@skillsmith/core 0.1.0

package/dist/tests/webhooks/WebhookHandler.idempotency.test.js

@@ -0,0 +1,190 @@
+/**
+ * Idempotency tests for WebhookHandler using X-GitHub-Delivery
+ *
+ * These tests verify that duplicate webhook deliveries are detected
+ * and handled idempotently using the X-GitHub-Delivery header.
+ */
+import { describe, it, expect, beforeEach } from 'vitest';
+import { WebhookHandler, } from '../../src/webhooks/WebhookHandler.js';
+import { WebhookQueue } from '../../src/webhooks/WebhookQueue.js';
+import { createHmac } from 'crypto';
+describe('WebhookHandler Idempotency', () => {
+    const TEST_SECRET = 'test-webhook-secret';
+    function createSignature(payload) {
+        return `sha256=${createHmac('sha256', TEST_SECRET).update(payload).digest('hex')}`;
+    }
+    function createValidPushPayload() {
+        return {
+            ref: 'refs/heads/main',
+            before: 'abc123',
+            after: 'def456',
+            created: false,
+            deleted: false,
+            forced: false,
+            base_ref: null,
+            compare: 'https://github.com/owner/repo/compare/abc123...def456',
+            commits: [
+                {
+                    id: 'def456',
+                    tree_id: 'tree123',
+                    distinct: true,
+                    message: 'Add SKILL.md',
+                    timestamp: '2024-01-01T00:00:00Z',
+                    url: 'https://github.com/owner/repo/commit/def456',
+                    author: { name: 'Test', email: 'test@example.com' },
+                    committer: { name: 'Test', email: 'test@example.com' },
+                    added: ['.claude/skills/test/SKILL.md'],
+                    removed: [],
+                    modified: [],
+                },
+            ],
+            head_commit: null,
+            repository: {
+                id: 123,
+                name: 'repo',
+                full_name: 'owner/repo',
+                private: false,
+                owner: { login: 'owner', id: 1, type: 'User' },
+                html_url: 'https://github.com/owner/repo',
+                description: null,
+                fork: false,
+                url: 'https://api.github.com/repos/owner/repo',
+                created_at: '2024-01-01T00:00:00Z',
+                updated_at: '2024-01-01T00:00:00Z',
+                pushed_at: '2024-01-01T00:00:00Z',
+                homepage: null,
+                size: 0,
+                stargazers_count: 0,
+                watchers_count: 0,
+                language: 'TypeScript',
+                forks_count: 0,
+                archived: false,
+                disabled: false,
+                open_issues_count: 0,
+                topics: [],
+                visibility: 'public',
+                default_branch: 'main',
+            },
+            pusher: { name: 'test', email: 'test@example.com' },
+            sender: { login: 'test', id: 1, type: 'User' },
+        };
+    }
+    let handler;
+    let queue;
+    let processedItems;
+    beforeEach(() => {
+        processedItems = [];
+        queue = new WebhookQueue({
+            debounceMs: 0,
+            maxRetries: 0,
+            retryDelayMs: 0,
+            processor: async (item) => {
+                processedItems.push(item);
+            },
+        });
+        handler = new WebhookHandler({
+            secret: TEST_SECRET,
+            queue,
+            onLog: () => { },
+        });
+    });
+    describe('X-GitHub-Delivery handling', () => {
+        it('should process first delivery normally', async () => {
+            const payload = JSON.stringify(createValidPushPayload());
+            const signature = createSignature(payload);
+            const deliveryId = 'unique-delivery-id-123';
+            const result = await handler.handleWebhook('push', payload, signature, deliveryId);
+            expect(result.success).toBe(true);
+            expect(result.changesDetected).toBe(1);
+            expect(result.itemsQueued).toBe(1);
+        });
+        it('should detect and skip duplicate deliveries', async () => {
+            const payload = JSON.stringify(createValidPushPayload());
+            const signature = createSignature(payload);
+            const deliveryId = 'duplicate-delivery-id';
+            // First delivery - should process
