@pikku/inspector 0.12.42 → 0.12.43

package/src/utils/get-property-value.ts

@@ -5,6 +5,17 @@ import { extractStringLiteral } from './extract-node-value.js'
 /**
  * Extracts an array of strings from an object property.
  */
+/**
+ * Unwraps `x as const` / `x as any` / `x satisfies T` down to the underlying
+ * expression. Without this a cast makes the value invisible to the inspector,
+ * so it is silently dropped from meta rather than validated — and `as const` on
+ * an array is idiomatic enough that this is easy to hit by accident.
+ */
+const unwrapAs = (node: ts.Expression): ts.Expression =>
+  ts.isAsExpression(node) || ts.isSatisfiesExpression(node)
+    ? unwrapAs(node.expression)
+    : node
+
 export const getArrayPropertyValue = (
   obj: ts.ObjectLiteralExpression,
   propertyName: string
@@ -17,7 +28,7 @@ export const getArrayPropertyValue = (
   )
 
   if (property && ts.isPropertyAssignment(property)) {
-    const initializer = property.initializer
+    const initializer = unwrapAs(property.initializer)
     if (ts.isArrayLiteralExpression(initializer)) {
       return initializer.elements
         .filter(ts.isStringLiteral)
@@ -28,6 +39,56 @@ export const getArrayPropertyValue = (
   return null
 }
 
+/**
+ * Extracts a string->string record from an object property.
+ *
+ * `getPropertyValue` falls through to `getText()` for an object literal, which
+ * returns the raw source text rather than the record — so callers that need the
+ * entries (e.g. oauth2 `additionalParams`) must use this instead.
+ */
+export const getRecordPropertyValue = (
+  obj: ts.ObjectLiteralExpression,
+  propertyName: string
+): Record<string, string> | null => {
+  const property = obj.properties.find(
+    (p) =>
+      ts.isPropertyAssignment(p) &&
+      ts.isIdentifier(p.name) &&
+      p.name.text === propertyName
+  )
+
+  if (!property || !ts.isPropertyAssignment(property)) {
+    return null
+  }
+  const initializer = property.initializer
+  if (!ts.isObjectLiteralExpression(initializer)) {
+    return null
+  }
+
+  const record: Record<string, string> = {}
+  for (const prop of initializer.properties) {
+    if (!ts.isPropertyAssignment(prop)) {
+      continue
+    }
+    const key = ts.isIdentifier(prop.name)
+      ? prop.name.text
+      : ts.isStringLiteral(prop.name)
+        ? prop.name.text
+        : null
+    if (key === null) {
+      continue
+    }
+    if (
+      ts.isStringLiteral(prop.initializer) ||
+      ts.isNoSubstitutionTemplateLiteral(prop.initializer)
+    ) {
+      record[key] = prop.initializer.text
+    }
+  }
+
+  return Object.keys(record).length > 0 ? record : null
+}
+
 /**
  * Wiring identity fields (`name`, `secretId`, `variableId`, …) are read
  * STATICALLY from source — a const or variable reference is keyed by its

