@pikku/inspector 0.12.49 → 0.12.52

package/dist/utils/schema-generator.js

@@ -1,6 +1,6 @@
 import * as ts from 'typescript';
 import { createHash } from 'crypto';
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
+import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync, } from 'fs';
 import { dirname, join, resolve } from 'path';
 import { createGenerator, RootlessError } from 'ts-json-schema-generator';
 import { register } from 'tsx/esm/api';
@@ -57,6 +57,7 @@ let cachedParsedConfig;
 let cachedTsconfigPath;
 let cachedCustomTypesContent;
 let cachedTSSchemas;
+let cachedTSSchemaDeps;
 const SCHEMA_CACHE_VERSION = 1;
 // This package's own version — folded into the cache key so that upgrading
 // @pikku/inspector (the channel through which a schema-format change ships)
@@ -90,25 +91,93 @@ function tsSchemaCacheKey(customTypesContent, config) {
 function schemaCacheFile(cacheDir) {
     return join(cacheDir, 'ts-schemas.json');
 }
-function readDiskTSSchemas(logger, cacheDir, key) {
+/**
+ * The files a set of generated schemas was actually derived from.
+ *
+ * The cache key alone cannot answer whether the schemas are stale. It hashes the
+ * *synthesized* custom-types source, but a named type — `KnowledgeBundle`,
+ * `DbSchema`, anything a function declares as its input or output — appears
+ * there only as a name; its definition is resolved out of a project file or a
+ * dependency's `.d.ts`. Edit one of those and the key is unchanged, so a stale
+ * schema is served for a type that no longer looks like that. The failure is
+ * silent and outlives `rm -rf .pikku`, because this cache lives in
+ * `node_modules/.cache`.
+ *
+ * The program is rooted at the virtual file, so its source files are exactly the
+ * transitive closure the schemas depend on — nothing wider, nothing missed.
+ * Default-lib files are skipped: they change only when TypeScript itself does,
+ * which the inspector version in the key already covers.
+ */
+function fingerprintSchemaDeps(program) {
+    const deps = [];
+    for (const sourceFile of program.getSourceFiles()) {
+        if (program.isSourceFileDefaultLibrary(sourceFile))
+            continue;
+        try {
+            const stat = statSync(sourceFile.fileName);
+            deps.push({
+                path: sourceFile.fileName,
+                mtimeMs: stat.mtimeMs,
+                size: stat.size,
+            });
+        }
+        catch {
+            // The virtual root has no file on disk. Its content is the custom-types
+            // source, which the cache key already hashes.
+        }
+    }
+    return deps;
+}
+/**
+ * Whether every file the schemas were derived from is still exactly as it was.
+ *
+ * mtime-and-size rather than a content hash: this runs on the cache-hit path,
+ * where the whole point is to answer in milliseconds without building a TS
+ * program. Anything that rewrites a file — a dependency rebuild, a checkout, an
+ * edit — moves its mtime, and a missing file reads as changed, so the answer errs
+ * toward regenerating.
+ */
+function schemaDepsUnchanged(deps) {
+    if (!Array.isArray(deps))
+        return false;
+    for (const dep of deps) {
+        if (!dep || typeof dep.path !== 'string')
+            return false;
+        try {
+            const stat = statSync(dep.path);
+            if (stat.mtimeMs !== dep.mtimeMs || stat.size !== dep.size)
+                return false;
+        }
+        catch {
+            return false;
+        }
+    }
+    return true;
+}
+export function readDiskTSSchemas(logger, cacheDir, key) {
     const file = schemaCacheFile(cacheDir);
     if (!existsSync(file))
         return null;
     try {
         const parsed = JSON.parse(readFileSync(file, 'utf-8'));
-        if (parsed?.key === key && parsed.schemas)
-            return parsed.schemas;
+        if (parsed?.key !== key || !parsed.schemas)
+            return null;
+        if (!schemaDepsUnchanged(parsed.deps)) {
+            logger.debug('Discarding TS-schema cache: a type it was built from changed');
+            return null;
+        }
