@pikku/inspector 0.12.42 → 0.12.44

package/CHANGELOG.md

@@ -1,3 +1,269 @@
+## 0.12.44
+
+### Patch Changes
+
+- 1a86d3f: Stop silently dropping DSL workflow constructs during extraction.
+
+  Four constructs produced a wrong workflow graph with no diagnostic:
+  - A property access on the fanout item (`users.map((u) => workflow.do(..., { userId: u.id }))`)
+    was dropped from the step's inputs — `extractInputSource` resolved property
+    access against the input param and output variables but not loop variables.
+  - `const [org, user] = await Promise.all([...])` dropped **both** steps, because
+    extraction bailed on any non-identifier binding name before reaching the
+    `Promise.all` branch. Array destructuring now binds each name to its matching
+    child step's output.
+  - A brace-less `for (const x of xs) await workflow.do(...)` dropped the entire
+    loop, since only block bodies were walked.
+  - Object destructuring of a step result and multi-declarator statements now
+    report a diagnostic instead of vanishing.
+
+- 1a86d3f: Fix a fanout collapsing into a single step, and preserve graph node config.
+  - A fanout took its `stepName` from the first step of its body. Node ids _are_
+    step names, so the loop and that step got the same id and the step overwrote
+    the loop: `await Promise.all(users.map(...))` rendered as one plain call, and
+    everything after the loop became unreachable. A fanout is not itself a cached
+    step, so it no longer borrows a name.
+  - A `workflow.sleep` or `workflow.suspend` inside a fanout body was dropped at
+    extraction — `FanoutStepMeta.body` was typed RPC-only. It now admits sleep and
+    suspend, and the regenerated body emits them.
+  - Regenerating a `pikkuWorkflowGraph` dropped `onError`, `retries` and
+    `retryDelay` from every node, and graph-level `notes`. All four are honoured
+    at runtime, so the round trip silently changed behaviour.
+
+- 1a86d3f: Support multi-step fanout bodies in DSL workflows.
+
+  A `Promise.all(array.map(...))` (or `for...of`) body containing more than one
+  `workflow.do` call previously extracted only a single step: `const`-captured
+  steps were skipped entirely by the parallel extractor, so a body like
+
+  ```ts
+  await Promise.all(
+    users.map(async (u) => {
+      const digestData = await workflow.do('Get pipeline', 'getDigestData', {
+        userId: u.id,
+      })
+      await workflow.do('Send digest', 'sendDigestEmail', { ...digestData })
+    })
+  )
+  ```
+
+  produced a graph with `getDigestData` missing and `sendDigestEmail` referencing
+  an unregistered variable. `FanoutStepMeta.child` is replaced by
+  `FanoutStepMeta.body: RpcStepMeta[]`, holding the per-iteration steps inline in
+  the same workflow — no sub-workflow boundary. Per-iteration `const` bindings are
+  now registered so later steps in the same iteration can reference them, and the
+  sequential path no longer hard-errors on bodies with more than one step.
+
+- 1a86d3f: Add `onError` compensation to DSL workflows.
+
+  A DSL workflow had no way to express error handling at all — `try/catch` is not
+  an allowed statement, and step options carried only `retries`/`retryDelay`. A
+  step can now name a compensation RPC:
+
+  ```ts
+  await workflow.do(
+    'Charge',
+    'chargeCard',
+    { id },
+    {
+      retries: 3,
+      onError: 'refundOrder',
+    }
+  )
+  ```
+
+  Semantics mirror a graph node's `onError` exactly: once the step's retries are
+  exhausted the handler is invoked with `{ error: { message } }` and the original
+  error is still thrown. This is compensation, not recovery — the workflow fails
+  either way. The handler runs as its own durable step, so a replay cannot
+  compensate twice, and it does not inherit `onError` itself.
+
+  The handler is materialised as a real graph node, so it is wired like any other
+  RPC and the console draws a dashed red "on error" edge to it rather than the
+  route being invisible.
+
+- 1a86d3f: Keep a numeric `retryDelay` numeric through the graph round-trip. The serialized
+  graph typed it as `string` and the DSL→graph conversion called `.toString()`, so
+  `retryDelay: 500` regenerated as `retryDelay: '500'` — a different value to the
+  runtime, which parses strings as durations.
+- 1a86d3f: Stop silently dropping switch cases and spread returns from workflow graphs.