package/src/utils/load-addon-functions-meta.test.ts

@@ -0,0 +1,157 @@
+import { strict as assert } from 'assert'
+import { describe, test, before, after } from 'node:test'
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'fs'
+import { tmpdir } from 'os'
+import { join } from 'path'
+import { loadAddonFunctionsMeta } from './load-addon-functions-meta.js'
+import type { InspectorState, InspectorLogger } from '../types.js'
+
+const ADDON = '@addon/slack'
+
+const writeAddonFixture = (rootDir: string) => {
+  writeFileSync(
+    join(rootDir, 'package.json'),
+    JSON.stringify({ name: 'consumer' })
+  )
+  const addonDir = join(rootDir, 'node_modules', ADDON)
+  const pikku = join(addonDir, '.pikku')
+  mkdirSync(join(pikku, 'function'), { recursive: true })
+  mkdirSync(join(pikku, 'secrets'), { recursive: true })
+  mkdirSync(join(pikku, 'variables'), { recursive: true })
+  mkdirSync(join(pikku, 'credentials'), { recursive: true })
+  writeFileSync(join(addonDir, 'package.json'), JSON.stringify({ name: ADDON }))
+  writeFileSync(
+    join(pikku, 'function', 'pikku-functions-meta.gen.json'),
+    JSON.stringify({})
+  )
+  // Real addon secrets/variables have a logical name that DIFFERS from the id
+  // the addon reads by (secretId/variableId) — overrides key on the id.
+  writeFileSync(
+    join(pikku, 'secrets', 'pikku-secrets-meta.gen.json'),
+    JSON.stringify({ slack: { name: 'slack', secretId: 'SLACK_TOKEN' } })
+  )
+  writeFileSync(
+    join(pikku, 'variables', 'pikku-variables-meta.gen.json'),
+    JSON.stringify({ region: { name: 'region', variableId: 'REGION' } })
+  )
+  writeFileSync(
+    join(pikku, 'credentials', 'pikku-credentials-meta.gen.json'),
+    JSON.stringify({
+      slackOAuth: { name: 'slackOAuth', type: 'singleton' },
+    })
+  )
+}
+
+const makeState = (
+  rootDir: string,
+  wireAddonDeclarations: Map<string, any>
+): InspectorState =>
+  ({
+    rootDir,
+    rpc: { wireAddonDeclarations },
+    addonFunctions: {},
+    secrets: { definitions: [] },
+    variables: { definitions: [] },
+    credentials: { definitions: [] },
+    mcpEndpoints: { toolsMeta: {} },
+    addonServerlessIncompatible: new Map(),
+    addonRequiredParentServices: [],
+    exportedContracts: { addonHttp: {}, addonCli: {}, addonChannel: {} },
+  }) as unknown as InspectorState
+
+const logger = {
+  debug: () => {},
+  info: () => {},
+  warn: () => {},
+  error: () => {},
+  critical: () => {},
+  diagnostic: () => {},
+} as unknown as InspectorLogger
+
+describe('loadAddonFunctionsMeta — per-instance secret/variable overrides', () => {
+  let rootDir: string
+
+  before(() => {
+    rootDir = mkdtempSync(join(tmpdir(), 'pikku-addon-meta-'))
+    writeAddonFixture(rootDir)
+  })
+
+  after(() => {
+    rmSync(rootDir, { recursive: true, force: true })
+  })
+
+  test('registers the override target names, one per instance, not the shared logical name', async () => {
+    const state = makeState(
+      rootDir,
+      new Map<string, any>([
+        [
+          'slack-marketing',
+          {
+            package: ADDON,
+            // Overrides key on the secretId/variableId, not the logical name.
+            secretOverrides: { SLACK_TOKEN: 'SLACK_MARKETING_TOKEN' },
+            variableOverrides: { REGION: 'MARKETING_REGION' },
+            credentialOverrides: { slackOAuth: 'slack_marketing_oauth' },
+          },
+        ],
+        [
+          'slack-support',
+          {
+            package: ADDON,
+            secretOverrides: { SLACK_TOKEN: 'SLACK_SUPPORT_TOKEN' },
+            credentialOverrides: { slackOAuth: 'slack_support_oauth' },
+          },
+        ],
+      ])
+    )
+
+    await loadAddonFunctionsMeta(logger, state)
+
+    const secretIds = state.secrets.definitions
+      .map((d: any) => d.secretId)
+      .sort()
+    assert.deepEqual(secretIds, [
+      'SLACK_MARKETING_TOKEN',
+      'SLACK_SUPPORT_TOKEN',
+    ])
+
+    // slack-marketing overrides region; slack-support has no override, so it
+    // falls back to the addon's default variableId.
+    const variableIds = state.variables.definitions
+      .map((d: any) => d.variableId)
+      .sort()
+    assert.deepEqual(variableIds, ['MARKETING_REGION', 'REGION'])
+
+    // Each instance's credentialOverride surfaces a distinct credential name
+    // (which doubles as the better-auth providerId) — no shared account pool.
+    const credentialNames = state.credentials.definitions
+      .map((d: any) => d.name)
+      .sort()
+    assert.deepEqual(credentialNames, [
+      'slack_marketing_oauth',
+      'slack_support_oauth',
+    ])
+  })
+
+  test('falls back to the addon logical name when no override is provided', async () => {
+    const state = makeState(
+      rootDir,
+      new Map<string, any>([['slack-plain', { package: ADDON }]])
+    )
+
+    await loadAddonFunctionsMeta(logger, state)
+
+    assert.deepEqual(
+      state.secrets.definitions.map((d: any) => d.secretId),
+      ['SLACK_TOKEN']
+    )
+    assert.deepEqual(
+      state.variables.definitions.map((d: any) => d.variableId),
+      ['REGION']
+    )
+    assert.deepEqual(
+      state.credentials.definitions.map((d: any) => d.name),
+      ['slackOAuth']
+    )
+  })
+})

