@pikku/cli 0.12.105 → 0.12.109

package/dist/src/functions/wirings/scopes/serialize-scopes-client.js

@@ -0,0 +1,72 @@
+import { flattenScopeDefinitions } from '@pikku/core/scope';
+const quote = (value) => `'${value.replace(/'/g, "\\'")}'`;
+/**
+ * Generates the browser-side scope client: the `ScopeId` union and a
+ * `hasScopes` that decides whether held grants satisfy a requirement.
+ *
+ * The cascade is emitted inline rather than imported, so the file a frontend
+ * bundles has no imports at all. `@pikku/core` is a server package — it pulls
+ * AsyncLocalStorage and the wiring runtime behind it — so a UI reaching for
+ * `@pikku/core/scope` to render a permission drags the server into the bundle.
+ * `serialize-scopes-client.test.ts` checks this copy against core's over a
+ * shared case table.
+ */
+export const serializeScopesClient = ({ definitions, }) => {
+    const flat = flattenScopeDefinitions(definitions);
+    const ids = flat.map((s) => s.id);
+    const hasChildren = (id) => ids.some((other) => other.startsWith(`${id}:`));
+    const requirable = [
+        ...ids,
+        ...ids.filter(hasChildren).map((id) => `${id}:*`),
+    ].sort();
+    const union = requirable.length > 0
+        ? `\n${requirable.map((id) => `  | ${quote(id)}`).join('\n')}`
+        : ' never';
+    return `/**
+ * This file was generated by the @pikku/cli
+ */
+
+/**
+ * Every scope a function can require.
+ *
+ * A \`:*\` entry requires the scope and all of its descendants. A held grant of
+ * \`admin:*\` satisfies any \`admin:...\` requirement.
+ */
+export type ScopeId =${union}
+
+const SEPARATOR = ':'
+const WILDCARD = '*'
+
+const satisfyingGrants = (scope: string): string[] => {
+  const segments = scope.split(SEPARATOR)
+  const grants = [scope, \`\${scope}\${SEPARATOR}\${WILDCARD}\`]
+  for (let i = 0; i < segments.length; i++) {
+    grants.push([...segments.slice(0, i), WILDCARD].join(SEPARATOR))
+  }
+  for (let i = 1; i < segments.length; i++) {
+    grants.push(segments.slice(0, i).join(SEPARATOR))
+  }
+  return grants
+}
+
+const holds = (held: ReadonlySet<string>, scope: string): boolean =>
+  satisfyingGrants(scope).some((grant) => held.has(grant))
+
+/**
+ * Whether \`held\` satisfies every scope in \`required\`.
+ *
+ * Fails closed: absent grants satisfy nothing. An empty \`required\` is
+ * satisfied by anything.
+ */
+export const hasScopes = (
+  required: readonly string[] | undefined,
+  held: Iterable<string> | undefined
+): boolean => {
+  if (!required || required.length === 0) {
+    return true
+  }
+  const grants = new Set(held ?? [])
+  return required.every((scope) => holds(grants, scope))
+}
+`;
+};

package/dist/src/functions/wirings/scopes/serialize-scopes-types.d.ts

@@ -1,4 +1,4 @@
-import type { ScopeDefinitions } from '@pikku/core/ecosystem/scope';
+import type { ScopeDefinitions } from '@pikku/core/scope';
 export interface SerializeScopesOptions {
     definitions: ScopeDefinitions;
 }

package/dist/src/functions/wirings/scopes/serialize-scopes-types.js

@@ -1,4 +1,4 @@
-import { flattenScopeDefinitions } from '@pikku/core/ecosystem/scope';
+import { flattenScopeDefinitions } from '@pikku/core/scope';
 const quote = (value) => `'${value.replace(/'/g, "\\'")}'`;
 /**
  * Generates the `ScopeId` union and scope metadata from `defineScope`
@@ -30,8 +30,8 @@ export const serializeScopesTypes = ({ definitions, }) => {
     return `/**
  * This file was generated by the @pikku/cli
  */
-import type { FlatScope, ScopeDefinitionsMeta } from '@pikku/core/ecosystem/scope'
-import { flattenScopeDefinitions } from '@pikku/core/ecosystem/scope'
+import type { FlatScope, ScopeDefinitionsMeta } from '@pikku/core/scope'
+import { flattenScopeDefinitions } from '@pikku/core/scope'
 import definitions from './pikku-scopes-meta.gen.json' with { type: 'json' }
 
