@pikku/cli 0.12.104 → 0.12.107

package/dist/src/functions/wirings/triggers/pikku-command-trigger.js

@@ -1,4 +1,4 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { serializeFileImports } from '../../../utils/file-imports-serializer.js';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';

package/dist/src/functions/wirings/triggers/serialize-trigger-meta.js

@@ -6,7 +6,7 @@ export const serializeTriggerMetaTS = (triggerMeta, jsonImportPath, supportsImpo
         ? `import metaData from '${jsonImportPath}' with { type: 'json' }`
         : `import metaData from '${jsonImportPath}'`;
     const serializedOutput = [];
-    serializedOutput.push("import { pikkuState } from '@pikku/core/ecosystem'");
+    serializedOutput.push("import { pikkuState } from '@pikku/core/state'");
     serializedOutput.push("import { TriggerMeta } from '@pikku/core/trigger'");
     serializedOutput.push(importStatement);
     serializedOutput.push('');
@@ -26,7 +26,7 @@ export const serializeTriggerSourceMetaTS = (sourceMeta, jsonImportPath, support
         ? `import metaData from '${jsonImportPath}' with { type: 'json' }`
         : `import metaData from '${jsonImportPath}'`;
     const serializedOutput = [];
-    serializedOutput.push("import { pikkuState } from '@pikku/core/ecosystem'");
+    serializedOutput.push("import { pikkuState } from '@pikku/core/state'");
     serializedOutput.push("import { TriggerSourceMeta } from '@pikku/core/trigger'");
     serializedOutput.push(importStatement);
     serializedOutput.push('');

package/dist/src/functions/wirings/triggers/serialize-trigger-types.d.ts

@@ -1,4 +1,6 @@
 /**
  * Generates type definitions for trigger wirings
  */
-export declare const serializeTriggerTypes: (singletonServicesTypeImport: string, singletonServicesTypeName: string) => string;
+export declare const serializeTriggerTypes: (singletonServicesTypeImport: string, singletonServicesTypeName: string, { addon }?: {
+    addon?: boolean;
+}) => string;

package/dist/src/functions/wirings/triggers/serialize-trigger-types.js

@@ -1,12 +1,15 @@
 /**
  * Generates type definitions for trigger wirings
  */
-export const serializeTriggerTypes = (singletonServicesTypeImport, singletonServicesTypeName) => {
+export const serializeTriggerTypes = (singletonServicesTypeImport, singletonServicesTypeName, { addon = false } = {}) => {
     return `/**
  * Trigger-specific type definitions for tree-shaking optimization
  */
 
