@pikku/inspector 0.12.95 → 0.12.98

package/CHANGELOG.md

@@ -1,3 +1,69 @@
+## 0.12.98
+
+### Patch Changes
+
+- 8ac25a8: An OAuth2 credential can set `scopeSeparator` for a provider that wants scopes joined by something other than a space (Twist wants a comma). A credential with no scopes already sent no `scope` parameter; that is now tested.
+- 6606777: A webhook source can declare how its requests are signed, and the runner checks every request before `receive` runs:
+
+  ```ts
+  wireTriggerWebhookSource({
+    name: 'github',
+    verify: {
+      hmac: {
+        header: 'x-hub-signature-256',
+        prefix: 'sha256=',
+        algorithm: 'sha256',
+        encoding: 'hex',
+      },
+    },
+    receive: githubWebhookReceive,
+  })
+  ```
+
+  `verify` is an HMAC over the raw body, a shared token or a public-key signature in one header, or a function `(request, secret, services) => boolean` for anything else. A request is refused while the secret is unset or when the signature does not match. A request without a body reaches `receive` unchecked so handshakes still work, but it may only be answered: events from it are refused.
+
+  Declaring `verify` declares the secret's credential too, so it needs no `defineCredential`. It is a singleton string named `<source>WebhookSecret` in camelCase (`microsoft-outlook` → `microsoftOutlookWebhookSecret`, see `webhookSecretCredentialName`), or whatever `credential` names, described by `credentialDescription`.
+
+  `@pikku/core/hmac` gains `hmacDigest`, `verifyHmacSignature` and `verifyPublicKeySignature`. `WebhookSigningSecret` is deprecated.
+
+- Updated dependencies [d327fa5]
+- Updated dependencies [942ebdd]
+- Updated dependencies [8ac25a8]
+- Updated dependencies [6606777]
+  - @pikku/core@0.12.132
+
+## 0.12.97
+
+### Patch Changes
+
+- 26dbfc0: A `func` written inline in a `wireCLI` command now registers its function metadata under `cli:<program>:<command path>`, with `sessionless` taken from the helper it was built with. Before, the command pointed at an id nothing had registered. An inline channel `onMessage` still fails the build with the named "No function metadata found" error, and a test now pins that.
+- 2dcc651: The inspector finds a project's source on Windows: its root directory is compared with TypeScript's forward-slash file names, not the backslash path `path.resolve` returns.
+- Updated dependencies [58cccc1]
+- Updated dependencies [a26c60e]
+  - @pikku/core@0.12.131
+
+## 0.12.96
+
+### Patch Changes
+
+- dfcd351: The deploy planner now binds a unit to the units of the functions its functions call with `rpc.invoke('name')` / `rpc.remote('name')`. Before, a caller and callee split into different units (e.g. a no-service function in `svc-base` calling a DB function in `svc-kysely`) got no service binding and failed on the deployed stage with "No service binding for function". The inspector records literal RPC names per function as `invokes` (single, double or substitution-free template quotes; `rpc!`, `wire.rpc`) and warns on a computed name, which the planner cannot see (#1883).
+- cf40182: Deployed units that call `rpc.startWorkflow('x')` now get x's meta, so the call no longer fails with `WorkflowNotFoundError`. The inspector records `startsWorkflows` for literal `rpc.startWorkflow(...)` calls. It warns when a handler computes the workflow name or passes `rpc` to a helper, because the planner cannot see those calls.
+
+  With workflow queues, the deploy planner gives a starter unit the workflow meta and orchestrator queue meta only (new `--workflowMeta` filter), plus `workflow-state` and `queue` services. Without queues the start runs inline, so the whole workflow is bundled. Core's `startWorkflow` now requires the workflow registration only for inline runs; queued runs need only the meta.
+
+- f817f1c: Schema generation no longer re-walks every source file for each type. ts-json-schema-generator looks each root type up by name by scanning the whole program, so a project with 677 types scanned it 677 times. The inspector now builds that name index once per program. On the e2e project, TS schema generation drops from 8.7s to 0.1s and a cold `pikku all` from 38s to 8s, with identical output.
+- 5bce779: Webhook trigger sources are off until someone turns them on, and addons declare their own.
+
+  An addon calls `wireTriggerWebhookSource` in its own package, and an app that wires the addon gets the source (its route included) without declaring it: named and routed after the addon's namespace, so two instances get one each. A source the app declares under the same name wins.
+
+  Every source now has an `enabled` switch in the `triggerSourceStore`, off by default. `reconcileTriggerSources` registers only enabled sources and records each one's `baseUrl` and `labelPrefix`; a disabled source's route answers 404 without running `receive`. New in core: `enableTriggerSource` registers a source with its provider and `disableTriggerSource` stops it receiving, then tears it down, both at the recorded address unless one is given. The admin addon exposes them as `triggerSourceEnable` and `triggerSourceDisable`. The `pikkuTriggerSource` table gains `enabled`, `baseUrl` and `labelPrefix`: run `pikku db generate` for the migration.
+
+- Updated dependencies [dfcd351]
+- Updated dependencies [cf40182]
+- Updated dependencies [5bce779]
+- Updated dependencies [5bce779]
+  - @pikku/core@0.12.130
+
 ## 0.12.95
 
