@pikku/cli 0.12.105 → 0.12.109

package/dist/src/functions/wirings/agent/serialize-public-agent.js

@@ -1,5 +1,4 @@
-export const serializePublicAgent = (pathToPikkuTypes, requireAuth = true, globalHTTPPrefix = '') => {
-    const authFlag = requireAuth ? 'true' : 'false';
+export const serializePublicAgent = (leaf, globalHTTPPrefix = '') => {
     const schemas = `/**
  * Auto-generated public agent schemas
  * Do not edit manually - regenerate with 'npx pikku'
@@ -54,8 +53,10 @@ export const ThreadRef = z.object({
 
 export const ThreadDeleted = z.object({ deleted: z.boolean() })
 `;
-    const functions = `import { canAccessThread, threadOwnerConstraint } from '@pikku/core/ecosystem/agent'
-import { pikkuSessionlessFunc, pikkuPermission, defineHTTPRoutes, wireHTTPRoutes } from '${pathToPikkuTypes}'
+    const functions = `import { canAccessThread, threadOwnerConstraint } from '@pikku/core/agent'
+import { pikkuSessionlessFunc } from '${leaf('function')}'
+import { pikkuPermission } from '${leaf('auth')}'
+import { defineHTTPRoutes, wireHTTPRoutes } from '${leaf('http')}'
 import {
   AgentCall,
   AgentApproval,
@@ -83,7 +84,7 @@ export const isThreadOwner = pikkuPermission<{ threadId: string }>(
 export const agentCaller = pikkuSessionlessFunc({
   description: 'Run a named AI agent with a message and return its reply',
   tags: ['pikku'],
-  auth: ${authFlag},
+  auth: false,
   input: AgentCall,
   func: async (_services, data, { rpc }) => {
     return await rpc.agent.run(data.agentName as any, {
@@ -100,7 +101,7 @@ export const agentCaller = pikkuSessionlessFunc({
 
 export const agentStreamCaller = pikkuSessionlessFunc({
   tags: ['pikku'],
-  auth: ${authFlag},
+  auth: false,
   input: AgentCall,
   func: async (_services, data, { rpc }) => {
     await rpc.agent.stream(data.agentName as any, {
@@ -117,7 +118,7 @@ export const agentStreamCaller = pikkuSessionlessFunc({
 
 export const agentApproveCaller = pikkuSessionlessFunc({
   tags: ['pikku'],
-  auth: ${authFlag},
+  auth: false,
   input: AgentApproval,
   func: async (_services, { runId, approvals, agentName }, { rpc }) => {
     return await rpc.agent.approve(runId, approvals, agentName)
@@ -126,7 +127,7 @@ export const agentApproveCaller = pikkuSessionlessFunc({
 
 export const agentResumeCaller = pikkuSessionlessFunc({
   tags: ['pikku'],
-  auth: ${authFlag},
+  auth: false,
   input: AgentResume,
   func: async (_services, data, { rpc }) => {
     await rpc.agent.resume(data.runId, {
@@ -143,7 +144,7 @@ export const getAgentThreads = pikkuSessionlessFunc({
   description:
     'Returns the caller\\'s AI agent threads from storage. Accepts optional filters: agentName, resourceId, limit, and offset for pagination.',
   expose: true,
-  auth: ${authFlag},
+  auth: false,
   func: async ({ agentRunService }, input, { session }) => {
     // \`owners\` is an authorization constraint derived from the session, never
     // from input — \`resourceId\` remains a caller-supplied filter within it.
@@ -164,7 +165,7 @@ export const getAgentThreadMessages = pikkuSessionlessFunc({
   description:
     'Returns all messages for a given AI agent thread, ordered by creation time.',
   expose: true,
-  auth: ${authFlag},
+  auth: false,
   permissions: { owner: isThreadOwner },
   func: async ({ agentRunService }, input) => {
     return await agentRunService.getThreadMessages(input.threadId)
@@ -178,7 +179,7 @@ export const getAgentThreadRuns = pikkuSessionlessFunc({
   description:
     'Returns the run history for a given AI agent thread, ordered by creation time.',
   expose: true,
-  auth: ${authFlag},
+  auth: false,
   permissions: { owner: isThreadOwner },
   func: async ({ agentRunService }, input) => {
     return await agentRunService.getThreadRuns(input.threadId)
@@ -193,7 +194,7 @@ export const deleteAgentThread = pikkuSessionlessFunc({
   description:
     'Deletes an AI agent thread and all of its persisted state.',
   expose: true,
-  auth: ${authFlag},
+  auth: false,
   permissions: { owner: isThreadOwner },
   func: async ({ agentRunService }, input) => {
     const deleted = await agentRunService.deleteThread(input.threadId)
@@ -202,7 +203,7 @@ export const deleteAgentThread = pikkuSessionlessFunc({
 })
 
