@apifuse/provider-sdk 2.2.0-beta.2 → 2.2.0-beta.21

package/README.md

@@ -119,7 +119,11 @@ the bad request path; provider/runtime failures include `code`, `message`, and
   local-only values through `connection.secrets`. Read them in handlers with
   `ctx.credential.get("key")` or `ctx.credential.getAccessToken()`.
 - **Provider env secrets**: declare `secrets[]`, set values in your shell or
-  `.env`, and read only those names through `ctx.env.get("NAME")`.
+  `.env`, and read only those names through `ctx.env.get("NAME")`. The SDK
+  enforces presence of `required: true` declarations before handlers and auth
+  flows run, failing the invocation with a structured `MISSING_SECRET` error
+  (HTTP 400, category `credential_unavailable`) — do not re-check presence in
+  handlers.
 - **Credentials auth flows**: prefer `defineCredentialsAuth()` over hand-written
   `auth.flow`. Declare the form fields and credential keys once, then put the
   upstream login/session creation in `login(ctx, input)`. Return
@@ -134,14 +138,56 @@ the bad request path; provider/runtime failures include `code`, `message`, and
 - **Stealth-sensitive providers**: use `ctx.http` for normal JSON/REST calls and
   `ctx.stealth.fetch()` when you need browser-like session or cookie control.
   `ctx.stealth.fetch()` uses the impit-backed browser stealth transport and
-  accepts request controls for `params`, `proxy`, `timeout`, `profile`,
-  `redirect`, `throwOnHttpError`, and `stealth.insecureSkipVerify`. For login
+  accepts request controls for `params`, `sensitiveParams`, `proxy`, `timeout`, `profile`,
+  `maxBodyBytes`, `redirect`, `throwOnHttpError`, and
+  `stealth.insecureSkipVerify`. For login
   flows that must inspect intermediate `Location`/`Set-Cookie` headers, create
   a session with `ctx.stealth.createSession()` and use `session.redirects.run()`;
   inspect accumulated cookies through `session.cookies`. Select an SDK stealth
   `profile` such as `chrome-146`; do not tune JA3, HTTP/2 SETTINGS, or
   pseudo-header order in provider code. Chrome/Firefox-style profiles are
   supported; use `ctx.browser` when Safari-specific behavior is required.
+- **Query-parameter credentials**: when an upstream requires a credential in
+  its URL query, pass it through `sensitiveParams`, not `params` and never a
+  hand-built URL. It is sent as a normal query parameter while the SDK redacts
+  its value from transport errors, traces, and recorded fixtures:
+
+  ```ts
+  const response = await ctx.http.get("/openapi/service", {
+    params: { page: 1 },
+    sensitiveParams: { serviceKey: ctx.env.get("APIFUSE__PROVIDER__EXAMPLE__API_KEY")! },
+  });
+  ```
+
+  Use this only when the upstream offers no header or body credential channel.
+  Declared query-key positions and exact scalar diagnostics are always redacted.
+  Free-text values of four or more characters are redacted as substrings; shorter
+  values require token boundaries so low-entropy values do not corrupt unrelated
+  words or timestamps. Consequently, a sub-four-character secret embedded in a
+  larger alphanumeric token can remain in free text; prefer higher-entropy or
+  non-query credentials when possible. `sensitiveParams: {}` is equivalent to
+  omitting the option. Redirect results structurally redact declared keys and
+  common response-only credential keys from hop URLs; use
+  `redirects.run({ stopWhen })` to inspect a real intermediate `Location` during
+  the run when a login flow needs a rotated value.
+- **Proxy URLs for non-stealth consumers**: use `resolveProxy()` when a
+  provider-owned client outside `ctx.stealth` needs the provider's proxy, such
+  as a CAPTCHA solver that must use matching egress. Pass the provider proxy
+  policy used by the provider and consume the returned `url`; the SDK owns
+  vendor selection, allocation, failover, and URL formats. Never call proxy
+  allocator APIs or hardcode proxy vendor hostnames in provider code.
+
+  ```ts
+  import { resolveProxy } from "@apifuse/provider-sdk"
+
+  const resolvedProxy = await resolveProxy({
+    proxyPolicy,
+    affinityKey: connectionId,
+  })
+
+  if (!resolvedProxy.url) throw new Error("This login requires proxy egress")
+  const captchaTask = { proxy: resolvedProxy.url }
+  ```
 - **Browser providers**: for TypeScript Providers use `runtime: "browser"` plus
   `browser.engine: "playwright-stealth"`; `nodriver` is a Python-runtime path.
   Install local browser assets with `bunx playwright install chromium` when

