLLSCAN |
-| **Partial** | If index needed not for all docs: `partialFilterExpression` |
-
----
-
-## 6. Query Pattern Mapping
-
-Mapping UX screen → query:
-
-| UX Screen | Action | Query | Index Used |
-|-----------|--------|-------|------------|
-| Dashboard: Coupons list | Load page | `find({ appInstanceId }).sort({ createdAt: -1 }).limit(20)` | `coupons_app_date` |
-| Dashboard: Coupons list | Filter active | `find({ appInstanceId, active: true }).sort({ createdAt: -1 })` | `coupons_app_active_date` |
-| Dashboard: Coupons list | Search by code | `find({ appInstanceId, code: { $regex } })` | `coupons_app_code` (prefix) |
-| Dashboard: Settings | Load | `findOne({ appInstanceId })` | `settings_appInstanceId` |
-| Dashboard: Settings | Save | `updateOne({ appInstanceId }, { $set: ... })` | `settings_appInstanceId` |
-| Embedded Script | Load config | `findOne({ appInstanceId })` + `findOne({ appInstanceId, active: true }).sort({ createdAt: -1 })` | `settings_appInstanceId` + `coupons_app_active_date` |
-| Webhook: install | Create | `updateOne({ appInstanceId }, { ... }, { upsert: true })` | `installations_appInstanceId` |
-
-### Performance notes
-
-| Query | Expected latency | Volume | Notes |
-|-------|-----------------|--------|-------|
-| Widget config | < 10ms | Every page view | Add cache header |
-| Coupons list | < 20ms | Dashboard only | Paginated |
-| Settings load | < 5ms | Dashboard only | Single doc |
-
----
-
-## 7. Transactions
-
-### When needed
-
-| Scenario | Transaction? | Rationale |
-|----------|:---:|-----------|
-| Create coupon | ⬜ No | Single collection write |
-| Update settings | ⬜ No | Single document update |
-| Apply coupon (if order system) | ✅ Yes | Multi-doc: update order + increment usage |
-| Install webhook (upsert install + settings) | ⬜ No | Idempotent upserts, eventual consistency OK |
-
-### Rule
-
-> MongoDB any modeling, where transactions needed **rarely**. If transaction needed often — revisit schema (can is worth embed).
-
----
-
-## 8. Migrations
-
-### Strategy
-
-| When | How |
-|-------|-----|
-| New field (optional) | Add in schema + `$setOnInsert` default |
-| New field (required) | Migration script: `updateMany` + backfill |
-| Rename field | Migration script + update code + period with both fields |
-| Remove field | Migration script: `$unset` + remove from schema |
-| Change type | Two steps: add new field → migrate data → remove old |
-
-### Tool
-
-```bash
-npx migrate-mongo create add-templateId-to-settings
-npx migrate-mongo up
-npx migrate-mongo down   # rollback
-npx migrate-mongo status
-```
-
----
-
-## 9. Example: full model
-
-```markdown
-# Data Model: Smart Cart Rescue
-
-## Entities
-1. Installation — Wix app installation record
-2. Settings — Widget configuration (1:1 with Installation)
-3. Coupon — Discount coupons (1:N with Installation)
-
-## Storage
-- MongoDB 7 (single instance, Docker)
-- Mongoose ODM (strict: 'throw')
-- Timestamps on all collections
-
-## Key decisions
-- Settings embedded approach considered, but separate collection for independent API
-- Coupons always referenced (unbounded, independent CRUD)
-- See ADR-001 (MongoDB), ADR-003 (embed vs reference)
-```
-
----
-
-## 10. Output Template
-
-```markdown
-# Data Model: <project-name>
-
-**Date:** YYYY-MM-DD
-**Database:** MongoDB 7 + Mongoose
-
-## ER Diagram
-<mermaid diagram>
-
-## Entities
-<for each entity: section 2 template>
-
-## Data Patterns
-<embed vs ref decisions with rationale>
-
-## Indexes
-<section 5 table>
-
-## Query Mapping
-<section 6 table>
-
-## Transactions
-<section 7 table>
-
-## Migration Strategy
-<section 8>
-```
-
----
-
-## See also
-- `$api_contracts` — API endpoints (schemas match entity fields)
-- `$mongodb_mongoose_best_practices` — implementation patterns
-- `$architecture_doc` — Architecture Document (data model section)
-- `$adr_log` — ADR for embed/reference/DB decisions

