@pikku/inspector 0.12.0 → 0.12.1

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 ## 0.12.0
 
+## 0.12.1
+
+### Patch Changes
+
+- 62a8725: Rename 'external' to 'addon' throughout the codebase. All types, functions, config keys, and CLI options previously named `external` or `External` are now named `addon` or `Addon` (e.g. `ExternalPackageConfig` → `AddonConfig`, `externalPackages` → `addons`, `function-external` → `function-addon`).
+- 8eed717: Add `readonly` flag to function config and runtime enforcement. Functions can be marked `readonly: true` in their config. At runtime, if a session has `readonly: true`, only functions marked as readonly can be called — otherwise a `ReadonlySessionError` (403) is thrown.
+- 62a8725: `pikku versions check` now prints rich, human-readable output for all contract version errors instead of raw error codes. Each error type (PKU861–PKU865) shows the function name, separate input/output schema hashes with a `prev → current` arrow, and clear next-step instructions.
+
+  The version manifest now stores separate `inputHash` and `outputHash` per version entry (backward-compatible — old string-hash manifests still load and validate correctly). `VersionValidateError` gains optional detail fields (`functionKey`, `version`, `previousInputHash`, `currentInputHash`, `previousOutputHash`, `currentOutputHash`, `nextVersion`, `latestVersion`, `expectedNextVersion`) for use by tooling.
+
+- 62a8725: Replace config-based addon declarations with the new `wireAddon()` code-based API. Addons are now declared directly in wiring files using `wireAddon({ name, package, rpcEndpoint?, auth?, tags? })` instead of the `addons` field in `pikku.config.json`. The inspector reads these declarations from the TypeScript AST at build time.
+- 62a8725: Add `secretOverrides` and `variableOverrides` support to `wireAddon()`. These optional maps allow an app to remap an addon's secret/variable keys to its own names (e.g. `secretOverrides: { SENDGRID_API_KEY: 'MY_EMAIL_API_KEY' }`). The inspector validates that all override keys exist in the app's own secrets/variables definitions.
+- Updated dependencies [62a8725]
+- Updated dependencies [a3bdb0d]
+- Updated dependencies [e0349ff]
+- Updated dependencies [62a8725]
+- Updated dependencies [e04531f]
+- Updated dependencies [62a8725]
+- Updated dependencies [a83efb8]
+- Updated dependencies [8eed717]
+- Updated dependencies [62a8725]
+- Updated dependencies [62a8725]
+- Updated dependencies [62a8725]
+  - @pikku/core@0.12.1
+
 ### New Features
 
 - AI agent metadata extraction

package/dist/add/add-ai-agent.d.ts

@@ -1,2 +1,2 @@
-import { AddWiring } from '../types.js';
+import type { AddWiring } from '../types.js';
 export declare const addAIAgent: AddWiring;

package/dist/add/add-ai-agent.js

@@ -33,7 +33,7 @@ function resolveToolReferences(obj, checker, agentName, logger) {
                     continue;
                 }
             }
-            if (calleeName === 'external') {
+            if (calleeName === 'addon') {
                 const [firstArg] = element.arguments;
                 if (firstArg && ts.isStringLiteral(firstArg)) {
                     resolved.push(firstArg.text);

package/dist/add/add-channel.js

@@ -7,6 +7,7 @@ import { getPropertyAssignmentInitializer } from '../utils/type-utils.js';
 import { resolveMiddleware, resolveChannelMiddleware, } from '../utils/middleware.js';
 import { extractWireNames } from '../utils/post-process.js';
 import { resolveIdentifier } from '../utils/resolve-identifier.js';
+import { validateAuthSessionless } from '../utils/validate-auth-sessionless.js';
 /**
  * Safely get the "initializer" expression of a property-like AST node:
  * - for `foo: expr`, returns `expr`
@@ -416,6 +417,17 @@ export const addChannel = (logger, node, checker, state, options) => {
         }
     }
     extractWireNames(middleware).forEach((name) => state.serviceAggregation.usedMiddleware.add(name));
+    // --- validate auth/sessionless ---
+    const handlersToValidate = [
+        connectFuncId,
+        disconnectFuncId,
+        message?.pikkuFuncId,
+    ].filter(Boolean);
+    for (const funcId of handlersToValidate) {
+        if (!validateAuthSessionless(logger, obj, state, funcId, `Channel '${name}'`)) {
+            return;
+        }
+    }
     state.channels.files.add(node.getSourceFile().fileName);
     state.channels.meta[name] = {
         name,

