@powerduck/dev-mcp-server 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,384 @@
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { Tool, Resource, ResourceTemplate } from '@modelcontextprotocol/sdk/types.js';
+import { AuthConfig, CliConfig, DeclarativeAssertion, TestResult, TestReport, ScenarioReport } from '@powerduck/openapi-cli';
+import { RequestValues } from '@powerduck/openapi-request';
+
+interface ServerFact {
+    url: string;
+    description?: string;
+    /** Names of variables the server URL still requires. */
+    variables: string[];
+}
+interface SecuritySchemeFact {
+    name: string;
+    type: string;
+    scheme?: string;
+    bearerFormat?: string;
+    in?: string;
+    parameterName?: string;
+    openIdConnectUrl?: string;
+    /** OAuth2 flow names and the scopes each declares. */
+    flows: Record<string, string[]>;
+}
+interface CompactOperation {
+    /** Stable reference, e.g. "POST /orders". */
+    ref: string;
+    operationId?: string;
+    method: string;
+    path: string;
+    summary?: string;
+    tags: string[];
+    /** A non-empty security requirement applies to this operation. */
+    secured: boolean;
+    statusCodes: string[];
+    hasParameters: boolean;
+    hasRequestBody: boolean;
+    protocol: string;
+}
+interface ParameterFact {
+    name: string;
+    in: "path" | "query" | "header" | "cookie";
+    required: boolean;
+    description?: string;
+    deprecated: boolean;
+    /** Compact JSON Schema describing the parameter value. */
+    schema: Record<string, unknown>;
+    example?: unknown;
+}
+interface MediaFact {
+    /** Dereferenced JSON Schema for the payload. */
+    schema: unknown;
+    example?: unknown;
+    /** Named examples declared by the specification. */
+    examples: string[];
+}
+interface HeaderFact {
+    name: string;
+    required: boolean;
+    description?: string;
+    schema: Record<string, unknown>;
+}
+interface ResponseFact {
+    status: string;
+    description?: string;
+    headers: HeaderFact[];
+    content: Record<string, MediaFact>;
+}
+interface RequestBodyFact {
+    required: boolean;
+    description?: string;
+    content: Record<string, MediaFact>;
+}
+interface OperationFact {
+    ref: string;
+    operationId?: string;
+    method: string;
+    path: string;
+    summary?: string;
+    description?: string;
+    tags: string[];
+    deprecated: boolean;
+    idempotent: boolean;
+    protocol: string;
+    parameters: ParameterFact[];
+    requestBody?: RequestBodyFact;
+    responses: ResponseFact[];
+    /** Effective security requirements after operation-level overrides. */
+    security: SecuritySchemeFact[];
+    servers: ServerFact[];
+}
+type IssueSeverity = "error" | "warning" | "info";
+interface ValidationIssue {
+    message: string;
+    severity: IssueSeverity;
+    path?: string;
+}
+interface ValidationFact {
+    valid: boolean;
+    openapiVersion?: string;
+    issues: ValidationIssue[];
+}
+interface OverviewFact {
+    title: string;
+    version: string;
+    description?: string;
+    openapiVersion?: string;
+    servers: ServerFact[];
+    endpointCount: number;
+    tags: string[];
+    protocols: string[];
+    schemaCount: number;
+    securitySchemes: SecuritySchemeFact[];
+}
+interface PagedOperations {
+    items: CompactOperation[];
+    total: number;
+    nextCursor?: string;
+}
+interface OperationLocator {
+    /** "METHOD /path" reference. */
+    ref?: string;
+    operationId?: string;
+    method?: string;
+    path?: string;
+}
+/** A failed tool call whose cause is the caller's input, not the server. */
+declare class FactError extends Error {
+    readonly code: string;
+    readonly details?: unknown;
+    constructor(code: string, message: string, details?: unknown);
+}
+
+/**
+ * Loads an OpenAPI document from disk and keeps it fresh.
+ *
+ * A developer edits the spec while the coding agent is connected, so the
+ * store re-reads the file whenever its mtime changes. Parsing and validation
+ * are best effort: an in-progress document with validation issues must still
+ * answer fact queries, and the validate_spec tool surfaces those problems.
+ */
+
+interface SpecSnapshot {
+    /** Absolute source path. */
+    path: string;
+    /** Document normalized to 3.x when conversion is safe; otherwise as authored. */
+    document: Record<string, any>;
+    /** Document with internal $ref values inlined where possible. */
+    dereferenced: Record<string, any>;
+    /** Raw source text, served by the `source` resource. */
+    sourceText: string;
+    mediaType: "application/yaml" | "application/json";
+    validation: ValidationFact;
+    mtimeMs: number;
+}
+declare class SpecStore {
+    readonly specPath: string;
+    private cache;
+    constructor(specPath: string);
+    /** Read and normalize the document, reusing the cache while mtime is stable. */
+    load(force?: boolean): Promise<SpecSnapshot>;
+}
+
+/**
+ * Builds the developer MCP server: read-only contract facts plus verification
+ * against a running backend.
+ *
+ * The server is transport agnostic. A SpecStore supplies a live document, and
+ * every request re-reads the file when it changed on disk. Long-running tools
+ * stream MCP $/progress and honor notifications/cancelled.
+ */
+
+interface CreateServerOptions {
+    name?: string;
+    version?: string;
+    /** Free-form usage instructions surfaced during MCP initialization. */
+    instructions?: string;
+}
+declare function createDevMcpServer(store: SpecStore, options?: CreateServerOptions): Server;
+
+/**
+ * stdio transport for AI coding clients (Claude Code, Codex CLI, Cursor,
+ * Claude Desktop). stdout is the JSON-RPC channel, so all accidental logging
+ * is diverted to stderr for the lifetime of the server.
+ */
+interface StdioHandle {
+    closed: Promise<void>;
+    close(): Promise<void>;
+}
+interface StartStdioOptions {
+    specPath: string;
+    name?: string;
+    version?: string;
+    handleSignals?: boolean;
+}
+declare function startStdioServer(options: StartStdioOptions): Promise<StdioHandle>;
+
+/**
+ * Builds the @powerduck/openapi-cli runner configuration for a verification
+ * request. Fact tools read an in-memory document; the runner also needs a real
+ * spec path (used as an identifier and fallback loader), which the SpecStore
+ * always has.
