@pikku/inspector 0.12.41 → 0.12.43

package/src/utils/post-process.ts

@@ -10,9 +10,12 @@ import type {
   MiddlewareMetadata,
   PermissionMetadata,
 } from '@pikku/core'
+import { existsSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
 import { extractTypeKeys } from './type-utils.js'
 import { ErrorCode } from '../error-codes.js'
 import { AUTH_HANDLER_FUNC_ID } from '../add/add-auth.js'
+import { flattenScopeDefinitions } from '@pikku/core/scope'
 
 /**
  * Stamp the inspected authorize/callbacks service set onto the generated auth
@@ -46,7 +49,7 @@ export function stampAuthHandlerServices(
  * Skips type:'http' and type:'tag' (reference groups, not individuals).
  */
 export function extractWireNames(
-  list?: MiddlewareMetadata[] | PermissionMetadata[]
+  list?: Array<MiddlewareMetadata | PermissionMetadata>
 ): string[] {
   if (!list) return []
   return list
@@ -57,34 +60,25 @@ export function extractWireNames(
 }
 
 /**
- * Helper to expand middleware/permission groups into individual names
- * and add their services to the aggregation.
- * This handles tag-based and HTTP-pattern-based middleware/permission groups.
+ * Helper to expand middleware groups into individual names and add their
+ * services to the aggregation. Handles tag-based and HTTP-pattern-based
+ * middleware groups. Permissions are function-scoped only and carry no groups.
  */
 function expandAndAddGroupServices(
-  list: MiddlewareMetadata[] | PermissionMetadata[] | undefined,
+  list: MiddlewareMetadata[] | undefined,
   state: InspectorState | Omit<InspectorState, 'typesLookup'>,
-  addServices: (services: FunctionServicesMeta | undefined) => void,
-  isMiddleware: boolean
+  addServices: (services: FunctionServicesMeta | undefined) => void
 ): void {
   if (!list) return
 
   for (const item of list) {
     if (item.type === 'tag') {
-      // Expand tag-based group
-      const groupMeta = isMiddleware
-        ? state.middleware.tagMiddleware.get(item.tag)
-        : state.permissions.tagPermissions.get(item.tag)
-
+      const groupMeta = state.middleware.tagMiddleware.get(item.tag)
       if (groupMeta?.services) {
         addServices(groupMeta.services)
       }
     } else if (item.type === 'http' && 'route' in item) {
-      // Expand HTTP-pattern-based group
-      const groupMeta = isMiddleware
-        ? state.http.routeMiddleware.get(item.route)
-        : state.http.routePermissions.get(item.route)
-
+      const groupMeta = state.http.routeMiddleware.get(item.route)
       if (groupMeta?.services) {
         addServices(groupMeta.services)
       }
@@ -188,55 +182,33 @@ export function aggregateRequiredServices(
     'options',
   ] as const) {
     for (const routeMeta of Object.values(state.http.meta[method])) {
-      expandAndAddGroupServices(routeMeta.middleware, state, addServices, true)
-      expandAndAddGroupServices(
-        routeMeta.permissions,
-        state,
-        addServices,
-        false
-      )
+      expandAndAddGroupServices(routeMeta.middleware, state, addServices)
     }
   }
 
   // Also check other wiring types (channels, queues, schedulers, MCP)
   for (const channelMeta of Object.values(state.channels.meta)) {
-    expandAndAddGroupServices(channelMeta.middleware, state, addServices, true)
-    expandAndAddGroupServices(
-      channelMeta.permissions,
-      state,
-      addServices,
-      false
-    )
+    expandAndAddGroupServices(channelMeta.middleware, state, addServices)
   }
 
   for (const queueMeta of Object.values(state.queueWorkers.meta)) {
-    expandAndAddGroupServices(queueMeta.middleware, state, addServices, true)
-    // expandAndAddGroupServices(queueMeta.permissions, state, addServices, false)
+    expandAndAddGroupServices(queueMeta.middleware, state, addServices)
   }
 
