@pikku/inspector 0.12.94 → 0.12.96

package/dist/utils/post-process.js

@@ -1,16 +1,16 @@
-import { existsSync, readFileSync } from 'node:fs';
-import { createRequire } from 'node:module';
-import { join } from 'node:path';
-import { extractTypeKeys } from './type-utils.js';
-import { ErrorCode } from '../error-codes.js';
-import { findSecretAliasServices } from './secret-alias-services.js';
-import { deriveOAuth2AppSecrets } from '@pikku/core/secret';
-import { resolveCoreType } from './resolve-core-type.js';
-import { relative } from 'node:path';
-import { AUTH_HANDLER_FUNC_ID } from '../add/add-auth.js';
-import { flattenScopeDefinitions } from '@pikku/core/scope';
-import { DYNAMIC_SCENARIO_STEP_TARGET } from './workflow/dsl/patterns.js';
-import { addonResolutionDirs } from './addon-resolution.js';
+import { existsSync, readFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { join } from "node:path";
+import { extractTypeKeys } from "./type-utils.js";
+import { ErrorCode } from "../error-codes.js";
+import { findSecretAliasServices } from "./secret-alias-services.js";
+import { deriveOAuth2AppSecrets } from "@pikku/core/secret";
+import { resolveCoreType } from "./resolve-core-type.js";
+import { relative } from "node:path";
+import { AUTH_HANDLER_FUNC_ID } from "../add/add-auth.js";
+import { flattenScopeDefinitions } from "@pikku/core/scope";
+import { DYNAMIC_SCENARIO_STEP_TARGET } from "./workflow/dsl/patterns.js";
+import { addonResolutionDirs } from "./addon-resolution.js";
 /**
  * Stamp the inspected authorize/callbacks service set onto the generated auth
  * handler's function meta.
@@ -45,7 +45,7 @@ export function extractWireNames(list) {
     if (!list)
         return [];
     return list
-        .filter((item) => item.type === 'wire')
+        .filter((item) => item.type === "wire")
         .map((item) => item.name);
 }
 /**
@@ -57,13 +57,13 @@ function expandAndAddGroupServices(list, state, addServices) {
     if (!list)
         return;
     for (const item of list) {
-        if (item.type === 'tag') {
+        if (item.type === "tag") {
             const groupMeta = state.middleware.tagMiddleware.get(item.tag);
             if (groupMeta?.services) {
                 addServices(groupMeta.services);
             }
         }
-        else if (item.type === 'http' && 'route' in item) {
+        else if (item.type === "http" && "route" in item) {
             const groupMeta = state.http.routeMiddleware.get(item.route);
             if (groupMeta?.services) {
                 addServices(groupMeta.services);
@@ -78,7 +78,7 @@ function expandAndAddGroupServices(list, state, addServices) {
  */
 function extractAllServices(state) {
     // Skip if typesLookup is not available (e.g., deserialized state)
-    if (!('typesLookup' in state)) {
+    if (!("typesLookup" in state)) {
         return;
     }
     // Extract all singleton services from the SingletonServices type
@@ -126,7 +126,7 @@ export function aggregateRequiredServices(state) {
     extractAllServices(state);
     const { requiredServices, usedFunctions, usedMiddleware, usedPermissions } = state.serviceAggregation;
     // Internal services (always excluded from tree-shaking)
-    const internalServices = new Set(['rpc', 'mcp', 'channel', 'userSession']);
+    const internalServices = new Set(["rpc", "mcp", "channel", "userSession"]);
     const addServices = (services) => {
         if (!services || !services.services)
             return;
@@ -172,15 +172,7 @@ export function aggregateRequiredServices(state) {
     });
     // 4. Services from middleware/permission groups used in wirings
     // We need to check all wirings and expand any tag/HTTP-pattern groups they use
-    for (const method of [
-        'get',
-        'post',
-        'put',
-        'patch',
-        'delete',
-        'head',
-        'options',
-    ]) {
+    for (const method of ["get", "post", "put", "patch", "delete", "head", "options"]) {
         for (const routeMeta of Object.values(state.http.meta[method])) {
             expandAndAddGroupServices(routeMeta.middleware, state, addServices);
         }
@@ -218,23 +210,22 @@ export function aggregateRequiredServices(state) {
     // that wrap workflow operations but don't destructure the services.
     const hasWorkflows = Object.keys(state.workflows.graphMeta).length > 0 ||
         Object.keys(state.workflows.meta).length > 0 ||
-        Object.keys(state.functions.meta).some((id) => id.startsWith('workflowStart:') ||
-            id.startsWith('workflowStatus:') ||
-            id.startsWith('workflow:'));
+        Object.keys(state.functions.meta).some((id) => id.startsWith("workflowStart:") ||
+            id.startsWith("workflowStatus:") ||
+            id.startsWith("workflow:"));
     if (hasWorkflows) {
-        requiredServices.add('workflowService');
-        requiredServices.add('workflowRunService');
-        requiredServices.add('schedulerService');
-        requiredServices.add('queueService');
+        requiredServices.add("workflowService");
+        requiredServices.add("workflowRunService");
+        requiredServices.add("schedulerService");
+        requiredServices.add("queueService");
     }
     // Webhook source routes and their worker are generated and destructure
     // nothing, so they are found by id: the route accepts into the queue through
     // incomingWebhookService and the worker records attempts through it.
     const hasWebhookSources = Object.values(state.triggers?.webhookSourceMeta ?? {}).some(({ method, route }) => state.functions.meta[`http:${method}:${route}`] !== undefined);
-    if (hasWebhookSources ||
-        state.functions.meta['queue:pikku-incoming-webhooks'] !== undefined) {
-        requiredServices.add('incomingWebhookService');
-        requiredServices.add('queueService');
+    if (hasWebhookSources || state.functions.meta["queue:pikku-incoming-webhooks"] !== undefined) {
+        requiredServices.add("incomingWebhookService");
+        requiredServices.add("queueService");
     }
     // 6b. Inject synthetic queue workers for workflow graph steps.
