@pikku/core 0.12.128 → 0.12.130

package/CHANGELOG.md

@@ -1,3 +1,25 @@
+## 0.12.130
+
+### Patch Changes
+
+- dfcd351: The deploy planner now binds a unit to the units of the functions its functions call with `rpc.invoke('name')` / `rpc.remote('name')`. Before, a caller and callee split into different units (e.g. a no-service function in `svc-base` calling a DB function in `svc-kysely`) got no service binding and failed on the deployed stage with "No service binding for function". The inspector records literal RPC names per function as `invokes` (single, double or substitution-free template quotes; `rpc!`, `wire.rpc`) and warns on a computed name, which the planner cannot see (#1883).
+- cf40182: Deployed units that call `rpc.startWorkflow('x')` now get x's meta, so the call no longer fails with `WorkflowNotFoundError`. The inspector records `startsWorkflows` for literal `rpc.startWorkflow(...)` calls. It warns when a handler computes the workflow name or passes `rpc` to a helper, because the planner cannot see those calls.
+
+  With workflow queues, the deploy planner gives a starter unit the workflow meta and orchestrator queue meta only (new `--workflowMeta` filter), plus `workflow-state` and `queue` services. Without queues the start runs inline, so the whole workflow is bundled. Core's `startWorkflow` now requires the workflow registration only for inline runs; queued runs need only the meta.
+
+- 5bce779: `pikku dev` registers webhook sources with their providers when `PIKKU_DEV_WEBHOOK_URL` is set. What it registered, signing secrets included, is kept in a git-ignored `.webhook-registrations.gen.json` next to `pikku.config.json`, so a database reset or `.pikku` wipe does not register again, and nothing reaches a provider while the url and events are unchanged. Registrations no source declares any more are warned about on every run, with the endpoint and label to delete by hand. The prefix defaults to `dev-<username>`; override it with `PIKKU_DEV_WEBHOOK_LABEL_PREFIX`. New in core: `reconcileWebhookRegistrations`.
+- 5bce779: Webhook trigger sources are off until someone turns them on, and addons declare their own.
+
+  An addon calls `wireTriggerWebhookSource` in its own package, and an app that wires the addon gets the source (its route included) without declaring it: named and routed after the addon's namespace, so two instances get one each. A source the app declares under the same name wins.
+
+  Every source now has an `enabled` switch in the `triggerSourceStore`, off by default. `reconcileTriggerSources` registers only enabled sources and records each one's `baseUrl` and `labelPrefix`; a disabled source's route answers 404 without running `receive`. New in core: `enableTriggerSource` registers a source with its provider and `disableTriggerSource` stops it receiving, then tears it down, both at the recorded address unless one is given. The admin addon exposes them as `triggerSourceEnable` and `triggerSourceDisable`. The `pikkuTriggerSource` table gains `enabled`, `baseUrl` and `labelPrefix`: run `pikku db generate` for the migration.
+
+## 0.12.129
+
+### Patch Changes
+
+- 1ab6eb4: Fix app functions reached through `rpc.invoke`/`rpc.exposed` (including the generated `/rpc/:rpcName` endpoint) running without their wire services. Since `singletonServicesOnly`, the forwarding `rpcCaller` built none and the callee inherited that, so any service from `pikkuWireServices` was `undefined`. The runner now resolves the callee's factory itself. Channels pass their per-connection set as the new `wireServices` option, which is reused and left open.
+
 ## 0.12.128
 
 ### Patch Changes

package/dist/function/function-meta.types.d.ts

@@ -138,12 +138,26 @@ export type FunctionMeta = FunctionRuntimeMeta & Partial<{
     isDirectFunction: boolean;
     sourceFile: string;
     exportedName: string;
+    /**
+     * RPC names this function's own body calls by literal name through
+     * `rpc.invoke(...)` / `rpc.remote(...)`. The deploy planner binds the
+     * function's unit to each callee's unit from this; a call with a computed
+     * name is not listed, and is warned about instead.
+     */
+    invokes: string[];
     /** File containing the handler body when it differs from sourceFile (imported handlers) */
     bodySourceFile?: string;
     /** 1-indexed first line of the handler body (verbose meta; coverage mapping) */
     bodyStart: number;
     /** 1-indexed last line of the handler body (verbose meta; coverage mapping) */
     bodyEnd: number;
+    /**
+     * Workflow names this function's own body starts by literal name through
+     * `rpc.startWorkflow(...)`. The deploy planner bundles each one's meta
+     * into the function's unit, which is all a queued start needs. A call
+     * made from a helper the handler passes `rpc` to is not listed.
+     */
+    startsWorkflows: string[];
 } & CommonWireMeta>;
 export type FunctionsRuntimeMeta = Record<string, FunctionRuntimeMeta>;
 export type FunctionsMeta = Record<string, FunctionMeta>;

