@pikku/inspector 0.12.42 → 0.12.44

package/src/add/add-workflow-sleep-expression.test.ts

@@ -0,0 +1,97 @@
+import { strict as assert } from 'assert'
+import { describe, test } from 'node:test'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { inspect } from '../inspector.js'
+import type { InspectorLogger } from '../types.js'
+
+const STEPS = [
+  "import { pikkuSessionlessFunc } from '@pikku/core'",
+  "export const notify = pikkuSessionlessFunc({ func: async () => ({ id: 'n' }) })",
+].join('\n')
+
+async function run(body: string) {
+  const diags: string[] = []
+  const logger = {
+    debug: () => {},
+    info: () => {},
+    warn: () => {},
+    error: () => {},
+    diagnostic: (...a: any[]) => diags.push(a.map(String).join(' ')),
+    critical: (...a: any[]) => diags.push(a.map(String).join(' ')),
+    hasCriticalErrors: () => false,
+  } as unknown as InspectorLogger
+
+  const rootDir = await mkdtemp(join(tmpdir(), 'pikku-sleep-'))
+  const stepFile = join(rootDir, 'w.steps.ts')
+  const wfFile = join(rootDir, 'w.workflow.ts')
+  await writeFile(stepFile, STEPS)
+  await writeFile(
+    wfFile,
+    [
+      "import { pikkuWorkflowFunc } from '@pikku/core/workflow'",
+      'export const wf = pikkuWorkflowFunc(async (_, data: any, { workflow }) => {',
+      body,
+      '})',
+    ].join('\n')
+  )
+  try {
+    const state: any = await inspect(logger, [stepFile, wfFile], { rootDir })
+    const gm = state.workflows.graphMeta
+    const graph = (gm instanceof Map ? [...gm.values()] : Object.values(gm))[0]
+    return { graph: graph as any, diags }
+  } finally {
+    await rm(rootDir, { recursive: true, force: true })
+  }
+}
+
+describe('sleep with a duration that is not a literal', () => {
+  test('a variable duration inside a loop is kept, not rejected', async () => {
+    const { graph, diags } = await run(
+      [
+        '  for (const interval of data.intervals) {',
+        '    await workflow.sleep(`Wait ${interval}`, interval)',
+        "    await workflow.do('Notify', 'notify', {})",
+        '  }',
+        '  return { sent: true }',
+      ].join('\n')
+    )
+
+    assert.deepEqual(
+      diags.filter((d) => d.includes('sleep')),
+      [],
+      'a duration only known at runtime is legal — the closure evaluates it'
+    )
+
+    const sleepNode = Object.values(graph?.nodes ?? {}).find(
+      (n: any) => n.flow === 'sleep'
+    ) as any
+    assert.ok(sleepNode, 'the sleep must still appear in the graph')
+    assert.equal(
+      sleepNode.expression,
+      'interval',
+      'its source text is recorded so the graph can show what it waits on'
+    )
+  })
+
+  test('a literal duration still round-trips as a value', async () => {
+    const { graph, diags } = await run(
+      [
+        "  await workflow.sleep('Wait', '5s')",
+        '  return { sent: true }',
+      ].join('\n')
+    )
+
+    assert.deepEqual(diags, [])
+    const sleepNode = Object.values(graph?.nodes ?? {}).find(
+      (n: any) => n.flow === 'sleep'
+    ) as any
+    assert.equal(sleepNode?.duration, '5s')
+    assert.equal(
+      sleepNode?.expression,
+      undefined,
+      'a literal is a value, not an expression'
+    )
+  })
+})

