@pikku/inspector 0.12.38 → 0.12.40

package/CHANGELOG.md

@@ -1,3 +1,39 @@
+## 0.12.40
+
+### Patch Changes
+
+- 1f3f510: Warn when a Pikku function body performs a runtime dynamic `import(...)`.
+
+  The inspector now flags any `pikkuFunc`/`pikkuSessionlessFunc` (and friends) whose handler body contains a dynamic `import(...)` call — including nested callbacks — with the new `PKU498` diagnostic. Function bodies run on every invocation, so a dynamic import there adds per-call latency and defeats bundling/tree-shaking; the import belongs at the top of the module or in your services/`wireServices` setup instead.
+
+  Type-only positions like `import('x').Foo` are not flagged. The rule defaults to `warn` — a printed yellow warning that does not fail the build — and is configurable via `lint.functionDynamicImport` in `pikku.config.json` (`'off'` to silence, `'error'` to make it a hard build failure), matching the existing `servicesNotDestructured`/`wiresNotDestructured` lints.
+
+- Updated dependencies [1f3f510]
+  - @pikku/core@0.12.59
+
+## 0.12.39
+
+### Patch Changes
+
+- 4f92e6f: `pikku db` schema-codegen warnings are now coded diagnostics routed through the CLI logger instead of raw `console.warn`, so they participate in the existing `--fail-on-warn` gate.
+
+  Each warning now carries a PKU code and `warn` severity: `PKU481` (JSON/JSONB column with no concrete `tsType`, degrading to `unknown`), `PKU480` (column named like a date/bool but whose DB type contradicts it), and `PKU482` (a `format` annotation ignored on a non-string column). Running `pikku db migrate --fail-on-warn` (e.g. in CI) now turns these into a hard failure, forcing the `db/annotations.ts` entry — closing the loophole where an untyped jsonb column silently degrades type-safety. Default behaviour is unchanged: the warnings still print, and only fail the build when `--fail-on-warn` is set.
+
+- daec082: Drop Node 22 support — the minimum supported runtime is now Node 24 (LTS).
+
+  Node 22 deadlocks `pikku dev` at `loadUserBootstrap` (tsx `register()` + `require(esm)` cycle handling on node 22.12+), and Node 20 is already below our floor. The `engines.node` requirement is raised to `>=24` across all packages, matching `.nvmrc` and the CI test matrix. Closes #751.
+
+- ad26273: Remove 16 dormant `ErrorCode` enum entries that were defined but never emitted anywhere in the framework. These were placeholder registrations that were never wired to a diagnostic, or codes whose emission sites were removed in later refactors (e.g. `PKU901`, `PKU431`). A whole-repo audit found zero emission sites — no user could ever see them — so they only cluttered the registry and demanded docs pages for errors that cannot occur.
+
+  Removed: `PKU300`, `PKU426`, `PKU427`, `PKU431`, `PKU488`, `PKU529`, `PKU568`, `PKU685`, `PKU715`, `PKU736`, `PKU787`, `PKU835`, `PKU836`, `PKU901`, `PKU937`, `PKU975`.
+
+  A new guard test (`error-codes-emitted.test.ts`) fails if any `ErrorCode` value has no `ErrorCode.<NAME>` or raw `PKU###` reference in the source, so dead entries can't silently accumulate again.
+
+- Updated dependencies [7b17b14]
+- Updated dependencies [daec082]
+- Updated dependencies [e0fd352]
+  - @pikku/core@0.12.58
+
 ## 0.12.38
 
