@pikku/inspector 0.12.63 → 0.12.65

package/CHANGELOG.md

@@ -1,3 +1,66 @@
+## 0.12.65
+
+### Patch Changes
+
+- b5e79c1: Resolve `Config`, `SingletonServices` and `Services` by declaration rather than
+  by name.
+
+  Service extraction read `typesLookup` under the hardcoded names the scaffold
+  happens to use, but the lookup is keyed by whatever the project named its
+  interface. A project that renamed one satisfied every required-type check and
+  then resolved to no services at all, surfacing much later as PKU724 or as every
+  singleton service turning optional. These now go through the import maps, which
+  carry the real name.
+
+  `pikku workflow` carried the same lookup as its fallback when aggregation came
+  back empty, so a project with a renamed interface was told
+  `WORKFLOW_ORCHESTRATOR_NOT_CONFIGURED` while holding a perfectly good
+  `workflowService`.
+
+- Updated dependencies [1cc50ef]
+- Updated dependencies [a3deea4]
+- Updated dependencies [2a02288]
+  - @pikku/core@0.12.95
+
+## 0.12.64
+
+### Patch Changes
+
+- 0b1bf53: Refuse better-auth's `admin()` plugin, and point at `ban()`.
+
+  `admin()` authorizes its endpoints against a `user.role` column while pikku
+  authorizes on scopes, so wiring it means running two authorization models and
+  projecting one onto the other — coarsely, since any single `admin:users:*` scope
+  has to project to `role='admin'` and thereby unlocks every one of its endpoints
+  underneath. Pikku dropped that projection when user management moved to
+  `@pikku/addon-admin`'s scoped RPCs, so nothing reads the column any more.
+
+  The inspector now throws when `admin()` appears in a `betterAuth({ plugins })`
+  array, naming the replacement:
+
+  ```ts
+  import { ban } from '@pikku/better-auth'
+  betterAuth({ plugins: [ban()] })
+  ```
+
+  `ban()` keeps the one capability `admin()` had that pikku cannot supply from
+  outside better-auth: the `banned`/`banReason`/`banExpires` columns and the
+  session hook that refuses a banned user a session.
+
+  `pikku validate` reports the same thing without a prebuild, and additionally
+  warns about the quieter half of the migration — an app that dropped `admin()`
+  and never wired `ban()`, which keeps its ban columns and its ban UI while
+  silently enforcing nothing.
+
+  Both resolve the plugin's provenance before applying the policy: the entry has
+  to be better-auth's `admin`, imported from `better-auth/plugins` — by name, by
+  alias or through a namespace — and actually present in the `plugins` array. A
+  project's own helper called `admin` passes, and an import left behind after the
+  call was removed configures nothing.
+
+- Updated dependencies [0b1bf53]
+  - @pikku/core@0.12.94
+
 ## 0.12.63
 
