@skillmark/webapp 0.1.0

package/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "@skillmark/webapp",
+  "version": "0.1.0",
+  "description": "Skillmark leaderboard webapp (Cloudflare Workers)",
+  "type": "module",
+  "main": "./src/worker-entry-point.ts",
+  "dependencies": {
+    "hono": "^4.0.0"
+  },
+  "devDependencies": {
+    "@cloudflare/workers-types": "^4.20240117.0",
+    "typescript": "^5.3.3",
+    "wrangler": "^3.22.0"
+  },
+  "scripts": {
+    "dev": "wrangler dev",
+    "deploy": "wrangler deploy",
+    "lint": "tsc --noEmit",
+    "db:create": "wrangler d1 create skillmark-db",
+    "db:migrate": "wrangler d1 execute skillmark-db --file=./src/db/schema.sql"
+  }
+}

package/src/db/d1-database-schema.sql

@@ -0,0 +1,69 @@
+-- Skillmark D1 Database Schema
+-- Run with: wrangler d1 execute skillmark-db --file=./src/db/d1-database-schema.sql
+
+-- Skills table: stores skill metadata
+CREATE TABLE IF NOT EXISTS skills (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL,
+  source TEXT,
+  description TEXT,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  updated_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+-- Results table: stores benchmark results
+CREATE TABLE IF NOT EXISTS results (
+  id TEXT PRIMARY KEY,
+  skill_id TEXT NOT NULL REFERENCES skills(id),
+  model TEXT NOT NULL,
+  accuracy REAL NOT NULL,
+  tokens_total INTEGER NOT NULL,
+  tokens_input INTEGER,
+  tokens_output INTEGER,
+  duration_ms INTEGER NOT NULL,
+  cost_usd REAL NOT NULL,
+  tool_count INTEGER,
+  runs INTEGER NOT NULL,
+  hash TEXT NOT NULL,
+  raw_json TEXT,
+  security_score REAL,
+  security_json TEXT,
+  repo_url TEXT,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+-- API keys table: stores user API keys for publishing
+CREATE TABLE IF NOT EXISTS api_keys (
+  id TEXT PRIMARY KEY,
+  key_hash TEXT NOT NULL UNIQUE,
+  user_name TEXT,
+  email TEXT,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  last_used_at INTEGER
+);
+
+-- Indexes for common queries
+CREATE INDEX IF NOT EXISTS idx_results_skill_id ON results(skill_id);
+CREATE INDEX IF NOT EXISTS idx_results_accuracy ON results(accuracy DESC);
+CREATE INDEX IF NOT EXISTS idx_results_created_at ON results(created_at DESC);
+CREATE INDEX IF NOT EXISTS idx_skills_name ON skills(name);
+CREATE INDEX IF NOT EXISTS idx_api_keys_hash ON api_keys(key_hash);
+
+-- View for leaderboard (best result per skill, composite scoring)
+CREATE VIEW IF NOT EXISTS leaderboard AS
+SELECT
+  s.id as skill_id,
+  s.name as skill_name,
+  s.source,
+  MAX(r.accuracy) as best_accuracy,
+  MAX(r.security_score) as best_security,
+  (MAX(r.accuracy) * 0.80 + COALESCE(MAX(r.security_score), 0) * 0.20) as composite_score,
+  (SELECT model FROM results WHERE skill_id = s.id ORDER BY accuracy DESC LIMIT 1) as best_model,
+  AVG(r.tokens_total) as avg_tokens,
+  AVG(r.cost_usd) as avg_cost,
+  MAX(r.created_at) as last_tested,
+  SUM(r.runs) as total_runs
+FROM skills s
+JOIN results r ON r.skill_id = s.id
+GROUP BY s.id
+ORDER BY composite_score DESC;

