@pikku/cli 0.12.154 → 0.12.156

package/dist/src/functions/wirings/functions/serialize-addon-types.js

@@ -10,12 +10,57 @@
  * `#pikku/addon/<leaf>` — a depth at which an application has nothing to match,
  * leaving the resolver to fall back to Node's per-package `imports`.
  */
-export const serializeAddonInstallTypes = () => `/**
+export const serializeAddonInstallTypes = (addonFunctionNames = {}) => {
+    const packages = Object.entries(addonFunctionNames).filter(([, names]) => names.length > 0);
+    // Nothing installed yet — the bootstrap run writes this before any addon's
+    // metadata has been read, and a project with no addons never gets more.
+    if (packages.length === 0) {
+        return `/**
  * Installing an addon into this application
  */
 
 export { wireAddon, wireRemoteAddon } from '@pikku/core/addon'
 `;
+    }
+    const entries = packages
+        .map(([pkg, names]) => `  ${JSON.stringify(pkg)}: ${names
+        .map((name) => JSON.stringify(name))
+        .join(' | ')}`)
+        .join('\n');
+    return `/**
+ * Installing an addon into this application
+ */
+
+import { wireAddon as wireAddonCore } from '@pikku/core/addon'
+import type { WireAddonConfig } from '@pikku/core/addon'
+
+export { wireRemoteAddon } from '@pikku/core/addon'
+
+/**
+ * The functions each installed addon publishes. \`mcp\` names them.
+ */
+type AddonFunctions = {
+${entries}
+}
+
+type AddonFunctionName<Package extends string> =
+  Package extends keyof AddonFunctions ? AddonFunctions[Package] : string
+
+/**
+ * Installs an addon into this project: its functions, wirings and scopes become
+ * part of the app, under the namespace and options given here.
+ *
+ * \`mcp: true\` offers every function the addon itself declared as a tool; a list
+ * names the functions to offer, checked against the ones the addon publishes.
+ */
+export const wireAddon = <Package extends string>(
+  config: Omit<WireAddonConfig, 'package' | 'mcp'> & {
+    package: Package
+    mcp?: boolean | AddonFunctionName<Package>[]
+  }
+): void => wireAddonCore(config)
+`;
+};
 export const serializeAddonTypes = (singletonServicesTypeImport, singletonServicesTypeName, configTypeImport, requiredServicesTypeImport, typedSecretServiceImport, typedVariablesServiceImport, typedCredentialServiceImport = null) => {
     return `/**
  * Addon package types for pikkuAddonConfig and pikkuAddonServices

package/dist/src/functions/wirings/mcp/pikku-command-mcp.js

@@ -44,7 +44,9 @@ const generateArgumentsFromSchema = async (inputSchema, schemaDirectory, typesMa
     }
     catch (e) {
         logger.warn(`Command MCP: Could not load schema for type: ${uniqueName} from ${schemaPath}`);
-        console.error(e);
+        // The warning above is the actionable half; the cause is detail, and detail
+        // belongs behind the verbosity control rather than on everyone's stderr.
+        logger.debug(e instanceof Error ? (e.stack ?? e.message) : String(e));
         return [];
     }
 };
@@ -55,7 +57,10 @@ export const pikkuMCP = pikkuSessionlessFunc({
         const hasMcpContent = Object.keys(mcpEndpoints.toolsMeta).length > 0 ||
             Object.keys(mcpEndpoints.resourcesMeta).length > 0 ||
             Object.keys(mcpEndpoints.promptsMeta).length > 0;
-        if (mcpEndpoints.files.size === 0 || !hasMcpContent) {
+        // `files` only holds sources that call wireMCPTool/Resource/Prompt, which
+        // an addon contributing tools through `wireAddon({ mcp })` never does.
+        // Gate on the content, or an addon-only app generates no meta at all.
+        if (!hasMcpContent) {
             return undefined;
         }
         await writeFileInDir(logger, mcpWiringsFile, serializeFileImports('wireMCPResource', mcpWiringsFile, mcpEndpoints.files, packageMappings));