 ### Patch Changes

package/dist/add/add-functions.js

@@ -15,6 +15,28 @@ const isValidVariableName = (name) => {
     const regex = /^[a-zA-Z_$][a-zA-Z0-9_$]*$/;
     return regex.test(name);
 };
+/**
+ * True when the handler body contains a runtime dynamic `import(...)` call
+ * anywhere (including nested callbacks). Type-only positions like
+ * `import('x').Foo` are `ImportTypeNode`s, not `CallExpression`s with an
+ * `ImportKeyword` callee, so they are intentionally not matched.
+ */
+const handlerHasDynamicImport = (handler) => {
+    let found = false;
+    const visit = (node) => {
+        if (found) {
+            return;
+        }
+        if (ts.isCallExpression(node) &&
+            node.expression.kind === ts.SyntaxKind.ImportKeyword) {
+            found = true;
+            return;
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(handler.body);
+    return found;
+};
 const nullifyTypes = (type) => {
     if (type === 'void' ||
         type === 'undefined' ||
@@ -779,6 +801,9 @@ export const addFunctions = (logger, node, checker, state, options) => {
         exportedName: exportedName || undefined,
         ...bodySpan,
     };
+    if (handlerHasDynamicImport(handler)) {
+        state.functions.dynamicImportIds.add(pikkuFuncId);
+    }
     // Populate node metadata if node config is present
     if (nodeDisplayName && nodeCategory && nodeType) {
         state.nodes.files.add(node.getSourceFile().fileName);

package/dist/error-codes.d.ts

@@ -14,37 +14,25 @@ export declare enum ErrorCode {
     MISSING_URI = "PKU220",
     MISSING_FUNC = "PKU236",
     INVALID_TAGS_TYPE = "PKU247",
-    INVALID_HANDLER = "PKU300",
     MISSING_TITLE = "PKU370",
     MISSING_QUEUE_NAME = "PKU384",
     MISSING_CHANNEL_NAME = "PKU400",
     CLI_CLIENTSIDE_RENDERER_HAS_SERVICES = "PKU672",
     SCENARIO_HAS_SERVICES = "PKU673",
     EXPECT_EVENTUALLY_SCENARIO_ONLY = "PKU675",
-    DYNAMIC_STEP_NAME = "PKU529",
     WORKFLOW_ORCHESTRATOR_NOT_CONFIGURED = "PKU600",
     INVALID_DSL_WORKFLOW = "PKU641",
-    CONFIG_TYPE_NOT_FOUND = "PKU426",
-    CONFIG_TYPE_UNDEFINED = "PKU427",
-    SCHEMA_NO_ROOT = "PKU431",
+    DB_COLUMN_NAME_TYPE_CONTRADICTION = "PKU480",
+    DB_JSON_COLUMN_UNTYPED = "PKU481",
+    DB_FORMAT_ON_NON_STRING = "PKU482",
     SCHEMA_GENERATION_ERROR = "PKU456",
-    SCHEMA_LOAD_ERROR = "PKU488",
     INLINE_SCHEMA = "PKU489",
     FUNCTION_METADATA_NOT_FOUND = "PKU559",
-    HANDLER_NOT_RESOLVED = "PKU568",
     DUPLICATE_AUTH_DEFINITION = "PKU581",
     AUTH_NOT_EXPORTED = "PKU582",
     ROUTE_PARAM_MISMATCH = "PKU571",
     ROUTE_QUERY_MISMATCH = "PKU572",
     AUTH_DISABLED_REQUIRES_SESSIONLESS = "PKU573",
-    MIDDLEWARE_HANDLER_INVALID = "PKU685",
-    MIDDLEWARE_TAG_INVALID = "PKU715",
-    MIDDLEWARE_EMPTY_ARRAY = "PKU736",
-    MIDDLEWARE_PATTERN_INVALID = "PKU787",
-    PERMISSION_HANDLER_INVALID = "PKU835",
-    PERMISSION_TAG_INVALID = "PKU836",
-    PERMISSION_EMPTY_ARRAY = "PKU937",
-    PERMISSION_PATTERN_INVALID = "PKU975",
     DUPLICATE_FUNCTION_VERSION = "PKU850",
     DUPLICATE_FUNCTION_NAME = "PKU851",
     MANIFEST_MISSING = "PKU860",
@@ -58,8 +46,8 @@ export declare enum ErrorCode {
     SCHEMA_AND_WIRING_COLOCATED = "PKU490",
     SERVICES_NOT_DESTRUCTURED = "PKU410",
     WIRES_NOT_DESTRUCTURED = "PKU411",
+    FUNCTION_DYNAMIC_IMPORT = "PKU498",
     DUPLICATE_CORE_VERSION = "PKU717",
-    WORKFLOW_MULTI_QUEUE_NOT_SUPPORTED = "PKU901",
     PII_IN_OUTPUT = "PKU910",
     ADDON_WIRING_NOT_ALLOWED = "PKU920",
     ADDON_CONTRACT_HANDLERS_NOT_ALLOWED = "PKU921",

