docs: correct and cut the markdown

README named the package @stackbox/fp-plugins in all six install and import
examples; it is @stackbox-dev/fp-plugins, so following the README could not work.
It also documented 168 lines of the event-bus plugin deleted in c001efc, claimed
Node 18+ against engines >=22, described the local default as the system temp dir
rather than a stackboxwms subdirectory, and gave no registry config for a package
published only to GitHub Packages. Rewritten for consumers: 378 -> 154 lines, with
env vars checked line by line against file-store.ts, and the automatic
FastifyInstance.FileStore typing and lazy SDK loading documented for the first time.

CLAUDE.md claimed its list was every script (prepare and prepublishOnly are also
defined) and omitted utils.spec.ts.

gen-test skill said cloud SDKs are never containerised and there are no
Docker-based tests, contradicting the MinIO integration spec.

security-reviewer agent reviewed the deleted event-bus — broker connections, the
publish endpoint, NATS and RabbitMQ clients. Rescoped to the file store.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: saby1101

.claude/agents/security-reviewer.md

@@ -1,18 +1,25 @@
 ---
 name: security-reviewer
-description: Reviews event-bus and file-store code for credential handling, injection risks, and insecure defaults
+description: Reviews file-store code for credential handling, path traversal, and insecure defaults
 tools: ["Read", "Grep", "Glob"]
 ---
 
-You are a security reviewer for a Fastify plugin library that handles cloud credentials and message broker connections.
+You are a security reviewer for `@stackbox-dev/fp-plugins`, a Fastify plugin library
+that wraps cloud storage (AWS S3, GCS, Azure Blob, MinIO, local filesystem) behind one
+`FileStore` interface (`src/file-store.ts`).
 
 Review the changed or specified files for:
 
-1. **Credential exposure**: Hardcoded secrets, credentials logged to stdout, tokens in error messages
-2. **Unsafe deserialization**: `JSON.parse` without try/catch or validation, especially on message payloads from external brokers
-3. **Injection risks**: Unsanitized input in the `/event-bus/publish/:event` endpoint, template literal injection in queue/topic names
-4. **Insecure defaults**: Missing TLS, overly permissive CORS, unauthenticated endpoints exposed by default
-5. **Resource leaks**: Unclosed connections, missing cleanup in error paths, containers not stopped in tests
-6. **Dependency concerns**: Known vulnerable patterns in AWS SDK, Azure SDK, GCP SDK, NATS, or RabbitMQ client usage
+1. **Credential exposure**: hardcoded secrets, credentials or endpoints logged, tokens
+   leaking into error messages
+2. **Path traversal**: `filepath` arguments are joined onto a base directory in
+   `LocalFileStore` and used as object keys in the cloud providers — check whether new
+   code lets `..` escape `LOCAL_STORAGE_DIR` or weakens key handling
+3. **Insecure defaults**: env-var fallbacks that silently point at the wrong
+   region/endpoint, TLS disabled, anonymous credentials
+4. **Resource leaks**: unclosed streams or clients, missing cleanup in error paths
+5. **SDK misuse**: unsafe patterns in AWS/GCP/Azure SDK usage, e.g. disabling
+   certificate validation
 
-Report findings with severity (critical/high/medium/low), file location, and a suggested fix.
+Report findings with severity (critical/high/medium/low), file location, and a
+suggested fix.

.claude/skills/gen-test/SKILL.md

@@ -20,9 +20,13 @@ Generate a Jest test file for a given source module in this project.
 - Test files live alongside source: `src/foo.ts` → `src/foo.spec.ts`.
   Provider-specific specs are suffixed: `file-store.<provider>.spec.ts`
 - `ts-jest` preset, `testEnvironment: "node"`
-- Cloud SDKs are **mocked**, never containerised — `jest.mock("@google-cloud/storage")`
-  and friends. This package has no Docker-based tests and no `testcontainers`
-  dependency; do not add one
+- Cloud SDKs are **mocked** in unit specs — `jest.mock("@google-cloud/storage")` and
+  friends. The one exception is `src/file-store.minio.integration.spec.ts`, which talks
+  to a real MinIO over the S3 wire protocol; it self-skips unless `MINIO_TEST_ENDPOINT`
+  is set and runs via `pnpm run test:integration`. No `testcontainers` dependency; do
+  not add one
+- Behavioural changes to S3/MinIO paths need cases in the integration spec too —
+  mocked tests cannot catch SDK behaviour changes (see CLAUDE.md, Testing)
 - `LocalFileStore` is the exception: test it against the real filesystem using
   `fs.promises.mkdtemp` under `os.tmpdir()`, and clean up in `afterEach`
 - Save and restore `process.env` around tests that set provider env vars

CLAUDE.md

@@ -13,7 +13,8 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 - **Clean**: `pnpm run clean` — removes `dist`
 - **Transpile**: `pnpm run transpile` — TypeScript compilation only
 
-These are the only scripts defined in `package.json`. CI (`.github/workflows/`) runs
+The only other scripts in `package.json` are `prepare` (husky) and `prepublishOnly`
+(build before publish). CI (`.github/workflows/`) runs
 `pnpm install --frozen-lockfile`, then lint, build and test on Node 24; the package declares
 `engines: node >=22`.
 
@@ -57,8 +58,8 @@ Registered via `fastify-plugin` (v6) and decorates the Fastify instance with
 ## Testing
 
 Jest + ts-jest. Tests live beside their source in `src/` as `*.spec.ts`, split by
-provider: `file-store.local.spec.ts`, `.gcs.`, `.s3.`, `.azure.`, plus the original
-`file-store.spec.ts` and `integration.spec.ts`. Coverage is 100% on statements,
+provider: `file-store.local.spec.ts`, `.gcs.`, `.s3.`, `.azure.`, plus
+`file-store.spec.ts`, `integration.spec.ts` and `utils.spec.ts`. Coverage is 100% on statements,
 branches, functions and lines — keep it there.
 
 Cloud SDKs are mocked with `jest.mock(...)`; `LocalFileStore` runs against the real

CONTRIBUTING.md

@@ -2,8 +2,9 @@
 
 ## Setup
 
-This repository uses **pnpm** (pinned via `packageManager` in `package.json`). Do not
-use npm or yarn — `pnpm-lock.yaml` is the committed lockfile and the only one CI reads.
+Node.js >= 22 (CI runs 24). This repository uses **pnpm** (pinned via `packageManager`
+in `package.json`). Do not use npm or yarn — `pnpm-lock.yaml` is the committed lockfile
+and the only one CI reads.
 
 ```bash
 pnpm install