 export const agentRoutes = defineHTTPRoutes({
-  auth: ${authFlag},
+  auth: false,
   tags: ['pikku:public'],
   routes: {
     agentRun: {

package/dist/src/functions/wirings/agent-scorer/pikku-command-agent-scorer.d.ts

@@ -1 +1 @@
-export declare const pikkuAgentScorer: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuAgentScorer: import("#pikku/function").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/agent-scorer/pikku-command-agent-scorer.js

@@ -1,4 +1,4 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
@@ -16,7 +16,7 @@ export const pikkuAgentScorer = pikkuSessionlessFunc({
             return undefined;
         }
         const lines = [];
-        lines.push(`import { addAgentScorer } from '@pikku/core/ecosystem/agent-scorer'`);
+        lines.push(`import { addAgentScorer } from '@pikku/core/agent-scorer'`);
         // Ahead of the registrations: addAgentScorer refuses a scorer whose metadata
         // has not landed yet.
         lines.push(`import '${getFileImportRelativePath(scorerWiringsFile, scorerWiringMetaFile, packageMappings)}'`);
@@ -36,8 +36,8 @@ export const pikkuAgentScorer = pikkuSessionlessFunc({
         const importStatement = schema?.supportsImportAttributes
             ? `import metaData from '${jsonImportPath}' with { type: 'json' }`
             : `import metaData from '${jsonImportPath}'`;
-        await writeFileInDir(logger, scorerWiringMetaFile, `import { pikkuState } from '@pikku/core/ecosystem'
-import type { ScorerMeta } from '@pikku/core/ecosystem/agent-scorer'
+        await writeFileInDir(logger, scorerWiringMetaFile, `import { pikkuState } from '@pikku/core/state'
+import type { ScorerMeta } from '@pikku/core/agent-scorer'
 ${importStatement}
 pikkuState(${addonName ? `'${addonName}'` : 'null'}, 'agent', 'scorersMeta', metaData.scorersMeta as ScorerMeta)`);
         return true;

package/dist/src/functions/wirings/agent-scorer/serialize-scorer-names.d.ts

@@ -1,4 +1,4 @@
-import type { ScorerMeta } from '@pikku/core/ecosystem/agent-scorer';
+import type { ScorerMeta } from '@pikku/core/agent-scorer';
 /**
  * The names an agent may ask to be graded by.
  *

package/dist/src/functions/wirings/auth/pikku-command-auth.d.ts

@@ -1,7 +1,7 @@
-export declare const pikkuAuth: import("#pikku").PikkuFunctionConfig<{
+export declare const pikkuAuth: import("#pikku/function").PikkuFunctionConfig<{
     bootstrap?: boolean;
-}, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{
+}, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<{
     bootstrap?: boolean;
-}, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<{
+}, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<{
     bootstrap?: boolean;
-}, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+}, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/auth/pikku-command-auth.js