 ### Patch Changes

package/dist/add/add-cli.js

@@ -3,6 +3,7 @@ import { extractFunctionName, makeContextBasedId, } from '../utils/extract-funct
 import { resolveCoreType } from '../utils/resolve-core-type.js';
 import { resolveMiddleware } from '../utils/middleware.js';
 import { resolveFunctionMeta } from '../utils/resolve-function-meta.js';
+import { ensureInlineWiringFunction } from '../utils/ensure-function-metadata.js';
 import { extractWireNames } from '../utils/post-process.js';
 import { getPropertyValue } from '../utils/get-property-value.js';
 import { resolveIdentifier } from '../utils/resolve-identifier.js';
@@ -253,9 +254,11 @@ function processCommand(logger, inspectorState, options, name, node, sourceFile,
                 }
             }
             else {
-                pikkuFuncId = extractFunctionName(prop.initializer, typeChecker, inspectorState.rootDir).pikkuFuncId;
+                const extracted = extractFunctionName(prop.initializer, typeChecker, inspectorState.rootDir);
+                pikkuFuncId = extracted.pikkuFuncId;
                 if (pikkuFuncId.startsWith('__temp_')) {
                     pikkuFuncId = makeContextBasedId('cli', programName, ...fullPath);
+                    ensureInlineWiringFunction(inspectorState, pikkuFuncId, fullPath.join(' '), prop.initializer, typeChecker, extracted.isHelper);
                 }
                 meta.pikkuFuncId = pikkuFuncId;
                 const cliPackageName = ts.isIdentifier(prop.initializer)

package/dist/add/add-credential.js

@@ -81,6 +81,7 @@ export const addCredential = (logger, node, checker, state, _options) => {
             const authorizationUrl = getPropertyValue(oauth2Obj, 'authorizationUrl');
             const tokenUrl = getPropertyValue(oauth2Obj, 'tokenUrl');
             const scopes = getArrayPropertyValue(oauth2Obj, 'scopes');
+            const scopeSeparator = getPropertyValue(oauth2Obj, 'scopeSeparator');
             const pkce = getPropertyValue(oauth2Obj, 'pkce');
             const additionalParams = getRecordPropertyValue(oauth2Obj, 'additionalParams');
             if (appCredentialSecretId && authorizationUrl && tokenUrl && scopes) {
@@ -90,6 +91,7 @@ export const addCredential = (logger, node, checker, state, _options) => {
                     authorizationUrl,
                     tokenUrl,
                     scopes,
+                    scopeSeparator: scopeSeparator || undefined,
                     pkce: pkce || undefined,
                     additionalParams: additionalParams || undefined,
                 };

