@pikku/inspector 0.12.42 → 0.12.44

package/dist/inspector.js

@@ -6,7 +6,7 @@ import { TypesMap } from './types-map.js';
 import { getFilesAndMethods } from './utils/get-files-and-methods.js';
 import { findCommonAncestor } from './utils/find-root-dir.js';
 import { createNestedProjectFilter } from './utils/nested-project-filter.js';
-import { aggregateRequiredServices, stampAuthHandlerServices, validateAgentModels, validateSecretOverrides, validateVariableOverrides, validateCredentialOverrides, computeResolvedIOTypes, computeMiddlewareGroupsMeta, computePermissionsGroupsMeta, computeRequiredSchemas, computeDiagnostics, validateSchemaWiringSeparation, } from './utils/post-process.js';
+import { aggregateRequiredServices, stampAuthHandlerServices, validateAgentModels, validateSecretOverrides, validateVariableOverrides, validateCredentialOverrides, validateRemoteAddonDependencies, validateRemoteAddonAuth, validateScopeReferences, computeResolvedIOTypes, computeMiddlewareGroupsMeta, computePermissionsGroupsMeta, computeRequiredSchemas, computeDiagnostics, validateSchemaWiringSeparation, validateWorkflowGraphAddons, } from './utils/post-process.js';
 import { generateOpenAPISpec } from './utils/serialize-openapi-json.js';
 import { pikkuState } from '@pikku/core/internal';
 import { resolveLatestVersions } from './utils/resolve-versions.js';
@@ -59,7 +59,6 @@ export function getInitialInspectorState(rootDir) {
             },
             files: new Set(),
             routeMiddleware: new Map(),
-            routePermissions: new Map(),
         },
         channels: {
             files: new Set(),
@@ -94,6 +93,8 @@ export function getInitialInspectorState(rootDir) {
             internalFiles: new Map(),
             exposedMeta: {},
             exposedFiles: new Map(),
+            remoteMeta: {},
+            remoteFiles: new Map(),
             invokedFunctions: new Set(),
             invokedFunctionsByFile: new Map(),
             usedAddons: new Set(),
@@ -135,6 +136,10 @@ export function getInitialInspectorState(rootDir) {
             definitions: [],
             files: new Set(),
         },
+        scopes: {
+            definitions: [],
+            files: new Set(),
+        },
         variables: {
             definitions: [],
             files: new Set(),
@@ -160,7 +165,6 @@ export function getInitialInspectorState(rootDir) {
         permissions: {
             definitions: {},
             instances: {},
-            tagPermissions: new Map(),
         },
         serviceAggregation: {
             requiredServices: new Set(),
@@ -184,8 +188,6 @@ export function getInitialInspectorState(rootDir) {
         },
         permissionsGroupsMeta: {
             definitions: {},
-            httpGroups: {},
-            tagGroups: {},
         },
         requiredSchemas: new Set(),
         openAPISpec: null,
@@ -307,6 +309,7 @@ export const inspect = async (logger, routeFiles, options = {}) => {
         computePermissionsGroupsMeta(state);
         computeDiagnostics(state);
         validateSchemaWiringSeparation(logger, state);
+        validateWorkflowGraphAddons(logger, state);
         if (options.openAPI) {
             state.openAPISpec = await generateOpenAPISpec(logger, state.functions.meta, state.http.meta, state.schemas, options.openAPI.additionalInfo, pikkuState(null, 'misc', 'errors'));
         }
@@ -314,6 +317,9 @@ export const inspect = async (logger, routeFiles, options = {}) => {
         validateSecretOverrides(logger, state);
         validateVariableOverrides(logger, state);
         validateCredentialOverrides(logger, state);
+        validateRemoteAddonDependencies(logger, state);
+        validateRemoteAddonAuth(logger, state);
+        validateScopeReferences(logger, state);
     }
     state.program = program;
     return state;

