@pikku/cli 0.12.105 → 0.12.109

package/dist/src/functions/wirings/user-admin/serialize-user-admin-functions.js

@@ -1,15 +1,16 @@
 /**
  * Generate the user-management functions into the project scaffold: the
- * directory read plus the writes that wrap better-auth's `admin()` endpoints.
+ * directory read plus the writes that administer it.
  *
- * Scaffolded rather than shipped in an addon because managing users is ordinary
- * application behaviour: an app should not have to install the console — which
- * exists to be served alongside a running dev server — just to list or ban its
- * own users. The console UI calls these same functions when it is present.
+ * Superseded by `@pikku/addon-admin`, which ships these same functions plus
+ * roles, credentials and the audit trail, and which an app can wire without
+ * installing the console. Kept for hosts still on the scaffold; the scope tree
+ * below must stay byte-identical to the addon's, or an app with both fails
+ * codegen on conflicting declarations.
  *
- * Each function is gated on its own `admin:users:*` scope. The writes are only
- * meaningful where `admin()` is wired, which is why this file is generated only
- * in that case.
+ * Each function is gated on its own `admin:users:*` scope, and works through
+ * better-auth's internal adapter. Banning additionally needs the `ban()` plugin
+ * from `@pikku/better-auth` for the columns it writes to exist.
  *
  * Emitted as two files. The schemas are zod, and the inspector reads a zod
  * schema by importing the module that declares it — which it cannot do for the
@@ -17,8 +18,7 @@
  * rewrites. Keeping the schemas in a sibling module that imports nothing but
  * zod sidesteps that entirely.
  */
-export const serializeUserAdminFunctions = (pathToPikkuTypes, requireAuth = true) => {
-    const authFlag = requireAuth ? 'true' : 'false';
+export const serializeUserAdminFunctions = (leaf) => {
     const schemas = `/**
  * Auto-generated user management schemas
  * Do not edit manually - regenerate with 'npx pikku'
@@ -27,9 +27,9 @@ import { z } from 'zod'
 
