@pikku/inspector 0.12.50 → 0.12.54

package/src/add/addon-bans.test.ts

@@ -104,17 +104,17 @@ describe('addon authoring bans', () => {
     })
   })
 
-  test('wireSecret inside an addon is allowed', async () => {
+  test('defineSecret inside an addon is allowed', async () => {
     const source = [
-      "import { wireSecret } from '@pikku/core'",
-      "wireSecret({ name: 'example', secretId: 'EXAMPLE' } as any)",
+      "import { defineSecret } from '@pikku/core'",
+      "defineSecret({ name: 'example', secretId: 'EXAMPLE' } as any)",
     ].join('\n')
     await withTempApp(source, async (file, rootDir) => {
       const { logger, criticals } = recordingLogger()
       await inspect(logger, [file], { rootDir, isAddon: true })
       assert.ok(
         !criticals.some((c) => c.code === ErrorCode.ADDON_WIRING_NOT_ALLOWED),
-        `expected wireSecret to be allowed, got ${JSON.stringify(criticals)}`
+        `expected defineSecret to be allowed, got ${JSON.stringify(criticals)}`
       )
     })
   })

package/src/add/allow-escape-hatches.test.ts

@@ -0,0 +1,144 @@
+import { strict as assert } from 'assert'
+import { describe, test } from 'node:test'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { inspect } from '../inspector.js'
+import { ErrorCode } from '../error-codes.js'
+import type { InspectorLogger, InspectorOptions } from '../types.js'
+
+function makeLogger(
+  criticals: Array<{ code: string; message: string }>
+): InspectorLogger {
+  return {
+    debug: () => {},
+    info: () => {},
+    warn: () => {},
+    error: () => {},
+    diagnostic: ({ code, message }: any) => criticals.push({ code, message }),
+    critical: (code: any, message: string) => criticals.push({ code, message }),
+    hasCriticalErrors: () => criticals.length > 0,
+  } as InspectorLogger
+}
+
+async function run(source: string, allow: InspectorOptions['allow'] = {}) {
+  const rootDir = await mkdtemp(join(tmpdir(), 'pikku-allow-'))
+  const file = join(rootDir, 'subject.ts')
+  await writeFile(file, source)
+  const criticals: Array<{ code: string; message: string }> = []
+  const state = await inspect(makeLogger(criticals), [file], {
+    rootDir,
+    allow,
+  })
+  await rm(rootDir, { recursive: true, force: true })
+  return { state, criticals }
+}
+
+const has = (criticals: Array<{ code: string }>, code: ErrorCode) =>
+  criticals.some((c) => c.code === code)
+
+const PERMISSIONS_IN_BODY = [
+  "import { pikkuSessionlessFunc } from '@pikku/core'",
+  'export const stripeWebhook = pikkuSessionlessFunc({',
+  '  expose: true,',
+  '  permissionsInBody: true,',
+  '  func: async () => ({ ok: true }),',
+  '})',
+].join('\n')
+
+const COMPLEX_WORKFLOW = [
+  "import { pikkuWorkflowComplexFunc } from '@pikku/core/workflow'",
+  'export const cleanup = pikkuWorkflowComplexFunc(',
+  '  async (_services, _input, { workflow }: any) => {',
+  '    for (const id of [1, 2, 3]) {',
+  "      await workflow.step('touch', { id })",
+  '    }',
+  '    return { ok: true }',
+  '  }',
+  ')',
+].join('\n')
+
+describe('allow: escape hatches are refused unless opted into', () => {
+  test('permissionsInBody is a critical when not allowed', async () => {
+    const { criticals } = await run(PERMISSIONS_IN_BODY)
+    assert.ok(
+      has(criticals, ErrorCode.PERMISSIONS_IN_BODY_NOT_ALLOWED),
+      `expected PKU576, got ${JSON.stringify(criticals)}`
+    )
+  })
+
+  test('the message names the flag that would permit it', async () => {
+    const { criticals } = await run(PERMISSIONS_IN_BODY)
+    const found = criticals.find(
+      (c) => c.code === ErrorCode.PERMISSIONS_IN_BODY_NOT_ALLOWED
+    )
+    assert.match(found!.message, /allow: \{ permissionsInBody: true \}/)
+    assert.match(found!.message, /stripeWebhook/)
+  })
+
+  test('permissionsInBody is accepted once allowed', async () => {
+    const { criticals, state } = await run(PERMISSIONS_IN_BODY, {
+      permissionsInBody: true,
+    })
+    assert.equal(
+      has(criticals, ErrorCode.PERMISSIONS_IN_BODY_NOT_ALLOWED),
+      false
+    )
+    const meta = Object.values(state.functions.meta) as any[]
+    assert.equal(
+      meta.find((m) => m.name === 'stripeWebhook')?.permissionsInBody,
+      true
+    )
+  })
+
+  test('a refused function is not registered at all', async () => {
+    const { state } = await run(PERMISSIONS_IN_BODY)
+    const meta = Object.values(state.functions.meta) as any[]
+    assert.equal(
+      meta.some((m) => m.name === 'stripeWebhook'),
+      false,
+      'a refused function must not reach the meta, or the build would emit it anyway'
+    )
+  })
+
+  test('complexWorkflows is a critical when not allowed', async () => {
+    const { criticals } = await run(COMPLEX_WORKFLOW)
+    assert.ok(
+      has(criticals, ErrorCode.COMPLEX_WORKFLOW_NOT_ALLOWED),
+      `expected PKU643, got ${JSON.stringify(criticals)}`
+    )
+  })
+
+  test('the complex-workflow message points at the DSL', async () => {
+    const { criticals } = await run(COMPLEX_WORKFLOW)
+    const found = criticals.find(
+      (c) => c.code === ErrorCode.COMPLEX_WORKFLOW_NOT_ALLOWED
+    )
+    assert.match(found!.message, /pikkuWorkflowFunc/)
+    assert.match(found!.message, /allow: \{ complexWorkflows: true \}/)
+  })
+
+  test('complexWorkflows is accepted once allowed', async () => {
+    const { criticals } = await run(COMPLEX_WORKFLOW, {
+      complexWorkflows: true,
+    })
+    assert.equal(has(criticals, ErrorCode.COMPLEX_WORKFLOW_NOT_ALLOWED), false)
+  })
+
+  test('an ordinary function and DSL workflow are unaffected', async () => {
+    const { criticals } = await run(
+      [
+        "import { pikkuFunc } from '@pikku/core'",
+        'export const ordinary = pikkuFunc({',
+        '  expose: true,',
+        '  func: async () => ({ ok: true }),',
+        '})',
+      ].join('\n')
+    )
+    assert.equal(
+      has(criticals, ErrorCode.PERMISSIONS_IN_BODY_NOT_ALLOWED),
+      false
+    )
+    assert.equal(has(criticals, ErrorCode.COMPLEX_WORKFLOW_NOT_ALLOWED), false)
+  })
+})