package/dist/add/add-functions.js

@@ -3,6 +3,8 @@ import { detectSchemaVendorOrError } from '../utils/detect-schema-vendor.js';
 import { extractFunctionName, funcIdToTypeName, } from '../utils/extract-function-name.js';
 import { extractFunctionNode } from '../utils/extract-function-node.js';
 import { extractUsedWires } from '../utils/extract-services.js';
+import { collectInvokedRpcNames } from './add-rpc-invocations.js';
+import { collectStartedWorkflows } from './collect-started-workflows.js';
 import { formatVersionedId, parseVersionedId } from '@pikku/core/utils';
 /** Binding keys a `pikkuScenarioStep` may declare, in report order. */
 const SCENARIO_SURFACE_KEYS = [
@@ -720,6 +722,10 @@ export const addFunctions = (logger, node, checker, state, options) => {
         }
     }
     const wires = extractUsedWires(handler, 2);
+    const invoked = collectInvokedRpcNames(handler.body);
+    for (const call of invoked.dynamic) {
+        logger.warn(`• ${pikkuFuncId} calls ${call} with a computed name — the deploy planner cannot bind its unit to the callee's, so the call fails with "No service binding" if the two are deployed apart. Use a literal RPC name.`);
+    }
     // --- Generics → ts.Type[], unwrapped from Promise ---
     const genericTypes = (typeArguments ?? [])
         .map((tn) => checker.getTypeFromTypeNode(tn))
@@ -986,6 +992,17 @@ export const addFunctions = (logger, node, checker, state, options) => {
             bodyStart: lineOf(handlerBody.getStart(handlerSourceFile)),
             bodyEnd: lineOf(handlerBody.getEnd()),
         };
+    const started = collectStartedWorkflows(handler.body);
+    // Generated scaffolds (the workflow start/run routes) take the name from the
+    // request by design, and are served by units that have every workflow.
+    const handlerFile = handler.getSourceFile().fileName;
+    const warnOnStarts = !/\.gen\.[cm]?[jt]s$/.test(handlerFile);
+    for (const call of warnOnStarts ? started.dynamic : []) {
+        logger.warn(`• ${pikkuFuncId} calls ${call} with a computed name — the deploy planner cannot bundle that workflow's meta into ${pikkuFuncId}'s unit, so the deployed call fails with "Workflow not found" unless the unit has it for another reason. Use a literal workflow name.`);
+    }
+    if (warnOnStarts && started.rpcHandoffs.length > 0) {
+        logger.warn(`• ${pikkuFuncId} passes rpc to ${started.rpcHandoffs.join(', ')} — rpc.startWorkflow / rpc.invoke calls made there are invisible to the deploy planner, so their targets are not bundled into or bound to ${pikkuFuncId}'s unit. Make those calls in the handler itself.`);
+    }
     state.functions.meta[pikkuFuncId] = {
         pikkuFuncId,
         functionType: 'user',
@@ -994,6 +1011,7 @@ export const addFunctions = (logger, node, checker, state, options) => {
         name,
         services,
         wires: wires.wires.length > 0 || !wires.optimized ? wires : undefined,
+        invokes: invoked.names.length > 0 ? invoked.names : undefined,
         inputSchemaName: inputNames[0] ?? null,
         outputSchemaName: outputNames[0] ?? null,
         inputs: inputNames.filter((n) => n !== 'void') ?? null,
@@ -1037,6 +1055,7 @@ export const addFunctions = (logger, node, checker, state, options) => {
         bodySourceFile,
         exportedName: exportedName || undefined,
         ...bodySpan,
+        startsWorkflows: started.names.length > 0 ? started.names : undefined,
     };
     if (handlerHasDynamicImport(handler)) {
         state.functions.dynamicImportIds.add(pikkuFuncId);

package/dist/add/add-rpc-invocations.d.ts

@@ -1,5 +1,22 @@
 import * as ts from 'typescript';
 import type { InspectorState, InspectorLogger } from '../types.js';
+/**
+ * The RPC names a function handler calls through `rpc.invoke(...)` /
+ * `rpc.remote(...)`, read from its own body.
+ *
+ * This is what the deploy planner uses to bind a unit to the units its
+ * functions call: without it, a caller and callee split into different units
+ * type-check, work in a single process, and fail on the deployed stage with
+ * "No service binding for function". `dynamic` holds the source text of calls
+ * whose name is not a literal — those cannot be planned for.
+ *
+ * Only the handler's own body is read. A call made from a helper defined
+ * elsewhere, with `rpc` passed in, is not seen.
+ */
+export declare function collectInvokedRpcNames(handler: ts.Node): {
+    names: string[];
+    dynamic: string[];
+};
 /**
  * Scan for rpc.invoke() calls to track which functions are actually being invoked
  * Also detects addon usage via:

package/dist/add/add-rpc-invocations.js

@@ -32,6 +32,63 @@ function invocationReceiver(node) {
     }
     return inner;
 }
+/** `rpc`, or anything ending in `.rpc` (`wire.rpc`), seen through `!` and parens. */
+function isRpcReceiver(node) {
+    const receiver = invocationReceiver(node);
+    return ts.isIdentifier(receiver)
+        ? receiver.text === 'rpc'
+        : ts.isPropertyAccessExpression(receiver) && receiver.name.text === 'rpc';
+}
+/**
+ * Methods on `rpc` that call another function by name and, when that function
+ * is not bundled in the caller's deploy unit, cross to another unit through the
+ * `DeploymentService`.
+ */
+const CROSS_UNIT_RPC_METHODS = new Set(['invoke', 'remote']);
+/** The name argument when it is statically known: `'x'`, `"x"` or `` `x` ``. */
+function literalRpcName(arg) {
+    if (ts.isStringLiteral(arg) || ts.isNoSubstitutionTemplateLiteral(arg)) {
+        return arg.text;
+    }
+    return undefined;
+}
+/**
+ * The RPC names a function handler calls through `rpc.invoke(...)` /
+ * `rpc.remote(...)`, read from its own body.
+ *
+ * This is what the deploy planner uses to bind a unit to the units its
+ * functions call: without it, a caller and callee split into different units
+ * type-check, work in a single process, and fail on the deployed stage with
+ * "No service binding for function". `dynamic` holds the source text of calls
+ * whose name is not a literal — those cannot be planned for.
+ *
+ * Only the handler's own body is read. A call made from a helper defined
+ * elsewhere, with `rpc` passed in, is not seen.
+ */
+export function collectInvokedRpcNames(handler) {
+    const names = new Set();
+    const dynamic = [];
+    const visit = (node) => {
+        if (ts.isCallExpression(node) &&
+            ts.isPropertyAccessExpression(node.expression) &&
+            CROSS_UNIT_RPC_METHODS.has(node.expression.name.text) &&
+            isRpcReceiver(node.expression.expression)) {
+            const [firstArg] = node.arguments;
+            if (firstArg) {
+                const name = literalRpcName(firstArg);
+                if (name !== undefined) {
+                    names.add(name);
+                }
+                else {
+                    dynamic.push(node.getText());
+                }
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(handler);
+    return { names: [...names].sort(), dynamic };
+}
 /**
  * Helper to extract namespace from a namespaced function reference like 'ext:hello'
  */
@@ -152,8 +209,9 @@ export function addRPCInvocations(node, state, logger) {
             }
             const [firstArg] = args;
             if (firstArg) {
-                if (ts.isStringLiteral(firstArg)) {
-                    const functionRef = firstArg.text;
+                const literalName = literalRpcName(firstArg);
+                if (literalName !== undefined) {
+                    const functionRef = literalName;
                     logger.debug(`• Found RPC invocation: ${functionRef}`);
                     state.rpc.invokedFunctions.add(functionRef);
                     let byFile = state.rpc.invokedFunctionsByFile.get(sourceFileName);
@@ -170,10 +228,9 @@ export function addRPCInvocations(node, state, logger) {
                     }
                 }
                 // Handle template literals like `function-${name}`
-                else if (ts.isTemplateExpression(firstArg) ||
-                    ts.isNoSubstitutionTemplateLiteral(firstArg)) {
+                else if (ts.isTemplateExpression(firstArg)) {
                     logger.warn(`• Found dynamic RPC invocation: ${firstArg.getText()}`);
-                    logger.warn(`\tYou can only use string literals for RPC function names, with ' or " and not \``);
+                    logger.warn(`\tYou can only use literal RPC function names, without \${...} substitutions`);
                 }
             }
         }

package/dist/add/add-trigger.js

@@ -8,6 +8,7 @@ import { extractWireNames } from '../utils/post-process.js';
 import { resolveAddonName } from '../utils/resolve-addon-package.js';
 import { resolveFunctionMeta } from '../utils/resolve-function-meta.js';
 import { ErrorCode } from '../error-codes.js';
+import { webhookSecretCredentialName } from '@pikku/core/trigger';
 const WEBHOOK_SOURCE_STEPS = ['receive', 'check', 'setup', 'teardown'];
 export const addTrigger = (logger, node, checker, state, options) => {
     if (!ts.isCallExpression(node)) {
@@ -161,6 +162,21 @@ const addWireTriggerWebhookSource = (logger, node, checker, state, firstArg) =>
     };
     state.triggers.webhookSourceMeta[name] = meta;
     state.triggers.files.add(node.getSourceFile().fileName);
+    if (!getPropertyAssignmentInitializer(obj, 'verify', false, checker))
+        return;
+    const sourceFile = node.getSourceFile().fileName;
+    const credential = getPropertyValue(obj, 'credential') ??
+        webhookSecretCredentialName(name);
+    state.credentials.files.add(sourceFile);
+    state.credentials.definitions.push({
+        name: credential,
+        displayName: `${name} webhook secret`,
+        description: getPropertyValue(obj, 'credentialDescription') ??
+            undefined,
+        type: 'singleton',
+        schema: { type: 'string' },
+        sourceFile,
+    });
 };
 /**
  * A trigger named `<source>:<event>` must name an event its webhook source

