@pikku/inspector 0.12.50 → 0.12.52

package/src/add/add-functions.ts

@@ -9,7 +9,28 @@ import {
 import { extractFunctionNode } from '../utils/extract-function-node.js'
 import { extractUsedWires } from '../utils/extract-services.js'
 import type { FunctionServicesMeta } from '@pikku/core'
+import type { ScenarioStepKind, ScenarioSurface } from '@pikku/core/workflow'
 import { formatVersionedId, parseVersionedId } from '@pikku/core'
+
+/** Binding keys a `pikkuScenarioStep` may declare, in report order. */
+const SCENARIO_SURFACE_KEYS: readonly ScenarioSurface[] = [
+  'browser',
+  'cli',
+  'default',
+]
+
+/**
+ * The step wrappers, and who acts in each.
+ *
+ * Which function was called *is* the kind. That is the whole reason these are
+ * three declarations rather than a `kind:` field on one: a string literal can be
+ * copied into an addon package by a consumer, a called identifier cannot.
+ */
+const SCENARIO_STEP_KINDS = new Map<string, ScenarioStepKind>([
+  ['pikkuScenarioStep', 'persona'],
+  ['pikkuPlatformScenarioStep', 'platform'],
+  ['pikkuAddonScenarioStep', 'addon'],
+])
 import {
   getPropertyValue,
   getArrayPropertyValue,
@@ -366,6 +387,112 @@ function computeImplementationHash(args: {
   )
 }
 
+/**
+ * Registers a `pikkuRemoteChannelFunc` declaration: a name, its schemas and its
+ * description, with no body to inspect. The name has to reach `rpc.internalMeta`
+ * for `channel.remote` to resolve the schemas it validates each call against.
+ */
+const addRemoteChannelFunc = ({
+  state,
+  logger,
+  node,
+  pikkuFuncId,
+  name,
+  exportedName,
+  inputSchemaRef,
+  outputSchemaRef,
+  meta,
+}: {
+  state: InspectorState
+  logger: Parameters<AddWiring>[0]
+  node: ts.CallExpression
+  pikkuFuncId: string
+  name: string
+  exportedName?: string | null
+  inputSchemaRef: SchemaRef | null
+  outputSchemaRef: SchemaRef | null
+  meta: {
+    version?: number
+    title?: string
+    tags?: string[]
+    summary?: string
+    description?: string
+    errors?: string[]
+  }
+}) => {
+  const sourceFile = node.getSourceFile().fileName
+
+  if (!exportedName) {
+    logger.error(
+      `• Remote channel function '${name}' is not exported, this is not allowed.`
+    )
+    return
+  }
+
+  // Two files declaring the same capability is the collision that matters:
+  // both ids are the bare name, so the id-compatibility check below reads them
+  // as the same function and lets the second overwrite the first.
+  const existingFunction = state.functions.meta[pikkuFuncId]
+  if (
+    existingFunction &&
+    existingFunction.sourceFile &&
+    existingFunction.sourceFile !== sourceFile
+  ) {
+    logger.critical(
+      ErrorCode.DUPLICATE_FUNCTION_NAME,
+      `Function name '${name}' is not unique. ` +
+        `'${pikkuFuncId}' is already defined in '${existingFunction.sourceFile}' and cannot be redefined in '${sourceFile}'.`
+    )
+    return
+  }
+
+  const existing = state.rpc.internalMeta[name]
+  if (existing && !areCompatibleFunctionIds(existing, pikkuFuncId)) {
+    logger.critical(
+      ErrorCode.DUPLICATE_FUNCTION_NAME,
+      `Function name '${name}' is not unique. ` +
+        `It already points to '${existing}' in '${resolveExistingFunctionSource(state, existing) || 'unknown file'}', but '${pikkuFuncId}' in '${sourceFile}' tried to use the same name.`
+    )
+    return
+  }
+
+  const capitalizedName = funcIdToTypeName(name)
+  const registerSchema = (
+    ref: SchemaRef | null,
+    suffix: 'Input' | 'Output'
+  ) => {
+    if (!ref) return null
+    const schemaName = `${capitalizedName}${suffix}`
+    state.schemaLookup.set(schemaName, ref)
+    state.functions.typesMap.addCustomType(schemaName, 'unknown', [])
+    return schemaName
+  }
+  const inputSchemaName = registerSchema(inputSchemaRef, 'Input')
+  const outputSchemaName = registerSchema(outputSchemaRef, 'Output')
+
+  state.functions.meta[pikkuFuncId] = {
+    pikkuFuncId,
+    functionType: 'remote',
+    funcWrapper: 'pikkuRemoteChannelFunc',
+    sessionless: true,
+    name,
+    services: { optimized: true, services: [] },
+    inputSchemaName,
+    outputSchemaName,
+    inputs: inputSchemaName ? [inputSchemaName] : [],
+    outputs: outputSchemaName ? [outputSchemaName] : [],
+    sourceFile,
+    exportedName,
+    ...meta,
+  }
+
+  state.functions.files.set(pikkuFuncId, { path: sourceFile, exportedName })
+  state.rpc.internalMeta[name] = pikkuFuncId
+  // Imported so a local call gets the factory's "this runs on the client"
+  // error rather than a bare lookup miss.
+  state.rpc.internalFiles.set(pikkuFuncId, { path: sourceFile, exportedName })
+}
+
 /**
  * Inspect pikkuFunc calls, extract input/output and first-arg destructuring,
  * then push into state.functions.meta.
@@ -387,13 +514,13 @@ export const addFunctions: AddWiring = (
   }
 