 /**
  * A user, as the directory sees one. Ban state is optional because those
- * columns belong to better-auth's \`admin()\` plugin: a host without it reports
- * no ban state at all, which a client can render as "unknown" rather than as a
- * misleading "not banned".
+ * columns belong to the \`ban()\` plugin: a host without it reports no ban state
+ * at all, which a client can render as "unknown" rather than as a misleading
+ * "not banned".
  */
 export const User = z.object({
   id: z.string(),
@@ -86,8 +86,15 @@ export const Success = z.object({
  * Auto-generated user management functions
  * Do not edit manually - regenerate with 'npx pikku'
  */
-import { pikkuFunc, defineScope } from '${pathToPikkuTypes}'
-import { callAdminApi } from '@pikku/better-auth'
+import { pikkuFunc } from '${leaf('function')}'
+import { defineScope } from '${leaf('scopes')}'
+import {
+  createAuthUser,
+  deleteAuthUser,
+  revokeAuthUserSessions,
+  setAuthUserBanned,
+  setAuthUserPassword,
+} from '@pikku/better-auth'
 import {
   CreateUserInput,
   CreateUserOutput,
@@ -102,7 +109,7 @@ import {
 // pikku requires every declaration of a shared scope root to be identical, so
 // this is the whole \`admin\` tree — not just the leaves gated below. It must stay
 // byte-identical to ADMIN_SCOPE_TREE in @pikku/better-auth and to the copy in
-// @pikku/addon-console, or codegen fails with conflicting declarations.
+// @pikku/addon-admin, or codegen fails with conflicting declarations.
 defineScope({
   admin: {
     displayName: 'Administration',
@@ -113,6 +120,8 @@ defineScope({
         description: 'Application-wide credentials',
         scopes: {
           link: { description: 'Bind a shared credential for every user' },
+          read: { description: 'Read credential values and who holds them' },
+          manage: { description: 'Set and delete credentials' },
         },
       },
       users: {
@@ -126,6 +135,27 @@ defineScope({
           password: { description: "Set a user's password" },
         },
       },
+      scopes: {
+        description: 'Authorization management',
+        scopes: {
+          read: {
+            description: 'View declared scopes, roles, and who holds them',
+          },
+          manage: {
+            description:
+              'Create and delete roles, change their scopes, and grant roles to users',
+          },
+        },
+      },
+      audit: {
+        description: 'The audit trail',
+        scopes: {
+          read: {
+            description:
+              'Read the audit trail — every recorded action, and which user took it',
+          },
+        },
+      },
     },
   },
 })
@@ -142,9 +172,8 @@ export const pikkuAdminListUsers = pikkuFunc({
   tags: ['pikku'],
   title: 'List Users',
   description:
-    'Lists and searches the user directory, read through the auth adapter rather than an admin endpoint so it works on any database better-auth supports.',
+    'Lists and searches the user directory, read through the auth adapter so it works on any database better-auth supports.',
   expose: true,
-  auth: ${authFlag},
   scopes: ['admin:users:list'],
   input: ListUsersInput,
   output: ListUsersOutput,
@@ -181,46 +210,34 @@ export const pikkuAdminCreateUser = pikkuFunc({
   tags: ['pikku'],
   title: 'Create User',
   description:
-    'Creates a user directly, for provisioning an account out of band rather than through your sign-up flow. better-auth enforces the configured password bounds and rejects a duplicate email.',
+    'Creates a user directly, for provisioning an account out of band rather than through your sign-up flow. Enforces the configured password bounds and rejects a duplicate email.',
   expose: true,
-  auth: ${authFlag},
   scopes: ['admin:users:create'],
   input: CreateUserInput,
   output: CreateUserOutput,
-  func: async ({ auth }, { email, password, name }, { http }) => {
-    const created: any = await callAdminApi(auth, http, (api, headers) =>
-      api.createUser!({
-        body: { email, password, name: name ?? email },
-        headers,
-      })
-    )
-    return { userId: created?.user?.id ?? created?.id }
-  },
+  func: async ({ auth }, { email, password, name }) => ({
+    userId: await createAuthUser(auth, { email, password, name }),
+  }),
 })
 
