@pikku/openapi-parser 0.12.21 → 0.12.23

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # @pikku/openapi-parser
 
+## 0.12.23
+
+### Patch Changes
+
+- 0210e96: Review fixes for the OpenAPI addon onboarding:
+
+  - A delegated sign-in whose email the upstream did not return, including a login typed as an email, never links to an existing user. An authenticator that omits `syntheticEmail` counts as synthetic.
+  - `pikkuActor` credentials take an optional `remove`, which drops a credential the environment no longer sets. The actor log line names the user id, not the email.
+  - Basic credentials are UTF-8 encoded, and a Swagger 2 `application` OAuth flow keeps its token URL.
+  - `pikku new addon` writes a `file:` path relative to each package when the app is not a workspace, and reports an auth.ts factory it cannot edit instead of half-wiring it.
+  - The inspector reads an addon from the package that declares it before the root.
+  - The dev credentials key file is created exclusively, so two `pikku dev` processes agree on one key.
+
+- 38d4f65: OpenAPI codegen builds without hand-fixes: specs from a URL with headers, Swagger 2 / OAS 3.0 / 3.1, server variables, form and multipart bodies, tag/include/exclude filters, a coverage warning for thin specs, a url() base URL, z.unknown() for vague responses, basic auth, CredentialRejectedError on an upstream 401, and a generalized delegated-login config.
+- a8cf3a1: A generated addon's errors now carry the upstream API's own message (`error.message`, `message`, `detail`, `title`), capped at 200 characters, instead of the raw response body with whatever debug data the API put in it.
+
+## 0.12.22
+
+### Patch Changes
+
+- 17d8746: An addon generated with `pikku new addon --openapi` never built. Every function file declared its zod schemas next to an import of `#pikku/function`, and `pikku all` loads the file that declares a schema to convert it. At runtime `#pikku` resolves through the addon's `imports` into `dist/`, which the first build has not written yet, so every schema failed with `Could not convert Zod schema … Cannot find module …/dist/.pikku/function/index.js` and the build stopped there. Each operation's schemas now go in a sibling `<operation>.schemas.ts` that imports only zod, and the function file imports them from it.
+
+  The generated imports also named the wrong tree. An addon's generated code lives under `.pikku/addon/`, so `#pikku/function` and `#pikku/variables/…` pointed at leaves that do not exist, and `tsc` failed even once codegen had run. They are now `#pikku/addon/function` and `#pikku/addon/variables/…`, as the hand-written addon scaffold already had them.
+
+  `pikku validate` now reports an installed Pikku package that resolves a different copy of a type-identity package (`zod`, `kysely`, `@pikku/core`, `better-auth`) than the project as an error, `skewed-type-identity-…`, and the codegen preflight warns about it as `PKU719`. Under bun's isolated layout `@pikku/cli` can carry its own `zod` beside it in the store. Codegen then reads the app's schemas with a different zod than wrote them, and correct schemas fail to convert. The existing check only looked at dependencies linked from outside the project, so it never saw this case.
+
+  The `pikku-build` skill now recognises an OpenAPI spec or an n8n export handed over with the request, says so, converts it first, then carries on building the app. `pikku-addon` gains an OpenAPI reference and corrects its addon import paths and build steps. `pikku-n8n-import` joins the `core` install group.
+
 ## 0.12.21
 