package/locales/en/.agents/data_model/agents/claude.json

@@ -1,17 +0,0 @@
-{
-  "name": "data_model",
-  "display_name": "Data Model",
-  "description": "Model data and strategy store — normalization/denormalization, indexes, transactions, cache, (optional) event sourcing/eventual consistency — with trade-offs and tied to UX flows.",
-  "default_prompt": "Use $data_model when the task matches the \"Data Model\" skill.",
-  "triggers": [
-    "data_model",
-    "data model",
-    "Model data and strategy store — normalization/denormalization, indexes, transactions, cache, (optional) event sourcing/eventual consistency — with trade-offs and tied to UX flows"
-  ],
-  "capabilities": [
-    "data",
-    "model"
-  ],
-  "tools": [],
-  "implicit_invocation": true
-}

package/locales/en/.agents/data_model/agents/copilot.json

@@ -1,17 +0,0 @@
-{
-  "name": "data_model",
-  "display_name": "Data Model",
-  "description": "Model data and strategy store — normalization/denormalization, indexes, transactions, cache, (optional) event sourcing/eventual consistency — with trade-offs and tied to UX flows.",
-  "default_prompt": "Use $data_model when the task matches the \"Data Model\" skill.",
-  "triggers": [
-    "data_model",
-    "data model",
-    "Model data and strategy store — normalization/denormalization, indexes, transactions, cache, (optional) event sourcing/eventual consistency — with trade-offs and tied to UX flows"
-  ],
-  "capabilities": [
-    "data",
-    "model"
-  ],
-  "tools": [],
-  "implicit_invocation": true
-}

package/locales/en/.agents/data_model/agents/gemini.json

@@ -1,17 +0,0 @@
-{
-  "name": "data_model",
-  "display_name": "Data Model",
-  "description": "Model data and strategy store — normalization/denormalization, indexes, transactions, cache, (optional) event sourcing/eventual consistency — with trade-offs and tied to UX flows.",
-  "default_prompt": "Use $data_model when the task matches the \"Data Model\" skill.",
-  "triggers": [
-    "data_model",
-    "data model",
-    "Model data and strategy store — normalization/denormalization, indexes, transactions, cache, (optional) event sourcing/eventual consistency — with trade-offs and tied to UX flows"
-  ],
-  "capabilities": [
-    "data",
-    "model"
-  ],
-  "tools": [],
-  "implicit_invocation": true
-}

package/locales/en/.agents/data_model/agents/openai.yaml

@@ -1,8 +0,0 @@
-interface:
-  display_name: "Data Model"
-  short_description: "Model data and strategy store — normalization/denormalization, indexes, transactions, cache, (o…"
-  default_prompt: "Use $data_model when the task matches the \"Data Model\" skill."
-dependencies:
-  tools: []
-policy:
-  allow_implicit_invocation: true

package/locales/en/.agents/data_model/agents/qwen.json

@@ -1,17 +0,0 @@
-{
-  "name": "data_model",
-  "display_name": "Data Model",
-  "description": "Model data and strategy store — normalization/denormalization, indexes, transactions, cache, (optional) event sourcing/eventual consistency — with trade-offs and tied to UX flows.",
-  "default_prompt": "Use $data_model when the task matches the \"Data Model\" skill.",
-  "triggers": [
-    "data_model",
-    "data model",
-    "Model data and strategy store — normalization/denormalization, indexes, transactions, cache, (optional) event sourcing/eventual consistency — with trade-offs and tied to UX flows"
-  ],
-  "capabilities": [
-    "data",
-    "model"
-  ],
-  "tools": [],
-  "implicit_invocation": true
-}