+ */
+
+interface RunOverrides {
+    baseUrl?: string;
+    timeoutMs?: number;
+    concurrency?: number;
+    headers?: Record<string, string>;
+    variables?: Record<string, string>;
+    proxy?: string;
+    auth?: AuthConfig;
+}
+interface ProgressSink {
+    /** Emit MCP $/progress when a progress token was supplied by the client. */
+    report?: (progress: number, total: number, message?: string) => void;
+    /** Cancellation propagated from notifications/cancelled. */
+    signal?: AbortSignal;
+}
+declare function buildRunnerConfig(snapshot: SpecSnapshot, overrides: RunOverrides): CliConfig;
+/** Resolves the target base URL from an explicit override or the spec servers. */
+declare function resolveBaseUrl(snapshot: SpecSnapshot, explicit: string | undefined): string | undefined;
+/** Maps raw tool arguments into typed runner overrides with validation. */
+declare function runOverridesFromArgs(snapshot: SpecSnapshot, args: Record<string, unknown>): RunOverrides;
+
+/**
+ * Developer MCP tools.
+ *
+ * Fact tools (M0) expose read-only contract truth. Verification tools (M1)
+ * send requests and run contract/scenario tests against a running backend via
+ * @powerduck/openapi-cli.
+ */
+
+declare const devTools: Tool[];
+/** Executes one tool call and returns a JSON-serializable result. */
+declare function executeDevTool(name: string, args: Record<string, unknown>, store: SpecStore, sink?: ProgressSink): Promise<unknown>;
+
+/**
+ * MCP resources expose the same facts as stable URIs, so agents can attach
+ * contract context directly to a conversation.
+ */
+
+declare function listSpecResources(store: SpecStore): Promise<Resource[]>;
+declare const specResourceTemplates: ResourceTemplate[];
+interface ResourceContents {
+    uri: string;
+    mimeType: string;
+    text: string;
+}
+declare function readSpecResource(uri: string, store: SpecStore): Promise<ResourceContents>;
+
+/**
+ * Pure fact extraction over an OpenAPI document.
+ *
+ * Every function here is deterministic and side-effect free. The MCP layer is
+ * a thin transport over these functions so the same logic is unit-testable
+ * without a JSON-RPC client.
+ */
+
+declare const HTTP_METHODS: readonly ["get", "post", "put", "patch", "delete", "head", "options", "trace"];
+/** Resolves a local JSON pointer ("#/components/schemas/Foo"). */
+declare function resolvePointer(doc: unknown, ref: string): unknown;
+declare function overview(doc: Record<string, any>): OverviewFact;
+interface ListOptions {
+    tag?: string;
+    method?: string;
+    protocol?: string;
+    secured?: boolean;
+    search?: string;
+    pageSize?: number;
+    cursor?: string;
+}
+declare function listOperations(doc: Record<string, any>, options?: ListOptions): PagedOperations;
+declare function getOperation(doc: Record<string, any>, rawDoc: Record<string, any>, locator: OperationLocator): OperationFact;
+interface SchemaLocator {
+    name?: string;
+    ref?: string;
+}
+declare function getSchema(doc: Record<string, any>, rawDoc: Record<string, any>, locator: SchemaLocator): {
+    name?: string;
+    schema: unknown;
+};
+declare function authRequirements(doc: Record<string, any>, locator?: OperationLocator): {
+    global: SecuritySchemeFact[];
+    operation?: SecuritySchemeFact[];
+};
+
+/**
+ * Project-level developer configuration (powerduck.dev.json).
+ *
+ * This file is safe to commit: it points at the specification and the local
+ * development server. Secrets must come from environment variables, never from
+ * this file.
+ */
+interface DevConfig {
+    /** Path to the OpenAPI document, relative to the config file. */
+    spec?: string;
+    /** Default base URL of the local backend under development. */
+    baseUrl?: string;
+    /** Backend project root, used by future code-aware tools. */
+    project?: string;
+}
+/**
+ * Loads optional configuration. Explicit `--config` wins; otherwise a
+ * powerduck.dev.json in the current working directory is used when present.
+ */
+declare function loadDevConfig(configPath?: string): {
+    config: DevConfig;
+    configDir: string;
+};
+/** Resolves a possibly config-relative path to an absolute one. */
+declare function resolveFrom(configDir: string, target?: string): string | undefined;
+
+/**
+ * Lightweight reachability probe. Unlike send_request this does not require a
+ * matching operation; it confirms the local backend is up before testing.
+ */
+interface PingResult {
+    url: string;
+    reachable: boolean;
+    status?: number;
+    statusText?: string;
+    contentType?: string;
+    latencyMs: number;
+    error?: string;
+}
+declare function pingTarget(rawUrl: string, timeoutMs: number): Promise<PingResult>;
+
+/**
+ * Single-operation verification: send one request to the local backend and
+ * report the normalized response plus spec-derived assertion results.
+ */
+
+interface SendInput {
+    values?: RequestValues;
+    variables?: Record<string, string>;
+    assertions?: DeclarativeAssertion[];
+    /** Per-call target override; wins over the configured base URL. */
+    baseUrl?: string;
+}
+declare function sendOne(snapshot: SpecSnapshot, overrides: RunOverrides, locator: OperationLocator, input: SendInput): Promise<TestResult>;
+
+/**
+ * Batch contract verification against a running backend.
+ *
+ * Mirrors openapi-cli's runTests but executes against the in-memory live
+ * document so the MCP never depends on a stale file on disk.
+ */
+
+interface ContractFilter {
+    methods?: string[];
+    paths?: string[];
+    tags?: string[];
+    operationIds?: string[];
+}
+interface ContractSuiteResult {
+    summary: TestReport["summary"];
+    results: TestResult[];
+    generatedAt: string;
+    version: string;
+}
+declare function contractFilterFromArgs(args: Record<string, unknown>): ContractFilter;
+declare function runContractSuite(snapshot: SpecSnapshot, overrides: RunOverrides, filter: ContractFilter, sink?: ProgressSink): Promise<ContractSuiteResult>;
+
+/**
+ * Scenario validation and execution.
+ *
+ * Validation resolves every step reference up front and never touches the
+ * network, so an agent can confirm a plan before running it. Execution reuses
+ * openapi-cli's ordered, stateful engine with live progress and cancellation.