package/dist/function/function-runner.d.ts

@@ -8,9 +8,14 @@ import type { AddonInstance } from '../wirings/addon/addon-runner.js';
 export declare const addFunction: (funcName: string, funcConfig: CorePikkuFunctionConfig<any, any, any, any, any>, packageName?: string | null) => void;
 export declare const getFunctionNames: (packageName?: string | null) => string[];
 export declare const getAllFunctionNames: () => string[];
-export declare const runPikkuFunc: <In = any, Out = any>(wireType: PikkuWiringTypes, wireId: string, funcName: string, { singletonServices, createWireServices, data, auth: wiringAuth, inheritedMiddleware, wireMiddleware, inheritedChannelMiddleware, wireChannelMiddleware, coerceDataFromSchema, wire, sessionService, credentialWireService, packageName, addonInstance, }: {
+export declare const runPikkuFunc: <In = any, Out = any>(wireType: PikkuWiringTypes, wireId: string, funcName: string, { singletonServices, createWireServices, wireServices: providedWireServices, data, auth: wiringAuth, inheritedMiddleware, wireMiddleware, inheritedChannelMiddleware, wireChannelMiddleware, coerceDataFromSchema, wire, sessionService, credentialWireService, packageName, addonInstance, }: {
     singletonServices: CoreSingletonServices;
     createWireServices?: CreateWireServices;
+    /**
+     * Wire services the caller already built and still owns, such as a
+     * channel's per-connection set. Used as-is and never closed here.
+     */
+    wireServices?: Record<string, unknown>;
     data: () => Promise<In> | In;
     auth?: boolean;
     inheritedMiddleware?: MiddlewareMetadata[];

package/dist/function/function-runner.js

@@ -3,7 +3,7 @@ import { runMiddleware, combineMiddleware } from '../middleware-runner.js';
 import { combineChannelMiddleware, wrapChannelWithMiddleware, } from '../wirings/channel/channel-middleware-runner.js';
 import { runPermissions } from '../permissions.js';
 import { withoutSecrets } from '../services/secretless.js';
-import { pikkuState } from '../pikku-state.js';
+import { getCreateWireServices, pikkuState } from '../pikku-state.js';
 import { applyDefaultsFromSchema, coerceTopLevelDataFromSchema, validateSchema, } from '../schema.js';
 import { parseVersionedId } from '../version.js';
 import { PikkuSessionService } from '../services/user-session-service.js';
@@ -64,7 +64,7 @@ export const getAllFunctionNames = () => {
     }
     return functions;
 };
-export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServices, createWireServices, data, auth: wiringAuth, inheritedMiddleware, wireMiddleware, inheritedChannelMiddleware, wireChannelMiddleware, coerceDataFromSchema, wire, sessionService, credentialWireService, packageName = null, addonInstance, }) => {
+export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServices, createWireServices, wireServices: providedWireServices, data, auth: wiringAuth, inheritedMiddleware, wireMiddleware, inheritedChannelMiddleware, wireChannelMiddleware, coerceDataFromSchema, wire, sessionService, credentialWireService, packageName = null, addonInstance, }) => {
     wire.wireType ??= wireType;
     wire.wireId ??= wireId;
     const funcMap = pikkuState(packageName, 'function', 'functions');
@@ -118,13 +118,14 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
     const resolvedSingletonServices = funcPackageName
         ? await getOrCreatePackageSingletonServices(funcPackageName, singletonServices, addonInstance)
         : singletonServices;
-    let resolvedCreateWireServices = createWireServices;
-    if (funcPackageName) {
-        const factories = pikkuState(funcPackageName, 'package', 'factories');
-        if (factories?.createWireServices) {
-            resolvedCreateWireServices = factories.createWireServices;
-        }
-    }
+    // knowledge: decisions/internals/the-runner-resolves-wire-services-itself.md
+    const packageCreateWireServices = funcPackageName
+        ? pikkuState(funcPackageName, 'package', 'factories')?.createWireServices
+        : undefined;
+    const reusedWireServices = packageCreateWireServices
+        ? undefined
+        : providedWireServices;
+    const resolvedCreateWireServices = packageCreateWireServices ?? createWireServices ?? getCreateWireServices();
     const allChannelMiddleware = combineChannelMiddleware(wireType, wireId, {
         wireInheritedChannelMiddleware: inheritedChannelMiddleware,
         wireChannelMiddleware,
@@ -256,11 +257,14 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
         let invocationAuditLog;
         let invocationAnalytics;
         try {
-            wireServices = funcMeta.singletonServicesOnly
+            if (!funcMeta.singletonServicesOnly && !reusedWireServices) {
+                wireServices = (await resolvedCreateWireServices?.(resolvedSingletonServices, invocationWire));
+            }
+            const invocationWireServices = funcMeta.singletonServicesOnly
                 ? undefined
-                : (await resolvedCreateWireServices?.(resolvedSingletonServices, invocationWire));
-            let services = wireServices && Object.keys(wireServices).length > 0
-                ? { ...resolvedSingletonServices, ...wireServices }
+                : (reusedWireServices ?? wireServices);
+            let services = invocationWireServices && Object.keys(invocationWireServices).length > 0
+                ? { ...resolvedSingletonServices, ...invocationWireServices }
                 : resolvedSingletonServices;
             // knowledge: decisions/internals/core-function-runner-restores-the-wire-fields-it-overwrites.md
             if (resolvedAuditConfig &&
@@ -286,7 +290,7 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
             const callerPackageName = funcPackageName;
             Object.defineProperty(invocationWire, 'rpc', {
                 get() {
-                    const rpc = rpcService.getContextRPCService(services, invocationWire, { sessionService }, 0, callerPackageName);
+                    const rpc = rpcService.getContextRPCService(resolvedSingletonServices, invocationWire, { sessionService }, 0, callerPackageName);
                     Object.defineProperty(invocationWire, 'rpc', {
                         value: rpc,
                         writable: true,

