@pikku/inspector 0.12.96 → 0.12.98

package/CHANGELOG.md

@@ -1,3 +1,47 @@
+## 0.12.98
+
+### Patch Changes
+
+- 8ac25a8: An OAuth2 credential can set `scopeSeparator` for a provider that wants scopes joined by something other than a space (Twist wants a comma). A credential with no scopes already sent no `scope` parameter; that is now tested.
+- 6606777: A webhook source can declare how its requests are signed, and the runner checks every request before `receive` runs:
+
+  ```ts
+  wireTriggerWebhookSource({
+    name: 'github',
+    verify: {
+      hmac: {
+        header: 'x-hub-signature-256',
+        prefix: 'sha256=',
+        algorithm: 'sha256',
+        encoding: 'hex',
+      },
+    },
+    receive: githubWebhookReceive,
+  })
+  ```
+
+  `verify` is an HMAC over the raw body, a shared token or a public-key signature in one header, or a function `(request, secret, services) => boolean` for anything else. A request is refused while the secret is unset or when the signature does not match. A request without a body reaches `receive` unchecked so handshakes still work, but it may only be answered: events from it are refused.
+
+  Declaring `verify` declares the secret's credential too, so it needs no `defineCredential`. It is a singleton string named `<source>WebhookSecret` in camelCase (`microsoft-outlook` → `microsoftOutlookWebhookSecret`, see `webhookSecretCredentialName`), or whatever `credential` names, described by `credentialDescription`.
+
+  `@pikku/core/hmac` gains `hmacDigest`, `verifyHmacSignature` and `verifyPublicKeySignature`. `WebhookSigningSecret` is deprecated.
+
+- Updated dependencies [d327fa5]
+- Updated dependencies [942ebdd]
+- Updated dependencies [8ac25a8]
+- Updated dependencies [6606777]
+  - @pikku/core@0.12.132
+
+## 0.12.97
+
+### Patch Changes
+
+- 26dbfc0: A `func` written inline in a `wireCLI` command now registers its function metadata under `cli:<program>:<command path>`, with `sessionless` taken from the helper it was built with. Before, the command pointed at an id nothing had registered. An inline channel `onMessage` still fails the build with the named "No function metadata found" error, and a test now pins that.
+- 2dcc651: The inspector finds a project's source on Windows: its root directory is compared with TypeScript's forward-slash file names, not the backslash path `path.resolve` returns.
+- Updated dependencies [58cccc1]
+- Updated dependencies [a26c60e]
+  - @pikku/core@0.12.131
+
 ## 0.12.96
 
 ### Patch Changes

package/dist/add/add-cli.js

@@ -3,6 +3,7 @@ import { extractFunctionName, makeContextBasedId, } from '../utils/extract-funct
 import { resolveCoreType } from '../utils/resolve-core-type.js';
 import { resolveMiddleware } from '../utils/middleware.js';
 import { resolveFunctionMeta } from '../utils/resolve-function-meta.js';
+import { ensureInlineWiringFunction } from '../utils/ensure-function-metadata.js';
 import { extractWireNames } from '../utils/post-process.js';
 import { getPropertyValue } from '../utils/get-property-value.js';
 import { resolveIdentifier } from '../utils/resolve-identifier.js';
@@ -253,9 +254,11 @@ function processCommand(logger, inspectorState, options, name, node, sourceFile,
                 }
             }
             else {
-                pikkuFuncId = extractFunctionName(prop.initializer, typeChecker, inspectorState.rootDir).pikkuFuncId;
+                const extracted = extractFunctionName(prop.initializer, typeChecker, inspectorState.rootDir);
+                pikkuFuncId = extracted.pikkuFuncId;
                 if (pikkuFuncId.startsWith('__temp_')) {
                     pikkuFuncId = makeContextBasedId('cli', programName, ...fullPath);
+                    ensureInlineWiringFunction(inspectorState, pikkuFuncId, fullPath.join(' '), prop.initializer, typeChecker, extracted.isHelper);
                 }
                 meta.pikkuFuncId = pikkuFuncId;
                 const cliPackageName = ts.isIdentifier(prop.initializer)

package/dist/add/add-credential.js

@@ -81,6 +81,7 @@ export const addCredential = (logger, node, checker, state, _options) => {
             const authorizationUrl = getPropertyValue(oauth2Obj, 'authorizationUrl');
             const tokenUrl = getPropertyValue(oauth2Obj, 'tokenUrl');
             const scopes = getArrayPropertyValue(oauth2Obj, 'scopes');
+            const scopeSeparator = getPropertyValue(oauth2Obj, 'scopeSeparator');
             const pkce = getPropertyValue(oauth2Obj, 'pkce');
             const additionalParams = getRecordPropertyValue(oauth2Obj, 'additionalParams');
             if (appCredentialSecretId && authorizationUrl && tokenUrl && scopes) {
@@ -90,6 +91,7 @@ export const addCredential = (logger, node, checker, state, _options) => {
                     authorizationUrl,
                     tokenUrl,
                     scopes,
+                    scopeSeparator: scopeSeparator || undefined,
                     pkce: pkce || undefined,
                     additionalParams: additionalParams || undefined,
                 };

