@pikku/inspector 0.12.75 → 0.12.81

package/src/utils/filter-inspector-state.ts

@@ -1,1298 +0,0 @@
-import type {
-  InspectorState,
-  InspectorFilters,
-  InspectorLogger,
-} from '../types.js'
-import type { PikkuWiringTypes } from '@pikku/core/types'
-import { parseVersionedId } from '@pikku/core/utils'
-import { makeContextBasedId } from './extract-function-name.js'
-import { aggregateRequiredServices } from './post-process.js'
-import {
-  IncompatibleDeployTargetError,
-  resolveDeployTarget,
-} from './resolve-deploy-target.js'
-
-/**
- * The deploy filter, asked about one function at a time rather than handed over
- * as a set, so that a function's own deploy conflict is raised only if this app
- * turns out to wire it.
- */
-type DeployFilter = {
-  has(pikkuFuncId: string): boolean
-}
-
-/**
- * Drop a workflow from every map that describes it. `files` and `graphFiles`
- * are what the wiring generator iterates, and `graphMeta` is what tells a
- * scenario apart from an app workflow — leaving a pruned workflow's file entry
- * behind registers it anyway, and a scenario whose graphMeta has gone reads as
- * an app workflow, which is how scenario steps reached deployed bundles.
- */
-const pruneWorkflow = (
-  workflows: InspectorState['workflows'],
-  name: string,
-  pikkuFuncId: string | undefined
-) => {
-  delete workflows.graphMeta[name]
-  delete workflows.meta[name]
-  workflows.files.delete(name)
-  workflows.graphFiles.delete(name)
-  if (pikkuFuncId) {
-    workflows.files.delete(pikkuFuncId)
-    workflows.graphFiles.delete(pikkuFuncId)
-  }
-}
-
-// Module-level Set to track warned groups across multiple filter calls
-const globalWarnedGroups = new Set<string>()
-
-/**
- * Match a value against a pattern with wildcard support
- * Supports "*" at the beginning, end, or both (e.g., "send*", "*Payment", "*process*")
- */
-function matchesWildcard(value: string, pattern: string): boolean {
-  if (pattern === '*') return true
-
-  const startsWithWildcard = pattern.startsWith('*')
-  const endsWithWildcard = pattern.endsWith('*')
-
-  if (startsWithWildcard && endsWithWildcard) {
-    const middle = pattern.slice(1, -1)
-    if (middle === '') return true
-    return value.includes(middle)
-  } else if (startsWithWildcard) {
-    const suffix = pattern.slice(1)
-    return value.endsWith(suffix) && value.length > suffix.length
-  } else if (endsWithWildcard) {
-    const prefix = pattern.slice(0, -1)
-    return value.startsWith(prefix) && value.length > prefix.length
-  }
-
-  return value === pattern
-}
-
-function collectSourceFiles(
-  value: unknown,
-  sourceFiles = new Set<string>(),
-  seen = new Set<object>()
-): Set<string> {
-  if (typeof value === 'string') {
-    return sourceFiles
-  }
-
-  if (Array.isArray(value)) {
-    for (const entry of value) {
-      collectSourceFiles(entry, sourceFiles, seen)
-    }
-    return sourceFiles
-  }
-
-  if (!value || typeof value !== 'object') {
-    return sourceFiles
-  }
-
-  if (seen.has(value)) {
-    return sourceFiles
-  }
-  seen.add(value)
-
-  if ('sourceFile' in value && typeof value.sourceFile === 'string') {
-    sourceFiles.add(value.sourceFile)
-  }
-
-  for (const nestedValue of Object.values(value)) {
-    collectSourceFiles(nestedValue, sourceFiles, seen)
-  }
-
-  return sourceFiles
-}
-
-function repopulateFileSetFromMeta(
-  meta: unknown,
-  fallbackFiles: Set<string>,
-  hasEntries: boolean
-): Set<string> {
-  const sourceFiles = collectSourceFiles(meta)
-  if (sourceFiles.size > 0) {
-    return sourceFiles
-  }
-
-  if (hasEntries) {
-    return new Set(fallbackFiles)
-  }
-
-  return new Set<string>()
-}
-
-/**
- * Check if metadata matches the given filters
- */
-function matchesFilters(
-  filters: InspectorFilters,
-  meta: {
-    type: PikkuWiringTypes
-    name: string
-    /**
-     * Further ids the `--names` filter may address this wiring by. An HTTP
-     * route wired with `ref('ns:fn')` carries the addon's own function id as
-     * its name, so its `http:<method>:<route>` wiring id is the only id that
-     * names this route rather than every wiring onto that addon function.
-     */
-    altNames?: string[]
-    tags?: string[]
-    filePath?: string
-    httpRoute?: string
-    httpMethod?: string
-    groupBasePath?: string
-  },
-  logger: InspectorLogger,
-  warnedGroups?: Set<string>,
-  // Kept pikkuFuncIds under the deploy filter; null when the filter is
-  // inactive. Asked about one id at a time, which is what lets a conflict in an
-  // addon's own metadata surface only for a function this app actually wires.
-  keptByDeploy?: DeployFilter | null
-): boolean {
-  // If no filters, allow everything
-  if (Object.keys(filters).length === 0) return true
-
-  // If all filter arrays are empty, allow everything
-  if (
-    (!filters.names || filters.names.length === 0) &&
-    (!filters.tags || filters.tags.length === 0) &&
-    (!filters.wires || filters.wires.length === 0) &&
-    (!filters.excludeWires || filters.excludeWires.length === 0) &&
-    (!filters.directories || filters.directories.length === 0) &&
-    (!filters.httpRoutes || filters.httpRoutes.length === 0) &&
-    (!filters.httpMethods || filters.httpMethods.length === 0) &&
-    (!filters.target || filters.target.length === 0) &&
-    (!filters.excludeNames || filters.excludeNames.length === 0) &&
-    (!filters.excludeTags || filters.excludeTags.length === 0) &&
-    (!filters.excludeWires || filters.excludeWires.length === 0) &&
-    (!filters.excludeDirectories || filters.excludeDirectories.length === 0) &&
-    (!filters.excludeHttpRoutes || filters.excludeHttpRoutes.length === 0) &&
-    (!filters.excludeHttpMethods || filters.excludeHttpMethods.length === 0) &&
-    (!filters.excludeTarget || filters.excludeTarget.length === 0)
-  ) {
-    return true
-  }
-
-  // Deploy-target include filter (computed once per filterInspectorState call).