   for (const scheduleMeta of Object.values(state.scheduledTasks.meta)) {
-    expandAndAddGroupServices(scheduleMeta.middleware, state, addServices, true)
-    // expandAndAddGroupServices(scheduleMeta.permissions, state, addServices, false)
+    expandAndAddGroupServices(scheduleMeta.middleware, state, addServices)
   }
 
   for (const toolMeta of Object.values(state.mcpEndpoints.toolsMeta)) {
-    expandAndAddGroupServices(toolMeta.middleware, state, addServices, true)
-    expandAndAddGroupServices(toolMeta.permissions, state, addServices, false)
+    expandAndAddGroupServices(toolMeta.middleware, state, addServices)
   }
 
   for (const promptMeta of Object.values(state.mcpEndpoints.promptsMeta)) {
-    expandAndAddGroupServices(promptMeta.middleware, state, addServices, true)
-    expandAndAddGroupServices(promptMeta.permissions, state, addServices, false)
+    expandAndAddGroupServices(promptMeta.middleware, state, addServices)
   }
 
   for (const resourceMeta of Object.values(state.mcpEndpoints.resourcesMeta)) {
-    expandAndAddGroupServices(resourceMeta.middleware, state, addServices, true)
-    expandAndAddGroupServices(
-      resourceMeta.permissions,
-      state,
-      addServices,
-      false
-    )
+    expandAndAddGroupServices(resourceMeta.middleware, state, addServices)
   }
 
   // 5. Services from session service factories
@@ -378,17 +350,24 @@ export function validateSecretOverrides(
   const { wireAddonDeclarations } = state.rpc
   if (!wireAddonDeclarations || wireAddonDeclarations.size === 0) return
 
-  const secretNames = new Set(state.secrets.definitions.map((d) => d.name))
+  // secretOverrides key on (and resolve to) SECRET IDs — the string the addon
+  // passes to getSecret — so validate against secretId, falling back to name for
+  // older meta without a secretId field.
+  const secretIds = new Set(
+    state.secrets.definitions.map((d: any) => d.secretId ?? d.name)
+  )
 
   for (const [namespace, addonDecl] of wireAddonDeclarations.entries()) {
     if (!addonDecl.secretOverrides) continue
 
-    for (const secretKey of Object.keys(addonDecl.secretOverrides)) {
-      if (!secretNames.has(secretKey)) {
-        const availableSecrets = Array.from(secretNames)
+    for (const [logicalName, resolvedName] of Object.entries(
+      addonDecl.secretOverrides
+    )) {
+      if (!secretIds.has(resolvedName)) {
+        const availableSecrets = Array.from(secretIds)
         logger.critical(
           ErrorCode.INVALID_VALUE,
-          `Secret override '${secretKey}' in addon '${namespace}' (${addonDecl.package}) does not exist. Available secrets: ${availableSecrets.join(', ') || 'none'}`
+          `Secret override '${logicalName}' -> '${resolvedName}' in addon '${namespace}' (${addonDecl.package}) targets a secret that does not exist. Available secrets: ${availableSecrets.join(', ') || 'none'}`
         )
       }
     }
@@ -409,12 +388,14 @@ export function validateCredentialOverrides(
   for (const [namespace, addonDecl] of wireAddonDeclarations.entries()) {
     if (!addonDecl.credentialOverrides) continue
 
-    for (const credentialKey of Object.keys(addonDecl.credentialOverrides)) {
-      if (!credentialNames.has(credentialKey)) {
+    for (const [logicalName, resolvedName] of Object.entries(
+      addonDecl.credentialOverrides
+    )) {
+      if (!credentialNames.has(resolvedName)) {
         const availableCredentials = Array.from(credentialNames)
         logger.critical(
           ErrorCode.INVALID_VALUE,
-          `Credential override '${credentialKey}' in addon '${namespace}' (${addonDecl.package}) does not exist. Available credentials: ${availableCredentials.join(', ') || 'none'}`
+          `Credential override '${logicalName}' -> '${resolvedName}' in addon '${namespace}' (${addonDecl.package}) targets a credential that does not exist. Available credentials: ${availableCredentials.join(', ') || 'none'}`
         )
       }
     }
@@ -428,23 +409,120 @@ export function validateVariableOverrides(
   const { wireAddonDeclarations } = state.rpc
   if (!wireAddonDeclarations || wireAddonDeclarations.size === 0) return
 
