@pikku/cli 0.12.104 → 0.12.107

package/dist/src/functions/wirings/auth/serialize-auth-guards.js

@@ -0,0 +1,168 @@
+/**
+ * Generates the authorization surface — who may call a function, and the
+ * credentials a call is made with. Permissions and auth gates were on the
+ * function leaf, where they sat next to the definers as if writing a function
+ * meant deciding who could reach it; they are a separate decision, taken once
+ * and reused across wirings, so they are a separate import.
+ *
+ * `PikkuPermission` is declared here rather than beside the function config that
+ * references it; that config imports it back, which is a type-only edge and
+ * carries no runtime cycle.
+ */
+export const serializeAuthGuards = (functionTypesImportPath, packageName) => {
+    const packageNameValue = packageName ? `'${packageName}'` : 'null';
+    return `/**
+ * Permission, auth gate and credential definitions
+ */
+
+import type { PikkuWire, SecretlessServices } from '@pikku/core/types'
+import type {
+  CorePermissionGroup,
+  CorePikkuAuth,
+  CorePikkuAuthConfig,
+  CorePikkuPermission,
+} from '@pikku/core/function'
+import { pikkuAuth as pikkuAuthCore } from '@pikku/core/function'
+import { addGlobalPermission as addGlobalPermissionCore } from '@pikku/core/middleware'
+import type {
+  Services,
+  Session,
+  SingletonServices,
+  WiredServices,
+  WiredSingletonServices,
+} from '${functionTypesImportPath}'
+
+export { defineCredential } from '@pikku/core/credential'
+
+/** \`WiredSingletonServices\` without \`secrets\`, for auth gates. */
+type WiredAuthServices = SecretlessServices<WiredSingletonServices>
+
+/**
+ * Type-safe API permission definition that integrates with your application's session type.
+ * Use this to define authorization logic for your API endpoints.
+ *
+ * @template In - The input type that the permission check will receive
+ * @template RequiredServices - The services required for this permission check
+ */
+export type PikkuPermission<In = unknown, RequiredServices extends SecretlessServices<Services> = WiredServices> = CorePikkuPermission<In, RequiredServices, PikkuWire<In, never, false, Session>>
+
+/**
+ * Configuration object for creating a permission with metadata
+ */
+type PikkuPermissionConfig<In = unknown, RequiredServices extends SecretlessServices<Services> = WiredServices> = {
+  /** The permission function */
+  func: PikkuPermission<In, RequiredServices>
+  /** Optional human-readable name for the permission */
+  name?: string
+  /** Optional description of what the permission checks */
+  description?: string
+}
+
+/**
+ * Factory function for creating permissions with tree-shaking support.
+ * Supports both direct function and configuration object syntax.
+ *
+ * @example
+ * \`\`\`typescript
+ * // Direct function syntax
+ * const permission = pikkuPermission(async ({ logger }, data, { session }) => {
+ *   const session = await session?.get()
+ *   return session?.role === 'admin'
+ * })
+ *
+ * // Configuration object syntax with metadata
+ * const adminPermission = pikkuPermission({
+ *   name: 'Admin Permission',
+ *   description: 'Checks if user has admin role',
+ *   func: async ({ logger }, data, { session }) => {
+ *     const session = await session?.get()
+ *     return session?.role === 'admin'
+ *   }
+ * })
+ * \`\`\`
+ */
+export const pikkuPermission = <In>(
+  permission: PikkuPermission<In> | PikkuPermissionConfig<In>
+): PikkuPermission<In> => {
+  return typeof permission === 'function' ? permission : permission.func
+}
+
+/**
+ * Type-safe auth-only permission that only needs services and session.
+ * Use this for upfront authorization gates (MCP tools, AI agents, workflows)
+ * where request data isn't available yet.
+ *
+ * @template RequiredServices - The services required for this auth check
+ */
+type PikkuAuth<RequiredServices extends SecretlessServices<SingletonServices> = WiredAuthServices> = CorePikkuAuth<RequiredServices, Session>
+
+/**
+ * Configuration object for creating an auth permission with metadata
+ */
+type PikkuAuthConfig<RequiredServices extends SecretlessServices<SingletonServices> = WiredAuthServices> = CorePikkuAuthConfig<RequiredServices, Session>
+
+/**
+ * Factory function for creating auth-only permissions with tree-shaking support.
+ * Auth permissions only receive services and session (no request data),
+ * making them evaluable before request data is available.
+ *
+ * @example
+ * \\\`\\\`\\\`typescript
+ * const isAuthenticated = pikkuAuth(async ({ logger }, session) => {
+ *   return !!session
+ * })
+ *
+ * const isAdmin = pikkuAuth({
+ *   name: 'Admin Auth',
+ *   description: 'Checks if user is an admin',
+ *   func: async ({ logger }, session) => {
+ *     return session?.role === 'admin'
+ *   }
+ * })
+ * \\\`\\\`\\\`
+ */
+export const pikkuAuth = <RequiredServices extends SecretlessServices<SingletonServices> = WiredAuthServices>(
+  auth: PikkuAuth<RequiredServices> | PikkuAuthConfig<RequiredServices>
+): PikkuPermission<any, any> => {
+  return pikkuAuthCore(auth as any) as any
+}
+
+/**
+ * Factory function for creating permission factories
+ * Use this when your permission needs configuration/input parameters
+ *
+ * @example
+ * \`\`\`typescript
+ * export const requireRole = pikkuPermissionFactory<{ role: string }>(({
+ *   role
+ * }) => {
+ *   return pikkuPermission(async ({ logger }, data, { session }) => {
+ *     if (!session || session.role !== role) {
+ *       logger.warn(\`Permission denied: required role '\${role}'\`)
+ *       return false
+ *     }
+ *     return true
+ *   })
+ * })
+ * \`\`\`
+ */
+export const pikkuPermissionFactory = <In = any>(
+  factory: (input: In) => PikkuPermission<any>
+): ((input: In) => PikkuPermission<any>) => {
+  return factory
+}
+
+/**
+ * Wire-agnostic global permissions. Runs at the top of every wiring's
+ * permission resolution — before wire-, tag-, and function-level entries.
+ *
+ * Resolution order: global -> wire -> tag -> function.
+ *
+ * @example
+ * addGlobalPermission([signedInUser])
+ */
+export const addGlobalPermission = <In = unknown>(permissions: CorePermissionGroup<PikkuPermission<In>> | PikkuPermission<In>[]) => {
+  addGlobalPermissionCore(permissions as any, ${packageNameValue})
+}
+`;
+};