package/dist/src/functions/wirings/middleware/pikku-command-middleware.js

@@ -13,10 +13,22 @@ export const pikkuMiddleware = pikkuSessionlessFunc({
         const hasDefinitions = Object.keys(state.middleware.definitions).length > 0;
         const hasChannelMiddleware = state.channelMiddleware.tagMiddleware.size > 0 ||
             Object.keys(state.channelMiddleware.definitions).length > 0;
+        // A project whose only middleware is `addGlobalMiddleware([...])` over
+        // middleware defined in a package (a session bridge, say) has no group and
+        // no local definition, and used to generate no middleware file at all — so
+        // the registration never ran.
+        // `globalFiles` is the current record, but the serializer also still reads
+        // `global:*` out of `instances` so that a state serialized by an older
+        // inspector keeps working. This gate decides whether the serializer runs at
+        // all, so it has to accept exactly what the serializer accepts — otherwise
+        // an older state is dropped here and the file it needed is never written.
+        const hasGlobalMiddleware = (state.middleware.globalFiles?.size ?? 0) > 0 ||
+            Object.keys(state.middleware.instances).some((id) => id.startsWith('global:'));
         if (hasHTTPGroups ||
             hasTagGroups ||
             hasDefinitions ||
-            hasChannelMiddleware) {
+            hasChannelMiddleware ||
+            hasGlobalMiddleware) {
             const metaData = state.middlewareGroupsMeta;
             await writeFileInDir(logger, config.middlewareGroupsMetaJsonFile, JSON.stringify(metaData, null, 2));
             await writeFileInDir(logger, middlewareFile, serializeMiddlewareImports(middlewareFile, middleware, state.http, packageMappings, state));

package/dist/src/functions/wirings/middleware/serialize-middleware-imports.d.ts

@@ -1,2 +1,15 @@
 import type { InspectorMiddlewareState, InspectorHTTPState, InspectorState } from '@pikku/inspector';
 export declare const serializeMiddlewareImports: (outputPath: string, middlewareState: InspectorMiddlewareState, httpState: InspectorHTTPState, packageMappings?: Record<string, string>, fullState?: InspectorState) => string;
+/**
+ * Fail the build if a file that calls `addGlobalMiddleware` has no side-effect
+ * import in the generated middleware file.
+ *
+ * Auth commonly lives in global middleware, and a deployed unit that misses its
+ * import does not fail to build — it serves every authenticated route a 401
+ * with a clean build log. Checking the emitted text (rather than the set it was
+ * built from) is what makes this a check and not a restatement: it fails if the
+ * emit is ever dropped, put behind a condition, or handed a path the import
+ * list does not actually carry. It cannot fire on a build that does emit the
+ * import.
+ */
+export declare const assertGlobalMiddlewareImported: (outputPath: string, output: string, globalImportPaths: Map<string, string>) => void;