   // Match identifiers that contain both "pikku" and "func" (case insensitive),
-  // plus pikkuScenario and pikkuScenarioStep (workflow wrappers without "func"
-  // in their names)
+  // plus pikkuScenario and the three scenario step wrappers (workflow wrappers
+  // without "func" in their names)
   const pikkuFuncPattern = /pikku.*func/i
   if (
     !pikkuFuncPattern.test(expression.text) &&
     expression.text !== 'pikkuScenario' &&
-    expression.text !== 'pikkuScenarioStep'
+    !SCENARIO_STEP_KINDS.has(expression.text)
   ) {
     return
   }
@@ -401,7 +528,8 @@ export const addFunctions: AddWiring = (
   // A scenario step is bundled like any invoked function, but is deliberately
   // never RPC-registered: a step may drive a browser, so exposing it over the
   // network would put a test harness on the public API surface.
-  const isScenarioStep = expression.text === 'pikkuScenarioStep'
+  const scenarioStepKind = SCENARIO_STEP_KINDS.get(expression.text)
+  const isScenarioStep = scenarioStepKind !== undefined
 
   // A scenario's own body. Marked so the codegen partitions and the deploy
   // analyzer can tell it apart from an application workflow without having to
@@ -444,6 +572,15 @@ export const addFunctions: AddWiring = (
   let expose: boolean | undefined
   let remote: boolean | undefined
   let mcp: boolean | undefined
+  /**
+   * A sessionless function's own `auth: true`. `sessionless` records the
+   * baseline — a `pikkuFunc` always needs a session — while this records the
+   * tightening a `pikkuSessionlessFunc` applies to itself, which is otherwise
+   * invisible to anything reading meta.
+   */
+  let auth: boolean | undefined
+  /** The author's claim that the body authorizes its own callers. */
+  let selfAuthenticated: boolean | undefined
   let readonly_: boolean | undefined
   let deploy: 'serverless' | 'server' | 'auto' | undefined
   let approvalRequired: boolean | undefined
@@ -451,7 +588,8 @@ export const addFunctions: AddWiring = (
   let workflowQueued: boolean | undefined
   let workflowRetries: number | undefined
   let workflowTimeout: string | undefined
-  let scenarioStepBrowser: boolean | undefined
+  let scenarioStepSurfaces: ScenarioSurface[] | undefined
+  let scenarioStepAddon: string | undefined
   let scenarioStepTemplate: string | undefined
   let scopes: string[] | undefined
   let version: number | undefined
@@ -540,6 +678,10 @@ export const addFunctions: AddWiring = (
     expose = getPropertyValue(firstArg, 'expose') as boolean | undefined
     remote = getPropertyValue(firstArg, 'remote') as boolean | undefined
     mcp = getPropertyValue(firstArg, 'mcp') as boolean | undefined
+    auth = getPropertyValue(firstArg, 'auth') as boolean | undefined
+    selfAuthenticated = getPropertyValue(firstArg, 'selfAuthenticated') as
+      | boolean
+      | undefined
     readonly_ = getPropertyValue(firstArg, 'readonly') as boolean | undefined
     deploy = getPropertyValue(firstArg, 'deploy') as
       | 'serverless'
@@ -558,9 +700,50 @@ export const addFunctions: AddWiring = (
     workflowTimeout = getPropertyValue(firstArg, 'workflowTimeout') as
       | string
       | undefined
-    scenarioStepBrowser = getPropertyValue(firstArg, 'browser') as
-      | boolean
-      | undefined
+    // A step declares one implementation per surface it supports; the binding
+    // keys that are present ARE the declaration, so there is nothing to read a
+    // value from — only names to collect.
+    const declaredSurfaces = SCENARIO_SURFACE_KEYS.filter((surface) =>
+      firstArg.properties.some(
+        (prop) =>
+          (ts.isPropertyAssignment(prop) ||
+            ts.isMethodDeclaration(prop) ||
+            ts.isShorthandPropertyAssignment(prop)) &&
