@pikku/inspector 0.12.41 → 0.12.43

package/dist/add/add-scope.js

@@ -0,0 +1,146 @@
+import * as ts from 'typescript';
+import { getPropertyValue } from '../utils/get-property-value.js';
+import { ErrorCode } from '../error-codes.js';
+const SEPARATOR = ':';
+const WILDCARD = '*';
+/**
+ * Validates a single scope segment, reporting rather than throwing so the
+ * inspector can surface every problem in one pass.
+ *
+ * @returns true when the segment is usable.
+ */
+const isValidSegment = (segment, scopeName, logger) => {
+    if (segment.length === 0) {
+        logger.critical(ErrorCode.INVALID_VALUE, `Scope '${scopeName}' contains an empty segment.`);
+        return false;
+    }
+    if (segment.includes(SEPARATOR)) {
+        logger.critical(ErrorCode.INVALID_VALUE, `Scope segment '${segment}' in '${scopeName}' contains the '${SEPARATOR}' separator. ` +
+            `Nest scopes with the 'scopes' property instead of embedding '${SEPARATOR}' in a name.`);
+        return false;
+    }
+    if (segment === WILDCARD) {
+        logger.critical(ErrorCode.INVALID_VALUE, `Scope segment '${segment}' in '${scopeName}' is the wildcard. ` +
+            `'${WILDCARD}' is reserved for granting a scope and its descendants, and cannot be declared.`);
+        return false;
+    }
+    return true;
+};
+/**
+ * Recursively extracts a `scopes: { ... }` object literal into nested metadata.
+ */
+const extractScopeNodes = (obj, scopeName, logger) => {
+    const nodes = {};
+    for (const prop of obj.properties) {
+        if (!ts.isPropertyAssignment(prop)) {
+            continue;
+        }
+        let segment;
+        if (ts.isIdentifier(prop.name)) {
+            segment = prop.name.text;
+        }
+        else if (ts.isStringLiteral(prop.name)) {
+            segment = prop.name.text;
+        }
+        if (segment === undefined) {
+            logger.critical(ErrorCode.NON_LITERAL_WIRE_NAME, `Scope '${scopeName}' has a nested scope whose key is not a literal.`);
+            continue;
+        }
+        if (!isValidSegment(segment, scopeName, logger)) {
+            continue;
+        }
+        if (!ts.isObjectLiteralExpression(prop.initializer)) {
+            logger.critical(ErrorCode.INVALID_VALUE, `Nested scope '${segment}' in '${scopeName}' must be an object literal.`);
+            continue;
+        }
+        const node = {};
+        const displayName = getPropertyValue(prop.initializer, 'displayName');
+        if (displayName) {
+            node.displayName = displayName;
+        }
+        const description = getPropertyValue(prop.initializer, 'description');
+        if (description) {
+            node.description = description;
+        }
+        const nestedProp = prop.initializer.properties.find((p) => ts.isPropertyAssignment(p) &&
+            ts.isIdentifier(p.name) &&
+            p.name.text === 'scopes');
+        if (nestedProp &&
+            ts.isPropertyAssignment(nestedProp) &&
+            ts.isObjectLiteralExpression(nestedProp.initializer)) {
+            const nested = extractScopeNodes(nestedProp.initializer, scopeName, logger);
+            if (nested) {
+                node.scopes = nested;
+            }
+        }
+        nodes[segment] = node;
+    }
+    return Object.keys(nodes).length > 0 ? nodes : undefined;
+};
+/**
+ * Unwraps `x as const` / `x as any` so a cast declaration is still extracted
+ * rather than silently skipped.
+ */
+const unwrapAs = (node) => ts.isAsExpression(node) || ts.isSatisfiesExpression(node)
+    ? unwrapAs(node.expression)
+    : node;
+export const addScope = (logger, node, checker, state, _options) => {
+    if (!ts.isCallExpression(node)) {
+        return;
+    }
+    const expression = node.expression;
+    if (!ts.isIdentifier(expression) || expression.text !== 'wireScope') {
+        return;
+    }
+    const firstArg = node.arguments[0];
+    if (!firstArg) {
+        return;
+    }
+    const unwrapped = unwrapAs(firstArg);
+    if (!ts.isObjectLiteralExpression(unwrapped)) {
+        return;
+    }
+    const sourceFile = node.getSourceFile().fileName;
+    // Roots are keyed exactly like the nodes beneath them, so each property of
+    // the call's single argument is one tree.
+    for (const prop of unwrapped.properties) {
+        if (!ts.isPropertyAssignment(prop)) {
+            continue;
+        }
+        let name;
+        if (ts.isIdentifier(prop.name) || ts.isStringLiteral(prop.name)) {
+            name = prop.name.text;
+        }
+        if (name === undefined) {
+            logger.critical(ErrorCode.NON_LITERAL_WIRE_NAME, 'A scope is declared with a key that is not a literal.');
+            continue;
+        }
+        if (!isValidSegment(name, name, logger)) {
+            continue;
+        }
+        if (!ts.isObjectLiteralExpression(prop.initializer)) {
+            logger.critical(ErrorCode.INVALID_VALUE, `Scope '${name}' must be an object literal.`);
+            continue;
+        }
+        const root = prop.initializer;
+        const displayNameValue = getPropertyValue(root, 'displayName');
+        const descriptionValue = getPropertyValue(root, 'description');
+        let scopes;
+        const scopesProp = root.properties.find((p) => ts.isPropertyAssignment(p) &&
+            ts.isIdentifier(p.name) &&
+            p.name.text === 'scopes');
+        if (scopesProp &&
+            ts.isPropertyAssignment(scopesProp) &&
+            ts.isObjectLiteralExpression(scopesProp.initializer)) {
+            scopes = extractScopeNodes(scopesProp.initializer, name, logger);
+        }
+        state.scopes.files.add(sourceFile);
+        state.scopes.definitions.push({
+            name,
+            displayName: displayNameValue || undefined,
+            description: descriptionValue || undefined,
+            scopes,
+            sourceFile,
+        });
+    }
+};