 export const pikkuAdminSetUserBanned = pikkuFunc({
   tags: ['pikku'],
   title: 'Ban or Unban User',
   description:
-    'Bans a user — revoking their sessions and blocking sign-in — or lifts an existing ban. An expiry lets the ban lapse on its own; without one it holds until it is lifted.',
+    'Bans a user — revoking their sessions and blocking sign-in — or lifts an existing ban. An expiry lets the ban lapse on its own; without one it holds until it is lifted. Requires better-auth wired with the \`ban()\` plugin.',
   expose: true,
-  auth: ${authFlag},
   scopes: ['admin:users:ban'],
   input: SetUserBannedInput,
   output: Success,
   func: async (
     { auth },
     { userId, banned, reason, expiresInSeconds },
-    { http }
+    { session }
   ) => {
-    await callAdminApi(auth, http, (api, headers) =>
-      banned
-        ? api.banUser!({
-            body: { userId, banReason: reason, banExpiresIn: expiresInSeconds },
-            headers,
-          })
-        : api.unbanUser!({ body: { userId }, headers })
-    )
+    if (banned && userId === session?.userId) {
+      throw new Error('You cannot ban yourself')
+    }
+    await setAuthUserBanned(auth, { userId, banned, reason, expiresInSeconds })
     return { success: true }
   },
 })
@@ -231,14 +248,14 @@ export const pikkuAdminRemoveUser = pikkuFunc({
   description:
     'Permanently deletes a user along with their sessions and linked accounts. Cannot be undone.',
   expose: true,
-  auth: ${authFlag},
   scopes: ['admin:users:remove'],
   input: UserRef,
   output: Success,
-  func: async ({ auth }, { userId }, { http }) => {
-    await callAdminApi(auth, http, (api, headers) =>
-      api.removeUser!({ body: { userId }, headers })
-    )
+  func: async ({ auth }, { userId }, { session }) => {
+    if (userId === session?.userId) {
+      throw new Error('You cannot delete yourself')
+    }
+    await deleteAuthUser(auth, userId)
     return { success: true }
   },
 })
@@ -249,14 +266,11 @@ export const pikkuAdminRevokeUserSessions = pikkuFunc({
   description:
     'Signs a user out of every device by deleting all of their sessions. They keep their account and can sign in again.',
   expose: true,
-  auth: ${authFlag},
   scopes: ['admin:users:sessions'],
   input: UserRef,
   output: Success,
-  func: async ({ auth }, { userId }, { http }) => {
-    await callAdminApi(auth, http, (api, headers) =>
-      api.revokeUserSessions!({ body: { userId }, headers })
-    )
+  func: async ({ auth }, { userId }) => {
+    await revokeAuthUserSessions(auth, userId)
     return { success: true }
   },
 })
@@ -265,16 +279,13 @@ export const pikkuAdminSetUserPassword = pikkuFunc({
   tags: ['pikku'],
   title: "Set User's Password",
   description:
-    'Sets a user password out of band, for when they cannot complete a reset themselves. better-auth enforces the configured length bounds.',
+    'Sets a user password out of band, for when they cannot complete a reset themselves. Enforces the configured length bounds, and gives a user who only ever signed in socially a credential account.',
   expose: true,
-  auth: ${authFlag},
   scopes: ['admin:users:password'],
   input: SetUserPasswordInput,
   output: Success,
-  func: async ({ auth }, { userId, newPassword }, { http }) => {
-    await callAdminApi(auth, http, (api, headers) =>
-      api.setUserPassword!({ body: { userId, newPassword }, headers })
-    )
+  func: async ({ auth }, { userId, newPassword }) => {
+    await setAuthUserPassword(auth, { userId, newPassword })
     return { success: true }
   },
 })

package/dist/src/functions/wirings/variables/pikku-command-variables.d.ts

@@ -1 +1 @@
-export declare const pikkuVariables: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuVariables: import("#pikku/function").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/variables/pikku-command-variables.js

@@ -1,8 +1,8 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { serializeVariablesTypes } from './serialize-variables-types.js';
-import { validateAndBuildVariableDefinitionsMeta } from '@pikku/core/ecosystem/variable';
+import { validateAndBuildVariableDefinitionsMeta } from '@pikku/core/variable';
 export const pikkuVariables = pikkuSessionlessFunc({
     func: async ({ logger, config, getInspectorState }) => {
         const { variablesFile, variablesMetaJsonFile, packageMappings } = config;

package/dist/src/functions/wirings/variables/serialize-variables-types.d.ts

@@ -1,4 +1,4 @@
-import type { VariableDefinitions } from '@pikku/core/ecosystem/variable';
+import type { VariableDefinitions } from '@pikku/core/variable';
 import type { SchemaRef } from '@pikku/inspector';
 export interface SerializeVariablesOptions {
     definitions: VariableDefinitions;

