@pikku/inspector 0.12.94 → 0.12.96

package/CHANGELOG.md

@@ -1,3 +1,32 @@
+## 0.12.96
+
+### Patch Changes
+
+- dfcd351: The deploy planner now binds a unit to the units of the functions its functions call with `rpc.invoke('name')` / `rpc.remote('name')`. Before, a caller and callee split into different units (e.g. a no-service function in `svc-base` calling a DB function in `svc-kysely`) got no service binding and failed on the deployed stage with "No service binding for function". The inspector records literal RPC names per function as `invokes` (single, double or substitution-free template quotes; `rpc!`, `wire.rpc`) and warns on a computed name, which the planner cannot see (#1883).
+- cf40182: Deployed units that call `rpc.startWorkflow('x')` now get x's meta, so the call no longer fails with `WorkflowNotFoundError`. The inspector records `startsWorkflows` for literal `rpc.startWorkflow(...)` calls. It warns when a handler computes the workflow name or passes `rpc` to a helper, because the planner cannot see those calls.
+
+  With workflow queues, the deploy planner gives a starter unit the workflow meta and orchestrator queue meta only (new `--workflowMeta` filter), plus `workflow-state` and `queue` services. Without queues the start runs inline, so the whole workflow is bundled. Core's `startWorkflow` now requires the workflow registration only for inline runs; queued runs need only the meta.
+
+- f817f1c: Schema generation no longer re-walks every source file for each type. ts-json-schema-generator looks each root type up by name by scanning the whole program, so a project with 677 types scanned it 677 times. The inspector now builds that name index once per program. On the e2e project, TS schema generation drops from 8.7s to 0.1s and a cold `pikku all` from 38s to 8s, with identical output.
+- 5bce779: Webhook trigger sources are off until someone turns them on, and addons declare their own.
+
+  An addon calls `wireTriggerWebhookSource` in its own package, and an app that wires the addon gets the source (its route included) without declaring it: named and routed after the addon's namespace, so two instances get one each. A source the app declares under the same name wins.
+
+  Every source now has an `enabled` switch in the `triggerSourceStore`, off by default. `reconcileTriggerSources` registers only enabled sources and records each one's `baseUrl` and `labelPrefix`; a disabled source's route answers 404 without running `receive`. New in core: `enableTriggerSource` registers a source with its provider and `disableTriggerSource` stops it receiving, then tears it down, both at the recorded address unless one is given. The admin addon exposes them as `triggerSourceEnable` and `triggerSourceDisable`. The `pikkuTriggerSource` table gains `enabled`, `baseUrl` and `labelPrefix`: run `pikku db generate` for the migration.
+
+- Updated dependencies [dfcd351]
+- Updated dependencies [cf40182]
+- Updated dependencies [5bce779]
+- Updated dependencies [5bce779]
+  - @pikku/core@0.12.130
+
+## 0.12.95
+
+### Patch Changes
+
+- 6ecf80e: Stop the services-destructure lint (PKU410) firing on the stub a wiring registers for its function. Since inline functions carry a source file, a queue worker wired to a named function failed the build with a critical PKU410 even though that function destructures its services.
+- 2612a67: The services-destructure lint also skips the `helper` wiring functions `ensureFunctionMetadata` synthesizes, alongside the `inline` ones it already skips, and a test pins that an inline wiring function that records a source file is not flagged.
+
 ## 0.12.94
 
