@pikku/inspector 0.12.60 → 0.12.62

package/dist/utils/filter-inspector-state.js

@@ -1,6 +1,7 @@
-import { parseVersionedId } from '@pikku/core/ecosystem/types';
+import { parseVersionedId } from '@pikku/core/utils';
+import { makeContextBasedId } from './extract-function-name.js';
 import { aggregateRequiredServices } from './post-process.js';
-import { resolveDeployTarget } from './resolve-deploy-target.js';
+import { IncompatibleDeployTargetError, resolveDeployTarget, } from './resolve-deploy-target.js';
 // Module-level Set to track warned groups across multiple filter calls
 const globalWarnedGroups = new Set();
 /**
@@ -67,8 +68,9 @@ function repopulateFileSetFromMeta(meta, fallbackFiles, hasEntries) {
  * Check if metadata matches the given filters
  */
 function matchesFilters(filters, meta, logger, warnedGroups, 
-// Set of pikkuFuncIds to keep based on the deploy filter; null when
-// the deploy filter is inactive.
+// Kept pikkuFuncIds under the deploy filter; null when the filter is
+// inactive. Asked about one id at a time, which is what lets a conflict in an
+// addon's own metadata surface only for a function this app actually wires.
 keptByDeploy) {
     // If no filters, allow everything
     if (Object.keys(filters).length === 0)
@@ -137,9 +139,12 @@ keptByDeploy) {
             return false;
         }
     }
-    const { baseName } = parseVersionedId(meta.name);
-    const matchesNamePattern = (pattern) => matchesWildcard(meta.name, pattern) ||
-        (baseName !== meta.name && matchesWildcard(baseName, pattern));
+    const candidateNames = [meta.name, ...(meta.altNames ?? [])];
+    const matchesNamePattern = (pattern) => candidateNames.some((candidate) => {
+        const { baseName } = parseVersionedId(candidate);
+        return (matchesWildcard(candidate, pattern) ||
+            (baseName !== candidate && matchesWildcard(baseName, pattern)));
+    });
     // Check name include filter (match against both full ID and base name for versioned functions)
     if (filters.names && filters.names.length > 0) {
         const nameMatches = filters.names.some(matchesNamePattern);
@@ -257,14 +262,48 @@ export function filterInspectorState(state, filters, logger) {
             : null;
         const incompatible = new Set(filters.serverlessIncompatible ?? []);
         const defaultTarget = filters.defaultTarget ?? 'serverless';
-        keptByDeploy = new Set();
-        for (const [funcId, funcMeta] of Object.entries(state.functions.meta)) {
-            const target = resolveDeployTarget(funcMeta, incompatible, funcId, defaultTarget);
+        const kept = new Set();
+        // An addon publishes metadata for everything it exports, so a conflict in a
+        // function this app never wires is not this app's build error. Holding it
+        // here and raising it from `has` reports it at the one place the app is
+        // known to depend on that function.
+        const conflicts = new Map();
+        keptByDeploy = {
+            has: (funcId) => {
+                const conflict = conflicts.get(funcId);
+                if (conflict)
+                    throw conflict;
+                return kept.has(funcId);
+            },
+        };
+        const keepByTarget = (funcId, funcMeta, incompatibleServices) => {
+            const target = resolveDeployTarget(funcMeta, incompatibleServices, funcId, defaultTarget);
             if (allowed && !allowed.has(target))
-                continue;
+                return;
             if (excluded && excluded.has(target))
-                continue;
-            keptByDeploy.add(funcId);
+                return;
+            kept.add(funcId);
+        };
+        for (const [funcId, funcMeta] of Object.entries(state.functions.meta)) {
+            keepByTarget(funcId, funcMeta, incompatible);
+        }
+        // A wiring onto an addon function records the addon's own id, so the
+        // addon's published metadata is the only place its deploy target can be
+        // read from. Its serverlessIncompatible services are namespace-scoped —
+        // a service name means whatever the addon that declared it means.
+        for (const [namespace, addonMeta] of Object.entries(state.addonFunctions ?? {})) {
+            const addonIncompatible = new Set(state.addonServerlessIncompatible?.get(namespace) ?? []);
+            for (const [funcName, funcMeta] of Object.entries(addonMeta)) {
+                const funcId = `${namespace}:${funcName}`;
+                try {
+                    keepByTarget(funcId, funcMeta, addonIncompatible);
+                }
+                catch (e) {
+                    if (!(e instanceof IncompatibleDeployTargetError))
+                        throw e;
+                    conflicts.set(funcId, e);
+                }
+            }
         }
     }
     // Snapshot the original workflow graph meta before filtering prunes it
@@ -363,6 +402,7 @@ export function filterInspectorState(state, filters, logger) {
             const matches = matchesFilters(filters, {
                 type: 'http',
                 name: routeMeta.pikkuFuncId, // Use function name, not route
+                altNames: [makeContextBasedId('http', method, routeMeta.route)],
                 tags: routeMeta.tags,
                 filePath,
                 httpRoute: routeMeta.route,
@@ -376,9 +416,6 @@ export function filterInspectorState(state, filters, logger) {
                 // Track used functions/middleware/permissions
                 if (routeMeta.pikkuFuncId) {
                     filteredState.serviceAggregation.usedFunctions.add(routeMeta.pikkuFuncId);
-                    if (routeMeta.refTarget) {
-                        filteredState.serviceAggregation.usedFunctions.add(routeMeta.refTarget);
-                    }
                     // For workflow/agent routes, also add the base name
                     // so the workflow/agent definition survives pruning
                     const colonIdx = routeMeta.pikkuFuncId.indexOf(':');