package/dist/services/trigger-source-store.d.ts

@@ -3,15 +3,22 @@ export type TriggerSourceKind = 'webhook';
 export type DeclaredTriggerSource = {
     name: string;
     kind: TriggerSourceKind;
+    /** Where the running app is served and how it labels provider endpoints: what enabling a source registers it with. */
+    baseUrl?: string;
+    labelPrefix?: string;
 };
 /**
  * What was registered with the provider for one declared trigger source.
  * `state` is what the last `setup` returned — provider identifiers only; any
  * secret it issued lives in the credential service.
  */
-export type TriggerSourceRow = DeclaredTriggerSource & {
+export type TriggerSourceRow = Required<Pick<DeclaredTriggerSource, 'name' | 'kind'>> & {
+    baseUrl: string | null;
+    labelPrefix: string | null;
     /** False once the declaration has gone from code without a teardown: an orphan. */
     declared: boolean;
+    /** Only an enabled source is registered with its provider or receives events. Off until someone turns it on. */
+    enabled: boolean;
     status: string | null;
     state: WebhookSourceState | null;
     /** The last step's instructions or error. */
@@ -25,11 +32,12 @@ export type TriggerSourceResult = {
 };
 /** What each declared trigger source registered with its provider. */
 export interface TriggerSourceStore {
-    /** Upserts the declared sources and marks the rest undeclared. */
+    /** Upserts the declared sources, keeping a known address when none is given, and marks the rest undeclared. */
     syncTriggerSources(sources: DeclaredTriggerSource[]): Promise<void>;
     listTriggerSources(): Promise<TriggerSourceRow[]>;
     getTriggerSource(name: string): Promise<TriggerSourceRow | null>;
     recordTriggerSource(name: string, result: TriggerSourceResult): Promise<void>;
+    setTriggerSourceEnabled(name: string, enabled: boolean): Promise<void>;
     deleteTriggerSource(name: string): Promise<void>;
 }
 export declare class InMemoryTriggerSourceStore implements TriggerSourceStore {
@@ -38,8 +46,12 @@ export declare class InMemoryTriggerSourceStore implements TriggerSourceStore {
     listTriggerSources(): Promise<{
         name: string;
         kind: TriggerSourceKind;
+        baseUrl: string | null;
+        labelPrefix: string | null;
         /** False once the declaration has gone from code without a teardown: an orphan. */
         declared: boolean;
+        /** Only an enabled source is registered with its provider or receives events. Off until someone turns it on. */
+        enabled: boolean;
         status: string | null;
         state: WebhookSourceState | null;
         /** The last step's instructions or error. */
@@ -49,8 +61,12 @@ export declare class InMemoryTriggerSourceStore implements TriggerSourceStore {
     getTriggerSource(name: string): Promise<{
         name: string;
         kind: TriggerSourceKind;
+        baseUrl: string | null;
+        labelPrefix: string | null;
         /** False once the declaration has gone from code without a teardown: an orphan. */
         declared: boolean;
+        /** Only an enabled source is registered with its provider or receives events. Off until someone turns it on. */
+        enabled: boolean;
         status: string | null;
         state: WebhookSourceState | null;
         /** The last step's instructions or error. */
@@ -58,5 +74,6 @@ export declare class InMemoryTriggerSourceStore implements TriggerSourceStore {
         updatedAt: string | null;
     } | null>;
     recordTriggerSource(name: string, result: TriggerSourceResult): Promise<void>;
+    setTriggerSourceEnabled(name: string, enabled: boolean): Promise<void>;
     deleteTriggerSource(name: string): Promise<void>;
 }

package/dist/services/trigger-source-store.js

@@ -5,16 +5,23 @@ export class InMemoryTriggerSourceStore {
         for (const row of this.rows.values()) {
             row.declared = names.has(row.name);
         }
-        for (const { name, kind } of sources) {
+        for (const { name, kind, baseUrl, labelPrefix } of sources) {
             const row = this.rows.get(name);
             if (row) {
                 row.kind = kind;
+                if (baseUrl !== undefined)
+                    row.baseUrl = baseUrl;
+                if (labelPrefix !== undefined)
+                    row.labelPrefix = labelPrefix;
                 continue;
             }
             this.rows.set(name, {
                 name,
                 kind,
+                baseUrl: baseUrl ?? null,
+                labelPrefix: labelPrefix ?? null,
                 declared: true,
+                enabled: false,
                 status: null,
                 state: null,
                 detail: null,
@@ -41,6 +48,12 @@ export class InMemoryTriggerSourceStore {
         row.detail = result.detail ?? null;
         row.updatedAt = new Date().toISOString();
     }
+    async setTriggerSourceEnabled(name, enabled) {
+        const row = this.rows.get(name);
+        if (!row)
+            throw new Error(`Unknown trigger source: ${name}`);
+        row.enabled = enabled;
+    }
     async deleteTriggerSource(name) {
         this.rows.delete(name);
     }

package/dist/wirings/channel/channel-common.d.ts

@@ -2,7 +2,7 @@ import type { CoreSingletonServices } from '../../types/core.types.js';
 import type { MiddlewareMetadata } from '../../middleware/middleware.types.js';
 import type { CoreChannel, ChannelMessageMeta } from './channel.types.js';
 import { type PikkuSessionService } from '../../services/user-session-service.js';
-export declare const runChannelLifecycleWithMiddleware: ({ channelConfig, meta, lifecycleConfig, lifecycleType, services, channel, data, channelMiddlewareMeta, userSession, }: {
+export declare const runChannelLifecycleWithMiddleware: ({ channelConfig, meta, lifecycleConfig, lifecycleType, services, channel, data, channelMiddlewareMeta, userSession, wireServices, }: {
     channelConfig: CoreChannel<unknown, any>;
     meta: ChannelMessageMeta;
     lifecycleConfig: any;
@@ -16,4 +16,6 @@ export declare const runChannelLifecycleWithMiddleware: ({ channelConfig, meta,
      * just connected.
      */
     userSession?: PikkuSessionService<any>;
+    /** The connection's wire services, reused rather than rebuilt per call. */
+    wireServices?: Record<string, unknown>;
 }) => Promise<unknown>;