     // Each workflow gets an orchestrator queue and per-step queues.
@@ -248,11 +239,11 @@ export function aggregateRequiredServices(state) {
         // synthetic entries were pure leakage: they put a
         // `wf-orchestrator-<scenario>` worker into the app's queue meta, which every
         // bundle imports and a provider then creates as a real production queue.
-        if (graph.source === 'scenario')
+        if (graph.source === "scenario")
             continue;
         const toKebab = (s) => s
-            .replace(/([a-z0-9])([A-Z])/g, '$1-$2')
-            .replace(/([A-Z])([A-Z][a-z])/g, '$1-$2')
+            .replace(/([a-z0-9])([A-Z])/g, "$1-$2")
+            .replace(/([A-Z])([A-Z][a-z])/g, "$1-$2")
             .toLowerCase();
         // Orchestrator queue
         const orchQueueName = `wf-orchestrator-${toKebab(graph.name)}`;
@@ -264,14 +255,11 @@ export function aggregateRequiredServices(state) {
         }
         // Per-step queues — only for steps explicitly marked workflowQueued: true
         for (const node of Object.values(graph.nodes)) {
-            if (!('rpcName' in node) || !node.rpcName)
+            if (!("rpcName" in node) || !node.rpcName)
                 continue;
             const rpcName = node.rpcName;
-            const funcId = state.rpc?.internalMeta?.[rpcName] ??
-                state.rpc?.exposedMeta?.[rpcName] ??
-                rpcName;
-            const funcMeta = (state.functions.meta[funcId] ??
-                state.functions.meta[rpcName]);
+            const funcId = state.rpc?.internalMeta?.[rpcName] ?? state.rpc?.exposedMeta?.[rpcName] ?? rpcName;
+            const funcMeta = (state.functions.meta[funcId] ?? state.functions.meta[rpcName]);
             if (funcMeta?.workflowQueued !== true)
                 continue;
             const stepQueueName = `wf-step-${toKebab(rpcName)}`;
@@ -285,20 +273,20 @@ export function aggregateRequiredServices(state) {
     }
     // AI agents need agentStorage + agentRunState + agentRunService + agentRunner
     if (Object.keys(state.agents.agentsMeta).length > 0) {
-        requiredServices.add('agentStorage');
-        requiredServices.add('agentRunState');
-        requiredServices.add('agentRunService');
-        requiredServices.add('agentRunner');
+        requiredServices.add("agentStorage");
+        requiredServices.add("agentRunState");
+        requiredServices.add("agentRunService");
+        requiredServices.add("agentRunner");
     }
     // Channels need eventHub for pub/sub
     if (Object.keys(state.channels.meta).length > 0) {
-        requiredServices.add('eventHub');
+        requiredServices.add("eventHub");
     }
     // Declared scopes need scopeService to resolve a grant. Nothing in a project
     // destructures it — the generated auth layer reaches it — so the declaration
     // is the only signal there is.
     if ((state.scopes?.definitions?.length ?? 0) > 0) {
-        requiredServices.add('scopeService');
+        requiredServices.add("scopeService");
     }
     // Declared feature flags need featureFlags for the same reason, from the
     // other side: `assertFeatureAvailable` reads the source out of the singleton
@@ -306,17 +294,17 @@ export function aggregateRequiredServices(state) {
     // ever says the project has flags. Without this the flag tables are left out
     // of the generated migration and every gate silently resolves open.
     if ((state.featureFlags?.definitions?.length ?? 0) > 0) {
-        requiredServices.add('featureFlags');
+        requiredServices.add("featureFlags");
     }
     // A `defineAnalyticsEvents` declaration means events are emitted, and the
     // invocation buffer flushes into `analyticsService`. Nothing destructures
     // that either — functions are handed the request-scoped `analytics` — so the
     // declaration is again the only signal.
     if ((state.analytics?.length ?? 0) > 0) {
-        requiredServices.add('analyticsService');
+        requiredServices.add("analyticsService");
     }
     if ((state.credentials?.definitions?.length ?? 0) > 0) {
-        requiredServices.add('credentialService');
+        requiredServices.add("credentialService");
     }
     // 7. Services that consumed addons need from the parent project.