package/dist/add/add-cli.d.ts

@@ -1,4 +1,4 @@
-import { AddWiring } from '../types.js';
+import type { AddWiring } from '../types.js';
 /**
  * Adds CLI command metadata to the inspector state
  */

package/dist/add/add-cli.js

@@ -4,6 +4,7 @@ import { resolveMiddleware } from '../utils/middleware.js';
 import { extractWireNames } from '../utils/post-process.js';
 import { getPropertyValue } from '../utils/get-property-value.js';
 import { resolveIdentifier } from '../utils/resolve-identifier.js';
+import { validateAuthSessionless } from '../utils/validate-auth-sessionless.js';
 // Track if we've warned about missing Config type to avoid duplicate warnings
 const configTypeWarningShown = new Set();
 /**
@@ -270,10 +271,14 @@ function processCommand(logger, inspectorState, options, name, node, sourceFile,
                 break;
         }
     }
+    // --- validate auth/sessionless ---
+    if (meta.pikkuFuncId &&
+        !validateAuthSessionless(logger, node, inspectorState, meta.pikkuFuncId, `CLI command '${name}'`)) {
+        return null;
+    }
     // --- track used functions/middleware for service aggregation ---
     inspectorState.serviceAggregation.usedFunctions.add(meta.pikkuFuncId);
     extractWireNames(meta.middleware).forEach((name) => inspectorState.serviceAggregation.usedMiddleware.add(name));
-    // Note: subcommands are tracked recursively when they're processed
     return meta;
 }
 /**

package/dist/add/add-file-extends-core-type.d.ts

@@ -1,3 +1,3 @@
 import * as ts from 'typescript';
-import { PathToNameAndType, InspectorState } from '../types.js';
+import type { PathToNameAndType, InspectorState } from '../types.js';
 export declare const addFileExtendsCoreType: (node: ts.Node, checker: ts.TypeChecker, methods: PathToNameAndType, expectedTypeName: string, state?: InspectorState) => void;

package/dist/add/add-file-with-config.d.ts

@@ -1,3 +1,3 @@
 import * as ts from 'typescript';
-import { PathToNameAndType } from '../types.js';
+import type { PathToNameAndType } from '../types.js';
 export declare const addFileWithConfig: (node: ts.Node, checker: ts.TypeChecker, configs: PathToNameAndType) => void;

package/dist/add/add-file-with-factory.d.ts

@@ -1,3 +1,3 @@
 import * as ts from 'typescript';
-import { PathToNameAndType, InspectorState } from '../types.js';
+import type { PathToNameAndType, InspectorState } from '../types.js';
 export declare const addFileWithFactory: (node: ts.Node, checker: ts.TypeChecker, methods: PathToNameAndType | undefined, expectedTypeName: string, state?: InspectorState) => void;

package/dist/add/add-file-with-factory.js

@@ -3,9 +3,9 @@ import { extractServicesFromFunction } from '../utils/extract-services.js';
 // Mapping of wrapper function names to their corresponding types
 const wrapperFunctionMap = {
     pikkuConfig: 'CreateConfig',
-    pikkuExternalConfig: 'CreateConfig',
+    pikkuAddonConfig: 'CreateConfig',
     pikkuServices: 'CreateSingletonServices',
-    pikkuExternalServices: 'CreateSingletonServices',
+    pikkuAddonServices: 'CreateSingletonServices',
     pikkuWireServices: 'CreateWireServices',
 };
 export const addFileWithFactory = (node, checker, methods = new Map(), expectedTypeName, state) => {

package/dist/add/add-functions.d.ts

@@ -1,4 +1,4 @@
-import { AddWiring } from '../types.js';
+import type { AddWiring } from '../types.js';
 /**
  * Inspect pikkuFunc calls, extract input/output and first-arg destructuring,
  * then push into state.functions.meta.

