@pikku/inspector 0.12.75 → 0.12.81

package/src/add/add-functions.ts

@@ -1,1548 +0,0 @@
-import * as ts from 'typescript'
-import type { AddWiring, InspectorState, SchemaRef } from '../types.js'
-import { detectSchemaVendorOrError } from '../utils/detect-schema-vendor.js'
-import type { TypesMap } from '../types-map.js'
-import {
-  extractFunctionName,
-  funcIdToTypeName,
-} from '../utils/extract-function-name.js'
-import { extractFunctionNode } from '../utils/extract-function-node.js'
-import { extractUsedWires } from '../utils/extract-services.js'
-import type { AuditDurability } from '@pikku/core/services'
-import type { FunctionServicesMeta } from '@pikku/core/function'
-import type { ScenarioSurface, ScenarioStepKind } from '@pikku/core/scenario'
-import { formatVersionedId, parseVersionedId } from '@pikku/core/utils'
-
-/** Binding keys a `pikkuScenarioStep` may declare, in report order. */
-const SCENARIO_SURFACE_KEYS: readonly ScenarioSurface[] = [
-  'browser',
-  'cli',
-  'default',
-]
-
-/**
- * The step wrappers, and who acts in each.
- *
- * Which function was called *is* the kind. That is the whole reason these are
- * three declarations rather than a `kind:` field on one: a string literal can be
- * copied into an addon package by a consumer, a called identifier cannot.
- */
-const SCENARIO_STEP_KINDS = new Map<string, ScenarioStepKind>([
-  ['pikkuScenarioStep', 'persona'],
-  ['pikkuPlatformScenarioStep', 'platform'],
-  ['pikkuAddonScenarioStep', 'addon'],
-])
-import {
-  getPropertyValue,
-  getArrayPropertyValue,
-  getCommonWireMetaData,
-} from '../utils/get-property-value.js'
-import { canonicalJSON, hashString } from '../utils/hash.js'
-import { resolveMiddleware } from '../utils/middleware.js'
-import { resolvePermissions } from '../utils/permissions.js'
-import { extractWireNames } from '../utils/post-process.js'
-import { ErrorCode } from '../error-codes.js'
-import { findPiiPaths } from '../utils/check-pii-output.js'
-import { findClassifiedSinks } from '../utils/check-classified-sinks.js'
-import { isScenarioInstrumentationFunction } from './scenario-instrumentation.js'
-import type { NodeType } from '@pikku/core/node'
-
-const isValidVariableName = (name: string) => {
-  const regex = /^[a-zA-Z_$][a-zA-Z0-9_$]*$/
-  return regex.test(name)
-}
-
-/**
- * True when the handler body contains a runtime dynamic `import(...)` call
- * anywhere (including nested callbacks). Type-only positions like
- * `import('x').Foo` are `ImportTypeNode`s, not `CallExpression`s with an
- * `ImportKeyword` callee, so they are intentionally not matched.
- */
-const handlerHasDynamicImport = (
-  handler: ts.ArrowFunction | ts.FunctionExpression
-): boolean => {
-  let found = false
-  const visit = (node: ts.Node) => {
-    if (found) {
-      return
-    }
-    if (
-      ts.isCallExpression(node) &&
-      node.expression.kind === ts.SyntaxKind.ImportKeyword
-    ) {
-      found = true
-      return
-    }
-    ts.forEachChild(node, visit)
-  }
-  visit(handler.body)
-  return found
-}
-
-const nullifyTypes = (type: string | null) => {
-  if (
-    type === 'void' ||
-    type === 'undefined' ||
-    type === 'unknown' ||
-    type === 'any' ||
-    type === 'null'
-  ) {
-    return null
-  }
-  return type
-}
-
-const resolveTypeImports = (
-  type: ts.Type,
-  resolvedTypes: TypesMap,
-  isCustom: boolean,
-  checker: ts.TypeChecker
-): string[] => {
-  const types: string[] = []
-
-  const visitType = (currentType: ts.Type) => {
-    const symbol = currentType.aliasSymbol || currentType.getSymbol()
-
-    if (symbol) {
-      const declarations = symbol.getDeclarations()
-      const declaration = declarations?.[0]
-      if (declaration) {
-        const sourceFile = declaration.getSourceFile()
-        const path = sourceFile.fileName
-
-        // Skip built-in utility types or TypeScript lib types
-        // Skip enum members (but not the enum type itself)
-        const isEnumMember = declaration && ts.isEnumMember(declaration)
-
-        if (
-          !path.includes('node_modules/typescript') &&
-          symbol.getName() !== '__type' &&
-          !isPrimitiveType(currentType) &&
-          !isEnumMember
-        ) {
-          const originalName = symbol.getName()
-          // Check if the type is already in the map
-          let uniqueName = resolvedTypes.exists(originalName, path)
-          if (!uniqueName) {
-            if (isCustom) {
-              uniqueName = resolvedTypes.addUniqueType(originalName, path)
-            } else {
-              resolvedTypes.addType(originalName, path)
-              uniqueName = originalName
-            }
-          }
-          types.push(uniqueName)
-        }
-      }
-    }
-
-    if (isCustom) {
-      // Handle nested utility types like Partial, Pick, etc.
-      if (currentType.aliasTypeArguments) {
-        currentType.aliasTypeArguments.forEach(visitType)
-      }
-
-      // Handle intersections and unions
-      if (currentType.isUnionOrIntersection()) {
-        currentType.types.forEach(visitType)
-      }
-
-      // Handle object types with type arguments
-      if (
-        currentType.flags & ts.TypeFlags.Object &&
-        (currentType as ts.ObjectType).objectFlags & ts.ObjectFlags.Reference
-      ) {
-        const typeRef = currentType as ts.TypeReference
-        typeRef.typeArguments?.forEach(visitType)
-      }
-    }
-
-    // Always traverse type arguments for thorough type collection
-    if (currentType.aliasTypeArguments) {
-      currentType.aliasTypeArguments.forEach(visitType)
-    }
-
-    // Always handle intersections and unions
-    if (currentType.isUnionOrIntersection()) {
-      currentType.types.forEach(visitType)
-    }
-
-    // Always handle object types with type arguments
-    if (
-      currentType.flags & ts.TypeFlags.Object &&
-      (currentType as ts.ObjectType).objectFlags & ts.ObjectFlags.Reference
-    ) {
-      const typeRef = currentType as ts.TypeReference
-      typeRef.typeArguments?.forEach(visitType)
-    }
-
-    // Handle anonymous object types with enum properties (e.g., { userType: UserType })
-    // Only traverse into enum property types to avoid over-importing other named types
-    if (currentType.flags & ts.TypeFlags.Object) {
-      const objectType = currentType as ts.ObjectType
-      const typeSymbol = objectType.getSymbol()
-
-      // Only traverse properties for anonymous object types (no symbol or __type symbol)
-      // Skip named types, interfaces, and enums to avoid over-importing
-      const isAnonymousObject = !typeSymbol || typeSymbol.getName() === '__type'
-
-      if (isAnonymousObject) {
-        const properties = objectType.getProperties()
-        for (const prop of properties) {
-          if (prop.valueDeclaration) {
-            const propType = checker.getTypeOfSymbolAtLocation(
-              prop,
-              prop.valueDeclaration
-            )
-            if (propType) {
-              visitType(propType)
-            }
-          }
-        }
-      }
-    }
-  }
-
-  visitType(type)
-  return types
-}
-
-const resolveUnionTypes = (
-  checker: ts.TypeChecker,
-  type: ts.Type
-): { types: ts.Type[]; names: string[] } => {
-  const types: ts.Type[] = []
-  const names: string[] = []
-
-  // Check if it's a union type AND not part of an intersection
-  if (type.isUnion() && !(type.flags & ts.TypeFlags.Intersection)) {
-    for (const t of type.types) {
-      const name = nullifyTypes(
-        checker.typeToString(t, undefined, ts.TypeFormatFlags.NoTruncation)
-      )
-      if (name) {
-        types.push(t)
-        names.push(name)
-      }
-    }
-  } else {
-    const name = nullifyTypes(
-      checker.typeToString(type, undefined, ts.TypeFormatFlags.NoTruncation)
-    )
-    if (name) {
-      types.push(type)
-      names.push(name)
-    }
-  }
-
-  return { types, names }
-}
-
-const getNamesAndTypes = (
-  checker: ts.TypeChecker,
-  typesMap: TypesMap,
-  direction: 'Input' | 'Output',
-  funcName: string,
-  type?: ts.Type
-) => {
-  if (!type) {
-    return { names: [], types: [] }
-  }
-
-  // 1) Handle an explicit void (or undefined or null) type up front
-  if (type.flags & (ts.TypeFlags.VoidLike | ts.TypeFlags.Null)) {
-    return {
-      names: [],
-      types: [],
-    }
-  }
-
-  // 2) For unions, resolve all member names/types
-  const { names: rawNames, types: rawTypes } = resolveUnionTypes(checker, type)
-
-  // If the union is exactly [void], we'd have caught it above.