     const addonFnServices = new Map();
@@ -327,13 +315,7 @@ export function aggregateRequiredServices(state) {
     }
     const parentDeclared = state.addonRequiredParentServices ?? [];
     const parentDeclaredSet = new Set(parentDeclared);
-    const defaultServices = new Set([
-        'config',
-        'logger',
-        'variables',
-        'schema',
-        'secrets',
-    ]);
+    const defaultServices = new Set(["config", "logger", "variables", "schema", "secrets"]);
     let usesAddonFn = false;
     let addonFactoryNeeded = false;
     for (const funcId of usedFunctions) {
@@ -349,8 +331,7 @@ export function aggregateRequiredServices(state) {
             if (parentDeclaredSet.has(service)) {
                 requiredServices.add(service);
             }
-            else if (!internalServices.has(service) &&
-                !defaultServices.has(service)) {
+            else if (!internalServices.has(service) && !defaultServices.has(service)) {
                 addonFactoryNeeded = true;
             }
         }
@@ -398,7 +379,7 @@ export function validateSecretOverrides(logger, state) {
         for (const [logicalName, resolvedName] of Object.entries(addonDecl.secretOverrides ?? {})) {
             if (!secretIds.has(resolvedName)) {
                 const availableSecrets = Array.from(secretIds);
-                logger.critical(ErrorCode.INVALID_VALUE, `Secret override '${logicalName}' -> '${resolvedName}' in addon '${namespace}' (${addonDecl.package}) targets a secret that does not exist. Available secrets: ${availableSecrets.join(', ') || 'none'}`);
+                logger.critical(ErrorCode.INVALID_VALUE, `Secret override '${logicalName}' -> '${resolvedName}' in addon '${namespace}' (${addonDecl.package}) targets a secret that does not exist. Available secrets: ${availableSecrets.join(", ") || "none"}`);
             }
         }
         // A grant names the secret as the addon reads it, so it resolves through
@@ -407,7 +388,7 @@ export function validateSecretOverrides(logger, state) {
             const resolvedName = addonDecl.secretOverrides?.[logicalName] ?? logicalName;
             if (!secretIds.has(resolvedName)) {
                 const availableSecrets = Array.from(secretIds);
-                logger.critical(ErrorCode.INVALID_VALUE, `Secret grant '${logicalName}' in addon '${namespace}' (${addonDecl.package}) targets a secret that does not exist. Available secrets: ${availableSecrets.join(', ') || 'none'}`);
+                logger.critical(ErrorCode.INVALID_VALUE, `Secret grant '${logicalName}' in addon '${namespace}' (${addonDecl.package}) targets a secret that does not exist. Available secrets: ${availableSecrets.join(", ") || "none"}`);
             }
         }
     }
@@ -418,8 +399,8 @@ export function validateCredentialOverrides(logger, state) {
         return;
     const credentialNames = new Set(state.credentials?.definitions.map((d) => d.name) ?? []);
     /** Only a rename has a target to check; a mode-only override renames nothing. */
-    const renameTarget = (override) => typeof override === 'string' ? override : override.name;
-    const overrideMode = (override) => typeof override === 'string' ? undefined : override.mode;
+    const renameTarget = (override) => typeof override === "string" ? override : override.name;
+    const overrideMode = (override) => typeof override === "string" ? undefined : override.mode;
     /**
      * Which declaration set each resolved name's mode. Credential generation
      * writes one shared metadata entry per name, so two declarations that map
@@ -436,10 +417,8 @@ export function validateCredentialOverrides(logger, state) {
             const resolvedName = renamed ?? logicalName;
             if (!credentialNames.has(resolvedName)) {
                 const availableCredentials = Array.from(credentialNames);
-                const target = renamed
-                    ? `'${logicalName}' -> '${resolvedName}'`
-                    : `'${logicalName}'`;
-                logger.critical(ErrorCode.INVALID_VALUE, `Credential override ${target} in addon '${namespace}' (${addonDecl.package}) targets a credential that does not exist. Available credentials: ${availableCredentials.join(', ') || 'none'}`);
+                const target = renamed ? `'${logicalName}' -> '${resolvedName}'` : `'${logicalName}'`;
+                logger.critical(ErrorCode.INVALID_VALUE, `Credential override ${target} in addon '${namespace}' (${addonDecl.package}) targets a credential that does not exist. Available credentials: ${availableCredentials.join(", ") || "none"}`);
             }
             const mode = overrideMode(override);
             if (!mode)
@@ -455,7 +434,7 @@ export function validateCredentialOverrides(logger, state) {
             const resolvedName = (override ? renameTarget(override) : undefined) ?? logicalName;
             if (!credentialNames.has(resolvedName)) {
                 const availableCredentials = Array.from(credentialNames);
-                logger.critical(ErrorCode.INVALID_VALUE, `Credential grant '${logicalName}' in addon '${namespace}' (${addonDecl.package}) targets a credential that does not exist. Available credentials: ${availableCredentials.join(', ') || 'none'}`);
+                logger.critical(ErrorCode.INVALID_VALUE, `Credential grant '${logicalName}' in addon '${namespace}' (${addonDecl.package}) targets a credential that does not exist. Available credentials: ${availableCredentials.join(", ") || "none"}`);
             }
         }
     }
@@ -473,7 +452,7 @@ export function validateVariableOverrides(logger, state) {
         for (const [logicalName, resolvedName] of Object.entries(addonDecl.variableOverrides)) {
             if (!variableIds.has(resolvedName)) {
                 const availableVariables = Array.from(variableIds);
-                logger.critical(ErrorCode.INVALID_VALUE, `Variable override '${logicalName}' -> '${resolvedName}' in addon '${namespace}' (${addonDecl.package}) targets a variable that does not exist. Available variables: ${availableVariables.join(', ') || 'none'}`);
+                logger.critical(ErrorCode.INVALID_VALUE, `Variable override '${logicalName}' -> '${resolvedName}' in addon '${namespace}' (${addonDecl.package}) targets a variable that does not exist. Available variables: ${availableVariables.join(", ") || "none"}`);
             }
         }
     }
@@ -489,11 +468,11 @@ export function validateVariableOverrides(logger, state) {
  * attempt means it is genuinely absent.
