@pikku/inspector 0.12.89 → 0.12.92

package/CHANGELOG.md

@@ -1,3 +1,45 @@
+## 0.12.92
+
+### Patch Changes
+
+- f84e173: An addon wired from a workspace package now resolves from that package. The installed-addon check (PKU340), the remote addon `devDependencies` check and `pikku db generate`'s addon schemas all looked only at the project root, so an addon declared where it is wired — the only place bun links it — failed codegen unless it was also declared at the root.
+- Updated dependencies [f02585e]
+- Updated dependencies [5586749]
+  - @pikku/core@0.12.127
+
+## 0.12.91
+
+### Patch Changes
+
+- 5e93f30: Add `defineOutgoingWebhook({ event, title, description?, payload })` in `@pikku/core/webhook`. The CLI collects every exported declaration into `.pikku/webhooks/pikku-outgoing-webhooks-meta.gen.json` and `pikku-outgoing-webhooks.gen.ts`, which exports `OutgoingWebhooksMap`, `TypedWebhookService` and `typedWebhookService(service)`: `send` checks `data` against the declared payload for a declared event and accepts any other event unchanged. `MetaService.getOutgoingWebhooksMeta()` and the console addon's `outgoingWebhooksMeta` serve the declarations.
+- 5e93f30: Add `wireTriggerWebhookSource({ name, method?, route?, secret?, events, receive?, check?, setup?, teardown? })` in `#pikku/trigger`. Each source becomes a `POST /webhooks/<name>` route whose events are validated against their schemas and queued on `pikku-incoming-webhooks` through `IncomingWebhookService`; a generated worker runs the matching `wireTrigger({ name: '<source>:<event>' })` and the queue retries it on failure. `pikku webhooks status | setup | teardown --url --labelPrefix [--previous]` registers the routes with the provider and prints one JSON line per source.
+
+  `KyselyIncomingWebhookService` (with the `incoming-webhook` schema) records a receipt per event, drops a provider's redelivery of an event it already accepted, and keeps each dispatch's attempts and last error. `pikku dev` and `pikku serve` use it when a Kysely database is configured.
+
+- Updated dependencies [5e93f30]
+- Updated dependencies [5e93f30]
+  - @pikku/core@0.12.125
+
+## 0.12.90
+
+### Patch Changes
+
+- 4e05a10: Print the TypeScript text for a Zod schema directly, dropping `zod-to-ts`.
+
+  `processZodSchema` built a TypeScript AST only to print it straight back to a
+  string. `zodToTypeText` walks Zod's own definitions instead, which removes
+  `zod-to-ts`, `ts.createPrinter`, `ts.EmitHint` and `ts.createSourceFile` from
+  the Zod path — it no longer touches the compiler API at all. `@pikku/cli`
+  declared `zod-to-ts` without importing it; that is dropped too.
+
+  A defaulted field is now optional in the generated type. `processZodSchema`
+  already strips defaulted fields out of the JSON Schema's `required`, so the two
+  halves of the same contract disagreed: the validator accepted a payload that
+  omitted the field, while the type said a caller had to pass it.
+
+- Updated dependencies [1394385]
+  - @pikku/core@0.12.124
+
 ## 0.12.89
 
 ### Patch Changes

package/dist/add/add-analytics.d.ts

@@ -1,5 +1,28 @@
 import * as ts from 'typescript';
 import type { InspectorLogger, InspectorState } from '../types.js';
+/**
+ * A call is the pikku one when the symbol it resolves to is, whatever the file
+ * chose to call it locally — `import { defineAnalyticsEvents as declare }` is
+ * an ordinary thing to write, and matching on the callee's text alone both
+ * misses that and claims a same-named local helper.
+ */
+export declare const callsImportedDefiner: (expression: ts.Expression, checker: ts.TypeChecker, definer: string) => boolean;
+/**
+ * The name the generated ingest has to import the declaration by — which is
+ * the name the module exports it under, not the name of the const. A module
+ * that keeps the declaration to itself has no such name, so it is refused here
+ * rather than emitted into an ingest that cannot compile.
+ */
+export declare const exportedName: (declaration: ts.VariableDeclaration, name: ts.Identifier, checker: ts.TypeChecker) => string | undefined;
+/**
+ * An event's props, as source text rather than a resolved type — `z.string()`
+ * is what the declaration says and what a reader recognises, and resolving it
+ * would mean type-checking a third-party generic to render one table cell.
+ *
+ * Absent for a schema pikku cannot read the shape off (a shared const, a union,
+ * a vendor that is not zod). The catalog renders nothing rather than guessing.
+ */
+export declare const readEventShape: (initializer: ts.Expression) => Record<string, string> | undefined;
 /**
  * Record where each `defineAnalyticsEvents` declaration is, which names it
  * declares, and the shape each name validates — the names drive the generated

package/dist/add/add-analytics.js

@@ -7,18 +7,17 @@ const DEFINE_ANALYTICS_EVENTS = 'defineAnalyticsEvents';
  * an ordinary thing to write, and matching on the callee's text alone both
  * misses that and claims a same-named local helper.
  */
-const callsDefineAnalyticsEvents = (expression, checker) => {
+export const callsImportedDefiner = (expression, checker, definer) => {
     if (!ts.isIdentifier(expression))
         return false;
     const symbol = checker.getSymbolAtLocation(expression);
     if (!symbol)
-        return expression.text === DEFINE_ANALYTICS_EVENTS;
+        return expression.text === definer;
     // An import specifier names what it imported even when the module itself
     // does not resolve, which is every project whose deps are not installed yet.
     const declaration = symbol.declarations?.[0];
     if (declaration && ts.isImportSpecifier(declaration)) {
-        return ((declaration.propertyName ?? declaration.name).text ===
-            DEFINE_ANALYTICS_EVENTS);
+        return (declaration.propertyName ?? declaration.name).text === definer;
     }
     // Only an import can be pikku's. A file's own helper of the same name
     // resolves to a symbol whose `.name` matches, so resolving without this
@@ -26,7 +25,7 @@ const callsDefineAnalyticsEvents = (expression, checker) => {
     if (!(symbol.flags & ts.SymbolFlags.Alias))
         return false;
     const resolved = checker.getAliasedSymbol(symbol) ?? symbol;
-    return resolved.name === DEFINE_ANALYTICS_EVENTS;
+    return resolved.name === definer;
 };
 /**
  * The name the generated ingest has to import the declaration by — which is
@@ -34,7 +33,7 @@ const callsDefineAnalyticsEvents = (expression, checker) => {
  * that keeps the declaration to itself has no such name, so it is refused here
  * rather than emitted into an ingest that cannot compile.
  */
-const exportedName = (declaration, name, checker) => {
+export const exportedName = (declaration, name, checker) => {
     const moduleSymbol = checker.getSymbolAtLocation(declaration.getSourceFile());
     const declarationSymbol = checker.getSymbolAtLocation(name);
     if (!moduleSymbol || !declarationSymbol) {
@@ -78,7 +77,7 @@ const findObjectShape = (expression) => {
  * Absent for a schema pikku cannot read the shape off (a shared const, a union,
  * a vendor that is not zod). The catalog renders nothing rather than guessing.
  */
-const readEventShape = (initializer) => {
+export const readEventShape = (initializer) => {
     const shape = findObjectShape(initializer);
     if (!shape)
         return undefined;
@@ -110,7 +109,7 @@ export const addAnalytics = (logger, node, checker, state) => {
     const { initializer, name } = node;
     if (!initializer || !ts.isCallExpression(initializer))
         return;
-    if (!callsDefineAnalyticsEvents(initializer.expression, checker))
+    if (!callsImportedDefiner(initializer.expression, checker, DEFINE_ANALYTICS_EVENTS))
         return;
     if (!ts.isIdentifier(name))
         return;