package/SUBMISSION.md

@@ -50,7 +50,7 @@ Fix all blockers before submitting:
 - High-confidence secret or token material in source, README, package metadata, or fixtures.
 - SDK-native source blockers: prefixed Provider ids, `vendor/` SDK shims or imports, raw `.describe()` prose instead of `describeKey`, raw global `fetch()` calls, and excessive `as Type` assertions.
 
-Warnings do not fail the command, but they should be addressed when practical. For example, the generated starter `ping` operation warns because it is not a real upstream-backed bounty Operation. SDK-native warnings also flag moderate `as Type` assertion counts and credentialed Providers that never reference `ctx.credential`.
+Warnings do not fail the command, but they should be addressed when practical. For example, the generated starter `ping` operation warns because it is not a real upstream-backed bounty Operation. SDK-native warnings also flag moderate `as Type` assertion counts, credentialed Providers that never reference `ctx.credential`, and provider-local re-validation of declared env secrets (`sdk-owned-secret-presence`, 0 points): the SDK already rejects invocations with a structured `MISSING_SECRET` error when a declared `required: true` secret is unset, so `requireServiceKey`-style presence guards are deprecated dead weight — delete the guard and read the value directly with `ctx.env.get()`, or acknowledge a deliberate exception with `// @apifuse-allow sdk-owned-secret-presence: <reason>`.
 
 ## Measured local smoke
 

package/bin/apifuse-check.ts

@@ -6,9 +6,14 @@ import { pathToFileURL } from "node:url";
 
 import { z } from "zod";
 
-import type { ProviderDefinition } from "../src";
-import { lintProvider, type ProviderLintMode } from "../src/lint";
-import { safeParseSchemaSync } from "../src/schema";
+import {
+	formatPromptAssetIssues,
+	PROMPT_ASSET_SYNC_REMEDIATION,
+	verifyPromptAssets,
+} from "../src/cli/prompt-assets.js";
+import type { ProviderDefinition } from "../src/index.js";
+import { lintProvider, type ProviderLintMode } from "../src/lint.js";
+import { safeParseSchemaSync } from "../src/schema.js";
 
 const HELP_TEXT = `Usage: apifuse check [path]
 Example: apifuse check providers/korea-air-quality
@@ -24,9 +29,7 @@ export type RunChecksOptions = {
 	lintMode?: ProviderLintMode;
 };
 
-type SafeParseResult =
-	| { success: true; data: unknown }
-	| { success: false; error: unknown };
+type SafeParseResult = { success: true; data: unknown } | { success: false; error: unknown };
 
 export async function main() {
 	const args = normalizeArgs(process.argv.slice(2));
@@ -63,7 +66,7 @@ function normalizeArgs(argv: string[]): string[] {
 	return argv[0] === "check" ? argv.slice(1) : argv;
 }
 
-function resolveProviderRoot(inputPath: string): string {
+export function resolveProviderRoot(inputPath: string): string {
 	const resolvedInput = resolveFromParents(inputPath);
 
 	if (!existsSync(resolvedInput)) {
@@ -131,9 +134,26 @@ export async function runChecks(
 		checkProviderMetadata(provider),
 		checkDockerfile(dockerfilePath),
 		checkPackageJson(packageJsonPath),
+		checkPromptAssets(providerRoot),
 	];
 }
 
