@pikku/inspector 0.12.39 → 0.12.40

package/CHANGELOG.md

@@ -1,3 +1,16 @@
+## 0.12.40
+
+### Patch Changes
+
+- 1f3f510: Warn when a Pikku function body performs a runtime dynamic `import(...)`.
+
+  The inspector now flags any `pikkuFunc`/`pikkuSessionlessFunc` (and friends) whose handler body contains a dynamic `import(...)` call — including nested callbacks — with the new `PKU498` diagnostic. Function bodies run on every invocation, so a dynamic import there adds per-call latency and defeats bundling/tree-shaking; the import belongs at the top of the module or in your services/`wireServices` setup instead.
+
+  Type-only positions like `import('x').Foo` are not flagged. The rule defaults to `warn` — a printed yellow warning that does not fail the build — and is configurable via `lint.functionDynamicImport` in `pikku.config.json` (`'off'` to silence, `'error'` to make it a hard build failure), matching the existing `servicesNotDestructured`/`wiresNotDestructured` lints.
+
+- Updated dependencies [1f3f510]
+  - @pikku/core@0.12.59
+
 ## 0.12.39
 
 ### Patch Changes

package/dist/add/add-functions.js

@@ -15,6 +15,28 @@ const isValidVariableName = (name) => {
     const regex = /^[a-zA-Z_$][a-zA-Z0-9_$]*$/;
     return regex.test(name);
 };
+/**
+ * True when the handler body contains a runtime dynamic `import(...)` call
+ * anywhere (including nested callbacks). Type-only positions like
+ * `import('x').Foo` are `ImportTypeNode`s, not `CallExpression`s with an
+ * `ImportKeyword` callee, so they are intentionally not matched.
+ */
+const handlerHasDynamicImport = (handler) => {
+    let found = false;
+    const visit = (node) => {
+        if (found) {
+            return;
+        }
+        if (ts.isCallExpression(node) &&
+            node.expression.kind === ts.SyntaxKind.ImportKeyword) {
+            found = true;
+            return;
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(handler.body);
+    return found;
+};
 const nullifyTypes = (type) => {
     if (type === 'void' ||
         type === 'undefined' ||
@@ -779,6 +801,9 @@ export const addFunctions = (logger, node, checker, state, options) => {
         exportedName: exportedName || undefined,
         ...bodySpan,
     };
+    if (handlerHasDynamicImport(handler)) {
+        state.functions.dynamicImportIds.add(pikkuFuncId);
+    }
     // Populate node metadata if node config is present
     if (nodeDisplayName && nodeCategory && nodeType) {
         state.nodes.files.add(node.getSourceFile().fileName);

package/dist/error-codes.d.ts

@@ -46,6 +46,7 @@ export declare enum ErrorCode {
     SCHEMA_AND_WIRING_COLOCATED = "PKU490",
     SERVICES_NOT_DESTRUCTURED = "PKU410",
     WIRES_NOT_DESTRUCTURED = "PKU411",
+    FUNCTION_DYNAMIC_IMPORT = "PKU498",
     DUPLICATE_CORE_VERSION = "PKU717",
     PII_IN_OUTPUT = "PKU910",
     ADDON_WIRING_NOT_ALLOWED = "PKU920",

package/dist/error-codes.js

@@ -58,6 +58,7 @@ export var ErrorCode;
     // Optimization diagnostics
     ErrorCode["SERVICES_NOT_DESTRUCTURED"] = "PKU410";
     ErrorCode["WIRES_NOT_DESTRUCTURED"] = "PKU411";
+    ErrorCode["FUNCTION_DYNAMIC_IMPORT"] = "PKU498";
     // Dependency integrity errors
     ErrorCode["DUPLICATE_CORE_VERSION"] = "PKU717";
     // Data classification errors

package/dist/inspector.js

@@ -43,6 +43,7 @@ export function getInitialInspectorState(rootDir) {
             meta: {},
             files: new Map(),
             approvalDescriptions: {},
+            dynamicImportIds: new Set(),
         },
         http: {
             metaInputTypes: new Map(),