-  if (keptByDeploy && !keptByDeploy.has(meta.name)) {
-    logger.debug(`⒡ Filtered by deploy include: ${meta.type}:${meta.name}`)
-    return false
-  }
-
-  // Check wire include filter
-  if (filters.wires && filters.wires.length > 0) {
-    if (!filters.wires.includes(meta.type)) {
-      logger.debug(`⒡ Filtered by wire include: ${meta.type}:${meta.name}`)
-      return false
-    }
-  }
-
-  // Check wire exclude filter
-  if (filters.excludeWires && filters.excludeWires.length > 0) {
-    if (filters.excludeWires.includes(meta.type)) {
-      logger.debug(`⒡ Filtered by wire exclude: ${meta.type}:${meta.name}`)
-      return false
-    }
-  }
-
-  // Check directory filter
-  if (filters.directories && filters.directories.length > 0 && meta.filePath) {
-    const matchesDirectory = filters.directories.some((dir) => {
-      const normalizedFilePath = meta.filePath!.replace(/\\/g, '/')
-      const normalizedDir = dir.replace(/\\/g, '/')
-      return normalizedFilePath.includes(normalizedDir)
-    })
-
-    if (!matchesDirectory) {
-      logger.debug(`⒡ Filtered by directory: ${meta.type}:${meta.name}`)
-      return false
-    }
-  }
-
-  // Check tag include filter
-  if (filters.tags && filters.tags.length > 0) {
-    if (!meta.tags || !filters.tags.some((tag) => meta.tags!.includes(tag))) {
-      logger.debug(`⒡ Filtered by tags include: ${meta.type}:${meta.name}`)
-      return false
-    }
-  }
-
-  // Check tag exclude filter
-  if (filters.excludeTags && filters.excludeTags.length > 0) {
-    if (
-      meta.tags &&
-      filters.excludeTags.some((tag) => meta.tags!.includes(tag))
-    ) {
-      logger.debug(`⒡ Filtered by tags exclude: ${meta.type}:${meta.name}`)
-      return false
-    }
-  }
-
-  const candidateNames = [meta.name, ...(meta.altNames ?? [])]
-  const matchesNamePattern = (pattern: string) =>
-    candidateNames.some((candidate) => {
-      const { baseName } = parseVersionedId(candidate)
-      return (
-        matchesWildcard(candidate, pattern) ||
-        (baseName !== candidate && matchesWildcard(baseName, pattern))
-      )
-    })
-
-  // Check name include filter (match against both full ID and base name for versioned functions)
-  if (filters.names && filters.names.length > 0) {
-    const nameMatches = filters.names.some(matchesNamePattern)
-    if (!nameMatches) {
-      logger.debug(`⒡ Filtered by name include: ${meta.type}:${meta.name}`)
-      return false
-    }
-  }
-
-  // Check name exclude filter
-  if (filters.excludeNames && filters.excludeNames.length > 0) {
-    if (filters.excludeNames.some(matchesNamePattern)) {
-      logger.debug(`⒡ Filtered by name exclude: ${meta.type}:${meta.name}`)
-      return false
-    }
-  }
-
-  const matchesRoutePattern = (pattern: string) =>
-    !!meta.httpRoute && matchesWildcard(meta.httpRoute, pattern)
-
-  // Check HTTP route include filter
-  if (filters.httpRoutes && filters.httpRoutes.length > 0 && meta.httpRoute) {
-    const routeMatches = filters.httpRoutes.some(matchesRoutePattern)
-    if (!routeMatches) {
-      logger.debug(`⒡ Filtered by HTTP route include: ${meta.httpRoute}`)
-      return false
-    }
-
-    // If route is part of a wireHTTPRoutes group, check if filter is at group level
-    if (meta.groupBasePath && warnedGroups) {
-      const groupMatches = filters.httpRoutes.some(
-        (pattern) =>
-          matchesWildcard(meta.groupBasePath!, pattern) ||
-          matchesWildcard(meta.groupBasePath! + '/*', pattern)
-      )
-      if (!groupMatches && !warnedGroups.has(meta.groupBasePath)) {
-        warnedGroups.add(meta.groupBasePath)
-        logger.warn(
-          `Filtering within wireHTTPRoutes group is not yet supported. ` +
-            `Route '${meta.httpRoute}' is part of group '${meta.groupBasePath}'. ` +
-            `Use '--httpRoutes=${meta.groupBasePath}/*' to filter the entire group.`
-        )
-      }
-    }
-  }
-
-  // Check HTTP route exclude filter
-  if (
-    filters.excludeHttpRoutes &&
-    filters.excludeHttpRoutes.length > 0 &&
-    meta.httpRoute
-  ) {
-    if (filters.excludeHttpRoutes.some(matchesRoutePattern)) {
-      logger.debug(`⒡ Filtered by HTTP route exclude: ${meta.httpRoute}`)
-      return false
-    }
-  }
-
-  const normalizedMethod = meta.httpMethod?.toUpperCase()
-
-  // Check HTTP method include filter
-  if (
-    filters.httpMethods &&
-    filters.httpMethods.length > 0 &&
-    normalizedMethod
-  ) {
-    if (!filters.httpMethods.includes(normalizedMethod)) {
-      logger.debug(`⒡ Filtered by HTTP method include: ${meta.httpMethod}`)
-      return false
-    }
-  }
-
-  // Check HTTP method exclude filter
-  if (
-    filters.excludeHttpMethods &&
-    filters.excludeHttpMethods.length > 0 &&
-    normalizedMethod
-  ) {
-    if (filters.excludeHttpMethods.includes(normalizedMethod)) {
-      logger.debug(`⒡ Filtered by HTTP method exclude: ${meta.httpMethod}`)
-      return false
-    }
-  }
-
-  return true
-}
-
-/**
- * Extract wire names from middleware/permissions metadata
- */
-function extractWireNames(obj: Record<string, any> | undefined): string[] {
-  if (!obj) return []
-  const names: string[] = []
-  for (const key of Object.keys(obj)) {
-    if (obj[key] && typeof obj[key] === 'object' && 'name' in obj[key]) {
-      names.push(obj[key].name)
-    }
-  }
-  return names
-}
-
-/**
- * Filters inspector state based on provided filters
- * This is applied post-inspection to support the inspect-once, filter-many pattern
- */
-export function filterInspectorState(
-  state: InspectorState | Omit<InspectorState, 'typesLookup'>,
-  filters: InspectorFilters,
-  logger: InspectorLogger
-): typeof state {
-  // If no filters, return original state
-  if (
-    Object.keys(filters).length === 0 ||
-    ((!filters.names || filters.names.length === 0) &&
-      (!filters.tags || filters.tags.length === 0) &&
-      (!filters.wires || filters.wires.length === 0) &&
-      (!filters.excludeWires || filters.excludeWires.length === 0) &&
-      (!filters.directories || filters.directories.length === 0) &&
-      (!filters.httpRoutes || filters.httpRoutes.length === 0) &&
-      (!filters.httpMethods || filters.httpMethods.length === 0) &&
-      (!filters.target || filters.target.length === 0) &&
-      (!filters.excludeNames || filters.excludeNames.length === 0) &&
-      (!filters.excludeTags || filters.excludeTags.length === 0) &&
-      (!filters.excludeWires || filters.excludeWires.length === 0) &&
-      (!filters.excludeDirectories ||
-        filters.excludeDirectories.length === 0) &&
-      (!filters.excludeHttpRoutes || filters.excludeHttpRoutes.length === 0) &&
-      (!filters.excludeHttpMethods ||
-        filters.excludeHttpMethods.length === 0) &&
-      (!filters.excludeTarget || filters.excludeTarget.length === 0))
-  ) {
-    return state
-  }
-
-  // Precompute kept-function set for the deploy filter (if active).
