@pikku/cli 0.12.105 → 0.12.107

package/dist/src/functions/wirings/setup/serialize-setup-types.js

@@ -0,0 +1,111 @@
+/**
+ * Generates the setup surface — the three factories a project declares exactly
+ * once, at the point the application is brought up. Grouping them apart from
+ * the function types keeps `#pikku/function` to what a feature imports every
+ * day and `#pikku/setup` to what bootstrap imports and never touches again.
+ */
+export const serializeSetupTypes = (functionTypesImportPath, configTypeImport, configTypeName, requiredServicesTypeImport) => {
+    return `/**
+ * Config and service factory definitions, declared once per application
+ */
+
+import { pikkuState as __pikkuState } from '@pikku/core/state'
+import { CreateWireServices } from '@pikku/core/types'
+import type { SingletonServices } from '${functionTypesImportPath}'
+${configTypeImport}
+${requiredServicesTypeImport}
+${!configTypeName ? 'export type Config = any' : configTypeName === 'Config' ? 'export type { Config }' : `export type { ${configTypeName} as Config }`}
+
+/**
+ * Creates a Pikku config factory.
+ * Use this to define your application's configuration factory.
+ *
+ * @param func - Config factory function that returns your application's config
+ * @returns The config factory function
+ *
+ * @example
+ * \`\`\`typescript
+ * export const createConfig = pikkuConfig(async () => {
+ *   return {
+ *     apiUrl: process.env.API_URL || 'http://localhost:3000',
+ *     dbUrl: process.env.DATABASE_URL
+ *   }
+ * })
+ * \`\`\`
+ */
+export const pikkuConfig = (
+  func: (variables?: any, ...args: any[]) => Promise<Config>
+) => func
+
+/**
+ * Creates a Pikku singleton services factory.
+ * Use this to define services that are created once and shared across all requests.
+ *
+ * @param func - Singleton services factory function
+ * @returns The singleton services factory function
+ *
+ * @example
+ * \`\`\`typescript
+ * export const createSingletonServices = pikkuServices(async (config, existingServices) => {
+ *   return {
+ *     config,
+ *     logger: new CustomLogger(),
+ *     db: await createDatabaseConnection(config.dbUrl)
+ *   }
+ * })
+ * \`\`\`
+ */
+export const pikkuServices = (
+  func: (config: Config, existingServices: Partial<SingletonServices>) => Promise<Partial<Omit<RequiredSingletonServices, 'auth'>>>
+) => {
+  return async (config: Config, existingServices: Partial<SingletonServices> = {}) => {
+    const createdServices = await func(config, existingServices)
+    const services = { ...existingServices, ...createdServices }
+    const authFactory = __pikkuState(null, 'package', 'authFactory')
+    if (authFactory) {
+      let authInstance: Promise<unknown> | undefined
+      ;(services as any).auth = () => {
+        authInstance ??= Promise.resolve()
+          .then(() => authFactory(services as any))
+          .catch((error) => {
+            authInstance = undefined
+            throw error
+          })
+        return authInstance
+      }
+    }
+    const resolved = services as RequiredSingletonServices
+    __pikkuState(null, 'package', 'singletonServices', resolved as any)
+    return resolved
+  }
+}
+
+/**
+ * Creates a Pikku wire services factory.
+ * Use this to define services that are created per-request/session.
+ *
+ * @param func - Wire services factory function
+ * @returns The wire services factory function
+ *
+ * @example
+ * \`\`\`typescript
+ * export const createWireServices = pikkuWireServices(async (services, wire) => {
+ *   const session = await wire.session?.get()
+ *   return {
+ *     userCache: new UserCache(session?.userId)
+ *   }
+ * })
+ * \`\`\`
+ */
+export const pikkuWireServices = (
+  func: (
+    services: SingletonServices,
+    wire: any
+  ) => Promise<RequiredWireServices>
+): CreateWireServices => {
+  const factories = __pikkuState(null, 'package', 'factories')
+  __pikkuState(null, 'package', 'factories', { ...factories, createWireServices: func as any })
+  return func as unknown as CreateWireServices
+}
+`;
+};

package/dist/src/functions/wirings/triggers/pikku-command-trigger-types.d.ts

@@ -1,7 +1,7 @@
-export declare const pikkuTriggerTypes: import("#pikku").PikkuFunctionConfig<{
+export declare const pikkuTriggerTypes: import("#pikku/function").PikkuFunctionConfig<{
     bootstrap?: boolean;
-}, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{
+}, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<{
     bootstrap?: boolean;
-}, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<{
+}, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<{
     bootstrap?: boolean;
-}, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+}, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/triggers/pikku-command-trigger-types.js