package/dist/types.d.ts

@@ -76,6 +76,12 @@ export interface InspectorFunctionState {
         exportedName: string;
     }>;
     approvalDescriptions: Record<string, InspectorApprovalDescriptionDefinition>;
+    /**
+     * pikkuFuncIds whose handler body performs a runtime dynamic `import(...)`.
+     * Transient lint signal consumed by computeDiagnostics (PKU498) in the same
+     * inspection pass — deliberately not part of the serialized function meta.
+     */
+    dynamicImportIds: Set<string>;
 }
 export interface InspectorChannelState {
     meta: ChannelsMeta;

package/dist/utils/post-process.js

@@ -581,6 +581,14 @@ export function computeDiagnostics(state) {
                 position: 0,
             });
         }
+        if (state.functions.dynamicImportIds.has(id)) {
+            diagnostics.push({
+                code: ErrorCode.FUNCTION_DYNAMIC_IMPORT,
+                message: `Function '${id}' performs a runtime dynamic 'import(...)' in its body. Move the import to the top of the module (static import) or into your services/wireServices setup — function bodies run on every invocation, so a dynamic import there adds latency and defeats bundling/tree-shaking.`,
+                sourceFile: meta.pikkuFuncId,
+                position: 0,
+            });
+        }
     }
     for (const [id, def] of Object.entries(state.middleware.definitions)) {
         if (def.services && !def.services.optimized) {

package/dist/utils/serialize-inspector-state.js

@@ -194,6 +194,7 @@ export function deserializeInspectorState(data) {
             meta: data.functions.meta,
             files: new Map(data.functions.files),
             approvalDescriptions: data.functions.approvalDescriptions || {},
+            dynamicImportIds: new Set(),
         },
         http: {
             metaInputTypes: new Map(data.http.metaInputTypes),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/inspector",
-  "version": "0.12.39",
+  "version": "0.12.40",
   "author": "yasser.fadl@gmail.com",
   "license": "BUSL-1.1",
   "type": "module",
@@ -44,10 +44,10 @@
     "zod-to-ts": "^2.1.0"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.58"
+    "@pikku/core": "^0.12.59"
   },
   "devDependencies": {
-    "@pikku/core": "^0.12.58",
+    "@pikku/core": "^0.12.59",
     "@types/node": "^24.11.0"
   },
   "engines": {

package/src/add/add-functions.ts

@@ -27,6 +27,33 @@ const isValidVariableName = (name: string) => {
   return regex.test(name)
 }
 
+/**
+ * True when the handler body contains a runtime dynamic `import(...)` call
+ * anywhere (including nested callbacks). Type-only positions like
+ * `import('x').Foo` are `ImportTypeNode`s, not `CallExpression`s with an
+ * `ImportKeyword` callee, so they are intentionally not matched.
+ */
+const handlerHasDynamicImport = (
+  handler: ts.ArrowFunction | ts.FunctionExpression
+): boolean => {
+  let found = false
+  const visit = (node: ts.Node) => {
+    if (found) {
+      return
+    }
+    if (
+      ts.isCallExpression(node) &&
+      node.expression.kind === ts.SyntaxKind.ImportKeyword
+    ) {
+      found = true
+      return
+    }
+    ts.forEachChild(node, visit)
+  }
+  visit(handler.body)
+  return found
+}
+
 const nullifyTypes = (type: string | null) => {
   if (
     type === 'void' ||
@@ -1083,6 +1110,10 @@ export const addFunctions: AddWiring = (
     ...bodySpan,
   }
 
+  if (handlerHasDynamicImport(handler)) {
+    state.functions.dynamicImportIds.add(pikkuFuncId)
+  }
+
   // Populate node metadata if node config is present
   if (nodeDisplayName && nodeCategory && nodeType) {
     state.nodes.files.add(node.getSourceFile().fileName)