package/dist/utils/filter-utils.d.ts

@@ -1,5 +1,5 @@
 import type { InspectorFilters, InspectorLogger } from '../types.js';
-import type { PikkuWiringTypes } from '@pikku/core/ecosystem/types';
+import type { PikkuWiringTypes } from '@pikku/core/types';
 /**
  * Match a value against a pattern with wildcard support
  * Supports "*" at the beginning, end, or both (e.g., "send*", "*Payment", "*process*")

package/dist/utils/get-property-value.js

@@ -94,6 +94,45 @@ export const assertStringLiteralProperty = (obj, propertyName, wiringType, logge
         console.error(errorMsg);
     }
 };
+/**
+ * Fold a node that is a compile-time constant string down to its value.
+ *
+ * The fallback below this is `getText()`, which returns the node's *source*.
+ * For a lone `'…'` that is indistinguishable from the value, so nobody noticed
+ * that anything written as an expression comes through raw: a `description`
+ * split across lines as `'Fetch the thing ' + 'from upstream'` reaches
+ * `infra.json` with the quotes and the `+` still in it, and is rendered that
+ * way in the fabric console.
+ *
+ * Deliberately checker-free, unlike `extractStringLiteral`. Every value this
+ * resolves is a literal in the same expression, so no symbol resolution is
+ * needed, and `getPropertyValue` is called from a dozen places that have no
+ * checker to hand. Anything it cannot fold — an identifier, a template with a
+ * substitution — returns `undefined` and takes the old path, so this only ever
+ * turns a wrong answer into a right one.
+ */
+const foldStaticString = (node) => {
+    if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) {
+        return node.text;
+    }
+    if (ts.isParenthesizedExpression(node)) {
+        return foldStaticString(node.expression);
+    }
+    if (ts.isAsExpression(node) || ts.isTypeAssertionExpression(node)) {
+        return foldStaticString(node.expression);
+    }
+    if (ts.isBinaryExpression(node) &&
+        node.operatorToken.kind === ts.SyntaxKind.PlusToken) {
+        const left = foldStaticString(node.left);
+        if (left === undefined)
+            return undefined;
+        const right = foldStaticString(node.right);
+        if (right === undefined)
+            return undefined;
+        return left + right;
+    }
+    return undefined;
+};
 export const getPropertyValue = (obj, propertyName) => {
     const property = obj.properties.find((p) => ts.isPropertyAssignment(p) &&
         ts.isIdentifier(p.name) &&
@@ -126,9 +165,9 @@ export const getPropertyValue = (obj, propertyName) => {
             }
             return Number(initializer.text);
         }
-        if (ts.isStringLiteral(initializer) ||
-            ts.isNoSubstitutionTemplateLiteral(initializer)) {
-            return initializer.text;
+        const staticString = foldStaticString(initializer);
+        if (staticString !== undefined) {
+            return staticString;
         }
         return initializer.getText();
     }