+        return { schemas: parsed.schemas, deps: parsed.deps };
     }
     catch (e) {
         logger.debug(`Ignoring unreadable TS-schema cache: ${e.message}`);
     }
     return null;
 }
-function writeDiskTSSchemas(logger, cacheDir, key, schemas) {
+export function writeDiskTSSchemas(logger, cacheDir, key, schemas, deps) {
     const file = schemaCacheFile(cacheDir);
     try {
         mkdirSync(dirname(file), { recursive: true });
-        writeFileSync(file, JSON.stringify({ key, schemas }));
+        writeFileSync(file, JSON.stringify({ key, schemas, deps }));
     }
     catch (e) {
         logger.debug(`Failed to persist TS-schema cache: ${e.message}`);
@@ -196,7 +265,7 @@ function generateTSSchemas(logger, tsconfig, customTypesContent, typesMap, funct
     // so that failed Zod conversions fall through to TS schema generation.
     const uncoveredSchemas = [...schemasSet].filter((s) => !PRIMITIVE_TYPES.has(s) && !generatedZodSchemas?.[s]);
     if (uncoveredSchemas.length === 0) {
-        return {};
+        return { schemas: {}, deps: [] };
     }
     logger.debug(`generateTSSchemas needed for ${uncoveredSchemas.length} types: ${uncoveredSchemas.slice(0, 3).join(', ')}${uncoveredSchemas.length > 3 ? '...' : ''}`);
     const virtualFilePath = join(dirname(resolve(tsconfig)), '__pikku_virtual_types__.ts');
@@ -239,8 +308,29 @@ function generateTSSchemas(logger, tsconfig, customTypesContent, typesMap, funct
             logger.error(`[${ErrorCode.SCHEMA_GENERATION_ERROR}] Error generating schema: ${schema}. Message: ${e.message}. Type info: ${customType ? `type=${customType.type}` : 'not in typesMap'}`);
         }
     });
-    return schemas;
+    // Fingerprinted here, while the program is still alive — it is released as soon
+    // as the schemas are out of it.
+    return { schemas, deps: fingerprintSchemaDeps(program) };
 }
+/**
+ * Where the RUNTIME value of a schema lives, given where TypeScript resolved it.
+ *
+ * A schema imported from a built workspace package resolves to that package's
+ * declaration file, and importing a `.d.ts` yields a module with no exports at
+ * all — every one of them is a type. The value is in the emitted JS beside it, so
+ * that is what gets imported.
+ *
+ * Falls back to the original path when no sibling JS exists, which keeps the
+ * "could not find exported schema" error pointing at the file the developer
+ * actually wrote.
+ */
+export const schemaRuntimeFile = (sourceFile) => {
+    const match = /\.d\.([cm]?)ts$/.exec(sourceFile);
+    if (!match)
+        return sourceFile;
+    const emitted = sourceFile.replace(/\.d\.([cm]?)ts$/, '.$1js');
+    return existsSync(emitted) ? emitted : sourceFile;
+};
 /**
  * Import all source files in parallel using tsx's register() API.
  *
@@ -333,7 +423,7 @@ async function generateZodSchemas(logger, schemaLookup, typesMap) {
     }
     // Collect unique source files and batch-import them in parallel
     const uniqueSourceFiles = [
-        ...new Set([...schemaLookup.values()].map((ref) => ref.sourceFile)),
+        ...new Set([...schemaLookup.values()].map((ref) => schemaRuntimeFile(ref.sourceFile))),
     ];
     logger.debug(`[TIMING] Zod schemas: ${schemaLookup.size} schemas from ${uniqueSourceFiles.length} files`);
     const importStart = performance.now();
@@ -343,11 +433,12 @@ async function generateZodSchemas(logger, schemaLookup, typesMap) {
     // Track schemas that need per-file tsImport fallback
     const fallbackSchemas = [];
     for (const [schemaName, ref] of schemaLookup.entries()) {
-        const mod = importedModules?.get(ref.sourceFile);
+        const runtimeFile = schemaRuntimeFile(ref.sourceFile);
+        const mod = importedModules?.get(runtimeFile);
         if (mod) {
             const zodSchema = mod[ref.variableName];
             if (!zodSchema) {
-                errors.push(`Could not find exported schema '${ref.variableName}' in ${ref.sourceFile} for ${schemaName}. Available exports: ${Object.keys(mod).join(', ')}`);
