@pikku/inspector 0.12.52 → 0.12.54

package/dist/utils/check-secret-sinks.js

@@ -0,0 +1,117 @@
+import * as ts from 'typescript';
+import { findPiiPaths } from './check-pii-output.js';
+import { doesTypeExtendsCore } from './does-type-extend-core-type.js';
+/**
+ * A method that writes its arguments somewhere a secret must never land, keyed
+ * by the core interface that owns it. `'*'` means every method on the type is a
+ * sink, which is true of a logger.
+ */
+const SINKS = [
+    { coreType: 'Logger', methods: '*' },
+    { coreType: 'QueueService', methods: ['add'] },
+    { coreType: 'EmailService', methods: ['send'] },
+    { coreType: 'WebhookService', methods: ['send'] },
+    { coreType: 'AuditService', methods: ['audit', 'write'] },
+    { coreType: 'AuditLog', methods: ['write'] },
+];
+/**
+ * Finds revealed vault secrets that flow into a sink.
+ *
+ * `SecretValue` is nominally typed, so the type system alone stops it reaching
+ * any of these. `.reveal()` is the deliberate escape hatch, and it hands back
+ * `Secret<T>` — the erasable classification brand. That brand is what this scan
+ * follows, which means it catches the revealed value both inline
+ * (`logger.info(s.reveal())`) and through a local binding, because the local's
+ * inferred type carries the brand too.
+ *
+ * The brand is optional by design, so an explicit annotation (`const t: string =
+ * s.reveal()`) erases it and this scan goes quiet. That is the documented limit
+ * of a structural marker: it catches the mistake, not someone determined to
+ * silence it.
+ *
+ * Sinks are matched on the receiver's resolved core interface, which means the
+ * scan needs the services parameter to be typed. Real projects get that from
+ * the generated `#pikku` factory; a hand-rolled file that calls the raw core
+ * factory without annotating its services leaves the parameter `any`, and an
+ * `any` receiver matches nothing.
+ */
+export function findRevealedSecretSinks(checker, handler) {
+    const violations = [];
+    const visit = (node) => {
+        if (ts.isCallExpression(node) && ts.isPropertyAccessExpression(node.expression)) {
+            const sink = describeSink(checker, node.expression);
+            if (sink) {
+                for (const arg of node.arguments) {
+                    const found = findSecretExpression(checker, arg);
+                    if (found) {
+                        violations.push({
+                            sink,
+                            path: found.getText(),
+                            line: found
+                                .getSourceFile()
+                                .getLineAndCharacterOfPosition(found.getStart()).line + 1,
+                        });
+                    }
+                }
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(handler);
+    return violations;
+}
+/**
+ * Finds the first expression inside a sink argument whose own type carries the
+ * secret brand, and returns it so the diagnostic can quote it.
+ *
+ * This walks the argument rather than typing it whole, because an object
+ * literal in an argument position is contextually typed by the parameter — for
+ * a guarded sink that parameter is `Safe<M>`, and resolving the literal against
+ * it drops the optional brand before it can be read. Each inner expression
+ * (`token.reveal()`, or a reference to a local holding it) carries its own type
+ * regardless of the surrounding context, so reading those is what actually
+ * sees the secret.
+ */
+function findSecretExpression(checker, node) {
+    // Descend first, so an object literal wrapping the secret reports the
+    // expression that actually holds it (`token.reveal()`) rather than the whole
+    // literal. Nothing inside a `SecretValue` receiver is itself branded, so a
+    // bare `token.reveal()` still falls through to the self-check below.
+    for (const child of node.getChildren()) {
+        // A property name is not a value, and typing it re-resolves the property.
+        if (ts.isPropertyAssignment(node) && child === node.name)
+            continue;
+        const found = findSecretExpression(checker, child);
+        if (found)
+            return found;
+    }
+    if (ts.isExpression(node) && !ts.isStringLiteralLike(node)) {
+        const type = checker.getTypeAtLocation(node);
+        const isSecret = findPiiPaths(checker, type).some((f) => f.classification === 'secret');
+        if (isSecret)
+            return node;
+    }
+    return undefined;
+}
+/**
+ * Names the sink a call writes to, or undefined when the call is not one.
+ * `console` is matched by identifier because it is a global with no Pikku type;
+ * everything else is matched on its resolved core interface so a renamed
+ * service or a decorator still counts.
+ */
+function describeSink(checker, callee) {
+    const method = callee.name.text;
+    const receiver = callee.expression;
+    if (ts.isIdentifier(receiver) && receiver.text === 'console') {
+        return `console.${method}`;
+    }
+    const receiverType = checker.getTypeAtLocation(receiver);
+    for (const { coreType, methods } of SINKS) {
+        if (methods !== '*' && !methods.includes(method))
+            continue;
+        if (doesTypeExtendsCore(receiverType, checker, new Set(), coreType)) {
+            return `${receiver.getText()}.${method}`;
+        }
+    }
+    return undefined;
+}

