@pikku/inspector 0.12.74 → 0.12.81

package/CHANGELOG.md

@@ -1,3 +1,350 @@
+## 0.12.81
+
+### Patch Changes
+
+- 78237ac: The console shows feature flags as a launch board, and analytics events as a
+  declared catalog.
+
+  A flag's state is four fields — `enabled`, `rolloutPercent`, `declared`,
+  `backed` — and none of them is the question an operator actually asks, which is
+  how far this has got. The board answers that directly: every declared flag sits
+  in the lane its rollout has reached, `dark` → `rolling` → `live`, with
+  `attention` for the flags that are not resolving in a way anybody chose.
+
+  Attention is evaluated before every other reading, and that ordering is the
+  whole point rather than an implementation detail. A flag declared in code with
+  no row in the store fails open, and it reports `enabled: true` with no rollout
+  limit — byte-identical to a deliberate full launch. Read the fields in the
+  obvious order and the one production-severity state on the board renders as the
+  healthiest one. `groupFlagsByLane` also returns all four lanes whether or not
+  they hold anything, because a board read by shape must not rearrange itself the
+  moment a lane empties.
+
+  Selecting a flag opens its controls beside the board rather than over it: the
+  switch, the rollout bucket, and the subjects pinned on or off past that bucket.
+  They share one surface because they are read together — "off for everyone except
+  these three" is a switch and an override row, and an operator who has to leave
+  one screen to see the other is the operator who turns a flag on for everybody by
+  mistake. The panel tracks the open flag by name and re-reads it from the list, so
+  committing a rollout moves the card and the panel together instead of leaving the
+  panel describing the flag as it was before the operator changed it.
+
+  A board whose flags come from a `FeatureFlagSource` — a provider Pikku reads but
+  does not own — says so and offers no controls, rather than offering controls that
+  would fail.
+
+  The analytics screen is a catalog of what the code declares, read from build-time
+  meta: the events a client may emit and the props each carries, with every prop
+  rendered as the schema source text the declaration wrote. It is deliberately not
+  a volume report — nothing here counts what was emitted — and saying which of the
+  two it is turned out to be the only design question the screen had.
+
+  Turning a flag on while it carries no rollout limit now asks first. That press
+  is the one irreversible thing the board can do — with no bucket left to hold
+  anybody back it admits everyone the flag's capabilities allow — and it used to
+  be a single click on a switch. The panel also reports what a mutation is doing
+  and what it refused to do: the controls it is waiting on go into a pending
+  state, and a failed write raises an inline `<Alert>` rather than reverting in
+  silence. The console mounts no notification provider, so the feedback is inline
+  where the action is, which is the idiom the rest of the console already uses.
+
+  `@pikku/mantine`'s theme gains four aliases, and they close a contrast defect
+  that predates this board:
+
+  ```ts
+  '--mantine-color-orange-light': 'var(--app-surface-warning)',
+  '--mantine-color-orange-light-color': 'var(--app-amber)',
+  '--mantine-color-teal-light': 'var(--app-surface-success)',
+  '--mantine-color-teal-light-color': 'var(--app-green)',
+  ```
+
+  The theme already documents two colour tiers — TEXT must clear AA, GRAPHIC only
+  3:1 — and already pulls Mantine's own variables into that contract rather than
+  linting call sites. What it had not covered was Mantine's _light variants_:
+  `<Alert color="orange">` renders #d9480f on #ffe8cc at 3.62:1, and
+  `<Badge variant="light" color="teal">` at 4.33:1, neither reachable from an
+  `--app-*` token because the component never asks for one. The ramp itself is
+  deliberately untouched: Mantine conflates `--mantine-color-orange-filled`
+  between `c="orange"` text and a `variant="filled"` background, so darkening it
+  for light-mode text would make an existing filled badge unreadable in dark mode.
+  Eight pre-existing `c="orange"` call sites moved onto the amber TEXT tier in the
+  same pass.
+
+  The analytics catalog is grouped by the file that declares each event, and its
+  rows are real buttons rather than table cells carrying a tabindex.
+
+  `ShellHeaderAction` gains `loading` and `testId`, and `ActionCluster` gains a
+  `measurement` flag. `ShellHeader` sizes its actions by rendering them a second
+  time off-screen, and that measuring copy was carrying the same `data-testid` and
+  `data-help` as the real one — so every action on a page with a collapsing header
+  resolved to two elements. The flags board also moved its two header actions from
+  `actionsNode` (documented as the non-collapsing escape hatch) onto the structured
+  `actions` array, which is what stopped them clipping off the right edge at 400px.