-  const variableNames = new Set(state.variables.definitions.map((d) => d.name))
+  // variableOverrides key on (and resolve to) VARIABLE IDs, so validate against
+  // variableId, falling back to name for older meta without a variableId field.
+  const variableIds = new Set(
+    state.variables.definitions.map((d: any) => d.variableId ?? d.name)
+  )
 
   for (const [namespace, addonDecl] of wireAddonDeclarations.entries()) {
     if (!addonDecl.variableOverrides) continue
 
-    for (const variableKey of Object.keys(addonDecl.variableOverrides)) {
-      if (!variableNames.has(variableKey)) {
-        const availableVariables = Array.from(variableNames)
+    for (const [logicalName, resolvedName] of Object.entries(
+      addonDecl.variableOverrides
+    )) {
+      if (!variableIds.has(resolvedName)) {
+        const availableVariables = Array.from(variableIds)
         logger.critical(
           ErrorCode.INVALID_VALUE,
-          `Variable override '${variableKey}' in addon '${namespace}' (${addonDecl.package}) does not exist. Available variables: ${availableVariables.join(', ') || 'none'}`
+          `Variable override '${logicalName}' -> '${resolvedName}' in addon '${namespace}' (${addonDecl.package}) targets a variable that does not exist. Available variables: ${availableVariables.join(', ') || 'none'}`
         )
       }
     }
   }
 }
 
+/**
+ * A `wireRemoteAddon` package ships types only — its handlers run on the host —
+ * so it MUST be a devDependency, not a production dependency (a prod dep would
+ * drag in the runtime deps remote consumption exists to avoid). This is the
+ * mirror image of `wireAddon`, which requires a production dependency.
+ */
+export function validateRemoteAddonDependencies(
+  logger: InspectorLogger,
+  state: InspectorState | Omit<InspectorState, 'typesLookup'>
+): void {
+  const { wireAddonDeclarations } = state.rpc
+  if (!wireAddonDeclarations || wireAddonDeclarations.size === 0) return
+
+  const hasRemote = Array.from(wireAddonDeclarations.values()).some(
+    (d) => d.remote
+  )
+  if (!hasRemote) return
+
+  const pkgJsonPath = join(state.rootDir, 'package.json')
+  if (!existsSync(pkgJsonPath)) return // no manifest to check (e.g. some tests)
+
+  let pkgJson: {
+    dependencies?: Record<string, string>
+    devDependencies?: Record<string, string>
+  }
+  try {
+    pkgJson = JSON.parse(readFileSync(pkgJsonPath, 'utf-8'))
+  } catch (e: any) {
+    logger.warn(
+      `Could not read ${pkgJsonPath} to verify remote addon dependencies: ${e?.message ?? e}`
+    )
+    return
+  }
+
+  const prodDeps = pkgJson.dependencies ?? {}
+  const devDeps = pkgJson.devDependencies ?? {}
+
+  for (const [namespace, decl] of wireAddonDeclarations.entries()) {
+    if (!decl.remote) continue
+    if (decl.package in devDeps) continue // correct
+
+    if (decl.package in prodDeps) {
+      logger.critical(
+        ErrorCode.REMOTE_ADDON_NOT_DEV_DEPENDENCY,
+        `Remote addon '${namespace}' ('${decl.package}') is a production dependency, but wireRemoteAddon consumes it for types only — its handlers run on the host. Move '${decl.package}' from "dependencies" to "devDependencies".`
+      )
+    } else {
+      logger.critical(
+        ErrorCode.REMOTE_ADDON_NOT_DEV_DEPENDENCY,
+        `Remote addon '${namespace}' ('${decl.package}') is wired with wireRemoteAddon but is not in "devDependencies". Add '${decl.package}' to "devDependencies" (types only).`
+      )
+    }
+  }
+}
+
+/**
+ * The auth a `wireRemoteAddon` consumer binds must reference a slot the consumer
+ * actually declares: a `credentialId` must be a wired credential, a `secretId`
+ * a wired secret. A custom `resolve()` and a public (omitted) surface are not
+ * statically checkable and are left to runtime.
+ */
+export function validateRemoteAddonAuth(
+  logger: InspectorLogger,
+  state: InspectorState | Omit<InspectorState, 'typesLookup'>
+): void {
+  const { wireAddonDeclarations } = state.rpc
+  if (!wireAddonDeclarations || wireAddonDeclarations.size === 0) return
+
+  const credentialNames = new Set(
+    state.credentials?.definitions.map((d) => d.name) ?? []
+  )
+  const secretNames = new Set(state.secrets.definitions.map((d) => d.name))
+
+  for (const [namespace, decl] of wireAddonDeclarations.entries()) {
+    if (!decl.remote) continue
+
+    if (decl.authCredentialId && !credentialNames.has(decl.authCredentialId)) {
+      logger.critical(
+        ErrorCode.REMOTE_ADDON_AUTH_UNRESOLVED,
+        `Remote addon '${namespace}' binds auth.credentialId '${decl.authCredentialId}', but no such credential is wired. Available credentials: ${Array.from(credentialNames).join(', ') || 'none'}`
+      )
+    }
+    if (decl.authSecretId && !secretNames.has(decl.authSecretId)) {
+      logger.critical(
+        ErrorCode.REMOTE_ADDON_AUTH_UNRESOLVED,
+        `Remote addon '${namespace}' binds auth.secretId '${decl.authSecretId}', but no such secret is wired. Available secrets: ${Array.from(secretNames).join(', ') || 'none'}`
+      )
+    }
+  }
+}
+
 export function computeResolvedIOTypes(state: InspectorState): void {
   const { functions } = state
   for (const [pikkuFuncId, meta] of Object.entries(functions.meta)) {
@@ -531,36 +609,8 @@ export function computeMiddlewareGroupsMeta(state: InspectorState): void {
 }
 
