@pikku/cli 0.12.104 → 0.12.107

package/dist/src/functions/wirings/console/serialize-console-functions.js

@@ -1,4 +1,4 @@
-export const serializeConsoleFunctions = (pathToPikkuTypes, _pathToAgentTypes, globalHTTPPrefix = '') => {
+export const serializeConsoleFunctions = (leaf, _pathToAgentTypes, globalHTTPPrefix = '') => {
     const schemas = `/**
  * Auto-generated console function schemas
  * Do not edit manually - regenerate with 'npx pikku'
@@ -19,7 +19,9 @@ export const ValueResult = z.object({
 
 export const Success = z.object({ success: z.boolean() })
 `;
-    const functions = `import { pikkuFunc, defineHTTPRoutes, wireHTTPRoutes, ref, wireAddon } from '${pathToPikkuTypes}'
+    const functions = `import { pikkuFunc, ref } from '${leaf('function')}'
+import { wireAddon } from '${leaf('addon')}'
+import { defineHTTPRoutes, wireHTTPRoutes } from '${leaf('http')}'
 import {
   VariableRef,
   SetVariable,
@@ -74,17 +76,31 @@ export const consoleRoutes = defineHTTPRoutes({
       sse: true,
       func: ref('console:streamWorkflowRun'),
     },
+    // A route rather than an RPC because a <video> and an <img> take a URL.
+    // Authenticated even though the group is not: everything else here is
+    // metadata, and these are recordings of an application being used. \`path\`
+    // arrives as a query parameter because an artifact key contains slashes.
+    scenarioArtifact: {
+      route: '/scenario-run/:runId/artifact',
+      method: 'get',
+      auth: true,
+      func: ref('console:getScenarioArtifact'),
+    },
   },
 })
 
+// The console's own root, not \`admin\`: administering the application (users,
+// roles, credentials, the audit trail) is \`@pikku/addon-admin\` under the
+// \`admin\` tree, and the two are granted separately. Addon scopes union with
+// each function's, so this is the floor for reaching the console at all.
 wireAddon({
   name: 'console',
   package: '@pikku/addon-console',
-  scopes: ['admin'],
+  scopes: ['pikku:console'],
   globalSecrets:
     'the console administers secrets an operator names at runtime, so no static declaration can cover them',
   globalCredentials:
-    'the console lists and links credentials across every user, so it cannot be scoped to a declared set',
+    'the console reports whether the caller has connected the OAuth credentials an agent needs, which are declared by other addons',
 })
 wireHTTPRoutes({ basePath: '${globalHTTPPrefix}', routes: { console: consoleRoutes } })
 `;

package/dist/src/functions/wirings/credentials/pikku-command-credentials.d.ts

@@ -1 +1 @@
-export declare const pikkuCredentials: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuCredentials: import("#pikku/function").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/credentials/pikku-command-credentials.js

@@ -1,8 +1,8 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { serializeCredentialsTypes } from './serialize-credentials-types.js';
-import { validateAndBuildCredentialDefinitionsMeta } from '@pikku/core/credential';
+import { validateAndBuildCredentialDefinitionsMeta, } from '@pikku/core/credential';
 export const pikkuCredentials = pikkuSessionlessFunc({
     func: async ({ logger, config, getInspectorState }) => {
         const { credentialsFile, credentialsMetaJsonFile, packageMappings } = config;

package/dist/src/functions/wirings/credentials/serialize-credentials-types.js

@@ -42,7 +42,8 @@ export const serializeCredentialsTypes = ({ definitions, schemaLookup, credentia
         metaEntries.push(`  '${name}': { ${metaParts.join(', ')} }`);
     }
     const imports = [];
-    imports.push(`import { TypedCredentialService as CoreTypedCredentialService, type CredentialMetaInfo } from '@pikku/core/services'`);
+    imports.push(`import { TypedCredentialService as CoreTypedCredentialService } from '@pikku/core/services'
+import type { CredentialMetaInfo } from '@pikku/core/services'`);
     imports.push(`import type { CredentialService } from '@pikku/core/services'`);
     if (oauth2Entries.length > 0) {
         imports.push(`import type { OAuth2CredentialConfig } from '@pikku/core/secret'`);
@@ -70,12 +71,10 @@ ${oauth2Entries.join(',\n')}
         : '';
     return `${imports.join('\n')}
 
-export interface CredentialsMap {
+export type CredentialsMap = {
 ${mapEntries.join('\n')}
 }
 