package/dist/types.d.ts

@@ -13,6 +13,7 @@ import type { CLICommandMeta } from '@pikku/core/cli';
 import type { NodesMeta } from '@pikku/core/node';
 import type { SecretDefinitions } from '@pikku/core/secret';
 import type { CredentialDefinitions } from '@pikku/core/credential';
+import type { ScopeDefinitions } from '@pikku/core/scope';
 import type { VariableDefinitions } from '@pikku/core/variable';
 import type { TypesMap } from './types-map.js';
 import type { FunctionsMeta, FunctionServicesMeta, FunctionWiresMeta, JSONValue } from '@pikku/core';
@@ -39,21 +40,11 @@ export interface MiddlewareGroupMeta {
     instanceIds: string[];
     isFactory: boolean;
 }
-export interface PermissionGroupMeta {
-    exportName: string | null;
-    sourceFile: string;
-    position: number;
-    services: FunctionServicesMeta;
-    count: number;
-    instanceIds: string[];
-    isFactory: boolean;
-}
 export interface InspectorHTTPState {
     metaInputTypes: MetaInputTypes;
     meta: HTTPWiringsMeta;
     files: Set<string>;
     routeMiddleware: Map<string, MiddlewareGroupMeta>;
-    routePermissions: Map<string, PermissionGroupMeta>;
 }
 /**
  * Schema vendor types for Standard Schema compliant validators
@@ -184,7 +175,6 @@ export interface InspectorPermissionInstance {
 export interface InspectorPermissionState {
     definitions: Record<string, InspectorPermissionDefinition>;
     instances: Record<string, InspectorPermissionInstance>;
-    tagPermissions: Map<string, PermissionGroupMeta>;
 }
 export type InspectorFilters = {
     names?: string[];
@@ -418,6 +408,12 @@ export interface InspectorState {
             path: string;
             exportedName: string;
         }>;
+        /** Functions marked `remote: true` — the surface a wireRemoteAddon consumer imports */
+        remoteMeta: Record<string, string>;
+        remoteFiles: Map<string, {
+            path: string;
+            exportedName: string;
+        }>;
         invokedFunctions: Set<string>;
         invokedFunctionsByFile: Map<string, Set<string>>;
         usedAddons: Set<string>;
@@ -425,6 +421,14 @@ export interface InspectorState {
             package: string;
             rpcEndpoint?: string;
             mcp?: boolean;
+            /** True when declared via `wireRemoteAddon` — import the addon's `.remote.gen` map, not `.internal.gen` */
+            remote?: boolean;
+            /** wireRemoteAddon: whether an `auth` binding was supplied (vs a public surface) */
+            hasAuth?: boolean;
+            /** wireRemoteAddon: statically-known `auth.credentialId`, for verify */
+            authCredentialId?: string;
+            /** wireRemoteAddon: statically-known `auth.secretId`, for verify */
+            authSecretId?: string;
             secretOverrides?: Record<string, string>;
             variableOverrides?: Record<string, string>;
             credentialOverrides?: Record<string, string>;
@@ -480,6 +484,10 @@ export interface InspectorState {
         definitions: CredentialDefinitions;
         files: Set<string>;
     };
+    scopes: {
+        definitions: ScopeDefinitions;
+        files: Set<string>;
+    };
     variables: {
         definitions: VariableDefinitions;
         files: Set<string>;
@@ -518,8 +526,6 @@ export interface InspectorState {
     };
     permissionsGroupsMeta: {
         definitions: Record<string, InspectorPermissionDefinition>;
-        httpGroups: Record<string, PermissionGroupMeta>;
-        tagGroups: Record<string, PermissionGroupMeta>;
     };
     requiredSchemas: Set<string>;
     openAPISpec: Record<string, any> | null;

