@pikku/inspector 0.12.48 → 0.12.49

package/CHANGELOG.md

@@ -1,3 +1,36 @@
+## 0.12.49
+
+### Patch Changes
+
+- 426610a: Scenario instrumentation is no longer scaffolded into projects, and no longer deploys.
+
+  `scaffold.scenarios` generated four functions — `pikkuScenarioTakeLiveCoverage`, `pikkuScenarioResetLiveCoverage`, `pikkuScenarioResetStubs`, `pikkuScenarioGetStubCalls` — into the project's own source. As project source they were indistinguishable from application code: registered in the app bootstrap, listed in the app's function and RPC meta, and shipped `expose: true` inside every deployed bundle. Coverage and stub inspection are things you do to a development server; production carried two endpoints that fingerprint the build and one that resets a global tracker, gated only by whether a metadata file happened to sit beside the bundle.
+
+  `pikku dev` now registers the implementations itself, after the app bootstrap. Nothing is generated, nothing is written to the project, and a bundle cannot carry what was never in its bootstrap — `pikku serve` and every deployed unit have no trace of them. The scenario runner reaches them over `/rpc/<name>` exactly as before.
+
+  Also:
+  - The inspector ignores these four names wherever it finds them, so a project that has not regenerated — and still has the scaffolded file checked in — stops deploying it immediately. Codegen deletes the retired scaffold on its next run.
+  - They no longer count towards a project's function total, so `pikku scenario --coverage` stops reporting four permanently-uncovered functions that were never the project's to cover.
+  - The instrumentation no longer carries schemas (there was nothing to validate but one optional string), which drops the `zod` dependency the scaffold silently required of every project that enabled it.
+  - They are registered sessionless, so `scaffold.scenarios: true` — as opposed to `'auth'` — now genuinely means "no session required". As a sessioned `pikkuFunc` with `auth: false`, it demanded a session anyway and logged a warning saying so.
+
+- 09973b9: Scenarios, features and steps no longer reach a deployment.
+
+  Steps were already held back from the app bootstrap, so a deployed server never imported a step body. Everything _about_ a scenario still travelled with the application: a `pikkuScenario(...)` is a function, so its name, schemas and hashes sat in the app function meta; the schemas it and its steps validate against sat in the app's `register.gen.ts` — on one project 458 of the 582 registered schemas belonged to tests; its name sat in the internal RPC meta; and because a scenario is _also_ a workflow, the inspector synthesised a `wf-orchestrator-<scenario>` queue worker for each one. The deploy analyzer, which reads inspector state rather than the partitioned codegen output, then read all of it back as application code: a unit per scenario, a `WorkflowDefinition` per scenario, and a real queue per scenario. A 13-scenario suite turned into 13 production queues named after tests, waiting for a provider to create them.
+
+  The existing scenario/app partition is now applied everywhere it was missing. `FunctionRuntimeMeta` gains a `scenario` marker (the counterpart of `scenarioStep`) so a scenario body is recognisable without walking the workflow graph; scenario bodies join their steps on the scenario side of the function-meta and registration split; schemas only a scenario or step needs are written and registered under `.pikku/scenarios/schemas/` and imported by the scenario bootstrap alone; scenario names are dropped from the internal RPC meta; no orchestrator queue worker is synthesised for a scenario; and the deploy analyzer drops both scenario functions and scenario workflows before it decides what a deployment contains.
+
+  The MCP metas are keyed by wiring rather than by function, so a scenario wired as an MCP tool, resource or prompt was the one id that still reached the manifest after the function and workflow filters — as an endpoint on the gateway plus a gateway dependency on a unit that was never emitted. Those ids are now filtered too.
+
+  `scenarioSchemaDirectory` is rejected when it resolves to the same directory as `schemaDirectory`. A schema write owns its directory — it emits `register.gen.ts` and prunes every schema file its own required-set does not name — so sharing one would replace the application register with the scenario-only one and delete the app's schema files, which nothing downstream can detect.
+
+  Nothing changes for `pikku scenario run` — the scenario bootstrap still registers every scenario, feature, step, meta and schema. What changes is that a bundle stops carrying them.
+
+- Updated dependencies [8a2c993]
+- Updated dependencies [a261006]
+- Updated dependencies [09973b9]
+  - @pikku/core@0.12.71
+
 ## 0.12.48
 