package/src/db/migrations/001-add-github-oauth-and-user-session-tables.sql

@@ -0,0 +1,40 @@
+-- Migration: Add GitHub OAuth fields and enhanced result tracking
+-- Run with: wrangler d1 execute skillmark-db --file=./src/db/migrations/001-github-oauth-fields.sql
+
+-- Add GitHub profile fields to api_keys table
+ALTER TABLE api_keys ADD COLUMN github_username TEXT;
+ALTER TABLE api_keys ADD COLUMN github_avatar TEXT;
+ALTER TABLE api_keys ADD COLUMN github_id INTEGER;
+
+-- Add submitter and test data fields to results table
+ALTER TABLE results ADD COLUMN submitter_github TEXT;
+ALTER TABLE results ADD COLUMN test_files TEXT;  -- JSON array of test file contents
+ALTER TABLE results ADD COLUMN skillsh_link TEXT;
+
+-- Create users table for session management
+CREATE TABLE IF NOT EXISTS users (
+  id TEXT PRIMARY KEY,
+  github_id INTEGER NOT NULL UNIQUE,
+  github_username TEXT NOT NULL,
+  github_avatar TEXT,
+  github_email TEXT,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  updated_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+-- Create sessions table for OAuth session management
+CREATE TABLE IF NOT EXISTS sessions (
+  id TEXT PRIMARY KEY,
+  user_id TEXT NOT NULL REFERENCES users(id),
+  expires_at INTEGER NOT NULL,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+-- Index for faster session lookups
+CREATE INDEX IF NOT EXISTS idx_sessions_user_id ON sessions(user_id);
+CREATE INDEX IF NOT EXISTS idx_sessions_expires_at ON sessions(expires_at);
+CREATE INDEX IF NOT EXISTS idx_users_github_id ON users(github_id);
+CREATE INDEX IF NOT EXISTS idx_api_keys_github_id ON api_keys(github_id);
+
+-- Update api_keys to reference users
+-- Note: existing keys remain valid but won't have user association

package/src/db/migrations/002-add-security-benchmark-columns.sql

@@ -0,0 +1,30 @@
+-- Migration: Add security benchmark columns and composite leaderboard
+-- Run: wrangler d1 execute skillmark-db --file=./src/db/migrations/002-add-security-benchmark-columns.sql
+
+-- Add security columns to results
+ALTER TABLE results ADD COLUMN security_score REAL;
+ALTER TABLE results ADD COLUMN security_json TEXT;
+
+-- Replace leaderboard view with composite scoring
+DROP VIEW IF EXISTS leaderboard;
+
+CREATE VIEW leaderboard AS
+SELECT
+  s.id as skill_id,
+  s.name as skill_name,
+  s.source,
+  MAX(r.accuracy) as best_accuracy,
+  MAX(r.security_score) as best_security,
+  (MAX(r.accuracy) * 0.80 + COALESCE(MAX(r.security_score), 0) * 0.20) as composite_score,
+  (SELECT model FROM results WHERE skill_id = s.id ORDER BY accuracy DESC LIMIT 1) as best_model,
+  AVG(r.tokens_total) as avg_tokens,
+  AVG(r.cost_usd) as avg_cost,
+  MAX(r.created_at) as last_tested,
+  SUM(r.runs) as total_runs
+FROM skills s
+JOIN results r ON r.skill_id = s.id
+GROUP BY s.id
+ORDER BY composite_score DESC;
+
+-- Index for security score queries
+CREATE INDEX IF NOT EXISTS idx_results_security_score ON results(security_score);

package/src/db/migrations/003-add-repo-url-and-update-composite-formula.sql

@@ -0,0 +1,27 @@
+-- Migration: Add repo_url column and update composite score formula (80/20)
+-- Run: wrangler d1 execute skillmark-db --file=./src/db/migrations/003-add-repo-url-and-update-composite-formula.sql
+
+-- Add repo_url column to results
+ALTER TABLE results ADD COLUMN repo_url TEXT;
+
+-- Update leaderboard view with new composite formula (80% accuracy + 20% security)
+DROP VIEW IF EXISTS leaderboard;
+
+CREATE VIEW leaderboard AS
+SELECT
+  s.id as skill_id,
+  s.name as skill_name,
+  s.source,
+  MAX(r.accuracy) as best_accuracy,
+  MAX(r.security_score) as best_security,
+  (MAX(r.accuracy) * 0.80 + COALESCE(MAX(r.security_score), 0) * 0.20) as composite_score,
+  (SELECT model FROM results WHERE skill_id = s.id ORDER BY accuracy DESC LIMIT 1) as best_model,
+  (SELECT repo_url FROM results WHERE skill_id = s.id AND repo_url IS NOT NULL ORDER BY created_at DESC LIMIT 1) as repo_url,
+  AVG(r.tokens_total) as avg_tokens,
+  AVG(r.cost_usd) as avg_cost,
+  MAX(r.created_at) as last_tested,
+  SUM(r.runs) as total_runs
+FROM skills s
+JOIN results r ON r.skill_id = s.id
+GROUP BY s.id
+ORDER BY composite_score DESC;