package/dist/add/add-trigger.js

@@ -2,6 +2,7 @@ import * as ts from 'typescript';
 import { getPropertyValue, getCommonWireMetaData, } from '../utils/get-property-value.js';
 import { extractFunctionName, makeContextBasedId, } from '../utils/extract-function-name.js';
 import { getPropertyAssignmentInitializer } from '../utils/type-utils.js';
+import { ensureInlineWiringFunction } from '../utils/ensure-function-metadata.js';
 import { resolveMiddleware } from '../utils/middleware.js';
 import { extractWireNames } from '../utils/post-process.js';
 import { resolveAddonName } from '../utils/resolve-addon-package.js';
@@ -45,6 +46,8 @@ const addWireTrigger = (logger, node, checker, state, firstArg) => {
     if (!nameValue) {
         return;
     }
+    // Register metadata for a func inlined into the wiring (see helper).
+    ensureInlineWiringFunction(state, pikkuFuncId, nameValue, funcInitializer, checker, extracted.isHelper);
     // --- resolve middleware ---
     const middleware = resolveMiddleware(state, obj, tags, checker);
     // --- track used functions/middleware for service aggregation ---

package/dist/add/add-wire-remote-addon.d.ts

@@ -0,0 +1,10 @@
+import * as ts from 'typescript';
+import type { InspectorState, InspectorLogger } from '../types.js';
+/**
+ * Detect wireRemoteAddon({ name: '...', package: '...' }) call expressions and
+ * record the namespace as a **remote** addon declaration. Only name + package
+ * are needed for codegen (serverUrl/auth are runtime closures resolved by the
+ * RPC runner); the `remote` marker tells the consumer's RPC-map generator to
+ * import the addon's `.remote.gen` map instead of `.internal.gen`.
+ */
+export declare function addWireRemoteAddon(node: ts.Node, state: InspectorState, logger: InspectorLogger): void;