+ */
+
+interface ScenarioValidation {
+    valid: boolean;
+    errors?: string[];
+    steps?: Array<{
+        index: number;
+        ref: string;
+        name?: string;
+    }>;
+    count?: number;
+}
+declare function validateScenario(snapshot: SpecSnapshot, rawScenario: unknown): ScenarioValidation;
+declare function runScenarioTool(snapshot: SpecSnapshot, rawScenario: unknown, overrides: RunOverrides, sink?: ProgressSink): Promise<Omit<ScenarioReport, "config">>;
+
+export { type CompactOperation, type ContractFilter, type ContractSuiteResult, type CreateServerOptions, type DevConfig, FactError, HTTP_METHODS, type HeaderFact, type ListOptions, type MediaFact, type OperationFact, type OperationLocator, type OverviewFact, type PagedOperations, type ParameterFact, type PingResult, type ProgressSink, type RequestBodyFact, type ResponseFact, type RunOverrides, type ScenarioValidation, type SecuritySchemeFact, type SendInput, type ServerFact, type SpecSnapshot, SpecStore, type StartStdioOptions, type StdioHandle, type ValidationFact, type ValidationIssue, authRequirements, buildRunnerConfig, contractFilterFromArgs, createDevMcpServer, devTools, executeDevTool, getOperation, getSchema, listOperations, listSpecResources, loadDevConfig, overview, pingTarget, readSpecResource, resolveBaseUrl, resolveFrom, resolvePointer, runContractSuite, runOverridesFromArgs, runScenarioTool, sendOne, specResourceTemplates, startStdioServer, validateScenario };

package/dist/index.mjs

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import{createRequire as e}from"module";import{Server as t}from"@modelcontextprotocol/sdk/server/index.js";import{ListToolsRequestSchema as r,CallToolRequestSchema as o,ListResourcesRequestSchema as n,ListResourceTemplatesRequestSchema as s,ReadResourceRequestSchema as i}from"@modelcontextprotocol/sdk/types.js";import{resolveConfig as a,executeStep as c,collectOperations as p,buildSummary as u,resolveSteps as d,runScenario as m}from"@powerduck/openapi-cli";import{createClient as l}from"@powerduck/openapi-request";import{StdioServerTransport as f}from"@modelcontextprotocol/sdk/server/stdio.js";import h from"fs";import{load as y}from"js-yaml";import{upgradeOasTo32 as g,validate as v,dereference as b}from"@powerduck/openapi-parser";import w from"path";e(import.meta.url);var x=class extends Error{code;details;constructor(e,t,r){super(t),this.name="FactError",this.code=e,this.details=r}},S=["get","post","put","patch","delete","head","options","trace"],j=new Set(["get","head","put","delete","options","trace"]);function _(e){return!!e&&"object"==typeof e&&!Array.isArray(e)}function O(e){return Array.isArray(e)?e:[]}function q(e){return"string"==typeof e&&e.trim()?e:void 0}function I(e,t){if(!t.startsWith("#/"))return;let r=e;for(const e of t.slice(2).split("/")){const t=e.replace(/~1/g,"/").replace(/~0/g,"~");if(!_(r)||!(t in r))return;r=r[t]}return r}function T(e,t,r=new Set,o=0){if(o>6)return e;if(_(e)){if("string"==typeof e.$ref){const n=e.$ref;if(r.has(n))return{$ref:n};const s=I(t,n);if(void 0===s)return e;const i=new Set(r).add(n);return T(s,t,i,o+1)}const n={};for(const[s,i]of Object.entries(e))n[s]=T(i,t,r,o+1);return n}return Array.isArray(e)?e.map(e=>T(e,t,r,o+1)):e}function A(e,t){const r=_(e)&&e["x-protocol"]||_(t)&&t["x-protocol"];if("string"==typeof r&&r.trim())return r.trim().toLowerCase();if(_(e)&&e["x-grpc"]||_(t)&&t["x-grpc"])return"grpc";if(_(e)&&e["x-graphql"]||_(t)&&t["x-graphql"])return"graphql";if(_(e)&&e["x-mcp"]||_(t)&&t["x-mcp"])return"mcp";if(_(e)&&(e["x-ws"]||e["x-websocket"])||_(t)&&t["x-ws"])return"websocket";const o=_(e)?e.responses:void 0;for(const e of Object.values(_(o)?o:{}))if(_(e)&&e.content?.["text/event-stream"])return"sse";return"http"}function U(e){const t=_(e.paths)?e.paths:{},r=[];for(const[e,o]of Object.entries(t))if(_(o))for(const t of S){const n=o[t];_(n)&&r.push({method:t.toUpperCase(),path:e,pathItem:o,operation:n,protocol:A(n,o)})}return r}function $(e){const t=new Map;for(const r of O(e.pathItem.parameters))_(r)&&r.name&&r.in&&t.set(`${r.in}:${r.name}`,r);for(const r of O(e.operation.parameters))_(r)&&r.name&&r.in&&t.set(`${r.in}:${r.name}`,r);return[...t.values()]}function P(e,t){return(Array.isArray(t.security)?t.security:Array.isArray(e.security)?e.security:[]).filter(_).map(e=>{const t={};for(const[r,o]of Object.entries(e))t[r]=Array.isArray(o)?o.map(String):[];return t})}function k(e){const t=_(e.components?.securitySchemes)?e.components.securitySchemes:{},r=[];for(const[e,o]of Object.entries(t)){const t=_(o)?o:{},n={};if(_(t.flows))for(const[e,r]of Object.entries(t.flows))_(r)&&_(r.scopes)&&(n[e]=Object.keys(r.scopes));const s={name:e,type:"string"==typeof t.type?t.type:"unknown",flows:n};q(t.scheme)&&(s.scheme=t.scheme),q(t.bearerFormat)&&(s.bearerFormat=t.bearerFormat),q(t.in)&&(s.in=t.in),q(t.name)&&(s.parameterName=t.name),q(t.openIdConnectUrl)&&(s.openIdConnectUrl=t.openIdConnectUrl),r.push(s)}return r}function C(e){return O(e).filter(e=>"string"==typeof e?.url).map(e=>({url:e.url,...q(e.description)?{description:e.description}:{},variables:_(e.variables)?Object.keys(e.variables):[]}))}function M(e){const t=U(e),r=new Set,o=new Set;for(const e of t){for(const t of O(e.operation.tags))"string"==typeof t&&r.add(t);o.add(e.protocol)}const n=_(e.components?.schemas)?e.components.schemas:{};return{title:q(e.info?.title)??"Untitled API",version:q(e.info?.version)??"0.0.0",...q(e.info?.description)?