package/dist/utils/post-process.js

@@ -659,7 +659,10 @@ export function validateScenarioSteps(logger, state) {
         // nothing threw. It is also invisible to witness coverage — it contributes
         // 0/0, so it can never lower the number — which makes an assertion-free
         // flow the cheapest way to make a suite look better covered than it is.
-        if (phasesSeen.size > 0 && !phasesSeen.has('then')) {
+        // `asserts` is the escape for a flow whose witness is an expectation helper
+        // instead: those are inline steps and leave no phase behind, but a recorded
+        // service call or a refusal is an assertion all the same.
+        if (phasesSeen.size > 0 && !phasesSeen.has('then') && !meta.asserts) {
             logger.critical(ErrorCode.SCENARIO_HAS_NO_ASSERTION, `Scenario '${workflowName}' has ${[...phasesSeen].join('/')} steps but never asserts. ` +
                 `Add a scenario.then(...) naming what the actor should now see — a flow with no 'then' ` +
                 `only proves nothing threw, and contributes nothing to witness coverage.`);

package/dist/utils/single-declaration.d.ts

@@ -0,0 +1,32 @@
+import type { ErrorCode } from '../error-codes.js';
+import type { InspectorLogger } from '../types.js';
+/**
+ * Claims the one call site a single-declaration construct is allowed.
+ *
+ * `definePersonas` takes a keyed object, so one call already declares as many
+ * entries as you like. Letting the call itself repeat buys nothing and costs
+ * the thing that matters: a single place to read the declared set from, and a
+ * single place to add to it. The same rule `pikkuBetterAuth` has had all along.
+ *
+ * A second call in the SAME file is refused too — "the file" is not an answer
+ * to "where do I add a persona?" when the file holds two calls, so allowing it
+ * would keep the ambiguity the rule exists to remove.
+ *
+ * A generated file is exempt, and never claims the slot either. The rule exists
+ * to name the one place a person adds to, and nobody adds to a file the CLI
+ * rewrites on the next run — `pikku-personas.gen.ts` would otherwise make every
+ * project that scaffolds one unbuildable, and take the app's own declaration
+ * down with it.
+ *
+ * `defineScope` and `defineSystemRole` held this rule too, briefly, and do not
+ * until the `admin` tree stops being app-declared. The exemption above is not
+ * enough for them: the CLI generates a `defineScope` in `user-admin.gen.ts` and
+ * `@pikku/addon-console` spells the same tree out again in a hand-written file,
+ * so two non-generated declarations remain and the build still fails. The fix
+ * is for `admin` to be a default scope nobody declares, and the rule comes back
+ * for scopes and roles once that lands.
+ *
+ * @param files - The construct's `files` set, which doubles as the claim.
+ * @returns true when the caller holds the claim and should carry on.
+ */
+export declare const claimSingleDeclaration: (logger: InspectorLogger, files: Set<string>, code: ErrorCode, helper: string, sourceFile: string) => boolean;