package/dist/add/add-wire-remote-addon.js

@@ -0,0 +1,66 @@
+import * as ts from 'typescript';
+/**
+ * Detect wireRemoteAddon({ name: '...', package: '...' }) call expressions and
+ * record the namespace as a **remote** addon declaration. Only name + package
+ * are needed for codegen (serverUrl/auth are runtime closures resolved by the
+ * RPC runner); the `remote` marker tells the consumer's RPC-map generator to
+ * import the addon's `.remote.gen` map instead of `.internal.gen`.
+ */
+export function addWireRemoteAddon(node, state, logger) {
+    if (!ts.isCallExpression(node))
+        return;
+    const { expression, arguments: args } = node;
+    if (!ts.isIdentifier(expression) || expression.text !== 'wireRemoteAddon')
+        return;
+    const [firstArg] = args;
+    if (!firstArg || !ts.isObjectLiteralExpression(firstArg))
+        return;
+    let name;
+    let pkg;
+    // The auth binding is a runtime closure; we only extract the statically
+    // knowable slot names so `pikku verify` can check they exist in the
+    // consumer's own wirings. `hasAuth` distinguishes "public" (omitted) from
+    // "bound via a custom resolve()" (present but no static id).
+    let hasAuth = false;
+    let authCredentialId;
+    let authSecretId;
+    for (const prop of firstArg.properties) {
+        if (!ts.isPropertyAssignment(prop) || !ts.isIdentifier(prop.name))
+            continue;
+        const key = prop.name.text;
+        if (key === 'name' && ts.isStringLiteral(prop.initializer)) {
+            name = prop.initializer.text;
+        }
+        else if (key === 'package' && ts.isStringLiteral(prop.initializer)) {
+            pkg = prop.initializer.text;
+        }
+        else if (key === 'auth' &&
+            ts.isObjectLiteralExpression(prop.initializer)) {
+            hasAuth = true;
+            for (const authProp of prop.initializer.properties) {
+                if (!ts.isPropertyAssignment(authProp) || !ts.isIdentifier(authProp.name))
+                    continue;
+                if (authProp.name.text === 'credentialId' &&
+                    ts.isStringLiteral(authProp.initializer)) {
+                    authCredentialId = authProp.initializer.text;
+                }
+                else if (authProp.name.text === 'secretId' &&
+                    ts.isStringLiteral(authProp.initializer)) {
+                    authSecretId = authProp.initializer.text;
+                }
+            }
+        }
+    }
+    if (!name || !pkg)
+        return;
+    logger.debug(`• Found wireRemoteAddon: ${name} → ${pkg} (remote)`);
+    state.rpc.wireAddonDeclarations.set(name, {
+        package: pkg,
+        remote: true,
+        hasAuth,
+        authCredentialId,
+        authSecretId,
+    });
+    state.rpc.usedAddons.add(name);
+    state.rpc.wireAddonFiles.add(node.getSourceFile().fileName);
+}