package/dist/add/add-trigger.js

@@ -8,6 +8,7 @@ import { extractWireNames } from '../utils/post-process.js';
 import { resolveAddonName } from '../utils/resolve-addon-package.js';
 import { resolveFunctionMeta } from '../utils/resolve-function-meta.js';
 import { ErrorCode } from '../error-codes.js';
+import { webhookSecretCredentialName } from '@pikku/core/trigger';
 const WEBHOOK_SOURCE_STEPS = ['receive', 'check', 'setup', 'teardown'];
 export const addTrigger = (logger, node, checker, state, options) => {
     if (!ts.isCallExpression(node)) {
@@ -161,6 +162,21 @@ const addWireTriggerWebhookSource = (logger, node, checker, state, firstArg) =>
     };
     state.triggers.webhookSourceMeta[name] = meta;
     state.triggers.files.add(node.getSourceFile().fileName);
+    if (!getPropertyAssignmentInitializer(obj, 'verify', false, checker))
+        return;
+    const sourceFile = node.getSourceFile().fileName;
+    const credential = getPropertyValue(obj, 'credential') ??
+        webhookSecretCredentialName(name);
+    state.credentials.files.add(sourceFile);
+    state.credentials.definitions.push({
+        name: credential,
+        displayName: `${name} webhook secret`,
+        description: getPropertyValue(obj, 'credentialDescription') ??
+            undefined,
+        type: 'singleton',
+        schema: { type: 'string' },
+        sourceFile,
+    });
 };
 /**
  * A trigger named `<source>:<event>` must name an event its webhook source

package/dist/inspector.js

@@ -7,6 +7,7 @@ import { getFilesAndMethods } from './utils/get-files-and-methods.js';
 import { findCommonAncestor } from './utils/find-root-dir.js';
 import { createSourceFileCacheHost } from './source-file-cache.js';
 import { createNestedProjectFilter } from './utils/nested-project-filter.js';
+import { toProgramPath } from './utils/program-path.js';
 import { aggregateRequiredServices, stampAuthHandlerServices, validateAgentModels, validateAgentToolReferences, validateAgentScorerReferences, validateSecretOverrides, validateVariableOverrides, validateCredentialOverrides, validateRemoteAddonDependencies, validateRemoteAddonAuth, validateScopeReferences, validateSystemRoleScopes, validatePersonaRoles, computeResolvedIOTypes, computeMiddlewareGroupsMeta, computePermissionsGroupsMeta, computeRequiredSchemas, validateNoSecretAliasServices, registerDerivedOAuth2AppSecrets, validateSecretUsage, computeDiagnostics, validateSchemaReferences, validateSchemaWiringSeparation, validateScenarioServices, validateScenarioSteps, validateScenarioFeatures, validateWorkflowGraphAddons, } from './utils/post-process.js';
 import { validateExposedFunctionsGated } from './utils/validate-exposed-functions-gated.js';
 import { validateTagsResolveToMiddleware } from './utils/validate-tags-resolve-to-middleware.js';
@@ -293,7 +294,7 @@ export const inspect = async (logger, routeFiles, options = {}) => {
     const checker = program.getTypeChecker();
     logger.debug(`Got type checker in ${(performance.now() - startChecker).toFixed(2)}ms`);
     // Use provided rootDir or infer from source files
-    const rootDir = options.rootDir || findCommonAncestor(normalizedRouteFiles);
+    const rootDir = toProgramPath(options.rootDir || findCommonAncestor(normalizedRouteFiles));
     const startSourceFiles = performance.now();
     // node_modules under rootDir (e.g. a locally-installed addon) is a
     // dependency, not project source — scanning it double-counts the addon's

package/dist/utils/program-path.d.ts

@@ -0,0 +1,7 @@
+/**
+ * A native path in the form a TypeScript program names its files: forward
+ * slashes on every platform. `sourceFile.fileName` is `D:/a/app/src/x.ts` on
+ * Windows while `path.resolve` gives `D:\a\app`, so comparing the two by
+ * prefix rejects every file unless one side is converted.
+ */
+export declare const toProgramPath: (nativePath: string, separator?: "/" | "\\") => string;

package/dist/utils/program-path.js

@@ -0,0 +1,8 @@
+import { sep } from 'path';
+/**
+ * A native path in the form a TypeScript program names its files: forward
+ * slashes on every platform. `sourceFile.fileName` is `D:/a/app/src/x.ts` on
+ * Windows while `path.resolve` gives `D:\a\app`, so comparing the two by
+ * prefix rejects every file unless one side is converted.
+ */
+export const toProgramPath = (nativePath, separator = sep) => nativePath.split(separator).join('/');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/inspector",
-  "version": "0.12.96",
+  "version": "0.12.98",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/pikkujs/pikku.git",
@@ -54,10 +54,10 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.130"
+    "@pikku/core": "^0.12.132"
   },
   "devDependencies": {
-    "@pikku/core": "^0.12.130",
+    "@pikku/core": "^0.12.132",
     "@types/node": "^24.13.3"
   },
   "engines": {