-import { CorePikkuTriggerFunction, CorePikkuTriggerFunctionConfig, CoreTrigger, wireTrigger as wireTriggerCore, wireTriggerSource as wireTriggerSourceCore } from '@pikku/core/trigger'
+${addon ? '' : `import { wireTrigger as wireTriggerCore, wireTriggerSource as wireTriggerSourceCore } from '@pikku/core/trigger'\n`}import {
+  CorePikkuTriggerFunction,
+  CorePikkuTriggerFunctionConfig,${addon ? '' : `\n  CoreTrigger,`}
+} from '@pikku/core/trigger'
 import type { CoreNodeConfig } from '@pikku/core/node'
 ${singletonServicesTypeImport}
 import type { StandardSchemaV1 } from '@standard-schema/spec'
@@ -20,7 +23,7 @@ ${singletonServicesTypeName !== 'SingletonServices' ? `type SingletonServices =
  * @template TInput - Input type (configuration passed when wired)
  * @template TOutput - Output type produced when trigger fires
  */
-export type PikkuTriggerFunction<
+type PikkuTriggerFunction<
   TInput = unknown,
   TOutput = unknown
 > = CorePikkuTriggerFunction<TInput, TOutput, SingletonServices>
@@ -28,7 +31,7 @@ export type PikkuTriggerFunction<
 /**
  * Configuration object for creating a trigger function with metadata
  */
-export type PikkuTriggerFunctionConfig<
+type PikkuTriggerFunctionConfig<
   TInput = unknown,
   TOutput = unknown,
   InputSchema extends StandardSchemaV1 | undefined = undefined,
@@ -45,7 +48,7 @@ type InferSchemaOutput<T> = T extends StandardSchemaV1<any, infer Output> ? Outp
  * Use this when you want to define input/output schemas using Zod.
  * Types are automatically inferred from the schemas.
  */
-export type PikkuTriggerFunctionConfigWithSchema<
+type PikkuTriggerFunctionConfigWithSchema<
   InputSchema extends StandardSchemaV1,
   OutputSchema extends StandardSchemaV1 | undefined = undefined
 > = {
@@ -65,22 +68,23 @@ export type PikkuTriggerFunctionConfigWithSchema<
  * Type definition for trigger wirings.
  * Declares a trigger name and its target pikku function.
  */
-export type TriggerWiring = CoreTrigger
-
-/**
+${addon ? '' : `type TriggerWiring = CoreTrigger\n`}
+${addon
+        ? ''
+        : `/**
  * A trigger source with the subscription function, using project-specific services.
  *
  * @template TInput - Input type passed to the trigger function
  * @template TOutput - Output type produced when trigger fires
  */
-export type TriggerSource<
+type TriggerSource<
   TInput = unknown,
   TOutput = unknown
 > = {
   name: string
   func: PikkuTriggerFunctionConfig<TInput, TOutput>
 } & (unknown extends TInput ? { input?: TInput } : { input: TInput })
-
+`}
 /**
  * Creates a trigger function configuration.
  * Use this to define trigger functions that set up subscriptions.
@@ -134,6 +138,9 @@ export function pikkuTriggerFunc(triggerOrConfig: any) {
   return triggerOrConfig
 }
 
+${addon
+        ? ''
+        : `
 /**
  * Registers a trigger with the Pikku framework.
  * Declares a trigger name and its target pikku function.
@@ -159,5 +166,5 @@ export const wireTriggerSource = <TInput = unknown, TOutput = unknown>(
 ) => {
   wireTriggerSourceCore(source as any)
 }
-`;
+`}`;
 };

package/dist/src/functions/wirings/user-admin/pikku-command-user-admin-functions.d.ts

@@ -1 +1 @@
-export declare const pikkuUserAdminFunctions: import("#pikku").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuUserAdminFunctions: import("#pikku/function").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/user-admin/pikku-command-user-admin-functions.js