package/dist/add/add-workflow-graph.js

@@ -2,6 +2,11 @@ import * as ts from 'typescript';
 import { ErrorCode } from '../error-codes.js';
 import { extractStringLiteral } from '../utils/extract-node-value.js';
 function extractAstValue(expr, refParamName, templateParamName) {
+    // `'GET' as const` / parenthesised values wrap the real initializer — see
+    // through them or the whole property is silently dropped from the meta.
+    while (ts.isAsExpression(expr) || ts.isParenthesizedExpression(expr)) {
+        expr = expr.expression;
+    }
     if (ts.isStringLiteral(expr)) {
         return expr.text;
     }
@@ -113,9 +118,13 @@ function extractInputMapping(node, _checker) {
     const refParamName = node.parameters.length > 0 && ts.isIdentifier(node.parameters[0].name)
         ? node.parameters[0].name.text
         : 'ref';
+    // The canonical form imports `template` from '@pikku/core/workflow' and calls
+    // it inside a single-param `(ref) => (...)` arrow; the older form passes it as
+    // a second arrow parameter. Support both — default to the imported name so a
+    // `template(...)` value is never dropped just because it isn't a 2nd param.
     const templateParamName = node.parameters.length > 1 && ts.isIdentifier(node.parameters[1].name)
         ? node.parameters[1].name.text
-        : undefined;
+        : 'template';
     const input = {};
     for (const prop of bodyObj.properties) {
         if (!ts.isPropertyAssignment(prop))
@@ -138,6 +147,12 @@ function extractInputMapping(node, _checker) {
  * Extract next config (string, array, or record)
  */
 function extractNextConfig(node, _checker) {
+    // Key-based branch `next` (`{ key: [targets] }`) is authored with an `as any`
+    // cast because the graph's NextConfig can't narrow record targets to node-id
+    // literals; see through that (and parens) so the routing survives into the meta.
+    while (ts.isAsExpression(node) || ts.isParenthesizedExpression(node)) {
+        node = node.expression;
+    }
     if (ts.isStringLiteral(node)) {
         return node.text;
     }
@@ -207,6 +222,7 @@ function extractWorkflowGraphConfig(configArg, checker) {
     let name;
     let description;
     let tags;
+    let notes;
     let disabled;
     let nodesNode;
     let configNode;
@@ -231,6 +247,12 @@ function extractWorkflowGraphConfig(configArg, checker) {
                 .filter(ts.isStringLiteral)
                 .map((el) => el.text);
         }
+        else if (propName === 'notes' &&
+            ts.isArrayLiteralExpression(prop.initializer)) {
+            notes = prop.initializer.elements
+                .filter(ts.isStringLiteral)
+                .map((el) => el.text);
+        }
         else if (propName === 'nodes' &&
             ts.isObjectLiteralExpression(prop.initializer)) {
             nodesNode = prop.initializer;
@@ -240,7 +262,7 @@ function extractWorkflowGraphConfig(configArg, checker) {
             configNode = prop.initializer;
         }
     }
-    return { name, description, tags, disabled, nodesNode, configNode };
+    return { name, description, tags, notes, disabled, nodesNode, configNode };
 }
 /**
  * Extract graph nodes from the new pikkuWorkflowGraph format
@@ -283,6 +305,7 @@ function extractGraphFromNewFormat(nodesNode, configNode, checker, state) {
             onError: undefined,
             retries: undefined,
             retryDelay: undefined,
+            notes: undefined,
         };
     }
     // Extract config for each node from 'config' property
@@ -305,6 +328,7 @@ function extractGraphFromNewFormat(nodesNode, configNode, checker, state) {
                     nodes[nodeId].input = nodeConfig.input;
                     nodes[nodeId].retries = nodeConfig.retries;
                     nodes[nodeId].retryDelay = nodeConfig.retryDelay;
+                    nodes[nodeId].notes = nodeConfig.notes;
                 }
             }
         }
@@ -320,6 +344,7 @@ function extractNodeConfigFromObject(obj, checker) {
     let input = {};
     let retries = undefined;
     let retryDelay = undefined;
+    let notes = undefined;
     for (const prop of obj.properties) {
         if (!ts.isPropertyAssignment(prop) || !ts.isIdentifier(prop.name))
             continue;
@@ -346,8 +371,11 @@ function extractNodeConfigFromObject(obj, checker) {
                 retryDelay = prop.initializer.text;
             }
         }
+        else if (propName === 'notes') {
+            notes = extractStringLiteral(prop.initializer, checker);
+        }
     }
-    return { next, onError, input, retries, retryDelay };
+    return { next, onError, input, retries, retryDelay, notes };
 }
 /**
  * Inspector for pikkuWorkflowGraph() calls
@@ -402,6 +430,7 @@ export const addWorkflowGraph = (logger, node, checker, state) => {
         source: 'graph',
         description: graphConfig.description,
         tags: graphConfig.tags,
+        notes: graphConfig.notes,
         nodes: graphNodes,
         entryNodeIds,
     };

package/dist/error-codes.d.ts

@@ -22,6 +22,9 @@ export declare enum ErrorCode {
     EXPECT_EVENTUALLY_SCENARIO_ONLY = "PKU675",
     WORKFLOW_ORCHESTRATOR_NOT_CONFIGURED = "PKU600",
     INVALID_DSL_WORKFLOW = "PKU641",
+    WORKFLOW_GRAPH_ADDON_NOT_WIRED = "PKU642",
+    REMOTE_ADDON_NOT_DEV_DEPENDENCY = "PKU338",
+    REMOTE_ADDON_AUTH_UNRESOLVED = "PKU339",
     DB_COLUMN_NAME_TYPE_CONTRADICTION = "PKU480",
     DB_JSON_COLUMN_UNTYPED = "PKU481",
     DB_FORMAT_ON_NON_STRING = "PKU482",