-  // If it's e.g. [string, void], rawNames should already include 'void'.
-
-  // 3) If multiple names or the single name isn't a valid identifier,
-  //    we emit an alias type.
-  const firstName = rawNames[0]
-  if (rawNames.length > 1 || (firstName && !isValidVariableName(firstName))) {
-    const aliasType = rawNames.join(' | ')
-    const aliasName = funcIdToTypeName(funcName) + direction
-
-    // record the alias in your TypesMap
-    const references = rawTypes.flatMap((t) =>
-      resolveTypeImports(t, typesMap, true, checker)
-    )
-
-    typesMap.addCustomType(aliasName, aliasType, references)
-
-    return {
-      names: [aliasName],
-      types: rawTypes,
-    }
-  }
-
-  // 4) Single, valid name → inline it
-  const uniqueNames = rawNames.flatMap((name, i) => {
-    const t = rawTypes[i]
-    if (!t) {
-      throw new Error(`Expected type for name "${name}" in ${funcName}`)
-    }
-    if (isPrimitiveType(t)) {
-      return name
-    }
-    // non-primitive: import/alias it inline
-    return resolveTypeImports(t, typesMap, false, checker)
-  })
-
-  return {
-    names: uniqueNames,
-    types: rawTypes,
-  }
-}
-
-const isPrimitiveType = (type: ts.Type): boolean => {
-  const primitiveFlags =
-    ts.TypeFlags.Number |
-    ts.TypeFlags.String |
-    ts.TypeFlags.Boolean |
-    ts.TypeFlags.BigInt |
-    ts.TypeFlags.ESSymbol |
-    ts.TypeFlags.Void |
-    ts.TypeFlags.Undefined |
-    ts.TypeFlags.Null |
-    ts.TypeFlags.Unknown |
-    ts.TypeFlags.VoidLike
-
-  return (type.flags & primitiveFlags) !== 0
-}
-
-/**
- * If `type` is a `Promise<T>`, return `T`, otherwise return `type` itself.
- */
-function unwrapPromise(checker: ts.TypeChecker, type: ts.Type): ts.Type {
-  if (!type?.symbol) return type
-
-  const isPromise =
-    type.symbol.name === 'Promise' &&
-    checker.getFullyQualifiedName(type.symbol).includes('Promise')
-
-  // aliasTypeArguments covers most Promise<T> cases
-  if (isPromise && type.aliasTypeArguments?.length === 1) {
-    return type.aliasTypeArguments[0]!
-  }
-
-  // fallback for raw TypeReference
-  if (isPromise && (type as ts.TypeReference).typeArguments?.length === 1) {
-    return (type as ts.TypeReference).typeArguments![0]!
-  }
-
-  return type
-}
-
-const resolveExistingFunctionSource = (
-  state: InspectorState,
-  pikkuFuncId: string
-): string | null => {
-  return (
-    state.functions.meta[pikkuFuncId]?.sourceFile ||
-    state.rpc.internalFiles.get(pikkuFuncId)?.path ||
-    null
-  )
-}
-
-const areCompatibleFunctionIds = (
-  existingId: string,
-  incomingId: string
-): boolean => {
-  if (existingId === incomingId) {
-    return true
-  }
-
-  const existingParsed = parseVersionedId(existingId)
-  const incomingParsed = parseVersionedId(incomingId)
-
-  return existingParsed.baseName === incomingParsed.baseName
-}
-
-function printNode(node: ts.Node): string {
-  return ts
-    .createPrinter({ removeComments: true })
-    .printNode(ts.EmitHint.Unspecified, node, node.getSourceFile())
-}
-
-function computeImplementationHash(args: {
-  wrapper: string
-  handler: ts.ArrowFunction | ts.FunctionExpression
-  objectNode?: ts.ObjectLiteralExpression
-  isDirectFunction: boolean
-}): string {
-  const { wrapper, handler, objectNode, isDirectFunction } = args
-  return hashString(
-    canonicalJSON({
-      wrapper,
-      isDirectFunction,
-      handler: printNode(handler),
-      config: objectNode ? printNode(objectNode) : null,
-    })
-  )
-}
-
-/**
- * Registers a `pikkuRemoteChannelFunc` declaration: a name, its schemas and its
- * description, with no body to inspect. The name has to reach `rpc.internalMeta`
- * for `channel.remote` to resolve the schemas it validates each call against.
- */
-const addRemoteChannelFunc = ({
-  state,
-  logger,
-  node,
-  pikkuFuncId,
-  name,
-  exportedName,
-  inputSchemaRef,
-  outputSchemaRef,
-  meta,
-}: {
-  state: InspectorState
-  logger: Parameters<AddWiring>[0]
-  node: ts.CallExpression
-  pikkuFuncId: string
-  name: string
-  exportedName?: string | null
-  inputSchemaRef: SchemaRef | null
-  outputSchemaRef: SchemaRef | null
-  meta: {
-    version?: number
-    title?: string
-    tags?: string[]
-    summary?: string
-    description?: string
-    errors?: string[]
-  }
-}) => {
-  const sourceFile = node.getSourceFile().fileName
-
-  if (!exportedName) {
-    logger.error(
-      `• Remote channel function '${name}' is not exported, this is not allowed.`
-    )
-    return
-  }
-
-  // Two files declaring the same capability is the collision that matters:
-  // both ids are the bare name, so the id-compatibility check below reads them
-  // as the same function and lets the second overwrite the first.