@@ -1,5 +1,5 @@
-import { pikkuSessionlessFunc } from '#pikku';
-import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
+import { pikkuSessionlessFunc } from '#pikku/function';
+import { getLeafImportPath } from '../../../utils/leaf-import-path.js';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { serializeUserAdminFunctions } from './serialize-user-admin-functions.js';
@@ -16,27 +16,28 @@ export const pikkuUserAdminFunctions = pikkuSessionlessFunc({
             return false;
         }
         const { definition } = (await getInspectorState()).auth;
-        // These functions are thin wrappers over better-auth's admin() endpoints.
-        // Without that plugin the endpoints do not exist, so the scaffold would
-        // generate four RPCs that throw on every call and four scopes that grant
-        // nothing. Fail the codegen instead of shipping that.
+        // Every one of these functions drives better-auth's internal adapter, so
+        // without a better-auth instance the scaffold would generate RPCs that
+        // throw on every call and scopes that grant nothing. Fail the codegen
+        // instead of shipping that.
         if (!definition) {
             throw new Error(`"scaffold.userAdmin" is enabled but no pikkuBetterAuth(...) was found in the project.\n` +
-                `User management wraps better-auth's admin() endpoints, so there is nothing to wrap.\n` +
+                `User management works through better-auth's internal adapter, so there is nothing to manage.\n` +
                 `Fix: set up Better Auth before scaffolding user management, or remove ` +
                 `"scaffold.userAdmin" from pikku.config.json.`);
         }
-        if (!definition.plugins.includes('admin')) {
-            throw new Error(`"scaffold.userAdmin" is enabled but better-auth is configured without the admin() plugin.\n` +
-                `Ban, delete, session-revocation and set-password are implemented by that plugin — without it ` +
-                `the generated functions would fail on every call.\n` +
-                `Fix: add admin() to the plugins array in ${definition.sourceFile}:\n` +
-                `  import { admin } from 'better-auth/plugins'\n` +
-                `  betterAuth({ plugins: [admin()] })\n` +
-                `Then re-run codegen. Or remove "scaffold.userAdmin" from pikku.config.json.`);
+        // Ban is the one capability with a schema requirement of its own, and it is
+        // only one of the six — a warning rather than a failure, so an app that
+        // never bans anyone is not forced to carry the columns.
+        if (!definition.plugins.includes('ban')) {
+            logger.warn(`"scaffold.userAdmin" is enabled but better-auth is configured without the ban() plugin, ` +
+                `so the banned/banReason/banExpires columns do not exist and setUserBanned will fail.\n` +
+                `Fix: add ban() to the plugins array in ${definition.sourceFile}:\n` +
+                `  import { ban } from '@pikku/better-auth'\n` +
+                `  betterAuth({ plugins: [ban()] })`);
         }
-        const pathToPikkuTypes = getFileImportRelativePath(config.userAdminFunctionsFile, config.typesDeclarationFile, config.packageMappings);
-        const { schemas, functions } = serializeUserAdminFunctions(pathToPikkuTypes, resolveScaffoldFeature('userAdmin', config.scaffold.userAdmin).auth);
+        const leaf = (name) => getLeafImportPath(config.userAdminFunctionsFile, name, config);
+        const { schemas, functions } = serializeUserAdminFunctions(leaf, resolveScaffoldFeature('userAdmin', config.scaffold.userAdmin).auth);
         await writeFileInDir(logger, config.userAdminSchemasFile, schemas);
         await writeFileInDir(logger, config.userAdminFunctionsFile, functions);
         return true;

package/dist/src/functions/wirings/user-admin/serialize-user-admin-functions.d.ts

@@ -4,16 +4,17 @@ export interface UserAdminGenOutput {
 }
 /**
  * Generate the user-management functions into the project scaffold: the
- * directory read plus the writes that wrap better-auth's `admin()` endpoints.
+ * directory read plus the writes that administer it.
  *
- * Scaffolded rather than shipped in an addon because managing users is ordinary
- * application behaviour: an app should not have to install the console — which
- * exists to be served alongside a running dev server — just to list or ban its
- * own users. The console UI calls these same functions when it is present.
+ * Superseded by `@pikku/addon-admin`, which ships these same functions plus
+ * roles, credentials and the audit trail, and which an app can wire without
+ * installing the console. Kept for hosts still on the scaffold; the scope tree
+ * below must stay byte-identical to the addon's, or an app with both fails
+ * codegen on conflicting declarations.
  *
- * Each function is gated on its own `admin:users:*` scope. The writes are only
- * meaningful where `admin()` is wired, which is why this file is generated only
- * in that case.
+ * Each function is gated on its own `admin:users:*` scope, and works through
+ * better-auth's internal adapter. Banning additionally needs the `ban()` plugin
+ * from `@pikku/better-auth` for the columns it writes to exist.
  *
  * Emitted as two files. The schemas are zod, and the inspector reads a zod
  * schema by importing the module that declares it — which it cannot do for the
@@ -21,4 +22,4 @@ export interface UserAdminGenOutput {
  * rewrites. Keeping the schemas in a sibling module that imports nothing but
  * zod sidesteps that entirely.
  */
-export declare const serializeUserAdminFunctions: (pathToPikkuTypes: string, requireAuth?: boolean) => UserAdminGenOutput;
+export declare const serializeUserAdminFunctions: (leaf: (name: string) => string, requireAuth?: boolean) => UserAdminGenOutput;