 export function computePermissionsGroupsMeta(state: InspectorState): void {
-  const httpGroups: Record<string, any> = {}
-  for (const [pattern, meta] of state.http.routePermissions.entries()) {
-    httpGroups[pattern] = {
-      exportName: meta.exportName,
-      sourceFile: meta.sourceFile,
-      position: meta.position,
-      services: meta.services,
-      count: meta.count,
-      instanceIds: meta.instanceIds,
-      isFactory: meta.isFactory,
-    }
-  }
-
-  const tagGroups: Record<string, any> = {}
-  for (const [tag, meta] of state.permissions.tagPermissions.entries()) {
-    tagGroups[tag] = {
-      exportName: meta.exportName,
-      sourceFile: meta.sourceFile,
-      position: meta.position,
-      services: meta.services,
-      count: meta.count,
-      instanceIds: meta.instanceIds,
-      isFactory: meta.isFactory,
-    }
-  }
-
   state.permissionsGroupsMeta = {
     definitions: state.permissions.definitions,
-    httpGroups,
-    tagGroups,
   }
 }
 
@@ -632,6 +682,44 @@ export function validateAgentModels(
   }
 }
 
+/**
+ * A `pikkuWorkflowGraph` node that references the `graph:` namespace (e.g.
+ * `graph:editFields`) needs @pikku/addon-graph wired — otherwise the RPC never
+ * registers and codegen fails deep in type-checking with an opaque error. Fail
+ * early with an actionable message pointing at `scaffold: { graph: true }`.
+ */
+export function validateWorkflowGraphAddons(
+  logger: InspectorLogger,
+  state: InspectorState
+): void {
+  const addonGraphWired = Array.from(
+    state.rpc.wireAddonDeclarations.values()
+  ).some((decl) => decl.package === '@pikku/addon-graph')
+  if (addonGraphWired) {
+    return
+  }
+
+  for (const [name, graph] of Object.entries(state.workflows.graphMeta)) {
+    for (const node of Object.values(graph.nodes)) {
+      if (!('rpcName' in node) || typeof node.rpcName !== 'string') {
+        continue
+      }
+      if (!node.rpcName.startsWith('graph:')) {
+        continue
+      }
+      if (state.functions.meta[node.rpcName]) {
+        continue
+      }
+      logger.critical(
+        ErrorCode.WORKFLOW_GRAPH_ADDON_NOT_WIRED,
+        `Workflow graph '${name}' references '${node.rpcName}' but @pikku/addon-graph is not wired. ` +
+          `Enable "scaffold": { "graph": true } in pikku.config.json (and install @pikku/addon-graph), ` +
+          `or wire it manually with wireAddon({ name: 'graph', package: '@pikku/addon-graph' }).`
+      )
+    }
+  }
+}
+
 /**
  * Validates that Zod schemas and wiring side-effects (wireHTTPRoutes,
  * addPermission, addHTTPMiddleware, etc.) do not coexist in the same file.
@@ -658,14 +746,6 @@ export function validateSchemaWiringSeparation(
     wiringFiles.add(file)
   }
 