  */
 const isPackageResolvable = (pkg, dirs) => {
-    const NOT_FOUND = new Set(['MODULE_NOT_FOUND', 'ERR_MODULE_NOT_FOUND']);
+    const NOT_FOUND = new Set(["MODULE_NOT_FOUND", "ERR_MODULE_NOT_FOUND"]);
     for (const dir of dirs) {
         let req;
         try {
-            req = createRequire(join(dir, 'package.json'));
+            req = createRequire(join(dir, "package.json"));
         }
         catch {
             return true; // cannot ask; do not accuse
@@ -547,7 +526,7 @@ export function validateRemoteAddonDependencies(logger, state) {
         const dirs = addonResolutionDirs(state.rootDir, decl.file);
         if (isPackageResolvable(decl.package, dirs))
             continue;
-        logger.critical(ErrorCode.ADDON_NOT_INSTALLED, `Addon '${namespace}' ('${decl.package}') is wired with wireAddon but cannot be resolved from ${dirs.join(' or ')} — every ref('${namespace}:…') will resolve to nothing and the surface will be dead at runtime. Add it to the dependencies of ${join(dirs[0], 'package.json')} and install, or remove the wireAddon call.`);
+        logger.critical(ErrorCode.ADDON_NOT_INSTALLED, `Addon '${namespace}' ('${decl.package}') is wired with wireAddon but cannot be resolved from ${dirs.join(" or ")} — every ref('${namespace}:…') will resolve to nothing and the surface will be dead at runtime. Add it to the dependencies of ${join(dirs[0], "package.json")} and install, or remove the wireAddon call.`);
     }
     // A remote addon belongs in the devDependencies of the package that wires
     // it, which in a workspace is not the root.
@@ -558,7 +537,7 @@ export function validateRemoteAddonDependencies(logger, state) {
         let manifest = null;
         if (existsSync(path)) {
             try {
-                manifest = JSON.parse(readFileSync(path, 'utf-8'));
+                manifest = JSON.parse(readFileSync(path, "utf-8"));
             }
             catch (e) {
                 logger.warn(`Could not read ${path} to verify remote addon dependencies: ${e?.message ?? e}`);
@@ -570,7 +549,7 @@ export function validateRemoteAddonDependencies(logger, state) {
     for (const [namespace, decl] of wireAddonDeclarations.entries()) {
         if (!decl.remote)
             continue;
-        const pkgJsonPath = join(addonResolutionDirs(state.rootDir, decl.file)[0], 'package.json');
+        const pkgJsonPath = join(addonResolutionDirs(state.rootDir, decl.file)[0], "package.json");
         const pkgJson = readManifest(pkgJsonPath);
         if (!pkgJson)
             continue; // no manifest to check (e.g. some tests)
@@ -602,10 +581,10 @@ export function validateRemoteAddonAuth(logger, state) {
         if (!decl.remote)
             continue;
         if (decl.authCredentialId && !credentialNames.has(decl.authCredentialId)) {
-            logger.critical(ErrorCode.REMOTE_ADDON_AUTH_UNRESOLVED, `Remote addon '${namespace}' binds auth.credentialId '${decl.authCredentialId}', but no such credential is wired. Available credentials: ${Array.from(credentialNames).join(', ') || 'none'}`);
+            logger.critical(ErrorCode.REMOTE_ADDON_AUTH_UNRESOLVED, `Remote addon '${namespace}' binds auth.credentialId '${decl.authCredentialId}', but no such credential is wired. Available credentials: ${Array.from(credentialNames).join(", ") || "none"}`);
         }
         if (decl.authSecretId && !secretNames.has(decl.authSecretId)) {
-            logger.critical(ErrorCode.REMOTE_ADDON_AUTH_UNRESOLVED, `Remote addon '${namespace}' binds auth.secretId '${decl.authSecretId}', but no such secret is wired. Available secrets: ${Array.from(secretNames).join(', ') || 'none'}`);
+            logger.critical(ErrorCode.REMOTE_ADDON_AUTH_UNRESOLVED, `Remote addon '${namespace}' binds auth.secretId '${decl.authSecretId}', but no such secret is wired. Available secrets: ${Array.from(secretNames).join(", ") || "none"}`);
         }
     }
 }
@@ -614,7 +593,7 @@ export function computeResolvedIOTypes(state) {
     for (const [pikkuFuncId, meta] of Object.entries(functions.meta)) {
         const input = meta.inputs?.[0];
         const output = meta.outputs?.[0];
-        let inputType = 'null';
+        let inputType = "null";
         if (input) {
             try {
                 inputType = functions.typesMap.getTypeMeta(input).uniqueName;
@@ -623,7 +602,7 @@ export function computeResolvedIOTypes(state) {
                 inputType = input;
             }
         }
-        let outputType = 'null';
+        let outputType = "null";
         if (output) {
             try {
                 outputType = functions.typesMap.getTypeMeta(output).uniqueName;
@@ -633,10 +612,10 @@ export function computeResolvedIOTypes(state) {
             }
         }
         state.resolvedIOTypes[pikkuFuncId] = { inputType, outputType };
-        if (meta.inputSchemaName && inputType !== 'null') {
+        if (meta.inputSchemaName && inputType !== "null") {
             meta.inputSchemaName = inputType;
         }
-        if (meta.outputSchemaName && outputType !== 'null') {
+        if (meta.outputSchemaName && outputType !== "null") {
             meta.outputSchemaName = outputType;
         }
         if (meta.inputs) {