-  const existingFunction = state.functions.meta[pikkuFuncId]
-  if (
-    existingFunction &&
-    existingFunction.sourceFile &&
-    existingFunction.sourceFile !== sourceFile
-  ) {
-    logger.critical(
-      ErrorCode.DUPLICATE_FUNCTION_NAME,
-      `Function name '${name}' is not unique. ` +
-        `'${pikkuFuncId}' is already defined in '${existingFunction.sourceFile}' and cannot be redefined in '${sourceFile}'.`
-    )
-    return
-  }
-
-  const existing = state.rpc.internalMeta[name]
-  if (existing && !areCompatibleFunctionIds(existing, pikkuFuncId)) {
-    logger.critical(
-      ErrorCode.DUPLICATE_FUNCTION_NAME,
-      `Function name '${name}' is not unique. ` +
-        `It already points to '${existing}' in '${resolveExistingFunctionSource(state, existing) || 'unknown file'}', but '${pikkuFuncId}' in '${sourceFile}' tried to use the same name.`
-    )
-    return
-  }
-
-  const capitalizedName = funcIdToTypeName(name)
-  const registerSchema = (
-    ref: SchemaRef | null,
-    suffix: 'Input' | 'Output'
-  ) => {
-    if (!ref) return null
-    const schemaName = `${capitalizedName}${suffix}`
-    state.schemaLookup.set(schemaName, ref)
-    state.functions.typesMap.addCustomType(schemaName, 'unknown', [])
-    return schemaName
-  }
-  const inputSchemaName = registerSchema(inputSchemaRef, 'Input')
-  const outputSchemaName = registerSchema(outputSchemaRef, 'Output')
-
-  state.functions.meta[pikkuFuncId] = {
-    pikkuFuncId,
-    functionType: 'remote',
-    funcWrapper: 'pikkuRemoteChannelFunc',
-    sessionless: true,
-    name,
-    services: { optimized: true, services: [] },
-    inputSchemaName,
-    outputSchemaName,
-    inputs: inputSchemaName ? [inputSchemaName] : [],
-    outputs: outputSchemaName ? [outputSchemaName] : [],
-    sourceFile,
-    exportedName,
-    ...meta,
-  }
-
-  state.functions.files.set(pikkuFuncId, { path: sourceFile, exportedName })
-  state.rpc.internalMeta[name] = pikkuFuncId
-  // Imported so a local call gets the factory's "this runs on the client"
-  // error rather than a bare lookup miss.
-  state.rpc.internalFiles.set(pikkuFuncId, { path: sourceFile, exportedName })
-}
-
-/**
- * Inspect pikkuFunc calls, extract input/output and first-arg destructuring,
- * then push into state.functions.meta.
- */
-export const addFunctions: AddWiring = (
-  logger,
-  node,
-  checker,
-  state,
-  options
-) => {
-  if (!ts.isCallExpression(node)) return
-
-  const { expression, arguments: args, typeArguments } = node
-
-  // only handle calls like pikkuFunc(...)
-  if (!ts.isIdentifier(expression)) {
-    return
-  }
-
-  // Match identifiers that contain both "pikku" and "func" (case insensitive),
-  // plus pikkuScenario and the three scenario step wrappers (workflow wrappers
-  // without "func" in their names)
-  const pikkuFuncPattern = /pikku.*func/i
-  if (
-    !pikkuFuncPattern.test(expression.text) &&
-    expression.text !== 'pikkuScenario' &&
-    !SCENARIO_STEP_KINDS.has(expression.text)
-  ) {
-    return
-  }
-
-  // A scenario step is bundled like any invoked function, but is deliberately
-  // never RPC-registered: a step may drive a browser, so exposing it over the
-  // network would put a test harness on the public API surface.
-  const scenarioStepKind = SCENARIO_STEP_KINDS.get(expression.text)
-  const isScenarioStep = scenarioStepKind !== undefined
-
-  // A scenario's own body. Marked so the codegen partitions and the deploy
-  // analyzer can tell it apart from an application workflow without having to
-  // reach into the workflow graph.
-  const isScenario = expression.text === 'pikkuScenario'
-
-  // only handle calls like pikkuFunc(...)
-  if (!ts.isIdentifier(expression) || !expression.text.startsWith('pikku')) {
-    return
-  }
-
-  if (args.length === 0) return
-
-  let { pikkuFuncId, name, explicitName, exportedName } = extractFunctionName(
-    node,
-    checker,
-    state.rootDir
-  )
-
-  if (!pikkuFuncId || pikkuFuncId.startsWith('__temp_')) {
-    return
-  }
-
-  // pikku's own scenario instrumentation, which older projects still carry as a
-  // scaffolded file in their source. It is not application code and must not be
-  // registered, metadata'd or deployed as if it were — `pikku dev` registers the
-  // implementations itself, and that is the only server that should have them.
-  if (
-    isScenarioInstrumentationFunction(pikkuFuncId) ||
-    isScenarioInstrumentationFunction(name)
-  ) {
-    return
-  }
-
-  let title: string | undefined
-  let tags: string[] | undefined
-  let summary: string | undefined
-  let description: string | undefined
-  let errors: string[] | undefined
-  let expose: boolean | undefined
-  let remote: boolean | undefined
-  let mcp: boolean | undefined
-  /**
-   * A sessionless function's own `auth: true`. `sessionless` records the
-   * baseline — a `pikkuFunc` always needs a session — while this records the
-   * tightening a `pikkuSessionlessFunc` applies to itself, which is otherwise
-   * invisible to anything reading meta.
-   */
-  let auth: boolean | undefined
-  /** The author's claim that the body authorizes its own callers. */
-  let permissionsInBody: boolean | undefined
-  /** The function's `audit` config, resolved to its object form. */
-  let audit: { durability: AuditDurability } | undefined
-  let readonly_: boolean | undefined
-  let deploy: 'serverless' | 'server' | 'auto' | undefined
-  let approvalRequired: boolean | undefined
-  let approvalDescription: string | undefined
-  let workflowQueued: boolean | undefined
-  let workflowRetries: number | undefined
-  let workflowTimeout: string | undefined
-  let scenarioStepSurfaces: ScenarioSurface[] | undefined
-  let scenarioStepRequiresActor: boolean | undefined
-  let scenarioStepAddon: string | undefined
-  let scenarioStepTemplate: string | undefined
-  let scopes: string[] | undefined
-  let version: number | undefined
-  let objectNode: ts.ObjectLiteralExpression | undefined
-  let nodeDisplayName: string | null = null
-  let nodeCategory: string | null = null
-  let nodeType: NodeType | null = null
-  let nodeErrorOutput: boolean | null = null
-
-  // Extract the function node using shared utility
-  const firstArg = args[0]!
-  const {
-    funcNode: handlerNode,
-    resolvedFunc,
-    isDirectFunction,
-  } = extractFunctionNode(firstArg, checker)
-
-  // Variables to hold schema references if provided
-  let inputSchemaRef: SchemaRef | null = null
-  let outputSchemaRef: SchemaRef | null = null
-
-  // Helper to resolve schema identifier to its actual source file and detect vendor.
