@pikku/cli 0.12.105 → 0.12.109

package/dist/src/functions/wirings/emails/serialize-emails.js

@@ -29,10 +29,10 @@ ${template.variables
         .join('\n')}
 }
 
-export type EmailTemplateVariables<TName extends EmailTemplateName> =
+type EmailTemplateVariables<TName extends EmailTemplateName> =
   TemplateVariableMap[TName]
 
-export type RenderEmailInput<TName extends EmailTemplateName> = {
+type RenderEmailInput<TName extends EmailTemplateName> = {
   name: TName
   locale?: EmailLocale
   data: EmailTemplateVariables<TName>
@@ -62,32 +62,103 @@ function getNestedValue(source: Record<string, unknown>, path: string): string {
     : ''
 }
 
-function applyTemplate(source: string, context: Record<string, unknown>): string {
-  return source.replace(/\\{\\{\\s*([^}]+?)\\s*\\}\\}/g, (_match, rawKey) => {
-    const key = String(rawKey).trim()
-    if (key === 'content') {
-      return typeof context.content === 'string' ? context.content : ''
-    }
-    if (key.startsWith('>')) {
-      return ''
-    }
-    return getNestedValue(context, key)
+const HTML_ESCAPES: Record<string, string> = {
+  '&': '&amp;',
+  '<': '&lt;',
+  '>': '&gt;',
+  '"': '&quot;',
+  "'": '&#39;',
+}
+
+function escapeHtml(value: string): string {
+  return value.replace(/[&<>"']/g, (char) => HTML_ESCAPES[char] ?? char)
+}
+
+// Matches the raw {{{ value }}} form before the escaped {{ value }} form, so the
+// opt-in escape hatch is never mistaken for a normal substitution.
+const TEMPLATE_TOKEN = /\\{\\{\\{\\s*([^{}]+?)\\s*\\}\\}\\}|\\{\\{\\s*([^}]+?)\\s*\\}\\}/g
+
+const PARTIAL_TOKEN = /\\{\\{\\s*>\\s*([a-zA-Z0-9-_/.]+)\\s*\\}\\}/g
+
+const MAX_TEMPLATE_DEPTH = 5
+
+// theme.json and the locale files ship with the templates, so they are treated as
+// template-author input: expanded before caller data and allowed to contain their
+// own placeholders. Everything else is caller-supplied.
+const TRUSTED_ROOTS = ['theme', 't']
+
+function isTrustedKey(key: string): boolean {
+  return TRUSTED_ROOTS.includes(String(key.split('.')[0]))
+}
+
+function readToken(rawTriple: unknown, rawDouble: unknown) {
+  const raw = typeof rawTriple === 'string'
+  return { raw, key: String(raw ? rawTriple : rawDouble).trim() }
+}
+
+function expandPartials(source: string, depth = 0): string {
+  if (depth >= MAX_TEMPLATE_DEPTH) return source
+  let found = false
+  const expanded = source.replace(PARTIAL_TOKEN, (_match, partialName) => {
+    found = true
+    const partial =
+      EMAIL_PARTIALS[String(partialName).trim() as keyof typeof EMAIL_PARTIALS]
+    return typeof partial === 'string' ? partial : ''
   })
+  return found ? expandPartials(expanded, depth + 1) : expanded
 }
 
-function renderTemplate(source: string, context: Record<string, unknown>): string {
+function expandTrusted(
+  source: string,
+  context: Record<string, unknown>,
+  escape: boolean
+): string {
   let rendered = source
-  for (let i = 0; i < 5; i += 1) {
-    const next = applyTemplate(rendered, context)
-    if (next === rendered) break
+  for (let i = 0; i < MAX_TEMPLATE_DEPTH; i += 1) {
+    let found = false
+    const next = rendered.replace(
+      TEMPLATE_TOKEN,
+      (match, rawTriple, rawDouble) => {
+        const { raw, key } = readToken(rawTriple, rawDouble)
+        if (!isTrustedKey(key)) return match
+        found = true
+        const value = getNestedValue(context, key)
+        return raw || !escape ? value : escapeHtml(value)
+      }
+    )
+    if (!found || next === rendered) break
     rendered = next
   }
   return rendered
 }
 