@@ -1,7 +1,8 @@
 import { join, dirname } from 'node:path';
 import { existsSync } from 'node:fs';
 import { rm } from 'node:fs/promises';
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
+import { getLeafImportPath } from '../../../utils/leaf-import-path.js';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { removeLegacyScaffoldFile } from '../../../utils/remove-legacy-scaffold-file.js';
@@ -11,7 +12,7 @@ import { serializeAuthMeta } from './serialize-auth-meta.js';
 import { projectDeclaresBetterAuth } from '../../../utils/detect-better-auth.js';
 export const pikkuAuth = pikkuSessionlessFunc({
     func: async ({ logger, config, getInspectorState }, data) => {
-        const { authFile, authTypesFile, authMetaJsonFile, functionTypesFile, typesDeclarationFile, secretsFile: secretsServiceFile, variablesFile, packageMappings, } = config;
+        const { authFile, authTypesFile, authMetaJsonFile, functionTypesFile, secretsFile: secretsServiceFile, variablesFile, packageMappings, } = config;
         if (!authFile)
             return;
         // Bootstrap pass: the inspector hasn't run, so the typed wrapper can't be
@@ -31,7 +32,7 @@ export const pikkuAuth = pikkuSessionlessFunc({
         // has no OAuth providers — still generates its /auth/* wiring.
         if (!state.auth.definition)
             return;
-        const { wiring, secrets, middleware } = serializeAuthGen(state.auth.definition, state.auth.providers, authFile, typesDeclarationFile, packageMappings ?? {}, state.auth.hasUserSessionMiddleware ?? false, Boolean(config.scaffold?.console));
+        const { wiring, secrets, middleware } = serializeAuthGen(state.auth.definition, state.auth.providers, authFile, (name) => getLeafImportPath(authFile, name, config), packageMappings ?? {}, state.auth.hasUserSessionMiddleware ?? false, Boolean(config.scaffold?.console));
         // The secrets file sits alongside authFile so re-inspection rediscovers it.
         // It is kept separate from the wiring file because the CLI forbids Zod
         // schemas and HTTP wiring (wireHTTPRoutes) in the same file (PKU490).
@@ -60,7 +61,7 @@ export const pikkuAuth = pikkuSessionlessFunc({
             const meta = serializeAuthMeta(state.auth.definition, state.auth.providers);
             await writeFileInDir(logger, authMetaJsonFile, JSON.stringify(meta, null, 2));
         }
-        // Generate the typed pikkuBetterAuth re-export consumed by `import { pikkuBetterAuth } from '#pikku'`.
+        // Generate the typed pikkuBetterAuth re-export consumed by `import { pikkuBetterAuth } from '#pikku/auth'`.
         if (authTypesFile &&
             functionTypesFile &&
             secretsServiceFile &&

package/dist/src/functions/wirings/auth/serialize-auth-gen.d.ts

@@ -18,4 +18,4 @@ export interface AuthGenOutput {
      * `session.cookieCache` is enabled (stateless path); undefined otherwise. */
     middleware?: string;
 }
-export declare const serializeAuthGen: (definition: AuthDefinition, providers: string[], authFile: string, typesDeclarationFile: string, packageMappings: Record<string, string>, hasUserSessionMiddleware?: boolean, includeConsoleToken?: boolean) => AuthGenOutput;
+export declare const serializeAuthGen: (definition: AuthDefinition, providers: string[], authFile: string, leaf: (name: string) => string, packageMappings: Record<string, string>, hasUserSessionMiddleware?: boolean, includeConsoleToken?: boolean) => AuthGenOutput;