package/dist/utils/load-addon-functions-meta.js

@@ -1,3 +1,4 @@
+import { existsSync } from 'fs';
 import { readFile, readdir } from 'fs/promises';
 import { createRequire } from 'module';
 import { join, dirname } from 'path';
@@ -88,6 +89,35 @@ const resolveAddonMeta = (require, packageName, baseName) => {
     }
     return null;
 };
+/**
+ * Give the addon's input/output type names a declaration file to be imported
+ * from, so a wiring that references an addon function can name its contract.
+ *
+ * Without this the only thing that knows where `GetScenarioArtifactInput` lives
+ * is the type checker, and it only knows once the consumer's *own* rpc map has
+ * already been generated with the addon's routes in it — which is to say on the
+ * second run. A first, cold run resolved `ref('console:getScenarioArtifact')`
+ * against a map that did not mention it yet and fell back to the whole
+ * `FlattenedRPCMap`, so the same source produced a different http-map depending
+ * on whether `.pikku` happened to be there. The addon publishes these types at a
+ * fixed subpath; reading them from the metadata makes the first run agree with
+ * the second.
+ */
+const registerAddonTypes = (state, metaPath, meta) => {
+    // Derived from the metadata's own location rather than resolved as a package
+    // subpath: the addon exports that declaration under a `types`-only condition,
+    // which `require.resolve` will not follow.
+    const typesPath = join(dirname(metaPath), '..', 'rpc', 'pikku-rpc-wirings-map.internal.gen.d.ts');
+    if (!existsSync(typesPath))
+        return;
+    for (const funcMeta of Object.values(meta)) {
+        for (const name of [funcMeta.inputSchemaName, funcMeta.outputSchemaName]) {
+            if (!name || state.functions.typesMap.exists(name, typesPath))
+                continue;
+            state.functions.typesMap.addType(name, typesPath);
+        }
+    }
+};
 /**
  * After the setup sweep discovers wireAddon() declarations, load each addon
  * package's function metadata so that wiring handlers (channels, HTTP routes,
@@ -116,6 +146,7 @@ export async function loadAddonFunctionsMeta(logger, state) {
             const meta = JSON.parse(raw);
             state.addonFunctions[namespace] = meta;
             logger.debug(`Loaded ${Object.keys(meta).length} addon functions for '${namespace}' from ${decl.package}`);
+            registerAddonTypes(state, metaPath, meta);
             // If wireAddon has mcp: true, expose addon functions with mcp: true as MCP tools
             if (decl.mcp) {
                 for (const [funcName, funcMeta] of Object.entries(meta)) {

package/dist/utils/middleware.d.ts

@@ -1,5 +1,5 @@
 import * as ts from 'typescript';
-import type { MiddlewareMetadata } from '@pikku/core/ecosystem/types';
+import type { MiddlewareMetadata } from '@pikku/core/middleware';
 import type { InspectorState } from '../types.js';
 export interface MiddlewareRef {
     definitionId: string;

package/dist/utils/permissions.d.ts

@@ -1,5 +1,5 @@
 import * as ts from 'typescript';
-import type { PermissionMetadata } from '@pikku/core/ecosystem/types';
+import type { PermissionMetadata } from '@pikku/core/function';
 import type { InspectorState } from '../types.js';
 /**
  * Extract permission pikkuFuncIds from an expression (array or object literal)