-function renderPartial(name: string, context: Record<string, unknown>): string {
-  const partial = EMAIL_PARTIALS[name as keyof typeof EMAIL_PARTIALS]
-  return partial ? renderTemplate(partial, context) : ''
+// A single substitution pass — the replacement text is never rescanned, so a
+// caller-supplied value can never be reinterpreted as a template.
+function substitute(
+  source: string,
+  context: Record<string, unknown>,
+  escape: boolean
+): string {
+  return source.replace(TEMPLATE_TOKEN, (_match, rawTriple, rawDouble) => {
+    const { raw, key } = readToken(rawTriple, rawDouble)
+    if (key === 'content') {
+      return typeof context.content === 'string' ? context.content : ''
+    }
+    if (key.startsWith('>')) {
+      return ''
+    }
+    const value = getNestedValue(context, key)
+    return raw || !escape ? value : escapeHtml(value)
+  })
+}
+
+function renderTemplate(
+  source: string,
+  context: Record<string, unknown>,
+  escape: boolean
+): string {
+  const composed = expandTrusted(expandPartials(source), context, escape)
+  return substitute(composed, context, escape)
 }
 
 export const EMAILS = EMAIL_TEMPLATES
@@ -119,39 +190,38 @@ export function renderEmailTemplate<TName extends EmailTemplateName>(
     appName,
   }
 
-  const subject = renderTemplate(template.subject, baseContext).trim()
-  const htmlWithPartials = template.html.replace(
-    /\\{\\{\\s*>\\s*([a-zA-Z0-9-_/.]+)\\s*\\}\\}/g,
-    (_match, partialName) => \`@@PARTIAL:\${String(partialName).trim()}@@\`
-  )
-
-  let htmlBody = renderTemplate(htmlWithPartials, {
-    ...baseContext,
-    subject,
-  })
+  const subject = renderTemplate(template.subject, baseContext, false).trim()
 
-  const partialMatches = [...htmlBody.matchAll(/@@PARTIAL:([^@]+)@@/g)]
-  for (const match of partialMatches) {
-    const rendered = renderPartial(match[1], {
+  const htmlBody = renderTemplate(
+    template.html,
+    {
       ...baseContext,
       subject,
-    })
-    htmlBody = htmlBody.replace(match[0], rendered)
-  }
+    },
+    true
+  )
 
   const html = EMAIL_PARTIALS.layout
-    ? renderTemplate(EMAIL_PARTIALS.layout, {
-        ...baseContext,
-        subject,
-        content: htmlBody,
-      })
+    ? renderTemplate(
+        EMAIL_PARTIALS.layout,
+        {
+          ...baseContext,
+          subject,
+          content: htmlBody,
+        },
+        true
+      )
     : htmlBody
 
   const text = template.text
-    ? renderTemplate(template.text, {
-        ...baseContext,
-        subject,
-      }).trim()
+    ? renderTemplate(
+        template.text,
+        {
+          ...baseContext,
+          subject,
+        },
+        false
+      ).trim()
     : undefined
   const hash = (template.hashes[locale]?.contentHash ??
     '') as RenderedEmail<TName>['hash']

package/dist/src/functions/wirings/errors/pikku-command-error-types.d.ts

@@ -0,0 +1 @@
+export declare const pikkuErrorTypes: import("#pikku/function").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/errors/pikku-command-error-types.js

@@ -0,0 +1,17 @@
+import { pikkuVoidFunc } from '#pikku/function';
+import { writeFileInDir } from '../../../utils/file-writer.js';
+import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
+import { serializeErrorTypes } from './serialize-error-types.js';
+export const pikkuErrorTypes = pikkuVoidFunc({
+    func: async ({ logger, config }) => {
+        const { errorTypesFile } = config;
+        const content = serializeErrorTypes();
+        await writeFileInDir(logger, errorTypesFile, content);
+    },
+    middleware: [
+        logCommandInfoAndTime({
+            commandStart: 'Creating error types',
+            commandEnd: 'Created error types',
+        }),
+    ],
+});

package/dist/src/functions/wirings/errors/serialize-error-types.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Generates the error leaf — the file `#pikku/error` resolves to.
+ *
+ * Unlike the wiring leaves there is nothing project-specific to generate: the
+ * catalogue, `PikkuError` and `addError` all come from core as they are. The
+ * leaf exists so an application names one door for every Pikku import it makes,
+ * rather than reaching past `#pikku` into `@pikku/core` for errors alone.
+ */
+export declare const serializeErrorTypes: () => string;

