@pikku/inspector 0.12.75 → 0.12.81

package/src/add/dynamic-import-check.test.ts

@@ -1,119 +0,0 @@
-import { strict as assert } from 'assert'
-import { describe, test } from 'node:test'
-import { mkdtemp, rm, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { inspect } from '../inspector.js'
-import { ErrorCode } from '../error-codes.js'
-import type { InspectorLogger } from '../types.js'
-
-const logger: InspectorLogger = {
-  debug: () => {},
-  info: () => {},
-  warn: () => {},
-  error: () => {},
-  diagnostic: () => {},
-  critical: () => {},
-  hasCriticalErrors: () => false,
-}
-
-async function inspectSource(source: string) {
-  const rootDir = await mkdtemp(join(tmpdir(), 'pikku-dynimport-'))
-  const file = join(rootDir, 'my.function.ts')
-  await writeFile(file, source)
-  try {
-    return await inspect(logger, [file], { rootDir })
-  } finally {
-    await rm(rootDir, { recursive: true, force: true })
-  }
-}
-
-describe('dynamic import in function bodies', () => {
-  test('flags a function whose body does `await import(...)`', async () => {
-    const state = await inspectSource(
-      [
-        "import { pikkuSessionlessFunc } from '@pikku/core'",
-        '',
-        'export const greedy = pikkuSessionlessFunc({',
-        '  func: async ({ logger }) => {',
-        "    const { readFile } = await import('node:fs/promises')",
-        '    return { readFile: typeof readFile }',
-        '  },',
-        '})',
-      ].join('\n')
-    )
-    const meta = (state.functions.meta as any).greedy
-    assert.ok(meta, 'greedy should be inspected')
-    assert.ok(state.functions.dynamicImportIds.has(meta.pikkuFuncId))
-    const diagnostic = state.diagnostics.find(
-      (d) => d.code === ErrorCode.FUNCTION_DYNAMIC_IMPORT
-    )
-    assert.ok(
-      diagnostic,
-      'expected a FUNCTION_DYNAMIC_IMPORT diagnostic for the function'
-    )
-  })
-
-  test('flags a nested `import(...)` call inside a callback', async () => {
-    const state = await inspectSource(
-      [
-        "import { pikkuSessionlessFunc } from '@pikku/core'",
-        '',
-        'export const nested = pikkuSessionlessFunc({',
-        '  func: async ({ logger }) => {',
-        '    await Promise.all([',
-        "      import('node:os').then((m) => m.hostname()),",
-        '    ])',
-        '    return { ok: true }',
-        '  },',
-        '})',
-      ].join('\n')
-    )
-    const meta = (state.functions.meta as any).nested
-    assert.ok(state.functions.dynamicImportIds.has(meta.pikkuFuncId))
-    assert.ok(
-      state.diagnostics.some(
-        (d) => d.code === ErrorCode.FUNCTION_DYNAMIC_IMPORT
-      )
-    )
-  })
-
-  test('does NOT flag a function with only static imports', async () => {
-    const state = await inspectSource(
-      [
-        "import { pikkuSessionlessFunc } from '@pikku/core'",
-        '',
-        'export const clean = pikkuSessionlessFunc({',
-        '  func: async ({ logger }, data: { n: number }) => {',
-        '    return { doubled: data.n * 2 }',
-        '  },',
-        '})',
-      ].join('\n')
-    )
-    const meta = (state.functions.meta as any).clean
-    assert.ok(meta, 'clean should be inspected')
-    assert.ok(!state.functions.dynamicImportIds.has(meta.pikkuFuncId))
-    assert.ok(
-      !state.diagnostics.some(
-        (d) => d.code === ErrorCode.FUNCTION_DYNAMIC_IMPORT
-      )
-    )
-  })
-
-  test('does NOT flag a type-only import position `import("x").T`', async () => {
-    const state = await inspectSource(
-      [
-        "import { pikkuSessionlessFunc } from '@pikku/core'",
-        '',
-        'export const typeOnly = pikkuSessionlessFunc({',
-        "  func: async ({ logger }, data: import('node:buffer').Blob) => {",
-        '    return { size: data.size }',
-        '  },',
-        '})',
-      ].join('\n')
-    )
-    const meta = (state.functions.meta as any).typeOnly
-    assert.ok(meta, 'typeOnly should be inspected')
-    assert.ok(!state.functions.dynamicImportIds.has(meta.pikkuFuncId))
-  })
-})