+            const result1 = await handler.handleWebhook('push', payload, signature, deliveryId);
+            expect(result1.success).toBe(true);
+            expect(result1.itemsQueued).toBe(1);
+            // Second delivery with same ID - should skip
+            const result2 = await handler.handleWebhook('push', payload, signature, deliveryId);
+            expect(result2.success).toBe(true);
+            expect(result2.message).toContain('Duplicate delivery');
+            expect(result2.itemsQueued).toBe(0);
+        });
+        it('should process deliveries with different IDs', async () => {
+            const payload = JSON.stringify(createValidPushPayload());
+            const signature = createSignature(payload);
+            const result1 = await handler.handleWebhook('push', payload, signature, 'delivery-1');
+            const result2 = await handler.handleWebhook('push', payload, signature, 'delivery-2');
+            expect(result1.success).toBe(true);
+            expect(result1.itemsQueued).toBe(1);
+            expect(result2.success).toBe(true);
+            expect(result2.itemsQueued).toBe(1);
+        });
+        it('should still work when deliveryId is not provided', async () => {
+            const payload = JSON.stringify(createValidPushPayload());
+            const signature = createSignature(payload);
+            // Without delivery ID, duplicates cannot be detected
+            const result1 = await handler.handleWebhook('push', payload, signature);
+            const result2 = await handler.handleWebhook('push', payload, signature);
+            expect(result1.success).toBe(true);
+            expect(result2.success).toBe(true);
+            // Both should process since no delivery ID to track
+        });
+    });
+    describe('delivery ID cleanup', () => {
+        it('should limit stored delivery IDs to prevent memory growth', async () => {
+            const payload = JSON.stringify(createValidPushPayload());
+            const signature = createSignature(payload);
+            // Process many unique deliveries
+            for (let i = 0; i < 15000; i++) {
+                await handler.handleWebhook('push', payload, signature, `delivery-${i}`);
+            }
+            // Verify that old delivery IDs are cleaned up
+            // The implementation should keep only the last N deliveries
+            const stats = handler.getDeliveryStats?.();
+            if (stats) {
+                expect(stats.trackedDeliveries).toBeLessThanOrEqual(10000);
+            }
+        });
+        it('should still detect recent duplicates after cleanup', async () => {
+            const payload = JSON.stringify(createValidPushPayload());
+            const signature = createSignature(payload);
+            // Process many deliveries
+            for (let i = 0; i < 5000; i++) {
+                await handler.handleWebhook('push', payload, signature, `delivery-${i}`);
+            }
+            // Try to replay a recent delivery
+            const result = await handler.handleWebhook('push', payload, signature, 'delivery-4999');
+            expect(result.message).toContain('Duplicate delivery');
+        });
+    });
+    describe('idempotency edge cases', () => {
+        it('should handle empty delivery ID as no delivery ID', async () => {
+            const payload = JSON.stringify(createValidPushPayload());
+            const signature = createSignature(payload);
+            const result1 = await handler.handleWebhook('push', payload, signature, '');
+            const result2 = await handler.handleWebhook('push', payload, signature, '');
+            // Empty string should be treated as no ID
+            expect(result1.success).toBe(true);
+            expect(result2.success).toBe(true);
+        });
+        it('should handle concurrent duplicate deliveries', async () => {
+            const payload = JSON.stringify(createValidPushPayload());
+            const signature = createSignature(payload);
+            const deliveryId = 'concurrent-delivery';
+            // Simulate concurrent delivery
+            const [result1, result2] = await Promise.all([
+                handler.handleWebhook('push', payload, signature, deliveryId),
+                handler.handleWebhook('push', payload, signature, deliveryId),
