@pikku/cli 0.12.105 → 0.12.109

package/dist/src/functions/wirings/functions/serialize-addon-types.js

@@ -1,10 +1,28 @@
+/**
+ * The install side of `#pikku/addon`, written for an application rather than an
+ * addon. Installing an addon and authoring one are the same concept approached
+ * from opposite ends, and a project is only ever one of the two — but they
+ * cannot share a tree, because a runtime template maps `#pikku/*` onto a
+ * sibling package through tsconfig `paths`, and `paths` are global to a tsx
+ * process rather than scoped to the package that declared them. A linked
+ * addon's leaves would otherwise resolve against the host application's, so an
+ * addon generates its whole tree one level down and authors against
+ * `#pikku/addon/<leaf>` — a depth at which an application has nothing to match,
+ * leaving the resolver to fall back to Node's per-package `imports`.
+ */
+export const serializeAddonInstallTypes = () => `/**
+ * Installing an addon into this application
+ */
+
+export { wireAddon, wireRemoteAddon } from '@pikku/core/addon'
+`;
 export const serializeAddonTypes = (singletonServicesTypeImport, singletonServicesTypeName, configTypeImport, requiredServicesTypeImport, typedSecretServiceImport, typedVariablesServiceImport, typedCredentialServiceImport = null) => {
     return `/**
  * Addon package types for pikkuAddonConfig and pikkuAddonServices
  */
 
-import type { CreateConfig } from '@pikku/core'
-import type { PikkuWire } from '@pikku/core/ecosystem/types'
+import type { CreateConfig } from '@pikku/core/types'
+import type { PikkuWire } from '@pikku/core/types'
 ${singletonServicesTypeImport}
 ${configTypeImport}
 ${requiredServicesTypeImport}

package/dist/src/functions/wirings/functions/serialize-function-imports.d.ts

@@ -1,4 +1,4 @@
-import type { FunctionsMeta } from '@pikku/core/ecosystem/services';
+import type { FunctionsMeta } from '@pikku/core/services';
 export declare const serializeFunctionImports: (outputPath: string, functionsMap: Map<string, {
     path: string;
     exportedName: string;

package/dist/src/functions/wirings/functions/serialize-function-types.d.ts

@@ -1,4 +1,9 @@
 /**
- * Generates core function, middleware, and permission type definitions
+ * Generates the function authoring surface — the definers every wiring points
+ * at and the types they are written against. Middleware, permissions and the
+ * bootstrap factories used to live here too; each is its own decision taken at
+ * its own time, so each is now its own leaf.
  */
-export declare const serializeFunctionTypes: (userSessionTypeImport: string, userSessionTypeName: string, singletonServicesTypeImport: string, singletonServicesTypeName: string, wireServicesTypeImport: string, wireServicesTypeName: string, rpcMapTypeImport: string, requiredServicesTypeImport: string, configTypeImport: string, packageName?: string, workflowTypesImport?: string, nodeCategories?: string[], scopesTypeImport?: string) => string;
+export declare const serializeFunctionTypes: (userSessionTypeImport: string, userSessionTypeName: string, singletonServicesTypeImport: string, singletonServicesTypeName: string, wireServicesTypeImport: string, wireServicesTypeName: string, rpcMapTypeImport: string, requiredServicesTypeImport: string, configTypeImport: string, authTypesImportPath?: string, workflowTypesImport?: string, nodeCategories?: string[], scopesTypeImport?: string, credentialsTypeImport?: string, middlewareTypesImportPath?: string, { addon }?: {
+    addon?: boolean;
+}) => string;

