@pikku/inspector 0.12.91 → 0.12.94

package/CHANGELOG.md

@@ -1,3 +1,36 @@
+## 0.12.94
+
+### Patch Changes
+
+- 4323bcf: Inline wiring functions now record their source file, so `pikku release` leaves scaffold-injected ones out of the API surface.
+
+## 0.12.93
+
+### Patch Changes
+
+- 658f047: A function whose services are all singletons no longer builds wire services, so an addon's credential-bound wire factory does not run for, or fail, a webhook `receive` step that needs no connection. The inspector decides this from the `Services` type and records it as `singletonServicesOnly` on the function's runtime meta; the runner only reads the flag.
+- 658f047: Webhook signing secrets live in the credential store. `WebhookSigningSecret.fromCredential(provider, credentialService, name)` reads the secret per delivery via `load()`, so a `setup` step (or a handshake) that stores a new one with `credentialService.set` takes effect without a deploy.
+
+  Breaking: `setup` no longer returns `secret`, `wireTriggerWebhookSource` no longer takes `secret`, lifecycle outcomes drop `secretName`/`secret`, and `pikku webhooks setup` drops `--secretsOut`.
+
+- 658f047: A webhook source's `method` may be a list, mounting one route per method, for providers that verify the URL with a GET and deliver events with a POST (WhatsApp, Strava, Onfleet, Mailchimp), or a HEAD (Trello, Mandrill, SurveyMonkey).
+- Updated dependencies [658f047]
+- Updated dependencies [de63ab2]
+- Updated dependencies [658f047]
+- Updated dependencies [658f047]
+- Updated dependencies [658f047]
+- Updated dependencies [658f047]
+  - @pikku/core@0.12.128
+
+## 0.12.92
+
+### Patch Changes
+
+- f84e173: An addon wired from a workspace package now resolves from that package. The installed-addon check (PKU340), the remote addon `devDependencies` check and `pikku db generate`'s addon schemas all looked only at the project root, so an addon declared where it is wired — the only place bun links it — failed codegen unless it was also declared at the root.
+- Updated dependencies [f02585e]
+- Updated dependencies [5586749]
+  - @pikku/core@0.12.127
+
 ## 0.12.91
 
 ### Patch Changes

package/dist/add/add-trigger.js

@@ -1,5 +1,5 @@
 import * as ts from 'typescript';
-import { getPropertyValue, getCommonWireMetaData, } from '../utils/get-property-value.js';
+import { getArrayPropertyValue, getPropertyValue, getCommonWireMetaData, } from '../utils/get-property-value.js';
 import { extractFunctionName, makeContextBasedId, } from '../utils/extract-function-name.js';
 import { getPropertyAssignmentInitializer } from '../utils/type-utils.js';
 import { ensureInlineWiringFunction } from '../utils/ensure-function-metadata.js';
@@ -114,9 +114,10 @@ const addWireTriggerWebhookSource = (logger, node, checker, state, firstArg) =>
         logger.critical(ErrorCode.MISSING_NAME, `wireTriggerWebhookSource in ${node.getSourceFile().fileName} needs 'name' as a string literal.`);
         return;
     }
-    const method = getPropertyValue(obj, 'method') ?? 'post';
+    const method = getArrayPropertyValue(obj, 'method') ??
+        getPropertyValue(obj, 'method') ??
+        'post';
     const route = getPropertyValue(obj, 'route') ?? `/webhooks/${name}`;
-    let secret = getPropertyValue(obj, 'secret');
     const eventsInitializer = getPropertyAssignmentInitializer(obj, 'events', false, checker);
     const events = eventsInitializer
         ? checker
@@ -151,23 +152,11 @@ const addWireTriggerWebhookSource = (logger, node, checker, state, firstArg) =>
         steps[step] = pikkuFuncId;
         state.serviceAggregation.usedFunctions.add(pikkuFuncId);
     }
-    // An addon's receive reads the secret by its own name; the app may have
-    // renamed it for this instance.
-    const namespace = steps.receive?.includes(':')
-        ? steps.receive.slice(0, steps.receive.indexOf(':'))
-        : null;
-    const addon = namespace
-        ? state.rpc.wireAddonDeclarations.get(namespace)
-        : undefined;
-    if (secret && addon?.secretOverrides?.[secret]) {
-        secret = addon.secretOverrides[secret];
-    }
     const meta = {
         name,
         method: method,
         route,
         events,
-        ...(secret ? { secret } : {}),
         ...steps,
     };
     state.triggers.webhookSourceMeta[name] = meta;