+            ]);
+            // At least one should process, one should be duplicate
+            const processed = [result1, result2].filter((r) => r.itemsQueued > 0);
+            const duplicates = [result1, result2].filter((r) => r.message?.includes('Duplicate'));
+            expect(processed.length + duplicates.length).toBe(2);
+            expect(processed.length).toBeGreaterThanOrEqual(1);
+        });
+    });
+});
+//# sourceMappingURL=WebhookHandler.idempotency.test.js.map

package/dist/tests/webhooks/WebhookHandler.idempotency.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebhookHandler.idempotency.test.js","sourceRoot":"","sources":["../../../tests/webhooks/WebhookHandler.idempotency.test.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAM,MAAM,QAAQ,CAAA;AAC7D,OAAO,EACL,cAAc,GAGf,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EAAE,YAAY,EAA4B,MAAM,oCAAoC,CAAA;AAC3F,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAEnC,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,MAAM,WAAW,GAAG,qBAAqB,CAAA;IAEzC,SAAS,eAAe,CAAC,OAAe;QACtC,OAAO,UAAU,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;IACpF,CAAC;IAED,SAAS,sBAAsB;QAC7B,OAAO;YACL,GAAG,EAAE,iBAAiB;YACtB,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,uDAAuD;YAChE,OAAO,EAAE;gBACP;oBACE,EAAE,EAAE,QAAQ;oBACZ,OAAO,EAAE,SAAS;oBAClB,QAAQ,EAAE,IAAI;oBACd,OAAO,EAAE,cAAc;oBACvB,SAAS,EAAE,sBAAsB;oBACjC,GAAG,EAAE,6CAA6C;oBAClD,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE;oBACnD,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE;oBACtD,KAAK,EAAE,CAAC,8BAA8B,CAAC;oBACvC,OAAO,EAAE,EAAE;oBACX,QAAQ,EAAE,EAAE;iBACb;aACF;YACD,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE;gBACV,EAAE,EAAE,GAAG;gBACP,IAAI,EAAE,MAAM;gBACZ,SAAS,EAAE,YAAY;gBACvB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE;gBAC9C,QAAQ,EAAE,+BAA+B;gBACzC,WAAW,EAAE,IAAI;gBACjB,IAAI,EAAE,KAAK;gBACX,GAAG,EAAE,yCAAyC;gBAC9C,UAAU,EAAE,sBAAsB;gBAClC,UAAU,EAAE,sBAAsB;gBAClC,SAAS,EAAE,sBAAsB;gBACjC,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,CAAC;gBACP,gBAAgB,EAAE,CAAC;gBACnB,cAAc,EAAE,CAAC;gBACjB,QAAQ,EAAE,YAAY;gBACtB,WAAW,EAAE,CAAC;gBACd,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,KAAK;gBACf,iBAAiB,EAAE,CAAC;gBACpB,MAAM,EAAE,EAAE;gBACV,UAAU,EAAE,QAAQ;gBACpB,cAAc,EAAE,MAAM;aACvB;YACD,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE;YACnD,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE;SAC/C,CAAA;IACH,CAAC;IAED,IAAI,OAAuB,CAAA;IAC3B,IAAI,KAAmB,CAAA;IACvB,IAAI,cAAyB,CAAA;IAE7B,UAAU,CAAC,GAAG,EAAE;QACd,cAAc,GAAG,EAAE,CAAA;QAEnB,KAAK,GAAG,IAAI,YAAY,CAAC;YACvB,UAAU,EAAE,CAAC;YACb,UAAU,EAAE,CAAC;YACb,YAAY,EAAE,CAAC;YACf,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACxB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC3B,CAAC;SACF,CAAC,CAAA;QAEF,OAAO,GAAG,IAAI,cAAc,CAAC;YAC3B,MAAM,EAAE,WAAW;YACnB,KAAK;YACL,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;SAChB,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;QAC1C,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,sBAAsB,EAAE,CAAC,CAAA;YACxD,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;YAC1C,MAAM,UAAU,GAAG,wBAAwB,CAAA;YAE3C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;YAElF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACjC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACtC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACpC,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;YAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,sBAAsB,EAAE,CAAC,CAAA;YACxD,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;YAC1C,MAAM,UAAU,GAAG,uBAAuB,CAAA;YAE1C,kCAAkC;YAClC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;YACnF,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAClC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAEnC,6CAA6C;YAC7C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;YACnF,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAClC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAA;YACvD,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACrC,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;YAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,sBAAsB,EAAE,CAAC,CAAA;YACxD,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;YAE1C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;YACrF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