@pikku/inspector 0.12.68 → 0.12.70

package/CHANGELOG.md

@@ -1,3 +1,38 @@
+## 0.12.70
+
+### Patch Changes
+
+- d64db40: Prune a filtered-out workflow's file entry, not just its meta.
+
+  `filterInspectorState` deleted a pruned workflow from `workflows.graphMeta` and `workflows.meta` but left it in `workflows.files`, which is what the wiring generator iterates. Per-unit deploy codegen therefore registered every workflow in the project into every unit, and — because a scenario is told apart from an app workflow by `graphMeta[name].source === 'scenario'`, which the same prune had just removed — each scenario was reclassified as an app workflow. That pulled scenario bodies, their steps, and whatever those import into deployed bundles; on Cloudflare a step reading a fixture off disk failed the whole publish with `No such module "node:fs"`.
+
+## 0.12.69
+
+### Patch Changes
+
+- 32d1280: Prefix the better-auth plugin factories with `pikku`: `pikkuActor`, `pikkuBan`,
+  `pikkuFabric`, `pikkuDelegatedAuth` and `pikkuCredentialOAuth`.
+
+  A `betterAuth({ plugins: [...] })` array mixes this package's plugins with
+  better-auth's own, and until now nothing at the call site told them apart —
+  `plugins: [actor(...), ban(), fabric(...), organization()]` reads as four
+  plugins from one place when only the last is better-auth's. The prefix says
+  which package a plugin came from where it is actually wired.
+
+  The old names are still exported as deprecated aliases bound to the same
+  functions, so no import has to change. Nothing about the plugins themselves
+  moved: the `id` each registers under — `pikku-ban`, `actor`, `fabric`,
+  `delegated-auth`, `credential-oauth` — is unchanged, so no deployed database or
+  session is affected.
+
+  The pieces that read a plugin's _export_ name rather than its id accept both:
+  `PLUGIN_REGISTRY` is keyed under the prefixed and the bare name, and the
+  `pikku validate` ban/actor checks and the `scaffold.userAdmin` ban check count
+  either spelling as wired. Their messages now point at the new names.
+
+- Updated dependencies [a0ed1e8]
+  - @pikku/core@0.12.100
+
 ## 0.12.68
 
 ### Patch Changes

package/dist/add/add-auth.js

@@ -86,7 +86,7 @@ const readPluginBindings = (source) => {
 };
 /**
  * Read a `plugins: [...]` entry. better-auth plugins are factory calls —
- * `bearer()`, `twoFactor({ ... })`, `ban()`, or `plugins.bearer()` through a
+ * `bearer()`, `twoFactor({ ... })`, `pikkuBan()`, or `plugins.bearer()` through a
  * namespace import; non-call entries are ignored. `betterAuthExport` is the
  * name better-auth exports the plugin under, and is absent for a plugin that
  * came from somewhere else, which no policy here applies to.
@@ -148,10 +148,10 @@ const isInsideGlobalMiddlewareRegistration = (node) => {
  * every one of its endpoints underneath. Pikku dropped that projection: user
  * management is `@pikku/addon-admin`'s scoped RPCs, and the one capability
  * `admin()` had that nothing else did — refusing a session to a banned user —
- * is `ban()`.
+ * is `pikkuBan()`.
  *
  * Thrown rather than warned because the failure it prevents is silent. An app
- * that drops `admin()` without wiring `ban()` keeps its ban columns and its ban
+ * that drops `admin()` without wiring `pikkuBan()` keeps its ban columns and its
  * UI, and simply stops enforcing bans.
  */
 const UNSUPPORTED_ADMIN_PLUGIN = (sourceFile) => `better-auth's admin() plugin is not supported by pikku (${sourceFile}).
@@ -160,12 +160,12 @@ It authorizes against a 'user.role' column, while pikku authorizes on scopes —
 wiring both means one has to be projected onto the other, and the projection is
 coarser than the scopes it stands in for.
 
-Use ban() instead:
+Use pikkuBan() instead:
 
-  import { ban } from '@pikku/better-auth'
-  betterAuth({ plugins: [ban()] })
+  import { pikkuBan } from '@pikku/better-auth'
+  betterAuth({ plugins: [pikkuBan()] })
 
-ban() keeps the part of admin() that pikku cannot supply from outside
+pikkuBan() keeps the part of admin() that pikku cannot supply from outside
 better-auth — the banned/banReason/banExpires columns and the session hook that
 refuses a banned user a session. Everything else admin() offered is already
 scoped RPCs in @pikku/addon-admin: list, create, ban, remove, revoke sessions