package/dist/utils/post-process.d.ts

@@ -1,5 +1,6 @@
 import type { InspectorState, InspectorLogger, InspectorOptions } from '../types.js';
-import type { MiddlewareMetadata, PermissionMetadata } from '@pikku/core/ecosystem/types';
+import type { PermissionMetadata } from '@pikku/core/function';
+import type { MiddlewareMetadata } from '@pikku/core/middleware';
 import type ts from 'typescript';
 /**
  * Stamp the inspected authorize/callbacks service set onto the generated auth
@@ -33,10 +34,27 @@ export declare function validateSecretOverrides(logger: InspectorLogger, state:
 export declare function validateCredentialOverrides(logger: InspectorLogger, state: InspectorState | Omit<InspectorState, 'typesLookup'>): void;
 export declare function validateVariableOverrides(logger: InspectorLogger, state: InspectorState | Omit<InspectorState, 'typesLookup'>): void;
 /**
+ * Every wired addon must be installed, in the bucket matching how it is used.
+ *
  * A `wireRemoteAddon` package ships types only — its handlers run on the host —
  * so it MUST be a devDependency, not a production dependency (a prod dep would
- * drag in the runtime deps remote consumption exists to avoid). This is the
- * mirror image of `wireAddon`, which requires a production dependency.
+ * drag in the runtime deps remote consumption exists to avoid).
+ *
+ * A plain `wireAddon` only has to be *resolvable*. The failure it allows is
+ * quiet in a way the remote one is not — an absent package makes the metadata
+ * load fail, which is caught and downgraded to a warning, so every
+ * `ref('<namespace>:…')` resolves against nothing and the surface is dead at
+ * runtime. The generated console is the common case: `scaffold.console` emits
+ * `wireAddon({ package: '@pikku/addon-console' })` and refs into it, and a
+ * project that never installed the package gets a console that 404s with
+ * nothing in the build output saying why.
+ *
+ * Deliberately a resolution check and not a `package.json` one. An addon is
+ * discovered because it is *wired*, not because it is a declared dependency —
+ * addons arrive by workspace link, by a local `addons/` directory recorded in
+ * `pikku-addons.json`, and by plain install, and only the last of those shows
+ * up in `dependencies`. Asking the resolver is the only question that matches
+ * what the loader will actually do.
  */
 export declare function validateRemoteAddonDependencies(logger: InspectorLogger, state: InspectorState | Omit<InspectorState, 'typesLookup'>): void;
 /**
@@ -64,6 +82,7 @@ export declare function computeRequiredSchemas(state: InspectorState, options: I
  * the functions that are actually invoked, so this blocks CI through
  * `--fail-on-error` without failing a dev server over a function nobody calls.
  */
+export declare function unresolvedSchemaReferences(state: InspectorState): string[];
 export declare function validateSchemaReferences(logger: InspectorLogger, state: InspectorState): void;
 /**
  * A model is either concrete (`provider/model`) or an alias, which must appear
@@ -89,10 +108,11 @@ export declare function validateScenarioServices(logger: InspectorLogger, state:
  *
  * - the step target must be a static string literal (PKU678) — otherwise it
  *   can't be bundled, typed or drawn;
- * - a step declaring a `browser` binding must be given an actor (PKU677), since
- *   the browser context signs in as that persona. It is checked statically even
- *   though the binding only runs on a browser run: a step that can never be
- *   driven by a human is a latent failure, not a passing default run.
+ * - a step that runs as a persona must be given one (PKU677) — declared by
+ *   `actor: true`, or implied by a `browser` binding, since the browser context
+ *   signs in as that persona. It is checked statically even though a browser
+ *   binding only runs on a browser run: a step that can never be driven by a
+ *   human is a latent failure, not a passing default run.
  * - a scenario written as a step ladder must assert something (PKU680).
  *
  * It also marks the step's function as used, so `scenario run` boots the