package/dist/add/add-outgoing-webhook.d.ts

@@ -0,0 +1,3 @@
+import * as ts from 'typescript';
+import type { InspectorLogger, InspectorState } from '../types.js';
+export declare const addOutgoingWebhook: (logger: InspectorLogger, node: ts.Node, checker: ts.TypeChecker, state: InspectorState) => void;

package/dist/add/add-outgoing-webhook.js

@@ -0,0 +1,81 @@
+import * as ts from 'typescript';
+import { callsImportedDefiner, exportedName, readEventShape, } from './add-analytics.js';
+const DEFINE_OUTGOING_WEBHOOK = 'defineOutgoingWebhook';
+const stringProperty = (object, key) => {
+    for (const property of object.properties) {
+        if (!ts.isPropertyAssignment(property))
+            continue;
+        const name = property.name;
+        const text = ts.isIdentifier(name) || ts.isStringLiteral(name) ? name.text : undefined;
+        if (text !== key)
+            continue;
+        const value = property.initializer;
+        if (ts.isStringLiteral(value) || ts.isNoSubstitutionTemplateLiteral(value))
+            return value.text;
+        return undefined;
+    }
+    return undefined;
+};
+const propertyInitializer = (object, key) => {
+    for (const property of object.properties) {
+        if (!ts.isPropertyAssignment(property))
+            continue;
+        const name = property.name;
+        if ((ts.isIdentifier(name) || ts.isStringLiteral(name)) &&
+            name.text === key)
+            return property.initializer;
+    }
+    return undefined;
+};
+export const addOutgoingWebhook = (logger, node, checker, state) => {
+    if (!ts.isVariableDeclaration(node))
+        return;
+    const { initializer, name } = node;
+    if (!initializer || !ts.isCallExpression(initializer))
+        return;
+    if (!callsImportedDefiner(initializer.expression, checker, DEFINE_OUTGOING_WEBHOOK))
+        return;
+    if (!ts.isIdentifier(name))
+        return;
+    const file = node.getSourceFile().fileName;
+    const [argument] = initializer.arguments;
+    if (!argument || !ts.isObjectLiteralExpression(argument)) {
+        logger.error(`defineOutgoingWebhook in ${file} must be called with an object literal: { event, title, payload }.`);
+        return;
+    }
+    const event = stringProperty(argument, 'event');
+    const title = stringProperty(argument, 'title');
+    if (!event || !title) {
+        logger.error(`defineOutgoingWebhook '${name.text}' in ${file} needs 'event' and 'title' as string literals, so they can be listed without running the app.`);
+        return;
+    }
+    const variable = exportedName(node, name, checker);
+    if (!variable) {
+        logger.error(`defineOutgoingWebhook '${event}' in ${file} is assigned to '${name.text}', which the module does not export. The generated webhook types import it by name, so export it.`);
+        return;
+    }
+    const description = stringProperty(argument, 'description');
+    const payloadExpression = propertyInitializer(argument, 'payload');
+    const payload = payloadExpression
+        ? readEventShape(payloadExpression)
+        : undefined;
+    const webhooks = (state.outgoingWebhooks ??= []);
+    const existing = webhooks.findIndex((webhook) => webhook.file === file && webhook.variable === variable);
+    const declared = webhooks.find((webhook, index) => webhook.event === event && index !== existing);
+    if (declared) {
+        logger.error(`Webhook event '${event}' is declared twice: ${declared.file} and ${file}. An event belongs to one defineOutgoingWebhook.`);
+        return;
+    }
+    const entry = {
+        file,
+        variable,
+        event,
+        title,
+        ...(description !== undefined ? { description } : {}),
+        ...(payload ? { payload } : {}),
+    };
+    if (existing >= 0)
+        webhooks[existing] = entry;
+    else
+        webhooks.push(entry);
+};

package/dist/add/add-trigger.d.ts

@@ -1,2 +1,7 @@
 import type { AddWiring } from '../types.js';
 export declare const addTrigger: AddWiring;
+/**
+ * A trigger named `<source>:<event>` must name an event its webhook source
+ * declares, or it would never fire.
+ */
+export declare const validateWebhookSourceTriggers: (logger: Parameters<AddWiring>[0], state: Parameters<AddWiring>[3]) => void;