;YAErF,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAClC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACnC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAClC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACrC,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;YACjE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,sBAAsB,EAAE,CAAC,CAAA;YACxD,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;YAE1C,qDAAqD;YACrD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;YACvE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;YAEvE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAClC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAClC,oDAAoD;QACtD,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;QACnC,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;YACzE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,sBAAsB,EAAE,CAAC,CAAA;YACxD,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;YAE1C,iCAAiC;YACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/B,MAAM,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC,CAAA;YAC1E,CAAC;YAED,8CAA8C;YAC9C,4DAA4D;YAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAA;YAC5D,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;YACnE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,sBAAsB,EAAE,CAAC,CAAA;YACxD,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;YAE1C,0BAA0B;YAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC9B,MAAM,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC,CAAA;YAC1E,CAAC;YAED,kCAAkC;YAClC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,CAAC,CAAA;YACvF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAA;QACxD,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;QACtC,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;YACjE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,sBAAsB,EAAE,CAAC,CAAA;YACxD,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;YAE1C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAA;YAC3E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAA;YAE3E,0CAA0C;YAC1C,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAClC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACpC,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,sBAAsB,EAAE,CAAC,CAAA;YACxD,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;YAC1C,MAAM,UAAU,GAAG,qBAAqB,CAAA;YAExC,+BAA+B;YAC/B,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC3C,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC;gBAC7D,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC;aAC9D,CAAC,CAAA;YAEF,uDAAuD;YACvD,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAA;YACrE,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAA;YAErF,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACpD,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAA;QACpD,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/tests/webhooks/WebhookPayload.security.test.d.ts

@@ -0,0 +1,8 @@
+/**
+ * SMI-680: Security tests for WebhookPayload validation
+ *
+ * These tests verify that parseWebhookPayload properly validates
+ * incoming payloads using zod schemas instead of unsafe type assertions.
+ */
+export {};
+//# sourceMappingURL=WebhookPayload.security.test.d.ts.map

package/dist/tests/webhooks/WebhookPayload.security.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebhookPayload.security.test.d.ts","sourceRoot":"","sources":["../../../tests/webhooks/WebhookPayload.security.test.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/tests/webhooks/WebhookPayload.security.test.js

@@ -0,0 +1,204 @@
+/**
+ * SMI-680: Security tests for WebhookPayload validation
+ *
+ * These tests verify that parseWebhookPayload properly validates
+ * incoming payloads using zod schemas instead of unsafe type assertions.
+ */
+import { describe, it, expect } from 'vitest';
+import { parseWebhookPayload } from '../../src/webhooks/WebhookPayload.js';
+describe('parseWebhookPayload Security (SMI-680)', () => {
+    describe('push event validation', () => {
+        it('should reject payload with missing required fields', () => {
+            const malformedPayload = {
+                // missing: ref, before, after, repository
+                commits: [],
+            };
+            expect(() => {
+                parseWebhookPayload('push', malformedPayload);