package/dist/src/functions/wirings/functions/serialize-function-types.js

@@ -1,37 +1,50 @@
 /**
- * Generates core function, middleware, and permission type definitions
+ * Generates the function authoring surface — the definers every wiring points
+ * at and the types they are written against. Middleware, permissions and the
+ * bootstrap factories used to live here too; each is its own decision taken at
+ * its own time, so each is now its own leaf.
  */
-export const serializeFunctionTypes = (userSessionTypeImport, userSessionTypeName, singletonServicesTypeImport, singletonServicesTypeName, wireServicesTypeImport, wireServicesTypeName, rpcMapTypeImport, requiredServicesTypeImport, configTypeImport, packageName, workflowTypesImport, nodeCategories, scopesTypeImport) => {
-    const packageNameValue = packageName ? `'${packageName}'` : 'null';
+export const serializeFunctionTypes = (userSessionTypeImport, userSessionTypeName, singletonServicesTypeImport, singletonServicesTypeName, wireServicesTypeImport, wireServicesTypeName, rpcMapTypeImport, requiredServicesTypeImport, configTypeImport, authTypesImportPath = '../auth/pikku-auth-types.gen.js', workflowTypesImport, nodeCategories, scopesTypeImport, credentialsTypeImport, middlewareTypesImportPath = '../middleware/pikku-middleware-types.gen.js', { addon = false } = {}) => {
     const nodeCategoryType = nodeCategories?.length
         ? nodeCategories.map((c) => `'${c}'`).join(' | ')
         : 'string';
     const workflowImport = workflowTypesImport ||
-        `import type { TypedWorkflow, TypedScenario, TypedPersonas } from '../workflow/pikku-workflow-types.gen.js'`;
+        `import type { TypedWorkflow } from '../workflow/pikku-workflow-types.gen.js'
+import type { TypedScenario, TypedPersonas } from '../scenarios/pikku-scenario-types.gen.js'`;
     // Falls back to `string` when a project has no scopes codegen, so that
     // `scopes` stays usable rather than resolving to an unbound type name.
     const scopesImport = scopesTypeImport || `type ScopeId = string`;
+    // Same fallback reasoning as scopes: a project that declares no credentials
+    // never has a credentials leaf to import from, and `wire.getCredential` stays
+    // callable with an explicit type argument.
+    const credentialsImport = credentialsTypeImport || `type CredentialsMap = Record<string, unknown>`;
     return `/**
- * Core function, middleware, and permission types for all wirings
- */
-
-import type { CorePikkuMiddleware, PickRequired } from '@pikku/core'
-import type { ListInput, ListOutput } from '@pikku/core/ecosystem/function'
-import type { CorePermissionGroup, PikkuWire, SecretlessServices } from '@pikku/core/ecosystem/types'
-import type { CorePikkuFunctionConfig, CorePikkuSessionlessFunctionConfig, CorePikkuAuth, CorePikkuAuthConfig, CorePikkuPermission } from '@pikku/core/ecosystem/function'
-import { pikkuAuth as pikkuAuthCore } from '@pikku/core/ecosystem/function'
-import { addTagMiddleware as addTagMiddlewareCore, addGlobalMiddleware as addGlobalMiddlewareCore } from '@pikku/core/middleware'
-import { addGlobalPermission as addGlobalPermissionCore } from '@pikku/core/ecosystem/middleware'
-import { pikkuState as __pikkuState, CreateWireServices } from '@pikku/core/ecosystem'
-import type { NodeType } from '@pikku/core/ecosystem/node'
+ * Core function types for all wirings
+ */
+
+import type { PickRequired } from '@pikku/core/utils'
+import type { ListInput, ListOutput } from '@pikku/core/function'
+import type { CorePermissionGroup } from '@pikku/core/function'
+import type { PikkuWire, SecretlessServices } from '@pikku/core/types'
+import type {
+  CorePikkuFunctionConfig,
+  CorePikkuSessionlessFunctionConfig,
+  CorePikkuPermission,
+} from '@pikku/core/function'
+import type { NodeType } from '@pikku/core/node'
+import type { PikkuMiddleware } from '${middlewareTypesImportPath}'
+import type { PikkuPermission } from '${authTypesImportPath}'
 ${scopesImport}
+${credentialsImport}
 import type { StandardSchemaV1 } from '@standard-schema/spec'
-import { CorePikkuFunction, CorePikkuFunctionSessionless } from '@pikku/core/ecosystem/function'
+import {
+  CorePikkuFunction,
+  CorePikkuFunctionSessionless,
+} from '@pikku/core/function'
 