package/dist/utils/custom-types-generator.js

@@ -5,7 +5,8 @@
  * ts-json-schema-generator can discover inline/custom types from typesMap.
  */
 export function sanitizeTypeName(name) {
-    return name.replace(/[^a-zA-Z0-9_$]/g, '_');
+    const sanitized = name.replace(/[^a-zA-Z0-9_$]/g, '_');
+    return /^[0-9]/.test(sanitized) ? `_${sanitized}` : sanitized;
 }
 const CLASSIFICATION_WRAPPERS = new Set(['Private', 'Pii', 'Secret']);
 function findMatchingAngleBracket(type, startIndex) {

package/dist/utils/ensure-function-metadata.d.ts

@@ -7,3 +7,18 @@ import type { InspectorState } from '../types.js';
  * extracts tags/middleware/permissions from the pikkuFunc() config.
  */
 export declare function ensureFunctionMetadata(state: InspectorState, pikkuFuncId: string, fallbackName?: string, funcInitializer?: ts.Node, checker?: ts.TypeChecker, isHelper?: boolean): void;
+/**
+ * Register metadata for a `func:` inlined into a wiring (queue/scheduler/
+ * trigger/gateway/…).
+ *
+ * An inline function has no exported name, so `addFunctions` skips it (it bails
+ * on `__temp_` ids) and only the wiring's context-based id exists. Without this
+ * the wiring points at a function that was never registered and the worker
+ * resolves to nothing at runtime ("Missing generated metadata for ...").
+ *
+ * The stub also carries no session info, so the runtime would treat it as
+ * session-required and every invocation would fail with "Authentication
+ * required". Derive `sessionless` from the helper the function was built with —
+ * the same rule `addFunctions` applies to named ones (`!== 'pikkuFunc'`).
+ */
+export declare function ensureInlineWiringFunction(state: InspectorState, pikkuFuncId: string, fallbackName: string | undefined, funcInitializer: ts.Node, checker: ts.TypeChecker, isHelper?: boolean): void;

package/dist/utils/ensure-function-metadata.js

@@ -207,6 +207,30 @@ export function ensureFunctionMetadata(state, pikkuFuncId, fallbackName, funcIni
         }
     }
 }
+/**
+ * Register metadata for a `func:` inlined into a wiring (queue/scheduler/
+ * trigger/gateway/…).
+ *
+ * An inline function has no exported name, so `addFunctions` skips it (it bails
+ * on `__temp_` ids) and only the wiring's context-based id exists. Without this
+ * the wiring points at a function that was never registered and the worker
+ * resolves to nothing at runtime ("Missing generated metadata for ...").
+ *
+ * The stub also carries no session info, so the runtime would treat it as
+ * session-required and every invocation would fail with "Authentication
+ * required". Derive `sessionless` from the helper the function was built with —
+ * the same rule `addFunctions` applies to named ones (`!== 'pikkuFunc'`).
+ */
+export function ensureInlineWiringFunction(state, pikkuFuncId, fallbackName, funcInitializer, checker, isHelper) {
+    ensureFunctionMetadata(state, pikkuFuncId, fallbackName, funcInitializer, checker, isHelper);
+    const meta = state.functions.meta[pikkuFuncId];
+    if (meta &&
+        meta.sessionless === undefined &&
+        ts.isCallExpression(funcInitializer) &&
+        ts.isIdentifier(funcInitializer.expression)) {
+        meta.sessionless = funcInitializer.expression.text !== 'pikkuFunc';
+    }
+}
 function populateTypesLookup(state, pikkuFuncId, funcInitializer, checker) {
     const typeArgs = funcInitializer.typeArguments;
     if (typeArgs && typeArgs.length >= 1) {