+export const PROMPT_ASSETS_CHECK_MESSAGE =
+	"Agent prompt assets match the installed SDK version";
+
+function checkPromptAssets(providerRoot: string): CheckResult {
+	const verification = verifyPromptAssets(providerRoot);
+	if (verification.ok) {
+		return { message: PROMPT_ASSETS_CHECK_MESSAGE, passed: true };
+	}
+
+	return {
+		message: PROMPT_ASSETS_CHECK_MESSAGE,
+		passed: false,
+		details: [...formatPromptAssetIssues(verification), PROMPT_ASSET_SYNC_REMEDIATION],
+	};
+}
+
 function isScannableProviderSourceFile(relativePath: string): boolean {
 	return (
 		/\.(?:ts|tsx|js|jsx|mjs|cjs|sh|bash)$/.test(relativePath) ||
@@ -142,17 +162,12 @@ function isScannableProviderSourceFile(relativePath: string): boolean {
 	);
 }
 
-function collectProviderSourceFiles(
-	providerRoot: string,
-): Record<string, string> {
+function collectProviderSourceFiles(providerRoot: string): Record<string, string> {
 	const sources: Record<string, string> = {};
-	const skipDirectories = new Set([
-		".git",
-		"node_modules",
-		"dist",
-		"build",
-		".next",
-	]);
+	// `.agents`/`.apifuse` are deliberately not skipped: managed content there
+	// is markdown/JSON (never matched by isScannableProviderSourceFile), and a
+	// planted `.ts`/`.sh` under those directories must stay in scanner scope.
+	const skipDirectories = new Set([".git", "node_modules", "dist", "build", ".next"]);
 	const visit = (directory: string) => {
 		for (const entry of readdirSync(directory, { withFileTypes: true })) {
 			const path = resolve(directory, entry.name);
@@ -162,10 +177,7 @@ function collectProviderSourceFiles(
 				}
 				continue;
 			}
-			if (
-				!entry.isFile() ||
-				!isScannableProviderSourceFile(path.slice(providerRoot.length + 1))
-			) {
+			if (!entry.isFile() || !isScannableProviderSourceFile(path.slice(providerRoot.length + 1))) {
 				continue;
 			}
 			sources[path.slice(providerRoot.length + 1)] = readFileSync(path, "utf8");
@@ -175,10 +187,7 @@ function collectProviderSourceFiles(
 	return sources;
 }
 
-function checkIndex(
-	indexPath: string,
-	provider: ProviderDefinition | undefined,
-): CheckResult {
+function checkIndex(indexPath: string, provider: ProviderDefinition | undefined): CheckResult {
 	if (!existsSync(indexPath)) {
 		return {
 			message: "index.ts exists and exports default defineProvider",
@@ -200,9 +209,7 @@ function checkIndex(
 	};
 }
 
-function checkOperations(
-	provider: ProviderDefinition | undefined,
-): CheckResult {
+function checkOperations(provider: ProviderDefinition | undefined): CheckResult {
 	if (!provider) {
 		return {
 			message: "All operations have handler, input, output",
@@ -277,20 +284,14 @@ function checkSchemas(provider: ProviderDefinition | undefined): CheckResult {
 			continue;
 		}
 
-		const requestResult = parseFixture(
-			operation.input,
-			operation.fixtures.request,
-		);
+		const requestResult = parseFixture(operation.input, operation.fixtures.request);
 		if (!requestResult.success) {
 			failures.push(
 				`${operationId}: request fixture invalid (${formatSchemaError(requestResult.error)})`,
 			);
 		}
 
-		const responseResult = parseFixture(
-			operation.output,
-			operation.fixtures.response,
-		);
+		const responseResult = parseFixture(operation.output, operation.fixtures.response);
 		if (!responseResult.success) {
 			failures.push(
 				`${operationId}: response fixture invalid (${formatSchemaError(responseResult.error)})`,
@@ -317,13 +318,8 @@ function checkAuthoringLint(
 		};
 	}
 