 ### Patch Changes

package/dist/add/add-auth.js

@@ -60,15 +60,52 @@ const readArrayProp = (obj, name) => {
         return prop.initializer;
     return undefined;
 };
+/** better-auth's own plugin entrypoint. */
+const BETTER_AUTH_PLUGINS_MODULE = 'better-auth/plugins';
+const readPluginBindings = (source) => {
+    const named = new Map();
+    const namespaces = new Set();
+    for (const statement of source.statements) {
+        if (!ts.isImportDeclaration(statement) ||
+            !ts.isStringLiteral(statement.moduleSpecifier) ||
+            statement.moduleSpecifier.text !== BETTER_AUTH_PLUGINS_MODULE) {
+            continue;
+        }
+        const bindings = statement.importClause?.namedBindings;
+        if (!bindings)
+            continue;
+        if (ts.isNamespaceImport(bindings)) {
+            namespaces.add(bindings.name.text);
+            continue;
+        }
+        for (const element of bindings.elements) {
+            named.set(element.name.text, (element.propertyName ?? element.name).text);
+        }
+    }
+    return { named, namespaces };
+};
 /**
- * Read the callee name of a `plugins: [...]` entry. better-auth plugins are
- * factory calls (`bearer()`, `twoFactor({ ... })`, `ban()`); the entry's id
- * is the called function's name. Member-expression callees (`foo.bar()`) and
- * non-call entries are ignored.
+ * Read a `plugins: [...]` entry. better-auth plugins are factory calls —
+ * `bearer()`, `twoFactor({ ... })`, `ban()`, or `plugins.bearer()` through a
+ * namespace import; non-call entries are ignored. `betterAuthExport` is the
+ * name better-auth exports the plugin under, and is absent for a plugin that
+ * came from somewhere else, which no policy here applies to.
  */
-const readPluginId = (el) => {
-    if (ts.isCallExpression(el) && ts.isIdentifier(el.expression))
-        return el.expression.text;
+const readPluginEntry = (el, bindings) => {
+    if (!ts.isCallExpression(el))
+        return undefined;
+    const callee = el.expression;
+    if (ts.isIdentifier(callee)) {
+        return {
+            id: callee.text,
+            betterAuthExport: bindings.named.get(callee.text),
+        };
+    }
+    if (ts.isPropertyAccessExpression(callee) &&
+        ts.isIdentifier(callee.expression) &&
+        bindings.namespaces.has(callee.expression.text)) {
+        return { id: callee.name.text, betterAuthExport: callee.name.text };
+    }
     return undefined;
 };
 /**
@@ -101,6 +138,38 @@ const isInsideGlobalMiddlewareRegistration = (node) => {
     }
     return false;
 };
+/**
+ * Refusal for better-auth's `admin()`, which pikku does not support.
+ *
+ * `admin()` authorizes its endpoints against a `user.role` column, so wiring it
+ * means running a second authorization model alongside pikku's scopes and
+ * keeping one projected onto the other — coarsely, since any single
+ * `admin:users:*` scope has to project to `role='admin'` and thereby unlocks
+ * every one of its endpoints underneath. Pikku dropped that projection: user
+ * management is `@pikku/addon-admin`'s scoped RPCs, and the one capability
+ * `admin()` had that nothing else did — refusing a session to a banned user —
+ * is `ban()`.
+ *
+ * Thrown rather than warned because the failure it prevents is silent. An app
+ * that drops `admin()` without wiring `ban()` keeps its ban columns and its ban
+ * UI, and simply stops enforcing bans.
+ */
+const UNSUPPORTED_ADMIN_PLUGIN = (sourceFile) => `better-auth's admin() plugin is not supported by pikku (${sourceFile}).
+
+It authorizes against a 'user.role' column, while pikku authorizes on scopes —
+wiring both means one has to be projected onto the other, and the projection is
+coarser than the scopes it stands in for.
+
+Use ban() instead:
+
+  import { ban } from '@pikku/better-auth'
+  betterAuth({ plugins: [ban()] })
+
+ban() keeps the part of admin() that pikku cannot supply from outside
+better-auth — the banned/banReason/banExpires columns and the session hook that
+refuses a banned user a session. Everything else admin() offered is already
+scoped RPCs in @pikku/addon-admin: list, create, ban, remove, revoke sessions
+and set password.`;
 /**
  * Detects `pikkuBetterAuth((services) => betterAuth({...}))` calls.
  *
@@ -234,10 +303,16 @@ export const addAuth = (logger, node, _checker, state) => {
         }
         const plugins = readArrayProp(config, 'plugins');
         if (plugins) {
+            const bindings = readPluginBindings(node.getSourceFile());
             for (const el of plugins.elements) {
-                const id = readPluginId(el);
-                if (id && !state.auth.plugins.includes(id)) {
-                    state.auth.plugins.push(id);
+                const entry = readPluginEntry(el, bindings);
+                if (!entry)
+                    continue;
+                if (entry.betterAuthExport === 'admin') {
+                    throw new Error(UNSUPPORTED_ADMIN_PLUGIN(sourceFile));
+                }
+                if (!state.auth.plugins.includes(entry.id)) {
+                    state.auth.plugins.push(entry.id);
                 }
             }
         }