package/dist/wirings/channel/channel-common.js

@@ -2,7 +2,7 @@ import { combineMiddleware, runMiddleware } from '../../middleware-runner.js';
 import { runPikkuFunc } from '../../function/function-runner.js';
 import { createMiddlewareSessionWireProps, } from '../../services/user-session-service.js';
 import { combineChannelMiddleware, wrapChannelWithMiddleware, } from './channel-middleware-runner.js';
-export const runChannelLifecycleWithMiddleware = async ({ channelConfig, meta, lifecycleConfig, lifecycleType, services, channel, data, channelMiddlewareMeta, userSession, }) => {
+export const runChannelLifecycleWithMiddleware = async ({ channelConfig, meta, lifecycleConfig, lifecycleType, services, channel, data, channelMiddlewareMeta, userSession, wireServices, }) => {
     const lifecycleMiddleware = typeof lifecycleConfig === 'object' && 'middleware' in lifecycleConfig
         ? lifecycleConfig.middleware || []
         : [];
@@ -25,6 +25,7 @@ export const runChannelLifecycleWithMiddleware = async ({ channelConfig, meta, l
     const runLifecycle = async () => {
         return await runPikkuFunc('channel', channelConfig.name, meta.pikkuFuncId, {
             singletonServices: services,
+            wireServices,
             data: () => data,
             wire,
             sessionService: userSession,

package/dist/wirings/channel/channel-handler.d.ts

@@ -1,7 +1,7 @@
 import type { CoreServices, CoreUserSession } from '../../types/core.types.js';
 import type { BinaryData, CoreChannel, PikkuChannelHandler } from './channel.types.js';
 import type { SessionService } from '../../services/user-session-service.js';
-export declare const processMessageHandlers: (services: CoreServices, channelConfig: CoreChannel<any, any>, channelHandler: PikkuChannelHandler, userSession?: SessionService<CoreUserSession>) => {
+export declare const processMessageHandlers: (services: CoreServices, channelConfig: CoreChannel<any, any>, channelHandler: PikkuChannelHandler, userSession?: SessionService<CoreUserSession>, wireServices?: Record<string, unknown>) => {
     onMessage: (rawData: unknown) => Promise<unknown>;
     onBinaryMessage: ((data: BinaryData) => Promise<BinaryData | void>) | undefined;
 };

package/dist/wirings/channel/channel-handler.js

@@ -37,7 +37,7 @@ const validateAuth = (requiresSession, session, onMessage) => {
     }
     return true;
 };
-export const processMessageHandlers = (services, channelConfig, channelHandler, userSession) => {
+export const processMessageHandlers = (services, channelConfig, channelHandler, userSession, wireServices) => {
     const logger = services.logger;
     const requiresSession = channelConfig.auth !== false;
     const processMessage = async (data, onMessage, routingProperty, routerValue) => {
@@ -76,6 +76,7 @@ export const processMessageHandlers = (services, channelConfig, channelHandler,
         const wireChannelMiddleware = channelConfig.channelMiddleware || [];
         return await runPikkuFunc('channel', cacheKey, pikkuFuncId, {
             singletonServices: services,
+            wireServices,
             data: () => data,
             inheritedMiddleware,
             wireMiddleware,

package/dist/wirings/channel/local/local-channel-runner.js

@@ -89,6 +89,7 @@ export const runLocalChannel = async ({ channelId, request, response, route, ski
                             data: openingData,
                             channelMiddlewareMeta: meta.channelMiddleware,
                             userSession,
+                            wireServices,
                         });
                         if (result !== undefined) {
                             await channel.send(result);
@@ -117,6 +118,7 @@ export const runLocalChannel = async ({ channelId, request, response, route, ski
                             channel,
                             channelMiddlewareMeta: meta.channelMiddleware,
                             userSession,
+                            wireServices,
                         });
                     }
                     catch (e) {
@@ -131,7 +133,7 @@ export const runLocalChannel = async ({ channelId, request, response, route, ski
                 }
                 await closeServices();
             });
-            const { onMessage, onBinaryMessage } = processMessageHandlers(services, channelConfig, channelHandler, userSession);
+            const { onMessage, onBinaryMessage } = processMessageHandlers(services, channelConfig, channelHandler, userSession, wireServices);
             channelHandler.registerOnMessage(async (data) => {
                 try {
                     const result = await onMessage(data);

package/dist/wirings/channel/serverless/serverless-channel-runner.js

@@ -80,6 +80,7 @@ export const runChannelConnect = async ({ channelId, channelObject, request, res
                 data: openingData,
                 channelMiddlewareMeta: meta.channelMiddleware,
                 userSession,
+                wireServices,
             });
         }
         const pikkuUserId = userSession.getPikkuUserId();
@@ -150,6 +151,7 @@ export const runChannelDisconnect = async ({ channelId, channelStore, channelHan
                 channel,
                 channelMiddlewareMeta: meta.channelMiddleware,
                 userSession,
+                wireServices,
             });
         }
         catch (e) {
@@ -197,7 +199,7 @@ export const runChannelMessage = async ({ channelId, channelStore, channelHandle
     };
     let response;
     try {
-        const { onMessage } = processMessageHandlers(services, channelConfig, channelHandler, userSession);
+        const { onMessage } = processMessageHandlers(services, channelConfig, channelHandler, userSession, wireServices);
         response = await onMessage(data);
     }
     catch (e) {