-  // Logs a fatal error and returns null if vendor cannot be determined.
-  const resolveSchemaRef = (
-    identifier: ts.Identifier,
-    context: string
-  ): SchemaRef | null => {
-    const symbol = checker.getSymbolAtLocation(identifier)
-    if (!symbol) return null
-
-    const decl = symbol.valueDeclaration || symbol.declarations?.[0]
-    if (!decl) return null
-
-    let sourceFile: string
-
-    // If it's an import specifier, resolve the aliased symbol to get the actual source
-    if (ts.isImportSpecifier(decl)) {
-      const aliasedSymbol = checker.getAliasedSymbol(symbol)
-      if (aliasedSymbol) {
-        const aliasedDecl =
-          aliasedSymbol.valueDeclaration || aliasedSymbol.declarations?.[0]
-        if (aliasedDecl) {
-          sourceFile = aliasedDecl.getSourceFile().fileName
-        } else {
-          return null
-        }
-      } else {
-        return null
-      }
-    } else {
-      sourceFile = decl.getSourceFile().fileName
-    }
-
-    const vendor = detectSchemaVendorOrError(
-      identifier,
-      checker,
-      logger,
-      context,
-      sourceFile
-    )
-    if (!vendor) return null
-
-    return {
-      variableName: identifier.text,
-      sourceFile,
-      vendor,
-    }
-  }
-
-  // Extract config properties if using object form
-  if (ts.isObjectLiteralExpression(firstArg)) {
-    objectNode = firstArg
-    const metadata = getCommonWireMetaData(
-      firstArg,
-      'Function',
-      name,
-      logger,
-      checker
-    )
-    if (metadata.disabled) return
-    title = metadata.title
-    tags = metadata.tags
-    summary = metadata.summary
-    description = metadata.description
-    errors = metadata.errors
-    expose = getPropertyValue(firstArg, 'expose') as boolean | undefined
-    remote = getPropertyValue(firstArg, 'remote') as boolean | undefined
-    mcp = getPropertyValue(firstArg, 'mcp') as boolean | undefined
-    auth = getPropertyValue(firstArg, 'auth') as boolean | undefined
-    permissionsInBody = getPropertyValue(firstArg, 'permissionsInBody') as
-      boolean | undefined
-    if (permissionsInBody && !options.allow?.permissionsInBody) {
-      logger.critical(
-        ErrorCode.PERMISSIONS_IN_BODY_NOT_ALLOWED,
-        `'${name}' declares \`permissionsInBody: true\`, which this project has not enabled. ` +
-          `It silences the exposed-and-ungated audit without gating anything, so it is opt-in: ` +
-          `set \`allow: { permissionsInBody: true }\` in pikku.config.json if the project accepts ` +
-          `permission checks that only a reader can verify. Otherwise express the check as a ` +
-          `\`permissions\` entry, or drop \`expose: true\` if the function was not meant to be ` +
-          `callable from outside.`
-      )
-      return
-    }
-    // `audit` is either `true` or `{ durability }`, so it needs the nested read:
-    // getPropertyValue stringifies an object initializer rather than parsing it.
-    // Mirrors core's `resolveAuditConfig` — the two must agree, or meta would
-    // claim a durability the runner does not use.
-    const auditProp = firstArg.properties.find(
-      (p) =>
-        ts.isPropertyAssignment(p) &&
-        ts.isIdentifier(p.name) &&
-        p.name.text === 'audit'
-    )
-    if (auditProp && ts.isPropertyAssignment(auditProp)) {
-      const auditInit = auditProp.initializer
-      if (auditInit.kind === ts.SyntaxKind.TrueKeyword) {
-        audit = { durability: 'best-effort' }
-      } else if (ts.isObjectLiteralExpression(auditInit)) {
-        const durability = getPropertyValue(
-          auditInit,
-          'durability'
-        ) as AuditDurability | null
-        audit = { durability: durability ?? 'best-effort' }
-      }
-    }
-    readonly_ = getPropertyValue(firstArg, 'readonly') as boolean | undefined
-    deploy = getPropertyValue(firstArg, 'deploy') as
-      'serverless' | 'server' | 'auto' | undefined
-    approvalRequired = getPropertyValue(firstArg, 'approvalRequired') as
-      boolean | undefined
-    workflowQueued = getPropertyValue(firstArg, 'workflowQueued') as
-      boolean | undefined
-    workflowRetries = getPropertyValue(firstArg, 'workflowRetries') as
-      number | undefined
-    workflowTimeout = getPropertyValue(firstArg, 'workflowTimeout') as
-      string | undefined
-    // A step declares one implementation per surface it supports; the binding
-    // keys that are present ARE the declaration, so there is nothing to read a
-    // value from — only names to collect.
-    const declaredSurfaces = SCENARIO_SURFACE_KEYS.filter((surface) =>
-      firstArg.properties.some(
-        (prop) =>
-          (ts.isPropertyAssignment(prop) ||
-            ts.isMethodDeclaration(prop) ||
-            ts.isShorthandPropertyAssignment(prop)) &&
-          ts.isIdentifier(prop.name) &&
-          prop.name.text === surface
-      )
-    )
-    if (scenarioStepKind === 'platform' || scenarioStepKind === 'addon') {
-      // Neither kind has surfaces. Nobody clicks "Stripe's webhook arrives", and
-      // there is no human behind "the platform has expired the trial" — so both
-      // take a single `func`, and a binding key here is a coded error rather
-      // than a convention nobody reads.
-      if (declaredSurfaces.length > 0) {
-        logger.error(
-          `• ${expression.text}('${name}') declares ${declaredSurfaces.join('/')} — a ${scenarioStepKind} step has one implementation, declared as \`func\`. Surfaces are how a person drives the system, and nobody drives this one.`
-        )
-        return
-      }
-      // The phase rule depends on it: an assertion runs every witness it has and
-      // fails if they disagree, so a step with exactly one witness by
-      // construction has to be unable to look like it has several.
-      scenarioStepSurfaces = ['default']
-      if (scenarioStepKind === 'addon') {
-        scenarioStepAddon = getPropertyValue(firstArg, 'addon') as
-          string | undefined
-        if (!scenarioStepAddon) {
-          logger.error(
-            `• pikkuAddonScenarioStep('${name}') needs a string literal \`addon\` naming the addon whose system acts — the same name its wireAddon declares.`
-          )
-          return
-        }
-      }
-    } else {
-      scenarioStepSurfaces = declaredSurfaces.length
-        ? declaredSurfaces
-        : undefined
-      // A browser binding cannot be provisioned without a window to open, so it
-      // requires an actor whether or not the step said so.
