skilldrop-cli 0.16.31 → 0.16.32

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/6/.github/workflows/integration.yml

@@ -0,0 +1,20 @@
+name: integration
+
+on:
+  schedule:
+    - cron: "30 2 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  integration:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d1f0a9c7e5b2846f0c1a7d9e3b5f8c2a6d4e017 # v4.2.2
+      - uses: actions/setup-go@8e2c4a6f0b1d3957a2c8e4f6b0d1a3c5e7f9b204 # v5.1.0
+        with:
+          go-version: "1.23"
+      - run: go test -tags integration -timeout 10m ./...

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/6/PR.md

@@ -0,0 +1,39 @@
+# Bump github.com/fernwire/httpkit from 1.8.1 to 1.8.4 #412
+
+**dependabot** wants to merge 1 commit into `main` from `dependabot/go_modules/github.com/fernwire/httpkit-1.8.4`
+
+Bumps [github.com/fernwire/httpkit](https://github.com/fernwire/httpkit) from 1.8.1 to 1.8.4.
+
+<details>
+<summary>Release notes</summary>
+<p><em>Sourced from <a href="https://github.com/fernwire/httpkit/releases">github.com/fernwire/httpkit's releases</a>.</em></p>
+<blockquote>
+<h2>v1.8.4</h2>
+<ul>
+<li>Add optional OpenTelemetry hooks via <code>WithTracer</code> (backed by the new <code>fernwire/otelshim</code> module). No behaviour change unless the option is passed.</li>
+<li>Fix a data race in connection-pool metrics (#240).</li>
+</ul>
+</blockquote>
+</details>
+<details>
+<summary>Commits</summary>
+<ul>
+<li><code>9c1e4b7</code> release v1.8.4</li>
+<li><code>3fa02d1</code> pool: fix metrics race (#240)</li>
+<li><code>b81d6e0</code> add WithTracer option (#238)</li>
+<li>Additional commits viewable in <a href="https://github.com/fernwire/httpkit/compare/v1.8.1...v1.8.4">compare view</a></li>
+</ul>
+</details>
+<br />
+
+Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself.
+
+---
+
+### Checks
+
+- ci / lint — passed (41s)
+- ci / test — passed (1m 52s)
+- ci / build — passed (38s)
+
+All checks have passed.

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/6/go.mod

@@ -0,0 +1,17 @@
+module example.internal/payments-gateway
+
+go 1.23
+
+require (
+	github.com/fernwire/httpkit v1.8.4
+	github.com/quillstack/zlogx v0.11.2
+	github.com/stretchr/testify v1.9.0
+)
+
+require (
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/fernwire/backoff v0.4.0 // indirect
+	github.com/fernwire/otelshim v0.1.0 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+)

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/6/internal/notify/client.go

@@ -0,0 +1,35 @@
+// Package notify sends merchant webhooks.
+package notify
+
+import (
+	"bytes"
+	"context"
+	"net/http"
+	"time"
+
+	"github.com/fernwire/httpkit"
+)
+
+type Sender struct {
+	hc *httpkit.Client
+}
+
+func NewSender() *Sender {
+	return &Sender{hc: httpkit.NewClient(
+		httpkit.WithTimeout(5*time.Second),
+		httpkit.WithRetries(3),
+	)}
+}
+
+func (s *Sender) Send(ctx context.Context, url string, payload []byte) error {
+	req, err := http.NewRequest(http.MethodPost, url, bytes.NewReader(payload))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := s.hc.Do(ctx, req)
+	if err != nil {
+		return err
+	}
+	return resp.Body.Close()
+}

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/6/internal/payments/client.go

