@pikku/inspector 0.12.87 → 0.12.89

package/CHANGELOG.md

@@ -1,3 +1,42 @@
+## 0.12.89
+
+### Patch Changes
+
+- bc488cf: fix(inspector): an explicit `auth: false` declares an exposed sessionless function public, so PKU574 no longer warns about it
+
+  A genuinely public endpoint — a published programme, a health check — had no
+  honest way to quiet PKU574: the only options were an always-true permission or
+  `permissionsInBody: true`, both of which claim a gate that does not exist. The
+  inspector now records `auth` on function meta exactly as written instead of
+  dropping `false`, and the check treats an explicit `auth: false` as the author
+  declaring the function public on purpose. A sessionless function that leaves
+  `auth` out still warns.
+
+- Updated dependencies [50b59a3]
+- Updated dependencies [2b946e9]
+- Updated dependencies [bc488cf]
+  - @pikku/core@0.12.123
+
+## 0.12.88
+
+### Patch Changes
+
+- 55ab4d1: An addon's metadata now resolves from the package that calls `wireAddon`, as well as from the repo root, so a workspace addon listed only in `packages/functions` loads. When it still cannot be found, the warning names the package, the directories tried and the fix: add the dependency and install, or build the addon if it is installed but has no generated metadata.
+- f6c1dd6: A fresh project with Better Auth no longer gets PKU951 for `BETTER_AUTH_SECRET` on its first `pikku all`. The secret is declared by the generated `auth-secrets.gen.ts`, which did not exist yet when the first inspection ran.
+- 0210e96: Review fixes for the OpenAPI addon onboarding:
+
+  - A delegated sign-in whose email the upstream did not return, including a login typed as an email, never links to an existing user. An authenticator that omits `syntheticEmail` counts as synthetic.
+  - `pikkuActor` credentials take an optional `remove`, which drops a credential the environment no longer sets. The actor log line names the user id, not the email.
+  - Basic credentials are UTF-8 encoded, and a Swagger 2 `application` OAuth flow keeps its token URL.
+  - `pikku new addon` writes a `file:` path relative to each package when the app is not a workspace, and reports an auth.ts factory it cannot edit instead of half-wiring it.
+  - The inspector reads an addon from the package that declares it before the root.
+  - The dev credentials key file is created exclusively, so two `pikku dev` processes agree on one key.
+
+- 86c2f1d: `pikku dev` keeps stored credentials in the dev database, so connected accounts and delegated sign-ins survive a restart. The key comes from `PIKKU_DEV_CREDENTIALS_KEY`, or is generated once into `.pikku-runtime/dev-credentials.key`. A project that declares a credential now gets the credential tables in its generated migration; without them dev falls back to the in-memory store and says so once.
+- da9b931: An inline `input`/`output` schema (PKU489) is now an `error` diagnostic instead of a critical one, so `pikku dev` keeps running. The function is validated against its TypeScript type until the schema is extracted to an exported variable; `--fail-on-error` still blocks it.
+- Updated dependencies [e84abd0]
+  - @pikku/core@0.12.121
+
 ## 0.12.87
 
 ### Patch Changes

package/dist/add/add-functions.js

@@ -397,10 +397,11 @@ export const addFunctions = (logger, node, checker, state, options) => {
     let remote;
     let mcp;
     /**
-     * A sessionless function's own `auth: true`. `sessionless` records the
-     * baseline — a `pikkuFunc` always needs a session — while this records the
-     * tightening a `pikkuSessionlessFunc` applies to itself, which is otherwise
-     * invisible to anything reading meta.
+     * A sessionless function's own `auth`, exactly as written. `sessionless`
+     * records the baseline — a `pikkuFunc` always needs a session — while this
+     * records what a `pikkuSessionlessFunc` says about itself: `true` tightens it
+     * to require a session, `false` declares it public on purpose. Both are
+     * otherwise invisible to anything reading meta; left out, it stays undefined.
      */
     let auth;
     /** The author's claim that the body authorizes its own callers. */
@@ -629,12 +630,16 @@ export const addFunctions = (logger, node, checker, state, options) => {
                         }
                     }
                     else if (ts.isCallExpression(prop.initializer)) {
-                        // Bad - it's an inline expression
                         const schemaName = `${funcIdToTypeName(name)}${propName.charAt(0).toUpperCase() + propName.slice(1)}`;
-                        logger.critical(ErrorCode.INLINE_SCHEMA, `Inline schemas are not supported for '${propName}' in '${name}'.\n` +
-                            `  Extract to an exported variable:\n` +
-                            `    export const ${schemaName} = ${prop.initializer.getText()}\n` +
-                            `  Then use: ${propName}: ${schemaName}`);
+                        logger.diagnostic({
+                            severity: 'error',
+                            code: ErrorCode.INLINE_SCHEMA,
+                            message: `Inline schemas are not supported for '${propName}' in '${name}'; ` +
+                                `it is validated against its TypeScript type only, so refinements are not enforced.\n` +
+                                `  Extract to an exported variable:\n` +
+                                `    export const ${schemaName} = ${prop.initializer.getText()}\n` +
+                                `  Then use: ${propName}: ${schemaName}`,
+                        });
                     }
                 }
             }
@@ -994,7 +999,7 @@ export const addFunctions = (logger, node, checker, state, options) => {
         inputs: inputNames.filter((n) => n !== 'void') ?? null,
         outputs: outputNames.filter((n) => n !== 'void') ?? null,
         expose: expose || undefined,
-        auth: auth || undefined,
+        auth: typeof auth === 'boolean' ? auth : undefined,
         permissionsInBody: permissionsInBody || undefined,
         audit,
         remote: remote || undefined,