package/dist/src/functions/wirings/auth/serialize-auth-types.d.ts

@@ -4,7 +4,7 @@
  * `SingletonServices` type for the generic `CoreSingletonServices`. This lets
  * users write:
  *
- *   import { pikkuBetterAuth } from '#pikku'
+ *   import { pikkuBetterAuth } from '#pikku/auth'
  *
  * and get proper autocomplete on the factory's `services` param (e.g.
  * `(services) => betterAuth({ database: { db: services.kysely } })` types
@@ -23,13 +23,13 @@
  * with no inline `getSecrets<{ ... }>()` generic, because the secret types flow
  * from the generated `CredentialsMap`.
  *
- * The file is re-exported from `.pikku/pikku-types.gen.ts` (the `#pikku` hub)
- * so the single import resolves correctly.
+ * The file is the `#pikku/auth` leaf's entry, so a project imports it as
+ * `#pikku/auth` and gets nothing else.
  */
 /**
  * A minimal `auth.types.ts` written during bootstrap (before the inspector has
  * run, so the typed wrapper above can't be built yet). It re-exports the raw
- * `pikkuBetterAuth` so `import { pikkuBetterAuth } from '#pikku'` resolves while
+ * `pikkuBetterAuth` so `import { pikkuBetterAuth } from '#pikku/auth'` resolves while
  * codegen is still in its bootstrap state — otherwise the first full inspect (or
  * a standalone `pikku db generate`) crashes importing the user's auth file with
  * "does not provide an export named 'pikkuBetterAuth'". The typed wrapper from