package/dist/src/functions/wirings/errors/serialize-error-types.js

@@ -0,0 +1,16 @@
+/**
+ * Generates the error leaf — the file `#pikku/error` resolves to.
+ *
+ * Unlike the wiring leaves there is nothing project-specific to generate: the
+ * catalogue, `PikkuError` and `addError` all come from core as they are. The
+ * leaf exists so an application names one door for every Pikku import it makes,
+ * rather than reaching past `#pikku` into `@pikku/core` for errors alone.
+ */
+export const serializeErrorTypes = () => {
+    return `/**
+ * Error catalogue — \`#pikku/error\` resolves here.
+ */
+
+export * from '@pikku/core/errors'
+`;
+};

package/dist/src/functions/wirings/functions/pikku-command-addon-types.d.ts

@@ -1,5 +1,5 @@
 type AddonTypesCommandInput = {
     bootstrap?: boolean;
 };
-export declare const pikkuAddonTypes: import("#pikku").PikkuFunctionConfig<AddonTypesCommandInput, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<AddonTypesCommandInput, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<AddonTypesCommandInput, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuAddonTypes: import("#pikku/function").PikkuFunctionConfig<AddonTypesCommandInput, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<AddonTypesCommandInput, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<AddonTypesCommandInput, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;
 export {};

package/dist/src/functions/wirings/functions/pikku-command-addon-types.js

@@ -1,18 +1,30 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
+import { rm } from 'fs/promises';
 import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
 import { checkRequiredTypes } from '../../../utils/check-required-types.js';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
-import { serializeAddonTypes } from './serialize-addon-types.js';
+import { serializeAddonInstallTypes, serializeAddonTypes, } from './serialize-addon-types.js';
 export const pikkuAddonTypes = pikkuSessionlessFunc({
     func: async ({ logger, config, getInspectorState }, input) => {
+        const { addonTypesFile, addonSetupTypesFile, packageMappings, servicesFile, secretsFile, credentialsFile, variablesFile, } = config;
+        // A project is one or the other, so the half it is not keeps no file on
+        // disk. A tree generated before it changed kind still has that file, and
+        // `existsSync` is what decides a leaf is alive — so left behind it would
+        // keep the wrong `#pikku/addon` resolving forever.
+        await rm(config.addon ? addonTypesFile : addonSetupTypesFile, {
+            force: true,
+        });
+        // An application installs addons; an addon package declares itself. Both
+        // halves are static, so the app half needs no inspector pass and is written
+        // on the bootstrap run as readily as on the full one.
         if (!config.addon) {
+            await writeFileInDir(logger, addonTypesFile, serializeAddonInstallTypes());
             return;
         }
-        const { addonTypesFile, packageMappings, servicesFile, secretsFile, credentialsFile, variablesFile, } = config;
         const bootstrap = input?.bootstrap === true;
         if (bootstrap) {
-            await writeFileInDir(logger, addonTypesFile, 'export {}\n');
+            await writeFileInDir(logger, addonSetupTypesFile, 'export {}\n');
             return;
         }
         const visitState = await getInspectorState();
@@ -24,12 +36,12 @@ export const pikkuAddonTypes = pikkuSessionlessFunc({
             throw new Error('Required types not found');
         }
         const configTypeImport = pikkuConfigType
-            ? `import type { ${pikkuConfigType.type} } from '${getFileImportRelativePath(addonTypesFile, pikkuConfigType.typePath, packageMappings)}'`
+            ? `import type { ${pikkuConfigType.type} } from '${getFileImportRelativePath(addonSetupTypesFile, pikkuConfigType.typePath, packageMappings)}'`
             : '// Config type not found, will use fallback';
-        const content = serializeAddonTypes(`import type { ${singletonServicesType.type} } from '${getFileImportRelativePath(addonTypesFile, singletonServicesType.typePath, packageMappings)}'`, singletonServicesType.type, configTypeImport, `import type { RequiredSingletonServices } from '${getFileImportRelativePath(addonTypesFile, servicesFile, packageMappings)}'`, `import { TypedSecretService } from '${getFileImportRelativePath(addonTypesFile, secretsFile, packageMappings)}'`, `import { TypedVariablesService } from '${getFileImportRelativePath(addonTypesFile, variablesFile, packageMappings)}'`, visitState.credentials?.definitions?.length > 0
-            ? `import { TypedCredentialService } from '${getFileImportRelativePath(addonTypesFile, credentialsFile, packageMappings)}'`
+        const content = serializeAddonTypes(`import type { ${singletonServicesType.type} } from '${getFileImportRelativePath(addonSetupTypesFile, singletonServicesType.typePath, packageMappings)}'`, singletonServicesType.type, configTypeImport, `import type { RequiredSingletonServices } from '${getFileImportRelativePath(addonSetupTypesFile, servicesFile, packageMappings)}'`, `import { TypedSecretService } from '${getFileImportRelativePath(addonSetupTypesFile, secretsFile, packageMappings)}'`, `import { TypedVariablesService } from '${getFileImportRelativePath(addonSetupTypesFile, variablesFile, packageMappings)}'`, visitState.credentials?.definitions?.length > 0
+            ? `import { TypedCredentialService } from '${getFileImportRelativePath(addonSetupTypesFile, credentialsFile, packageMappings)}'`
             : null);
-        await writeFileInDir(logger, addonTypesFile, content);
+        await writeFileInDir(logger, addonSetupTypesFile, content);
     },
     middleware: [
         logCommandInfoAndTime({