 /**

package/dist/src/functions/wirings/secrets/pikku-command-secrets.d.ts

@@ -1 +1 @@
-export declare const pikkuSecrets: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuSecrets: import("#pikku/function").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/secrets/pikku-command-secrets.js

@@ -1,8 +1,8 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { serializeSecretsTypes } from './serialize-secrets-types.js';
-import { validateAndBuildSecretDefinitionsMeta } from '@pikku/core/ecosystem/secret';
+import { validateAndBuildSecretDefinitionsMeta } from '@pikku/core/secret';
 export const pikkuSecrets = pikkuSessionlessFunc({
     func: async ({ logger, config, getInspectorState }) => {
         const { secretsFile, secretsMetaJsonFile, packageMappings } = config;

package/dist/src/functions/wirings/secrets/serialize-secrets-types.d.ts

@@ -1,4 +1,4 @@
-import type { SecretDefinitions } from '@pikku/core/ecosystem/secret';
+import type { SecretDefinitions } from '@pikku/core/secret';
 import type { SchemaRef } from '@pikku/inspector';
 export interface SerializeSecretsOptions {
     definitions: SecretDefinitions;

package/dist/src/functions/wirings/secrets/serialize-secrets-types.js

@@ -1,4 +1,4 @@
-import { validateAndBuildSecretDefinitionsMeta } from '@pikku/core/ecosystem/secret';
+import { validateAndBuildSecretDefinitionsMeta } from '@pikku/core/secret';
 import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
 /**
  * A display name is the human-facing label a developer wrote, so an apostrophe
@@ -31,22 +31,28 @@ export const serializeSecretsTypes = ({ definitions, schemaLookup, secretsFile,
                     schemaImports.set(schemaRef.sourceFile, new Set());
                 }
                 schemaImports.get(schemaRef.sourceFile).add(schemaRef.variableName);
-                mapEntries.push(`  '${meta.secretId}': z.infer<typeof ${schemaRef.variableName}>`);
-                metaEntries.push(`  '${meta.secretId}': { name: '${name}', displayName: ${literal(meta.displayName)} }`);
+                mapEntries.push(`  '${meta.secretId}'${meta.optional ? '?' : ''}: z.infer<typeof ${schemaRef.variableName}>`);
+                metaEntries.push(`  '${meta.secretId}': { name: '${name}', displayName: ${literal(meta.displayName)}${meta.optional ? ', optional: true' : ''} }`);
             }
         }
     }
     const imports = [];
     imports.push(`import { TypedSecretService as CoreTypedSecretService } from '@pikku/core/services'
-import type { CredentialMeta } from '@pikku/core/ecosystem/services'`);
+import type { CredentialMeta } from '@pikku/core/services'`);
     imports.push(`import type { SecretService } from '@pikku/core/services'`);
-    imports.push(`import type { SecretDefinitionsMeta } from '@pikku/core/secret'`);
-    imports.push(`import secretsMeta from './pikku-secrets-meta.gen.json' with { type: 'json' }`);
+    imports.push(`/**
+ * Side-effect import of the metadata sidecar, so that tsc emits the .json
+ * alongside this file. An addon publishes only its compiled output, and a host
+ * reads that .json off disk to discover the addon's declared secrets — an
+ * uncopied sidecar leaves them invisible to the host. Nothing binds it: the
+ * sidecar is not part of \`#pikku/secrets\`.
+ */
+import './pikku-secrets-meta.gen.json' with { type: 'json' }`);
     if (needsZod) {
         imports.push(`import type { z } from 'zod'`);
     }
     if (needsOAuth2Types) {
-        imports.push(`import type { OAuth2AppCredential, OAuth2Token } from '@pikku/core/ecosystem/oauth2'`);
+        imports.push(`import type { OAuth2AppCredential, OAuth2Token } from '@pikku/core/oauth2'`);
     }
     for (const [sourceFile, variableNames] of schemaImports) {
         const importPath = getFileImportRelativePath(secretsFile, sourceFile, packageMappings);
@@ -55,23 +61,10 @@ import type { CredentialMeta } from '@pikku/core/ecosystem/services'`);
     }
     return `${imports.join('\n')}
 