@@ -1,4 +1,4 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
@@ -12,7 +12,7 @@ export const pikkuTriggerTypes = pikkuSessionlessFunc({
             throw new Error('SingletonServices type not found');
         }
         const singletonServicesTypeImport = `import type { ${singletonServicesType.type} } from '${getFileImportRelativePath(triggersTypesFile, singletonServicesType.typePath, packageMappings)}'`;
-        const content = serializeTriggerTypes(singletonServicesTypeImport, singletonServicesType.type);
+        const content = serializeTriggerTypes(singletonServicesTypeImport, singletonServicesType.type, { addon: !!config.addon });
         await writeFileInDir(logger, triggersTypesFile, content);
     },
     middleware: [

package/dist/src/functions/wirings/triggers/pikku-command-trigger.d.ts

@@ -1 +1 @@
-export declare const pikkuTrigger: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuTrigger: import("#pikku/function").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/triggers/pikku-command-trigger.js

@@ -1,4 +1,4 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { serializeFileImports } from '../../../utils/file-imports-serializer.js';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';

package/dist/src/functions/wirings/triggers/serialize-trigger-meta.d.ts

@@ -1,4 +1,4 @@
-import type { TriggerMeta, TriggerSourceMeta } from '@pikku/core/ecosystem/trigger';
+import type { TriggerMeta, TriggerSourceMeta } from '@pikku/core/trigger';
 export declare const serializeTriggerMeta: (triggerMeta: TriggerMeta) => TriggerMeta;
 export declare const serializeTriggerMetaTS: (triggerMeta: TriggerMeta, jsonImportPath: string, supportsImportAttributes: boolean) => string;
 export declare const serializeTriggerSourceMeta: (sourceMeta: TriggerSourceMeta) => TriggerSourceMeta;

package/dist/src/functions/wirings/triggers/serialize-trigger-meta.js

@@ -6,8 +6,8 @@ export const serializeTriggerMetaTS = (triggerMeta, jsonImportPath, supportsImpo
         ? `import metaData from '${jsonImportPath}' with { type: 'json' }`
         : `import metaData from '${jsonImportPath}'`;
     const serializedOutput = [];
-    serializedOutput.push("import { pikkuState } from '@pikku/core/ecosystem'");
-    serializedOutput.push("import { TriggerMeta } from '@pikku/core/ecosystem/trigger'");
+    serializedOutput.push("import { pikkuState } from '@pikku/core/state'");
+    serializedOutput.push("import { TriggerMeta } from '@pikku/core/trigger'");
     serializedOutput.push(importStatement);
     serializedOutput.push('');
     serializedOutput.push("pikkuState(null, 'trigger', 'meta', metaData as TriggerMeta)");
@@ -26,8 +26,8 @@ export const serializeTriggerSourceMetaTS = (sourceMeta, jsonImportPath, support
         ? `import metaData from '${jsonImportPath}' with { type: 'json' }`
         : `import metaData from '${jsonImportPath}'`;
     const serializedOutput = [];
-    serializedOutput.push("import { pikkuState } from '@pikku/core/ecosystem'");
-    serializedOutput.push("import { TriggerSourceMeta } from '@pikku/core/ecosystem/trigger'");
+    serializedOutput.push("import { pikkuState } from '@pikku/core/state'");
+    serializedOutput.push("import { TriggerSourceMeta } from '@pikku/core/trigger'");
     serializedOutput.push(importStatement);
     serializedOutput.push('');
     serializedOutput.push("pikkuState(null, 'trigger', 'sourceMeta', metaData as TriggerSourceMeta)");