package/dist/utils/single-declaration.js

@@ -0,0 +1,43 @@
+/**
+ * Claims the one call site a single-declaration construct is allowed.
+ *
+ * `definePersonas` takes a keyed object, so one call already declares as many
+ * entries as you like. Letting the call itself repeat buys nothing and costs
+ * the thing that matters: a single place to read the declared set from, and a
+ * single place to add to it. The same rule `pikkuBetterAuth` has had all along.
+ *
+ * A second call in the SAME file is refused too — "the file" is not an answer
+ * to "where do I add a persona?" when the file holds two calls, so allowing it
+ * would keep the ambiguity the rule exists to remove.
+ *
+ * A generated file is exempt, and never claims the slot either. The rule exists
+ * to name the one place a person adds to, and nobody adds to a file the CLI
+ * rewrites on the next run — `pikku-personas.gen.ts` would otherwise make every
+ * project that scaffolds one unbuildable, and take the app's own declaration
+ * down with it.
+ *
+ * `defineScope` and `defineSystemRole` held this rule too, briefly, and do not
+ * until the `admin` tree stops being app-declared. The exemption above is not
+ * enough for them: the CLI generates a `defineScope` in `user-admin.gen.ts` and
+ * `@pikku/addon-console` spells the same tree out again in a hand-written file,
+ * so two non-generated declarations remain and the build still fails. The fix
+ * is for `admin` to be a default scope nobody declares, and the rule comes back
+ * for scopes and roles once that lands.
+ *
+ * @param files - The construct's `files` set, which doubles as the claim.
+ * @returns true when the caller holds the claim and should carry on.
+ */
+export const claimSingleDeclaration = (logger, files, code, helper, sourceFile) => {
+    if (sourceFile.endsWith('.gen.ts')) {
+        return true;
+    }
+    const [first] = files;
+    if (first === undefined) {
+        files.add(sourceFile);
+        return true;
+    }
+    logger.critical(code, first === sourceFile
+        ? `Only one ${helper}(...) is allowed per codebase, so there is one place to read the declarations from and one place to add to. Found a second call in ${sourceFile}. Declare them all in one call.`
+        : `Only one ${helper}(...) is allowed per codebase, so there is one place to read the declarations from and one place to add to. Found a second in ${sourceFile} (first: ${first}). Declare them all in one call.`);
+    return false;
+};

package/dist/utils/validate-exposed-functions-gated.js

@@ -26,7 +26,7 @@ export function validateExposedFunctionsGated(logger, state) {
         // this check has no way to see. Taking the claim at face value is the
         // point: without it the warning fires forever on functions that are fine,
         // and a warning that is usually wrong stops being read.
-        if (meta.selfAuthenticated === true)
+        if (meta.permissionsInBody === true)
             continue;
         // The function gates itself.
         if (meta.auth === true)
@@ -43,17 +43,25 @@ export function validateExposedFunctionsGated(logger, state) {
         return;
     const shown = ungated.slice(0, 10);
     const rest = ungated.length - shown.length;
+    const one = ungated.length === 1;
+    // Every function here is sessionless — that is the population, not the
+    // finding, so the message names it as given rather than reporting it as a
+    // defect. The remedies are the ones that can actually apply to an anonymous
+    // caller: `scopes` cannot, because `verifyScopes` fails closed on a session
+    // that does not exist, and telling someone to add them sends them to a
+    // MissingScopeError on every public request.
     logger.diagnostic({
         severity: 'warn',
         code: ErrorCode.EXPOSED_FUNCTION_HAS_NO_GATE,
-        message: `${ungated.length} exposed function${ungated.length === 1 ? '' : 's'} ` +
-            `require neither a session nor any permission or scope, and ` +
-            `${ungated.length === 1 ? 'is' : 'are'} reachable by anyone through ` +
+        message: `${ungated.length} exposed sessionless function${one ? '' : 's'} ` +
+            `carr${one ? 'ies' : 'y'} no permission and no addon gate, so ` +
+            `${one ? 'it is' : 'they are'} reachable by anyone through ` +
             `POST /rpc/:rpcName: ${shown.join(', ')}` +
             (rest > 0 ? `, and ${rest} more` : '') +
-            `. Add scopes or permissions to the function, gate the whole addon with ` +
-            `wireAddon({ scopes: [...] }), or drop \`expose: true\` if it was not ` +
-            `meant to be callable from outside.`,
+            `. Add permissions to the function, set \`auth: true\` if a session is ` +
+            `required after all, gate the whole addon with ` +
+            `wireAddon({ auth: true }), or drop \`expose: true\` if ` +
+            `${one ? 'it was' : 'they were'} not meant to be callable from outside.`,
     });
 }
 /**