package/dist/add/add-functions.js

@@ -154,9 +154,7 @@ const getNamesAndTypes = (checker, typesMap, direction, funcName, type) => {
         const aliasType = rawNames.join(' | ');
         const aliasName = funcIdToTypeName(funcName) + direction;
         // record the alias in your TypesMap
-        const references = rawTypes
-            .map((t) => resolveTypeImports(t, typesMap, true, checker))
-            .flat();
+        const references = rawTypes.flatMap((t) => resolveTypeImports(t, typesMap, true, checker));
         typesMap.addCustomType(aliasName, aliasType, references);
         return {
             names: [aliasName],
@@ -164,8 +162,7 @@ const getNamesAndTypes = (checker, typesMap, direction, funcName, type) => {
         };
     }
     // 4) Single, valid name → inline it
-    const uniqueNames = rawNames
-        .map((name, i) => {
+    const uniqueNames = rawNames.flatMap((name, i) => {
         const t = rawTypes[i];
         if (!t) {
             throw new Error(`Expected type for name "${name}" in ${funcName}`);
@@ -175,8 +172,7 @@ const getNamesAndTypes = (checker, typesMap, direction, funcName, type) => {
         }
         // non-primitive: import/alias it inline
         return resolveTypeImports(t, typesMap, false, checker);
-    })
-        .flat();
+    });
     return {
         names: uniqueNames,
         types: rawTypes,
@@ -248,6 +244,7 @@ export const addFunctions = (logger, node, checker, state, options) => {
     let expose;
     let remote;
     let mcp;
+    let readonly_;
     let requiresApproval;
     let version;
     let objectNode;
@@ -313,6 +310,7 @@ export const addFunctions = (logger, node, checker, state, options) => {
         expose = getPropertyValue(firstArg, 'expose');
         remote = getPropertyValue(firstArg, 'remote');
         mcp = getPropertyValue(firstArg, 'mcp');
+        readonly_ = getPropertyValue(firstArg, 'readonly');
         requiresApproval = getPropertyValue(firstArg, 'requiresApproval');
         const versionRaw = getPropertyValue(firstArg, 'version');
         if (versionRaw !== null && versionRaw !== undefined) {
@@ -566,6 +564,7 @@ export const addFunctions = (logger, node, checker, state, options) => {
         expose: expose || undefined,
         remote: remote || undefined,
         mcp: mcpEnabled || undefined,
+        readonly: readonly_ || undefined,
         requiresApproval: requiresApproval || undefined,
         version,
         title,

package/dist/add/add-http-route.d.ts

@@ -1,5 +1,5 @@
 import * as ts from 'typescript';
-import { AddWiring, InspectorState } from '../types.js';
+import type { AddWiring, InspectorState } from '../types.js';
 import type { InspectorLogger } from '../types.js';
 /**
  * Parameters for registering an HTTP route
@@ -12,12 +12,13 @@ export interface RegisterHTTPRouteParams {
     sourceFile: ts.SourceFile;
     basePath?: string;
     inheritedTags?: string[];
+    inheritedAuth?: boolean;
 }
 /**
  * Shared function to register an HTTP route in the inspector state.
  * Used by both wireHTTP and wireHTTPRoutes.
  */
-export declare function registerHTTPRoute({ obj, state, checker, logger, sourceFile, basePath, inheritedTags, }: RegisterHTTPRouteParams): void;
+export declare function registerHTTPRoute({ obj, state, checker, logger, sourceFile, basePath, inheritedTags, inheritedAuth, }: RegisterHTTPRouteParams): void;
 /**
  * Process wireHTTP calls
  */