+
+- Updated dependencies [78237ac]
+- Updated dependencies [add56d2]
+  - @pikku/core@0.12.111
+
+## 0.12.80
+
+### Patch Changes
+
+- 1c9a55a: Give `pikku dev` and `pikku serve` a database-backed flag store and analytics sink.
+
+  Both followed `agentStorage` and friends everywhere except in being wired: with a
+  local database present, `dev` built one for agents, workflows and scopes and left
+  feature flags unregistered — which makes every gate resolve open — and analytics
+  on the logger fallback. Both are now built from the same `kysely`, and dropped
+  with a warning naming `pikku db generate` rather than failing the boot when the
+  tables are not there yet.
+
+  The inspector now counts a `featureFlag:` declaration as needing `featureFlags`
+  and a `defineAnalyticsEvents` declaration as needing `analyticsService`, the same
+  way a declared scope implies `scopeService`. Neither service is ever destructured
+  — the runner reaches both out of the singleton services — so without this the
+  declaration was invisible to service aggregation and `pikku db generate` wrote no
+  tables for either.
+
+- 52eb461: Prune a unit's addon wiring files alongside its addon declarations, so a
+  deployment unit no longer imports (and registers) addons whose functions the
+  unit filter dropped. `wireAddon` now records the app file that declared it, and
+  a file is dropped only when every addon it wires is dropped.
+- 1c9a55a: Feature flags, declared in source and resolved from two independent booleans.
+
+  `defineFeatureFlags` declares a flag the way `defineScopes` declares a scope —
+  the inspector collects it, the CLI emits a `FeatureFlagName` union, and a
+  misspelled `featureFlag:` is a type error rather than a gate that silently fails
+  open.
+
+  A flag answers two questions that are not the same question. `capable` comes
+  from the session's scopes and is per-user, advisory, and protects nothing — it
+  hides UI. `available` comes from one global config snapshot, is caller-blind,
+  and is the only half the runner enforces: `override(subject) ?? (enabled AND
+bucket)`, so "off for everyone except these three organizations" is one row, and
+  a kill is one write rather than a fan-out. Authorization stays where it was, in
+  the function's own `scopes:` — enforcing capability would make a flag a second
+  authorization path OR-ing against them. An unavailable feature throws 503, not
+  403, because the caller was allowed; the feature was not on.
+
+  `featureFlag:` is deliberately available on sessionless functions too. It reads
+  the config, not the session, so the kill switch reaches a cron task, a queue
+  worker and a webhook — which is where it matters most, since nobody is watching
+  a UI to notice the feature is off.
+
+  Refresh is pull-on-demand, so the TTL is the kill-switch latency. Where that is
+  too long, `invalidate()` is public: a provider's change webhook lands on an HTTP
+  wiring, drops the cache, and the next request does the read. It deliberately
+  does not fetch — a burst of webhooks would be N round trips, and on a serverless
+  runtime the isolate that took the signal may be gone before anything reads the
+  result.
+
+  Availability fails open through three layers: a fresh read, then the last good
+  cached read, then the compiled declaration. The middle layer is load-bearing —
+  dropping straight to the compiled fallback on a blip would switch on every flag
+  that was deliberately dark.
+
+  Backing stores split along what they can honestly do. `FeatureFlagSource` is
+  read-only (`snapshot()`) and is what a third-party provider implements;
+  `FeatureFlagStore` adds the write half and is for stores Pikku owns.
+  `@pikku/kysely` ships the store, with declarations synced additively — a removed
+  declaration is marked undeclared, never revoked, and a sync never re-enables a
+  killed flag. Third-party providers implement the read-only half in the addons
+  repository, over plain `fetch` rather than a vendor SDK — those poll on a timer
+  belonging to a long-lived process, which a serverless isolate cannot hold
+  between requests.
+
+  A client asks for its flags once per session rather than per flag:
+  `scaffold.featureFlags` generates a `GET /feature-flags` returning every
+  declared flag resolved for the caller, keyed by this app's `FeatureFlagName`.
+  Generated into the app rather than shipped in an addon precisely for that union
+  — an addon never sees the host's, and could only answer
+  `Record<string, boolean>`. It returns `show` alone: sending `available` apart
+  from `capable` would tell every visitor which features exist but are dark.