 ${userSessionTypeImport}
 ${singletonServicesTypeImport}
 ${wireServicesTypeImport}
-${configTypeImport}
 ${rpcMapTypeImport}
 ${requiredServicesTypeImport}
 ${workflowImport}
@@ -39,7 +52,6 @@ ${workflowImport}
 ${singletonServicesTypeName !== 'SingletonServices' ? `export type SingletonServices = ${singletonServicesTypeName}` : `export type { ${singletonServicesTypeName} as SingletonServices }`}
 ${wireServicesTypeName !== 'Services' ? `export type Services = ${wireServicesTypeName}` : `export type { ${wireServicesTypeName} as Services }`}
 ${userSessionTypeName !== 'Session' ? `export type Session = ${userSessionTypeName}` : `export type { ${userSessionTypeName} as Session }`}
-${configTypeImport.includes('Config type not found') ? 'export type Config = any' : ''}
 
 /**
  * The services a wired function actually receives. The inspector records which
@@ -52,9 +64,6 @@ ${configTypeImport.includes('Config type not found') ? 'export type Config = any
 export type WiredSingletonServices = RequiredSingletonServices & SingletonServices
 export type WiredServices = SecretlessServices<RequiredSingletonServices & Services>
 
-/** \`WiredSingletonServices\` without \`secrets\`, for auth gates. */
-export type WiredAuthServices = SecretlessServices<WiredSingletonServices>
-
 /**
  * Inline node configuration for function definitions.
  */
@@ -65,193 +74,6 @@ export type NodeConfig = {
   errorOutput?: boolean
 }
 
