@pikku/inspector 0.12.75 → 0.12.82

package/CHANGELOG.md

@@ -1,3 +1,360 @@
+## 0.12.82
+
+### Patch Changes
+
+- c842054: Middleware instance ids are now allocated per group across the whole inspection, not per source file, and a build that would drop a global middleware registration fails instead of shipping.
+
+  The per-group index restarted at 0 for every file, so the second file to register against a group minted ids the first already owned and overwrote its entries in `middleware.instances` — `instanceIds` listed one key twice while `count` correctly said two. For `addGlobalMiddleware` that was not cosmetic. Global middleware belongs to no wire group, so the instance map is the only record that its module must be imported, and per-unit deploy codegen emits its side-effect imports from that map. An app file registering a global middleware was erased by the generated auth scaffold registering its own, the app's module was never imported, its registration never ran — and because auth commonly lives in global middleware, a deployed unit answered every authenticated route with a 401 against a clean build log.
+
+  The inspector now also records each `addGlobalMiddleware` file in `middleware.globalFiles`, a plain set that no key collision can corrupt; codegen emits the side-effect imports from it, generates the middleware file when global middleware is a project's only middleware, and asserts against the text it emitted that every such file is imported — naming the files if not, rather than letting the unit deploy without its auth gate.
+
+- dfd7019: Resolve the MCP server instance per log message, and restore the wireAddon
+  declaration's source file.
+- 1469e73: The app names which of an addon's functions reach MCP
+
+  `wireAddon`'s `mcp` takes a list as well as `true`. `true` still offers every
+  function the addon declared `mcp: true`; a list names the tools this deployment
+  offers, whether or not the addon declared them, and is typed against the
+  function names that addon publishes — a typo is a compile error rather than a
+  tool silently missing from the menu.
+
+- Updated dependencies [c842054]
+- Updated dependencies [dfd7019]
+- Updated dependencies [dfd7019]
+- Updated dependencies [9b978e7]
+- Updated dependencies [1469e73]
+  - @pikku/core@0.12.113
+
+## 0.12.81
+
+### Patch Changes
+
+- 78237ac: The console shows feature flags as a launch board, and analytics events as a
+  declared catalog.
+
+  A flag's state is four fields — `enabled`, `rolloutPercent`, `declared`,
+  `backed` — and none of them is the question an operator actually asks, which is
+  how far this has got. The board answers that directly: every declared flag sits
+  in the lane its rollout has reached, `dark` → `rolling` → `live`, with
+  `attention` for the flags that are not resolving in a way anybody chose.
+
+  Attention is evaluated before every other reading, and that ordering is the
+  whole point rather than an implementation detail. A flag declared in code with
+  no row in the store fails open, and it reports `enabled: true` with no rollout
+  limit — byte-identical to a deliberate full launch. Read the fields in the
+  obvious order and the one production-severity state on the board renders as the
+  healthiest one. `groupFlagsByLane` also returns all four lanes whether or not
+  they hold anything, because a board read by shape must not rearrange itself the
+  moment a lane empties.
+
+  Selecting a flag opens its controls beside the board rather than over it: the
+  switch, the rollout bucket, and the subjects pinned on or off past that bucket.
+  They share one surface because they are read together — "off for everyone except
+  these three" is a switch and an override row, and an operator who has to leave
+  one screen to see the other is the operator who turns a flag on for everybody by
+  mistake. The panel tracks the open flag by name and re-reads it from the list, so
+  committing a rollout moves the card and the panel together instead of leaving the
+  panel describing the flag as it was before the operator changed it.
+
+  A board whose flags come from a `FeatureFlagSource` — a provider Pikku reads but
+  does not own — says so and offers no controls, rather than offering controls that
+  would fail.
+
+  The analytics screen is a catalog of what the code declares, read from build-time
+  meta: the events a client may emit and the props each carries, with every prop
+  rendered as the schema source text the declaration wrote. It is deliberately not
+  a volume report — nothing here counts what was emitted — and saying which of the
+  two it is turned out to be the only design question the screen had.