package/dist/add/add-trigger.js

@@ -6,7 +6,9 @@ import { ensureInlineWiringFunction } from '../utils/ensure-function-metadata.js
 import { resolveMiddleware } from '../utils/middleware.js';
 import { extractWireNames } from '../utils/post-process.js';
 import { resolveAddonName } from '../utils/resolve-addon-package.js';
+import { resolveFunctionMeta } from '../utils/resolve-function-meta.js';
 import { ErrorCode } from '../error-codes.js';
+const WEBHOOK_SOURCE_STEPS = ['receive', 'check', 'setup', 'teardown'];
 export const addTrigger = (logger, node, checker, state, options) => {
     if (!ts.isCallExpression(node)) {
         return;
@@ -23,6 +25,9 @@ export const addTrigger = (logger, node, checker, state, options) => {
     else if (expression.text === 'wireTriggerSource') {
         addWireTriggerSource(logger, node, checker, state, options, firstArg);
     }
+    else if (expression.text === 'wireTriggerWebhookSource') {
+        addWireTriggerWebhookSource(logger, node, checker, state, firstArg);
+    }
 };
 const addWireTrigger = (logger, node, checker, state, firstArg) => {
     if (!firstArg || !ts.isObjectLiteralExpression(firstArg)) {
@@ -88,3 +93,102 @@ const addWireTriggerSource = (logger, node, checker, state, options, firstArg) =
     }
     state.triggers.files.add(node.getSourceFile().fileName);
 };
+const refTarget = (initializer) => {
+    if (!ts.isCallExpression(initializer) ||
+        !ts.isIdentifier(initializer.expression) ||
+        initializer.expression.text !== 'ref') {
+        return null;
+    }
+    const [target] = initializer.arguments;
+    return target && ts.isStringLiteral(target) && target.text.includes(':')
+        ? target.text
+        : null;
+};
+const addWireTriggerWebhookSource = (logger, node, checker, state, firstArg) => {
+    if (!firstArg || !ts.isObjectLiteralExpression(firstArg)) {
+        return;
+    }
+    const obj = firstArg;
+    const name = getPropertyValue(obj, 'name');
+    if (!name) {
+        logger.critical(ErrorCode.MISSING_NAME, `wireTriggerWebhookSource in ${node.getSourceFile().fileName} needs 'name' as a string literal.`);
+        return;
+    }
+    const method = getPropertyValue(obj, 'method') ?? 'post';
+    const route = getPropertyValue(obj, 'route') ?? `/webhooks/${name}`;
+    let secret = getPropertyValue(obj, 'secret');
+    const eventsInitializer = getPropertyAssignmentInitializer(obj, 'events', false, checker);
+    const events = eventsInitializer
+        ? checker
+            .getTypeAtLocation(eventsInitializer)
+            .getProperties()
+            .map((property) => property.getName())
+            .sort()
+        : [];
+    const steps = {};
+    for (const step of WEBHOOK_SOURCE_STEPS) {
+        const initializer = getPropertyAssignmentInitializer(obj, step, true, checker);
+        if (!initializer)
+            continue;
+        const target = refTarget(initializer);
+        if (target) {
+            if (!resolveFunctionMeta(state, target)) {
+                logger.warn(`Webhook source '${name}': addon function metadata for '${target}' is not available yet.`);
+            }
+            steps[step] = target;
+            state.serviceAggregation.usedFunctions.add(target);
+            continue;
+        }
+        const extracted = extractFunctionName(initializer, checker, state.rootDir);
+        let pikkuFuncId = extracted.pikkuFuncId;
+        if (pikkuFuncId.startsWith('__temp_')) {
+            pikkuFuncId = makeContextBasedId('trigger-webhook', name, step);
+        }
+        ensureInlineWiringFunction(state, pikkuFuncId, `${name}:${step}`, initializer, checker, extracted.isHelper);
+        const meta = state.functions.meta[pikkuFuncId];
+        if (meta && meta.sessionless === undefined)
+            meta.sessionless = true;
+        steps[step] = pikkuFuncId;
+        state.serviceAggregation.usedFunctions.add(pikkuFuncId);
+    }
+    // An addon's receive reads the secret by its own name; the app may have
+    // renamed it for this instance.
+    const namespace = steps.receive?.includes(':')
+        ? steps.receive.slice(0, steps.receive.indexOf(':'))
+        : null;
+    const addon = namespace
+        ? state.rpc.wireAddonDeclarations.get(namespace)
+        : undefined;
+    if (secret && addon?.secretOverrides?.[secret]) {
+        secret = addon.secretOverrides[secret];
+    }
+    const meta = {
+        name,
+        method: method,
+        route,
+        events,
+        ...(secret ? { secret } : {}),
+        ...steps,
+    };
+    state.triggers.webhookSourceMeta[name] = meta;
+    state.triggers.files.add(node.getSourceFile().fileName);
+};
+/**
+ * A trigger named `<source>:<event>` must name an event its webhook source
+ * declares, or it would never fire.
+ */
+export const validateWebhookSourceTriggers = (logger, state) => {
+    const sources = state.triggers.webhookSourceMeta;
+    for (const trigger of Object.keys(state.triggers.meta)) {
+        const colon = trigger.indexOf(':');
+        if (colon === -1)
+            continue;
+        const source = sources[trigger.slice(0, colon)];
+        if (!source || source.events.length === 0)
+            continue;
+        const event = trigger.slice(colon + 1);
+        if (!source.events.includes(event)) {
+            logger.error(`Trigger '${trigger}' listens for '${event}', which webhook source '${source.name}' does not declare. Declared: ${source.events.join(', ')}.`);
+        }
+    }
+};

package/dist/index.d.ts

@@ -26,3 +26,4 @@ export type { SerializedWorkflowGraph, SerializedWorkflowGraphs, } from './utils
 export { resolveCoreType } from './utils/resolve-core-type.js';
 export { readModuleSpecifiers } from './utils/read-module-specifiers.js';
 export { readTsconfigOutDir } from './utils/read-tsconfig-out-dir.js';
+export { addonResolutionDirs, createAddonResolver, } from './utils/addon-resolution.js';

package/dist/index.js

@@ -15,3 +15,4 @@ export { resolveFunctionMeta } from './utils/resolve-function-meta.js';
 export { resolveCoreType } from './utils/resolve-core-type.js';
 export { readModuleSpecifiers } from './utils/read-module-specifiers.js';
 export { readTsconfigOutDir } from './utils/read-tsconfig-out-dir.js';
+export { addonResolutionDirs, createAddonResolver, } from './utils/addon-resolution.js';