package/dist/utils/filter-inspector-state.js

@@ -334,6 +334,8 @@ export function filterInspectorState(state, filters, logger) {
             internalFiles: new Map(state.rpc.internalFiles),
             exposedMeta: { ...state.rpc.exposedMeta },
             exposedFiles: new Map(state.rpc.exposedFiles),
+            remoteMeta: { ...state.rpc.remoteMeta },
+            remoteFiles: new Map(state.rpc.remoteFiles),
             invokedFunctions: new Set(state.rpc.invokedFunctions),
         },
         cli: {
@@ -746,6 +748,13 @@ export function filterInspectorState(state, filters, logger) {
                 filteredState.rpc.exposedFiles.delete(key);
             }
         }
+        for (const key of Object.keys(filteredState.rpc.remoteMeta)) {
+            const targetFuncId = filteredState.rpc.remoteMeta[key];
+            if (!survivingFuncIds.has(targetFuncId) && !survivingFuncIds.has(key)) {
+                delete filteredState.rpc.remoteMeta[key];
+                filteredState.rpc.remoteFiles.delete(key);
+            }
+        }
         // Prune invokedFunctions to match surviving functions
         for (const funcId of filteredState.rpc.invokedFunctions) {
             if (!survivingFuncIds.has(funcId)) {

package/dist/utils/get-property-value.d.ts

@@ -1,9 +1,14 @@
 import * as ts from 'typescript';
 import { ErrorCode } from '../error-codes.js';
+export declare const getArrayPropertyValue: (obj: ts.ObjectLiteralExpression, propertyName: string) => string[] | null;
 /**
- * Extracts an array of strings from an object property.
+ * Extracts a string->string record from an object property.
+ *
+ * `getPropertyValue` falls through to `getText()` for an object literal, which
+ * returns the raw source text rather than the record — so callers that need the
+ * entries (e.g. oauth2 `additionalParams`) must use this instead.
  */
-export declare const getArrayPropertyValue: (obj: ts.ObjectLiteralExpression, propertyName: string) => string[] | null;
+export declare const getRecordPropertyValue: (obj: ts.ObjectLiteralExpression, propertyName: string) => Record<string, string> | null;
 /**
  * Wiring identity fields (`name`, `secretId`, `variableId`, …) are read
  * STATICALLY from source — a const or variable reference is keyed by its

package/dist/utils/get-property-value.js

@@ -4,12 +4,21 @@ import { extractStringLiteral } from './extract-node-value.js';
 /**
  * Extracts an array of strings from an object property.
  */
+/**
+ * Unwraps `x as const` / `x as any` / `x satisfies T` down to the underlying
+ * expression. Without this a cast makes the value invisible to the inspector,
+ * so it is silently dropped from meta rather than validated — and `as const` on
+ * an array is idiomatic enough that this is easy to hit by accident.
+ */
+const unwrapAs = (node) => ts.isAsExpression(node) || ts.isSatisfiesExpression(node)
+    ? unwrapAs(node.expression)
+    : node;
 export const getArrayPropertyValue = (obj, propertyName) => {
     const property = obj.properties.find((p) => ts.isPropertyAssignment(p) &&
         ts.isIdentifier(p.name) &&
         p.name.text === propertyName);
     if (property && ts.isPropertyAssignment(property)) {
-        const initializer = property.initializer;
+        const initializer = unwrapAs(property.initializer);
         if (ts.isArrayLiteralExpression(initializer)) {
             return initializer.elements
                 .filter(ts.isStringLiteral)
@@ -18,6 +27,44 @@ export const getArrayPropertyValue = (obj, propertyName) => {
     }
     return null;
 };
+/**
+ * Extracts a string->string record from an object property.
+ *
+ * `getPropertyValue` falls through to `getText()` for an object literal, which
+ * returns the raw source text rather than the record — so callers that need the
+ * entries (e.g. oauth2 `additionalParams`) must use this instead.
+ */
+export const getRecordPropertyValue = (obj, propertyName) => {
+    const property = obj.properties.find((p) => ts.isPropertyAssignment(p) &&
+        ts.isIdentifier(p.name) &&
+        p.name.text === propertyName);
+    if (!property || !ts.isPropertyAssignment(property)) {
+        return null;
+    }
+    const initializer = property.initializer;
+    if (!ts.isObjectLiteralExpression(initializer)) {
+        return null;
+    }
+    const record = {};
+    for (const prop of initializer.properties) {
+        if (!ts.isPropertyAssignment(prop)) {
+            continue;
+        }
+        const key = ts.isIdentifier(prop.name)
+            ? prop.name.text
+            : ts.isStringLiteral(prop.name)
+                ? prop.name.text
+                : null;
+        if (key === null) {
+            continue;
+        }
+        if (ts.isStringLiteral(prop.initializer) ||
+            ts.isNoSubstitutionTemplateLiteral(prop.initializer)) {
+            record[key] = prop.initializer.text;
+        }
+    }
+    return Object.keys(record).length > 0 ? record : null;
+};
 /**
  * Wiring identity fields (`name`, `secretId`, `variableId`, …) are read
  * STATICALLY from source — a const or variable reference is keyed by its