package/dist/add/add-cli.js

@@ -1,5 +1,6 @@
 import ts from 'typescript';
 import { extractFunctionName, makeContextBasedId, } from '../utils/extract-function-name.js';
+import { resolveCoreType } from '../utils/resolve-core-type.js';
 import { resolveMiddleware } from '../utils/middleware.js';
 import { resolveFunctionMeta } from '../utils/resolve-function-meta.js';
 import { extractWireNames } from '../utils/post-process.js';
@@ -538,8 +539,8 @@ function extractEnumFromPropertyType(type, propertyName, typeChecker) {
  */
 function extractEnumFromConfigType(logger, propertyName, typeChecker, inspectorState, _inspectorOptions) {
     // Look for Config type in typesLookup
-    const configTypes = inspectorState.typesLookup.get('Config');
-    if (!configTypes || configTypes.length === 0) {
+    const configType = resolveCoreType(inspectorState.typesLookup, inspectorState.configTypeImportMap);
+    if (!configType) {
         // Only warn once per CLI file to avoid spamming logs
         if (!configTypeWarningShown.has('missing-config-type')) {
             configTypeWarningShown.add('missing-config-type');
@@ -548,15 +549,6 @@ function extractEnumFromConfigType(logger, propertyName, typeChecker, inspectorS
         }
         return null;
     }
-    // Use the first Config type (there should only be one)
-    const configType = configTypes[0];
-    if (!configType) {
-        if (!configTypeWarningShown.has('undefined-config-type')) {
-            configTypeWarningShown.add('undefined-config-type');
-            logger.warn(`Config type is undefined in typesLookup.`);
-        }
-        return null;
-    }
     // Extract enum from the property
     return extractEnumFromPropertyType(configType, propertyName, typeChecker);
 }

package/dist/index.d.ts

@@ -23,3 +23,4 @@ export { deserializeDslWorkflow, deserializeGraphWorkflow, deserializeAllDslWork
 export { getFilesAndMethods } from './utils/get-files-and-methods.js';
 export { resolveFunctionMeta } from './utils/resolve-function-meta.js';
 export type { SerializedWorkflowGraph, SerializedWorkflowGraphs, } from './utils/workflow/graph/index.js';
+export { resolveCoreType } from './utils/resolve-core-type.js';

package/dist/index.js

@@ -12,3 +12,4 @@ export { serializeMCPJson } from './utils/serialize-mcp-json.js';
 export { deserializeDslWorkflow, deserializeGraphWorkflow, deserializeAllDslWorkflows, } from './utils/workflow/dsl/index.js';
 export { getFilesAndMethods } from './utils/get-files-and-methods.js';
 export { resolveFunctionMeta } from './utils/resolve-function-meta.js';
+export { resolveCoreType } from './utils/resolve-core-type.js';

package/dist/utils/post-process.js

@@ -4,6 +4,7 @@ import { join } from 'node:path';
 import { extractTypeKeys } from './type-utils.js';
 import { ErrorCode } from '../error-codes.js';
 import { findSecretAliasServices } from './secret-alias-services.js';
+import { resolveCoreType } from './resolve-core-type.js';
 import { relative } from 'node:path';
 import { AUTH_HANDLER_FUNC_ID } from '../add/add-auth.js';
 import { flattenScopeDefinitions } from '@pikku/core/scope';
@@ -79,18 +80,16 @@ function extractAllServices(state) {
         return;
     }
     // Extract all singleton services from the SingletonServices type
-    const singletonServicesTypes = state.typesLookup.get('SingletonServices');
-    if (singletonServicesTypes && singletonServicesTypes.length > 0) {
-        const singletonServiceNames = extractTypeKeys(singletonServicesTypes[0]);
-        state.serviceAggregation.allSingletonServices = singletonServiceNames.sort();
+    const singletonServicesType = resolveCoreType(state.typesLookup, state.singletonServicesTypeImportMap);
+    if (singletonServicesType) {
+        state.serviceAggregation.allSingletonServices = extractTypeKeys(singletonServicesType).sort();
     }
     // Extract all services from the Services type
-    const servicesTypes = state.typesLookup.get('Services');
-    if (servicesTypes && servicesTypes.length > 0) {
-        const allServiceNames = extractTypeKeys(servicesTypes[0]);
+    const servicesType = resolveCoreType(state.typesLookup, state.wireServicesTypeImportMap);
+    if (servicesType) {
         // Wire services are those in Services but not in SingletonServices
         const singletonSet = new Set(state.serviceAggregation.allSingletonServices);
-        state.serviceAggregation.allWireServices = allServiceNames
+        state.serviceAggregation.allWireServices = extractTypeKeys(servicesType)
             .filter((name) => !singletonSet.has(name))
             .sort();
     }
@@ -898,11 +897,11 @@ export function validateNoSecretAliasServices(logger, checker, state) {
     if (!('typesLookup' in state)) {
         return;
     }
-    const singletonServicesTypes = state.typesLookup.get('SingletonServices');
-    if (!singletonServicesTypes?.length) {
+    const singletonServicesType = resolveCoreType(state.typesLookup, state.singletonServicesTypeImportMap);
+    if (!singletonServicesType) {
         return;
     }
-    const aliases = findSecretAliasServices(singletonServicesTypes[0], checker);
+    const aliases = findSecretAliasServices(singletonServicesType, checker);
     if (aliases.length === 0) {
         return;
     }