-	const diagnostics = lintProvider(
-		{ ...provider, providerSourceFiles },
-		{ mode: lintMode },
-	);
-	const errors = diagnostics.filter(
-		(diagnostic) => diagnostic.level === "error",
-	);
+	const diagnostics = lintProvider({ ...provider, providerSourceFiles }, { mode: lintMode });
+	const errors = diagnostics.filter((diagnostic) => diagnostic.level === "error");
 	const details = diagnostics.map((diagnostic) => {
 		const field = diagnostic.field ? `${diagnostic.field}: ` : "";
 		return `${diagnostic.level.toUpperCase()} ${diagnostic.rule} ${field}${diagnostic.message}`;
@@ -336,9 +332,7 @@ function checkAuthoringLint(
 	};
 }
 
-function checkProviderMetadata(
-	provider: ProviderDefinition | undefined,
-): CheckResult {
+function checkProviderMetadata(provider: ProviderDefinition | undefined): CheckResult {
 	if (!provider) {
 		return {
 			message: "Provider metadata is declared in defineProvider",
@@ -425,18 +419,12 @@ function checkPackageJson(packageJsonPath: string): CheckResult {
 	}
 }
 
-function assertProviderDefinition(
-	value: unknown,
-): ProviderDefinition | undefined {
+function assertProviderDefinition(value: unknown): ProviderDefinition | undefined {
 	return isProviderDefinition(value) ? value : undefined;
 }
 
 function isProviderDefinition(value: unknown): value is ProviderDefinition {
-	if (
-		!isRecord(value) ||
-		!isRecord(value.meta) ||
-		!isRecord(value.operations)
-	) {
+	if (!isRecord(value) || !isRecord(value.meta) || !isRecord(value.operations)) {
 		return false;
 	}
 
@@ -457,8 +445,7 @@ function hasSchemaParser(value: unknown): boolean {
 	return (
 		isRecord(value) &&
 		(typeof value.safeParse === "function" ||
-			(isRecord(value["~standard"]) &&
-				typeof value["~standard"].validate === "function"))
+			(isRecord(value["~standard"]) && typeof value["~standard"].validate === "function"))
 	);
 }
 
@@ -470,9 +457,7 @@ function formatSchemaError(error: unknown): string {
 	if (Array.isArray(error)) {
 		return error
 			.map((issue) =>
-				isRecord(issue) && typeof issue.message === "string"
-					? issue.message
-					: String(issue),
+				isRecord(issue) && typeof issue.message === "string" ? issue.message : String(issue),
 			)
 			.join(", ");
 	}

package/bin/apifuse-create.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env bun
 
-import { main as runMain } from "../src/cli/create";
+import { main as runMain } from "../src/cli/create.js";
 
 export { runMain as main };
 

package/bin/apifuse-dev.ts

@@ -2,7 +2,7 @@
 
 import { existsSync } from "node:fs";
 import { dirname, relative, resolve } from "node:path";
-import type { ProviderDefinition } from "../src";
+import type { ProviderDefinition } from "../src/index.js";
 import {
 	createBrowserClient,
 	createCredentialContext,
@@ -14,10 +14,10 @@ import {
 	createSttClientFromEnv,
 	PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV,
 	ProviderError,
-} from "../src";
-import { createMemoryProviderRuntimeState } from "../src/runtime/state";
-import { createTraceContext } from "../src/runtime/trace";
-import type { BrowserClient, ProviderContext } from "../src/types";
+} from "../src/index.js";
+import { createMemoryProviderRuntimeState } from "../src/runtime/state.js";
+import { createTraceContext } from "../src/runtime/trace.js";
+import type { BrowserClient, ProviderContext } from "../src/types.js";
 
 const HELP_TEXT = `Usage: apifuse dev [path]
 Example: apifuse dev providers/korea-air-quality
@@ -33,12 +33,9 @@ export async function main() {
 
 	const providerPath = resolveProviderPath(args[0] ?? ".");
 	const providerModule = await import(resolve(providerPath, "index.ts"));
-	const provider = assertProviderDefinition(
-		providerModule.default,
-		providerPath,
-	);
+	const provider = assertProviderDefinition(providerModule.default, providerPath);
 