package/dist/utils/load-addon-functions-meta.js

@@ -80,6 +80,11 @@ export async function loadAddonFunctionsMeta(logger, state) {
         return;
     const require = createRequire(join(state.rootDir, 'package.json'));
     for (const [namespace, decl] of wireAddonDeclarations) {
+        // Remote addons (wireRemoteAddon) ship as a devDependency: types only.
+        // Their functions, secrets, variables, schemas and services live on the
+        // HOST that runs them — never load or require any of that here.
+        if (decl.remote)
+            continue;
         try {
             const metaPath = require.resolve(`${decl.package}/.pikku/function/pikku-functions-meta.gen.json`);
             const raw = await readFile(metaPath, 'utf-8');
@@ -108,32 +113,99 @@ export async function loadAddonFunctionsMeta(logger, state) {
                 const secretsRaw = await readFile(secretsMetaPath, 'utf-8');
                 const secretsMeta = JSON.parse(secretsRaw);
                 for (const [key, def] of Object.entries(secretsMeta)) {
-                    const existing = state.secrets.definitions.find((d) => d.name === key);
+                    // secretOverrides key on the SECRET ID (the string the addon passes to
+                    // getSecret — its typed map is keyed by secretId, e.g.
+                    // `getSecret('MAILGUN_CREDENTIALS')`), NOT the logical meta key, so the
+                    // runtime aliaser (which also keys on secretId) and this merge agree.
+                    // The resolved id is the real project secret; the addon's secretId is
+                    // the default when no override is given. Two instances with different
+                    // overrides therefore surface two distinct project secrets. `key` is
+                    // the fallback for older meta that predates the secretId field.
+                    const secretId = def.secretId ?? key;
+                    const resolvedSecretId = decl.secretOverrides?.[secretId] ?? secretId;
+                    const existing = state.secrets.definitions.find((d) => (d.secretId ?? d.name) === resolvedSecretId);
                     if (!existing) {
-                        state.secrets.definitions.push(def);
-                        logger.debug(`Loaded addon secret '${key}' from ${decl.package}`);
+                        state.secrets.definitions.push({
+                            ...def,
+                            secretId: resolvedSecretId,
+                        });
+                        logger.debug(`Loaded addon secret '${resolvedSecretId}' from ${decl.package}`);
                     }
                 }
             }
             catch {
                 // No secrets meta — that's fine
             }
+            // Load addon scopes meta. Without this an addon's own scopes never reach
+            // the host's ScopeId union or its declared set, so the pikku_scopes FK
+            // would refuse to grant one.
+            try {
+                const scopesMetaPath = require.resolve(`${decl.package}/.pikku/scopes/pikku-scopes-meta.gen.json`);
+                const scopesRaw = await readFile(scopesMetaPath, 'utf-8');
+                const scopesMeta = JSON.parse(scopesRaw);
+                for (const [key, def] of Object.entries(scopesMeta)) {
+                    const existing = state.scopes.definitions.find((d) => d.name === key);
+                    if (!existing) {
+                        state.scopes.definitions.push(def);
+                        logger.debug(`Loaded addon scope '${key}' from ${decl.package}`);
+                    }
+                }
+            }
+            catch {
+                // No scopes meta — that's fine
+            }
             // Load addon variables meta
             try {
                 const variablesMetaPath = require.resolve(`${decl.package}/.pikku/variables/pikku-variables-meta.gen.json`);
                 const variablesRaw = await readFile(variablesMetaPath, 'utf-8');
                 const variablesMeta = JSON.parse(variablesRaw);