package/dist/error-codes.js

@@ -16,26 +16,23 @@ export var ErrorCode;
     ErrorCode["MISSING_URI"] = "PKU220";
     ErrorCode["MISSING_FUNC"] = "PKU236";
     ErrorCode["INVALID_TAGS_TYPE"] = "PKU247";
-    ErrorCode["INVALID_HANDLER"] = "PKU300";
     ErrorCode["MISSING_TITLE"] = "PKU370";
     ErrorCode["MISSING_QUEUE_NAME"] = "PKU384";
     ErrorCode["MISSING_CHANNEL_NAME"] = "PKU400";
     ErrorCode["CLI_CLIENTSIDE_RENDERER_HAS_SERVICES"] = "PKU672";
     ErrorCode["SCENARIO_HAS_SERVICES"] = "PKU673";
     ErrorCode["EXPECT_EVENTUALLY_SCENARIO_ONLY"] = "PKU675";
-    ErrorCode["DYNAMIC_STEP_NAME"] = "PKU529";
     ErrorCode["WORKFLOW_ORCHESTRATOR_NOT_CONFIGURED"] = "PKU600";
     ErrorCode["INVALID_DSL_WORKFLOW"] = "PKU641";
+    // Database schema codegen warnings
+    ErrorCode["DB_COLUMN_NAME_TYPE_CONTRADICTION"] = "PKU480";
+    ErrorCode["DB_JSON_COLUMN_UNTYPED"] = "PKU481";
+    ErrorCode["DB_FORMAT_ON_NON_STRING"] = "PKU482";
     // Configuration errors
-    ErrorCode["CONFIG_TYPE_NOT_FOUND"] = "PKU426";
-    ErrorCode["CONFIG_TYPE_UNDEFINED"] = "PKU427";
-    ErrorCode["SCHEMA_NO_ROOT"] = "PKU431";
     ErrorCode["SCHEMA_GENERATION_ERROR"] = "PKU456";
-    ErrorCode["SCHEMA_LOAD_ERROR"] = "PKU488";
     ErrorCode["INLINE_SCHEMA"] = "PKU489";
     // Function errors
     ErrorCode["FUNCTION_METADATA_NOT_FOUND"] = "PKU559";
-    ErrorCode["HANDLER_NOT_RESOLVED"] = "PKU568";
     // Auth errors
     ErrorCode["DUPLICATE_AUTH_DEFINITION"] = "PKU581";
     ErrorCode["AUTH_NOT_EXPORTED"] = "PKU582";
@@ -43,15 +40,6 @@ export var ErrorCode;
     ErrorCode["ROUTE_PARAM_MISMATCH"] = "PKU571";
     ErrorCode["ROUTE_QUERY_MISMATCH"] = "PKU572";
     ErrorCode["AUTH_DISABLED_REQUIRES_SESSIONLESS"] = "PKU573";
-    // Middleware/Permission errors
-    ErrorCode["MIDDLEWARE_HANDLER_INVALID"] = "PKU685";
-    ErrorCode["MIDDLEWARE_TAG_INVALID"] = "PKU715";
-    ErrorCode["MIDDLEWARE_EMPTY_ARRAY"] = "PKU736";
-    ErrorCode["MIDDLEWARE_PATTERN_INVALID"] = "PKU787";
-    ErrorCode["PERMISSION_HANDLER_INVALID"] = "PKU835";
-    ErrorCode["PERMISSION_TAG_INVALID"] = "PKU836";
-    ErrorCode["PERMISSION_EMPTY_ARRAY"] = "PKU937";
-    ErrorCode["PERMISSION_PATTERN_INVALID"] = "PKU975";
     // Versioning errors
     ErrorCode["DUPLICATE_FUNCTION_VERSION"] = "PKU850";
     ErrorCode["DUPLICATE_FUNCTION_NAME"] = "PKU851";
@@ -70,10 +58,9 @@ export var ErrorCode;
     // Optimization diagnostics
     ErrorCode["SERVICES_NOT_DESTRUCTURED"] = "PKU410";
     ErrorCode["WIRES_NOT_DESTRUCTURED"] = "PKU411";
+    ErrorCode["FUNCTION_DYNAMIC_IMPORT"] = "PKU498";
     // Dependency integrity errors
     ErrorCode["DUPLICATE_CORE_VERSION"] = "PKU717";
-    // Feature Flag
-    ErrorCode["WORKFLOW_MULTI_QUEUE_NOT_SUPPORTED"] = "PKU901";
     // Data classification errors
     ErrorCode["PII_IN_OUTPUT"] = "PKU910";
     // Addon authoring errors

