@pikku/openapi-parser 0.12.20 → 0.12.22

package/CHANGELOG.md

@@ -1,5 +1,42 @@
 # @pikku/openapi-parser
 
+## 0.12.22
+
+### Patch Changes
+
+- 17d8746: An addon generated with `pikku new addon --openapi` never built. Every function file declared its zod schemas next to an import of `#pikku/function`, and `pikku all` loads the file that declares a schema to convert it. At runtime `#pikku` resolves through the addon's `imports` into `dist/`, which the first build has not written yet, so every schema failed with `Could not convert Zod schema … Cannot find module …/dist/.pikku/function/index.js` and the build stopped there. Each operation's schemas now go in a sibling `<operation>.schemas.ts` that imports only zod, and the function file imports them from it.
+
+  The generated imports also named the wrong tree. An addon's generated code lives under `.pikku/addon/`, so `#pikku/function` and `#pikku/variables/…` pointed at leaves that do not exist, and `tsc` failed even once codegen had run. They are now `#pikku/addon/function` and `#pikku/addon/variables/…`, as the hand-written addon scaffold already had them.
+
+  `pikku validate` now reports an installed Pikku package that resolves a different copy of a type-identity package (`zod`, `kysely`, `@pikku/core`, `better-auth`) than the project as an error, `skewed-type-identity-…`, and the codegen preflight warns about it as `PKU719`. Under bun's isolated layout `@pikku/cli` can carry its own `zod` beside it in the store. Codegen then reads the app's schemas with a different zod than wrote them, and correct schemas fail to convert. The existing check only looked at dependencies linked from outside the project, so it never saw this case.
+
+  The `pikku-build` skill now recognises an OpenAPI spec or an n8n export handed over with the request, says so, converts it first, then carries on building the app. `pikku-addon` gains an OpenAPI reference and corrects its addon import paths and build steps. `pikku-n8n-import` joins the `core` install group.
+
+## 0.12.21
+
+### Patch Changes
+
+- 4c7a1b5: Run the monorepo's own scripts through bun instead of yarn. What moves is the
+  package manager each package's `prepublishOnly` and build scripts invoke, plus
+  the two manifest fixes bun needs to resolve the tree: `uWebSockets.js` is
+  declared with an explicit `github:` specifier, and `@pikku/uws-handler` marks
+  its `uWebSockets.js` peer optional so a bun install of a consumer that brings
+  its own uWS app does not try to fetch it from the registry.
+
+  Three published behaviours change, all of them cases where an isolated
+  `node_modules` or bun as the runtime had been papered over by yarn's hoisting:
+
+  - `@pikku/migrator-sql` turns foreign keys on when it opens a sqlite database
+    through bun. `node:sqlite` enforces them by default and `bun:sqlite` does not,
+    which silently turned every `ON DELETE CASCADE` into a no-op under
+    `bunx --bun pikku`.
+  - `@pikku/cli` resolves a deploy provider against the project being deployed
+    rather than against wherever the CLI itself is installed, which is what its
+    own "is not installed" error asks the user to arrange.
+  - `@pikku/cli` treats a specifier a runtime hands straight back — bun does this
+    for the modules it implements itself — as not resolved from the project, so
+    it falls back rather than loading the runtime's own copy.
+
 ## 0.12.20
 
 ### Patch Changes

package/dist/auth-config.d.ts

@@ -14,9 +14,9 @@ export declare const DelegatedLoginSchema: z.ZodObject<{
     loginPath: z.ZodString;
     loginMethod: z.ZodDefault<z.ZodString>;
     credentials: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        apiKey: "apiKey";
         email: "email";
         password: "password";
-        apiKey: "apiKey";
     }>>>;
     apiKeyHeader: z.ZodDefault<z.ZodString>;
     tokenPath: z.ZodString;
@@ -36,17 +36,17 @@ export declare const DelegatedLoginSchema: z.ZodObject<{
 export declare const AuthConfigSchema: z.ZodObject<{
     headerName: z.ZodOptional<z.ZodString>;
     headerFormat: z.ZodOptional<z.ZodEnum<{
-        raw: "raw";
         bearer: "bearer";
+        raw: "raw";
     }>>;
     extraHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     delegated: z.ZodOptional<z.ZodObject<{
         loginPath: z.ZodString;
         loginMethod: z.ZodDefault<z.ZodString>;
         credentials: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+            apiKey: "apiKey";
             email: "email";
             password: "password";
-            apiKey: "apiKey";
         }>>>;
         apiKeyHeader: z.ZodDefault<z.ZodString>;
         tokenPath: z.ZodString;