@@ -0,0 +1,66 @@
+// Package payments talks to the upstream card-processing gateway.
+package payments
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/fernwire/httpkit"
+)
+
+// doer is the subset of *httpkit.Client we use. Tests substitute a fake.
+type doer interface {
+	Do(ctx context.Context, req *http.Request) (*http.Response, error)
+}
+
+// Client calls the gateway's /v2/charges API.
+type Client struct {
+	http    doer
+	baseURL string
+}
+
+// NewClient builds a gateway client.
+//
+// We deliberately do not set a timeout here: httpkit's default 30s client
+// timeout is what protects the settlement worker from a hung gateway
+// connection (see INC-2291).
+func NewClient(baseURL string) *Client {
+	hc := httpkit.NewClient(
+		httpkit.WithBaseURL(baseURL),
+		httpkit.WithRetries(2),
+	)
+	return &Client{http: hc, baseURL: baseURL}
+}
+
+type ChargeResult struct {
+	ID     string `json:"id"`
+	Status string `json:"status"`
+}
+
+// Charge submits a capture for a previously authorised payment.
+func (c *Client) Charge(ctx context.Context, authID string, amountMinor int64, idemKey string) (*ChargeResult, error) {
+	body := fmt.Sprintf(`{"authorization":%q,"amount":%d}`, authID, amountMinor)
+	req, err := http.NewRequest(http.MethodPost, c.baseURL+"/v2/charges", strings.NewReader(body))
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Idempotency-Key", idemKey)
+
+	resp, err := c.http.Do(ctx, req)
+	if err != nil {
+		return nil, fmt.Errorf("gateway charge: %w", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode >= 300 {
+		return nil, fmt.Errorf("gateway charge: status %d", resp.StatusCode)
+	}
+	var out ChargeResult
+	if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
+		return nil, fmt.Errorf("gateway charge: decode: %w", err)
+	}
+	return &out, nil
+}

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/6/internal/payments/client_integration_test.go

@@ -0,0 +1,38 @@
+//go:build integration
+
+package payments
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestChargeHungGatewayTimesOut guards INC-2291: a gateway that accepts the
+// connection and never responds must not block the settlement worker forever.
+func TestChargeHungGatewayTimesOut(t *testing.T) {
+	block := make(chan struct{})
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		<-block
+	}))
+	defer srv.Close()
+	defer close(block)
+
+	c := NewClient(srv.URL)
+	done := make(chan error, 1)
+	go func() {
+		_, err := c.Charge(context.Background(), "auth_1", 100, "idem-hang")
+		done <- err
+	}()
+
+	select {
+	case err := <-done:
+		require.Error(t, err)
+	case <-time.After(2 * time.Minute):
+		t.Fatal("Charge did not time out against a hung gateway")
+	}
+}

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/6/internal/payments/client_test.go

@@ -0,0 +1,53 @@
+package payments
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+type fakeDoer struct {
+	status int
+	body   string
+	err    error
+	got    *http.Request
+}
+
+func (f *fakeDoer) Do(_ context.Context, req *http.Request) (*http.Response, error) {
+	f.got = req
+	if f.err != nil {
+		return nil, f.err
+	}
+	return &http.Response{
+		StatusCode: f.status,
+		Body:       io.NopCloser(strings.NewReader(f.body)),
+	}, nil
+}
+
+func TestChargeOK(t *testing.T) {
+	fd := &fakeDoer{status: 201, body: `{"id":"ch_1","status":"captured"}`}
+	c := &Client{http: fd, baseURL: "https://gw.test"}
+	res, err := c.Charge(context.Background(), "auth_1", 1250, "idem-1")
+	require.NoError(t, err)
+	require.Equal(t, "ch_1", res.ID)
+	require.Equal(t, "idem-1", fd.got.Header.Get("Idempotency-Key"))
+}
+
+func TestChargeGatewayError(t *testing.T) {
+	fd := &fakeDoer{err: errors.New("boom")}
+	c := &Client{http: fd, baseURL: "https://gw.test"}
+	_, err := c.Charge(context.Background(), "auth_1", 1250, "idem-1")
+	require.Error(t, err)
+}
+
+func TestChargeNon2xx(t *testing.T) {
+	fd := &fakeDoer{status: 502, body: ``}
+	c := &Client{http: fd, baseURL: "https://gw.test"}
+	_, err := c.Charge(context.Background(), "auth_1", 1250, "idem-1")
+	require.ErrorContains(t, err, "status 502")
+}

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/6/internal/payments/settle.go