package/dist/inspector.js

@@ -43,6 +43,7 @@ export function getInitialInspectorState(rootDir) {
             meta: {},
             files: new Map(),
             approvalDescriptions: {},
+            dynamicImportIds: new Set(),
         },
         http: {
             metaInputTypes: new Map(),

package/dist/types.d.ts

@@ -76,6 +76,12 @@ export interface InspectorFunctionState {
         exportedName: string;
     }>;
     approvalDescriptions: Record<string, InspectorApprovalDescriptionDefinition>;
+    /**
+     * pikkuFuncIds whose handler body performs a runtime dynamic `import(...)`.
+     * Transient lint signal consumed by computeDiagnostics (PKU498) in the same
+     * inspection pass — deliberately not part of the serialized function meta.
+     */
+    dynamicImportIds: Set<string>;
 }
 export interface InspectorChannelState {
     meta: ChannelsMeta;

package/dist/utils/post-process.js

@@ -581,6 +581,14 @@ export function computeDiagnostics(state) {
                 position: 0,
             });
         }
+        if (state.functions.dynamicImportIds.has(id)) {
+            diagnostics.push({
+                code: ErrorCode.FUNCTION_DYNAMIC_IMPORT,
+                message: `Function '${id}' performs a runtime dynamic 'import(...)' in its body. Move the import to the top of the module (static import) or into your services/wireServices setup — function bodies run on every invocation, so a dynamic import there adds latency and defeats bundling/tree-shaking.`,
+                sourceFile: meta.pikkuFuncId,
+                position: 0,
+            });
+        }
     }
     for (const [id, def] of Object.entries(state.middleware.definitions)) {
         if (def.services && !def.services.optimized) {

package/dist/utils/serialize-inspector-state.js

@@ -194,6 +194,7 @@ export function deserializeInspectorState(data) {
             meta: data.functions.meta,
             files: new Map(data.functions.files),
             approvalDescriptions: data.functions.approvalDescriptions || {},
+            dynamicImportIds: new Set(),
         },
         http: {
             metaInputTypes: new Map(data.http.metaInputTypes),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/inspector",
-  "version": "0.12.38",
+  "version": "0.12.40",
   "author": "yasser.fadl@gmail.com",
   "license": "BUSL-1.1",
   "type": "module",
@@ -44,13 +44,13 @@
     "zod-to-ts": "^2.1.0"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.54"
+    "@pikku/core": "^0.12.59"
   },
   "devDependencies": {
-    "@pikku/core": "^0.12.54",
+    "@pikku/core": "^0.12.59",
     "@types/node": "^24.11.0"
   },
   "engines": {
-    "node": ">=22"
+    "node": ">=24"
   }
 }

package/src/add/add-functions.ts

@@ -27,6 +27,33 @@ const isValidVariableName = (name: string) => {
   return regex.test(name)
 }
 