+
+  The write half is the operator's, and lives in `@pikku/addon-admin` beside the
+  scope RPCs, under a new `admin:flags` scope. `flagList` reports `writable:
+false` rather than failing when flags come from a provider, because a provider's
+  own UI is its operator surface and a console full of buttons that 500 is worse
+  than a read-only tab. It still lists the flags: a source may report its declared
+  set through `declaredFlags()`, and each row carries `backed`, false where the
+  provider has never heard of a declared flag. That row is the one worth seeing —
+  an absent row fails open, so a dark launch nobody created in PostHog is already
+  live for everyone, and a store pikku owns can reconcile that on deploy where a
+  provider cannot.
+
+  On the client, `createFeatureFlags` fetches that map once and `useFeatureFlag`
+  reads it synchronously after, through the same provider the analytics client
+  hangs off. It takes a `bootstrap` map so a server-rendered page hydrates onto
+  the answer it already computed: without one there is a gap in which neither
+  default is right, since false hides a feature the user has and true flashes one
+  they do not. A failed refresh keeps the map already on screen rather than
+  relabelling every flag on a blip.
+
+- Updated dependencies [1c9a55a]
+- Updated dependencies [1c9a55a]
+- Updated dependencies [1c9a55a]
+  - @pikku/core@0.12.110
+
+## 0.12.79
+
+### Patch Changes
+
+- 54138b1: Product analytics moves into core behind a `scaffold.analytics` generator.
+
+  An app declares what it measures, and nothing else:
+
+  ```ts
+  import { defineAnalyticsEvents } from '#pikku/analytics'
+
+  export const analyticsEvents = defineAnalyticsEvents({
+    page_viewed: z.object({ path: z.string() }),
+    todo_created: z.object({ priority: z.enum(['low', 'medium', 'high']) }),
+  })
+  ```
+
+  The definer reaches an app through the generated `#pikku/analytics` leaf, the
+  way `defineFeatureFlags` reaches it through `#pikku/scopes` — an app declares
+  what it measures without importing out of core. The leaf is written on every
+  run, whatever `scaffold.analytics` says: the declaration is how a project names
+  what it measures, and the scaffold only decides whether an ingest wire is
+  generated for it. Its path is `analyticsTypesFile`, defaulting to
+  `<outDir>/analytics/pikku-analytics-types.gen.ts`. It carries the sink surface
+  as well as the definer — `AnalyticsService`, `AnalyticsRecord`,
+  `AnalyticsIdentity`, `AnalyticsClientContext`, `AnalyticsLog`,
+  `LoggerAnalyticsService` — because writing the destination events go to is the
+  other half of the same job, and both halves should come through one door.
+
+  The name is the key, so it is never repeated as a `z.literal` inside the
+  schema. Declare in as many modules as suits the project — a feature declares
+  its events beside its functions — and the CLI unions them into the generated
+  `/analytics` ingest and its schemas. The inspector finds the declarations the
+  way it finds every other wiring, so there is no path to configure.
+
+  Where events go is not part of the declaration. `services.analytics` is the
+  request-scoped buffer a function records into, typed against the declared
+  names:
+
+  ```ts
+  await analytics.record({ name: 'todo_created', priority: 'high' })
+  ```
+
+  It stamps identity, trace and wire fields from the invocation, buffers for the
+  length of the call and flushes once when it ends. Identity is always
+  server-side and never read from a request body, which is what makes the
+  unauthenticated ingest safe to expose.
+
+  The transport behind it is an `AnalyticsService` on singleton services — the
+  one swappable slot. With none wired the runner installs
+  `LoggerAnalyticsService`, so an app that turns the scaffold on can watch events
+  arrive without first choosing a store; a platform injects its own through
+  singleton services, and an app that wants neither sets `analyticsService` in
+  its own `services.ts`, which runs last and wins. There is no process-global
+  sink registry and no noop: events are never silently dropped.
+
+  The generated wire is added to the set of scaffolds the inspector reads.
+  Nothing imports it — it is a wiring, not a module anyone calls — so without
+  that the route was written and never registered: no HTTP wiring, no entry in
+  the fetch client, an endpoint that 404s.
+
+  No middleware is emitted with the wire: an origin lock rejects every native
+  client and is forgeable anyway, so guarding the route is the project's call.