 ### Patch Changes

package/LICENSE

@@ -0,0 +1,106 @@
+Business Source License 1.1
+
+Parameters
+
+Licensor:             Yasser Fadl and Pikku contributors
+Licensed Work:        TypeScript inspector for Pikku — discovers functions and wirings to drive code generation (@pikku/inspector)
+                      Pikku Console (@pikku/console)
+                      The Licensed Work is (c) 2021 - present Yasser Fadl and Pikku contributors
+Additional Use Grant: You may make production use of the Licensed Work for any purpose,
+                      including creating free or open source software. However, you may
+                      not offer as a commercial product or service any software featuring
+                      a visual or graphical interface for authoring, editing, building,
+                      or managing Pikku code, Pikku functions, Pikku handlers, or Pikku
+                      workflows.
+Change Date:          Four years from the date the Licensed Work was first made available
+Change License:       MIT License
+
+For information about alternative licensing arrangements, contact yasser.fadl@gmail.com
+
+Notice
+
+The Business Source License (this document, or the "License") is not an Open Source
+license. However, the Licensed Work will eventually be made available under an Open
+Source License, as stated in this License.
+
+License text copyright (c) 2017 MariaDB Corporation Ab, All Rights Reserved.
+"Business Source License" is a trademark of MariaDB Corporation Ab.
+
+-----------------------------------------------------------------------------
+
+Business Source License 1.1
+
+Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative works,
+redistribute, and make non-production use of the Licensed Work. The Licensor may make
+an Additional Use Grant, above, permitting limited production use.
+
+Effective on the Change Date, or the fourth anniversary of the first publicly
+available distribution of a specific version of the Licensed Work under this License,
+whichever comes first, the Licensor hereby grants you rights under the terms of the
+Change License, and the rights granted in the paragraph above terminate.
+
+If your use of the Licensed Work does not comply with the requirements currently in
+effect as described in this License, you must purchase a commercial license from the
+Licensor, its affiliated entities, or authorized resellers, or you must refrain from
+using the Licensed Work.
+
+All copies of the original and modified Licensed Work, and derivative works of the
+Licensed Work, are subject to this License. This License applies separately for each
+version of the Licensed Work and the Change Date may vary for each version of the
+Licensed Work released by Licensor.
+
+You must conspicuously display this License on each original or modified copy of the
+Licensed Work. If you receive the Licensed Work in original or modified form from a
+third party, the terms and conditions set forth in this License apply to your use of
+that work.
+
+Any use of the Licensed Work in violation of this License will automatically terminate
+your rights under this License for the current and all other versions of the Licensed
+Work.
+
+This License does not grant you any right in any trademark or logo of Licensor or its
+affiliates (provided that you may use a trademark or logo of Licensor as expressly
+required by this License).
+
+TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON AN "AS IS"
+BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS, EXPRESS OR IMPLIED,
+INCLUDING (WITHOUT LIMITATION) WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
+PURPOSE, NON-INFRINGEMENT, AND TITLE.
+
+MariaDB hereby grants you permission to use this License's text to license your works,
+and to refer to it using the trademark "Business Source License", as long as you
+comply with the Covenants of Licensor below.
+
+Covenants of Licensor
+
+In consideration of the right to use this License's text and the "Business Source
+License" name and trademark, Licensor covenants to MariaDB, and to all other
+recipients of the licensed work to be provided by Licensor:
+
+1. To specify as the Change License the GPL Version 2.0 or any later version, or a
+   license that is compatible with GPL Version 2.0 or a later version, where
+   "compatible" means that software provided under the Change License can be included
+   in a program with software provided under GPL Version 2.0 or a later version.
+   Licensor may specify additional Change Licenses without limitation.
+
+2. To either: (a) specify an additional grant of rights to use that does not impose
+   any additional restriction on the right granted in this License, as the Additional
+   Use Grant; or (b) insert the text "None".
+
+3. To specify a Change Date.
+
+4. Not to modify this License in any other way.
+
+-----------------------------------------------------------------------------
+
+Note: Every other Pikku package — @pikku/core, the runtimes, the services, the clients,
+and @pikku/skills — is licensed under the MIT License. Each package ships its own LICENSE
+file stating its terms; that file governs, and this one covers only the Licensed Work
+named above.
+
+In particular, the Pikku agent skills (@pikku/skills) are MIT. They are the instruction
+set coding agents read to build, wire and deploy Pikku projects, and they are meant to be
+adopted, forked and extended by any harness — so their terms do not depend on the CLI
+that happens to install them.