@@ -698,15 +677,15 @@ export function computePermissionsGroupsMeta(state) {
     };
 }
 const PRIMITIVE_TYPES = new Set([
-    'boolean',
-    'string',
-    'number',
-    'null',
-    'undefined',
-    'void',
-    'any',
-    'unknown',
-    'never',
+    "boolean",
+    "string",
+    "number",
+    "null",
+    "undefined",
+    "void",
+    "any",
+    "unknown",
+    "never",
 ]);
 export function computeRequiredSchemas(state, options) {
     const { functions, schemaLookup } = state;
@@ -767,8 +746,8 @@ export function unresolvedSchemaReferences(state) {
     };
     for (const [funcName, meta] of Object.entries(functions.meta)) {
         for (const [role, declared] of [
-            ['input', meta.inputs?.[0]],
-            ['output', meta.outputs?.[0]],
+            ["input", meta.inputs?.[0]],
+            ["output", meta.outputs?.[0]],
         ]) {
             if (!declared || PRIMITIVE_TYPES.has(declared))
                 continue;
@@ -785,12 +764,12 @@ export function validateSchemaReferences(logger, state) {
     if (unresolved.length === 0)
         return;
     logger.diagnostic({
-        severity: 'error',
+        severity: "error",
         code: ErrorCode.SCHEMA_REFERENCE_UNRESOLVED,
-        message: `${unresolved.length} function contract${unresolved.length === 1 ? '' : 's'} ` +
-            `name${unresolved.length === 1 ? 's' : ''} a schema that was never generated, so ` +
-            `calling ${unresolved.length === 1 ? 'it' : 'them'} fails at runtime with ` +
-            `MissingSchemaError: ${unresolved.join(', ')}. ` +
+        message: `${unresolved.length} function contract${unresolved.length === 1 ? "" : "s"} ` +
+            `name${unresolved.length === 1 ? "s" : ""} a schema that was never generated, so ` +
+            `calling ${unresolved.length === 1 ? "it" : "them"} fails at runtime with ` +
+            `MissingSchemaError: ${unresolved.join(", ")}. ` +
             `The usual cause is a named type used as the function's input/output that ` +
             `is declared but not exported — export it, or inline the type at the call site.`,
     });
@@ -809,11 +788,11 @@ export function validateAgentModels(logger, state, modelAliases = {}) {
         // `hasOwn`, not a truthy lookup: every object literal inherits `toString`,
         // `constructor` and `__proto__`, so a bare model named after one of them
         // would read as a configured alias and pass a check nothing else repeats.
-        if (!model.includes('/') && !Object.hasOwn(modelAliases, model)) {
+        if (!model.includes("/") && !Object.hasOwn(modelAliases, model)) {
             const known = Object.keys(modelAliases).sort();
             logger.critical(ErrorCode.INVALID_MODEL, `AI agent '${meta.name}' uses model '${model}', which is neither provider-qualified as '<provider>/<model>' (e.g. 'openai/gpt-4') nor an alias in the "models" table of pikku.config.json. ` +
                 (known.length
-                    ? `Known aliases: ${known.join(', ')}.`
+                    ? `Known aliases: ${known.join(", ")}.`
                     : `No "models" aliases are configured.`));
         }
     }
@@ -836,9 +815,9 @@ export function validateScenarioServices(logger, state) {
         const funcMeta = state.functions.meta[meta.pikkuFuncId];
         if (!funcMeta?.services)
             continue;
-        const disallowed = funcMeta.services.services.filter((svc) => svc !== 'logger' && svc !== 'config');
+        const disallowed = funcMeta.services.services.filter((svc) => svc !== "logger" && svc !== "config");
         if (disallowed.length > 0) {
-            logger.critical(ErrorCode.SCENARIO_HAS_SERVICES, `Scenario '${workflowName}' destructures services: ${disallowed.join(', ')}. ` +
+            logger.critical(ErrorCode.SCENARIO_HAS_SERVICES, `Scenario '${workflowName}' destructures services: ${disallowed.join(", ")}. ` +
                 `Scenarios may only use 'logger'/'config' — drive everything else through ` +
                 `actor steps (workflow.do(step, rpc, data, { actor: actors.x })) so the flow ` +
                 `runs against the target environment.`);
@@ -858,8 +837,8 @@ export const proseOpensWithActor = (prose, actor) => {
     if (!actor) {
         return false;
     }
-    const escaped = actor.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-    return new RegExp(`^["'“‘\\s]*${escaped}(?:['’]s)?\\b`, 'i').test(prose);
+    const escaped = actor.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    return new RegExp(`^["'“‘\\s]*${escaped}(?:['’]s)?\\b`, "i").test(prose);
 };
 /**
  * The prose that will actually render for one step, in the runtime's own
@@ -875,11 +854,7 @@ const renderableProse = (step, stepMeta) => {
     if (description) {
         return [step.stepName, description];
     }
-    return [
-        step.stepName,
-        stepMeta?.scenarioStepTemplate,
-        stepMeta?.description,
-    ].filter((prose) => typeof prose === 'string');
+    return [step.stepName, stepMeta?.scenarioStepTemplate, stepMeta?.description].filter((prose) => typeof prose === "string");
 };
 /**
  * A step's prose must not open by naming the actor it already runs as (PKU681).