package/dist/add/collect-started-workflows.d.ts

@@ -0,0 +1,26 @@
+import * as ts from 'typescript';
+export type StartedWorkflows = {
+    /** Workflow names passed as a literal to `rpc.startWorkflow(...)`. */
+    names: string[];
+    /** Source text of `rpc.startWorkflow(...)` calls whose name is computed. */
+    dynamic: string[];
+    /**
+     * Plain functions the handler passes `rpc` to — calls made inside them are
+     * not seen. Methods (`workflowService.runToCompletion(..., rpc)`) are left
+     * out: they are services, not the app's own helpers.
+     */
+    rpcHandoffs: string[];
+};
+/**
+ * The workflows a function handler starts through `rpc.startWorkflow(...)`,
+ * read from its own body.
+ *
+ * `startWorkflow` looks the workflow up by name in the process that calls it,
+ * so a deployed unit that starts a workflow needs that workflow's meta bundled
+ * in. The deploy planner does that from these names.
+ *
+ * Only the handler's own body is read. When the handler passes `rpc` on to a
+ * helper, whatever the helper starts is invisible here; those callees are
+ * returned in `rpcHandoffs` so the caller can say so.
+ */
+export declare function collectStartedWorkflows(handler: ts.Node): StartedWorkflows;

package/dist/add/collect-started-workflows.js

@@ -0,0 +1,72 @@
+import * as ts from 'typescript';
+/** `x` seen through `x!` and `(x)`. */
+function unwrap(node) {
+    let inner = node;
+    while (ts.isNonNullExpression(inner) || ts.isParenthesizedExpression(inner)) {
+        inner = inner.expression;
+    }
+    return inner;
+}
+/** `rpc`, or anything ending in `.rpc` (`wire.rpc`), seen through `!` and parens. */
+function isRpcExpression(node) {
+    const inner = unwrap(node);
+    return ts.isIdentifier(inner)
+        ? inner.text === 'rpc'
+        : ts.isPropertyAccessExpression(inner) && inner.name.text === 'rpc';
+}
+/** An argument that hands `rpc` over: `rpc`, `wire.rpc`, `{ rpc }`, `{ rpc: wire.rpc }`. */
+function passesRpc(arg) {
+    if (isRpcExpression(arg))
+        return true;
+    const inner = unwrap(arg);
+    if (!ts.isObjectLiteralExpression(inner))
+        return false;
+    return inner.properties.some((p) => (ts.isShorthandPropertyAssignment(p) && p.name.text === 'rpc') ||
+        (ts.isPropertyAssignment(p) && isRpcExpression(p.initializer)));
+}
+/**
+ * The workflows a function handler starts through `rpc.startWorkflow(...)`,
+ * read from its own body.
+ *
+ * `startWorkflow` looks the workflow up by name in the process that calls it,
+ * so a deployed unit that starts a workflow needs that workflow's meta bundled
+ * in. The deploy planner does that from these names.
+ *
+ * Only the handler's own body is read. When the handler passes `rpc` on to a
+ * helper, whatever the helper starts is invisible here; those callees are
+ * returned in `rpcHandoffs` so the caller can say so.
+ */
+export function collectStartedWorkflows(handler) {
+    const names = new Set();
+    const dynamic = [];
+    const rpcHandoffs = new Set();
+    const visit = (node) => {
+        if (ts.isCallExpression(node)) {
+            const callee = node.expression;
+            const isRpcMethod = ts.isPropertyAccessExpression(callee) &&
+                isRpcExpression(callee.expression);
+            if (isRpcMethod && callee.name.text === 'startWorkflow') {
+                const [firstArg] = node.arguments;
+                if (firstArg) {
+                    if (ts.isStringLiteral(firstArg) ||
+                        ts.isNoSubstitutionTemplateLiteral(firstArg)) {
+                        names.add(firstArg.text);
+                    }
+                    else {
+                        dynamic.push(node.getText());
+                    }
+                }
+            }
+            else if (ts.isIdentifier(callee) && node.arguments.some(passesRpc)) {
+                rpcHandoffs.add(callee.text);
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(handler);
+    return {
+        names: [...names].sort(),
+        dynamic,
+        rpcHandoffs: [...rpcHandoffs].sort(),
+    };
+}