+            }).toThrow(/Invalid push event payload/);
+        });
+        it('should reject payload with wrong field types', () => {
+            const malformedPayload = {
+                ref: 123, // should be string
+                before: 'abc',
+                after: 'def',
+                repository: {
+                    full_name: 'owner/repo',
+                    default_branch: 'main',
+                },
+            };
+            expect(() => {
+                parseWebhookPayload('push', malformedPayload);
+            }).toThrow(/Invalid push event payload/);
+        });
+        it('should reject payload with missing repository.full_name', () => {
+            const malformedPayload = {
+                ref: 'refs/heads/main',
+                before: 'abc123',
+                after: 'def456',
+                repository: {
+                    // missing: full_name
+                    default_branch: 'main',
+                },
+            };
+            expect(() => {
+                parseWebhookPayload('push', malformedPayload);
+            }).toThrow(/Invalid push event payload/);
+        });
+        it('should reject payload with invalid commits array', () => {
+            const malformedPayload = {
+                ref: 'refs/heads/main',
+                before: 'abc123',
+                after: 'def456',
+                repository: {
+                    full_name: 'owner/repo',
+                    default_branch: 'main',
+                },
+                commits: 'not-an-array', // should be array
+            };
+            expect(() => {
+                parseWebhookPayload('push', malformedPayload);
+            }).toThrow(/Invalid push event payload/);
+        });
+        it('should accept valid push payload and preserve extra fields (passthrough)', () => {
+            const validPayload = {
+                ref: 'refs/heads/main',
+                before: 'abc123',
+                after: 'def456',
+                created: false,
+                deleted: false,
+                forced: false,
+                base_ref: null,
+                compare: 'https://github.com/owner/repo/compare/abc123...def456',
+                commits: [
+                    {
+                        id: 'def456',
+                        message: 'Test commit',
+                        added: ['SKILL.md'],
+                        removed: [],
+                        modified: [],
+                    },
+                ],
+                repository: {
+                    id: 123,
+                    name: 'repo',
+                    full_name: 'owner/repo',
+                    default_branch: 'main',
+                    private: false,
+                    html_url: 'https://github.com/owner/repo',
+                    owner: { login: 'owner', id: 1, type: 'User' },
+                    extra_field: 'should be preserved', // extra field
+                },
+                pusher: { name: 'user', email: 'user@example.com' },
+                sender: { login: 'user', id: 1, type: 'User' },
+            };
+            const result = parseWebhookPayload('push', validPayload);
+            expect(result.type).toBe('push');
+            expect(result.payload).toBeDefined();
+            if (result.type === 'push') {
+                expect(result.payload.ref).toBe('refs/heads/main');
+                expect(result.payload.repository.full_name).toBe('owner/repo');
+                // Extra field should be preserved (cast through unknown for index access)
+                expect(result.payload.repository.extra_field).toBe('should be preserved');
+            }
+        });
+    });
+    describe('repository event validation', () => {
+        it('should reject repository payload with missing action', () => {
+            const malformedPayload = {
+                // missing: action
+                repository: {
+                    full_name: 'owner/repo',
+                },
+            };
+            expect(() => {
+                parseWebhookPayload('repository', malformedPayload);
+            }).toThrow(/Invalid repository event payload/);
+        });
+        it('should reject repository payload with invalid action type', () => {
+            const malformedPayload = {
+                action: 123, // should be string