@@ -927,7 +902,7 @@ export function validateScenarioSteps(logger, state) {
     const phasesSeen = new Set();
     const visit = (workflowName, steps) => {
         for (const step of steps) {
-            if (step.type === 'scenarioStep') {
+            if (step.type === "scenarioStep") {
                 phasesSeen.add(step.phase);
                 if (step.stepFunc === DYNAMIC_SCENARIO_STEP_TARGET) {
                     logger.critical(ErrorCode.SCENARIO_STEP_TARGET_NOT_STATIC, `Scenario '${workflowName}' calls step '${step.stepName}' with a target that isn't a string literal. ` +
@@ -939,21 +914,21 @@ export function validateScenarioSteps(logger, state) {
                 const stepMeta = state.functions.meta[step.stepFunc];
                 validateStepProse(logger, workflowName, step, stepMeta);
                 if (stepMeta?.scenarioStepRequiresActor && !step.actor) {
-                    const why = stepMeta.scenarioStepSurfaces?.includes('browser')
-                        ? 'declares a browser binding'
-                        : 'is driven by a persona';
+                    const why = stepMeta.scenarioStepSurfaces?.includes("browser")
+                        ? "declares a browser binding"
+                        : "is driven by a persona";
                     logger.critical(ErrorCode.SCENARIO_STEP_NEEDS_ACTOR, `Scenario '${workflowName}' calls step '${step.stepFunc}', which ${why}, without an actor. ` +
                         `Pass { actor: actors.<name> } so it runs as that persona.`);
                 }
                 continue;
             }
-            if (step.type === 'branch') {
+            if (step.type === "branch") {
                 for (const branch of step.branches)
                     visit(workflowName, branch.steps);
                 if (step.elseSteps)
                     visit(workflowName, step.elseSteps);
             }
-            else if (step.type === 'switch') {
+            else if (step.type === "switch") {
                 for (const c of step.cases ?? []) {
                     if (c.steps)
                         visit(workflowName, c.steps);
@@ -961,10 +936,10 @@ export function validateScenarioSteps(logger, state) {
                 if (step.defaultSteps)
                     visit(workflowName, step.defaultSteps);
             }
-            else if (step.type === 'fanout' && step.body) {
+            else if (step.type === "fanout" && step.body) {
                 visit(workflowName, step.body);
             }
-            else if (step.type === 'parallel' && step.children) {
+            else if (step.type === "parallel" && step.children) {
                 visit(workflowName, step.children);
             }
         }
@@ -979,8 +954,8 @@ export function validateScenarioSteps(logger, state) {
         // `asserts` is the escape for a flow whose witness is an expectation helper
         // instead: those are inline steps and leave no phase behind, but a recorded
         // service call or a refusal is an assertion all the same.
-        if (phasesSeen.size > 0 && !phasesSeen.has('then') && !meta.asserts) {
-            logger.critical(ErrorCode.SCENARIO_HAS_NO_ASSERTION, `Scenario '${workflowName}' has ${[...phasesSeen].join('/')} steps but never asserts. ` +
+        if (phasesSeen.size > 0 && !phasesSeen.has("then") && !meta.asserts) {
+            logger.critical(ErrorCode.SCENARIO_HAS_NO_ASSERTION, `Scenario '${workflowName}' has ${[...phasesSeen].join("/")} steps but never asserts. ` +
                 `Add a scenario.then(...) naming what the actor should now see — a flow with no 'then' ` +
                 `only proves nothing threw, and contributes nothing to witness coverage.`);
         }
@@ -1041,17 +1016,17 @@ export function validateScenarioFeatures(logger, state) {
         .map((feature) => feature.exportedName);
     if (unreadable.length > 0) {
         logger.diagnostic({
-            severity: 'warn',
+            severity: "warn",
             code: ErrorCode.SCENARIO_HAS_NO_FEATURE,
-            message: `${unowned.map((name) => `'${name}'`).join(', ')} appear in no feature's \`scenarios\` array, ` +
-                `but ${unreadable.map((name) => `'${name}'`).join(', ')} build theirs with a spread or a call, so one of them may still be listed there. ` +
+            message: `${unowned.map((name) => `'${name}'`).join(", ")} appear in no feature's \`scenarios\` array, ` +
+                `but ${unreadable.map((name) => `'${name}'`).join(", ")} build theirs with a spread or a call, so one of them may still be listed there. ` +
                 `List those scenarios literally and this becomes a definite answer either way.`,
         });
         return;
     }
     for (const name of unowned) {
         logger.diagnostic({
-            severity: 'error',
+            severity: "error",
             code: ErrorCode.SCENARIO_HAS_NO_FEATURE,
             message: `Scenario '${name}' is listed by no pikkuFeature, so nothing downstream can reach it — ` +
                 `a run stamps no feature onto its results, the console groups it under none, and a guide cannot cite it. ` +
@@ -1066,16 +1041,16 @@ export function validateScenarioFeatures(logger, state) {
  * early with an actionable message pointing at `scaffold: { graph: true }`.
  */
 export function validateWorkflowGraphAddons(logger, state) {
-    const addonGraphWired = Array.from(state.rpc.wireAddonDeclarations.values()).some((decl) => decl.package === '@pikku/addon-graph');
+    const addonGraphWired = Array.from(state.rpc.wireAddonDeclarations.values()).some((decl) => decl.package === "@pikku/addon-graph");
     if (addonGraphWired) {
         return;
     }
     for (const [name, graph] of Object.entries(state.workflows.graphMeta)) {
         for (const node of Object.values(graph.nodes)) {
-            if (!('rpcName' in node) || typeof node.rpcName !== 'string') {
+            if (!("rpcName" in node) || typeof node.rpcName !== "string") {
                 continue;
             }
-            if (!node.rpcName.startsWith('graph:')) {
+            if (!node.rpcName.startsWith("graph:")) {
                 continue;
             }
             if (state.functions.meta[node.rpcName]) {
@@ -1125,7 +1100,7 @@ export function validateSchemaWiringSeparation(logger, state) {
             const schemas = Array.from(state.schemaLookup.entries())
                 .filter(([, ref]) => ref.sourceFile === file)
                 .map(([name]) => name);
-            logger.critical(ErrorCode.SCHEMA_AND_WIRING_COLOCATED, `File '${file}' contains both Zod schemas (${schemas.join(', ')}) and wiring calls (wireHTTPRoutes, addPermission, etc.). ` +
+            logger.critical(ErrorCode.SCHEMA_AND_WIRING_COLOCATED, `File '${file}' contains both Zod schemas (${schemas.join(", ")}) and wiring calls (wireHTTPRoutes, addPermission, etc.). ` +
                 `These must be in separate files because the CLI imports schema files at runtime, which triggers wiring side-effects that crash without server context. ` +
                 `Move the route/wiring definitions to a dedicated wiring file.`);
         }
@@ -1140,7 +1115,7 @@ export function validateSchemaWiringSeparation(logger, state) {
  * not.