{description:e.info.description}:{},...q(e.openapi)?{openapiVersion:e.openapi}:{},servers:C(e.servers),endpointCount:t.length,tags:[...r].sort(),protocols:[...o].sort(),schemaCount:Object.keys(n).length,securitySchemes:k(e)}}function E(e){return Buffer.from(JSON.stringify({offset:e}),"utf8").toString("base64url")}function N(e,t={}){const r=t.method?.trim().toUpperCase(),o=t.protocol?.trim().toLowerCase(),n=t.tag?.trim().toLowerCase(),s=t.search?.trim().toLowerCase(),i=t.secured,a=U(e).map(t=>function(e,t){const r=$(t),o=_(t.operation.responses)?t.operation.responses:{};return{ref:`${t.method} ${t.path}`,...q(t.operation.operationId)?{operationId:t.operation.operationId}:{},method:t.method,path:t.path,...q(t.operation.summary)?{summary:t.operation.summary}:{},tags:O(t.operation.tags).filter(e=>"string"==typeof e),secured:P(e,t.operation).length>0,statusCodes:Object.keys(o),hasParameters:r.length>0,hasRequestBody:_(t.operation.requestBody),protocol:t.protocol}}(e,t)).filter(e=>{if(r&&e.method!==r)return!1;if(o&&e.protocol!==o)return!1;if(n&&!e.tags.some(e=>e.toLowerCase()===n))return!1;if(void 0!==i&&e.secured!==i)return!1;if(s){if(![e.ref,e.operationId??"",e.summary??"",e.path,e.tags.join(" ")].join(" ").toLowerCase().includes(s))return!1}return!0}),c=a.length,p=Math.min(Math.max(t.pageSize??100,1),500),u=function(e){if(!e)return 0;try{const t=JSON.parse(Buffer.from(e,"base64url").toString("utf8"));return Number.isInteger(t.offset)&&(t.offset??0)>=0?t.offset??0:0}catch{throw new x("invalid_cursor","The pagination cursor is malformed.")}}(t.cursor),d=a.slice(u,u+p),m=u+d.length;return{items:d,total:c,...m<c?{nextCursor:E(m)}:{}}}function L(e,t){const r={};for(const[o,n]of Object.entries(e)){if(!_(n))continue;const e={schema:n.schema?T(n.schema,t):{},examples:_(n.examples)?Object.keys(n.examples):[]};"example"in n&&(e.example=n.example),r[o]=e}return r}function R(e,t,r){const o=function(e,t){const r=U(e);let o;if(t.operationId)o=r.find(e=>e.operation.operationId===t.operationId);else if(t.method&&t.path){const e=t.method.trim().toUpperCase();o=r.find(r=>r.method===e&&r.path===t.path.trim())}else t.ref&&(o=r.find(e=>`${e.method} ${e.path}`===t.ref.trim()));if(!o)throw new x("operation_not_found",`No operation matches ${t.ref??t.operationId??`${t.method??""} ${t.path??""}`.trim()}.`);return o}(e,r),{operation:n,method:s,path:i}=o,a=$(o).map(e=>{const r=e.in,o={name:String(e.name),in:r,required:"path"===r||Boolean(e.required),deprecated:Boolean(e.deprecated),schema:e.schema?T(e.schema,t):{}};return q(e.description)&&(o.description=e.description),"example"in e&&(o.example=e.example),o}).sort((e,t)=>"path"===e.in!=("path"===t.in)?"path"===e.in?-1:1:e.required!==t.required?e.required?-1:1:e.name.localeCompare(t.name));let c;_(n.requestBody)&&_(n.requestBody.content)&&(c={required:Boolean(n.requestBody.required),...q(n.requestBody.description)?{description:n.requestBody.description}:{},content:L(n.requestBody.content,t)});const p=Object.entries(_(n.responses)?n.responses:{}).map(([e,r])=>{const o=_(r)?r:{},n=[];for(const[e,r]of Object.entries(_(o.headers)?o.headers:{})){const o=_(r)?r:{};n.push({name:e,required:Boolean(o.required),...q(o.description)?{description:o.description}:{},schema:o.schema?T(o.schema,t):{}})}return{status:e,...q(o.description)?{description:o.description}:{},headers:n,content:_(o.content)?L(o.content,t):{}}}),u=P(e,n),d=k(e),m=new Set(u.flatMap(e=>Object.keys(e))),l=d.filter(e=>m.has(e.name));return{ref:`${s} ${i}`,...q(n.operationId)?{operationId:n.operationId}:{},method:s,path:i,...q(n.summary)?{summary:n.summary}:{},...q(n.description)?{description:n.description}:{},tags:O(n.tags).filter(e=>"string"==typeof e),deprecated:Boolean(n.deprecated),idempotent:j.has(s.toLowerCase()),protocol:o.protocol,parameters:a,...c?{requestBody:c}:{},responses:p,security:l,servers:C(n.servers??e.servers)}}function B(e,t,r){let o,n;if(r.ref){o=I(t,r.ref);const e=r.ref.split("/");n=e[e.length-1]}else r.name&&(n=r.name,o=t.components?.schemas?.[r.name]);if(void 0===o)throw new x("schema_not_found",`No schema matches ${r.ref??r.name??"(empty locator)"}.`);return{...n?{name:n}:{},schema:T(o,t)}}function D(e,t){const r=k(e).filter(t=>(e.security??[]).some(e=>_(e)&&t.name in e));if(!t)return{global:r};return{global:r,operation:R(e,e,t).security}}async function J(e,t){let r;try{r=new URL(e)}catch{return{url:e,reachable:!1,latencyMs:0,error:"Invalid URL."}}if("http:"!==r.protocol&&"https:"!==r.protocol)return{url:e,reachable:!1,latencyMs:0,error:"Only http and https targets are supported."};const o=new AbortController,n=setTimeout(()=>o.abort(),t),s=Date.now();try{const t=await fetch(r,{method:"GET",signal:o.signal,redirect:"follow"}),n=t.headers.get("content-type");return{url:e,reachable:!0,status:t.status,statusText:t.statusText,...n?{contentType:n}:{},latencyMs:Date.now()-s}}catch(r){const o=r instanceof DOMException&&"AbortError"===r.name;return{url:e,reachable:!1,latencyMs:Date.now()-s,error:o?`Timed out after ${t}ms.