@pikku/openapi-parser 0.12.23 → 0.12.24

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/openapi-parser",
-  "version": "0.12.23",
+  "version": "0.12.24",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/pikkujs/pikku.git",
@@ -15,15 +15,21 @@
   "scripts": {
     "tsc": "tsc",
     "ncu": "npx npm-check-updates",
-    "build": "tsc -b",
+    "build": "bun run clean && tsc -b",
     "test": "node --import tsx --test src/**/*.test.ts",
-    "prepublishOnly": "bun run build"
+    "prepublishOnly": "bun run build",
+    "clean": "rm -rf dist tsconfig.tsbuildinfo"
   },
   "exports": {
-    ".": "./dist/index.js"
+    ".": "./dist/index.js",
+    "./package.json": "./package.json"
   },
+  "files": [
+    "dist",
+    "!dist/**/*.tsbuildinfo"
+  ],
   "dependencies": {
-    "yaml": "^2.9.0",
+    "yaml": "^2.9.1",
     "zod": "^4"
   }
 }

package/CHANGELOG.md

@@ -1,263 +0,0 @@
-# @pikku/openapi-parser
-
-## 0.12.23
-
-### Patch Changes
-
-- 0210e96: Review fixes for the OpenAPI addon onboarding:
-
-  - A delegated sign-in whose email the upstream did not return, including a login typed as an email, never links to an existing user. An authenticator that omits `syntheticEmail` counts as synthetic.
-  - `pikkuActor` credentials take an optional `remove`, which drops a credential the environment no longer sets. The actor log line names the user id, not the email.
-  - Basic credentials are UTF-8 encoded, and a Swagger 2 `application` OAuth flow keeps its token URL.
-  - `pikku new addon` writes a `file:` path relative to each package when the app is not a workspace, and reports an auth.ts factory it cannot edit instead of half-wiring it.
-  - The inspector reads an addon from the package that declares it before the root.
-  - The dev credentials key file is created exclusively, so two `pikku dev` processes agree on one key.
-
-- 38d4f65: OpenAPI codegen builds without hand-fixes: specs from a URL with headers, Swagger 2 / OAS 3.0 / 3.1, server variables, form and multipart bodies, tag/include/exclude filters, a coverage warning for thin specs, a url() base URL, z.unknown() for vague responses, basic auth, CredentialRejectedError on an upstream 401, and a generalized delegated-login config.
-- a8cf3a1: A generated addon's errors now carry the upstream API's own message (`error.message`, `message`, `detail`, `title`), capped at 200 characters, instead of the raw response body with whatever debug data the API put in it.
-
-## 0.12.22
-
-### Patch Changes
-
-- 17d8746: An addon generated with `pikku new addon --openapi` never built. Every function file declared its zod schemas next to an import of `#pikku/function`, and `pikku all` loads the file that declares a schema to convert it. At runtime `#pikku` resolves through the addon's `imports` into `dist/`, which the first build has not written yet, so every schema failed with `Could not convert Zod schema … Cannot find module …/dist/.pikku/function/index.js` and the build stopped there. Each operation's schemas now go in a sibling `<operation>.schemas.ts` that imports only zod, and the function file imports them from it.
-
-  The generated imports also named the wrong tree. An addon's generated code lives under `.pikku/addon/`, so `#pikku/function` and `#pikku/variables/…` pointed at leaves that do not exist, and `tsc` failed even once codegen had run. They are now `#pikku/addon/function` and `#pikku/addon/variables/…`, as the hand-written addon scaffold already had them.
-
-  `pikku validate` now reports an installed Pikku package that resolves a different copy of a type-identity package (`zod`, `kysely`, `@pikku/core`, `better-auth`) than the project as an error, `skewed-type-identity-…`, and the codegen preflight warns about it as `PKU719`. Under bun's isolated layout `@pikku/cli` can carry its own `zod` beside it in the store. Codegen then reads the app's schemas with a different zod than wrote them, and correct schemas fail to convert. The existing check only looked at dependencies linked from outside the project, so it never saw this case.