-export type CredentialName = keyof CredentialsMap
-
 const CREDENTIALS_META: Record<string, CredentialMetaInfo> = {
 ${metaEntries.join(',\n')}
 }

package/dist/src/functions/wirings/emails/pikku-command-emails.d.ts

@@ -1,6 +1,6 @@
 import type { PikkuCLIConfig } from '../../../../types/config.js';
 import type { CLILogger } from '../../../services/cli-logger.service.js';
-export declare const pikkuEmails: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuEmails: import("#pikku/function").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;
 export declare function generateEmailsArtifacts(logger: CLILogger, config: Pick<PikkuCLIConfig, 'outDir'> & {
     emailTemplatesDir?: string;
 }): Promise<true | undefined>;

package/dist/src/functions/wirings/emails/pikku-command-emails.js

@@ -1,7 +1,7 @@
 import { createHash } from 'node:crypto';
 import { readdir, readFile } from 'node:fs/promises';
 import { basename, extname, join } from 'node:path';
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { serializeEmailsModule } from './serialize-emails.js';

package/dist/src/functions/wirings/emails/serialize-emails.js

@@ -29,10 +29,10 @@ ${template.variables
         .join('\n')}
 }
 
-export type EmailTemplateVariables<TName extends EmailTemplateName> =
+type EmailTemplateVariables<TName extends EmailTemplateName> =
   TemplateVariableMap[TName]
 
-export type RenderEmailInput<TName extends EmailTemplateName> = {
+type RenderEmailInput<TName extends EmailTemplateName> = {
   name: TName
   locale?: EmailLocale
   data: EmailTemplateVariables<TName>

package/dist/src/functions/wirings/errors/pikku-command-error-types.d.ts

@@ -0,0 +1 @@
+export declare const pikkuErrorTypes: import("#pikku/function").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/errors/pikku-command-error-types.js

@@ -0,0 +1,17 @@
+import { pikkuVoidFunc } from '#pikku/function';
+import { writeFileInDir } from '../../../utils/file-writer.js';
+import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
+import { serializeErrorTypes } from './serialize-error-types.js';
+export const pikkuErrorTypes = pikkuVoidFunc({
+    func: async ({ logger, config }) => {
+        const { errorTypesFile } = config;
+        const content = serializeErrorTypes();
+        await writeFileInDir(logger, errorTypesFile, content);
+    },
+    middleware: [
+        logCommandInfoAndTime({
+            commandStart: 'Creating error types',
+            commandEnd: 'Created error types',
+        }),
+    ],
+});

package/dist/src/functions/wirings/errors/serialize-error-types.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Generates the error leaf — the file `#pikku/error` resolves to.
+ *
+ * Unlike the wiring leaves there is nothing project-specific to generate: the
+ * catalogue, `PikkuError` and `addError` all come from core as they are. The
+ * leaf exists so an application names one door for every Pikku import it makes,
+ * rather than reaching past `#pikku` into `@pikku/core` for errors alone.
+ */
+export declare const serializeErrorTypes: () => string;

package/dist/src/functions/wirings/errors/serialize-error-types.js

@@ -0,0 +1,16 @@
+/**
+ * Generates the error leaf — the file `#pikku/error` resolves to.
+ *
+ * Unlike the wiring leaves there is nothing project-specific to generate: the
+ * catalogue, `PikkuError` and `addError` all come from core as they are. The
+ * leaf exists so an application names one door for every Pikku import it makes,
+ * rather than reaching past `#pikku` into `@pikku/core` for errors alone.
+ */
+export const serializeErrorTypes = () => {
+    return `/**
+ * Error catalogue — \`#pikku/error\` resolves here.
+ */
+
+export * from '@pikku/core/errors'
+`;
+};

package/dist/src/functions/wirings/functions/pikku-command-addon-types.d.ts

@@ -1,5 +1,5 @@
 type AddonTypesCommandInput = {
     bootstrap?: boolean;
 };
-export declare const pikkuAddonTypes: import("#pikku").PikkuFunctionConfig<AddonTypesCommandInput, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<AddonTypesCommandInput, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<AddonTypesCommandInput, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuAddonTypes: import("#pikku/function").PikkuFunctionConfig<AddonTypesCommandInput, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<AddonTypesCommandInput, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<AddonTypesCommandInput, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;
 export {};