package/src/utils/load-addon-functions-meta.ts

@@ -133,6 +133,10 @@ export async function loadAddonFunctionsMeta(
   const require = createRequire(join(state.rootDir, 'package.json'))
 
   for (const [namespace, decl] of wireAddonDeclarations) {
+    // Remote addons (wireRemoteAddon) ship as a devDependency: types only.
+    // Their functions, secrets, variables, schemas and services live on the
+    // HOST that runs them — never load or require any of that here.
+    if (decl.remote) continue
     try {
       const metaPath = require.resolve(
         `${decl.package}/.pikku/function/pikku-functions-meta.gen.json`
@@ -168,18 +172,55 @@ export async function loadAddonFunctionsMeta(
         const secretsRaw = await readFile(secretsMetaPath, 'utf-8')
         const secretsMeta = JSON.parse(secretsRaw)
         for (const [key, def] of Object.entries<any>(secretsMeta)) {
+          // secretOverrides key on the SECRET ID (the string the addon passes to
+          // getSecret — its typed map is keyed by secretId, e.g.
+          // `getSecret('MAILGUN_CREDENTIALS')`), NOT the logical meta key, so the
+          // runtime aliaser (which also keys on secretId) and this merge agree.
+          // The resolved id is the real project secret; the addon's secretId is
+          // the default when no override is given. Two instances with different
+          // overrides therefore surface two distinct project secrets. `key` is
+          // the fallback for older meta that predates the secretId field.
+          const secretId = def.secretId ?? key
+          const resolvedSecretId = decl.secretOverrides?.[secretId] ?? secretId
           const existing = state.secrets.definitions.find(
-            (d: any) => d.name === key
+            (d: any) => (d.secretId ?? d.name) === resolvedSecretId
           )
           if (!existing) {
-            state.secrets.definitions.push(def)
-            logger.debug(`Loaded addon secret '${key}' from ${decl.package}`)
+            state.secrets.definitions.push({
+              ...def,
+              secretId: resolvedSecretId,
+            })
+            logger.debug(
+              `Loaded addon secret '${resolvedSecretId}' from ${decl.package}`
+            )
           }
         }
       } catch {
         // No secrets meta — that's fine
       }
 
