@pikku/inspector 0.12.81 → 0.12.82

package/CHANGELOG.md

@@ -1,3 +1,30 @@
+## 0.12.82
+
+### Patch Changes
+
+- c842054: Middleware instance ids are now allocated per group across the whole inspection, not per source file, and a build that would drop a global middleware registration fails instead of shipping.
+
+  The per-group index restarted at 0 for every file, so the second file to register against a group minted ids the first already owned and overwrote its entries in `middleware.instances` — `instanceIds` listed one key twice while `count` correctly said two. For `addGlobalMiddleware` that was not cosmetic. Global middleware belongs to no wire group, so the instance map is the only record that its module must be imported, and per-unit deploy codegen emits its side-effect imports from that map. An app file registering a global middleware was erased by the generated auth scaffold registering its own, the app's module was never imported, its registration never ran — and because auth commonly lives in global middleware, a deployed unit answered every authenticated route with a 401 against a clean build log.
+
+  The inspector now also records each `addGlobalMiddleware` file in `middleware.globalFiles`, a plain set that no key collision can corrupt; codegen emits the side-effect imports from it, generates the middleware file when global middleware is a project's only middleware, and asserts against the text it emitted that every such file is imported — naming the files if not, rather than letting the unit deploy without its auth gate.
+
+- dfd7019: Resolve the MCP server instance per log message, and restore the wireAddon
+  declaration's source file.
+- 1469e73: The app names which of an addon's functions reach MCP
+
+  `wireAddon`'s `mcp` takes a list as well as `true`. `true` still offers every
+  function the addon declared `mcp: true`; a list names the tools this deployment
+  offers, whether or not the addon declared them, and is typed against the
+  function names that addon publishes — a typo is a compile error rather than a
+  tool silently missing from the menu.
+
+- Updated dependencies [c842054]
+- Updated dependencies [dfd7019]
+- Updated dependencies [dfd7019]
+- Updated dependencies [9b978e7]
+- Updated dependencies [1469e73]
+  - @pikku/core@0.12.113
+
 ## 0.12.81
 