package/dist/src/functions/wirings/functions/pikku-command-function-types-split.d.ts

@@ -1,7 +1,7 @@
-export declare const pikkuFunctionTypesSplit: import("#pikku").PikkuFunctionConfig<{
+export declare const pikkuFunctionTypesSplit: import("#pikku/function").PikkuFunctionConfig<{
     bootstrap?: boolean;
-}, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{
+}, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<{
     bootstrap?: boolean;
-}, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<{
+}, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<{
     bootstrap?: boolean;
-}, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+}, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/functions/pikku-command-function-types-split.js

@@ -1,14 +1,17 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
 import { checkRequiredTypes } from '../../../utils/check-required-types.js';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { serializeFunctionTypes } from './serialize-function-types.js';
 import { serializeAddonRefs } from './serialize-addon-refs.js';
+import { serializeMiddlewareTypes } from '../middleware/serialize-middleware-types.js';
+import { serializeSetupTypes } from '../setup/serialize-setup-types.js';
+import { serializeAuthGuards } from '../auth/serialize-auth-guards.js';
 export const pikkuFunctionTypesSplit = pikkuSessionlessFunc({
     func: async ({ logger, config, getInspectorState }, data) => {
         const visitState = await getInspectorState(false, true, data?.bootstrap ?? false);
-        const { functionTypesFile, packageMappings, rpcInternalMapDeclarationFile, servicesFile, } = config;
+        const { functionTypesFile, middlewareTypesFile, setupTypesFile, authGuardsFile, packageMappings, rpcInternalMapDeclarationFile, servicesFile, credentialsFile, } = config;
         // Check for required types
         checkRequiredTypes(visitState.filesAndMethodsErrors, {
             userSessionType: true,
@@ -19,10 +22,21 @@ export const pikkuFunctionTypesSplit = pikkuSessionlessFunc({
         if (!userSessionType || !wireServicesType || !singletonServicesType) {
             throw new Error('Required types not found');
         }
+        // The credentials leaf is only written when the project declares at least
+        // one credential, so importing from it unconditionally would emit a broken
+        // import for every project that declares none.
+        const credentialsTypeImport = credentialsFile && visitState.credentials?.definitions.length
+            ? `import type { CredentialsMap } from '${getFileImportRelativePath(functionTypesFile, credentialsFile, packageMappings)}'`
+            : undefined;
         const configTypeImport = pikkuConfigType
             ? `import type { ${pikkuConfigType.type} } from '${getFileImportRelativePath(functionTypesFile, pikkuConfigType.typePath, packageMappings)}'`
             : '// Config type not found, will use fallback';
-        const content = serializeFunctionTypes(`import type { ${userSessionType.type} } from '${getFileImportRelativePath(functionTypesFile, userSessionType.typePath, packageMappings)}'`, userSessionType.type, `import type { ${singletonServicesType.type} } from '${getFileImportRelativePath(functionTypesFile, singletonServicesType.typePath, packageMappings)}'`, singletonServicesType.type, `import type { ${wireServicesType.type} } from '${getFileImportRelativePath(functionTypesFile, wireServicesType.typePath, packageMappings)}'`, wireServicesType.type, `import type { TypedPikkuRPC, FlattenedRPCMap } from '${getFileImportRelativePath(functionTypesFile, rpcInternalMapDeclarationFile, packageMappings)}'`, `import type { RequiredSingletonServices, RequiredWireServices } from '${getFileImportRelativePath(functionTypesFile, servicesFile, packageMappings)}'`, configTypeImport, config.addonName, undefined, typeof config.addon === 'object' ? config.addon?.categories : undefined, `import type { ScopeId } from '${getFileImportRelativePath(functionTypesFile, config.scopesFile, packageMappings)}'`);