+/**
+ * True when the handler body contains a runtime dynamic `import(...)` call
+ * anywhere (including nested callbacks). Type-only positions like
+ * `import('x').Foo` are `ImportTypeNode`s, not `CallExpression`s with an
+ * `ImportKeyword` callee, so they are intentionally not matched.
+ */
+const handlerHasDynamicImport = (
+  handler: ts.ArrowFunction | ts.FunctionExpression
+): boolean => {
+  let found = false
+  const visit = (node: ts.Node) => {
+    if (found) {
+      return
+    }
+    if (
+      ts.isCallExpression(node) &&
+      node.expression.kind === ts.SyntaxKind.ImportKeyword
+    ) {
+      found = true
+      return
+    }
+    ts.forEachChild(node, visit)
+  }
+  visit(handler.body)
+  return found
+}
+
 const nullifyTypes = (type: string | null) => {
   if (
     type === 'void' ||
@@ -1083,6 +1110,10 @@ export const addFunctions: AddWiring = (
     ...bodySpan,
   }
 
+  if (handlerHasDynamicImport(handler)) {
+    state.functions.dynamicImportIds.add(pikkuFuncId)
+  }
+
   // Populate node metadata if node config is present
   if (nodeDisplayName && nodeCategory && nodeType) {
     state.nodes.files.add(node.getSourceFile().fileName)

package/src/add/dynamic-import-check.test.ts

@@ -0,0 +1,119 @@
+import { strict as assert } from 'assert'
+import { describe, test } from 'node:test'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { inspect } from '../inspector.js'
+import { ErrorCode } from '../error-codes.js'
+import type { InspectorLogger } from '../types.js'
+
+const logger: InspectorLogger = {
+  debug: () => {},
+  info: () => {},
+  warn: () => {},
+  error: () => {},
+  diagnostic: () => {},
+  critical: () => {},
+  hasCriticalErrors: () => false,
+}
+
+async function inspectSource(source: string) {
+  const rootDir = await mkdtemp(join(tmpdir(), 'pikku-dynimport-'))
+  const file = join(rootDir, 'my.function.ts')
+  await writeFile(file, source)
+  try {
+    return await inspect(logger, [file], { rootDir })
+  } finally {
+    await rm(rootDir, { recursive: true, force: true })
+  }
+}
+
+describe('dynamic import in function bodies', () => {
+  test('flags a function whose body does `await import(...)`', async () => {
+    const state = await inspectSource(
+      [
+        "import { pikkuSessionlessFunc } from '@pikku/core'",
+        '',
+        'export const greedy = pikkuSessionlessFunc({',
+        '  func: async ({ logger }) => {',
+        "    const { readFile } = await import('node:fs/promises')",
+        '    return { readFile: typeof readFile }',
+        '  },',
+        '})',
+      ].join('\n')
+    )
+    const meta = (state.functions.meta as any).greedy
+    assert.ok(meta, 'greedy should be inspected')
+    assert.ok(state.functions.dynamicImportIds.has(meta.pikkuFuncId))
+    const diagnostic = state.diagnostics.find(
+      (d) => d.code === ErrorCode.FUNCTION_DYNAMIC_IMPORT
+    )
+    assert.ok(
+      diagnostic,
+      'expected a FUNCTION_DYNAMIC_IMPORT diagnostic for the function'
+    )
+  })
+
+  test('flags a nested `import(...)` call inside a callback', async () => {
+    const state = await inspectSource(
+      [
+        "import { pikkuSessionlessFunc } from '@pikku/core'",
+        '',
+        'export const nested = pikkuSessionlessFunc({',
+        '  func: async ({ logger }) => {',
+        '    await Promise.all([',
+        "      import('node:os').then((m) => m.hostname()),",
+        '    ])',
+        '    return { ok: true }',
+        '  },',
+        '})',
+      ].join('\n')
+    )
+    const meta = (state.functions.meta as any).nested
+    assert.ok(state.functions.dynamicImportIds.has(meta.pikkuFuncId))
+    assert.ok(
+      state.diagnostics.some(
+        (d) => d.code === ErrorCode.FUNCTION_DYNAMIC_IMPORT
+      )
+    )
+  })
+
+  test('does NOT flag a function with only static imports', async () => {
+    const state = await inspectSource(
+      [
+        "import { pikkuSessionlessFunc } from '@pikku/core'",
+        '',
+        'export const clean = pikkuSessionlessFunc({',
+        '  func: async ({ logger }, data: { n: number }) => {',
+        '    return { doubled: data.n * 2 }',
+        '  },',
+        '})',
+      ].join('\n')
+    )
+    const meta = (state.functions.meta as any).clean
+    assert.ok(meta, 'clean should be inspected')
+    assert.ok(!state.functions.dynamicImportIds.has(meta.pikkuFuncId))
+    assert.ok(
+      !state.diagnostics.some(
+        (d) => d.code === ErrorCode.FUNCTION_DYNAMIC_IMPORT
+      )
+    )
+  })
+
+  test('does NOT flag a type-only import position `import("x").T`', async () => {
+    const state = await inspectSource(
+      [
+        "import { pikkuSessionlessFunc } from '@pikku/core'",
+        '',
+        'export const typeOnly = pikkuSessionlessFunc({',
+        "  func: async ({ logger }, data: import('node:buffer').Blob) => {",
+        '    return { size: data.size }',
+        '  },',
+        '})',
+      ].join('\n')
+    )
+    const meta = (state.functions.meta as any).typeOnly
+    assert.ok(meta, 'typeOnly should be inspected')
+    assert.ok(!state.functions.dynamicImportIds.has(meta.pikkuFuncId))
+  })
+})