package/dist/src/functions/wirings/middleware/serialize-middleware-imports.js

@@ -54,21 +54,34 @@ export const serializeMiddlewareImports = (outputPath, middlewareState, httpStat
     // Global middleware (addGlobalMiddleware) is registered by a top-level call
     // at module evaluation, so a side-effect import of its source file runs the
     // registration. Unlike tag/http middleware it has no associated wire group —
-    // it lives only in `instances` keyed `global:*` — so the per-unit `--names`
-    // filter leaves it out of every deployed unit (the `state.http.files`
-    // fallback that add-middleware adds gets stripped by that filter). Emitting
-    // it here, into the always-bootstrap-imported pikku-middleware.gen.ts,
-    // guarantees global middleware registers in every unit. A duplicate import
-    // in full builds is harmless — module bodies evaluate once.
+    // the inspector records it as a source file in `globalFiles` (and as
+    // `global:*` entries in `instances`) — so the per-unit `--names` filter
+    // leaves it out of every deployed unit (the `state.http.files` fallback that
+    // add-middleware adds gets stripped by that filter). Emitting it here, into
+    // the always-bootstrap-imported pikku-middleware.gen.ts, guarantees global
+    // middleware registers in every unit. A duplicate import in full builds is
+    // harmless — module bodies evaluate once.
     //
     // `isFactoryCall` is not consulted: it distinguishes `mw()` from `mw` as an
     // array element, not a deferred registration behind an exported factory, and
     // addGlobalMiddleware registers at module evaluation under either form.
+    //
+    // `globalFiles` is the primary source: it is a plain set of file names, where
+    // `instances` is a map whose keys an unrelated registration could once
+    // collide with. The `global:*` sweep stays as well, so a state serialized by
+    // an older inspector (no `globalFiles`) still emits its imports.
+    const globalSourceFiles = new Set(middlewareState.globalFiles ?? []);
     for (const [instanceId, instance] of Object.entries(middlewareState.instances)) {
         if (instanceId.startsWith('global:')) {
-            directImports.add(getFileImportRelativePath(outputPath, instance.sourceFile, packageMappings));
+            globalSourceFiles.add(instance.sourceFile);
         }
     }
+    const globalImportPaths = new Map();
+    for (const sourceFile of globalSourceFiles) {
+        const filePath = getFileImportRelativePath(outputPath, sourceFile, packageMappings);
+        globalImportPaths.set(sourceFile, filePath);
+        directImports.add(filePath);
+    }
     const allFactories = new Map([
         ...httpFactories,
         ...tagFactories,
@@ -90,5 +103,32 @@ export const serializeMiddlewareImports = (outputPath, middlewareState, httpStat
             serializedFactoryCalls.push(`${exportName}()`);
         }
     }
-    return [...serializedImports, ...serializedFactoryCalls].join('\n');
+    const output = [...serializedImports, ...serializedFactoryCalls].join('\n');
+    assertGlobalMiddlewareImported(outputPath, output, globalImportPaths);
+    return output;
+};
+/**
+ * Fail the build if a file that calls `addGlobalMiddleware` has no side-effect
+ * import in the generated middleware file.
+ *
+ * Auth commonly lives in global middleware, and a deployed unit that misses its
+ * import does not fail to build — it serves every authenticated route a 401
+ * with a clean build log. Checking the emitted text (rather than the set it was
+ * built from) is what makes this a check and not a restatement: it fails if the
+ * emit is ever dropped, put behind a condition, or handed a path the import
+ * list does not actually carry. It cannot fire on a build that does emit the
+ * import.
+ */
+export const assertGlobalMiddlewareImported = (outputPath, output, globalImportPaths) => {
+    const missing = [...globalImportPaths.entries()].filter(([, filePath]) => !output.includes(`import '${filePath}'`));
+    if (missing.length === 0) {
+        return;
+    }
+    throw new Error(`Global middleware would not be registered in ${outputPath}.\n` +
+        `These files call addGlobalMiddleware() but no side-effect import for them was emitted:\n` +
+        missing.map(([sourceFile]) => `  - ${sourceFile}`).join('\n') +
+        `\n\nGlobal middleware — auth gates included — only runs if its module is imported, so ` +
+        `this build would start up with it silently missing. Re-run \`pikku all\`; if it persists, ` +
+        `register the middleware from a file that also makes a wire registration ` +
+        `(e.g. addHTTPMiddleware) and report this as a pikku bug.`);
 };

package/dist/src/functions/wirings/secrets/serialize-secrets-types.js

@@ -12,10 +12,15 @@ export const serializeSecretsTypes = ({ definitions, schemaLookup, secretsFile,
     for (const [name, meta] of credentialEntries) {
         if (meta.oauth2) {
             needsOAuth2Types = true;
-            mapEntries.push(`  '${meta.secretId}': OAuth2AppCredential`);
-            mapEntries.push(`  '${meta.oauth2.tokenSecretId}': OAuth2Token`);
-            metaEntries.push(`  '${meta.secretId}': { name: '${name}', displayName: ${tsLiteral(meta.displayName)}, oauth2: { tokenSecretId: '${meta.oauth2.tokenSecretId}' } }`);
-            metaEntries.push(`  '${meta.oauth2.tokenSecretId}': { name: '${name}_tokens', displayName: ${tsLiteral(`${meta.displayName} Tokens`)} }`);
+            // Tokens are as optional as the app they belong to: nobody can connect
+            // without the client id and secret, so a deployment that is allowed to
+            // omit the app is never asked for the tokens either.
+            const optional = meta.optional ? '?' : '';
+            const optionalMeta = meta.optional ? ', optional: true' : '';
+            mapEntries.push(`  '${meta.secretId}'${optional}: OAuth2AppCredential`);
+            mapEntries.push(`  '${meta.oauth2.tokenSecretId}'${optional}: OAuth2Token`);
+            metaEntries.push(`  '${meta.secretId}': { name: '${name}', displayName: ${tsLiteral(meta.displayName)}${optionalMeta}, oauth2: { tokenSecretId: '${meta.oauth2.tokenSecretId}' } }`);
+            metaEntries.push(`  '${meta.oauth2.tokenSecretId}': { name: '${name}_tokens', displayName: ${tsLiteral(`${meta.displayName} Tokens`)}${optionalMeta} }`);
         }
         else if (meta.schema && typeof meta.schema === 'string') {
             const schemaRef = schemaLookup.get(meta.schema);