                 for (const [key, def] of Object.entries(variablesMeta)) {
-                    const existing = state.variables.definitions.find((d) => d.name === key);
+                    // variableOverrides key on the VARIABLE ID (the string the addon reads
+                    // via its typed map, keyed by variableId), same as secretOverrides key
+                    // on secretId — so the runtime aliaser and this merge agree. `key` is
+                    // the fallback for older meta without a variableId field.
+                    const variableId = def.variableId ?? key;
+                    const resolvedVariableId = decl.variableOverrides?.[variableId] ?? variableId;
+                    const existing = state.variables.definitions.find((d) => (d.variableId ?? d.name) === resolvedVariableId);
                     if (!existing) {
-                        state.variables.definitions.push(def);
-                        logger.debug(`Loaded addon variable '${key}' from ${decl.package}`);
+                        state.variables.definitions.push({
+                            ...def,
+                            variableId: resolvedVariableId,
+                        });
+                        logger.debug(`Loaded addon variable '${resolvedVariableId}' from ${decl.package}`);
                     }
                 }
             }
             catch {
                 // No variables meta — that's fine
             }
+            // Load addon credentials meta. Without this an addon's OAuth2/wire
+            // credentials never reach the consuming app's CREDENTIAL_OAUTH2_CONFIGS,
+            // so the credential-oauth provider and BetterAuthCredentialService can't
+            // resolve them — the addon's Connect flow and status silently no-op.
+            try {
+                const credentialsMetaPath = require.resolve(`${decl.package}/.pikku/credentials/pikku-credentials-meta.gen.json`);
+                const credentialsRaw = await readFile(credentialsMetaPath, 'utf-8');
+                const credentialsMeta = JSON.parse(credentialsRaw);
+                for (const [key, def] of Object.entries(credentialsMeta)) {
+                    // Each instance's credentialOverrides remap the addon's logical
+                    // credential name to a project credential — same mechanic as secrets
+                    // and variables above. The credential name doubles as the better-auth
+                    // providerId (accounts keyed by providerId+userId), so two instances
+                    // with different overrides surface two distinct OAuth providers rather
+                    // than sharing one account pool. The logical name is the default when
+                    // no override is given.
+                    const resolvedName = decl.credentialOverrides?.[key] ?? key;
+                    const existing = state.credentials.definitions.find((d) => d.name === resolvedName);
+                    if (!existing) {
+                        state.credentials.definitions.push({ ...def, name: resolvedName });
+                        logger.debug(`Loaded addon credential '${resolvedName}' from ${decl.package}`);
+                    }
+                }
+            }
+            catch {
+                // No credentials meta — that's fine
+            }
             // Load addon serverlessIncompatible service names from pikku-addon-meta.gen.json
             let loadedParentServices = false;
             try {
@@ -215,6 +287,9 @@ export async function loadAddonSchemas(logger, state) {
         return;
     const require = createRequire(join(state.rootDir, 'package.json'));
     for (const [namespace, decl] of wireAddonDeclarations) {
+        // Remote addons carry no local schemas — their funcs run on the host.
+        if (decl.remote)
+            continue;
         try {
             const metaPath = require.resolve(`${decl.package}/.pikku/function/pikku-functions-meta.gen.json`);
             const schemasDir = join(dirname(metaPath), '..', 'schemas', 'schemas');

