
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@specsafe/core
Advanced tools
Core workflow engine, types, and utilities for the SpecSafe spec-driven development framework.
npm install @specsafe/core
The main class for managing spec workflows.
import { Workflow } from '@specsafe/core';
const workflow = new Workflow({
specsDir: './specs',
projectName: 'My Project'
});
createSpec(specId: string, content: string): Promise<Spec>Create a new specification.
const spec = await workflow.createSpec('user-auth', `# User Authentication
## Requirements
### REQ-001: Login
**Given** a registered user
**When** they enter valid credentials
**Then** they should be logged in
`);
moveToTest(specId: string): Promise<Spec>Move a spec to the "test" phase.
const spec = await workflow.moveToTest('user-auth');
moveToCode(specId: string): Promise<Spec>Move a spec to the "code" phase.
const spec = await workflow.moveToCode('user-auth');
moveToQA(specId: string, report?: QAReport): Promise<Spec>Transition a spec into QA review or mark QA as complete. Optionally accepts a QAReport to record results.
const spec = await workflow.moveToQA('user-auth', {
passed: true,
notes: 'All tests passing'
});
complete(specId: string): Promise<Spec>Mark a spec as complete.
const spec = await workflow.complete('user-auth');
archive(specId: string): Promise<Spec>Archive a completed spec.
const spec = await workflow.archive('user-auth');
getSpec(specId: string): Promise<Spec | null>Get a spec by ID.
const spec = await workflow.getSpec('user-auth');
listSpecs(phase?: Phase): Promise<Spec[]>List all specs or filter by phase.
// All specs
const allSpecs = await workflow.listSpecs();
// Only active specs
const activeSpecs = await workflow.listSpecs('active');
Track project-level state and metadata.
import { ProjectTracker } from '@specsafe/core';
const tracker = new ProjectTracker('./specs');
getProjectState(): Promise<ProjectState>Get the current project state.
const state = await tracker.getProjectState();
console.log(state.activeSpecs.length);
console.log(state.completedSpecs.length);
updateSpecStatus(specId: string, status: SpecStatus): Promise<void>Update the status of a spec.
await tracker.updateSpecStatus('user-auth', 'in-progress');
validateSpecId(specId: string): booleanValidate a spec ID format.
import { validateSpecId } from '@specsafe/core';
validateSpecId('user-auth'); // true
validateSpecId('user_auth'); // false (underscores not allowed)
validateSpecId('user-auth-123'); // true
interface Spec {
id: string;
title: string;
description: string;
phase: Phase;
status: SpecStatus;
requirements: Requirement[];
acceptanceCriteria: string[];
technicalNotes?: string;
createdAt: Date;
updatedAt: Date;
completedAt?: Date;
qaReport?: QAReport;
}
interface Requirement {
id: string;
title: string;
given: string;
when: string;
then: string;
}
interface QAReport {
passed: boolean;
notes?: string;
testedAt: Date;
testedBy?: string;
}
type Phase = 'draft' | 'active' | 'test' | 'code' | 'qa' | 'completed' | 'archived';
type SpecStatus = 'pending' | 'in-progress' | 'blocked' | 'completed';
import { Workflow } from '@specsafe/core';
async function main() {
const workflow = new Workflow({
specsDir: './specs',
projectName: 'My App'
});
// Create a spec
await workflow.createSpec('email-validation', `
# Email Validation
## Requirements
### REQ-001: Valid Email Format
**Given** an email input field
**When** the user enters "user@example.com"
**Then** the email should be marked as valid
### REQ-002: Invalid Email Format
**Given** an email input field
**When** the user enters "invalid-email"
**Then** an error message should be shown
`);
// Move through phases
await workflow.moveToTest('email-validation');
await workflow.moveToCode('email-validation');
await workflow.moveToQA('email-validation', { passed: true });
await workflow.complete('email-validation');
}
main();
import { ProjectTracker } from '@specsafe/core';
async function printStats() {
const tracker = new ProjectTracker('./specs');
const state = await tracker.getProjectState();
console.log(`Active specs: ${state.activeSpecs.length}`);
console.log(`Completed: ${state.completedSpecs.length}`);
console.log(`Archived: ${state.archivedSpecs.length}`);
}
MIT © Agentic Engineering
FAQs
Core types and workflow engine for SpecSafe
The npm package @specsafe/core receives a total of 1 weekly downloads. As such, @specsafe/core popularity was classified as not popular.
We found that @specsafe/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.