package/dist/add/add-functions.js

@@ -11,6 +11,7 @@ import { resolvePermissions } from '../utils/permissions.js';
 import { extractWireNames } from '../utils/post-process.js';
 import { ErrorCode } from '../error-codes.js';
 import { findPiiPaths } from '../utils/check-pii-output.js';
+import { isScenarioInstrumentationFunction } from './scenario-instrumentation.js';
 const isValidVariableName = (name) => {
     const regex = /^[a-zA-Z_$][a-zA-Z0-9_$]*$/;
     return regex.test(name);
@@ -285,6 +286,10 @@ export const addFunctions = (logger, node, checker, state, options) => {
     // never RPC-registered: a step may drive a browser, so exposing it over the
     // network would put a test harness on the public API surface.
     const isScenarioStep = expression.text === 'pikkuScenarioStep';
+    // A scenario's own body. Marked so the codegen partitions and the deploy
+    // analyzer can tell it apart from an application workflow without having to
+    // reach into the workflow graph.
+    const isScenario = expression.text === 'pikkuScenario';
     // only handle calls like pikkuFunc(...)
     if (!ts.isIdentifier(expression) || !expression.text.startsWith('pikku')) {
         return;
@@ -295,6 +300,14 @@ export const addFunctions = (logger, node, checker, state, options) => {
     if (!pikkuFuncId || pikkuFuncId.startsWith('__temp_')) {
         return;
     }
+    // pikku's own scenario instrumentation, which older projects still carry as a
+    // scaffolded file in their source. It is not application code and must not be
+    // registered, metadata'd or deployed as if it were — `pikku dev` registers the
+    // implementations itself, and that is the only server that should have them.
+    if (isScenarioInstrumentationFunction(pikkuFuncId) ||
+        isScenarioInstrumentationFunction(name)) {
+        return;
+    }
     let title;
     let tags;
     let summary;
@@ -784,6 +797,7 @@ export const addFunctions = (logger, node, checker, state, options) => {
         expose: expose || undefined,
         remote: remote || undefined,
         scenarioStep: isScenarioStep || undefined,
+        scenario: isScenario || undefined,
         mcp: mcpEnabled || undefined,
         readonly: readonly_ || undefined,
         deploy: deploy || undefined,