+
+  Turning a flag on while it carries no rollout limit now asks first. That press
+  is the one irreversible thing the board can do — with no bucket left to hold
+  anybody back it admits everyone the flag's capabilities allow — and it used to
+  be a single click on a switch. The panel also reports what a mutation is doing
+  and what it refused to do: the controls it is waiting on go into a pending
+  state, and a failed write raises an inline `<Alert>` rather than reverting in
+  silence. The console mounts no notification provider, so the feedback is inline
+  where the action is, which is the idiom the rest of the console already uses.
+
+  `@pikku/mantine`'s theme gains four aliases, and they close a contrast defect
+  that predates this board:
+
+  ```ts
+  '--mantine-color-orange-light': 'var(--app-surface-warning)',
+  '--mantine-color-orange-light-color': 'var(--app-amber)',
+  '--mantine-color-teal-light': 'var(--app-surface-success)',
+  '--mantine-color-teal-light-color': 'var(--app-green)',
+  ```
+
+  The theme already documents two colour tiers — TEXT must clear AA, GRAPHIC only
+  3:1 — and already pulls Mantine's own variables into that contract rather than
+  linting call sites. What it had not covered was Mantine's _light variants_:
+  `<Alert color="orange">` renders #d9480f on #ffe8cc at 3.62:1, and
+  `<Badge variant="light" color="teal">` at 4.33:1, neither reachable from an
+  `--app-*` token because the component never asks for one. The ramp itself is
+  deliberately untouched: Mantine conflates `--mantine-color-orange-filled`
+  between `c="orange"` text and a `variant="filled"` background, so darkening it
+  for light-mode text would make an existing filled badge unreadable in dark mode.
+  Eight pre-existing `c="orange"` call sites moved onto the amber TEXT tier in the
+  same pass.
+
+  The analytics catalog is grouped by the file that declares each event, and its
+  rows are real buttons rather than table cells carrying a tabindex.
+
+  `ShellHeaderAction` gains `loading` and `testId`, and `ActionCluster` gains a
+  `measurement` flag. `ShellHeader` sizes its actions by rendering them a second
+  time off-screen, and that measuring copy was carrying the same `data-testid` and
+  `data-help` as the real one — so every action on a page with a collapsing header
+  resolved to two elements. The flags board also moved its two header actions from
+  `actionsNode` (documented as the non-collapsing escape hatch) onto the structured
+  `actions` array, which is what stopped them clipping off the right edge at 400px.
+
+- Updated dependencies [78237ac]
+- Updated dependencies [add56d2]
+  - @pikku/core@0.12.111
+
+## 0.12.80
+
+### Patch Changes
+
+- 1c9a55a: Give `pikku dev` and `pikku serve` a database-backed flag store and analytics sink.
+
+  Both followed `agentStorage` and friends everywhere except in being wired: with a
+  local database present, `dev` built one for agents, workflows and scopes and left
+  feature flags unregistered — which makes every gate resolve open — and analytics
+  on the logger fallback. Both are now built from the same `kysely`, and dropped
+  with a warning naming `pikku db generate` rather than failing the boot when the
+  tables are not there yet.
+
+  The inspector now counts a `featureFlag:` declaration as needing `featureFlags`
+  and a `defineAnalyticsEvents` declaration as needing `analyticsService`, the same
+  way a declared scope implies `scopeService`. Neither service is ever destructured
+  — the runner reaches both out of the singleton services — so without this the
+  declaration was invisible to service aggregation and `pikku db generate` wrote no
+  tables for either.
+
+- 52eb461: Prune a unit's addon wiring files alongside its addon declarations, so a
+  deployment unit no longer imports (and registers) addons whose functions the
+  unit filter dropped. `wireAddon` now records the app file that declared it, and
+  a file is dropped only when every addon it wires is dropped.