package/dist/inspector.js

@@ -14,6 +14,7 @@ import { annotateHttpRouteAuth } from './utils/annotate-http-route-auth.js';
 import { generateOpenAPISpec } from './utils/serialize-openapi-json.js';
 import { pikkuState } from '@pikku/core/state';
 import { resolveLatestVersions } from './utils/resolve-versions.js';
+import { validateWebhookSourceTriggers } from './add/add-trigger.js';
 import { finalizeWorkflows } from './utils/workflow/graph/finalize-workflows.js';
 import { finalizeWorkflowHelperTypes, finalizeWorkflowWires, } from './utils/workflow/graph/finalize-workflow-wires.js';
 import { generateAllSchemas } from './utils/schema-generator.js';
@@ -79,6 +80,7 @@ export function getInitialInspectorState(rootDir) {
         triggers: {
             meta: {},
             sourceMeta: {},
+            webhookSourceMeta: {},
             files: new Set(),
         },
         scheduledTasks: {
@@ -353,6 +355,7 @@ export const inspect = async (logger, routeFiles, options = {}) => {
             ts.forEachChild(sourceFile, (child) => visitRoutes(logger, checker, child, state, sourceOptions));
         }
         logger.debug(`Visit routes phase completed in ${(performance.now() - startRoutes).toFixed(0)}ms`);
+        validateWebhookSourceTriggers(logger, state);
         resolveLatestVersions(state, logger);
         if (options.schemaConfig) {
             const startSchemas = performance.now();

package/dist/types.d.ts

@@ -5,7 +5,7 @@ import type { ChannelMessageMeta, ChannelsMeta } from '@pikku/core/channel';
 import type { GatewaysMeta } from '@pikku/core/gateway';
 import type { HTTPWiringsMeta } from '@pikku/core/http';
 import type { ScheduledTasksMeta } from '@pikku/core/scheduler';
-import type { TriggerMeta, TriggerSourceMeta } from '@pikku/core/trigger';
+import type { TriggerMeta, TriggerSourceMeta, WebhookSourcesMeta } from '@pikku/core/trigger';
 import type { QueueWorkersMeta } from '@pikku/core/queue';
 import type { WorkflowsMeta } from '@pikku/core/workflow';
 import type { MCPResourceMeta, MCPToolMeta, MCPPromptMeta } from '@pikku/core/mcp';
@@ -515,6 +515,14 @@ export interface InspectorState {
          *  inspector cannot read off the declaration. */
         props?: Record<string, Record<string, string>>;
     }>;
+    outgoingWebhooks?: Array<{
+        file: string;
+        variable: string;
+        event: string;
+        title: string;
+        description?: string;
+        payload?: Record<string, string>;
+    }>;
     addonServerlessIncompatible: Map<string, string[]>;
     configFactories: PathToNameAndType;
     serverLifecycleFactories: PathToNameAndType;
@@ -539,6 +547,7 @@ export interface InspectorState {
     triggers: {
         meta: TriggerMeta;
         sourceMeta: TriggerSourceMeta;
+        webhookSourceMeta: WebhookSourcesMeta;
         files: Set<string>;
     };
     scheduledTasks: {

package/dist/utils/addon-resolution.d.ts

@@ -0,0 +1,10 @@
+export type AddonResolver = {
+    resolve: (id: string) => string;
+};
+/**
+ * An addon is installed wherever the package that calls `wireAddon` lists it,
+ * which in a workspace is usually not the repo root. Resolve from the declaring
+ * package first, as its code does at runtime, then from the root.
+ */
+export declare const addonResolutionDirs: (rootDir: string, declFile?: string) => string[];
+export declare const createAddonResolver: (dirs: string[]) => AddonResolver;

package/dist/utils/addon-resolution.js

@@ -0,0 +1,43 @@
+import { existsSync } from 'fs';
+import { createRequire } from 'module';
+import { join, dirname, parse, resolve } from 'path';
+const nearestPackageDir = (file) => {
+    const root = parse(file).root;
+    let dir = dirname(file);
+    while (dir && dir !== root) {
+        if (existsSync(join(dir, 'package.json')))
+            return dir;
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return null;
+};
+/**
+ * An addon is installed wherever the package that calls `wireAddon` lists it,
+ * which in a workspace is usually not the repo root. Resolve from the declaring
+ * package first, as its code does at runtime, then from the root.
+ */
+export const addonResolutionDirs = (rootDir, declFile) => {
+    const root = resolve(rootDir);
+    const declDir = declFile ? nearestPackageDir(resolve(declFile)) : null;
+    return declDir && declDir !== root ? [declDir, root] : [root];
+};
+export const createAddonResolver = (dirs) => {
+    const requires = dirs.map((dir) => createRequire(join(dir, 'package.json')));
+    return {
+        resolve: (id) => {
+            let lastError;
+            for (const req of requires) {
+                try {
+                    return req.resolve(id);
+                }
+                catch (e) {
+                    lastError = e;
+                }
+            }
+            throw lastError;
+        },
+    };
+};

package/dist/utils/find-zod-transform.d.ts

@@ -6,9 +6,9 @@
  * contract has to describe one shape. Zod says so twice, in two different
  * places, and neither says it usefully on its own — `toJSONSchema` with
  * `unrepresentable: 'any'` quietly yields `{}`, a schema that accepts
- * everything, and `zodToTs` throws about TypeScript rather than about the
- * wiring. Finding it up front lets the diagnostic name the schema, the path,
- * and the call.
+ * everything, and `zodToTypeText` prints the input side of the pipe, which is
+ * not the shape the function receives. Finding it up front lets the diagnostic
+ * name the schema, the path, and the call.
  *
  * Zod 4 models `x.transform(fn)` as a `pipe` whose `out` is a `transform`, so
  * the walk looks for that node rather than for the method.

package/dist/utils/find-zod-transform.js

@@ -6,9 +6,9 @@
  * contract has to describe one shape. Zod says so twice, in two different
  * places, and neither says it usefully on its own — `toJSONSchema` with
  * `unrepresentable: 'any'` quietly yields `{}`, a schema that accepts
- * everything, and `zodToTs` throws about TypeScript rather than about the
- * wiring. Finding it up front lets the diagnostic name the schema, the path,
- * and the call.
+ * everything, and `zodToTypeText` prints the input side of the pipe, which is
+ * not the shape the function receives. Finding it up front lets the diagnostic
+ * name the schema, the path, and the call.
  *
  * Zod 4 models `x.transform(fn)` as a `pipe` whose `out` is a `transform`, so
  * the walk looks for that node rather than for the method.