-  // resolveDeployTarget throws IncompatibleDeployTargetError when an
-  // explicit deploy: 'serverless' clashes with serverlessIncompatible.
-  let keptByDeploy: DeployFilter | null = null
-  if (
-    (filters.target && filters.target.length > 0) ||
-    (filters.excludeTarget && filters.excludeTarget.length > 0)
-  ) {
-    const allowed = filters.target ? new Set(filters.target) : null
-    const excluded = filters.excludeTarget
-      ? new Set(filters.excludeTarget)
-      : null
-    const incompatible = new Set(filters.serverlessIncompatible ?? [])
-    const defaultTarget = filters.defaultTarget ?? 'serverless'
-    const kept = new Set<string>()
-    // An addon publishes metadata for everything it exports, so a conflict in a
-    // function this app never wires is not this app's build error. Holding it
-    // here and raising it from `has` reports it at the one place the app is
-    // known to depend on that function.
-    const conflicts = new Map<string, IncompatibleDeployTargetError>()
-    keptByDeploy = {
-      has: (funcId: string) => {
-        const conflict = conflicts.get(funcId)
-        if (conflict) throw conflict
-        return kept.has(funcId)
-      },
-    }
-    const keepByTarget = (
-      funcId: string,
-      funcMeta: unknown,
-      incompatibleServices: Set<string>
-    ) => {
-      const target = resolveDeployTarget(
-        funcMeta as any,
-        incompatibleServices,
-        funcId,
-        defaultTarget
-      )
-      if (allowed && !allowed.has(target)) return
-      if (excluded && excluded.has(target)) return
-      kept.add(funcId)
-    }
-    for (const [funcId, funcMeta] of Object.entries(state.functions.meta)) {
-      keepByTarget(funcId, funcMeta, incompatible)
-    }
-    // A wiring onto an addon function records the addon's own id, so the
-    // addon's published metadata is the only place its deploy target can be
-    // read from. Its serverlessIncompatible services are namespace-scoped —
-    // a service name means whatever the addon that declared it means.
-    for (const [namespace, addonMeta] of Object.entries(
-      state.addonFunctions ?? {}
-    )) {
-      const addonIncompatible = new Set(
-        state.addonServerlessIncompatible?.get(namespace) ?? []
-      )
-      for (const [funcName, funcMeta] of Object.entries(addonMeta)) {
-        const funcId = `${namespace}:${funcName}`
-        try {
-          keepByTarget(funcId, funcMeta, addonIncompatible)
-        } catch (e) {
-          if (!(e instanceof IncompatibleDeployTargetError)) throw e
-          conflicts.set(funcId, e)
-        }
-      }
-    }
-  }
-
-  // Snapshot the original workflow graph meta before filtering prunes it
-  const originalGraphMeta = {
-    ...((state as InspectorState).workflows?.graphMeta ?? {}),
-  }
-
-  // Create a shallow copy with new Maps/Sets to avoid mutating the original
-  const filteredState = {
-    ...state,
-    serviceAggregation: {
-      ...state.serviceAggregation,
-      requiredServices: new Set<string>(), // Reset requiredServices - will be recalculated
-      usedFunctions: new Set<string>(),
-      usedMiddleware: new Set<string>(),
-      usedPermissions: new Set<string>(),
-    },
-    functions: {
-      ...state.functions,
-      meta: JSON.parse(JSON.stringify(state.functions.meta)), // Deep clone to avoid mutating original
-      files: new Map(state.functions.files),
-    },
-    http: {
-      ...state.http,
-      meta: JSON.parse(JSON.stringify(state.http.meta)), // Deep clone metadata
-      files: new Set<string>(), // Will be repopulated with filtered files
-    },
-    workflows: {
-      ...state.workflows,
-      graphMeta: JSON.parse(JSON.stringify(state.workflows?.graphMeta ?? {})),
-      meta: JSON.parse(JSON.stringify(state.workflows?.meta ?? {})),
-      files: new Map(state.workflows?.files ?? []),
-      graphFiles: new Map(state.workflows?.graphFiles ?? []),
-    },
-    channels: {
-      ...state.channels,
-      meta: JSON.parse(JSON.stringify(state.channels.meta)),
-      files: new Set<string>(), // Will be repopulated with filtered files
-    },
-    triggers: {
-      ...state.triggers,
-      meta: JSON.parse(JSON.stringify(state.triggers?.meta ?? {})),
-      files: new Set<string>(),
-    },
-    scheduledTasks: {
-      ...state.scheduledTasks,
-      meta: JSON.parse(JSON.stringify(state.scheduledTasks.meta)),
-      files: new Set<string>(), // Will be repopulated with filtered files
-    },
-    queueWorkers: {
-      ...state.queueWorkers,
-      meta: JSON.parse(JSON.stringify(state.queueWorkers.meta)),
-      files: new Set<string>(), // Will be repopulated with filtered files
-    },
-    mcpEndpoints: {
-      ...state.mcpEndpoints,
-      toolsMeta: JSON.parse(JSON.stringify(state.mcpEndpoints.toolsMeta)),
-      resourcesMeta: JSON.parse(
-        JSON.stringify(state.mcpEndpoints.resourcesMeta)
-      ),
-      promptsMeta: JSON.parse(JSON.stringify(state.mcpEndpoints.promptsMeta)),
-      files: new Set<string>(),
-    },
-    agents: {
-      ...state.agents,
-      agentsMeta: JSON.parse(JSON.stringify(state.agents?.agentsMeta ?? {})),
-      files: new Map(),
-      invokedAgentsByFile: new Map(
-        [
-          ...(state.agents?.invokedAgentsByFile ??