-      scenarioStepRequiresActor =
-        getPropertyValue(firstArg, 'actor') === true ||
-        declaredSurfaces.includes('browser')
-          ? true
-          : undefined
-    }
-    scenarioStepTemplate = getPropertyValue(firstArg, 'template') as
-      string | undefined
-    scopes = getArrayPropertyValue(firstArg, 'scopes') ?? undefined
-
-    // Extract approvalDescription identifier reference
-    for (const prop of firstArg.properties) {
-      if (
-        ts.isPropertyAssignment(prop) &&
-        ts.isIdentifier(prop.name) &&
-        prop.name.text === 'approvalDescription' &&
-        ts.isIdentifier(prop.initializer)
-      ) {
-        const { pikkuFuncId: descId } = extractFunctionName(
-          prop.initializer,
-          checker,
-          state.rootDir
-        )
-        if (descId && !descId.startsWith('__temp_')) {
-          approvalDescription = descId
-        } else {
-          // Try resolving the identifier directly
-          approvalDescription = prop.initializer.text
-        }
-        break
-      }
-    }
-
-    const versionRaw = getPropertyValue(firstArg, 'version')
-    if (versionRaw !== null && versionRaw !== undefined) {
-      const parsed = Number(versionRaw)
-      if (Number.isInteger(parsed) && parsed >= 1) {
-        version = parsed
-      }
-    }
-
-    // Extract node config from nested object
-    for (const prop of firstArg.properties) {
-      if (
-        ts.isPropertyAssignment(prop) &&
-        ts.isIdentifier(prop.name) &&
-        prop.name.text === 'node' &&
-        ts.isObjectLiteralExpression(prop.initializer)
-      ) {
-        const nodeObj = prop.initializer
-        nodeDisplayName = getPropertyValue(nodeObj, 'displayName') as
-          string | null
-        nodeCategory = getPropertyValue(nodeObj, 'category') as string | null
-        nodeType = getPropertyValue(nodeObj, 'type') as NodeType | null
-        nodeErrorOutput = getPropertyValue(nodeObj, 'errorOutput') as
-          boolean | null
-
-        if (!nodeDisplayName) {
-          logger.critical(
-            ErrorCode.MISSING_NAME,
-            `Function '${name}' node config is missing the required 'displayName' property.`
-          )
-        }
-        if (!nodeCategory) {
-          logger.critical(
-            ErrorCode.MISSING_NAME,
-            `Function '${name}' node config is missing the required 'category' property.`
-          )
-        }
-        if (!nodeType) {
-          logger.critical(
-            ErrorCode.MISSING_NAME,
-            `Function '${name}' node config is missing the required 'type' property.`
-          )
-        } else if (!['trigger', 'action', 'end'].includes(nodeType)) {
-          logger.critical(
-            ErrorCode.INVALID_VALUE,
-            `Function '${name}' node config has invalid type '${nodeType}'. Must be 'trigger', 'action', or 'end'.`
-          )
-        }
-        break
-      }
-    }
-
-    // Extract schema variable names from input/output properties
-    for (const prop of firstArg.properties) {
-      if (ts.isPropertyAssignment(prop) && ts.isIdentifier(prop.name)) {
-        const propName = prop.name.text
-        if (propName === 'input' || propName === 'output') {
-          if (ts.isIdentifier(prop.initializer)) {
-            // Good - it's a variable reference, resolve its actual source file and vendor
-            const context = `Function '${name}' ${propName}`
-            const ref = resolveSchemaRef(prop.initializer, context)
-            if (ref) {
-              if (propName === 'input') {
-                inputSchemaRef = ref
-              } else {
-                outputSchemaRef = ref
-              }
-            }
-          } else if (ts.isCallExpression(prop.initializer)) {
-            // Bad - it's an inline expression
-            const schemaName = `${funcIdToTypeName(name)}${propName.charAt(0).toUpperCase() + propName.slice(1)}`
-            logger.critical(
-              ErrorCode.INLINE_SCHEMA,
-              `Inline schemas are not supported for '${propName}' in '${name}'.\n` +
-                `  Extract to an exported variable:\n` +
-                `    export const ${schemaName} = ${prop.initializer.getText()}\n` +
-                `  Then use: ${propName}: ${schemaName}`
-            )
-          }
-        }
-      }
-    }
-  }
-
-  if (version !== undefined) {
-    let baseName = explicitName || exportedName || pikkuFuncId
-    // Strip trailing VN suffix if it matches the version (e.g. getDataV1 + version:1 → getData@v1)
-    const vSuffix = `V${version}`
-    if (baseName.endsWith(vSuffix) && baseName.length > vSuffix.length) {
-      baseName = baseName.slice(0, -vSuffix.length)
-    }
-    pikkuFuncId = formatVersionedId(baseName, version)
-  }
-
-  // A remote channel capability is a contract with no body: the connected
-  // client answers it. Everything past this point reads the handler, so it gets
-  // its own path rather than a nullable handler threaded through all of it.
-  if (expression.text === 'pikkuRemoteChannelFunc') {
-    addRemoteChannelFunc({
-      state,
-      logger,
-      node,
-      pikkuFuncId,
-      name,
-      exportedName,
-      inputSchemaRef,
-      outputSchemaRef,
-      meta: { version, title, tags, summary, description, errors },
-    })
-    return
-  }
-
-  const isMCPToolFunc = expression.text === 'pikkuMCPToolFunc'
-  const isListFunc = expression.text === 'pikkuListFunc'
-  const mcpEnabled = mcp || isMCPToolFunc
-
-  // Pick the handler: use resolvedFunc when it exists and is a function, otherwise fall back to handlerNode
-  const handler =
-    resolvedFunc &&
-    (ts.isArrowFunction(resolvedFunc) || ts.isFunctionExpression(resolvedFunc))
-      ? resolvedFunc
-      : handlerNode
-
-  // Validate that we got a valid function
-  if (!ts.isArrowFunction(handler) && !ts.isFunctionExpression(handler)) {
-    logger.error(`• No valid 'func' property found for ${pikkuFuncId}.`)
-    // Create stub metadata to prevent "function not found" errors in wirings
-    state.functions.meta[pikkuFuncId] = {
-      pikkuFuncId,
-      functionType: 'user',
-      name,
-      services: { optimized: false, services: [] },
-      inputSchemaName: null,
-      outputSchemaName: null,
-      inputs: [],
-      outputs: [],
-      middleware: undefined,
-    }
-    return
-  }
-
-  const services: FunctionServicesMeta = {
-    optimized: true,
-    services: [],
-  }
-
-  const firstParam = handler.parameters[0]
-  if (firstParam) {
-    if (ts.isObjectBindingPattern(firstParam.name)) {
-      for (const elem of firstParam.name.elements) {
-        const original =
-          elem.propertyName && ts.isIdentifier(elem.propertyName)
-            ? elem.propertyName.text
-            : ts.isIdentifier(elem.name)
-              ? elem.name.text
-              : undefined
-        if (original) {
-          services.services.push(original)
-        }
-      }
-    } else if (
-      ts.isIdentifier(firstParam.name) &&
-      !firstParam.name.text.startsWith('_')
-    ) {
-      services.optimized = false
-    }
-  }
-
-  const wires = extractUsedWires(handler, 2)
-
-  // --- Generics → ts.Type[], unwrapped from Promise ---
-  const genericTypes: ts.Type[] = (typeArguments ?? [])
-    .map((tn) => checker.getTypeFromTypeNode(tn))
-    .map((t) => unwrapPromise(checker, t))
-
-  // pikkuChannelConnectionFunc<Out> declares a single generic that is the
-  // OUTPUT type — its input is always void (PikkuFunctionSessionless<void, Out>).