  */
 export function validateNoSecretAliasServices(logger, checker, state) {
-    if (!('typesLookup' in state)) {
+    if (!("typesLookup" in state)) {
         return;
     }
     const singletonServicesType = resolveCoreType(state.typesLookup, state.singletonServicesTypeImportMap);
@@ -1156,14 +1131,14 @@ export function validateNoSecretAliasServices(logger, checker, state) {
         if (used.length === 0) {
             return;
         }
-        logger.critical(ErrorCode.SECRET_SERVICE_ALIASED, `${kind} '${id}' receives ${used.map((s) => `'${s}'`).join(', ')}, which ${used.length === 1 ? 'is' : 'are'} a SecretService under another name. ` +
+        logger.critical(ErrorCode.SECRET_SERVICE_ALIASED, `${kind} '${id}' receives ${used.map((s) => `'${s}'`).join(", ")}, which ${used.length === 1 ? "is" : "are"} a SecretService under another name. ` +
             `SecretService is confined to pikkuServices, pikkuWireServices, addon service factories and middleware — give a service the secret value when you construct it and expose only what the function needs.`);
     };
     for (const [id, meta] of Object.entries(state.functions.meta)) {
-        report('Function', id, meta.services?.services ?? []);
+        report("Function", id, meta.services?.services ?? []);
     }
     for (const [id, def] of Object.entries(state.permissions.definitions)) {
-        report('Permission', id, def.services?.services ?? []);
+        report("Permission", id, def.services?.services ?? []);
     }
 }
 /**
@@ -1192,22 +1167,22 @@ export function validateSecretUsage(logger, state) {
     // auth-secrets.gen.ts declares it, but that file is written after the first
     // inspection of a fresh project, so its defineSecret is not seen yet.
     if (state.auth?.definition)
-        declared.add('BETTER_AUTH_SECRET');
+        declared.add("BETTER_AUTH_SECRET");
     for (const [file, usage] of state.secrets.usage) {
         const relativeFile = relative(state.rootDir, file);
         const undeclared = usage.keys.filter((key) => !declared.has(key));
         if (undeclared.length > 0) {
             logger.diagnostic({
-                severity: 'warn',
+                severity: "warn",
                 code: ErrorCode.SECRET_NOT_DECLARED,
-                message: `${relativeFile} reads ${undeclared.map((k) => `'${k}'`).join(', ')}, which no defineSecret declares. Declare it so it is validated at deploy time and shown to whoever has to provision it.`,
+                message: `${relativeFile} reads ${undeclared.map((k) => `'${k}'`).join(", ")}, which no defineSecret declares. Declare it so it is validated at deploy time and shown to whoever has to provision it.`,
             });
         }
         if (usage.dynamic.length > 0) {
             logger.diagnostic({
-                severity: 'warn',
+                severity: "warn",
                 code: ErrorCode.SECRET_KEY_NOT_STATIC,
-                message: `${relativeFile} reads a secret with a non-literal key (${usage.dynamic.join(', ')}). The deployment cannot narrow its secret scope around a key it cannot see.`,
+                message: `${relativeFile} reads a secret with a non-literal key (${usage.dynamic.join(", ")}). The deployment cannot narrow its secret scope around a key it cannot see.`,
             });
         }
     }
@@ -1220,7 +1195,10 @@ export function computeDiagnostics(state) {
         // bridges that reference addon functions (id `http:<method>:<route>`, no
         // source file). The user can't edit any of these, so a destructure lint
         // meant to nudge them about their own code must not fail the build over them.
-        if (!meta.sourceFile || meta.sourceFile.endsWith('.gen.ts')) {
+        if (!meta.sourceFile ||
+            meta.sourceFile.endsWith(".gen.ts") ||
+            meta.functionType === "inline" ||
+            meta.functionType === "helper") {
             continue;
         }
         if (meta.services && !meta.services.optimized) {
@@ -1300,14 +1278,14 @@ export function validateScopeReferences(logger, state) {
             continue;
         for (const scope of meta.scopes) {
             // A trailing wildcard grants a subtree; the node it hangs off must exist.