-            new Map<string, Set<string>>()),
-        ].map(([file, agents]): [string, Set<string>] => [
-          file,
-          new Set(agents),
-        ])
-      ),
-    },
-    // Scorers carry through every filter. They are named by the agents that
-    // survive it, and a deployment that quietly stopped grading would look
-    // exactly like one whose scorers all returned nothing.
-    scorers: {
-      ...state.scorers,
-      scorersMeta: JSON.parse(JSON.stringify(state.scorers?.scorersMeta ?? {})),
-      files: new Map(state.scorers?.files ?? []),
-    },
-    rpc: {
-      ...state.rpc,
-      internalMeta: { ...state.rpc.internalMeta }, // Clone to avoid mutating original
-      internalFiles: new Map(state.rpc.internalFiles),
-      exposedMeta: { ...state.rpc.exposedMeta },
-      exposedFiles: new Map(state.rpc.exposedFiles),
-      remoteMeta: { ...state.rpc.remoteMeta },
-      remoteFiles: new Map(state.rpc.remoteFiles),
-      invokedFunctions: new Set(state.rpc.invokedFunctions),
-    },
-    cli: {
-      ...state.cli,
-      meta: JSON.parse(JSON.stringify(state.cli.meta)),
-      files: new Set<string>(), // Will be repopulated with filtered files
-    },
-  }
-
-  // Filter HTTP routes
-  for (const method of Object.keys(filteredState.http.meta)) {
-    const routes = filteredState.http.meta[method]
-    for (const route of Object.keys(routes)) {
-      const routeMeta = routes[route]
-
-      // Get function file path for directory filtering
-      const funcFile = filteredState.functions.files.get(routeMeta.pikkuFuncId)
-      const filePath = funcFile?.path
-
-      const matches = matchesFilters(
-        filters,
-        {
-          type: 'http' as PikkuWiringTypes,
-          name: routeMeta.pikkuFuncId, // Use function name, not route
-          altNames: [makeContextBasedId('http', method, routeMeta.route)],
-          tags: routeMeta.tags,
-          filePath,
-          httpRoute: routeMeta.route,
-          httpMethod: routeMeta.method,
-          groupBasePath: routeMeta.groupBasePath,
-        },
-        logger,
-        globalWarnedGroups,
-        keptByDeploy
-      )
-
-      if (!matches) {
-        delete routes[route]
-      } else {
-        // Track used functions/middleware/permissions
-        if (routeMeta.pikkuFuncId) {
-          filteredState.serviceAggregation.usedFunctions.add(
-            routeMeta.pikkuFuncId
-          )
-          // For workflow/agent routes, also add the base name
-          // so the workflow/agent definition survives pruning
-          const colonIdx = routeMeta.pikkuFuncId.indexOf(':')
-          if (colonIdx !== -1) {
-            filteredState.serviceAggregation.usedFunctions.add(
-              routeMeta.pikkuFuncId.slice(colonIdx + 1)
-            )
-          }
-        }
-        extractWireNames(routeMeta.middleware).forEach((name: string) =>
-          filteredState.serviceAggregation.usedMiddleware.add(name)
-        )
-        extractWireNames(routeMeta.permissions).forEach((name: string) =>
-          filteredState.serviceAggregation.usedPermissions.add(name)
-        )
-      }
-    }
-  }
-
-  // Repopulate http.files with only files that have surviving routes
-  for (const method of Object.keys(filteredState.http.meta)) {
-    const routes = (
-      filteredState.http.meta as Record<
-        string,
-        Record<string, { sourceFile?: string }>
-      >
-    )[method]
-    for (const routeMeta of Object.values(routes)) {
-      if (routeMeta.sourceFile) {
-        filteredState.http.files.add(routeMeta.sourceFile)
-      }
-    }
-  }
-  // Fallback: if no sourceFile info available but routes exist, include all files
-  if (filteredState.http.files.size === 0) {
-    const hasHttpRoutes = Object.values(
-      filteredState.http.meta as Record<string, Record<string, unknown>>
-    ).some((routes) => Object.keys(routes).length > 0)
-    if (hasHttpRoutes) {
-      filteredState.http.files = new Set(state.http.files)
-    }
-  }
-
-  // Filter channels
-  for (const name of Object.keys(filteredState.channels.meta)) {
-    const channelMeta = filteredState.channels.meta[name]
-    const matches = matchesFilters(
-      filters,
-      {
-        type: 'channel' as PikkuWiringTypes,
-        name,
-        tags: channelMeta.tags,
-      },
-      logger,
-
-      undefined,
-
-      keptByDeploy
-    )
-
-    if (!matches) {
-      delete filteredState.channels.meta[name]
-    } else {
-      // Add all functions referenced by this channel
-      if ('pikkuFuncId' in channelMeta && channelMeta.pikkuFuncId) {
-        filteredState.serviceAggregation.usedFunctions.add(
-          channelMeta.pikkuFuncId as string
-        )
-      }
-      if (channelMeta.connect?.pikkuFuncId) {
-        filteredState.serviceAggregation.usedFunctions.add(
-          channelMeta.connect.pikkuFuncId
-        )
-      }
-      if (channelMeta.disconnect?.pikkuFuncId) {
-        filteredState.serviceAggregation.usedFunctions.add(
-          channelMeta.disconnect.pikkuFuncId
-        )
-      }
-      if (channelMeta.message?.pikkuFuncId) {
-        filteredState.serviceAggregation.usedFunctions.add(
-          channelMeta.message.pikkuFuncId
-        )
-      }
-      if (channelMeta.messageWirings) {
-        for (const groupKey of Object.keys(channelMeta.messageWirings)) {