package/dist/utils/load-addon-functions-meta.js

@@ -1,7 +1,7 @@
 import { existsSync } from 'fs';
 import { readFile, readdir } from 'fs/promises';
-import { createRequire } from 'module';
 import { join, dirname, parse, relative } from 'path';
+import { addonResolutionDirs, createAddonResolver, } from './addon-resolution.js';
 import { ErrorCode } from '../error-codes.js';
 const isHTTPRouteConfig = (value) => typeof value === 'object' &&
     value !== null &&
@@ -90,45 +90,6 @@ const resolveAddonMeta = (require, packageName, baseName) => {
     }
     return null;
 };
-const nearestPackageDir = (file) => {
-    const root = parse(file).root;
-    let dir = dirname(file);
-    while (dir && dir !== root) {
-        if (existsSync(join(dir, 'package.json')))
-            return dir;
-        const parent = dirname(dir);
-        if (parent === dir)
-            break;
-        dir = parent;
-    }
-    return null;
-};
-/**
- * An addon is installed wherever the package that calls `wireAddon` lists it,
- * which in a workspace is usually not the repo root. Resolve from the declaring
- * package first, as its code does at runtime, then from the root.
- */
-const addonResolutionDirs = (rootDir, declFile) => {
-    const declDir = declFile ? nearestPackageDir(declFile) : null;
-    return declDir && declDir !== rootDir ? [declDir, rootDir] : [rootDir];
-};
-const createAddonResolver = (dirs) => {
-    const requires = dirs.map((dir) => createRequire(join(dir, 'package.json')));
-    return {
-        resolve: (id) => {
-            let lastError;
-            for (const req of requires) {
-                try {
-                    return req.resolve(id);
-                }
-                catch (e) {
-                    lastError = e;
-                }
-            }
-            throw lastError;
-        },
-    };
-};
 const findInstalledPackageDir = (dirs, packageName) => {
     for (const start of dirs) {
         const root = parse(start).root;

package/dist/utils/post-process.js

@@ -10,6 +10,7 @@ import { relative } from 'node:path';
 import { AUTH_HANDLER_FUNC_ID } from '../add/add-auth.js';
 import { flattenScopeDefinitions } from '@pikku/core/scope';
 import { DYNAMIC_SCENARIO_STEP_TARGET } from './workflow/dsl/patterns.js';
+import { addonResolutionDirs } from './addon-resolution.js';
 /**
  * Stamp the inspected authorize/callbacks service set onto the generated auth
  * handler's function meta.
@@ -208,6 +209,15 @@ export function aggregateRequiredServices(state) {
         requiredServices.add('schedulerService');
         requiredServices.add('queueService');
     }
+    // Webhook source routes and their worker are generated and destructure
+    // nothing, so they are found by id: the route accepts into the queue through
+    // incomingWebhookService and the worker records attempts through it.
+    const hasWebhookSources = Object.values(state.triggers?.webhookSourceMeta ?? {}).some(({ method, route }) => state.functions.meta[`http:${method}:${route}`] !== undefined);
+    if (hasWebhookSources ||
+        state.functions.meta['queue:pikku-incoming-webhooks'] !== undefined) {
+        requiredServices.add('incomingWebhookService');
+        requiredServices.add('queueService');
+    }
     // 6b. Inject synthetic queue workers for workflow graph steps.
     // Each workflow gets an orchestrator queue and per-step queues.
     // Without these, the PikkuWorkflowService constructor can't find
@@ -451,32 +461,34 @@ export function validateVariableOverrides(logger, state) {
     }
 }
 /**
- * Can `pkg` be resolved from `rootDir`, by any means the loader would use?
+ * Can `pkg` be resolved from any of `dirs`, by any means the loader would use?
  *
  * Resolution is attempted against `<pkg>/package.json` first and the bare
  * specifier second, because neither alone is conclusive. A package with a
  * restrictive `exports` map refuses the first with
  * `ERR_PACKAGE_PATH_NOT_EXPORTED` — which is not a failure at all: reaching the
- * exports map means the package was found. Only a module-not-found from both
- * attempts means it is genuinely absent.
+ * exports map means the package was found. Only a module-not-found from every
+ * attempt means it is genuinely absent.
  */
-const isPackageResolvable = (pkg, rootDir) => {
+const isPackageResolvable = (pkg, dirs) => {
     const NOT_FOUND = new Set(['MODULE_NOT_FOUND', 'ERR_MODULE_NOT_FOUND']);
-    let req;
-    try {
-        req = createRequire(join(rootDir, 'package.json'));
-    }
-    catch {
-        return true; // cannot ask; do not accuse
-    }
-    for (const specifier of [`${pkg}/package.json`, pkg]) {
+    for (const dir of dirs) {
+        let req;
         try {
-            req.resolve(specifier);
-            return true;
+            req = createRequire(join(dir, 'package.json'));
         }
-        catch (e) {
-            if (!NOT_FOUND.has(e?.code))
+        catch {
+            return true; // cannot ask; do not accuse
+        }
+        for (const specifier of [`${pkg}/package.json`, pkg]) {
+            try {
+                req.resolve(specifier);
                 return true;
+            }
+            catch (e) {
+                if (!NOT_FOUND.has(e?.code))
+                    return true;
+            }
         }
     }
     return false;
@@ -514,35 +526,45 @@ export function validateRemoteAddonDependencies(logger, state) {
     for (const [namespace, decl] of wireAddonDeclarations.entries()) {
         if (decl.remote)
             continue;
-        if (isPackageResolvable(decl.package, state.rootDir))
+        const dirs = addonResolutionDirs(state.rootDir, decl.file);
+        if (isPackageResolvable(decl.package, dirs))
             continue;
-        logger.critical(ErrorCode.ADDON_NOT_INSTALLED, `Addon '${namespace}' ('${decl.package}') is wired with wireAddon but cannot be resolved — every ref('${namespace}:…') will resolve to nothing and the surface will be dead at runtime. Install it, or remove the wireAddon call.`);
-    }
-    if (!Array.from(wireAddonDeclarations.values()).some((d) => d.remote))
-        return;
-    const pkgJsonPath = join(state.rootDir, 'package.json');
-    if (!existsSync(pkgJsonPath))
-        return; // no manifest to check (e.g. some tests)
-    let pkgJson;
-    try {
-        pkgJson = JSON.parse(readFileSync(pkgJsonPath, 'utf-8'));
-    }
-    catch (e) {
-        logger.warn(`Could not read ${pkgJsonPath} to verify remote addon dependencies: ${e?.message ?? e}`);
-        return;
-    }
-    const prodDeps = pkgJson.dependencies ?? {};
-    const devDeps = pkgJson.devDependencies ?? {};
+        logger.critical(ErrorCode.ADDON_NOT_INSTALLED, `Addon '${namespace}' ('${decl.package}') is wired with wireAddon but cannot be resolved from ${dirs.join(' or ')} — every ref('${namespace}:…') will resolve to nothing and the surface will be dead at runtime. Add it to the dependencies of ${join(dirs[0], 'package.json')} and install, or remove the wireAddon call.`);
+    }
+    // A remote addon belongs in the devDependencies of the package that wires
+    // it, which in a workspace is not the root.
+    const manifests = new Map();
+    const readManifest = (path) => {
+        if (manifests.has(path))
+            return manifests.get(path);
+        let manifest = null;
+        if (existsSync(path)) {
+            try {
+                manifest = JSON.parse(readFileSync(path, 'utf-8'));
+            }
+            catch (e) {
+                logger.warn(`Could not read ${path} to verify remote addon dependencies: ${e?.message ?? e}`);
+            }
+        }
+        manifests.set(path, manifest);
+        return manifest;
+    };
     for (const [namespace, decl] of wireAddonDeclarations.entries()) {
         if (!decl.remote)
             continue;
+        const pkgJsonPath = join(addonResolutionDirs(state.rootDir, decl.file)[0], 'package.json');
+        const pkgJson = readManifest(pkgJsonPath);
+        if (!pkgJson)
+            continue; // no manifest to check (e.g. some tests)
+        const prodDeps = pkgJson.dependencies ?? {};
+        const devDeps = pkgJson.devDependencies ?? {};
         if (decl.package in devDeps)
             continue; // correct
         if (decl.package in prodDeps) {
-            logger.critical(ErrorCode.REMOTE_ADDON_NOT_DEV_DEPENDENCY, `Remote addon '${namespace}' ('${decl.package}') is a production dependency, but wireRemoteAddon consumes it for types only — its handlers run on the host. Move '${decl.package}' from "dependencies" to "devDependencies".`);
+            logger.critical(ErrorCode.REMOTE_ADDON_NOT_DEV_DEPENDENCY, `Remote addon '${namespace}' ('${decl.package}') is a production dependency in ${pkgJsonPath}, but wireRemoteAddon consumes it for types only — its handlers run on the host. Move '${decl.package}' from "dependencies" to "devDependencies".`);
         }
         else {
-            logger.critical(ErrorCode.REMOTE_ADDON_NOT_DEV_DEPENDENCY, `Remote addon '${namespace}' ('${decl.package}') is wired with wireRemoteAddon but is not in "devDependencies". Add '${decl.package}' to "devDependencies" (types only).`);
+            logger.critical(ErrorCode.REMOTE_ADDON_NOT_DEV_DEPENDENCY, `Remote addon '${namespace}' ('${decl.package}') is wired with wireRemoteAddon but is not in the "devDependencies" of ${pkgJsonPath}. Add '${decl.package}' to "devDependencies" (types only).`);
         }
     }
 }