+                errors.push(`Could not find exported schema '${ref.variableName}' in ${runtimeFile} for ${schemaName}. Available exports: ${Object.keys(mod).join(', ')}`);
                 continue;
             }
             try {
@@ -368,11 +459,12 @@ async function generateZodSchemas(logger, schemaLookup, typesMap) {
     if (fallbackSchemas.length > 0) {
         logger.debug(`Falling back to register() import for ${fallbackSchemas.length} schema(s)`);
         for (const [schemaName, ref] of fallbackSchemas) {
+            const runtimeFile = schemaRuntimeFile(ref.sourceFile);
             try {
-                const module = await importWithRegister(ref.sourceFile);
+                const module = await importWithRegister(runtimeFile);
                 const zodSchema = module[ref.variableName];
                 if (!zodSchema) {
-                    errors.push(`Could not find exported schema '${ref.variableName}' in ${ref.sourceFile} for ${schemaName}. Available exports: ${Object.keys(module).join(', ')}`);
+                    errors.push(`Could not find exported schema '${ref.variableName}' in ${runtimeFile} for ${schemaName}. Available exports: ${Object.keys(module).join(', ')}`);
                     continue;
                 }
                 processZodSchema(schemaName, zodSchema, schemas, typesMap, auxiliaryTypeStore, printer, fakeSourceFile, logger);
@@ -395,8 +487,13 @@ export async function generateAllSchemas(logger, config, state) {
     const zodSchemas = await generateZodSchemas(logger, state.schemaLookup, state.functions.typesMap);
     const requiredTypes = new Set();
     const customTypesContent = generateCustomTypes(state.functions.typesMap, requiredTypes);
-    // Fast path: same process, types unchanged — reuse the in-memory result.
-    if (cachedTSSchemas && cachedCustomTypesContent === customTypesContent) {
+    // Fast path: same process, types unchanged — reuse the in-memory result. The
+    // dep check is what makes this correct under `pikku dev`, where the process
+    // outlives the edits: the custom-types source is identical whenever a named
+    // type changes shape without changing its name.
+    if (cachedTSSchemas &&
+        cachedCustomTypesContent === customTypesContent &&
+        schemaDepsUnchanged(cachedTSSchemaDeps)) {
         logger.debug('Reusing cached TS schemas (types unchanged)');
         return { ...cachedTSSchemas, ...zodSchemas };
     }
@@ -411,11 +508,12 @@ export async function generateAllSchemas(logger, config, state) {
         if (disk) {
             logger.debug('Reusing on-disk TS schemas (types unchanged across runs)');
             cachedCustomTypesContent = customTypesContent;
-            cachedTSSchemas = disk;
-            return { ...disk, ...zodSchemas };
+            cachedTSSchemas = disk.schemas;
+            cachedTSSchemaDeps = disk.deps;
+            return { ...disk.schemas, ...zodSchemas };
         }
     }
-    const tsSchemas = generateTSSchemas(logger, config.tsconfig, customTypesContent, state.functions.typesMap, state.functions.meta, state.http.meta, config.schemasFromTypes, config.schema?.additionalProperties, zodSchemas);
+    const { schemas: tsSchemas, deps: tsSchemaDeps } = generateTSSchemas(logger, config.tsconfig, customTypesContent, state.functions.typesMap, state.functions.meta, state.http.meta, config.schemasFromTypes, config.schema?.additionalProperties, zodSchemas);
     // Release the program once the schemas are out of it. It spans the whole
     // tsconfig (~2.5k files, ~600MB on a large tree) and was previously pinned at
     // module scope for the life of the process, so it stacked on top of the main
@@ -425,8 +523,9 @@ export async function generateAllSchemas(logger, config, state) {
     cachedSchemaProgram = undefined;
     cachedCustomTypesContent = customTypesContent;
     cachedTSSchemas = tsSchemas;
+    cachedTSSchemaDeps = tsSchemaDeps;
     if (config.cacheDir && cacheKey) {
-        writeDiskTSSchemas(logger, config.cacheDir, cacheKey, tsSchemas);
+        writeDiskTSSchemas(logger, config.cacheDir, cacheKey, tsSchemas, tsSchemaDeps);
     }
     return { ...tsSchemas, ...zodSchemas };
 }