package/dist/utils/load-addon-functions-meta.d.ts

@@ -1,4 +1,5 @@
 import type { InspectorState, InspectorLogger } from '../types.js';
+export declare const describeMissingAddonMeta: (namespace: string, packageName: string, dirs: string[], declFile?: string) => string;
 /**
  * After the setup sweep discovers wireAddon() declarations, load each addon
  * package's function metadata so that wiring handlers (channels, HTTP routes,

package/dist/utils/load-addon-functions-meta.js

@@ -1,7 +1,7 @@
 import { existsSync } from 'fs';
 import { readFile, readdir } from 'fs/promises';
 import { createRequire } from 'module';
-import { join, dirname } from 'path';
+import { join, dirname, parse, relative } from 'path';
 import { ErrorCode } from '../error-codes.js';
 const isHTTPRouteConfig = (value) => typeof value === 'object' &&
     value !== null &&
@@ -90,6 +90,77 @@ const resolveAddonMeta = (require, packageName, baseName) => {
     }
     return null;
 };
+const nearestPackageDir = (file) => {
+    const root = parse(file).root;
+    let dir = dirname(file);
+    while (dir && dir !== root) {
+        if (existsSync(join(dir, 'package.json')))
+            return dir;
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return null;
+};
+/**
+ * An addon is installed wherever the package that calls `wireAddon` lists it,
+ * which in a workspace is usually not the repo root. Resolve from the declaring
+ * package first, as its code does at runtime, then from the root.
+ */
+const addonResolutionDirs = (rootDir, declFile) => {
+    const declDir = declFile ? nearestPackageDir(declFile) : null;
+    return declDir && declDir !== rootDir ? [declDir, rootDir] : [rootDir];
+};
+const createAddonResolver = (dirs) => {
+    const requires = dirs.map((dir) => createRequire(join(dir, 'package.json')));
+    return {
+        resolve: (id) => {
+            let lastError;
+            for (const req of requires) {
+                try {
+                    return req.resolve(id);
+                }
+                catch (e) {
+                    lastError = e;
+                }
+            }
+            throw lastError;
+        },
+    };
+};
+const findInstalledPackageDir = (dirs, packageName) => {
+    for (const start of dirs) {
+        const root = parse(start).root;
+        let dir = start;
+        while (dir) {
+            const candidate = join(dir, 'node_modules', packageName);
+            if (existsSync(join(candidate, 'package.json')))
+                return candidate;
+            if (dir === root)
+                break;
+            const parent = dirname(dir);
+            if (parent === dir)
+                break;
+            dir = parent;
+        }
+    }
+    return null;
+};
+export const describeMissingAddonMeta = (namespace, packageName, dirs, declFile) => {
+    const caller = declFile
+        ? relative(dirs[dirs.length - 1], declFile) || declFile
+        : undefined;
+    const declaredIn = caller ? ` (declared in ${caller})` : '';
+    const packageDir = findInstalledPackageDir(dirs, packageName);
+    if (!packageDir) {
+        const declaringPackage = dirs[0];
+        return (`wireAddon('${namespace}')${declaredIn} names ${packageName}, which is not installed where it can be resolved — tried ${dirs.join(', ')}. ` +
+            `Add "${packageName}": "workspace:*" (or a version) to the dependencies of ${join(declaringPackage, 'package.json')} and run install.`);
+    }
+    return (`wireAddon('${namespace}')${declaredIn}: ${packageName} is installed at ${packageDir} but has not been built — ` +
+        `its dist/.pikku/addon/function/pikku-functions-meta.gen.json does not exist. Run the addon's build (pikku all && tsc && pikku dist) in ${packageDir}.`);
+};
 /**
  * Give the addon's input/output type names a declaration file to be imported
  * from, so a wiring that references an addon function can name its contract.
@@ -128,21 +199,24 @@ export async function loadAddonFunctionsMeta(logger, state) {
     const { wireAddonDeclarations } = state.rpc;
     if (wireAddonDeclarations.size === 0)
         return;
-    const require = createRequire(join(state.rootDir, 'package.json'));
     for (const [namespace, decl] of wireAddonDeclarations) {
         // Remote addons (wireRemoteAddon) ship as a devDependency: types only.
         // Their functions, secrets, variables, schemas and services live on the
         // HOST that runs them — never load or require any of that here.
         if (decl.remote)
             continue;
+        const dirs = addonResolutionDirs(state.rootDir, decl.file);
+        const require = createAddonResolver(dirs);
         try {
             // Verbose first. `description` is one of the fields stripped from the
             // minimal copy, and it is what an addon's function is offered to a model
             // under — both as an MCP tool below and as an agent tool. Read the minimal
             // one and every addon function looks undescribed.
             const metaPath = resolveAddonMeta(require, decl.package, 'function/pikku-functions-meta');
-            if (!metaPath)
-                throw new Error('no function metadata');
+            if (!metaPath) {
+                logger.warn(describeMissingAddonMeta(namespace, decl.package, dirs, decl.file));
+                continue;
+            }
             const raw = await readFile(metaPath, 'utf-8');
             const meta = JSON.parse(raw);
             state.addonFunctions[namespace] = meta;
@@ -375,11 +449,11 @@ export async function loadAddonSchemas(logger, state) {
     const { wireAddonDeclarations } = state.rpc;
     if (wireAddonDeclarations.size === 0)
         return;
-    const require = createRequire(join(state.rootDir, 'package.json'));
     for (const [namespace, decl] of wireAddonDeclarations) {
         // Remote addons carry no local schemas — their funcs run on the host.
         if (decl.remote)
             continue;
+        const require = createAddonResolver(addonResolutionDirs(state.rootDir, decl.file));
         try {
             const metaPath = require.resolve(`${decl.package}/.pikku/function/pikku-functions-meta.gen.json`);
             const schemasDir = join(dirname(metaPath), '..', 'schemas', 'schemas');
@@ -400,6 +474,10 @@ export async function loadAddonSchemas(logger, state) {
             }
         }
         catch (error) {
+            if (error?.code === 'MODULE_NOT_FOUND' ||
+                error?.code === 'ERR_PACKAGE_PATH_NOT_EXPORTED') {
+                continue;
+            }
             logger.warn(`Failed to load addon schemas for '${namespace}' (${decl.package}): ${error.message}`);
         }
     }