package/dist/add/add-http-route.js

@@ -8,6 +8,7 @@ import { resolveHTTPPermissionsFromObject } from '../utils/permissions.js';
 import { extractWireNames } from '../utils/post-process.js';
 import { ensureFunctionMetadata } from '../utils/ensure-function-metadata.js';
 import { ErrorCode } from '../error-codes.js';
+import { validateAuthSessionless } from '../utils/validate-auth-sessionless.js';
 import { detectSchemaVendorOrError } from '../utils/detect-schema-vendor.js';
 /**
  * Extract header schema reference from headers property
@@ -76,7 +77,7 @@ const computeInputTypes = (metaTypes, methodType, inputType, queryValues, params
  * Shared function to register an HTTP route in the inspector state.
  * Used by both wireHTTP and wireHTTPRoutes.
  */
-export function registerHTTPRoute({ obj, state, checker, logger, sourceFile, basePath = '', inheritedTags = [], }) {
+export function registerHTTPRoute({ obj, state, checker, logger, sourceFile, basePath = '', inheritedTags = [], inheritedAuth, }) {
     // Extract route path
     const routePath = getPropertyValue(obj, 'route');
     if (!routePath)
@@ -118,6 +119,9 @@ export function registerHTTPRoute({ obj, state, checker, logger, sourceFile, bas
         logger.critical(ErrorCode.FUNCTION_METADATA_NOT_FOUND, `No function metadata found for '${funcName}'.`);
         return;
     }
+    if (!validateAuthSessionless(logger, obj, state, funcName, `Route '${fullRoute}'`, inheritedAuth)) {
+        return;
+    }
     const input = fnMeta.inputs?.[0] || null;
     // Validate that route params and query params exist in function input type
     if (params.length > 0 || query.length > 0) {

package/dist/add/add-http-routes.d.ts

@@ -1,4 +1,4 @@
-import { AddWiring } from '../types.js';
+import type { AddWiring } from '../types.js';
 /**
  * Process wireHTTPRoutes calls
  */

package/dist/add/add-http-routes.js

@@ -155,5 +155,6 @@ function processRoute(obj, groupConfig, state, checker, logger, sourceFile) {
         sourceFile,
         basePath: groupConfig.basePath,
         inheritedTags: groupConfig.tags,
+        inheritedAuth: groupConfig.auth,
     });
 }

package/dist/add/add-keyed-wiring.d.ts

@@ -1,4 +1,4 @@
-import { AddWiring, InspectorState } from '../types.js';
+import type { AddWiring, InspectorState } from '../types.js';
 export interface KeyedWiringConfig {
     functionName: string;
     idField: string;

package/dist/add/add-mcp-prompt.d.ts

@@ -1,2 +1,2 @@
-import { AddWiring } from '../types.js';
+import type { AddWiring } from '../types.js';
 export declare const addMCPPrompt: AddWiring;

package/dist/add/add-mcp-resource.d.ts

@@ -1,2 +1,2 @@
-import { AddWiring } from '../types.js';
+import type { AddWiring } from '../types.js';
 export declare const addMCPResource: AddWiring;

package/dist/add/add-queue-worker.d.ts

@@ -1,2 +1,2 @@
-import { AddWiring } from '../types.js';
+import type { AddWiring } from '../types.js';
 export declare const addQueueWorker: AddWiring;

package/dist/add/add-rpc-invocations.d.ts

@@ -1,9 +1,9 @@
 import * as ts from 'typescript';
-import { InspectorState, InspectorLogger } from '../types.js';
+import type { InspectorState, InspectorLogger } from '../types.js';
 /**
  * Scan for rpc.invoke() calls to track which functions are actually being invoked
- * Also detects external package usage via:
+ * Also detects addon usage via:
  * - Namespaced calls: rpc.invoke('namespace:function')
- * - External helper: external('namespace:function')
+ * - Addon helper: addon('namespace:function')
  */
 export declare function addRPCInvocations(node: ts.Node, state: InspectorState, logger: InspectorLogger): void;

