add-export — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited add-export (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Subpath exports are defined in package.json under the exports field. Each subpath maps to a source entry point that gets compiled to dist/. The exports catalog in CLAUDE.md/AGENTS.md must stay in sync with package.json.
The build uses tsconfig.build.json (not tsconfig.json) with rootDir: ./src and include: ["src/**/*"]. This means every source file at src/foo/bar.ts compiles to dist/foo/bar.js — the dist/ path in each export entry must match wherever tsc produces the compiled output for the named source file. Choose your source file location to produce the dist/ path you want in the export entry.
src/ (e.g., src/utils/new-util.ts)package.json exports, mirroring the source path: // source: src/utils/new-util.ts → dist: dist/utils/new-util.js
"./newutil": {
"types": "./dist/utils/new-util.d.ts",
"import": "./dist/utils/new-util.js"
}CLAUDE.md and AGENTS.md — add a row to the table. These files must stay byte-identical; the simplest approach is cp CLAUDE.md AGENTS.md after editingbun run build to generate dist/ outputexports map: # Confirm the compiled file exists at the expected dist path
ls dist/utils/new-util.js
# Confirm the subpath export resolves correctly (tests the exports map, not just the dist file)
bun -e "import('@cyanheads/mcp-ts-core/newutil').then(m => console.log(Object.keys(m)))"| Convention | Rule |
|---|---|
| Subpath | all-lowercase, no underscores (e.g., utils, storage/types, testing/fuzz) |
| Source file | kebab-case (e.g., error-handler.ts) |
| Export name | camelCase for values, PascalCase for types |
package.json exports with types and import conditionsCLAUDE.md and AGENTS.md (must be byte-identical)peerDependencies and peerDependenciesMeta in package.jsonbun run build succeedsdist/ path and subpath import resolves correctlytests/integration/package-consumer.int.test.ts updated: new subpath added to the import spec list and toHaveLength count incrementedbun run devcheck passes~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.