-	const { startDevServer } = await import("../src/dev");
+	const { startDevServer } = await import("../src/dev.js");
 	const port = Number(process.env.APIFUSE__RUNTIME__PORT) || 3900;
 
 	startDevServer(provider, { port });
@@ -57,8 +54,7 @@ export async function main() {
 
 	const firstOperation = Object.keys(provider.operations)[0];
 	if (firstOperation) {
-		const sampleInput =
-			provider.operations[firstOperation]?.fixtures?.request ?? {};
+		const sampleInput = provider.operations[firstOperation]?.fixtures?.request ?? {};
 		const sampleBody = JSON.stringify({
 			requestId: `req_local_${firstOperation}`,
 			input: sampleInput,
@@ -149,9 +145,7 @@ function renderHotReloadCommand(providerPath: string, port: number): string {
 	const devEntry = resolve(providerPath, "dev.ts");
 	if (existsSync(devEntry)) {
 		const relativeDevEntry = relative(process.cwd(), devEntry) || "dev.ts";
-		const portPrefix = process.env.APIFUSE__RUNTIME__PORT
-			? `APIFUSE__RUNTIME__PORT=${port} `
-			: "";
+		const portPrefix = process.env.APIFUSE__RUNTIME__PORT ? `APIFUSE__RUNTIME__PORT=${port} ` : "";
 		return `${portPrefix}bun --hot ${relativeDevEntry}`;
 	}
 	return "rerun `apifuse dev` after edits (no dev.ts entrypoint found)";
@@ -166,40 +160,28 @@ function createUnsupportedBrowserStub(): BrowserClient {
 		engine: "playwright-stealth",
 		async close() {},
 		async newPage() {
-			throw new ProviderError(
-				"Browser runtime is not enabled for this provider",
-				{
-					code: "BROWSER_RUNTIME_UNSUPPORTED",
-					fix: 'Set provider runtime to "browser" to use ctx.browser',
-				},
-			);
+			throw new ProviderError("Browser runtime is not enabled for this provider", {
+				code: "BROWSER_RUNTIME_UNSUPPORTED",
+				fix: 'Set provider runtime to "browser" to use ctx.browser',
+			});
 		},
 		async rawPage() {
-			throw new ProviderError(
-				"Browser runtime is not enabled for this provider",
-				{
-					code: "BROWSER_RUNTIME_UNSUPPORTED",
-					fix: 'Set provider runtime to "browser" and APIFUSE__CDP_POOL__URL to use ctx.browser.rawPage',
-				},
-			);
+			throw new ProviderError("Browser runtime is not enabled for this provider", {
+				code: "BROWSER_RUNTIME_UNSUPPORTED",
+				fix: 'Set provider runtime to "browser" and APIFUSE__CDP_POOL__URL to use ctx.browser.rawPage',
+			});
 		},
 		async withIsolatedContext() {
-			throw new ProviderError(
-				"Browser runtime is not enabled for this provider",
-				{
-					code: "BROWSER_RUNTIME_UNSUPPORTED",
-					fix: 'Set provider runtime to "browser" to use ctx.browser.withIsolatedContext',
-				},
-			);
+			throw new ProviderError("Browser runtime is not enabled for this provider", {
+				code: "BROWSER_RUNTIME_UNSUPPORTED",
+				fix: 'Set provider runtime to "browser" to use ctx.browser.withIsolatedContext',
+			});
 		},
 		async solveChallenge() {
-			throw new ProviderError(
-				"Browser runtime is not enabled for this provider",
-				{
-					code: "BROWSER_RUNTIME_UNSUPPORTED",
-					fix: 'Set provider runtime to "browser" to use ctx.browser.solveChallenge',
-				},
-			);
+			throw new ProviderError("Browser runtime is not enabled for this provider", {
+				code: "BROWSER_RUNTIME_UNSUPPORTED",
+				fix: 'Set provider runtime to "browser" to use ctx.browser.solveChallenge',
+			});
 		},
 	};
 }
@@ -216,10 +198,7 @@ function createUnsupportedAuthStub() {
 	};
 }
 