package/src/add/expect-eventually-scenario-only.test.ts

@@ -1,108 +0,0 @@
-import { strict as assert } from 'assert'
-import { describe, test } from 'node:test'
-import { mkdtemp, rm, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { inspect } from '../inspector.js'
-import type { InspectorLogger } from '../types.js'
-
-function makeLogger(
-  criticals: Array<{ code: string; message: string }>
-): InspectorLogger {
-  return {
-    debug: () => {},
-    info: () => {},
-    warn: () => {},
-    error: () => {},
-    diagnostic: ({ code, message }) => {
-      criticals.push({ code, message })
-    },
-    critical: (code: any, message: string) => {
-      criticals.push({ code, message })
-    },
-    hasCriticalErrors: () => criticals.length > 0,
-  }
-}
-
-const stepFile = (dir: string) => join(dir, 'my.steps.ts')
-const stepSource = [
-  "import { pikkuSessionlessFunc } from '@pikku/core'",
-  'export const getTodos = pikkuSessionlessFunc({',
-  '  func: async ({ logger }) => [{ done: true }],',
-  '})',
-].join('\n')
-
-describe('expectEventually is scenario-only', () => {
-  test('pikkuWorkflowFunc calling expectEventually is a critical error pointing at pikkuScenario', async () => {
-    const rootDir = await mkdtemp(join(tmpdir(), 'pikku-ee-wf-'))
-    const wfFile = join(rootDir, 'my.workflow.ts')
-    await writeFile(stepFile(rootDir), stepSource)
-    await writeFile(
-      wfFile,
-      [
-        "import { pikkuWorkflowFunc } from '@pikku/core/workflow'",
-        'export const badWorkflow = pikkuWorkflowFunc(async (_, _input, { workflow }) => {',
-        "  await workflow.expectEventually('Wait', 'getTodos', {}, (todos: any) => todos.length > 0)",
-        '  return { ok: true }',
-        '})',
-      ].join('\n')
-    )
-
-    const criticals: Array<{ code: string; message: string }> = []
-    try {
-      await inspect(makeLogger(criticals), [stepFile(rootDir), wfFile], {
-        rootDir,
-      })
-      const pku675 = criticals.find((c) => c.code === 'PKU675')
-      assert.ok(
-        pku675,
-        `expected a PKU675 critical, got: ${JSON.stringify(criticals)}`
-      )
-      assert.ok(
-        pku675.message.includes('pikkuScenario'),
-        `PKU675 should point users at pikkuScenario, got: ${pku675.message}`
-      )
-    } finally {
-      await rm(rootDir, { recursive: true, force: true })
-    }
-  })
-
-  test('pikkuScenario calling expectEventually is allowed and flagged as a scenario', async () => {
-    const rootDir = await mkdtemp(join(tmpdir(), 'pikku-ee-sc-'))
-    const wfFile = join(rootDir, 'my.scenario.ts')
-    await writeFile(stepFile(rootDir), stepSource)
-    await writeFile(
-      wfFile,
-      [
-        "import { pikkuScenario } from '@pikku/core/workflow'",
-        'declare const actors: Record<string, any>',
-        'export const goodFlow = pikkuScenario(async (_, _input, { workflow }) => {',
-        "  await workflow.expectEventually('Wait', 'getTodos', {}, (todos: any) => todos.length > 0, { actor: actors.pm })",
-        '  return { ok: true }',
-        '})',
-      ].join('\n')
-    )
-
-    const criticals: Array<{ code: string; message: string }> = []
-    try {
-      const state = await inspect(
-        makeLogger(criticals),
-        [stepFile(rootDir), wfFile],
-        { rootDir }
-      )
-      assert.ok(
-        !criticals.some((c) => c.code === 'PKU675'),
-        `scenarios may use expectEventually; got: ${JSON.stringify(criticals)}`
-      )
-      const meta = (state.workflows.meta as any).goodFlow
-      assert.ok(meta, 'pikkuScenario export should register a workflow')
-      assert.equal(
-        meta.scenario,
-        true,
-        `scenario meta flag should be true, got: ${JSON.stringify(meta)}`
-      )
-    } finally {
-      await rm(rootDir, { recursive: true, force: true })
-    }
-  })
-})

package/src/add/function-body-span.test.ts

@@ -1,96 +0,0 @@
-import { strict as assert } from 'assert'
-import { describe, test } from 'node:test'
-import { mkdtemp, rm, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { inspect } from '../inspector.js'