-  // Every other wrapper reads generic[0] as INPUT, so without this guard the
-  // connect handler's output generic is mis-recorded as inputSchemaName and the
-  // empty WS handshake fails input validation at connect (1008/403).
-  const isChannelConnectionFunc = /ChannelConnection/i.test(expression.text)
-
-  const capitalizedName = funcIdToTypeName(name)
-
-  // --- Input Extraction ---
-  let inputNames: string[] = []
-  let inputTypes: ts.Type[] = []
-
-  if (inputSchemaRef) {
-    const schemaName = `${capitalizedName}Input`
-    inputNames = [schemaName]
-    state.schemaLookup.set(schemaName, inputSchemaRef)
-    state.functions.typesMap.addCustomType(schemaName, 'unknown', [])
-  } else if (isListFunc && genericTypes.length >= 1 && genericTypes[0]) {
-    const inputAliasName = `${capitalizedName}Input`
-    const filterType = genericTypes[0]
-    const filterTypeText = checker.typeToString(
-      filterType,
-      undefined,
-      ts.TypeFormatFlags.NoTruncation
-    )
-    const refs = resolveTypeImports(
-      filterType,
-      state.functions.typesMap,
-      true,
-      checker
-    )
-    state.functions.typesMap.addCustomType(
-      inputAliasName,
-      `{ cursor?: string; limit?: number; sort?: Array<{ column: string; direction: 'asc' | 'desc' }>; filter?: unknown; search?: string; } & ${filterTypeText}`,
-      [...new Set(refs)]
-    )
-    inputNames = [inputAliasName]
-    const secondParam = handler.parameters[1]
-    if (secondParam) {
-      inputTypes = [checker.getTypeAtLocation(secondParam)]
-    } else {
-      inputTypes = [filterType]
-    }
-  } else if (
-    !isChannelConnectionFunc &&
-    !isListFunc &&
-    genericTypes.length >= 1 &&
-    genericTypes[0]
-  ) {
-    // Fall back to extracting from generic type arguments
-    const result = getNamesAndTypes(
-      checker,
-      state.functions.typesMap,
-      'Input',
-      name,
-      genericTypes[0]
-    )
-    inputNames = result.names
-    inputTypes = result.types
-  } else {
-    // Fall back to extracting from the function's second parameter type
-    const secondParam = handler.parameters[1]
-    if (secondParam) {
-      const paramType = checker.getTypeAtLocation(secondParam)
-      const result = getNamesAndTypes(
-        checker,
-        state.functions.typesMap,
-        'Input',
-        pikkuFuncId,
-        paramType
-      )
-      inputNames = result.names
-      inputTypes = result.types
-    }
-  }
-
-  // --- Output Extraction ---
-  let outputNames: string[] = []
-
-  if (outputSchemaRef) {
-    const schemaName = `${capitalizedName}Output`
-    outputNames = [schemaName]
-    state.schemaLookup.set(schemaName, outputSchemaRef)
-    state.functions.typesMap.addCustomType(schemaName, 'unknown', [])
-  } else if (isListFunc && genericTypes.length >= 2 && genericTypes[1]) {
-    const outputAliasName = `${capitalizedName}Output`
-    const rowType = genericTypes[1]
-    const rowTypeText = checker.typeToString(
-      rowType,
-      undefined,
-      ts.TypeFormatFlags.NoTruncation
-    )
-    const refs = resolveTypeImports(
-      rowType,
-      state.functions.typesMap,
-      true,
-      checker
-    )
-    state.functions.typesMap.addCustomType(
-      outputAliasName,
-      `{ rows: Array<${rowTypeText}>; nextCursor: string | null; totalCount?: number; }`,
-      [...new Set(refs)]
-    )
-    outputNames = [outputAliasName]
-  } else if (!isListFunc && genericTypes.length >= 2) {
-    outputNames = getNamesAndTypes(
-      checker,
-      state.functions.typesMap,
-      'Output',
-      name,
-      genericTypes[1]
-    ).names
-  } else {
-    const sig = checker.getSignatureFromDeclaration(handler)
-    if (sig) {
-      const rawRet = checker.getReturnTypeOfSignature(sig)
-      const unwrapped = unwrapPromise(checker, rawRet)
-      outputNames = getNamesAndTypes(
-        checker,
-        state.functions.typesMap,
-        'Output',
-        pikkuFuncId,
-        unwrapped
-      ).names
-    }
-  }
-
-  const mcpOutputTypes: Record<string, string> = {
-    pikkuMCPResourceFunc: 'MCPResourceResponse',
-    pikkuMCPToolFunc: 'MCPToolResponse',
-    pikkuMCPPromptFunc: 'MCPPromptResponse',
-  }
-  const mcpOutputType = mcpOutputTypes[expression.text]
-  if (mcpOutputType && outputNames[0] !== mcpOutputType) {
-    let resolved = false
-    const rawSymbol = checker.getSymbolAtLocation(expression)
-    const funcSymbol =
-      rawSymbol && rawSymbol.flags & ts.SymbolFlags.Alias
-        ? checker.getAliasedSymbol(rawSymbol)
-        : rawSymbol
-    const funcDecls = funcSymbol?.getDeclarations() || []
-    for (const funcDecl of funcDecls) {
-      if (resolved) break
-      const mcpTypeSymbol = checker.resolveName(
-        mcpOutputType,
-        funcDecl,
-        ts.SymbolFlags.Type,
-        false
-      )
-      if (mcpTypeSymbol) {
-        const aliased =
-          mcpTypeSymbol.flags & ts.SymbolFlags.Alias
-            ? checker.getAliasedSymbol(mcpTypeSymbol)
-            : mcpTypeSymbol
-        const typeDecl = aliased?.getDeclarations()?.[0]
-        if (typeDecl) {
-          const path = typeDecl.getSourceFile().fileName
-          if (!state.functions.typesMap.exists(mcpOutputType, path)) {
-            state.functions.typesMap.addType(mcpOutputType, path)
-          }
-          resolved = true
-        }
-      }
-    }
-    if (!resolved) {
-      state.functions.typesMap.addCustomType(mcpOutputType, mcpOutputType, [])
-    }
-    outputNames = [mcpOutputType]
-  }
-
-  if (inputNames.length > 1) {
-    logger.warn(
-      'More than one input type detected, only the first one will be used as a schema.'