+                repository: {
+                    full_name: 'owner/repo',
+                },
+            };
+            expect(() => {
+                parseWebhookPayload('repository', malformedPayload);
+            }).toThrow(/Invalid repository event payload/);
+        });
+        it('should accept valid repository payload', () => {
+            const validPayload = {
+                action: 'deleted',
+                repository: {
+                    id: 123,
+                    name: 'repo',
+                    full_name: 'owner/repo',
+                    private: false,
+                    html_url: 'https://github.com/owner/repo',
+                    owner: { login: 'owner', id: 1, type: 'User' },
+                    default_branch: 'main',
+                },
+                sender: { login: 'user', id: 1, type: 'User' },
+            };
+            const result = parseWebhookPayload('repository', validPayload);
+            expect(result.type).toBe('repository');
+            if (result.type === 'repository') {
+                expect(result.payload.action).toBe('deleted');
+            }
+        });
+    });
+    describe('ping event validation', () => {
+        it('should reject ping payload with missing zen', () => {
+            const malformedPayload = {
+                // missing: zen
+                hook_id: 123,
+            };
+            expect(() => {
+                parseWebhookPayload('ping', malformedPayload);
+            }).toThrow(/Invalid ping event payload/);
+        });
+        it('should reject ping payload with missing hook_id', () => {
+            const malformedPayload = {
+                zen: 'Keep it simple',
+                // missing: hook_id
+            };
+            expect(() => {
+                parseWebhookPayload('ping', malformedPayload);
+            }).toThrow(/Invalid ping event payload/);
+        });
+        it('should accept valid ping payload', () => {
+            const validPayload = {
+                zen: 'Keep it simple',
+                hook_id: 123,
+                hook: {
+                    type: 'Repository',
+                    id: 123,
+                    name: 'web',
+                    active: true,
+                    events: ['push'],
+                    config: {
+                        content_type: 'json',
+                        insecure_ssl: '0',
+                        url: 'https://example.com/webhook',
+                    },
+                },
+                sender: { login: 'user', id: 1, type: 'User' },
+            };
+            const result = parseWebhookPayload('ping', validPayload);
+            expect(result.type).toBe('ping');
+            if (result.type === 'ping') {
+                expect(result.payload.zen).toBe('Keep it simple');
+                expect(result.payload.hook_id).toBe(123);
+            }
+        });
+    });
+    describe('unknown event type', () => {
+        it('should return unknown type for unrecognized event types', () => {
+            const payload = { some: 'data' };
+            const result = parseWebhookPayload('unknown_event', payload);
+            expect(result.type).toBe('unknown');
+            expect(result.payload).toEqual({ some: 'data' });
+        });
+    });
+});
+//# sourceMappingURL=WebhookPayload.security.test.js.map

package/dist/tests/webhooks/WebhookPayload.security.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebhookPayload.security.test.js","sourceRoot":"","sources":["../../../tests/webhooks/WebhookPayload.security.test.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,mBAAmB,EAA2B,MAAM,sCAAsC,CAAA;AAEnG,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;IACtD,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;QACrC,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;YAC5D,MAAM,gBAAgB,GAAG;gBACvB,0CAA0C;gBAC1C,OAAO,EAAE,EAAE;aACZ,CAAA;YAED,MAAM,CAAC,GAAG,EAAE;gBACV,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;YAC/C,CAAC,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAA;QAC1C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;YACtD,MAAM,gBAAgB,GAAG;gBACvB,GAAG,EAAE,GAAG,EAAE,mBAAmB;gBAC7B,MAAM,EAAE,KAAK;gBACb,KAAK,EAAE,KAAK;gBACZ,UAAU,EAAE;oBACV,SAAS,EAAE,YAAY;oBACvB,cAAc,EAAE,MAAM;iBACvB;aACF,CAAA;YAED,MAAM,CAAC,GAAG,EAAE;gBACV,