 ### Patch Changes

package/dist/add/add-middleware.js

@@ -47,6 +47,52 @@ function recordMiddlewareGroup(groups, key, group) {
         services: Array.from(new Set([...existing.services.services, ...group.services.services])),
     };
 }
+/**
+ * Record one `add*Middleware` call's entries in the instance map, giving each
+ * entry an id that is unique across the whole inspection.
+ *
+ * The index used to restart at 0 for every call, so a second file registering
+ * against the same group (or against `global`, which is one group for the whole
+ * project) minted ids the first file already owned and silently overwrote its
+ * entries. For `global:*` that is fatal rather than cosmetic: the instance map
+ * is the only record of a global registration, and per-unit deploy codegen
+ * emits its side-effect imports from that map — a lost entry means the module
+ * is never imported, `addGlobalMiddleware` never runs, and an auth gate is
+ * simply absent from the deployed unit with nothing in the build log.
+ *
+ * Allocating from the ids already present makes N registrations against one
+ * group produce N distinct entries, whatever order the files are visited in.
+ */
+function registerMiddlewareInstances(instances, groupType, groupKey, entries, sourceFile, position) {
+    // The inspector may revisit a file; the same call site is not a second
+    // registration, and re-allocating would inflate the map on every pass.
+    const alreadyRecorded = Object.entries(instances)
+        .filter(([id, instance]) => instance.sourceFile === sourceFile &&
+        instance.position === position &&
+        id.startsWith(`${makeContextBasedId(groupType, groupKey)}:`))
+        .map(([id]) => id);
+    if (alreadyRecorded.length === entries.length) {
+        return alreadyRecorded;
+    }
+    const instanceIds = [];
+    let next = 0;
+    for (const entry of entries) {
+        let instanceId = makeContextBasedId(groupType, groupKey, String(next));
+        while (instances[instanceId]) {
+            next++;
+            instanceId = makeContextBasedId(groupType, groupKey, String(next));
+        }
+        instances[instanceId] = {
+            definitionId: entry.definitionId,
+            sourceFile,
+            position,
+            isFactoryCall: entry.isFactoryCall,
+        };
+        instanceIds.push(instanceId);
+        next++;
+    }
+    return instanceIds;
+}
 function renameTempDefinitions(state, definitionIds, groupType, groupKey, storeKey = 'middleware') {
     const tempIndices = definitionIds
         .map((name, i) => (name.startsWith('__temp_') ? i : -1))
@@ -237,17 +283,10 @@ export const addMiddleware = (logger, node, checker, state) => {
             renameTempDefinitions(state, definitionIds, 'tag', tag);
         }
         const sourceFile = node.getSourceFile().fileName;
-        const instanceIds = [];
-        for (let i = 0; i < refs.length; i++) {
-            const instanceId = makeContextBasedId('tag', tag, String(i));
-            state.middleware.instances[instanceId] = {
-                definitionId: definitionIds[i],
-                sourceFile,
-                position: node.getStart(),
-                isFactoryCall: refs[i].isFactoryCall,
-            };
-            instanceIds.push(instanceId);
-        }
+        const instanceIds = registerMiddlewareInstances(state.middleware.instances, 'tag', tag, refs.map((ref, i) => ({
+            definitionId: definitionIds[i],
+            isFactoryCall: ref.isFactoryCall,
+        })), sourceFile, node.getStart());
         const allServices = new Set();
         for (const defId of definitionIds) {
             const def = state.middleware.definitions[defId];
@@ -309,15 +348,14 @@ export const addMiddleware = (logger, node, checker, state) => {
             renameTempDefinitions(state, definitionIds, 'global', 'middleware');
         }
         const sourceFile = node.getSourceFile().fileName;
-        for (let i = 0; i < refs.length; i++) {
-            const instanceId = makeContextBasedId('global', 'middleware', String(i));
-            state.middleware.instances[instanceId] = {
-                definitionId: definitionIds[i],
-                sourceFile,
-                position: node.getStart(),
-                isFactoryCall: refs[i].isFactoryCall,
-            };
-        }
+        registerMiddlewareInstances(state.middleware.instances, 'global', 'middleware', refs.map((ref, i) => ({
+            definitionId: definitionIds[i],
+            isFactoryCall: ref.isFactoryCall,
+        })), sourceFile, node.getStart());
+        // The instance map is one map for the whole project, and codegen reads it
+        // by string-prefix. This set is the independent witness that lets codegen
+        // fail loudly if a global registration ever goes missing from it.
+        state.middleware.globalFiles.add(sourceFile);
         // Without this, bootstrap codegen's "import every file with a wire-call"
         // pass skips middleware-only files and the registration never runs.
         state.http.files.add(sourceFile);
@@ -347,17 +385,10 @@ export const addMiddleware = (logger, node, checker, state) => {
             renameTempDefinitions(state, definitionIds, 'http', pattern);
         }
         const sourceFile = node.getSourceFile().fileName;
-        const instanceIds = [];
-        for (let i = 0; i < refs.length; i++) {
-            const instanceId = makeContextBasedId('http', pattern, String(i));
-            state.middleware.instances[instanceId] = {
-                definitionId: definitionIds[i],
-                sourceFile,
-                position: node.getStart(),
-                isFactoryCall: refs[i].isFactoryCall,
-            };
-            instanceIds.push(instanceId);
-        }
+        const instanceIds = registerMiddlewareInstances(state.middleware.instances, 'http', pattern, refs.map((ref, i) => ({
+            definitionId: definitionIds[i],
+            isFactoryCall: ref.isFactoryCall,
+        })), sourceFile, node.getStart());
         const allServices = new Set();
         for (const defId of definitionIds) {
             const def = state.middleware.definitions[defId];
@@ -581,17 +612,10 @@ export const addMiddleware = (logger, node, checker, state) => {
         const definitionIds = refs.map((r) => r.definitionId);
         renameTempDefinitions(state, definitionIds, 'tag', tag, 'channelMiddleware');
         const sourceFile = node.getSourceFile().fileName;
-        const instanceIds = [];
-        for (let i = 0; i < refs.length; i++) {
-            const instanceId = makeContextBasedId('tag', tag, String(i));
-            state.channelMiddleware.instances[instanceId] = {
-                definitionId: definitionIds[i],
-                sourceFile,
-                position: node.getStart(),
-                isFactoryCall: refs[i].isFactoryCall,
-            };
-            instanceIds.push(instanceId);
-        }
+        const instanceIds = registerMiddlewareInstances(state.channelMiddleware.instances, 'tag', tag, refs.map((ref, i) => ({
+            definitionId: definitionIds[i],
+            isFactoryCall: ref.isFactoryCall,
+        })), sourceFile, node.getStart());
         const allServices = new Set();
         for (const defId of definitionIds) {
             const def = state.channelMiddleware.definitions[defId];