package/src/routes/api-endpoints-handler.ts

@@ -0,0 +1,380 @@
+/**
+ * API endpoints handler for Skillmark leaderboard
+ */
+import { Hono } from 'hono';
+
+type Bindings = {
+  DB: D1Database;
+};
+
+export const apiRouter = new Hono<{ Bindings: Bindings }>();
+
+/** Result submission payload */
+interface ResultPayload {
+  skillId: string;
+  skillName: string;
+  source: string;
+  model: string;
+  accuracy: number;
+  tokensTotal: number;
+  tokensInput?: number;
+  tokensOutput?: number;
+  durationMs: number;
+  costUsd: number;
+  toolCount?: number;
+  runs: number;
+  hash: string;
+  timestamp: string;
+  rawJson?: string;
+  // New fields for GitHub OAuth + enhanced tracking
+  testFiles?: Array<{ name: string; content: string }>;
+  skillshLink?: string;
+  /** Security benchmark score (0-100) */
+  securityScore?: number;
+  /** Full security breakdown JSON */
+  securityJson?: string;
+  /** Git repository URL (auto-detected from skill directory) */
+  repoUrl?: string;
+}
+
+/** API key info returned from verification */
+interface ApiKeyInfo {
+  githubUsername: string | null;
+  githubAvatar: string | null;
+}
+
+/**
+ * POST /api/results - Submit benchmark results
+ */
+apiRouter.post('/results', async (c) => {
+  try {
+    // Verify API key and get user info
+    const authHeader = c.req.header('Authorization');
+    if (!authHeader?.startsWith('Bearer ')) {
+      return c.json({ error: 'Missing or invalid API key' }, 401);
+    }
+
+    const apiKey = authHeader.slice(7);
+    const keyInfo = await verifyApiKeyAndGetInfo(c.env.DB, apiKey);
+    if (!keyInfo) {
+      return c.json({ error: 'Invalid API key' }, 401);
+    }
+
+    // Parse payload
+    const payload = await c.req.json<ResultPayload>();
+
+    // Validate required fields
+    if (!payload.skillId || !payload.skillName || !payload.model || !payload.hash) {
+      return c.json({ error: 'Missing required fields' }, 400);
+    }
+
+    // Validate model
+    if (!['haiku', 'sonnet', 'opus'].includes(payload.model)) {
+      return c.json({ error: 'Invalid model' }, 400);
+    }
+
+    // Validate accuracy range
+    if (payload.accuracy < 0 || payload.accuracy > 100) {
+      return c.json({ error: 'Accuracy must be between 0 and 100' }, 400);
+    }
+
+    // Ensure skill exists
+    await ensureSkillExists(c.env.DB, payload.skillId, payload.skillName, payload.source);
+
+    // Insert result with new fields
+    const resultId = crypto.randomUUID();
+    await c.env.DB.prepare(`
+      INSERT INTO results (
+        id, skill_id, model, accuracy, tokens_total, tokens_input, tokens_output,
+        duration_ms, cost_usd, tool_count, runs, hash, raw_json,
+        submitter_github, test_files, skillsh_link,
+        security_score, security_json, repo_url
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).bind(
+      resultId,
+      payload.skillId,
+      payload.model,
+      payload.accuracy,
+      payload.tokensTotal,
+      payload.tokensInput ?? null,
+      payload.tokensOutput ?? null,
+      payload.durationMs,
+      payload.costUsd,
+      payload.toolCount ?? null,
+      payload.runs,
+      payload.hash,
+      payload.rawJson || null,
+      keyInfo.githubUsername || null,
+      payload.testFiles ? JSON.stringify(payload.testFiles) : null,
+      payload.skillshLink || null,
+      payload.securityScore ?? null,
+      payload.securityJson || null,
+      payload.repoUrl || null
+    ).run();
+
+    // Update API key last used
+    await updateApiKeyLastUsed(c.env.DB, apiKey);
+
+    // Get rank
+    const rank = await getSkillRank(c.env.DB, payload.skillId);
+
+    return c.json({
+      success: true,