package/dist/src/functions/wirings/variables/serialize-variables-types.js

@@ -1,4 +1,4 @@
-import { validateAndBuildVariableDefinitionsMeta } from '@pikku/core/ecosystem/variable';
+import { validateAndBuildVariableDefinitionsMeta } from '@pikku/core/variable';
 import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
 /**
  * A display name is the human-facing label a developer wrote, so an apostrophe
@@ -29,10 +29,19 @@ export const serializeVariablesTypes = ({ definitions, schemaLookup, variablesFi
         }
     }
     const imports = [];
-    imports.push(`import { TypedVariablesService as CoreTypedVariablesService, type VariableMeta } from '@pikku/core/ecosystem/services'`);
+    imports.push(`import {
+  TypedVariablesService as CoreTypedVariablesService,
+  type VariableMeta,
+} from '@pikku/core/services'`);
     imports.push(`import type { VariablesService } from '@pikku/core/services'`);
-    imports.push(`import type { VariableDefinitionsMeta } from '@pikku/core/ecosystem/variable'`);
-    imports.push(`import variablesMeta from './pikku-variables-meta.gen.json' with { type: 'json' }`);
+    imports.push(`/**
+ * Side-effect import of the metadata sidecar, so that tsc emits the .json
+ * alongside this file. An addon publishes only its compiled output, and a host
+ * reads that .json off disk to discover the addon's declared variables — an
+ * uncopied sidecar leaves them invisible to the host. Nothing binds it: the
+ * sidecar is not part of \`#pikku/variables\`.
+ */
+import './pikku-variables-meta.gen.json' with { type: 'json' }`);
     if (needsZod) {
         imports.push(`import type { z } from 'zod'`);
     }
@@ -43,23 +52,10 @@ export const serializeVariablesTypes = ({ definitions, schemaLookup, variablesFi
     }
     return `${imports.join('\n')}
 
-/**
- * Every variable declared in this package.
- *
- * Read from the metadata sidecar rather than inlined, so that the import above
- * forces tsc to emit the .json alongside this file. An addon publishes only its
- * compiled output, and a host reads that .json to discover the addon's declared
- * variables — an uncopied sidecar leaves them invisible to the host.
- */
-export const VARIABLES_META: VariableDefinitionsMeta =
-  variablesMeta as VariableDefinitionsMeta
-
 export interface VariablesMap {
 ${mapEntries.join('\n')}
 }
 
-export type VariableId = keyof VariablesMap
-
 const TYPED_VARIABLES_META: Record<string, VariableMeta> = {
 ${metaEntries.join(',\n')}
 }

package/dist/src/functions/wirings/virtual-user/pikku-command-virtual-user-functions.d.ts

@@ -1 +1 @@
-export declare const pikkuVirtualUserFunctions: import("#pikku").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuVirtualUserFunctions: import("#pikku/function").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/virtual-user/pikku-command-virtual-user-functions.js

@@ -1,9 +1,9 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
+import { getLeafImportPath } from '../../../utils/leaf-import-path.js';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { serializeVirtualUserFunctions } from './serialize-virtual-user-functions.js';
-import { resolveScaffoldFeature } from '../../../utils/resolve-scaffold-feature.js';
 export const pikkuVirtualUserFunctions = pikkuSessionlessFunc({
     func: async ({ logger, config, getInspectorState }) => {
         if (!config.scaffold?.virtualUser ||
@@ -26,9 +26,9 @@ export const pikkuVirtualUserFunctions = pikkuSessionlessFunc({
                 `Fix: declare one with definePersonas({ ... }), or remove ` +
                 `"scaffold.virtualUser" from pikku.config.json.`);
         }
-        const pathToPikkuTypes = getFileImportRelativePath(config.virtualUserFunctionsFile, config.typesDeclarationFile, config.packageMappings);
+        const leaf = (name) => getLeafImportPath(config.virtualUserFunctionsFile, name, config);
         const pathToPersonas = getFileImportRelativePath(config.virtualUserFunctionsFile, config.personasWiringFile, config.packageMappings);
-        const { schemas, functions } = serializeVirtualUserFunctions(pathToPikkuTypes, pathToPersonas, resolveScaffoldFeature('virtualUser', config.scaffold.virtualUser).auth);
+        const { schemas, functions } = serializeVirtualUserFunctions(leaf, pathToPersonas);
         await writeFileInDir(logger, config.virtualUserSchemasFile, schemas);
         await writeFileInDir(logger, config.virtualUserFunctionsFile, functions);
         return true;

package/dist/src/functions/wirings/virtual-user/serialize-virtual-user-functions.d.ts

@@ -25,4 +25,4 @@ export interface VirtualUserGenOutput {
  * rewrites. Keeping the schemas in a sibling module that imports nothing but
  * zod sidesteps that entirely.
  */
-export declare const serializeVirtualUserFunctions: (pathToPikkuTypes: string, pathToPersonas: string, requireAuth?: boolean) => VirtualUserGenOutput;
+export declare const serializeVirtualUserFunctions: (leaf: (name: string) => string, pathToPersonas: string) => VirtualUserGenOutput;

package/dist/src/functions/wirings/virtual-user/serialize-virtual-user-functions.js