package/dist/add/scenario-instrumentation.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The instrumentation RPCs `pikku scenario run` calls on the server it is
+ * testing: snapshot/reset live coverage, and reset/read recorded stub calls.
+ *
+ * They are pikku's own, not the application's. They used to be scaffolded into
+ * the project as ordinary `pikkuFunc`s, which made them indistinguishable from
+ * application code — so they were registered in the app bootstrap, listed in the
+ * app's function and RPC meta, and shipped, `expose: true`, in every deployed
+ * bundle. A deployment has no use for them: coverage and stub inspection are
+ * things you do to a development server.
+ *
+ * The inspector therefore ignores these names wherever it finds them, and
+ * `pikku dev` registers the implementations itself. Ignoring by name (rather
+ * than deleting the scaffold and requiring every project to regenerate) is what
+ * keeps an existing project's checked-in `scenarios.gen.ts` from deploying.
+ */
+export declare const SCENARIO_INSTRUMENTATION_FUNCTIONS: readonly ["pikkuScenarioTakeLiveCoverage", "pikkuScenarioResetLiveCoverage", "pikkuScenarioResetStubs", "pikkuScenarioGetStubCalls"];
+export type ScenarioInstrumentationFunction = (typeof SCENARIO_INSTRUMENTATION_FUNCTIONS)[number];
+/**
+ * True for a scenario instrumentation function, by name. Versioned ids
+ * (`name@v2`) are matched on their base so a project that bumps one is still
+ * covered.
+ */
+export declare const isScenarioInstrumentationFunction: (name: string | undefined) => boolean;

package/dist/add/scenario-instrumentation.js

@@ -0,0 +1,29 @@
+/**
+ * The instrumentation RPCs `pikku scenario run` calls on the server it is
+ * testing: snapshot/reset live coverage, and reset/read recorded stub calls.
+ *
+ * They are pikku's own, not the application's. They used to be scaffolded into
+ * the project as ordinary `pikkuFunc`s, which made them indistinguishable from
+ * application code — so they were registered in the app bootstrap, listed in the
+ * app's function and RPC meta, and shipped, `expose: true`, in every deployed
+ * bundle. A deployment has no use for them: coverage and stub inspection are
+ * things you do to a development server.
+ *
+ * The inspector therefore ignores these names wherever it finds them, and
+ * `pikku dev` registers the implementations itself. Ignoring by name (rather
+ * than deleting the scaffold and requiring every project to regenerate) is what
+ * keeps an existing project's checked-in `scenarios.gen.ts` from deploying.
+ */
+export const SCENARIO_INSTRUMENTATION_FUNCTIONS = [
+    'pikkuScenarioTakeLiveCoverage',
+    'pikkuScenarioResetLiveCoverage',
+    'pikkuScenarioResetStubs',
+    'pikkuScenarioGetStubCalls',
+];
+const names = new Set(SCENARIO_INSTRUMENTATION_FUNCTIONS);
+/**
+ * True for a scenario instrumentation function, by name. Versioned ids
+ * (`name@v2`) are matched on their base so a project that bumps one is still
+ * covered.
+ */
+export const isScenarioInstrumentationFunction = (name) => (name ? names.has(name.split('@')[0]) : false);

package/dist/index.d.ts

@@ -5,6 +5,8 @@ export type { FilesAndMethodsErrors } from './utils/get-files-and-methods.js';
 export { ErrorCode } from './error-codes.js';
 export type { DiagnosticSeverity, CodedDiagnostic } from './error-codes.js';
 export { AUTH_HANDLER_FUNC_ID } from './add/add-auth.js';
+export { SCENARIO_INSTRUMENTATION_FUNCTIONS, isScenarioInstrumentationFunction, } from './add/scenario-instrumentation.js';
+export type { ScenarioInstrumentationFunction } from './add/scenario-instrumentation.js';
 export { serializeInspectorState, deserializeInspectorState, } from './utils/serialize-inspector-state.js';
 export type { SerializableInspectorState } from './utils/serialize-inspector-state.js';
 export { filterInspectorState } from './utils/filter-inspector-state.js';

package/dist/index.js

@@ -1,6 +1,7 @@
 export { inspect, getInitialInspectorState } from './inspector.js';
 export { ErrorCode } from './error-codes.js';
 export { AUTH_HANDLER_FUNC_ID } from './add/add-auth.js';
+export { SCENARIO_INSTRUMENTATION_FUNCTIONS, isScenarioInstrumentationFunction, } from './add/scenario-instrumentation.js';
 export { serializeInspectorState, deserializeInspectorState, } from './utils/serialize-inspector-state.js';
 export { filterInspectorState } from './utils/filter-inspector-state.js';
 export { resolveDeployTarget } from './utils/resolve-deploy-target.js';