-/**
- * Type-safe API permission definition that integrates with your application's session type.
- * Use this to define authorization logic for your API endpoints.
- *
- * @template In - The input type that the permission check will receive
- * @template RequiredServices - The services required for this permission check
- */
-export type PikkuPermission<In = unknown, RequiredServices extends SecretlessServices<Services> = WiredServices> = CorePikkuPermission<In, RequiredServices, PikkuWire<In, never, false, Session>>
-
-/**
- * Type-safe middleware definition that can access your application's services and session.
- * Use this to define reusable middleware that can be applied to multiple wirings.
- *
- * @template RequiredServices - The services required for this middleware
- */
-export type PikkuMiddleware<RequiredServices extends SingletonServices = WiredSingletonServices> = CorePikkuMiddleware<RequiredServices>
-
-/**
- * Configuration object for creating a permission with metadata
- */
-export type PikkuPermissionConfig<In = unknown, RequiredServices extends SecretlessServices<Services> = WiredServices> = {
-  /** The permission function */
-  func: PikkuPermission<In, RequiredServices>
-  /** Optional human-readable name for the permission */
-  name?: string
-  /** Optional description of what the permission checks */
-  description?: string
-}
-
-/**
- * Factory function for creating permissions with tree-shaking support.
- * Supports both direct function and configuration object syntax.
- *
- * @example
- * \`\`\`typescript
- * // Direct function syntax
- * const permission = pikkuPermission(async ({ logger }, data, { session }) => {
- *   const session = await session?.get()
- *   return session?.role === 'admin'
- * })
- *
- * // Configuration object syntax with metadata
- * const adminPermission = pikkuPermission({
- *   name: 'Admin Permission',
- *   description: 'Checks if user has admin role',
- *   func: async ({ logger }, data, { session }) => {
- *     const session = await session?.get()
- *     return session?.role === 'admin'
- *   }
- * })
- * \`\`\`
- */
-export const pikkuPermission = <In>(
-  permission: PikkuPermission<In> | PikkuPermissionConfig<In>
-): PikkuPermission<In> => {
-  return typeof permission === 'function' ? permission : permission.func
-}
-
-/**
- * Type-safe auth-only permission that only needs services and session.
- * Use this for upfront authorization gates (MCP tools, AI agents, workflows)
- * where request data isn't available yet.
- *
- * @template RequiredServices - The services required for this auth check
- */
-export type PikkuAuth<RequiredServices extends SecretlessServices<SingletonServices> = WiredAuthServices> = CorePikkuAuth<RequiredServices, Session>
-
-/**
- * Configuration object for creating an auth permission with metadata
- */
-export type PikkuAuthConfig<RequiredServices extends SecretlessServices<SingletonServices> = WiredAuthServices> = CorePikkuAuthConfig<RequiredServices, Session>
-
-/**
- * Factory function for creating auth-only permissions with tree-shaking support.
- * Auth permissions only receive services and session (no request data),
- * making them evaluable before request data is available.
- *
- * @example
- * \\\`\\\`\\\`typescript
- * const isAuthenticated = pikkuAuth(async ({ logger }, session) => {
- *   return !!session
- * })
- *
- * const isAdmin = pikkuAuth({
- *   name: 'Admin Auth',
- *   description: 'Checks if user is an admin',
- *   func: async ({ logger }, session) => {
- *     return session?.role === 'admin'
- *   }
- * })
- * \\\`\\\`\\\`
- */
-export const pikkuAuth = <RequiredServices extends SecretlessServices<SingletonServices> = WiredAuthServices>(
-  auth: PikkuAuth<RequiredServices> | PikkuAuthConfig<RequiredServices>
-): PikkuPermission<any, any> => {
-  return pikkuAuthCore(auth as any) as any
-}
-
-/**
- * Configuration object for creating middleware with metadata
- */
-export type PikkuMiddlewareConfig<RequiredServices extends SingletonServices = WiredSingletonServices> = {
-  /** The middleware function */
-  func: PikkuMiddleware<RequiredServices>
-  /** Optional human-readable name for the middleware */
-  name?: string
-  /** Optional description of what the middleware does */
-  description?: string
-}
-
-/**
- * Factory function for creating middleware with tree-shaking support.
- * Supports both direct function and configuration object syntax.
- *
- * @example
- * \`\`\`typescript
- * // Direct function syntax
- * const middleware = pikkuMiddleware(({ logger }, wires, next) => {
- *   logger.info('Middleware executed')
- *   await next()
- * })
- *
- * // Configuration object syntax with metadata
- * const logMiddleware = pikkuMiddleware({
- *   name: 'Request Logger',
- *   description: 'Logs all incoming requests',
- *   func: async ({ logger }, wires, next) => {
- *     logger.info('Request started')
- *     await next()
- *   }
- * })
- * \`\`\`
- */
-export const pikkuMiddleware = <RequiredServices extends SingletonServices = WiredSingletonServices>(
-  middleware: PikkuMiddleware<RequiredServices> | PikkuMiddlewareConfig<RequiredServices>
-): PikkuMiddleware<RequiredServices> => {
-  return typeof middleware === 'function' ? middleware : middleware.func
-}
-
-/**
- * Factory function for creating middleware factories
- * Use this when your middleware needs configuration/input parameters
- *
- * @example
- * \`\`\`typescript
- * export const logMiddleware = pikkuMiddlewareFactory<LogOptions>(({
- *   message,
- *   level = 'info'
- * }) => {
- *   return pikkuMiddleware(async ({ logger }, next) => {
- *     logger[level](message)
- *     await next()
- *   })
- * })
- * \`\`\`
- */
-export const pikkuMiddlewareFactory = <In = any>(
-  factory: (input: In) => PikkuMiddleware
-): ((input: In) => PikkuMiddleware) => {
-  return factory
-}
-
-/**
- * Factory function for creating permission factories
- * Use this when your permission needs configuration/input parameters
- *
- * @example
- * \`\`\`typescript
- * export const requireRole = pikkuPermissionFactory<{ role: string }>(({
- *   role
- * }) => {
- *   return pikkuPermission(async ({ logger }, data, { session }) => {
- *     if (!session || session.role !== role) {
- *       logger.warn(\`Permission denied: required role '\${role}'\`)
- *       return false
- *     }
- *     return true
- *   })
- * })
- * \`\`\`
- */
-export const pikkuPermissionFactory = <In = any>(
-  factory: (input: In) => PikkuPermission<any>
-): ((input: In) => PikkuPermission<any>) => {
-  return factory
-}
-
 /**
  * A function that generates a human-readable description of a pending approval action.
  * Used by AI agents to show meaningful approval prompts instead of raw tool arguments.
@@ -306,7 +128,7 @@ export type PikkuFunctionSessionless<
     Out,
     RequiredServices,
     Session,
-    PickRequired<PikkuWire<In, Out, false, Session, TypedPikkuRPC, null, any, TypedWorkflow, unknown, TypedScenario<ScenarioOut>, TypedPersonas>, RequiredWires>
+    PickRequired<PikkuWire<In, Out, false, Session, TypedPikkuRPC, null, any, TypedWorkflow, unknown, TypedScenario<ScenarioOut>, TypedPersonas, CredentialsMap>, RequiredWires>
   >
 