package/dist/utils/post-process.js

@@ -1,11 +1,12 @@
 import { existsSync, readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
 import { join } from 'node:path';
 import { extractTypeKeys } from './type-utils.js';
 import { ErrorCode } from '../error-codes.js';
 import { findSecretAliasServices } from './secret-alias-services.js';
 import { relative } from 'node:path';
 import { AUTH_HANDLER_FUNC_ID } from '../add/add-auth.js';
-import { flattenScopeDefinitions } from '@pikku/core/ecosystem/scope';
+import { flattenScopeDefinitions } from '@pikku/core/scope';
 import { DYNAMIC_SCENARIO_STEP_TARGET } from './workflow/dsl/patterns.js';
 /**
  * Stamp the inspected authorize/callbacks service set onto the generated auth
@@ -374,17 +375,74 @@ export function validateVariableOverrides(logger, state) {
     }
 }
 /**
+ * Can `pkg` be resolved from `rootDir`, by any means the loader would use?
+ *
+ * Resolution is attempted against `<pkg>/package.json` first and the bare
+ * specifier second, because neither alone is conclusive. A package with a
+ * restrictive `exports` map refuses the first with
+ * `ERR_PACKAGE_PATH_NOT_EXPORTED` — which is not a failure at all: reaching the
+ * exports map means the package was found. Only a module-not-found from both
+ * attempts means it is genuinely absent.
+ */
+const isPackageResolvable = (pkg, rootDir) => {
+    const NOT_FOUND = new Set(['MODULE_NOT_FOUND', 'ERR_MODULE_NOT_FOUND']);
+    let req;
+    try {
+        req = createRequire(join(rootDir, 'package.json'));
+    }
+    catch {
+        return true; // cannot ask; do not accuse
+    }
+    for (const specifier of [`${pkg}/package.json`, pkg]) {
+        try {
+            req.resolve(specifier);
+            return true;
+        }
+        catch (e) {
+            if (!NOT_FOUND.has(e?.code))
+                return true;
+        }
+    }
+    return false;
+};
+/**
+ * Every wired addon must be installed, in the bucket matching how it is used.
+ *
  * A `wireRemoteAddon` package ships types only — its handlers run on the host —
  * so it MUST be a devDependency, not a production dependency (a prod dep would
- * drag in the runtime deps remote consumption exists to avoid). This is the
- * mirror image of `wireAddon`, which requires a production dependency.
+ * drag in the runtime deps remote consumption exists to avoid).
+ *
+ * A plain `wireAddon` only has to be *resolvable*. The failure it allows is
+ * quiet in a way the remote one is not — an absent package makes the metadata
+ * load fail, which is caught and downgraded to a warning, so every
+ * `ref('<namespace>:…')` resolves against nothing and the surface is dead at
+ * runtime. The generated console is the common case: `scaffold.console` emits
+ * `wireAddon({ package: '@pikku/addon-console' })` and refs into it, and a
+ * project that never installed the package gets a console that 404s with
+ * nothing in the build output saying why.
+ *
+ * Deliberately a resolution check and not a `package.json` one. An addon is
+ * discovered because it is *wired*, not because it is a declared dependency —
+ * addons arrive by workspace link, by a local `addons/` directory recorded in
+ * `pikku-addons.json`, and by plain install, and only the last of those shows
+ * up in `dependencies`. Asking the resolver is the only question that matches
+ * what the loader will actually do.
  */
 export function validateRemoteAddonDependencies(logger, state) {
     const { wireAddonDeclarations } = state.rpc;
     if (!wireAddonDeclarations || wireAddonDeclarations.size === 0)
         return;
-    const hasRemote = Array.from(wireAddonDeclarations.values()).some((d) => d.remote);
-    if (!hasRemote)
+    // Local addons first, and independently of the manifest below: their check
+    // asks the resolver, not `package.json`, so a project without a manifest (as