package/dist/src/functions/wirings/auth/serialize-auth-gen.js

@@ -65,17 +65,12 @@ const consoleTokenMiddlewareLines = () => [
     `    },`,
     `  }),`,
 ];
-export const serializeAuthGen = (definition, providers, authFile, typesDeclarationFile, packageMappings, hasUserSessionMiddleware = false, includeConsoleToken = false) => {
+export const serializeAuthGen = (definition, providers, authFile, leaf, packageMappings, hasUserSessionMiddleware = false, includeConsoleToken = false) => {
     const known = providers.filter((p) => p in PROVIDER_REGISTRY);
     const basePath = definition.basePath;
     // Side-effect import of the user's auth file so `pikkuBetterAuth` runs and
     // registers its factory into pikkuState before singleton services are built.
     const configImportPath = getFileImportRelativePath(authFile, definition.sourceFile, packageMappings);
-    // Resolve the pikku types file relative to the scaffold location instead of
-    // hardcoding the `#pikku` subpath import — the scaffold dir may live outside
-    // the package's `imports` map (e.g. a project's `pikku/` dir), where `#pikku`
-    // would not resolve. This mirrors how the console/agent scaffolds import it.
-    const pikkuTypesImportPath = getFileImportRelativePath(authFile, typesDeclarationFile, packageMappings);
     // ─── Secrets file: Zod schemas + defineSecret/defineVariable ──────────────────
     const secrets = [
         '// AUTO-GENERATED by pikku CLI — do not edit',
@@ -159,8 +154,8 @@ export const serializeAuthGen = (definition, providers, authFile, typesDeclarati
         '// AUTO-GENERATED by pikku CLI — do not edit',
         '',
         emitStatefulSession
-            ? `import { pikkuSessionlessFunc, wireHTTPRoutes } from '${pikkuTypesImportPath}'\nimport { addGlobalMiddleware } from '@pikku/core/middleware'`
-            : `import { pikkuSessionlessFunc, wireHTTPRoutes } from '${pikkuTypesImportPath}'`,
+            ? `import { pikkuSessionlessFunc } from '${leaf('function')}'\nimport { wireHTTPRoutes } from '${leaf('http')}'\nimport { addGlobalMiddleware } from '@pikku/core/middleware'`
+            : `import { pikkuSessionlessFunc } from '${leaf('function')}'\nimport { wireHTTPRoutes } from '${leaf('http')}'`,
         emitStatefulSession
             ? `import { createAuthHandler, betterAuthSession } from '@pikku/better-auth'`
             : `import { createAuthHandler } from '@pikku/better-auth'`,

package/dist/src/functions/wirings/auth/serialize-auth-guards.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Generates the authorization surface — who may call a function, and the
+ * credentials a call is made with. Permissions and auth gates were on the
+ * function leaf, where they sat next to the definers as if writing a function
+ * meant deciding who could reach it; they are a separate decision, taken once
+ * and reused across wirings, so they are a separate import.
+ *
+ * `PikkuPermission` is declared here rather than beside the function config that
+ * references it; that config imports it back, which is a type-only edge and
+ * carries no runtime cycle.
+ */
+export declare const serializeAuthGuards: (functionTypesImportPath: string, packageName?: string) => string;