 ### Patch Changes

package/dist/add/add-functions.js

@@ -3,6 +3,8 @@ import { detectSchemaVendorOrError } from '../utils/detect-schema-vendor.js';
 import { extractFunctionName, funcIdToTypeName, } from '../utils/extract-function-name.js';
 import { extractFunctionNode } from '../utils/extract-function-node.js';
 import { extractUsedWires } from '../utils/extract-services.js';
+import { collectInvokedRpcNames } from './add-rpc-invocations.js';
+import { collectStartedWorkflows } from './collect-started-workflows.js';
 import { formatVersionedId, parseVersionedId } from '@pikku/core/utils';
 /** Binding keys a `pikkuScenarioStep` may declare, in report order. */
 const SCENARIO_SURFACE_KEYS = [
@@ -720,6 +722,10 @@ export const addFunctions = (logger, node, checker, state, options) => {
         }
     }
     const wires = extractUsedWires(handler, 2);
+    const invoked = collectInvokedRpcNames(handler.body);
+    for (const call of invoked.dynamic) {
+        logger.warn(`• ${pikkuFuncId} calls ${call} with a computed name — the deploy planner cannot bind its unit to the callee's, so the call fails with "No service binding" if the two are deployed apart. Use a literal RPC name.`);
+    }
     // --- Generics → ts.Type[], unwrapped from Promise ---
     const genericTypes = (typeArguments ?? [])
         .map((tn) => checker.getTypeFromTypeNode(tn))
@@ -986,6 +992,17 @@ export const addFunctions = (logger, node, checker, state, options) => {
             bodyStart: lineOf(handlerBody.getStart(handlerSourceFile)),
             bodyEnd: lineOf(handlerBody.getEnd()),
         };
+    const started = collectStartedWorkflows(handler.body);
+    // Generated scaffolds (the workflow start/run routes) take the name from the
+    // request by design, and are served by units that have every workflow.
+    const handlerFile = handler.getSourceFile().fileName;
+    const warnOnStarts = !/\.gen\.[cm]?[jt]s$/.test(handlerFile);
+    for (const call of warnOnStarts ? started.dynamic : []) {
+        logger.warn(`• ${pikkuFuncId} calls ${call} with a computed name — the deploy planner cannot bundle that workflow's meta into ${pikkuFuncId}'s unit, so the deployed call fails with "Workflow not found" unless the unit has it for another reason. Use a literal workflow name.`);
+    }
+    if (warnOnStarts && started.rpcHandoffs.length > 0) {
+        logger.warn(`• ${pikkuFuncId} passes rpc to ${started.rpcHandoffs.join(', ')} — rpc.startWorkflow / rpc.invoke calls made there are invisible to the deploy planner, so their targets are not bundled into or bound to ${pikkuFuncId}'s unit. Make those calls in the handler itself.`);
+    }
     state.functions.meta[pikkuFuncId] = {
         pikkuFuncId,
         functionType: 'user',
@@ -994,6 +1011,7 @@ export const addFunctions = (logger, node, checker, state, options) => {
         name,
         services,
         wires: wires.wires.length > 0 || !wires.optimized ? wires : undefined,
+        invokes: invoked.names.length > 0 ? invoked.names : undefined,
         inputSchemaName: inputNames[0] ?? null,
         outputSchemaName: outputNames[0] ?? null,
         inputs: inputNames.filter((n) => n !== 'void') ?? null,
@@ -1037,6 +1055,7 @@ export const addFunctions = (logger, node, checker, state, options) => {
         bodySourceFile,
         exportedName: exportedName || undefined,
         ...bodySpan,
+        startsWorkflows: started.names.length > 0 ? started.names : undefined,
     };
     if (handlerHasDynamicImport(handler)) {
         state.functions.dynamicImportIds.add(pikkuFuncId);

package/dist/add/add-rpc-invocations.d.ts

@@ -1,5 +1,22 @@
 import * as ts from 'typescript';
 import type { InspectorState, InspectorLogger } from '../types.js';
+/**
+ * The RPC names a function handler calls through `rpc.invoke(...)` /
+ * `rpc.remote(...)`, read from its own body.
+ *
+ * This is what the deploy planner uses to bind a unit to the units its
+ * functions call: without it, a caller and callee split into different units
+ * type-check, work in a single process, and fail on the deployed stage with
+ * "No service binding for function". `dynamic` holds the source text of calls
+ * whose name is not a literal — those cannot be planned for.
+ *
+ * Only the handler's own body is read. A call made from a helper defined
+ * elsewhere, with `rpc` passed in, is not seen.
+ */
+export declare function collectInvokedRpcNames(handler: ts.Node): {
+    names: string[];
+    dynamic: string[];
+};
 /**
  * Scan for rpc.invoke() calls to track which functions are actually being invoked
  * Also detects addon usage via:

package/dist/add/add-rpc-invocations.js

@@ -32,6 +32,63 @@ function invocationReceiver(node) {
     }
     return inner;
 }
+/** `rpc`, or anything ending in `.rpc` (`wire.rpc`), seen through `!` and parens. */
+function isRpcReceiver(node) {
+    const receiver = invocationReceiver(node);
+    return ts.isIdentifier(receiver)
+        ? receiver.text === 'rpc'
+        : ts.isPropertyAccessExpression(receiver) && receiver.name.text === 'rpc';
+}
+/**
+ * Methods on `rpc` that call another function by name and, when that function
+ * is not bundled in the caller's deploy unit, cross to another unit through the
+ * `DeploymentService`.
+ */
+const CROSS_UNIT_RPC_METHODS = new Set(['invoke', 'remote']);
+/** The name argument when it is statically known: `'x'`, `"x"` or `` `x` ``. */
+function literalRpcName(arg) {
+    if (ts.isStringLiteral(arg) || ts.isNoSubstitutionTemplateLiteral(arg)) {
+        return arg.text;
+    }
+    return undefined;
+}
+/**
+ * The RPC names a function handler calls through `rpc.invoke(...)` /
+ * `rpc.remote(...)`, read from its own body.
+ *
+ * This is what the deploy planner uses to bind a unit to the units its
+ * functions call: without it, a caller and callee split into different units
+ * type-check, work in a single process, and fail on the deployed stage with
+ * "No service binding for function". `dynamic` holds the source text of calls
+ * whose name is not a literal — those cannot be planned for.
+ *
+ * Only the handler's own body is read. A call made from a helper defined
+ * elsewhere, with `rpc` passed in, is not seen.
+ */
+export function collectInvokedRpcNames(handler) {
+    const names = new Set();
+    const dynamic = [];
+    const visit = (node) => {
+        if (ts.isCallExpression(node) &&
+            ts.isPropertyAccessExpression(node.expression) &&
+            CROSS_UNIT_RPC_METHODS.has(node.expression.name.text) &&
+            isRpcReceiver(node.expression.expression)) {
+            const [firstArg] = node.arguments;
+            if (firstArg) {
+                const name = literalRpcName(firstArg);
+                if (name !== undefined) {
+                    names.add(name);
+                }
+                else {
+                    dynamic.push(node.getText());
+                }
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(handler);
+    return { names: [...names].sort(), dynamic };
+}
 /**
  * Helper to extract namespace from a namespaced function reference like 'ext:hello'
  */
@@ -152,8 +209,9 @@ export function addRPCInvocations(node, state, logger) {
             }
             const [firstArg] = args;
             if (firstArg) {
-                if (ts.isStringLiteral(firstArg)) {
-                    const functionRef = firstArg.text;
+                const literalName = literalRpcName(firstArg);
+                if (literalName !== undefined) {
+                    const functionRef = literalName;
                     logger.debug(`• Found RPC invocation: ${functionRef}`);
                     state.rpc.invokedFunctions.add(functionRef);
                     let byFile = state.rpc.invokedFunctionsByFile.get(sourceFileName);
@@ -170,10 +228,9 @@ export function addRPCInvocations(node, state, logger) {
                     }
                 }
                 // Handle template literals like `function-${name}`
-                else if (ts.isTemplateExpression(firstArg) ||
-                    ts.isNoSubstitutionTemplateLiteral(firstArg)) {
+                else if (ts.isTemplateExpression(firstArg)) {
                     logger.warn(`• Found dynamic RPC invocation: ${firstArg.getText()}`);
-                    logger.warn(`\tYou can only use string literals for RPC function names, with ' or " and not \``);
+                    logger.warn(`\tYou can only use literal RPC function names, without \${...} substitutions`);
                 }
             }
         }

package/dist/add/collect-started-workflows.d.ts

@@ -0,0 +1,26 @@
+import * as ts from 'typescript';
+export type StartedWorkflows = {
+    /** Workflow names passed as a literal to `rpc.startWorkflow(...)`. */
+    names: string[];
+    /** Source text of `rpc.startWorkflow(...)` calls whose name is computed. */
+    dynamic: string[];
+    /**
+     * Plain functions the handler passes `rpc` to — calls made inside them are
+     * not seen. Methods (`workflowService.runToCompletion(..., rpc)`) are left
+     * out: they are services, not the app's own helpers.
+     */
+    rpcHandoffs: string[];
+};
+/**
+ * The workflows a function handler starts through `rpc.startWorkflow(...)`,
+ * read from its own body.
+ *
+ * `startWorkflow` looks the workflow up by name in the process that calls it,
+ * so a deployed unit that starts a workflow needs that workflow's meta bundled
+ * in. The deploy planner does that from these names.
+ *
+ * Only the handler's own body is read. When the handler passes `rpc` on to a
+ * helper, whatever the helper starts is invisible here; those callees are
+ * returned in `rpcHandoffs` so the caller can say so.
+ */
+export declare function collectStartedWorkflows(handler: ts.Node): StartedWorkflows;