package/dist/src/functions/wirings/functions/pikku-command-addon-types.js

@@ -1,18 +1,30 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
+import { rm } from 'fs/promises';
 import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
 import { checkRequiredTypes } from '../../../utils/check-required-types.js';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
-import { serializeAddonTypes } from './serialize-addon-types.js';
+import { serializeAddonInstallTypes, serializeAddonTypes, } from './serialize-addon-types.js';
 export const pikkuAddonTypes = pikkuSessionlessFunc({
     func: async ({ logger, config, getInspectorState }, input) => {
+        const { addonTypesFile, addonSetupTypesFile, packageMappings, servicesFile, secretsFile, credentialsFile, variablesFile, } = config;
+        // A project is one or the other, so the half it is not keeps no file on
+        // disk. A tree generated before it changed kind still has that file, and
+        // `existsSync` is what decides a leaf is alive — so left behind it would
+        // keep the wrong `#pikku/addon` resolving forever.
+        await rm(config.addon ? addonTypesFile : addonSetupTypesFile, {
+            force: true,
+        });
+        // An application installs addons; an addon package declares itself. Both
+        // halves are static, so the app half needs no inspector pass and is written
+        // on the bootstrap run as readily as on the full one.
         if (!config.addon) {
+            await writeFileInDir(logger, addonTypesFile, serializeAddonInstallTypes());
             return;
         }
-        const { addonTypesFile, packageMappings, servicesFile, secretsFile, credentialsFile, variablesFile, } = config;
         const bootstrap = input?.bootstrap === true;
         if (bootstrap) {
-            await writeFileInDir(logger, addonTypesFile, 'export {}\n');
+            await writeFileInDir(logger, addonSetupTypesFile, 'export {}\n');
             return;
         }
         const visitState = await getInspectorState();
@@ -24,12 +36,12 @@ export const pikkuAddonTypes = pikkuSessionlessFunc({
             throw new Error('Required types not found');
         }
         const configTypeImport = pikkuConfigType
-            ? `import type { ${pikkuConfigType.type} } from '${getFileImportRelativePath(addonTypesFile, pikkuConfigType.typePath, packageMappings)}'`
+            ? `import type { ${pikkuConfigType.type} } from '${getFileImportRelativePath(addonSetupTypesFile, pikkuConfigType.typePath, packageMappings)}'`
             : '// Config type not found, will use fallback';
-        const content = serializeAddonTypes(`import type { ${singletonServicesType.type} } from '${getFileImportRelativePath(addonTypesFile, singletonServicesType.typePath, packageMappings)}'`, singletonServicesType.type, configTypeImport, `import type { RequiredSingletonServices } from '${getFileImportRelativePath(addonTypesFile, servicesFile, packageMappings)}'`, `import { TypedSecretService } from '${getFileImportRelativePath(addonTypesFile, secretsFile, packageMappings)}'`, `import { TypedVariablesService } from '${getFileImportRelativePath(addonTypesFile, variablesFile, packageMappings)}'`, visitState.credentials?.definitions?.length > 0
-            ? `import { TypedCredentialService } from '${getFileImportRelativePath(addonTypesFile, credentialsFile, packageMappings)}'`
+        const content = serializeAddonTypes(`import type { ${singletonServicesType.type} } from '${getFileImportRelativePath(addonSetupTypesFile, singletonServicesType.typePath, packageMappings)}'`, singletonServicesType.type, configTypeImport, `import type { RequiredSingletonServices } from '${getFileImportRelativePath(addonSetupTypesFile, servicesFile, packageMappings)}'`, `import { TypedSecretService } from '${getFileImportRelativePath(addonSetupTypesFile, secretsFile, packageMappings)}'`, `import { TypedVariablesService } from '${getFileImportRelativePath(addonSetupTypesFile, variablesFile, packageMappings)}'`, visitState.credentials?.definitions?.length > 0
+            ? `import { TypedCredentialService } from '${getFileImportRelativePath(addonSetupTypesFile, credentialsFile, packageMappings)}'`
             : null);
-        await writeFileInDir(logger, addonTypesFile, content);
+        await writeFileInDir(logger, addonSetupTypesFile, content);
     },
     middleware: [
         logCommandInfoAndTime({

package/dist/src/functions/wirings/functions/pikku-command-function-types-split.d.ts

@@ -1,7 +1,7 @@
-export declare const pikkuFunctionTypesSplit: import("#pikku").PikkuFunctionConfig<{
+export declare const pikkuFunctionTypesSplit: import("#pikku/function").PikkuFunctionConfig<{
     bootstrap?: boolean;
-}, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{
+}, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<{
     bootstrap?: boolean;
-}, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<{
+}, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<{
     bootstrap?: boolean;
-}, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+}, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/functions/pikku-command-function-types-split.js