package/dist/utils/workflow/dsl/extract-dsl-workflow.d.ts

@@ -8,6 +8,12 @@ export interface ExtractionResult {
     steps?: WorkflowStepMeta[];
     /** Workflow context (top-level variables) */
     context?: WorkflowContext;
+    /**
+     * The flow asserts something through an expectation helper rather than a
+     * `then` step. Recorded separately because those helpers are inline steps and
+     * leave no phase behind, so PKU680 has no other way to see them.
+     */
+    asserts?: boolean;
     reason?: string;
 }
 /**

package/dist/utils/workflow/dsl/extract-dsl-workflow.js

@@ -1,7 +1,53 @@
 import * as ts from 'typescript';
-import { isWorkflowDoCall, isWorkflowExpectEventuallyCall, isScenarioStepCall, getScenarioStepPhase, DYNAMIC_SCENARIO_STEP_TARGET, extractActorFromOptions, isWorkflowSleepCall, isWorkflowSuspendCall, isWorkflowApprovalCall, isThrowCancelException, extractCancelReason, isParallelFanout, isParallelGroup, isSequentialFanout, isArrayFilter, isArraySome, isArrayEvery, extractForOfVariable, isArrayType, getSourceText, extractSourcePath, } from './patterns.js';
+import { isWorkflowDoCall, isWorkflowExpectEventuallyCall, isScenarioStepCall, isScenarioExpectationCall, getScenarioStepPhase, DYNAMIC_SCENARIO_STEP_TARGET, extractActorFromOptions, isWorkflowSleepCall, isWorkflowSuspendCall, isWorkflowApprovalCall, isThrowCancelException, extractCancelReason, isParallelFanout, isParallelGroup, isSequentialFanout, isArrayFilter, isArraySome, isArrayEvery, extractForOfVariable, isArrayType, getSourceText, extractSourcePath, } from './patterns.js';
 import { validateNoDisallowedPatterns, validateAwaitedCalls, formatValidationErrors, } from './validation.js';
 import { extractStringLiteral, extractNumberLiteral, } from '../../extract-node-value.js';
+/**
+ * A function the walk must not step into, because nothing here says it runs.
+ *
+ * A callback handed straight to a call — a fanout's `map`, an inline
+ * `workflow.do` step — executes as part of the body and counts. A function that
+ * is merely *declared* or assigned to a name does not: an assertion parked in an
+ * unused helper asserts nothing, and counting it would let a scenario silence
+ * PKU680 with dead code.
+ */
+function isUncalledFunction(node) {
+    if (!ts.isFunctionDeclaration(node) &&
+        !ts.isFunctionExpression(node) &&
+        !ts.isArrowFunction(node)) {
+        return false;
+    }
+    if (ts.isFunctionDeclaration(node))
+        return true;
+    const parent = node.parent;
+    return !(parent &&
+        ts.isCallExpression(parent) &&
+        parent.arguments.some((argument) => argument === node));
+}
+/**
+ * Whether the body calls one of the expectation helpers anywhere it runs.
+ *
+ * A whole-body walk rather than a check inside step extraction: the helpers
+ * produce no step of their own, so there is no extraction result to hang the
+ * answer off, and one nested inside a branch asserts just as much as one at the
+ * top level.
+ */
+function hasScenarioExpectation(body) {
+    let found = false;
+    const visit = (node) => {
+        if (found)
+            return;
+        if (ts.isCallExpression(node) && isScenarioExpectationCall(node)) {
+            found = true;
+            return;
+        }
+        if (node !== body && isUncalledFunction(node))
+            return;
+        ts.forEachChild(node, visit);
+    };
+    visit(body);
+    return found;
+}
 /**
  * Extract DSL workflow metadata from a function declaration
  */
@@ -74,6 +120,7 @@ export function extractDSLWorkflow(funcNode, checker, options) {
             status: 'ok',
             steps,
             context: Object.keys(workflowContext).length > 0 ? workflowContext : undefined,
+            asserts: hasScenarioExpectation(arrowFunc.body) || undefined,
         };
     }
     catch (error) {