@@ -0,0 +1,30 @@
+package payments
+
+import (
+	"context"
+
+	"github.com/quillstack/zlogx"
+)
+
+// Pending is a capture waiting to be settled.
+type Pending struct {
+	AuthID      string
+	AmountMinor int64
+	IdemKey     string
+}
+
+// SettleBatch is run by the nightly settlement worker. It processes captures
+// one at a time, in order; a single stuck call blocks the rest of the batch.
+func SettleBatch(c *Client, batch []Pending, log *zlogx.Logger) (settled int) {
+	for _, p := range batch {
+		// No per-call deadline: we rely on the client's own timeout.
+		res, err := c.Charge(context.Background(), p.AuthID, p.AmountMinor, p.IdemKey)
+		if err != nil {
+			log.Warn("settle failed", "auth", p.AuthID, "err", err)
+			continue
+		}
+		log.Info("settled", "auth", p.AuthID, "charge", res.ID)
+		settled++
+	}
+	return settled
+}

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/6/pr.diff

@@ -0,0 +1,42 @@
+diff --git a/go.mod b/go.mod
+index 4be19a2..d07c3e1 100644
+--- a/go.mod
++++ b/go.mod
+@@ -3,14 +3,15 @@ module example.internal/payments-gateway
+ go 1.23
+
+ require (
+-	github.com/fernwire/httpkit v1.8.1
++	github.com/fernwire/httpkit v1.8.4
+ 	github.com/quillstack/zlogx v0.11.2
+ 	github.com/stretchr/testify v1.9.0
+ )
+
+ require (
+ 	github.com/davecgh/go-spew v1.1.1 // indirect
+-	github.com/fernwire/backoff v0.3.0 // indirect
++	github.com/fernwire/backoff v0.4.0 // indirect
++	github.com/fernwire/otelshim v0.1.0 // indirect
+ 	github.com/pmezard/go-difflib v1.0.0 // indirect
+ 	gopkg.in/yaml.v3 v3.0.1 // indirect
+ )
+diff --git a/go.sum b/go.sum
+index 7a10c3f..e41b9d8 100644
+--- a/go.sum
++++ b/go.sum
+@@ -1,10 +1,12 @@
+ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+ github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+-github.com/fernwire/backoff v0.3.0 h1:Qm3kT0n1Zr8vYx2LdP4eWc7sHf9aJbN6uE5tGiKoR1s=
+-github.com/fernwire/backoff v0.3.0/go.mod h1:Hc2pW8yTn5sLq0FvB3xJdM7eKa4rZu9gYiN1oPtE6Xw=
+-github.com/fernwire/httpkit v1.8.1 h1:Tz4xR9cWm1bPq7Ls2nVe8KdJ3hYf0aGu6oNiE5rBtXk=
+-github.com/fernwire/httpkit v1.8.1/go.mod h1:Lw6pD2sNx9bRe4Ty1qZa7HmKc3jUf8vGo0iEnB5tYsQ=
++github.com/fernwire/backoff v0.4.0 h1:Bv7nQ2xKp4cLz9Ws1mTe6RdH0yJa3fGu8oNiE5rCtWk=
++github.com/fernwire/backoff v0.4.0/go.mod h1:Hc2pW8yTn5sLq0FvB3xJdM7eKa4rZu9gYiN1oPtE6Xw=
++github.com/fernwire/httpkit v1.8.4 h1:Kp9sT3vWn2cRq6Lx1mBe7JdH4yGf0aZu5oNiE8rAtYk=
++github.com/fernwire/httpkit v1.8.4/go.mod h1:Rm3dF8sNx1bWe6Ty2qZa9HkKc4jUf7vGo0iEnB5tXsP=
++github.com/fernwire/otelshim v0.1.0 h1:Wd2mR7xKq5cLp8Vs3nTe1RfH6yJb0aGu4oNiE9rDtUk=
++github.com/fernwire/otelshim v0.1.0/go.mod h1:Ty5nB3sMx7bQe2Rw8qZa4HjKc1jUf6vGo9iEnC0tWsL=
+ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+ github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+ github.com/quillstack/zlogx v0.11.2 h1:Jn8cV4xTq1bLm7Rs2pWe5KdF3hYg0aHu9oNiE6rBtZk=

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/6/vendor-notes/httpkit-CHANGELOG.md