-          const commands = channelMeta.messageWirings[groupKey]
-          for (const cmdKey of Object.keys(commands)) {
-            const wiring = commands[cmdKey]
-            if (wiring.pikkuFuncId) {
-              filteredState.serviceAggregation.usedFunctions.add(
-                wiring.pikkuFuncId
-              )
-            }
-          }
-        }
-      }
-      extractWireNames(channelMeta.middleware).forEach((name: string) =>
-        filteredState.serviceAggregation.usedMiddleware.add(name)
-      )
-      extractWireNames(channelMeta.permissions).forEach((name: string) =>
-        filteredState.serviceAggregation.usedPermissions.add(name)
-      )
-    }
-  }
-
-  filteredState.channels.files = repopulateFileSetFromMeta(
-    filteredState.channels.meta,
-    state.channels.files,
-    Object.keys(filteredState.channels.meta).length > 0
-  )
-
-  // Filter triggers
-  for (const name of Object.keys(filteredState.triggers.meta)) {
-    const triggerMeta = filteredState.triggers.meta[name]
-    const matches = matchesFilters(
-      filters,
-      {
-        type: 'trigger' as PikkuWiringTypes,
-        name,
-        tags: triggerMeta.tags,
-      },
-      logger,
-
-      undefined,
-
-      keptByDeploy
-    )
-
-    if (!matches) {
-      delete filteredState.triggers.meta[name]
-    } else {
-      if (triggerMeta.pikkuFuncId) {
-        filteredState.serviceAggregation.usedFunctions.add(
-          triggerMeta.pikkuFuncId
-        )
-      }
-    }
-  }
-
-  filteredState.triggers.files = repopulateFileSetFromMeta(
-    filteredState.triggers.meta,
-    state.triggers.files,
-    Object.keys(filteredState.triggers.meta).length > 0
-  )
-
-  // Filter scheduled tasks
-  for (const name of Object.keys(filteredState.scheduledTasks.meta)) {
-    const taskMeta = filteredState.scheduledTasks.meta[name]
-    const matches = matchesFilters(
-      filters,
-      {
-        type: 'scheduler' as PikkuWiringTypes,
-        name,
-        tags: taskMeta.tags,
-      },
-      logger,
-
-      undefined,
-
-      keptByDeploy
-    )
-
-    if (!matches) {
-      delete filteredState.scheduledTasks.meta[name]
-    } else {
-      if (taskMeta.pikkuFuncId) {
-        filteredState.serviceAggregation.usedFunctions.add(taskMeta.pikkuFuncId)
-      }
-      extractWireNames(taskMeta.middleware).forEach((name: string) =>
-        filteredState.serviceAggregation.usedMiddleware.add(name)
-      )
-    }
-  }
-
-  filteredState.scheduledTasks.files = repopulateFileSetFromMeta(
-    filteredState.scheduledTasks.meta,
-    state.scheduledTasks.files,
-    Object.keys(filteredState.scheduledTasks.meta).length > 0
-  )
-
-  // Filter queue workers
-  for (const name of Object.keys(filteredState.queueWorkers.meta)) {
-    const workerMeta = filteredState.queueWorkers.meta[name]
-    const matches = matchesFilters(
-      filters,
-      {
-        type: 'queue' as PikkuWiringTypes,
-        name,
-        tags: workerMeta.tags,
-      },
-      logger,
-
-      undefined,
-
-      keptByDeploy
-    )
-
-    if (!matches) {
-      delete filteredState.queueWorkers.meta[name]
-    } else {
-      if (workerMeta.pikkuFuncId) {
-        filteredState.serviceAggregation.usedFunctions.add(
-          workerMeta.pikkuFuncId
-        )
-        const colonIdx = workerMeta.pikkuFuncId.indexOf(':')
-        if (colonIdx !== -1) {
-          filteredState.serviceAggregation.usedFunctions.add(
-            workerMeta.pikkuFuncId.slice(colonIdx + 1)
-          )
-        }
-      }
-      extractWireNames(workerMeta.middleware).forEach((name: string) =>
-        filteredState.serviceAggregation.usedMiddleware.add(name)
-      )
-    }
-  }
-
-  filteredState.queueWorkers.files = repopulateFileSetFromMeta(
-    filteredState.queueWorkers.meta,
-    state.queueWorkers.files,
-    Object.keys(filteredState.queueWorkers.meta).length > 0
-  )
-
-  // Filter MCP tools
-  for (const name of Object.keys(filteredState.mcpEndpoints.toolsMeta)) {
-    const toolMeta = filteredState.mcpEndpoints.toolsMeta[name]
-    const matches = matchesFilters(
-      filters,
-      {
-        type: 'mcp' as PikkuWiringTypes,
-        name,
-        tags: toolMeta.tags,
-      },
-      logger,
-
-      undefined,
-
-      keptByDeploy
-    )
-
-    if (!matches) {
-      delete filteredState.mcpEndpoints.toolsMeta[name]
-    } else {
-      if (toolMeta.pikkuFuncId) {
-        filteredState.serviceAggregation.usedFunctions.add(toolMeta.pikkuFuncId)
-      }
-      extractWireNames(toolMeta.middleware).forEach((name: string) =>
-        filteredState.serviceAggregation.usedMiddleware.add(name)
-      )
-      extractWireNames(toolMeta.permissions).forEach((name: string) =>
-        filteredState.serviceAggregation.usedPermissions.add(name)
-      )
-    }
-  }
-
-  // Filter MCP resources
-  for (const name of Object.keys(filteredState.mcpEndpoints.resourcesMeta)) {
-    const resourceMeta = filteredState.mcpEndpoints.resourcesMeta[name]
-    const matches = matchesFilters(
-      filters,
-      {
-        type: 'mcp' as PikkuWiringTypes,
-        name,
-        tags: resourceMeta.tags,
-      },
-      logger,
-
-      undefined,
-
-      keptByDeploy
-    )
-
-    if (!matches) {
-      delete filteredState.mcpEndpoints.resourcesMeta[name]
-    } else {
-      if (resourceMeta.pikkuFuncId) {
-        filteredState.serviceAggregation.usedFunctions.add(