-import type { InspectorLogger } from '../types.js'
-
-const logger: InspectorLogger = {
-  debug: () => {},
-  info: () => {},
-  warn: () => {},
-  error: () => {},
-  diagnostic: () => {},
-  critical: () => {},
-  hasCriticalErrors: () => false,
-}
-
-describe('function body spans in meta', () => {
-  test('meta records 1-indexed bodyStart/bodyEnd lines of the handler body', async () => {
-    const rootDir = await mkdtemp(join(tmpdir(), 'pikku-span-'))
-    const file = join(rootDir, 'my.function.ts')
-    await writeFile(
-      file,
-      [
-        "import { pikkuSessionlessFunc } from '@pikku/core'", // line 1
-        '', // 2
-        'export const spanProbe = pikkuSessionlessFunc({', // 3
-        '  func: async ({ logger }, data: { n: number }) => {', // 4
-        '    const doubled = data.n * 2', // 5
-        '    return { doubled }', // 6
-        '  },', // 7
-        '})', // 8
-      ].join('\n')
-    )
-    try {
-      const state = await inspect(logger, [file], { rootDir })
-      const meta = (state.functions.meta as any).spanProbe
-      assert.ok(meta, 'spanProbe should be inspected')
-      assert.equal(
-        meta.bodyStart,
-        5,
-        `bodyStart should be 5, got ${meta.bodyStart}`
-      )
-      assert.equal(meta.bodyEnd, 6, `bodyEnd should be 6, got ${meta.bodyEnd}`)
-    } finally {
-      await rm(rootDir, { recursive: true, force: true })
-    }
-  })
-
-  test('meta records bodySourceFile when the handler is imported from another file', async () => {
-    const rootDir = await mkdtemp(join(tmpdir(), 'pikku-span-'))
-    const handlerFile = join(rootDir, 'handlers.ts')
-    const wiringFile = join(rootDir, 'my.function.ts')
-    await writeFile(
-      handlerFile,
-      [
-        'export const importedHandler = async (', // line 1
-        '  { logger }: any,', // 2
-        '  data: { n: number }', // 3
-        ') => {', // 4
-        '  const doubled = data.n * 2', // 5
-        '  return { doubled }', // 6
-        '}', // 7
-      ].join('\n')
-    )
-    await writeFile(
-      wiringFile,
-      [
-        "import { pikkuSessionlessFunc } from '@pikku/core'",
-        "import { importedHandler } from './handlers.js'",
-        '',
-        'export const importedProbe = pikkuSessionlessFunc({',
-        '  func: importedHandler,',
-        '})',
-      ].join('\n')
-    )
-    try {
-      const state = await inspect(logger, [wiringFile, handlerFile], {
-        rootDir,
-      })
-      const meta = (state.functions.meta as any).importedProbe
-      assert.ok(meta, 'importedProbe should be inspected')
-      assert.equal(meta.sourceFile, wiringFile)
-      assert.equal(
-        meta.bodySourceFile,
-        handlerFile,
-        `bodySourceFile should be the handler file, got ${meta.bodySourceFile}`
-      )
-      assert.equal(meta.bodyStart, 5)
-      assert.equal(meta.bodyEnd, 6)
-    } finally {
-      await rm(rootDir, { recursive: true, force: true })
-    }
-  })
-})

package/src/add/inline-wiring-function.test.ts

@@ -1,104 +0,0 @@
-import { strict as assert } from 'assert'
-import { describe, test } from 'node:test'
-import { mkdtemp, rm, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { inspect } from '../inspector.js'
-import type { ErrorCode, InspectorLogger } from '../types.js'
-
-const silentLogger = (): InspectorLogger => ({
-  debug: () => {},
-  info: () => {},
-  warn: () => {},
-  error: () => {},
-  diagnostic: () => {},
-  critical: (_code: ErrorCode, _message: string) => {},
-  hasCriticalErrors: () => false,
-})
-
-// A `func:` inlined into a wiring has no exported name, so addFunctions skips
-// it and only the wiring's context-based id exists. The wiring visitor must
-// register the function metadata under that id (via ensureInlineWiringFunction)
-// or the transport resolves to nothing at runtime ("Missing generated metadata
-// for ...") and, once registered, every invocation would 403 unless the
-// sessionless flag is carried across from the helper used.