package/dist/index.d.ts

@@ -26,3 +26,4 @@ export type { SerializedWorkflowGraph, SerializedWorkflowGraphs, } from './utils
 export { resolveCoreType } from './utils/resolve-core-type.js';
 export { readModuleSpecifiers } from './utils/read-module-specifiers.js';
 export { readTsconfigOutDir } from './utils/read-tsconfig-out-dir.js';
+export { addonResolutionDirs, createAddonResolver, } from './utils/addon-resolution.js';

package/dist/index.js

@@ -15,3 +15,4 @@ export { resolveFunctionMeta } from './utils/resolve-function-meta.js';
 export { resolveCoreType } from './utils/resolve-core-type.js';
 export { readModuleSpecifiers } from './utils/read-module-specifiers.js';
 export { readTsconfigOutDir } from './utils/read-tsconfig-out-dir.js';
+export { addonResolutionDirs, createAddonResolver, } from './utils/addon-resolution.js';

package/dist/utils/addon-resolution.d.ts

@@ -0,0 +1,10 @@
+export type AddonResolver = {
+    resolve: (id: string) => string;
+};
+/**
+ * An addon is installed wherever the package that calls `wireAddon` lists it,
+ * which in a workspace is usually not the repo root. Resolve from the declaring
+ * package first, as its code does at runtime, then from the root.
+ */
+export declare const addonResolutionDirs: (rootDir: string, declFile?: string) => string[];
+export declare const createAddonResolver: (dirs: string[]) => AddonResolver;

package/dist/utils/addon-resolution.js

@@ -0,0 +1,43 @@
+import { existsSync } from 'fs';
+import { createRequire } from 'module';
+import { join, dirname, parse, resolve } from 'path';
+const nearestPackageDir = (file) => {
+    const root = parse(file).root;
+    let dir = dirname(file);
+    while (dir && dir !== root) {
+        if (existsSync(join(dir, 'package.json')))
+            return dir;
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return null;
+};
+/**
+ * An addon is installed wherever the package that calls `wireAddon` lists it,
+ * which in a workspace is usually not the repo root. Resolve from the declaring
+ * package first, as its code does at runtime, then from the root.
+ */
+export const addonResolutionDirs = (rootDir, declFile) => {
+    const root = resolve(rootDir);
+    const declDir = declFile ? nearestPackageDir(resolve(declFile)) : null;
+    return declDir && declDir !== root ? [declDir, root] : [root];
+};
+export const createAddonResolver = (dirs) => {
+    const requires = dirs.map((dir) => createRequire(join(dir, 'package.json')));
+    return {
+        resolve: (id) => {
+            let lastError;
+            for (const req of requires) {
+                try {
+                    return req.resolve(id);
+                }
+                catch (e) {
+                    lastError = e;
+                }
+            }
+            throw lastError;
+        },
+    };
+};

package/dist/utils/ensure-function-metadata.js

@@ -176,6 +176,9 @@ export function ensureFunctionMetadata(state, pikkuFuncId, fallbackName, funcIni
         };
     }
     const meta = state.functions.meta[pikkuFuncId];
+    if (!meta.sourceFile && funcInitializer) {
+        meta.sourceFile = funcInitializer.getSourceFile().fileName;
+    }
     if (funcInitializer && checker) {
         let pikkuFuncCall = null;
         if (ts.isCallExpression(funcInitializer)) {

package/dist/utils/load-addon-functions-meta.js

@@ -1,7 +1,7 @@
 import { existsSync } from 'fs';
 import { readFile, readdir } from 'fs/promises';
-import { createRequire } from 'module';
 import { join, dirname, parse, relative } from 'path';
+import { addonResolutionDirs, createAddonResolver, } from './addon-resolution.js';
 import { ErrorCode } from '../error-codes.js';
 const isHTTPRouteConfig = (value) => typeof value === 'object' &&
     value !== null &&
@@ -90,45 +90,6 @@ const resolveAddonMeta = (require, packageName, baseName) => {
     }
     return null;
 };
-const nearestPackageDir = (file) => {
-    const root = parse(file).root;
-    let dir = dirname(file);
-    while (dir && dir !== root) {
-        if (existsSync(join(dir, 'package.json')))
-            return dir;
-        const parent = dirname(dir);
-        if (parent === dir)
-            break;
-        dir = parent;
-    }
-    return null;
-};
-/**
- * An addon is installed wherever the package that calls `wireAddon` lists it,
- * which in a workspace is usually not the repo root. Resolve from the declaring
- * package first, as its code does at runtime, then from the root.
- */
-const addonResolutionDirs = (rootDir, declFile) => {
-    const declDir = declFile ? nearestPackageDir(declFile) : null;
-    return declDir && declDir !== rootDir ? [declDir, rootDir] : [rootDir];
-};
-const createAddonResolver = (dirs) => {
-    const requires = dirs.map((dir) => createRequire(join(dir, 'package.json')));
-    return {
-        resolve: (id) => {
-            let lastError;
-            for (const req of requires) {
-                try {
-                    return req.resolve(id);
-                }
-                catch (e) {
-                    lastError = e;
-                }
-            }
-            throw lastError;
-        },
-    };
-};
 const findInstalledPackageDir = (dirs, packageName) => {
     for (const start of dirs) {
         const root = parse(start).root;