package/src/add/add-workflow.ts

@@ -73,8 +73,8 @@ function hasInlineSteps(steps: WorkflowStepMeta[]): boolean {
         if (c.steps && hasInlineSteps(c.steps)) return true
       }
       if (step.defaultSteps && hasInlineSteps(step.defaultSteps)) return true
-    } else if (step.type === 'fanout' && step.child) {
-      if (hasInlineSteps([step.child])) return true
+    } else if (step.type === 'fanout' && step.body) {
+      if (hasInlineSteps(step.body)) return true
     } else if (step.type === 'parallel' && step.children) {
       if (hasInlineSteps(step.children)) return true
     }
@@ -92,6 +92,11 @@ export function collectInvokedRPCs(
   for (const step of steps) {
     if (step.type === 'rpc' && step.rpcName) {
       rpcs.add(step.rpcName)
+      // The compensation handler is invoked at runtime too, so it has to be
+      // wired like any other step.
+      if (step.options?.onError) {
+        rpcs.add(step.options.onError)
+      }
     } else if (step.type === 'branch') {
       for (const branch of step.branches) {
         collectInvokedRPCs(branch.steps, rpcs)
@@ -102,8 +107,8 @@ export function collectInvokedRPCs(
         if (c.steps) collectInvokedRPCs(c.steps, rpcs)
       }
       if (step.defaultSteps) collectInvokedRPCs(step.defaultSteps, rpcs)
-    } else if (step.type === 'fanout' && step.child) {
-      collectInvokedRPCs([step.child], rpcs)
+    } else if (step.type === 'fanout' && step.body) {
+      collectInvokedRPCs(step.body, rpcs)
     } else if (step.type === 'parallel' && step.children) {
       collectInvokedRPCs(step.children, rpcs)
     }