package/dist/src/functions/wirings/user-admin/serialize-user-admin-functions.js

@@ -1,15 +1,16 @@
 /**
  * Generate the user-management functions into the project scaffold: the
- * directory read plus the writes that wrap better-auth's `admin()` endpoints.
+ * directory read plus the writes that administer it.
  *
- * Scaffolded rather than shipped in an addon because managing users is ordinary
- * application behaviour: an app should not have to install the console — which
- * exists to be served alongside a running dev server — just to list or ban its
- * own users. The console UI calls these same functions when it is present.
+ * Superseded by `@pikku/addon-admin`, which ships these same functions plus
+ * roles, credentials and the audit trail, and which an app can wire without
+ * installing the console. Kept for hosts still on the scaffold; the scope tree
+ * below must stay byte-identical to the addon's, or an app with both fails
+ * codegen on conflicting declarations.
  *
- * Each function is gated on its own `admin:users:*` scope. The writes are only
- * meaningful where `admin()` is wired, which is why this file is generated only
- * in that case.
+ * Each function is gated on its own `admin:users:*` scope, and works through
+ * better-auth's internal adapter. Banning additionally needs the `ban()` plugin
+ * from `@pikku/better-auth` for the columns it writes to exist.
  *
  * Emitted as two files. The schemas are zod, and the inspector reads a zod
  * schema by importing the module that declares it — which it cannot do for the
@@ -17,7 +18,7 @@
  * rewrites. Keeping the schemas in a sibling module that imports nothing but
  * zod sidesteps that entirely.
  */
-export const serializeUserAdminFunctions = (pathToPikkuTypes, requireAuth = true) => {
+export const serializeUserAdminFunctions = (leaf, requireAuth = true) => {
     const authFlag = requireAuth ? 'true' : 'false';
     const schemas = `/**
  * Auto-generated user management schemas
@@ -27,9 +28,9 @@ import { z } from 'zod'
 
 /**
  * A user, as the directory sees one. Ban state is optional because those
- * columns belong to better-auth's \`admin()\` plugin: a host without it reports
- * no ban state at all, which a client can render as "unknown" rather than as a
- * misleading "not banned".
+ * columns belong to the \`ban()\` plugin: a host without it reports no ban state
+ * at all, which a client can render as "unknown" rather than as a misleading
+ * "not banned".
  */
 export const User = z.object({
   id: z.string(),
@@ -86,8 +87,15 @@ export const Success = z.object({
  * Auto-generated user management functions
  * Do not edit manually - regenerate with 'npx pikku'
  */
-import { pikkuFunc, defineScope } from '${pathToPikkuTypes}'
-import { callAdminApi } from '@pikku/better-auth'
+import { pikkuFunc } from '${leaf('function')}'
+import { defineScope } from '${leaf('scopes')}'
+import {
+  createAuthUser,
+  deleteAuthUser,
+  revokeAuthUserSessions,
+  setAuthUserBanned,
+  setAuthUserPassword,
+} from '@pikku/better-auth'
 import {
   CreateUserInput,
   CreateUserOutput,
@@ -102,7 +110,7 @@ import {
 // pikku requires every declaration of a shared scope root to be identical, so
 // this is the whole \`admin\` tree — not just the leaves gated below. It must stay
 // byte-identical to ADMIN_SCOPE_TREE in @pikku/better-auth and to the copy in
-// @pikku/addon-console, or codegen fails with conflicting declarations.
+// @pikku/addon-admin, or codegen fails with conflicting declarations.
 defineScope({
   admin: {
     displayName: 'Administration',
@@ -113,6 +121,8 @@ defineScope({
         description: 'Application-wide credentials',
         scopes: {
           link: { description: 'Bind a shared credential for every user' },
+          read: { description: 'Read credential values and who holds them' },
+          manage: { description: 'Set and delete credentials' },
         },
       },
       users: {
@@ -126,6 +136,27 @@ defineScope({
           password: { description: "Set a user's password" },
         },
       },
+      scopes: {
+        description: 'Authorization management',
+        scopes: {
+          read: {
+            description: 'View declared scopes, roles, and who holds them',
+          },
+          manage: {
+            description:
+              'Create and delete roles, change their scopes, and grant roles to users',
+          },
+        },
+      },
+      audit: {
+        description: 'The audit trail',
+        scopes: {
+          read: {
+            description:
+              'Read the audit trail — every recorded action, and which user took it',
+          },
+        },
+      },
     },
   },
 })
@@ -142,7 +173,7 @@ export const pikkuAdminListUsers = pikkuFunc({
   tags: ['pikku'],
   title: 'List Users',
   description:
-    'Lists and searches the user directory, read through the auth adapter rather than an admin endpoint so it works on any database better-auth supports.',
+    'Lists and searches the user directory, read through the auth adapter so it works on any database better-auth supports.',
   expose: true,
   auth: ${authFlag},
   scopes: ['admin:users:list'],
@@ -181,28 +212,22 @@ export const pikkuAdminCreateUser = pikkuFunc({
   tags: ['pikku'],
   title: 'Create User',
   description:
-    'Creates a user directly, for provisioning an account out of band rather than through your sign-up flow. better-auth enforces the configured password bounds and rejects a duplicate email.',
+    'Creates a user directly, for provisioning an account out of band rather than through your sign-up flow. Enforces the configured password bounds and rejects a duplicate email.',
   expose: true,
   auth: ${authFlag},
   scopes: ['admin:users:create'],
   input: CreateUserInput,
   output: CreateUserOutput,
-  func: async ({ auth }, { email, password, name }, { http }) => {
-    const created: any = await callAdminApi(auth, http, (api, headers) =>
-      api.createUser!({
-        body: { email, password, name: name ?? email },
-        headers,
-      })
-    )
-    return { userId: created?.user?.id ?? created?.id }
-  },
+  func: async ({ auth }, { email, password, name }) => ({
+    userId: await createAuthUser(auth, { email, password, name }),
+  }),
 })
 