package/src/add/audit-meta.test.ts

@@ -0,0 +1,75 @@
+import { strict as assert } from 'assert'
+import { describe, test } from 'node:test'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { inspect } from '../inspector.js'
+import type { InspectorLogger } from '../types.js'
+
+const silentLogger = (): InspectorLogger =>
+  ({
+    debug: () => {},
+    info: () => {},
+    warn: () => {},
+    error: () => {},
+    diagnostic: () => {},
+    critical: () => {},
+    hasCriticalErrors: () => false,
+  }) as InspectorLogger
+
+async function metaFor(source: string) {
+  const rootDir = await mkdtemp(join(tmpdir(), 'pikku-audit-'))
+  const file = join(rootDir, 'subject.ts')
+  await writeFile(file, source)
+  const state = await inspect(silentLogger(), [file], { rootDir })
+  await rm(rootDir, { recursive: true, force: true })
+  return Object.values(state.functions.meta) as any[]
+}
+
+const func = (name: string, auditLine: string | null) =>
+  [
+    "import { pikkuFunc } from '@pikku/core'",
+    `export const ${name} = pikkuFunc({`,
+    ...(auditLine ? [`  ${auditLine}`] : []),
+    '  func: async () => ({ ok: true }),',
+    '})',
+  ].join('\n')
+
+describe('the audit flag reaches the function meta', () => {
+  test('`audit: true` resolves to best-effort', async () => {
+    const meta = await metaFor(func('cancelInvoice', 'audit: true,'))
+    assert.deepEqual(meta.find((m) => m.name === 'cancelInvoice')?.audit, {
+      durability: 'best-effort',
+    })
+  })
+
+  test('an explicit durability is carried through', async () => {
+    const meta = await metaFor(
+      func('chargeCard', "audit: { durability: 'transactional' },")
+    )
+    assert.deepEqual(meta.find((m) => m.name === 'chargeCard')?.audit, {
+      durability: 'transactional',
+    })
+  })
+
+  test('an object without a durability defaults to best-effort', async () => {
+    const meta = await metaFor(func('refund', 'audit: {},'))
+    assert.deepEqual(meta.find((m) => m.name === 'refund')?.audit, {
+      durability: 'best-effort',
+    })
+  })
+
+  // Absent rather than `false`: an unmarked function drops `auditLog.write()`
+  // with a warning, so "no audit key" has to be the honest reading of it.
+  test('a function with no audit config carries no audit key', async () => {
+    const meta = await metaFor(func('listInvoices', null))
+    const found = meta.find((m) => m.name === 'listInvoices')
+    assert.ok(found, 'the function should still be registered')
+    assert.equal(found.audit, undefined)
+  })
+
+  test('`audit: false` is the same as not declaring it', async () => {
+    const meta = await metaFor(func('healthCheck', 'audit: false,'))
+    assert.equal(meta.find((m) => m.name === 'healthCheck')?.audit, undefined)
+  })
+})