package/dist/add/collect-started-workflows.js

@@ -0,0 +1,72 @@
+import * as ts from 'typescript';
+/** `x` seen through `x!` and `(x)`. */
+function unwrap(node) {
+    let inner = node;
+    while (ts.isNonNullExpression(inner) || ts.isParenthesizedExpression(inner)) {
+        inner = inner.expression;
+    }
+    return inner;
+}
+/** `rpc`, or anything ending in `.rpc` (`wire.rpc`), seen through `!` and parens. */
+function isRpcExpression(node) {
+    const inner = unwrap(node);
+    return ts.isIdentifier(inner)
+        ? inner.text === 'rpc'
+        : ts.isPropertyAccessExpression(inner) && inner.name.text === 'rpc';
+}
+/** An argument that hands `rpc` over: `rpc`, `wire.rpc`, `{ rpc }`, `{ rpc: wire.rpc }`. */
+function passesRpc(arg) {
+    if (isRpcExpression(arg))
+        return true;
+    const inner = unwrap(arg);
+    if (!ts.isObjectLiteralExpression(inner))
+        return false;
+    return inner.properties.some((p) => (ts.isShorthandPropertyAssignment(p) && p.name.text === 'rpc') ||
+        (ts.isPropertyAssignment(p) && isRpcExpression(p.initializer)));
+}
+/**
+ * The workflows a function handler starts through `rpc.startWorkflow(...)`,
+ * read from its own body.
+ *
+ * `startWorkflow` looks the workflow up by name in the process that calls it,
+ * so a deployed unit that starts a workflow needs that workflow's meta bundled
+ * in. The deploy planner does that from these names.
+ *
+ * Only the handler's own body is read. When the handler passes `rpc` on to a
+ * helper, whatever the helper starts is invisible here; those callees are
+ * returned in `rpcHandoffs` so the caller can say so.
+ */
+export function collectStartedWorkflows(handler) {
+    const names = new Set();
+    const dynamic = [];
+    const rpcHandoffs = new Set();
+    const visit = (node) => {
+        if (ts.isCallExpression(node)) {
+            const callee = node.expression;
+            const isRpcMethod = ts.isPropertyAccessExpression(callee) &&
+                isRpcExpression(callee.expression);
+            if (isRpcMethod && callee.name.text === 'startWorkflow') {
+                const [firstArg] = node.arguments;
+                if (firstArg) {
+                    if (ts.isStringLiteral(firstArg) ||
+                        ts.isNoSubstitutionTemplateLiteral(firstArg)) {
+                        names.add(firstArg.text);
+                    }
+                    else {
+                        dynamic.push(node.getText());
+                    }
+                }
+            }
+            else if (ts.isIdentifier(callee) && node.arguments.some(passesRpc)) {
+                rpcHandoffs.add(callee.text);
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(handler);
+    return {
+        names: [...names].sort(),
+        dynamic,
+        rpcHandoffs: [...rpcHandoffs].sort(),
+    };
+}

package/dist/types.d.ts

@@ -227,6 +227,7 @@ export type InspectorFilters = {
     excludeTarget?: Array<'serverless' | 'server'>;
     serverlessIncompatible?: string[];
     defaultTarget?: 'serverless' | 'server';
+    workflowMeta?: string[];
 };
 export type AddonConfig = {
     package: string;