 export const pikkuAdminSetUserBanned = pikkuFunc({
   tags: ['pikku'],
   title: 'Ban or Unban User',
   description:
-    'Bans a user — revoking their sessions and blocking sign-in — or lifts an existing ban. An expiry lets the ban lapse on its own; without one it holds until it is lifted.',
+    'Bans a user — revoking their sessions and blocking sign-in — or lifts an existing ban. An expiry lets the ban lapse on its own; without one it holds until it is lifted. Requires better-auth wired with the \`ban()\` plugin.',
   expose: true,
   auth: ${authFlag},
   scopes: ['admin:users:ban'],
@@ -211,16 +236,12 @@ export const pikkuAdminSetUserBanned = pikkuFunc({
   func: async (
     { auth },
     { userId, banned, reason, expiresInSeconds },
-    { http }
+    { session }
   ) => {
-    await callAdminApi(auth, http, (api, headers) =>
-      banned
-        ? api.banUser!({
-            body: { userId, banReason: reason, banExpiresIn: expiresInSeconds },
-            headers,
-          })
-        : api.unbanUser!({ body: { userId }, headers })
-    )
+    if (banned && userId === session?.userId) {
+      throw new Error('You cannot ban yourself')
+    }
+    await setAuthUserBanned(auth, { userId, banned, reason, expiresInSeconds })
     return { success: true }
   },
 })
@@ -235,10 +256,11 @@ export const pikkuAdminRemoveUser = pikkuFunc({
   scopes: ['admin:users:remove'],
   input: UserRef,
   output: Success,
-  func: async ({ auth }, { userId }, { http }) => {
-    await callAdminApi(auth, http, (api, headers) =>
-      api.removeUser!({ body: { userId }, headers })
-    )
+  func: async ({ auth }, { userId }, { session }) => {
+    if (userId === session?.userId) {
+      throw new Error('You cannot delete yourself')
+    }
+    await deleteAuthUser(auth, userId)
     return { success: true }
   },
 })
@@ -253,10 +275,8 @@ export const pikkuAdminRevokeUserSessions = pikkuFunc({
   scopes: ['admin:users:sessions'],
   input: UserRef,
   output: Success,
-  func: async ({ auth }, { userId }, { http }) => {
-    await callAdminApi(auth, http, (api, headers) =>
-      api.revokeUserSessions!({ body: { userId }, headers })
-    )
+  func: async ({ auth }, { userId }) => {
+    await revokeAuthUserSessions(auth, userId)
     return { success: true }
   },
 })
@@ -265,16 +285,14 @@ export const pikkuAdminSetUserPassword = pikkuFunc({
   tags: ['pikku'],
   title: "Set User's Password",
   description:
-    'Sets a user password out of band, for when they cannot complete a reset themselves. better-auth enforces the configured length bounds.',
+    'Sets a user password out of band, for when they cannot complete a reset themselves. Enforces the configured length bounds, and gives a user who only ever signed in socially a credential account.',
   expose: true,
   auth: ${authFlag},
   scopes: ['admin:users:password'],
   input: SetUserPasswordInput,
   output: Success,
-  func: async ({ auth }, { userId, newPassword }, { http }) => {
-    await callAdminApi(auth, http, (api, headers) =>
-      api.setUserPassword!({ body: { userId, newPassword }, headers })
-    )
+  func: async ({ auth }, { userId, newPassword }) => {
+    await setAuthUserPassword(auth, { userId, newPassword })
     return { success: true }
   },
 })