package/src/add/config-value-metadata.test.ts

@@ -36,17 +36,17 @@ const makeLogger = (criticals: Array<{ code: ErrorCode; message: string }>) =>
  * downstream, which is exactly how `displayName` went unused.
  */
 describe('config value metadata (docsUrl)', () => {
-  test('carries docsUrl from wireSecret into the definition', async () => {
+  test('carries docsUrl from defineSecret into the definition', async () => {
     const rootDir = await mkdtemp(`${fixtureRoot}-secret-`)
     const file = join(rootDir, 'secret.ts')
 
     await writeFile(
       file,
       [
-        "import { wireSecret } from '@pikku/core'",
+        "import { defineSecret } from '@pikku/core'",
         "import { z } from 'zod'",
         'export const StripeKeySchema = z.string()',
-        'wireSecret({',
+        'defineSecret({',
         "  name: 'stripeKey',",
         "  displayName: 'Stripe Secret Key',",
         "  secretId: 'STRIPE_SECRET_KEY',",
@@ -76,10 +76,10 @@ describe('config value metadata (docsUrl)', () => {
     await writeFile(
       file,
       [
-        "import { wireSecret } from '@pikku/core'",
+        "import { defineSecret } from '@pikku/core'",
         "import { z } from 'zod'",
         'export const ApiKeySchema = z.string()',
-        'wireSecret({',
+        'defineSecret({',
         "  name: 'apiKey',",
         "  displayName: 'API Key',",
         "  secretId: 'API_KEY',",
@@ -101,17 +101,17 @@ describe('config value metadata (docsUrl)', () => {
     }
   })
 
-  test('carries docsUrl from wireVariable into the definition', async () => {
+  test('carries docsUrl from defineVariable into the definition', async () => {
     const rootDir = await mkdtemp(`${fixtureRoot}-variable-`)
     const file = join(rootDir, 'variable.ts')
 
     await writeFile(
       file,
       [
-        "import { wireVariable } from '@pikku/core'",
+        "import { defineVariable } from '@pikku/core'",
         "import { z } from 'zod'",
         'export const ConsoleUrlSchema = z.string()',
-        'wireVariable({',
+        'defineVariable({',
         "  name: 'consoleUrl',",
         "  displayName: 'Console URL',",
         "  variableId: 'CONSOLE_URL',",
@@ -134,17 +134,17 @@ describe('config value metadata (docsUrl)', () => {
     }
   })
 