package/dist/add/add-rpc-invocations.js

@@ -11,25 +11,25 @@ function extractNamespace(functionRef) {
 }
 /**
  * Scan for rpc.invoke() calls to track which functions are actually being invoked
- * Also detects external package usage via:
+ * Also detects addon usage via:
  * - Namespaced calls: rpc.invoke('namespace:function')
- * - External helper: external('namespace:function')
+ * - Addon helper: addon('namespace:function')
  */
 export function addRPCInvocations(node, state, logger) {
-    // Look for call expressions: external('ext:hello') or rpc.invoke('...')
+    // Look for call expressions: addon('ext:hello') or rpc.invoke('...')
     if (ts.isCallExpression(node)) {
         const { expression, arguments: args } = node;
-        // Check for external('namespace:function') calls
-        if (ts.isIdentifier(expression) && expression.text === 'external') {
+        // Check for addon('namespace:function') calls
+        if (ts.isIdentifier(expression) && expression.text === 'addon') {
             const [firstArg] = args;
             if (firstArg && ts.isStringLiteral(firstArg)) {
                 const functionRef = firstArg.text;
-                logger.debug(`• Found external() call: ${functionRef}`);
+                logger.debug(`• Found addon() call: ${functionRef}`);
                 state.rpc.invokedFunctions.add(functionRef);
                 const namespace = extractNamespace(functionRef);
                 if (namespace) {
-                    logger.debug(`  → External package detected: ${namespace}`);
-                    state.rpc.usedExternalPackages.add(namespace);
+                    logger.debug(`  → Addon detected: ${namespace}`);
+                    state.rpc.usedAddons.add(namespace);
                 }
             }
         }
@@ -60,8 +60,8 @@ export function addRPCInvocations(node, state, logger) {
                     state.rpc.invokedFunctions.add(functionRef);
                     const namespace = extractNamespace(functionRef);
                     if (namespace) {
-                        logger.debug(`  → External package detected: ${namespace}`);
-                        state.rpc.usedExternalPackages.add(namespace);
+                        logger.debug(`  → Addon detected: ${namespace}`);
+                        state.rpc.usedAddons.add(namespace);
                     }
                 }
                 // Handle template literals like `function-${name}`

package/dist/add/add-schedule.d.ts

@@ -1,2 +1,2 @@
-import { AddWiring } from '../types.js';
+import type { AddWiring } from '../types.js';
 export declare const addSchedule: AddWiring;

package/dist/add/add-secret.d.ts

@@ -1,3 +1,3 @@
-import { AddWiring } from '../types.js';
+import type { AddWiring } from '../types.js';
 export declare const addSecret: AddWiring;
 export declare const addOAuth2Credential: AddWiring;

package/dist/add/add-trigger.d.ts

@@ -1,2 +1,2 @@
-import { AddWiring } from '../types.js';
+import type { AddWiring } from '../types.js';
 export declare const addTrigger: AddWiring;

package/dist/add/add-trigger.js

@@ -4,7 +4,7 @@ import { extractFunctionName, makeContextBasedId, } from '../utils/extract-funct
 import { getPropertyAssignmentInitializer } from '../utils/type-utils.js';
 import { resolveMiddleware } from '../utils/middleware.js';
 import { extractWireNames } from '../utils/post-process.js';
-import { resolveExternalPackageName } from '../utils/resolve-external-package.js';
+import { resolveAddonName } from '../utils/resolve-addon-package.js';
 import { ErrorCode } from '../error-codes.js';
 export const addTrigger = (logger, node, checker, state, options) => {
     if (!ts.isCallExpression(node)) {
@@ -76,7 +76,7 @@ const addWireTriggerSource = (logger, node, checker, state, options, firstArg) =
         return;
     }
     if (ts.isIdentifier(funcInitializer)) {
-        const packageName = resolveExternalPackageName(funcInitializer, checker, options.externalPackages);
+        const packageName = resolveAddonName(funcInitializer, checker, state.rpc.wireAddonDeclarations);
         state.triggers.sourceMeta[nameValue] = {
             name: nameValue,
             pikkuFuncId: funcInitializer.text,

package/dist/add/add-wire-addon.d.ts

@@ -0,0 +1,7 @@
+import * as ts from 'typescript';
+import type { InspectorState, InspectorLogger } from '../types.js';
+/**
+ * Detect wireAddon({ name: '...', package: '...' }) call expressions and
+ * populate state.rpc.wireAddonDeclarations and state.rpc.usedAddons.
+ */
+export declare function addWireAddon(node: ts.Node, state: InspectorState, logger: InspectorLogger): void;