-          resourceMeta.pikkuFuncId
-        )
-      }
-      extractWireNames(resourceMeta.middleware).forEach((name: string) =>
-        filteredState.serviceAggregation.usedMiddleware.add(name)
-      )
-      extractWireNames(resourceMeta.permissions).forEach((name: string) =>
-        filteredState.serviceAggregation.usedPermissions.add(name)
-      )
-    }
-  }
-
-  // Filter MCP prompts
-  for (const name of Object.keys(filteredState.mcpEndpoints.promptsMeta)) {
-    const promptMeta = filteredState.mcpEndpoints.promptsMeta[name]
-    const matches = matchesFilters(
-      filters,
-      {
-        type: 'mcp' as PikkuWiringTypes,
-        name,
-        tags: promptMeta.tags,
-      },
-      logger,
-
-      undefined,
-
-      keptByDeploy
-    )
-
-    if (!matches) {
-      delete filteredState.mcpEndpoints.promptsMeta[name]
-    } else {
-      if (promptMeta.pikkuFuncId) {
-        filteredState.serviceAggregation.usedFunctions.add(
-          promptMeta.pikkuFuncId
-        )
-      }
-      extractWireNames(promptMeta.middleware).forEach((name: string) =>
-        filteredState.serviceAggregation.usedMiddleware.add(name)
-      )
-      extractWireNames(promptMeta.permissions).forEach((name: string) =>
-        filteredState.serviceAggregation.usedPermissions.add(name)
-      )
-    }
-  }
-
-  // Repopulate mcpEndpoints.files from surviving endpoint metadata
-  const hasMcpEndpoints =
-    Object.keys(filteredState.mcpEndpoints.toolsMeta).length > 0 ||
-    Object.keys(filteredState.mcpEndpoints.resourcesMeta).length > 0 ||
-    Object.keys(filteredState.mcpEndpoints.promptsMeta).length > 0
-  filteredState.mcpEndpoints.files = repopulateFileSetFromMeta(
-    {
-      toolsMeta: filteredState.mcpEndpoints.toolsMeta,
-      resourcesMeta: filteredState.mcpEndpoints.resourcesMeta,
-      promptsMeta: filteredState.mcpEndpoints.promptsMeta,
-    },
-    state.mcpEndpoints.files,
-    hasMcpEndpoints
-  )
-
-  // Filter AI agents
-  for (const name of Object.keys(filteredState.agents.agentsMeta)) {
-    const agentMeta = filteredState.agents.agentsMeta[name]
-    const matches = matchesFilters(
-      filters,
-      {
-        type: 'agent' as PikkuWiringTypes,
-        name,
-        tags: agentMeta.tags,
-      },
-      logger,
-
-      undefined,
-
-      keptByDeploy
-    )
-
-    if (!matches) {
-      delete filteredState.agents.agentsMeta[name]
-    } else {
-      if (agentMeta.pikkuFuncId) {
-        filteredState.serviceAggregation.usedFunctions.add(
-          agentMeta.pikkuFuncId
-        )
-      }
-      extractWireNames(agentMeta.middleware).forEach((name: string) =>
-        filteredState.serviceAggregation.usedMiddleware.add(name)
-      )
-      extractWireNames(agentMeta.permissions).forEach((name: string) =>
-        filteredState.serviceAggregation.usedPermissions.add(name)
-      )
-    }
-  }
-
-  if (Object.keys(filteredState.agents.agentsMeta).length > 0) {
-    filteredState.agents.files = new Map(state.agents.files)
-  }
-
-  // Filter CLI programs (note: CLI filtering might be more complex with nested commands)
-  const referencedRenderers = new Set<string>()
-
-  for (const programName of Object.keys(filteredState.cli.meta.programs)) {
-    const programMeta = filteredState.cli.meta.programs[programName]
-
-    // Filter commands in the program
-    for (const commandName of Object.keys(programMeta.commands)) {
-      const commandMeta = programMeta.commands[commandName]
-      const matches = matchesFilters(
-        filters,
-        {
-          type: 'cli' as PikkuWiringTypes,
-          name: commandName,
-          tags: commandMeta.tags,
-        },
-        logger,
-
-        undefined,
-
-        keptByDeploy
-      )
-
-      if (!matches) {
-        delete programMeta.commands[commandName]
-      } else {
-        if (commandMeta.pikkuFuncId) {
-          filteredState.serviceAggregation.usedFunctions.add(
-            commandMeta.pikkuFuncId
-          )
-        }
-        extractWireNames(commandMeta.middleware).forEach((name: string) =>
-          filteredState.serviceAggregation.usedMiddleware.add(name)
-        )
-        // Track referenced renderers
-        if (commandMeta.defaultRenderName) {
-          referencedRenderers.add(commandMeta.defaultRenderName)
-        }
-      }
-    }
-
-    // Remove program if it has no commands left
-    if (Object.keys(programMeta.commands).length === 0) {
-      delete filteredState.cli.meta.programs[programName]
-    }
-  }
-
-  // Filter out renderers that aren't referenced by any remaining commands
-  for (const rendererName of Object.keys(
-    filteredState.cli.meta.renderers || {}
-  )) {
-    if (!referencedRenderers.has(rendererName)) {
-      delete filteredState.cli.meta.renderers![rendererName]
-    }
-  }
-
-  // Repopulate cli.files from surviving program/renderer metadata
-  const hasCliPrograms = Object.keys(filteredState.cli.meta.programs).length > 0
-  const hasCliRenderers =
-    Object.keys(filteredState.cli.meta.renderers || {}).length > 0
-  filteredState.cli.files = repopulateFileSetFromMeta(
-    filteredState.cli.meta,
-    state.cli.files,
-    hasCliPrograms || hasCliRenderers
-  )
-
-  // Direct function filtering: functions that match the names/tags/directories
-  // filters should be included even if no wiring (HTTP, scheduler, etc.) references them.