package/dist/src/functions/wirings/auth/serialize-auth-guards.js

@@ -0,0 +1,168 @@
+/**
+ * Generates the authorization surface — who may call a function, and the
+ * credentials a call is made with. Permissions and auth gates were on the
+ * function leaf, where they sat next to the definers as if writing a function
+ * meant deciding who could reach it; they are a separate decision, taken once
+ * and reused across wirings, so they are a separate import.
+ *
+ * `PikkuPermission` is declared here rather than beside the function config that
+ * references it; that config imports it back, which is a type-only edge and
+ * carries no runtime cycle.
+ */
+export const serializeAuthGuards = (functionTypesImportPath, packageName) => {
+    const packageNameValue = packageName ? `'${packageName}'` : 'null';
+    return `/**
+ * Permission, auth gate and credential definitions
+ */
+
+import type { PikkuWire, SecretlessServices } from '@pikku/core/types'
+import type {
+  CorePermissionGroup,
+  CorePikkuAuth,
+  CorePikkuAuthConfig,
+  CorePikkuPermission,
+} from '@pikku/core/function'
+import { pikkuAuth as pikkuAuthCore } from '@pikku/core/function'
+import { addGlobalPermission as addGlobalPermissionCore } from '@pikku/core/middleware'
+import type {
+  Services,
+  Session,
+  SingletonServices,
+  WiredServices,
+  WiredSingletonServices,
+} from '${functionTypesImportPath}'
+
+export { defineCredential } from '@pikku/core/credential'
+
+/** \`WiredSingletonServices\` without \`secrets\`, for auth gates. */
+type WiredAuthServices = SecretlessServices<WiredSingletonServices>
+
+/**
+ * Type-safe API permission definition that integrates with your application's session type.
+ * Use this to define authorization logic for your API endpoints.
+ *
+ * @template In - The input type that the permission check will receive
+ * @template RequiredServices - The services required for this permission check
+ */
+export type PikkuPermission<In = unknown, RequiredServices extends SecretlessServices<Services> = WiredServices> = CorePikkuPermission<In, RequiredServices, PikkuWire<In, never, false, Session>>
+
+/**
+ * Configuration object for creating a permission with metadata
+ */
+type PikkuPermissionConfig<In = unknown, RequiredServices extends SecretlessServices<Services> = WiredServices> = {
+  /** The permission function */
+  func: PikkuPermission<In, RequiredServices>
+  /** Optional human-readable name for the permission */
+  name?: string
+  /** Optional description of what the permission checks */
+  description?: string
+}
+
+/**
+ * Factory function for creating permissions with tree-shaking support.
+ * Supports both direct function and configuration object syntax.
+ *
+ * @example
+ * \`\`\`typescript
+ * // Direct function syntax
+ * const permission = pikkuPermission(async ({ logger }, data, { session }) => {
+ *   const session = await session?.get()
+ *   return session?.role === 'admin'
+ * })
+ *
+ * // Configuration object syntax with metadata
+ * const adminPermission = pikkuPermission({
+ *   name: 'Admin Permission',
+ *   description: 'Checks if user has admin role',
+ *   func: async ({ logger }, data, { session }) => {
+ *     const session = await session?.get()
+ *     return session?.role === 'admin'
+ *   }
+ * })
+ * \`\`\`
+ */
+export const pikkuPermission = <In>(
+  permission: PikkuPermission<In> | PikkuPermissionConfig<In>
+): PikkuPermission<In> => {
+  return typeof permission === 'function' ? permission : permission.func
+}
+
+/**
+ * Type-safe auth-only permission that only needs services and session.
+ * Use this for upfront authorization gates (MCP tools, AI agents, workflows)
+ * where request data isn't available yet.
+ *
+ * @template RequiredServices - The services required for this auth check
+ */
+type PikkuAuth<RequiredServices extends SecretlessServices<SingletonServices> = WiredAuthServices> = CorePikkuAuth<RequiredServices, Session>
+
+/**
+ * Configuration object for creating an auth permission with metadata
+ */
+type PikkuAuthConfig<RequiredServices extends SecretlessServices<SingletonServices> = WiredAuthServices> = CorePikkuAuthConfig<RequiredServices, Session>
+
+/**
+ * Factory function for creating auth-only permissions with tree-shaking support.
+ * Auth permissions only receive services and session (no request data),
+ * making them evaluable before request data is available.
+ *
+ * @example
+ * \\\`\\\`\\\`typescript
+ * const isAuthenticated = pikkuAuth(async ({ logger }, session) => {
+ *   return !!session
+ * })
+ *
+ * const isAdmin = pikkuAuth({
+ *   name: 'Admin Auth',
+ *   description: 'Checks if user is an admin',
+ *   func: async ({ logger }, session) => {
+ *     return session?.role === 'admin'
+ *   }
+ * })
+ * \\\`\\\`\\\`
+ */
+export const pikkuAuth = <RequiredServices extends SecretlessServices<SingletonServices> = WiredAuthServices>(
+  auth: PikkuAuth<RequiredServices> | PikkuAuthConfig<RequiredServices>
+): PikkuPermission<any, any> => {
+  return pikkuAuthCore(auth as any) as any
+}
+
+/**
+ * Factory function for creating permission factories
+ * Use this when your permission needs configuration/input parameters
+ *
+ * @example
+ * \`\`\`typescript
+ * export const requireRole = pikkuPermissionFactory<{ role: string }>(({
+ *   role
+ * }) => {
+ *   return pikkuPermission(async ({ logger }, data, { session }) => {
+ *     if (!session || session.role !== role) {
+ *       logger.warn(\`Permission denied: required role '\${role}'\`)
+ *       return false
+ *     }
+ *     return true
+ *   })
+ * })
+ * \`\`\`
+ */
+export const pikkuPermissionFactory = <In = any>(
+  factory: (input: In) => PikkuPermission<any>
+): ((input: In) => PikkuPermission<any>) => {
+  return factory
+}
+
+/**
+ * Wire-agnostic global permissions. Runs at the top of every wiring's
+ * permission resolution — before wire-, tag-, and function-level entries.
+ *
+ * Resolution order: global -> wire -> tag -> function.
+ *
+ * @example
+ * addGlobalPermission([signedInUser])
+ */
+export const addGlobalPermission = <In = unknown>(permissions: CorePermissionGroup<PikkuPermission<In>> | PikkuPermission<In>[]) => {
+  addGlobalPermissionCore(permissions as any, ${packageNameValue})
+}
+`;
+};