package/dist/codegen.js

@@ -281,8 +281,11 @@ export function generateAddonFromOpenAPI(spec, vars, flags) {
             camelCase: flags.camelCase,
         });
         const inlineSchemas = singleSchemasPerOp.get(i) ?? new Set();
-        const funcCode = generateFunctionFile(named, parsed, vars, funcCtx, spec, flags, inlineSchemas, sharedWithDeps, schemaIdentityMap);
-        files[`src/functions/${named.functionName}.function.ts`] = funcCode;
+        const { functionFile, schemasFile } = generateFunctionFile(named, parsed, vars, funcCtx, spec, flags, inlineSchemas, sharedWithDeps, schemaIdentityMap);
+        files[`src/functions/${named.functionName}.function.ts`] = functionFile;
+        if (schemasFile) {
+            files[`src/functions/${named.functionName}.schemas.ts`] = schemasFile;
+        }
         functionExports.push(named.functionName);
     }
     // Delegated login: emit the upstream authenticate() implementation
@@ -516,14 +519,19 @@ function generateFunctionFile(named, parsed, vars, ctx, spec, flags, inlineSchem
     }
     // Determine error imports needed
     const errorClasses = getErrorClassesForResponses(parsed.errorResponses);
-    const needsZod = hasInput || !!parsed.responseSchema || inlineSchemas.size > 0;
-    if (needsZod) {
-        lines.push("import { z } from 'zod'");
-    }
-    lines.push("import { pikkuSessionlessFunc } from '#pikku/function'");
+    const schemaExports = [
+        ...(hasInput && inputCode ? [inputName] : []),
+        ...(parsed.responseSchema && outputCode ? [outputName] : []),
+    ];
+    lines.push("import { pikkuSessionlessFunc } from '#pikku/addon/function'");
     if (errorClasses.length > 0) {
         lines.push(`import { ${errorClasses.join(', ')} } from '@pikku/core/errors'`);
     }
+    if (schemaExports.length > 0) {
+        lines.push(`import { ${schemaExports.join(', ')} } from './${named.functionName}.schemas.js'`);
+    }
+    lines.push('');
+    const schemaLines = ["import { z } from 'zod'"];
     // Import referenced component schemas from the types file.
     // Only import schemas that are in the shared set (not inlined ones).
     // In addition to the refs tracked through usedRefs, scan the generated Zod
@@ -543,10 +551,10 @@ function generateFunctionFile(named, parsed, vars, ctx, spec, flags, inlineSchem
                 .filter(Boolean)),
         ].sort();
         if (schemaImports.length > 0) {
-            lines.push(`import { ${schemaImports.join(', ')} } from '../${name}.types.js'`);
+            schemaLines.push(`import { ${schemaImports.join(', ')} } from '../${name}.types.js'`);
         }
     }
-    lines.push('');
+    schemaLines.push('');
     // Emit inline (single-use) schema definitions before input/output
     if (inlineSchemas.size > 0) {
         // Build a mini component schemas map for just the inline schemas
@@ -607,7 +615,7 @@ function generateFunctionFile(named, parsed, vars, ctx, spec, flags, inlineSchem
             const emittedTypeNames = new Set();
             // Forward declarations for cycles and forward references within inline schemas
             if (forwardRefs.size > 0) {
-                lines.push('// Forward declarations for circular references');
