@pikku/cli 0.12.155 → 0.12.159

package/dist/src/functions/wirings/mcp/pikku-command-mcp.js

@@ -57,7 +57,10 @@ export const pikkuMCP = pikkuSessionlessFunc({
         const hasMcpContent = Object.keys(mcpEndpoints.toolsMeta).length > 0 ||
             Object.keys(mcpEndpoints.resourcesMeta).length > 0 ||
             Object.keys(mcpEndpoints.promptsMeta).length > 0;
-        if (mcpEndpoints.files.size === 0 || !hasMcpContent) {
+        // `files` only holds sources that call wireMCPTool/Resource/Prompt, which
+        // an addon contributing tools through `wireAddon({ mcp })` never does.
+        // Gate on the content, or an addon-only app generates no meta at all.
+        if (!hasMcpContent) {
             return undefined;
         }
         await writeFileInDir(logger, mcpWiringsFile, serializeFileImports('wireMCPResource', mcpWiringsFile, mcpEndpoints.files, packageMappings));

package/dist/src/functions/wirings/secrets/serialize-secrets-types.js

@@ -12,10 +12,15 @@ export const serializeSecretsTypes = ({ definitions, schemaLookup, secretsFile,
     for (const [name, meta] of credentialEntries) {
         if (meta.oauth2) {
             needsOAuth2Types = true;
-            mapEntries.push(`  '${meta.secretId}': OAuth2AppCredential`);
-            mapEntries.push(`  '${meta.oauth2.tokenSecretId}': OAuth2Token`);
-            metaEntries.push(`  '${meta.secretId}': { name: '${name}', displayName: ${tsLiteral(meta.displayName)}, oauth2: { tokenSecretId: '${meta.oauth2.tokenSecretId}' } }`);
-            metaEntries.push(`  '${meta.oauth2.tokenSecretId}': { name: '${name}_tokens', displayName: ${tsLiteral(`${meta.displayName} Tokens`)} }`);
+            // Tokens are as optional as the app they belong to: nobody can connect
+            // without the client id and secret, so a deployment that is allowed to
+            // omit the app is never asked for the tokens either.
+            const optional = meta.optional ? '?' : '';
+            const optionalMeta = meta.optional ? ', optional: true' : '';
+            mapEntries.push(`  '${meta.secretId}'${optional}: OAuth2AppCredential`);
+            mapEntries.push(`  '${meta.oauth2.tokenSecretId}'${optional}: OAuth2Token`);
+            metaEntries.push(`  '${meta.secretId}': { name: '${name}', displayName: ${tsLiteral(meta.displayName)}${optionalMeta}, oauth2: { tokenSecretId: '${meta.oauth2.tokenSecretId}' } }`);
+            metaEntries.push(`  '${meta.oauth2.tokenSecretId}': { name: '${name}_tokens', displayName: ${tsLiteral(`${meta.displayName} Tokens`)}${optionalMeta} }`);
         }
         else if (meta.schema && typeof meta.schema === 'string') {
             const schemaRef = schemaLookup.get(meta.schema);

package/dist/src/functions/workflows/all.workflow.js

@@ -270,6 +270,14 @@ export const allWorkflow = pikkuWorkflowComplexFunc({
                 allImports.push(config.middlewareFile);
             }
         }
+        // The generated credentials file registers the project's own credential
+        // meta into pikku state, which is what lets `wire.getCredential` resolve a
+        // credential the app declares rather than one an addon brought with it.
+        if (!config.addon &&
+            config.credentialsFile &&
+            stateAfterScaffold.credentials?.definitions.length) {
+            allImports.push(config.credentialsFile);
+        }
         const schemas = await workflow.do('Schemas', 'pikkuSchemas', null);
         if (schemas) {
             allImports.push(`${config.schemaDirectory}/register.gen.ts`);

package/dist/src/server/bun-server-runner.js

@@ -27,6 +27,7 @@ export class BunServerRunner {
             // Read off this options object by the transport, not off `config` — so it
             // has to be forwarded here explicitly, exactly like the JWT above.
             mcpJson: options.mcpJson,
+            mcpSurfaces: options.mcpSurfaces,
         });
     }
 }

package/dist/src/server/dev-server-runner.interface.d.ts

@@ -45,6 +45,19 @@ export type DevServerOptions = {
         resources?: unknown[];
         prompts?: unknown[];
     };
+    /**
+     * The further MCP endpoints this project serves, one per surface, each with
+     * the path it answers on. Forwarded the same way and with the same
+     * consequence for forgetting: the surface 404s with no error anywhere.
+     */
+    mcpSurfaces?: Array<{
+        mcpJson: {
+            tools?: unknown[];
+            resources?: unknown[];
+            prompts?: unknown[];
+        };
+        mcpPath: string;
+    }>;
 };
 export interface DevServerRunner {
     /**

package/dist/src/server/node-server-runner.js

@@ -47,6 +47,7 @@ export class NodeServerRunner {
             // Read off this options object by the transport, not off `config` — so it
             // has to be forwarded here explicitly, exactly like the JWT above.
             mcpJson: options.mcpJson,
+            mcpSurfaces: options.mcpSurfaces,
         });
         return {
             init: () => server.init(),

package/dist/src/services.js

@@ -77,6 +77,7 @@ export const defaultCLIRenderer = pikkuCLIRender((_services, data) => {
  * at the moment it is most worth having.
  */
 const CONFIG_FREE_COMMANDS = new Set([
+    'new.addon',
     'skills',
     'skills.list',
     'skills.install',

package/dist/src/utils/mcp-surface.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The slug a surface's manifest filename and its deploy unit name are both
+ * built from. `deploy-apply` recovers the filename by stripping `mcp-` off the
+ * unit name, so codegen and the analyzer have to agree on it exactly or a
+ * deployed unit reads a manifest nobody wrote — hence one function, not the
+ * same expression written twice.
+ */
+export declare const mcpSurfaceSlug: (surface: string) => string;

package/dist/src/utils/mcp-surface.js

@@ -0,0 +1,9 @@
+import { toSafeKebab } from '../deploy/analyzer/naming.js';
+/**
+ * The slug a surface's manifest filename and its deploy unit name are both
+ * built from. `deploy-apply` recovers the filename by stripping `mcp-` off the
+ * unit name, so codegen and the analyzer have to agree on it exactly or a
+ * deployed unit reads a manifest nobody wrote — hence one function, not the
+ * same expression written twice.
+ */
+export const mcpSurfaceSlug = (surface) => toSafeKebab(surface);