package/dist/add/add-wire-addon.js

@@ -70,10 +70,12 @@ export function addWireAddon(node, state, logger) {
         else if (key === 'rpcEndpoint' && ts.isStringLiteral(prop.initializer)) {
             rpcEndpoint = prop.initializer.text;
         }
-        else if (key === 'mcp' &&
-            (prop.initializer.kind === ts.SyntaxKind.TrueKeyword ||
-                prop.initializer.kind === ts.SyntaxKind.FalseKeyword)) {
-            mcp = prop.initializer.kind === ts.SyntaxKind.TrueKeyword;
+        else if (key === 'mcp') {
+            mcp =
+                prop.initializer.kind === ts.SyntaxKind.TrueKeyword ||
+                    prop.initializer.kind === ts.SyntaxKind.FalseKeyword
+                    ? prop.initializer.kind === ts.SyntaxKind.TrueKeyword
+                    : parseStringArray(prop.initializer);
         }
         else if (key === 'auth' &&
             (prop.initializer.kind === ts.SyntaxKind.TrueKeyword ||

package/dist/error-codes.d.ts

@@ -32,6 +32,7 @@ export declare enum ErrorCode {
     REMOTE_ADDON_NOT_DEV_DEPENDENCY = "PKU338",
     REMOTE_ADDON_AUTH_UNRESOLVED = "PKU339",
     ADDON_NOT_INSTALLED = "PKU340",
+    ADDON_MCP_FUNCTION_NOT_FOUND = "PKU341",
     DB_COLUMN_NAME_TYPE_CONTRADICTION = "PKU480",
     DB_JSON_COLUMN_UNTYPED = "PKU481",
     DB_FORMAT_ON_NON_STRING = "PKU482",

package/dist/error-codes.js

@@ -35,6 +35,7 @@ export var ErrorCode;
     ErrorCode["REMOTE_ADDON_NOT_DEV_DEPENDENCY"] = "PKU338";
     ErrorCode["REMOTE_ADDON_AUTH_UNRESOLVED"] = "PKU339";
     ErrorCode["ADDON_NOT_INSTALLED"] = "PKU340";
+    ErrorCode["ADDON_MCP_FUNCTION_NOT_FOUND"] = "PKU341";
     // Database schema codegen warnings
     ErrorCode["DB_COLUMN_NAME_TYPE_CONTRADICTION"] = "PKU480";
     ErrorCode["DB_JSON_COLUMN_UNTYPED"] = "PKU481";

package/dist/inspector.js

@@ -181,6 +181,7 @@ export function getInitialInspectorState(rootDir) {
             definitions: {},
             instances: {},
             tagMiddleware: new Map(),
+            globalFiles: new Set(),
         },
         channelMiddleware: {
             definitions: {},

package/dist/types.d.ts

@@ -162,6 +162,16 @@ export interface InspectorMiddlewareState {
     definitions: Record<string, InspectorMiddlewareDefinition>;
     instances: Record<string, InspectorMiddlewareInstance>;
     tagMiddleware: Map<string, MiddlewareGroupMeta>;
+    /**
+     * Every source file with a top-level `addGlobalMiddleware` call.
+     *
+     * Global middleware belongs to no wire group, so the only thing that makes it
+     * run in a generated bundle is a side-effect import of its source file. This
+     * set is the record codegen emits those imports from, and the one it checks
+     * itself against — a plain set of file names, so nothing can overwrite an
+     * entry the way a keyed map could.
+     */
+    globalFiles: Set<string>;
 }
 export interface InspectorChannelMiddlewareState {
     definitions: Record<string, InspectorMiddlewareDefinition>;
@@ -565,7 +575,12 @@ export interface InspectorState {
             /** The app source file whose `wireAddon` call declared this instance. */
             file?: string;
             rpcEndpoint?: string;
-            mcp?: boolean;
+            /**
+             * `true` offers every function the addon declared `mcp: true`; a list
+             * names the functions to offer, whatever the addon declared. Absent
+             * when the declared value was not a statically-knowable literal.
+             */
+            mcp?: boolean | string[];
             /**
              * The addon's own gates. `runPikkuFunc` applies these to every function
              * in the package, on every wiring path — not just `namespace:function`.