`:r instanceof Error?r.message:String(r)}}finally{clearTimeout(n)}}function F(e,t){if(!e)return;const r=Object.entries(e).map(([e,r])=>`${e}${t}${r}`);return r.length?r:void 0}function H(e,t){const r={spec:e.path};t.baseUrl&&(r.server=t.baseUrl),t.timeoutMs&&(r.timeout=t.timeoutMs),t.concurrency&&(r.concurrency=t.concurrency),t.proxy&&(r.proxy=t.proxy);const o=F(t.headers,":");o&&(r.header=o);const n=F(t.variables,"=");n&&(r.variable=n);const s=a(r);return s.formats=[],s.outputDir="",s.failOnError=!1,t.auth&&(s.auth=t.auth),s}function z(e,t){if(t?.trim())return t.trim();const r=e.document.servers;if(Array.isArray(r))for(const e of r)if(e&&"string"==typeof e.url&&e.url.trim()&&!e.url.includes("{"))return e.url.trim()}function G(e,t){if(void 0===e)return;if(!e||"object"!=typeof e||Array.isArray(e))throw new Error(`${t} must be an object of strings.`);const r={};for(const[o,n]of Object.entries(e)){if("string"!=typeof n)throw new Error(`${t}.${o} must be a string.`);r[o]=n}return r}function W(e,t){const r=z(e,"string"==typeof t.baseUrl?t.baseUrl:void 0),o={};r&&(o.baseUrl=r),"number"==typeof t.timeoutMs&&(o.timeoutMs=V(t.timeoutMs,"timeoutMs",3e4,1,6e5)),"number"==typeof t.concurrency&&(o.concurrency=V(t.concurrency,"concurrency",5,1,20));const n=G(t.headers,"headers");n&&(o.headers=n);const s=G(t.variables,"variables");return s&&(o.variables=s),"string"==typeof t.proxy&&t.proxy.trim()&&(o.proxy=t.proxy.trim()),o}function V(e,t,r,o,n){if(null==e)return r;const s=Number(e);if(!Number.isFinite(s)||s<o)throw new Error(`${t} must be a number >= ${o}.`);return Math.min(Math.round(s),n)}var Y={};function K(e){return p(e.dereferenced,Y)}async function Q(e,t,r,o){const n=H(e,{...t,...o.baseUrl?{baseUrl:o.baseUrl}:{}}),s=function(e,t){const r=K(e);let o;if(t.operationId)o=r.find(e=>e.operationId===t.operationId);else if(t.method&&t.path){const e=t.method.toUpperCase();o=r.find(r=>r.method.toUpperCase()===e&&r.path===t.path)}else t.ref&&(o=r.find(e=>`${e.method.toUpperCase()} ${e.path}`===t.ref.trim()));if(!o)throw new x("operation_not_found",`No executable operation matches ${t.ref??t.operationId??`${t.method??""} ${t.path??""}`.trim()}.`);return o}(e,r),i=l(),a={config:n,spec:e.dereferenced},p=function(e){if(void 0!==e){if(!e||"object"!=typeof e||Array.isArray(e))throw new Error("values must be an object with path/query/header/body keys.");return e}}(o.values);p&&(a.values=p),o.variables&&(a.variables=o.variables);const u=function(e){if(void 0!==e){if(!Array.isArray(e))throw new Error("assertions must be an array.");return e.filter(e=>!!e&&"object"==typeof e&&"string"==typeof e.assert)}}(o.assertions);u&&(a.extraAssertions=u),o.baseUrl&&(a.serverUrl=o.baseUrl);return(await c(i,s,a)).result}function X(e,t){if(void 0!==e){if(!Array.isArray(e)||e.some(e=>"string"!=typeof e))throw new x("invalid_arguments",`${t} must be an array of strings.`);return e}}function Z(e){const t={},r=X(e.methods,"methods");r&&(t.methods=r.map(e=>e.toLowerCase()));const o=X(e.paths,"paths");o&&(t.paths=o);const n=X(e.tags,"tags");n&&(t.tags=n);const s=X(e.operationIds,"operationIds");return s&&(t.operationIds=s),t}async function ee(e,t,r,o={}){const n=H(e,t);Object.keys(r).length&&(n.filter=r);const s=p(e.dereferenced,n);if(0===s.length)throw new x("no_operations","No operations match the current specification and filter.");const i=l(),a=Math.max(1,Math.min(n.concurrency??5,s.length)),d=[...s],m=[],f=Date.now();let h=!1;const y=Array.from({length:a},async()=>{for(;d.length>0;){if(o.signal?.aborted)return void(h=!0);const t=d.shift();if(!t)return;const r={config:n,spec:e.dereferenced};n.variables&&(r.variables=n.variables);const a=await c(i,t,r);m.push(a.result),o.report?.(m.length,s.length,`${t.method.toUpperCase()} ${t.path}`)}});await Promise.all(y),m.sort((e,t)=>e.path.localeCompare(t.path)||e.method.localeCompare(t.method));const g=u(m,Date.now()-f);return h&&(g.skipped+=s.length-m.length,g.total=s.length),{summary:g,results:m,generatedAt:(new Date).toISOString(),version:"0.1.0"}}function te(e){if(!e||"object"!=typeof e||Array.isArray(e))throw new x("invalid_scenario","scenario must be an object with name and steps.");const t=e;if("string"!=typeof t.name||!t.name.trim())throw new x("invalid_scenario","scenario.name is required.");if(!Array.isArray(t.steps)||0===t.steps.length)throw new x("invalid_scenario","scenario.steps must be a non-empty array.");return t}function re(e,t){let r;try{r=te(t)}catch(e){if(e instanceof x)return{valid:!1,errors:[e.message]};throw e}try{const t=d(r,K(e));return{valid:!0,count:t.length,steps:t.map((e,t)=>({index:t,ref:e.ref,...e.step.name?{name:e.step.name}:{}}))}}catch(e){return{valid:!1,errors:[e instanceof Error?e.message:String(e)]}}}async function oe(e,t,r,o={}){const n=te(t),s=re(e,n);if(!s.valid)throw new x("invalid_scenario","Scenario failed validation.",s.errors);const i={config:H(e,r),spec:e.dereferenced,onEvent:e=>{"step:start"===e.type&&"number"==typeof e.stepIndex?o.report?.(e.stepIndex+1,n.steps.length,e.type):"scenario:finish"===e.type&&o.report?.(n.steps.length,n.steps.length,e.type)}};o.signal&&(i.signal=o.signal);return function(e){const{config:t,...r}=e;return r}(await m(n,i))}var ne=["GET","POST","PUT","PATCH","DELETE","HEAD","OPTIONS","TRACE"],se={ref:{type:"string",description:'Operation reference, e.g. "POST /orders".'},operationId:{type:"string",description:"The operationId declared in the specification."},method:{type:"string",enum:ne},path:{type:"string",description:'The path, e.g. "/orders/{orderId}".'}},ie={baseUrl:{type:"string",description:"Local backend base URL. Defaults to the first spec server URL."