package/dist/utils/filter-inspector-state.js

@@ -2,6 +2,23 @@ import { parseVersionedId } from '@pikku/core/utils';
 import { makeContextBasedId } from './extract-function-name.js';
 import { aggregateRequiredServices } from './post-process.js';
 import { IncompatibleDeployTargetError, resolveDeployTarget, } from './resolve-deploy-target.js';
+/**
+ * Drop a workflow from every map that describes it. `files` and `graphFiles`
+ * are what the wiring generator iterates, and `graphMeta` is what tells a
+ * scenario apart from an app workflow — leaving a pruned workflow's file entry
+ * behind registers it anyway, and a scenario whose graphMeta has gone reads as
+ * an app workflow, which is how scenario steps reached deployed bundles.
+ */
+const pruneWorkflow = (workflows, name, pikkuFuncId) => {
+    delete workflows.graphMeta[name];
+    delete workflows.meta[name];
+    workflows.files.delete(name);
+    workflows.graphFiles.delete(name);
+    if (pikkuFuncId) {
+        workflows.files.delete(pikkuFuncId);
+        workflows.graphFiles.delete(pikkuFuncId);
+    }
+};
 // Module-level Set to track warned groups across multiple filter calls
 const globalWarnedGroups = new Set();
 /**
@@ -334,6 +351,8 @@ export function filterInspectorState(state, filters, logger) {
             ...state.workflows,
             graphMeta: JSON.parse(JSON.stringify(state.workflows?.graphMeta ?? {})),
             meta: JSON.parse(JSON.stringify(state.workflows?.meta ?? {})),
+            files: new Map(state.workflows?.files ?? []),
+            graphFiles: new Map(state.workflows?.graphFiles ?? []),
         },
         channels: {
             ...state.channels,
@@ -768,13 +787,11 @@ export function filterInspectorState(state, filters, logger) {
             const pikkuFuncId = graphMeta?.pikkuFuncId ?? workflowMeta?.pikkuFuncId;
             if (pikkuFuncId &&
                 !filteredState.serviceAggregation.usedFunctions.has(pikkuFuncId)) {
-                delete filteredState.workflows.graphMeta[name];
-                delete filteredState.workflows.meta[name];
+                pruneWorkflow(filteredState.workflows, name, pikkuFuncId);
             }
             else if (!pikkuFuncId) {
                 // No function ID found — prune it
-                delete filteredState.workflows.graphMeta[name];
-                delete filteredState.workflows.meta[name];
+                pruneWorkflow(filteredState.workflows, name, pikkuFuncId);
             }
         }
         // Prune RPC meta to only include entries whose target function survived

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/inspector",
-  "version": "0.12.68",
+  "version": "0.12.70",
   "description": "TypeScript inspector for Pikku — discovers functions and wirings to drive code generation",
   "author": "yasser.fadl@gmail.com",
   "license": "BUSL-1.1",
@@ -45,10 +45,10 @@
     "zod-to-ts": "^2.1.0"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.99"
+    "@pikku/core": "^0.12.100"
   },
   "devDependencies": {
-    "@pikku/core": "^0.12.99",
+    "@pikku/core": "^0.12.100",
     "@types/node": "^24.13.3"
   },
   "engines": {

package/src/add/add-auth.test.ts

@@ -217,7 +217,7 @@ describe('addAuth inspector', () => {
     }
   })
 
-  test('refuses better-auth admin() and points at ban()', async () => {
+  test('refuses better-auth admin() and points at pikkuBan()', async () => {
     const rootDir = await mkdtemp(join(tmpdir(), 'pikku-add-auth-admin-'))
     const file = join(rootDir, 'auth.ts')
 
@@ -241,7 +241,7 @@ describe('addAuth inspector', () => {
         () => inspect(makeLogger(criticals), [file], { rootDir }),
         (error: Error) => {
           assert.match(error.message, /admin\(\) plugin is not supported/)
-          assert.match(error.message, /ban\(\)/)
+          assert.match(error.message, /pikkuBan\(\)/)
           assert.match(error.message, /@pikku\/addon-admin/)
           return true
         }

package/src/add/add-auth.ts

@@ -128,7 +128,7 @@ const readPluginBindings = (source: ts.SourceFile): PluginBindings => {
 
 /**
  * Read a `plugins: [...]` entry. better-auth plugins are factory calls —
- * `bearer()`, `twoFactor({ ... })`, `ban()`, or `plugins.bearer()` through a
+ * `bearer()`, `twoFactor({ ... })`, `pikkuBan()`, or `plugins.bearer()` through a
  * namespace import; non-call entries are ignored. `betterAuthExport` is the
  * name better-auth exports the plugin under, and is absent for a plugin that
  * came from somewhere else, which no policy here applies to.
@@ -194,10 +194,10 @@ const isInsideGlobalMiddlewareRegistration = (node: ts.Node): boolean => {
  * every one of its endpoints underneath. Pikku dropped that projection: user
  * management is `@pikku/addon-admin`'s scoped RPCs, and the one capability
  * `admin()` had that nothing else did — refusing a session to a banned user —
- * is `ban()`.
+ * is `pikkuBan()`.
  *
  * Thrown rather than warned because the failure it prevents is silent. An app
- * that drops `admin()` without wiring `ban()` keeps its ban columns and its ban
+ * that drops `admin()` without wiring `pikkuBan()` keeps its ban columns and its
  * UI, and simply stops enforcing bans.
  */
 const UNSUPPORTED_ADMIN_PLUGIN = (sourceFile: string): string =>
@@ -207,12 +207,12 @@ It authorizes against a 'user.role' column, while pikku authorizes on scopes —
 wiring both means one has to be projected onto the other, and the projection is
 coarser than the scopes it stands in for.
 