+  - A fall-through case (`case 'a': case 'b': ...`) recorded only the last value.
+    A run entering on `'a'` therefore appeared to match no case at all. Empty
+    clauses now carry through to the entry they fall into — the next non-empty
+    case, otherwise `default`, otherwise the switch exit.
+  - `return { ...r, extra: 1 }` produced a return node listing only `extra`, so
+    the graph claimed an output shape the workflow does not have, with no
+    diagnostic. `return r` produced no return node at all. `ReturnStepMeta` now
+    records a `spread` list, and the regenerated code emits it.
+
+- 1a86d3f: Stop deleting code when regenerating a DSL workflow from its graph.
+
+  Regenerating a workflow (as the console's graph editor does) silently dropped
+  steps:
+  - Only the **first** step of an `if` arm survived. The walk stopped via a
+    heuristic that tested whether the next node id contained `_then_`/`_else_`,
+    but node ids are step names, so it never matched. Branch and switch bodies now
+    walk the `next` chain up to an explicit exit boundary — the enclosing flow
+    node's own `next`.
+  - Switch cases emitted only their entry node, never walking `next` at all.
+  - Every step was renamed to `Call <rpcName>`, because the graph conversion never
+    wrote `stepName` onto the node. Step names are the durable replay cache key,
+    so a round-trip silently invalidated in-flight runs.
+  - `workflow.suspend()` had no graph node, yet the preceding step's `next` still
+    pointed at its id — traversal dead-ended there and every following step was
+    deleted. `suspend` is now a real flow node, and both `suspend` and `approval`
+    have deserializer cases.
+  - Numeric and boolean `switch` case values were emitted quoted (`case '1':`),
+    so the case could never match. Step names and reasons containing a quote are
+    now escaped.
+
+  Also fixed in the same pass:
+  - `const [org, user] = await Promise.all([...])` regenerated as a bare
+    `await Promise.all([...])`, leaving both names unbound.
+  - A step result assigned inside a branch was re-declared with `const` inside
+    that branch, so any later reference was out of scope. Hoisting analysis was
+    keyed off the same dead node-id heuristic and never fired.
+  - A top-level step whose _name_ contained `_case`, `_item_`, `_then_`,
+    `_else_`, `_child_` or `_default_` was silently deleted, because node ids are
+    step names and were matched against those structural substrings. Ownership is
+    now read from the parent constructs themselves.
+
+- 1a86d3f: Stop corrupting values when regenerating a workflow from its graph.
+  - A numeric `workflow.sleep('Wait', 5000)` came back as `'5000'`, and a numeric
+    `retryDelay` likewise. Durations are `string | number`; only strings are
+    quoted now.
+  - An assignment to a context variable was stored as an opaque `value`, so
+    `count = count + 1` regenerated as `count = 'count + 1'` — an expression
+    turned into a string literal. `SetStepMeta` now carries a separate
+    `expression` field (mirroring `SwitchCaseMeta`), so a string literal and a
+    code expression are no longer indistinguishable in the meta.
+  - A `next` that was not a single node id was coerced with a string cast: an
+    array became the bogus id `'a,b'` and a branch-key record became
+    `'[object Object]'`, severing every downstream node. Arrays, key-based
+    routing tables and condition lists now each render in their own shape.
+  - A `filter`/`some`/`every` node with no `outputVar` emitted
+    `const undefined = ...`, which does not parse.
+
+- 1a86d3f: Keep a `workflow.sleep` whose duration is only known at runtime (a loop
+  variable, a field off the input). The closure evaluates it, so it is legal DSL;
+  its source text is recorded as an `expression` and emitted raw when regenerating
+  code, as a set step already does.
+- 314ace3: Cut the schema generator's ts.Program cost — the dominant contributor to `pikku all` memory and time.
+
+  Two independent fixes: the program is now scoped to the virtual file's import
+  closure (870 source files instead of the whole tsconfig's 2572), and it is
+  released once schemas are generated instead of being pinned at module scope for
+  the life of the process. On a 279-function tree this cuts cold codegen ~20% and