package/dist/utils/workflow/dsl/patterns.d.ts

@@ -20,12 +20,12 @@ export declare function isWorkflowDoCall(node: ts.CallExpression, checker: ts.Ty
  * hit repeatedly on workflow graph round-trips.
  */
 export declare const DYNAMIC_SCENARIO_STEP_TARGET = "<dynamic>";
-declare const SCENARIO_STEP_PHASES: readonly ["step", "given", "when", "then"];
+declare const SCENARIO_STEP_PHASES: readonly ["given", "when", "then"];
 export type ScenarioStepPhaseName = (typeof SCENARIO_STEP_PHASES)[number];
 /**
- * Check if a call expression is scenario.step()/given()/when()/then() — a
- * declared `pikkuScenarioStep` invoked by name. `given`/`when`/`then` are pure
- * sugar over `step`: the phase only changes the prose a reporter renders.
+ * Check if a call expression is scenario.given()/when()/then() — a declared
+ * `pikkuScenarioStep` invoked by name. `given`/`when` are pure sugar for each
+ * other; `then` additionally makes the step's bindings witnesses.
  */
 export declare function isScenarioStepCall(node: ts.CallExpression): boolean;
 /**
@@ -33,6 +33,11 @@ export declare function isScenarioStepCall(node: ts.CallExpression): boolean;
  * isn't one.
  */
 export declare function getScenarioStepPhase(node: ts.CallExpression): ScenarioStepPhaseName | undefined;
+/**
+ * Check if a call expression is one of the scenario expectation helpers —
+ * `scenario.expectService()`, `.expectError()` or `.expectEventually()`.
+ */
+export declare function isScenarioExpectationCall(node: ts.CallExpression): boolean;
 /**
  * Check if a call expression is workflow.expectEventually()
  */