@@ -21,8 +21,7 @@
  * rewrites. Keeping the schemas in a sibling module that imports nothing but
  * zod sidesteps that entirely.
  */
-export const serializeVirtualUserFunctions = (pathToPikkuTypes, pathToPersonas, requireAuth = true) => {
-    const authFlag = requireAuth ? 'true' : 'false';
+export const serializeVirtualUserFunctions = (leaf, pathToPersonas) => {
     const schemas = `/**
  * Auto-generated virtual user schemas
  * Do not edit manually - regenerate with 'npx pikku'
@@ -133,9 +132,13 @@ export const ExecuteVirtualUserRunOutput = z.object({
  * Auto-generated virtual user functions
  * Do not edit manually - regenerate with 'npx pikku'
  */
-import { pikkuFunc, pikkuSessionlessFunc, defineScope } from '${pathToPikkuTypes}'
+import { pikkuFunc, pikkuSessionlessFunc } from '${leaf('function')}'
+import { defineScope } from '${leaf('scopes')}'
 import { personaVirtualUserTarget, runVirtualUser as runVirtualUserEngine, type SchemaMap, type VirtualUserDisposition } from '@pikku/core/virtual-user'
-import { prepareVirtualUserRun, PRODUCTION_DISPOSITION } from '@pikku/core/ecosystem/virtual-user'
+import {
+  prepareVirtualUserRun,
+  PRODUCTION_DISPOSITION,
+} from '@pikku/core/virtual-user'
 import { createPersonas, personaConfigs } from '${pathToPersonas}'
 import {
   ExecuteVirtualUserRunInput,
@@ -173,7 +176,6 @@ export const runVirtualUser = pikkuFunc({
   description:
     'Turns a declared persona loose on this application and records what it finds. Returns immediately with a run id; read the result back with getVirtualUserRun.',
   expose: true,
-  auth: ${authFlag},
   scopes: ['virtualUser:run'],
   input: RunVirtualUserInput,
   output: RunVirtualUserOutput,
@@ -261,7 +263,6 @@ export const getVirtualUserRun = pikkuFunc({
   description:
     'Reads a run back: its status, what it found, and the counts the engine kept.',
   expose: true,
-  auth: ${authFlag},
   // Its own scope, and not the one that starts a run: an adversarial run's
   // findings are working exploits carrying live ids, so reading them is the
   // more sensitive of the two.

package/dist/src/functions/wirings/webhook/pikku-command-webhook.d.ts

@@ -1 +1 @@
-export declare const pikkuWebhook: import("#pikku").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuWebhook: import("#pikku/function").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/webhook/pikku-command-webhook.js

@@ -1,18 +1,18 @@
-import { pikkuSessionlessFunc } from '#pikku';
-import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
+import { pikkuSessionlessFunc } from '#pikku/function';
+import { getLeafImportPath } from '../../../utils/leaf-import-path.js';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { removeLegacyScaffoldFile } from '../../../utils/remove-legacy-scaffold-file.js';
 import { serializeWebhook } from './serialize-webhook.js';
+import { isDeployCodegen } from '../../../utils/is-deploy-codegen.js';
 export const pikkuWebhook = pikkuSessionlessFunc({
     func: async ({ logger, config, variables }) => {
-        const deployCodegenFlag = await variables.get('PIKKU_DEPLOY_CODEGEN');
-        if (deployCodegenFlag === '1') {
+        if (await isDeployCodegen(variables)) {
             return false;
         }
         if (config.webhookWorkersFile && config.webhookSchemasFile) {
-            const pathToPikkuTypes = getFileImportRelativePath(config.webhookWorkersFile, config.typesDeclarationFile, config.packageMappings);
-            const { schemas, functions } = serializeWebhook(pathToPikkuTypes);
+            const leaf = (name) => getLeafImportPath(config.webhookWorkersFile, name, config);
+            const { schemas, functions } = serializeWebhook(leaf);
             await writeFileInDir(logger, config.webhookSchemasFile, schemas);
             await writeFileInDir(logger, config.webhookWorkersFile, functions);
             await removeLegacyScaffoldFile(config.webhookWorkersFile);