+
+  `name` belongs to the event, not to its props. The generated union rebuilds
+  each member from the declared schema's shape and attaches the literal name
+  last, so a declaration that happens to carry a `name` prop of its own cannot
+  displace the discriminator the union is built on. Props schemas are typed to
+  require that shape, so a schema that has none — a union, a primitive — is
+  refused at the declaration rather than in generated code.
+
+- Updated dependencies [54138b1]
+  - @pikku/core@0.12.109
+
+## 0.12.78
+
+### Patch Changes
+
+- d067ac9: Skip the schema-generator retention assertion under `--coverage`. Coverage
+  instrumentation keeps per-line counters alive for the life of the run, so the
+  heap delta cannot discriminate a retained `ts.Program` from accumulated
+  counters, and `Unit Coverage` failed intermittently while `Unit Tests` passed on
+  the same commit. Matches the existing guard in `module-runner.test.ts`.
+
+## 0.12.77
+
+### Patch Changes
+
+- 5c236ee: A deployment unit records why it is where it is. `DeploymentUnit` gains `groupedBy` — the `deploy.grouping` rule that put its functions together — and `targetForcedBy` — the `serverlessIncompatible` services that crossed it to `target: 'server'`. Both are absent for the fallback and for a target that was chosen rather than forced, so anything reading a manifest can tell a deliberate `server` unit from a crossed one. `resolveDeployTarget` now shares `incompatibleServicesFor` with the analyzer, so resolving a target and explaining it cannot drift.
+
+## 0.12.76
+
+### Patch Changes
+
+- 4c7a1b5: Run the monorepo's own scripts through bun instead of yarn. What moves is the
+  package manager each package's `prepublishOnly` and build scripts invoke, plus
+  the two manifest fixes bun needs to resolve the tree: `uWebSockets.js` is
+  declared with an explicit `github:` specifier, and `@pikku/uws-handler` marks
+  its `uWebSockets.js` peer optional so a bun install of a consumer that brings
+  its own uWS app does not try to fetch it from the registry.
+
+  Three published behaviours change, all of them cases where an isolated
+  `node_modules` or bun as the runtime had been papered over by yarn's hoisting:
+
+  - `@pikku/migrator-sql` turns foreign keys on when it opens a sqlite database
+    through bun. `node:sqlite` enforces them by default and `bun:sqlite` does not,
+    which silently turned every `ON DELETE CASCADE` into a no-op under
+    `bunx --bun pikku`.
+  - `@pikku/cli` resolves a deploy provider against the project being deployed
+    rather than against wherever the CLI itself is installed, which is what its
+    own "is not installed" error asks the user to arrange.
+  - `@pikku/cli` treats a specifier a runtime hands straight back — bun does this
+    for the modules it implements itself — as not resolved from the project, so
+    it falls back rather than loading the runtime's own copy.
+
+- 9d7a96d: Deprioritise the generated session middleware instead of skipping it
+
+  Two session middlewares were reconciled by having the CLI inspect the app for
+  its own `betterAuthSession` / `betterAuthStatelessSession` registration and then
+  generate nothing (pikkujs/pikku#754). That silently dropped everything emitted
+  alongside — including the `PIKKU_CONSOLE_TOKEN` bearer, so an app that
+  customized `mapSession` answered `MissingScopeError` on every `console:*` RPC.
+
+  All three session middlewares now take a `priority`, and the CLI generates its
+  registration at `lowest`. An app's own registration defaults to `medium`, so it
+  resolves the session first and the generated one short-circuits on its existing
+  `if (session) next()`. Nothing is detected and nothing is skipped;
+  `state.auth.userStatelessSession` and `state.auth.hasUserSessionMiddleware` are
+  gone.
+
+  `betterAuthSession`, `betterAuthStatelessSession` and the session store now also
+  carry the organization plugin's `activeOrganizationId` onto `session.orgId`
+  without a `mapSession`, and `impersonation.loadUser` defaults to better-auth's
+  own `findUserById` — the two things an app most often wrote a whole `mapSession`
+  for.
+
+- bb6abc2: The CLI's own code no longer imports the TypeScript compiler API. `collectSurface` moved out of `@pikku/cli` into a new `@pikku/inspector/surface` entry point, and the two smaller compiler needs the CLI had are exposed as `readModuleSpecifiers` and `readTsconfigOutDir`.
+
+  `typescript` drops to a devDependency on `@pikku/cli`. It still arrives transitively through `@pikku/code-edit`, which needs a parser to rewrite your source and is loaded only by `pikku meta apply` and the console's edit RPCs.