package/dist/utils/filter-inspector-state.js

@@ -831,6 +831,54 @@ export function filterInspectorState(state, filters, logger) {
             }
         }
     }
+    // Workflows asked for by meta only — a unit that `rpc.startWorkflow`s one the
+    // orchestrator unit runs. The run is created from the meta and handed to the
+    // orchestrator queue, so the meta (and the workflow function's meta, which
+    // the generated workflow map types the start from) is restored, while the
+    // registration files stay out: bundling them would pull the workflow
+    // function and everything it imports into the unit.
+    const fullWorkflowNames = new Set(filters.names ?? []);
+    for (const name of filters.workflowMeta ?? []) {
+        const graphMeta = state.workflows?.graphMeta?.[name];
+        const workflowMeta = state.workflows?.meta?.[name];
+        if (!graphMeta && !workflowMeta)
+            continue;
+        const pikkuFuncId = graphMeta?.pikkuFuncId ?? workflowMeta?.pikkuFuncId;
+        if (graphMeta && !filteredState.workflows.graphMeta[name]) {
+            filteredState.workflows.graphMeta[name] = JSON.parse(JSON.stringify(graphMeta));
+        }
+        if (workflowMeta && !filteredState.workflows.meta[name]) {
+            filteredState.workflows.meta[name] = JSON.parse(JSON.stringify(workflowMeta));
+        }
+        const funcMeta = pikkuFuncId ? state.functions.meta[pikkuFuncId] : undefined;
+        if (pikkuFuncId && funcMeta && !filteredState.functions.meta[pikkuFuncId]) {
+            filteredState.functions.meta[pikkuFuncId] = funcMeta;
+        }
+        // The orchestrator queue's meta routes the start to the workflow's own
+        // queue instead of the shared fallback; its consumer is core's synthetic
+        // orchestrator, so no registration comes with it.
+        const orchestratorQueue = `wf-orchestrator-${name
+            .replace(/([a-z0-9])([A-Z])/g, '$1-$2')
+            .replace(/([A-Z])([A-Z][a-z])/g, '$1-$2')
+            .toLowerCase()}`;
+        const orchestratorMeta = state.queueWorkers?.meta?.[orchestratorQueue];
+        if (orchestratorMeta &&
+            !filteredState.queueWorkers.meta[orchestratorQueue]) {
+            filteredState.queueWorkers.meta[orchestratorQueue] = JSON.parse(JSON.stringify(orchestratorMeta));
+        }
+        const keepsRegistration = fullWorkflowNames.has(name) ||
+            (pikkuFuncId !== undefined &&
+                filteredState.serviceAggregation.usedFunctions.has(pikkuFuncId));
+        if (!keepsRegistration) {
+            for (const key of [name, pikkuFuncId]) {
+                if (!key)
+                    continue;
+                filteredState.workflows.files.delete(key);
+                filteredState.workflows.graphFiles.delete(key);
+            }
+        }
+        filteredState.serviceAggregation.requiredServices.add('workflowService');
+    }
     // Recompute requiredSchemas based on pruned functions.meta
     if (filteredState.serviceAggregation.usedFunctions.size > 0) {
         const prunedSchemas = new Set();

package/dist/utils/load-addon-functions-meta.d.ts

@@ -1,5 +1,13 @@
 import type { InspectorState, InspectorLogger } from '../types.js';
+import type { WebhookSourcesMeta } from '@pikku/core/trigger';
 export declare const describeMissingAddonMeta: (namespace: string, packageName: string, dirs: string[], declFile?: string) => string;
+/**
+ * The webhook sources an addon declares, as the app mounts them. The source is
+ * named after the addon's namespace, so two instances of one addon get a
+ * route each; an addon declaring several suffixes each with its own name.
+ * Every source starts off: the app turns one on at runtime.
+ */
+export declare const namespaceAddonWebhookSources: (sources: WebhookSourcesMeta, namespace: string) => WebhookSourcesMeta;
 /**
  * After the setup sweep discovers wireAddon() declarations, load each addon
  * package's function metadata so that wiring handlers (channels, HTTP routes,