+      resultId,
+      leaderboardUrl: `https://skillmark.sh/?skill=${encodeURIComponent(payload.skillName)}`,
+      rank,
+      submitter: keyInfo.githubUsername ? {
+        github: keyInfo.githubUsername,
+        avatar: keyInfo.githubAvatar,
+      } : null,
+    });
+  } catch (error) {
+    console.error('Error submitting result:', error);
+    return c.json({ error: 'Internal server error' }, 500);
+  }
+});
+
+/**
+ * GET /api/leaderboard - Get skill rankings
+ */
+apiRouter.get('/leaderboard', async (c) => {
+  try {
+    const limit = Math.min(parseInt(c.req.query('limit') || '20'), 100);
+    const offset = parseInt(c.req.query('offset') || '0');
+
+    const results = await c.env.DB.prepare(`
+      SELECT
+        skill_id as skillId,
+        skill_name as skillName,
+        source,
+        best_accuracy as bestAccuracy,
+        best_security as bestSecurity,
+        composite_score as compositeScore,
+        best_model as bestModel,
+        repo_url as repoUrl,
+        avg_tokens as avgTokens,
+        avg_cost as avgCost,
+        last_tested as lastTested,
+        total_runs as totalRuns
+      FROM leaderboard
+      LIMIT ? OFFSET ?
+    `).bind(limit, offset).all();
+
+    // Format timestamps
+    const entries = results.results?.map((row: Record<string, unknown>) => ({
+      ...row,
+      lastTested: row.lastTested
+        ? new Date((row.lastTested as number) * 1000).toISOString()
+        : null,
+    })) || [];
+
+    return c.json({ entries });
+  } catch (error) {
+    console.error('Error fetching leaderboard:', error);
+    return c.json({ error: 'Internal server error' }, 500);
+  }
+});
+
+/**
+ * GET /api/skill/:name - Get specific skill details
+ */
+apiRouter.get('/skill/:name', async (c) => {
+  try {
+    const skillName = decodeURIComponent(c.req.param('name'));
+
+    // Get skill from leaderboard view
+    const skill = await c.env.DB.prepare(`
+      SELECT
+        skill_id as skillId,
+        skill_name as skillName,
+        source,
+        best_accuracy as bestAccuracy,
+        best_security as bestSecurity,
+        composite_score as compositeScore,
+        best_model as bestModel,
+        repo_url as repoUrl,
+        avg_tokens as avgTokens,
+        avg_cost as avgCost,
+        last_tested as lastTested,
+        total_runs as totalRuns
+      FROM leaderboard
+      WHERE skill_name = ?
+    `).bind(skillName).first();
+
+    if (!skill) {
+      return c.json({ error: 'Skill not found' }, 404);
+    }
+
+    // Get result history
+    const history = await c.env.DB.prepare(`
+      SELECT
+        id,
+        accuracy,
+        model,
+        tokens_total as tokensTotal,
+        duration_ms as durationMs,
+        cost_usd as costUsd,
+        tool_count as toolCount,
+        security_score as securityScore,
+        created_at as date
+      FROM results
+      WHERE skill_id = ?
+      ORDER BY created_at DESC
+      LIMIT 20
+    `).bind(skill.skillId).all();
+
+    const formattedHistory = history.results?.map((row: Record<string, unknown>) => ({
+      id: row.id,
+      accuracy: row.accuracy,
+      model: row.model,
+      tokensTotal: row.tokensTotal ?? null,
+      durationMs: row.durationMs ?? null,
+      costUsd: row.costUsd ?? null,
+      toolCount: row.toolCount ?? null,
+      securityScore: row.securityScore ?? null,
+      date: row.date ? new Date((row.date as number) * 1000).toISOString() : null,
+    })) || [];
+
+    return c.json({
+      ...skill,
+      lastTested: skill.lastTested
+        ? new Date((skill.lastTested as number) * 1000).toISOString()
+        : null,
+      history: formattedHistory,