package/dist/wirings/trigger/index.d.ts

@@ -1,6 +1,6 @@
 export { wireTrigger, wireTriggerSource } from './trigger-runner.js';
-export { wireTriggerWebhookSource, receiveWebhookSourceRequest, dispatchWebhookSourceJob, runWebhookSourceLifecycle, declaredTriggerSources, reconcileTriggerSources, teardownTriggerSources, subscribedWebhookEvents, } from './webhook-source-runner.js';
-export type { WebhookSourceOutcome } from './webhook-source-runner.js';
+export { wireTriggerWebhookSource, receiveWebhookSourceRequest, dispatchWebhookSourceJob, runWebhookSourceLifecycle, declaredTriggerSources, reconcileTriggerSources, enableTriggerSource, disableTriggerSource, reconcileWebhookRegistrations, teardownTriggerSources, subscribedWebhookEvents, } from './webhook-source-runner.js';
+export type { OrphanedWebhookRegistration, WebhookRegistration, WebhookRegistrations, WebhookSourceOutcome, } from './webhook-source-runner.js';
 export { PIKKU_INCOMING_WEBHOOK_QUEUE_NAME } from './webhook-source.types.js';
 export type { CoreTriggerWebhookSource, TriggerEvent, WebhookCheckResult, WebhookLifecycleInput, WebhookReceiveResult, WebhookRequest, WebhookSetupResult, WebhookSourceJob, WebhookSourceMeta, WebhookSourceMethod, WebhookSourcesMeta, WebhookSourceState, WebhookTeardownInput, WebhookTeardownResult, } from './webhook-source.types.js';
 export { PikkuTriggerService } from './pikku-trigger-service.js';

package/dist/wirings/trigger/index.js

@@ -1,4 +1,4 @@
 export { wireTrigger, wireTriggerSource } from './trigger-runner.js';
-export { wireTriggerWebhookSource, receiveWebhookSourceRequest, dispatchWebhookSourceJob, runWebhookSourceLifecycle, declaredTriggerSources, reconcileTriggerSources, teardownTriggerSources, subscribedWebhookEvents, } from './webhook-source-runner.js';
+export { wireTriggerWebhookSource, receiveWebhookSourceRequest, dispatchWebhookSourceJob, runWebhookSourceLifecycle, declaredTriggerSources, reconcileTriggerSources, enableTriggerSource, disableTriggerSource, reconcileWebhookRegistrations, teardownTriggerSources, subscribedWebhookEvents, } from './webhook-source-runner.js';
 export { PIKKU_INCOMING_WEBHOOK_QUEUE_NAME } from './webhook-source.types.js';
 export { PikkuTriggerService } from './pikku-trigger-service.js';

package/dist/wirings/trigger/webhook-source-runner.d.ts

@@ -9,7 +9,8 @@ export declare const subscribedWebhookEvents: (source: string) => string[];
 /**
  * The body of a webhook source's route: `receive`, validate, and queue every
  * event some trigger listens for. Events nobody listens for are answered and
- * dropped, so the provider does not retry them forever.
+ * dropped, so the provider does not retry them forever. With a
+ * `triggerSourceStore`, a source nobody enabled answers 404.
  */
 export declare const receiveWebhookSourceRequest: (sourceName: string, wire: {
     http?: PikkuHTTP;
@@ -44,15 +45,61 @@ export declare const runWebhookSourceLifecycle: ({ action, previous, singletonSe
     singletonServices?: CoreSingletonServices;
 }) => Promise<WebhookSourceOutcome[]>;
 /** The trigger sources this app declares, as the store is synced to. */
-export declare const declaredTriggerSources: () => DeclaredTriggerSource[];
+export declare const declaredTriggerSources: (address?: LifecycleInput) => DeclaredTriggerSource[];
 /**
- * Registers every declared webhook source with its provider: `check`, then
+ * Registers every enabled webhook source with its provider: `check`, then
  * `setup` where it is missing or drifted, recording what was registered.
- * Run after a deployment goes live.
+ * A source nobody enabled is skipped. Run after a deployment goes live.
  */
 export declare const reconcileTriggerSources: ({ singletonServices, ...input }: LifecycleInput & {
     singletonServices?: CoreSingletonServices;
 }) => Promise<WebhookSourceOutcome[]>;
+type SwitchInput = Partial<LifecycleInput> & {
+    name: string;
+    singletonServices?: CoreSingletonServices;
+};
+/**
+ * Turns a declared webhook source on and registers it with its provider, at
+ * the address given or the one the last deployment recorded.
+ */
+export declare const enableTriggerSource: ({ singletonServices, ...input }: SwitchInput) => Promise<WebhookSourceOutcome>;
+/**
+ * Turns a webhook source off: it stops receiving at once, then is removed
+ * from its provider. A failed teardown leaves it off and records the error.
+ */
+export declare const disableTriggerSource: ({ singletonServices, ...input }: SwitchInput) => Promise<WebhookSourceOutcome>;
+/** What one source registered with its provider, as a caller keeps it between runs. */
+export type WebhookRegistration = {
+    url: string;
+    events: string[];
+    status: WebhookSourceOutcome['status'];
+    state?: WebhookSourceState;
+    /** The signing secrets `setup` stored, so a wiped credential store can be refilled without registering again. */
+    credentials?: Record<string, unknown>;
+};
+export type WebhookRegistrations = Record<string, WebhookRegistration>;
+export type OrphanedWebhookRegistration = {
+    source: string;
+    url: string;
+    label: string;
+};
+/**
+ * Registers every declared webhook source against registrations the caller
+ * keeps rather than a `triggerSourceStore`, as `pikku dev` does in a file that
+ * outlives its database. A source whose url and events match what was
+ * registered is left alone without calling the provider, and its signing
+ * secrets are put back if the credential store lost them. Registrations no
+ * source declares any more are returned as orphans and kept, since only the
+ * code that set one up could tear it down.
+ */
+export declare const reconcileWebhookRegistrations: ({ registrations, singletonServices, ...input }: LifecycleInput & {
+    registrations: WebhookRegistrations;
+    singletonServices?: CoreSingletonServices;
+}) => Promise<{
+    registrations: WebhookRegistrations;
+    outcomes: WebhookSourceOutcome[];
+    orphans: OrphanedWebhookRegistration[];
+}>;
 /**
  * Removes the named webhook sources from their providers and forgets them.
  * Run on the outgoing deployment for the sources the next release drops,