-/**
- * Every secret declared in this package.
- *
- * Read from the metadata sidecar rather than inlined, so that the import above
- * forces tsc to emit the .json alongside this file. An addon publishes only its
- * compiled output, and a host reads that .json to discover the addon's declared
- * secrets — an uncopied sidecar leaves them invisible to the host.
- */
-export const SECRETS_META: SecretDefinitionsMeta =
-  secretsMeta as SecretDefinitionsMeta
-
-export interface CredentialsMap {
+export type CredentialsMap = {
 ${mapEntries.join('\n')}
 }
 
-export type SecretId = keyof CredentialsMap
-
 const CREDENTIALS_META: Record<string, CredentialMeta> = {
 ${metaEntries.join(',\n')}
 }

package/dist/src/functions/wirings/setup/serialize-setup-types.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Generates the setup surface — the three factories a project declares exactly
+ * once, at the point the application is brought up. Grouping them apart from
+ * the function types keeps `#pikku/function` to what a feature imports every
+ * day and `#pikku/setup` to what bootstrap imports and never touches again.
+ */
+export declare const serializeSetupTypes: (functionTypesImportPath: string, configTypeImport: string, configTypeName: string | undefined, requiredServicesTypeImport: string) => string;

package/dist/src/functions/wirings/setup/serialize-setup-types.js

@@ -0,0 +1,111 @@
+/**
+ * Generates the setup surface — the three factories a project declares exactly
+ * once, at the point the application is brought up. Grouping them apart from
+ * the function types keeps `#pikku/function` to what a feature imports every
+ * day and `#pikku/setup` to what bootstrap imports and never touches again.
+ */
+export const serializeSetupTypes = (functionTypesImportPath, configTypeImport, configTypeName, requiredServicesTypeImport) => {
+    return `/**
+ * Config and service factory definitions, declared once per application
+ */
+
+import { pikkuState as __pikkuState } from '@pikku/core/state'
+import { CreateWireServices } from '@pikku/core/types'
+import type { SingletonServices } from '${functionTypesImportPath}'
+${configTypeImport}
+${requiredServicesTypeImport}
+${!configTypeName ? 'export type Config = any' : configTypeName === 'Config' ? 'export type { Config }' : `export type { ${configTypeName} as Config }`}
+
+/**
+ * Creates a Pikku config factory.
+ * Use this to define your application's configuration factory.
+ *
+ * @param func - Config factory function that returns your application's config
+ * @returns The config factory function
+ *
+ * @example
+ * \`\`\`typescript
+ * export const createConfig = pikkuConfig(async () => {
+ *   return {
+ *     apiUrl: process.env.API_URL || 'http://localhost:3000',
+ *     dbUrl: process.env.DATABASE_URL
+ *   }
+ * })
+ * \`\`\`
+ */
+export const pikkuConfig = (
+  func: (variables?: any, ...args: any[]) => Promise<Config>
+) => func
+
+/**
+ * Creates a Pikku singleton services factory.
+ * Use this to define services that are created once and shared across all requests.
+ *
+ * @param func - Singleton services factory function
+ * @returns The singleton services factory function
+ *
+ * @example
+ * \`\`\`typescript
+ * export const createSingletonServices = pikkuServices(async (config, existingServices) => {
+ *   return {
+ *     config,
+ *     logger: new CustomLogger(),
+ *     db: await createDatabaseConnection(config.dbUrl)
+ *   }
+ * })
+ * \`\`\`
+ */
+export const pikkuServices = (
+  func: (config: Config, existingServices: Partial<SingletonServices>) => Promise<Partial<Omit<RequiredSingletonServices, 'auth'>>>
+) => {
+  return async (config: Config, existingServices: Partial<SingletonServices> = {}) => {
+    const createdServices = await func(config, existingServices)
+    const services = { ...existingServices, ...createdServices }
+    const authFactory = __pikkuState(null, 'package', 'authFactory')
+    if (authFactory) {
+      let authInstance: Promise<unknown> | undefined
+      ;(services as any).auth = () => {
+        authInstance ??= Promise.resolve()
+          .then(() => authFactory(services as any))
+          .catch((error) => {
+            authInstance = undefined
+            throw error
+          })
+        return authInstance
+      }
+    }
+    const resolved = services as RequiredSingletonServices
+    __pikkuState(null, 'package', 'singletonServices', resolved as any)
+    return resolved
+  }
+}
+
+/**
+ * Creates a Pikku wire services factory.
+ * Use this to define services that are created per-request/session.
+ *
+ * @param func - Wire services factory function
+ * @returns The wire services factory function
+ *
+ * @example
+ * \`\`\`typescript
+ * export const createWireServices = pikkuWireServices(async (services, wire) => {
+ *   const session = await wire.session?.get()
+ *   return {
+ *     userCache: new UserCache(session?.userId)
+ *   }
+ * })
+ * \`\`\`
+ */
+export const pikkuWireServices = (
+  func: (
+    services: SingletonServices,
+    wire: any
+  ) => Promise<RequiredWireServices>
+): CreateWireServices => {
+  const factories = __pikkuState(null, 'package', 'factories')
+  __pikkuState(null, 'package', 'factories', { ...factories, createWireServices: func as any })
+  return func as unknown as CreateWireServices
+}
+`;
+};