package/src/add/config-value-metadata.test.ts

@@ -0,0 +1,169 @@
+import { strict as assert } from 'assert'
+import { describe, test } from 'node:test'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { inspect } from '../inspector.js'
+import type { ErrorCode } from '../error-codes.js'
+import type { InspectorLogger } from '../types.js'
+
+// Fixtures must sit inside the package so `zod` resolves — the schema-vendor
+// check rejects a schema it cannot trace to a supported library, and the
+// definition is then never recorded at all.
+const fixtureRoot = join(
+  fileURLToPath(new URL('.', import.meta.url)),
+  '__fixtures'
+)
+
+const makeLogger = (criticals: Array<{ code: ErrorCode; message: string }>) =>
+  ({
+    debug: () => {},
+    info: () => {},
+    warn: () => {},
+    error: () => {},
+    diagnostic: ({ code, message }) => {
+      criticals.push({ code, message })
+    },
+    critical: (code: ErrorCode, message: string) => {
+      criticals.push({ code, message })
+    },
+    hasCriticalErrors: () => criticals.length > 0,
+  }) satisfies InspectorLogger
+
+/**
+ * `docsUrl` is only useful if it survives inspection — a field declared on the
+ * wiring but dropped by the inspector is invisible to every consumer
+ * downstream, which is exactly how `displayName` went unused.
+ */
+describe('config value metadata (docsUrl)', () => {
+  test('carries docsUrl from wireSecret into the definition', async () => {
+    const rootDir = await mkdtemp(`${fixtureRoot}-secret-`)
+    const file = join(rootDir, 'secret.ts')
+
+    await writeFile(
+      file,
+      [
+        "import { wireSecret } from '@pikku/core'",
+        "import { z } from 'zod'",
+        'export const StripeKeySchema = z.string()',
+        'wireSecret({',
+        "  name: 'stripeKey',",
+        "  displayName: 'Stripe Secret Key',",
+        "  secretId: 'STRIPE_SECRET_KEY',",
+        "  docsUrl: 'https://dashboard.stripe.com/apikeys',",
+        '  schema: StripeKeySchema,',
+        '})',
+      ].join('\n')
+    )
+
+    const criticals: Array<{ code: ErrorCode; message: string }> = []
+    try {
+      const state = await inspect(makeLogger(criticals), [file], { rootDir })
+      const def = state.secrets.definitions.find(
+        (d) => d.secretId === 'STRIPE_SECRET_KEY'
+      )
+      assert.ok(def, 'expected the secret definition to be inspected')
+      assert.equal(def!.docsUrl, 'https://dashboard.stripe.com/apikeys')
+    } finally {
+      await rm(rootDir, { recursive: true, force: true })
+    }
+  })
+
+  test('leaves docsUrl undefined when not declared', async () => {
+    const rootDir = await mkdtemp(`${fixtureRoot}-bare-`)
+    const file = join(rootDir, 'secret.ts')
+
+    await writeFile(
+      file,
+      [
+        "import { wireSecret } from '@pikku/core'",
+        "import { z } from 'zod'",
+        'export const ApiKeySchema = z.string()',
+        'wireSecret({',
+        "  name: 'apiKey',",
+        "  displayName: 'API Key',",
+        "  secretId: 'API_KEY',",
+        '  schema: ApiKeySchema,',
+        '})',
+      ].join('\n')
+    )
+
+    const criticals: Array<{ code: ErrorCode; message: string }> = []
+    try {
+      const state = await inspect(makeLogger(criticals), [file], { rootDir })
+      const def = state.secrets.definitions.find(
+        (d) => d.secretId === 'API_KEY'
+      )
+      assert.ok(def, 'expected the secret definition to be inspected')
+      assert.equal(def!.docsUrl, undefined)
+    } finally {
+      await rm(rootDir, { recursive: true, force: true })
+    }
+  })
+
+  test('carries docsUrl from wireVariable into the definition', async () => {
+    const rootDir = await mkdtemp(`${fixtureRoot}-variable-`)
+    const file = join(rootDir, 'variable.ts')
+
+    await writeFile(
+      file,
+      [
+        "import { wireVariable } from '@pikku/core'",
+        "import { z } from 'zod'",
+        'export const ConsoleUrlSchema = z.string()',
+        'wireVariable({',
+        "  name: 'consoleUrl',",
+        "  displayName: 'Console URL',",
+        "  variableId: 'CONSOLE_URL',",
+        "  docsUrl: 'https://example.com/docs/console-url',",
+        '  schema: ConsoleUrlSchema,',
+        '})',
+      ].join('\n')
+    )
+
+    const criticals: Array<{ code: ErrorCode; message: string }> = []
+    try {
+      const state = await inspect(makeLogger(criticals), [file], { rootDir })
+      const def = state.variables.definitions.find(
+        (d) => d.variableId === 'CONSOLE_URL'
+      )
+      assert.ok(def, 'expected the variable definition to be inspected')
+      assert.equal(def!.docsUrl, 'https://example.com/docs/console-url')
+    } finally {
+      await rm(rootDir, { recursive: true, force: true })
+    }
+  })
+
+  test('carries docsUrl from wireCredential into the definition', async () => {
+    const rootDir = await mkdtemp(`${fixtureRoot}-credential-`)
+    const file = join(rootDir, 'credential.ts')
+
+    await writeFile(
+      file,
+      [
+        "import { wireCredential } from '@pikku/core'",
+        "import { z } from 'zod'",
+        'export const TokenSchema = z.object({ token: z.string() })',
+        'wireCredential({',
+        "  name: 'githubToken',",
+        "  displayName: 'GitHub Token',",
+        "  type: 'wire',",
+        "  docsUrl: 'https://github.com/settings/tokens',",
+        '  schema: TokenSchema,',
+        '})',
+      ].join('\n')
+    )
+
+    const criticals: Array<{ code: ErrorCode; message: string }> = []
+    try {
+      const state = await inspect(makeLogger(criticals), [file], { rootDir })
+      const def = state.credentials.definitions.find(
+        (d) => d.name === 'githubToken'
+      )
+      assert.ok(def, 'expected the credential definition to be inspected')
+      assert.equal(def!.docsUrl, 'https://github.com/settings/tokens')
+    } finally {
+      await rm(rootDir, { recursive: true, force: true })
+    }
+  })
+})