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;YAC/C,CAAC,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAA;QAC1C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;YACjE,MAAM,gBAAgB,GAAG;gBACvB,GAAG,EAAE,iBAAiB;gBACtB,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,QAAQ;gBACf,UAAU,EAAE;oBACV,qBAAqB;oBACrB,cAAc,EAAE,MAAM;iBACvB;aACF,CAAA;YAED,MAAM,CAAC,GAAG,EAAE;gBACV,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;YAC/C,CAAC,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAA;QAC1C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;YAC1D,MAAM,gBAAgB,GAAG;gBACvB,GAAG,EAAE,iBAAiB;gBACtB,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,QAAQ;gBACf,UAAU,EAAE;oBACV,SAAS,EAAE,YAAY;oBACvB,cAAc,EAAE,MAAM;iBACvB;gBACD,OAAO,EAAE,cAAc,EAAE,kBAAkB;aAC5C,CAAA;YAED,MAAM,CAAC,GAAG,EAAE;gBACV,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;YAC/C,CAAC,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAA;QAC1C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;YAClF,MAAM,YAAY,GAAG;gBACnB,GAAG,EAAE,iBAAiB;gBACtB,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,KAAK;gBACb,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,uDAAuD;gBAChE,OAAO,EAAE;oBACP;wBACE,EAAE,EAAE,QAAQ;wBACZ,OAAO,EAAE,aAAa;wBACtB,KAAK,EAAE,CAAC,UAAU,CAAC;wBACnB,OAAO,EAAE,EAAE;wBACX,QAAQ,EAAE,EAAE;qBACb;iBACF;gBACD,UAAU,EAAE;oBACV,EAAE,EAAE,GAAG;oBACP,IAAI,EAAE,MAAM;oBACZ,SAAS,EAAE,YAAY;oBACvB,cAAc,EAAE,MAAM;oBACtB,OAAO,EAAE,KAAK;oBACd,QAAQ,EAAE,+BAA+B;oBACzC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE;oBAC9C,WAAW,EAAE,qBAAqB,EAAE,cAAc;iBACnD;gBACD,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE;gBACnD,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE;aAC/C,CAAA;YAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;YAExD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAChC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAA;YACpC,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC3B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;gBAClD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;gBAC9D,0EAA0E;gBAC1E,MAAM,CAAE,MAAM,CAAC,OAAO,CAAC,UAAiD,CAAC,WAAW,CAAC,CAAC,IAAI,CACxF,qBAAqB,CACtB,CAAA;YACH,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;QAC3C,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;YAC9D,MAAM,gBAAgB,GAAG;gBACvB,kBAAkB;gBAClB,UAAU,EAAE;oBACV,SAAS,EAAE,YAAY;iBACxB;aACF,CAAA;YAED,MAAM,CAAC,GAAG,EAAE;gBACV,mBAAmB,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAA;YACrD,CAAC,CAAC,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAA;QAChD,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;YACnE,MAAM,gBAAgB,GAAG;gBACvB,MAAM,EAAE,GAAG,EAAE,mBAAmB;gBAChC,UAAU,EAAE;oBACV,SAAS,EAAE,YAAY;iBACxB;aACF,CAAA;YAED,MAAM,CAAC,GAAG,EAAE;gBACV,mBAAmB,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAA;YACrD,CAAC,CAAC,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAA;QAChD,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,YAAY,GAAG;gBACnB,MAAM,EAAE,SAAS;gBACjB,UAAU,EAAE;oBACV,EAAE,EAAE,GAAG;oBACP,IAAI,EAAE,MAAM;oBACZ,SAAS,EAAE,YAAY;oBACvB,OAAO,EAAE,KAAK;oBACd,QAAQ,EAAE,+BAA+B;oBACzC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE;oBAC9C,cAAc,EAAE,MAAM;iBACvB;gBACD,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE;aAC/C,CAAA;YAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,YAAY,EAAE,YAAY,CAAC,CAAA;YAE9D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;YACtC,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACjC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YAC/C,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;QACrC,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACrD,MAAM,gBAAgB,GAAG;gBACvB,eAAe;gBACf,OAAO,EAAE,GAAG;aACb,CAAA;YAED,MAAM,CAAC,GAAG,EAAE;gBACV,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;YAC/C,CAAC,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAA;QAC1C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;YACzD,MAAM,gBAAgB,GAAG;gBACvB,GAAG,EAAE,gBAAgB;gBACrB,mBAAmB;aACpB,CAAA;YAED,MAAM,CAAC,GAAG,EAAE;gBACV,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;YAC/C,CAAC,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAA;QAC1C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;YAC1C,MAAM,YAAY,GAAG;gBACnB,GAAG,EAAE,gBAAgB;gBACrB,OAAO,EAAE,GAAG;gBACZ,IAAI,EAAE;oBACJ,IAAI,EAAE,YAAY;oBAClB,EAAE,EAAE,GAAG;oBACP,IAAI,EAAE,KAAK;oBACX,MAAM,EAAE