@@ -1,14 +1,17 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
 import { checkRequiredTypes } from '../../../utils/check-required-types.js';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { serializeFunctionTypes } from './serialize-function-types.js';
 import { serializeAddonRefs } from './serialize-addon-refs.js';
+import { serializeMiddlewareTypes } from '../middleware/serialize-middleware-types.js';
+import { serializeSetupTypes } from '../setup/serialize-setup-types.js';
+import { serializeAuthGuards } from '../auth/serialize-auth-guards.js';
 export const pikkuFunctionTypesSplit = pikkuSessionlessFunc({
     func: async ({ logger, config, getInspectorState }, data) => {
         const visitState = await getInspectorState(false, true, data?.bootstrap ?? false);
-        const { functionTypesFile, packageMappings, rpcInternalMapDeclarationFile, servicesFile, } = config;
+        const { functionTypesFile, middlewareTypesFile, setupTypesFile, authGuardsFile, packageMappings, rpcInternalMapDeclarationFile, servicesFile, credentialsFile, } = config;
         // Check for required types
         checkRequiredTypes(visitState.filesAndMethodsErrors, {
             userSessionType: true,
@@ -19,10 +22,21 @@ export const pikkuFunctionTypesSplit = pikkuSessionlessFunc({
         if (!userSessionType || !wireServicesType || !singletonServicesType) {
             throw new Error('Required types not found');
         }
+        // The credentials leaf is only written when the project declares at least
+        // one credential, so importing from it unconditionally would emit a broken
+        // import for every project that declares none.
+        const credentialsTypeImport = credentialsFile && visitState.credentials?.definitions.length
+            ? `import type { CredentialsMap } from '${getFileImportRelativePath(functionTypesFile, credentialsFile, packageMappings)}'`
+            : undefined;
         const configTypeImport = pikkuConfigType
             ? `import type { ${pikkuConfigType.type} } from '${getFileImportRelativePath(functionTypesFile, pikkuConfigType.typePath, packageMappings)}'`
             : '// Config type not found, will use fallback';
-        const content = serializeFunctionTypes(`import type { ${userSessionType.type} } from '${getFileImportRelativePath(functionTypesFile, userSessionType.typePath, packageMappings)}'`, userSessionType.type, `import type { ${singletonServicesType.type} } from '${getFileImportRelativePath(functionTypesFile, singletonServicesType.typePath, packageMappings)}'`, singletonServicesType.type, `import type { ${wireServicesType.type} } from '${getFileImportRelativePath(functionTypesFile, wireServicesType.typePath, packageMappings)}'`, wireServicesType.type, `import type { TypedPikkuRPC, FlattenedRPCMap } from '${getFileImportRelativePath(functionTypesFile, rpcInternalMapDeclarationFile, packageMappings)}'`, `import type { RequiredSingletonServices, RequiredWireServices } from '${getFileImportRelativePath(functionTypesFile, servicesFile, packageMappings)}'`, configTypeImport, config.addonName, undefined, typeof config.addon === 'object' ? config.addon?.categories : undefined, `import type { ScopeId } from '${getFileImportRelativePath(functionTypesFile, config.scopesFile, packageMappings)}'`);
+        const content = serializeFunctionTypes(`import type { ${userSessionType.type} } from '${getFileImportRelativePath(functionTypesFile, userSessionType.typePath, packageMappings)}'`, userSessionType.type, `import type { ${singletonServicesType.type} } from '${getFileImportRelativePath(functionTypesFile, singletonServicesType.typePath, packageMappings)}'`, singletonServicesType.type, `import type { ${wireServicesType.type} } from '${getFileImportRelativePath(functionTypesFile, wireServicesType.typePath, packageMappings)}'`, wireServicesType.type, `import type { TypedPikkuRPC, FlattenedRPCMap } from '${getFileImportRelativePath(functionTypesFile, rpcInternalMapDeclarationFile, packageMappings)}'`, `import type { RequiredSingletonServices } from '${getFileImportRelativePath(functionTypesFile, servicesFile, packageMappings)}'`, configTypeImport, getFileImportRelativePath(functionTypesFile, authGuardsFile, packageMappings), undefined, typeof config.addon === 'object' ? config.addon?.categories : undefined, `import type { ScopeId } from '${getFileImportRelativePath(functionTypesFile, config.scopesFile, packageMappings)}'`, credentialsTypeImport, getFileImportRelativePath(functionTypesFile, middlewareTypesFile, packageMappings), { addon: !!config.addon });
+        await writeFileInDir(logger, middlewareTypesFile, serializeMiddlewareTypes(getFileImportRelativePath(middlewareTypesFile, functionTypesFile, packageMappings), config.addonName));
+        await writeFileInDir(logger, setupTypesFile, serializeSetupTypes(getFileImportRelativePath(setupTypesFile, functionTypesFile, packageMappings), pikkuConfigType
+            ? `import type { ${pikkuConfigType.type} } from '${getFileImportRelativePath(setupTypesFile, pikkuConfigType.typePath, packageMappings)}'`
+            : '// Config type not found, will use fallback', pikkuConfigType?.type, `import type { RequiredSingletonServices, RequiredWireServices } from '${getFileImportRelativePath(setupTypesFile, servicesFile, packageMappings)}'`));
+        await writeFileInDir(logger, authGuardsFile, serializeAuthGuards(getFileImportRelativePath(authGuardsFile, functionTypesFile, packageMappings), config.addonName));
         const addonRefs = serializeAddonRefs({
             addonHttp: visitState.exportedContracts.addonHttp,
             addonChannel: visitState.exportedContracts.addonChannel,