+  in-pass live heap ~21%, with byte-identical schema output.
+
+- 3d76f51: Add an optional `docsUrl` to `wireSecret`, `wireVariable`, and `wireCredential`, so a console or deploy UI reporting a missing value can link the user to where they obtain it instead of showing a bare identifier.
+- Updated dependencies [1a86d3f]
+- Updated dependencies [1a86d3f]
+- Updated dependencies [1a86d3f]
+- Updated dependencies [1a86d3f]
+- Updated dependencies [1a86d3f]
+- Updated dependencies [1a86d3f]
+- Updated dependencies [3d76f51]
+  - @pikku/core@0.12.65
+
+## 0.12.43
+
+### Patch Changes
+
+- c478794: Simplify authorization to be session + function based (#972). Permissions are now function-scoped only: global permissions AND together, a function's own permissions OR together, and the two are independent gates that both must pass — a broad global can no longer satisfy an admin-only function. Removed wire-, tag-, and HTTP-route-level permissions (`addTagPermission`, `addHTTPPermission`, wire-level `permissions` on HTTP/channel/MCP wirings). Tags are now organizational only. `auth` (session presence) and tag/HTTP middleware are unchanged.
+- b714fd4: Merge an addon's credential meta into the consuming app during inspection, the
+  same way addon secrets and variables are already merged. Without this, a
+  credential declared by an addon (e.g. an OAuth2 integration) never reached the
+  app's `CREDENTIAL_OAUTH2_CONFIGS`, so the `credential-oauth` provider and the
+  credential service could not resolve it — the addon's Connect flow and status
+  silently no-op'd. Addon credentials are added as fallbacks: an app-declared
+  credential of the same name still wins.
+- cb079cc: `pikkuAIAgent` gains a `workflows: []` capability: a referenced workflow is exposed to the LLM as a tool that runs inline and returns its output.
+- 13474a6: Generate a `ScopeId` union from `wireScope` declarations.
+
+  `pikku all` now emits `.pikku/scopes/pikku-scopes.gen.ts` with a `ScopeId` union
+  of every declared scope, plus a wildcard form for each node that has
+  descendants. A project's generated `pikkuFunc` narrows `scopes` to that union,
+  so an undeclared scope is a compile error with editor autocomplete:
+
+  ```ts
+  wireScope({ admin: { scopes: { invoices: { scopes: { create: {} } } } } })
+
+  pikkuFunc({
+    scopes: ['admin:invoices:create'],  // ✓ autocompleted
+    func: ...,
+  })
+
+  pikkuFunc({
+    scopes: ['admin:invoice:create'],   // ✗ compile error (typo)
+    func: ...,
+  })
+  ```
+
+  The inspector independently rejects undeclared scopes, so a cast that defeats
+  the compiler is still caught at build time.
+
+  Also fixes `getArrayPropertyValue` dropping any array behind a cast — idiomatic
+  `tags: ['a'] as const` was previously invisible to the inspector and silently
+  omitted from meta.
+
+- ca0d14f: Apply `credentialOverrides` when merging an addon's credentials into the consuming app, mirroring the existing `secretOverrides`/`variableOverrides` handling. Previously the credentials merge ignored overrides and always registered the addon's logical credential name, so a second instance of the same package (`wireAddon` with a `credentialOverrides` map) failed `validateCredentialOverrides` and both instances shared one OAuth provider. Now each override's resolved name is provisioned as its own credential — and since the credential name doubles as the better-auth providerId, two instances surface two distinct providers instead of a shared account pool.
+- 13474a6: feat: propagate an addon's declared scopes to the host
+
+  An addon can now declare scopes with `wireScope`, and a host that wires it picks
+  them up: they merge into the host's `ScopeId` union and its declared set, so a
+  host function can require an addon scope and the `pikku_scopes` foreign key
+  accepts granting one. This mirrors how addon secrets and variables are loaded.
+
+  The generated `pikku-scopes.gen.ts` now imports its metadata sidecar and derives
+  `SCOPES` from it, rather than inlining the list. TypeScript only emits a `.json`
+  into the build output when something imports it, and an addon publishes only
+  that output — without the import, an addon's scopes never reached a host.
+
+- cb079cc: `pikkuWorkflowGraph` nodes accept an optional `notes?: string` and the graph an optional `notes?: string[]`; notes are documentation only and excluded from `graphHash`.