package/locales/en/.agents/data_model/agents/skill.yaml

@@ -1,21 +0,0 @@
-version: 1
-name: "data_model"
-display_name: "Data Model"
-description: "Model data and strategy store — normalization/denormalization, indexes, transactions, cache, (optional) event sourcing/eventual consistency — with trade-offs and tied to UX flows."
-default_prompt: "Use $data_model when the task matches the \"Data Model\" skill."
-triggers:
-  - "data_model"
-  - "data model"
-  - "Model data and strategy store — normalization/denormalization, indexes, transactions, cache, (optional) event sourcing/eventual consistency — with trade-offs and tied to UX flows"
-capabilities:
-  - "data"
-  - "model"
-tools: []
-invocation:
-  explicit: true
-  implicit: true
-localization:
-  default_locale: "en"
-  available_locales:
-    - "ru"
-    - "en"

package/locales/en/.agents/dependency_supply_chain_review/SKILL.md

@@ -1,300 +0,0 @@
----
-name: dependency_supply_chain_review
-description: Review dependencies — minimization, updates, audit vulnerability, licenses, ban unsafe packages.
----
-
-#Skill: Dependency & Supply Chain Review
-
-Audit npm-dependencies: vulnerabilities, licenses, suspicious packages.
-
-**Sections:**
-1. [When to activate](#1-when)
-2. [Audit Commands](#2-audit)
-3. [Checklist](#3-checklist)
-4. [Red Flags](#4-red-flags)
-5. [License Policy](#5-licenses)
-6. [Decision Framework](#6-decision)
-7. [CI Integration](#7-ci)
-8. [Output Template](#8-output)
-
----
-
-## 1. When to activate
-
-| Trigger | Action |
-|---------|--------|
-| New dependency added | Full review of the package |
-| PR with `package.json` / `package-lock.json` changes | Diff review + audit |
-| Periodic review (monthly) | Full audit |
-| Security alert (GitHub Dependabot, npm advisory) | Targeted review |
-| Major version upgrade | Changelog review + test |
-| Pre-release gate | Full audit as part of RG checklist |
-
----
-
-## 2. Audit Commands
-
-### Essential commands
-
-```bash
-# Vulnerability audit (fail on high/critical)
-npm audit --audit-level=high
-
-# Detailed audit (JSON for parsing)
-npm audit --json
-
-# List outdated packages
-npm outdated
-
-# Check licenses
-npx license-checker --summary
-
-# Check licenses with allowed list
-npx license-checker --onlyAllow "MIT;ISC;BSD-2-Clause;BSD-3-Clause;Apache-2.0"
-
-# Find unused dependencies
-npx depcheck
-
-# Package size analysis
-npx cost-of-modules
-
-# Check package popularity/health
-npx npm-check
-
-# Lock file integrity
-npm ci --dry-run
-```
-
-### Grep for suspicious patterns
-
-```bash
-# Postinstall scripts (supply chain attack vector)
-grep_search: Query="postinstall" SearchPath="package.json"
-grep_search: Query="preinstall" SearchPath="package.json"
-
-# Native bindings (potential security risk)
-grep_search: Query="node-gyp" SearchPath="package-lock.json"
-grep_search: Query="prebuild" SearchPath="package-lock.json"
-```
-
----
-
-## 3. Checklist
-
-### 3.1 Necessity
-
-| # | Check | Severity | Status |
-|---|-------|----------|--------|
-| DEP-01 | Each dependency is actually used (no dead deps) | 🟠 P1 | ☐ |
-| DEP-02 | No duplicate packages for same purpose (e.g. 2 date libs) | 🟠 P1 | ☐ |
-| DEP-03 | Could be replaced with native API (e.g. `fetch` vs `axios`, `crypto` vs `uuid`) | 🟡 P2 | ☐ |
-| DEP-04 | Dev dependencies are in `devDependencies`, not `dependencies` | 🟠 P1 | ☐ |
-
-### 3.2 Security
-
-| # | Check | Severity | Status |
-|---|-------|----------|--------|
-| DEP-05 | `npm audit` — no high/critical vulnerabilities | 🔴 P0 | ☐ |
-| DEP-06 | `package-lock.json` committed and up to date | 🔴 P0 | ☐ |