package/dist/inspector.js

@@ -7,6 +7,7 @@ import { getFilesAndMethods } from './utils/get-files-and-methods.js';
 import { findCommonAncestor } from './utils/find-root-dir.js';
 import { createSourceFileCacheHost } from './source-file-cache.js';
 import { createNestedProjectFilter } from './utils/nested-project-filter.js';
+import { toProgramPath } from './utils/program-path.js';
 import { aggregateRequiredServices, stampAuthHandlerServices, validateAgentModels, validateAgentToolReferences, validateAgentScorerReferences, validateSecretOverrides, validateVariableOverrides, validateCredentialOverrides, validateRemoteAddonDependencies, validateRemoteAddonAuth, validateScopeReferences, validateSystemRoleScopes, validatePersonaRoles, computeResolvedIOTypes, computeMiddlewareGroupsMeta, computePermissionsGroupsMeta, computeRequiredSchemas, validateNoSecretAliasServices, registerDerivedOAuth2AppSecrets, validateSecretUsage, computeDiagnostics, validateSchemaReferences, validateSchemaWiringSeparation, validateScenarioServices, validateScenarioSteps, validateScenarioFeatures, validateWorkflowGraphAddons, } from './utils/post-process.js';
 import { validateExposedFunctionsGated } from './utils/validate-exposed-functions-gated.js';
 import { validateTagsResolveToMiddleware } from './utils/validate-tags-resolve-to-middleware.js';
@@ -293,7 +294,7 @@ export const inspect = async (logger, routeFiles, options = {}) => {
     const checker = program.getTypeChecker();
     logger.debug(`Got type checker in ${(performance.now() - startChecker).toFixed(2)}ms`);
     // Use provided rootDir or infer from source files
-    const rootDir = options.rootDir || findCommonAncestor(normalizedRouteFiles);
+    const rootDir = toProgramPath(options.rootDir || findCommonAncestor(normalizedRouteFiles));
     const startSourceFiles = performance.now();
     // node_modules under rootDir (e.g. a locally-installed addon) is a
     // dependency, not project source — scanning it double-counts the addon's

package/dist/types.d.ts

@@ -227,6 +227,7 @@ export type InspectorFilters = {
     excludeTarget?: Array<'serverless' | 'server'>;
     serverlessIncompatible?: string[];
     defaultTarget?: 'serverless' | 'server';
+    workflowMeta?: string[];
 };
 export type AddonConfig = {
     package: string;

package/dist/utils/filter-inspector-state.js

@@ -831,6 +831,54 @@ export function filterInspectorState(state, filters, logger) {
             }
         }
     }
+    // Workflows asked for by meta only — a unit that `rpc.startWorkflow`s one the
+    // orchestrator unit runs. The run is created from the meta and handed to the
+    // orchestrator queue, so the meta (and the workflow function's meta, which
+    // the generated workflow map types the start from) is restored, while the
+    // registration files stay out: bundling them would pull the workflow
+    // function and everything it imports into the unit.
+    const fullWorkflowNames = new Set(filters.names ?? []);
+    for (const name of filters.workflowMeta ?? []) {
+        const graphMeta = state.workflows?.graphMeta?.[name];
+        const workflowMeta = state.workflows?.meta?.[name];
+        if (!graphMeta && !workflowMeta)
+            continue;
+        const pikkuFuncId = graphMeta?.pikkuFuncId ?? workflowMeta?.pikkuFuncId;
+        if (graphMeta && !filteredState.workflows.graphMeta[name]) {
+            filteredState.workflows.graphMeta[name] = JSON.parse(JSON.stringify(graphMeta));
+        }
+        if (workflowMeta && !filteredState.workflows.meta[name]) {
+            filteredState.workflows.meta[name] = JSON.parse(JSON.stringify(workflowMeta));
+        }
+        const funcMeta = pikkuFuncId ? state.functions.meta[pikkuFuncId] : undefined;
+        if (pikkuFuncId && funcMeta && !filteredState.functions.meta[pikkuFuncId]) {
+            filteredState.functions.meta[pikkuFuncId] = funcMeta;
+        }
+        // The orchestrator queue's meta routes the start to the workflow's own
+        // queue instead of the shared fallback; its consumer is core's synthetic
+        // orchestrator, so no registration comes with it.
+        const orchestratorQueue = `wf-orchestrator-${name
+            .replace(/([a-z0-9])([A-Z])/g, '$1-$2')
+            .replace(/([A-Z])([A-Z][a-z])/g, '$1-$2')
+            .toLowerCase()}`;
+        const orchestratorMeta = state.queueWorkers?.meta?.[orchestratorQueue];
+        if (orchestratorMeta &&
+            !filteredState.queueWorkers.meta[orchestratorQueue]) {
+            filteredState.queueWorkers.meta[orchestratorQueue] = JSON.parse(JSON.stringify(orchestratorMeta));
+        }
+        const keepsRegistration = fullWorkflowNames.has(name) ||
+            (pikkuFuncId !== undefined &&
+                filteredState.serviceAggregation.usedFunctions.has(pikkuFuncId));
+        if (!keepsRegistration) {
+            for (const key of [name, pikkuFuncId]) {
+                if (!key)
+                    continue;
+                filteredState.workflows.files.delete(key);
+                filteredState.workflows.graphFiles.delete(key);
+            }
+        }
+        filteredState.serviceAggregation.requiredServices.add('workflowService');
+    }
     // Recompute requiredSchemas based on pruned functions.meta
     if (filteredState.serviceAggregation.usedFunctions.size > 0) {
         const prunedSchemas = new Set();