+- cb079cc: Fix two corpus type-check failures: n8n `graph:sort`/`graph:summarize` enum rows now emit `as const`, and the inspector's `sanitizeTypeName` prefixes an underscore when a name starts with a digit.
+- 8601505: Make `wireCredential` the single source of truth for an addon's OAuth2 config: `pikku-credentials.gen.ts` exports `CREDENTIAL_OAUTH2_CONFIGS`, generated services import from it, the OpenAPI importer emits a `wireCredential`, and the inspector now extracts `oauth2.additionalParams`.
+- 70fa400: Add outgoing webhooks — `webhookService.send()` enqueues signed deliveries onto a retrying queue, `@pikku/kysely`'s `KyselyWebhookService` persists per-attempt delivery history, and `@pikku/console` gains a read-only `/webhooks` page; also caches resolved secrets in `TypedSecretService` and registers inline-`func` metadata for queue/scheduler/trigger/gateway wirings.
+- 3c75366: Key `secretOverrides`/`variableOverrides` on the secretId/variableId (the string the addon actually reads by — its typed map is keyed by id, e.g. `getSecret('MAILGUN_CREDENTIALS')`), not the logical meta name. The runtime aliaser already keys on the id, but the inspector merge + validation keyed on the logical name, so a correctly-keyed override failed validation and never provisioned its target whenever an addon's logical name differed from its id (the common case — `mailgun`/`MAILGUN_CREDENTIALS`). The existing test masked it by using a secret whose name equalled its id. The merge now resolves and provisions by id (with a name-fallback for older meta), validation checks ids, and the console install codegen generates overrides keyed by id.
+- 7b2ea23: `wireAddon` can install one addon package as multiple named instances, each with its own per-instance singleton services and `secretOverrides`/`variableOverrides`/`credentialOverrides` that alias logical names to real project secrets/variables/credentials.
+- 13474a6: Extract `wireScope` declarations and validate scope references.
+
+  Functions referencing a scope that no `wireScope` declares now fail the build
+  with an `INVALID_VALUE` critical listing the available scopes, so a typo like
+  `admin:invoice:create` is caught at codegen rather than at runtime.
+
+  `wireScope` declarations wrapped in a cast (`as const`, `as any`) are unwrapped
+  before extraction rather than being silently skipped.
+
+- d2a6eea: Add `wireRemoteAddon` — consume a hosted addon's `remote: true` RPCs transparently over HTTP, with the addon installed as a devDependency (types only). `rpc('ns:fn', input)` dispatches to the host's `/remote/rpc/:rpcName`, authenticating as a client with a token bound from a local source (`{ credentialId }` per-user, `{ secretId }` platform, or a custom `resolve()`), or omitted for a public surface. This is any-machine → hosted-library client auth, distinct from the trusted mesh (`PIKKU_REMOTE_SECRET`). A new `.remote.gen.d.ts` RPC map exposes only the `remote: true` surface to consumers. `pikku` verify errors if a `wireRemoteAddon` package is a production dependency (or missing) instead of a devDependency, and if a bound `credentialId`/`secretId` isn't wired.
+- 30e62ee: Add `workflow.approval(reason, { schema, expiry })` — a return-valued, expiring human-in-the-loop gate that stays closed until a decision is recorded (via `workflowService.approveStep` or `POST /workflow/:workflowName/approve/:runId`), unlike the one-shot `workflow.suspend()`.
+- Updated dependencies [7ab5287]
+- Updated dependencies [e86bc17]
+- Updated dependencies [a9b96a0]
+- Updated dependencies [3f7fc54]
+- Updated dependencies [c478794]
+- Updated dependencies [3f04ae4]
+- Updated dependencies [90d9f04]
+- Updated dependencies [cb079cc]
+- Updated dependencies [cb079cc]
+- Updated dependencies [0a7db82]
+- Updated dependencies [981c4db]
+- Updated dependencies [13474a6]
+- Updated dependencies [5a2b0d5]
+- Updated dependencies [13474a6]
+- Updated dependencies [ee040dc]
+- Updated dependencies [cb079cc]
+- Updated dependencies [13474a6]
+- Updated dependencies [9f0d0eb]
+- Updated dependencies [13474a6]
+- Updated dependencies [70fa400]
+- Updated dependencies [7b2ea23]
+- Updated dependencies [1dc77d5]
+- Updated dependencies [416606c]
+- Updated dependencies [d2a6eea]
+- Updated dependencies [30e62ee]
+  - @pikku/core@0.12.64
+
 ## 0.12.42
 