 /**
@@ -327,7 +149,7 @@ export type PikkuFunction<
     Out,
     RequiredServices,
     Session,
-    PickRequired<PikkuWire<In, Out, true, Session, TypedPikkuRPC, null, any, TypedWorkflow, unknown, TypedScenario, TypedPersonas>, RequiredWires>
+    PickRequired<PikkuWire<In, Out, true, Session, TypedPikkuRPC, null, any, TypedWorkflow, unknown, TypedScenario, TypedPersonas, CredentialsMap>, RequiredWires>
   >
 
 /**
@@ -352,20 +174,24 @@ export type PikkuFunctionConfig<
   PikkuFunc extends PikkuFunction<In, Out, RequiredWires, any> | PikkuFunctionSessionless<In, Out, RequiredWires, any, any> = PikkuFunction<In, Out, RequiredWires> | PikkuFunctionSessionless<In, Out, RequiredWires>,
   InputSchema extends StandardSchemaV1 | undefined = undefined,
   OutputSchema extends StandardSchemaV1 | undefined = undefined
-> = CorePikkuFunctionConfig<PikkuFunc, PikkuPermission<In>, PikkuMiddleware, InputSchema, OutputSchema, ScopeId>
+> = Omit<CorePikkuFunctionConfig<PikkuFunc, PikkuPermission<In>, PikkuMiddleware, InputSchema, OutputSchema, ScopeId>, 'node'> & {
+  node?: NodeConfig
+}
 
 /**
  * {@link PikkuFunctionConfig} for a function that runs without a session.
  * Has no \`scopes\`: an anonymous caller holds none, so none can ever be met.
  */
-export type PikkuFunctionSessionlessConfig<
+type PikkuFunctionSessionlessConfig<
   In = unknown,
   Out = unknown,
   RequiredWires extends keyof PikkuWire = never,
   PikkuFunc extends PikkuFunctionSessionless<In, Out, RequiredWires, any> = PikkuFunctionSessionless<In, Out, RequiredWires>,
   InputSchema extends StandardSchemaV1 | undefined = undefined,
   OutputSchema extends StandardSchemaV1 | undefined = undefined
-> = CorePikkuSessionlessFunctionConfig<PikkuFunc, PikkuPermission<In>, PikkuMiddleware, InputSchema, OutputSchema>
+> = Omit<CorePikkuSessionlessFunctionConfig<PikkuFunc, PikkuPermission<In>, PikkuMiddleware, InputSchema, OutputSchema>, 'node'> & {
+  node?: NodeConfig
+}
 