-| DEP-07 | No `npm install` with `--force` or `--legacy-peer-deps` (unless justified) | 🟠 P1 | ☐ |
-| DEP-08 | No postinstall scripts from untrusted packages | 🔴 P0 | ☐ |
-| DEP-09 | Packages use well-known publishers (npm org verified) | 🟠 P1 | ☐ |
-
-### 3.3 Maintenance
-
-| # | Check | Severity | Status |
-|---|-------|----------|--------|
-| DEP-10 | No abandoned packages (last publish > 2 years, no maintainer) | 🟠 P1 | ☐ |
-| DEP-11 | Major version not overly outdated (< 2 major versions behind) | 🟠 P1 | ☐ |
-| DEP-12 | Critical deps have alternatives identified (bus factor) | 🟡 P2 | ☐ |
-| DEP-13 | Version pinning strategy defined (exact vs range vs caret) | 🟡 P2 | ☐ |
-
-### 3.4 License
-
-| # | Check | Severity | Status |
-|---|-------|----------|--------|
-| DEP-14 | All licenses are permissive (MIT, ISC, BSD, Apache-2.0) | 🟠 P1 | ☐ |
-| DEP-15 | No GPL/AGPL/SSPL in production dependencies (if proprietary project) | 🔴 P0 | ☐ |
-| DEP-16 | No UNLICENSED packages in production | 🟠 P1 | ☐ |
-
----
-
-## 4. Red Flags
-
-### Package red flags
-
-| 🚩 Red Flag | Risk | Example |
-|------------|------|---------|
-| **Typosquatting** | Malicious package with similar name | `lodahs` instead of `lodash` |
-| **No README / empty repo** | Placeholder for attack | New package with 0 downloads |
-| **Excessive permissions** | postinstall runs arbitrary code | `"postinstall": "curl | sh"` |
-| **Single maintainer, no org** | Bus factor = 1, takeover risk | Unmaintained personal project |
-| **Version 0.0.x** | Unstable, breaking changes | Not ready for production |
-| **Last publish > 2 years** | Abandoned, no security patches | `is-promise` (1 line, 3M downloads) |
-| **Huge transitive deps** | Giant attack surface | One util bringing 100+ sub-deps |
-| **Native bindings** | Build-time vulnerabilities | `node-gyp` based packages |
-| **Filesystem / network access** | Unexpected side effects | Package writes to disk or phones home |
-
-### Quick health check for new dependency
-
-```markdown
-Before adding `npm install <package>`:
-
-1. ☐ npm page: weekly downloads > 10K? last publish < 1 year?
-2. ☐ GitHub: stars > 100? open issues managed? CI passing?
-3. ☐ License: MIT/ISC/BSD/Apache?
-4. ☐ Bundle size: acceptable? (bundlephobia.com)
-5. ☐ Alternatives: is there a smaller/native option?
-6. ☐ Transitive deps: how many sub-dependencies?
-```
-
----
-
-## 5. License Policy
-
-### Allowed licenses (production)
-
-| License | Status | Notes |
-|---------|--------|-------|
-| MIT | ✅ Allowed | Most permissive |
-| ISC | ✅ Allowed | npm default |
-| BSD-2-Clause | ✅ Allowed | Permissive |
-| BSD-3-Clause | ✅ Allowed | Permissive |
-| Apache-2.0 | ✅ Allowed | Patent grant included |
-| 0BSD | ✅ Allowed | Public domain equivalent |
-| CC0-1.0 | ✅ Allowed | Public domain |
-| Unlicense | ⚠️ Review | May have legal ambiguity |
-| GPL-2.0 | ❌ Blocked | Copyleft, infectious |
-| GPL-3.0 | ❌ Blocked | Copyleft, infectious |
-| AGPL-3.0 | ❌ Blocked | Most restrictive copyleft |
-| SSPL | ❌ Blocked | MongoDB's copyleft variant |
-| UNLICENSED | ❌ Blocked | No license = all rights reserved |
-
----
-
-## 6. Decision Framework
-
-### Keep vs Remove vs Replace
-
-```
-New dependency request:
-                          ┌──────────────────────────┐
-                          │ Is it actually needed?     │
-                          └────┬────────────┬──────────┘
-                               │ Yes        │ No
-                               ▼            ▼
-                          ┌────────┐    REMOVE