package/dist/add/add-wire-addon.js

@@ -0,0 +1,70 @@
+import * as ts from 'typescript';
+function parseStringRecord(obj) {
+    const result = {};
+    for (const prop of obj.properties) {
+        if (!ts.isPropertyAssignment(prop))
+            continue;
+        const keyNode = prop.name;
+        const key = ts.isIdentifier(keyNode)
+            ? keyNode.text
+            : ts.isStringLiteral(keyNode)
+                ? keyNode.text
+                : undefined;
+        if (key && ts.isStringLiteral(prop.initializer)) {
+            result[key] = prop.initializer.text;
+        }
+    }
+    return result;
+}
+/**
+ * Detect wireAddon({ name: '...', package: '...' }) call expressions and
+ * populate state.rpc.wireAddonDeclarations and state.rpc.usedAddons.
+ */
+export function addWireAddon(node, state, logger) {
+    if (!ts.isCallExpression(node))
+        return;
+    const { expression, arguments: args } = node;
+    if (!ts.isIdentifier(expression) || expression.text !== 'wireAddon')
+        return;
+    const [firstArg] = args;
+    if (!firstArg || !ts.isObjectLiteralExpression(firstArg))
+        return;
+    let name;
+    let pkg;
+    let rpcEndpoint;
+    let secretOverrides;
+    let variableOverrides;
+    for (const prop of firstArg.properties) {
+        if (!ts.isPropertyAssignment(prop) || !ts.isIdentifier(prop.name))
+            continue;
+        const key = prop.name.text;
+        if (key === 'name' && ts.isStringLiteral(prop.initializer)) {
+            name = prop.initializer.text;
+        }
+        else if (key === 'package' && ts.isStringLiteral(prop.initializer)) {
+            pkg = prop.initializer.text;
+        }
+        else if (key === 'rpcEndpoint' && ts.isStringLiteral(prop.initializer)) {
+            rpcEndpoint = prop.initializer.text;
+        }
+        else if (key === 'secretOverrides' &&
+            ts.isObjectLiteralExpression(prop.initializer)) {
+            secretOverrides = parseStringRecord(prop.initializer);
+        }
+        else if (key === 'variableOverrides' &&
+            ts.isObjectLiteralExpression(prop.initializer)) {
+            variableOverrides = parseStringRecord(prop.initializer);
+        }
+    }
+    if (!name || !pkg)
+        return;
+    logger.debug(`• Found wireAddon: ${name} → ${pkg}`);
+    state.rpc.wireAddonDeclarations.set(name, {
+        package: pkg,
+        rpcEndpoint,
+        secretOverrides,
+        variableOverrides,
+    });
+    state.rpc.usedAddons.add(name);
+    state.rpc.wireAddonFiles.add(node.getSourceFile().fileName);
+}

package/dist/add/add-workflow.d.ts

@@ -1,4 +1,4 @@
-import { AddWiring } from '../types.js';
+import type { AddWiring } from '../types.js';
 /**
  * Inspector for pikkuWorkflow() and pikkuSimpleWorkflow() calls
  * Detects workflow registration and extracts metadata

package/dist/error-codes.d.ts

@@ -31,6 +31,7 @@ export declare enum ErrorCode {
     HANDLER_NOT_RESOLVED = "PKU568",
     ROUTE_PARAM_MISMATCH = "PKU571",
     ROUTE_QUERY_MISMATCH = "PKU572",
+    AUTH_DISABLED_REQUIRES_SESSIONLESS = "PKU573",
     MIDDLEWARE_HANDLER_INVALID = "PKU685",
     MIDDLEWARE_TAG_INVALID = "PKU715",
     MIDDLEWARE_EMPTY_ARRAY = "PKU736",

package/dist/error-codes.js

@@ -36,6 +36,7 @@ export var ErrorCode;
     // HTTP Route errors
     ErrorCode["ROUTE_PARAM_MISMATCH"] = "PKU571";
     ErrorCode["ROUTE_QUERY_MISMATCH"] = "PKU572";
+    ErrorCode["AUTH_DISABLED_REQUIRES_SESSIONLESS"] = "PKU573";
     // Middleware/Permission errors
     ErrorCode["MIDDLEWARE_HANDLER_INVALID"] = "PKU685";
     ErrorCode["MIDDLEWARE_TAG_INVALID"] = "PKU715";

