@pikku/inspector 0.12.42 → 0.12.43

package/CHANGELOG.md

@@ -1,3 +1,101 @@
+## 0.12.43
+
+### Patch Changes
+
+- c478794: Simplify authorization to be session + function based (#972). Permissions are now function-scoped only: global permissions AND together, a function's own permissions OR together, and the two are independent gates that both must pass — a broad global can no longer satisfy an admin-only function. Removed wire-, tag-, and HTTP-route-level permissions (`addTagPermission`, `addHTTPPermission`, wire-level `permissions` on HTTP/channel/MCP wirings). Tags are now organizational only. `auth` (session presence) and tag/HTTP middleware are unchanged.
+- b714fd4: Merge an addon's credential meta into the consuming app during inspection, the
+  same way addon secrets and variables are already merged. Without this, a
+  credential declared by an addon (e.g. an OAuth2 integration) never reached the
+  app's `CREDENTIAL_OAUTH2_CONFIGS`, so the `credential-oauth` provider and the
+  credential service could not resolve it — the addon's Connect flow and status
+  silently no-op'd. Addon credentials are added as fallbacks: an app-declared
+  credential of the same name still wins.
+- cb079cc: `pikkuAIAgent` gains a `workflows: []` capability: a referenced workflow is exposed to the LLM as a tool that runs inline and returns its output.
+- 13474a6: Generate a `ScopeId` union from `wireScope` declarations.
+
+  `pikku all` now emits `.pikku/scopes/pikku-scopes.gen.ts` with a `ScopeId` union
+  of every declared scope, plus a wildcard form for each node that has
+  descendants. A project's generated `pikkuFunc` narrows `scopes` to that union,
+  so an undeclared scope is a compile error with editor autocomplete:
+
+  ```ts
+  wireScope({ admin: { scopes: { invoices: { scopes: { create: {} } } } } })
+
+  pikkuFunc({
+    scopes: ['admin:invoices:create'],  // ✓ autocompleted
+    func: ...,
+  })
+
+  pikkuFunc({
+    scopes: ['admin:invoice:create'],   // ✗ compile error (typo)
+    func: ...,
+  })
+  ```
+
+  The inspector independently rejects undeclared scopes, so a cast that defeats
+  the compiler is still caught at build time.
+
+  Also fixes `getArrayPropertyValue` dropping any array behind a cast — idiomatic
+  `tags: ['a'] as const` was previously invisible to the inspector and silently
+  omitted from meta.
+
+- ca0d14f: Apply `credentialOverrides` when merging an addon's credentials into the consuming app, mirroring the existing `secretOverrides`/`variableOverrides` handling. Previously the credentials merge ignored overrides and always registered the addon's logical credential name, so a second instance of the same package (`wireAddon` with a `credentialOverrides` map) failed `validateCredentialOverrides` and both instances shared one OAuth provider. Now each override's resolved name is provisioned as its own credential — and since the credential name doubles as the better-auth providerId, two instances surface two distinct providers instead of a shared account pool.
+- 13474a6: feat: propagate an addon's declared scopes to the host
+
+  An addon can now declare scopes with `wireScope`, and a host that wires it picks
+  them up: they merge into the host's `ScopeId` union and its declared set, so a
+  host function can require an addon scope and the `pikku_scopes` foreign key
+  accepts granting one. This mirrors how addon secrets and variables are loaded.
+
+  The generated `pikku-scopes.gen.ts` now imports its metadata sidecar and derives
+  `SCOPES` from it, rather than inlining the list. TypeScript only emits a `.json`
+  into the build output when something imports it, and an addon publishes only
+  that output — without the import, an addon's scopes never reached a host.
+
+- cb079cc: `pikkuWorkflowGraph` nodes accept an optional `notes?: string` and the graph an optional `notes?: string[]`; notes are documentation only and excluded from `graphHash`.
+- cb079cc: Fix two corpus type-check failures: n8n `graph:sort`/`graph:summarize` enum rows now emit `as const`, and the inspector's `sanitizeTypeName` prefixes an underscore when a name starts with a digit.