+      // Load addon scopes meta. Without this an addon's own scopes never reach
+      // the host's ScopeId union or its declared set, so the pikku_scopes FK
+      // would refuse to grant one.
+      try {
+        const scopesMetaPath = require.resolve(
+          `${decl.package}/.pikku/scopes/pikku-scopes-meta.gen.json`
+        )
+        const scopesRaw = await readFile(scopesMetaPath, 'utf-8')
+        const scopesMeta = JSON.parse(scopesRaw)
+        for (const [key, def] of Object.entries<any>(scopesMeta)) {
+          const existing = state.scopes.definitions.find(
+            (d: any) => d.name === key
+          )
+          if (!existing) {
+            state.scopes.definitions.push(def)
+            logger.debug(`Loaded addon scope '${key}' from ${decl.package}`)
+          }
+        }
+      } catch {
+        // No scopes meta — that's fine
+      }
+
       // Load addon variables meta
       try {
         const variablesMetaPath = require.resolve(
@@ -188,17 +229,62 @@ export async function loadAddonFunctionsMeta(
         const variablesRaw = await readFile(variablesMetaPath, 'utf-8')
         const variablesMeta = JSON.parse(variablesRaw)
         for (const [key, def] of Object.entries<any>(variablesMeta)) {
+          // variableOverrides key on the VARIABLE ID (the string the addon reads
+          // via its typed map, keyed by variableId), same as secretOverrides key
+          // on secretId — so the runtime aliaser and this merge agree. `key` is
+          // the fallback for older meta without a variableId field.
+          const variableId = def.variableId ?? key
+          const resolvedVariableId =
+            decl.variableOverrides?.[variableId] ?? variableId
           const existing = state.variables.definitions.find(
-            (d: any) => d.name === key
+            (d: any) => (d.variableId ?? d.name) === resolvedVariableId
           )
           if (!existing) {
-            state.variables.definitions.push(def)
-            logger.debug(`Loaded addon variable '${key}' from ${decl.package}`)
+            state.variables.definitions.push({
+              ...def,
+              variableId: resolvedVariableId,
+            })
+            logger.debug(
+              `Loaded addon variable '${resolvedVariableId}' from ${decl.package}`
+            )
           }
         }
       } catch {
         // No variables meta — that's fine
       }
+
+      // Load addon credentials meta. Without this an addon's OAuth2/wire
+      // credentials never reach the consuming app's CREDENTIAL_OAUTH2_CONFIGS,
+      // so the credential-oauth provider and BetterAuthCredentialService can't
+      // resolve them — the addon's Connect flow and status silently no-op.
+      try {
+        const credentialsMetaPath = require.resolve(
+          `${decl.package}/.pikku/credentials/pikku-credentials-meta.gen.json`
+        )
+        const credentialsRaw = await readFile(credentialsMetaPath, 'utf-8')
+        const credentialsMeta = JSON.parse(credentialsRaw)
+        for (const [key, def] of Object.entries<any>(credentialsMeta)) {
+          // Each instance's credentialOverrides remap the addon's logical
+          // credential name to a project credential — same mechanic as secrets
+          // and variables above. The credential name doubles as the better-auth
+          // providerId (accounts keyed by providerId+userId), so two instances
+          // with different overrides surface two distinct OAuth providers rather
+          // than sharing one account pool. The logical name is the default when
+          // no override is given.
+          const resolvedName = decl.credentialOverrides?.[key] ?? key
+          const existing = state.credentials.definitions.find(
+            (d: any) => d.name === resolvedName
+          )
+          if (!existing) {
+            state.credentials.definitions.push({ ...def, name: resolvedName })
+            logger.debug(
+              `Loaded addon credential '${resolvedName}' from ${decl.package}`
+            )
+          }
+        }
+      } catch {
+        // No credentials meta — that's fine
+      }
       // Load addon serverlessIncompatible service names from pikku-addon-meta.gen.json
       let loadedParentServices = false
       try {
@@ -323,6 +409,8 @@ export async function loadAddonSchemas(
   const require = createRequire(join(state.rootDir, 'package.json'))
 
   for (const [namespace, decl] of wireAddonDeclarations) {
+    // Remote addons carry no local schemas — their funcs run on the host.
+    if (decl.remote) continue
     try {
       const metaPath = require.resolve(
         `${decl.package}/.pikku/function/pikku-functions-meta.gen.json`