package/dist/error-codes.js

@@ -24,6 +24,10 @@ export var ErrorCode;
     ErrorCode["EXPECT_EVENTUALLY_SCENARIO_ONLY"] = "PKU675";
     ErrorCode["WORKFLOW_ORCHESTRATOR_NOT_CONFIGURED"] = "PKU600";
     ErrorCode["INVALID_DSL_WORKFLOW"] = "PKU641";
+    ErrorCode["WORKFLOW_GRAPH_ADDON_NOT_WIRED"] = "PKU642";
+    // Remote addon (wireRemoteAddon) validation
+    ErrorCode["REMOTE_ADDON_NOT_DEV_DEPENDENCY"] = "PKU338";
+    ErrorCode["REMOTE_ADDON_AUTH_UNRESOLVED"] = "PKU339";
     // Database schema codegen warnings
     ErrorCode["DB_COLUMN_NAME_TYPE_CONTRADICTION"] = "PKU480";
     ErrorCode["DB_JSON_COLUMN_UNTYPED"] = "PKU481";

package/dist/inspector.js

@@ -5,7 +5,8 @@ import { visitSetup, visitFunctions, visitRoutes } from './visit.js';
 import { TypesMap } from './types-map.js';
 import { getFilesAndMethods } from './utils/get-files-and-methods.js';
 import { findCommonAncestor } from './utils/find-root-dir.js';
-import { aggregateRequiredServices, stampAuthHandlerServices, validateAgentModels, validateSecretOverrides, validateVariableOverrides, validateCredentialOverrides, computeResolvedIOTypes, computeMiddlewareGroupsMeta, computePermissionsGroupsMeta, computeRequiredSchemas, computeDiagnostics, validateSchemaWiringSeparation, } from './utils/post-process.js';
+import { createNestedProjectFilter } from './utils/nested-project-filter.js';
+import { aggregateRequiredServices, stampAuthHandlerServices, validateAgentModels, validateSecretOverrides, validateVariableOverrides, validateCredentialOverrides, validateRemoteAddonDependencies, validateRemoteAddonAuth, validateScopeReferences, computeResolvedIOTypes, computeMiddlewareGroupsMeta, computePermissionsGroupsMeta, computeRequiredSchemas, computeDiagnostics, validateSchemaWiringSeparation, validateWorkflowGraphAddons, } from './utils/post-process.js';
 import { generateOpenAPISpec } from './utils/serialize-openapi-json.js';
 import { pikkuState } from '@pikku/core/internal';
 import { resolveLatestVersions } from './utils/resolve-versions.js';
@@ -58,7 +59,6 @@ export function getInitialInspectorState(rootDir) {
             },
             files: new Set(),
             routeMiddleware: new Map(),
-            routePermissions: new Map(),
         },
         channels: {
             files: new Set(),
@@ -93,6 +93,8 @@ export function getInitialInspectorState(rootDir) {
             internalFiles: new Map(),
             exposedMeta: {},
             exposedFiles: new Map(),
+            remoteMeta: {},
+            remoteFiles: new Map(),
             invokedFunctions: new Set(),
             invokedFunctionsByFile: new Map(),
             usedAddons: new Set(),
@@ -134,6 +136,10 @@ export function getInitialInspectorState(rootDir) {
             definitions: [],
             files: new Set(),
         },
+        scopes: {
+            definitions: [],
+            files: new Set(),
+        },
         variables: {
             definitions: [],
             files: new Set(),
@@ -159,7 +165,6 @@ export function getInitialInspectorState(rootDir) {
         permissions: {
             definitions: {},