package/dist/src/functions/wirings/auth/serialize-auth-types.d.ts

@@ -4,7 +4,7 @@
  * `SingletonServices` type for the generic `CoreSingletonServices`. This lets
  * users write:
  *
- *   import { pikkuBetterAuth } from '#pikku'
+ *   import { pikkuBetterAuth } from '#pikku/auth'
  *
  * and get proper autocomplete on the factory's `services` param (e.g.
  * `(services) => betterAuth({ database: { db: services.kysely } })` types
@@ -23,13 +23,13 @@
  * with no inline `getSecrets<{ ... }>()` generic, because the secret types flow
  * from the generated `CredentialsMap`.
  *
- * The file is re-exported from `.pikku/pikku-types.gen.ts` (the `#pikku` hub)
- * so the single import resolves correctly.
+ * The file is the `#pikku/auth` leaf's entry, so a project imports it as
+ * `#pikku/auth` and gets nothing else.
  */
 /**
  * A minimal `auth.types.ts` written during bootstrap (before the inspector has
  * run, so the typed wrapper above can't be built yet). It re-exports the raw
- * `pikkuBetterAuth` so `import { pikkuBetterAuth } from '#pikku'` resolves while
+ * `pikkuBetterAuth` so `import { pikkuBetterAuth } from '#pikku/auth'` resolves while
  * codegen is still in its bootstrap state — otherwise the first full inspect (or
  * a standalone `pikku db generate`) crashes importing the user's auth file with
  * "does not provide an export named 'pikkuBetterAuth'". The typed wrapper from

package/dist/src/functions/wirings/auth/serialize-auth-types.js

@@ -5,7 +5,7 @@ import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
  * `SingletonServices` type for the generic `CoreSingletonServices`. This lets
  * users write:
  *
- *   import { pikkuBetterAuth } from '#pikku'
+ *   import { pikkuBetterAuth } from '#pikku/auth'
  *
  * and get proper autocomplete on the factory's `services` param (e.g.
  * `(services) => betterAuth({ database: { db: services.kysely } })` types
@@ -24,13 +24,13 @@ import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
  * with no inline `getSecrets<{ ... }>()` generic, because the secret types flow
  * from the generated `CredentialsMap`.
  *
- * The file is re-exported from `.pikku/pikku-types.gen.ts` (the `#pikku` hub)
- * so the single import resolves correctly.
+ * The file is the `#pikku/auth` leaf's entry, so a project imports it as
+ * `#pikku/auth` and gets nothing else.
  */
 /**
  * A minimal `auth.types.ts` written during bootstrap (before the inspector has
  * run, so the typed wrapper above can't be built yet). It re-exports the raw
- * `pikkuBetterAuth` so `import { pikkuBetterAuth } from '#pikku'` resolves while
+ * `pikkuBetterAuth` so `import { pikkuBetterAuth } from '#pikku/auth'` resolves while
  * codegen is still in its bootstrap state — otherwise the first full inspect (or
  * a standalone `pikku db generate`) crashes importing the user's auth file with
  * "does not provide an export named 'pikkuBetterAuth'". The typed wrapper from

package/dist/src/functions/wirings/channels/pikku-channels.d.ts

@@ -1 +1 @@
-export declare const pikkuChannels: import("#pikku").PikkuFunctionSessionlessConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices, unknown>, undefined, undefined>;
+export declare const pikkuChannels: import("#pikku/function").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/channels/pikku-channels.js