package/dist/utils/load-addon-functions-meta.js

@@ -151,6 +151,31 @@ const registerAddonTypes = (state, metaPath, meta) => {
         }
     }
 };
+/**
+ * The webhook sources an addon declares, as the app mounts them. The source is
+ * named after the addon's namespace, so two instances of one addon get a
+ * route each; an addon declaring several suffixes each with its own name.
+ * Every source starts off: the app turns one on at runtime.
+ */
+export const namespaceAddonWebhookSources = (sources, namespace) => {
+    const declared = Object.values(sources);
+    const namespaced = {};
+    for (const source of declared) {
+        const name = declared.length === 1 ? namespace : `${namespace}-${source.name}`;
+        const meta = {
+            ...source,
+            name,
+            route: `/webhooks/${name}`,
+        };
+        for (const step of ['receive', 'check', 'setup', 'teardown']) {
+            const funcId = source[step];
+            if (funcId && !funcId.includes(':'))
+                meta[step] = `${namespace}:${funcId}`;
+        }
+        namespaced[name] = meta;
+    }
+    return namespaced;
+};
 /**
  * After the setup sweep discovers wireAddon() declarations, load each addon
  * package's function metadata so that wiring handlers (channels, HTTP routes,
@@ -366,6 +391,28 @@ export async function loadAddonFunctionsMeta(logger, state) {
                 }
                 catch { }
             }
+            try {
+                const webhookSourcesPath = require.resolve(`${decl.package}/.pikku/webhooks/pikku-webhook-sources-meta.gen.json`);
+                const sources = namespaceAddonWebhookSources(JSON.parse(await readFile(webhookSourcesPath, 'utf-8')), namespace);
+                for (const [name, source] of Object.entries(sources)) {
+                    if (state.triggers.webhookSourceMeta[name])
+                        continue;
+                    state.triggers.webhookSourceMeta[name] = source;
+                    for (const step of [
+                        'receive',
+                        'check',
+                        'setup',
+                        'teardown',
+                    ]) {
+                        const funcId = source[step];
+                        if (funcId)
+                            state.serviceAggregation.usedFunctions.add(funcId);
+                    }
+                }
+            }
+            catch {
+                // No addon webhook sources
+            }
             try {
                 const httpContractsPath = require.resolve(`${decl.package}/.pikku/http/pikku-http-contracts-meta.gen.json`);
                 const httpContractsRaw = await readFile(httpContractsPath, 'utf-8');