 /**
  * Configuration object for Pikku functions with Zod schema validation.
@@ -380,7 +206,7 @@ type SchemaInferred<S, Fallback = unknown> = S extends StandardSchemaV1
  * Schema-overload variant for pikkuFunc. Derived from CorePikkuFunctionConfig
  * so adding a field on the core type automatically propagates here.
  */
-export type PikkuFunctionConfigWithSchema<
+type PikkuFunctionConfigWithSchema<
   InputSchema extends StandardSchemaV1 | undefined = undefined,
   OutputSchema extends StandardSchemaV1 | undefined = undefined,
   RequiredWires extends keyof PikkuWire = never,
@@ -395,13 +221,14 @@ export type PikkuFunctionConfigWithSchema<
     undefined,
     ScopeId
   >,
-  'func' | 'input' | 'output' | 'permissions' | 'approvalDescription'
+  'func' | 'input' | 'output' | 'permissions' | 'approvalDescription' | 'node'
 > & {
   func:
     | PikkuFunction<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires, RequiredServices>
     | PikkuFunctionSessionless<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires, RequiredServices>
   input?: InputSchema
   output?: OutputSchema
+  node?: NodeConfig
   permissions?: InputSchema extends StandardSchemaV1
     ? CorePermissionGroup<PikkuPermission<InferSchemaOutput<InputSchema>>>
     : undefined
@@ -451,18 +278,6 @@ export function pikkuFunc(func: any) {
   return typeof func === 'function' ? { func } : func
 }
 
-export type PikkuListFunction<
-  F extends Record<string, unknown> = {},
-  Row = unknown,
-  S extends string = never
-> =
-  | PikkuFunction<ListInput<F, S>, ListOutput<Row>, 'session' | 'rpc'>
-  | PikkuFunctionSessionless<
-      ListInput<F, S>,
-      ListOutput<Row>,
-      'session' | 'rpc'
-    >
-
 export const pikkuListFunc = <
   F extends Record<string, unknown> = {},
   Row = unknown,
@@ -485,7 +300,7 @@ export const pikkuListFunc = <
  * CorePikkuSessionlessFunctionConfig to stay in sync with the generic-typed
  * config — so it has no \`scopes\` either.
  */
-export type PikkuFunctionSessionlessConfigWithSchema<
+type PikkuFunctionSessionlessConfigWithSchema<
   InputSchema extends StandardSchemaV1 | undefined = undefined,
   OutputSchema extends StandardSchemaV1 | undefined = undefined,
   RequiredWires extends keyof PikkuWire = never,
@@ -494,7 +309,7 @@ export type PikkuFunctionSessionlessConfigWithSchema<
   CorePikkuSessionlessFunctionConfig<
     PikkuFunctionSessionless<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires, RequiredServices>
   >,
-  'func' | 'input' | 'output' | 'permissions' | 'approvalDescription'
+  'func' | 'input' | 'output' | 'permissions' | 'approvalDescription' | 'node'
 > & {
   func: PikkuFunctionSessionless<
     SchemaInferred<InputSchema>,
@@ -504,6 +319,7 @@ export type PikkuFunctionSessionlessConfigWithSchema<
   >
   input?: InputSchema
   output?: OutputSchema
+  node?: NodeConfig
   permissions?: InputSchema extends StandardSchemaV1
     ? CorePermissionGroup<PikkuPermission<InferSchemaOutput<InputSchema>>>
     : undefined
@@ -572,7 +388,7 @@ export const pikkuVoidFunc = (
   func:
     | PikkuFunctionSessionless<void, void, 'session' | 'rpc'>
     | PikkuFunctionSessionlessConfig<void, void, 'session' | 'rpc'>
-) => {
+): PikkuFunctionConfig<void, void, 'session' | 'rpc'> => {
   return typeof func === 'function' ? { func } : func
 }
 