package/dist/utils/secret-alias-services.d.ts

@@ -0,0 +1,8 @@
+import type ts from 'typescript';
+/** Whether a type structurally satisfies `SecretService`. */
+export declare const isSecretServiceType: (type: ts.Type, checker: ts.TypeChecker) => boolean;
+/**
+ * Singleton service names, other than `secrets`, whose type is a
+ * `SecretService`.
+ */
+export declare const findSecretAliasServices: (singletonServicesType: ts.Type, checker: ts.TypeChecker) => string[];

package/dist/utils/secret-alias-services.js

@@ -0,0 +1,45 @@
+const SECRET_SERVICE_METHODS = [
+    'getSecret',
+    'hasSecret',
+    'setSecret',
+    'deleteSecret',
+    'getSecrets',
+];
+/** Whether a type structurally satisfies `SecretService`. */
+export const isSecretServiceType = (type, checker) => {
+    const nonNullable = checker.getNonNullableType(type);
+    return SECRET_SERVICE_METHODS.every((method) => {
+        const property = nonNullable.getProperty(method);
+        if (!property) {
+            return false;
+        }
+        const declaration = property.valueDeclaration ?? property.declarations?.[0];
+        if (!declaration) {
+            return false;
+        }
+        const propertyType = checker.getTypeOfSymbolAtLocation(property, declaration);
+        return propertyType.getCallSignatures().length > 0;
+    });
+};
+/**
+ * Singleton service names, other than `secrets`, whose type is a
+ * `SecretService`.
+ */
+export const findSecretAliasServices = (singletonServicesType, checker) => {
+    const aliases = [];
+    for (const property of singletonServicesType.getProperties()) {
+        const name = property.getName();
+        if (name === 'secrets') {
+            continue;
+        }
+        const declaration = property.valueDeclaration ?? property.declarations?.[0];
+        if (!declaration) {
+            continue;
+        }
+        const type = checker.getTypeOfSymbolAtLocation(property, declaration);
+        if (isSecretServiceType(type, checker)) {
+            aliases.push(name);
+        }
+    }
+    return aliases.sort();
+};

package/dist/utils/secret-brokers.d.ts

@@ -0,0 +1,2 @@
+/** Whether this function keeps the full `SecretService`. */
+export declare const isSecretBrokerFunction: (functionId: string) => boolean;

package/dist/utils/secret-brokers.js

@@ -0,0 +1,9 @@
+/** The console's secret administration functions, and nothing else. */
+const SECRET_BROKER_FUNCTIONS = new Set([
+    'pikkuConsoleSetSecret',
+    'pikkuConsoleGetSecret',
+    'pikkuConsoleHasSecret',
+]);
+/** Whether this function keeps the full `SecretService`. */
+export const isSecretBrokerFunction = (functionId) => SECRET_BROKER_FUNCTIONS.has(functionId) ||
+    SECRET_BROKER_FUNCTIONS.has(functionId.split(':').pop() ?? '');

package/dist/utils/serialize-inspector-state.d.ts

@@ -1,3 +1,4 @@
+import type { SecretUsage } from './extract-secret-usage.js';
 import type { JSONValue } from '@pikku/core';
 import type { InspectorDiagnostic, InspectorFeature, InspectorState } from '../types.js';
 /**
@@ -228,6 +229,7 @@ export interface SerializableInspectorState {
     secrets: {
         definitions: InspectorState['secrets']['definitions'];
         files: string[];
+        usage: Record<string, SecretUsage>;
     };
     credentials: {
         definitions: InspectorState['credentials']['definitions'];
@@ -237,6 +239,14 @@ export interface SerializableInspectorState {
         definitions: InspectorState['scopes']['definitions'];
         files: string[];
     };
+    systemRoles: {
+        definitions: InspectorState['systemRoles']['definitions'];
+        files: string[];
+    };
+    personas: {
+        definitions: InspectorState['personas']['definitions'];
+        files: string[];
+    };
     variables: {
         definitions: InspectorState['variables']['definitions'];
         files: string[];