package/src/add/inline-wiring-function.test.ts

@@ -0,0 +1,104 @@
+import { strict as assert } from 'assert'
+import { describe, test } from 'node:test'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { inspect } from '../inspector.js'
+import type { ErrorCode, InspectorLogger } from '../types.js'
+
+const silentLogger = (): InspectorLogger => ({
+  debug: () => {},
+  info: () => {},
+  warn: () => {},
+  error: () => {},
+  diagnostic: () => {},
+  critical: (_code: ErrorCode, _message: string) => {},
+  hasCriticalErrors: () => false,
+})
+
+// A `func:` inlined into a wiring has no exported name, so addFunctions skips
+// it and only the wiring's context-based id exists. The wiring visitor must
+// register the function metadata under that id (via ensureInlineWiringFunction)
+// or the transport resolves to nothing at runtime ("Missing generated metadata
+// for ...") and, once registered, every invocation would 403 unless the
+// sessionless flag is carried across from the helper used.
+const WIRINGS = [
+  {
+    label: 'wireQueueWorker',
+    wire: 'wireQueueWorker',
+    props: "name: 'inline-queue',",
+    expectedId: 'queue:inline-queue',
+  },
+  {
+    label: 'wireScheduler',
+    wire: 'wireScheduler',
+    props: "name: 'inline-cron', schedule: '* * * * *',",
+    expectedId: 'scheduler:inline-cron',
+  },
+  {
+    label: 'wireTrigger',
+    wire: 'wireTrigger',
+    props: "name: 'inline-trigger',",
+    expectedId: 'trigger:inline-trigger',
+  },
+  {
+    label: 'wireGateway',
+    wire: 'wireGateway',
+    props: "name: 'inline-gw', type: 'slack',",
+    expectedId: 'gateway:inline-gw',
+  },
+]
+
+const write = (wire: string, props: string, helper: string) =>
+  [
+    `import { ${helper}, ${wire} } from '@pikku/core'`,
+    `${wire}({`,
+    `  ${props}`,
+    `  func: ${helper}<{ url: string }, void>({ func: async () => {} }),`,
+    '})',
+  ].join('\n')
+
+describe('inline wiring functions register metadata', () => {
+  for (const { label, wire, props, expectedId } of WIRINGS) {
+    test(`${label} registers a sessionless func inlined into it`, async () => {
+      const rootDir = await mkdtemp(join(tmpdir(), 'pikku-inline-'))
+      const file = join(rootDir, 'wire.ts')
+      await writeFile(file, write(wire, props, 'pikkuSessionlessFunc'))
+
+      try {
+        const state = await inspect(silentLogger(), [file], { rootDir })
+        const funcMeta = state.functions.meta[expectedId]
+        assert.ok(
+          funcMeta,
+          `${label}: metadata must exist under the id the wiring references`
+        )
+        assert.equal(
+          funcMeta!.sessionless,
+          true,
+          `${label}: pikkuSessionlessFunc must stay sessionless when inlined`
+        )
+      } finally {
+        await rm(rootDir, { recursive: true, force: true })
+      }
+    })
+
+    test(`${label} keeps an inlined pikkuFunc session-required`, async () => {
+      const rootDir = await mkdtemp(join(tmpdir(), 'pikku-inline-auth-'))
+      const file = join(rootDir, 'wire.ts')
+      await writeFile(file, write(wire, props, 'pikkuFunc'))
+
+      try {
+        const state = await inspect(silentLogger(), [file], { rootDir })
+        const funcMeta = state.functions.meta[expectedId]
+        assert.ok(funcMeta, `${label}: metadata must exist`)
+        assert.equal(
+          funcMeta!.sessionless,
+          false,
+          `${label}: pikkuFunc must not be marked sessionless`
+        )
+      } finally {
+        await rm(rootDir, { recursive: true, force: true })
+      }
+    })
+  }
+})

