@pikku/inspector 0.12.61 → 0.12.63

package/CHANGELOG.md

@@ -1,3 +1,78 @@
+## 0.12.63
+
+### Patch Changes
+
+- 274cab3: The singleton intersection moves to the leaves that name it, the runtime stops
+  creating schema, and `db generate` writes only the runtime tables a project's
+  services own
+
+  `WiredSingletonServices` was exported from the generated function leaf so the
+  auth leaf could import it. Nothing outside a generated leaf ever names it —
+  emit declarations for a project of any size and it appears in none of them —
+  so the auth and middleware leaves derive the intersection themselves and the
+  function leaf keeps it private. `WiredServices` stays exported: 147 `.d.ts`
+  files name it, and unexporting it asks every wired module to name each member
+  service through a specifier it does not have.
+
+  `ensurePikkuSchema` is gone. `requirePikkuSchema` replaces it: a service calls
+  it at boot, it looks, and it issues no DDL at all. `pikku db generate` writes
+  the declaration down as a migration and `pikku db migrate` applies it, and
+  those two are now the only way pikku's runtime tables come into existence. A
+  service that finds them missing says so and stops, naming both commands.
+  Half-present is no longer a distinct case — the remedy is the same migration
+  either way. `audit` and `virtual-user` join `pikkuSchemas` as a consequence:
+  boot was the only thing that had ever created them.
+
+  `pikku db generate` applied all of `pikkuSchemas`, so a project with no agents,
+  no channels and no workflows still had `agent_threads`, `channels` and
+  `workflow_runs` written into its migrations, and then carried them forever. A
+  schema now names the services that own it, and generation gates on
+  `requiredServices` — the set the inspector already builds for service
+  tree-shaking. The gate is one-sided: a schema that names no owner is always
+  written, because the session and secret stores and the deployment record are
+  reached by the runtime itself and nothing in a project's source implies them.
+  Declared scopes now imply `scopeService`, which nothing destructures because
+  the generated auth layer is what reaches it.
+
+  Drift keeps asking the unscoped question. A table already in a database has to
+  stay recognisable as a runtime table after the service that needed it is
+  dropped — scoping it there would report those tables as unexplained.
+
+  Every project in this repo that had been relying on boot-time creation now says
+  where its tables come from. `createConfig` moves into its own `config.ts` in the
+  templates — `pikku db` looks for it there — and the three postgres templates plus
+  the workflow verifier declare `postgresUrl` and run `pikku db generate && pikku
+db migrate` before the server starts, from the single connection string their
+  runtime opens. The e2e harness cannot: its databases are in-memory sqlite built
+  inside the services factory, so nothing outside the process can migrate them. It
+  applies the schemas it owns with `applyPikkuSchemas` instead — the same DDL, run
+  by the one process that has the database.
+
+- Updated dependencies [32616af]
+- Updated dependencies [6848cd9]
+  - @pikku/core@0.12.89
+
+## 0.12.62
+
+### Patch Changes
+
+- 985b87b: Follow through on the variable `required` → `optional` rename: regenerate the
+  core API report and update the inspector's `defineVariable` gating-flag test,
+  both of which #1369 left describing the deleted `required` flag.
+- 3a83f85: Stop re-exporting package internals through entry points
+
+  66 names reached consumers only because an `export *` in an entry point swept
+  them up. Each one is referenced solely inside its own package, so the star is
+  now an explicit named re-export listing what is genuinely public. The
+  declarations themselves are untouched — this narrows the entry point, not the
+  module.
+
+- Updated dependencies [9687ad1]
+- Updated dependencies [2d21628]
+- Updated dependencies [985b87b]
+- Updated dependencies [3a83f85]
+  - @pikku/core@0.12.87
+
 ## 0.12.61
 
 ### Patch Changes

package/dist/add/add-variable.js

@@ -4,6 +4,6 @@ export const addVariable = createAddKeyedWiring({
     idField: 'variableId',
     label: 'Variable',
     schemaPrefix: 'VariableSchema',
-    flagField: 'required',
+    flagField: 'optional',
     getState: (state) => state.variables,
 });