package/dist/utils/resolve-versions.js

@@ -169,6 +169,12 @@ function updateWiringReferences(state, oldId, newId) {
                 source.pikkuFuncId = newId;
             }
         }
+        for (const source of Object.values(state.triggers.webhookSourceMeta ?? {})) {
+            for (const step of ['receive', 'check', 'setup', 'teardown']) {
+                if (source[step] === oldId)
+                    source[step] = newId;
+            }
+        }
     }
     // MCP resources, tools, and prompts
     if (state.mcpEndpoints) {

package/dist/utils/schema-generator.js

@@ -5,8 +5,8 @@ import { dirname, join, resolve } from 'path';
 import { createGenerator, RootlessError } from 'ts-json-schema-generator';
 import { register } from 'tsx/esm/api';
 import * as z from 'zod';
-import { zodToTs, createAuxiliaryTypeStore } from 'zod-to-ts';
 import { findZodTransform } from './find-zod-transform.js';
+import { zodToTypeText } from './zod-to-type-text.js';
 import { ErrorCode } from '../error-codes.js';
 import { generateCustomTypes } from './custom-types-generator.js';
 const PRIMITIVE_TYPES = new Set([
@@ -382,7 +382,7 @@ async function importWithRegister(sourceFile) {
         void Promise.resolve(unregister()).catch(() => { });
     }
 }
-function processZodSchema(schemaName, zodSchema, schemas, typesMap, auxiliaryTypeStore, printer, fakeSourceFile, logger) {
+function processZodSchema(schemaName, zodSchema, schemas, typesMap, logger) {
     const transformPath = findZodTransform(zodSchema);
     if (transformPath !== undefined) {
         const where = transformPath === '' ? 'the schema itself' : transformPath;
@@ -412,18 +412,13 @@ function processZodSchema(schemaName, zodSchema, schemas, typesMap, auxiliaryTyp
             delete schema.required;
         }
     }
-    const { node: tsType } = zodToTs(zodSchema, { auxiliaryTypeStore });
-    const typeText = printer.printNode(ts.EmitHint.Unspecified, tsType, fakeSourceFile);
-    typesMap.addCustomType(schemaName, typeText, []);
+    typesMap.addCustomType(schemaName, zodToTypeText(zodSchema), []);
     schemas[schemaName] = schema;
     logger.debug(`• Generated schema from Zod: ${schemaName}`);
 }
 async function generateZodSchemas(logger, schemaLookup, typesMap) {
     const schemas = {};
     const errors = [];
-    const auxiliaryTypeStore = createAuxiliaryTypeStore();
-    const printer = ts.createPrinter();
-    const fakeSourceFile = ts.createSourceFile('zod-types.ts', '', ts.ScriptTarget.ESNext, false, ts.ScriptKind.TS);
     // Validate all schemas are zod (or unspecified vendor)
     for (const [schemaName, ref] of schemaLookup.entries()) {
         if (ref.vendor && ref.vendor !== 'zod') {
@@ -453,7 +448,7 @@ async function generateZodSchemas(logger, schemaLookup, typesMap) {
                 continue;
             }
             try {
-                processZodSchema(schemaName, zodSchema, schemas, typesMap, auxiliaryTypeStore, printer, fakeSourceFile, logger);
+                processZodSchema(schemaName, zodSchema, schemas, typesMap, logger);
             }
             catch (e) {
                 errors.push(`Could not convert Zod schema '${schemaName}': ${e instanceof Error ? e.message : e}`);
@@ -478,7 +473,7 @@ async function generateZodSchemas(logger, schemaLookup, typesMap) {
                     errors.push(`Could not find exported schema '${ref.variableName}' in ${runtimeFile} for ${schemaName}. Available exports: ${Object.keys(module).join(', ')}`);
                     continue;
                 }
-                processZodSchema(schemaName, zodSchema, schemas, typesMap, auxiliaryTypeStore, printer, fakeSourceFile, logger);
+                processZodSchema(schemaName, zodSchema, schemas, typesMap, logger);
             }
             catch (e) {
                 errors.push(`Could not convert Zod schema '${schemaName}': ${e instanceof Error ? e.message : e}`);