-    )
-  }
-
-  // Store the input type for later use
-  if (inputTypes.length > 0) {
-    state.typesLookup.set(pikkuFuncId, inputTypes)
-  }
-
-  const sourceFile = node.getSourceFile().fileName
-  const existingFunction = state.functions.meta[pikkuFuncId]
-  if (
-    existingFunction &&
-    existingFunction.sourceFile &&
-    existingFunction.sourceFile !== sourceFile
-  ) {
-    logger.critical(
-      ErrorCode.DUPLICATE_FUNCTION_NAME,
-      `Function name '${name}' is not unique. ` +
-        `'${pikkuFuncId}' is already defined in '${existingFunction.sourceFile}' and cannot be redefined in '${sourceFile}'.`
-    )
-    return
-  }
-
-  if (exportedName || explicitName) {
-    const existingInternal = state.rpc.internalMeta[name]
-    if (
-      existingInternal &&
-      !areCompatibleFunctionIds(existingInternal, pikkuFuncId)
-    ) {
-      const existingSource =
-        resolveExistingFunctionSource(state, existingInternal) || 'unknown file'
-      logger.critical(
-        ErrorCode.DUPLICATE_FUNCTION_NAME,
-        `Function name '${name}' is not unique. ` +
-          `It already points to '${existingInternal}' in '${existingSource}', but '${pikkuFuncId}' in '${sourceFile}' tried to use the same name.`
-      )
-      return
-    }
-
-    if (expose) {
-      const existingExposed = state.rpc.exposedMeta[name]
-      if (
-        existingExposed &&
-        !areCompatibleFunctionIds(existingExposed, pikkuFuncId)
-      ) {
-        const existingSource =
-          resolveExistingFunctionSource(state, existingExposed) ||
-          'unknown file'
-        logger.critical(
-          ErrorCode.DUPLICATE_FUNCTION_NAME,
-          `Exposed function name '${name}' is not unique. ` +
-            `It already points to '${existingExposed}' in '${existingSource}', but '${pikkuFuncId}' in '${sourceFile}' tried to use the same name.`
-        )
-        return
-      }
-    }
-  }
-
-  const sessionless = expression.text !== 'pikkuFunc'
-
-  // ── Classification brand check ─────────────────────────────────────────────
-  // Walk the function body's ACTUAL inferred return type looking for classification
-  // brands (__classification__ property on Private<T>, Pii<T>, Secret<T>).
-  //
-  // Semantics:
-  //   secret  → never returned by any exposed function (sessioned or not)
-  //   private → only visible to authenticated (sessioned) users; ok for pikkuFunc
-  //   public  → safe for sessionless functions
-  // Opt-in only: inferring every handler's return type (getReturnTypeOfSignature)
-  // is the single most expensive checker operation and dominates `pikku all`
-  // wall-clock. The classification leak scan is a security lint, not codegen, so
-  // it runs ONLY when explicitly requested (`pikku all --security`) — see the
-  // classificationCheck option. Default codegen skips it entirely.
-  if (options.classificationCheck) {
-    // A revealed vault secret — or a PII column — is invisible to the return-type
-    // scan below when it is written out mid-body rather than returned, so walk
-    // the sinks too.
-    for (const violation of findClassifiedSinks(checker, handler)) {
-      logger.diagnostic({
-        severity: 'error',
-        code:
-          violation.classification === 'secret'
-            ? ErrorCode.SECRET_REVEALED_INTO_SINK
-            : ErrorCode.PII_INTO_SINK,
-        message:
-          violation.classification === 'secret'
-            ? `Function '${name}' passes a revealed secret to '${violation.sink}' ` +
-              `at line ${violation.line} (path '${violation.path}').\n  ` +
-              `A vault secret must not be written to a log, an audit, a queue, an email or a webhook. ` +
-              `Pass the value only to the client that needs it, and reveal it there.`
-            : `Function '${name}' passes personal data to '${violation.sink}' ` +
-              `at line ${violation.line} (path '${violation.path}').\n  ` +
-              `A log, the console and a webhook all leave your control — they are shipped to third parties and retained ` +
-              `long past the request. Log an id instead, or narrow the value to a non-identifying field. ` +
-              `An email to the data subject, an audit in your own database and a queue on your own infrastructure are fine.`,
-      })
-    }
-
-    const sig = checker.getSignatureFromDeclaration(handler)
-    if (sig) {
-      const rawRet = checker.getReturnTypeOfSignature(sig)
-      const unwrapped = unwrapPromise(checker, rawRet)
-      const classifiedFields = findPiiPaths(checker, unwrapped)
-
-      const secretPaths = classifiedFields
-        .filter((f) => f.classification === 'secret')
-        .map((f) => f.path)
-
-      const privatePaths = classifiedFields
-        .filter(
-          (f) => f.classification === 'private' || f.classification === 'pii'
-        )
-        .map((f) => f.path)
-
-      if (secretPaths.length > 0) {
-        logger.diagnostic({
-          severity: 'error',
-          code: ErrorCode.PII_IN_OUTPUT,
-          message:
-            `Function '${name}' exposes secret-classified field(s) in its return type: ` +
-            secretPaths.map((p) => `'${p}'`).join(', ') +
-            `.\n  Secret fields must never appear in function output. ` +
-            `Strip these fields before returning or change the column classification.`,
-        })
-      }
-
-      if (sessionless && privatePaths.length > 0) {
-        logger.diagnostic({
-          severity: 'error',
-          code: ErrorCode.PII_IN_OUTPUT,
-          message:
-            `Sessionless function '${name}' exposes private-classified field(s) in its return type: ` +
-            privatePaths.map((p) => `'${p}'`).join(', ') +
-            `.\n  Private fields are only safe to return from authenticated (sessioned) functions. ` +
-            `Either require a session (use pikkuFunc) or set the column's security to 'public' in db/annotations.ts if it is safe to expose publicly.`,
-        })
-      }
-    }
-  }
-
-  // --- resolve middleware ---
-  let middleware = objectNode
-    ? resolveMiddleware(state, objectNode, tags, checker)
-    : undefined
-
-  // --- resolve permissions ---
-  let permissions = objectNode
-    ? resolvePermissions(state, objectNode, tags, checker)
-    : undefined
-
-  if (options.tags?.length) {
-    tags = [...new Set([...(tags || []), ...options.tags])]
-    const tagEntries = options.tags.map((tag) => ({
-      type: 'tag' as const,
-      tag,
-    }))
-    const existingMiddlewareTags = new Set(
-      (middleware || [])
-        .filter((m) => m.type === 'tag')
-        .map((m) => (m as any).tag)
-    )
-    const newMiddleware = tagEntries.filter(
-      (e) => !existingMiddlewareTags.has(e.tag)
-    )
-    if (newMiddleware.length > 0) {
-      middleware = [...(middleware || []), ...newMiddleware]
-    }
-  }
-
-  const implementationHash = computeImplementationHash({
-    wrapper: expression.text,
-    handler,
-    objectNode,
-    isDirectFunction,
-  })
-
-  const handlerSourceFile = handler.getSourceFile()
-  const bodySourceFile =
-    handlerSourceFile.fileName !== sourceFile
-      ? handlerSourceFile.fileName
-      : undefined
-  const lineOf = (pos: number) =>
-    handlerSourceFile.getLineAndCharacterOfPosition(pos).line + 1
-  const handlerBody = handler.body
-  const bodySpan =
-    ts.isBlock(handlerBody) && handlerBody.statements.length > 0
-      ? {
-          bodyStart: lineOf(
-            handlerBody.statements[0].getStart(handlerSourceFile)
-          ),
-          bodyEnd: lineOf(
-            handlerBody.statements[handlerBody.statements.length - 1].getEnd()
-          ),
-        }
-      : {
-          bodyStart: lineOf(handlerBody.getStart(handlerSourceFile)),
-          bodyEnd: lineOf(handlerBody.getEnd()),
-        }
-
-  state.functions.meta[pikkuFuncId] = {
-    pikkuFuncId,
-    functionType: 'user',
-    funcWrapper: expression.text,
-    sessionless,
-    name,
-    services,
-    wires: wires.wires.length > 0 || !wires.optimized ? wires : undefined,
-    inputSchemaName: inputNames[0] ?? null,
-    outputSchemaName: outputNames[0] ?? null,
-    inputs: inputNames.filter((n) => n !== 'void') ?? null,
-    outputs: outputNames.filter((n) => n !== 'void') ?? null,
-    expose: expose || undefined,
-    auth: auth || undefined,
-    permissionsInBody: permissionsInBody || undefined,
-    audit,
-    remote: remote || undefined,
-    scenarioStep: isScenarioStep || undefined,
-    scenario: isScenario || undefined,
-    mcp: mcpEnabled || undefined,
-    readonly: readonly_ || undefined,
-    deploy: deploy || undefined,
-    approvalRequired: approvalRequired || undefined,
-    approvalDescription: approvalDescription || undefined,
-    workflowQueued: workflowQueued === true ? true : undefined,
-    workflowRetries: workflowRetries ?? undefined,
-    workflowTimeout: workflowTimeout ?? undefined,
-    scenarioStepSurfaces,
-    scenarioStepRequiresActor,
-    // `persona` is the default reading of an unmarked step, so it is left off
-    // rather than written into every step meta a project already has.