-  // Permission wirings (addPermission calls)
-  for (const meta of state.permissions.tagPermissions.values()) {
-    wiringFiles.add(meta.sourceFile)
-  }
-  for (const meta of state.http.routePermissions.values()) {
-    wiringFiles.add(meta.sourceFile)
-  }
-
   // Middleware wirings (addHTTPMiddleware calls)
   for (const meta of state.http.routeMiddleware.values()) {
     wiringFiles.add(meta.sourceFile)
@@ -769,3 +849,44 @@ export function computeDiagnostics(state: InspectorState): void {
 
   state.diagnostics = diagnostics
 }
+
+/**
+ * Validates that every scope referenced by a function is declared via
+ * `wireScope`. Runs after all visitors, so declaration order does not matter.
+ *
+ * A `*` suffix is a wildcard requirement: `admin:*` requires the `admin` scope
+ * to be declared, and grants its whole subtree.
+ */
+export function validateScopeReferences(
+  logger: InspectorLogger,
+  state: InspectorState | Omit<InspectorState, 'typesLookup'>
+): void {
+  const declared = new Set(
+    flattenScopeDefinitions(state.scopes.definitions).map((s) => s.id)
+  )
+
+  for (const [funcName, meta] of Object.entries(state.functions.meta)) {
+    if (!meta.scopes?.length) continue
+
+    for (const scope of meta.scopes) {
+      // A trailing wildcard grants a subtree; the node it hangs off must exist.
+      const declaredForm = scope.endsWith(':*') ? scope.slice(0, -2) : scope
+
+      if (scope === '*') {
+        logger.critical(
+          ErrorCode.INVALID_VALUE,
+          `Function '${funcName}' requires the bare wildcard scope '*'. A function must require a specific scope — '*' is only meaningful as a grant.`
+        )
+        continue
+      }
+
+      if (!declared.has(declaredForm)) {
+        const available = Array.from(declared)
+        logger.critical(
+          ErrorCode.INVALID_VALUE,
+          `Function '${funcName}' requires scope '${scope}' which is not declared. Declare it with wireScope. Available scopes: ${available.join(', ') || 'none'}`
+        )
+      }
+    }
+  }
+}