package/dist/utils/resolve-core-type.d.ts

@@ -0,0 +1,21 @@
+import type ts from 'typescript';
+import type { PathToNameAndType } from '../types.js';
+/**
+ * Resolves the one interface extending a core type (`CoreConfig`,
+ * `CoreSingletonServices`, `CoreServices`) to the `ts.Type` the AST walk
+ * recorded for it.
+ *
+ * `typesLookup` is keyed by whatever the project named the interface, so
+ * reading it under a hardcoded `'SingletonServices'` only works for projects
+ * that follow the scaffold's naming. A project that renamed the interface still
+ * satisfies every required-type check and then resolves to no services at all,
+ * which surfaces far downstream as PKU724 or as every service turning optional.
+ * The import map carries the real name, so no name matching is needed.
+ *
+ * A project is only ever meant to declare one of each: `getMetaTypes` records
+ * `More than one ... found` when it sees a second, which `checkRequiredTypes`
+ * then reports. That check is the caller's to run, and extraction happens
+ * first, so where two declarations do exist this takes the first in traversal
+ * order rather than diagnosing the ambiguity itself.
+ */
+export declare const resolveCoreType: (typesLookup: Map<string, ts.Type[]>, importMap: PathToNameAndType) => ts.Type | undefined;

package/dist/utils/resolve-core-type.js

@@ -0,0 +1,29 @@
+/**
+ * Resolves the one interface extending a core type (`CoreConfig`,
+ * `CoreSingletonServices`, `CoreServices`) to the `ts.Type` the AST walk
+ * recorded for it.
+ *
+ * `typesLookup` is keyed by whatever the project named the interface, so
+ * reading it under a hardcoded `'SingletonServices'` only works for projects
+ * that follow the scaffold's naming. A project that renamed the interface still
+ * satisfies every required-type check and then resolves to no services at all,
+ * which surfaces far downstream as PKU724 or as every service turning optional.
+ * The import map carries the real name, so no name matching is needed.
+ *
+ * A project is only ever meant to declare one of each: `getMetaTypes` records
+ * `More than one ... found` when it sees a second, which `checkRequiredTypes`
+ * then reports. That check is the caller's to run, and extraction happens
+ * first, so where two declarations do exist this takes the first in traversal
+ * order rather than diagnosing the ambiguity itself.
+ */
+export const resolveCoreType = (typesLookup, importMap) => {
+    for (const entries of importMap.values()) {
+        for (const { type } of entries) {
+            const resolved = type ? typesLookup.get(type)?.[0] : undefined;
+            if (resolved) {
+                return resolved;
+            }
+        }
+    }
+    return undefined;
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/inspector",
-  "version": "0.12.63",
+  "version": "0.12.65",
   "description": "TypeScript inspector for Pikku — discovers functions and wirings to drive code generation",
   "author": "yasser.fadl@gmail.com",
   "license": "BUSL-1.1",
@@ -45,10 +45,10 @@
     "zod-to-ts": "^2.1.0"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.89"
+    "@pikku/core": "^0.12.95"
   },
   "devDependencies": {
-    "@pikku/core": "^0.12.89",
+    "@pikku/core": "^0.12.95",
     "@types/node": "^24.13.3"
   },
   "engines": {

package/src/add/add-auth.test.ts

@@ -217,6 +217,126 @@ describe('addAuth inspector', () => {
     }
   })
 