package/dist/src/functions/wirings/triggers/serialize-trigger-types.d.ts

@@ -1,4 +1,6 @@
 /**
  * Generates type definitions for trigger wirings
  */
-export declare const serializeTriggerTypes: (singletonServicesTypeImport: string, singletonServicesTypeName: string) => string;
+export declare const serializeTriggerTypes: (singletonServicesTypeImport: string, singletonServicesTypeName: string, { addon }?: {
+    addon?: boolean;
+}) => string;

package/dist/src/functions/wirings/triggers/serialize-trigger-types.js

@@ -1,14 +1,16 @@
 /**
  * Generates type definitions for trigger wirings
  */
-export const serializeTriggerTypes = (singletonServicesTypeImport, singletonServicesTypeName) => {
+export const serializeTriggerTypes = (singletonServicesTypeImport, singletonServicesTypeName, { addon = false } = {}) => {
     return `/**
  * Trigger-specific type definitions for tree-shaking optimization
  */
 
-import { wireTrigger as wireTriggerCore, wireTriggerSource as wireTriggerSourceCore } from '@pikku/core/trigger'
-import { CorePikkuTriggerFunction, CorePikkuTriggerFunctionConfig, CoreTrigger } from '@pikku/core/ecosystem/trigger'
-import type { CoreNodeConfig } from '@pikku/core/ecosystem/node'
+${addon ? '' : `import { wireTrigger as wireTriggerCore, wireTriggerSource as wireTriggerSourceCore } from '@pikku/core/trigger'\n`}import {
+  CorePikkuTriggerFunction,
+  CorePikkuTriggerFunctionConfig,${addon ? '' : `\n  CoreTrigger,`}
+} from '@pikku/core/trigger'
+import type { CoreNodeConfig } from '@pikku/core/node'
 ${singletonServicesTypeImport}
 import type { StandardSchemaV1 } from '@standard-schema/spec'
 
@@ -21,7 +23,7 @@ ${singletonServicesTypeName !== 'SingletonServices' ? `type SingletonServices =
  * @template TInput - Input type (configuration passed when wired)
  * @template TOutput - Output type produced when trigger fires
  */
-export type PikkuTriggerFunction<
+type PikkuTriggerFunction<
   TInput = unknown,
   TOutput = unknown
 > = CorePikkuTriggerFunction<TInput, TOutput, SingletonServices>
@@ -29,7 +31,7 @@ export type PikkuTriggerFunction<
 /**
  * Configuration object for creating a trigger function with metadata
  */
-export type PikkuTriggerFunctionConfig<
+type PikkuTriggerFunctionConfig<
   TInput = unknown,
   TOutput = unknown,
   InputSchema extends StandardSchemaV1 | undefined = undefined,
@@ -46,7 +48,7 @@ type InferSchemaOutput<T> = T extends StandardSchemaV1<any, infer Output> ? Outp
  * Use this when you want to define input/output schemas using Zod.
  * Types are automatically inferred from the schemas.
  */
-export type PikkuTriggerFunctionConfigWithSchema<
+type PikkuTriggerFunctionConfigWithSchema<
   InputSchema extends StandardSchemaV1,
   OutputSchema extends StandardSchemaV1 | undefined = undefined
 > = {
@@ -66,22 +68,23 @@ export type PikkuTriggerFunctionConfigWithSchema<
  * Type definition for trigger wirings.
  * Declares a trigger name and its target pikku function.
  */
-export type TriggerWiring = CoreTrigger
-
-/**
+${addon ? '' : `type TriggerWiring = CoreTrigger\n`}
+${addon
+        ? ''
+        : `/**
  * A trigger source with the subscription function, using project-specific services.
  *
  * @template TInput - Input type passed to the trigger function
  * @template TOutput - Output type produced when trigger fires
  */
-export type TriggerSource<
+type TriggerSource<
   TInput = unknown,
   TOutput = unknown
 > = {
   name: string
   func: PikkuTriggerFunctionConfig<TInput, TOutput>
 } & (unknown extends TInput ? { input?: TInput } : { input: TInput })
-
+`}
 /**
  * Creates a trigger function configuration.
  * Use this to define trigger functions that set up subscriptions.
@@ -135,6 +138,9 @@ export function pikkuTriggerFunc(triggerOrConfig: any) {
   return triggerOrConfig
 }
 