+- 8601505: Make `wireCredential` the single source of truth for an addon's OAuth2 config: `pikku-credentials.gen.ts` exports `CREDENTIAL_OAUTH2_CONFIGS`, generated services import from it, the OpenAPI importer emits a `wireCredential`, and the inspector now extracts `oauth2.additionalParams`.
+- 70fa400: Add outgoing webhooks — `webhookService.send()` enqueues signed deliveries onto a retrying queue, `@pikku/kysely`'s `KyselyWebhookService` persists per-attempt delivery history, and `@pikku/console` gains a read-only `/webhooks` page; also caches resolved secrets in `TypedSecretService` and registers inline-`func` metadata for queue/scheduler/trigger/gateway wirings.
+- 3c75366: Key `secretOverrides`/`variableOverrides` on the secretId/variableId (the string the addon actually reads by — its typed map is keyed by id, e.g. `getSecret('MAILGUN_CREDENTIALS')`), not the logical meta name. The runtime aliaser already keys on the id, but the inspector merge + validation keyed on the logical name, so a correctly-keyed override failed validation and never provisioned its target whenever an addon's logical name differed from its id (the common case — `mailgun`/`MAILGUN_CREDENTIALS`). The existing test masked it by using a secret whose name equalled its id. The merge now resolves and provisions by id (with a name-fallback for older meta), validation checks ids, and the console install codegen generates overrides keyed by id.
+- 7b2ea23: `wireAddon` can install one addon package as multiple named instances, each with its own per-instance singleton services and `secretOverrides`/`variableOverrides`/`credentialOverrides` that alias logical names to real project secrets/variables/credentials.
+- 13474a6: Extract `wireScope` declarations and validate scope references.
+
+  Functions referencing a scope that no `wireScope` declares now fail the build
+  with an `INVALID_VALUE` critical listing the available scopes, so a typo like
+  `admin:invoice:create` is caught at codegen rather than at runtime.
+
+  `wireScope` declarations wrapped in a cast (`as const`, `as any`) are unwrapped
+  before extraction rather than being silently skipped.
+
+- d2a6eea: Add `wireRemoteAddon` — consume a hosted addon's `remote: true` RPCs transparently over HTTP, with the addon installed as a devDependency (types only). `rpc('ns:fn', input)` dispatches to the host's `/remote/rpc/:rpcName`, authenticating as a client with a token bound from a local source (`{ credentialId }` per-user, `{ secretId }` platform, or a custom `resolve()`), or omitted for a public surface. This is any-machine → hosted-library client auth, distinct from the trusted mesh (`PIKKU_REMOTE_SECRET`). A new `.remote.gen.d.ts` RPC map exposes only the `remote: true` surface to consumers. `pikku` verify errors if a `wireRemoteAddon` package is a production dependency (or missing) instead of a devDependency, and if a bound `credentialId`/`secretId` isn't wired.
+- 30e62ee: Add `workflow.approval(reason, { schema, expiry })` — a return-valued, expiring human-in-the-loop gate that stays closed until a decision is recorded (via `workflowService.approveStep` or `POST /workflow/:workflowName/approve/:runId`), unlike the one-shot `workflow.suspend()`.
+- Updated dependencies [7ab5287]
+- Updated dependencies [e86bc17]
+- Updated dependencies [a9b96a0]
+- Updated dependencies [3f7fc54]
+- Updated dependencies [c478794]
+- Updated dependencies [3f04ae4]
+- Updated dependencies [90d9f04]
+- Updated dependencies [cb079cc]
+- Updated dependencies [cb079cc]
+- Updated dependencies [0a7db82]
+- Updated dependencies [981c4db]
+- Updated dependencies [13474a6]
+- Updated dependencies [5a2b0d5]
+- Updated dependencies [13474a6]
+- Updated dependencies [ee040dc]
+- Updated dependencies [cb079cc]
+- Updated dependencies [13474a6]
+- Updated dependencies [9f0d0eb]
+- Updated dependencies [13474a6]
+- Updated dependencies [70fa400]
+- Updated dependencies [7b2ea23]
+- Updated dependencies [1dc77d5]
+- Updated dependencies [416606c]
+- Updated dependencies [d2a6eea]
+- Updated dependencies [30e62ee]
+  - @pikku/core@0.12.64
+
 ## 0.12.42
 