+  test('refuses better-auth admin() and points at ban()', async () => {
+    const rootDir = await mkdtemp(join(tmpdir(), 'pikku-add-auth-admin-'))
+    const file = join(rootDir, 'auth.ts')
+
+    await writeFile(
+      file,
+      [
+        "import { pikkuBetterAuth } from '@pikku/better-auth'",
+        "import { betterAuth } from 'better-auth'",
+        "import { admin, bearer } from 'better-auth/plugins'",
+        'export const auth = pikkuBetterAuth(() =>',
+        '  betterAuth({',
+        '    plugins: [bearer(), admin()],',
+        '  })',
+        ')',
+      ].join('\n')
+    )
+
+    const criticals: Array<{ code: ErrorCode; message: string }> = []
+    try {
+      await assert.rejects(
+        () => inspect(makeLogger(criticals), [file], { rootDir }),
+        (error: Error) => {
+          assert.match(error.message, /admin\(\) plugin is not supported/)
+          assert.match(error.message, /ban\(\)/)
+          assert.match(error.message, /@pikku\/addon-admin/)
+          return true
+        }
+      )
+    } finally {
+      await rm(rootDir, { recursive: true, force: true })
+    }
+  })
+
+  test('refuses admin() reached through a namespace import', async () => {
+    const rootDir = await mkdtemp(join(tmpdir(), 'pikku-add-auth-ns-admin-'))
+    const file = join(rootDir, 'auth.ts')
+
+    await writeFile(
+      file,
+      [
+        "import { pikkuBetterAuth } from '@pikku/better-auth'",
+        "import { betterAuth } from 'better-auth'",
+        "import * as plugins from 'better-auth/plugins'",
+        'export const auth = pikkuBetterAuth(() =>',
+        '  betterAuth({',
+        '    plugins: [plugins.bearer(), plugins.admin()],',
+        '  })',
+        ')',
+      ].join('\n')
+    )
+
+    const criticals: Array<{ code: ErrorCode; message: string }> = []
+    try {
+      await assert.rejects(
+        () => inspect(makeLogger(criticals), [file], { rootDir }),
+        /admin\(\) plugin is not supported/
+      )
+    } finally {
+      await rm(rootDir, { recursive: true, force: true })
+    }
+  })
+
+  test('allows a local plugin of its own named admin', async () => {
+    const rootDir = await mkdtemp(join(tmpdir(), 'pikku-add-auth-local-admin-'))
+    const file = join(rootDir, 'auth.ts')
+
+    await writeFile(
+      file,
+      [
+        "import { pikkuBetterAuth } from '@pikku/better-auth'",
+        "import { betterAuth } from 'better-auth'",
+        "import { bearer } from 'better-auth/plugins'",
+        'const admin = () => ({ id: "admin" })',
+        'export const auth = pikkuBetterAuth(() =>',
+        '  betterAuth({',
+        '    plugins: [bearer(), admin()],',
+        '  })',
+        ')',
+      ].join('\n')
+    )
+
+    const criticals: Array<{ code: ErrorCode; message: string }> = []
+    try {
+      const state = await inspect(makeLogger(criticals), [file], { rootDir })
+      assert.equal(criticals.length, 0)
+      assert.deepEqual(state.auth.plugins, ['bearer', 'admin'])
+    } finally {
+      await rm(rootDir, { recursive: true, force: true })
+    }
+  })
+
+  test('records a namespace-imported plugin under its exported name', async () => {
+    const rootDir = await mkdtemp(join(tmpdir(), 'pikku-add-auth-ns-'))
+    const file = join(rootDir, 'auth.ts')
+
+    await writeFile(
+      file,
+      [
+        "import { pikkuBetterAuth } from '@pikku/better-auth'",
+        "import { betterAuth } from 'better-auth'",
+        "import * as plugins from 'better-auth/plugins'",
+        'export const auth = pikkuBetterAuth(() =>',
+        '  betterAuth({',
+        '    plugins: [plugins.bearer()],',
+        '  })',
+        ')',
+      ].join('\n')
+    )
+
+    const criticals: Array<{ code: ErrorCode; message: string }> = []
+    try {
+      const state = await inspect(makeLogger(criticals), [file], { rootDir })
+      assert.equal(criticals.length, 0)
+      assert.deepEqual(state.auth.plugins, ['bearer'])
+    } finally {
+      await rm(rootDir, { recursive: true, force: true })
+    }
+  })
+
   test('records no plugins when the plugins array is absent', async () => {
     const rootDir = await mkdtemp(join(tmpdir(), 'pikku-add-auth-noplugins-'))
     const file = join(rootDir, 'auth.ts')