+${addon
+        ? ''
+        : `
 /**
  * Registers a trigger with the Pikku framework.
  * Declares a trigger name and its target pikku function.
@@ -160,5 +166,5 @@ export const wireTriggerSource = <TInput = unknown, TOutput = unknown>(
 ) => {
   wireTriggerSourceCore(source as any)
 }
-`;
+`}`;
 };

package/dist/src/functions/wirings/user-admin/pikku-command-user-admin-functions.d.ts

@@ -1 +1 @@
-export declare const pikkuUserAdminFunctions: import("#pikku").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuUserAdminFunctions: import("#pikku/function").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/user-admin/pikku-command-user-admin-functions.js

@@ -1,5 +1,5 @@
-import { pikkuSessionlessFunc } from '#pikku';
-import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
+import { pikkuSessionlessFunc } from '#pikku/function';
+import { getLeafImportPath } from '../../../utils/leaf-import-path.js';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { serializeUserAdminFunctions } from './serialize-user-admin-functions.js';
@@ -16,27 +16,28 @@ export const pikkuUserAdminFunctions = pikkuSessionlessFunc({
             return false;
         }
         const { definition } = (await getInspectorState()).auth;
-        // These functions are thin wrappers over better-auth's admin() endpoints.
-        // Without that plugin the endpoints do not exist, so the scaffold would
-        // generate four RPCs that throw on every call and four scopes that grant
-        // nothing. Fail the codegen instead of shipping that.
+        // Every one of these functions drives better-auth's internal adapter, so
+        // without a better-auth instance the scaffold would generate RPCs that
+        // throw on every call and scopes that grant nothing. Fail the codegen
+        // instead of shipping that.
         if (!definition) {
             throw new Error(`"scaffold.userAdmin" is enabled but no pikkuBetterAuth(...) was found in the project.\n` +
-                `User management wraps better-auth's admin() endpoints, so there is nothing to wrap.\n` +
+                `User management works through better-auth's internal adapter, so there is nothing to manage.\n` +
                 `Fix: set up Better Auth before scaffolding user management, or remove ` +
                 `"scaffold.userAdmin" from pikku.config.json.`);
         }
-        if (!definition.plugins.includes('admin')) {
-            throw new Error(`"scaffold.userAdmin" is enabled but better-auth is configured without the admin() plugin.\n` +
-                `Ban, delete, session-revocation and set-password are implemented by that plugin — without it ` +
-                `the generated functions would fail on every call.\n` +
-                `Fix: add admin() to the plugins array in ${definition.sourceFile}:\n` +
-                `  import { admin } from 'better-auth/plugins'\n` +
-                `  betterAuth({ plugins: [admin()] })\n` +
-                `Then re-run codegen. Or remove "scaffold.userAdmin" from pikku.config.json.`);
+        // Ban is the one capability with a schema requirement of its own, and it is
+        // only one of the six — a warning rather than a failure, so an app that
+        // never bans anyone is not forced to carry the columns.
+        if (!definition.plugins.includes('ban')) {
+            logger.warn(`"scaffold.userAdmin" is enabled but better-auth is configured without the ban() plugin, ` +
+                `so the banned/banReason/banExpires columns do not exist and setUserBanned will fail.\n` +
+                `Fix: add ban() to the plugins array in ${definition.sourceFile}:\n` +
+                `  import { ban } from '@pikku/better-auth'\n` +
+                `  betterAuth({ plugins: [ban()] })`);
         }
-        const pathToPikkuTypes = getFileImportRelativePath(config.userAdminFunctionsFile, config.typesDeclarationFile, config.packageMappings);
-        const { schemas, functions } = serializeUserAdminFunctions(pathToPikkuTypes, resolveScaffoldFeature('userAdmin', config.scaffold.userAdmin).auth);
+        const leaf = (name) => getLeafImportPath(config.userAdminFunctionsFile, name, config);
+        const { schemas, functions } = serializeUserAdminFunctions(leaf, resolveScaffoldFeature('userAdmin', config.scaffold.userAdmin).auth);
         await writeFileInDir(logger, config.userAdminSchemasFile, schemas);
         await writeFileInDir(logger, config.userAdminFunctionsFile, functions);
         return true;

package/dist/src/functions/wirings/user-admin/serialize-user-admin-functions.d.ts