package/dist/src/functions/wirings/triggers/pikku-command-trigger-types.d.ts

@@ -1,7 +1,7 @@
-export declare const pikkuTriggerTypes: import("#pikku").PikkuFunctionConfig<{
+export declare const pikkuTriggerTypes: import("#pikku/function").PikkuFunctionConfig<{
     bootstrap?: boolean;
-}, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{
+}, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<{
     bootstrap?: boolean;
-}, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<{
+}, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<{
     bootstrap?: boolean;
-}, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+}, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/triggers/pikku-command-trigger-types.js

@@ -1,4 +1,4 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
@@ -12,7 +12,7 @@ export const pikkuTriggerTypes = pikkuSessionlessFunc({
             throw new Error('SingletonServices type not found');
         }
         const singletonServicesTypeImport = `import type { ${singletonServicesType.type} } from '${getFileImportRelativePath(triggersTypesFile, singletonServicesType.typePath, packageMappings)}'`;
-        const content = serializeTriggerTypes(singletonServicesTypeImport, singletonServicesType.type);
+        const content = serializeTriggerTypes(singletonServicesTypeImport, singletonServicesType.type, { addon: !!config.addon });
         await writeFileInDir(logger, triggersTypesFile, content);
     },
     middleware: [

package/dist/src/functions/wirings/triggers/pikku-command-trigger.d.ts

@@ -1 +1 @@
-export declare const pikkuTrigger: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuTrigger: import("#pikku/function").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/triggers/pikku-command-trigger.js

@@ -1,4 +1,4 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { serializeFileImports } from '../../../utils/file-imports-serializer.js';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';

package/dist/src/functions/wirings/triggers/serialize-trigger-meta.d.ts

@@ -1,4 +1,4 @@
-import type { TriggerMeta, TriggerSourceMeta } from '@pikku/core/ecosystem/trigger';
+import type { TriggerMeta, TriggerSourceMeta } from '@pikku/core/trigger';
 export declare const serializeTriggerMeta: (triggerMeta: TriggerMeta) => TriggerMeta;
 export declare const serializeTriggerMetaTS: (triggerMeta: TriggerMeta, jsonImportPath: string, supportsImportAttributes: boolean) => string;
 export declare const serializeTriggerSourceMeta: (sourceMeta: TriggerSourceMeta) => TriggerSourceMeta;