package/src/error-codes-emitted.test.ts

@@ -0,0 +1,76 @@
+import { test } from 'node:test'
+import { strict as assert } from 'node:assert'
+import { readFileSync, readdirSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { dirname, join } from 'node:path'
+
+/**
+ * Guards against dead `ErrorCode` registry entries.
+ *
+ * Every value in the `ErrorCode` enum must have at least one emission site in
+ * the framework source — a `ErrorCode.<NAME>` reference or the raw `PKU###`
+ * string in a non-test `.ts` file under `packages/*​/src`. A code that is
+ * defined but never thrown is a dead entry: it can never appear in a user's
+ * terminal, yet it still demands a docs page and clutters the registry. This
+ * test fails and names any such entries so they get wired up or removed rather
+ * than silently accumulating.
+ */
+
+const here = dirname(fileURLToPath(import.meta.url))
+const packagesDir = join(here, '..', '..')
+const errorCodesFile = join(here, 'error-codes.ts')
+
+const enumMembers = [
+  ...readFileSync(errorCodesFile, 'utf8').matchAll(
+    /^\s*([A-Z0-9_]+)\s*=\s*'(PKU\d+)'/gm
+  ),
+].map((m) => ({ name: m[1], code: m[2] }))
+
+const collectSource = () => {
+  const contents: string[] = []
+  for (const pkg of readdirSync(packagesDir, { withFileTypes: true })) {
+    if (!pkg.isDirectory()) continue
+    const srcDir = join(packagesDir, pkg.name, 'src')
+    let entries
+    try {
+      entries = readdirSync(srcDir, { recursive: true, withFileTypes: true })
+    } catch {
+      continue
+    }
+    for (const entry of entries) {
+      if (!entry.isFile()) continue
+      const name = entry.name
+      if (
+        !name.endsWith('.ts') ||
+        name.endsWith('.d.ts') ||
+        name.endsWith('.test.ts') ||
+        name === 'error-codes.ts'
+      ) {
+        continue
+      }
+      contents.push(readFileSync(join(entry.parentPath, name), 'utf8'))
+    }
+  }
+  return contents.join('\n')
+}
+
+test('every ErrorCode value has an emission site in the source', () => {
+  assert.ok(
+    enumMembers.length > 0,
+    'Failed to parse any ErrorCode members from error-codes.ts'
+  )
+
+  const source = collectSource()
+
+  const dead = enumMembers.filter(
+    ({ name, code }) =>
+      !source.includes(`ErrorCode.${name}`) && !source.includes(code)
+  )
+
+  assert.deepEqual(
+    dead.map(({ code, name }) => `${code} ${name}`),
+    [],
+    `Dead ErrorCode entries (defined but never emitted). Wire them to a diagnostic or delete them:\n` +
+      dead.map(({ code, name }) => `  - ${code} ${name}`).join('\n')
+  )
+})