},timeoutMs:{type:"integer",minimum:1,maximum:6e5,default:3e4},headers:{type:"object",description:"Extra headers sent with every request.",additionalProperties:{type:"string"}},variables:{type:"object",description:"Postman-style {{name}} variables.",additionalProperties:{type:"string"}},proxy:{type:"string",description:"HTTP/HTTPS proxy URL."}},ae={type:"object",description:"ScenarioDefinition: { name, description?, variables?, stopOnFailure?, steps: [{ ref | method+path, name?, skip?, request: { values?, serverUrl?, extract?: [{name, from: body|header|status, path?, key?}], assertions?: [{name, assert, ...}] } }] }",properties:{name:{type:"string"},description:{type:"string"},stopOnFailure:{type:"boolean"},variables:{type:"object",additionalProperties:{type:"string"}},steps:{type:"array",items:{type:"object"}}},required:["name","steps"]};function ce(e){const t="string"==typeof e.ref?e.ref.trim():void 0,r="string"==typeof e.operationId?e.operationId.trim():void 0,o="string"==typeof e.method?e.method.trim():void 0,n="string"==typeof e.path?e.path.trim():void 0;if(t||r||o&&n)return{...t?{ref:t}:{},...r?{operationId:r}:{},...o&&n?{method:o,path:n}:{}};throw new x("invalid_arguments","Provide either ref, operationId, or both method and path.")}var pe=[{name:"spec_overview",description:"Get the API title, version, servers, tags, protocols, security schemes, and counts. Call this first to understand the specification.",inputSchema:{type:"object",properties:{},additionalProperties:!1}},{name:"list_operations",description:"List operations as compact rows (reference, operationId, summary, tags, status codes, auth). Filter by tag, method, protocol, auth, or free-text search. Results are paginated.",inputSchema:{type:"object",properties:{tag:{type:"string",description:"Exact tag name."},method:{type:"string",enum:ne},protocol:{type:"string",description:"http, grpc, graphql, websocket, sse, or mcp."},secured:{type:"boolean",description:"Filter by secured operations."},search:{type:"string",description:"Case-insensitive substring."},pageSize:{type:"integer",minimum:1,maximum:500,default:100},cursor:{type:"string",description:"Opaque nextCursor from a previous page."}},additionalProperties:!1}},{name:"get_operation",description:"Get the full implementation contract for one operation: parameters with validation rules, request body JSON Schemas and examples, every documented response (status, headers, body), and effective security. Use this before writing handler code so field names, types, required flags, enums, and response shapes match the spec exactly.",inputSchema:{type:"object",properties:se,additionalProperties:!1}},{name:"get_schema",description:"Get one reusable component schema (dereferenced) by component name or JSON pointer.",inputSchema:{type:"object",properties:{name:{type:"string",description:'Component schema name, e.g. "Order".'},ref:{type:"string",description:'Local pointer, e.g. "#/components/schemas/Order".'}},additionalProperties:!1}},{name:"validate_spec",description:"Validate the current specification and list errors and warnings with their locations. The document is re-read from disk, so recent edits are reflected.",inputSchema:{type:"object",properties:{},additionalProperties:!1}},{name:"get_auth_requirements",description:"List every security scheme and, when an operation is given, the exact auth that operation requires (scheme type, header/query placement, OAuth flows and scopes). Use before implementing auth middleware or guards.",inputSchema:{type:"object",properties:se,additionalProperties:!1}},{name:"ping_target",description:"Check that the local backend is reachable before testing. Returns status and latency. Use this first when a contract test fails at the connection layer.",inputSchema:{type:"object",properties:{...ie,timeoutMs:{type:"integer",minimum:100,maximum:6e4,default:5e3}},additionalProperties:!1}},{name:"send_request",description:"Send one operation request to the running backend with optional path/query/header/body values, variables, and extra assertions. Returns the normalized response and per-assertion pass/fail. Use this to verify a single handler you just implemented.",inputSchema:{type:"object",properties:{...se,...ie,values:{type:"object",description:"Request values merged over sampled defaults: { path, query, header, body }."},assertions:{type:"array",description:"Declarative assertions added to the operation's spec assertions.",items:{type:"object"}}},additionalProperties:!1}},{name:"run_contract_tests",description:"Execute the selected operations against the backend and evaluate the spec contract (status, schema, declared assertions). Returns per-operation results and a summary. Filter by methods, tags, path regexes, or operationIds.",inputSchema:{type:"object",properties:{...ie,concurrency:{type:"integer",minimum:1,maximum:20,default:5},methods:{type:"array",items:{type:"string"}},paths:{type:"array",items:{type:"string"}},tags:{type:"array",items:{type:"string"}},operationIds:{type:"array",items:{type:"string"}}},additionalProperties:!1}},{name:"validate_scenario",description:"Statically validate an ordered multi-step scenario: every step reference must resolve, and extraction/assertion shapes are checked. Never sends a request. Call this before run_scenario.",inputSchema:{type:"object",properties:{scenario:ae},required:["scenario"],additionalProperties:!1}},{name:"run_scenario",description:"Run an ordered, stateful scenario (for example register then login then create order). Steps share variables; each