+- 1c9a55a: Feature flags, declared in source and resolved from two independent booleans.
+
+  `defineFeatureFlags` declares a flag the way `defineScopes` declares a scope —
+  the inspector collects it, the CLI emits a `FeatureFlagName` union, and a
+  misspelled `featureFlag:` is a type error rather than a gate that silently fails
+  open.
+
+  A flag answers two questions that are not the same question. `capable` comes
+  from the session's scopes and is per-user, advisory, and protects nothing — it
+  hides UI. `available` comes from one global config snapshot, is caller-blind,
+  and is the only half the runner enforces: `override(subject) ?? (enabled AND
+bucket)`, so "off for everyone except these three organizations" is one row, and
+  a kill is one write rather than a fan-out. Authorization stays where it was, in
+  the function's own `scopes:` — enforcing capability would make a flag a second
+  authorization path OR-ing against them. An unavailable feature throws 503, not
+  403, because the caller was allowed; the feature was not on.
+
+  `featureFlag:` is deliberately available on sessionless functions too. It reads
+  the config, not the session, so the kill switch reaches a cron task, a queue
+  worker and a webhook — which is where it matters most, since nobody is watching
+  a UI to notice the feature is off.
+
+  Refresh is pull-on-demand, so the TTL is the kill-switch latency. Where that is
+  too long, `invalidate()` is public: a provider's change webhook lands on an HTTP
+  wiring, drops the cache, and the next request does the read. It deliberately
+  does not fetch — a burst of webhooks would be N round trips, and on a serverless
+  runtime the isolate that took the signal may be gone before anything reads the
+  result.
+
+  Availability fails open through three layers: a fresh read, then the last good
+  cached read, then the compiled declaration. The middle layer is load-bearing —
+  dropping straight to the compiled fallback on a blip would switch on every flag
+  that was deliberately dark.
+
+  Backing stores split along what they can honestly do. `FeatureFlagSource` is
+  read-only (`snapshot()`) and is what a third-party provider implements;
+  `FeatureFlagStore` adds the write half and is for stores Pikku owns.
+  `@pikku/kysely` ships the store, with declarations synced additively — a removed
+  declaration is marked undeclared, never revoked, and a sync never re-enables a
+  killed flag. Third-party providers implement the read-only half in the addons
+  repository, over plain `fetch` rather than a vendor SDK — those poll on a timer
+  belonging to a long-lived process, which a serverless isolate cannot hold
+  between requests.
+
+  A client asks for its flags once per session rather than per flag:
+  `scaffold.featureFlags` generates a `GET /feature-flags` returning every
+  declared flag resolved for the caller, keyed by this app's `FeatureFlagName`.
+  Generated into the app rather than shipped in an addon precisely for that union
+  — an addon never sees the host's, and could only answer
+  `Record<string, boolean>`. It returns `show` alone: sending `available` apart
+  from `capable` would tell every visitor which features exist but are dark.
+
+  The write half is the operator's, and lives in `@pikku/addon-admin` beside the
+  scope RPCs, under a new `admin:flags` scope. `flagList` reports `writable:
+false` rather than failing when flags come from a provider, because a provider's
+  own UI is its operator surface and a console full of buttons that 500 is worse
+  than a read-only tab. It still lists the flags: a source may report its declared
+  set through `declaredFlags()`, and each row carries `backed`, false where the
+  provider has never heard of a declared flag. That row is the one worth seeing —
+  an absent row fails open, so a dark launch nobody created in PostHog is already
+  live for everyone, and a store pikku owns can reconcile that on deploy where a
+  provider cannot.
+
+  On the client, `createFeatureFlags` fetches that map once and `useFeatureFlag`
+  reads it synchronously after, through the same provider the analytics client
+  hangs off. It takes a `bootstrap` map so a server-rendered page hydrates onto
+  the answer it already computed: without one there is a gap in which neither
+  default is right, since false hides a feature the user has and true flashes one
+  they do not. A failed refresh keeps the map already on screen rather than
+  relabelling every flag on a blip.