package/dist/src/functions/wirings/webhook/serialize-webhook.d.ts

@@ -8,4 +8,4 @@ export interface WebhookGenOutput {
  * The handler is inlined: it is wired exactly once, so a named export would
  * only be indirection.
  */
-export declare const serializeWebhook: (pathToPikkuTypes: string) => WebhookGenOutput;
+export declare const serializeWebhook: (leaf: (name: string) => string) => WebhookGenOutput;

package/dist/src/functions/wirings/webhook/serialize-webhook.js

@@ -4,7 +4,7 @@
  * The handler is inlined: it is wired exactly once, so a named export would
  * only be indirection.
  */
-export const serializeWebhook = (pathToPikkuTypes) => {
+export const serializeWebhook = (leaf) => {
     const schemas = `/**
  * Auto-generated outgoing webhook delivery schemas
  * Do not edit manually - regenerate with 'npx pikku'
@@ -23,8 +23,9 @@ export const WebhookDelivery = z.object({
  * Auto-generated outgoing webhook delivery queue worker
  * Do not edit manually - regenerate with 'npx pikku'
  */
-import { pikkuSessionlessFunc, wireQueueWorker } from '${pathToPikkuTypes}'
-import { pikkuWebhookWorkerFunc } from '@pikku/core/ecosystem/services'
+import { pikkuSessionlessFunc } from '${leaf('function')}'
+import { wireQueueWorker } from '${leaf('queue')}'
+import { pikkuWebhookWorkerFunc } from '@pikku/core/services'
 import { WebhookDelivery } from './webhook.schemas.gen.js'
 
 wireQueueWorker({

package/dist/src/functions/wirings/workflow/pikku-command-workflow-routes.d.ts

@@ -1 +1 @@
-export declare const pikkuWorkflowRoutes: import("#pikku").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuWorkflowRoutes: import("#pikku/function").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/workflow/pikku-command-workflow-routes.js

@@ -1,17 +1,16 @@
-import { pikkuSessionlessFunc } from '#pikku';
-import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
+import { pikkuSessionlessFunc } from '#pikku/function';
+import { getLeafImportPath } from '../../../utils/leaf-import-path.js';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { removeLegacyScaffoldFile } from '../../../utils/remove-legacy-scaffold-file.js';
 import { serializeWorkflowRoutes } from './serialize-workflow-routes.js';
-import { resolveScaffoldFeature } from '../../../utils/resolve-scaffold-feature.js';
 export const pikkuWorkflowRoutes = pikkuSessionlessFunc({
     func: async ({ logger, config }) => {
         if (config.scaffold?.workflow &&
             config.workflowRoutesFile &&
             config.workflowRoutesSchemasFile) {
-            const pathToPikkuTypes = getFileImportRelativePath(config.workflowRoutesFile, config.typesDeclarationFile, config.packageMappings);
-            const { schemas, functions } = serializeWorkflowRoutes(pathToPikkuTypes, resolveScaffoldFeature('workflow', config.scaffold?.workflow).auth);
+            const leaf = (name) => getLeafImportPath(config.workflowRoutesFile, name, config);
+            const { schemas, functions } = serializeWorkflowRoutes(leaf);
             await writeFileInDir(logger, config.workflowRoutesSchemasFile, schemas);
             await writeFileInDir(logger, config.workflowRoutesFile, functions);
             await removeLegacyScaffoldFile(config.workflowRoutesFile);