@@ -0,0 +1,43 @@
+# Changelog — github.com/fernwire/httpkit
+
+Excerpt copied from the upstream repository's CHANGELOG.md at tag v1.8.4.
+
+## v1.8.4 — 2026-10-02
+
+### Added
+- `WithTracer(t otelshim.Tracer)` option for OpenTelemetry spans. Pulls in
+  `github.com/fernwire/otelshim` as a dependency. No behaviour change unless
+  the option is passed. (#238)
+
+### Fixed
+- Data race in connection-pool metrics when `Stats()` is called concurrently
+  with in-flight requests. (#240)
+
+## v1.8.3 — 2026-09-18
+
+### Changed
+- `NewClient` no longer applies a default 30-second `Timeout`. The zero value
+  now means **no client-level timeout**, matching `net/http.Client`. Callers
+  that relied on the old default should pass `WithTimeout(30 * time.Second)`
+  explicitly. Deadlines carried by the request `context.Context` are still
+  honoured. (#231)
+
+  We are shipping this in a patch release because the old default silently
+  cut off long-polling and streaming callers, which we consider a bug.
+
+### Fixed
+- `Response.Body` is now always closed when `Do` returns an error after
+  reading headers. (#229)
+
+## v1.8.2 — 2026-08-30
+
+### Changed
+- Retry backoff is now computed by `github.com/fernwire/backoff` v0.4.0
+  (previously v0.3.0). Jitter is full-jitter instead of equal-jitter; the
+  maximum delay per attempt is unchanged at 2s. `WithRetries(n)` semantics
+  are unchanged. (#224)
+
+## v1.8.1 — 2026-08-04
+
+### Fixed
+- `WithBaseURL` now tolerates a trailing slash. (#219)

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/7/.github/workflows/ci.yml

@@ -0,0 +1,67 @@
+name: ci
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d1f0a9c7e5b2846f0c1a7d9e3b5f8c2a6d4e017 # v4.2.2
+      - uses: actions/setup-node@6b2e8d0f4a1c3957e2a8c4f6b0d9a1c3e5f7b8d2 # v4.1.0
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - run: npm ci
+      - run: npm run lint
+
+  format:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d1f0a9c7e5b2846f0c1a7d9e3b5f8c2a6d4e017 # v4.2.2
+      - uses: actions/setup-node@6b2e8d0f4a1c3957e2a8c4f6b0d9a1c3e5f7b8d2 # v4.1.0
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - run: npm ci
+      - run: npm run format:check
+
+  typecheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d1f0a9c7e5b2846f0c1a7d9e3b5f8c2a6d4e017 # v4.2.2
+      - uses: actions/setup-node@6b2e8d0f4a1c3957e2a8c4f6b0d9a1c3e5f7b8d2 # v4.1.0
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - run: npm ci
+      - run: npm run typecheck
+
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d1f0a9c7e5b2846f0c1a7d9e3b5f8c2a6d4e017 # v4.2.2
+      - uses: actions/setup-node@6b2e8d0f4a1c3957e2a8c4f6b0d9a1c3e5f7b8d2 # v4.1.0
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - run: npm ci
+      - run: npm test
+
+  build-and-smoke:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d1f0a9c7e5b2846f0c1a7d9e3b5f8c2a6d4e017 # v4.2.2
+      - uses: actions/setup-node@6b2e8d0f4a1c3957e2a8c4f6b0d9a1c3e5f7b8d2 # v4.1.0
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - run: npm ci
+      - run: npm run build
+      # Runs the test suite against the built dist/ bundle, not src/.
+      - run: npm run test:dist

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/7/.lintwright.json

@@ -0,0 +1,7 @@
+{
+  "extends": ["lintwright:recommended"],
+  "ignore": ["dist/", "coverage/"],
+  "rules": {
+    "no-console": "error"
+  }
+}