@@ -1,4 +1,4 @@
-import { pikkuVoidFunc } from '#pikku';
+import { pikkuVoidFunc } from '#pikku/function';
 import { serializeFileImports } from '../../../utils/file-imports-serializer.js';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
@@ -26,7 +26,7 @@ export const pikkuChannels = pikkuVoidFunc({
             const importStatement = supportsImportAttributes
                 ? `import metaData from '${jsonImportPath}' with { type: 'json' }`
                 : `import metaData from '${jsonImportPath}'`;
-            await writeFileInDir(logger, channelsWiringMetaFile, `import { pikkuState } from '@pikku/core/ecosystem'\nimport { ChannelsMeta } from '@pikku/core/ecosystem/channel'\n${importStatement}\npikkuState(null, 'channel', 'meta', metaData as ChannelsMeta)`);
+            await writeFileInDir(logger, channelsWiringMetaFile, `import { pikkuState } from '@pikku/core/state'\nimport { ChannelsMeta } from '@pikku/core/channel'\n${importStatement}\npikkuState(null, 'channel', 'meta', metaData as ChannelsMeta)`);
         }
     },
     middleware: [

package/dist/src/functions/wirings/channels/pikku-command-channel-types.d.ts

@@ -1 +1 @@
-export declare const pikkuChannelTypes: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuChannelTypes: import("#pikku/function").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/channels/pikku-command-channel-types.js

@@ -1,13 +1,16 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { serializeChannelTypes } from './serialize-channel-types.js';
 export const pikkuChannelTypes = pikkuSessionlessFunc({
     func: async ({ logger, config }) => {
-        const { channelsTypesFile, functionTypesFile, packageMappings, addonName } = config;
+        const { channelsTypesFile, functionTypesFile, middlewareTypesFile, packageMappings, } = config;
         const functionTypesImportPath = getFileImportRelativePath(channelsTypesFile, functionTypesFile, packageMappings);
-        const content = serializeChannelTypes(functionTypesImportPath, addonName);
+        const middlewareTypesImportPath = getFileImportRelativePath(channelsTypesFile, middlewareTypesFile, packageMappings);
+        const content = serializeChannelTypes(functionTypesImportPath, middlewareTypesImportPath, getFileImportRelativePath(channelsTypesFile, config.authGuardsFile, packageMappings), {
+            addon: !!config.addon,
+        });
         await writeFileInDir(logger, channelsTypesFile, content);
     },
     middleware: [

package/dist/src/functions/wirings/channels/pikku-command-channels-map.d.ts

@@ -1 +1 @@
-export declare const pikkuChannelsMap: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuChannelsMap: import("#pikku/function").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/channels/pikku-command-channels-map.js

@@ -1,4 +1,4 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { serializeTypedChannelsMap } from './serialize-typed-channel-map.js';

package/dist/src/functions/wirings/channels/pikku-command-channels.d.ts

@@ -1 +1 @@
-export declare const pikkuCommandChannels: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuCommandChannels: import("#pikku/function").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/channels/pikku-command-channels.js

@@ -1,4 +1,4 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { serializeFileImports } from '../../../utils/file-imports-serializer.js';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
@@ -41,7 +41,7 @@ export const pikkuCommandChannels = pikkuSessionlessFunc({
         const importStatement = supportsImportAttributes
             ? `import metaData from '${jsonImportPath}' with { type: 'json' }`
             : `import metaData from '${jsonImportPath}'`;
-        await writeFileInDir(logger, channelsWiringMetaFile, `import { pikkuState } from '@pikku/core/ecosystem'\nimport type { ChannelsMeta } from '@pikku/core/ecosystem/channel'\n${importStatement}\npikkuState(null, 'channel', 'meta', metaData as ChannelsMeta)`);
+        await writeFileInDir(logger, channelsWiringMetaFile, `import { pikkuState } from '@pikku/core/state'\nimport type { ChannelsMeta } from '@pikku/core/channel'\n${importStatement}\npikkuState(null, 'channel', 'meta', metaData as ChannelsMeta)`);
         return true;
     },
     middleware: [

package/dist/src/functions/wirings/channels/serialize-channel-types.d.ts

@@ -1,4 +1,6 @@
 /**
  * Generates type definitions for WebSocket channel wirings
  */
-export declare const serializeChannelTypes: (functionTypesImportPath: string, packageName?: string) => string;
+export declare const serializeChannelTypes: (functionTypesImportPath: string, middlewareTypesImportPath: string, authTypesImportPath: string, { addon }?: {
+    addon?: boolean;
+}) => string;