package/src/add/validate-workflow-graph-addons.test.ts

@@ -0,0 +1,102 @@
+import { strict as assert } from 'assert'
+import { describe, test } from 'node:test'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { inspect } from '../inspector.js'
+import type { InspectorLogger } from '../types.js'
+import { ErrorCode } from '../error-codes.js'
+
+function makeLogger(
+  criticals: Array<{ code: string; message: string }>
+): InspectorLogger {
+  return {
+    debug: () => {},
+    info: () => {},
+    warn: () => {},
+    error: () => {},
+    diagnostic: () => {},
+    critical: (code, message) => criticals.push({ code, message }),
+    hasCriticalErrors: () => criticals.length > 0,
+  }
+}
+
+describe('validateWorkflowGraphAddons', () => {
+  test('a graph node referencing graph: without @pikku/addon-graph wired raises PKU642', async () => {
+    const rootDir = await mkdtemp(join(tmpdir(), 'pikku-graph-addon-'))
+    const stepFile = join(rootDir, 'my.steps.ts')
+    const graphFile = join(rootDir, 'my.graph.ts')
+
+    await writeFile(
+      stepFile,
+      [
+        "import { pikkuSessionlessFunc } from '@pikku/core'",
+        'export const notify = pikkuSessionlessFunc({ func: async () => ({ sent: true }) })',
+      ].join('\n')
+    )
+    await writeFile(
+      graphFile,
+      [
+        "import { pikkuWorkflowGraph } from '@pikku/core/workflow'",
+        'export const myGraph = pikkuWorkflowGraph({',
+        "  name: 'my-graph',",
+        '  nodes: {',
+        "    setFields: 'graph:editFields',",
+        "    notify: 'notify',",
+        '  },',
+        "  config: { setFields: { next: 'notify' }, notify: {} },",
+        '})',
+      ].join('\n')
+    )
+
+    try {
+      const criticals: Array<{ code: string; message: string }> = []
+      await inspect(makeLogger(criticals), [stepFile, graphFile], { rootDir })
+      const hit = criticals.find(
+        (c) => c.code === ErrorCode.WORKFLOW_GRAPH_ADDON_NOT_WIRED
+      )
+      assert.ok(hit, 'expected a WORKFLOW_GRAPH_ADDON_NOT_WIRED critical')
+      assert.match(hit!.message, /@pikku\/addon-graph is not wired/)
+      assert.match(hit!.message, /scaffold/)
+    } finally {
+      await rm(rootDir, { recursive: true, force: true })
+    }
+  })
+
+  test('a graph with only user RPCs raises no addon-graph critical', async () => {
+    const rootDir = await mkdtemp(join(tmpdir(), 'pikku-graph-addon-ok-'))
+    const stepFile = join(rootDir, 'my.steps.ts')
+    const graphFile = join(rootDir, 'my.graph.ts')
+
+    await writeFile(
+      stepFile,
+      [
+        "import { pikkuSessionlessFunc } from '@pikku/core'",
+        'export const assess = pikkuSessionlessFunc({ func: async () => ({ ok: true }) })',
+        'export const notify = pikkuSessionlessFunc({ func: async () => ({ sent: true }) })',
+      ].join('\n')
+    )
+    await writeFile(
+      graphFile,
+      [
+        "import { pikkuWorkflowGraph } from '@pikku/core/workflow'",
+        'export const myGraph = pikkuWorkflowGraph({',
+        "  name: 'my-graph',",
+        "  nodes: { assess: 'assess', notify: 'notify' },",
+        "  config: { assess: { next: 'notify' }, notify: {} },",
+        '})',
+      ].join('\n')
+    )
+
+    try {
+      const criticals: Array<{ code: string; message: string }> = []
+      await inspect(makeLogger(criticals), [stepFile, graphFile], { rootDir })
+      const hit = criticals.find(
+        (c) => c.code === ErrorCode.WORKFLOW_GRAPH_ADDON_NOT_WIRED
+      )
+      assert.equal(hit, undefined, 'no addon-graph critical expected')
+    } finally {
+      await rm(rootDir, { recursive: true, force: true })
+    }
+  })
+})