-const WIRINGS = [
-  {
-    label: 'wireQueueWorker',
-    wire: 'wireQueueWorker',
-    props: "name: 'inline-queue',",
-    expectedId: 'queue:inline-queue',
-  },
-  {
-    label: 'wireScheduler',
-    wire: 'wireScheduler',
-    props: "name: 'inline-cron', schedule: '* * * * *',",
-    expectedId: 'scheduler:inline-cron',
-  },
-  {
-    label: 'wireTrigger',
-    wire: 'wireTrigger',
-    props: "name: 'inline-trigger',",
-    expectedId: 'trigger:inline-trigger',
-  },
-  {
-    label: 'wireGateway',
-    wire: 'wireGateway',
-    props: "name: 'inline-gw', type: 'slack',",
-    expectedId: 'gateway:inline-gw',
-  },
-]
-
-const write = (wire: string, props: string, helper: string) =>
-  [
-    `import { ${helper}, ${wire} } from '@pikku/core'`,
-    `${wire}({`,
-    `  ${props}`,
-    `  func: ${helper}<{ url: string }, void>({ func: async () => {} }),`,
-    '})',
-  ].join('\n')
-
-describe('inline wiring functions register metadata', () => {
-  for (const { label, wire, props, expectedId } of WIRINGS) {
-    test(`${label} registers a sessionless func inlined into it`, async () => {
-      const rootDir = await mkdtemp(join(tmpdir(), 'pikku-inline-'))
-      const file = join(rootDir, 'wire.ts')
-      await writeFile(file, write(wire, props, 'pikkuSessionlessFunc'))
-
-      try {
-        const state = await inspect(silentLogger(), [file], { rootDir })
-        const funcMeta = state.functions.meta[expectedId]
-        assert.ok(
-          funcMeta,
-          `${label}: metadata must exist under the id the wiring references`
-        )
-        assert.equal(
-          funcMeta!.sessionless,
-          true,
-          `${label}: pikkuSessionlessFunc must stay sessionless when inlined`
-        )
-      } finally {
-        await rm(rootDir, { recursive: true, force: true })
-      }
-    })
-
-    test(`${label} keeps an inlined pikkuFunc session-required`, async () => {
-      const rootDir = await mkdtemp(join(tmpdir(), 'pikku-inline-auth-'))
-      const file = join(rootDir, 'wire.ts')
-      await writeFile(file, write(wire, props, 'pikkuFunc'))
-
-      try {
-        const state = await inspect(silentLogger(), [file], { rootDir })
-        const funcMeta = state.functions.meta[expectedId]
-        assert.ok(funcMeta, `${label}: metadata must exist`)
-        assert.equal(
-          funcMeta!.sessionless,
-          false,
-          `${label}: pikkuFunc must not be marked sessionless`
-        )
-      } finally {
-        await rm(rootDir, { recursive: true, force: true })
-      }
-    })
-  }
-})

package/src/add/pii-check.test.ts

@@ -1,258 +0,0 @@
-import { strict as assert } from 'assert'
-import { describe, test } from 'node:test'
-import { mkdtemp, rm, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { inspect } from '../inspector.js'
-import { ErrorCode } from '../error-codes.js'
-import type { InspectorLogger } from '../types.js'
-
-// ── helpers ──────────────────────────────────────────────────────────────────
-
-function makeLogger() {
-  // Collects every coded diagnostic regardless of severity. PKU910 is now
-  // emitted at 'error' severity (surface, don't block the dev server) so it
-  // arrives via `diagnostic`, not `critical`.
-  const criticals: Array<{ code: ErrorCode; message: string }> = []
-  const logger: InspectorLogger = {
-    debug: () => {},
-    info: () => {},
-    warn: () => {},
-    error: () => {},
-    diagnostic: ({ code, message }) => criticals.push({ code, message }),
-    critical: (code, message) => criticals.push({ code, message }),
-    hasCriticalErrors: () => criticals.length > 0,
-  }
-  return { logger, criticals }
-}
-
-/**
- * Inline Private<T>/Pii<T>/Secret<T> definitions that the test source files use.
- * Mirrors what schema.gen.ts emits so the TypeScript program sees the correct
- * structural brand type even without @pikku/core being importable from /tmp.
- */
-// Optional `__classification__?` mirrors what @pikku/core and `pikku db migrate`
-// actually emit (optional so plain values stay assignable to branded columns).