package/dist/src/functions/wirings/functions/pikku-command-functions.d.ts

@@ -1 +1 @@
-export declare const pikkuFunctions: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuFunctions: import("#pikku/function").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/functions/pikku-command-functions.js

@@ -1,4 +1,4 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { serializeFunctionImports } from './serialize-function-imports.js';
@@ -27,7 +27,7 @@ export const pikkuFunctions = pikkuSessionlessFunc({
             ? `import metaData from '${jsonImportPath}' with { type: 'json' }`
             : `import metaData from '${jsonImportPath}'`;
         const packageName = config.addonName ? `'${config.addonName}'` : 'null';
-        await writeFileInDir(logger, functionsMetaFile, `import { pikkuState } from '@pikku/core/ecosystem'\nimport type { FunctionsMeta } from '@pikku/core'\n${importStatement}\npikkuState(${packageName}, 'function', 'meta', metaData as FunctionsMeta)`);
+        await writeFileInDir(logger, functionsMetaFile, `import { pikkuState } from '@pikku/core/state'\nimport type { FunctionsMeta } from '@pikku/core/services'\n${importStatement}\npikkuState(${packageName}, 'function', 'meta', metaData as FunctionsMeta)`);
         // For addon packages, register ALL functions (they'll be invoked by consumers)
         // For main packages, only register functions that are invoked via internal RPCs
         const isAddon = !!config.addonName;

package/dist/src/functions/wirings/functions/pikku-command-leaf-indexes.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The entry files a wiring's leaf is reached by. An addon never generates
+ * the wiring leaves, so those indexes are simply absent and `#pikku/http`
+ * fails to resolve rather than resolving to a module missing the export.
+ *
+ * Most leaves have a single entry. `secrets` and `variables` split their definer
+ * from their typed-service map across two generated files, `auth` pairs its
+ * always-written permission surface with a better-auth wrapper only some
+ * projects have, and `setup` holds the application's definers or the addon's —
+ * a project being only ever one kind — so each entry is listed and the index
+ * re-exports whichever of them the project actually generated.
+ */
+export declare const leafEntries: readonly [readonly ["function", readonly ["functionTypesFile"]], readonly ["middleware", readonly ["middlewareTypesFile"]], readonly ["setup", readonly ["setupTypesFile", "addonSetupTypesFile"]], readonly ["error", readonly ["errorTypesFile"]], readonly ["http", readonly ["httpTypesFile"]], readonly ["channel", readonly ["channelsTypesFile"]], readonly ["gateway", readonly ["gatewaysTypesFile"]], readonly ["trigger", readonly ["triggersTypesFile"]], readonly ["scheduler", readonly ["schedulersTypesFile"]], readonly ["queue", readonly ["queueTypesFile"]], readonly ["workflow", readonly ["workflowTypesFile"]], readonly ["scenarios", readonly ["scenarioTypesFile"]], readonly ["mcp", readonly ["mcpTypesFile"]], readonly ["agent", readonly ["agentTypesFile"]], readonly ["cli", readonly ["cliTypesFile"]], readonly ["addon", readonly ["addonTypesFile"]], readonly ["secrets", readonly ["secretTypesFile", "secretsFile"]], readonly ["credentials", readonly ["credentialsFile"]], readonly ["scopes", readonly ["scopeTypesFile"]], readonly ["variables", readonly ["variableTypesFile", "variablesFile"]], readonly ["auth", readonly ["authGuardsFile", "authTypesFile"]]];
+export declare const pikkuLeafIndexes: import("#pikku/function").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/functions/pikku-command-leaf-indexes.js