package/dist/utils/workflow/dsl/patterns.js

@@ -31,11 +31,11 @@ export function isWorkflowDoCall(node, checker) {
  * hit repeatedly on workflow graph round-trips.
  */
 export const DYNAMIC_SCENARIO_STEP_TARGET = '<dynamic>';
-const SCENARIO_STEP_PHASES = ['step', 'given', 'when', 'then'];
+const SCENARIO_STEP_PHASES = ['given', 'when', 'then'];
 /**
- * Check if a call expression is scenario.step()/given()/when()/then() — a
- * declared `pikkuScenarioStep` invoked by name. `given`/`when`/`then` are pure
- * sugar over `step`: the phase only changes the prose a reporter renders.
+ * Check if a call expression is scenario.given()/when()/then() — a declared
+ * `pikkuScenarioStep` invoked by name. `given`/`when` are pure sugar for each
+ * other; `then` additionally makes the step's bindings witnesses.
  */
 export function isScenarioStepCall(node) {
     return getScenarioStepPhase(node) !== undefined;
@@ -54,6 +54,28 @@ export function getScenarioStepPhase(node) {
     }
     return SCENARIO_STEP_PHASES.find((phase) => phase === propAccess.name.text);
 }
+/**
+ * The expectation helpers that assert without being a `then`.
+ *
+ * `expectService` and `expectError` are inline steps rather than scenario
+ * steps, so they carry no phase and never reach the step meta — but each one is
+ * a witness: a recorded service call, or a refusal. PKU680 has to see them, or
+ * a scenario whose only assertion is one of these reads as asserting nothing.
+ */
+const SCENARIO_EXPECTATION_CALLS = [
+    'expectService',
+    'expectError',
+    'expectEventually',
+];
+/**
+ * Check if a call expression is one of the scenario expectation helpers —
+ * `scenario.expectService()`, `.expectError()` or `.expectEventually()`.
+ */
+export function isScenarioExpectationCall(node) {
+    return (ts.isPropertyAccessExpression(node.expression) &&
+        SCENARIO_EXPECTATION_CALLS.some((name) => name === node.expression.name.text) &&
+        isWorkflowWireIdentifier(node.expression.expression));
+}
 /**
  * Check if a call expression is workflow.expectEventually()
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/inspector",
-  "version": "0.12.52",
+  "version": "0.12.54",
   "description": "TypeScript inspector for Pikku — discovers functions and wirings to drive code generation",
   "author": "yasser.fadl@gmail.com",
   "license": "BUSL-1.1",
@@ -45,10 +45,10 @@
     "zod-to-ts": "^2.1.0"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.74"
+    "@pikku/core": "^0.12.76"
   },
   "devDependencies": {
-    "@pikku/core": "^0.12.74",
+    "@pikku/core": "^0.12.76",
     "@types/node": "^24.11.0"
   },
   "engines": {

package/src/add/add-functions.ts

@@ -8,7 +8,7 @@ import {
 } from '../utils/extract-function-name.js'
 import { extractFunctionNode } from '../utils/extract-function-node.js'
 import { extractUsedWires } from '../utils/extract-services.js'
-import type { FunctionServicesMeta } from '@pikku/core'
+import type { AuditDurability, FunctionServicesMeta } from '@pikku/core'
 import type { ScenarioStepKind, ScenarioSurface } from '@pikku/core/workflow'
 import { formatVersionedId, parseVersionedId } from '@pikku/core'
 
@@ -42,6 +42,7 @@ import { resolvePermissions } from '../utils/permissions.js'
 import { extractWireNames } from '../utils/post-process.js'
 import { ErrorCode } from '../error-codes.js'
 import { findPiiPaths } from '../utils/check-pii-output.js'
+import { findRevealedSecretSinks } from '../utils/check-secret-sinks.js'
 import { isScenarioInstrumentationFunction } from './scenario-instrumentation.js'
 import type { NodeType } from '@pikku/core/node'
 