package/dist/utils/post-process.js

@@ -10,6 +10,7 @@ import { relative } from 'node:path';
 import { AUTH_HANDLER_FUNC_ID } from '../add/add-auth.js';
 import { flattenScopeDefinitions } from '@pikku/core/scope';
 import { DYNAMIC_SCENARIO_STEP_TARGET } from './workflow/dsl/patterns.js';
+import { addonResolutionDirs } from './addon-resolution.js';
 /**
  * Stamp the inspected authorize/callbacks service set onto the generated auth
  * handler's function meta.
@@ -93,6 +94,24 @@ function extractAllServices(state) {
         state.serviceAggregation.allWireServices = extractTypeKeys(servicesType)
             .filter((name) => !singletonSet.has(name))
             .sort();
+        markSingletonServicesOnly(state, new Set(state.serviceAggregation.allWireServices));
+    }
+}
+/**
+ * Marks the functions that never read a wire service, so the runner can skip
+ * `createWireServices` for them. Only called once the `Services` type has
+ * resolved: an unresolved type yields no wire services, which would otherwise
+ * mark every function.
+ */
+function markSingletonServicesOnly(state, wireServices) {
+    for (const meta of Object.values(state.functions.meta)) {
+        if (meta.services?.optimized &&
+            !meta.services.services.some((name) => wireServices.has(name))) {
+            meta.singletonServicesOnly = true;
+        }
+        else {
+            delete meta.singletonServicesOnly;
+        }
     }
 }
 /**
@@ -460,32 +479,34 @@ export function validateVariableOverrides(logger, state) {
     }
 }
 /**
- * Can `pkg` be resolved from `rootDir`, by any means the loader would use?
+ * Can `pkg` be resolved from any of `dirs`, by any means the loader would use?
  *
  * Resolution is attempted against `<pkg>/package.json` first and the bare
  * specifier second, because neither alone is conclusive. A package with a
  * restrictive `exports` map refuses the first with
  * `ERR_PACKAGE_PATH_NOT_EXPORTED` — which is not a failure at all: reaching the
- * exports map means the package was found. Only a module-not-found from both
- * attempts means it is genuinely absent.
+ * exports map means the package was found. Only a module-not-found from every
+ * attempt means it is genuinely absent.
  */
-const isPackageResolvable = (pkg, rootDir) => {
+const isPackageResolvable = (pkg, dirs) => {
     const NOT_FOUND = new Set(['MODULE_NOT_FOUND', 'ERR_MODULE_NOT_FOUND']);
-    let req;
-    try {
-        req = createRequire(join(rootDir, 'package.json'));
-    }
-    catch {
-        return true; // cannot ask; do not accuse
-    }
-    for (const specifier of [`${pkg}/package.json`, pkg]) {
+    for (const dir of dirs) {
+        let req;
         try {
-            req.resolve(specifier);
-            return true;
+            req = createRequire(join(dir, 'package.json'));
         }
-        catch (e) {
-            if (!NOT_FOUND.has(e?.code))
+        catch {
+            return true; // cannot ask; do not accuse
+        }
+        for (const specifier of [`${pkg}/package.json`, pkg]) {
+            try {
+                req.resolve(specifier);
                 return true;
+            }
+            catch (e) {
+                if (!NOT_FOUND.has(e?.code))
+                    return true;
+            }
         }
     }
     return false;
@@ -523,35 +544,45 @@ export function validateRemoteAddonDependencies(logger, state) {
     for (const [namespace, decl] of wireAddonDeclarations.entries()) {
         if (decl.remote)
             continue;
-        if (isPackageResolvable(decl.package, state.rootDir))
+        const dirs = addonResolutionDirs(state.rootDir, decl.file);
+        if (isPackageResolvable(decl.package, dirs))
             continue;
-        logger.critical(ErrorCode.ADDON_NOT_INSTALLED, `Addon '${namespace}' ('${decl.package}') is wired with wireAddon but cannot be resolved — every ref('${namespace}:…') will resolve to nothing and the surface will be dead at runtime. Install it, or remove the wireAddon call.`);