step can extract response values (body JSONPath, header, status) for later steps and add assertions. Streams progress; supports cancellation.",inputSchema:{type:"object",properties:{scenario:ae,...ie},required:["scenario"],additionalProperties:!1}}],ue=new Set(pe.map(e=>e.name));async function de(e,t,r,o={}){if(!ue.has(e))throw new x("unknown_tool",`Unknown tool: ${e}`);const n=await r.load(),s=n.dereferenced,i=n.document;switch(e){case"spec_overview":return M(s);case"list_operations":{const e={};return"string"==typeof t.tag&&(e.tag=t.tag),"string"==typeof t.method&&(e.method=t.method),"string"==typeof t.protocol&&(e.protocol=t.protocol),"boolean"==typeof t.secured&&(e.secured=t.secured),"string"==typeof t.search&&(e.search=t.search),"number"==typeof t.pageSize&&(e.pageSize=t.pageSize),"string"==typeof t.cursor&&(e.cursor=t.cursor),N(s,e)}case"get_operation":return R(s,i,ce(t));case"get_schema":{const e="string"==typeof t.name?t.name.trim():void 0,r="string"==typeof t.ref?t.ref.trim():void 0;if(!e&&!r)throw new x("invalid_arguments","Provide either a schema name or a $ref pointer.");return B(0,i,{...e?{name:e}:{},...r?{ref:r}:{}})}case"validate_spec":return(await r.load(!0)).validation;case"get_auth_requirements":return void 0!==t.ref||void 0!==t.operationId||void 0!==t.method?D(s,ce(t)):D(s);case"ping_target":{const e=W(n,t).baseUrl;if(!e)throw new x("missing_base_url","Provide baseUrl or declare a concrete server URL in the specification.");return J(e,"number"==typeof t.timeoutMs?V(t.timeoutMs,"timeoutMs",5e3,100,6e4):5e3)}case"send_request":return Q(n,W(n,t),ce(t),{values:t.values??void 0,variables:t.variables??void 0,assertions:t.assertions??void 0});case"run_contract_tests":return ee(n,W(n,t),Z(t),o);case"validate_scenario":return re(n,t.scenario);case"run_scenario":{const e=W(n,t);return oe(n,t.scenario,e,o)}default:throw new x("unknown_tool",`Unknown tool: ${e}`)}}var me="powerduck://spec/";async function le(e){const t=await e.load();return[{uri:`${me}source`,name:"OpenAPI source",description:"The raw OpenAPI document exactly as authored.",mimeType:t.mediaType},{uri:`${me}overview`,name:"API overview",description:"Servers, tags, protocols, security schemes, and counts.",mimeType:"application/json"},{uri:`${me}operations`,name:"Operations index",description:"Compact index of all operations (up to 500).",mimeType:"application/json"}]}var fe=[{uriTemplate:`${me}operation/{ref}`,name:"Operation contract",description:'Full contract for one operation. Use the reference form "METHOD /path", URL-encoded, e.g. operation/POST%20/orders.',mimeType:"application/json"},{uriTemplate:`${me}schema/{name}`,name:"Component schema",description:"A dereferenced component schema by name.",mimeType:"application/json"}];async function he(e,t){if(!e.startsWith(me))throw new x("resource_not_found",`Unknown resource: ${e}`);const r=await t.load(),o=r.dereferenced,n=r.document,s=decodeURIComponent(e.slice(17));if("source"===s)return{uri:e,mimeType:r.mediaType,text:r.sourceText};if("overview"===s)return{uri:e,mimeType:"application/json",text:JSON.stringify(M(o),null,2)};if("operations"===s)return{uri:e,mimeType:"application/json",text:JSON.stringify(N(o,{pageSize:500}),null,2)};if(s.startsWith("operation/")){const t=R(o,n,{ref:s.slice(10)});return{uri:e,mimeType:"application/json",text:JSON.stringify(t,null,2)}}if(s.startsWith("schema/")){const t=B(0,n,{name:s.slice(7)});return{uri:e,mimeType:"application/json",text:JSON.stringify(t,null,2)}}throw new x("resource_not_found",`Unknown resource: ${e}`)}var ye=["PowerDuck developer MCP gives you accurate, dereferenced OpenAPI facts for the backend you are implementing and verifies it against a running server.","Call spec_overview and list_operations to orient yourself, then get_operation before writing each handler so parameters, request bodies, responses, and auth match the specification.","Use ping_target, send_request, run_contract_tests, validate_scenario, and run_scenario to verify the implementation as you build it.","Call validate_spec after the specification changes. The document is re-read from disk on every request."].join(" ");function ge(e){return{isError:!0,content:[{type:"text",text:JSON.stringify({error:e.code,message:e.message,...void 0!==e.details?{details:e.details}:{}},null,2)}]}}function ve(e,a={}){const c=new t({name:a.name??"powerduck-dev-mcp",version:a.version??"0.1.0"},{capabilities:{tools:{},resources:{}},instructions:a.instructions??ye});return c.setRequestHandler(r,async()=>({tools:pe})),c.setRequestHandler(o,async(t,r)=>{const{name:o,arguments:n,_meta:s}=t.params,i=s?.progressToken,a={signal:r.signal};void 0!==i&&(a.report=(e,t,o)=>{r.sendNotification({method:"notifications/progress",params:{progressToken:i,progress:e,...t?{total:t}:{},...o?{message:o}:{}}})});try{const t=await de(o,n??{},e,a);return c=t,{content:[{type:"text",text:JSON.stringify(c,null,2)}]}}catch(e){if(e instanceof x)return ge(e);const t=e instanceof Error?e.message:String(e);return ge(new x("internal_error",t))}var c}),c.setRequestHandler(n,async()=>({resources:await le(e)})),c.setRequestHandler(s,async()=>({resourceTemplates:fe})),c.setRequestHandler(i,async t=>{const{uri:r}=t.params;try{const t=await he(r,e);return{contents:[{uri:t.uri,mimeType:t.mimeType,text:t.text}]}}catch(e){if(e instanceof x)throw e;throw new x("resource_error",e instanceof Error?e.message:String(e))}}),c}function be(e){return!!e&&"object"==typeof e&&!Array.isArray(e)}function we(e){if("string"==typeof e&&e.trim())return{message:e,severity:"error"};if(be(e)&&"string"==typeof e.message){const t="warning"===e.severity||"info"===e.severity?e.severity:"error",r=Array.isArray(e.path)?e.path.join("/"):"string"==typeof e.path?e.path:void 0;return r?