package/dist/src/functions/wirings/variables/pikku-command-variables.d.ts

@@ -1 +1 @@
-export declare const pikkuVariables: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuVariables: import("#pikku/function").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/variables/pikku-command-variables.js

@@ -1,4 +1,4 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { serializeVariablesTypes } from './serialize-variables-types.js';

package/dist/src/functions/wirings/variables/serialize-variables-types.js

@@ -29,10 +29,19 @@ export const serializeVariablesTypes = ({ definitions, schemaLookup, variablesFi
         }
     }
     const imports = [];
-    imports.push(`import { TypedVariablesService as CoreTypedVariablesService, type VariableMeta } from '@pikku/core/services'`);
+    imports.push(`import {
+  TypedVariablesService as CoreTypedVariablesService,
+  type VariableMeta,
+} from '@pikku/core/services'`);
     imports.push(`import type { VariablesService } from '@pikku/core/services'`);
-    imports.push(`import type { VariableDefinitionsMeta } from '@pikku/core/variable'`);
-    imports.push(`import variablesMeta from './pikku-variables-meta.gen.json' with { type: 'json' }`);
+    imports.push(`/**
+ * Side-effect import of the metadata sidecar, so that tsc emits the .json
+ * alongside this file. An addon publishes only its compiled output, and a host
+ * reads that .json off disk to discover the addon's declared variables — an
+ * uncopied sidecar leaves them invisible to the host. Nothing binds it: the
+ * sidecar is not part of \`#pikku/variables\`.
+ */
+import './pikku-variables-meta.gen.json' with { type: 'json' }`);
     if (needsZod) {
         imports.push(`import type { z } from 'zod'`);
     }
@@ -43,23 +52,10 @@ export const serializeVariablesTypes = ({ definitions, schemaLookup, variablesFi
     }
     return `${imports.join('\n')}
 
-/**
- * Every variable declared in this package.
- *
- * Read from the metadata sidecar rather than inlined, so that the import above
- * forces tsc to emit the .json alongside this file. An addon publishes only its
- * compiled output, and a host reads that .json to discover the addon's declared
- * variables — an uncopied sidecar leaves them invisible to the host.
- */
-export const VARIABLES_META: VariableDefinitionsMeta =
-  variablesMeta as VariableDefinitionsMeta
-
 export interface VariablesMap {
 ${mapEntries.join('\n')}
 }
 