+
+- Updated dependencies [1c9a55a]
+- Updated dependencies [1c9a55a]
+- Updated dependencies [1c9a55a]
+  - @pikku/core@0.12.110
+
+## 0.12.79
+
+### Patch Changes
+
+- 54138b1: Product analytics moves into core behind a `scaffold.analytics` generator.
+
+  An app declares what it measures, and nothing else:
+
+  ```ts
+  import { defineAnalyticsEvents } from '#pikku/analytics'
+
+  export const analyticsEvents = defineAnalyticsEvents({
+    page_viewed: z.object({ path: z.string() }),
+    todo_created: z.object({ priority: z.enum(['low', 'medium', 'high']) }),
+  })
+  ```
+
+  The definer reaches an app through the generated `#pikku/analytics` leaf, the
+  way `defineFeatureFlags` reaches it through `#pikku/scopes` — an app declares
+  what it measures without importing out of core. The leaf is written on every
+  run, whatever `scaffold.analytics` says: the declaration is how a project names
+  what it measures, and the scaffold only decides whether an ingest wire is
+  generated for it. Its path is `analyticsTypesFile`, defaulting to
+  `<outDir>/analytics/pikku-analytics-types.gen.ts`. It carries the sink surface
+  as well as the definer — `AnalyticsService`, `AnalyticsRecord`,
+  `AnalyticsIdentity`, `AnalyticsClientContext`, `AnalyticsLog`,
+  `LoggerAnalyticsService` — because writing the destination events go to is the
+  other half of the same job, and both halves should come through one door.
+
+  The name is the key, so it is never repeated as a `z.literal` inside the
+  schema. Declare in as many modules as suits the project — a feature declares
+  its events beside its functions — and the CLI unions them into the generated
+  `/analytics` ingest and its schemas. The inspector finds the declarations the
+  way it finds every other wiring, so there is no path to configure.
+
+  Where events go is not part of the declaration. `services.analytics` is the
+  request-scoped buffer a function records into, typed against the declared
+  names:
+
+  ```ts
+  await analytics.record({ name: 'todo_created', priority: 'high' })
+  ```
+
+  It stamps identity, trace and wire fields from the invocation, buffers for the
+  length of the call and flushes once when it ends. Identity is always
+  server-side and never read from a request body, which is what makes the
+  unauthenticated ingest safe to expose.
+
+  The transport behind it is an `AnalyticsService` on singleton services — the
+  one swappable slot. With none wired the runner installs
+  `LoggerAnalyticsService`, so an app that turns the scaffold on can watch events
+  arrive without first choosing a store; a platform injects its own through
+  singleton services, and an app that wants neither sets `analyticsService` in
+  its own `services.ts`, which runs last and wins. There is no process-global
+  sink registry and no noop: events are never silently dropped.
+
+  The generated wire is added to the set of scaffolds the inspector reads.
+  Nothing imports it — it is a wiring, not a module anyone calls — so without
+  that the route was written and never registered: no HTTP wiring, no entry in
+  the fetch client, an endpoint that 404s.
+
+  No middleware is emitted with the wire: an origin lock rejects every native
+  client and is forgeable anyway, so guarding the route is the project's call.
+
+  `name` belongs to the event, not to its props. The generated union rebuilds
+  each member from the declared schema's shape and attaches the literal name
+  last, so a declaration that happens to carry a `name` prop of its own cannot
+  displace the discriminator the union is built on. Props schemas are typed to
+  require that shape, so a schema that has none — a union, a primitive — is
+  refused at the declaration rather than in generated code.