package/src/add/dynamic-import-check.test.ts

@@ -0,0 +1,119 @@
+import { strict as assert } from 'assert'
+import { describe, test } from 'node:test'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { inspect } from '../inspector.js'
+import { ErrorCode } from '../error-codes.js'
+import type { InspectorLogger } from '../types.js'
+
+const logger: InspectorLogger = {
+  debug: () => {},
+  info: () => {},
+  warn: () => {},
+  error: () => {},
+  diagnostic: () => {},
+  critical: () => {},
+  hasCriticalErrors: () => false,
+}
+
+async function inspectSource(source: string) {
+  const rootDir = await mkdtemp(join(tmpdir(), 'pikku-dynimport-'))
+  const file = join(rootDir, 'my.function.ts')
+  await writeFile(file, source)
+  try {
+    return await inspect(logger, [file], { rootDir })
+  } finally {
+    await rm(rootDir, { recursive: true, force: true })
+  }
+}
+
+describe('dynamic import in function bodies', () => {
+  test('flags a function whose body does `await import(...)`', async () => {
+    const state = await inspectSource(
+      [
+        "import { pikkuSessionlessFunc } from '@pikku/core'",
+        '',
+        'export const greedy = pikkuSessionlessFunc({',
+        '  func: async ({ logger }) => {',
+        "    const { readFile } = await import('node:fs/promises')",
+        '    return { readFile: typeof readFile }',
+        '  },',
+        '})',
+      ].join('\n')
+    )
+    const meta = (state.functions.meta as any).greedy
+    assert.ok(meta, 'greedy should be inspected')
+    assert.ok(state.functions.dynamicImportIds.has(meta.pikkuFuncId))
+    const diagnostic = state.diagnostics.find(
+      (d) => d.code === ErrorCode.FUNCTION_DYNAMIC_IMPORT
+    )
+    assert.ok(
+      diagnostic,
+      'expected a FUNCTION_DYNAMIC_IMPORT diagnostic for the function'
+    )
+  })
+
+  test('flags a nested `import(...)` call inside a callback', async () => {
+    const state = await inspectSource(
+      [
+        "import { pikkuSessionlessFunc } from '@pikku/core'",
+        '',
+        'export const nested = pikkuSessionlessFunc({',
+        '  func: async ({ logger }) => {',
+        '    await Promise.all([',
+        "      import('node:os').then((m) => m.hostname()),",
+        '    ])',
+        '    return { ok: true }',
+        '  },',
+        '})',
+      ].join('\n')
+    )
+    const meta = (state.functions.meta as any).nested
+    assert.ok(state.functions.dynamicImportIds.has(meta.pikkuFuncId))
+    assert.ok(
+      state.diagnostics.some(
+        (d) => d.code === ErrorCode.FUNCTION_DYNAMIC_IMPORT
+      )
+    )
+  })
+
+  test('does NOT flag a function with only static imports', async () => {
+    const state = await inspectSource(
+      [
+        "import { pikkuSessionlessFunc } from '@pikku/core'",
+        '',
+        'export const clean = pikkuSessionlessFunc({',
+        '  func: async ({ logger }, data: { n: number }) => {',
+        '    return { doubled: data.n * 2 }',
+        '  },',
+        '})',
+      ].join('\n')
+    )
+    const meta = (state.functions.meta as any).clean
+    assert.ok(meta, 'clean should be inspected')
+    assert.ok(!state.functions.dynamicImportIds.has(meta.pikkuFuncId))
+    assert.ok(
+      !state.diagnostics.some(
+        (d) => d.code === ErrorCode.FUNCTION_DYNAMIC_IMPORT
+      )
+    )
+  })
+
+  test('does NOT flag a type-only import position `import("x").T`', async () => {
+    const state = await inspectSource(
+      [
+        "import { pikkuSessionlessFunc } from '@pikku/core'",
+        '',
+        'export const typeOnly = pikkuSessionlessFunc({',
+        "  func: async ({ logger }, data: import('node:buffer').Blob) => {",
+        '    return { size: data.size }',
+        '  },',
+        '})',
+      ].join('\n')
+    )
+    const meta = (state.functions.meta as any).typeOnly
+    assert.ok(meta, 'typeOnly should be inspected')
+    assert.ok(!state.functions.dynamicImportIds.has(meta.pikkuFuncId))
+  })
+})

package/src/error-codes.ts

@@ -68,6 +68,7 @@ export enum ErrorCode {
   // Optimization diagnostics
   SERVICES_NOT_DESTRUCTURED = 'PKU410',
   WIRES_NOT_DESTRUCTURED = 'PKU411',
+  FUNCTION_DYNAMIC_IMPORT = 'PKU498',
 