package/dist/utils/post-process.js

@@ -212,6 +212,13 @@ export function aggregateRequiredServices(state) {
     for (const [, graph] of Object.entries(state.workflows.graphMeta)) {
         if (!graph.nodes || !graph.name)
             continue;
+        // A scenario is a workflow, but it only ever runs in-process under
+        // `pikku scenario run` — no step of one is dispatched through a queue. The
+        // synthetic entries were pure leakage: they put a
+        // `wf-orchestrator-<scenario>` worker into the app's queue meta, which every
+        // bundle imports and a provider then creates as a real production queue.
+        if (graph.source === 'scenario')
+            continue;
         const toKebab = (s) => s
             .replace(/([a-z0-9])([A-Z])/g, '$1-$2')
             .replace(/([A-Z])([A-Z][a-z])/g, '$1-$2')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/inspector",
-  "version": "0.12.48",
+  "version": "0.12.49",
   "description": "TypeScript inspector for Pikku — discovers functions and wirings to drive code generation",
   "author": "yasser.fadl@gmail.com",
   "license": "BUSL-1.1",
@@ -45,10 +45,10 @@
     "zod-to-ts": "^2.1.0"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.70"
+    "@pikku/core": "^0.12.71"
   },
   "devDependencies": {
-    "@pikku/core": "^0.12.70",
+    "@pikku/core": "^0.12.71",
     "@types/node": "^24.11.0"
   },
   "engines": {

package/src/add/add-functions.ts

@@ -21,6 +21,7 @@ import { resolvePermissions } from '../utils/permissions.js'
 import { extractWireNames } from '../utils/post-process.js'
 import { ErrorCode } from '../error-codes.js'
 import { findPiiPaths } from '../utils/check-pii-output.js'
+import { isScenarioInstrumentationFunction } from './scenario-instrumentation.js'
 import type { NodeType } from '@pikku/core/node'
 
 const isValidVariableName = (name: string) => {
@@ -402,6 +403,11 @@ export const addFunctions: AddWiring = (
   // network would put a test harness on the public API surface.
   const isScenarioStep = expression.text === 'pikkuScenarioStep'
 
+  // A scenario's own body. Marked so the codegen partitions and the deploy
+  // analyzer can tell it apart from an application workflow without having to
+  // reach into the workflow graph.
+  const isScenario = expression.text === 'pikkuScenario'
+
   // only handle calls like pikkuFunc(...)
   if (!ts.isIdentifier(expression) || !expression.text.startsWith('pikku')) {
     return
@@ -419,6 +425,17 @@ export const addFunctions: AddWiring = (
     return
   }
 
+  // pikku's own scenario instrumentation, which older projects still carry as a
+  // scaffolded file in their source. It is not application code and must not be
+  // registered, metadata'd or deployed as if it were — `pikku dev` registers the
+  // implementations itself, and that is the only server that should have them.
+  if (
+    isScenarioInstrumentationFunction(pikkuFuncId) ||
+    isScenarioInstrumentationFunction(name)
+  ) {
+    return
+  }
+
   let title: string | undefined
   let tags: string[] | undefined
   let summary: string | undefined
@@ -1094,6 +1111,7 @@ export const addFunctions: AddWiring = (
     expose: expose || undefined,
     remote: remote || undefined,
     scenarioStep: isScenarioStep || undefined,
+    scenario: isScenario || undefined,
     mcp: mcpEnabled || undefined,
     readonly: readonly_ || undefined,
     deploy: deploy || undefined,