package/dist/utils/post-process.js

@@ -287,6 +287,9 @@ export function aggregateRequiredServices(state) {
     if ((state.analytics?.length ?? 0) > 0) {
         requiredServices.add('analyticsService');
     }
+    if ((state.credentials?.definitions?.length ?? 0) > 0) {
+        requiredServices.add('credentialService');
+    }
     // 7. Services that consumed addons need from the parent project.
     const addonFnServices = new Map();
     for (const [namespace, fns] of Object.entries(state.addonFunctions ?? {})) {
@@ -1146,6 +1149,10 @@ export function validateSecretUsage(logger, state) {
             declared.add(definition.oauth2.tokenSecretId);
         }
     }
+    // auth-secrets.gen.ts declares it, but that file is written after the first
+    // inspection of a fresh project, so its defineSecret is not seen yet.
+    if (state.auth?.definition)
+        declared.add('BETTER_AUTH_SECRET');
     for (const [file, usage] of state.secrets.usage) {
         const relativeFile = relative(state.rootDir, file);
         const undeclared = usage.keys.filter((key) => !declared.has(key));

package/dist/utils/validate-exposed-functions-gated.js

@@ -64,8 +64,9 @@ export function validateExposedFunctionsGated(logger, state) {
             (rest > 0 ? `, and ${rest} more` : '') +
             `. Add permissions to the function, set \`auth: true\` if a session is ` +
             `required after all, gate the whole addon with ` +
-            `wireAddon({ auth: true }), or drop \`expose: true\` if ` +
-            `${one ? 'it was' : 'they were'} not meant to be callable from outside.`,
+            `wireAddon({ auth: true }), drop \`expose: true\` if ` +
+            `${one ? 'it was' : 'they were'} not meant to be callable from outside, ` +
+            `or set \`auth: false\` to declare ${one ? 'it' : 'them'} public on purpose.`,
     });
 }
 const gatesItself = (meta) => 
@@ -79,6 +80,11 @@ meta.sessionless === false ||
     // and a warning that is usually wrong stops being read.
     meta.permissionsInBody === true ||
     meta.auth === true ||
+    // The author wrote `auth: false` on a sessionless function: public on
+    // purpose — a health check, a sign-up, a published catalogue. A declaration,
+    // like `permissionsInBody`, so the default-open function nobody thought
+    // about still warns and the one somebody decided about does not.
+    meta.auth === false ||
     (meta.scopes?.length ?? 0) > 0 ||
     (meta.permissions?.length ?? 0) > 0;
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/inspector",
-  "version": "0.12.87",
+  "version": "0.12.89",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/pikkujs/pikku.git",
@@ -55,10 +55,10 @@
     "zod-to-ts": "^2.1.0"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.120"
+    "@pikku/core": "^0.12.123"
   },
   "devDependencies": {
-    "@pikku/core": "^0.12.120",
+    "@pikku/core": "^0.12.123",
     "@types/node": "^24.13.3"
   },
   "engines": {