+          ts.isIdentifier(prop.name) &&
+          prop.name.text === surface
+      )
+    )
+    if (scenarioStepKind === 'platform' || scenarioStepKind === 'addon') {
+      // Neither kind has surfaces. Nobody clicks "Stripe's webhook arrives", and
+      // there is no human behind "the platform has expired the trial" — so both
+      // take a single `func`, and a binding key here is a coded error rather
+      // than a convention nobody reads.
+      if (declaredSurfaces.length > 0) {
+        logger.error(
+          `• ${expression.text}('${name}') declares ${declaredSurfaces.join('/')} — a ${scenarioStepKind} step has one implementation, declared as \`func\`. Surfaces are how a person drives the system, and nobody drives this one.`
+        )
+        return
+      }
+      // The phase rule depends on it: an assertion runs every witness it has and
+      // fails if they disagree, so a step with exactly one witness by
+      // construction has to be unable to look like it has several.
+      scenarioStepSurfaces = ['default']
+      if (scenarioStepKind === 'addon') {
+        scenarioStepAddon = getPropertyValue(firstArg, 'addon') as
+          | string
+          | undefined
+        if (!scenarioStepAddon) {
+          logger.error(
+            `• pikkuAddonScenarioStep('${name}') needs a string literal \`addon\` naming the addon whose system acts — the same name its wireAddon declares.`
+          )
+          return
+        }
+      }
+    } else {
+      scenarioStepSurfaces = declaredSurfaces.length
+        ? declaredSurfaces
+        : undefined
+    }
     scenarioStepTemplate = getPropertyValue(firstArg, 'template') as
       | string
       | undefined
@@ -684,6 +867,24 @@ export const addFunctions: AddWiring = (
     pikkuFuncId = formatVersionedId(baseName, version)
   }
 
+  // A remote channel capability is a contract with no body: the connected
+  // client answers it. Everything past this point reads the handler, so it gets
+  // its own path rather than a nullable handler threaded through all of it.
+  if (expression.text === 'pikkuRemoteChannelFunc') {
+    addRemoteChannelFunc({
+      state,
+      logger,
+      node,
+      pikkuFuncId,
+      name,
+      exportedName,
+      inputSchemaRef,
+      outputSchemaRef,
+      meta: { version, title, tags, summary, description, errors },
+    })
+    return
+  }
+
   const isMCPToolFunc = expression.text === 'pikkuMCPToolFunc'
   const isListFunc = expression.text === 'pikkuListFunc'
   const mcpEnabled = mcp || isMCPToolFunc
@@ -1109,6 +1310,8 @@ export const addFunctions: AddWiring = (
     inputs: inputNames.filter((n) => n !== 'void') ?? null,
     outputs: outputNames.filter((n) => n !== 'void') ?? null,
     expose: expose || undefined,
+    auth: auth || undefined,
+    selfAuthenticated: selfAuthenticated || undefined,
     remote: remote || undefined,
     scenarioStep: isScenarioStep || undefined,
     scenario: isScenario || undefined,
@@ -1120,7 +1323,14 @@ export const addFunctions: AddWiring = (
     workflowQueued: workflowQueued === true ? true : undefined,
     workflowRetries: workflowRetries ?? undefined,
     workflowTimeout: workflowTimeout ?? undefined,
-    scenarioStepBrowser: scenarioStepBrowser === true ? true : undefined,
+    scenarioStepSurfaces,
+    // `persona` is the default reading of an unmarked step, so it is left off
+    // rather than written into every step meta a project already has.
+    scenarioStepKind:
+      scenarioStepKind && scenarioStepKind !== 'persona'
+        ? scenarioStepKind
+        : undefined,
+    scenarioStepAddon,
     scenarioStepTemplate: scenarioStepTemplate || undefined,
     scopes: scopes ?? undefined,
     implementationHash,