 ### Patch Changes

package/dist/add/add-addon-bans.js

@@ -7,6 +7,7 @@ import { ErrorCode } from '../error-codes.js';
  */
 const BANNED_WIRINGS = new Set([
     'wireAddon',
+    'wireRemoteAddon',
     'wireChannel',
     'wireCLI',
     'wireGateway',

package/dist/add/add-ai-agent.d.ts

@@ -1,2 +1,4 @@
-import type { AddWiring } from '../types.js';
+import * as ts from 'typescript';
+import type { AddWiring, InspectorLogger } from '../types.js';
+export declare function resolveWorkflowReferences(obj: ts.ObjectLiteralExpression, checker: ts.TypeChecker, agentName: string, logger: InspectorLogger): string[] | null;
 export declare const addAIAgent: AddWiring;

package/dist/add/add-ai-agent.js

@@ -83,6 +83,81 @@ function resolveAgentReferences(obj, checker, agentName, logger) {
     }
     return resolved.length > 0 ? resolved : null;
 }
+export function resolveWorkflowReferences(obj, checker, agentName, logger) {
+    const property = obj.properties.find((p) => ts.isPropertyAssignment(p) &&
+        ts.isIdentifier(p.name) &&
+        p.name.text === 'workflows');
+    if (!property || !ts.isPropertyAssignment(property)) {
+        return null;
+    }
+    const initializer = property.initializer;
+    if (!ts.isArrayLiteralExpression(initializer)) {
+        return null;
+    }
+    const resolved = [];
+    for (const element of initializer.elements) {
+        if (ts.isStringLiteral(element)) {
+            logger.critical(ErrorCode.INVALID_VALUE, `AI agent '${agentName}' workflows array contains a string literal '${element.text}'. ` +
+                `Use a workflow reference instead (e.g., ref('<workflowName>') or import the pikkuWorkflowGraph variable).`);
+            continue;
+        }
+        if (ts.isCallExpression(element) && ts.isIdentifier(element.expression)) {
+            const calleeName = element.expression.text;
+            if (calleeName === 'ref' || calleeName === 'workflow') {
+                const [firstArg] = element.arguments;
+                if (firstArg && ts.isStringLiteral(firstArg)) {
+                    resolved.push(firstArg.text);
+                    continue;
+                }
+            }
+        }
+        if (ts.isIdentifier(element)) {
+            const name = resolveIdentifierToWorkflowName(element, checker);
+            if (name) {
+                resolved.push(name);
+                continue;
+            }
+            logger.critical(ErrorCode.INVALID_VALUE, `AI agent '${agentName}' workflows array contains identifier '${element.text}' ` +
+                `that could not be resolved to a pikkuWorkflowGraph.`);
+        }
+    }
+    return resolved.length > 0 ? resolved : null;
+}
+function resolveIdentifierToWorkflowName(identifier, checker) {
+    const symbol = checker.getSymbolAtLocation(identifier);
+    if (!symbol)
+        return null;
+    let resolved = symbol;
+    if (resolved.flags & ts.SymbolFlags.Alias) {
+        resolved = checker.getAliasedSymbol(resolved) ?? resolved;
+    }
+    const decl = resolved.valueDeclaration ?? resolved.declarations?.[0];
+    if (!decl)
+        return null;
+    if (ts.isVariableDeclaration(decl) && decl.initializer) {
+        if (ts.isCallExpression(decl.initializer) &&
+            ts.isIdentifier(decl.initializer.expression) &&
+            (decl.initializer.expression.text === 'pikkuWorkflowGraph' ||
+                decl.initializer.expression.text === 'pikkuWorkflow' ||
+                decl.initializer.expression.text === 'pikkuWorkflowComplex')) {
+            const firstArg = decl.initializer.arguments[0];
+            if (firstArg && ts.isObjectLiteralExpression(firstArg)) {
+                for (const prop of firstArg.properties) {
+                    if (ts.isPropertyAssignment(prop) &&
+                        ts.isIdentifier(prop.name) &&
+                        prop.name.text === 'name' &&
+                        ts.isStringLiteral(prop.initializer)) {
+                        return prop.initializer.text;
+                    }
+                }
+            }
+            if (ts.isIdentifier(decl.name)) {
+                return decl.name.text;
+            }
+        }
+    }
+    return null;
+}
 function resolveIdentifierToRpcName(identifier, checker) {
     const symbol = checker.getSymbolAtLocation(identifier);
     if (!symbol)
@@ -181,6 +256,12 @@ export const addAIAgent = (logger, node, checker, state, options) => {
             }
         }
         const agentsValue = resolveAgentReferences(obj, checker, nameValue || '', logger);
+        const workflowsValue = resolveWorkflowReferences(obj, checker, nameValue || '', logger);
+        if (workflowsValue) {
+            for (const workflowName of workflowsValue) {
+                state.workflows.invokedWorkflows.add(workflowName);
+            }
+        }
         if (!nameValue) {
             logger.critical(ErrorCode.MISSING_NAME, "AI agent is missing the required 'name' property.");
             return;
@@ -307,6 +388,7 @@ export const addAIAgent = (logger, node, checker, state, options) => {
             }),
             ...(toolsValue !== null && { tools: toolsValue }),
             ...(agentsValue !== null && { agents: agentsValue }),
+            ...(workflowsValue !== null && { workflows: workflowsValue }),
             tags,
             inputSchema,
             outputSchema,