package/dist/src/functions/wirings/triggers/serialize-trigger-meta.js

@@ -6,8 +6,8 @@ export const serializeTriggerMetaTS = (triggerMeta, jsonImportPath, supportsImpo
         ? `import metaData from '${jsonImportPath}' with { type: 'json' }`
         : `import metaData from '${jsonImportPath}'`;
     const serializedOutput = [];
-    serializedOutput.push("import { pikkuState } from '@pikku/core/ecosystem'");
-    serializedOutput.push("import { TriggerMeta } from '@pikku/core/ecosystem/trigger'");
+    serializedOutput.push("import { pikkuState } from '@pikku/core/state'");
+    serializedOutput.push("import { TriggerMeta } from '@pikku/core/trigger'");
     serializedOutput.push(importStatement);
     serializedOutput.push('');
     serializedOutput.push("pikkuState(null, 'trigger', 'meta', metaData as TriggerMeta)");
@@ -26,8 +26,8 @@ export const serializeTriggerSourceMetaTS = (sourceMeta, jsonImportPath, support
         ? `import metaData from '${jsonImportPath}' with { type: 'json' }`
         : `import metaData from '${jsonImportPath}'`;
     const serializedOutput = [];
-    serializedOutput.push("import { pikkuState } from '@pikku/core/ecosystem'");
-    serializedOutput.push("import { TriggerSourceMeta } from '@pikku/core/ecosystem/trigger'");
+    serializedOutput.push("import { pikkuState } from '@pikku/core/state'");
+    serializedOutput.push("import { TriggerSourceMeta } from '@pikku/core/trigger'");
     serializedOutput.push(importStatement);
     serializedOutput.push('');
     serializedOutput.push("pikkuState(null, 'trigger', 'sourceMeta', metaData as TriggerSourceMeta)");

package/dist/src/functions/wirings/triggers/serialize-trigger-types.d.ts

@@ -1,4 +1,6 @@
 /**
  * Generates type definitions for trigger wirings
  */
-export declare const serializeTriggerTypes: (singletonServicesTypeImport: string, singletonServicesTypeName: string) => string;
+export declare const serializeTriggerTypes: (singletonServicesTypeImport: string, singletonServicesTypeName: string, { addon }?: {
+    addon?: boolean;
+}) => string;

package/dist/src/functions/wirings/triggers/serialize-trigger-types.js

@@ -1,14 +1,16 @@
 /**
  * Generates type definitions for trigger wirings
  */
-export const serializeTriggerTypes = (singletonServicesTypeImport, singletonServicesTypeName) => {
+export const serializeTriggerTypes = (singletonServicesTypeImport, singletonServicesTypeName, { addon = false } = {}) => {
     return `/**
  * Trigger-specific type definitions for tree-shaking optimization
  */
 
-import { wireTrigger as wireTriggerCore, wireTriggerSource as wireTriggerSourceCore } from '@pikku/core/trigger'
-import { CorePikkuTriggerFunction, CorePikkuTriggerFunctionConfig, CoreTrigger } from '@pikku/core/ecosystem/trigger'
-import type { CoreNodeConfig } from '@pikku/core/ecosystem/node'
+${addon ? '' : `import { wireTrigger as wireTriggerCore, wireTriggerSource as wireTriggerSourceCore } from '@pikku/core/trigger'\n`}import {
+  CorePikkuTriggerFunction,
+  CorePikkuTriggerFunctionConfig,${addon ? '' : `\n  CoreTrigger,`}
+} from '@pikku/core/trigger'
+import type { CoreNodeConfig } from '@pikku/core/node'
 ${singletonServicesTypeImport}
 import type { StandardSchemaV1 } from '@standard-schema/spec'
 