 ### Patch Changes

package/dist/add/add-addon-bans.js

@@ -7,6 +7,7 @@ import { ErrorCode } from '../error-codes.js';
  */
 const BANNED_WIRINGS = new Set([
     'wireAddon',
+    'wireRemoteAddon',
     'wireChannel',
     'wireCLI',
     'wireGateway',

package/dist/add/add-ai-agent.d.ts

@@ -1,2 +1,4 @@
-import type { AddWiring } from '../types.js';
+import * as ts from 'typescript';
+import type { AddWiring, InspectorLogger } from '../types.js';
+export declare function resolveWorkflowReferences(obj: ts.ObjectLiteralExpression, checker: ts.TypeChecker, agentName: string, logger: InspectorLogger): string[] | null;
 export declare const addAIAgent: AddWiring;

package/dist/add/add-ai-agent.js

@@ -83,6 +83,81 @@ function resolveAgentReferences(obj, checker, agentName, logger) {
     }
     return resolved.length > 0 ? resolved : null;
 }
+export function resolveWorkflowReferences(obj, checker, agentName, logger) {
+    const property = obj.properties.find((p) => ts.isPropertyAssignment(p) &&
+        ts.isIdentifier(p.name) &&
+        p.name.text === 'workflows');
+    if (!property || !ts.isPropertyAssignment(property)) {
+        return null;
+    }
+    const initializer = property.initializer;
+    if (!ts.isArrayLiteralExpression(initializer)) {
+        return null;
+    }
+    const resolved = [];
+    for (const element of initializer.elements) {
+        if (ts.isStringLiteral(element)) {
+            logger.critical(ErrorCode.INVALID_VALUE, `AI agent '${agentName}' workflows array contains a string literal '${element.text}'. ` +
+                `Use a workflow reference instead (e.g., ref('<workflowName>') or import the pikkuWorkflowGraph variable).`);
+            continue;
+        }
+        if (ts.isCallExpression(element) && ts.isIdentifier(element.expression)) {
+            const calleeName = element.expression.text;
+            if (calleeName === 'ref' || calleeName === 'workflow') {
+                const [firstArg] = element.arguments;
+                if (firstArg && ts.isStringLiteral(firstArg)) {
+                    resolved.push(firstArg.text);
+                    continue;
+                }
+            }
+        }
+        if (ts.isIdentifier(element)) {
+            const name = resolveIdentifierToWorkflowName(element, checker);
+            if (name) {
+                resolved.push(name);
+                continue;
+            }
+            logger.critical(ErrorCode.INVALID_VALUE, `AI agent '${agentName}' workflows array contains identifier '${element.text}' ` +
+                `that could not be resolved to a pikkuWorkflowGraph.`);
+        }
+    }
+    return resolved.length > 0 ? resolved : null;
+}
+function resolveIdentifierToWorkflowName(identifier, checker) {
+    const symbol = checker.getSymbolAtLocation(identifier);
+    if (!symbol)
+        return null;
+    let resolved = symbol;
+    if (resolved.flags & ts.SymbolFlags.Alias) {
+        resolved = checker.getAliasedSymbol(resolved) ?? resolved;
+    }
+    const decl = resolved.valueDeclaration ?? resolved.declarations?.[0];
+    if (!decl)
+        return null;
+    if (ts.isVariableDeclaration(decl) && decl.initializer) {
+        if (ts.isCallExpression(decl.initializer) &&
+            ts.isIdentifier(decl.initializer.expression) &&
+            (decl.initializer.expression.text === 'pikkuWorkflowGraph' ||
+                decl.initializer.expression.text === 'pikkuWorkflow' ||
+                decl.initializer.expression.text === 'pikkuWorkflowComplex')) {
+            const firstArg = decl.initializer.arguments[0];
+            if (firstArg && ts.isObjectLiteralExpression(firstArg)) {
+                for (const prop of firstArg.properties) {
+                    if (ts.isPropertyAssignment(prop) &&
+                        ts.isIdentifier(prop.name) &&
+                        prop.name.text === 'name' &&
+                        ts.isStringLiteral(prop.initializer)) {
+                        return prop.initializer.text;
+                    }
+                }
+            }
+            if (ts.isIdentifier(decl.name)) {
+                return decl.name.text;
+            }
+        }
+    }
+    return null;
+}
 function resolveIdentifierToRpcName(identifier, checker) {
     const symbol = checker.getSymbolAtLocation(identifier);
     if (!symbol)
@@ -181,6 +256,12 @@ export const addAIAgent = (logger, node, checker, state, options) => {
             }
         }
         const agentsValue = resolveAgentReferences(obj, checker, nameValue || '', logger);
+        const workflowsValue = resolveWorkflowReferences(obj, checker, nameValue || '', logger);
+        if (workflowsValue) {
+            for (const workflowName of workflowsValue) {
+                state.workflows.invokedWorkflows.add(workflowName);
+            }
+        }
         if (!nameValue) {
             logger.critical(ErrorCode.MISSING_NAME, "AI agent is missing the required 'name' property.");
             return;
@@ -307,6 +388,7 @@ export const addAIAgent = (logger, node, checker, state, options) => {
             }),
             ...(toolsValue !== null && { tools: toolsValue }),
             ...(agentsValue !== null && { agents: agentsValue }),
+            ...(workflowsValue !== null && { workflows: workflowsValue }),
             tags,
             inputSchema,
             outputSchema,