package/dist/add/add-credential.js

@@ -1,5 +1,5 @@
 import * as ts from 'typescript';
-import { getPropertyValue, getArrayPropertyValue, assertStringLiteralProperty, } from '../utils/get-property-value.js';
+import { getPropertyValue, getArrayPropertyValue, getRecordPropertyValue, assertStringLiteralProperty, } from '../utils/get-property-value.js';
 import { ErrorCode } from '../error-codes.js';
 import { detectSchemaVendorOrError } from '../utils/detect-schema-vendor.js';
 export const addCredential = (logger, node, checker, state, _options) => {
@@ -22,6 +22,7 @@ export const addCredential = (logger, node, checker, state, _options) => {
         const displayNameValue = getPropertyValue(obj, 'displayName');
         const descriptionValue = getPropertyValue(obj, 'description');
         const typeValue = getPropertyValue(obj, 'type');
+        const docsUrlValue = getPropertyValue(obj, 'docsUrl');
         if (!nameValue) {
             logger.critical(ErrorCode.MISSING_NAME, "Credential is missing the required 'name' property.");
             return;
@@ -81,6 +82,7 @@ export const addCredential = (logger, node, checker, state, _options) => {
             const tokenUrl = getPropertyValue(oauth2Obj, 'tokenUrl');
             const scopes = getArrayPropertyValue(oauth2Obj, 'scopes');
             const pkce = getPropertyValue(oauth2Obj, 'pkce');
+            const additionalParams = getRecordPropertyValue(oauth2Obj, 'additionalParams');
             if (appCredentialSecretId && authorizationUrl && tokenUrl && scopes) {
                 oauth2 = {
                     appCredentialSecretId,
@@ -89,6 +91,7 @@ export const addCredential = (logger, node, checker, state, _options) => {
                     tokenUrl,
                     scopes,
                     pkce: pkce || undefined,
+                    additionalParams: additionalParams || undefined,
                 };
             }
         }
@@ -111,6 +114,7 @@ export const addCredential = (logger, node, checker, state, _options) => {
             displayName: displayNameValue,
             description: descriptionValue || undefined,
             type: typeValue,
+            docsUrl: docsUrlValue || undefined,
             schema: schemaLookupName,
             oauth2,
             sourceFile,