package/dist/src/functions/wirings/auth/serialize-auth-types.js

@@ -5,7 +5,7 @@ import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
  * `SingletonServices` type for the generic `CoreSingletonServices`. This lets
  * users write:
  *
- *   import { pikkuBetterAuth } from '#pikku'
+ *   import { pikkuBetterAuth } from '#pikku/auth'
  *
  * and get proper autocomplete on the factory's `services` param (e.g.
  * `(services) => betterAuth({ database: { db: services.kysely } })` types
@@ -24,13 +24,13 @@ import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
  * with no inline `getSecrets<{ ... }>()` generic, because the secret types flow
  * from the generated `CredentialsMap`.
  *
- * The file is re-exported from `.pikku/pikku-types.gen.ts` (the `#pikku` hub)
- * so the single import resolves correctly.
+ * The file is the `#pikku/auth` leaf's entry, so a project imports it as
+ * `#pikku/auth` and gets nothing else.
  */
 /**
  * A minimal `auth.types.ts` written during bootstrap (before the inspector has
  * run, so the typed wrapper above can't be built yet). It re-exports the raw
- * `pikkuBetterAuth` so `import { pikkuBetterAuth } from '#pikku'` resolves while
+ * `pikkuBetterAuth` so `import { pikkuBetterAuth } from '#pikku/auth'` resolves while
  * codegen is still in its bootstrap state — otherwise the first full inspect (or
  * a standalone `pikku db generate`) crashes importing the user's auth file with
  * "does not provide an export named 'pikkuBetterAuth'". The typed wrapper from

package/dist/src/functions/wirings/channels/pikku-channels.d.ts

@@ -1 +1 @@
-export declare const pikkuChannels: import("#pikku").PikkuFunctionSessionlessConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices, unknown>, undefined, undefined>;
+export declare const pikkuChannels: import("#pikku/function").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/channels/pikku-channels.js

@@ -1,4 +1,4 @@
-import { pikkuVoidFunc } from '#pikku';
+import { pikkuVoidFunc } from '#pikku/function';
 import { serializeFileImports } from '../../../utils/file-imports-serializer.js';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
@@ -26,7 +26,7 @@ export const pikkuChannels = pikkuVoidFunc({
             const importStatement = supportsImportAttributes
                 ? `import metaData from '${jsonImportPath}' with { type: 'json' }`
                 : `import metaData from '${jsonImportPath}'`;
-            await writeFileInDir(logger, channelsWiringMetaFile, `import { pikkuState } from '@pikku/core/ecosystem'\nimport { ChannelsMeta } from '@pikku/core/channel'\n${importStatement}\npikkuState(null, 'channel', 'meta', metaData as ChannelsMeta)`);
+            await writeFileInDir(logger, channelsWiringMetaFile, `import { pikkuState } from '@pikku/core/state'\nimport { ChannelsMeta } from '@pikku/core/channel'\n${importStatement}\npikkuState(null, 'channel', 'meta', metaData as ChannelsMeta)`);
         }
     },
     middleware: [

package/dist/src/functions/wirings/channels/pikku-command-channel-types.d.ts

@@ -1 +1 @@
-export declare const pikkuChannelTypes: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuChannelTypes: import("#pikku/function").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/channels/pikku-command-channel-types.js

@@ -1,13 +1,16 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { serializeChannelTypes } from './serialize-channel-types.js';
 export const pikkuChannelTypes = pikkuSessionlessFunc({
     func: async ({ logger, config }) => {
-        const { channelsTypesFile, functionTypesFile, packageMappings, addonName } = config;
+        const { channelsTypesFile, functionTypesFile, middlewareTypesFile, packageMappings, } = config;
         const functionTypesImportPath = getFileImportRelativePath(channelsTypesFile, functionTypesFile, packageMappings);
-        const content = serializeChannelTypes(functionTypesImportPath, addonName);
+        const middlewareTypesImportPath = getFileImportRelativePath(channelsTypesFile, middlewareTypesFile, packageMappings);
+        const content = serializeChannelTypes(functionTypesImportPath, middlewareTypesImportPath, getFileImportRelativePath(channelsTypesFile, config.authGuardsFile, packageMappings), {
+            addon: !!config.addon,
+        });
         await writeFileInDir(logger, channelsTypesFile, content);
     },
     middleware: [

package/dist/src/functions/wirings/channels/pikku-command-channels-map.d.ts

@@ -1 +1 @@
-export declare const pikkuChannelsMap: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuChannelsMap: import("#pikku/function").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/channels/pikku-command-channels-map.js