package/dist/src/functions/wirings/workflow/pikku-command-workflow.d.ts

@@ -1,5 +1,5 @@
 type WorkflowCommandInput = {
     bootstrap?: boolean;
 };
-export declare const pikkuWorkflow: import("#pikku").PikkuFunctionConfig<WorkflowCommandInput, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<WorkflowCommandInput, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<WorkflowCommandInput, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuWorkflow: import("#pikku/function").PikkuFunctionConfig<WorkflowCommandInput, boolean | undefined, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<WorkflowCommandInput, boolean | undefined, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<WorkflowCommandInput, boolean | undefined, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;
 export {};

package/dist/src/functions/wirings/workflow/pikku-command-workflow.js

@@ -1,8 +1,9 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { ErrorCode } from '@pikku/inspector';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { serializeWorkflowTypes } from './serialize-workflow-types.js';
+import { serializeScenarioTypes } from './serialize-scenario-types.js';
 import { serializePersonas } from './serialize-personas.js';
 import { resolvePersonas } from '../../../utils/resolve-personas.js';
 import { serializeWorkflowRegistration } from './serialize-workflow-registration.js';
@@ -16,7 +17,7 @@ import { buildFeaturesMeta } from '../scenarios/serialize-feature-meta.js';
 import { serializeScenarioWorkflowMeta } from '../scenarios/serialize-scenario-meta.js';
 import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
 import { stripVerboseFields, hasVerboseFields, } from '../../../utils/strip-verbose-meta.js';
-import { join } from 'path';
+import { join, dirname } from 'path';
 import { rm } from 'fs/promises';
 export const pikkuWorkflow = pikkuSessionlessFunc({
     func: async ({ logger, config, getInspectorState }, input) => {
@@ -88,9 +89,11 @@ export const pikkuWorkflow = pikkuSessionlessFunc({
         const workflowMapImportPath = getFileImportRelativePath(workflowTypesFile, workflowMapDeclarationFile, packageMappings);
         const agentMapImportPath = getFileImportRelativePath(workflowTypesFile, config.agentMapDeclarationFile, packageMappings);
         const scopesImportPath = getFileImportRelativePath(workflowTypesFile, config.scopesFile, packageMappings);
-        const scenarioStepMapImportPath = getFileImportRelativePath(workflowTypesFile, config.scenarioStepMapDeclarationFile, packageMappings);
-        const personasImportPath = getFileImportRelativePath(workflowTypesFile, config.personasWiringFile, packageMappings);
-        await writeFileInDir(logger, workflowTypesFile, serializeWorkflowTypes(functionTypesImportPath, rpcMapImportPath, workflowMapImportPath, agentMapImportPath, scopesImportPath, scenarioStepMapImportPath, personasImportPath));
+        await writeFileInDir(logger, workflowTypesFile, serializeWorkflowTypes(functionTypesImportPath, getFileImportRelativePath(workflowTypesFile, config.middlewareTypesFile, packageMappings), getFileImportRelativePath(workflowTypesFile, config.authGuardsFile, packageMappings), rpcMapImportPath, workflowMapImportPath, agentMapImportPath, scopesImportPath));
+        // Scenarios get their own barrel: a scenario is a testing primitive, and
+        // mixing it into the workflow barrel meant every project that only ships
+        // workflows still imported the whole scenario surface.
+        await writeFileInDir(logger, config.scenarioTypesFile, serializeScenarioTypes(getFileImportRelativePath(config.scenarioTypesFile, functionTypesFile, packageMappings), getFileImportRelativePath(config.scenarioTypesFile, config.middlewareTypesFile, packageMappings), getFileImportRelativePath(config.scenarioTypesFile, workflowTypesFile, packageMappings), getFileImportRelativePath(config.scenarioTypesFile, config.scenarioStepMapDeclarationFile, packageMappings), getFileImportRelativePath(config.scenarioTypesFile, config.personasWiringFile, packageMappings)));
         // Rides the workflow command rather than getting its own codegen node, so
         // it can't drift out of the two hand-maintained ordering lists.
         await writeFileInDir(logger, config.scenarioStepMapDeclarationFile, serializeScenarioStepMap(logger, config.scenarioStepMapDeclarationFile, packageMappings, typesMap, functionState.meta));
@@ -101,6 +104,12 @@ export const pikkuWorkflow = pikkuSessionlessFunc({
             const agentMapImportPath = getFileImportRelativePath(config.personasWiringFile, config.agentMapDeclarationFile, packageMappings);
             const exposedRpcMapImportPath = getFileImportRelativePath(config.personasWiringFile, config.rpcMapDeclarationFile, packageMappings);
             await writeFileInDir(logger, config.personasWiringFile, serializePersonas(personas, agentMapImportPath, exposedRpcMapImportPath));
+            // Same reason as the scenario meta above: a project generated before this
+            // moved to `scenarios/` still has a copy under `workflow/`, and tsc
+            // compiles every file in the output tree whether anything imports it.
+            await rm(join(dirname(workflowTypesFile), 'pikku-personas.gen.ts'), {
+                force: true,
+            });
             // Fixed path getPersonasMeta() reads; kept out of workflow/meta, which
             // getWorkflowMeta() globs as workflows.
             await writeFileInDir(logger, join(config.outDir, 'workflow', 'personas.gen.json'), JSON.stringify(personas, null, 2));