package/src/add/add-http-route.ts

@@ -272,18 +272,27 @@ export function registerHTTPRoute({
     }
   }
 
+  // The route's own `auth`, falling back to the group's. Recorded on the meta
+  // below so an audit can answer "is this route open?" without re-reading the
+  // source: the route can tighten a sessionless function, and until this was
+  // written down that tightening existed only in the wiring.
+  const routeAuthProp = getPropertyValue(obj, 'auth')
+  const resolvedAuth =
+    routeAuthProp === true || routeAuthProp === false
+      ? routeAuthProp
+      : inheritedAuth
+
   // For inline functions (e.g. oauth2 handlers), propagate sessionless: true
   // when auth is explicitly disabled at the route or group level — the
   // developer opted out of auth so no session is required.
   {
     const inlineMeta = state.functions.meta[funcName]
-    if (inlineMeta && inlineMeta.sessionless === undefined) {
-      const routeAuth = getPropertyValue(obj, 'auth')
-      const resolvedAuth =
-        routeAuth === true || routeAuth === false ? routeAuth : inheritedAuth
-      if (resolvedAuth === false) {
-        inlineMeta.sessionless = true
-      }
+    if (
+      inlineMeta &&
+      inlineMeta.sessionless === undefined &&
+      resolvedAuth === false
+    ) {
+      inlineMeta.sessionless = true
     }
   }
 
@@ -416,6 +425,7 @@ export function registerHTTPRoute({
     route: fullRoute,
     sourceFile: sourceFile.fileName,
     method: method as HTTPMethod,
+    ...(resolvedAuth !== undefined && { auth: resolvedAuth }),
     params: params.length > 0 ? params : undefined,
     query: query.length > 0 ? query : undefined,
     inputTypes: undefined,
@@ -484,6 +494,9 @@ export function registerHTTPRouteMeta({
     route: fullRoute,
     sourceFile: sourceFile.fileName,
     method: method as HTTPMethod,
+    ...((route.auth ?? inheritedAuth) !== undefined && {
+      auth: route.auth ?? inheritedAuth,
+    }),
     params: params.length > 0 ? params : undefined,
     inputTypes: undefined,
     tags: tags.length > 0 ? tags : undefined,