+        const content = serializeFunctionTypes(`import type { ${userSessionType.type} } from '${getFileImportRelativePath(functionTypesFile, userSessionType.typePath, packageMappings)}'`, userSessionType.type, `import type { ${singletonServicesType.type} } from '${getFileImportRelativePath(functionTypesFile, singletonServicesType.typePath, packageMappings)}'`, singletonServicesType.type, `import type { ${wireServicesType.type} } from '${getFileImportRelativePath(functionTypesFile, wireServicesType.typePath, packageMappings)}'`, wireServicesType.type, `import type { TypedPikkuRPC, FlattenedRPCMap } from '${getFileImportRelativePath(functionTypesFile, rpcInternalMapDeclarationFile, packageMappings)}'`, `import type { RequiredSingletonServices } from '${getFileImportRelativePath(functionTypesFile, servicesFile, packageMappings)}'`, configTypeImport, getFileImportRelativePath(functionTypesFile, authGuardsFile, packageMappings), undefined, typeof config.addon === 'object' ? config.addon?.categories : undefined, `import type { ScopeId } from '${getFileImportRelativePath(functionTypesFile, config.scopesFile, packageMappings)}'`, credentialsTypeImport, getFileImportRelativePath(functionTypesFile, middlewareTypesFile, packageMappings), { addon: !!config.addon });
+        await writeFileInDir(logger, middlewareTypesFile, serializeMiddlewareTypes(getFileImportRelativePath(middlewareTypesFile, functionTypesFile, packageMappings), config.addonName));
+        await writeFileInDir(logger, setupTypesFile, serializeSetupTypes(getFileImportRelativePath(setupTypesFile, functionTypesFile, packageMappings), pikkuConfigType
+            ? `import type { ${pikkuConfigType.type} } from '${getFileImportRelativePath(setupTypesFile, pikkuConfigType.typePath, packageMappings)}'`
+            : '// Config type not found, will use fallback', pikkuConfigType?.type, `import type { RequiredSingletonServices, RequiredWireServices } from '${getFileImportRelativePath(setupTypesFile, servicesFile, packageMappings)}'`));
+        await writeFileInDir(logger, authGuardsFile, serializeAuthGuards(getFileImportRelativePath(authGuardsFile, functionTypesFile, packageMappings), config.addonName));
         const addonRefs = serializeAddonRefs({
             addonHttp: visitState.exportedContracts.addonHttp,
             addonChannel: visitState.exportedContracts.addonChannel,

package/dist/src/functions/wirings/functions/pikku-command-functions.d.ts

@@ -1 +1 @@
-export declare const pikkuFunctions: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuFunctions: import("#pikku/function").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/functions/pikku-command-functions.js

@@ -1,4 +1,4 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { serializeFunctionImports } from './serialize-function-imports.js';
@@ -27,7 +27,7 @@ export const pikkuFunctions = pikkuSessionlessFunc({
             ? `import metaData from '${jsonImportPath}' with { type: 'json' }`
             : `import metaData from '${jsonImportPath}'`;
         const packageName = config.addonName ? `'${config.addonName}'` : 'null';
-        await writeFileInDir(logger, functionsMetaFile, `import { pikkuState } from '@pikku/core/ecosystem'\nimport type { FunctionsMeta } from '@pikku/core/ecosystem/services'\n${importStatement}\npikkuState(${packageName}, 'function', 'meta', metaData as FunctionsMeta)`);
+        await writeFileInDir(logger, functionsMetaFile, `import { pikkuState } from '@pikku/core/state'\nimport type { FunctionsMeta } from '@pikku/core/services'\n${importStatement}\npikkuState(${packageName}, 'function', 'meta', metaData as FunctionsMeta)`);
         // For addon packages, register ALL functions (they'll be invoked by consumers)
         // For main packages, only register functions that are invoked via internal RPCs
         const isAddon = !!config.addonName;