@@ -1,4 +1,4 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { serializeTypedChannelsMap } from './serialize-typed-channel-map.js';

package/dist/src/functions/wirings/channels/pikku-command-channels.d.ts

@@ -1 +1 @@
-export declare const pikkuCommandChannels: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuCommandChannels: import("#pikku/function").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/channels/pikku-command-channels.js

@@ -1,4 +1,4 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { serializeFileImports } from '../../../utils/file-imports-serializer.js';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
@@ -41,7 +41,7 @@ export const pikkuCommandChannels = pikkuSessionlessFunc({
         const importStatement = supportsImportAttributes
             ? `import metaData from '${jsonImportPath}' with { type: 'json' }`
             : `import metaData from '${jsonImportPath}'`;
-        await writeFileInDir(logger, channelsWiringMetaFile, `import { pikkuState } from '@pikku/core/ecosystem'\nimport type { ChannelsMeta } from '@pikku/core/channel'\n${importStatement}\npikkuState(null, 'channel', 'meta', metaData as ChannelsMeta)`);
+        await writeFileInDir(logger, channelsWiringMetaFile, `import { pikkuState } from '@pikku/core/state'\nimport type { ChannelsMeta } from '@pikku/core/channel'\n${importStatement}\npikkuState(null, 'channel', 'meta', metaData as ChannelsMeta)`);
         return true;
     },
     middleware: [

package/dist/src/functions/wirings/channels/serialize-channel-types.d.ts

@@ -1,4 +1,6 @@
 /**
  * Generates type definitions for WebSocket channel wirings
  */
-export declare const serializeChannelTypes: (functionTypesImportPath: string, packageName?: string) => string;
+export declare const serializeChannelTypes: (functionTypesImportPath: string, middlewareTypesImportPath: string, authTypesImportPath: string, { addon }?: {
+    addon?: boolean;
+}) => string;

package/dist/src/functions/wirings/channels/serialize-channel-types.js

@@ -1,16 +1,20 @@
 /**
  * Generates type definitions for WebSocket channel wirings
  */
-export const serializeChannelTypes = (functionTypesImportPath, packageName) => {
-    const packageNameValue = packageName ? `'${packageName}'` : 'null';
+export const serializeChannelTypes = (functionTypesImportPath, middlewareTypesImportPath, authTypesImportPath, { addon = false } = {}) => {
     return `/**
  * Channel-specific type definitions for tree-shaking optimization
  */
 
-import { CoreChannel, CorePikkuChannelMiddleware, CorePikkuChannelMiddlewareFactory, wireChannel as wireChannelCore, defineChannelRoutes as defineChannelRoutesCore, addChannelMiddleware as addChannelMiddlewareCore } from '@pikku/core/channel'
-import { AssertHTTPWiringParams } from '@pikku/core/http'
-import type { PikkuFunctionConfig, PikkuFunctionSessionless, PikkuPermission, PikkuMiddleware, Services } from '${functionTypesImportPath}'
-import type { CorePermissionGroup } from '@pikku/core'
+import { ${addon ? '' : 'wireChannel as wireChannelCore, '}defineChannelRoutes as defineChannelRoutesCore } from '@pikku/core/channel'
+${addon
+        ? ''
+        : `import {
+  CoreChannel,
+} from '@pikku/core/channel'\n`}${addon ? '' : `import { AssertHTTPWiringParams } from '@pikku/core/http'\n`}import type { PikkuFunctionConfig, PikkuFunctionSessionless } from '${functionTypesImportPath}'
+import type { PikkuPermission } from '${authTypesImportPath}'
+import type { PikkuMiddleware } from '${middlewareTypesImportPath}'
+import type { CorePermissionGroup } from '@pikku/core/function'
 import type { StandardSchemaV1 } from '@standard-schema/spec'
 
 /**
@@ -18,7 +22,9 @@ import type { StandardSchemaV1 } from '@standard-schema/spec'
  */
 type InferSchemaOutput<T> = T extends StandardSchemaV1<any, infer Output> ? Output : never
 