package/dist/utils/post-process.d.ts

@@ -1,7 +1,7 @@
-import type { InspectorState, InspectorLogger, InspectorOptions } from '../types.js';
-import type { PermissionMetadata } from '@pikku/core/function';
-import type { MiddlewareMetadata } from '@pikku/core/middleware';
-import type ts from 'typescript';
+import type { InspectorState, InspectorLogger, InspectorOptions } from "../types.js";
+import type { PermissionMetadata } from "@pikku/core/function";
+import type { MiddlewareMetadata } from "@pikku/core/middleware";
+import type ts from "typescript";
 /**
  * Stamp the inspected authorize/callbacks service set onto the generated auth
  * handler's function meta.
@@ -15,7 +15,7 @@ import type ts from 'typescript';
  * onto the handler meta. Re-derived every inspect and ordered BEFORE
  * `aggregateRequiredServices` so it flows into `requiredServices`.
  */
-export declare function stampAuthHandlerServices(state: InspectorState | Omit<InspectorState, 'typesLookup'>): void;
+export declare function stampAuthHandlerServices(state: InspectorState | Omit<InspectorState, "typesLookup">): void;
 /**
  * Helper to extract wire-level middleware/permission names from metadata.
  * Only extracts type:'wire' variants (individual middleware/permissions).
@@ -29,10 +29,10 @@ export declare function extractWireNames(list?: Array<MiddlewareMetadata | Permi
  * Note: usedFunctions, usedMiddleware, and usedPermissions are tracked directly
  * in the add-* methods during AST traversal for efficiency.
  */
-export declare function aggregateRequiredServices(state: InspectorState | Omit<InspectorState, 'typesLookup'>): void;
-export declare function validateSecretOverrides(logger: InspectorLogger, state: InspectorState | Omit<InspectorState, 'typesLookup'>): void;
-export declare function validateCredentialOverrides(logger: InspectorLogger, state: InspectorState | Omit<InspectorState, 'typesLookup'>): void;
-export declare function validateVariableOverrides(logger: InspectorLogger, state: InspectorState | Omit<InspectorState, 'typesLookup'>): void;
+export declare function aggregateRequiredServices(state: InspectorState | Omit<InspectorState, "typesLookup">): void;
+export declare function validateSecretOverrides(logger: InspectorLogger, state: InspectorState | Omit<InspectorState, "typesLookup">): void;
+export declare function validateCredentialOverrides(logger: InspectorLogger, state: InspectorState | Omit<InspectorState, "typesLookup">): void;
+export declare function validateVariableOverrides(logger: InspectorLogger, state: InspectorState | Omit<InspectorState, "typesLookup">): void;
 /**
  * Every wired addon must be installed, in the bucket matching how it is used.
  *
@@ -56,14 +56,14 @@ export declare function validateVariableOverrides(logger: InspectorLogger, state
  * up in `dependencies`. Asking the resolver is the only question that matches
  * what the loader will actually do.
  */
-export declare function validateRemoteAddonDependencies(logger: InspectorLogger, state: InspectorState | Omit<InspectorState, 'typesLookup'>): void;
+export declare function validateRemoteAddonDependencies(logger: InspectorLogger, state: InspectorState | Omit<InspectorState, "typesLookup">): void;
 /**
  * The auth a `wireRemoteAddon` consumer binds must reference a slot the consumer
  * actually declares: a `credentialId` must be a wired credential, a `secretId`
  * a wired secret. A custom `resolve()` and a public (omitted) surface are not
  * statically checkable and are left to runtime.
  */
-export declare function validateRemoteAddonAuth(logger: InspectorLogger, state: InspectorState | Omit<InspectorState, 'typesLookup'>): void;
+export declare function validateRemoteAddonAuth(logger: InspectorLogger, state: InspectorState | Omit<InspectorState, "typesLookup">): void;
 export declare function computeResolvedIOTypes(state: InspectorState): void;
 export declare function computeMiddlewareGroupsMeta(state: InspectorState): void;
 export declare function computePermissionsGroupsMeta(state: InspectorState): void;
@@ -88,7 +88,7 @@ export declare function validateSchemaReferences(logger: InspectorLogger, state:
  * A model is either concrete (`provider/model`) or an alias, which must appear
  * in the `models` table from pikku.config.json.
  */
-export declare function validateAgentModels(logger: InspectorLogger, state: InspectorState | Omit<InspectorState, 'typesLookup'>, modelAliases?: Record<string, string>): void;
+export declare function validateAgentModels(logger: InspectorLogger, state: InspectorState | Omit<InspectorState, "typesLookup">, modelAliases?: Record<string, string>): void;
 /**
  * Scenarios are pure stories of remote RPCs (same rule as client-side CLI
  * renderers): the func may only destructure logger/config — everything else
@@ -100,7 +100,7 @@ export declare function validateAgentModels(logger: InspectorLogger, state: Insp
  * `addFunctions` (`visitFunctions`) has populated `state.functions.meta` — so
  * the check read `undefined` there and never fired.
  */
-export declare function validateScenarioServices(logger: InspectorLogger, state: InspectorState | Omit<InspectorState, 'typesLookup'>): void;
+export declare function validateScenarioServices(logger: InspectorLogger, state: InspectorState | Omit<InspectorState, "typesLookup">): void;
 /**
  * Does this step's prose open by naming the actor who is already its subject?
  *
@@ -128,7 +128,7 @@ export declare const proseOpensWithActor: (prose: string, actor: string) => bool
  * It also marks the step's function as used, so `scenario run` boots the
  * singletons the step actually needs.
  */