-    scenarioStepKind:
-      scenarioStepKind && scenarioStepKind !== 'persona'
-        ? scenarioStepKind
-        : undefined,
-    scenarioStepAddon,
-    scenarioStepTemplate: scenarioStepTemplate || undefined,
-    scopes: scopes ?? undefined,
-    implementationHash,
-    version,
-    title,
-    tags: tags || undefined,
-    summary,
-    description,
-    errors,
-    middleware,
-    permissions,
-    isDirectFunction,
-    sourceFile,
-    bodySourceFile,
-    exportedName: exportedName || undefined,
-    ...bodySpan,
-  }
-
-  if (handlerHasDynamicImport(handler)) {
-    state.functions.dynamicImportIds.add(pikkuFuncId)
-  }
-
-  // Populate node metadata if node config is present
-  if (nodeDisplayName && nodeCategory && nodeType) {
-    state.nodes.files.add(node.getSourceFile().fileName)
-    state.nodes.meta[pikkuFuncId] = {
-      name: pikkuFuncId,
-      displayName: nodeDisplayName,
-      category: nodeCategory,
-      type: nodeType,
-      rpc: pikkuFuncId,
-      description,
-      errorOutput: nodeErrorOutput ?? false,
-      inputSchemaName: inputNames[0] ?? null,
-      outputSchemaName: outputNames[0] ?? null,
-      tags,
-    }
-  }
-
-  if (mcpEnabled) {
-    // `pikkuMCPToolFunc`'s config accepts `name`, and it is the name an AI client
-    // calls the tool by — `runMCPTool` looks the tool up in `toolsMeta` by exactly
-    // this key and then dispatches through `pikkuFuncId`, so it is a public label
-    // rather than an identity. It was never read here, so a declared `name` was
-    // silently dropped and the tool published under whatever the export happened to
-    // be called. It does NOT become the `pikkuFuncId`: renaming an export's rpc id
-    // is a different decision, and the scenario-step wrappers are the only place
-    // `name` carries that weight.
-    const declaredName = objectNode
-      ? getPropertyValue(objectNode, 'name')
-      : undefined
-    const toolName =
-      typeof declaredName === 'string' && declaredName ? declaredName : name
-    if (!description) {
-      logger.warn(`MCP tool '${toolName}' is missing a description.`)
-    }
-    state.mcpEndpoints.files.add(node.getSourceFile().fileName)
-    state.mcpEndpoints.toolsMeta[toolName] = {
-      pikkuFuncId,
-      name: toolName,
-      title: title || undefined,
-      description: description || undefined,
-      summary,
-      errors,
-      tags,
-      inputSchema: inputNames[0] ?? null,
-      outputSchema: outputNames[0] ?? null,
-      middleware,
-    }
-    state.serviceAggregation.usedFunctions.add(pikkuFuncId)
-    extractWireNames(middleware).forEach((n) =>
-      state.serviceAggregation.usedMiddleware.add(n)
-    )
-    extractWireNames(permissions).forEach((n) =>
-      state.serviceAggregation.usedPermissions.add(n)
-    )
-  }
-
-  // Workflow functions don't get registered as RPC functions,
-  // they are their own type handled by add-workflow
-  if (expression.text.includes('Workflow')) {
-    return
-  }
-
-  // Trigger and channel connect/disconnect functions are not callable via RPC
-  const nonRPCPatterns = [
-    /Trigger/i,
-    /ChannelConnection/i,
-    /ChannelDisconnection/i,
-  ]
-  if (nonRPCPatterns.some((pattern) => pattern.test(expression.text))) {
-    return
-  }
-
-  // Store function file location for wiring generation
-  if (exportedName) {
-    state.functions.files.set(pikkuFuncId, {
-      path: node.getSourceFile().fileName,
-      exportedName,
-    })
-  }
-
-  if (exportedName || explicitName) {
-    if (!exportedName) {
-      logger.error(
-        `• Function with explicit name '${name}' is not exported, this is not allowed.`
-      )
-      return
-    }
-
-    if (remote && !isScenarioStep) {
-      state.rpc.invokedFunctions.add(pikkuFuncId)
-      // The consumer-facing surface a wireRemoteAddon imports (mirrors exposedMeta)
-      state.rpc.remoteMeta[name] = pikkuFuncId
-      state.rpc.remoteFiles.set(name, {
-        path: node.getSourceFile().fileName,
-        exportedName,
-      })
-    }
-
-    if (expose && !isScenarioStep) {
-      state.rpc.exposedMeta[name] = pikkuFuncId
-      state.rpc.exposedFiles.set(name, {
-        path: node.getSourceFile().fileName,
-        exportedName,
-      })
-      // Track exposed RPC function for service aggregation
-      state.serviceAggregation.usedFunctions.add(pikkuFuncId)
-    }
-
-    if (!isScenarioStep) {
-      // We add it to internal meta to allow autocomplete for everything
-      state.rpc.internalMeta[name] = pikkuFuncId
-
-      if (version !== undefined) {
-        state.rpc.internalMeta[pikkuFuncId] = pikkuFuncId
-        state.rpc.invokedFunctions.add(pikkuFuncId)
-      }
-    }
-
-    // But we only import the actual function if it's actually invoked to keep
-    // bundle size down
-    if (
-      state.rpc.invokedFunctions.has(pikkuFuncId) ||
-      expose ||
-      remote ||
-      mcpEnabled
-    ) {
-      state.rpc.internalFiles.set(pikkuFuncId, {
-        path: node.getSourceFile().fileName,
-        exportedName,
-      })
-    }
-  }
-}