             instances: {},
-            tagPermissions: new Map(),
         },
         serviceAggregation: {
             requiredServices: new Set(),
@@ -183,8 +188,6 @@ export function getInitialInspectorState(rootDir) {
         },
         permissionsGroupsMeta: {
             definitions: {},
-            httpGroups: {},
-            tagGroups: {},
         },
         requiredSchemas: new Set(),
         openAPISpec: null,
@@ -225,17 +228,22 @@ export const inspect = async (logger, routeFiles, options = {}) => {
     const startSourceFiles = performance.now();
     // node_modules under rootDir (e.g. a locally-installed addon) is a
     // dependency, not project source — scanning it double-counts the addon's
-    // own application types (CoreConfig/Services/SingletonServices).
+    // own application types (CoreConfig/Services/SingletonServices). Nested
+    // pikku projects (a workspace addon at packages/<addon>) are the same case:
+    // TS resolves the node_modules symlink to its realpath under rootDir, so
+    // the node_modules check alone misses them.
     // Sort by file name so the sweeps populate state in a stable order. The
     // program's own file order depends on glob + import-graph resolution, which
     // varies run to run — leaving generated meta keys (and anything serialized
     // in insertion order) non-reproducible across identical `pikku all` runs.
     // Safe because function registration is a dedicated pass (visitFunctions)
     // that completes before any order-sensitive wiring resolution in visitRoutes.
+    const isNestedProjectFile = createNestedProjectFilter(rootDir);
     const sourceFiles = program
         .getSourceFiles()
         .filter((sf) => sf.fileName.startsWith(rootDir) &&
-        !sf.fileName.includes('/node_modules/'))
+        !sf.fileName.includes('/node_modules/') &&
+        !isNestedProjectFile(sf.fileName))
         .sort((a, b) => a.fileName < b.fileName ? -1 : a.fileName > b.fileName ? 1 : 0);
     logger.debug(`Got source files in ${(performance.now() - startSourceFiles).toFixed(2)}ms`);
     const state = getInitialInspectorState(rootDir);
@@ -301,6 +309,7 @@ export const inspect = async (logger, routeFiles, options = {}) => {
         computePermissionsGroupsMeta(state);
         computeDiagnostics(state);
         validateSchemaWiringSeparation(logger, state);
+        validateWorkflowGraphAddons(logger, state);
         if (options.openAPI) {
             state.openAPISpec = await generateOpenAPISpec(logger, state.functions.meta, state.http.meta, state.schemas, options.openAPI.additionalInfo, pikkuState(null, 'misc', 'errors'));
         }
@@ -308,6 +317,9 @@ export const inspect = async (logger, routeFiles, options = {}) => {
         validateSecretOverrides(logger, state);
         validateVariableOverrides(logger, state);
         validateCredentialOverrides(logger, state);
+        validateRemoteAddonDependencies(logger, state);
+        validateRemoteAddonAuth(logger, state);
+        validateScopeReferences(logger, state);
     }
     state.program = program;
     return state;