+
+- Updated dependencies [4c7a1b5]
+  - @pikku/core@0.12.108
+
+## 0.12.75
+
+### Patch Changes
+
+- b28a8c0: An addon's exposed functions get their own deployment unit
+
+  `collectFilterNames` adds the `/rpc/:rpcName` scaffold name to every unit holding an exposed function, so that unit can serve its own `/rpc/<funcName>`. `filterInspectorState` read that same string back as "this unit is the generic dispatcher" and kept every wired addon's declaration for it, so almost every function unit imported each addon's whole package bootstrap — and the node-only modules it reaches.
+
+  No unit retains a wired addon on the strength of a catch-all route any more. Instead the analyzer emits a unit per addon carrying that addon's exposed functions, and the unit serving `/rpc/:rpcName` dispatches to it over a service binding rather than bundling it. Granularity is per addon rather than per function because an addon publishes a single prebuilt bootstrap that registers all of its functions at once.
+
+  `node:child_process` joins `node:fs` as a stubbed builtin: Workers have no implementation of it under any compatibility flag, and it is reached from the console addon's audit tooling.
+
+  `DeploymentUnit` gains `dispatch`, an RPC-name → unit-name map for calls whose target unit isn't the kebab-cased RPC name. `rpc.exposed(name)` falls through to the deployment service for a namespaced name with no local metadata, and Cloudflare function units with a `dependsOn` now get a `deploymentService`, which previously only gateway units had.
+
+- Updated dependencies [b28a8c0]
+  - @pikku/core@0.12.107
+
 ## 0.12.74
 
 ### Patch Changes

package/dist/add/add-analytics.d.ts

@@ -0,0 +1,9 @@
+import * as ts from 'typescript';
+import type { InspectorLogger, InspectorState } from '../types.js';
+/**
+ * Record where each `defineAnalyticsEvents` declaration is, which names it
+ * declares, and the shape each name validates — the names drive the generated
+ * ingest, which reads the schemas off the declaration itself; the shapes are
+ * read here only so the console can show what an event carries.
+ */
+export declare const addAnalytics: (logger: InspectorLogger, node: ts.Node, checker: ts.TypeChecker, state: InspectorState) => void;

package/dist/add/add-analytics.js

@@ -0,0 +1,178 @@
+import * as ts from 'typescript';
+import { isNamedExport } from '../utils/extract-function-name.js';
+const DEFINE_ANALYTICS_EVENTS = 'defineAnalyticsEvents';
+/**
+ * A call is the pikku one when the symbol it resolves to is, whatever the file
+ * chose to call it locally — `import { defineAnalyticsEvents as declare }` is
+ * an ordinary thing to write, and matching on the callee's text alone both
+ * misses that and claims a same-named local helper.
+ */
+const callsDefineAnalyticsEvents = (expression, checker) => {
+    if (!ts.isIdentifier(expression))
+        return false;
+    const symbol = checker.getSymbolAtLocation(expression);
+    if (!symbol)
+        return expression.text === DEFINE_ANALYTICS_EVENTS;
+    // An import specifier names what it imported even when the module itself
+    // does not resolve, which is every project whose deps are not installed yet.
+    const declaration = symbol.declarations?.[0];
+    if (declaration && ts.isImportSpecifier(declaration)) {
+        return ((declaration.propertyName ?? declaration.name).text ===
+            DEFINE_ANALYTICS_EVENTS);
+    }
+    // Only an import can be pikku's. A file's own helper of the same name
+    // resolves to a symbol whose `.name` matches, so resolving without this
+    // claims it — the mirror of what matching on the callee's text misses.
+    if (!(symbol.flags & ts.SymbolFlags.Alias))
+        return false;
+    const resolved = checker.getAliasedSymbol(symbol) ?? symbol;
+    return resolved.name === DEFINE_ANALYTICS_EVENTS;
+};
+/**
+ * The name the generated ingest has to import the declaration by — which is
+ * the name the module exports it under, not the name of the const. A module
+ * that keeps the declaration to itself has no such name, so it is refused here
+ * rather than emitted into an ingest that cannot compile.