+    });
+  } catch (error) {
+    console.error('Error fetching skill:', error);
+    return c.json({ error: 'Internal server error' }, 500);
+  }
+});
+
+/**
+ * GET /api/result/:id - Get full result detail (parsed raw_json)
+ */
+apiRouter.get('/result/:id', async (c) => {
+  try {
+    const id = c.req.param('id');
+
+    const result = await c.env.DB.prepare(`
+      SELECT raw_json FROM results WHERE id = ?
+    `).bind(id).first();
+
+    if (!result?.raw_json) {
+      return c.json({ error: 'Result not found or no detailed data available' }, 404);
+    }
+
+    return c.json(JSON.parse(result.raw_json as string));
+  } catch (error) {
+    console.error('Error fetching result detail:', error);
+    return c.json({ error: 'Internal server error' }, 500);
+  }
+});
+
+/**
+ * POST /api/verify - Verify API key
+ */
+apiRouter.post('/verify', async (c) => {
+  try {
+    const authHeader = c.req.header('Authorization');
+    if (!authHeader?.startsWith('Bearer ')) {
+      return c.json({ valid: false }, 401);
+    }
+
+    const apiKey = authHeader.slice(7);
+    const isValid = await verifyApiKey(c.env.DB, apiKey);
+
+    return c.json({ valid: isValid });
+  } catch (error) {
+    return c.json({ valid: false }, 500);
+  }
+});
+
+/**
+ * Verify API key against database
+ */
+async function verifyApiKey(db: D1Database, apiKey: string): Promise<boolean> {
+  const keyHash = await hashApiKey(apiKey);
+
+  const result = await db.prepare(`
+    SELECT id FROM api_keys WHERE key_hash = ?
+  `).bind(keyHash).first();
+
+  return result !== null;
+}
+
+/**
+ * Verify API key and return associated user info
+ */
+async function verifyApiKeyAndGetInfo(db: D1Database, apiKey: string): Promise<ApiKeyInfo | null> {
+  const keyHash = await hashApiKey(apiKey);
+
+  const result = await db.prepare(`
+    SELECT github_username, github_avatar FROM api_keys WHERE key_hash = ?
+  `).bind(keyHash).first();
+
+  if (!result) {
+    return null;
+  }
+
+  return {
+    githubUsername: result.github_username as string | null,
+    githubAvatar: result.github_avatar as string | null,
+  };
+}
+
+/**
+ * Update API key last used timestamp
+ */
+async function updateApiKeyLastUsed(db: D1Database, apiKey: string): Promise<void> {
+  const keyHash = await hashApiKey(apiKey);
+
+  await db.prepare(`
+    UPDATE api_keys SET last_used_at = unixepoch() WHERE key_hash = ?
+  `).bind(keyHash).run();
+}
+
+/**
+ * Hash API key for storage using Web Crypto API
+ */
+async function hashApiKey(apiKey: string): Promise<string> {
+  const encoder = new TextEncoder();
+  const data = encoder.encode(apiKey);
+  const hashBuffer = await crypto.subtle.digest('SHA-256', data);
+  const hashArray = Array.from(new Uint8Array(hashBuffer));
+  return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
+}
+
+/**
+ * Ensure skill exists in database
+ */
+async function ensureSkillExists(
+  db: D1Database,
+  skillId: string,
+  skillName: string,
+  source: string
+): Promise<void> {
+  const existing = await db.prepare(`
+    SELECT id FROM skills WHERE id = ?
+  `).bind(skillId).first();
+
+  if (!existing) {
+    await db.prepare(`
+      INSERT INTO skills (id, name, source) VALUES (?, ?, ?)
+    `).bind(skillId, skillName, source).run();
+  }
+}
+
+/**
+ * Get skill rank in leaderboard
+ */
+async function getSkillRank(db: D1Database, skillId: string): Promise<number | null> {
+  const result = await db.prepare(`
+    SELECT COUNT(*) + 1 as rank
+    FROM leaderboard
+    WHERE composite_score > (
+      SELECT composite_score FROM leaderboard WHERE skill_id = ?
+    )
+  `).bind(skillId).first();
+
+  return result?.rank as number || null;
+}