@@ -4,16 +4,17 @@ export interface UserAdminGenOutput {
 }
 /**
  * Generate the user-management functions into the project scaffold: the
- * directory read plus the writes that wrap better-auth's `admin()` endpoints.
+ * directory read plus the writes that administer it.
  *
- * Scaffolded rather than shipped in an addon because managing users is ordinary
- * application behaviour: an app should not have to install the console — which
- * exists to be served alongside a running dev server — just to list or ban its
- * own users. The console UI calls these same functions when it is present.
+ * Superseded by `@pikku/addon-admin`, which ships these same functions plus
+ * roles, credentials and the audit trail, and which an app can wire without
+ * installing the console. Kept for hosts still on the scaffold; the scope tree
+ * below must stay byte-identical to the addon's, or an app with both fails
+ * codegen on conflicting declarations.
  *
- * Each function is gated on its own `admin:users:*` scope. The writes are only
- * meaningful where `admin()` is wired, which is why this file is generated only
- * in that case.
+ * Each function is gated on its own `admin:users:*` scope, and works through
+ * better-auth's internal adapter. Banning additionally needs the `ban()` plugin
+ * from `@pikku/better-auth` for the columns it writes to exist.
  *
  * Emitted as two files. The schemas are zod, and the inspector reads a zod
  * schema by importing the module that declares it — which it cannot do for the
@@ -21,4 +22,4 @@ export interface UserAdminGenOutput {
  * rewrites. Keeping the schemas in a sibling module that imports nothing but
  * zod sidesteps that entirely.
  */
-export declare const serializeUserAdminFunctions: (pathToPikkuTypes: string, requireAuth?: boolean) => UserAdminGenOutput;
+export declare const serializeUserAdminFunctions: (leaf: (name: string) => string, requireAuth?: boolean) => UserAdminGenOutput;

package/dist/src/functions/wirings/user-admin/serialize-user-admin-functions.js

@@ -1,15 +1,16 @@
 /**
  * Generate the user-management functions into the project scaffold: the
- * directory read plus the writes that wrap better-auth's `admin()` endpoints.
+ * directory read plus the writes that administer it.
  *
- * Scaffolded rather than shipped in an addon because managing users is ordinary
- * application behaviour: an app should not have to install the console — which
- * exists to be served alongside a running dev server — just to list or ban its
- * own users. The console UI calls these same functions when it is present.
+ * Superseded by `@pikku/addon-admin`, which ships these same functions plus
+ * roles, credentials and the audit trail, and which an app can wire without
+ * installing the console. Kept for hosts still on the scaffold; the scope tree
+ * below must stay byte-identical to the addon's, or an app with both fails
+ * codegen on conflicting declarations.
  *
- * Each function is gated on its own `admin:users:*` scope. The writes are only
- * meaningful where `admin()` is wired, which is why this file is generated only
- * in that case.
+ * Each function is gated on its own `admin:users:*` scope, and works through
+ * better-auth's internal adapter. Banning additionally needs the `ban()` plugin
+ * from `@pikku/better-auth` for the columns it writes to exist.
  *
  * Emitted as two files. The schemas are zod, and the inspector reads a zod
  * schema by importing the module that declares it — which it cannot do for the
@@ -17,7 +18,7 @@
  * rewrites. Keeping the schemas in a sibling module that imports nothing but
  * zod sidesteps that entirely.
  */
-export const serializeUserAdminFunctions = (pathToPikkuTypes, requireAuth = true) => {
+export const serializeUserAdminFunctions = (leaf, requireAuth = true) => {
     const authFlag = requireAuth ? 'true' : 'false';
     const schemas = `/**
  * Auto-generated user management schemas
@@ -27,9 +28,9 @@ import { z } from 'zod'
 