package/dist/wirings/trigger/webhook-source-runner.js

@@ -79,11 +79,16 @@ const validateEvents = async (source, events, logger) => {
 /**
  * The body of a webhook source's route: `receive`, validate, and queue every
  * event some trigger listens for. Events nobody listens for are answered and
- * dropped, so the provider does not retry them forever.
+ * dropped, so the provider does not retry them forever. With a
+ * `triggerSourceStore`, a source nobody enabled answers 404.
  */
 export const receiveWebhookSourceRequest = async (sourceName, wire) => {
     const singletonServices = getSingletonServices();
     const meta = getSourceMeta(sourceName);
+    const store = singletonServices.triggerSourceStore;
+    if (store && !(await store.getTriggerSource(sourceName))?.enabled) {
+        return new Response(null, { status: 404 });
+    }
     const source = pikkuState(null, 'trigger', 'webhookSources').get(sourceName);
     const request = await readRequest(wire.http);
     const result = meta.receive
@@ -152,9 +157,12 @@ export const dispatchWebhookSourceJob = async (job) => {
 const recordAttempt = (singletonServices, receiptId, trigger, error) => singletonServices.incomingWebhookService
     ?.recordAttempt(receiptId, { trigger, ...(error ? { error } : {}) })
     .catch((storeError) => singletonServices.logger.error(`Failed to record the attempt for webhook receipt ${receiptId}`, storeError));
-const runSourceLifecycleStep = async (meta, action, { baseUrl, labelPrefix }, previous, singletonServices) => {
-    const url = `${baseUrl.replace(/\/+$/, '')}${meta.route}`;
-    const label = `${labelPrefix}:${meta.name}`;
+const sourceAddress = (meta, { baseUrl, labelPrefix }) => ({
+    url: `${baseUrl.replace(/\/+$/, '')}${meta.route}`,
+    label: `${labelPrefix}:${meta.name}`,
+});
+const runSourceLifecycleStep = async (meta, action, lifecycleInput, previous, singletonServices) => {
+    const { url, label } = sourceAddress(meta, lifecycleInput);
     const input = {
         url,
         label,
@@ -217,31 +225,165 @@ const requireTriggerSourceStore = (singletonServices) => {
     return store;
 };
 /** The trigger sources this app declares, as the store is synced to. */
-export const declaredTriggerSources = () => Object.keys(pikkuState(null, 'trigger', 'webhookSourceMeta')).map((name) => ({
+export const declaredTriggerSources = (address) => Object.keys(pikkuState(null, 'trigger', 'webhookSourceMeta')).map((name) => ({
     name,
     kind: 'webhook',
+    ...address,
 }));
 const detailOf = (outcome) => outcome.instructions ?? outcome.error ?? outcome.reason ?? null;
+const registerTriggerSource = async (store, meta, input, previous, singletonServices) => {
+    const outcome = await runSourceLifecycleStep(meta, 'setup', input, previous, singletonServices);
+    await store.recordTriggerSource(meta.name, {
+        status: outcome.status,
+        ...(outcome.state ? { state: outcome.state } : {}),
+        detail: detailOf(outcome),
+    });
+    return outcome;
+};
 /**
- * Registers every declared webhook source with its provider: `check`, then
+ * Registers every enabled webhook source with its provider: `check`, then
  * `setup` where it is missing or drifted, recording what was registered.
- * Run after a deployment goes live.
+ * A source nobody enabled is skipped. Run after a deployment goes live.
  */
 export const reconcileTriggerSources = async ({ singletonServices = getSingletonServices(), ...input }) => {
     const store = requireTriggerSourceStore(singletonServices);
-    await store.syncTriggerSources(declaredTriggerSources());
+    await store.syncTriggerSources(declaredTriggerSources({
+        baseUrl: input.baseUrl,
+        labelPrefix: input.labelPrefix,
+    }));
     const outcomes = [];
     for (const meta of Object.values(pikkuState(null, 'trigger', 'webhookSourceMeta'))) {
         const row = await store.getTriggerSource(meta.name);
-        const outcome = await runSourceLifecycleStep(meta, 'setup', input, row?.state ?? undefined, singletonServices);
-        await store.recordTriggerSource(meta.name, {
+        if (!row?.enabled) {
+            outcomes.push({
+                source: meta.name,
+                url: sourceAddress(meta, input).url,
+                status: 'skipped',
+                reason: 'disabled',
+            });
+            continue;
+        }
+        outcomes.push(await registerTriggerSource(store, meta, input, row.state ?? undefined, singletonServices));
+    }
+    return outcomes;
+};
+/** The address given, or the one the last deployment synced onto the row. */
+const switchAddress = (row, { baseUrl, labelPrefix, name }) => {
+    const address = {
+        baseUrl: baseUrl ?? row?.baseUrl,
+        labelPrefix: labelPrefix ?? row?.labelPrefix,
+    };
+    if (!address.baseUrl || !address.labelPrefix) {
+        throw new Error(`Trigger source '${name}' has no address yet: pass baseUrl and labelPrefix, or deploy so reconcile records them.`);
+    }
+    return address;
+};
+/**
+ * Turns a declared webhook source on and registers it with its provider, at
+ * the address given or the one the last deployment recorded.