package/src/add/scenario-instrumentation.test.ts

@@ -0,0 +1,89 @@
+import { strict as assert } from 'assert'
+import { describe, test } from 'node:test'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { inspect } from '../inspector.js'
+import type { InspectorLogger } from '../types.js'
+import {
+  SCENARIO_INSTRUMENTATION_FUNCTIONS,
+  isScenarioInstrumentationFunction,
+} from './scenario-instrumentation.js'
+
+const silentLogger: InspectorLogger = {
+  debug: () => {},
+  info: () => {},
+  warn: () => {},
+  error: () => {},
+  diagnostic: () => {},
+  critical: () => {},
+  hasCriticalErrors: () => false,
+}
+
+describe('scenario instrumentation', () => {
+  test('recognises the instrumentation names, including versioned ids', () => {
+    for (const name of SCENARIO_INSTRUMENTATION_FUNCTIONS) {
+      assert.ok(isScenarioInstrumentationFunction(name), name)
+      assert.ok(isScenarioInstrumentationFunction(`${name}@v2`), `${name}@v2`)
+    }
+    assert.ok(!isScenarioInstrumentationFunction('createUser'))
+    assert.ok(!isScenarioInstrumentationFunction(undefined))
+  })
+
+  test('a project still carrying the retired scaffold registers none of it', async () => {
+    const rootDir = await mkdtemp(join(tmpdir(), 'pikku-scenario-instr-'))
+    const file = join(rootDir, 'scenarios.gen.ts')
+
+    // What `scaffold.scenarios` used to write into the project. Whatever a
+    // project has checked in, none of it may reach the app's meta or RPC surface:
+    // `pikku dev` registers the real implementations itself.
+    await writeFile(
+      file,
+      [
+        "import { pikkuFunc } from '@pikku/core'",
+        'export const pikkuScenarioTakeLiveCoverage = pikkuFunc({',
+        "  tags: ['pikku'],",
+        '  expose: true,',
+        '  auth: true,',
+        '  func: async () => null,',
+        '})',
+        'export const pikkuScenarioResetStubs = pikkuFunc({',
+        "  tags: ['pikku'],",
+        '  expose: true,',
+        '  auth: true,',
+        '  func: async () => ({ enabled: true }),',
+        '})',
+        'export const createUser = pikkuFunc({',
+        '  expose: true,',
+        '  func: async () => ({ ok: true }),',
+        '})',
+      ].join('\n')
+    )
+
+    try {
+      const state = await inspect(silentLogger, [file], { rootDir })
+
+      for (const name of SCENARIO_INSTRUMENTATION_FUNCTIONS) {
+        assert.ok(
+          !(name in state.functions.meta),
+          `${name} must not be in the app function meta`
+        )
+        assert.ok(
+          !(name in state.rpc.internalMeta),
+          `${name} must not be in the internal RPC meta`
+        )
+        assert.ok(
+          !(name in state.rpc.exposedMeta),
+          `${name} must not be exposed`
+        )
+      }
+
+      // The application function in the same file is untouched — the drop is by
+      // name, not by file.
+      assert.ok(state.functions.meta['createUser'])
+      assert.strictEqual(state.rpc.exposedMeta['createUser'], 'createUser')
+    } finally {
+      await rm(rootDir, { recursive: true, force: true })
+    }
+  })
+})

package/src/add/scenario-instrumentation.ts

@@ -0,0 +1,36 @@
+/**
+ * The instrumentation RPCs `pikku scenario run` calls on the server it is
+ * testing: snapshot/reset live coverage, and reset/read recorded stub calls.
+ *
+ * They are pikku's own, not the application's. They used to be scaffolded into
+ * the project as ordinary `pikkuFunc`s, which made them indistinguishable from
+ * application code — so they were registered in the app bootstrap, listed in the
+ * app's function and RPC meta, and shipped, `expose: true`, in every deployed
+ * bundle. A deployment has no use for them: coverage and stub inspection are
+ * things you do to a development server.
+ *
+ * The inspector therefore ignores these names wherever it finds them, and
+ * `pikku dev` registers the implementations itself. Ignoring by name (rather
+ * than deleting the scaffold and requiring every project to regenerate) is what
+ * keeps an existing project's checked-in `scenarios.gen.ts` from deploying.
+ */
+export const SCENARIO_INSTRUMENTATION_FUNCTIONS = [
+  'pikkuScenarioTakeLiveCoverage',
+  'pikkuScenarioResetLiveCoverage',
+  'pikkuScenarioResetStubs',
+  'pikkuScenarioGetStubCalls',
+] as const
+
+export type ScenarioInstrumentationFunction =
+  (typeof SCENARIO_INSTRUMENTATION_FUNCTIONS)[number]
+
+const names = new Set<string>(SCENARIO_INSTRUMENTATION_FUNCTIONS)
+
+/**
+ * True for a scenario instrumentation function, by name. Versioned ids
+ * (`name@v2`) are matched on their base so a project that bumps one is still
+ * covered.
+ */
+export const isScenarioInstrumentationFunction = (
+  name: string | undefined
+): boolean => (name ? names.has(name.split('@')[0]!) : false)