+                schemaLines.push('// Forward declarations for circular references');
                 for (const sName of forwardRefs) {
                     if (!inlineSchemas.has(sName))
                         continue;
@@ -615,8 +623,8 @@ function generateFunctionFile(named, parsed, vars, ctx, spec, flags, inlineSchem
                     const typeN = sanitizeTypeName(sName);
                     emittedVarNames.add(varN);
                     emittedTypeNames.add(typeN);
-                    lines.push(`const ${varN}: z.ZodType<any> = z.lazy(() => _${varN})`);
-                    lines.push('');
+                    schemaLines.push(`const ${varN}: z.ZodType<any> = z.lazy(() => _${varN})`);
+                    schemaLines.push('');
                 }
             }
             for (const sName of inlineSorted) {
@@ -624,24 +632,24 @@ function generateFunctionFile(named, parsed, vars, ctx, spec, flags, inlineSchem
                 emittedVarNames.add(varN);
                 const zodCode = generatedCode.get(sName);
                 if (forwardRefs.has(sName)) {
-                    lines.push(`const _${varN} = ${zodCode}`);
+                    schemaLines.push(`const _${varN} = ${zodCode}`);
                 }
                 else {
-                    lines.push(`const ${varN} = ${zodCode}`);
+                    schemaLines.push(`const ${varN} = ${zodCode}`);
                 }
-                lines.push('');
+                schemaLines.push('');
             }
         }
     }
     // Build Input schema (exported for pikku schema discovery)
     if (hasInput && inputCode) {
-        lines.push(`export const ${inputName} = ${inputCode}`);
-        lines.push('');
+        schemaLines.push(`export const ${inputName} = ${inputCode}`);
+        schemaLines.push('');
     }
     // Build Output schema (exported for pikku schema discovery)
     if (parsed.responseSchema && outputCode) {
-        lines.push(`export const ${outputName} = ${outputCode}`);
-        lines.push('');
+        schemaLines.push(`export const ${outputName} = ${outputCode}`);
+        schemaLines.push('');
     }
     const description = humanDescription(parsed);
     const method = parsed.method.toUpperCase();
@@ -671,7 +679,10 @@ function generateFunctionFile(named, parsed, vars, ctx, spec, flags, inlineSchem
     lines.push(funcConfig.join('\n'));
     lines.push('})');
     lines.push('');
-    return lines.join('\n');
+    return {
+        functionFile: lines.join('\n'),
+        schemasFile: schemaExports.length > 0 ? schemaLines.join('\n') : undefined,
+    };
 }
 function buildInputSchema(parsed, ctx) {
     const props = [];
@@ -950,7 +961,7 @@ function generateServiceFile(spec, opPairs, vars, flags) {
     if (allErrorClasses.size > 0) {
         lines.push(`import { ${[...allErrorClasses].sort().join(', ')} } from '@pikku/core/errors'`);
     }
-    lines.push(`import type { TypedVariablesService } from '#pikku/variables/pikku-variables.gen.js'`);
+    lines.push(`import type { TypedVariablesService } from '#pikku/addon/variables/pikku-variables.gen.js'`);
     lines.push('');
     // Generate route map from parsed operations
     const routes = {};