package/dist/utils/serialize-inspector-state.js

@@ -112,6 +112,7 @@ export function serializeInspectorState(state) {
         secrets: {
             definitions: state.secrets.definitions,
             files: Array.from(state.secrets.files),
+            usage: Object.fromEntries(state.secrets.usage),
         },
         credentials: {
             definitions: state.credentials.definitions,
@@ -121,6 +122,14 @@ export function serializeInspectorState(state) {
             definitions: state.scopes.definitions,
             files: Array.from(state.scopes.files),
         },
+        systemRoles: {
+            definitions: state.systemRoles.definitions,
+            files: Array.from(state.systemRoles.files),
+        },
+        personas: {
+            definitions: state.personas.definitions,
+            files: Array.from(state.personas.files),
+        },
         variables: {
             definitions: state.variables.definitions,
             files: Array.from(state.variables.files),
@@ -276,6 +285,7 @@ export function deserializeInspectorState(data) {
         secrets: {
             definitions: data.secrets?.definitions || [],
             files: new Set(data.secrets?.files || []),
+            usage: new Map(Object.entries(data.secrets?.usage || {})),
         },
         credentials: {
             definitions: data.credentials?.definitions || [],
@@ -285,6 +295,14 @@ export function deserializeInspectorState(data) {
             definitions: data.scopes?.definitions || [],
             files: new Set(data.scopes?.files || []),
         },
+        systemRoles: {
+            definitions: data.systemRoles?.definitions || [],
+            files: new Set(data.systemRoles?.files || []),
+        },
+        personas: {
+            definitions: data.personas?.definitions || [],
+            files: new Set(data.personas?.files || []),
+        },
         variables: {
             definitions: data.variables?.definitions || [],
             files: new Set(data.variables?.files || []),

package/dist/utils/serialize-middleware-groups-meta.js

@@ -9,6 +9,9 @@ const serializeGroupMap = (groupMap) => {
             count: meta.count,
             instanceIds: meta.instanceIds,
             isFactory: meta.isFactory,
+            ...(meta.additionalRegistrations && {
+                additionalRegistrations: meta.additionalRegistrations,
+            }),
         };
     }
     return result;

package/dist/utils/validate-exposed-functions-gated.d.ts

@@ -0,0 +1,14 @@
+import type { InspectorLogger, InspectorState } from '../types.js';
+/**
+ * A function reachable through the generated `POST /rpc/:rpcName` dispatcher
+ * that nothing will stop.
+ *
+ * `rpc.exposed` refuses anything without `expose: true`, so the population is
+ * small and deliberate — someone typed it. What makes one dangerous is the
+ * combination: exposed, sessionless, and carrying no gate of its own or from
+ * the addon it belongs to. The dispatcher cannot help, because it does not know
+ * what it is dispatching to.
+ *
+ * knowledge: decisions/security/console-addon-privileged-functions-gate-themselves.md
+ */
+export declare function validateExposedFunctionsGated(logger: InspectorLogger, state: InspectorState): void;

package/dist/utils/validate-exposed-functions-gated.js

@@ -0,0 +1,85 @@
+import { ErrorCode } from '../error-codes.js';
+/**
+ * A function reachable through the generated `POST /rpc/:rpcName` dispatcher
+ * that nothing will stop.
+ *
+ * `rpc.exposed` refuses anything without `expose: true`, so the population is
+ * small and deliberate — someone typed it. What makes one dangerous is the
+ * combination: exposed, sessionless, and carrying no gate of its own or from
+ * the addon it belongs to. The dispatcher cannot help, because it does not know
+ * what it is dispatching to.
+ *
+ * knowledge: decisions/security/console-addon-privileged-functions-gate-themselves.md
+ */
+export function validateExposedFunctionsGated(logger, state) {
+    const ungated = [];
+    for (const [funcName, meta] of Object.entries(state.functions.meta)) {
+        if (!meta.expose)
+            continue;
+        // A pikkuFunc always requires a session, on every path.
+        if (meta.sessionless === false)
+            continue;
+        // Scenario steps are refused by rpcExposed regardless of `expose`.
+        if (meta.scenarioStep)
+            continue;
+        // The author declared that the body authorizes its own callers — a gate
+        // this check has no way to see. Taking the claim at face value is the
+        // point: without it the warning fires forever on functions that are fine,
+        // and a warning that is usually wrong stops being read.
+        if (meta.selfAuthenticated === true)
+            continue;
+        // The function gates itself.
+        if (meta.auth === true)
+            continue;
+        if (meta.scopes && meta.scopes.length > 0)
+            continue;
+        if (meta.permissions && meta.permissions.length > 0)
+            continue;
+        if (isGatedByItsAddon(state, meta.packageName))
+            continue;
+        ungated.push(funcName);
+    }
+    if (ungated.length === 0)
+        return;
+    const shown = ungated.slice(0, 10);
+    const rest = ungated.length - shown.length;
+    logger.diagnostic({
+        severity: 'warn',
+        code: ErrorCode.EXPOSED_FUNCTION_HAS_NO_GATE,
+        message: `${ungated.length} exposed function${ungated.length === 1 ? '' : 's'} ` +
+            `require neither a session nor any permission or scope, and ` +
+            `${ungated.length === 1 ? 'is' : 'are'} reachable by anyone through ` +
+            `POST /rpc/:rpcName: ${shown.join(', ')}` +
+            (rest > 0 ? `, and ${rest} more` : '') +
+            `. Add scopes or permissions to the function, gate the whole addon with ` +
+            `wireAddon({ scopes: [...] }), or drop \`expose: true\` if it was not ` +
+            `meant to be callable from outside.`,
+    });
+}
+/**
+ * Whether every function in this package is already gated by its `wireAddon`.
+ * Those gates are applied by `runPikkuFunc` on every wiring path, so a function
+ * with no gate of its own is still covered by them.
+ *
+ * An addon whose `scopes`/`auth` were not statically knowable reads as
+ * unknown, and unknown is treated as gated — a false negative here costs a
+ * missing warning, a false positive costs trust in every warning.
+ *
+ * knowledge: decisions/security/addon-scopes-are-resolved-where-the-function-runs.md
+ */
+function isGatedByItsAddon(state, packageName) {
+    if (!packageName)
+        return false;
+    const declarations = state.rpc?.wireAddonDeclarations;
+    if (!declarations)
+        return false;
+    for (const declaration of declarations.values()) {
+        if (declaration.package !== packageName)
+            continue;
+        if (declaration.auth === true)
+            return true;
+        if (declaration.scopes && declaration.scopes.length > 0)
+            return true;
+    }
+    return false;
+}