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 export { inspect, getInitialInspectorState } from './inspector.js';
 export type { TypesMap } from './types-map.js';
-export type * from './types.js';
+export type { AddonConfig, AuthDefinition, InspectorDiagnostic, InspectorFilters, InspectorHTTPState, InspectorLogger, InspectorMiddlewareState, InspectorOptions, InspectorPermissionState, InspectorState, MetaInputTypes, MiddlewareGroupMeta, MiddlewareRegistration, SchemaRef, } from './types.js';
 export type { FilesAndMethodsErrors } from './utils/get-files-and-methods.js';
 export { ErrorCode } from './error-codes.js';
 export type { DiagnosticSeverity, CodedDiagnostic } from './error-codes.js';

package/dist/utils/post-process.js

@@ -266,6 +266,12 @@ export function aggregateRequiredServices(state) {
     if (Object.keys(state.channels.meta).length > 0) {
         requiredServices.add('eventHub');
     }
+    // Declared scopes need scopeService to resolve a grant. Nothing in a project
+    // destructures it — the generated auth layer reaches it — so the declaration
+    // is the only signal there is.
+    if ((state.scopes?.definitions?.length ?? 0) > 0) {
+        requiredServices.add('scopeService');
+    }
     // 7. Services that consumed addons need from the parent project.
     const addonFnServices = new Map();
     for (const [namespace, fns] of Object.entries(state.addonFunctions ?? {})) {

package/dist/utils/workflow/graph/index.d.ts

@@ -1,7 +1,8 @@
 /**
  * Workflow graph serialization exports
  */
-export * from './workflow-graph.types.js';
+export { isDataRef, isFunctionNode, ref, state, } from './workflow-graph.types.js';
+export type { BranchCondition, ContextVariable, DataRef, FlowNode, ForEachMode, FunctionNode, NodeOptions, SerializedWorkflowGraph, SerializedWorkflowGraphs, WorkflowContext, } from './workflow-graph.types.js';
 export { serializeWorkflowGraph } from './serialize-workflow-graph.js';
 export { convertDslToGraph } from './convert-dsl-to-graph.js';
 export { finalizeWorkflows } from './finalize-workflows.js';

package/dist/utils/workflow/graph/index.js

@@ -1,7 +1,7 @@
 /**
  * Workflow graph serialization exports
  */
-export * from './workflow-graph.types.js';
+export { isDataRef, isFunctionNode, ref, state, } from './workflow-graph.types.js';
 export { serializeWorkflowGraph } from './serialize-workflow-graph.js';
 export { convertDslToGraph } from './convert-dsl-to-graph.js';
 export { finalizeWorkflows } from './finalize-workflows.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/inspector",
-  "version": "0.12.61",
+  "version": "0.12.63",
   "description": "TypeScript inspector for Pikku — discovers functions and wirings to drive code generation",
   "author": "yasser.fadl@gmail.com",
   "license": "BUSL-1.1",
@@ -45,10 +45,10 @@
     "zod-to-ts": "^2.1.0"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.85"
+    "@pikku/core": "^0.12.89"
   },
   "devDependencies": {
-    "@pikku/core": "^0.12.85",
+    "@pikku/core": "^0.12.89",
     "@types/node": "^24.13.3"
   },
   "engines": {

package/src/add/add-variable.ts

@@ -5,6 +5,6 @@ export const addVariable = createAddKeyedWiring({
   idField: 'variableId',
   label: 'Variable',
   schemaPrefix: 'VariableSchema',
-  flagField: 'required',
+  flagField: 'optional',
   getState: (state) => state.variables,
 })

package/src/add/config-value-metadata.test.ts

@@ -169,7 +169,7 @@ describe('config value metadata (docsUrl)', () => {
 })
 
 /**
- * `optional` and `required` are the deploy gate's whole input. A flag the
+ * `optional` is the deploy gate's whole input. A flag the
  * inspector drops leaves the gate seeing a bare declaration, which is how an
  * optional secret suspends a deploy over a value production is meant NOT to
  * have.
@@ -218,8 +218,8 @@ describe('config value gating flags', () => {
     }
   })
 
-  test('carries required from defineVariable into the definition', async () => {
-    const rootDir = await mkdtemp(`${fixtureRoot}-variable-required-`)
+  test('carries optional from defineVariable into the definition', async () => {
+    const rootDir = await mkdtemp(`${fixtureRoot}-variable-optional-`)
     const file = join(rootDir, 'variable.ts')
 
     await writeFile(
@@ -233,7 +233,7 @@ describe('config value gating flags', () => {
         "  name: 'consoleUrl',",
         "  displayName: 'Console URL',",
         "  variableId: 'CONSOLE_URL',",
-        '  required: true,',
+        '  optional: true,',
         '  schema: ConsoleUrlSchema,',
         '})',
         'defineVariable({',
@@ -248,14 +248,14 @@ describe('config value gating flags', () => {
     const criticals: Array<{ code: ErrorCode; message: string }> = []
     try {
       const state = await inspect(makeLogger(criticals), [file], { rootDir })
-      const required = state.variables.definitions.find(
+      const optional = state.variables.definitions.find(
         (d) => d.variableId === 'CONSOLE_URL'
       )
-      const optional = state.variables.definitions.find(
+      const required = state.variables.definitions.find(
         (d) => d.variableId === 'CORS_ORIGINS'
       )
-      assert.equal(required!.required, true)
-      assert.equal(optional!.required, undefined)
+      assert.equal(optional!.optional, true)
+      assert.equal(required!.optional, undefined)
     } finally {
       await rm(rootDir, { recursive: true, force: true })
     }