-export type VariableId = keyof VariablesMap
-
 const TYPED_VARIABLES_META: Record<string, VariableMeta> = {
 ${metaEntries.join(',\n')}
 }

package/dist/src/functions/wirings/virtual-user/pikku-command-virtual-user-functions.d.ts

@@ -1 +1 @@
-export declare const pikkuVirtualUserFunctions: import("#pikku").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuVirtualUserFunctions: import("#pikku/function").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/virtual-user/pikku-command-virtual-user-functions.js

@@ -1,5 +1,6 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
+import { getLeafImportPath } from '../../../utils/leaf-import-path.js';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { serializeVirtualUserFunctions } from './serialize-virtual-user-functions.js';
@@ -26,9 +27,9 @@ export const pikkuVirtualUserFunctions = pikkuSessionlessFunc({
                 `Fix: declare one with definePersonas({ ... }), or remove ` +
                 `"scaffold.virtualUser" from pikku.config.json.`);
         }
-        const pathToPikkuTypes = getFileImportRelativePath(config.virtualUserFunctionsFile, config.typesDeclarationFile, config.packageMappings);
+        const leaf = (name) => getLeafImportPath(config.virtualUserFunctionsFile, name, config);
         const pathToPersonas = getFileImportRelativePath(config.virtualUserFunctionsFile, config.personasWiringFile, config.packageMappings);
-        const { schemas, functions } = serializeVirtualUserFunctions(pathToPikkuTypes, pathToPersonas, resolveScaffoldFeature('virtualUser', config.scaffold.virtualUser).auth);
+        const { schemas, functions } = serializeVirtualUserFunctions(leaf, pathToPersonas, resolveScaffoldFeature('virtualUser', config.scaffold.virtualUser).auth);
         await writeFileInDir(logger, config.virtualUserSchemasFile, schemas);
         await writeFileInDir(logger, config.virtualUserFunctionsFile, functions);
         return true;

package/dist/src/functions/wirings/virtual-user/serialize-virtual-user-functions.d.ts

@@ -25,4 +25,4 @@ export interface VirtualUserGenOutput {
  * rewrites. Keeping the schemas in a sibling module that imports nothing but
  * zod sidesteps that entirely.
  */
-export declare const serializeVirtualUserFunctions: (pathToPikkuTypes: string, pathToPersonas: string, requireAuth?: boolean) => VirtualUserGenOutput;
+export declare const serializeVirtualUserFunctions: (leaf: (name: string) => string, pathToPersonas: string, requireAuth?: boolean) => VirtualUserGenOutput;

package/dist/src/functions/wirings/virtual-user/serialize-virtual-user-functions.js

@@ -21,7 +21,7 @@
  * rewrites. Keeping the schemas in a sibling module that imports nothing but
  * zod sidesteps that entirely.
  */
-export const serializeVirtualUserFunctions = (pathToPikkuTypes, pathToPersonas, requireAuth = true) => {
+export const serializeVirtualUserFunctions = (leaf, pathToPersonas, requireAuth = true) => {
     const authFlag = requireAuth ? 'true' : 'false';
     const schemas = `/**
  * Auto-generated virtual user schemas
@@ -133,14 +133,12 @@ export const ExecuteVirtualUserRunOutput = z.object({
  * Auto-generated virtual user functions
  * Do not edit manually - regenerate with 'npx pikku'
  */
-import { pikkuFunc, pikkuSessionlessFunc, defineScope } from '${pathToPikkuTypes}'
+import { pikkuFunc, pikkuSessionlessFunc } from '${leaf('function')}'
+import { defineScope } from '${leaf('scopes')}'
+import { personaVirtualUserTarget, runVirtualUser as runVirtualUserEngine, type SchemaMap, type VirtualUserDisposition } from '@pikku/core/virtual-user'
 import {
-  personaVirtualUserTarget,
   prepareVirtualUserRun,
-  runVirtualUser as runVirtualUserEngine,
   PRODUCTION_DISPOSITION,
-  type SchemaMap,
-  type VirtualUserDisposition,
 } from '@pikku/core/virtual-user'
 import { createPersonas, personaConfigs } from '${pathToPersonas}'
 import {
@@ -324,7 +322,7 @@ export const executeVirtualUserRun = pikkuSessionlessFunc({
   input: ExecuteVirtualUserRunInput,
   output: ExecuteVirtualUserRunOutput,
   func: async (
-    { virtualUserRunStore, metaService, aiAgentRunner, variables, logger },
+    { virtualUserRunStore, metaService, agentRunner, variables, logger },
     { runId, persona: personaId, disposition, goals, memory, budget, seed }
   ) => {
     if (!virtualUserRunStore) {
@@ -334,8 +332,8 @@ export const executeVirtualUserRun = pikkuSessionlessFunc({
       if (!metaService) {
         throw new Error('metaService is not wired — there is no catalogue to derive')
       }
-      if (!aiAgentRunner) {
-        throw new Error('aiAgentRunner is not wired — there is nothing to think with')
+      if (!agentRunner) {
+        throw new Error('agentRunner is not wired — there is nothing to think with')
       }
 