package/src/add/add-middleware.test.ts

@@ -0,0 +1,196 @@
+import { strict as assert } from 'assert'
+import { describe, test } from 'node:test'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { inspect } from '../inspector.js'
+import type { ErrorCode } from '../error-codes.js'
+import type { InspectorLogger, MiddlewareGroupMeta } from '../types.js'
+
+const makeLogger = (criticals: Array<{ code: ErrorCode; message: string }>) =>
+  ({
+    debug: () => {},
+    info: () => {},
+    warn: () => {},
+    error: () => {},
+    diagnostic: ({ code, message }) => {
+      criticals.push({ code, message })
+    },
+    critical: (code: ErrorCode, message: string) => {
+      criticals.push({ code, message })
+    },
+    hasCriticalErrors: () => criticals.length > 0,
+  }) satisfies InspectorLogger
+
+/** Every file that registered middleware for one pattern or tag. */
+const sourceFiles = (group: MiddlewareGroupMeta | undefined): string[] =>
+  group
+    ? [
+        group.sourceFile,
+        ...(group.additionalRegistrations ?? []).map((r) => r.sourceFile),
+      ]
+    : []
+
+/** Runs the inspector over files written into a throwaway directory. */
+const withProject = async (
+  prefix: string,
+  files: Record<string, string[]>,
+  assertions: (state: Awaited<ReturnType<typeof inspect>>) => void
+) => {
+  const rootDir = await mkdtemp(join(tmpdir(), prefix))
+  const paths: string[] = []
+  for (const [name, lines] of Object.entries(files)) {
+    const path = join(rootDir, name)
+    await writeFile(path, lines.join('\n'))
+    paths.push(path)
+  }
+  try {
+    assertions(await inspect(makeLogger([]), paths, { rootDir }))
+  } finally {
+    await rm(rootDir, { recursive: true, force: true })
+  }
+}
+
+describe('addMiddleware inspector', () => {
+  describe('two files registering the same HTTP pattern', () => {
+    // The group is keyed by pattern, so the second call used to overwrite the
+    // first. Codegen emits imports from what is stored, so the losing file was
+    // never imported and its middleware never registered — an app could lose
+    // its session bridge to an unrelated '*' group and see nothing go wrong
+    // until a request arrived without a session.
+    const project = {
+      'session.ts': [
+        "import { addHTTPMiddleware, pikkuMiddleware } from '#pikku'",
+        'export const sessionMiddleware = () =>',
+        "  addHTTPMiddleware('*', [",
+        '    pikkuMiddleware(async (_s, _w, next) => next()),',
+        '  ])',
+      ],
+      'logging.ts': [
+        "import { addHTTPMiddleware, pikkuMiddleware } from '#pikku'",
+        'export const loggingMiddleware = () =>',
+        "  addHTTPMiddleware('*', [",
+        '    pikkuMiddleware(async (_s, _w, next) => next()),',
+        '  ])',
+      ],
+    }
+
+    test('keeps both registrations', async () => {
+      await withProject('pikku-mw-http-collide-', project, (state) => {
+        const group = state.http.routeMiddleware.get('*')
+        assert.ok(group, "expected a group for '*'")
+        assert.equal(
+          sourceFiles(group).length,
+          2,
+          'both files must survive, or one middleware silently stops running'
+        )
+      })
+    })
+
+    test('keeps both export names, so both can be imported', async () => {
+      await withProject('pikku-mw-http-names-', project, (state) => {
+        const group = state.http.routeMiddleware.get('*')!
+        const names = [
+          group.exportName,
+          ...(group.additionalRegistrations ?? []).map((r) => r.exportName),
+        ]
+        assert.deepEqual(names.sort(), [
+          'loggingMiddleware',
+          'sessionMiddleware',
+        ])
+      })
+    })
+
+    test('unions the services both registrations need', async () => {
+      await withProject('pikku-mw-http-services-', project, (state) => {
+        const group = state.http.routeMiddleware.get('*')!
+        assert.equal(
+          new Set(group.services.services).size,
+          group.services.services.length,
+          'services must not repeat when two groups merge'
+        )
+      })
+    })
+  })
+
+  test('a single registration is unchanged', async () => {
+    await withProject(
+      'pikku-mw-http-single-',
+      {
+        'session.ts': [
+          "import { addHTTPMiddleware, pikkuMiddleware } from '#pikku'",
+          'export const sessionMiddleware = () =>',
+          "  addHTTPMiddleware('*', [",
+          '    pikkuMiddleware(async (_s, _w, next) => next()),',
+          '  ])',
+        ],
+      },
+      (state) => {
+        const group = state.http.routeMiddleware.get('*')!
+        assert.equal(group.exportName, 'sessionMiddleware')
+        assert.equal(
+          group.additionalRegistrations,
+          undefined,
+          'nothing to merge means nothing extra to serialize'
+        )
+      }
+    )
+  })
+
+  test('different patterns stay separate groups', async () => {
+    await withProject(
+      'pikku-mw-http-distinct-',
+      {
+        'session.ts': [
+          "import { addHTTPMiddleware, pikkuMiddleware } from '#pikku'",
+          'export const sessionMiddleware = () =>',
+          "  addHTTPMiddleware('*', [",
+          '    pikkuMiddleware(async (_s, _w, next) => next()),',
+          '  ])',
+        ],
+        'api.ts': [
+          "import { addHTTPMiddleware, pikkuMiddleware } from '#pikku'",
+          'export const apiMiddleware = () =>',
+          "  addHTTPMiddleware('/api/*', [",
+          '    pikkuMiddleware(async (_s, _w, next) => next()),',
+          '  ])',
+        ],
+      },
+      (state) => {
+        assert.equal(sourceFiles(state.http.routeMiddleware.get('*')).length, 1)
+        assert.equal(
+          sourceFiles(state.http.routeMiddleware.get('/api/*')).length,
+          1
+        )
+      }
+    )
+  })
+
+  test('two files registering the same tag keep both registrations', async () => {
+    await withProject(
+      'pikku-mw-tag-collide-',
+      {
+        'session.ts': [
+          "import { addTagMiddleware, pikkuMiddleware } from '#pikku'",
+          'export const sessionTag = () =>',
+          "  addTagMiddleware('api', [",
+          '    pikkuMiddleware(async (_s, _w, next) => next()),',
+          '  ])',
+        ],
+        'logging.ts': [
+          "import { addTagMiddleware, pikkuMiddleware } from '#pikku'",
+          'export const loggingTag = () =>',
+          "  addTagMiddleware('api', [",
+          '    pikkuMiddleware(async (_s, _w, next) => next()),',
+          '  ])',
+        ],
+      },
+      (state) => {
+        assert.equal(
+          sourceFiles(state.middleware.tagMiddleware.get('api')).length,
+          2
+        )
+      }
+    )
+  })
+})