package/dist/add/add-credential.js

@@ -1,5 +1,5 @@
 import * as ts from 'typescript';
-import { getPropertyValue, getArrayPropertyValue, assertStringLiteralProperty, } from '../utils/get-property-value.js';
+import { getPropertyValue, getArrayPropertyValue, getRecordPropertyValue, assertStringLiteralProperty, } from '../utils/get-property-value.js';
 import { ErrorCode } from '../error-codes.js';
 import { detectSchemaVendorOrError } from '../utils/detect-schema-vendor.js';
 export const addCredential = (logger, node, checker, state, _options) => {
@@ -81,6 +81,7 @@ export const addCredential = (logger, node, checker, state, _options) => {
             const tokenUrl = getPropertyValue(oauth2Obj, 'tokenUrl');
             const scopes = getArrayPropertyValue(oauth2Obj, 'scopes');
             const pkce = getPropertyValue(oauth2Obj, 'pkce');
+            const additionalParams = getRecordPropertyValue(oauth2Obj, 'additionalParams');
             if (appCredentialSecretId && authorizationUrl && tokenUrl && scopes) {
                 oauth2 = {
                     appCredentialSecretId,
@@ -89,6 +90,7 @@ export const addCredential = (logger, node, checker, state, _options) => {
                     tokenUrl,
                     scopes,
                     pkce: pkce || undefined,
+                    additionalParams: additionalParams || undefined,
                 };
             }
         }