package/dist/src/functions/wirings/functions/pikku-command-leaf-indexes.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The entry files a wiring's leaf is reached by. An addon never generates
+ * the wiring leaves, so those indexes are simply absent and `#pikku/http`
+ * fails to resolve rather than resolving to a module missing the export.
+ *
+ * Most leaves have a single entry. `secrets` and `variables` split their definer
+ * from their typed-service map across two generated files, `auth` pairs its
+ * always-written permission surface with a better-auth wrapper only some
+ * projects have, and `setup` holds the application's definers or the addon's —
+ * a project being only ever one kind — so each entry is listed and the index
+ * re-exports whichever of them the project actually generated.
+ */
+export declare const leafEntries: readonly [readonly ["function", readonly ["functionTypesFile"]], readonly ["middleware", readonly ["middlewareTypesFile"]], readonly ["setup", readonly ["setupTypesFile", "addonSetupTypesFile"]], readonly ["error", readonly ["errorTypesFile"]], readonly ["http", readonly ["httpTypesFile"]], readonly ["channel", readonly ["channelsTypesFile"]], readonly ["gateway", readonly ["gatewaysTypesFile"]], readonly ["trigger", readonly ["triggersTypesFile"]], readonly ["scheduler", readonly ["schedulersTypesFile"]], readonly ["queue", readonly ["queueTypesFile"]], readonly ["workflow", readonly ["workflowTypesFile"]], readonly ["scenarios", readonly ["scenarioTypesFile"]], readonly ["mcp", readonly ["mcpTypesFile"]], readonly ["agent", readonly ["agentTypesFile"]], readonly ["cli", readonly ["cliTypesFile"]], readonly ["addon", readonly ["addonTypesFile"]], readonly ["secrets", readonly ["secretTypesFile", "secretsFile"]], readonly ["credentials", readonly ["credentialsFile"]], readonly ["scopes", readonly ["scopeTypesFile"]], readonly ["variables", readonly ["variableTypesFile", "variablesFile"]], readonly ["auth", readonly ["authGuardsFile", "authTypesFile"]]];
+export declare const pikkuLeafIndexes: import("#pikku/function").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/functions/pikku-command-leaf-indexes.js

