@pikku/inspector 0.12.99 → 0.12.101

package/CHANGELOG.md

@@ -1,3 +1,20 @@
+## 0.12.101
+
+### Patch Changes
+
+- 9112494: `pikku knowledge validate` reports code that no note describes as a warning rather than info, and raises one `PKU960` diagnostic for it, so `--fail-on-warn` can gate on it and the "consistent" line no longer prints while notes are missing. A plain run still exits 0: only errors fail it.
+
+## 0.12.100
+
+### Patch Changes
+
+- 149faae: Webhook `receive` steps lose their boilerplate. `pikkuWebhookReceive` (from `#pikku/trigger` or `#pikku/addon/trigger`) declares one: it is public, typed to the raw request with a required `http`, and never registered as an RPC, and the inspector rejects a `receive` declared with any other wrapper. `parseJson` (in `@pikku/core/utils`, generated as `#pikku/utils` and `#pikku/addon/utils`) parses text or bytes and answers a body that is not JSON with a 400. A webhook source whose `method` includes `'head'` answers HEAD probes itself with a 200.
+
+  `receive` no longer returns `{ respond }`: a handshake returns nothing and writes its answer to `http.response`, like any other HTTP function. The webhook route no longer returns a fetch `Response` either. An HTTP function that returns nothing is now answered with whatever status its response has (200 unless it set another), no longer a forced 204. A webhook receive is also left out of contract versioning, since nothing but its own route calls it.
+
+- Updated dependencies [149faae]
+  - @pikku/core@0.12.136
+
 ## 0.12.99
 
 ### Patch Changes

package/dist/add/add-functions.js

@@ -361,6 +361,7 @@ export const addFunctions = (logger, node, checker, state, options) => {
     const pikkuFuncPattern = /pikku.*func/i;
     if (!pikkuFuncPattern.test(expression.text) &&
         expression.text !== 'pikkuScenario' &&
+        expression.text !== 'pikkuWebhookReceive' &&
         !SCENARIO_STEP_KINDS.has(expression.text)) {
         return;
     }
@@ -373,6 +374,10 @@ export const addFunctions = (logger, node, checker, state, options) => {
     // analyzer can tell it apart from an application workflow without having to
     // reach into the workflow graph.
     const isScenario = expression.text === 'pikkuScenario';
+    // A webhook source's `receive`. Only its source's route runs it, with the
+    // raw request, so like a scenario step it is bundled but never RPC-registered.
+    const isWebhookReceive = expression.text === 'pikkuWebhookReceive';
+    const notRpc = isScenarioStep || isWebhookReceive;
     // only handle calls like pikkuFunc(...)
     if (!ts.isIdentifier(expression) || !expression.text.startsWith('pikku')) {
         return;
@@ -817,6 +822,9 @@ export const addFunctions = (logger, node, checker, state, options) => {
             inputTypes = result.types;
         }
     }
+    // A receive's input is always the raw request, which no schema describes.
+    if (isWebhookReceive)
+        inputNames = [];
     // --- Output Extraction ---
     let outputNames = [];
     if (outputSchemaRef) {
@@ -1054,11 +1062,16 @@ export const addFunctions = (logger, node, checker, state, options) => {
         inputs: inputNames.filter((n) => n !== 'void') ?? null,
         outputs: outputNames.filter((n) => n !== 'void') ?? null,
         expose: expose || undefined,
-        auth: typeof auth === 'boolean' ? auth : undefined,
+        auth: isWebhookReceive
+            ? false
+            : typeof auth === 'boolean'
+                ? auth
+                : undefined,
         permissionsInBody: permissionsInBody || undefined,
         audit,
         remote: remote || undefined,
         scenarioStep: isScenarioStep || undefined,
+        webhookReceive: isWebhookReceive || undefined,
         scenario: isScenario || undefined,
         mcp: mcpEnabled || undefined,
         readonly: readonly_ || undefined,
@@ -1173,7 +1186,7 @@ export const addFunctions = (logger, node, checker, state, options) => {
             logger.error(`• Function with explicit name '${name}' is not exported, this is not allowed.`);
             return;
         }
-        if (remote && !isScenarioStep) {
+        if (remote && !notRpc) {
             state.rpc.invokedFunctions.add(pikkuFuncId);
             // The consumer-facing surface a wireRemoteAddon imports (mirrors exposedMeta)
             state.rpc.remoteMeta[name] = pikkuFuncId;
@@ -1182,7 +1195,7 @@ export const addFunctions = (logger, node, checker, state, options) => {
                 exportedName,
             });
         }
-        if (expose && !isScenarioStep) {
+        if (expose && !notRpc) {
             state.rpc.exposedMeta[name] = pikkuFuncId;
             state.rpc.exposedFiles.set(name, {
                 path: node.getSourceFile().fileName,
@@ -1191,7 +1204,7 @@ export const addFunctions = (logger, node, checker, state, options) => {
             // Track exposed RPC function for service aggregation
             state.serviceAggregation.usedFunctions.add(pikkuFuncId);
         }
-        if (!isScenarioStep) {
+        if (!notRpc) {
             // We add it to internal meta to allow autocomplete for everything
             state.rpc.internalMeta[name] = pikkuFuncId;
             if (version !== undefined) {