-// The `Secret`-in-sessioned-function cases below double as the level-fidelity
-// guard: they only pass if `findPiiPaths` reads the level union-aware
-// ('secret' | undefined), not via a naive `.value`.
-const BRAND_TYPES = `
-type Private<T> = T & { readonly __classification__?: 'private' }
-type Pii<T> = T & { readonly __classification__?: 'pii' }
-type Secret<T> = T & { readonly __classification__?: 'secret' }
-`
-
-async function runInspect(sourceCode: string) {
-  const tmpDir = await mkdtemp(join(tmpdir(), 'pikku-pii-test-'))
-  const file = join(tmpDir, 'funcs.ts')
-  await writeFile(file, sourceCode)
-  const { logger, criticals } = makeLogger()
-  try {
-    // The data-classification leak scan is opt-in (off by default to keep it
-    // off the `pikku all` hot path); these tests exercise it, so enable it.
-    await inspect(logger, [file], {
-      rootDir: tmpDir,
-      classificationCheck: true,
-    })
-  } finally {
-    await rm(tmpDir, { recursive: true, force: true })
-  }
-  return criticals
-}
-
-// ── classification semantics:
-//   secret  → never returned by any function (sessioned or not)
-//   private → only blocked in sessionless functions (pikkuSessionlessFunc)
-//   public  → safe for sessionless functions
-
-describe('PII output check — PKU910', () => {
-  // ── Secret<T>: always blocked ──────────────────────────────────────────────
-
-  test('flags a top-level Secret<string> field in a sessioned function', async () => {
-    const criticals = await runInspect(`
-${BRAND_TYPES}
-import { pikkuFunc } from '@pikku/core'
-export const getToken = pikkuFunc({
-  func: async () => {
-    const token = 'abc' as Secret<string>
-    return { token }
-  }
-})
-`)
-    const hit = criticals.find((c) => c.code === ErrorCode.PII_IN_OUTPUT)
-    assert.ok(hit)
-    assert.match(hit.message, /token/)
-  })
-
-  test('flags a top-level Secret<string> field in a sessionless function', async () => {
-    const criticals = await runInspect(`
-${BRAND_TYPES}
-import { pikkuSessionlessFunc } from '@pikku/core'
-export const getToken = pikkuSessionlessFunc({
-  func: async () => {
-    const token = 'abc' as Secret<string>
-    return { token }
-  }
-})
-`)
-    const hit = criticals.find((c) => c.code === ErrorCode.PII_IN_OUTPUT)
-    assert.ok(hit)
-    assert.match(hit.message, /token/)
-  })
-
-  // ── Private<T>: only blocked in sessionless functions ─────────────────────
-
-  test('flags a top-level Private<string> field in a sessionless function', async () => {
-    const criticals = await runInspect(`
-${BRAND_TYPES}
-import { pikkuSessionlessFunc } from '@pikku/core'
-export const getUser = pikkuSessionlessFunc({
-  func: async () => {
-    const email = 'test@example.com' as Private<string>
-    return { id: 1, email }
-  }
-})
-`)
-    const hit = criticals.find((c) => c.code === ErrorCode.PII_IN_OUTPUT)
-    assert.ok(hit, `Expected PKU910 but got: ${JSON.stringify(criticals)}`)
-    assert.match(hit.message, /email/)
-  })
-
-  test('does not flag a Private<string> field in a sessioned function', async () => {
-    const criticals = await runInspect(`
-${BRAND_TYPES}
-import { pikkuFunc } from '@pikku/core'
-export const getUser = pikkuFunc({
-  func: async () => {
-    const email = 'test@example.com' as Private<string>
-    return { id: 1, email }
-  }
-})
-`)
-    const hit = criticals.find((c) => c.code === ErrorCode.PII_IN_OUTPUT)
-    assert.equal(
-      hit,
-      undefined,
-      `Expected no PKU910 (sessioned function may return Private fields) but got: ${JSON.stringify(hit)}`
-    )
-  })
-
-  test('flags a nested Private field in a sessionless function', async () => {
-    const criticals = await runInspect(`
-${BRAND_TYPES}
-import { pikkuSessionlessFunc } from '@pikku/core'
-export const getProfile = pikkuSessionlessFunc({
-  func: async () => {
-    const email = 'x@y.com' as Private<string>
-    return { user: { id: 1, email } }