       const apiUrl = await variables.get(API_URL_VARIABLE)
@@ -403,10 +401,10 @@ export const executeVirtualUserRun = pikkuSessionlessFunc({
           model,
           agents: agents.map((agent) => agent.name),
         }),
-        // \`AIAgentRunnerService.run\` IS the engine's \`ActorLLM\` — same params,
+        // \`AgentRunnerService.run\` IS the engine's \`ActorLLM\` — same params,
         // same result — so a virtual user thinks through the same runner every
         // agent in the app does, provider quirks and all.
-        llm: (params) => aiAgentRunner.run(params),
+        llm: (params) => agentRunner.run(params),
         model,
         budget: {
           steps: budget?.steps,

package/dist/src/functions/wirings/webhook/pikku-command-webhook.d.ts

@@ -1 +1 @@
-export declare const pikkuWebhook: import("#pikku").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuWebhook: import("#pikku/function").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/webhook/pikku-command-webhook.js

@@ -1,18 +1,18 @@
-import { pikkuSessionlessFunc } from '#pikku';
-import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
+import { pikkuSessionlessFunc } from '#pikku/function';
+import { getLeafImportPath } from '../../../utils/leaf-import-path.js';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { removeLegacyScaffoldFile } from '../../../utils/remove-legacy-scaffold-file.js';
 import { serializeWebhook } from './serialize-webhook.js';
+import { isDeployCodegen } from '../../../utils/is-deploy-codegen.js';
 export const pikkuWebhook = pikkuSessionlessFunc({
     func: async ({ logger, config, variables }) => {
-        const deployCodegenFlag = await variables.get('PIKKU_DEPLOY_CODEGEN');
-        if (deployCodegenFlag === '1') {
+        if (await isDeployCodegen(variables)) {
             return false;
         }
         if (config.webhookWorkersFile && config.webhookSchemasFile) {
-            const pathToPikkuTypes = getFileImportRelativePath(config.webhookWorkersFile, config.typesDeclarationFile, config.packageMappings);
-            const { schemas, functions } = serializeWebhook(pathToPikkuTypes);
+            const leaf = (name) => getLeafImportPath(config.webhookWorkersFile, name, config);
+            const { schemas, functions } = serializeWebhook(leaf);
             await writeFileInDir(logger, config.webhookSchemasFile, schemas);
             await writeFileInDir(logger, config.webhookWorkersFile, functions);
             await removeLegacyScaffoldFile(config.webhookWorkersFile);

package/dist/src/functions/wirings/webhook/serialize-webhook.d.ts

@@ -8,4 +8,4 @@ export interface WebhookGenOutput {
  * The handler is inlined: it is wired exactly once, so a named export would
  * only be indirection.
  */
-export declare const serializeWebhook: (pathToPikkuTypes: string) => WebhookGenOutput;
+export declare const serializeWebhook: (leaf: (name: string) => string) => WebhookGenOutput;