@@ -648,136 +464,6 @@ export function pikkuRemoteChannelFunc<
   } as any
 }
 
-/**
- * Creates a Pikku config factory.
- * Use this to define your application's configuration factory.
- *
- * @param func - Config factory function that returns your application's config
- * @returns The config factory function
- *
- * @example
- * \`\`\`typescript
- * export const createConfig = pikkuConfig(async () => {
- *   return {
- *     apiUrl: process.env.API_URL || 'http://localhost:3000',
- *     dbUrl: process.env.DATABASE_URL
- *   }
- * })
- * \`\`\`
- */
-export const pikkuConfig = (
-  func: (variables?: any, ...args: any[]) => Promise<Config>
-) => func
-
-
-/**
- * Creates a Pikku singleton services factory.
- * Use this to define services that are created once and shared across all requests.
- *
- * @param func - Singleton services factory function
- * @returns The singleton services factory function
- *
- * @example
- * \`\`\`typescript
- * export const createSingletonServices = pikkuServices(async (config, existingServices) => {
- *   return {
- *     config,
- *     logger: new CustomLogger(),
- *     db: await createDatabaseConnection(config.dbUrl)
- *   }
- * })
- * \`\`\`
- */
-export const pikkuServices = (
-  func: (config: Config, existingServices: Partial<SingletonServices>) => Promise<Partial<Omit<RequiredSingletonServices, 'auth'>>>
-) => {
-  return async (config: Config, existingServices: Partial<SingletonServices> = {}) => {
-    const createdServices = await func(config, existingServices)
-    const services = { ...existingServices, ...createdServices }
-    const authFactory = __pikkuState(null, 'package', 'authFactory')
-    if (authFactory) {
-      let authInstance: Promise<unknown> | undefined
-      ;(services as any).auth = () => {
-        authInstance ??= Promise.resolve()
-          .then(() => authFactory(services as any))
-          .catch((error) => {
-            authInstance = undefined
-            throw error
-          })
-        return authInstance
-      }
-    }
-    const resolved = services as RequiredSingletonServices
-    __pikkuState(null, 'package', 'singletonServices', resolved as any)
-    return resolved
-  }
-}
-
-/**
- * Creates a Pikku wire services factory.
- * Use this to define services that are created per-request/session.
- *
- * @param func - Wire services factory function
- * @returns The wire services factory function
- *
- * @example
- * \`\`\`typescript
- * export const createWireServices = pikkuWireServices(async (services, wire) => {
- *   const session = await wire.session?.get()
- *   return {
- *     userCache: new UserCache(session?.userId)
- *   }
- * })
- * \`\`\`
- */
-export const pikkuWireServices = (
-  func: (
-    services: SingletonServices,
-    wire: any
-  ) => Promise<RequiredWireServices>
-): CreateWireServices => {
-  const factories = __pikkuState(null, 'package', 'factories')
-  __pikkuState(null, 'package', 'factories', { ...factories, createWireServices: func as any })
-  return func as unknown as CreateWireServices
-}
-
-/**
- * Tag-scoped middleware. Applies to any wiring that carries the matching tag.
- *
- * @example
- * addTagMiddleware('admin', [adminMiddleware])
- */
-export const addTagMiddleware = (tag: string, middleware: PikkuMiddleware[]) => {
-  addTagMiddlewareCore(tag, middleware as any, ${packageNameValue})
-}
-
-/**
- * Wire-agnostic global middleware. Runs at the top of every wiring's
- * middleware chain — before wire-, tag-, and function-level entries.
- *
- * Resolution order: global -> wire -> tag -> function.
- *
- * @example
- * addGlobalMiddleware([telemetryMiddleware])
- */
-export const addGlobalMiddleware = (middleware: PikkuMiddleware[]) => {
-  addGlobalMiddlewareCore(middleware as any, ${packageNameValue})
-}
-
-/**
- * Wire-agnostic global permissions. Runs at the top of every wiring's
- * permission resolution — before wire-, tag-, and function-level entries.
- *
- * Resolution order: global -> wire -> tag -> function.
- *
- * @example
- * addGlobalPermission([signedInUser])
- */
-export const addGlobalPermission = <In = unknown>(permissions: CorePermissionGroup<PikkuPermission<In>> | PikkuPermission<In>[]) => {
-  addGlobalPermissionCore(permissions as any, ${packageNameValue})
-}
 