package/dist/add/add-functions.js

@@ -4,7 +4,7 @@ import { extractFunctionName, funcIdToTypeName, } from '../utils/extract-functio
 import { extractFunctionNode } from '../utils/extract-function-node.js';
 import { extractUsedWires } from '../utils/extract-services.js';
 import { formatVersionedId, parseVersionedId } from '@pikku/core';
-import { getPropertyValue, getCommonWireMetaData, } from '../utils/get-property-value.js';
+import { getPropertyValue, getArrayPropertyValue, getCommonWireMetaData, } from '../utils/get-property-value.js';
 import { canonicalJSON, hashString } from '../utils/hash.js';
 import { resolveMiddleware } from '../utils/middleware.js';
 import { resolvePermissions } from '../utils/permissions.js';
@@ -304,6 +304,7 @@ export const addFunctions = (logger, node, checker, state, options) => {
     let workflowQueued;
     let workflowRetries;
     let workflowTimeout;
+    let scopes;
     let version;
     let objectNode;
     let nodeDisplayName = null;
@@ -374,6 +375,7 @@ export const addFunctions = (logger, node, checker, state, options) => {
         workflowQueued = getPropertyValue(firstArg, 'workflowQueued');
         workflowRetries = getPropertyValue(firstArg, 'workflowRetries');
         workflowTimeout = getPropertyValue(firstArg, 'workflowTimeout');
+        scopes = getArrayPropertyValue(firstArg, 'scopes') ?? undefined;
         // Extract approvalDescription identifier reference
         for (const prop of firstArg.properties) {
             if (ts.isPropertyAssignment(prop) &&
@@ -735,13 +737,6 @@ export const addFunctions = (logger, node, checker, state, options) => {
         if (newMiddleware.length > 0) {
             middleware = [...(middleware || []), ...newMiddleware];
         }
-        const existingPermissionTags = new Set((permissions || [])
-            .filter((p) => p.type === 'tag')
-            .map((p) => p.tag));
-        const newPermissions = tagEntries.filter((e) => !existingPermissionTags.has(e.tag));
-        if (newPermissions.length > 0) {
-            permissions = [...(permissions || []), ...newPermissions];
-        }
     }
     const implementationHash = computeImplementationHash({
         wrapper: expression.text,
@@ -786,6 +781,7 @@ export const addFunctions = (logger, node, checker, state, options) => {
         workflowQueued: workflowQueued === true ? true : undefined,
         workflowRetries: workflowRetries ?? undefined,
         workflowTimeout: workflowTimeout ?? undefined,
+        scopes: scopes ?? undefined,
         implementationHash,
         version,
         title,
@@ -836,7 +832,6 @@ export const addFunctions = (logger, node, checker, state, options) => {
             inputSchema: inputNames[0] ?? null,
             outputSchema: outputNames[0] ?? null,
             middleware,
-            permissions,
         };
         state.serviceAggregation.usedFunctions.add(pikkuFuncId);
         extractWireNames(middleware).forEach((n) => state.serviceAggregation.usedMiddleware.add(n));
@@ -870,6 +865,12 @@ export const addFunctions = (logger, node, checker, state, options) => {
         }
         if (remote) {
             state.rpc.invokedFunctions.add(pikkuFuncId);
+            // The consumer-facing surface a wireRemoteAddon imports (mirrors exposedMeta)
+            state.rpc.remoteMeta[name] = pikkuFuncId;
+            state.rpc.remoteFiles.set(name, {
+                path: node.getSourceFile().fileName,
+                exportedName,
+            });
         }
         if (expose) {
             state.rpc.exposedMeta[name] = pikkuFuncId;

package/dist/add/add-gateway.js

@@ -2,6 +2,7 @@ import * as ts from 'typescript';
 import { getPropertyValue, getCommonWireMetaData, } from '../utils/get-property-value.js';
 import { extractFunctionName, makeContextBasedId, } from '../utils/extract-function-name.js';
 import { getPropertyAssignmentInitializer } from '../utils/type-utils.js';
+import { ensureInlineWiringFunction } from '../utils/ensure-function-metadata.js';
 import { resolveMiddleware } from '../utils/middleware.js';
 import { extractWireNames } from '../utils/post-process.js';
 import { resolveAddonName } from '../utils/resolve-addon-package.js';
@@ -44,6 +45,8 @@ export const addGateway = (logger, node, checker, state, _options) => {
     if (!nameValue || !typeValue) {
         return;
     }
+    // Register metadata for a func inlined into the wiring (see helper).
+    ensureInlineWiringFunction(state, pikkuFuncId, nameValue, funcInitializer, checker, extracted.isHelper);
     const middleware = resolveMiddleware(state, obj, tags, checker);
     state.serviceAggregation.usedFunctions.add(pikkuFuncId);
     extractWireNames(middleware).forEach((name) => state.serviceAggregation.usedMiddleware.add(name));

package/dist/add/add-http-route.js

@@ -4,7 +4,7 @@ import { pathToRegexp } from 'path-to-regexp';
 import { extractFunctionName, makeContextBasedId, } from '../utils/extract-function-name.js';
 import { getPropertyAssignmentInitializer, extractTypeKeys, } from '../utils/type-utils.js';
 import { resolveHTTPMiddlewareFromObject } from '../utils/middleware.js';
-import { resolveHTTPPermissionsFromObject } from '../utils/permissions.js';
+import { resolvePermissions } from '../utils/permissions.js';
 import { extractWireNames } from '../utils/post-process.js';
 import { ensureFunctionMetadata } from '../utils/ensure-function-metadata.js';
 import { resolveFunctionMeta } from '../utils/resolve-function-meta.js';
@@ -219,7 +219,7 @@ export function registerHTTPRoute({ obj, state, checker, logger, sourceFile, bas
     // Resolve middleware
     const middleware = resolveHTTPMiddlewareFromObject(state, fullRoute, obj, tags, checker);
     // Resolve permissions
-    const permissions = resolveHTTPPermissionsFromObject(state, fullRoute, obj, tags, checker);
+    const permissions = resolvePermissions(state, obj, tags, checker);
     state.serviceAggregation.usedFunctions.add(funcName);
     if (refAddonTarget) {
         state.serviceAggregation.usedFunctions.add(refAddonTarget);