package/src/index.ts

@@ -1,6 +1,21 @@
 export { inspect, getInitialInspectorState } from './inspector.js'
 export type { TypesMap } from './types-map.js'
-export type * from './types.js'
+export type {
+  AddonConfig,
+  AuthDefinition,
+  InspectorDiagnostic,
+  InspectorFilters,
+  InspectorHTTPState,
+  InspectorLogger,
+  InspectorMiddlewareState,
+  InspectorOptions,
+  InspectorPermissionState,
+  InspectorState,
+  MetaInputTypes,
+  MiddlewareGroupMeta,
+  MiddlewareRegistration,
+  SchemaRef,
+} from './types.js'
 export type { FilesAndMethodsErrors } from './utils/get-files-and-methods.js'
 export { ErrorCode } from './error-codes.js'
 export type { DiagnosticSeverity, CodedDiagnostic } from './error-codes.js'

package/src/utils/post-process.test.ts

@@ -94,6 +94,7 @@ function makeState(
     addonRequiredParentServices?: string[]
     authServices?: string[]
     graphMeta?: Record<string, any>
+    scopeDefinitions?: any[]
   } = {}
 ): Omit<InspectorState, 'typesLookup'> {
   return {
@@ -128,6 +129,7 @@ function makeState(
     workflows: { meta: {}, graphMeta: overrides.graphMeta ?? {} },
     wireServicesMeta: new Map(),
     rpc: { internalMeta: {}, exposedMeta: {} },
+    scopes: { definitions: overrides.scopeDefinitions ?? [] },
     addonFunctions: overrides.addonFunctions ?? {},
     addonRequiredParentServices: overrides.addonRequiredParentServices ?? [],
     auth: overrides.authServices
@@ -392,6 +394,24 @@ describe('aggregateRequiredServices — the auth factory’s own services', () =
   })
 })
 
+describe('aggregateRequiredServices — scopes imply the service that resolves them', () => {
+  // Nothing in a project destructures `scopeService` — the generated auth layer
+  // reaches it — so the declaration is the only signal there is. Without this,
+  // `pikku db generate` would leave a project that declares scopes with no
+  // tables to grant them in.
+  test('a declared scope requires scopeService', () => {
+    const state = makeState({ scopeDefinitions: [{ id: 'admin' }] })
+    aggregateRequiredServices(state)
+    assert.ok(state.serviceAggregation.requiredServices.has('scopeService'))
+  })
+
+  test('a project that declares none does not', () => {
+    const state = makeState()
+    aggregateRequiredServices(state)
+    assert.ok(!state.serviceAggregation.requiredServices.has('scopeService'))
+  })
+})
+
 describe('override validation resolves the override target (value), not the logical key', () => {
   test('validateSecretOverrides accepts an override whose value is a declared secret', () => {
     const { logger, criticals } = makeCriticalLogger()

package/src/utils/post-process.ts

@@ -322,6 +322,13 @@ export function aggregateRequiredServices(
     requiredServices.add('eventHub')
   }
 
+  // Declared scopes need scopeService to resolve a grant. Nothing in a project
+  // destructures it — the generated auth layer reaches it — so the declaration
+  // is the only signal there is.
+  if ((state.scopes?.definitions?.length ?? 0) > 0) {
+    requiredServices.add('scopeService')
+  }
+
   // 7. Services that consumed addons need from the parent project.
   const addonFnServices = new Map<string, string[] | undefined>()
   for (const [namespace, fns] of Object.entries(state.addonFunctions ?? {})) {

package/src/utils/workflow/graph/index.ts

@@ -1,7 +1,24 @@
 /**
  * Workflow graph serialization exports
  */
-export * from './workflow-graph.types.js'
+export {
+  isDataRef,
+  isFunctionNode,
+  ref,
+  state,
+} from './workflow-graph.types.js'
+export type {
+  BranchCondition,
+  ContextVariable,
+  DataRef,
+  FlowNode,
+  ForEachMode,
+  FunctionNode,
+  NodeOptions,
+  SerializedWorkflowGraph,
+  SerializedWorkflowGraphs,
+  WorkflowContext,
+} from './workflow-graph.types.js'
 export { serializeWorkflowGraph } from './serialize-workflow-graph.js'
 export { convertDslToGraph } from './convert-dsl-to-graph.js'
 export { finalizeWorkflows } from './finalize-workflows.js'