package/src/add/add-auth.ts

@@ -87,15 +87,71 @@ const readArrayProp = (
   return undefined
 }
 
+/** better-auth's own plugin entrypoint. */
+const BETTER_AUTH_PLUGINS_MODULE = 'better-auth/plugins'
+
+/**
+ * What the names used in a `plugins: [...]` array were bound to by the file's
+ * imports of {@link BETTER_AUTH_PLUGINS_MODULE}, so a project's local helper
+ * called `admin` is not mistaken for better-auth's.
+ */
+type PluginBindings = {
+  /** Local name → the name it is exported under by better-auth. */
+  named: Map<string, string>
+  /** Locals bound by `import * as x from 'better-auth/plugins'`. */
+  namespaces: Set<string>
+}
+
+const readPluginBindings = (source: ts.SourceFile): PluginBindings => {
+  const named = new Map<string, string>()
+  const namespaces = new Set<string>()
+  for (const statement of source.statements) {
+    if (
+      !ts.isImportDeclaration(statement) ||
+      !ts.isStringLiteral(statement.moduleSpecifier) ||
+      statement.moduleSpecifier.text !== BETTER_AUTH_PLUGINS_MODULE
+    ) {
+      continue
+    }
+    const bindings = statement.importClause?.namedBindings
+    if (!bindings) continue
+    if (ts.isNamespaceImport(bindings)) {
+      namespaces.add(bindings.name.text)
+      continue
+    }
+    for (const element of bindings.elements) {
+      named.set(element.name.text, (element.propertyName ?? element.name).text)
+    }
+  }
+  return { named, namespaces }
+}
+
 /**
- * Read the callee name of a `plugins: [...]` entry. better-auth plugins are
- * factory calls (`bearer()`, `twoFactor({ ... })`, `ban()`); the entry's id
- * is the called function's name. Member-expression callees (`foo.bar()`) and
- * non-call entries are ignored.
+ * Read a `plugins: [...]` entry. better-auth plugins are factory calls —
+ * `bearer()`, `twoFactor({ ... })`, `ban()`, or `plugins.bearer()` through a
+ * namespace import; non-call entries are ignored. `betterAuthExport` is the
+ * name better-auth exports the plugin under, and is absent for a plugin that
+ * came from somewhere else, which no policy here applies to.
  */
-const readPluginId = (el: ts.Expression): string | undefined => {
-  if (ts.isCallExpression(el) && ts.isIdentifier(el.expression))
-    return el.expression.text
+const readPluginEntry = (
+  el: ts.Expression,
+  bindings: PluginBindings
+): { id: string; betterAuthExport?: string } | undefined => {
+  if (!ts.isCallExpression(el)) return undefined
+  const callee = el.expression
+  if (ts.isIdentifier(callee)) {
+    return {
+      id: callee.text,
+      betterAuthExport: bindings.named.get(callee.text),
+    }
+  }
+  if (
+    ts.isPropertyAccessExpression(callee) &&
+    ts.isIdentifier(callee.expression) &&
+    bindings.namespaces.has(callee.expression.text)
+  ) {
+    return { id: callee.name.text, betterAuthExport: callee.name.text }
+  }
   return undefined
 }
 
@@ -128,6 +184,40 @@ const isInsideGlobalMiddlewareRegistration = (node: ts.Node): boolean => {
   return false
 }
 