package/src/add/add-middleware.ts

@@ -1,5 +1,9 @@
 import * as ts from 'typescript'
-import type { AddWiring, InspectorState } from '../types.js'
+import type {
+  AddWiring,
+  InspectorState,
+  MiddlewareGroupMeta,
+} from '../types.js'
 import {
   extractFunctionName,
   isNamedExport,
@@ -13,6 +17,62 @@ import { extractMiddlewareRefs } from '../utils/middleware.js'
 import { getPropertyValue } from '../utils/get-property-value.js'
 import { getPropertyAssignmentInitializer } from '../utils/type-utils.js'
 
+/**
+ * Record a middleware group, keeping any registration already stored under the
+ * same pattern or tag.
+ *
+ * Several files may add middleware for one pattern — an app's own `'*'` group
+ * alongside the generated better-auth session bridge, say — and the runtime
+ * composes them. A plain `set` kept only the last, and codegen emits imports
+ * from what is stored, so the other file was never imported and its middleware
+ * silently stopped running. Merging is the only shape that cannot lose a gate;
+ * the first registration stays primary so single-registration groups serialize
+ * exactly as before.
+ */
+function recordMiddlewareGroup(
+  groups: Map<string, MiddlewareGroupMeta>,
+  key: string,
+  group: MiddlewareGroupMeta
+): void {
+  const existing = groups.get(key)
+  if (!existing) {
+    groups.set(key, group)
+    return
+  }
+
+  // The same call seen twice — the inspector may revisit a file — is not a
+  // second registration, and appending it would emit a duplicate import.
+  const alreadyRecorded = [
+    existing,
+    ...(existing.additionalRegistrations ?? []),
+  ]
+  if (
+    alreadyRecorded.some(
+      (r) => r.sourceFile === group.sourceFile && r.position === group.position
+    )
+  ) {
+    return
+  }
+
+  existing.additionalRegistrations = [
+    ...(existing.additionalRegistrations ?? []),
+    {
+      exportName: group.exportName,
+      sourceFile: group.sourceFile,
+      position: group.position,
+      isFactory: group.isFactory,
+    },
+  ]
+  existing.count += group.count
+  existing.instanceIds = [...existing.instanceIds, ...group.instanceIds]
+  existing.services = {
+    optimized: false,
+    services: Array.from(
+      new Set([...existing.services.services, ...group.services.services])
+    ),
+  }
+}
+
 function renameTempDefinitions(
   state: InspectorState,
   definitionIds: string[],
@@ -333,7 +393,7 @@ export const addMiddleware: AddWiring = (logger, node, checker, state) => {
       )
     }
 
-    state.middleware.tagMiddleware.set(tag, {
+    recordMiddlewareGroup(state.middleware.tagMiddleware, tag, {
       exportName: exportedName,
       sourceFile,
       position: node.getStart(),
@@ -477,7 +537,7 @@ export const addMiddleware: AddWiring = (logger, node, checker, state) => {
       )
     }
 
-    state.http.routeMiddleware.set(pattern, {
+    recordMiddlewareGroup(state.http.routeMiddleware, pattern, {
       exportName: exportedName,
       sourceFile,
       position: node.getStart(),
@@ -796,7 +856,7 @@ export const addMiddleware: AddWiring = (logger, node, checker, state) => {
       )
     }
 
-    state.channelMiddleware.tagMiddleware.set(tag, {
+    recordMiddlewareGroup(state.channelMiddleware.tagMiddleware, tag, {
       exportName: exportedName,
       sourceFile,
       position: node.getStart(),