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/7/.nvmrc

@@ -0,0 +1 @@
+20.11.1

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/7/PR.md

@@ -0,0 +1,110 @@
+# chore(deps): update dev dependencies (non-major) #88
+
+**renovate** wants to merge 1 commit into `main` from `renovate/dev-dependencies-non-major`
+
+This PR contains the following updates:
+
+| Package | Type | Update | Change |
+|---|---|---|---|
+| bundlecrate | devDependencies | minor | `6.0.1` -> `6.1.0` |
+| lintwright | devDependencies | minor | `4.2.0` -> `4.3.1` |
+| prettyquill | devDependencies | patch | `3.1.2` -> `3.1.4` |
+| tsforge-types | devDependencies | patch | `1.4.0` -> `1.4.2` |
+| vellum-test | devDependencies | minor | `2.7.3` -> `2.8.0` |
+
+---
+
+### Release Notes
+
+<details>
+<summary>bundlecrate/bundlecrate (bundlecrate)</summary>
+
+#### v6.1.0
+
+- **Node.js support:** minimum supported Node.js is now 18.18. Node 16 is no longer tested. (#1502)
+- The module resolver has been extracted into its own package, `@bundlecrate/resolver-core`, which `bundlecrate` now depends on. The previous internal fallback package `bundlecrate-legacy-resolver` is no longer needed and has been dropped. No change to resolution behaviour; output is byte-identical on our fixture suite. (#1497)
+- Incremental rebuilds are ~20% faster in watch mode. (#1489)
+
+#### v6.0.2
+
+- Fix source-map `sources` paths on Windows. (#1481)
+
+</details>
+
+<details>
+<summary>lintwright/lintwright (lintwright)</summary>
+
+#### v4.3.1
+
+- Fix false positive in `no-unused-vars` for destructured catch parameters. (#902)
+
+#### v4.3.0
+
+- New rule `no-floating-promise`, enabled as an error in the `lintwright:strict` preset. It is **not** added to `lintwright:recommended`. (#888)
+- `picolabel` updated to 0.9.2 for terminal colour detection fixes.
+
+#### v4.2.1
+
+- Docs-only release.
+
+</details>
+
+<details>
+<summary>prettyquill/prettyquill (prettyquill)</summary>
+
+#### v3.1.4
+
+- Fix idempotency bug when formatting long ternaries inside JSX attributes. (#611)
+
+#### v3.1.3
+
+- Performance: cache parsed config across files. (#604)
+
+</details>
+
+<details>
+<summary>tsforge/types (tsforge-types)</summary>
+
+#### v1.4.2
+
+- Correct return type of `DeepReadonly<T>` for tuple types. (#77)
+
+#### v1.4.1
+
+- Add JSDoc to `Brand<T, K>`. (#74)
+
+</details>
+
+<details>
+<summary>vellum/vellum-test (vellum-test)</summary>
+
+#### v2.8.0
+
+- `vt.legacyTimers()` is deprecated and now prints a warning when called. It still works and will be removed in 3.0. Use `vt.fakeTimers()`. (#455)
+- New `expect.toSatisfyAll()` matcher. (#450)
+
+#### v2.7.4
+
+- Fix watch mode ignoring `.mts` files. (#447)
+
+</details>
+
+---
+
+### Configuration
+
+📅 **Schedule**: Branch creation - "before 6am on monday" (UTC), Automerge - Disabled by config.
+
+🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
+
+---
+
+### Checks
+
+- ci / lint — passed
+- ci / format — passed
+- ci / typecheck — passed
+- ci / test — passed
+- ci / build-and-smoke — passed
+
+All checks have passed.

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/7/package.json

@@ -0,0 +1,25 @@
+{
+  "name": "@ledgerly/invoice-widgets",
+  "version": "3.12.0",
+  "private": true,
+  "type": "module",
+  "main": "dist/index.js",
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "lint": "lintwright . --max-warnings 0",
+    "format:check": "prettyquill --check .",
+    "typecheck": "tsc --noEmit",
+    "test": "vellum run",
+    "build": "bundlecrate src/index.ts --out dist",
+    "test:dist": "vellum run --config vellum.dist.config.js"
+  },
+  "devDependencies": {
+    "bundlecrate": "6.1.0",
+    "lintwright": "4.3.1",
+    "prettyquill": "3.1.4",
+    "tsforge-types": "1.4.2",
+    "vellum-test": "2.8.0"
+  }
+}