package/dist/add/add-mcp-prompt.js

@@ -83,7 +83,6 @@ export const addMCPPrompt = (logger, node, checker, state, options) => {
             outputSchema,
             arguments: [], // Will be populated by CLI during serialization
             middleware,
-            permissions,
         };
     }
 };

package/dist/add/add-mcp-resource.js

@@ -93,7 +93,6 @@ export const addMCPResource = (logger, node, checker, state, options) => {
             inputSchema,
             outputSchema,
             middleware,
-            permissions,
         };
     }
 };

package/dist/add/add-permission.d.ts

@@ -1,5 +1,5 @@
 import type { AddWiring } from '../types.js';
 /**
- * Inspect pikkuPermission calls, addPermission calls, and addHTTPPermission calls
+ * Inspect pikkuPermission, pikkuAuth, and pikkuPermissionFactory definitions.
  */
 export declare const addPermission: AddWiring;

package/dist/add/add-permission.js

@@ -1,34 +1,14 @@
 import * as ts from 'typescript';
-import { extractFunctionName, isNamedExport, makeContextBasedId, } from '../utils/extract-function-name.js';
+import { extractFunctionName } from '../utils/extract-function-name.js';
 import { extractServicesFromFunction, extractUsedWires, } from '../utils/extract-services.js';
-import { extractPermissionPikkuNames } from '../utils/permissions.js';
 import { getPropertyValue } from '../utils/get-property-value.js';
 import { getPropertyAssignmentInitializer } from '../utils/type-utils.js';
-function renameTempDefinitions(state, definitionIds, groupType, groupKey) {
-    const tempIndices = definitionIds
-        .map((name, i) => (name.startsWith('__temp_') ? i : -1))
-        .filter((i) => i >= 0);
-    for (const idx of tempIndices) {
-        const oldId = definitionIds[idx];
-        const newId = tempIndices.length === 1
-            ? makeContextBasedId(groupType, groupKey)
-            : makeContextBasedId(groupType, groupKey, String(idx));
-        const existing = state.permissions.definitions[oldId];
-        if (existing) {
-            delete state.permissions.definitions[oldId];
-            state.permissions.definitions[newId] = existing;
-        }
-        definitionIds[idx] = newId;
-    }
-}
 function isInsidePermissionContainer(node) {
     let current = node.parent;
     while (current) {
         if (ts.isCallExpression(current) &&
             ts.isIdentifier(current.expression) &&
-            (current.expression.text === 'pikkuPermissionFactory' ||
-                current.expression.text === 'addTagPermission' ||
-                current.expression.text === 'addHTTPPermission')) {
+            current.expression.text === 'pikkuPermissionFactory') {
             return true;
         }
         current = current.parent;
@@ -36,7 +16,7 @@ function isInsidePermissionContainer(node) {
     return false;
 }
 /**
- * Inspect pikkuPermission calls, addPermission calls, and addHTTPPermission calls
+ * Inspect pikkuPermission, pikkuAuth, and pikkuPermissionFactory definitions.
  */
 export const addPermission = (logger, node, checker, state) => {
     if (!ts.isCallExpression(node))
@@ -249,158 +229,4 @@ export const addPermission = (logger, node, checker, state) => {
         logger.debug(`• Found permission factory with services: ${services.services.join(', ')}`);
         return;
     }
-    // Handle addPermission('tag', [permission1, permission2])
-    // Supports two patterns:
-    // 1. export const x = () => addTagPermission('tag', [...])  (factory - tree-shakeable)
-    // 2. export const x = addTagPermission('tag', [...])  (direct - no tree-shaking)
-    if (expression.text === 'addTagPermission') {
-        const tagArg = args[0];
-        const permissionsArrayArg = args[1];
-        if (!tagArg || !permissionsArrayArg)
-            return;
-        // Extract tag name
-        let tag;
-        if (ts.isStringLiteral(tagArg)) {
-            tag = tagArg.text;
-        }
-        if (!tag) {
-            logger.warn(`• addTagPermission call without valid tag string`);
-            return;
-        }
-        // Check if permissions is a literal array or object
-        if (!ts.isArrayLiteralExpression(permissionsArrayArg) &&
-            !ts.isObjectLiteralExpression(permissionsArrayArg)) {
-            logger.error(`• addTagPermission('${tag}', ...) must have a literal array or object as second argument`);
-            return;
-        }
-        // Extract permission pikkuFuncIds from array
-        const permissionNames = extractPermissionPikkuNames(permissionsArrayArg, checker, state.rootDir);
-        if (permissionNames.length > 0) {
-            renameTempDefinitions(state, permissionNames, 'tag', tag);
-        }
-        const allServices = new Set();
-        for (const permissionName of permissionNames) {
-            const permissionMeta = state.permissions.definitions[permissionName];
-            if (permissionMeta && permissionMeta.services) {
-                for (const service of permissionMeta.services.services) {
-                    allServices.add(service);
-                }
-            }
-        }
-        let isFactory = false;
-        let exportedName = null;
-        let parent = node.parent;