+    // in some tests) must not skip it.
+    for (const [namespace, decl] of wireAddonDeclarations.entries()) {
+        if (decl.remote)
+            continue;
+        if (isPackageResolvable(decl.package, state.rootDir))
+            continue;
+        logger.critical(ErrorCode.ADDON_NOT_INSTALLED, `Addon '${namespace}' ('${decl.package}') is wired with wireAddon but cannot be resolved — every ref('${namespace}:…') will resolve to nothing and the surface will be dead at runtime. Install it, or remove the wireAddon call.`);
+    }
+    if (!Array.from(wireAddonDeclarations.values()).some((d) => d.remote))
         return;
     const pkgJsonPath = join(state.rootDir, 'package.json');
     if (!existsSync(pkgJsonPath))
@@ -579,7 +637,7 @@ export function computeRequiredSchemas(state, options) {
  * the functions that are actually invoked, so this blocks CI through
  * `--fail-on-error` without failing a dev server over a function nobody calls.
  */
-export function validateSchemaReferences(logger, state) {
+export function unresolvedSchemaReferences(state) {
     const { functions, schemas } = state;
     const available = new Set(Object.keys(schemas ?? {}));
     const unresolved = [];
@@ -604,6 +662,10 @@ export function validateSchemaReferences(logger, state) {
             unresolved.push(`${funcName}.${role} → '${resolved}'`);
         }
     }
+    return unresolved;
+}
+export function validateSchemaReferences(logger, state) {
+    const unresolved = unresolvedSchemaReferences(state);
     if (unresolved.length === 0)
         return;
     logger.diagnostic({
@@ -674,10 +736,11 @@ export function validateScenarioServices(logger, state) {
  *
  * - the step target must be a static string literal (PKU678) — otherwise it
  *   can't be bundled, typed or drawn;
- * - a step declaring a `browser` binding must be given an actor (PKU677), since
- *   the browser context signs in as that persona. It is checked statically even
- *   though the binding only runs on a browser run: a step that can never be
- *   driven by a human is a latent failure, not a passing default run.
+ * - a step that runs as a persona must be given one (PKU677) — declared by
+ *   `actor: true`, or implied by a `browser` binding, since the browser context
+ *   signs in as that persona. It is checked statically even though a browser
+ *   binding only runs on a browser run: a step that can never be driven by a
+ *   human is a latent failure, not a passing default run.
  * - a scenario written as a step ladder must assert something (PKU680).
  *
  * It also marks the step's function as used, so `scenario run` boots the
@@ -697,10 +760,12 @@ export function validateScenarioSteps(logger, state) {
                 }
                 state.serviceAggregation.usedFunctions.add(step.stepFunc);
                 const stepMeta = state.functions.meta[step.stepFunc];
-                if (stepMeta?.scenarioStepSurfaces?.includes('browser') &&
-                    !step.actor) {
-                    logger.critical(ErrorCode.SCENARIO_BROWSER_STEP_NEEDS_ACTOR, `Scenario '${workflowName}' calls step '${step.stepFunc}', which declares a browser binding, without an actor. ` +
-                        `Pass { actor: actors.<name> } so the browser context signs in as that persona.`);
+                if (stepMeta?.scenarioStepRequiresActor && !step.actor) {
+                    const why = stepMeta.scenarioStepSurfaces?.includes('browser')
+                        ? 'declares a browser binding'
+                        : 'is driven by a persona';
+                    logger.critical(ErrorCode.SCENARIO_STEP_NEEDS_ACTOR, `Scenario '${workflowName}' calls step '${step.stepFunc}', which ${why}, without an actor. ` +
+                        `Pass { actor: actors.<name> } so it runs as that persona.`);
                 }
                 continue;
             }