package/dist/types.d.ts

@@ -13,6 +13,7 @@ import type { CLICommandMeta } from '@pikku/core/cli';
 import type { NodesMeta } from '@pikku/core/node';
 import type { SecretDefinitions } from '@pikku/core/secret';
 import type { CredentialDefinitions } from '@pikku/core/credential';
+import type { ScopeDefinitions } from '@pikku/core/scope';
 import type { VariableDefinitions } from '@pikku/core/variable';
 import type { TypesMap } from './types-map.js';
 import type { FunctionsMeta, FunctionServicesMeta, FunctionWiresMeta, JSONValue } from '@pikku/core';
@@ -39,21 +40,11 @@ export interface MiddlewareGroupMeta {
     instanceIds: string[];
     isFactory: boolean;
 }
-export interface PermissionGroupMeta {
-    exportName: string | null;
-    sourceFile: string;
-    position: number;
-    services: FunctionServicesMeta;
-    count: number;
-    instanceIds: string[];
-    isFactory: boolean;
-}
 export interface InspectorHTTPState {
     metaInputTypes: MetaInputTypes;
     meta: HTTPWiringsMeta;
     files: Set<string>;
     routeMiddleware: Map<string, MiddlewareGroupMeta>;
-    routePermissions: Map<string, PermissionGroupMeta>;
 }
 /**
  * Schema vendor types for Standard Schema compliant validators
@@ -184,7 +175,6 @@ export interface InspectorPermissionInstance {
 export interface InspectorPermissionState {
     definitions: Record<string, InspectorPermissionDefinition>;
     instances: Record<string, InspectorPermissionInstance>;
-    tagPermissions: Map<string, PermissionGroupMeta>;
 }
 export type InspectorFilters = {
     names?: string[];
@@ -418,6 +408,12 @@ export interface InspectorState {
             path: string;
             exportedName: string;
         }>;
+        /** Functions marked `remote: true` — the surface a wireRemoteAddon consumer imports */
+        remoteMeta: Record<string, string>;
+        remoteFiles: Map<string, {
+            path: string;
+            exportedName: string;
+        }>;
         invokedFunctions: Set<string>;
         invokedFunctionsByFile: Map<string, Set<string>>;
         usedAddons: Set<string>;
@@ -425,6 +421,14 @@ export interface InspectorState {
             package: string;
             rpcEndpoint?: string;
             mcp?: boolean;
+            /** True when declared via `wireRemoteAddon` — import the addon's `.remote.gen` map, not `.internal.gen` */
+            remote?: boolean;
+            /** wireRemoteAddon: whether an `auth` binding was supplied (vs a public surface) */
+            hasAuth?: boolean;
+            /** wireRemoteAddon: statically-known `auth.credentialId`, for verify */
+            authCredentialId?: string;
+            /** wireRemoteAddon: statically-known `auth.secretId`, for verify */
+            authSecretId?: string;
             secretOverrides?: Record<string, string>;
             variableOverrides?: Record<string, string>;
             credentialOverrides?: Record<string, string>;
@@ -480,6 +484,10 @@ export interface InspectorState {
         definitions: CredentialDefinitions;
         files: Set<string>;
     };
+    scopes: {
+        definitions: ScopeDefinitions;
+        files: Set<string>;
+    };
     variables: {
         definitions: VariableDefinitions;
         files: Set<string>;
@@ -518,8 +526,6 @@ export interface InspectorState {
     };
     permissionsGroupsMeta: {
         definitions: Record<string, InspectorPermissionDefinition>;
-        httpGroups: Record<string, PermissionGroupMeta>;
-        tagGroups: Record<string, PermissionGroupMeta>;
     };
     requiredSchemas: Set<string>;
     openAPISpec: Record<string, any> | null;

package/dist/utils/custom-types-generator.js

@@ -5,7 +5,8 @@
  * ts-json-schema-generator can discover inline/custom types from typesMap.
  */
 export function sanitizeTypeName(name) {
-    return name.replace(/[^a-zA-Z0-9_$]/g, '_');
+    const sanitized = name.replace(/[^a-zA-Z0-9_$]/g, '_');
+    return /^[0-9]/.test(sanitized) ? `_${sanitized}` : sanitized;
 }
 const CLASSIFICATION_WRAPPERS = new Set(['Private', 'Pii', 'Secret']);
 function findMatchingAngleBracket(type, startIndex) {

package/dist/utils/ensure-function-metadata.d.ts

@@ -7,3 +7,18 @@ import type { InspectorState } from '../types.js';
  * extracts tags/middleware/permissions from the pikkuFunc() config.
  */
 export declare function ensureFunctionMetadata(state: InspectorState, pikkuFuncId: string, fallbackName?: string, funcInitializer?: ts.Node, checker?: ts.TypeChecker, isHelper?: boolean): void;
+/**
+ * Register metadata for a `func:` inlined into a wiring (queue/scheduler/
+ * trigger/gateway/…).
+ *
+ * An inline function has no exported name, so `addFunctions` skips it (it bails
+ * on `__temp_` ids) and only the wiring's context-based id exists. Without this
+ * the wiring points at a function that was never registered and the worker
+ * resolves to nothing at runtime ("Missing generated metadata for ...").
+ *
+ * The stub also carries no session info, so the runtime would treat it as
+ * session-required and every invocation would fail with "Authentication
+ * required". Derive `sessionless` from the helper the function was built with —
+ * the same rule `addFunctions` applies to named ones (`!== 'pikkuFunc'`).
+ */
+export declare function ensureInlineWiringFunction(state: InspectorState, pikkuFuncId: string, fallbackName: string | undefined, funcInitializer: ts.Node, checker: ts.TypeChecker, isHelper?: boolean): void;