+
+- Updated dependencies [54138b1]
+  - @pikku/core@0.12.109
+
+## 0.12.78
+
+### Patch Changes
+
+- d067ac9: Skip the schema-generator retention assertion under `--coverage`. Coverage
+  instrumentation keeps per-line counters alive for the life of the run, so the
+  heap delta cannot discriminate a retained `ts.Program` from accumulated
+  counters, and `Unit Coverage` failed intermittently while `Unit Tests` passed on
+  the same commit. Matches the existing guard in `module-runner.test.ts`.
+
+## 0.12.77
+
+### Patch Changes
+
+- 5c236ee: A deployment unit records why it is where it is. `DeploymentUnit` gains `groupedBy` — the `deploy.grouping` rule that put its functions together — and `targetForcedBy` — the `serverlessIncompatible` services that crossed it to `target: 'server'`. Both are absent for the fallback and for a target that was chosen rather than forced, so anything reading a manifest can tell a deliberate `server` unit from a crossed one. `resolveDeployTarget` now shares `incompatibleServicesFor` with the analyzer, so resolving a target and explaining it cannot drift.
+
+## 0.12.76
+
+### Patch Changes
+
+- 4c7a1b5: Run the monorepo's own scripts through bun instead of yarn. What moves is the
+  package manager each package's `prepublishOnly` and build scripts invoke, plus
+  the two manifest fixes bun needs to resolve the tree: `uWebSockets.js` is
+  declared with an explicit `github:` specifier, and `@pikku/uws-handler` marks
+  its `uWebSockets.js` peer optional so a bun install of a consumer that brings
+  its own uWS app does not try to fetch it from the registry.
+
+  Three published behaviours change, all of them cases where an isolated
+  `node_modules` or bun as the runtime had been papered over by yarn's hoisting:
+
+  - `@pikku/migrator-sql` turns foreign keys on when it opens a sqlite database
+    through bun. `node:sqlite` enforces them by default and `bun:sqlite` does not,
+    which silently turned every `ON DELETE CASCADE` into a no-op under
+    `bunx --bun pikku`.
+  - `@pikku/cli` resolves a deploy provider against the project being deployed
+    rather than against wherever the CLI itself is installed, which is what its
+    own "is not installed" error asks the user to arrange.
+  - `@pikku/cli` treats a specifier a runtime hands straight back — bun does this
+    for the modules it implements itself — as not resolved from the project, so
+    it falls back rather than loading the runtime's own copy.
+
+- 9d7a96d: Deprioritise the generated session middleware instead of skipping it
+
+  Two session middlewares were reconciled by having the CLI inspect the app for
+  its own `betterAuthSession` / `betterAuthStatelessSession` registration and then
+  generate nothing (pikkujs/pikku#754). That silently dropped everything emitted
+  alongside — including the `PIKKU_CONSOLE_TOKEN` bearer, so an app that
+  customized `mapSession` answered `MissingScopeError` on every `console:*` RPC.
+
+  All three session middlewares now take a `priority`, and the CLI generates its
+  registration at `lowest`. An app's own registration defaults to `medium`, so it
+  resolves the session first and the generated one short-circuits on its existing
+  `if (session) next()`. Nothing is detected and nothing is skipped;
+  `state.auth.userStatelessSession` and `state.auth.hasUserSessionMiddleware` are
+  gone.
+
+  `betterAuthSession`, `betterAuthStatelessSession` and the session store now also
+  carry the organization plugin's `activeOrganizationId` onto `session.orgId`
+  without a `mapSession`, and `impersonation.loadUser` defaults to better-auth's
+  own `findUserById` — the two things an app most often wrote a whole `mapSession`
+  for.
+
+- bb6abc2: The CLI's own code no longer imports the TypeScript compiler API. `collectSurface` moved out of `@pikku/cli` into a new `@pikku/inspector/surface` entry point, and the two smaller compiler needs the CLI had are exposed as `readModuleSpecifiers` and `readTsconfigOutDir`.
+
+  `typescript` drops to a devDependency on `@pikku/cli`. It still arrives transitively through `@pikku/code-edit`, which needs a parser to rewrite your source and is loaded only by `pikku meta apply` and the console's edit RPCs.