-/**
+${addon
+        ? ''
+        : `/**
  * Type definition for WebSocket channels with typed data exchange.
  * Supports connection, disconnection, and message handling.
  * Accepts both session-based (PikkuFunction) and sessionless (PikkuFunctionSessionless) functions.
@@ -35,6 +41,7 @@ type ChannelWiring<ChannelData, Channel extends string> = CoreChannel<
   PikkuPermission,
   PikkuMiddleware
 >
+`}
 
 /**
  * Creates a function that handles WebSocket channel connections.
@@ -136,7 +143,9 @@ export function pikkuChannelFunc(func: any) {
   return typeof func === 'function' ? { func } : func
 }
 
-/**
+${addon
+        ? ''
+        : `/**
  * Registers a WebSocket channel with the Pikku framework.
  *
  * @template ChannelData - Type of data associated with the channel
@@ -148,7 +157,7 @@ export const wireChannel = <ChannelData, Channel extends string>(
 ) => {
   wireChannelCore(channel as any)
 }
-
+`}
 /**
  * Type-safe helper for defining channel message routes that can be composed.
  * Returns the routes record as-is for use with wireChannel's onMessageWiring.
@@ -161,21 +170,6 @@ export function defineChannelRoutes<T extends Record<string, any>>(routes: T): T
   return defineChannelRoutesCore(routes)
 }
 
-export type PikkuChannelMiddleware<RequiredServices extends Services = Services, Event = unknown> = CorePikkuChannelMiddleware<RequiredServices, Event>
-
-export const pikkuChannelMiddleware = <RequiredServices extends Services = Services, Event = unknown>(
-  middleware: PikkuChannelMiddleware<RequiredServices, Event>
-): PikkuChannelMiddleware<RequiredServices, Event> => {
-  return middleware
-}
-
-export const pikkuChannelMiddlewareFactory = <In = any>(
-  factory: CorePikkuChannelMiddlewareFactory<In>
-): CorePikkuChannelMiddlewareFactory<In> => {
-  return factory
-}
 
-export const addChannelMiddleware = (tag: string, middleware: PikkuChannelMiddleware[]) =>
-  addChannelMiddlewareCore(tag, middleware, ${packageNameValue})
 `;
 };

package/dist/src/functions/wirings/channels/serialize-typed-channel-map.d.ts

@@ -1,5 +1,4 @@
 import type { ChannelsMeta } from '@pikku/core/channel';
 import type { TypesMap } from '@pikku/inspector';
-import type { FunctionsMeta } from '@pikku/core';
-import type { Logger } from '@pikku/core/services';
+import type { FunctionsMeta, Logger } from '@pikku/core/services';
 export declare const serializeTypedChannelsMap: (logger: Logger, relativeToPath: string, packageMappings: Record<string, string>, typesMap: TypesMap, functionsMeta: FunctionsMeta, addonFunctions: Record<string, FunctionsMeta>, channelsMeta: ChannelsMeta, rpcInternalMapDeclarationFile: string) => string;

package/dist/src/functions/wirings/cli/pikku-command-cli-entry.d.ts

@@ -1 +1 @@
-export declare const pikkuCLIEntry: import("#pikku").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuCLIEntry: import("#pikku/function").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/cli/pikku-command-cli-entry.js

@@ -1,4 +1,4 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { checkRequiredTypes } from '../../../utils/check-required-types.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
@@ -57,7 +57,7 @@ export const pikkuCLIEntry = pikkuSessionlessFunc({
                             `Move it to a source directory like "src/wirings/cli-channel.gen.ts".`);
                     }
                     const channelWireFile = resolvedWirePath;
-                    const channelCode = serializeChannelCLI(programName, programMeta, channelWireFile, visitState.functions.files, config.packageMappings, config.channelsTypesFile, config.functionTypesFile, channelName, channelRoute, config.globalHTTPPrefix || '', visitState.rpc?.wireAddonDeclarations);
+                    const channelCode = serializeChannelCLI(programName, programMeta, channelWireFile, visitState.functions.files, config.packageMappings, config.channelsTypesFile, config.functionTypesFile, config.middlewareTypesFile, channelName, channelRoute, config.globalHTTPPrefix || '', visitState.rpc?.wireAddonDeclarations);
                     await writeFileInDir(logger, channelWireFile, channelCode);
                     channelWireGenerated = true;
                     logger.debug(`Serialized CLI channel for ${programName}: ${channelWireFile}`);