+/**
+ * Refusal for better-auth's `admin()`, which pikku does not support.
+ *
+ * `admin()` authorizes its endpoints against a `user.role` column, so wiring it
+ * means running a second authorization model alongside pikku's scopes and
+ * keeping one projected onto the other — coarsely, since any single
+ * `admin:users:*` scope has to project to `role='admin'` and thereby unlocks
+ * every one of its endpoints underneath. Pikku dropped that projection: user
+ * management is `@pikku/addon-admin`'s scoped RPCs, and the one capability
+ * `admin()` had that nothing else did — refusing a session to a banned user —
+ * is `ban()`.
+ *
+ * Thrown rather than warned because the failure it prevents is silent. An app
+ * that drops `admin()` without wiring `ban()` keeps its ban columns and its ban
+ * UI, and simply stops enforcing bans.
+ */
+const UNSUPPORTED_ADMIN_PLUGIN = (sourceFile: string): string =>
+  `better-auth's admin() plugin is not supported by pikku (${sourceFile}).
+
+It authorizes against a 'user.role' column, while pikku authorizes on scopes —
+wiring both means one has to be projected onto the other, and the projection is
+coarser than the scopes it stands in for.
+
+Use ban() instead:
+
+  import { ban } from '@pikku/better-auth'
+  betterAuth({ plugins: [ban()] })
+
+ban() keeps the part of admin() that pikku cannot supply from outside
+better-auth — the banned/banReason/banExpires columns and the session hook that
+refuses a banned user a session. Everything else admin() offered is already
+scoped RPCs in @pikku/addon-admin: list, create, ban, remove, revoke sessions
+and set password.`
+
 /**
  * Detects `pikkuBetterAuth((services) => betterAuth({...}))` calls.
  *
@@ -304,10 +394,15 @@ export const addAuth: AddWiring = (logger, node, _checker, state) => {
 
     const plugins = readArrayProp(config, 'plugins')
     if (plugins) {
+      const bindings = readPluginBindings(node.getSourceFile())
       for (const el of plugins.elements) {
-        const id = readPluginId(el)
-        if (id && !state.auth.plugins.includes(id)) {
-          state.auth.plugins.push(id)
+        const entry = readPluginEntry(el, bindings)
+        if (!entry) continue
+        if (entry.betterAuthExport === 'admin') {
+          throw new Error(UNSUPPORTED_ADMIN_PLUGIN(sourceFile))
+        }
+        if (!state.auth.plugins.includes(entry.id)) {
+          state.auth.plugins.push(entry.id)
         }
       }
     }

package/src/add/add-cli.ts

@@ -11,6 +11,7 @@ import {
   extractFunctionName,
   makeContextBasedId,
 } from '../utils/extract-function-name.js'
+import { resolveCoreType } from '../utils/resolve-core-type.js'
 import { resolveMiddleware } from '../utils/middleware.js'
 import { resolveFunctionMeta } from '../utils/resolve-function-meta.js'
 import { extractWireNames } from '../utils/post-process.js'
@@ -825,8 +826,11 @@ function extractEnumFromConfigType(
   _inspectorOptions: InspectorOptions
 ): string[] | null {
   // Look for Config type in typesLookup
-  const configTypes = inspectorState.typesLookup.get('Config')
-  if (!configTypes || configTypes.length === 0) {
+  const configType = resolveCoreType(
+    inspectorState.typesLookup,
+    inspectorState.configTypeImportMap
+  )
+  if (!configType) {
     // Only warn once per CLI file to avoid spamming logs
     if (!configTypeWarningShown.has('missing-config-type')) {
       configTypeWarningShown.add('missing-config-type')
@@ -838,16 +842,6 @@ function extractEnumFromConfigType(
     return null
   }
 
-  // Use the first Config type (there should only be one)
-  const configType = configTypes[0]
-  if (!configType) {
-    if (!configTypeWarningShown.has('undefined-config-type')) {
-      configTypeWarningShown.add('undefined-config-type')
-      logger.warn(`Config type is undefined in typesLookup.`)
-    }
-    return null
-  }
-
   // Extract enum from the property
   return extractEnumFromPropertyType(configType, propertyName, typeChecker)
 }

package/src/index.ts

@@ -63,3 +63,4 @@ export type {
   SerializedWorkflowGraph,
   SerializedWorkflowGraphs,
 } from './utils/workflow/graph/index.js'
+export { resolveCoreType } from './utils/resolve-core-type.js'