-export declare function validateScenarioSteps(logger: InspectorLogger, state: InspectorState | Omit<InspectorState, 'typesLookup'>): void;
+export declare function validateScenarioSteps(logger: InspectorLogger, state: InspectorState | Omit<InspectorState, "typesLookup">): void;
 /**
  * Reports scenarios that no `pikkuFeature` lists.
  *
@@ -153,7 +153,7 @@ export declare function validateScenarioSteps(logger: InspectorLogger, state: In
  * the check reports it then and downgrades to a warn naming both sides, rather
  * than accusing a scenario that may well be in that array.
  */
-export declare function validateScenarioFeatures(logger: InspectorLogger, state: InspectorState | Omit<InspectorState, 'typesLookup'>): void;
+export declare function validateScenarioFeatures(logger: InspectorLogger, state: InspectorState | Omit<InspectorState, "typesLookup">): void;
 /**
  * A `pikkuWorkflowGraph` node that references the `graph:` namespace (e.g.
  * `graph:editFields`) needs @pikku/addon-graph wired — otherwise the RPC never
@@ -178,7 +178,7 @@ export declare function validateSchemaWiringSeparation(logger: InspectorLogger,
  * a name the omit does not cover. A name-based rule misses this; the type does
  * not.
  */
-export declare function validateNoSecretAliasServices(logger: InspectorLogger, checker: ts.TypeChecker, state: InspectorState | Omit<InspectorState, 'typesLookup'>): void;
+export declare function validateNoSecretAliasServices(logger: InspectorLogger, checker: ts.TypeChecker, state: InspectorState | Omit<InspectorState, "typesLookup">): void;
 /**
  * Reports secret reads the catalogue does not account for.
  *
@@ -191,8 +191,8 @@ export declare function validateNoSecretAliasServices(logger: InspectorLogger, c
  * deployment is asked for the client id and secret every connect flow needs
  * without an author restating a shape the runtime already fixes.
  */
-export declare function registerDerivedOAuth2AppSecrets(state: InspectorState | Omit<InspectorState, 'typesLookup'>): void;
-export declare function validateSecretUsage(logger: InspectorLogger, state: InspectorState | Omit<InspectorState, 'typesLookup'>): void;
+export declare function registerDerivedOAuth2AppSecrets(state: InspectorState | Omit<InspectorState, "typesLookup">): void;
+export declare function validateSecretUsage(logger: InspectorLogger, state: InspectorState | Omit<InspectorState, "typesLookup">): void;
 export declare function computeDiagnostics(state: InspectorState): void;
 /**
  * Validates that every scope referenced by a function is declared via
@@ -201,7 +201,7 @@ export declare function computeDiagnostics(state: InspectorState): void;
  * A `*` suffix is a wildcard requirement: `admin:*` requires the `admin` scope
  * to be declared, and grants its whole subtree.
  */
-export declare function validateScopeReferences(logger: InspectorLogger, state: InspectorState | Omit<InspectorState, 'typesLookup'>): void;
+export declare function validateScopeReferences(logger: InspectorLogger, state: InspectorState | Omit<InspectorState, "typesLookup">): void;
 /**
  * Resolves every `tools:` entry on every agent and reports the ones that do not
  * land on a real function, or that land on one with nothing to tell the model.
@@ -218,7 +218,7 @@ export declare function validateScopeReferences(logger: InspectorLogger, state:
  * quality loss rather than a failure. A title deliberately does not satisfy it —
  * a title labels a tool in a UI, it does not tell a model when to reach for it.
  */
-export declare function validateAgentToolReferences(logger: InspectorLogger, state: InspectorState | Omit<InspectorState, 'typesLookup'>, options?: InspectorOptions): void;
+export declare function validateAgentToolReferences(logger: InspectorLogger, state: InspectorState | Omit<InspectorState, "typesLookup">, options?: InspectorOptions): void;
 /**
  * Validates that every scorer an agent asks to be graded by exists.
  *
@@ -226,7 +226,7 @@ export declare function validateAgentToolReferences(logger: InspectorLogger, sta
  * that has already answered the user — which means a typo would otherwise cost
  * nothing visible and simply grade nothing, forever.
  */
-export declare function validateAgentScorerReferences(logger: InspectorLogger, state: InspectorState | Omit<InspectorState, 'typesLookup'>): void;
+export declare function validateAgentScorerReferences(logger: InspectorLogger, state: InspectorState | Omit<InspectorState, "typesLookup">): void;
 /**
  * Validates that every scope granted by a system role is declared via
  * `defineScope`. Runs after all visitors, so declaration order does not matter.
@@ -239,7 +239,7 @@ export declare function validateAgentScorerReferences(logger: InspectorLogger, s
  *
  * A `*` suffix grants a subtree; the node it hangs off must exist.
  */
-export declare function validateSystemRoleScopes(logger: InspectorLogger, state: InspectorState | Omit<InspectorState, 'typesLookup'>): void;
+export declare function validateSystemRoleScopes(logger: InspectorLogger, state: InspectorState | Omit<InspectorState, "typesLookup">): void;
 /**
  * Validates that every role a persona names is declared with
  * `defineSystemRole`. Runs after all visitors, so declaration order does not
@@ -251,4 +251,4 @@ export declare function validateSystemRoleScopes(logger: InspectorLogger, state:
  * symptom is a scatter of 403s that read like authorization findings rather
  * than like a deleted role.
  */
-export declare function validatePersonaRoles(logger: InspectorLogger, state: InspectorState | Omit<InspectorState, 'typesLookup'>): void;
+export declare function validatePersonaRoles(logger: InspectorLogger, state: InspectorState | Omit<InspectorState, "typesLookup">): void;