-  test('carries docsUrl from wireCredential into the definition', async () => {
+  test('carries docsUrl from defineCredential into the definition', async () => {
     const rootDir = await mkdtemp(`${fixtureRoot}-credential-`)
     const file = join(rootDir, 'credential.ts')
 
     await writeFile(
       file,
       [
-        "import { wireCredential } from '@pikku/core'",
+        "import { defineCredential } from '@pikku/core'",
         "import { z } from 'zod'",
         'export const TokenSchema = z.object({ token: z.string() })',
-        'wireCredential({',
+        'defineCredential({',
         "  name: 'githubToken',",
         "  displayName: 'GitHub Token',",
         "  type: 'wire',",

package/src/add/secret-sink-check.test.ts

@@ -0,0 +1,211 @@
+import { strict as assert } from 'assert'
+import { describe, test } from 'node:test'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { inspect } from '../inspector.js'
+import { ErrorCode } from '../error-codes.js'
+import type { InspectorLogger } from '../types.js'
+
+function makeLogger() {
+  const diagnostics: Array<{ code: ErrorCode; message: string }> = []
+  const logger: InspectorLogger = {
+    debug: () => {},
+    info: () => {},
+    warn: () => {},
+    error: () => {},
+    diagnostic: ({ code, message }) => diagnostics.push({ code, message }),
+    critical: (code, message) => diagnostics.push({ code, message }),
+    hasCriticalErrors: () => diagnostics.length > 0,
+  }
+  return { logger, diagnostics }
+}
+
+/**
+ * Stands in for @pikku/core, which is not importable from a tmp dir. The shapes
+ * are what matters: `Secret<T>` is the optional brand `.reveal()` returns, and
+ * the service interfaces are matched by name, so these must keep the real names.
+ */
+const PRELUDE = `
+type Secret<T> = T & { readonly __classification__?: 'secret' }
+
+declare class SecretValue<T = string> {
+  private brand: T
+  reveal(): Secret<T>
+}
+
+interface Logger {
+  info(messageOrObj: any, ...meta: any[]): void
+  error(messageOrObj: any, ...meta: any[]): void
+}
+interface QueueService {
+  add<T>(queueName: string, data: T): Promise<string>
+}
+interface EmailService {
+  send(input: any): Promise<void>
+}
+interface WebhookService {
+  send(input: any): Promise<void>
+}
+interface AuditService {
+  audit(event: { type: string; input?: unknown }): Promise<void>
+}
+interface AuditLog {
+  write(event: { type: string; input?: unknown }): Promise<void>
+}
+
+type Services = {
+  logger: Logger
+  queueService: QueueService
+  email: EmailService
+  webhooks: WebhookService
+  audit?: AuditService
+  auditLog?: AuditLog
+  secrets: { getSecret(key: string): Promise<SecretValue<string>> }
+}
+
+declare const pikkuFunc: <In, Out>(cfg: {
+  func: (services: Services, data: In) => Promise<Out>
+}) => unknown
+`
+
+async function runInspect(source: string) {
+  const tmpDir = await mkdtemp(join(tmpdir(), 'pikku-secret-sink-test-'))
+  const file = join(tmpDir, 'funcs.ts')
+  await writeFile(file, PRELUDE + source)
+  const { logger, diagnostics } = makeLogger()
+  try {
+    await inspect(logger, [file], { rootDir: tmpDir, classificationCheck: true })
+  } finally {
+    await rm(tmpDir, { recursive: true, force: true })
+  }
+  return diagnostics
+}
+
+const sinkErrors = (diagnostics: Array<{ code: ErrorCode; message: string }>) =>
+  diagnostics.filter((d) => d.code === ErrorCode.SECRET_REVEALED_INTO_SINK)
+
+describe('PKU953 — a revealed secret reaching a sink', () => {
+  test('flags a secret logged inline', async () => {
+    const diagnostics = await runInspect(`
+      export const leak = pikkuFunc<void, void>({
+        func: async ({ logger, secrets }) => {
+          const token = await secrets.getSecret('API_KEY')
+          logger.info(token.reveal())
+        },
+      })
+    `)
+    const errors = sinkErrors(diagnostics)
+    assert.equal(errors.length, 1)
+    assert.match(errors[0]!.message, /logger\.info/)
+  })
+
+  test('flags a secret that reaches the sink through a local binding', async () => {
+    const diagnostics = await runInspect(`
+      export const leak = pikkuFunc<void, void>({
+        func: async ({ logger, secrets }) => {
+          const token = (await secrets.getSecret('API_KEY')).reveal()
+          logger.error('auth failed', { token })
+        },
+      })
+    `)
+    const errors = sinkErrors(diagnostics)
+    assert.equal(errors.length, 1)
+    assert.match(errors[0]!.message, /logger\.error/)
+    assert.match(errors[0]!.message, /token/)
+  })
+
+  test('flags a secret enqueued, emailed or sent to a webhook', async () => {
+    const diagnostics = await runInspect(`
+      export const leak = pikkuFunc<void, void>({
+        func: async ({ queueService, email, webhooks, secrets }) => {
+          const token = (await secrets.getSecret('API_KEY')).reveal()
+          await queueService.add('jobs', { token })
+          await email.send({ to: 'a@b.c', text: token })
+          await webhooks.send({ url: 'https://x', data: { token } })
+        },
+      })
+    `)
+    assert.equal(sinkErrors(diagnostics).length, 3)
+  })
+
+  test('flags a secret written to an audit, through the optional chain it is reached by', async () => {
+    const diagnostics = await runInspect(`
+      export const leak = pikkuFunc<void, void>({
+        func: async ({ audit, auditLog, secrets }) => {
+          const token = (await secrets.getSecret('API_KEY')).reveal()
+          await audit?.audit({ type: 'used', input: { token } })
+          await auditLog?.write({ type: 'used', input: token })
+        },
+      })
+    `)
+    const errors = sinkErrors(diagnostics)
+    assert.equal(errors.length, 2)
+    assert.match(errors[0]!.message, /audit\.audit/)
+    assert.match(errors[1]!.message, /auditLog\.write/)
+  })
+
+  test('flags console, which no type guard covers', async () => {
+    const diagnostics = await runInspect(`
+      export const leak = pikkuFunc<void, void>({
+        func: async ({ secrets }) => {
+          const token = await secrets.getSecret('API_KEY')
+          console.log(token.reveal())
+        },
+      })
+    `)
+    const errors = sinkErrors(diagnostics)
+    assert.equal(errors.length, 1)
+    assert.match(errors[0]!.message, /console\.log/)
+  })
+
+  test('stays quiet when the secret never reaches a sink', async () => {
+    const diagnostics = await runInspect(`
+      declare function authenticate(token: string): Promise<void>
+
+      export const fine = pikkuFunc<void, void>({
+        func: async ({ logger, secrets }) => {
+          const token = (await secrets.getSecret('API_KEY')).reveal()
+          await authenticate(token)
+          logger.info('authenticated')
+        },
+      })
+    `)
+    assert.equal(sinkErrors(diagnostics).length, 0)
+  })
+
+  test('stays quiet for ordinary logging', async () => {
+    const diagnostics = await runInspect(`
+      export const fine = pikkuFunc<{ id: string }, void>({
+        func: async ({ logger }, data) => {
+          logger.info('processing', { id: data.id, at: new Date() })
+        },
+      })
+    `)
+    assert.equal(sinkErrors(diagnostics).length, 0)
+  })
+
+  test('does not run without the classification flag', async () => {
+    const tmpDir = await mkdtemp(join(tmpdir(), 'pikku-secret-sink-off-'))
+    const file = join(tmpDir, 'funcs.ts')
+    await writeFile(
+      file,
+      PRELUDE +
+        `
+      export const leak = pikkuFunc<void, void>({
+        func: async ({ logger, secrets }) => {
+          const token = await secrets.getSecret('API_KEY')
+          logger.info(token.reveal())
+        },
+      })
+    `
+    )
+    const { logger, diagnostics } = makeLogger()
+    try {
+      await inspect(logger, [file], { rootDir: tmpDir })
+    } finally {
+      await rm(tmpDir, { recursive: true, force: true })
+    }
+    assert.equal(sinkErrors(diagnostics).length, 0)
+  })
+})