-Use ban() instead:
+Use pikkuBan() instead:
 
-  import { ban } from '@pikku/better-auth'
-  betterAuth({ plugins: [ban()] })
+  import { pikkuBan } from '@pikku/better-auth'
+  betterAuth({ plugins: [pikkuBan()] })
 
-ban() keeps the part of admin() that pikku cannot supply from outside
+pikkuBan() keeps the part of admin() that pikku cannot supply from outside
 better-auth — the banned/banReason/banExpires columns and the session hook that
 refuses a banned user a session. Everything else admin() offered is already
 scoped RPCs in @pikku/addon-admin: list, create, ban, remove, revoke sessions

package/src/utils/filter-inspector-state.test.ts

@@ -2010,3 +2010,56 @@ describe('invokedFunctionsByFile serialization', () => {
     assert.strictEqual(restored.rpc.invokedFunctionsByFile.size, 0)
   })
 })
+
+describe('Workflow file pruning', () => {
+  const workflowState = () => {
+    const state = createMockInspectorState()
+    state.workflows.meta = {
+      moveOut: { pikkuFuncId: 'getUsers' } as any,
+      theMoveOutScenario: { pikkuFuncId: 'createUser' } as any,
+    }
+    state.workflows.graphMeta = {
+      moveOut: { pikkuFuncId: 'getUsers' } as any,
+      theMoveOutScenario: {
+        pikkuFuncId: 'createUser',
+        source: 'scenario',
+      } as any,
+    }
+    state.workflows.files = new Map([
+      [
+        'moveOut',
+        {
+          path: '/test/project/src/wirings/move-out.workflow.ts',
+          exportedName: 'moveOut',
+        },
+      ],
+      [
+        'theMoveOutScenario',
+        {
+          path: '/test/project/test/scenarios/the-move-out.scenario.ts',
+          exportedName: 'theMoveOutScenario',
+        },
+      ],
+    ])
+    return state
+  }
+
+  test('drops the file entry of a pruned workflow', () => {
+    const result = filterInspectorState(
+      workflowState(),
+      { names: ['getUsers'] },
+      mockLogger
+    )
+
+    assert.deepEqual(Object.keys(result.workflows.graphMeta), ['moveOut'])
+    assert.deepEqual([...result.workflows.files.keys()], ['moveOut'])
+  })
+
+  test('leaves the original state untouched', () => {
+    const state = workflowState()
+    filterInspectorState(state, { names: ['getUsers'] }, mockLogger)
+
+    assert.equal(state.workflows.files.size, 2)
+    assert.equal(Object.keys(state.workflows.graphMeta).length, 2)
+  })
+})

package/src/utils/filter-inspector-state.ts

@@ -21,6 +21,28 @@ type DeployFilter = {
   has(pikkuFuncId: string): boolean
 }
 
+/**
+ * Drop a workflow from every map that describes it. `files` and `graphFiles`
+ * are what the wiring generator iterates, and `graphMeta` is what tells a
+ * scenario apart from an app workflow — leaving a pruned workflow's file entry
+ * behind registers it anyway, and a scenario whose graphMeta has gone reads as
+ * an app workflow, which is how scenario steps reached deployed bundles.
+ */
+const pruneWorkflow = (
+  workflows: InspectorState['workflows'],
+  name: string,
+  pikkuFuncId: string | undefined
+) => {
+  delete workflows.graphMeta[name]
+  delete workflows.meta[name]
+  workflows.files.delete(name)
+  workflows.graphFiles.delete(name)
+  if (pikkuFuncId) {
+    workflows.files.delete(pikkuFuncId)
+    workflows.graphFiles.delete(pikkuFuncId)
+  }
+}
+
 // Module-level Set to track warned groups across multiple filter calls
 const globalWarnedGroups = new Set<string>()
 
@@ -449,6 +471,8 @@ export function filterInspectorState(
       ...state.workflows,
       graphMeta: JSON.parse(JSON.stringify(state.workflows?.graphMeta ?? {})),
       meta: JSON.parse(JSON.stringify(state.workflows?.meta ?? {})),
+      files: new Map(state.workflows?.files ?? []),
+      graphFiles: new Map(state.workflows?.graphFiles ?? []),
     },
     channels: {
       ...state.channels,
@@ -1098,12 +1122,10 @@ export function filterInspectorState(
         pikkuFuncId &&
         !filteredState.serviceAggregation.usedFunctions.has(pikkuFuncId)
       ) {
-        delete filteredState.workflows.graphMeta[name]
-        delete filteredState.workflows.meta[name]
+        pruneWorkflow(filteredState.workflows, name, pikkuFuncId)
       } else if (!pikkuFuncId) {
         // No function ID found — prune it
-        delete filteredState.workflows.graphMeta[name]
-        delete filteredState.workflows.meta[name]
+        pruneWorkflow(filteredState.workflows, name, pikkuFuncId)
       }
     }