@@ -0,0 +1,119 @@
+import { pikkuSessionlessFunc } from '#pikku/function';
+import { existsSync } from 'fs';
+import { readdir, rm } from 'fs/promises';
+import { basename, dirname, join } from 'path';
+import { writeFileInDir } from '../../../utils/file-writer.js';
+import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
+import { serializeLeafIndex } from './serialize-leaf-index.js';
+/**
+ * The entry files a wiring's leaf is reached by. An addon never generates
+ * the wiring leaves, so those indexes are simply absent and `#pikku/http`
+ * fails to resolve rather than resolving to a module missing the export.
+ *
+ * Most leaves have a single entry. `secrets` and `variables` split their definer
+ * from their typed-service map across two generated files, `auth` pairs its
+ * always-written permission surface with a better-auth wrapper only some
+ * projects have, and `setup` holds the application's definers or the addon's —
+ * a project being only ever one kind — so each entry is listed and the index
+ * re-exports whichever of them the project actually generated.
+ */
+export const leafEntries = [
+    ['function', ['functionTypesFile']],
+    ['middleware', ['middlewareTypesFile']],
+    ['setup', ['setupTypesFile', 'addonSetupTypesFile']],
+    ['error', ['errorTypesFile']],
+    ['http', ['httpTypesFile']],
+    ['channel', ['channelsTypesFile']],
+    ['gateway', ['gatewaysTypesFile']],
+    ['trigger', ['triggersTypesFile']],
+    ['scheduler', ['schedulersTypesFile']],
+    ['queue', ['queueTypesFile']],
+    ['workflow', ['workflowTypesFile']],
+    ['scenarios', ['scenarioTypesFile']],
+    ['mcp', ['mcpTypesFile']],
+    ['agent', ['agentTypesFile']],
+    ['cli', ['cliTypesFile']],
+    ['addon', ['addonTypesFile']],
+    ['secrets', ['secretTypesFile', 'secretsFile']],
+    ['credentials', ['credentialsFile']],
+    ['scopes', ['scopeTypesFile']],
+    ['variables', ['variableTypesFile', 'variablesFile']],
+    ['auth', ['authGuardsFile', 'authTypesFile']],
+];
+/**
+ * Leaves whose entire content is a wiring an addon has no registry to reach, so
+ * the addon half of the leaf would export nothing at all. They are named rather
+ * than inferred from what is on disk: a project that used to be an application
+ * still has the files an earlier run wrote, which would otherwise keep the leaf
+ * looking alive to `existsSync` forever.
+ */
+const ADDON_RETIRED_LEAVES = new Set(['queue', 'scheduler', 'gateway', 'cli']);
+export const pikkuLeafIndexes = pikkuSessionlessFunc({
+    func: async ({ logger, config }) => {
+        const written = new Set();
+        const retired = [];
+        for (const [leaf, keys] of leafEntries) {
+            const entryFiles = config.addon && ADDON_RETIRED_LEAVES.has(leaf)
+                ? []
+                : keys
+                    .map((key) => config[key])
+                    .filter((entryFile) => Boolean(entryFile && existsSync(entryFile)));
+            if (entryFiles.length === 0) {
+                // A leaf this project stopped generating — the wiring leaves an addon
+                // never gets, most often. Its directory is still full of the files an
+                // earlier run wrote, and tsc compiles every file in the output tree
+                // whether a barrel re-exports it or not, so they have to go with it.
+                retired.push(...keys.map((key) => config[key]).filter(Boolean));
+                continue;
+            }
+            const indexFile = join(dirname(entryFiles[0]), 'index.ts');
+            const entryImportPaths = entryFiles
+                .filter((entryFile) => entryFile !== indexFile)
+                .map((entryFile) => `./${basename(entryFile).replace(/\.ts$/, '.js')}`);
+            if (entryImportPaths.length === 0)
+                continue;
+            await writeFileInDir(logger, indexFile, serializeLeafIndex(leaf, entryImportPaths));
+            written.add(indexFile);
+        }
+        // This command owns the leaf surface outright. An index it did not write is
+        // one whose entry file is gone — a wiring the project stopped generating,
+        // or a directory that was never a leaf — and left in place it keeps
+        // `#pikku/<name>` resolving to a module that no longer compiles.
+        const outDirEntries = existsSync(config.outDir)
+            ? await readdir(config.outDir, { withFileTypes: true })
+            : [];
+        for (const entry of outDirEntries) {
+            if (!entry.isDirectory())
+                continue;
+            const indexFile = join(config.outDir, entry.name, 'index.ts');
+            if (written.has(indexFile) || !existsSync(indexFile))
+                continue;
+            await rm(indexFile, { force: true });
+        }
+        for (const entryFile of retired) {
+            await rm(entryFile, { force: true });
+            await rm(join(dirname(entryFile), 'index.ts'), { force: true });
+        }
+        // `console/pikku-node-types.gen.ts` held only `NodeCategory` and
+        // `NodeRPCName`, which nothing derived from. A project generated before it
+        // was dropped still has the file, and tsc compiles every file in the output
+        // tree whether anything re-exports it or not.
+        await rm(join(config.outDir, 'console', 'pikku-node-types.gen.ts'), {
+            force: true,
+        });
+        // `defineCredential` moved to the auth leaf, next to the permissions and
+        // auth gates it is declared alongside. A project generated before the move
+        // still has the file, and tsc compiles every file in the output tree.
+        await rm(join(config.outDir, 'credentials', 'pikku-credential-types.gen.ts'), { force: true });
+        // The re-export hub every leaf now replaces. A project generated before the
+        // split still has it, and it would keep resolving `#pikku` while pulling in
+        // every wiring's core dependencies.
+        await rm(join(config.outDir, 'pikku-types.gen.ts'), { force: true });
+    },
+    middleware: [
+        logCommandInfoAndTime({
+            commandStart: 'Creating leaf subpath entries',
+            commandEnd: 'Created leaf subpath entries',
+        }),
+    ],
+});

package/dist/src/functions/wirings/functions/pikku-command-services.d.ts

@@ -1,2 +1,2 @@
 export declare const serializeServicesMap: (allSingletonServices: string[], allWireServices: string[], requiredServices: Set<string>, forceRequiredServices: string[] | undefined, servicesImport: string, wireServicesImport: string, addonRequiredParentServices?: string[], authInjected?: boolean, agentScaffoldEnabled?: boolean) => string;
-export declare const pikkuServices: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuServices: import("#pikku/function").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/functions/pikku-command-services.js