package/package.json

@@ -1,6 +1,11 @@
 {
   "name": "@pikku/openapi-parser",
-  "version": "0.12.20",
+  "version": "0.12.22",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pikkujs/pikku.git",
+    "directory": "packages/openapi-parser"
+  },
   "description": "OpenAPI spec parser and code generator for Pikku",
   "author": "yasser.fadl@gmail.com",
   "license": "MIT",
@@ -12,7 +17,7 @@
     "ncu": "npx npm-check-updates",
     "build": "tsc -b",
     "test": "node --import tsx --test src/**/*.test.ts",
-    "prepublishOnly": "yarn build"
+    "prepublishOnly": "bun run build"
   },
   "exports": {
     ".": "./dist/index.js"
@@ -20,8 +25,5 @@
   "dependencies": {
     "yaml": "^2.9.0",
     "zod": "^4"
-  },
-  "devDependencies": {
-    "typescript": "^6.0.3"
   }
-}
+}

package/src/auth-config.ts

@@ -1,94 +0,0 @@
-/**
- * Operator/agent-supplied auth configuration that overrides or augments an
- * OpenAPI spec's securitySchemes. Needed for real-world enterprise specs that
- * carry no machine-readable auth at all (auth described only in prose), or
- * that use a custom auth header the spec doesn't declare.
- */
-import { readFile } from 'fs/promises'
-import { z } from 'zod'
-
-export const DelegatedClaimsSchema = z.object({
-  /** Where identity claims live: the decoded login-JWT payload, or the login response body. */
-  source: z.enum(['jwt', 'response']),
-  /** Dot-path to the stable upstream user id (e.g. 'user._id'). */
-  externalId: z.string(),
-  email: z.string(),
-  /** One dot-path, or several joined with a space (e.g. first + last name). */
-  name: z.union([z.string(), z.array(z.string())]).optional(),
-  role: z.string().optional(),
-  tenantId: z.string().optional(),
-})
-
-export const DelegatedLoginSchema = z.object({
-  /** Spec-relative path of the login operation (e.g. '/users/login'). */
-  loginPath: z.string(),
-  loginMethod: z.string().default('post'),
-  /** Which credential fields the login accepts. email/password go in the JSON body; apiKey in a header. */
-  credentials: z
-    .array(z.enum(['email', 'password', 'apiKey']))
-    .default(['email', 'password']),
-  /** Header carrying the apiKey when 'apiKey' is a supported credential. */
-  apiKeyHeader: z.string().default('x-api-key'),
-  /** Dot-path to the token in the login response (e.g. 'token'). */
-  tokenPath: z.string(),
-  /** Dot-path to an epoch-seconds expiry in the response; defaults to the JWT `exp` claim when source is jwt. */
-  expiresAtPath: z.string().optional(),
-  claims: DelegatedClaimsSchema,
-})
-
-export const AuthConfigSchema = z.object({
-  /** Auth header the API expects on authenticated calls (e.g. 'authentication'). Overrides the spec. */
-  headerName: z.string().optional(),
-  /** 'raw' sends the bare token; 'bearer' prefixes it. Default: bearer for Authorization, raw for custom headers. */
-  headerFormat: z.enum(['raw', 'bearer']).optional(),
-  /**
-   * Static headers sent on EVERY request — the delegated login call and all
-   * proxied API calls. Needed for upstreams that route on a header, e.g. a
-   * multi-tenant API that resolves the tenant from an `Origin` header and
-   * rejects requests without it.
-   */
-  extraHeaders: z.record(z.string(), z.string()).optional(),
-  /** Present when end-users sign in with their existing upstream credentials (delegated login). */
-  delegated: DelegatedLoginSchema.optional(),
-})
-
-export type DelegatedLoginConfig = z.infer<typeof DelegatedLoginSchema>
-export type AuthConfig = z.infer<typeof AuthConfigSchema>
-
-/** The effective value template for the auth header. */
-export const authHeaderValue = (
-  config: AuthConfig,
-  tokenExpr: string
-): { header: string; value: string } => {
-  const header = config.headerName ?? 'Authorization'
-  const format =
-    config.headerFormat ??
-    (config.headerName && config.headerName !== 'Authorization'
-      ? 'raw'
-      : 'bearer')
-  return {
-    header,
-    value: format === 'bearer' ? `\`Bearer \${${tokenExpr}}\`` : tokenExpr,
-  }
-}
-
-/** Load and validate an auth-config JSON file; throws with the zod issue list on mismatch. */
-export async function loadAuthConfig(filePath: string): Promise<AuthConfig> {
-  const raw = await readFile(filePath, 'utf-8')
-  let parsed: unknown
-  try {
-    parsed = JSON.parse(raw)
-  } catch (error) {
-    throw new Error(
-      `Auth config ${filePath} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`
-    )
-  }
-  const result = AuthConfigSchema.safeParse(parsed)
-  if (!result.success) {
-    const issues = result.error.issues
-      .map((i) => `  ${i.path.join('.') || '(root)'}: ${i.message}`)
-      .join('\n')
-    throw new Error(`Auth config ${filePath} is invalid:\n${issues}`)
-  }
-  return result.data
-}