-                          │ Native │
-                          │ API?   │
-                          └─┬────┬─┘
-                       Yes  │    │ No
-                            ▼    ▼
-                         REMOVE  ┌────────────┐
-                                 │ Audit pass? │
-                                 └─┬────────┬──┘
-                              Yes  │        │ No
-                                   ▼        ▼
-                              ┌─────────┐  FIND
-                              │ License │  ALTERNATIVE
-                              │  OK?    │
-                              └─┬─────┬─┘
-                             Yes │    │ No
-                                 ▼    ▼
-                               ADD   FIND
-                                     ALTERNATIVE
-```
-
-### Alternatives for common packages
-
-| Package | Size | Alternative | Size |
-|---------|------|-------------|------|
-| `moment` | 290KB | `dayjs` (2KB) or native `Intl` | 0-2KB |
-| `lodash` | 530KB | `lodash-es` (tree-shakeable) or native | 0-70KB |
-| `axios` | 29KB | native `fetch` | 0KB |
-| `uuid` | 18KB | `crypto.randomUUID()` | 0KB |
-| `chalk` | 15KB | `picocolors` (2KB) | 2KB |
-| `dotenv` | 7KB | native `--env-file` (Node 20.6+) | 0KB |
-| `express-validator` | 35KB | `zod` (already in stack) | 0KB extra |
-
----
-
-## 7. CI Integration
-
-### GitHub Actions
-
-```yaml
-dependency-review:
-  runs-on: ubuntu-latest
-  steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-node@v4
-      with: { node-version: 20 }
-
-    # Vulnerability check
-    - name: npm audit
-      run: npm audit --audit-level=high
-
-    # License check
-    - name: License compliance
-      run: npx license-checker --onlyAllow "MIT;ISC;BSD-2-Clause;BSD-3-Clause;Apache-2.0;0BSD"
-
-    # Unused deps
-    - name: Depcheck
-      run: npx depcheck --ignores="@types/*,vitest"
-
-    # PR dependency review (for pull requests)
-    - name: Dependency Review
-      if: github.event_name == 'pull_request'
-      uses: actions/dependency-review-action@v4
-      with:
-        fail-on-severity: high
-        deny-licenses: GPL-2.0, GPL-3.0, AGPL-3.0
-```
-
----
-
-## 8. Output Template
-
-```markdown
-# Dependency & Supply Chain Review
-
-**Date:** YYYY-MM-DD
-**Reviewer:** Reviewer Agent
-**Total deps:** production: XX, dev: YY
-
-## Audit Results
-| Check | Result |
-|-------|--------|
-| npm audit | ✅ No high/critical |
-| License check | ⚠️ 1 GPL package found |
-| Unused deps | ✅ All used |
-| Outdated (major) | ⚠️ 3 packages behind |
-
-## Findings
-
-| # | Severity | Package | Finding | Action |
-|---|----------|---------|---------|--------|
-| 1 | 🔴 P0 | `event-stream@3.3.6` | Known supply chain attack | Remove immediately |
-| 2 | 🟠 P1 | `moment@2.29.1` | 290KB, abandoned | Replace with dayjs |
-| 3 | 🟠 P1 | `some-lib@0.1.0` | GPL-3.0 license | Replace or get legal approval |
-| 4 | 🟡 P2 | `lodash@4.17.21` | Only using `debounce` | Replace with `lodash.debounce` or native |
-
-## New Dependencies (this PR)
-| Package | Version | Size | License | Downloads/week | Verdict |
-|---------|---------|------|---------|----------------|---------|
-| `zod` | 3.22.0 | 13KB | MIT | 8M | ✅ Approved |
-
-## Summary
-- P0: X findings (must fix)
-- P1: Y findings (should fix)
-- P2: Z findings (optional)
-- Total bundle impact: +XX KB
-```
-
----
-
-## See also
-- `$security_review` — application security review
-- `$security_baseline_dev` — secure coding patterns
-- `$cloud_infrastructure_security` — CI/CD pipeline security
-- `$tooling_bun_biome` — package manager setup