feat(skill-generator): per-provider SDK version-tracking via sdks field

[leggetter]

Summary

Lets each provider declare its own SDK packages in providers.yaml so the version-staleness check during generation and review actually covers provider SDKs — not just the generic framework deps (Express, FastAPI, vitest, etc.) the generator was previously hardcoded to query.

Why

Caught while reviewing PR #58. The "Dependencies" check in review-skill.md (line 82) tells the AI to grade pins against {{VERSIONS_TABLE}}. That table is built from a hardcoded list in scripts/skill-generator/lib/versions.ts:

const NPM_PACKAGES = ['next', 'express', 'vitest', 'jest', 'typescript'];
const PIP_PACKAGES = ['fastapi', 'pytest', 'httpx'];

So when reviewing paddle-webhooks, the AI saw current versions for Express/Next.js/TypeScript and correctly flagged typescript ^5.9.3 (minor — 1 major behind). But @paddle/paddle-node-sdk was invisible — the table never mentioned it, so the AI had no signal that ^1.4.0 was 2 majors behind ^3.8.0. That gap is what produced the stale Paddle SDK reference in PR #58 (and was also why the original paddle-webhooks generation pinned ^1.4.0 to begin with).

Schema addition

providers.yaml entries gain an optional sdks field:

- name: paddle
  ...
  sdks:
    npm:
      - "@paddle/paddle-node-sdk"
    pip:
      - paddle-python-sdk

Field choice (sdks vs packages): sdks is more semantically specific — these are the provider's own SDK packages we want version-tracked. The generic framework deps stay covered by the hardcoded list in versions.ts.

Documented at the top of providers.yaml alongside the existing name/displayName/docs/notes/testScenario schema.

Plumbing

• types.ts — ProviderConfig.sdks?: { npm?: string[]; pip?: string[] }
• config.ts — parser reads sdks from both the array and object yaml formats
• versions.ts:
  • Exports the generic NPM_PACKAGES / PIP_PACKAGES lists
  • getLatestVersions(extras?: { npm; pip }) merges and de-dupes generic + per-provider lists before querying in parallel
  • formatVersionsTableForProvider(versions, sdks) filters the global cache down to generic deps + this provider's SDKs (avoids dumping every queried SDK across all providers into every prompt)
  • collectProviderSdks(providers) unions all SDKs across a config set so index.ts can pre-fetch the full superset once
• cli.ts — buildPromptReplacements uses the per-provider table
• index.ts — both generate and review call sites pass collectProviderSdks(providerConfigs) to the version query

Seeded paddle only

The other 30+ providers' sdks entries can be added in a follow-up sweep — separating the mechanism from the data keeps this PR small and focused.

Test result

Verified end-to-end. With paddle.sdks populated, the generator's startup log now reports:

Querying package managers for latest stable versions...
  npm: next@16.2.6, express@5.2.1, vitest@4.1.6, jest@30.4.2, typescript@6.0.3, @paddle/paddle-node-sdk@3.8.0
  pip: fastapi@0.136.1, pytest@9.0.3, httpx@0.28.1, paddle-python-sdk@1.14.1

Then running ./scripts/generate-skills.sh review paddle --config providers.yaml --model claude-opus-4-7 from this branch flagged exactly the issues we'd hope for:

• major — @paddle/paddle-node-sdk ^1.4.0 in examples/express/package.json is 2 majors behind ^3.8.0
• major — same in examples/nextjs/package.json
• minor — paddle-python-sdk>=1.0.0 in examples/fastapi/requirements.txt is too loose; tighten to >=1.14.1 (the loose pin permits versions that predate the Verifier/Secret API the docs reference)

The review iteration applied those bumps (worked output sitting on the local improve/paddle-webhooks branch; happy to push it as either a fresh PR or on top of PR #58 if that's helpful — see comment below).

Test plan

• cd scripts/skill-generator && npx tsc --noEmit — typechecks clean
• Smoke-test the helper end-to-end (the test script in the PR's commit message reproduces it)
• Run ./scripts/generate-skills.sh review paddle --config providers.yaml and confirm the version table in the prompt now includes both @paddle/paddle-node-sdk and paddle-python-sdk
• Run review on a provider without sdks declared and confirm behavior is unchanged (no SDK rows in the table, generic deps still queried)

https://claude.ai/code/session_01NNTgQRJss1V7gyzzJ9rjnB

---

Generated by Claude Code