-            const declaredForm = scope.endsWith(':*') ? scope.slice(0, -2) : scope;
-            if (scope === '*') {
+            const declaredForm = scope.endsWith(":*") ? scope.slice(0, -2) : scope;
+            if (scope === "*") {
                 logger.critical(ErrorCode.INVALID_VALUE, `Function '${funcName}' requires the bare wildcard scope '*'. A function must require a specific scope — '*' is only meaningful as a grant.`);
                 continue;
             }
             if (!declared.has(declaredForm)) {
                 const available = Array.from(declared);
-                logger.critical(ErrorCode.INVALID_VALUE, `Function '${funcName}' requires scope '${scope}' which is not declared. Declare it with defineScope. Available scopes: ${available.join(', ') || 'none'}`);
+                logger.critical(ErrorCode.INVALID_VALUE, `Function '${funcName}' requires scope '${scope}' which is not declared. Declare it with defineScope. Available scopes: ${available.join(", ") || "none"}`);
             }
         }
     }
@@ -1334,12 +1312,12 @@ export function validateAgentToolReferences(logger, state, options = {}) {
         return;
     const { wireAddonDeclarations } = state.rpc;
     for (const [agentKey, agent] of agents) {
-        const where = agent.sourceFile ? ` (${agent.sourceFile})` : '';
+        const where = agent.sourceFile ? ` (${agent.sourceFile})` : "";
         for (const tool of agent.tools ?? []) {
             // A workflow reference is resolved against the workflow map, not here.
-            if (tool.startsWith('workflow:'))
+            if (tool.startsWith("workflow:"))
                 continue;
-            const separator = tool.indexOf(':');
+            const separator = tool.indexOf(":");
             let meta;
             if (separator === -1) {
                 const funcId = state.rpc.internalMeta[tool] ?? tool;
@@ -1356,7 +1334,7 @@ export function validateAgentToolReferences(logger, state, options = {}) {
                 if (!addon) {
                     const known = Array.from(wireAddonDeclarations?.keys() ?? []);
                     logger.critical(ErrorCode.AGENT_TOOL_UNKNOWN_NAMESPACE, `AI agent '${agentKey}'${where} references tool '${tool}', but no addon is wired under the namespace '${namespace}'. ` +
-                        `Wired namespaces: ${known.join(', ') || 'none'}.`);
+                        `Wired namespaces: ${known.join(", ") || "none"}.`);
                     continue;
                 }
                 // An addon that has not been built yet contributed no metadata, which
@@ -1373,7 +1351,7 @@ export function validateAgentToolReferences(logger, state, options = {}) {
             if (options.strictMeta && !meta.description) {
                 logger.critical(ErrorCode.AGENT_TOOL_MISSING_DESCRIPTION, `AI agent '${agentKey}'${where} uses tool '${tool}', which has no description. ` +
                     `An agent tool's description is what the model is told it does; without one it is offered the tool under its own name. ` +
-                    `Add a 'description' to '${tool}'${meta.title ? " (a 'title' does not count — it labels the tool, it does not explain it)" : ''}.`);
+                    `Add a 'description' to '${tool}'${meta.title ? " (a 'title' does not count — it labels the tool, it does not explain it)" : ""}.`);
             }
         }
     }
@@ -1388,12 +1366,12 @@ export function validateAgentToolReferences(logger, state, options = {}) {
 export function validateAgentScorerReferences(logger, state) {
     const known = Object.keys(state.scorers.scorersMeta);
     for (const [agentKey, agent] of Object.entries(state.agents.agentsMeta)) {
-        const where = agent.sourceFile ? ` (${agent.sourceFile})` : '';
+        const where = agent.sourceFile ? ` (${agent.sourceFile})` : "";
         for (const scorer of agent.scorers ?? []) {
             if (known.includes(scorer))
                 continue;
             logger.critical(ErrorCode.AGENT_SCORER_NOT_FOUND, `AI agent '${agentKey}'${where} asks to be graded by scorer '${scorer}', which is not declared in this project. ` +
-                `Declared scorers: ${known.join(', ') || 'none'}.`);
+                `Declared scorers: ${known.join(", ") || "none"}.`);
         }
     }
 }
@@ -1416,14 +1394,14 @@ export function validateSystemRoleScopes(logger, state) {
     const declared = new Set(flattenScopeDefinitions(state.scopes.definitions).map((s) => s.id));
     for (const role of state.systemRoles.definitions) {
         for (const scope of role.scopes) {
-            if (scope === '*') {
+            if (scope === "*") {
                 logger.critical(ErrorCode.INVALID_VALUE, `System role '${role.name}' grants the bare wildcard scope '*'. Grant the roots it should cover instead — '*' hides what the role actually confers.`);
                 continue;
             }
-            const declaredForm = scope.endsWith(':*') ? scope.slice(0, -2) : scope;
+            const declaredForm = scope.endsWith(":*") ? scope.slice(0, -2) : scope;
             if (!declared.has(declaredForm)) {
                 const available = Array.from(declared);
-                logger.critical(ErrorCode.INVALID_VALUE, `System role '${role.name}' grants scope '${scope}' which is not declared. Declare it with defineScope. Available scopes: ${available.join(', ') || 'none'}`);
+                logger.critical(ErrorCode.INVALID_VALUE, `System role '${role.name}' grants scope '${scope}' which is not declared. Declare it with defineScope. Available scopes: ${available.join(", ") || "none"}`);
             }
         }
     }
@@ -1450,7 +1428,7 @@ export function validatePersonaRoles(logger, state) {
                 const available = Array.from(declared).sort();
                 logger.critical(ErrorCode.INVALID_VALUE, `Persona '${persona.id}' holds role '${role}', which is not declared with defineSystemRole. ` +
                     `A persona may only name a system role — a role composed in the console can be deleted, and the persona would go on claiming to test it. ` +
-                    `Declared roles: ${available.join(', ') || 'none'}`);
+                    `Declared roles: ${available.join(", ") || "none"}`);
             }
         }
     }