package/dist/add/add-functions.js

@@ -4,7 +4,7 @@ import { extractFunctionName, funcIdToTypeName, } from '../utils/extract-functio
 import { extractFunctionNode } from '../utils/extract-function-node.js';
 import { extractUsedWires } from '../utils/extract-services.js';
 import { formatVersionedId, parseVersionedId } from '@pikku/core';
-import { getPropertyValue, getCommonWireMetaData, } from '../utils/get-property-value.js';
+import { getPropertyValue, getArrayPropertyValue, getCommonWireMetaData, } from '../utils/get-property-value.js';
 import { canonicalJSON, hashString } from '../utils/hash.js';
 import { resolveMiddleware } from '../utils/middleware.js';
 import { resolvePermissions } from '../utils/permissions.js';
@@ -304,6 +304,7 @@ export const addFunctions = (logger, node, checker, state, options) => {
     let workflowQueued;
     let workflowRetries;
     let workflowTimeout;
+    let scopes;
     let version;
     let objectNode;
     let nodeDisplayName = null;
@@ -374,6 +375,7 @@ export const addFunctions = (logger, node, checker, state, options) => {
         workflowQueued = getPropertyValue(firstArg, 'workflowQueued');
         workflowRetries = getPropertyValue(firstArg, 'workflowRetries');
         workflowTimeout = getPropertyValue(firstArg, 'workflowTimeout');
+        scopes = getArrayPropertyValue(firstArg, 'scopes') ?? undefined;
         // Extract approvalDescription identifier reference
         for (const prop of firstArg.properties) {
             if (ts.isPropertyAssignment(prop) &&
@@ -735,13 +737,6 @@ export const addFunctions = (logger, node, checker, state, options) => {
         if (newMiddleware.length > 0) {
             middleware = [...(middleware || []), ...newMiddleware];
         }
-        const existingPermissionTags = new Set((permissions || [])
-            .filter((p) => p.type === 'tag')
-            .map((p) => p.tag));
-        const newPermissions = tagEntries.filter((e) => !existingPermissionTags.has(e.tag));
-        if (newPermissions.length > 0) {
-            permissions = [...(permissions || []), ...newPermissions];
-        }
     }
     const implementationHash = computeImplementationHash({
         wrapper: expression.text,
@@ -786,6 +781,7 @@ export const addFunctions = (logger, node, checker, state, options) => {
         workflowQueued: workflowQueued === true ? true : undefined,
         workflowRetries: workflowRetries ?? undefined,
         workflowTimeout: workflowTimeout ?? undefined,
+        scopes: scopes ?? undefined,
         implementationHash,
         version,
         title,
@@ -836,7 +832,6 @@ export const addFunctions = (logger, node, checker, state, options) => {
             inputSchema: inputNames[0] ?? null,
             outputSchema: outputNames[0] ?? null,
             middleware,
-            permissions,
         };
         state.serviceAggregation.usedFunctions.add(pikkuFuncId);
         extractWireNames(middleware).forEach((n) => state.serviceAggregation.usedMiddleware.add(n));
@@ -870,6 +865,12 @@ export const addFunctions = (logger, node, checker, state, options) => {
         }
         if (remote) {
             state.rpc.invokedFunctions.add(pikkuFuncId);
+            // The consumer-facing surface a wireRemoteAddon imports (mirrors exposedMeta)
+            state.rpc.remoteMeta[name] = pikkuFuncId;
+            state.rpc.remoteFiles.set(name, {
+                path: node.getSourceFile().fileName,
+                exportedName,
+            });
         }
         if (expose) {
             state.rpc.exposedMeta[name] = pikkuFuncId;