package/src/add/scenario-marker.test.ts

@@ -0,0 +1,89 @@
+/**
+ * The `scenario` / `scenarioStep` markers in the *function* meta are what every
+ * deployment boundary downstream reads: the codegen partition, the RPC meta
+ * filter, the schema split and the deploy analyzer. Asserting them on a real
+ * `pikkuScenario(...)` is what makes those filters mean anything — filters tested
+ * against hand-written meta would keep passing if extraction stopped setting it.
+ */
+import { strict as assert } from 'assert'
+import { describe, test } from 'node:test'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { inspect } from '../inspector.js'
+import type { InspectorLogger } from '../types.js'
+
+const logger = {
+  debug: () => {},
+  info: () => {},
+  warn: () => {},
+  error: () => {},
+  diagnostic: () => {},
+  critical: () => {},
+  hasCriticalErrors: () => false,
+} as unknown as InspectorLogger
+
+const STEPS = [
+  "import { pikkuScenarioStep } from '@pikku/core'",
+  'export const buysAnApple = pikkuScenarioStep({',
+  "  name: 'buysAnApple',",
+  "  description: 'buys an apple',",
+  '  func: async ({ logger }, data: { qty: number }) => ({ ok: data.qty > 0 }),',
+  '})',
+].join('\n')
+
+const APP = [
+  "import { pikkuFunc } from '@pikku/core'",
+  'export const createTodo = pikkuFunc({',
+  '  expose: true,',
+  '  func: async (_services, data: { title: string }) => ({ id: data.title }),',
+  '})',
+].join('\n')
+
+const SCENARIO = [
+  "import { pikkuScenario } from '@pikku/core/workflow'",
+  'export const shopFlow = pikkuScenario({',
+  "  title: 'Buys an apple',",
+  '  func: async (_services, _input, { scenario }: any) => {',
+  "    await scenario.when('buys an apple', 'buysAnApple', { qty: 1 })",
+  '    return { ok: true }',
+  '  },',
+  '})',
+].join('\n')
+
+describe('scenario markers in the function meta', () => {
+  test('a real pikkuScenario and pikkuScenarioStep are marked, an application function is not', async () => {
+    const rootDir = await mkdtemp(join(tmpdir(), 'pikku-scenario-marker-'))
+    const files = [
+      [join(rootDir, 'shop.steps.ts'), STEPS],
+      [join(rootDir, 'shop.scenario.ts'), SCENARIO],
+      [join(rootDir, 'todo.function.ts'), APP],
+    ] as const
+    await Promise.all(files.map(([path, source]) => writeFile(path, source)))
+
+    try {
+      const state = await inspect(
+        logger,
+        files.map(([path]) => path),
+        { rootDir }
+      )
+
+      const scenario = state.functions.meta['shopFlow']
+      assert.ok(scenario, 'the scenario body is a function and must have meta')
+      assert.equal(scenario.scenario, true)
+      assert.equal(scenario.scenarioStep, undefined)
+
+      const step = state.functions.meta['buysAnApple']
+      assert.ok(step)
+      assert.equal(step.scenarioStep, true)
+      assert.equal(step.scenario, undefined)
+
+      const app = state.functions.meta['createTodo']
+      assert.ok(app)
+      assert.equal(app.scenario, undefined)
+      assert.equal(app.scenarioStep, undefined)
+    } finally {
+      await rm(rootDir, { recursive: true, force: true })
+    }
+  })
+})