package/src/error-codes.ts

@@ -16,28 +16,26 @@ export enum ErrorCode {
   MISSING_URI = 'PKU220',
   MISSING_FUNC = 'PKU236',
   INVALID_TAGS_TYPE = 'PKU247',
-  INVALID_HANDLER = 'PKU300',
   MISSING_TITLE = 'PKU370',
   MISSING_QUEUE_NAME = 'PKU384',
   MISSING_CHANNEL_NAME = 'PKU400',
   CLI_CLIENTSIDE_RENDERER_HAS_SERVICES = 'PKU672',
   SCENARIO_HAS_SERVICES = 'PKU673',
   EXPECT_EVENTUALLY_SCENARIO_ONLY = 'PKU675',
-  DYNAMIC_STEP_NAME = 'PKU529',
   WORKFLOW_ORCHESTRATOR_NOT_CONFIGURED = 'PKU600',
   INVALID_DSL_WORKFLOW = 'PKU641',
 
+  // Database schema codegen warnings
+  DB_COLUMN_NAME_TYPE_CONTRADICTION = 'PKU480',
+  DB_JSON_COLUMN_UNTYPED = 'PKU481',
+  DB_FORMAT_ON_NON_STRING = 'PKU482',
+
   // Configuration errors
-  CONFIG_TYPE_NOT_FOUND = 'PKU426',
-  CONFIG_TYPE_UNDEFINED = 'PKU427',
-  SCHEMA_NO_ROOT = 'PKU431',
   SCHEMA_GENERATION_ERROR = 'PKU456',
-  SCHEMA_LOAD_ERROR = 'PKU488',
   INLINE_SCHEMA = 'PKU489',
 
   // Function errors
   FUNCTION_METADATA_NOT_FOUND = 'PKU559',
-  HANDLER_NOT_RESOLVED = 'PKU568',
 
   // Auth errors
   DUPLICATE_AUTH_DEFINITION = 'PKU581',
@@ -48,16 +46,6 @@ export enum ErrorCode {
   ROUTE_QUERY_MISMATCH = 'PKU572',
   AUTH_DISABLED_REQUIRES_SESSIONLESS = 'PKU573',
 
-  // Middleware/Permission errors
-  MIDDLEWARE_HANDLER_INVALID = 'PKU685',
-  MIDDLEWARE_TAG_INVALID = 'PKU715',
-  MIDDLEWARE_EMPTY_ARRAY = 'PKU736',
-  MIDDLEWARE_PATTERN_INVALID = 'PKU787',
-  PERMISSION_HANDLER_INVALID = 'PKU835',
-  PERMISSION_TAG_INVALID = 'PKU836',
-  PERMISSION_EMPTY_ARRAY = 'PKU937',
-  PERMISSION_PATTERN_INVALID = 'PKU975',
-
   // Versioning errors
   DUPLICATE_FUNCTION_VERSION = 'PKU850',
   DUPLICATE_FUNCTION_NAME = 'PKU851',
@@ -80,13 +68,11 @@ export enum ErrorCode {
   // Optimization diagnostics
   SERVICES_NOT_DESTRUCTURED = 'PKU410',
   WIRES_NOT_DESTRUCTURED = 'PKU411',
+  FUNCTION_DYNAMIC_IMPORT = 'PKU498',
 