@@ -580,7 +581,9 @@ export const addFunctions: AddWiring = (
    */
   let auth: boolean | undefined
   /** The author's claim that the body authorizes its own callers. */
-  let selfAuthenticated: boolean | undefined
+  let permissionsInBody: boolean | undefined
+  /** The function's `audit` config, resolved to its object form. */
+  let audit: { durability: AuditDurability } | undefined
   let readonly_: boolean | undefined
   let deploy: 'serverless' | 'server' | 'auto' | undefined
   let approvalRequired: boolean | undefined
@@ -679,9 +682,43 @@ export const addFunctions: AddWiring = (
     remote = getPropertyValue(firstArg, 'remote') as boolean | undefined
     mcp = getPropertyValue(firstArg, 'mcp') as boolean | undefined
     auth = getPropertyValue(firstArg, 'auth') as boolean | undefined
-    selfAuthenticated = getPropertyValue(firstArg, 'selfAuthenticated') as
+    permissionsInBody = getPropertyValue(firstArg, 'permissionsInBody') as
       | boolean
       | undefined
+    if (permissionsInBody && !options.allow?.permissionsInBody) {
+      logger.critical(
+        ErrorCode.PERMISSIONS_IN_BODY_NOT_ALLOWED,
+        `'${name}' declares \`permissionsInBody: true\`, which this project has not enabled. ` +
+          `It silences the exposed-and-ungated audit without gating anything, so it is opt-in: ` +
+          `set \`allow: { permissionsInBody: true }\` in pikku.config.json if the project accepts ` +
+          `permission checks that only a reader can verify. Otherwise express the check as a ` +
+          `\`permissions\` entry, or drop \`expose: true\` if the function was not meant to be ` +
+          `callable from outside.`
+      )
+      return
+    }
+    // `audit` is either `true` or `{ durability }`, so it needs the nested read:
+    // getPropertyValue stringifies an object initializer rather than parsing it.
+    // Mirrors core's `resolveAuditConfig` — the two must agree, or meta would
+    // claim a durability the runner does not use.
+    const auditProp = firstArg.properties.find(
+      (p) =>
+        ts.isPropertyAssignment(p) &&
+        ts.isIdentifier(p.name) &&
+        p.name.text === 'audit'
+    )
+    if (auditProp && ts.isPropertyAssignment(auditProp)) {
+      const auditInit = auditProp.initializer
+      if (auditInit.kind === ts.SyntaxKind.TrueKeyword) {
+        audit = { durability: 'best-effort' }
+      } else if (ts.isObjectLiteralExpression(auditInit)) {
+        const durability = getPropertyValue(
+          auditInit,
+          'durability'
+        ) as AuditDurability | null
+        audit = { durability: durability ?? 'best-effort' }
+      }
+    }
     readonly_ = getPropertyValue(firstArg, 'readonly') as boolean | undefined
     deploy = getPropertyValue(firstArg, 'deploy') as
       | 'serverless'
@@ -1196,6 +1233,20 @@ export const addFunctions: AddWiring = (
   // it runs ONLY when explicitly requested (`pikku all --security`) — see the
   // classificationCheck option. Default codegen skips it entirely.
   if (options.classificationCheck) {
+    // A revealed vault secret is invisible to the return-type scan below when it
+    // is written out mid-body rather than returned, so walk the sinks too.
+    for (const violation of findRevealedSecretSinks(checker, handler)) {
+      logger.diagnostic({
+        severity: 'error',
+        code: ErrorCode.SECRET_REVEALED_INTO_SINK,
+        message:
+          `Function '${name}' passes a revealed secret to '${violation.sink}' ` +
+          `at line ${violation.line} (path '${violation.path}').\n  ` +
+          `A vault secret must not be written to a log, an audit, a queue, an email or a webhook. ` +
+          `Pass the value only to the client that needs it, and reveal it there.`,
+      })
+    }
+
     const sig = checker.getSignatureFromDeclaration(handler)
     if (sig) {
       const rawRet = checker.getReturnTypeOfSignature(sig)
@@ -1232,7 +1283,7 @@ export const addFunctions: AddWiring = (
             `Sessionless function '${name}' exposes private-classified field(s) in its return type: ` +
             privatePaths.map((p) => `'${p}'`).join(', ') +
             `.\n  Private fields are only safe to return from authenticated (sessioned) functions. ` +
-            `Either require a session (use pikkuFunc) or mark the column @public if it is safe to expose publicly.`,
+            `Either require a session (use pikkuFunc) or set the column's security to 'public' in db/annotations.ts if it is safe to expose publicly.`,
         })
       }
     }
@@ -1311,7 +1362,8 @@ export const addFunctions: AddWiring = (
     outputs: outputNames.filter((n) => n !== 'void') ?? null,
     expose: expose || undefined,
     auth: auth || undefined,
-    selfAuthenticated: selfAuthenticated || undefined,
+    permissionsInBody: permissionsInBody || undefined,
+    audit,
     remote: remote || undefined,
     scenarioStep: isScenarioStep || undefined,
     scenario: isScenario || undefined,