-
-  The `pikku-build` skill now recognises an OpenAPI spec or an n8n export handed over with the request, says so, converts it first, then carries on building the app. `pikku-addon` gains an OpenAPI reference and corrects its addon import paths and build steps. `pikku-n8n-import` joins the `core` install group.
-
-## 0.12.21
-
-### Patch Changes
-
-- 4c7a1b5: Run the monorepo's own scripts through bun instead of yarn. What moves is the
-  package manager each package's `prepublishOnly` and build scripts invoke, plus
-  the two manifest fixes bun needs to resolve the tree: `uWebSockets.js` is
-  declared with an explicit `github:` specifier, and `@pikku/uws-handler` marks
-  its `uWebSockets.js` peer optional so a bun install of a consumer that brings
-  its own uWS app does not try to fetch it from the registry.
-
-  Three published behaviours change, all of them cases where an isolated
-  `node_modules` or bun as the runtime had been papered over by yarn's hoisting:
-
-  - `@pikku/migrator-sql` turns foreign keys on when it opens a sqlite database
-    through bun. `node:sqlite` enforces them by default and `bun:sqlite` does not,
-    which silently turned every `ON DELETE CASCADE` into a no-op under
-    `bunx --bun pikku`.
-  - `@pikku/cli` resolves a deploy provider against the project being deployed
-    rather than against wherever the CLI itself is installed, which is what its
-    own "is not installed" error asks the user to arrange.
-  - `@pikku/cli` treats a specifier a runtime hands straight back — bun does this
-    for the modules it implements itself — as not resolved from the project, so
-    it falls back rather than loading the runtime's own copy.
-
-## 0.12.20
-
-### Patch Changes
-
-- 6eef0a0: Bump every dependency to its latest compatible minor/patch across the monorepo.
-- 266e3bc: `#pikku` is a namespace, not a module: one subpath per wiring
-
-  The bare `#pikku` specifier resolved to `.pikku/pikku-types.gen.ts`, a hub that
-  re-exported all twelve wiring leaves with `export *` — undoing the split the
-  leaves exist for, each of which still says so in its own generated header
-  ("HTTP-specific type definitions for tree-shaking optimization"). Reaching that
-  hub put 33 distinct `@pikku/core` subpaths into the module graph, and neither
-  consumer could drop them again: bundlers keep `export *` chains because the app
-  declares no `sideEffects`, and Node and tsx do not tree-shake at all, so an app
-  with no queues still executed `@pikku/core/queue` at boot.
-
-  The hub is gone. An app now imports the leaf the name belongs to —
-  `#pikku/function`, `#pikku/http`, `#pikku/workflow` — and a project's `imports`
-  map declares two patterns, because both resolvers pick the more specific one:
-
-  ```json
-  "#pikku/*.js": "./.pikku/*.ts",
-  "#pikku/*": "./.pikku/*/index.ts"
-  ```
-
-  A source tree names the `.ts` on both. Webpack, esbuild and Bun all rewrite a
-  `.js` specifier to the `.ts` beside it for a relative import but not for an
-  imports-map target, so a `.js` target there resolves to a file that does not
-  exist. The two places that keep `.js` are the ones where it is the real file: a
-  published addon, whose map points into `dist`, and a project that imports a
-  declaration-only generated file such as `pikku-rpc-wirings-map.gen.d.ts`, where
-  naming the `.js` lets the type resolver's own mapping reach the `.d.ts`.
-
-  `pikku` generates the leaf indexes and removes the hub, and `pikku validate`
-  reports a barrel import as an error. The split also turns the addon boundary
-  from advice into a rule: an addon never generates the wiring leaves, so
-  `#pikku/http` fails at the specifier rather than yielding "no exported member"
-  from a hub that quietly dropped the re-export.
-
-## 0.12.19
-
-### Patch Changes
-
-- a7fcd2e: Declare dependencies that were imported but missing from `package.json`
-
-  `@pikku/openapi-parser` and `@pikku/better-auth` imported `zod`, `@pikku/next`
-  imported `path-to-regexp`, `@pikku/cli` imported `kysely`, and
-  `@pikku/assistant-ui` imported `rxjs`, none of which were declared. Each
-  resolved through Yarn hoisting inside the monorepo and would fail for anyone
-  installing the package on its own.