package/dist/src/functions/wirings/cli/pikku-command-cli-types.d.ts

@@ -1,5 +1,5 @@
 type CLITypesCommandInput = {
     bootstrap?: boolean;
 };
-export declare const pikkuCLITypes: import("#pikku").PikkuFunctionConfig<CLITypesCommandInput, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<CLITypesCommandInput, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<CLITypesCommandInput, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuCLITypes: import("#pikku/function").PikkuFunctionConfig<CLITypesCommandInput, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<CLITypesCommandInput, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<CLITypesCommandInput, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;
 export {};

package/dist/src/functions/wirings/cli/pikku-command-cli-types.js

@@ -1,4 +1,4 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
@@ -10,7 +10,7 @@ export const pikkuCLITypes = pikkuSessionlessFunc({
         const bootstrap = input?.bootstrap === true;
         // In bootstrap mode we only need filesAndMethods (userSession/singleton
         // services types) — skip schema generation. Full mode would dynamic-import
-        // pikku-types.gen.ts, which re-exports the not-yet-written cli-types file.
+        // the not-yet-written cli-types file through '#pikku/cli'.
         const visitState = bootstrap
             ? await getInspectorState(false, true, true)
             : await getInspectorState();
@@ -25,7 +25,7 @@ export const pikkuCLITypes = pikkuSessionlessFunc({
         if (!userSessionType || !singletonServicesType) {
             throw new Error('Required types not found');
         }
-        const content = serializeCLITypes(functionTypesImportPath, `import type { ${userSessionType.type} } from '${getFileImportRelativePath(cliTypesFile, userSessionType.typePath, packageMappings)}'`, userSessionType.type, `import type { ${singletonServicesType.type} } from '${getFileImportRelativePath(cliTypesFile, singletonServicesType.typePath, packageMappings)}'`, singletonServicesType.type);
+        const content = serializeCLITypes(functionTypesImportPath, getFileImportRelativePath(cliTypesFile, config.middlewareTypesFile, packageMappings), `import type { ${userSessionType.type} } from '${getFileImportRelativePath(cliTypesFile, userSessionType.typePath, packageMappings)}'`, userSessionType.type, `import type { ${singletonServicesType.type} } from '${getFileImportRelativePath(cliTypesFile, singletonServicesType.typePath, packageMappings)}'`, singletonServicesType.type);
         await writeFileInDir(logger, cliTypesFile, content);
     },
     middleware: [

package/dist/src/functions/wirings/cli/pikku-command-cli.d.ts

@@ -1 +1 @@
-export declare const pikkuCLI: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuCLI: import("#pikku/function").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/cli/pikku-command-cli.js

@@ -1,4 +1,4 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { serializeFileImports } from '../../../utils/file-imports-serializer.js';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
@@ -41,7 +41,7 @@ export const pikkuCLI = pikkuSessionlessFunc({
         const importStatement = supportsImportAttributes
             ? `import metaData from '${jsonImportPath}' with { type: 'json' }`
             : `import metaData from '${jsonImportPath}'`;
-        await writeFileInDir(logger, cliWiringMetaFile, `import { pikkuState } from '@pikku/core/ecosystem'\nimport { CLIMeta } from '@pikku/core/cli'\n${importStatement}\npikkuState(null, 'cli', 'meta', metaData as CLIMeta)`);
+        await writeFileInDir(logger, cliWiringMetaFile, `import { pikkuState } from '@pikku/core/state'\nimport { CLIMeta } from '@pikku/core/cli'\n${importStatement}\npikkuState(null, 'cli', 'meta', metaData as CLIMeta)`);
         return true;
     },
     middleware: [