package/dist/utils/ensure-function-metadata.js

@@ -207,6 +207,30 @@ export function ensureFunctionMetadata(state, pikkuFuncId, fallbackName, funcIni
         }
     }
 }
+/**
+ * Register metadata for a `func:` inlined into a wiring (queue/scheduler/
+ * trigger/gateway/…).
+ *
+ * An inline function has no exported name, so `addFunctions` skips it (it bails
+ * on `__temp_` ids) and only the wiring's context-based id exists. Without this
+ * the wiring points at a function that was never registered and the worker
+ * resolves to nothing at runtime ("Missing generated metadata for ...").
+ *
+ * The stub also carries no session info, so the runtime would treat it as
+ * session-required and every invocation would fail with "Authentication
+ * required". Derive `sessionless` from the helper the function was built with —
+ * the same rule `addFunctions` applies to named ones (`!== 'pikkuFunc'`).
+ */
+export function ensureInlineWiringFunction(state, pikkuFuncId, fallbackName, funcInitializer, checker, isHelper) {
+    ensureFunctionMetadata(state, pikkuFuncId, fallbackName, funcInitializer, checker, isHelper);
+    const meta = state.functions.meta[pikkuFuncId];
+    if (meta &&
+        meta.sessionless === undefined &&
+        ts.isCallExpression(funcInitializer) &&
+        ts.isIdentifier(funcInitializer.expression)) {
+        meta.sessionless = funcInitializer.expression.text !== 'pikkuFunc';
+    }
+}
 function populateTypesLookup(state, pikkuFuncId, funcInitializer, checker) {
     const typeArgs = funcInitializer.typeArguments;
     if (typeArgs && typeArgs.length >= 1) {

package/dist/utils/filter-inspector-state.js

@@ -334,6 +334,8 @@ export function filterInspectorState(state, filters, logger) {
             internalFiles: new Map(state.rpc.internalFiles),
             exposedMeta: { ...state.rpc.exposedMeta },
             exposedFiles: new Map(state.rpc.exposedFiles),
+            remoteMeta: { ...state.rpc.remoteMeta },
+            remoteFiles: new Map(state.rpc.remoteFiles),
             invokedFunctions: new Set(state.rpc.invokedFunctions),
         },
         cli: {
@@ -746,6 +748,13 @@ export function filterInspectorState(state, filters, logger) {
                 filteredState.rpc.exposedFiles.delete(key);
             }
         }
+        for (const key of Object.keys(filteredState.rpc.remoteMeta)) {
+            const targetFuncId = filteredState.rpc.remoteMeta[key];
+            if (!survivingFuncIds.has(targetFuncId) && !survivingFuncIds.has(key)) {
+                delete filteredState.rpc.remoteMeta[key];
+                filteredState.rpc.remoteFiles.delete(key);
+            }
+        }
         // Prune invokedFunctions to match surviving functions
         for (const funcId of filteredState.rpc.invokedFunctions) {
             if (!survivingFuncIds.has(funcId)) {

package/dist/utils/get-property-value.d.ts

@@ -1,9 +1,14 @@
 import * as ts from 'typescript';
 import { ErrorCode } from '../error-codes.js';
+export declare const getArrayPropertyValue: (obj: ts.ObjectLiteralExpression, propertyName: string) => string[] | null;
 /**
- * Extracts an array of strings from an object property.
+ * Extracts a string->string record from an object property.
+ *
+ * `getPropertyValue` falls through to `getText()` for an object literal, which
+ * returns the raw source text rather than the record — so callers that need the
+ * entries (e.g. oauth2 `additionalParams`) must use this instead.
  */
-export declare const getArrayPropertyValue: (obj: ts.ObjectLiteralExpression, propertyName: string) => string[] | null;
+export declare const getRecordPropertyValue: (obj: ts.ObjectLiteralExpression, propertyName: string) => Record<string, string> | null;
 /**
  * Wiring identity fields (`name`, `secretId`, `variableId`, …) are read
  * STATICALLY from source — a const or variable reference is keyed by its