package/dist/utils/validate-tags-resolve-to-middleware.d.ts

@@ -0,0 +1,20 @@
+import type { InspectorLogger, InspectorState } from '../types.js';
+/**
+ * An addon tag naming middleware nobody registered.
+ *
+ * `wireAddon({ tags: ['admin'] })` reads like a gate and is applied like one —
+ * right up until no `addTagMiddleware('admin', …)` exists, at which point it
+ * resolves to an empty list and every request sails through. Nothing at runtime
+ * distinguishes "this tag runs three middlewares" from "this tag does nothing".
+ *
+ * Only **addon** tags are reported. A tag on a function is just as likely to be
+ * organizational — grouping, documentation, OpenAPI — and warning about every
+ * one of those would bury the case that matters. A tag on `wireAddon` is
+ * different: it is the documented way to apply a gate across a whole addon, so
+ * an inert one is never decorative. An exposed function relying on a tag it
+ * has no other gate behind is already reported by
+ * `validateExposedFunctionsGated`, which does not count tags as a gate.
+ *
+ * knowledge: decisions/security/addon-auth-and-tags-only-tighten.md
+ */
+export declare function validateTagsResolveToMiddleware(logger: InspectorLogger, state: InspectorState): void;

package/dist/utils/validate-tags-resolve-to-middleware.js

@@ -0,0 +1,41 @@
+import { ErrorCode } from '../error-codes.js';
+/**
+ * An addon tag naming middleware nobody registered.
+ *
+ * `wireAddon({ tags: ['admin'] })` reads like a gate and is applied like one —
+ * right up until no `addTagMiddleware('admin', …)` exists, at which point it
+ * resolves to an empty list and every request sails through. Nothing at runtime
+ * distinguishes "this tag runs three middlewares" from "this tag does nothing".
+ *
+ * Only **addon** tags are reported. A tag on a function is just as likely to be
+ * organizational — grouping, documentation, OpenAPI — and warning about every
+ * one of those would bury the case that matters. A tag on `wireAddon` is
+ * different: it is the documented way to apply a gate across a whole addon, so
+ * an inert one is never decorative. An exposed function relying on a tag it
+ * has no other gate behind is already reported by
+ * `validateExposedFunctionsGated`, which does not count tags as a gate.
+ *
+ * knowledge: decisions/security/addon-auth-and-tags-only-tighten.md
+ */
+export function validateTagsResolveToMiddleware(logger, state) {
+    const registered = new Set([
+        ...state.middleware.tagMiddleware.keys(),
+        ...state.channelMiddleware.tagMiddleware.keys(),
+    ]);
+    for (const [namespace, declaration] of state.rpc?.wireAddonDeclarations ??
+        []) {
+        for (const tag of declaration.tags ?? []) {
+            if (registered.has(tag))
+                continue;
+            logger.diagnostic({
+                severity: 'warn',
+                code: ErrorCode.TAG_RESOLVES_TO_NO_MIDDLEWARE,
+                message: `wireAddon('${namespace}') declares tag '${tag}', but no ` +
+                    `addTagMiddleware('${tag}', …) registers anything for it. The tag ` +
+                    `resolves to an empty middleware list, so it applies no gate to the ` +
+                    `addon at all. Register middleware for it, or drop the tag if it is ` +
+                    `only meant to group and document.`,
+            });
+        }
+    }
+}