package/dist/utils/load-addon-functions-meta.d.ts

@@ -1,5 +1,13 @@
 import type { InspectorState, InspectorLogger } from '../types.js';
+import type { WebhookSourcesMeta } from '@pikku/core/trigger';
 export declare const describeMissingAddonMeta: (namespace: string, packageName: string, dirs: string[], declFile?: string) => string;
+/**
+ * The webhook sources an addon declares, as the app mounts them. The source is
+ * named after the addon's namespace, so two instances of one addon get a
+ * route each; an addon declaring several suffixes each with its own name.
+ * Every source starts off: the app turns one on at runtime.
+ */
+export declare const namespaceAddonWebhookSources: (sources: WebhookSourcesMeta, namespace: string) => WebhookSourcesMeta;
 /**
  * After the setup sweep discovers wireAddon() declarations, load each addon
  * package's function metadata so that wiring handlers (channels, HTTP routes,

package/dist/utils/load-addon-functions-meta.js

@@ -151,6 +151,31 @@ const registerAddonTypes = (state, metaPath, meta) => {
         }
     }
 };
+/**
+ * The webhook sources an addon declares, as the app mounts them. The source is
+ * named after the addon's namespace, so two instances of one addon get a
+ * route each; an addon declaring several suffixes each with its own name.
+ * Every source starts off: the app turns one on at runtime.
+ */
+export const namespaceAddonWebhookSources = (sources, namespace) => {
+    const declared = Object.values(sources);
+    const namespaced = {};
+    for (const source of declared) {
+        const name = declared.length === 1 ? namespace : `${namespace}-${source.name}`;
+        const meta = {
+            ...source,
+            name,
+            route: `/webhooks/${name}`,
+        };
+        for (const step of ['receive', 'check', 'setup', 'teardown']) {
+            const funcId = source[step];
+            if (funcId && !funcId.includes(':'))
+                meta[step] = `${namespace}:${funcId}`;
+        }
+        namespaced[name] = meta;
+    }
+    return namespaced;
+};
 /**
  * After the setup sweep discovers wireAddon() declarations, load each addon
  * package's function metadata so that wiring handlers (channels, HTTP routes,
@@ -366,6 +391,28 @@ export async function loadAddonFunctionsMeta(logger, state) {
                 }
                 catch { }
             }
+            try {
+                const webhookSourcesPath = require.resolve(`${decl.package}/.pikku/webhooks/pikku-webhook-sources-meta.gen.json`);
+                const sources = namespaceAddonWebhookSources(JSON.parse(await readFile(webhookSourcesPath, 'utf-8')), namespace);
+                for (const [name, source] of Object.entries(sources)) {
+                    if (state.triggers.webhookSourceMeta[name])
+                        continue;
+                    state.triggers.webhookSourceMeta[name] = source;
+                    for (const step of [
+                        'receive',
+                        'check',
+                        'setup',
+                        'teardown',
+                    ]) {
+                        const funcId = source[step];
+                        if (funcId)
+                            state.serviceAggregation.usedFunctions.add(funcId);
+                    }
+                }
+            }
+            catch {
+                // No addon webhook sources
+            }
             try {
                 const httpContractsPath = require.resolve(`${decl.package}/.pikku/http/pikku-http-contracts-meta.gen.json`);
                 const httpContractsRaw = await readFile(httpContractsPath, 'utf-8');