+
+- Updated dependencies [4c7a1b5]
+  - @pikku/core@0.12.108
+
 ## 0.12.75
 
 ### Patch Changes

package/dist/add/add-analytics.d.ts

@@ -0,0 +1,9 @@
+import * as ts from 'typescript';
+import type { InspectorLogger, InspectorState } from '../types.js';
+/**
+ * Record where each `defineAnalyticsEvents` declaration is, which names it
+ * declares, and the shape each name validates — the names drive the generated
+ * ingest, which reads the schemas off the declaration itself; the shapes are
+ * read here only so the console can show what an event carries.
+ */
+export declare const addAnalytics: (logger: InspectorLogger, node: ts.Node, checker: ts.TypeChecker, state: InspectorState) => void;

package/dist/add/add-analytics.js

@@ -0,0 +1,178 @@
+import * as ts from 'typescript';
+import { isNamedExport } from '../utils/extract-function-name.js';
+const DEFINE_ANALYTICS_EVENTS = 'defineAnalyticsEvents';
+/**
+ * A call is the pikku one when the symbol it resolves to is, whatever the file
+ * chose to call it locally — `import { defineAnalyticsEvents as declare }` is
+ * an ordinary thing to write, and matching on the callee's text alone both
+ * misses that and claims a same-named local helper.
+ */
+const callsDefineAnalyticsEvents = (expression, checker) => {
+    if (!ts.isIdentifier(expression))
+        return false;
+    const symbol = checker.getSymbolAtLocation(expression);
+    if (!symbol)
+        return expression.text === DEFINE_ANALYTICS_EVENTS;
+    // An import specifier names what it imported even when the module itself
+    // does not resolve, which is every project whose deps are not installed yet.
+    const declaration = symbol.declarations?.[0];
+    if (declaration && ts.isImportSpecifier(declaration)) {
+        return ((declaration.propertyName ?? declaration.name).text ===
+            DEFINE_ANALYTICS_EVENTS);
+    }
+    // Only an import can be pikku's. A file's own helper of the same name
+    // resolves to a symbol whose `.name` matches, so resolving without this
+    // claims it — the mirror of what matching on the callee's text misses.
+    if (!(symbol.flags & ts.SymbolFlags.Alias))
+        return false;
+    const resolved = checker.getAliasedSymbol(symbol) ?? symbol;
+    return resolved.name === DEFINE_ANALYTICS_EVENTS;
+};
+/**
+ * The name the generated ingest has to import the declaration by — which is
+ * the name the module exports it under, not the name of the const. A module
+ * that keeps the declaration to itself has no such name, so it is refused here
+ * rather than emitted into an ingest that cannot compile.
+ */
+const exportedName = (declaration, name, checker) => {
+    const moduleSymbol = checker.getSymbolAtLocation(declaration.getSourceFile());
+    const declarationSymbol = checker.getSymbolAtLocation(name);
+    if (!moduleSymbol || !declarationSymbol) {
+        return isNamedExport(declaration, checker) ? name.text : undefined;
+    }
+    for (const exported of checker.getExportsOfModule(moduleSymbol)) {
+        const resolved = exported.flags & ts.SymbolFlags.Alias
+            ? (checker.getAliasedSymbol(exported) ?? exported)
+            : exported;
+        if (resolved === declarationSymbol)
+            return exported.name;
+    }
+    return undefined;
+};
+/**
+ * The `z.object({ ... })` an event's schema is built from, wherever it sits in
+ * a chain — `z.object({}).strict()` and `z.object({}).describe('…')` are both
+ * ordinary things to write, and the shape is on the innermost call either way.