package/dist/visit.js

@@ -23,6 +23,8 @@ import { addAuth } from './add/add-auth.js';
 import { addSecret } from './add/add-secret.js';
 import { addCredential } from './add/add-credential.js';
 import { addScope } from './add/add-scope.js';
+import { addSystemRole } from './add/add-system-role.js';
+import { addPersonas } from './add/add-personas.js';
 import { addVariable } from './add/add-variable.js';
 import { addWorkflowGraph } from './add/add-workflow-graph.js';
 import { addFeature } from './add/add-feature.js';
@@ -69,6 +71,8 @@ export const visitRoutes = (logger, checker, node, state, options) => {
     addSecret(logger, node, checker, state, nextOptions);
     addCredential(logger, node, checker, state, nextOptions);
     addScope(logger, node, checker, state, nextOptions);
+    addSystemRole(logger, node, checker, state, nextOptions);
+    addPersonas(logger, node, checker, state, nextOptions);
     addVariable(logger, node, checker, state, nextOptions);
     addHTTPRoute(logger, node, checker, state, nextOptions);
     addHTTPRoutes(logger, node, checker, state, nextOptions);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/inspector",
-  "version": "0.12.49",
+  "version": "0.12.52",
   "description": "TypeScript inspector for Pikku — discovers functions and wirings to drive code generation",
   "author": "yasser.fadl@gmail.com",
   "license": "BUSL-1.1",
@@ -45,10 +45,10 @@
     "zod-to-ts": "^2.1.0"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.71"
+    "@pikku/core": "^0.12.74"
   },
   "devDependencies": {
-    "@pikku/core": "^0.12.71",
+    "@pikku/core": "^0.12.74",
     "@types/node": "^24.11.0"
   },
   "engines": {

package/src/add/add-auth.test.ts

@@ -13,8 +13,10 @@ const makeLogger = (criticals: Array<{ code: ErrorCode; message: string }>) =>
     info: () => {},
     warn: () => {},
     error: () => {},
-    diagnostic: ({ code, message }) => {
-      criticals.push({ code, message })
+    diagnostic: ({ severity, code, message }) => {
+      if (severity !== 'warn') {
+        criticals.push({ code, message })
+      }
     },
     critical: (code: ErrorCode, message: string) => {
       criticals.push({ code, message })
@@ -111,7 +113,7 @@ describe('addAuth inspector', () => {
         'export const auth = pikkuBetterAuth(() =>',
         '  betterAuth({',
         '    session: { cookieCache: { enabled: true } },',
-        "    emailAndPassword: { enabled: true },",
+        '    emailAndPassword: { enabled: true },',
         '  })',
         ')',
       ].join('\n')

package/src/add/add-auth.ts

@@ -139,7 +139,7 @@ const isInsideGlobalMiddlewareRegistration = (node: ts.Node): boolean => {
  *
  * The pikku CLI discovers that single export and generates a catch-all
  * `auth.gen.ts` that wires `${basePath}/**` to one shared handler, registers the
- * better-auth session middleware, and emits a `wireSecret` for every configured
+ * better-auth session middleware, and emits a `defineSecret` for every configured
  * social provider — so the auth routes and secret requirements flow through
  * normal inspection into the deploy manifest.
  *

package/src/add/add-cli.ts

@@ -153,6 +153,14 @@ function processCLIConfig(
         // Already handled in first pass
         break
 
+      case 'auth': {
+        const value = getPropertyValue(node, 'auth')
+        if (typeof value === 'boolean') {
+          programMeta.auth = value
+        }
+        break
+      }
+
       case 'commands':
         if (ts.isObjectLiteralExpression(prop.initializer)) {
           programMeta.commands = processCommands(

package/src/add/add-credential.ts

@@ -24,7 +24,7 @@ export const addCredential: AddWiring = (
   const firstArg = args[0]
   const expression = node.expression
 
-  if (!ts.isIdentifier(expression) || expression.text !== 'wireCredential') {
+  if (!ts.isIdentifier(expression) || expression.text !== 'defineCredential') {
     return
   }