+ */
+const exportedName = (declaration, name, checker) => {
+    const moduleSymbol = checker.getSymbolAtLocation(declaration.getSourceFile());
+    const declarationSymbol = checker.getSymbolAtLocation(name);
+    if (!moduleSymbol || !declarationSymbol) {
+        return isNamedExport(declaration, checker) ? name.text : undefined;
+    }
+    for (const exported of checker.getExportsOfModule(moduleSymbol)) {
+        const resolved = exported.flags & ts.SymbolFlags.Alias
+            ? (checker.getAliasedSymbol(exported) ?? exported)
+            : exported;
+        if (resolved === declarationSymbol)
+            return exported.name;
+    }
+    return undefined;
+};
+/**
+ * The `z.object({ ... })` an event's schema is built from, wherever it sits in
+ * a chain — `z.object({}).strict()` and `z.object({}).describe('…')` are both
+ * ordinary things to write, and the shape is on the innermost call either way.
+ */
+const findObjectShape = (expression) => {
+    let current = expression;
+    while (current && ts.isCallExpression(current)) {
+        const callee = current.expression;
+        if (ts.isPropertyAccessExpression(callee) &&
+            callee.name.text === 'object') {
+            const [shape] = current.arguments;
+            if (shape && ts.isObjectLiteralExpression(shape))
+                return shape;
+        }
+        current = ts.isPropertyAccessExpression(callee)
+            ? callee.expression
+            : undefined;
+    }
+    return undefined;
+};
+/**
+ * An event's props, as source text rather than a resolved type — `z.string()`
+ * is what the declaration says and what a reader recognises, and resolving it
+ * would mean type-checking a third-party generic to render one table cell.
+ *
+ * Absent for a schema pikku cannot read the shape off (a shared const, a union,
+ * a vendor that is not zod). The catalog renders nothing rather than guessing.
+ */
+const readEventShape = (initializer) => {
+    const shape = findObjectShape(initializer);
+    if (!shape)
+        return undefined;
+    const props = {};
+    for (const property of shape.properties) {
+        if (!ts.isPropertyAssignment(property))
+            continue;
+        const key = property.name;
+        const propName = ts.isIdentifier(key)
+            ? key.text
+            : ts.isStringLiteral(key)
+                ? key.text
+                : undefined;
+        if (propName === undefined)
+            continue;
+        props[propName] = property.initializer.getText().replace(/\s+/g, ' ');
+    }
+    return props;
+};
+/**
+ * Record where each `defineAnalyticsEvents` declaration is, which names it
+ * declares, and the shape each name validates — the names drive the generated
+ * ingest, which reads the schemas off the declaration itself; the shapes are
+ * read here only so the console can show what an event carries.
+ */
+export const addAnalytics = (logger, node, checker, state) => {
+    if (!ts.isVariableDeclaration(node))
+        return;
+    const { initializer, name } = node;
+    if (!initializer || !ts.isCallExpression(initializer))
+        return;
+    if (!callsDefineAnalyticsEvents(initializer.expression, checker))
+        return;
+    if (!ts.isIdentifier(name))
+        return;
+    const file = node.getSourceFile().fileName;
+    const [argument] = initializer.arguments;
+    if (!argument || !ts.isObjectLiteralExpression(argument)) {
+        logger.error(`defineAnalyticsEvents in ${file} must be called with an object literal keyed by event name, so the generated ingest knows what to union.`);
+        return;
+    }
+    const events = [];
+    const props = {};
+    for (const property of argument.properties) {
+        // `{ page_viewed }` names the event in the shorthand's own identifier.
+        if (ts.isShorthandPropertyAssignment(property)) {
+            events.push(property.name.text);
+            continue;
+        }
+        if (!ts.isPropertyAssignment(property))
+            continue;
+        const key = property.name;
+        const eventName = ts.isIdentifier(key)
+            ? key.text
+            : ts.isStringLiteral(key)
+                ? key.text
+                : undefined;
+        if (eventName === undefined)
+            continue;
+        events.push(eventName);
+        const shape = readEventShape(property.initializer);
+        if (shape)
+            props[eventName] = shape;
+    }
+    if (events.length === 0) {
+        logger.error(`defineAnalyticsEvents in ${file} declares no events. Remove it or add one.`);
+        return;
+    }
+    const variable = exportedName(node, name, checker);
+    if (!variable) {
+        logger.error(`defineAnalyticsEvents in ${file} is assigned to '${name.text}', which the module does not export. The generated ingest imports every declaration by name, so export it.`);
+        return;
+    }
+    // A declaration whose shapes the inspector could not read carries no props,
+    // which the meta says by leaving the field off rather than by an empty object.