@@ -0,0 +1,119 @@
+import { pikkuSessionlessFunc } from '#pikku/function';
+import { existsSync } from 'fs';
+import { readdir, rm } from 'fs/promises';
+import { basename, dirname, join } from 'path';
+import { writeFileInDir } from '../../../utils/file-writer.js';
+import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
+import { serializeLeafIndex } from './serialize-leaf-index.js';
+/**
+ * The entry files a wiring's leaf is reached by. An addon never generates
+ * the wiring leaves, so those indexes are simply absent and `#pikku/http`
+ * fails to resolve rather than resolving to a module missing the export.
+ *
+ * Most leaves have a single entry. `secrets` and `variables` split their definer
+ * from their typed-service map across two generated files, `auth` pairs its
+ * always-written permission surface with a better-auth wrapper only some
+ * projects have, and `setup` holds the application's definers or the addon's —
+ * a project being only ever one kind — so each entry is listed and the index
+ * re-exports whichever of them the project actually generated.
+ */
+export const leafEntries = [
+    ['function', ['functionTypesFile']],
+    ['middleware', ['middlewareTypesFile']],
+    ['setup', ['setupTypesFile', 'addonSetupTypesFile']],
+    ['error', ['errorTypesFile']],
+    ['http', ['httpTypesFile']],
+    ['channel', ['channelsTypesFile']],
+    ['gateway', ['gatewaysTypesFile']],
+    ['trigger', ['triggersTypesFile']],
+    ['scheduler', ['schedulersTypesFile']],
+    ['queue', ['queueTypesFile']],
+    ['workflow', ['workflowTypesFile']],
+    ['scenarios', ['scenarioTypesFile']],
+    ['mcp', ['mcpTypesFile']],
+    ['agent', ['agentTypesFile']],
+    ['cli', ['cliTypesFile']],
+    ['addon', ['addonTypesFile']],
+    ['secrets', ['secretTypesFile', 'secretsFile']],
+    ['credentials', ['credentialsFile']],
+    ['scopes', ['scopeTypesFile']],
+    ['variables', ['variableTypesFile', 'variablesFile']],
+    ['auth', ['authGuardsFile', 'authTypesFile']],
+];
+/**
+ * Leaves whose entire content is a wiring an addon has no registry to reach, so
+ * the addon half of the leaf would export nothing at all. They are named rather
+ * than inferred from what is on disk: a project that used to be an application
+ * still has the files an earlier run wrote, which would otherwise keep the leaf
+ * looking alive to `existsSync` forever.
+ */
+const ADDON_RETIRED_LEAVES = new Set(['queue', 'scheduler', 'gateway', 'cli']);
+export const pikkuLeafIndexes = pikkuSessionlessFunc({
+    func: async ({ logger, config }) => {
+        const written = new Set();
+        const retired = [];
+        for (const [leaf, keys] of leafEntries) {
+            const entryFiles = config.addon && ADDON_RETIRED_LEAVES.has(leaf)
+                ? []
+                : keys
+                    .map((key) => config[key])
+                    .filter((entryFile) => Boolean(entryFile && existsSync(entryFile)));
+            if (entryFiles.length === 0) {
+                // A leaf this project stopped generating — the wiring leaves an addon
+                // never gets, most often. Its directory is still full of the files an
+                // earlier run wrote, and tsc compiles every file in the output tree
+                // whether a barrel re-exports it or not, so they have to go with it.
+                retired.push(...keys.map((key) => config[key]).filter(Boolean));
+                continue;
+            }
+            const indexFile = join(dirname(entryFiles[0]), 'index.ts');
+            const entryImportPaths = entryFiles
+                .filter((entryFile) => entryFile !== indexFile)
+                .map((entryFile) => `./${basename(entryFile).replace(/\.ts$/, '.js')}`);
+            if (entryImportPaths.length === 0)
+                continue;
+            await writeFileInDir(logger, indexFile, serializeLeafIndex(leaf, entryImportPaths));
+            written.add(indexFile);
+        }
+        // This command owns the leaf surface outright. An index it did not write is
+        // one whose entry file is gone — a wiring the project stopped generating,
+        // or a directory that was never a leaf — and left in place it keeps
+        // `#pikku/<name>` resolving to a module that no longer compiles.
+        const outDirEntries = existsSync(config.outDir)
+            ? await readdir(config.outDir, { withFileTypes: true })
+            : [];
+        for (const entry of outDirEntries) {
+            if (!entry.isDirectory())
+                continue;
+            const indexFile = join(config.outDir, entry.name, 'index.ts');
+            if (written.has(indexFile) || !existsSync(indexFile))
+                continue;
+            await rm(indexFile, { force: true });
+        }
+        for (const entryFile of retired) {
+            await rm(entryFile, { force: true });
+            await rm(join(dirname(entryFile), 'index.ts'), { force: true });
+        }
+        // `console/pikku-node-types.gen.ts` held only `NodeCategory` and
+        // `NodeRPCName`, which nothing derived from. A project generated before it
+        // was dropped still has the file, and tsc compiles every file in the output
+        // tree whether anything re-exports it or not.
+        await rm(join(config.outDir, 'console', 'pikku-node-types.gen.ts'), {
+            force: true,
+        });
+        // `defineCredential` moved to the auth leaf, next to the permissions and
+        // auth gates it is declared alongside. A project generated before the move
+        // still has the file, and tsc compiles every file in the output tree.
+        await rm(join(config.outDir, 'credentials', 'pikku-credential-types.gen.ts'), { force: true });
+        // The re-export hub every leaf now replaces. A project generated before the
+        // split still has it, and it would keep resolving `#pikku` while pulling in
+        // every wiring's core dependencies.
+        await rm(join(config.outDir, 'pikku-types.gen.ts'), { force: true });
+    },
+    middleware: [
+        logCommandInfoAndTime({
+            commandStart: 'Creating leaf subpath entries',
+            commandEnd: 'Created leaf subpath entries',
+        }),
+    ],
+});