   // Dependency integrity errors
   DUPLICATE_CORE_VERSION = 'PKU717',
 
-  // Feature Flag
-  WORKFLOW_MULTI_QUEUE_NOT_SUPPORTED = 'PKU901',
-
   // Data classification errors
   PII_IN_OUTPUT = 'PKU910',
 

package/src/inspector.ts

@@ -74,6 +74,7 @@ export function getInitialInspectorState(rootDir: string): InspectorState {
       meta: {},
       files: new Map(),
       approvalDescriptions: {},
+      dynamicImportIds: new Set(),
     },
     http: {
       metaInputTypes: new Map(),

package/src/types.ts

@@ -101,6 +101,12 @@ export interface InspectorFunctionState {
   meta: FunctionsMeta
   files: Map<string, { path: string; exportedName: string }>
   approvalDescriptions: Record<string, InspectorApprovalDescriptionDefinition>
+  /**
+   * pikkuFuncIds whose handler body performs a runtime dynamic `import(...)`.
+   * Transient lint signal consumed by computeDiagnostics (PKU498) in the same
+   * inspection pass — deliberately not part of the serialized function meta.
+   */
+  dynamicImportIds: Set<string>
 }
 
 export interface InspectorChannelState {

package/src/utils/compute-diagnostics.test.ts

@@ -5,10 +5,11 @@ import type { InspectorState } from '../types.js'
 import { ErrorCode } from '../error-codes.js'
 
 function stateWithFunctions(
-  meta: InspectorState['functions']['meta']
+  meta: InspectorState['functions']['meta'],
+  dynamicImportIds: string[] = []
 ): InspectorState {
   return {
-    functions: { meta },
+    functions: { meta, dynamicImportIds: new Set(dynamicImportIds) },
     middleware: { definitions: {} },
     permissions: { definitions: {} },
   } as unknown as InspectorState
@@ -27,10 +28,7 @@ describe('computeDiagnostics', () => {
     })
     computeDiagnostics(state)
     assert.equal(state.diagnostics.length, 1)
-    assert.equal(
-      state.diagnostics[0].code,
-      ErrorCode.SERVICES_NOT_DESTRUCTURED
-    )
+    assert.equal(state.diagnostics[0].code, ErrorCode.SERVICES_NOT_DESTRUCTURED)
   })
 
   test('does NOT flag a generated .gen.ts function (user cannot edit it)', () => {
@@ -66,4 +64,43 @@ describe('computeDiagnostics', () => {
     computeDiagnostics(state)
     assert.equal(state.diagnostics.length, 0)
   })
+
+  test('flags a user-authored function that does a dynamic import in its body', () => {
+    const state = stateWithFunctions(
+      {
+        greedy: {
+          pikkuFuncId: 'greedy',
+          inputSchemaName: null,
+          outputSchemaName: null,
+          sourceFile: '/project/src/greedy.ts',
+          services: { optimized: true, services: ['logger'] },
+        },
+      },
+      ['greedy']
+    )
+    computeDiagnostics(state)
+    assert.equal(
+      state.diagnostics.filter(
+        (d) => d.code === ErrorCode.FUNCTION_DYNAMIC_IMPORT
+      ).length,
+      1
+    )
+  })
+
+  test('does NOT flag a dynamic import in a generated .gen.ts function', () => {
+    const state = stateWithFunctions(
+      {
+        authHandler: {
+          pikkuFuncId: 'authHandler',
+          inputSchemaName: null,
+          outputSchemaName: null,
+          sourceFile: '/project/.pikku/auth.gen.ts',
+          services: { optimized: true, services: [] },
+        },
+      },
+      ['authHandler']
+    )
+    computeDiagnostics(state)
+    assert.equal(state.diagnostics.length, 0)
+  })
 })