-        if (parent && ts.isArrowFunction(parent)) {
-            if (parent.parameters.length === 0) {
-                isFactory = true;
-                const arrowParent = parent.parent;
-                if (arrowParent && ts.isVariableDeclaration(arrowParent)) {
-                    if (ts.isIdentifier(arrowParent.name)) {
-                        if (isNamedExport(arrowParent)) {
-                            exportedName = arrowParent.name.text;
-                        }
-                    }
-                }
-            }
-        }
-        if (!isFactory) {
-            const extracted = extractFunctionName(node, checker, state.rootDir);
-            exportedName = extracted.exportedName;
-        }
-        if (!isFactory && exportedName) {
-            logger.warn(`• Permission group '${exportedName}' for tag '${tag}' is not wrapped in a factory function. ` +
-                `For tree-shaking, use: export const ${exportedName} = () => addTagPermission('${tag}', [...])`);
-        }
-        state.permissions.tagPermissions.set(tag, {
-            exportName: exportedName,
-            sourceFile: node.getSourceFile().fileName,
-            position: node.getStart(),
-            services: {
-                optimized: false,
-                services: Array.from(allServices),
-            },
-            count: permissionNames.length,
-            instanceIds: permissionNames,
-            isFactory,
-        });
-        logger.debug(`• Found tag permission group: ${tag} -> [${permissionNames.join(', ')}] (${isFactory ? 'factory' : 'direct'})`);
-        return;
-    }
-    // Handle addHTTPPermission(pattern, [permission1, permission2])
-    // Supports two patterns:
-    // 1. export const x = () => addHTTPPermission('*', [...])  (factory - tree-shakeable)
-    // 2. export const x = addHTTPPermission('*', [...])  (direct - no tree-shaking)
-    if (expression.text === 'addHTTPPermission') {
-        const patternArg = args[0];
-        const permissionsArrayArg = args[1];
-        if (!patternArg || !permissionsArrayArg)
-            return;
-        // Extract route pattern
-        let pattern;
-        if (ts.isStringLiteral(patternArg)) {
-            pattern = patternArg.text;
-        }
-        if (!pattern) {
-            logger.warn(`• addHTTPPermission call without valid pattern string`);
-            return;
-        }
-        // Check if permissions is a literal array or object
-        if (!ts.isArrayLiteralExpression(permissionsArrayArg) &&
-            !ts.isObjectLiteralExpression(permissionsArrayArg)) {
-            logger.error(`• addHTTPPermission('${pattern}', ...) must have a literal array or object as second argument`);
-            return;
-        }
-        // Extract permission pikkuFuncIds from array
-        const permissionNames = extractPermissionPikkuNames(permissionsArrayArg, checker, state.rootDir);
-        if (permissionNames.length > 0) {
-            renameTempDefinitions(state, permissionNames, 'http', pattern);
-        }
-        const allServices = new Set();
-        for (const permissionName of permissionNames) {
-            const permissionMeta = state.permissions.definitions[permissionName];
-            if (permissionMeta && permissionMeta.services) {
-                for (const service of permissionMeta.services.services) {
-                    allServices.add(service);
-                }
-            }
-        }
-        let isFactory = false;
-        let exportedName = null;
-        let parent = node.parent;
-        if (parent && ts.isArrowFunction(parent)) {
-            if (parent.parameters.length === 0) {
-                isFactory = true;
-                const arrowParent = parent.parent;
-                if (arrowParent && ts.isVariableDeclaration(arrowParent)) {
-                    if (ts.isIdentifier(arrowParent.name)) {
-                        if (isNamedExport(arrowParent)) {
-                            exportedName = arrowParent.name.text;
-                        }
-                    }
-                }
-            }
-        }
-        if (!isFactory) {
-            const extracted = extractFunctionName(node, checker, state.rootDir);
-            exportedName = extracted.exportedName;
-        }
-        if (!isFactory && exportedName) {
-            logger.warn(`• HTTP permission group '${exportedName}' for pattern '${pattern}' is not wrapped in a factory function. ` +
-                `For tree-shaking, use: export const ${exportedName} = () => addHTTPPermission('${pattern}', [...])`);
-        }
-        state.http.routePermissions.set(pattern, {
-            exportName: exportedName,
-            sourceFile: node.getSourceFile().fileName,
-            position: node.getStart(),
-            services: {
-                optimized: false,
-                services: Array.from(allServices),
-            },
-            count: permissionNames.length,
-            instanceIds: permissionNames,
-            isFactory,
-        });
-        logger.debug(`• Found HTTP route permission group: ${pattern} -> [${permissionNames.join(', ')}] (${isFactory ? 'factory' : 'direct'})`);
-        return;
-    }
 };