 ### Patch Changes

package/dist/auth-config.d.ts

@@ -1,11 +1,12 @@
 import { z } from 'zod';
 export declare const DelegatedClaimsSchema: z.ZodObject<{
-    source: z.ZodEnum<{
+    source: z.ZodOptional<z.ZodEnum<{
+        identity: "identity";
         jwt: "jwt";
         response: "response";
-    }>;
-    externalId: z.ZodString;
-    email: z.ZodString;
+    }>>;
+    externalId: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodString>;
     name: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
     role: z.ZodOptional<z.ZodString>;
     tenantId: z.ZodOptional<z.ZodString>;
@@ -16,22 +17,40 @@ export declare const DelegatedLoginSchema: z.ZodObject<{
     credentials: z.ZodDefault<z.ZodArray<z.ZodEnum<{
         apiKey: "apiKey";
         email: "email";
+        login: "login";
         password: "password";
     }>>>;
+    fields: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
+        email: "email";
+        login: "login";
+        password: "password";
+    }> & z.core.$partial, z.ZodString>>;
+    encoding: z.ZodDefault<z.ZodEnum<{
+        form: "form";
+        json: "json";
+        query: "query";
+    }>>;
     apiKeyHeader: z.ZodDefault<z.ZodString>;
     tokenPath: z.ZodString;
     expiresAtPath: z.ZodOptional<z.ZodString>;
-    claims: z.ZodObject<{
-        source: z.ZodEnum<{
+    identity: z.ZodOptional<z.ZodObject<{
+        path: z.ZodString;
+        method: z.ZodDefault<z.ZodString>;
+    }, z.core.$strip>>;
+    claims: z.ZodDefault<z.ZodObject<{
+        source: z.ZodOptional<z.ZodEnum<{
+            identity: "identity";
             jwt: "jwt";
             response: "response";
-        }>;
-        externalId: z.ZodString;
-        email: z.ZodString;
+        }>>;
+        externalId: z.ZodOptional<z.ZodString>;
+        email: z.ZodOptional<z.ZodString>;
         name: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
         role: z.ZodOptional<z.ZodString>;
         tenantId: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>;
+    }, z.core.$strip>>;
+    emailTemplate: z.ZodDefault<z.ZodString>;
+    roles: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
 }, z.core.$strip>;
 export declare const AuthConfigSchema: z.ZodObject<{
     headerName: z.ZodOptional<z.ZodString>;
@@ -46,22 +65,40 @@ export declare const AuthConfigSchema: z.ZodObject<{
         credentials: z.ZodDefault<z.ZodArray<z.ZodEnum<{
             apiKey: "apiKey";
             email: "email";
+            login: "login";
             password: "password";
         }>>>;
+        fields: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
+            email: "email";
+            login: "login";
+            password: "password";
+        }> & z.core.$partial, z.ZodString>>;
+        encoding: z.ZodDefault<z.ZodEnum<{
+            form: "form";
+            json: "json";
+            query: "query";
+        }>>;
         apiKeyHeader: z.ZodDefault<z.ZodString>;
         tokenPath: z.ZodString;
         expiresAtPath: z.ZodOptional<z.ZodString>;
-        claims: z.ZodObject<{
-            source: z.ZodEnum<{
+        identity: z.ZodOptional<z.ZodObject<{
+            path: z.ZodString;
+            method: z.ZodDefault<z.ZodString>;
+        }, z.core.$strip>>;
+        claims: z.ZodDefault<z.ZodObject<{
+            source: z.ZodOptional<z.ZodEnum<{
+                identity: "identity";
                 jwt: "jwt";
                 response: "response";
-            }>;
-            externalId: z.ZodString;
-            email: z.ZodString;
+            }>>;
+            externalId: z.ZodOptional<z.ZodString>;
+            email: z.ZodOptional<z.ZodString>;
             name: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
             role: z.ZodOptional<z.ZodString>;
             tenantId: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip>;
+        }, z.core.$strip>>;
+        emailTemplate: z.ZodDefault<z.ZodString>;
+        roles: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type DelegatedLoginConfig = z.infer<typeof DelegatedLoginSchema>;