   // Dependency integrity errors
   DUPLICATE_CORE_VERSION = 'PKU717',

package/src/inspector.ts

@@ -74,6 +74,7 @@ export function getInitialInspectorState(rootDir: string): InspectorState {
       meta: {},
       files: new Map(),
       approvalDescriptions: {},
+      dynamicImportIds: new Set(),
     },
     http: {
       metaInputTypes: new Map(),

package/src/types.ts

@@ -101,6 +101,12 @@ export interface InspectorFunctionState {
   meta: FunctionsMeta
   files: Map<string, { path: string; exportedName: string }>
   approvalDescriptions: Record<string, InspectorApprovalDescriptionDefinition>
+  /**
+   * pikkuFuncIds whose handler body performs a runtime dynamic `import(...)`.
+   * Transient lint signal consumed by computeDiagnostics (PKU498) in the same
+   * inspection pass — deliberately not part of the serialized function meta.
+   */
+  dynamicImportIds: Set<string>
 }
 
 export interface InspectorChannelState {

package/src/utils/compute-diagnostics.test.ts

@@ -5,10 +5,11 @@ import type { InspectorState } from '../types.js'
 import { ErrorCode } from '../error-codes.js'
 
 function stateWithFunctions(
-  meta: InspectorState['functions']['meta']
+  meta: InspectorState['functions']['meta'],
+  dynamicImportIds: string[] = []
 ): InspectorState {
   return {
-    functions: { meta },
+    functions: { meta, dynamicImportIds: new Set(dynamicImportIds) },
     middleware: { definitions: {} },
     permissions: { definitions: {} },
   } as unknown as InspectorState
@@ -27,10 +28,7 @@ describe('computeDiagnostics', () => {
     })
     computeDiagnostics(state)
     assert.equal(state.diagnostics.length, 1)
-    assert.equal(
-      state.diagnostics[0].code,
-      ErrorCode.SERVICES_NOT_DESTRUCTURED
-    )
+    assert.equal(state.diagnostics[0].code, ErrorCode.SERVICES_NOT_DESTRUCTURED)
   })
 
   test('does NOT flag a generated .gen.ts function (user cannot edit it)', () => {
@@ -66,4 +64,43 @@ describe('computeDiagnostics', () => {
     computeDiagnostics(state)
     assert.equal(state.diagnostics.length, 0)
   })
+
+  test('flags a user-authored function that does a dynamic import in its body', () => {
+    const state = stateWithFunctions(
+      {
+        greedy: {
+          pikkuFuncId: 'greedy',
+          inputSchemaName: null,
+          outputSchemaName: null,
+          sourceFile: '/project/src/greedy.ts',
+          services: { optimized: true, services: ['logger'] },
+        },
+      },
+      ['greedy']
+    )
+    computeDiagnostics(state)
+    assert.equal(
+      state.diagnostics.filter(
+        (d) => d.code === ErrorCode.FUNCTION_DYNAMIC_IMPORT
+      ).length,
+      1
+    )
+  })
+
+  test('does NOT flag a dynamic import in a generated .gen.ts function', () => {
+    const state = stateWithFunctions(
+      {
+        authHandler: {
+          pikkuFuncId: 'authHandler',
+          inputSchemaName: null,
+          outputSchemaName: null,
+          sourceFile: '/project/.pikku/auth.gen.ts',
+          services: { optimized: true, services: [] },
+        },
+      },
+      ['authHandler']
+    )
+    computeDiagnostics(state)
+    assert.equal(state.diagnostics.length, 0)
+  })
 })

package/src/utils/post-process.ts

@@ -719,6 +719,14 @@ export function computeDiagnostics(state: InspectorState): void {
         position: 0,
       })
     }
+    if (state.functions.dynamicImportIds.has(id)) {
+      diagnostics.push({
+        code: ErrorCode.FUNCTION_DYNAMIC_IMPORT,
+        message: `Function '${id}' performs a runtime dynamic 'import(...)' in its body. Move the import to the top of the module (static import) or into your services/wireServices setup — function bodies run on every invocation, so a dynamic import there adds latency and defeats bundling/tree-shaking.`,
+        sourceFile: meta.pikkuFuncId,
+        position: 0,
+      })
+    }
   }
 
   for (const [id, def] of Object.entries(state.middleware.definitions)) {

package/src/utils/serialize-inspector-state.ts

@@ -529,6 +529,7 @@ export function deserializeInspectorState(
       meta: data.functions.meta,
       files: new Map(data.functions.files),
       approvalDescriptions: (data.functions as any).approvalDescriptions || {},
+      dynamicImportIds: new Set(),
     },
     http: {
       metaInputTypes: new Map(data.http.metaInputTypes),