@pikku/inspector 0.12.83 → 0.12.84

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## 0.12.84
+
+### Patch Changes
+
+- 238902c: A channel's `auth` flag now reaches its meta. The inspector already read it to mark the connect and disconnect functions sessionless, then dropped it, so nothing downstream could tell a public channel from a private one without reading the generated source.
+
+  That matters in front of the channel rather than inside it. A `wireCLI({ auth: false })` program is reachable by anyone holding its address; a router or deploy that cannot see the flag either guesses or demands a token in front of a surface it was never protecting, locking out the clients the program was opened for.
+
+  The flag is only recorded when the channel actually said. A channel that never mentioned `auth` leaves it absent rather than claiming a default it did not declare, which the runtime continues to read as requiring a session.
+
+- Updated dependencies [238902c]
+- Updated dependencies [2fd2b22]
+  - @pikku/core@0.12.115
+
 ## 0.12.83
 
 ### Patch Changes

package/dist/add/add-channel.js

@@ -482,8 +482,9 @@ export const addChannel = (logger, node, checker, state, options) => {
     // with pikkuChannelConnectionFunc/pikkuChannelDisconnectionFunc (not pikkuFunc/
     // pikkuSessionlessFunc), so the runtime has correct sessionless info without
     // needing to inject it at runtime.
+    const channelAuth = getPropertyValue(obj, 'auth');
     {
-        const routeAuth = getPropertyValue(obj, 'auth');
+        const routeAuth = channelAuth;
         const sessionless = routeAuth === false ? true : undefined;
         for (const funcId of [connectFuncId, disconnectFuncId]) {
             if (funcId && !state.functions.meta[funcId]) {
@@ -538,6 +539,11 @@ export const addChannel = (logger, node, checker, state, options) => {
         message,
         messageWirings,
         binary: binary === undefined ? undefined : binary,
+        // Recorded so a deploy can tell a public surface from a private one without
+        // reading the generated source. Only stored when the channel actually said,
+        // so a channel that never mentioned auth stays absent rather than claiming
+        // a default it did not declare.
+        auth: typeof channelAuth === 'boolean' ? channelAuth : undefined,
         summary,
         description,
         errors,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/inspector",
-  "version": "0.12.83",
+  "version": "0.12.84",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/pikkujs/pikku.git",
@@ -55,10 +55,10 @@
     "zod-to-ts": "^2.1.0"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.114"
+    "@pikku/core": "^0.12.115"
   },
   "devDependencies": {
-    "@pikku/core": "^0.12.114",
+    "@pikku/core": "^0.12.115",
     "@types/node": "^24.13.3"
   },
   "engines": {