-function assertProviderDefinition(
-	value: unknown,
-	providerPath: string,
-): ProviderDefinition {
+function assertProviderDefinition(value: unknown, providerPath: string): ProviderDefinition {
 	if (!isProviderDefinition(value)) {
 		throw new Error(
 			`Expected ${resolve(providerPath, "index.ts")} to export default defineProvider(...)`,
@@ -230,11 +209,7 @@ function assertProviderDefinition(
 }
 
 function isProviderDefinition(value: unknown): value is ProviderDefinition {
-	if (
-		!isRecord(value) ||
-		!isRecord(value.meta) ||
-		!isRecord(value.operations)
-	) {
+	if (!isRecord(value) || !isRecord(value.meta) || !isRecord(value.operations)) {
 		return false;
 	}
 

package/bin/apifuse-pack-check.ts

@@ -48,6 +48,13 @@ const requiredPaths = [
 	"src/cli/templates/provider/operations/ping.ts.tpl",
 	"src/cli/templates/provider/schemas/ping.ts.tpl",
 	"src/cli/templates/provider/upstream/README.md.tpl",
+	"src/cli/templates/provider/AGENTS.md.tpl",
+	"src/cli/templates/provider/.agents/skills/normalization-standards/SKILL.md.tpl",
+	"src/cli/templates/provider/.agents/skills/upstream-contract-verification/SKILL.md.tpl",
+	"src/cli/templates/provider/.agents/skills/fixtures-and-recording/SKILL.md.tpl",
+	"src/cli/templates/provider/.agents/skills/pagination-and-counts/SKILL.md.tpl",
+	"src/cli/templates/provider/.agents/skills/health-checks-and-fail-closed/SKILL.md.tpl",
+	"src/cli/templates/provider/.agents/skills/upstream-notes/README.md.tpl",
 	"dist/cli/templates/provider/.dockerignore.tpl",
 	"dist/cli/templates/provider/.gitignore.tpl",
 	"dist/cli/templates/provider/Dockerfile.tpl",
@@ -60,6 +67,13 @@ const requiredPaths = [
 	"dist/cli/templates/provider/operations/ping.ts.tpl",
 	"dist/cli/templates/provider/schemas/ping.ts.tpl",
 	"dist/cli/templates/provider/upstream/README.md.tpl",
+	"dist/cli/templates/provider/AGENTS.md.tpl",
+	"dist/cli/templates/provider/.agents/skills/normalization-standards/SKILL.md.tpl",
+	"dist/cli/templates/provider/.agents/skills/upstream-contract-verification/SKILL.md.tpl",
+	"dist/cli/templates/provider/.agents/skills/fixtures-and-recording/SKILL.md.tpl",
+	"dist/cli/templates/provider/.agents/skills/pagination-and-counts/SKILL.md.tpl",
+	"dist/cli/templates/provider/.agents/skills/health-checks-and-fail-closed/SKILL.md.tpl",
+	"dist/cli/templates/provider/.agents/skills/upstream-notes/README.md.tpl",
 	"dist/auth-turn/index.js",
 	"dist/auth-turn/index.d.ts",
 	"dist/auth-turn/auth-turn.v1.schema.json",

package/bin/apifuse-pack-smoke.ts

@@ -1,19 +1,7 @@
 #!/usr/bin/env bun
 
-import {
-	type ChildProcess,
-	execFileSync,
-	spawn,
-	spawnSync,
-} from "node:child_process";
-import {
-	existsSync,
-	mkdirSync,
-	mkdtempSync,
-	readFileSync,
-	rmSync,
-	writeFileSync,
-} from "node:fs";
+import { type ChildProcess, execFileSync, spawn, spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { createServer } from "node:net";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
@@ -41,9 +29,7 @@ const PING_RESPONSE_SCHEMA = z.object({
 
 const KEEP_TEMP = process.env.APIFUSE__PACK_SMOKE__KEEP_TEMP === "1";
 