package/src/add/wire-name-literal.test.ts

@@ -62,9 +62,9 @@ describe('wiring name must be a string literal', () => {
     await writeFile(
       file,
       [
-        "import { wireSecret } from '@pikku/core'",
+        "import { defineSecret } from '@pikku/core'",
         'const SECRET_ID = "STRIPE_SECRET_KEY"',
-        'wireSecret({',
+        'defineSecret({',
         '  secretId: SECRET_ID,',
         "  name: 'Stripe secret key',",
         "  displayName: 'Stripe secret key',",

package/src/error-codes.ts

@@ -25,9 +25,11 @@ export enum ErrorCode {
   SCENARIO_BROWSER_STEP_NEEDS_ACTOR = 'PKU677',
   SCENARIO_STEP_TARGET_NOT_STATIC = 'PKU678',
   SCENARIO_NOT_EXTRACTABLE = 'PKU679',
+  SCENARIO_HAS_NO_ASSERTION = 'PKU680',
   WORKFLOW_ORCHESTRATOR_NOT_CONFIGURED = 'PKU600',
   INVALID_DSL_WORKFLOW = 'PKU641',
   WORKFLOW_GRAPH_ADDON_NOT_WIRED = 'PKU642',
+  COMPLEX_WORKFLOW_NOT_ALLOWED = 'PKU643',
 