package/src/utils/serialize-inspector-state.ts

@@ -112,14 +112,6 @@ export interface SerializableInspectorState {
           : never,
       ]
     >
-    routePermissions: Array<
-      [
-        string,
-        InspectorState['http']['routePermissions'] extends Map<string, infer V>
-          ? V
-          : never,
-      ]
-    >
   }
   channels: {
     files: string[]
@@ -154,6 +146,8 @@ export interface SerializableInspectorState {
     internalFiles: Array<[string, { path: string; exportedName: string }]>
     exposedMeta: InspectorState['rpc']['exposedMeta']
     exposedFiles: Array<[string, { path: string; exportedName: string }]>
+    remoteMeta: InspectorState['rpc']['remoteMeta']
+    remoteFiles: Array<[string, { path: string; exportedName: string }]>
     invokedFunctions: string[]
     invokedFunctionsByFile?: Array<[string, string[]]>
     usedAddons: string[]
@@ -163,6 +157,10 @@ export interface SerializableInspectorState {
         {
           package: string
           rpcEndpoint?: string
+          remote?: boolean
+          hasAuth?: boolean
+          authCredentialId?: string
+          authSecretId?: string
           secretOverrides?: Record<string, string>
           variableOverrides?: Record<string, string>
           credentialOverrides?: Record<string, string>
@@ -203,6 +201,10 @@ export interface SerializableInspectorState {
     definitions: InspectorState['credentials']['definitions']
     files: string[]
   }
+  scopes: {
+    definitions: InspectorState['scopes']['definitions']
+    files: string[]
+  }
   variables: {
     definitions: InspectorState['variables']['definitions']
     files: string[]
@@ -244,17 +246,6 @@ export interface SerializableInspectorState {
   permissions: {
     definitions: InspectorState['permissions']['definitions']
     instances: InspectorState['permissions']['instances']
-    tagPermissions: Array<
-      [
-        string,
-        InspectorState['permissions']['tagPermissions'] extends Map<
-          string,
-          infer V
-        >
-          ? V
-          : never,
-      ]
-    >
   }
   serviceAggregation: {
     requiredServices: string[]
@@ -344,7 +335,6 @@ export function serializeInspectorState(
       meta: state.http.meta,
       files: Array.from(state.http.files),
       routeMiddleware: Array.from(state.http.routeMiddleware.entries()),
-      routePermissions: Array.from(state.http.routePermissions.entries()),
     },
     channels: {
       files: Array.from(state.channels.files),
@@ -379,6 +369,8 @@ export function serializeInspectorState(
       internalFiles: Array.from(state.rpc.internalFiles.entries()),
       exposedMeta: state.rpc.exposedMeta,
       exposedFiles: Array.from(state.rpc.exposedFiles.entries()),
+      remoteMeta: state.rpc.remoteMeta,
+      remoteFiles: Array.from(state.rpc.remoteFiles.entries()),
       invokedFunctions: Array.from(state.rpc.invokedFunctions),
       invokedFunctionsByFile: Array.from(
         (
@@ -423,6 +415,10 @@ export function serializeInspectorState(
       definitions: state.credentials.definitions,
       files: Array.from(state.credentials.files),
     },
+    scopes: {
+      definitions: state.scopes.definitions,
+      files: Array.from(state.scopes.files),
+    },
     variables: {
       definitions: state.variables.definitions,
       files: Array.from(state.variables.files),
@@ -446,7 +442,6 @@ export function serializeInspectorState(
     permissions: {
       definitions: state.permissions.definitions,
       instances: state.permissions.instances,
-      tagPermissions: Array.from(state.permissions.tagPermissions.entries()),
     },
     serviceAggregation: {
       requiredServices: Array.from(state.serviceAggregation.requiredServices),
@@ -536,7 +531,6 @@ export function deserializeInspectorState(
       meta: data.http.meta,
       files: new Set(data.http.files),
       routeMiddleware: new Map(data.http.routeMiddleware),
-      routePermissions: new Map(data.http.routePermissions),
     },
     channels: {
       files: new Set(data.channels.files),
@@ -571,6 +565,8 @@ export function deserializeInspectorState(
       internalFiles: new Map(data.rpc.internalFiles),
       exposedMeta: data.rpc.exposedMeta,
       exposedFiles: new Map(data.rpc.exposedFiles),
+      remoteMeta: data.rpc.remoteMeta ?? {},
+      remoteFiles: new Map(data.rpc.remoteFiles ?? []),
       invokedFunctions: new Set(data.rpc.invokedFunctions),
       invokedFunctionsByFile: new Map(
         (data.rpc.invokedFunctionsByFile || []).map(
@@ -613,6 +609,10 @@ export function deserializeInspectorState(
       definitions: data.credentials?.definitions || [],
       files: new Set(data.credentials?.files || []),
     },
+    scopes: {
+      definitions: data.scopes?.definitions || [],
+      files: new Set(data.scopes?.files || []),
+    },
     variables: {
       definitions: data.variables?.definitions || [],
       files: new Set(data.variables?.files || []),
@@ -634,7 +634,6 @@ export function deserializeInspectorState(
     permissions: {
       definitions: data.permissions.definitions,
       instances: data.permissions.instances || {},
-      tagPermissions: new Map(data.permissions.tagPermissions),
     },
     serviceAggregation: {
       requiredServices: new Set(data.serviceAggregation.requiredServices),
@@ -654,8 +653,6 @@ export function deserializeInspectorState(
     },
     permissionsGroupsMeta: data.permissionsGroupsMeta || {
       definitions: {},
-      httpGroups: {},
-      tagGroups: {},
     },
     requiredSchemas: new Set(data.requiredSchemas || []),
     openAPISpec: data.openAPISpec || null,