@@ -21,7 +23,7 @@ ${singletonServicesTypeName !== 'SingletonServices' ? `type SingletonServices =
  * @template TInput - Input type (configuration passed when wired)
  * @template TOutput - Output type produced when trigger fires
  */
-export type PikkuTriggerFunction<
+type PikkuTriggerFunction<
   TInput = unknown,
   TOutput = unknown
 > = CorePikkuTriggerFunction<TInput, TOutput, SingletonServices>
@@ -29,7 +31,7 @@ export type PikkuTriggerFunction<
 /**
  * Configuration object for creating a trigger function with metadata
  */
-export type PikkuTriggerFunctionConfig<
+type PikkuTriggerFunctionConfig<
   TInput = unknown,
   TOutput = unknown,
   InputSchema extends StandardSchemaV1 | undefined = undefined,
@@ -46,7 +48,7 @@ type InferSchemaOutput<T> = T extends StandardSchemaV1<any, infer Output> ? Outp
  * Use this when you want to define input/output schemas using Zod.
  * Types are automatically inferred from the schemas.
  */
-export type PikkuTriggerFunctionConfigWithSchema<
+type PikkuTriggerFunctionConfigWithSchema<
   InputSchema extends StandardSchemaV1,
   OutputSchema extends StandardSchemaV1 | undefined = undefined
 > = {
@@ -66,22 +68,23 @@ export type PikkuTriggerFunctionConfigWithSchema<
  * Type definition for trigger wirings.
  * Declares a trigger name and its target pikku function.
  */
-export type TriggerWiring = CoreTrigger
-
-/**
+${addon ? '' : `type TriggerWiring = CoreTrigger\n`}
+${addon
+        ? ''
+        : `/**
  * A trigger source with the subscription function, using project-specific services.
  *
  * @template TInput - Input type passed to the trigger function
  * @template TOutput - Output type produced when trigger fires
  */
-export type TriggerSource<
+type TriggerSource<
   TInput = unknown,
   TOutput = unknown
 > = {
   name: string
   func: PikkuTriggerFunctionConfig<TInput, TOutput>
 } & (unknown extends TInput ? { input?: TInput } : { input: TInput })
-
+`}
 /**
  * Creates a trigger function configuration.
  * Use this to define trigger functions that set up subscriptions.
@@ -135,6 +138,9 @@ export function pikkuTriggerFunc(triggerOrConfig: any) {
   return triggerOrConfig
 }
 
+${addon
+        ? ''
+        : `
 /**
  * Registers a trigger with the Pikku framework.
  * Declares a trigger name and its target pikku function.
@@ -160,5 +166,5 @@ export const wireTriggerSource = <TInput = unknown, TOutput = unknown>(
 ) => {
   wireTriggerSourceCore(source as any)
 }
-`;
+`}`;
 };

package/dist/src/functions/wirings/user-admin/pikku-command-user-admin-functions.d.ts

@@ -1 +1 @@
-export declare const pikkuUserAdminFunctions: import("#pikku").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuUserAdminFunctions: import("#pikku/function").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/user-admin/pikku-command-user-admin-functions.js