-
-  `rxjs`, `kysely` and `path-to-regexp` reach consumers through public
-  signatures — `Observable<BaseEvent>` is the return type of a published method,
-  and `createCoercionPlugin` returns a `KyselyPlugin` — so they are runtime
-  dependencies rather than build-only ones.
-
-  `@pikku/assistant-ui` pins `rxjs` to the exact `7.8.1` that `@ag-ui/client`
-  pins, rather than a caret range. The two packages exchange `Observable`s, so a
-  range that floats to a second copy gives them two incompatible `Observable`
-  types.
-
-  `@pikku/kysely` also drops `SqliteSerializePlugin`, an alias of
-  `SerializePlugin` that has been marked `@deprecated` in favour of it. Use
-  `SerializePlugin`.
-
-## 0.12.18
-
-### Patch Changes
-
-- fd9d834: Stop publishing internals that only their own package or file used. The declarations stay; only the entrypoint re-export is removed, so nothing that imported a name from where it is declared is affected.
-
-## 0.12.17
-
-### Patch Changes
-
-- a7b26c5: rename the inspected declarations to `define*`: `wireScope` → `defineScope`, `wireSecret` → `defineSecret`, `wireVariable` → `defineVariable`, `wireCredential` → `defineCredential`
-
-  `wire*` meant two unrelated things. A transport wiring attaches a function to
-  something that can invoke it — `wireHTTP`, `wireChannel`, `wireScheduler`,
-  `wireQueueWorker` and the rest — and the thing it wires runs. These four wire
-  nothing: they are no-ops that exist only so the call typechecks, they are
-  tree-shaken out of the build, and their whole job is to be found by the
-  inspector's AST pass and turned into a type union. One word for both left the
-  declaration reading like a registration with a runtime.
-
-  So the vocabulary splits: **`wire*` is a transport, `define*` is an inspected
-  declaration.**
-
-  ```ts
-  import { defineScope } from '@pikku/core/scope'
-  import { defineSecret } from '@pikku/core/secret'
-  import { defineVariable } from '@pikku/core/variable'
-  import { defineCredential } from '@pikku/core/credential'
-
-  defineScope({ admin: { scopes: { invoices: { scopes: { create: {} } } } } })
-  ```
-
-  **Breaking:** no alias is kept. Rename the four call sites; the module subpaths
-  (`@pikku/core/scope`, `/secret`, `/variable`) are unchanged.
-
-  The inspector matches these by identifier text, so a stale `wire*` call is not a
-  type error — it is silently not extracted, and the generated union comes back
-  empty. That fails as "this scope isn't declared" on code that was fine a moment
-  ago, nowhere near the declaration. Grep for the old names rather than trusting a
-  clean build.
-
-  An addon published with `.pikku` output generated before this release re-exports
-  `wireSecret` from `@pikku/core/secret` and will not typecheck against this core
-  until it is rebuilt and republished.
-
-## 0.12.16
-
-### Patch Changes
-
-- 9f0d0eb: Migrate the `--oauth` addon scaffold off `OAuth2Client`. A scaffolded OAuth2
-  addon service used to construct `new OAuth2Client(config, appCredentialSecretId,
-secrets)` and do its own token exchange/refresh — the responsibility better-auth
-  now owns via the credential service. The `pikku new addon --oauth` scaffold (and
-  the OpenAPI `--openapi` generator) now emit a service that receives a ready
-  access token: `services.ts` uses `createWireServices` + `wire.getCredential<{
-accessToken: string }>(name)` and the service does a plain `fetch` with
-  `Authorization: Bearer ${accessToken}`, matching the existing per-user
-  bearer/apikey credential scaffold. With no remaining consumers, `OAuth2Client`
-  (`@pikku/core/oauth2`) and its test are removed; the `./oauth2` export keeps the
-  `OAuth2AppCredential` / `OAuth2Token` types.
-- 8601505: Make `wireCredential` the single source of truth for an addon's OAuth2 config: `pikku-credentials.gen.ts` exports `CREDENTIAL_OAUTH2_CONFIGS`, generated services import from it, the OpenAPI importer emits a `wireCredential`, and the inspector now extracts `oauth2.additionalParams`.