-  // This ensures standalone RPC-callable functions survive filtering.
-  // Only run when function-level filters are active — httpRoutes/httpMethods work
-  // through the HTTP wiring pass which already adds the right functions.
-  const hasFunctionLevelFilters =
-    (filters.names && filters.names.length > 0) ||
-    (filters.tags && filters.tags.length > 0) ||
-    (filters.directories && filters.directories.length > 0)
-
-  for (const funcId of Object.keys(filteredState.functions.meta)) {
-    if (!hasFunctionLevelFilters) break
-    const funcMeta = filteredState.functions.meta[funcId]
-    const funcFile = filteredState.functions.files.get(funcId)
-    const filePath = funcFile?.path
-
-    const matches = matchesFilters(
-      filters,
-      {
-        type: 'rpc' as PikkuWiringTypes,
-        name: funcId,
-        tags: funcMeta.tags,
-        filePath,
-      },
-      logger,
-
-      undefined,
-
-      keptByDeploy
-    )
-
-    if (matches) {
-      filteredState.serviceAggregation.usedFunctions.add(funcId)
-    }
-  }
-
-  // Post-filter version expansion: when an unversioned base name is matched,
-  // include all its versions. Specific version matches (e.g. analyzeData@v1)
-  // do NOT expand to include other versions.
-  const includedBaseNames = new Set<string>()
-  for (const funcId of filteredState.serviceAggregation.usedFunctions) {
-    const { baseName, version } = parseVersionedId(funcId)
-    if (version === null) {
-      includedBaseNames.add(baseName)
-    }
-  }
-  if (includedBaseNames.size > 0) {
-    for (const funcId of Object.keys(state.functions.meta)) {
-      const { baseName } = parseVersionedId(funcId)
-      if (includedBaseNames.has(baseName)) {
-        filteredState.serviceAggregation.usedFunctions.add(funcId)
-      }
-    }
-  }
-
-  // Prune functions.meta and functions.files to only include used functions
-  if (filteredState.serviceAggregation.usedFunctions.size > 0) {
-    for (const funcId of Object.keys(filteredState.functions.meta)) {
-      if (!filteredState.serviceAggregation.usedFunctions.has(funcId)) {
-        delete filteredState.functions.meta[funcId]
-        filteredState.functions.files.delete(funcId)
-      }
-    }
-
-    // Prune channels whose functions were filtered out
-    for (const name of Object.keys(filteredState.channels.meta)) {
-      const channelMeta = filteredState.channels.meta[name]
-      // Check if any of the channel's functions are in the used set
-      const channelFuncIds: string[] = []
-      if (channelMeta.connect?.pikkuFuncId)
-        channelFuncIds.push(channelMeta.connect.pikkuFuncId)
-      if (channelMeta.disconnect?.pikkuFuncId)
-        channelFuncIds.push(channelMeta.disconnect.pikkuFuncId)
-      if (channelMeta.message?.pikkuFuncId)
-        channelFuncIds.push(channelMeta.message.pikkuFuncId)
-      if (channelMeta.messageWirings) {
-        for (const groupKey of Object.keys(channelMeta.messageWirings)) {
-          const commands = channelMeta.messageWirings[groupKey]
-          for (const cmdKey of Object.keys(commands)) {
-            const wiring = commands[cmdKey]
-            if (wiring.pikkuFuncId) channelFuncIds.push(wiring.pikkuFuncId)
-          }
-        }
-      }
-      const hasUsedFunc = channelFuncIds.some((id) =>
-        filteredState.serviceAggregation.usedFunctions.has(id)
-      )
-      if (channelFuncIds.length > 0 && !hasUsedFunc) {
-        delete filteredState.channels.meta[name]
-      }
-    }
-
-    // Prune workflow graphs whose function was filtered out — UNLESS the
-    // workflow's own name is in the filter (covers pikkuWorkflowGraph,
-    // which doesn't register a function meta, so its pikkuFuncId never
-    // ends up in usedFunctions even when callers explicitly want it).
-    const filterNamesSet = new Set(filters.names ?? [])
-    const workflowKeys = new Set([
-      ...Object.keys(filteredState.workflows.graphMeta),
-      ...Object.keys(filteredState.workflows.meta),
-    ])
-    for (const name of workflowKeys) {
-      if (filterNamesSet.has(name)) continue
-      const graphMeta = filteredState.workflows.graphMeta[name]
-      const workflowMeta = filteredState.workflows.meta[name]
-      // Check both graphMeta.pikkuFuncId and meta.pikkuFuncId
-      const pikkuFuncId = graphMeta?.pikkuFuncId ?? workflowMeta?.pikkuFuncId
-      if (
-        pikkuFuncId &&
-        !filteredState.serviceAggregation.usedFunctions.has(pikkuFuncId)
-      ) {
-        pruneWorkflow(filteredState.workflows, name, pikkuFuncId)
-      } else if (!pikkuFuncId) {
-        // No function ID found — prune it
-        pruneWorkflow(filteredState.workflows, name, pikkuFuncId)
-      }
-    }
-
-    // Prune RPC meta to only include entries whose target function survived
-    const survivingFuncIds = new Set(Object.keys(filteredState.functions.meta))
-    for (const key of Object.keys(filteredState.rpc.internalMeta)) {
-      const targetFuncId = filteredState.rpc.internalMeta[key]
-      if (!survivingFuncIds.has(targetFuncId) && !survivingFuncIds.has(key)) {
-        delete filteredState.rpc.internalMeta[key]
-        filteredState.rpc.internalFiles.delete(key)
-      }
-    }
-    for (const key of Object.keys(filteredState.rpc.exposedMeta)) {
-      const targetFuncId = filteredState.rpc.exposedMeta[key]
-      if (!survivingFuncIds.has(targetFuncId) && !survivingFuncIds.has(key)) {
-        delete filteredState.rpc.exposedMeta[key]
-        filteredState.rpc.exposedFiles.delete(key)
-      }
-    }
-    for (const key of Object.keys(filteredState.rpc.remoteMeta)) {
-      const targetFuncId = filteredState.rpc.remoteMeta[key]
-      if (!survivingFuncIds.has(targetFuncId) && !survivingFuncIds.has(key)) {
-        delete filteredState.rpc.remoteMeta[key]
-        filteredState.rpc.remoteFiles.delete(key)
-      }
-    }
-    // Prune invokedFunctions to match surviving functions
-    for (const funcId of filteredState.rpc.invokedFunctions) {
-      if (!survivingFuncIds.has(funcId)) {
-        filteredState.rpc.invokedFunctions.delete(funcId)
-      }
-    }
-  }
-
-  // Recompute requiredSchemas based on pruned functions.meta
-  if (filteredState.serviceAggregation.usedFunctions.size > 0) {
-    const prunedSchemas = new Set<string>()
-    for (const funcMeta of Object.values(
-      filteredState.functions.meta
-    ) as Array<{ inputs?: string[]; outputs?: string[] }>) {
-      if (funcMeta.inputs?.[0]) prunedSchemas.add(funcMeta.inputs[0])
-      if (funcMeta.outputs?.[0]) prunedSchemas.add(funcMeta.outputs[0])
-    }
-    filteredState.requiredSchemas = prunedSchemas
-  }
-
-  // Step dispatch is decided purely per-function: a workflow step runs via the
-  // queue only when its function is marked `workflowQueued: true`. Such a unit
-  // needs workflowService + queueService injected even though the function
-  // itself doesn't reference them. Check the ORIGINAL graph meta (before
-  // filtering pruned it).