package/dist/utils/resolve-deploy-target.d.ts

@@ -1,4 +1,4 @@
-import type { FunctionMeta } from '@pikku/core/ecosystem/services';
+import type { FunctionMeta } from '@pikku/core/services';
 /**
  * Thrown when a function's explicit `deploy: 'serverless'` conflicts
  * with one of its services being declared `serverlessIncompatible`.

package/dist/utils/resolve-function-meta.d.ts

@@ -1,4 +1,4 @@
-import type { FunctionMeta, FunctionsMeta } from '@pikku/core/ecosystem/services';
+import type { FunctionMeta, FunctionsMeta } from '@pikku/core/services';
 /**
  * Look up function metadata by pikkuFuncId, checking both local functions
  * and addon functions. Addon functions use namespaced IDs like 'namespace:funcName'.

package/dist/utils/resolve-function-types.d.ts

@@ -1,5 +1,5 @@
 import type { TypesMap } from '../types-map.js';
-import type { FunctionsMeta } from '@pikku/core/ecosystem/services';
+import type { FunctionsMeta } from '@pikku/core/services';
 export declare function resolveFunctionIOTypes(pikkuFuncId: string, functionsMeta: FunctionsMeta, typesMap: TypesMap, requiredTypes: Set<string>): {
     inputType: string;
     outputType: string;

package/dist/utils/resolve-versions.js

@@ -1,4 +1,4 @@
-import { parseVersionedId, formatVersionedId, } from '@pikku/core/ecosystem/types';
+import { parseVersionedId, formatVersionedId } from '@pikku/core/utils';
 import { ErrorCode } from '../error-codes.js';
 export function resolveLatestVersions(state, logger) {
     const functionsMeta = state.functions.meta;

package/dist/utils/schema-generator.d.ts

@@ -1,4 +1,4 @@
-import type { JSONValue } from '@pikku/core/ecosystem/types';
+import type { JSONValue } from '@pikku/core/utils';
 import type { InspectorLogger, InspectorState } from '../types.js';
 /** One file the generated schemas were derived from, as of when they were generated. */
 export type SchemaDep = {

package/dist/utils/serialize-inspector-state.d.ts

@@ -1,5 +1,5 @@
 import type { SecretUsage } from './extract-secret-usage.js';
-import type { JSONValue } from '@pikku/core/ecosystem/types';
+import type { JSONValue } from '@pikku/core/utils';
 import type { InspectorDiagnostic, InspectorFeature, InspectorState } from '../types.js';
 /**
  * Serializable version of InspectorState that can be saved to JSON
@@ -242,6 +242,7 @@ export interface SerializableInspectorState {
         files: string[];
         usage: Record<string, SecretUsage>;
     };
+    surfaceUsage: InspectorState['surfaceUsage'];
     credentials: {
         definitions: InspectorState['credentials']['definitions'];
         files: string[];

package/dist/utils/serialize-inspector-state.js

@@ -118,6 +118,7 @@ export function serializeInspectorState(state) {
             files: Array.from(state.secrets.files),
             usage: Object.fromEntries(state.secrets.usage),
         },
+        surfaceUsage: state.surfaceUsage,
         credentials: {
             definitions: state.credentials.definitions,
             files: Array.from(state.credentials.files),
@@ -295,6 +296,7 @@ export function deserializeInspectorState(data) {
             files: new Set(data.secrets?.files || []),
             usage: new Map(Object.entries(data.secrets?.usage || {})),
         },
+        surfaceUsage: data.surfaceUsage || {},
         credentials: {
             definitions: data.credentials?.definitions || [],
             files: new Set(data.credentials?.files || []),

package/dist/utils/serialize-openapi-json.d.ts

@@ -1,5 +1,5 @@
-import type { FunctionsMeta } from '@pikku/core/ecosystem/services';
-import type { HTTPWiringsMeta } from '@pikku/core/ecosystem/http';
+import type { FunctionsMeta } from '@pikku/core/services';
+import type { HTTPWiringsMeta } from '@pikku/core/http';
 import type { InspectorLogger } from '../types.js';
 interface ErrorDetails {
     status: number;

package/dist/utils/validate-auth-sessionless.js

@@ -1,7 +1,8 @@
 import { getPropertyValue } from './get-property-value.js';
 import { ErrorCode } from '../error-codes.js';
+import { resolveFunctionMeta } from './resolve-function-meta.js';
 export function validateAuthSessionless(logger, obj, state, funcName, wireDescription, inheritedAuth) {
-    const fnMeta = state.functions.meta[funcName];
+    const fnMeta = resolveFunctionMeta(state, funcName);
     if (!fnMeta)
         return true;
     const routeAuth = getPropertyValue(obj, 'auth');