-
-## 0.12.15
-
-### Patch Changes
-
-- 854c342: Fix workspace addon integration: exclude nested pikku projects from inspection (prevents "More than one CoreUserSession/CoreConfig found" when a workspace addon is linked), widen the generated addon service `call()` data param to `unknown` so schema-less function inputs compile, and add `@pikku/inspector` + `@standard-schema/spec` to the generated addon devDependencies so its `.pikku` gen files typecheck.
-
-## 0.12.14
-
-### Patch Changes
-
-- a10e88d: auth-config: new `extraHeaders` field — static headers baked into every generated request (the delegated login call and all proxied service calls), for upstreams that route on a header such as multi-tenant APIs resolving the tenant from `Origin`.
-
-## 0.12.13
-
-### Patch Changes
-
-- 0f3edd3: Support an operator-supplied auth config that overrides/augments a spec's securitySchemes: custom auth header name/format (e.g. a raw token in `authentication:` instead of `Authorization: Bearer`), and a delegated-login descriptor (login path, credential fields, token dot-path, claims mapping from the decoded JWT payload or response body) that emits a self-contained `src/<name>-upstream-auth.ts` `authenticate<Name>Upstream()` for wiring into `@pikku/better-auth`'s `delegatedAuth()` plugin.
-
-## 0.12.12
-
-### Patch Changes
-
-- d97f2a1: Always emit a description for generated addon functions (and their MCP tools). When an OpenAPI operation omits both `description` and `summary` (common), the generator now synthesizes one — a humanized `operationId` (with the `Controller` segment stripped), else `METHOD /path` — instead of emitting none. This removes the "MCP tool is missing a description" warnings and makes `--mcp`-exposed tools usable.
-
-## 0.12.11
-
-### Patch Changes
-
-- 41ce2cb: Upgrade to TypeScript 6 and raise the minimum Node.js version to 22.
-
-  All packages now build against `typescript@^6.0.3` and declare `engines.node >= 22`. Internal tooling (`ts-json-schema-generator`, `zod-to-ts`) was bumped to TypeScript 6-compatible releases.
-
-## 0.12.10
-
-### Patch Changes
-
-- 02fca80: Fix OpenAPI-to-addon codegen robustness across 2521 real-world specs (77% → 97.8% pass rate).
-  - Cycle detection and depth limits in schema generation to prevent stack overflows
-  - Schema partitioning: shared types file for multi-referenced schemas, inline for single-use (fixes crash on large specs)
-  - Topological sort with z.lazy() for circular schema references
-  - Validate default value types and enum membership before emitting .default()
-  - Skip refinements (.min/.max) on incompatible Zod types
-  - Sanitize reserved words and digit-leading names in function/type identifiers
-  - Deduplicate schema names, imports, and object properties
-  - 117 unit tests covering all edge cases
-
-## 0.12.9
-
-### Patch Changes
-
-- 2ce0733: Fix credential services template variable passing, duplicate body/path param collision, and add credentialOverrides to wireAddon.
-
-## 0.12.8
-
-### Patch Changes
-
-- 94ceecd: Fix duplicate property error in generated code when body and path/query/header params share the same name. Skips the body property with a warning.
-
-## 0.12.7
-
-### Patch Changes
-
-- 5dd1996: Fix credentials command crash when state.credentials is undefined, and add --credential flag to `pikku new addon` for per-user credential wiring (apikey, bearer, oauth2).
-
-## 0.12.6
-
-### Patch Changes
-
-- a57ff11: Add Swagger 2.0 support: extract requestBody from body parameters, responseSchema from direct response schema, and component schemas from definitions. Fix duplicate .describe() on request body properties.
-
-## 0.12.5
-
-### Patch Changes
-
-- 8552e18: Don't generate `output: z.void()` for operations without response schemas — omit the field instead
-
-## 0.12.4
-
-### Patch Changes
-
-- e3142ad: Use JSON.stringify for safe interpolation of OpenAPI spec values in generated code to prevent code injection via malicious specs.