-export { wireAddon, wireRemoteAddon } from '@pikku/core/ecosystem/rpc'
-export type { WireAddonConfig, WireRemoteAddonConfig, RemoteAddonAuth } from '@pikku/core/ecosystem/rpc'
 `;
 };

package/dist/src/functions/wirings/functions/serialize-leaf-index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Generates a leaf's `index.ts`, the file `#pikku/<leaf>` resolves to.
+ *
+ * The indirection exists because the entry filenames differ per leaf
+ * (`pikku-http-types.gen.ts`, `pikku-channel-types.gen.ts`) and are themselves
+ * overridable in `pikku.config.json`, so no single `#pikku/*` pattern can reach
+ * them by name. One generated re-export per leaf gives every wiring a stable
+ * specifier while leaving the entry file wherever the project put it.
+ *
+ * A leaf may have more than one entry. `credentials` splits its definer
+ * (`defineCredential`) from its map (`CredentialsMap`, `TypedCredentialService`)
+ * across two generated files, as `secrets` and `variables` do, and both halves
+ * are the app's to import — so the index re-exports each of them rather than
+ * picking one and leaving the other reachable only by a relative path into
+ * `.pikku`.
+ */
+export declare const serializeLeafIndex: (leaf: string, entryImportPaths: string[]) => string;

package/dist/src/functions/wirings/functions/serialize-leaf-index.js

@@ -0,0 +1,27 @@
+/**
+ * Generates a leaf's `index.ts`, the file `#pikku/<leaf>` resolves to.
+ *
+ * The indirection exists because the entry filenames differ per leaf
+ * (`pikku-http-types.gen.ts`, `pikku-channel-types.gen.ts`) and are themselves
+ * overridable in `pikku.config.json`, so no single `#pikku/*` pattern can reach
+ * them by name. One generated re-export per leaf gives every wiring a stable
+ * specifier while leaving the entry file wherever the project put it.
+ *
+ * A leaf may have more than one entry. `credentials` splits its definer
+ * (`defineCredential`) from its map (`CredentialsMap`, `TypedCredentialService`)
+ * across two generated files, as `secrets` and `variables` do, and both halves
+ * are the app's to import — so the index re-exports each of them rather than
+ * picking one and leaving the other reachable only by a relative path into
+ * `.pikku`.
+ */
+export const serializeLeafIndex = (leaf, entryImportPaths) => {
+    const exports = entryImportPaths
+        .map((path) => `export * from '${path}'`)
+        .join('\n');
+    return `/**
+ * Subpath entry — \`#pikku/${leaf}\` resolves here.
+ */
+
+${exports}
+`;
+};

package/dist/src/functions/wirings/gateway/pikku-command-gateway-types.d.ts

@@ -0,0 +1,7 @@
+export declare const pikkuGatewayTypes: import("#pikku/function").PikkuFunctionConfig<{
+    bootstrap?: boolean;
+}, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<{
+    bootstrap?: boolean;
+}, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<{
+    bootstrap?: boolean;
+}, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/gateway/pikku-command-gateway-types.js

@@ -0,0 +1,24 @@
+import { pikkuSessionlessFunc } from '#pikku/function';
+import { writeFileInDir } from '../../../utils/file-writer.js';
+import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
+import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
+import { serializeGatewayTypes } from './serialize-gateway-types.js';
+export const pikkuGatewayTypes = pikkuSessionlessFunc({
+    func: async ({ logger, config, getInspectorState }, data) => {
+        const { gatewaysTypesFile, packageMappings } = config;
+        const visitState = await getInspectorState(false, true, data?.bootstrap ?? false);
+        const { singletonServicesType } = visitState.filesAndMethods;
+        if (!singletonServicesType) {
+            throw new Error('SingletonServices type not found');
+        }
+        const singletonServicesTypeImport = `import type { ${singletonServicesType.type} } from '${getFileImportRelativePath(gatewaysTypesFile, singletonServicesType.typePath, packageMappings)}'`;
+        const content = serializeGatewayTypes(singletonServicesTypeImport, singletonServicesType.type, { addon: !!config.addon });
+        await writeFileInDir(logger, gatewaysTypesFile, content);
+    },
+    middleware: [
+        logCommandInfoAndTime({
+            commandStart: 'Creating gateway types',
+            commandEnd: 'Created gateway types',
+        }),
+    ],
+});