+ */
+const findObjectShape = (expression) => {
+    let current = expression;
+    while (current && ts.isCallExpression(current)) {
+        const callee = current.expression;
+        if (ts.isPropertyAccessExpression(callee) &&
+            callee.name.text === 'object') {
+            const [shape] = current.arguments;
+            if (shape && ts.isObjectLiteralExpression(shape))
+                return shape;
+        }
+        current = ts.isPropertyAccessExpression(callee)
+            ? callee.expression
+            : undefined;
+    }
+    return undefined;
+};
+/**
+ * An event's props, as source text rather than a resolved type — `z.string()`
+ * is what the declaration says and what a reader recognises, and resolving it
+ * would mean type-checking a third-party generic to render one table cell.
+ *
+ * Absent for a schema pikku cannot read the shape off (a shared const, a union,
+ * a vendor that is not zod). The catalog renders nothing rather than guessing.
+ */
+const readEventShape = (initializer) => {
+    const shape = findObjectShape(initializer);
+    if (!shape)
+        return undefined;
+    const props = {};
+    for (const property of shape.properties) {
+        if (!ts.isPropertyAssignment(property))
+            continue;
+        const key = property.name;
+        const propName = ts.isIdentifier(key)
+            ? key.text
+            : ts.isStringLiteral(key)
+                ? key.text
+                : undefined;
+        if (propName === undefined)
+            continue;
+        props[propName] = property.initializer.getText().replace(/\s+/g, ' ');
+    }
+    return props;
+};
+/**
+ * Record where each `defineAnalyticsEvents` declaration is, which names it
+ * declares, and the shape each name validates — the names drive the generated
+ * ingest, which reads the schemas off the declaration itself; the shapes are
+ * read here only so the console can show what an event carries.
+ */
+export const addAnalytics = (logger, node, checker, state) => {
+    if (!ts.isVariableDeclaration(node))
+        return;
+    const { initializer, name } = node;
+    if (!initializer || !ts.isCallExpression(initializer))
+        return;
+    if (!callsDefineAnalyticsEvents(initializer.expression, checker))
+        return;
+    if (!ts.isIdentifier(name))
+        return;
+    const file = node.getSourceFile().fileName;
+    const [argument] = initializer.arguments;
+    if (!argument || !ts.isObjectLiteralExpression(argument)) {
+        logger.error(`defineAnalyticsEvents in ${file} must be called with an object literal keyed by event name, so the generated ingest knows what to union.`);
+        return;
+    }
+    const events = [];
+    const props = {};
+    for (const property of argument.properties) {
+        // `{ page_viewed }` names the event in the shorthand's own identifier.
+        if (ts.isShorthandPropertyAssignment(property)) {
+            events.push(property.name.text);
+            continue;
+        }
+        if (!ts.isPropertyAssignment(property))
+            continue;
+        const key = property.name;
+        const eventName = ts.isIdentifier(key)
+            ? key.text
+            : ts.isStringLiteral(key)
+                ? key.text
+                : undefined;
+        if (eventName === undefined)
+            continue;
+        events.push(eventName);
+        const shape = readEventShape(property.initializer);
+        if (shape)
+            props[eventName] = shape;
+    }
+    if (events.length === 0) {
+        logger.error(`defineAnalyticsEvents in ${file} declares no events. Remove it or add one.`);
+        return;
+    }
+    const variable = exportedName(node, name, checker);
+    if (!variable) {
+        logger.error(`defineAnalyticsEvents in ${file} is assigned to '${name.text}', which the module does not export. The generated ingest imports every declaration by name, so export it.`);
+        return;
+    }
+    // A declaration whose shapes the inspector could not read carries no props,
+    // which the meta says by leaving the field off rather than by an empty object.