package/dist/index.d.ts

@@ -8,7 +8,7 @@ export type { SerializableInspectorState } from './utils/serialize-inspector-sta
 export { filterInspectorState } from './utils/filter-inspector-state.js';
 export { generateCustomTypes, sanitizeTypeName, } from './utils/custom-types-generator.js';
 export { createEmptyManifest, serializeManifest, } from './utils/contract-hashes.js';
-export type { ContractEntry, VersionValidateError, VersionManifest, VersionManifestEntry, } from './utils/contract-hashes.js';
+export type { ContractEntry, VersionHashEntry, VersionValidateError, VersionManifest, VersionManifestEntry, } from './utils/contract-hashes.js';
 export { serializeMCPJson } from './utils/serialize-mcp-json.js';
 export type { OpenAPISpecInfo } from './utils/serialize-openapi-json.js';
 export { deserializeDslWorkflow, deserializeGraphWorkflow, deserializeAllDslWorkflows, } from './utils/workflow/dsl/index.js';

package/dist/inspector.d.ts

@@ -1,4 +1,4 @@
-import { InspectorState, InspectorLogger, InspectorOptions } from './types.js';
+import type { InspectorState, InspectorLogger, InspectorOptions } from './types.js';
 /**
  * Creates an initial/empty inspector state with all required properties initialized
  * @param rootDir - The root directory for the project

package/dist/inspector.js

@@ -4,9 +4,9 @@ import { visitSetup, visitRoutes } from './visit.js';
 import { TypesMap } from './types-map.js';
 import { getFilesAndMethods } from './utils/get-files-and-methods.js';
 import { findCommonAncestor } from './utils/find-root-dir.js';
-import { aggregateRequiredServices, validateSecretOverrides, validateAgentModels, validateAgentOverrides, computeResolvedIOTypes, computeMiddlewareGroupsMeta, computePermissionsGroupsMeta, computeRequiredSchemas, computeDiagnostics, } from './utils/post-process.js';
+import { aggregateRequiredServices, validateAgentModels, validateAgentOverrides, validateSecretOverrides, validateVariableOverrides, computeResolvedIOTypes, computeMiddlewareGroupsMeta, computePermissionsGroupsMeta, computeRequiredSchemas, computeDiagnostics, } from './utils/post-process.js';
 import { generateOpenAPISpec } from './utils/serialize-openapi-json.js';
-import { pikkuState } from '@pikku/core';
+import { pikkuState } from '@pikku/core/internal';
 import { resolveLatestVersions } from './utils/resolve-versions.js';
 import { finalizeWorkflows } from './utils/workflow/graph/finalize-workflows.js';
 import { finalizeWorkflowHelperTypes, finalizeWorkflowWires, } from './utils/workflow/graph/finalize-workflow-wires.js';
@@ -83,7 +83,9 @@ export function getInitialInspectorState(rootDir) {
             exposedMeta: {},
             exposedFiles: new Map(),
             invokedFunctions: new Set(),
-            usedExternalPackages: new Set(),
+            usedAddons: new Set(),
+            wireAddonDeclarations: new Map(),
+            wireAddonFiles: new Set(),
         },
         mcpEndpoints: {
             resourcesMeta: {},
@@ -238,9 +240,10 @@ export const inspect = async (logger, routeFiles, options = {}) => {
         if (options.openAPI) {
             state.openAPISpec = await generateOpenAPISpec(logger, state.functions.meta, state.http.meta, state.schemas, options.openAPI.additionalInfo, pikkuState(null, 'misc', 'errors'));
         }
-        validateSecretOverrides(logger, state, options.externalPackages);
         validateAgentModels(logger, state, options.modelConfig);
         validateAgentOverrides(logger, state, options.modelConfig);
+        validateSecretOverrides(logger, state);
+        validateVariableOverrides(logger, state);
     }
     return state;
 };