package/src/utils/serialize-permissions-groups-meta.ts

@@ -1,35 +1,7 @@
 import type { InspectorState } from '../types.js'
 
 export const serializePermissionsGroupsMeta = (state: InspectorState) => {
-  const httpGroups: Record<string, any> = {}
-  for (const [pattern, meta] of state.http.routePermissions.entries()) {
-    httpGroups[pattern] = {
-      exportName: meta.exportName,
-      sourceFile: meta.sourceFile,
-      position: meta.position,
-      services: meta.services,
-      count: meta.count,
-      instanceIds: meta.instanceIds,
-      isFactory: meta.isFactory,
-    }
-  }
-
-  const tagGroups: Record<string, any> = {}
-  for (const [tag, meta] of state.permissions.tagPermissions.entries()) {
-    tagGroups[tag] = {
-      exportName: meta.exportName,
-      sourceFile: meta.sourceFile,
-      position: meta.position,
-      services: meta.services,
-      count: meta.count,
-      instanceIds: meta.instanceIds,
-      isFactory: meta.isFactory,
-    }
-  }
-
   return {
     definitions: state.permissions.definitions,
-    httpGroups,
-    tagGroups,
   }
 }

package/src/utils/workflow/derive-workflow-plan.test.ts

@@ -84,7 +84,11 @@ describe('deriveWorkflowPlan', () => {
       } as WorkflowStepMeta,
     ])
     assert.equal(plan.deterministic, false)
-    assert.equal(plan.plannedSteps, undefined, 'loop count is runtime-dependent')
+    assert.equal(
+      plan.plannedSteps,
+      undefined,
+      'loop count is runtime-dependent'
+    )
   })
 
   test('a fanout nested inside a branch still suppresses the plan', () => {
@@ -133,8 +137,42 @@ describe('deriveWorkflowPlan', () => {
       { stepName: 'build' },
       { stepName: '__workflow_suspend:building', displayName: 'Building' },
       { stepName: 'publish' },
-      { stepName: '__workflow_suspend:awaiting_approval', displayName: 'Awaiting approval' },
-      { stepName: '__workflow_suspend:building-image', displayName: 'Building image' },
+      {
+        stepName: '__workflow_suspend:awaiting_approval',
+        displayName: 'Awaiting approval',
+      },
+      {
+        stepName: '__workflow_suspend:building-image',
+        displayName: 'Building image',
+      },
+    ])
+  })
+
+  test('approval steps appear in the plan with __workflow_approval: key and sentence-case displayName', () => {
+    const plan = deriveWorkflowPlan([
+      rpc('build'),
+      { type: 'approval', reason: 'awaiting_approval' } as WorkflowStepMeta,
+      rpc('publish'),
+    ])
+    assert.equal(plan.deterministic, true)
+    assert.deepEqual(plan.plannedSteps, [
+      { stepName: 'build' },
+      {
+        stepName: '__workflow_approval:awaiting_approval',
+        displayName: 'Awaiting approval',
+      },
+      { stepName: 'publish' },
+    ])
+  })
+
+  test('an approval is namespaced apart from a suspend sharing its reason', () => {
+    const plan = deriveWorkflowPlan([
+      { type: 'suspend', reason: 'sign_off' } as WorkflowStepMeta,
+      { type: 'approval', reason: 'sign_off' } as WorkflowStepMeta,
     ])
+    assert.deepEqual(
+      plan.plannedSteps.map((s) => s.stepName),
+      ['__workflow_suspend:sign_off', '__workflow_approval:sign_off']
+    )
   })
 })