+    const readProps = Object.keys(props).length > 0 ? props : undefined;
+    const declarations = (state.analytics ??= []);
+    const existing = declarations.find((declaration) => declaration.file === file && declaration.variable === variable);
+    if (existing) {
+        existing.events = events;
+        if (readProps)
+            existing.props = readProps;
+        else
+            delete existing.props;
+        return;
+    }
+    for (const eventName of events) {
+        const declaredIn = declarations.find((declaration) => declaration.events.includes(eventName));
+        if (declaredIn) {
+            logger.error(`Analytics event '${eventName}' is declared twice: ${declaredIn.file} and ${file}. An event name belongs to one declaration.`);
+            return;
+        }
+    }
+    declarations.push(readProps
+        ? { file, variable, events, props: readProps }
+        : { file, variable, events });
+};

package/dist/add/add-auth.js

@@ -108,36 +108,6 @@ const readPluginEntry = (el, bindings) => {
     }
     return undefined;
 };
-/**
- * True when `node` sits inside a GLOBAL middleware registration — i.e. an actual
- * global registration, not a bare standalone call or a route-scoped one.
- *
- * `addGlobalMiddleware(...)` is always global. `addHTTPMiddleware` is global only
- * in its array form (`addHTTPMiddleware([...])`) or with the `'*'` wildcard
- * pattern; a specific route pattern (`addHTTPMiddleware('/api/admin/*', [...])`)
- * scopes the middleware to that route and must NOT count as a global stateless
- * registration (#754).
- */
-const isInsideGlobalMiddlewareRegistration = (node) => {
-    let parent = node.parent;
-    while (parent) {
-        if (ts.isCallExpression(parent) && ts.isIdentifier(parent.expression)) {
-            const fn = parent.expression.text;
-            if (fn === 'addGlobalMiddleware')
-                return true;
-            if (fn === 'addHTTPMiddleware') {
-                const first = parent.arguments[0];
-                if (!first)
-                    return false;
-                // String first arg → route pattern (global only when '*'); otherwise
-                // the array form, which is global.
-                return ts.isStringLiteral(first) ? first.text === '*' : true;
-            }
-        }
-        parent = parent.parent;
-    }
-    return false;
-};
 /**
  * Refusal for better-auth's `admin()`, which pikku does not support.
  *
@@ -193,30 +163,6 @@ export const addAuth = (logger, node, _checker, state) => {
     if (!ts.isCallExpression(node))
         return;
     const expression = node.expression;
-    // A user-registered stateless session middleware (custom mapSession) means the
-    // CLI must NOT auto-generate its own default-map one — the generated one runs
-    // first and pre-empts the user's via the `if (session) next()` short-circuit
-    // (pikkujs/pikku#754). Only a GLOBAL registration counts (inside
-    // addHTTPMiddleware/addGlobalMiddleware) — a bare betterAuthStatelessSession()
-    // call (e.g. a test harness) is not a registration. Ignore generated files so
-    // the emitted middleware can't self-trigger the skip.
-    if (ts.isIdentifier(expression) &&
-        expression.text === 'betterAuthStatelessSession' &&
-        !node.getSourceFile().fileName.endsWith('.gen.ts') &&
-        isInsideGlobalMiddlewareRegistration(node)) {
-        state.auth.userStatelessSession = true;
-    }
-    // Same rule for the stateful variant: a user-registered global
-    // betterAuthSession(...) (custom mapSession/impersonation/apiKey) means the CLI
-    // must NOT auto-generate its own default one — the generated one runs first and
-    // pre-empts the user's via the `if (session) next()` short-circuit. Stateful
-    // analogue of the betterAuthStatelessSession skip above.
-    if (ts.isIdentifier(expression) &&
-        expression.text === 'betterAuthSession' &&
-        !node.getSourceFile().fileName.endsWith('.gen.ts') &&
-        isInsideGlobalMiddlewareRegistration(node)) {
-        state.auth.hasUserSessionMiddleware = true;
-    }
     if (!ts.isIdentifier(expression) || expression.text !== 'pikkuBetterAuth')
         return;
     const sourceFile = node.getSourceFile().fileName;

package/dist/add/add-feature-flag.d.ts

@@ -0,0 +1,2 @@
+import type { AddWiring } from '../types.js';
+export declare const addFeatureFlag: AddWiring;