@@ -1,4 +1,5 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
+import { ErrorCode } from '@pikku/inspector';
 import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
 import { checkRequiredTypes } from '../../../utils/check-required-types.js';
 import { writeFileInDir } from '../../../utils/file-writer.js';
@@ -116,8 +117,22 @@ export const pikkuServices = pikkuSessionlessFunc({
         if (!wireServicesType || !singletonServicesType) {
             throw new Error('Required types not found: wireServicesType or singletonServicesType');
         }
-        const servicesImport = `import type { ${singletonServicesType.type} } from '${getFileImportRelativePath(config.typesDeclarationFile, singletonServicesType.typePath, config.packageMappings)}'`;
-        const wireServicesImport = `import type { ${wireServicesType.type} } from '${getFileImportRelativePath(config.typesDeclarationFile, wireServicesType.typePath, config.packageMappings)}'`;
+        // `SingletonServices` always carries the framework's own singletons, so an
+        // empty list is never a project with no services — it is the inspector's
+        // program failing to resolve the type, usually because a `#pikku/*` leaf it
+        // imports does not exist yet. Written out, every service becomes optional in
+        // `RequiredSingletonServices`, and the failure resurfaces as dozens of
+        // unrelated "possibly undefined" errors in files nobody touched.
+        if (visitState.serviceAggregation.allSingletonServices.length === 0) {
+            throw new Error(`[${ErrorCode.SINGLETON_SERVICES_TYPE_UNRESOLVED}] '${singletonServicesType.type}' resolved to no services at all, which means it did not resolve.\n` +
+                `Declared in ${singletonServicesType.typePath}.\n\n` +
+                'This is usually a stale or partial generated tree: a source file imports a ' +
+                '`#pikku/*` leaf that the current output no longer writes, so the type it ' +
+                'feeds resolves to an error type. Delete the output directory and re-run to ' +
+                'rebuild it from scratch.');
+        }
+        const servicesImport = `import type { ${singletonServicesType.type} } from '${getFileImportRelativePath(config.servicesFile, singletonServicesType.typePath, config.packageMappings)}'`;
+        const wireServicesImport = `import type { ${wireServicesType.type} } from '${getFileImportRelativePath(config.servicesFile, wireServicesType.typePath, config.packageMappings)}'`;
         const servicesCode = serializeServicesMap(visitState.serviceAggregation.allSingletonServices, visitState.serviceAggregation.allWireServices, visitState.serviceAggregation.requiredServices, config.forceRequiredServices, servicesImport, wireServicesImport, config.addonName ? visitState.addonRequiredParentServices : [], Boolean(visitState.auth?.definition), Boolean(config.scaffold?.agent));
         await writeFileInDir(logger, config.servicesFile, servicesCode);
     },

package/dist/src/functions/wirings/functions/schemas.d.ts

@@ -1 +1 @@
-export declare const pikkuSchemas: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuSchemas: import("#pikku/function").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/functions/schemas.js

@@ -1,4 +1,4 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { saveSchemas } from '../../../utils/serialize-schemas.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { partitionRequiredSchemas } from '../scenarios/scenario-schema-partition.js';

package/dist/src/functions/wirings/functions/serialize-addon-types.d.ts

@@ -1 +1,14 @@
+/**
+ * The install side of `#pikku/addon`, written for an application rather than an
+ * addon. Installing an addon and authoring one are the same concept approached
+ * from opposite ends, and a project is only ever one of the two — but they
+ * cannot share a tree, because a runtime template maps `#pikku/*` onto a
+ * sibling package through tsconfig `paths`, and `paths` are global to a tsx
+ * process rather than scoped to the package that declared them. A linked
+ * addon's leaves would otherwise resolve against the host application's, so an
+ * addon generates its whole tree one level down and authors against
+ * `#pikku/addon/<leaf>` — a depth at which an application has nothing to match,
+ * leaving the resolver to fall back to Node's per-package `imports`.
+ */
+export declare const serializeAddonInstallTypes: () => string;
 export declare const serializeAddonTypes: (singletonServicesTypeImport: string, singletonServicesTypeName: string, configTypeImport: string, requiredServicesTypeImport: string, typedSecretServiceImport: string, typedVariablesServiceImport: string, typedCredentialServiceImport?: string | null) => string;