+    const readProps = Object.keys(props).length > 0 ? props : undefined;
+    const declarations = (state.analytics ??= []);
+    const existing = declarations.find((declaration) => declaration.file === file && declaration.variable === variable);
+    if (existing) {
+        existing.events = events;
+        if (readProps)
+            existing.props = readProps;
+        else
+            delete existing.props;
+        return;
+    }
+    for (const eventName of events) {
+        const declaredIn = declarations.find((declaration) => declaration.events.includes(eventName));
+        if (declaredIn) {
+            logger.error(`Analytics event '${eventName}' is declared twice: ${declaredIn.file} and ${file}. An event name belongs to one declaration.`);
+            return;
+        }
+    }
+    declarations.push(readProps
+        ? { file, variable, events, props: readProps }
+        : { file, variable, events });
+};

package/dist/add/add-auth.js

@@ -108,36 +108,6 @@ const readPluginEntry = (el, bindings) => {
     }
     return undefined;
 };
-/**
- * True when `node` sits inside a GLOBAL middleware registration — i.e. an actual
- * global registration, not a bare standalone call or a route-scoped one.
- *
- * `addGlobalMiddleware(...)` is always global. `addHTTPMiddleware` is global only
- * in its array form (`addHTTPMiddleware([...])`) or with the `'*'` wildcard
- * pattern; a specific route pattern (`addHTTPMiddleware('/api/admin/*', [...])`)
- * scopes the middleware to that route and must NOT count as a global stateless
- * registration (#754).
- */
-const isInsideGlobalMiddlewareRegistration = (node) => {
-    let parent = node.parent;
-    while (parent) {
-        if (ts.isCallExpression(parent) && ts.isIdentifier(parent.expression)) {
-            const fn = parent.expression.text;
-            if (fn === 'addGlobalMiddleware')
-                return true;
-            if (fn === 'addHTTPMiddleware') {
-                const first = parent.arguments[0];
-                if (!first)
-                    return false;
-                // String first arg → route pattern (global only when '*'); otherwise
-                // the array form, which is global.
-                return ts.isStringLiteral(first) ? first.text === '*' : true;
-            }
-        }
-        parent = parent.parent;
-    }
-    return false;
-};
 /**
  * Refusal for better-auth's `admin()`, which pikku does not support.
  *
@@ -193,30 +163,6 @@ export const addAuth = (logger, node, _checker, state) => {
     if (!ts.isCallExpression(node))
         return;
     const expression = node.expression;
-    // A user-registered stateless session middleware (custom mapSession) means the
-    // CLI must NOT auto-generate its own default-map one — the generated one runs
-    // first and pre-empts the user's via the `if (session) next()` short-circuit
-    // (pikkujs/pikku#754). Only a GLOBAL registration counts (inside
-    // addHTTPMiddleware/addGlobalMiddleware) — a bare betterAuthStatelessSession()
-    // call (e.g. a test harness) is not a registration. Ignore generated files so
-    // the emitted middleware can't self-trigger the skip.
-    if (ts.isIdentifier(expression) &&
-        expression.text === 'betterAuthStatelessSession' &&
-        !node.getSourceFile().fileName.endsWith('.gen.ts') &&
-        isInsideGlobalMiddlewareRegistration(node)) {
-        state.auth.userStatelessSession = true;
-    }
-    // Same rule for the stateful variant: a user-registered global
-    // betterAuthSession(...) (custom mapSession/impersonation/apiKey) means the CLI
-    // must NOT auto-generate its own default one — the generated one runs first and
-    // pre-empts the user's via the `if (session) next()` short-circuit. Stateful
-    // analogue of the betterAuthStatelessSession skip above.
-    if (ts.isIdentifier(expression) &&
-        expression.text === 'betterAuthSession' &&
-        !node.getSourceFile().fileName.endsWith('.gen.ts') &&
-        isInsideGlobalMiddlewareRegistration(node)) {
-        state.auth.hasUserSessionMiddleware = true;
-    }
     if (!ts.isIdentifier(expression) || expression.text !== 'pikkuBetterAuth')
         return;
     const sourceFile = node.getSourceFile().fileName;

package/dist/add/add-feature-flag.d.ts

@@ -0,0 +1,2 @@
+import type { AddWiring } from '../types.js';
+export declare const addFeatureFlag: AddWiring;