{message:e.message,severity:t,path:r}:{message:e.message,severity:t}}return null}var xe=class{constructor(e){this.specPath=e}specPath;cache=null;async load(e=!1){const t=h.statSync(this.specPath);if(!e&&this.cache&&this.cache.mtimeMs===t.mtimeMs)return this.cache.snapshot;const r=h.readFileSync(this.specPath,"utf8"),o=/\.ya?ml$/i.test(this.specPath),n=function(e,t){return t?y(e):JSON.parse(e)}(r,o);if(!be(n))throw new Error("The OpenAPI document must be a JSON or YAML object.");let s=n;const i="string"==typeof n.openapi?n.openapi:"";if(i&&!/^3\./.test(i))try{s=await g(n)}catch{s=n}const a=await async function(e){try{const t=await v(e),r=[];for(const e of t.errors??[]){const t=we(e);t&&r.push(t)}return{valid:Boolean(t.valid),..."string"==typeof t.version?{openapiVersion:t.version}:{},issues:r}}catch(e){return{valid:!1,issues:[{message:e instanceof Error?e.message:String(e),severity:"error"}]}}}(s),c=await async function(e){try{const t=await b(e);return!t.errors?.length&&be(t.schema)?t.schema:e}catch{return e}}(s),p={path:this.specPath,document:s,dereferenced:c,sourceText:r,mediaType:o?"application/yaml":"application/json",validation:a,mtimeMs:t.mtimeMs};return this.cache={mtimeMs:t.mtimeMs,snapshot:p},p}};async function Se(e){const t=function(){const e={log:console.log,info:console.info,debug:console.debug,dir:console.dir},t=(...e)=>console.error(...e);return console.log=t,console.info=t,console.debug=t,console.dir=t,()=>{console.log=e.log,console.info=e.info,console.debug=e.debug,console.dir=e.dir}}(),r=ve(new xe(e.specPath),{...e.name?{name:e.name}:{},...e.version?{version:e.version}:{}}),o=new f;let n=()=>{};const s=new Promise(e=>{n=e});let i=!1;const a=[],c=()=>{if(!i){i=!0;for(const e of a)e();t(),n()}};if(o.onerror=e=>{console.error("[dev-mcp:stdio] transport error:",e)},o.onclose=()=>c(),await r.connect(o),!1!==e.handleSignals)for(const e of["SIGINT","SIGTERM"]){const t=()=>{r.close().catch(()=>{})};process.once(e,t),a.push(()=>process.removeListener(e,t))}return{closed:s,close:async()=>{try{await r.close()}finally{c()}}}}function je(e){const t=h.readFileSync(e,"utf8");let r;try{r=JSON.parse(t)}catch(t){throw new Error(`Invalid JSON in ${e}: ${t instanceof Error?t.message:String(t)}`)}if(!r||"object"!=typeof r||Array.isArray(r))throw new Error(`${e} must contain a JSON object.`);const o={},n=r;return"string"==typeof n.spec&&(o.spec=n.spec),"string"==typeof n.baseUrl&&(o.baseUrl=n.baseUrl),"string"==typeof n.project&&(o.project=n.project),o}function _e(e){const t=e?w.resolve(e):w.resolve(process.cwd(),"powerduck.dev.json");return h.existsSync(t)?{config:je(t),configDir:w.dirname(t)}:{config:{},configDir:process.cwd()}}function Oe(e,t){return t?w.resolve(e,t):void 0}export{x as FactError,S as HTTP_METHODS,xe as SpecStore,D as authRequirements,H as buildRunnerConfig,Z as contractFilterFromArgs,ve as createDevMcpServer,pe as devTools,de as executeDevTool,R as getOperation,B as getSchema,N as listOperations,le as listSpecResources,_e as loadDevConfig,M as overview,J as pingTarget,he as readSpecResource,z as resolveBaseUrl,Oe as resolveFrom,I as resolvePointer,ee as runContractSuite,W as runOverridesFromArgs,oe as runScenarioTool,Q as sendOne,fe as specResourceTemplates,Se as startStdioServer,re as validateScenario};

package/package.json

@@ -0,0 +1,78 @@
+{
+  "name": "@powerduck/dev-mcp-server",
+  "version": "0.1.0",
+  "description": "Developer-facing MCP server that gives AI coding agents accurate OpenAPI facts and runs contract/scenario tests against a local backend. Build APIs correctly, verify them immediately.",
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.cjs"
+    },
+    "./package.json": "./package.json"
+  },
+  "bin": {
+    "powerduck-dev-mcp": "./dist/cli.mjs"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20.11"
+  },
+  "scripts": {
+    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
+    "typecheck": "tsc -p tsconfig.json",
+    "bundle": "tsup",
+    "build": "npm run clean && npm run typecheck && npm run bundle",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "prepublishOnly": "npm run build && npm run test"
+  },
+  "keywords": [
+    "openapi",
+    "mcp",
+    "model-context-protocol",
+    "ai",
+    "coding-agent",
+    "claude",
+    "codex",
+    "cursor",
+    "backend",
+    "contract-testing",
+    "scenario-testing",
+    "developer-tools"
+  ],
+  "author": "Powerduck limited",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/powerducklab/dev-mcp-server.git"
+  },
+  "bugs": {
+    "url": "https://github.com/powerducklab/dev-mcp-server/issues"
+  },
+  "homepage": "https://www.powerduck.com/",
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@powerduck/openapi-cli": "^0.2.7",
+    "@powerduck/openapi-parser": "^0.3.3",
+    "@powerduck/openapi-request": "^0.2.11",
+    "commander": "^15.0.0",
+    "js-yaml": "^5.4.1"
+  },
+  "devDependencies": {
+    "@types/js-yaml": "^4.0.9",
+    "@types/node": "^22.20.1",
+    "tsup": "^8.5.1",
+    "tsx": "^4.19.1",
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.0"
+  }
+}