package/dist/utils/workflow/derive-workflow-plan.d.ts

@@ -1,4 +1,4 @@
-import type { WorkflowStepMeta, WorkflowPlannedStep } from '@pikku/core/ecosystem/workflow';
+import type { WorkflowStepMeta, WorkflowPlannedStep } from '@pikku/core/workflow';
 /**
  * Derive the static UI plan for a DSL workflow from its extracted step tree.
  *

package/dist/utils/workflow/dsl/extract-dsl-workflow.d.ts

@@ -1,5 +1,5 @@
 import * as ts from 'typescript';
-import type { WorkflowStepMeta, WorkflowContext } from '@pikku/core/ecosystem/workflow';
+import type { WorkflowStepMeta, WorkflowContext } from '@pikku/core/workflow';
 /**
  * Result of DSL workflow extraction
  */

package/dist/utils/workflow/graph/convert-dsl-to-graph.d.ts

@@ -1,7 +1,7 @@
 /**
  * Converts DSL (Domain Specific Language) step-based format to graph node format
  */
-import type { WorkflowsMeta } from '@pikku/core/ecosystem/workflow';
+import type { WorkflowsMeta } from '@pikku/core/workflow';
 import type { SerializedWorkflowGraph } from './workflow-graph.types.js';
 /**
  * Convert a DSL workflow to graph format

package/dist/utils/workflow/graph/finalize-workflows.js

@@ -1,4 +1,4 @@
-import { isVersionedId, formatVersionedId, parseVersionedId, } from '@pikku/core/ecosystem/types';
+import { isVersionedId, formatVersionedId, parseVersionedId, } from '@pikku/core/utils';
 import { canonicalJSON, hashString } from '../../hash.js';
 import { convertDslToGraph } from './convert-dsl-to-graph.js';
 import { deriveWorkflowPlan } from '../derive-workflow-plan.js';

package/dist/utils/workflow/graph/index.d.ts

@@ -1,7 +1,8 @@
 /**
  * Workflow graph serialization exports
  */
-export * from './workflow-graph.types.js';
+export { isDataRef, isFunctionNode, ref, state, } from './workflow-graph.types.js';
+export type { BranchCondition, ContextVariable, DataRef, FlowNode, ForEachMode, FunctionNode, NodeOptions, SerializedWorkflowGraph, SerializedWorkflowGraphs, WorkflowContext, } from './workflow-graph.types.js';
 export { serializeWorkflowGraph } from './serialize-workflow-graph.js';
 export { convertDslToGraph } from './convert-dsl-to-graph.js';
 export { finalizeWorkflows } from './finalize-workflows.js';

package/dist/utils/workflow/graph/index.js

@@ -1,7 +1,7 @@
 /**
  * Workflow graph serialization exports
  */
-export * from './workflow-graph.types.js';
+export { isDataRef, isFunctionNode, ref, state, } from './workflow-graph.types.js';
 export { serializeWorkflowGraph } from './serialize-workflow-graph.js';
 export { convertDslToGraph } from './convert-dsl-to-graph.js';
 export { finalizeWorkflows } from './finalize-workflows.js';

package/dist/utils/workflow/graph/serialize-workflow-graph.d.ts

@@ -11,7 +11,12 @@ export declare function serializeWorkflowGraph(definition: {
         func: {
             name?: string;
         };
-        input?: (ref: any) => Record<string, unknown>;
+        input?: (ref: any, template?: any, $item?: any) => Record<string, unknown>;
+        forEach?: string | {
+            nodeId: string;
+            path?: string;
+        } | ((ref: any) => unknown);
+        mode?: 'parallel' | 'sequential';
         next?: string | string[] | Record<string, string | string[]>;
         onError?: string | string[];
         notes?: string;