package/dist/add/add-queue-worker.js

@@ -2,6 +2,7 @@ import * as ts from 'typescript';
 import { getPropertyValue, getCommonWireMetaData, } from '../utils/get-property-value.js';
 import { extractFunctionName, makeContextBasedId, } from '../utils/extract-function-name.js';
 import { getPropertyAssignmentInitializer } from '../utils/type-utils.js';
+import { ensureInlineWiringFunction } from '../utils/ensure-function-metadata.js';
 import { resolveMiddleware } from '../utils/middleware.js';
 import { extractWireNames } from '../utils/post-process.js';
 import { resolveAddonName } from '../utils/resolve-addon-package.js';
@@ -44,6 +45,8 @@ export const addQueueWorker = (logger, node, checker, state) => {
             logger.critical(ErrorCode.MISSING_QUEUE_NAME, `No 'name' provided for queue processor function '${pikkuFuncId}'.`);
             return;
         }
+        // Register metadata for a func inlined into the wiring (see helper).
+        ensureInlineWiringFunction(state, pikkuFuncId, name, funcInitializer, checker, extracted.isHelper);
         // --- resolve middleware ---
         const middleware = resolveMiddleware(state, obj, tags, checker);
         // --- track used functions/middleware for service aggregation ---

package/dist/add/add-schedule.js

@@ -2,6 +2,7 @@ import * as ts from 'typescript';
 import { getPropertyValue, getCommonWireMetaData, } from '../utils/get-property-value.js';
 import { extractFunctionName, makeContextBasedId, } from '../utils/extract-function-name.js';
 import { getPropertyAssignmentInitializer } from '../utils/type-utils.js';
+import { ensureInlineWiringFunction } from '../utils/ensure-function-metadata.js';
 import { resolveMiddleware } from '../utils/middleware.js';
 import { extractWireNames } from '../utils/post-process.js';
 import { resolveAddonName } from '../utils/resolve-addon-package.js';
@@ -43,6 +44,8 @@ export const addSchedule = (logger, node, checker, state, options) => {
         if (!nameValue || !scheduleValue) {
             return;
         }
+        // Register metadata for a func inlined into the wiring (see helper).
+        ensureInlineWiringFunction(state, pikkuFuncId, nameValue, funcInitializer, checker, extracted.isHelper);
         // --- resolve middleware ---
         const middleware = resolveMiddleware(state, obj, tags, checker);
         // --- track used functions/middleware for service aggregation ---

package/dist/add/add-scope.d.ts

@@ -0,0 +1,2 @@
+import type { AddWiring } from '../types.js';
+export declare const addScope: AddWiring;