package/dist/types.d.ts

@@ -1,20 +1,20 @@
-import * as ts from 'typescript';
-import { ChannelsMeta } from '@pikku/core/channel';
-import { HTTPWiringsMeta } from '@pikku/core/http';
-import { ScheduledTasksMeta } from '@pikku/core/scheduler';
-import { TriggerMeta, TriggerSourceMeta } from '@pikku/core/trigger';
-import { QueueWorkersMeta } from '@pikku/core/queue';
-import { WorkflowsMeta } from '@pikku/core/workflow';
-import { MCPResourceMeta, MCPToolMeta, MCPPromptMeta } from '@pikku/core/mcp';
-import { AIAgentMeta } from '@pikku/core/ai-agent';
-import { CLIMeta } from '@pikku/core/cli';
-import { NodesMeta } from '@pikku/core/node';
-import { SecretDefinitions } from '@pikku/core/secret';
-import { VariableDefinitions } from '@pikku/core/variable';
-import { TypesMap } from './types-map.js';
-import { FunctionsMeta, FunctionServicesMeta, FunctionWiresMeta, JSONValue } from '@pikku/core';
+import type * as ts from 'typescript';
+import type { ChannelsMeta } from '@pikku/core/channel';
+import type { HTTPWiringsMeta } from '@pikku/core/http';
+import type { ScheduledTasksMeta } from '@pikku/core/scheduler';
+import type { TriggerMeta, TriggerSourceMeta } from '@pikku/core/trigger';
+import type { QueueWorkersMeta } from '@pikku/core/queue';
+import type { WorkflowsMeta } from '@pikku/core/workflow';
+import type { MCPResourceMeta, MCPToolMeta, MCPPromptMeta } from '@pikku/core/mcp';
+import type { AIAgentMeta } from '@pikku/core/ai-agent';
+import type { CLIMeta } from '@pikku/core/cli';
+import type { NodesMeta } from '@pikku/core/node';
+import type { SecretDefinitions } from '@pikku/core/secret';
+import type { VariableDefinitions } from '@pikku/core/variable';
+import type { TypesMap } from './types-map.js';
+import type { FunctionsMeta, FunctionServicesMeta, FunctionWiresMeta, JSONValue } from '@pikku/core';
 import type { OpenAPISpecInfo } from './utils/serialize-openapi-json.js';
-import { ErrorCode } from './error-codes.js';
+import type { ErrorCode } from './error-codes.js';
 import type { VersionManifest, VersionValidateError } from './utils/contract-hashes.js';
 import type { SerializedWorkflowGraphs } from './utils/workflow/graph/workflow-graph.types.js';
 export type PathToNameAndType = Map<string, {
@@ -138,7 +138,7 @@ export type InspectorFilters = {
     httpRoutes?: string[];
     httpMethods?: string[];
 };
-export type ExternalPackageConfig = {
+export type AddonConfig = {
     package: string;
     rpcEndpoint?: string;
     secretOverrides?: Record<string, string>;
@@ -164,14 +164,13 @@ export type InspectorModelConfig = {
 export type InspectorOptions = Partial<{
     setupOnly: boolean;
     rootDir: string;
-    isExternalPackage: boolean;
+    isAddon: boolean;
     types: Partial<{
         configFileType: string;
         userSessionType: string;
         singletonServicesFactoryType: string;
         wireServicesFactoryType: string;
     }>;
-    externalPackages: Record<string, ExternalPackageConfig>;
     schemaConfig: {
         tsconfig: string;
         schemasFromTypes?: string[];
@@ -301,7 +300,14 @@ export interface InspectorState {
             exportedName: string;
         }>;
         invokedFunctions: Set<string>;
-        usedExternalPackages: Set<string>;
+        usedAddons: Set<string>;
+        wireAddonDeclarations: Map<string, {
+            package: string;
+            rpcEndpoint?: string;
+            secretOverrides?: Record<string, string>;
+            variableOverrides?: Record<string, string>;
+        }>;
+        wireAddonFiles: Set<string>;
     };
     mcpEndpoints: {
         resourcesMeta: MCPResourceMeta;

package/dist/utils/compute-required-schemas.js

@@ -12,7 +12,7 @@ const PRIMITIVE_TYPES = new Set([
 export function computeRequiredSchemas(functionsMeta, typesMap, additionalTypes, schemaLookup) {
     return new Set([
         ...Object.values(functionsMeta)
-            .map(({ inputs, outputs }) => {
+            .flatMap(({ inputs, outputs }) => {
             const types = [];
             if (inputs?.[0]) {
                 try {
@@ -32,7 +32,6 @@ export function computeRequiredSchemas(functionsMeta, typesMap, additionalTypes,
             }
             return types;
         })
-            .flat()
             .filter((s) => !!s && !PRIMITIVE_TYPES.has(s)),
         ...typesMap.customTypes.keys(),
         ...(additionalTypes || []),