package/dist/src/functions/wirings/cli/serialize-channel-cli.d.ts

@@ -9,5 +9,5 @@ type WireAddonDeclarations = Map<string, {
 export declare function serializeChannelCLI(programName: string, programMeta: CLIProgramMeta, channelFile: string, functionFiles: Map<string, {
     path: string;
     exportedName: string;
-}>, packageMappings: Record<string, string>, channelTypesFile: string, functionTypesFile: string, channelName?: string, channelRoute?: string, globalHTTPPrefix?: string, wireAddonDeclarations?: WireAddonDeclarations): string;
+}>, packageMappings: Record<string, string>, channelTypesFile: string, functionTypesFile: string, middlewareTypesFile: string, channelName?: string, channelRoute?: string, globalHTTPPrefix?: string, wireAddonDeclarations?: WireAddonDeclarations): string;
 export {};

package/dist/src/functions/wirings/cli/serialize-channel-cli.js

@@ -3,7 +3,7 @@ import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
  * Serializes a wireChannel call from CLI metadata
  * This creates a WebSocket backend for all CLI commands
  */
-export function serializeChannelCLI(programName, programMeta, channelFile, functionFiles, packageMappings, channelTypesFile, functionTypesFile, channelName, channelRoute, globalHTTPPrefix = '', wireAddonDeclarations) {
+export function serializeChannelCLI(programName, programMeta, channelFile, functionFiles, packageMappings, channelTypesFile, functionTypesFile, middlewareTypesFile, channelName, channelRoute, globalHTTPPrefix = '', wireAddonDeclarations) {
     const packageToNamespace = new Map();
     if (wireAddonDeclarations) {
         for (const [namespace, decl] of wireAddonDeclarations.entries()) {
@@ -54,14 +54,20 @@ export function serializeChannelCLI(programName, programMeta, channelFile, funct
     const channelTypesPath = getFileImportRelativePath(channelFile, channelTypesFile, packageMappings);
     // Get relative path to function types file
     const functionTypesPath = getFileImportRelativePath(channelFile, functionTypesFile, packageMappings);
+    const middlewareTypesPath = getFileImportRelativePath(channelFile, middlewareTypesFile, packageMappings);
     return `/**
  * WebSocket channel backend for '${programName}' CLI commands
  */
 import { wireChannel } from '${channelTypesPath}'
-import { pikkuMiddleware${hasAddonFuncs ? ', ref' : ''}, pikkuSessionlessFunc } from '${functionTypesPath}'
+import { ${hasAddonFuncs ? 'ref, ' : ''}pikkuSessionlessFunc } from '${functionTypesPath}'
+import { pikkuMiddleware } from '${middlewareTypesPath}'
 import { generateCommandHelp } from '@pikku/core/cli'
 import { handleRawCLI, type RawCLIFrame } from '@pikku/core/cli/channel'
-import { pikkuState, getSingletonServices, getCreateWireServices } from '@pikku/core/ecosystem'
+import {
+  pikkuState,
+  getSingletonServices,
+  getCreateWireServices,
+} from '@pikku/core/state'
 ${imports}
 
 // Middleware to close the channel after CLI command completes

package/dist/src/functions/wirings/cli/serialize-cli-types.d.ts

@@ -1,4 +1,4 @@
 /**
  * Generates type definitions for CLI wirings
  */
-export declare const serializeCLITypes: (functionTypesImportPath: string, userSessionTypeImport: string, userSessionTypeName: string, singletonServicesTypeImport: string, singletonServicesTypeName: string) => string;
+export declare const serializeCLITypes: (functionTypesImportPath: string, middlewareTypesImportPath: string, userSessionTypeImport: string, userSessionTypeName: string, singletonServicesTypeImport: string, singletonServicesTypeName: string) => string;

package/dist/src/functions/wirings/cli/serialize-cli-types.js

@@ -1,14 +1,20 @@
 /**
  * Generates type definitions for CLI wirings
  */
-export const serializeCLITypes = (functionTypesImportPath, userSessionTypeImport, userSessionTypeName, singletonServicesTypeImport, singletonServicesTypeName) => {
+export const serializeCLITypes = (functionTypesImportPath, middlewareTypesImportPath, userSessionTypeImport, userSessionTypeName, singletonServicesTypeImport, singletonServicesTypeName) => {
     return `/**
 