+ */
+export const enableTriggerSource = async ({ singletonServices = getSingletonServices(), ...input }) => {
+    const store = requireTriggerSourceStore(singletonServices);
+    const meta = getSourceMeta(input.name);
+    await store.syncTriggerSources(declaredTriggerSources());
+    const row = await store.getTriggerSource(input.name);
+    const address = switchAddress(row, input);
+    await store.setTriggerSourceEnabled(input.name, true);
+    return registerTriggerSource(store, meta, address, row?.state ?? undefined, singletonServices);
+};
+/**
+ * Turns a webhook source off: it stops receiving at once, then is removed
+ * from its provider. A failed teardown leaves it off and records the error.
+ */
+export const disableTriggerSource = async ({ singletonServices = getSingletonServices(), ...input }) => {
+    const store = requireTriggerSourceStore(singletonServices);
+    const meta = getSourceMeta(input.name);
+    const row = await store.getTriggerSource(input.name);
+    const address = switchAddress(row, input);
+    await store.setTriggerSourceEnabled(input.name, false);
+    const outcome = await runSourceLifecycleStep(meta, 'teardown', address, row?.state ?? undefined, singletonServices);
+    await store.recordTriggerSource(input.name, {
+        status: outcome.status,
+        ...(outcome.status === 'failed' ? {} : { state: null }),
+        detail: detailOf(outcome),
+    });
+    return outcome;
+};
+/** The singleton credentials the package owning a source's `setup` declares: where its signing secret goes. */
+const sourceCredentialNames = (meta) => {
+    if (!meta.setup)
+        return [];
+    const namespace = meta.setup.includes(':') ? meta.setup.split(':')[0] : '';
+    const packageName = pikkuState(null, 'addons', 'packages').get(namespace)?.package ?? null;
+    const declared = pikkuState(packageName, 'package', 'credentialsMeta') ?? {};
+    return Object.entries(declared)
+        .filter(([, credential]) => credential.type === 'singleton' && !credential.oauth2)
+        .map(([name]) => name);
+};
+const sameEvents = (a, b) => a.length === b.length && a.every((event) => b.includes(event));
+/**
+ * Registers every declared webhook source against registrations the caller
+ * keeps rather than a `triggerSourceStore`, as `pikku dev` does in a file that
+ * outlives its database. A source whose url and events match what was
+ * registered is left alone without calling the provider, and its signing
+ * secrets are put back if the credential store lost them. Registrations no
+ * source declares any more are returned as orphans and kept, since only the
+ * code that set one up could tear it down.
+ */
+export const reconcileWebhookRegistrations = async ({ registrations, singletonServices = getSingletonServices(), ...input }) => {
+    const credentialService = singletonServices.credentialService;
+    const sources = pikkuState(null, 'trigger', 'webhookSourceMeta');
+    const next = {};
+    const outcomes = [];
+    for (const meta of Object.values(sources)) {
+        const { url } = sourceAddress(meta, input);
+        const events = subscribedWebhookEvents(meta.name);
+        const previous = registrations[meta.name];
+        const names = sourceCredentialNames(meta);
+        if (credentialService) {
+            for (const [name, value] of Object.entries(previous?.credentials ?? {})) {
+                if (!(await credentialService.has(name))) {
+                    await credentialService.set(name, value);
+                }
+            }
+        }
+        if (previous &&
+            previous.status !== 'failed' &&
+            previous.url === url &&
+            sameEvents(previous.events, events)) {
+            next[meta.name] = previous;
+            outcomes.push({ source: meta.name, url, status: 'unchanged' });
+            continue;
+        }
+        const outcome = await runSourceLifecycleStep(meta, 'setup', input, previous?.state, singletonServices);
+        const credentials = {};
+        for (const name of names) {
+            const value = await credentialService?.get(name);
+            if (value != null)
+                credentials[name] = value;
+        }
+        const state = outcome.state ?? previous?.state;
+        next[meta.name] = {
+            url,
+            events,
             status: outcome.status,
-            ...(outcome.state ? { state: outcome.state } : {}),
-            detail: detailOf(outcome),
-        });
+            ...(state ? { state } : {}),
+            ...(Object.keys(credentials).length ? { credentials } : {}),
+        };
         outcomes.push(outcome);
     }
-    return outcomes;
+    const orphans = [];
+    for (const [source, registration] of Object.entries(registrations)) {
+        if (sources[source])
+            continue;
+        next[source] = registration;
+        orphans.push({
+            source,
+            url: registration.url,
+            label: `${input.labelPrefix}:${source}`,
+        });
+    }
+    return { registrations: next, outcomes, orphans };
 };
 /**
  * Removes the named webhook sources from their providers and forgets them.