package/dist/auth-config.js

@@ -7,12 +7,17 @@
 import { readFile } from 'fs/promises';
 import { z } from 'zod';
 export const DelegatedClaimsSchema = z.object({
-    /** Where identity claims live: the decoded login-JWT payload, or the login response body. */
-    source: z.enum(['jwt', 'response']),
-    /** Dot-path to the stable upstream user id (e.g. 'user._id'). */
-    externalId: z.string(),
-    email: z.string(),
-    /** One dot-path, or several joined with a space (e.g. first + last name). */
+    /**
+     * Where identity claims live: the decoded login-JWT payload, the login
+     * response body, or the `identity` lookup's response. Defaults to
+     * `identity` when an identity lookup is configured, else `response`.
+     */
+    source: z.enum(['jwt', 'response', 'identity']).optional(),
+    /** Dot-path to the stable upstream user id (e.g. 'user._id'). Defaults to the sign-in login. */
+    externalId: z.string().optional(),
+    /** Dot-path to the email; when missing or empty, `emailTemplate` builds one. */
+    email: z.string().optional(),
+    /** One dot-path, or several joined with a space (e.g. first + last name). Defaults to the login. */
     name: z.union([z.string(), z.array(z.string())]).optional(),
     role: z.string().optional(),
     tenantId: z.string().optional(),
@@ -21,17 +26,46 @@ export const DelegatedLoginSchema = z.object({
     /** Spec-relative path of the login operation (e.g. '/users/login'). */
     loginPath: z.string(),
     loginMethod: z.string().default('post'),
-    /** Which credential fields the login accepts. email/password go in the JSON body; apiKey in a header. */
+    /**
+     * Which credentials the sign-in form collects. `login` is a username or
+     * email, `email` an email address, `apiKey` a key sent in `apiKeyHeader`.
+     */
     credentials: z
-        .array(z.enum(['email', 'password', 'apiKey']))
+        .array(z.enum(['login', 'email', 'password', 'apiKey']))
         .default(['email', 'password']),
+    /**
+     * Upstream field name for each credential, e.g. `{ "login": "username" }`.
+     * Unmapped credentials keep their own name.
+     */
+    fields: z
+        .partialRecord(z.enum(['login', 'email', 'password']), z.string())
+        .optional(),
+    /** How the login fields travel: a JSON body, a form body, or the query string. */
+    encoding: z.enum(['json', 'form', 'query']).default('json'),
     /** Header carrying the apiKey when 'apiKey' is a supported credential. */
     apiKeyHeader: z.string().default('x-api-key'),
     /** Dot-path to the token in the login response (e.g. 'token'). */
     tokenPath: z.string(),
     /** Dot-path to an epoch-seconds expiry in the response; defaults to the JWT `exp` claim when source is jwt. */
     expiresAtPath: z.string().optional(),
-    claims: DelegatedClaimsSchema,
+    /**
+     * An operation that returns the signed-in user, called with the new token
+     * in the auth header — for upstreams whose login returns only a token.
+     */
+    identity: z
+        .object({
+        path: z.string(),
+        method: z.string().default('get'),
+    })
+        .optional(),
+    claims: DelegatedClaimsSchema.default({}),
+    /**
+     * Builds the user's email when the upstream has none. Placeholders:
+     * `{login}`, `{externalId}`, `{host}` (the upstream's host).
+     */
+    emailTemplate: z.string().default('{login}@{host}'),
+    /** Maps the raw `claims.role` value onto an app role; unmapped values get no role. */
+    roles: z.record(z.string(), z.string()).optional(),
 });
 export const AuthConfigSchema = z.object({
     /** Auth header the API expects on authenticated calls (e.g. 'authentication'). Overrides the spec. */

package/dist/codegen.d.ts

@@ -15,7 +15,7 @@ interface AddonVars {
 interface CodegenFlags {
     oauth: boolean;
     secret: boolean;
-    credential?: 'apikey' | 'bearer' | 'oauth2';
+    credential?: 'apikey' | 'bearer' | 'basic' | 'oauth2';
     mcp?: boolean;
     camelCase?: boolean;
     /** Operator-supplied auth overrides (custom header, delegated login). */