-const tempRoot = mkdtempSync(
-	join(tmpdir(), "apifuse-provider-sdk-pack-smoke-"),
-);
+const tempRoot = mkdtempSync(join(tmpdir(), "apifuse-provider-sdk-pack-smoke-"));
 const packDir = join(tempRoot, "pack");
 const consumerDir = join(tempRoot, "consumer");
 const externalWorkspaceDir = join(tempRoot, "external-workspace");
@@ -73,6 +59,20 @@ try {
 	);
 
 	run("bun", ["install"], consumerDir);
+	run(
+		"bun",
+		[
+			"--eval",
+			[
+				'import { resolveProxy } from "@apifuse/provider-sdk";',
+				'if (typeof resolveProxy !== "function") throw new Error("resolveProxy is not exported");',
+				'const resolved = await resolveProxy({ proxy: "http://127.0.0.1:8080" });',
+				'if (resolved.url !== "http://127.0.0.1:8080") throw new Error("resolveProxy returned the wrong URL");',
+				'console.log("packed root resolveProxy export OK");',
+			].join("\n"),
+		],
+		consumerDir,
+	);
 
 	const cliBin = join(consumerDir, "node_modules", ".bin", "apifuse");
 	if (!existsSync(cliBin)) {
@@ -81,15 +81,7 @@ try {
 
 	run(
 		"bun",
-		[
-			cliBin,
-			"create",
-			"dx-smoke",
-			"--yes",
-			"--json",
-			"--sdk-specifier",
-			tarballSpecifier,
-		],
+		[cliBin, "create", "dx-smoke", "--yes", "--json", "--sdk-specifier", tarballSpecifier],
 		consumerDir,
 	);
 
@@ -99,11 +91,7 @@ try {
 	run("bun", ["run", "test"], generatedProviderDir);
 	assertGeneratedReadme(generatedProviderDir);
 	await smokeGeneratedDevServer(generatedProviderDir);
-	assertExternalWorkspaceTopology(
-		cliBin,
-		externalWorkspaceDir,
-		tarballSpecifier,
-	);
+	assertExternalWorkspaceTopology(cliBin, externalWorkspaceDir, tarballSpecifier);
 
 	console.log(
 		`Provider SDK packed-artifact smoke passed: ${tarballPath} -> ${generatedProviderDir}`,
@@ -148,15 +136,8 @@ function assertExternalWorkspaceTopology(
 		externalWorkspaceDir,
 	);
 
-	const generatedProviderDir = join(
-		externalWorkspaceDir,
-		"external-workspace-smoke",
-	);
-	const forbiddenProviderDir = join(
-		externalWorkspaceDir,
-		"providers",
-		"external-workspace-smoke",
-	);
+	const generatedProviderDir = join(externalWorkspaceDir, "external-workspace-smoke");
+	const forbiddenProviderDir = join(externalWorkspaceDir, "providers", "external-workspace-smoke");
 	if (!existsSync(generatedProviderDir)) {
 		throw new Error(
 			"Public create must generate a one-provider repository at <name>/ even when providers/ exists.",
@@ -168,9 +149,7 @@ function assertExternalWorkspaceTopology(
 		);
 	}
 