package/src/error-codes.ts

@@ -24,6 +24,11 @@ export enum ErrorCode {
   EXPECT_EVENTUALLY_SCENARIO_ONLY = 'PKU675',
   WORKFLOW_ORCHESTRATOR_NOT_CONFIGURED = 'PKU600',
   INVALID_DSL_WORKFLOW = 'PKU641',
+  WORKFLOW_GRAPH_ADDON_NOT_WIRED = 'PKU642',
+
+  // Remote addon (wireRemoteAddon) validation
+  REMOTE_ADDON_NOT_DEV_DEPENDENCY = 'PKU338',
+  REMOTE_ADDON_AUTH_UNRESOLVED = 'PKU339',
 
   // Database schema codegen warnings
   DB_COLUMN_NAME_TYPE_CONTRADICTION = 'PKU480',

package/src/inspector.ts

@@ -18,12 +18,16 @@ import {
   validateSecretOverrides,
   validateVariableOverrides,
   validateCredentialOverrides,
+  validateRemoteAddonDependencies,
+  validateRemoteAddonAuth,
+  validateScopeReferences,
   computeResolvedIOTypes,
   computeMiddlewareGroupsMeta,
   computePermissionsGroupsMeta,
   computeRequiredSchemas,
   computeDiagnostics,
   validateSchemaWiringSeparation,
+  validateWorkflowGraphAddons,
 } from './utils/post-process.js'
 import { generateOpenAPISpec } from './utils/serialize-openapi-json.js'
 import { pikkuState } from '@pikku/core/internal'
@@ -90,7 +94,6 @@ export function getInitialInspectorState(rootDir: string): InspectorState {
       },
       files: new Set(),
       routeMiddleware: new Map(),
-      routePermissions: new Map(),
     },
     channels: {
       files: new Set(),
@@ -125,6 +128,8 @@ export function getInitialInspectorState(rootDir: string): InspectorState {
       internalFiles: new Map(),
       exposedMeta: {},
       exposedFiles: new Map(),
+      remoteMeta: {},
+      remoteFiles: new Map(),
       invokedFunctions: new Set(),
       invokedFunctionsByFile: new Map(),
       usedAddons: new Set(),
@@ -166,6 +171,10 @@ export function getInitialInspectorState(rootDir: string): InspectorState {
       definitions: [],
       files: new Set(),
     },
+    scopes: {
+      definitions: [],
+      files: new Set(),
+    },
     variables: {
       definitions: [],
       files: new Set(),
@@ -191,7 +200,6 @@ export function getInitialInspectorState(rootDir: string): InspectorState {
     permissions: {
       definitions: {},
       instances: {},
-      tagPermissions: new Map(),
     },
     serviceAggregation: {
       requiredServices: new Set(),
@@ -215,8 +223,6 @@ export function getInitialInspectorState(rootDir: string): InspectorState {
     },
     permissionsGroupsMeta: {
       definitions: {},
-      httpGroups: {},
-      tagGroups: {},
     },
     requiredSchemas: new Set(),
     openAPISpec: null,
@@ -400,6 +406,7 @@ export const inspect = async (
     computePermissionsGroupsMeta(state)
     computeDiagnostics(state)
     validateSchemaWiringSeparation(logger, state)
+    validateWorkflowGraphAddons(logger, state)
 
     if (options.openAPI) {
       state.openAPISpec = await generateOpenAPISpec(
@@ -416,6 +423,9 @@ export const inspect = async (
     validateSecretOverrides(logger, state)
     validateVariableOverrides(logger, state)
     validateCredentialOverrides(logger, state)
+    validateRemoteAddonDependencies(logger, state)
+    validateRemoteAddonAuth(logger, state)
+    validateScopeReferences(logger, state)
   }
 
   state.program = program

package/src/types.ts

@@ -17,6 +17,7 @@ import type { CLICommandMeta } from '@pikku/core/cli'
 import type { NodesMeta } from '@pikku/core/node'
 import type { SecretDefinitions } from '@pikku/core/secret'
 import type { CredentialDefinitions } from '@pikku/core/credential'
+import type { ScopeDefinitions } from '@pikku/core/scope'
 import type { VariableDefinitions } from '@pikku/core/variable'
 import type { TypesMap } from './types-map.js'
 import type {
@@ -57,16 +58,6 @@ export interface MiddlewareGroupMeta {
   isFactory: boolean // true if wrapped in () => add...()
 }
 