 /**
  * A user, as the directory sees one. Ban state is optional because those
- * columns belong to better-auth's \`admin()\` plugin: a host without it reports
- * no ban state at all, which a client can render as "unknown" rather than as a
- * misleading "not banned".
+ * columns belong to the \`ban()\` plugin: a host without it reports no ban state
+ * at all, which a client can render as "unknown" rather than as a misleading
+ * "not banned".
  */
 export const User = z.object({
   id: z.string(),
@@ -86,8 +87,15 @@ export const Success = z.object({
  * Auto-generated user management functions
  * Do not edit manually - regenerate with 'npx pikku'
  */
-import { pikkuFunc, defineScope } from '${pathToPikkuTypes}'
-import { callAdminApi } from '@pikku/better-auth'
+import { pikkuFunc } from '${leaf('function')}'
+import { defineScope } from '${leaf('scopes')}'
+import {
+  createAuthUser,
+  deleteAuthUser,
+  revokeAuthUserSessions,
+  setAuthUserBanned,
+  setAuthUserPassword,
+} from '@pikku/better-auth'
 import {
   CreateUserInput,
   CreateUserOutput,
@@ -102,7 +110,7 @@ import {
 // pikku requires every declaration of a shared scope root to be identical, so
 // this is the whole \`admin\` tree — not just the leaves gated below. It must stay
 // byte-identical to ADMIN_SCOPE_TREE in @pikku/better-auth and to the copy in
-// @pikku/addon-console, or codegen fails with conflicting declarations.
+// @pikku/addon-admin, or codegen fails with conflicting declarations.
 defineScope({
   admin: {
     displayName: 'Administration',
@@ -113,6 +121,8 @@ defineScope({
         description: 'Application-wide credentials',
         scopes: {
           link: { description: 'Bind a shared credential for every user' },
+          read: { description: 'Read credential values and who holds them' },
+          manage: { description: 'Set and delete credentials' },
         },
       },
       users: {
@@ -126,6 +136,27 @@ defineScope({
           password: { description: "Set a user's password" },
         },
       },
+      scopes: {
+        description: 'Authorization management',
+        scopes: {
+          read: {
+            description: 'View declared scopes, roles, and who holds them',
+          },
+          manage: {
+            description:
+              'Create and delete roles, change their scopes, and grant roles to users',
+          },
+        },
+      },
+      audit: {
+        description: 'The audit trail',
+        scopes: {
+          read: {
+            description:
+              'Read the audit trail — every recorded action, and which user took it',
+          },
+        },
+      },
     },
   },
 })
@@ -142,7 +173,7 @@ export const pikkuAdminListUsers = pikkuFunc({
   tags: ['pikku'],
   title: 'List Users',
   description:
-    'Lists and searches the user directory, read through the auth adapter rather than an admin endpoint so it works on any database better-auth supports.',
+    'Lists and searches the user directory, read through the auth adapter so it works on any database better-auth supports.',
   expose: true,
   auth: ${authFlag},
   scopes: ['admin:users:list'],
@@ -181,28 +212,22 @@ export const pikkuAdminCreateUser = pikkuFunc({
   tags: ['pikku'],
   title: 'Create User',
   description:
-    'Creates a user directly, for provisioning an account out of band rather than through your sign-up flow. better-auth enforces the configured password bounds and rejects a duplicate email.',
+    'Creates a user directly, for provisioning an account out of band rather than through your sign-up flow. Enforces the configured password bounds and rejects a duplicate email.',
   expose: true,
   auth: ${authFlag},
   scopes: ['admin:users:create'],
   input: CreateUserInput,
   output: CreateUserOutput,
-  func: async ({ auth }, { email, password, name }, { http }) => {
-    const created: any = await callAdminApi(auth, http, (api, headers) =>
-      api.createUser!({
-        body: { email, password, name: name ?? email },
-        headers,
-      })
-    )
-    return { userId: created?.user?.id ?? created?.id }
-  },
+  func: async ({ auth }, { email, password, name }) => ({
+    userId: await createAuthUser(auth, { email, password, name }),
+  }),
 })
 