package/dist/utils/load-addon-functions-meta.js

@@ -2,6 +2,7 @@ import { existsSync } from 'fs';
 import { readFile, readdir } from 'fs/promises';
 import { createRequire } from 'module';
 import { join, dirname } from 'path';
+import { ErrorCode } from '../error-codes.js';
 const isHTTPRouteConfig = (value) => typeof value === 'object' &&
     value !== null &&
     'method' in value &&
@@ -147,19 +148,31 @@ export async function loadAddonFunctionsMeta(logger, state) {
             state.addonFunctions[namespace] = meta;
             logger.debug(`Loaded ${Object.keys(meta).length} addon functions for '${namespace}' from ${decl.package}`);
             registerAddonTypes(state, metaPath, meta);
-            // If wireAddon has mcp: true, expose addon functions with mcp: true as MCP tools
+            // `mcp: true` offers what the addon declared as tools; `mcp: [...]` names
+            // the functions to offer, whatever the addon declared — the consuming app
+            // decides which of the addon's functions a model gets to see.
             if (decl.mcp) {
+                const selected = Array.isArray(decl.mcp) ? new Set(decl.mcp) : null;
                 for (const [funcName, funcMeta] of Object.entries(meta)) {
-                    if (funcMeta.mcp) {
-                        const toolName = `${namespace}:${funcName}`;
-                        state.mcpEndpoints.toolsMeta[toolName] = {
-                            pikkuFuncId: `${namespace}:${funcName}`,
-                            name: toolName,
-                            description: funcMeta.description || funcMeta.title || funcName,
-                            inputSchema: funcMeta.inputSchemaName ?? null,
-                            outputSchema: funcMeta.outputSchemaName ?? null,
-                            tags: funcMeta.tags,
-                        };
+                    if (selected ? !selected.has(funcName) : !funcMeta.mcp) {
+                        continue;
+                    }
+                    const toolName = `${namespace}:${funcName}`;
+                    state.mcpEndpoints.toolsMeta[toolName] = {
+                        pikkuFuncId: `${namespace}:${funcName}`,
+                        name: toolName,
+                        description: funcMeta.description || funcMeta.title || funcName,
+                        inputSchema: funcMeta.inputSchemaName ?? null,
+                        outputSchema: funcMeta.outputSchemaName ?? null,
+                        tags: funcMeta.tags,
+                    };
+                }
+                // A name the addon does not publish is a tool the app believes it
+                // offers and never does, so it fails the build rather than silently
+                // offering one tool fewer than the list says.
+                for (const funcName of selected ?? []) {
+                    if (!(funcName in meta)) {
+                        logger.critical(ErrorCode.ADDON_MCP_FUNCTION_NOT_FOUND, `wireAddon('${namespace}') lists '${funcName}' under mcp, but ${decl.package} publishes no such function.`);
                     }
                 }
             }

package/dist/utils/serialize-inspector-state.d.ts

@@ -275,6 +275,7 @@ export interface SerializableInspectorState {
     middleware: {
         definitions: InspectorState['middleware']['definitions'];
         instances: InspectorState['middleware']['instances'];
+        globalFiles: string[];
         tagMiddleware: Array<[
             string,
             InspectorState['middleware']['tagMiddleware'] extends Map<string, infer V> ? V : never

package/dist/utils/serialize-inspector-state.js

@@ -150,6 +150,7 @@ export function serializeInspectorState(state) {
         middleware: {
             definitions: state.middleware.definitions,
             instances: state.middleware.instances,
+            globalFiles: Array.from(state.middleware.globalFiles),
             tagMiddleware: Array.from(state.middleware.tagMiddleware.entries()),
         },
         channelMiddleware: {
@@ -335,6 +336,7 @@ export function deserializeInspectorState(data) {
         middleware: {
             definitions: data.middleware.definitions,
             instances: data.middleware.instances || {},
+            globalFiles: new Set(data.middleware.globalFiles || []),
             tagMiddleware: new Map(data.middleware.tagMiddleware),
         },
         channelMiddleware: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/inspector",
-  "version": "0.12.81",
+  "version": "0.12.82",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/pikkujs/pikku.git",
@@ -55,10 +55,10 @@
     "zod-to-ts": "^2.1.0"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.111"
+    "@pikku/core": "^0.12.113"
   },
   "devDependencies": {
-    "@pikku/core": "^0.12.111",
+    "@pikku/core": "^0.12.113",
     "@types/node": "^24.13.3"
   },
   "engines": {