-export interface PermissionGroupMeta {
-  exportName: string | null // null if not exported
-  sourceFile: string
-  position: number
-  services: FunctionServicesMeta
-  count: number
-  instanceIds: string[]
-  isFactory: boolean // true if wrapped in () => add...()
-}
-
 export interface InspectorHTTPState {
   metaInputTypes: MetaInputTypes
   meta: HTTPWiringsMeta
@@ -75,10 +66,6 @@ export interface InspectorHTTPState {
   // Pattern '*' matches all routes (from addHTTPMiddleware('*', [...]))
   // Pattern '/api/*' matches specific routes (from addHTTPMiddleware('/api/*', [...]))
   routeMiddleware: Map<string, MiddlewareGroupMeta>
-  // HTTP permission calls tracking - route pattern -> group metadata
-  // Pattern '*' matches all routes (from addHTTPPermission('*', [...]))
-  // Pattern '/api/*' matches specific routes (from addHTTPPermission('/api/*', [...]))
-  routePermissions: Map<string, PermissionGroupMeta>
 }
 
 /**
@@ -241,7 +228,6 @@ export interface InspectorPermissionInstance {
 export interface InspectorPermissionState {
   definitions: Record<string, InspectorPermissionDefinition>
   instances: Record<string, InspectorPermissionInstance>
-  tagPermissions: Map<string, PermissionGroupMeta>
 }
 
 export type InspectorFilters = {
@@ -487,6 +473,9 @@ export interface InspectorState {
     internalFiles: Map<string, { path: string; exportedName: string }>
     exposedMeta: Record<string, string>
     exposedFiles: Map<string, { path: string; exportedName: string }>
+    /** Functions marked `remote: true` — the surface a wireRemoteAddon consumer imports */
+    remoteMeta: Record<string, string>
+    remoteFiles: Map<string, { path: string; exportedName: string }>
     invokedFunctions: Set<string>
     invokedFunctionsByFile: Map<string, Set<string>>
     usedAddons: Set<string>
@@ -496,6 +485,14 @@ export interface InspectorState {
         package: string
         rpcEndpoint?: string
         mcp?: boolean
+        /** True when declared via `wireRemoteAddon` — import the addon's `.remote.gen` map, not `.internal.gen` */
+        remote?: boolean
+        /** wireRemoteAddon: whether an `auth` binding was supplied (vs a public surface) */
+        hasAuth?: boolean
+        /** wireRemoteAddon: statically-known `auth.credentialId`, for verify */
+        authCredentialId?: string
+        /** wireRemoteAddon: statically-known `auth.secretId`, for verify */
+        authSecretId?: string
         secretOverrides?: Record<string, string>
         variableOverrides?: Record<string, string>
         credentialOverrides?: Record<string, string>
@@ -549,6 +546,10 @@ export interface InspectorState {
     definitions: CredentialDefinitions
     files: Set<string>
   }
+  scopes: {
+    definitions: ScopeDefinitions
+    files: Set<string>
+  }
   variables: {
     definitions: VariableDefinitions
     files: Set<string>
@@ -584,8 +585,6 @@ export interface InspectorState {
   }
   permissionsGroupsMeta: {
     definitions: Record<string, InspectorPermissionDefinition>
-    httpGroups: Record<string, PermissionGroupMeta>
-    tagGroups: Record<string, PermissionGroupMeta>
   }
   requiredSchemas: Set<string>
   openAPISpec: Record<string, any> | null