package/dist/utils/program-path.d.ts

@@ -0,0 +1,7 @@
+/**
+ * A native path in the form a TypeScript program names its files: forward
+ * slashes on every platform. `sourceFile.fileName` is `D:/a/app/src/x.ts` on
+ * Windows while `path.resolve` gives `D:\a\app`, so comparing the two by
+ * prefix rejects every file unless one side is converted.
+ */
+export declare const toProgramPath: (nativePath: string, separator?: "/" | "\\") => string;

package/dist/utils/program-path.js

@@ -0,0 +1,8 @@
+import { sep } from 'path';
+/**
+ * A native path in the form a TypeScript program names its files: forward
+ * slashes on every platform. `sourceFile.fileName` is `D:/a/app/src/x.ts` on
+ * Windows while `path.resolve` gives `D:\a\app`, so comparing the two by
+ * prefix rejects every file unless one side is converted.
+ */
+export const toProgramPath = (nativePath, separator = sep) => nativePath.split(separator).join('/');

package/dist/utils/schema-generator.js

@@ -2,7 +2,7 @@ import * as ts from 'typescript';
 import { createHash } from 'crypto';
 import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync, } from 'fs';
 import { dirname, join, resolve } from 'path';
-import { createGenerator, RootlessError } from 'ts-json-schema-generator';
+import { createFormatter, createParser, DEFAULT_CONFIG, RootlessError, SchemaGenerator, } from 'ts-json-schema-generator';
 import { register } from 'tsx/esm/api';
 import * as z from 'zod';
 import { findZodTransform } from './find-zod-transform.js';
@@ -184,6 +184,34 @@ export function writeDiskTSSchemas(logger, cacheDir, key, schemas, deps) {
         logger.debug(`Failed to persist TS-schema cache: ${e.message}`);
     }
 }
+// The base class walks every source file again for each type it looks up by
+// name, which was nearly all of schema generation (8.7s for 677 types on e2e).
+class IndexedSchemaGenerator extends SchemaGenerator {
+    projectTypes;
+    allTypes;
+    findNamedNode(fullName) {
+        const typeChecker = this.program.getTypeChecker();
+        if (!this.projectTypes) {
+            this.projectTypes = new Map();
+            this.appendTypes(this.partitionFiles().projectFiles, typeChecker, this.projectTypes);
+        }
+        const projectType = this.projectTypes.get(fullName);
+        if (projectType)
+            return projectType;
+        if (!this.allTypes) {
+            this.allTypes = new Map(this.projectTypes);
+            this.appendTypes(this.partitionFiles().externalFiles, typeChecker, this.allTypes);
+        }
+        const type = this.allTypes.get(fullName);
+        if (type)
+            return type;
+        throw new RootlessError(fullName);
+    }
+}
+const createIndexedGenerator = (program, config) => {
+    const completedConfig = { ...DEFAULT_CONFIG, ...config };
+    return new IndexedSchemaGenerator(program, createParser(program, completedConfig), createFormatter(completedConfig), completedConfig);
+};
 function createProgramWithVirtualFile(logger, tsconfig, virtualFilePath, virtualFileContent) {
     const configPath = resolve(tsconfig);
     // Cache the parsed tsconfig — it doesn't change between runs
@@ -271,8 +299,7 @@ function generateTSSchemas(logger, tsconfig, customTypesContent, typesMap, funct
     logger.debug(`generateTSSchemas needed for ${uncoveredSchemas.length} types: ${uncoveredSchemas.slice(0, 3).join(', ')}${uncoveredSchemas.length > 3 ? '...' : ''}`);
     const virtualFilePath = join(dirname(resolve(tsconfig)), '__pikku_virtual_types__.ts');
     const program = createProgramWithVirtualFile(logger, tsconfig, virtualFilePath, customTypesContent);
-    const generator = createGenerator({
-        tsProgram: program,
+    const generator = createIndexedGenerator(program, {
         skipTypeCheck: true,
         topRef: false,
         discriminatorType: 'open-api',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/inspector",
-  "version": "0.12.95",
+  "version": "0.12.98",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/pikkujs/pikku.git",
@@ -54,10 +54,10 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.128"
+    "@pikku/core": "^0.12.132"
   },
   "devDependencies": {
-    "@pikku/core": "^0.12.128",
+    "@pikku/core": "^0.12.132",
     "@types/node": "^24.13.3"
   },
   "engines": {