package/src/utils/load-addon-scopes.test.ts

@@ -0,0 +1,138 @@
+import assert from 'node:assert/strict'
+import { describe, test, beforeEach, afterEach } from 'node:test'
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { loadAddonFunctionsMeta } from './load-addon-functions-meta.js'
+
+const PACKAGE = '@test/addon'
+
+let rootDir: string
+let warnings: string[]
+
+const logger = {
+  debug: () => {},
+  info: () => {},
+  warn: (msg: string) => warnings.push(msg),
+  error: () => {},
+} as any
+
+/**
+ * Lays out an installed addon the way the host resolves one: a real package in
+ * node_modules whose built `.pikku` carries its generated metadata.
+ */
+const installAddon = (scopesMeta?: unknown) => {
+  const pkgDir = join(rootDir, 'node_modules', '@test', 'addon')
+  const pikkuDir = join(pkgDir, '.pikku')
+
+  mkdirSync(join(pikkuDir, 'function'), { recursive: true })
+  writeFileSync(
+    join(pkgDir, 'package.json'),
+    JSON.stringify({ name: PACKAGE, version: '1.0.0' }),
+    'utf8'
+  )
+  writeFileSync(
+    join(pikkuDir, 'function', 'pikku-functions-meta.gen.json'),
+    JSON.stringify({ someFunc: { pikkuFuncId: 'someFunc' } }),
+    'utf8'
+  )
+
+  if (scopesMeta !== undefined) {
+    mkdirSync(join(pikkuDir, 'scopes'), { recursive: true })
+    writeFileSync(
+      join(pikkuDir, 'scopes', 'pikku-scopes-meta.gen.json'),
+      JSON.stringify(scopesMeta),
+      'utf8'
+    )
+  }
+}
+
+const makeState = (definitions: any[] = []) =>
+  ({
+    rootDir,
+    addonFunctions: {},
+    addonServerlessIncompatible: new Map(),
+    addonRequiredParentServices: [],
+    mcpEndpoints: { toolsMeta: {} },
+    exportedContracts: { addonHttp: {}, addonCli: {}, addonChannel: {} },
+    secrets: { definitions: [] },
+    variables: { definitions: [] },
+    scopes: { definitions, files: new Set() },
+    schemas: {},
+    rpc: {
+      wireAddonDeclarations: new Map([['test', { package: PACKAGE }]]),
+    },
+  }) as any
+
+beforeEach(() => {
+  rootDir = mkdtempSync(join(tmpdir(), 'pikku-addon-scopes-'))
+  warnings = []
+  writeFileSync(
+    join(rootDir, 'package.json'),
+    JSON.stringify({ name: 'host' }),
+    'utf8'
+  )
+})
+
+afterEach(() => {
+  rmSync(rootDir, { recursive: true, force: true })
+})
+
+describe('loadAddonFunctionsMeta — addon scopes', () => {
+  // Without this, an addon's own scopes never reach the host's ScopeId union or
+  // its declared set, so the pikku_scopes FK would reject granting one.
+  test("merges an addon's declared scopes into the host state", async () => {
+    installAddon({
+      pikku: {
+        name: 'pikku',
+        displayName: 'Pikku',
+        scopes: { scopes: { scopes: { manage: {} } } },
+      },
+    })
+    const state = makeState()
+
+    await loadAddonFunctionsMeta(logger, state)
+
+    assert.deepEqual(
+      state.scopes.definitions.map((d: any) => d.name),
+      ['pikku']
+    )
+    assert.deepEqual(state.scopes.definitions[0].scopes, {
+      scopes: { scopes: { manage: {} } },
+    })
+  })
+
+  test("keeps the host's own scopes alongside the addon's", async () => {
+    installAddon({ pikku: { name: 'pikku' } })
+    const state = makeState([{ name: 'admin' }])
+
+    await loadAddonFunctionsMeta(logger, state)
+
+    assert.deepEqual(state.scopes.definitions.map((d: any) => d.name).sort(), [
+      'admin',
+      'pikku',
+    ])
+  })
+
+  // A host that already declares the name owns it — mirrors how addon secrets
+  // and variables resolve the same collision.
+  test('does not let an addon redeclare a scope the host already owns', async () => {
+    installAddon({ admin: { name: 'admin', description: 'from the addon' } })
+    const state = makeState([{ name: 'admin', description: 'from the host' }])
+
+    await loadAddonFunctionsMeta(logger, state)
+
+    assert.equal(state.scopes.definitions.length, 1)
+    assert.equal(state.scopes.definitions[0].description, 'from the host')
+  })
+
+  test('is a no-op for an addon that declares no scopes', async () => {
+    installAddon()
+    const state = makeState()
+
+    await loadAddonFunctionsMeta(logger, state)
+
+    assert.deepEqual(state.scopes.definitions, [])
+    assert.deepEqual(warnings, [])
+  })
+})