package/dist/utils/permissions.d.ts

@@ -16,28 +16,8 @@ export declare function extractPermissionPikkuNames(node: ts.Expression, checker
  * Returns the initializer node for the 'permissions' property if it exists
  */
 export declare function getPermissionsNode(obj: ts.ObjectLiteralExpression): ts.Expression | undefined;
-/**
- * Check if a route matches a pattern with wildcards
- * Pattern can be exact match or use * as wildcard
- * e.g., '/api/*' matches '/api/users', '/api/posts/123', etc.
- */
-export declare function routeMatchesPattern(route: string, pattern: string): boolean;
-/**
- * Resolve permissions for an HTTP wiring based on:
- * 1. Global HTTP permissions (addHTTPPermission('*', [...]))
- * 2. Route-specific HTTP permissions (addHTTPPermission('/pattern', [...]))
- * 3. Tag-based permissions (addPermission('tag', [...]))
- * 4. Explicit wiring permissions (wireHTTP({ permissions: [...] }))
- * Returns undefined if no permissions are found, otherwise returns array with at least one item
- */
-export declare function resolveHTTPPermissions(state: InspectorState, route: string, tags: string[] | undefined, explicitPermissionsNode: ts.Expression | undefined, checker: ts.TypeChecker): PermissionMetadata[] | undefined;
 /**
  * Convenience wrapper: Extract permissions node from object and resolve
  * Use this in add-* files for cleaner code
  */
-export declare function resolvePermissions(state: InspectorState, obj: ts.ObjectLiteralExpression, tags: string[] | undefined, checker: ts.TypeChecker): PermissionMetadata[] | undefined;
-/**
- * Convenience wrapper for HTTP: Extract permissions and resolve with HTTP-specific logic
- * Use this in add-http-route.ts for cleaner code
- */
-export declare function resolveHTTPPermissionsFromObject(state: InspectorState, route: string, obj: ts.ObjectLiteralExpression, tags: string[] | undefined, checker: ts.TypeChecker): PermissionMetadata[] | undefined;
+export declare function resolvePermissions(state: InspectorState, obj: ts.ObjectLiteralExpression, _tags: string[] | undefined, checker: ts.TypeChecker): PermissionMetadata[] | undefined;