 export const pikkuAdminSetUserBanned = pikkuFunc({
   tags: ['pikku'],
   title: 'Ban or Unban User',
   description:
-    'Bans a user — revoking their sessions and blocking sign-in — or lifts an existing ban. An expiry lets the ban lapse on its own; without one it holds until it is lifted.',
+    'Bans a user — revoking their sessions and blocking sign-in — or lifts an existing ban. An expiry lets the ban lapse on its own; without one it holds until it is lifted. Requires better-auth wired with the \`ban()\` plugin.',
   expose: true,
   auth: ${authFlag},
   scopes: ['admin:users:ban'],
@@ -211,16 +236,12 @@ export const pikkuAdminSetUserBanned = pikkuFunc({
   func: async (
     { auth },
     { userId, banned, reason, expiresInSeconds },
-    { http }
+    { session }
   ) => {
-    await callAdminApi(auth, http, (api, headers) =>
-      banned
-        ? api.banUser!({
-            body: { userId, banReason: reason, banExpiresIn: expiresInSeconds },
-            headers,
-          })
-        : api.unbanUser!({ body: { userId }, headers })
-    )
+    if (banned && userId === session?.userId) {
+      throw new Error('You cannot ban yourself')
+    }
+    await setAuthUserBanned(auth, { userId, banned, reason, expiresInSeconds })
     return { success: true }
   },
 })
@@ -235,10 +256,11 @@ export const pikkuAdminRemoveUser = pikkuFunc({
   scopes: ['admin:users:remove'],
   input: UserRef,
   output: Success,
-  func: async ({ auth }, { userId }, { http }) => {
-    await callAdminApi(auth, http, (api, headers) =>
-      api.removeUser!({ body: { userId }, headers })
-    )
+  func: async ({ auth }, { userId }, { session }) => {
+    if (userId === session?.userId) {
+      throw new Error('You cannot delete yourself')
+    }
+    await deleteAuthUser(auth, userId)
     return { success: true }
   },
 })
@@ -253,10 +275,8 @@ export const pikkuAdminRevokeUserSessions = pikkuFunc({
   scopes: ['admin:users:sessions'],
   input: UserRef,
   output: Success,
-  func: async ({ auth }, { userId }, { http }) => {
-    await callAdminApi(auth, http, (api, headers) =>
-      api.revokeUserSessions!({ body: { userId }, headers })
-    )
+  func: async ({ auth }, { userId }) => {
+    await revokeAuthUserSessions(auth, userId)
     return { success: true }
   },
 })
@@ -265,16 +285,14 @@ export const pikkuAdminSetUserPassword = pikkuFunc({
   tags: ['pikku'],
   title: "Set User's Password",
   description:
-    'Sets a user password out of band, for when they cannot complete a reset themselves. better-auth enforces the configured length bounds.',
+    'Sets a user password out of band, for when they cannot complete a reset themselves. Enforces the configured length bounds, and gives a user who only ever signed in socially a credential account.',
   expose: true,
   auth: ${authFlag},
   scopes: ['admin:users:password'],
   input: SetUserPasswordInput,
   output: Success,
-  func: async ({ auth }, { userId, newPassword }, { http }) => {
-    await callAdminApi(auth, http, (api, headers) =>
-      api.setUserPassword!({ body: { userId, newPassword }, headers })
-    )
+  func: async ({ auth }, { userId, newPassword }) => {
+    await setAuthUserPassword(auth, { userId, newPassword })
     return { success: true }
   },
 })

package/dist/src/functions/wirings/variables/pikku-command-variables.d.ts

@@ -1 +1 @@
-export declare const pikkuVariables: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuVariables: import("#pikku/function").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/variables/pikku-command-variables.js

@@ -1,8 +1,8 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { serializeVariablesTypes } from './serialize-variables-types.js';
-import { validateAndBuildVariableDefinitionsMeta } from '@pikku/core/ecosystem/variable';
+import { validateAndBuildVariableDefinitionsMeta } from '@pikku/core/variable';
 export const pikkuVariables = pikkuSessionlessFunc({
     func: async ({ logger, config, getInspectorState }) => {
         const { variablesFile, variablesMetaJsonFile, packageMappings } = config;

package/dist/src/functions/wirings/variables/serialize-variables-types.d.ts

@@ -1,4 +1,4 @@
-import type { VariableDefinitions } from '@pikku/core/ecosystem/variable';
+import type { VariableDefinitions } from '@pikku/core/variable';
 import type { SchemaRef } from '@pikku/inspector';
 export interface SerializeVariablesOptions {
     definitions: VariableDefinitions;