package/dist/utils/serialize-inspector-state.d.ts

@@ -143,6 +143,7 @@ export interface SerializableInspectorState {
     triggers: {
         meta: InspectorState['triggers']['meta'];
         sourceMeta: InspectorState['triggers']['sourceMeta'];
+        webhookSourceMeta?: InspectorState['triggers']['webhookSourceMeta'];
         files: string[];
     };
     scheduledTasks: {

package/dist/utils/serialize-inspector-state.js

@@ -56,6 +56,7 @@ export function serializeInspectorState(state) {
         triggers: {
             meta: state.triggers.meta,
             sourceMeta: state.triggers.sourceMeta,
+            webhookSourceMeta: state.triggers.webhookSourceMeta,
             files: Array.from(state.triggers.files),
         },
         scheduledTasks: {
@@ -243,6 +244,7 @@ export function deserializeInspectorState(data) {
         triggers: {
             meta: data.triggers?.meta ?? {},
             sourceMeta: data.triggers?.sourceMeta ?? {},
+            webhookSourceMeta: data.triggers?.webhookSourceMeta ?? {},
             files: new Set(data.triggers?.files ?? []),
         },
         scheduledTasks: {

package/dist/utils/zod-to-type-text.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Print the TypeScript type text for a Zod schema.
+ *
+ * `processZodSchema` needs two things from a schema: the JSON Schema, which
+ * `z.toJSONSchema` already gives it, and the TypeScript source text that goes
+ * into the generated types. Only the second needed a library, and only to build
+ * a TypeScript AST that was immediately printed back to a string — so this walks
+ * Zod's own definitions and writes the text directly.
+ *
+ * It prints from the Zod tree rather than from the JSON Schema on purpose. The
+ * JSON Schema has already lost what the text needs: `z.date()` is rewritten to
+ * `string`/`date-time` before anything can read it, and `z.any()` and
+ * `z.unknown()` both flatten to `{}`. The Zod tree still says `Date`, `any` and
+ * `unknown`.
+ *
+ * The walk mirrors {@link findZodTransform} — same `_zod.def` shapes, same
+ * seen-set and node budget, for the same reason.
+ */
+/**
+ * The TypeScript type text for `schema`, as it would be written by hand.
+ *
+ * A schema that refers to itself cannot be written inline, so a cycle prints as
+ * `any` rather than recursing forever.
+ */
+export declare function zodToTypeText(schema: unknown): string;