package/dist/utils/permissions.js

@@ -57,122 +57,31 @@ export function getPermissionsNode(obj) {
     return permissionsProp?.initializer;
 }
 /**
- * Check if a route matches a pattern with wildcards
- * Pattern can be exact match or use * as wildcard
- * e.g., '/api/*' matches '/api/users', '/api/posts/123', etc.
+ * Resolve the explicit permission references declared on a function (or agent).
+ * Permissions are function-scoped only: a `permissions: { group: [fn] }` object
+ * is flattened to `{ type: 'wire', name }` references used at filter time.
+ * Returns undefined if none are declared, otherwise an array with ≥1 item.
  */
-export function routeMatchesPattern(route, pattern) {
-    if (route === pattern)
-        return true;
-    // Convert pattern to regex: replace * with .*
-    const regexPattern = pattern
-        .replace(/[.+?^${}()|[\]\\]/g, '\\$&') // Escape regex special chars except *
-        .replace(/\*/g, '.*'); // Replace * with .*
-    const regex = new RegExp(`^${regexPattern}$`);
-    return regex.test(route);
-}
-/**
- * Resolve permissions for an HTTP wiring based on:
- * 1. Global HTTP permissions (addHTTPPermission('*', [...]))
- * 2. Route-specific HTTP permissions (addHTTPPermission('/pattern', [...]))
- * 3. Tag-based permissions (addPermission('tag', [...]))
- * 4. Explicit wiring permissions (wireHTTP({ permissions: [...] }))
- * Returns undefined if no permissions are found, otherwise returns array with at least one item
- */
-export function resolveHTTPPermissions(state, route, tags, explicitPermissionsNode, checker) {
-    const resolved = [];
-    // 1. HTTP route permission groups (includes '*' for global)
-    for (const [pattern, _groupMeta] of state.http.routePermissions.entries()) {
-        if (routeMatchesPattern(route, pattern)) {
-            // Just reference the group by route pattern
-            resolved.push({
-                type: 'http',
-                route: pattern,
-            });
-        }
-    }
-    // 2. Tag-based permission groups
-    if (tags && tags.length > 0) {
-        for (const tag of tags) {
-            if (state.permissions.tagPermissions.has(tag)) {
-                // Just reference the group by tag
-                resolved.push({
-                    type: 'tag',
-                    tag,
-                });
-            }
-        }
-    }
-    // 3. Explicit wire permissions (inline is OK here)
-    if (explicitPermissionsNode) {
-        const permissionNames = extractPermissionPikkuNames(explicitPermissionsNode, checker, state.rootDir);
-        for (const name of permissionNames) {
-            const def = state.permissions.definitions[name];
-            resolved.push({
-                type: 'wire',
-                name,
-                inline: def?.exportedName === null,
-            });
-        }
+function resolveExplicitPermissions(state, explicitPermissionsNode, checker) {
+    if (!explicitPermissionsNode) {
+        return undefined;
     }
-    return resolved.length > 0 ? resolved : undefined;
-}
-/**
- * Resolve tag-based and explicit permissions (common logic for wires and functions)
- * 1. Tag-based permissions (addPermission('tag', [...]))
- * 2. Explicit permissions (wireHTTP/pikkuFunc({ permissions: [...] }))
- */
-function resolveTagAndExplicitPermissions(state, tags, explicitPermissionsNode, checker) {
     const resolved = [];
-    // 1. Tag-based permission groups
-    if (tags && tags.length > 0) {
-        for (const tag of tags) {
-            if (state.permissions.tagPermissions.has(tag)) {
-                // Just reference the group by tag
-                resolved.push({
-                    type: 'tag',
-                    tag,
-                });
-            }
-        }
-    }
-    // 2. Explicit permissions (inline is OK here - used directly in wire/function)
-    if (explicitPermissionsNode) {
-        const permissionNames = extractPermissionPikkuNames(explicitPermissionsNode, checker, state.rootDir);
-        for (const name of permissionNames) {
-            const def = state.permissions.definitions[name];
-            resolved.push({
-                type: 'wire',
-                name,
-                inline: def?.exportedName === null,
-            });
-        }
+    const permissionNames = extractPermissionPikkuNames(explicitPermissionsNode, checker, state.rootDir);
+    for (const name of permissionNames) {
+        const def = state.permissions.definitions[name];
+        resolved.push({
+            type: 'wire',
+            name,
+            inline: def?.exportedName === null,
+        });
     }
-    return resolved;
-}
-/**
- * Resolve permissions for a function based on:
- * 1. Tag-based permissions (addPermission('tag', [...]))
- * 2. Explicit function permissions (pikkuFunc({ permissions: [...] }))
- * Returns undefined if no permissions are found, otherwise returns array with at least one item
- */
-function resolveFunctionPermissionsInternal(state, tags, explicitPermissionsNode, checker) {
-    const resolved = resolveTagAndExplicitPermissions(state, tags, explicitPermissionsNode, checker);
     return resolved.length > 0 ? resolved : undefined;
 }
 /**
  * Convenience wrapper: Extract permissions node from object and resolve
  * Use this in add-* files for cleaner code
  */
-export function resolvePermissions(state, obj, tags, checker) {
-    const explicitPermissionsNode = getPermissionsNode(obj);
-    return resolveFunctionPermissionsInternal(state, tags, explicitPermissionsNode, checker);
-}
-/**
- * Convenience wrapper for HTTP: Extract permissions and resolve with HTTP-specific logic
- * Use this in add-http-route.ts for cleaner code
- */
-export function resolveHTTPPermissionsFromObject(state, route, obj, tags, checker) {
-    const explicitPermissionsNode = getPermissionsNode(obj);
-    return resolveHTTPPermissions(state, route, tags, explicitPermissionsNode, checker);
+export function resolvePermissions(state, obj, _tags, checker) {
+    return resolveExplicitPermissions(state, getPermissionsNode(obj), checker);
 }