package/dist/wirings/workflow/pikku-workflow-service.js

@@ -385,15 +385,15 @@ export class PikkuWorkflowService {
             const shouldInline = options?.inline || !getSingletonServices()?.queueService;
             return runWorkflowGraph(this, name, input, rpcService, shouldInline, options?.startNode, wire, workflowMeta);
         }
-        const registrations = pikkuState(packageName, 'workflows', 'registrations');
-        const workflow = registrations.get(resolved?.resolvedName ?? name);
-        if (!workflow) {
-            throw new WorkflowNotFoundError(name);
-        }
         if (!workflowMeta.graphHash) {
             throw new Error(`Missing workflow graphHash for '${name}'`);
         }
         const shouldInline = options?.inline || !getSingletonServices()?.queueService;
+        // A queued run needs only the meta; the orchestrator's unit runs it.
+        const registrations = pikkuState(packageName, 'workflows', 'registrations');
+        if (shouldInline && !registrations.get(resolved?.resolvedName ?? name)) {
+            throw new WorkflowNotFoundError(name);
+        }
         const runId = await this.createRun(name, input, shouldInline, workflowMeta.graphHash, wire, {
             deterministic: workflowMeta.deterministic,
             plannedSteps: workflowMeta.plannedSteps,

package/knowledge/decisions/internals/index.md

@@ -62,6 +62,7 @@ caller is entitled to assume.
 - [A column's at-rest form is an axis of its own](core-column-form-is-an-axis-of-its-own.md) — How a value is stored is independent of how sensitive it is, so form carries a required nominal brand on writes while classification stays optional on reads
 - [The data-classification brand is an optional property](core-data-classification-brand-is-an-optional-property.md) — Making **classification** required would break ordinary Kysely operands, so the brand only constrains values flowing out
 - [The function runner restores the wire fields it overwrites](core-function-runner-restores-the-wire-fields-it-overwrites.md) — One wire object is reused across nested calls, so functionId, audit, addonNamespace and rpc are saved and put back in a finally
+- [The function runner resolves wire services itself](the-runner-resolves-wire-services-itself.md) — A function's wire services come from its own package's factory or the app's registered one, never borrowed from whoever called it
 - [Hot reload merges generated meta and never replaces it](core-hot-reload-merges-generated-meta-never-replaces-it.md) — Reloading codegen output must preserve runtime-registered meta, which no generated JSON contains
 - [Hot reload owns its module registry instead of re-importing](core-hot-reload-owns-its-module-registry.md) — Dev reload transpiles to CJS and runs modules through vm.compileFunction, because the native ESM loader map cannot be evicted
 - [Middleware order is resolution scope first, then priority](core-middleware-order-is-scope-then-priority.md) — Middleware is collected global to function, then stably sorted by priority, deduped, frozen and cached per wire

package/knowledge/decisions/internals/the-runner-resolves-wire-services-itself.md

@@ -0,0 +1,31 @@
+---
+type: decision
+title: The function runner resolves wire services itself
+description: A function's wire services come from its own package's factory or the app's registered one, never borrowed from whoever called it
+tags: core
+---
+
+# The function runner resolves wire services itself
+
+`runPikkuFunc` picks the wire-services factory for the function it is about to
+run: the function's addon package factory if it has one, else a factory the
+transport passed explicitly, else the app's registered one
+(`getCreateWireServices()`). A caller that passes nothing still gets the
+function its wire services.
+
+Before this, only the transports passed a factory. `rpc.invoke`, `rpc.exposed`,
+gateway handlers and webhook sources passed none, so an app function reached
+through them ran on whatever services its caller had already merged. That held
+until `singletonServicesOnly` let a caller skip building wire services: the
+generated `rpcCaller` behind `/rpc/:rpcName` reads no service, was marked, and
+every app function behind it lost `events` and every other wire service. Nested
+RPC therefore gets `resolvedSingletonServices`, not the caller's merged set.
+
+Channels are the one caller that legitimately shares wire services: they build
+one set per connection. They hand it over as `wireServices`, which the runner
+uses as-is and does not close, because the connection owns its lifetime.
+
+**What this rules out:** passing a caller's merged services down as
+`singletonServices` to carry wire services into a nested call, and deciding in
+one function's meta whether a different function gets wire services.
+`singletonServicesOnly` only ever describes the function it is set on.

package/knowledge/decisions/security/an-actor-credential-is-derived-per-persona.md

@@ -26,9 +26,10 @@ rotating it invalidates every credential at once.
 
 This is what lets a holder be handed less than everything:
 
-- The browser switcher gets `VITE_DEV_ACTOR_SECRETS`, one credential per
-  declared persona. The root stays on the dev server, so a bundle can no longer
-  hold the thing that is entitled to every persona.
+- The browser switcher gets no credential at all. It used to be handed
+  `VITE_DEV_ACTOR_SECRETS`, one per persona; it now names a persona by id at
+  `/sign-in/persona`, which the server gates with the actor opt-in and the
+  `devSwitcher` flag, so a bundle holds nothing worth taking.
 - A run can be given `PIKKU_PERSONA_SECRETS` (`id=secret,…`, minted with
   `pikku persona secret`) instead of the root, and then it can sign in as those
   personas and no others. Asking for one outside the list throws naming the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/core",
-  "version": "0.12.128",
+  "version": "0.12.130",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/pikkujs/pikku.git",

package/src/public-surface.json

@@ -183,9 +183,12 @@
     "PIKKU_INCOMING_WEBHOOK_QUEUE_NAME",
     "PikkuTriggerService",
     "declaredTriggerSources",
+    "disableTriggerSource",
     "dispatchWebhookSourceJob",
+    "enableTriggerSource",
     "receiveWebhookSourceRequest",
     "reconcileTriggerSources",
+    "reconcileWebhookRegistrations",
     "runWebhookSourceLifecycle",
     "subscribedWebhookEvents",
     "teardownTriggerSources",