package/dist/add/add-gateway.js

@@ -2,6 +2,7 @@ import * as ts from 'typescript';
 import { getPropertyValue, getCommonWireMetaData, } from '../utils/get-property-value.js';
 import { extractFunctionName, makeContextBasedId, } from '../utils/extract-function-name.js';
 import { getPropertyAssignmentInitializer } from '../utils/type-utils.js';
+import { ensureInlineWiringFunction } from '../utils/ensure-function-metadata.js';
 import { resolveMiddleware } from '../utils/middleware.js';
 import { extractWireNames } from '../utils/post-process.js';
 import { resolveAddonName } from '../utils/resolve-addon-package.js';
@@ -44,6 +45,8 @@ export const addGateway = (logger, node, checker, state, _options) => {
     if (!nameValue || !typeValue) {
         return;
     }
+    // Register metadata for a func inlined into the wiring (see helper).
+    ensureInlineWiringFunction(state, pikkuFuncId, nameValue, funcInitializer, checker, extracted.isHelper);
     const middleware = resolveMiddleware(state, obj, tags, checker);
     state.serviceAggregation.usedFunctions.add(pikkuFuncId);
     extractWireNames(middleware).forEach((name) => state.serviceAggregation.usedMiddleware.add(name));

package/dist/add/add-http-route.js

@@ -4,7 +4,7 @@ import { pathToRegexp } from 'path-to-regexp';
 import { extractFunctionName, makeContextBasedId, } from '../utils/extract-function-name.js';
 import { getPropertyAssignmentInitializer, extractTypeKeys, } from '../utils/type-utils.js';
 import { resolveHTTPMiddlewareFromObject } from '../utils/middleware.js';
-import { resolveHTTPPermissionsFromObject } from '../utils/permissions.js';
+import { resolvePermissions } from '../utils/permissions.js';
 import { extractWireNames } from '../utils/post-process.js';
 import { ensureFunctionMetadata } from '../utils/ensure-function-metadata.js';
 import { resolveFunctionMeta } from '../utils/resolve-function-meta.js';
@@ -219,7 +219,7 @@ export function registerHTTPRoute({ obj, state, checker, logger, sourceFile, bas
     // Resolve middleware
     const middleware = resolveHTTPMiddlewareFromObject(state, fullRoute, obj, tags, checker);
     // Resolve permissions
-    const permissions = resolveHTTPPermissionsFromObject(state, fullRoute, obj, tags, checker);
+    const permissions = resolvePermissions(state, obj, tags, checker);
     state.serviceAggregation.usedFunctions.add(funcName);
     if (refAddonTarget) {
         state.serviceAggregation.usedFunctions.add(refAddonTarget);

package/dist/add/add-keyed-wiring.js

@@ -26,6 +26,7 @@ export const createAddKeyedWiring = (config) => {
             const displayNameValue = getPropertyValue(obj, 'displayName');
             const descriptionValue = getPropertyValue(obj, 'description');
             const rotationPeriodValue = getPropertyValue(obj, 'rotationPeriod');
+            const docsUrlValue = getPropertyValue(obj, 'docsUrl');
             const idValue = getPropertyValue(obj, config.idField);
             let schemaVariableName = null;
             let schemaSourceFile = null;
@@ -102,6 +103,7 @@ export const createAddKeyedWiring = (config) => {
                 displayName: displayNameValue,
                 description: descriptionValue || undefined,
                 rotationPeriod: rotationPeriodValue || undefined,
+                docsUrl: docsUrlValue || undefined,
                 [config.idField]: idValue,
                 schema: schemaLookupName,
                 sourceFile,

package/dist/add/add-mcp-prompt.js

@@ -83,7 +83,6 @@ export const addMCPPrompt = (logger, node, checker, state, options) => {
             outputSchema,
             arguments: [], // Will be populated by CLI during serialization
             middleware,
-            permissions,
         };
     }
 };

package/dist/add/add-mcp-resource.js

@@ -93,7 +93,6 @@ export const addMCPResource = (logger, node, checker, state, options) => {
             inputSchema,
             outputSchema,
             middleware,
-            permissions,
         };
     }
 };

package/dist/add/add-permission.d.ts

@@ -1,5 +1,5 @@
 import type { AddWiring } from '../types.js';
 /**
- * Inspect pikkuPermission calls, addPermission calls, and addHTTPPermission calls
+ * Inspect pikkuPermission, pikkuAuth, and pikkuPermissionFactory definitions.
  */
 export declare const addPermission: AddWiring;