,IAAI;oBACZ,MAAM,EAAE,CAAC,MAAM,CAAC;oBAChB,MAAM,EAAE;wBACN,YAAY,EAAE,MAAM;wBACpB,YAAY,EAAE,GAAG;wBACjB,GAAG,EAAE,6BAA6B;qBACnC;iBACF;gBACD,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE;aAC/C,CAAA;YAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;YAExD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAChC,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC3B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;gBACjD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC1C,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAClC,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;YACjE,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;YAEhC,MAAM,MAAM,GAAG,mBAAmB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;YAE5D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACnC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;QAClD,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/vitest.config.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("vite").UserConfig;
+export default _default;
+//# sourceMappingURL=vitest.config.d.ts.map

package/dist/vitest.config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vitest.config.d.ts","sourceRoot":"","sources":["../vitest.config.ts"],"names":[],"mappings":";AAEA,wBAUE"}

package/dist/vitest.config.js

@@ -0,0 +1,13 @@
+import { defineConfig } from 'vitest/config';
+export default defineConfig({
+    test: {
+        globals: true,
+        environment: 'node',
+        include: ['tests/**/*.test.ts'],
+        coverage: {
+            provider: 'v8',
+            reporter: ['text', 'json', 'html'],
+        },
+    },
+});
+//# sourceMappingURL=vitest.config.js.map

package/dist/vitest.config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vitest.config.js","sourceRoot":"","sources":["../vitest.config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAE5C,eAAe,YAAY,CAAC;IAC1B,IAAI,EAAE;QACJ,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,MAAM;QACnB,OAAO,EAAE,CAAC,oBAAoB,CAAC;QAC/B,QAAQ,EAAE;YACR,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SACnC;KACF;CACF,CAAC,CAAA"}

package/package.json

@@ -0,0 +1,77 @@
+{
+  "name": "@skillsmith/core",
+  "version": "0.1.0",
+  "description": "Core types and utilities for Skillsmith",
+  "type": "module",
+  "main": "./dist/src/index.js",
+  "types": "./dist/src/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/src/index.d.ts",
+      "import": "./dist/src/index.js"
+    },
+    "./errors": {
+      "types": "./dist/src/errors.d.ts",
+      "import": "./dist/src/errors.js"
+    },
+    "./embeddings": {
+      "types": "./dist/src/embeddings/index.d.ts",
+      "import": "./dist/src/embeddings/index.js"
+    }
+  },
+  "scripts": {
+    "prepublishOnly": "npm run build && npm run test",
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:security": "vitest run tests/security",
+    "benchmark": "npx tsx src/benchmarks/cli.ts",
+    "benchmark:search": "npx tsx src/benchmarks/cli.ts --suite search",
+    "benchmark:index": "npx tsx src/benchmarks/cli.ts --suite index",
+    "benchmark:cache": "npx tsx src/benchmarks/cli.ts --suite cache",
+    "benchmark:embedding": "npx tsx src/benchmarks/cli.ts --suite embedding",
+    "import:skills": "npx tsx src/scripts/import-to-database.ts"
+  },
+  "dependencies": {
+    "@opentelemetry/api": "1.9.0",
+    "@opentelemetry/auto-instrumentations-node": "0.52.1",
+    "@opentelemetry/exporter-trace-otlp-http": "0.56.0",
+    "@opentelemetry/resources": "1.30.1",
+    "@opentelemetry/sdk-node": "0.56.0",
+    "@opentelemetry/sdk-trace-base": "1.30.1",
+    "@opentelemetry/semantic-conventions": "1.38.0",
+    "@xenova/transformers": "2.17.2",
+    "better-sqlite3": "11.10.0",
+    "lru-cache": "^10.1.0",
+    "zod": "4.2.1"
+  },
+  "devDependencies": {
+    "@types/better-sqlite3": "7.6.13",
+    "vitest": "4.0.16"
+  },
+  "files": [
+    "dist"
+  ],
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/smith-horn-group/skillsmith.git",
+    "directory": "packages/core"
+  },
+  "homepage": "https://github.com/smith-horn-group/skillsmith#readme",
+  "bugs": {
+    "url": "https://github.com/smith-horn-group/skillsmith/issues"
+  },
+  "keywords": [
+    "claude",
+    "ai",
+    "skills",
+    "mcp",
+    "llm",
+    "anthropic"
+  ],
+  "engines": {
+    "node": ">=22.0.0"
+  }
+}