-	const packageJson = JSON.parse(
-		readFileSync(join(generatedProviderDir, "package.json"), "utf8"),
-	);
+	const packageJson = JSON.parse(readFileSync(join(generatedProviderDir, "package.json"), "utf8"));
 	const sdkDependency = packageJson?.dependencies?.["@apifuse/provider-sdk"];
 	if (sdkDependency !== tarballSpecifier) {
 		throw new Error(
@@ -178,9 +157,7 @@ function assertExternalWorkspaceTopology(
 		);
 	}
 	if (JSON.stringify(packageJson).includes("workspace:")) {
-		throw new Error(
-			"External bounty workspace scaffold must not contain workspace: dependencies.",
-		);
+		throw new Error("External bounty workspace scaffold must not contain workspace: dependencies.");
 	}
 
 	run("bun", ["install"], generatedProviderDir);
@@ -199,30 +176,20 @@ function assertExternalWorkspaceTopology(
 		},
 	);
 	if (monorepoAttempt.status === 0) {
-		throw new Error(
-			"--preset monorepo must reject outside the private APIFuse monorepo.",
-		);
+		throw new Error("--preset monorepo must reject outside the private APIFuse monorepo.");
 	}
 	const rejectionOutput = `${monorepoAttempt.stdout}\n${monorepoAttempt.stderr}`;
-	if (
-		!rejectionOutput.includes(
-			"Monorepo preset is internal to the APIFuse repository",
-		)
-	) {
+	if (!rejectionOutput.includes("Monorepo preset is internal to the APIFuse repository")) {
 		throw new Error(`Unexpected monorepo rejection output: ${rejectionOutput}`);
 	}
 }
 
 function packSdk(destination: string): { filename: string } {
-	const raw = execFileSync(
-		"npm",
-		["pack", "--json", "--pack-destination", destination],
-		{
-			cwd: process.cwd(),
-			encoding: "utf8",
-			stdio: ["ignore", "pipe", "inherit"],
-		},
-	);
+	const raw = execFileSync("npm", ["pack", "--json", "--pack-destination", destination], {
+		cwd: process.cwd(),
+		encoding: "utf8",
+		stdio: ["ignore", "pipe", "inherit"],
+	});
 	const parsed = PACK_RESULT_SCHEMA.parse(JSON.parse(raw));
 	const first = parsed[0];
 	if (!first) {
@@ -252,29 +219,19 @@ function run(command: string, args: string[], cwd: string): void {
 function assertGeneratedReadme(providerDir: string): void {
 	const readme = readFileSync(join(providerDir, "README.md"), "utf8");
 	if (!readme.includes('"requestId":"req_local_ping"')) {
-		throw new Error(
-			"Generated README is missing requestId in local smoke docs.",
-		);
+		throw new Error("Generated README is missing requestId in local smoke docs.");
 	}
 	if (readme.includes('"connection":null')) {
-		throw new Error(
-			"Generated README must not document connection:null for no-auth local smoke.",
-		);
+		throw new Error("Generated README must not document connection:null for no-auth local smoke.");
 	}
 	if (!readme.includes("bunx playwright install chromium")) {
-		throw new Error(
-			"Generated README is missing browser runtime troubleshooting guidance.",
-		);
+		throw new Error("Generated README is missing browser runtime troubleshooting guidance.");
 	}
 	if (!readme.includes("impit")) {
-		throw new Error(
-			"Generated README is missing impit stealth runtime guidance.",
-		);
+		throw new Error("Generated README is missing impit stealth runtime guidance.");
 	}
 	if (!readme.includes("bun run submit-check")) {
-		throw new Error(
-			"Generated README must document the submit-check pre-submission workflow.",
-		);
+		throw new Error("Generated README must document the submit-check pre-submission workflow.");
 	}
 	if (!readme.includes("bun run record -- --operation <operation>")) {
 		throw new Error(
@@ -368,9 +325,7 @@ async function waitForHttp(
 
 	while (Date.now() < deadline) {
 		if (server.exitCode !== null) {
-			throw new Error(
-				`Dev server exited early with code ${server.exitCode}\n${getOutput()}`,
-			);
+			throw new Error(`Dev server exited early with code ${server.exitCode}\n${getOutput()}`);
 		}
 
 		try {