   // Remote addon (wireRemoteAddon) validation
   REMOTE_ADDON_NOT_DEV_DEPENDENCY = 'PKU338',
@@ -37,6 +39,9 @@ export enum ErrorCode {
   DB_COLUMN_NAME_TYPE_CONTRADICTION = 'PKU480',
   DB_JSON_COLUMN_UNTYPED = 'PKU481',
   DB_FORMAT_ON_NON_STRING = 'PKU482',
+  DB_SECRET_COLUMN_STORED_PLAIN = 'PKU483',
+  DB_FORM_ON_NON_STRING = 'PKU484',
+  DB_DEFAULT_SCHEMA_NAME_COLLISION = 'PKU485',
 
   // Configuration errors
   SCHEMA_GENERATION_ERROR = 'PKU456',
@@ -49,10 +54,20 @@ export enum ErrorCode {
   DUPLICATE_AUTH_DEFINITION = 'PKU581',
   AUTH_NOT_EXPORTED = 'PKU582',
 
+  // Single-declaration constructs — one call site per codebase.
+  // PKU583 (defineScope) and PKU584 (defineSystemRole) are retired, not free:
+  // scopes and roles held this rule until the generated `admin` tree made it
+  // unsatisfiable, and get it back once `admin` is a default scope nobody
+  // declares. Do not reuse those two numbers for anything else.
+  DUPLICATE_PERSONAS_DEFINITION = 'PKU585',
+
   // HTTP Route errors
   ROUTE_PARAM_MISMATCH = 'PKU571',
   ROUTE_QUERY_MISMATCH = 'PKU572',
   AUTH_DISABLED_REQUIRES_SESSIONLESS = 'PKU573',
+  EXPOSED_FUNCTION_HAS_NO_GATE = 'PKU574',
+  TAG_RESOLVES_TO_NO_MIDDLEWARE = 'PKU575',
+  PERMISSIONS_IN_BODY_NOT_ALLOWED = 'PKU576',
 
   // Versioning errors
   DUPLICATE_FUNCTION_VERSION = 'PKU850',
@@ -70,6 +85,11 @@ export enum ErrorCode {
   MISSING_MODEL = 'PKU145',
   INVALID_MODEL = 'PKU146',
 
+  // Agent tool reference errors
+  AGENT_TOOL_UNKNOWN_NAMESPACE = 'PKU152',
+  AGENT_TOOL_NOT_FOUND = 'PKU153',
+  AGENT_TOOL_MISSING_DESCRIPTION = 'PKU154',
+
   // File structure errors
   SCHEMA_AND_WIRING_COLOCATED = 'PKU490',
 
@@ -90,6 +110,12 @@ export enum ErrorCode {
   ADDON_CONTRACT_HANDLERS_NOT_ALLOWED = 'PKU921',
 
   RPC_INVOCATION_TYPE_CAST = 'PKU940',
+
+  // Secret boundary errors
+  SECRET_SERVICE_ALIASED = 'PKU950',
+  SECRET_NOT_DECLARED = 'PKU951',
+  SECRET_KEY_NOT_STATIC = 'PKU952',
+  SECRET_REVEALED_INTO_SINK = 'PKU953',
 }
 
 /**

package/src/index.ts

@@ -32,7 +32,10 @@ export type {
   VersionManifest,
   VersionManifestEntry,
 } from './utils/contract-hashes.js'
-export type { InspectorFeature, InspectorFeatureEntry } from './types.js'
+export type {
+  InspectorFeature,
+  InspectorFeatureEntry,
+} from './types.js'
 export { serializeMCPJson } from './utils/serialize-mcp-json.js'
 export type { OpenAPISpecInfo } from './utils/serialize-openapi-json.js'
 export {