package/dist/src/functions/wirings/workflow/serialize-personas.d.ts

@@ -1,4 +1,4 @@
-import type { ResolvedPersona } from '@pikku/core/ecosystem/services';
+import type { ResolvedPersona } from '@pikku/core/services';
 /**
  * The runtime half of `definePersonas()`.
  *

package/dist/src/functions/wirings/workflow/serialize-personas.js

@@ -8,10 +8,10 @@
  */
 export const serializePersonas = (personas, agentMapImportPath, rpcMapImportPath) => {
     return `/** Personas declared with definePersonas() */
-import { createHttpPersonas } from '@pikku/core/ecosystem/persona'
-import type { HttpPersonasConfig } from '@pikku/core/ecosystem/persona'
+import { createHttpPersonas } from '@pikku/core/persona'
+import type { HttpPersonasConfig } from '@pikku/core/persona'
 import type { ScenarioPersona } from '@pikku/core/services'
-import type { ResolvedPersona } from '@pikku/core/ecosystem/services'
+import type { ResolvedPersona } from '@pikku/core/services'
 import type { AgentMap } from '${agentMapImportPath}'
 import type { FlattenedRPCMap } from '${rpcMapImportPath}'
 

package/dist/src/functions/wirings/workflow/serialize-scenario-step-map.d.ts

@@ -1,4 +1,3 @@
 import { type TypesMap } from '@pikku/inspector';
-import type { FunctionsMeta } from '@pikku/core/ecosystem/services';
-import type { Logger } from '@pikku/core/services';
+import type { FunctionsMeta, Logger } from '@pikku/core/services';
 export declare const serializeScenarioStepMap: (logger: Logger, relativeToPath: string, packageMappings: Record<string, string>, typesMap: TypesMap, functionsMeta: FunctionsMeta) => string;

package/dist/src/functions/wirings/workflow/serialize-scenario-types.d.ts

@@ -0,0 +1,2 @@
+export declare const sharedWorkflowConfigFields = "  title?: string\n  description?: string\n  tags?: string[]\n  expose?: boolean\n  internal?: boolean\n  override?: string\n  version?: number\n  remote?: boolean\n  mcp?: boolean\n  readonly?: boolean\n  approvalRequired?: boolean\n  approvalDescription?: InputSchema extends StandardSchemaV1 ? PikkuApprovalDescription<InferSchemaOutput<InputSchema>> : never\n  middleware?: PikkuMiddleware[]\n  input?: InputSchema\n  output?: OutputSchema\n  node?: NodeConfig\n  errors?: Array<typeof PikkuError>\n  inline?: boolean";
+export declare const serializeScenarioTypes: (functionTypesImportPath: string, middlewareTypesImportPath: string, workflowTypesImportPath: string, scenarioStepMapImportPath: string, personasImportPath: string) => string;