package/dist/add/add-trigger.js

@@ -184,6 +184,12 @@ const addWireTriggerWebhookSource = (logger, node, checker, state, firstArg) =>
  */
 export const validateWebhookSourceTriggers = (logger, state) => {
     const sources = state.triggers.webhookSourceMeta;
+    for (const source of Object.values(sources)) {
+        const meta = source.receive && state.functions.meta[source.receive];
+        if (meta && meta.funcWrapper && !meta.webhookReceive) {
+            logger.error(`Webhook source '${source.name}' receives with '${source.receive}', a ${meta.funcWrapper}. Declare it with pikkuWebhookReceive so it is never callable as an RPC.`);
+        }
+    }
     for (const trigger of Object.keys(state.triggers.meta)) {
         const colon = trigger.indexOf(':');
         if (colon === -1)

package/dist/error-codes.d.ts

@@ -83,6 +83,7 @@ export declare enum ErrorCode {
     ADDON_WIRING_NOT_ALLOWED = "PKU920",
     ADDON_CONTRACT_HANDLERS_NOT_ALLOWED = "PKU921",
     RPC_INVOCATION_TYPE_CAST = "PKU940",
+    KNOWLEDGE_NOTE_MISSING = "PKU960",
     SECRET_SERVICE_ALIASED = "PKU950",
     SECRET_NOT_DECLARED = "PKU951",
     SECRET_KEY_NOT_STATIC = "PKU952",

package/dist/error-codes.js

@@ -108,6 +108,8 @@ export var ErrorCode;
     ErrorCode["ADDON_WIRING_NOT_ALLOWED"] = "PKU920";
     ErrorCode["ADDON_CONTRACT_HANDLERS_NOT_ALLOWED"] = "PKU921";
     ErrorCode["RPC_INVOCATION_TYPE_CAST"] = "PKU940";
+    // Knowledge base errors
+    ErrorCode["KNOWLEDGE_NOTE_MISSING"] = "PKU960";
     // Secret boundary errors
     ErrorCode["SECRET_SERVICE_ALIASED"] = "PKU950";
     ErrorCode["SECRET_NOT_DECLARED"] = "PKU951";

package/dist/utils/contract-hashes.js

@@ -71,7 +71,9 @@ function resolveSchema(typeNames, allSchemas, typesMap) {
 export function buildCurrentContracts(functionsMeta, allSchemas, typesMap) {
     const result = new Map();
     for (const [funcId, meta] of Object.entries(functionsMeta)) {
-        if (meta.remote === true) {
+        // A webhook receive has no callers but its own route, so there is no
+        // contract for a version to protect.
+        if (meta.remote === true || meta.webhookReceive) {
             continue;
         }
         const parsed = parseVersionedId(funcId);
@@ -251,7 +253,7 @@ export function updateManifest(existing, currentContracts) {
 export function extractContractsFromMeta(functionsMeta) {
     const result = new Map();
     for (const [funcId, meta] of Object.entries(functionsMeta)) {
-        if (meta.remote === true || !meta.contractHash) {
+        if (meta.remote === true || meta.webhookReceive || !meta.contractHash) {
             continue;
         }
         const parsed = parseVersionedId(funcId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/inspector",
-  "version": "0.12.99",
+  "version": "0.12.101",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/pikkujs/pikku.git",
@@ -54,10 +54,10 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.135"
+    "@pikku/core": "^0.12.136"
   },
   "devDependencies": {
-    "@pikku/core": "^0.12.135",
+    "@pikku/core": "^0.12.136",
     "@types/node": "^24.13.3"
   },
   "engines": {