-  }
-})
-`)
-    const hit = criticals.find((c) => c.code === ErrorCode.PII_IN_OUTPUT)
-    assert.ok(hit)
-    assert.match(hit.message, /user\.email/)
-  })
-
-  test('does not flag a plain string return', async () => {
-    const criticals = await runInspect(`
-import { pikkuFunc } from '@pikku/core'
-export const getPublicData = pikkuFunc({
-  func: async () => ({ id: 1, status: 'active', count: 42 })
-})
-`)
-    const hit = criticals.find((c) => c.code === ErrorCode.PII_IN_OUTPUT)
-    assert.equal(
-      hit,
-      undefined,
-      `Expected no PKU910 but got: ${JSON.stringify(hit)}`
-    )
-  })
-
-  test('does not flag a void-returning function', async () => {
-    const criticals = await runInspect(`
-import { pikkuFunc } from '@pikku/core'
-export const doWork = pikkuFunc({
-  func: async () => { /* no return */ }
-})
-`)
-    const hit = criticals.find((c) => c.code === ErrorCode.PII_IN_OUTPUT)
-    assert.equal(hit, undefined)
-  })
-
-  test('flags a sessionless function that returns a typed alias with Private field', async () => {
-    const criticals = await runInspect(`
-${BRAND_TYPES}
-import { pikkuSessionlessFunc } from '@pikku/core'
-type UserRow = { id: number; email: Private<string> }
-export const getUser = pikkuSessionlessFunc({
-  func: async (): Promise<UserRow> => {
-    return { id: 1, email: 'x' as Private<string> }
-  }
-})
-`)
-    const hit = criticals.find((c) => c.code === ErrorCode.PII_IN_OUTPUT)
-    assert.ok(hit)
-    assert.match(hit.message, /email/)
-  })
-
-  test('flags across multiple sessionless functions in the same file', async () => {
-    const criticals = await runInspect(`
-${BRAND_TYPES}
-import { pikkuSessionlessFunc } from '@pikku/core'
-export const getEmail = pikkuSessionlessFunc({
-  func: async () => ({ email: 'x' as Private<string> })
-})
-export const getPhone = pikkuSessionlessFunc({
-  func: async () => ({ phone: '555' as Private<string> })
-})
-export const getSafe = pikkuSessionlessFunc({
-  func: async () => ({ name: 'Alice' })
-})
-`)
-    const hits = criticals.filter((c) => c.code === ErrorCode.PII_IN_OUTPUT)
-    assert.equal(hits.length, 2, `Expected 2 PKU910 but got ${hits.length}`)
-  })
-
-  test('flags branded values inside arrays (sessionless)', async () => {
-    const criticals = await runInspect(`
-${BRAND_TYPES}
-import { pikkuSessionlessFunc } from '@pikku/core'
-export const getEmails = pikkuSessionlessFunc({
-  func: async () => ({ emails: ['x@y.com' as Private<string>] })
-})
-`)
-    const hit = criticals.find((c) => c.code === ErrorCode.PII_IN_OUTPUT)
-    assert.ok(hit, `Expected PKU910 but got: ${JSON.stringify(criticals)}`)
-    assert.match(hit.message, /emails/)
-  })
-
-  test('flags branded values inside string-indexed records (sessionless)', async () => {
-    const criticals = await runInspect(`
-${BRAND_TYPES}
-import { pikkuSessionlessFunc } from '@pikku/core'
-export const getMap = pikkuSessionlessFunc({
-  func: async () => ({ byId: { a: 'x@y.com' as Private<string> } as Record<string, Private<string>> })
-})
-`)
-    const hit = criticals.find((c) => c.code === ErrorCode.PII_IN_OUTPUT)
-    assert.ok(hit, `Expected PKU910 but got: ${JSON.stringify(criticals)}`)
-    assert.match(hit.message, /byId/)
-  })
-
-  test('does not flag when branded field is stripped before return', async () => {
-    const criticals = await runInspect(`
-${BRAND_TYPES}
-import { pikkuSessionlessFunc } from '@pikku/core'
-export const getUser = pikkuSessionlessFunc({
-  func: async () => {
-    const raw: { email: Private<string> } = { email: 'x' as Private<string> }
-    const safe: { email: string } = { email: raw.email as string }
-    return safe
-  }
-})
-`)
-    // The explicit type annotation on 'safe' strips the brand from the inferred return type
-    const hit = criticals.find((c) => c.code === ErrorCode.PII_IN_OUTPUT)
-    assert.equal(hit, undefined)
-  })
-})