-  const survivingFuncIds = new Set(Object.keys(filteredState.functions.meta))
-  const resolveFuncId = (rpcName: string): string =>
-    filteredState.rpc.internalMeta[rpcName] ??
-    filteredState.rpc.exposedMeta[rpcName] ??
-    rpcName
-  // Use the snapshot taken before filtering
-  for (const graph of Object.values(originalGraphMeta)) {
-    if (!graph.nodes) continue
-    for (const node of Object.values(graph.nodes)) {
-      if (!('rpcName' in node) || !node.rpcName) continue
-      const rpcName = node.rpcName as string
-      const funcId = resolveFuncId(rpcName)
-      if (!survivingFuncIds.has(funcId) && !survivingFuncIds.has(rpcName))
-        continue
-      const funcMeta = (filteredState.functions.meta[funcId] ??
-        filteredState.functions.meta[rpcName]) as { workflowQueued?: boolean }
-      if (funcMeta?.workflowQueued === true) {
-        filteredState.serviceAggregation.requiredServices.add('workflowService')
-        filteredState.serviceAggregation.requiredServices.add('queueService')
-      }
-    }
-  }
-
-  // workflowService internally calls queueService (via queueStepWorker /
-  // queueOrchestrator). Any unit that needs workflowService also needs
-  // queueService for the transitive enqueue calls — covers
-  // workflow-starter, graph-starter, workflow-runner, etc.
-  if (
-    filteredState.serviceAggregation.requiredServices.has('workflowService')
-  ) {
-    filteredState.serviceAggregation.requiredServices.add('queueService')
-  }
-
-  const keptFunctionFiles = new Set<string>()
-  for (const file of filteredState.functions.files.values()) {
-    if (file?.path) keptFunctionFiles.add(file.path)
-  }
-  for (const file of filteredState.agents.invokedAgentsByFile.keys()) {
-    if (!keptFunctionFiles.has(file)) {
-      filteredState.agents.invokedAgentsByFile.delete(file)
-    }
-  }
-
-  if ((filteredState.rpc.wireAddonDeclarations?.size ?? 0) > 0) {
-    const referencedIds = new Set<string>(
-      filteredState.serviceAggregation.usedFunctions
-    )
-    const keptFiles = new Set<string>()
-    for (const funcId of filteredState.serviceAggregation.usedFunctions) {
-      const file = filteredState.functions.files.get(funcId)
-      if (file?.path) keptFiles.add(file.path)
-    }
-    for (const [file, invoked] of state.rpc.invokedFunctionsByFile ??
-      new Map<string, Set<string>>()) {
-      if (!keptFiles.has(file)) continue
-      for (const id of invoked) {
-        referencedIds.add(id)
-        if (id.includes(':')) {
-          filteredState.serviceAggregation.usedFunctions.add(id)
-        }
-      }
-    }
-    for (const toolMeta of Object.values(
-      filteredState.mcpEndpoints?.toolsMeta ?? {}
-    ) as Array<{ pikkuFuncId?: string }>) {
-      if (toolMeta.pikkuFuncId) referencedIds.add(toolMeta.pikkuFuncId)
-    }
-    for (const agentMeta of Object.values(
-      filteredState.agents?.agentsMeta ?? {}
-    ) as Array<{ tools?: string[] }>) {
-      for (const tool of agentMeta.tools ?? []) referencedIds.add(tool)
-    }
-    // An addon RPC named outright in the filter is what a unit built FOR that
-    // addon is given, so its declaration has to survive even though no
-    // app-local function references it.
-    for (const name of filters.names ?? []) {
-      const namespace = name.slice(0, name.indexOf(':'))
-      if (namespace && filteredState.rpc.wireAddonDeclarations.has(namespace)) {
-        referencedIds.add(name)
-      }
-    }
-    const keptNamespaces = new Set<string>()
-    for (const namespace of filteredState.rpc.wireAddonDeclarations.keys()) {
-      const prefix = `${namespace}:`
-      for (const id of referencedIds) {
-        if (id.startsWith(prefix)) {
-          keptNamespaces.add(namespace)
-          break
-        }
-      }
-    }
-    filteredState.rpc.wireAddonDeclarations = new Map(
-      [...filteredState.rpc.wireAddonDeclarations].filter(([namespace]) =>
-        keptNamespaces.has(namespace)
-      )
-    )
-    filteredState.rpc.usedAddons = new Set(
-      [...filteredState.rpc.usedAddons].filter((namespace) =>
-        keptNamespaces.has(namespace)
-      )
-    )
-  }
-
-  // Recalculate requiredServices based on filtered functions/middleware/permissions
-  // Need to cast to InspectorState temporarily for aggregateRequiredServices
-  const stateForAggregation = filteredState as InspectorState
-  aggregateRequiredServices(stateForAggregation)
-
-  return filteredState
-}