package/dist/src/functions/workflows/all.workflow.js

@@ -270,6 +270,14 @@ export const allWorkflow = pikkuWorkflowComplexFunc({
                 allImports.push(config.middlewareFile);
             }
         }
+        // The generated credentials file registers the project's own credential
+        // meta into pikku state, which is what lets `wire.getCredential` resolve a
+        // credential the app declares rather than one an addon brought with it.
+        if (!config.addon &&
+            config.credentialsFile &&
+            stateAfterScaffold.credentials?.definitions.length) {
+            allImports.push(config.credentialsFile);
+        }
         const schemas = await workflow.do('Schemas', 'pikkuSchemas', null);
         if (schemas) {
             allImports.push(`${config.schemaDirectory}/register.gen.ts`);

package/dist/src/services.js

@@ -77,6 +77,7 @@ export const defaultCLIRenderer = pikkuCLIRender((_services, data) => {
  * at the moment it is most worth having.
  */
 const CONFIG_FREE_COMMANDS = new Set([
+    'new.addon',
     'skills',
     'skills.list',
     'skills.install',

package/dist/src/utils/pikku-cli-config-error.d.ts

@@ -1,9 +1,14 @@
+import { PikkuError } from '@pikku/core/errors';
 /**
- * A config that was found and parsed, but says something impossible.
+ * A config that was found and parsed, but says something impossible — or one
+ * that could not be found at all.
  *
  * Its message reaches the developer verbatim — every other error out of the
  * loader is reported as "failed to load", which sends the reader hunting for a
- * broken file rather than the line that is wrong.
+ * broken file rather than the line that is wrong. A `PikkuError`, so the CLI
+ * prints that message alone: a stack through the config loader is never the
+ * answer to "which line of my config is wrong", and `--verbose` / `PIKKU_DEBUG`
+ * still shows it for the times it is.
  */
-export declare class PikkuCLIConfigError extends Error {
+export declare class PikkuCLIConfigError extends PikkuError {
 }

package/dist/src/utils/pikku-cli-config-error.js

@@ -1,9 +1,14 @@
+import { PikkuError } from '@pikku/core/errors';
 /**
- * A config that was found and parsed, but says something impossible.
+ * A config that was found and parsed, but says something impossible — or one
+ * that could not be found at all.
  *
  * Its message reaches the developer verbatim — every other error out of the
  * loader is reported as "failed to load", which sends the reader hunting for a
- * broken file rather than the line that is wrong.
+ * broken file rather than the line that is wrong. A `PikkuError`, so the CLI
+ * prints that message alone: a stack through the config loader is never the
+ * answer to "which line of my config is wrong", and `--verbose` / `PIKKU_DEBUG`
+ * still shows it for the times it is.
  */
-export class PikkuCLIConfigError extends Error {
+export class PikkuCLIConfigError extends PikkuError {
 }

package/dist/src/utils/pikku-cli-config.js

@@ -56,7 +56,7 @@ async function findConfigFileOrNull() {
 async function findConfigFile() {
     const configFile = await findConfigFileOrNull();
     if (!configFile) {
-        throw new Error('Config file pikku.config.json not found');
+        throw new PikkuCLIConfigError('No Pikku config file (pikku.config.ts, .js or .json) found in this directory or any parent up to the repository root.\nRun this from inside a pikku project, or create one with `pikku init`.');
     }
     return configFile;
 }