package/dist/utils/zod-to-type-text.js

@@ -0,0 +1,228 @@
+/**
+ * Print the TypeScript type text for a Zod schema.
+ *
+ * `processZodSchema` needs two things from a schema: the JSON Schema, which
+ * `z.toJSONSchema` already gives it, and the TypeScript source text that goes
+ * into the generated types. Only the second needed a library, and only to build
+ * a TypeScript AST that was immediately printed back to a string — so this walks
+ * Zod's own definitions and writes the text directly.
+ *
+ * It prints from the Zod tree rather than from the JSON Schema on purpose. The
+ * JSON Schema has already lost what the text needs: `z.date()` is rewritten to
+ * `string`/`date-time` before anything can read it, and `z.any()` and
+ * `z.unknown()` both flatten to `{}`. The Zod tree still says `Date`, `any` and
+ * `unknown`.
+ *
+ * The walk mirrors {@link findZodTransform} — same `_zod.def` shapes, same
+ * seen-set and node budget, for the same reason.
+ */
+/** Max nodes visited, so a pathological or cyclic schema cannot hang the walk. */
+const MAX_NODES = 10_000;
+const INDENT = '    ';
+const isNode = (value) => typeof value === 'object' &&
+    value !== null &&
+    typeof value._zod?.def?.type === 'string';
+const tight = (text) => ({ text, loose: false });
+const loose = (text) => ({ text, loose: true });
+const parenthesized = ({ text, loose }) => loose ? `(${text})` : text;
+/** A JS value as a TypeScript literal type. */
+const literalOf = (value) => {
+    if (typeof value === 'string')
+        return JSON.stringify(value);
+    if (typeof value === 'bigint')
+        return `${value}n`;
+    if (value === undefined)
+        return 'undefined';
+    if (value === null)
+        return 'null';
+    return String(value);
+};
+const IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+const propertyKey = (name) => IDENTIFIER.test(name) ? name : JSON.stringify(name);
+/** A `.describe()` string as a JSDoc block at the given indentation. */
+const jsDoc = (description, indent) => {
+    if (!description)
+        return '';
+    const lines = description.split('\n');
+    if (lines.length === 1)
+        return `${indent}/** ${lines[0]} */\n`;
+    return `${indent}/**\n${lines.map((line) => `${indent} * ${line}`).join('\n')}\n${indent} */\n`;
+};
+const union = (parts) => {
+    const texts = [...new Set(parts.map(parenthesized))];
+    if (texts.length === 0)
+        return tight('never');
+    if (texts.length === 1)
+        return tight(texts[0]);
+    return loose(texts.join(' | '));
+};
+/**
+ * The TypeScript type text for `schema`, as it would be written by hand.
+ *
+ * A schema that refers to itself cannot be written inline, so a cycle prints as
+ * `any` rather than recursing forever.
+ */
+export function zodToTypeText(schema) {
+    const seen = new Set();
+    let budget = MAX_NODES;
+    const print = (node, indent) => {
+        if (budget-- <= 0 || !isNode(node))
+            return tight('any');
+        if (seen.has(node))
+            return tight('any');
+        seen.add(node);
+        try {
+            return printDef(node, indent);
+        }
+        finally {
+            seen.delete(node);
+        }
+    };
+    const printDef = (node, indent) => {
+        const def = node._zod.def;
+        const inner = indent + INDENT;
+        switch (def.type) {
+            case 'string':
+            case 'email':
+            case 'url':
+            case 'uuid':
+            case 'guid':
+            case 'cuid':
+            case 'cuid2':
+            case 'ulid':
+            case 'emoji':
+            case 'nanoid':
+            case 'jwt':
+            case 'base64':
+            case 'base64url':
+            case 'ipv4':
+            case 'ipv6':
+            case 'cidrv4':
+            case 'cidrv6':
+            case 'iso_date':
+            case 'iso_time':
+            case 'iso_datetime':
+            case 'iso_duration':
+                return tight('string');
+            case 'number':
+            case 'int':
+            case 'nan':
+                return tight('number');
+            case 'bigint':
+                return tight('bigint');
+            case 'boolean':
+                return tight('boolean');
+            case 'date':
+                return tight('Date');
+            case 'null':
+                return tight('null');
+            case 'undefined':
+            case 'void':
+                return tight('undefined');
+            case 'symbol':
+                return tight('symbol');
+            case 'file':
+                return tight('File');
+            case 'never':
+                return tight('never');
+            case 'any':
+                return tight('any');
+            case 'unknown':
+                return tight('unknown');
+            case 'literal':
+                return union((def.values ?? []).map((v) => tight(literalOf(v))));
+            case 'enum':
+                return union(Object.values(def.entries ?? {}).map((v) => tight(literalOf(v))));
+            case 'template_literal': {
+                const body = (def.parts ?? [])
+                    .map((part) => isNode(part) ? `\${${print(part, indent).text}}` : String(part))
+                    .join('');
+                return tight(`\`${body}\``);
+            }
+            case 'array':
+                return tight(`${parenthesized(print(def.element, indent))}[]`);
+            case 'set':
+                return tight(`Set<${print(def.valueType, indent).text}>`);
+            case 'map':
+                return tight(`Map<${print(def.keyType, indent).text}, ${print(def.valueType, indent).text}>`);
+            case 'promise':
+                return tight(`Promise<${print(def.innerType, indent).text}>`);
+            case 'tuple': {
+                const items = (def.items ?? []).map((item) => print(item, inner).text);
+                if (def.rest) {
+                    items.push(`...${parenthesized(print(def.rest, inner))}[]`);
+                }
+                if (items.length === 0)
+                    return tight('[]');
+                return tight(`[\n${items.map((item) => `${inner}${item}`).join(',\n')}\n${indent}]`);
+            }
+            case 'union':
+                return union((def.options ?? []).map((option) => print(option, indent)));
+            case 'intersection':
+                return loose(`${parenthesized(print(def.left, indent))} & ${parenthesized(print(def.right, indent))}`);
+            case 'record':
+                return tight(`{\n${inner}[key: ${print(def.keyType, inner).text}]: ${print(def.valueType, inner).text};\n${indent}}`);
+            case 'object':
+            case 'interface': {
+                const shape = def.shape ?? {};
+                const entries = Object.entries(shape);
+                if (entries.length === 0 && !def.catchall)
+                    return tight('{}');
+                const members = entries.map(([name, property]) => {
+                    const optional = isNode(property) && isOptional(property);
+                    const printed = print(property, inner);
+                    const type = optional
+                        ? `${parenthesized(printed)} | undefined`
+                        : printed.text;
+                    const doc = jsDoc(isNode(property) ? property.description : undefined, inner);
+                    return `${doc}${inner}${propertyKey(name)}${optional ? '?' : ''}: ${type};`;
+                });
+                if (def.catchall) {
+                    members.push(`${inner}[key: string]: ${print(def.catchall, inner).text};`);
+                }
+                return tight(`{\n${members.join('\n')}\n${indent}}`);
+            }
+            case 'nullable':
+                return union([print(def.innerType, indent), tight('null')]);
+            case 'lazy': {
+                try {
+                    return print(def.getter(), indent);
+                }
+                catch {
+                    // A lazy schema that cannot be forced tells us nothing about its type.
+                    return tight('any');
+                }
+            }
+            default:
+                // optional, default, prefault, nonoptional, readonly, catch, success,
+                // pipe — every wrapper Zod spells `innerType`, and a pipe's input is the
+                // shape a caller writes.
+                if (def.innerType)
+                    return print(def.innerType, indent);
+                if (def.in)
+                    return print(def.in, indent);
+                return tight('any');
+        }
+    };
+    /**
+     * Whether a property may be omitted.
+     *
+     * `.default()` counts. `processZodSchema` strips every defaulted field out of
+     * the JSON Schema's `required`, because a caller who omits one gets the
+     * default rather than a validation error — so the text has to say the same
+     * thing the validator does.
+     */
+    const isOptional = (node) => {
+        const def = node._zod.def;
+        if (def.type === 'optional')
+            return true;
+        if (def.type === 'default' || def.type === 'prefault')
+            return true;
+        if (def.type === 'nonoptional')
+            return false;
+        if (def.innerType && isNode(def.innerType))
+            return isOptional(def.innerType);
+        return false;
+    };
+    return print(schema, '').text;
+}

package/dist/visit.js

@@ -31,6 +31,7 @@ import { addWorkflowGraph } from './add/add-workflow-graph.js';
 import { addFeature } from './add/add-feature.js';
 import { addAgent } from './add/add-agent.js';
 import { addAnalytics } from './add/add-analytics.js';
+import { addOutgoingWebhook } from './add/add-outgoing-webhook.js';
 import { addAgentScorer } from './add/add-agent-scorer.js';
 import { addApprovalDescription } from './add/add-approval-description.js';
 export const visitSetup = (logger, checker, node, state, options) => {
@@ -43,6 +44,7 @@ export const visitSetup = (logger, checker, node, state, options) => {
     addFileWithFactory(node, checker, state.configFactories, 'CreateConfig');
     addFileWithFactory(node, checker, state.serverLifecycleFactories, 'ServerLifecycle');
     addAnalytics(logger, node, checker, state);
+    addOutgoingWebhook(logger, node, checker, state);
     addRPCInvocations(node, state, logger);
     addWireAddon(node, state, logger);
     addWireRemoteAddon(node, state, logger);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/inspector",
-  "version": "0.12.89",
+  "version": "0.12.92",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/pikkujs/pikku.git",
@@ -51,14 +51,13 @@
     "ts-json-schema-generator": "2.9.1-next.18",
     "tsx": "^4.23.12",
     "typescript": "^6.0.3",
-    "zod": "^4.4.3",
-    "zod-to-ts": "^2.1.0"
+    "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.123"
+    "@pikku/core": "^0.12.127"
   },
   "devDependencies": {
-    "@pikku/core": "^0.12.123",
+    "@pikku/core": "^0.12.127",
     "@types/node": "^24.13.3"
   },
   "engines": {