package/dist/src/functions/wirings/functions/pikku-command-services.d.ts

@@ -1,2 +1,2 @@
 export declare const serializeServicesMap: (allSingletonServices: string[], allWireServices: string[], requiredServices: Set<string>, forceRequiredServices: string[] | undefined, servicesImport: string, wireServicesImport: string, addonRequiredParentServices?: string[], authInjected?: boolean, agentScaffoldEnabled?: boolean) => string;
-export declare const pikkuServices: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuServices: import("#pikku/function").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/functions/pikku-command-services.js

@@ -1,4 +1,5 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
+import { ErrorCode } from '@pikku/inspector';
 import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
 import { checkRequiredTypes } from '../../../utils/check-required-types.js';
 import { writeFileInDir } from '../../../utils/file-writer.js';
@@ -116,8 +117,22 @@ export const pikkuServices = pikkuSessionlessFunc({
         if (!wireServicesType || !singletonServicesType) {
             throw new Error('Required types not found: wireServicesType or singletonServicesType');
         }
-        const servicesImport = `import type { ${singletonServicesType.type} } from '${getFileImportRelativePath(config.typesDeclarationFile, singletonServicesType.typePath, config.packageMappings)}'`;
-        const wireServicesImport = `import type { ${wireServicesType.type} } from '${getFileImportRelativePath(config.typesDeclarationFile, wireServicesType.typePath, config.packageMappings)}'`;
+        // `SingletonServices` always carries the framework's own singletons, so an
+        // empty list is never a project with no services — it is the inspector's
+        // program failing to resolve the type, usually because a `#pikku/*` leaf it
+        // imports does not exist yet. Written out, every service becomes optional in
+        // `RequiredSingletonServices`, and the failure resurfaces as dozens of
+        // unrelated "possibly undefined" errors in files nobody touched.
+        if (visitState.serviceAggregation.allSingletonServices.length === 0) {
+            throw new Error(`[${ErrorCode.SINGLETON_SERVICES_TYPE_UNRESOLVED}] '${singletonServicesType.type}' resolved to no services at all, which means it did not resolve.\n` +
+                `Declared in ${singletonServicesType.typePath}.\n\n` +
+                'This is usually a stale or partial generated tree: a source file imports a ' +
+                '`#pikku/*` leaf that the current output no longer writes, so the type it ' +
+                'feeds resolves to an error type. Delete the output directory and re-run to ' +
+                'rebuild it from scratch.');
+        }
+        const servicesImport = `import type { ${singletonServicesType.type} } from '${getFileImportRelativePath(config.servicesFile, singletonServicesType.typePath, config.packageMappings)}'`;
+        const wireServicesImport = `import type { ${wireServicesType.type} } from '${getFileImportRelativePath(config.servicesFile, wireServicesType.typePath, config.packageMappings)}'`;
         const servicesCode = serializeServicesMap(visitState.serviceAggregation.allSingletonServices, visitState.serviceAggregation.allWireServices, visitState.serviceAggregation.requiredServices, config.forceRequiredServices, servicesImport, wireServicesImport, config.addonName ? visitState.addonRequiredParentServices : [], Boolean(visitState.auth?.definition), Boolean(config.scaffold?.agent));
         await writeFileInDir(logger, config.servicesFile, servicesCode);
     },

package/dist/src/functions/wirings/functions/schemas.d.ts

@@ -1 +1 @@
-export declare const pikkuSchemas: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuSchemas: import("#pikku/function").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/functions/schemas.js