package/src/index.ts

@@ -5,6 +5,11 @@ export type { FilesAndMethodsErrors } from './utils/get-files-and-methods.js'
 export { ErrorCode } from './error-codes.js'
 export type { DiagnosticSeverity, CodedDiagnostic } from './error-codes.js'
 export { AUTH_HANDLER_FUNC_ID } from './add/add-auth.js'
+export {
+  SCENARIO_INSTRUMENTATION_FUNCTIONS,
+  isScenarioInstrumentationFunction,
+} from './add/scenario-instrumentation.js'
+export type { ScenarioInstrumentationFunction } from './add/scenario-instrumentation.js'
 export {
   serializeInspectorState,
   deserializeInspectorState,

package/src/utils/post-process.test.ts

@@ -64,6 +64,7 @@ function makeState(
     addonFunctions?: Record<string, Record<string, any>>
     addonRequiredParentServices?: string[]
     authServices?: string[]
+    graphMeta?: Record<string, any>
   } = {}
 ): Omit<InspectorState, 'typesLookup'> {
   return {
@@ -95,7 +96,7 @@ function makeState(
     scheduledTasks: { meta: {} },
     mcpEndpoints: { toolsMeta: {}, promptsMeta: {}, resourcesMeta: {} },
     agents: { agentsMeta: {} },
-    workflows: { meta: {}, graphMeta: {} },
+    workflows: { meta: {}, graphMeta: overrides.graphMeta ?? {} },
     wireServicesMeta: new Map(),
     rpc: { internalMeta: {}, exposedMeta: {} },
     addonFunctions: overrides.addonFunctions ?? {},
@@ -117,6 +118,34 @@ const CONSOLE_PARENT_SERVICES = [
   'credentialService',
 ]
 
+describe('aggregateRequiredServices — synthetic workflow queue workers', () => {
+  const graphMeta = {
+    orderWorkflow: {
+      name: 'orderWorkflow',
+      source: 'dsl',
+      nodes: { 'step-1': { rpcName: 'chargeCard' } },
+    },
+    loginScenario: {
+      name: 'loginScenario',
+      source: 'scenario',
+      nodes: { 'step-1': { rpcName: 'opensPage' } },
+    },
+  }
+
+  // A scenario IS a workflow, so it used to be handed an orchestrator queue
+  // worker in the app's queue meta — which the app bootstrap registers and every
+  // deployed bundle therefore carries, leaving a provider to create a production
+  // queue named after a test. Nothing dispatches a scenario through a queue:
+  // `pikku scenario run` executes its steps in-process.
+  test('a scenario gets no orchestrator queue worker', () => {
+    const state = makeState({ graphMeta })
+    aggregateRequiredServices(state)
+    assert.deepEqual(Object.keys(state.queueWorkers.meta), [
+      'wf-orchestrator-order-workflow',
+    ])
+  })
+})
+
 describe('aggregateRequiredServices — per-function addon services', () => {
   test('a used addon function adds only its own parent services', () => {
     const state = makeState({

package/src/utils/post-process.ts

@@ -262,6 +262,12 @@ export function aggregateRequiredServices(
   // per-workflow queue entries and falls back to shared queue names.
   for (const [, graph] of Object.entries(state.workflows.graphMeta)) {
     if (!graph.nodes || !graph.name) continue
+    // A scenario is a workflow, but it only ever runs in-process under
+    // `pikku scenario run` — no step of one is dispatched through a queue. The
+    // synthetic entries were pure leakage: they put a
+    // `wf-orchestrator-<scenario>` worker into the app's queue meta, which every
+    // bundle imports and a provider then creates as a real production queue.
+    if (graph.source === 'scenario') continue
 
     const toKebab = (s: string) =>
       s