-    }
-    if (!Array.from(wireAddonDeclarations.values()).some((d) => d.remote))
-        return;
-    const pkgJsonPath = join(state.rootDir, 'package.json');
-    if (!existsSync(pkgJsonPath))
-        return; // no manifest to check (e.g. some tests)
-    let pkgJson;
-    try {
-        pkgJson = JSON.parse(readFileSync(pkgJsonPath, 'utf-8'));
-    }
-    catch (e) {
-        logger.warn(`Could not read ${pkgJsonPath} to verify remote addon dependencies: ${e?.message ?? e}`);
-        return;
-    }
-    const prodDeps = pkgJson.dependencies ?? {};
-    const devDeps = pkgJson.devDependencies ?? {};
+        logger.critical(ErrorCode.ADDON_NOT_INSTALLED, `Addon '${namespace}' ('${decl.package}') is wired with wireAddon but cannot be resolved from ${dirs.join(' or ')} — every ref('${namespace}:…') will resolve to nothing and the surface will be dead at runtime. Add it to the dependencies of ${join(dirs[0], 'package.json')} and install, or remove the wireAddon call.`);
+    }
+    // A remote addon belongs in the devDependencies of the package that wires
+    // it, which in a workspace is not the root.
+    const manifests = new Map();
+    const readManifest = (path) => {
+        if (manifests.has(path))
+            return manifests.get(path);
+        let manifest = null;
+        if (existsSync(path)) {
+            try {
+                manifest = JSON.parse(readFileSync(path, 'utf-8'));
+            }
+            catch (e) {
+                logger.warn(`Could not read ${path} to verify remote addon dependencies: ${e?.message ?? e}`);
+            }
+        }
+        manifests.set(path, manifest);
+        return manifest;
+    };
     for (const [namespace, decl] of wireAddonDeclarations.entries()) {
         if (!decl.remote)
             continue;
+        const pkgJsonPath = join(addonResolutionDirs(state.rootDir, decl.file)[0], 'package.json');
+        const pkgJson = readManifest(pkgJsonPath);
+        if (!pkgJson)
+            continue; // no manifest to check (e.g. some tests)
+        const prodDeps = pkgJson.dependencies ?? {};
+        const devDeps = pkgJson.devDependencies ?? {};
         if (decl.package in devDeps)
             continue; // correct
         if (decl.package in prodDeps) {
-            logger.critical(ErrorCode.REMOTE_ADDON_NOT_DEV_DEPENDENCY, `Remote addon '${namespace}' ('${decl.package}') is a production dependency, but wireRemoteAddon consumes it for types only — its handlers run on the host. Move '${decl.package}' from "dependencies" to "devDependencies".`);
+            logger.critical(ErrorCode.REMOTE_ADDON_NOT_DEV_DEPENDENCY, `Remote addon '${namespace}' ('${decl.package}') is a production dependency in ${pkgJsonPath}, but wireRemoteAddon consumes it for types only — its handlers run on the host. Move '${decl.package}' from "dependencies" to "devDependencies".`);
         }
         else {
-            logger.critical(ErrorCode.REMOTE_ADDON_NOT_DEV_DEPENDENCY, `Remote addon '${namespace}' ('${decl.package}') is wired with wireRemoteAddon but is not in "devDependencies". Add '${decl.package}' to "devDependencies" (types only).`);
+            logger.critical(ErrorCode.REMOTE_ADDON_NOT_DEV_DEPENDENCY, `Remote addon '${namespace}' ('${decl.package}') is wired with wireRemoteAddon but is not in the "devDependencies" of ${pkgJsonPath}. Add '${decl.package}' to "devDependencies" (types only).`);
         }
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/inspector",
-  "version": "0.12.91",
+  "version": "0.12.94",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/pikkujs/pikku.git",
@@ -54,10 +54,10 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.125"
+    "@pikku/core": "^0.12.128"
   },
   "devDependencies": {
-    "@pikku/core": "^0.12.125",
+    "@pikku/core": "^0.12.128",
     "@types/node": "^24.13.3"
   },
   "engines": {