@@ -1,9 +1,8 @@
-import { pikkuSessionlessFunc } from '#pikku';
-import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
+import { pikkuSessionlessFunc } from '#pikku/function';
+import { getLeafImportPath } from '../../../utils/leaf-import-path.js';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { serializeUserAdminFunctions } from './serialize-user-admin-functions.js';
-import { resolveScaffoldFeature } from '../../../utils/resolve-scaffold-feature.js';
 export const pikkuUserAdminFunctions = pikkuSessionlessFunc({
     func: async ({ logger, config, getInspectorState }) => {
         if (!config.scaffold?.userAdmin ||
@@ -16,27 +15,28 @@ export const pikkuUserAdminFunctions = pikkuSessionlessFunc({
             return false;
         }
         const { definition } = (await getInspectorState()).auth;
-        // These functions are thin wrappers over better-auth's admin() endpoints.
-        // Without that plugin the endpoints do not exist, so the scaffold would
-        // generate four RPCs that throw on every call and four scopes that grant
-        // nothing. Fail the codegen instead of shipping that.
+        // Every one of these functions drives better-auth's internal adapter, so
+        // without a better-auth instance the scaffold would generate RPCs that
+        // throw on every call and scopes that grant nothing. Fail the codegen
+        // instead of shipping that.
         if (!definition) {
             throw new Error(`"scaffold.userAdmin" is enabled but no pikkuBetterAuth(...) was found in the project.\n` +
-                `User management wraps better-auth's admin() endpoints, so there is nothing to wrap.\n` +
+                `User management works through better-auth's internal adapter, so there is nothing to manage.\n` +
                 `Fix: set up Better Auth before scaffolding user management, or remove ` +
                 `"scaffold.userAdmin" from pikku.config.json.`);
         }
-        if (!definition.plugins.includes('admin')) {
-            throw new Error(`"scaffold.userAdmin" is enabled but better-auth is configured without the admin() plugin.\n` +
-                `Ban, delete, session-revocation and set-password are implemented by that plugin — without it ` +
-                `the generated functions would fail on every call.\n` +
-                `Fix: add admin() to the plugins array in ${definition.sourceFile}:\n` +
-                `  import { admin } from 'better-auth/plugins'\n` +
-                `  betterAuth({ plugins: [admin()] })\n` +
-                `Then re-run codegen. Or remove "scaffold.userAdmin" from pikku.config.json.`);
+        // Ban is the one capability with a schema requirement of its own, and it is
+        // only one of the six — a warning rather than a failure, so an app that
+        // never bans anyone is not forced to carry the columns.
+        if (!definition.plugins.includes('ban')) {
+            logger.warn(`"scaffold.userAdmin" is enabled but better-auth is configured without the ban() plugin, ` +
+                `so the banned/banReason/banExpires columns do not exist and setUserBanned will fail.\n` +
+                `Fix: add ban() to the plugins array in ${definition.sourceFile}:\n` +
+                `  import { ban } from '@pikku/better-auth'\n` +
+                `  betterAuth({ plugins: [ban()] })`);
         }
-        const pathToPikkuTypes = getFileImportRelativePath(config.userAdminFunctionsFile, config.typesDeclarationFile, config.packageMappings);
-        const { schemas, functions } = serializeUserAdminFunctions(pathToPikkuTypes, resolveScaffoldFeature('userAdmin', config.scaffold.userAdmin).auth);
+        const leaf = (name) => getLeafImportPath(config.userAdminFunctionsFile, name, config);
+        const { schemas, functions } = serializeUserAdminFunctions(leaf);
         await writeFileInDir(logger, config.userAdminSchemasFile, schemas);
         await writeFileInDir(logger, config.userAdminFunctionsFile, functions);
         return true;

package/dist/src/functions/wirings/user-admin/serialize-user-admin-functions.d.ts

@@ -4,16 +4,17 @@ export interface UserAdminGenOutput {
 }
 /**
  * Generate the user-management functions into the project scaffold: the
- * directory read plus the writes that wrap better-auth's `admin()` endpoints.
+ * directory read plus the writes that administer it.
  *
- * Scaffolded rather than shipped in an addon because managing users is ordinary
- * application behaviour: an app should not have to install the console — which
- * exists to be served alongside a running dev server — just to list or ban its
- * own users. The console UI calls these same functions when it is present.
+ * Superseded by `@pikku/addon-admin`, which ships these same functions plus
+ * roles, credentials and the audit trail, and which an app can wire without
+ * installing the console. Kept for hosts still on the scaffold; the scope tree
+ * below must stay byte-identical to the addon's, or an app with both fails
+ * codegen on conflicting declarations.
  *
- * Each function is gated on its own `admin:users:*` scope. The writes are only
- * meaningful where `admin()` is wired, which is why this file is generated only
- * in that case.
+ * Each function is gated on its own `admin:users:*` scope, and works through
+ * better-auth's internal adapter. Banning additionally needs the `ban()` plugin
+ * from `@pikku/better-auth` for the columns it writes to exist.
  *
  * Emitted as two files. The schemas are zod, and the inspector reads a zod
  * schema by importing the module that declares it — which it cannot do for the
@@ -21,4 +22,4 @@ export interface UserAdminGenOutput {
  * rewrites. Keeping the schemas in a sibling module that imports nothing but
  * zod sidesteps that entirely.
  */
-export declare const serializeUserAdminFunctions: (pathToPikkuTypes: string, requireAuth?: boolean) => UserAdminGenOutput;
+export declare const serializeUserAdminFunctions: (leaf: (name: string) => string) => UserAdminGenOutput;