  * CLI-specific type definitions for tree-shaking optimization
  */
 
-import { CoreCLI, wireCLI as wireCLICore, CorePikkuCLIRender, CoreCLICommandConfig, defineCLICommands as defineCLICommandsCore } from '@pikku/core/cli'
-import type { PikkuFunctionConfig, PikkuMiddleware } from '${functionTypesImportPath}'
+import { wireCLI as wireCLICore, defineCLICommands as defineCLICommandsCore } from '@pikku/core/cli'
+import {
+  CoreCLI,
+  CorePikkuCLIRender,
+  CoreCLICommandConfig,
+} from '@pikku/core/cli'
+import type { PikkuFunctionConfig } from '${functionTypesImportPath}'
+import type { PikkuMiddleware } from '${middlewareTypesImportPath}'
 ${userSessionTypeImport}
 ${singletonServicesTypeImport}
 

package/dist/src/functions/wirings/console/pikku-command-console-functions.d.ts

@@ -1 +1 @@
-export declare const pikkuConsoleFunctions: import("#pikku").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuConsoleFunctions: import("#pikku/function").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/console/pikku-command-console-functions.js

@@ -1,14 +1,15 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
+import { getLeafImportPath } from '../../../utils/leaf-import-path.js';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { projectDeclaresBetterAuth } from '../../../utils/detect-better-auth.js';
 import { removeLegacyScaffoldFile } from '../../../utils/remove-legacy-scaffold-file.js';
 import { serializeConsoleFunctions } from './serialize-console-functions.js';
+import { isDeployCodegen } from '../../../utils/is-deploy-codegen.js';
 export const pikkuConsoleFunctions = pikkuSessionlessFunc({
     func: async ({ logger, config, variables }) => {
-        const deployCodegenFlag = await variables.get('PIKKU_DEPLOY_CODEGEN');
-        if (deployCodegenFlag === '1') {
+        if (await isDeployCodegen(variables)) {
             return false;
         }
         if (config.scaffold?.console && config.consoleSchemasFile) {
@@ -24,9 +25,9 @@ export const pikkuConsoleFunctions = pikkuSessionlessFunc({
                     `Fix: set up Better Auth (add a pikkuBetterAuth(...) config) before scaffolding the console, ` +
                     `or remove "scaffold.console" from pikku.config.json.`);
             }
-            const pathToPikkuTypes = getFileImportRelativePath(config.consoleFunctionsFile, config.typesDeclarationFile, config.packageMappings);
+            const leaf = (name) => getLeafImportPath(config.consoleFunctionsFile, name, config);
             const pathToAgentTypes = getFileImportRelativePath(config.consoleFunctionsFile, config.agentTypesFile, config.packageMappings);
-            const { schemas, functions } = serializeConsoleFunctions(pathToPikkuTypes, pathToAgentTypes, config.globalHTTPPrefix || '');
+            const { schemas, functions } = serializeConsoleFunctions(leaf, pathToAgentTypes, config.globalHTTPPrefix || '');
             await writeFileInDir(logger, config.consoleSchemasFile, schemas);
             await writeFileInDir(logger, config.consoleFunctionsFile, functions);
             await removeLegacyScaffoldFile(config.consoleFunctionsFile);

package/dist/src/functions/wirings/console/pikku-command-nodes-meta.d.ts

@@ -1 +1 @@
-export declare const pikkuNodesMeta: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuNodesMeta: import("#pikku/function").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/console/pikku-command-nodes-meta.js

@@ -1,4 +1,4 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { ErrorCode } from '@pikku/inspector';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';

package/dist/src/functions/wirings/console/serialize-console-functions.d.ts

@@ -2,4 +2,4 @@ export interface ConsoleGenOutput {
     schemas: string;
     functions: string;
 }
-export declare const serializeConsoleFunctions: (pathToPikkuTypes: string, _pathToAgentTypes: string, globalHTTPPrefix?: string) => ConsoleGenOutput;
+export declare const serializeConsoleFunctions: (leaf: (name: string) => string, _pathToAgentTypes: string, globalHTTPPrefix?: string) => ConsoleGenOutput;