@@ -1,4 +1,4 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { saveSchemas } from '../../../utils/serialize-schemas.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { partitionRequiredSchemas } from '../scenarios/scenario-schema-partition.js';

package/dist/src/functions/wirings/functions/serialize-addon-types.d.ts

@@ -1 +1,14 @@
+/**
+ * The install side of `#pikku/addon`, written for an application rather than an
+ * addon. Installing an addon and authoring one are the same concept approached
+ * from opposite ends, and a project is only ever one of the two — but they
+ * cannot share a tree, because a runtime template maps `#pikku/*` onto a
+ * sibling package through tsconfig `paths`, and `paths` are global to a tsx
+ * process rather than scoped to the package that declared them. A linked
+ * addon's leaves would otherwise resolve against the host application's, so an
+ * addon generates its whole tree one level down and authors against
+ * `#pikku/addon/<leaf>` — a depth at which an application has nothing to match,
+ * leaving the resolver to fall back to Node's per-package `imports`.
+ */
+export declare const serializeAddonInstallTypes: () => string;
 export declare const serializeAddonTypes: (singletonServicesTypeImport: string, singletonServicesTypeName: string, configTypeImport: string, requiredServicesTypeImport: string, typedSecretServiceImport: string, typedVariablesServiceImport: string, typedCredentialServiceImport?: string | null) => string;

package/dist/src/functions/wirings/functions/serialize-addon-types.js

@@ -1,9 +1,28 @@
+/**
+ * The install side of `#pikku/addon`, written for an application rather than an
+ * addon. Installing an addon and authoring one are the same concept approached
+ * from opposite ends, and a project is only ever one of the two — but they
+ * cannot share a tree, because a runtime template maps `#pikku/*` onto a
+ * sibling package through tsconfig `paths`, and `paths` are global to a tsx
+ * process rather than scoped to the package that declared them. A linked
+ * addon's leaves would otherwise resolve against the host application's, so an
+ * addon generates its whole tree one level down and authors against
+ * `#pikku/addon/<leaf>` — a depth at which an application has nothing to match,
+ * leaving the resolver to fall back to Node's per-package `imports`.
+ */
+export const serializeAddonInstallTypes = () => `/**
+ * Installing an addon into this application
+ */
+
+export { wireAddon, wireRemoteAddon } from '@pikku/core/addon'
+`;
 export const serializeAddonTypes = (singletonServicesTypeImport, singletonServicesTypeName, configTypeImport, requiredServicesTypeImport, typedSecretServiceImport, typedVariablesServiceImport, typedCredentialServiceImport = null) => {
     return `/**
  * Addon package types for pikkuAddonConfig and pikkuAddonServices
  */
 
-import type { CreateConfig, PikkuWire } from '@pikku/core'
+import type { CreateConfig } from '@pikku/core/types'
+import type { PikkuWire } from '@pikku/core/types'
 ${singletonServicesTypeImport}
 ${configTypeImport}
 ${requiredServicesTypeImport}

package/dist/src/functions/wirings/functions/serialize-function-imports.d.ts

@@ -1,4 +1,4 @@
-import type { FunctionsMeta } from '@pikku/core';
+import type { FunctionsMeta } from '@pikku/core/services';
 export declare const serializeFunctionImports: (outputPath: string, functionsMap: Map<string, {
     path: string;
     exportedName: string;

package/dist/src/functions/wirings/functions/serialize-function-types.d.ts

@@ -1,4 +1,9 @@
 /**
- * Generates core function, middleware, and permission type definitions
+ * Generates the function authoring surface — the definers every wiring points
+ * at and the types they are written against. Middleware, permissions and the
+ * bootstrap factories used to live here too; each is its own decision taken at
+ * its own time, so each is now its own leaf.
  */
-export declare const serializeFunctionTypes: (userSessionTypeImport: string, userSessionTypeName: string, singletonServicesTypeImport: string, singletonServicesTypeName: string, wireServicesTypeImport: string, wireServicesTypeName: string, rpcMapTypeImport: string, requiredServicesTypeImport: string, configTypeImport: string, packageName?: string, workflowTypesImport?: string, nodeCategories?: string[], scopesTypeImport?: string) => string;
+export declare const serializeFunctionTypes: (userSessionTypeImport: string, userSessionTypeName: string, singletonServicesTypeImport: string, singletonServicesTypeName: string, wireServicesTypeImport: string, wireServicesTypeName: string, rpcMapTypeImport: string, requiredServicesTypeImport: string, configTypeImport: string, authTypesImportPath?: string, workflowTypesImport?: string, nodeCategories?: string[], scopesTypeImport?: string, credentialsTypeImport?: string, middlewareTypesImportPath?: string, { addon }?: {
+    addon?: boolean;
+}) => string;