@pikku/cli 0.12.107 → 0.12.110

package/dist/src/functions/commands/serve.js

@@ -14,7 +14,6 @@ import { InMemorySchedulerService } from '@pikku/schedule';
 import { resolveDb, createKysely, parseDatabaseUrl, } from '../db/local-db.js';
 import { loadUserBootstrap, loadUserModule } from './load-user-project.js';
 import { registerScenarioInstrumentation } from '../wirings/scenarios/register-scenario-instrumentation.js';
-import { resolveScaffoldFeature } from '../../utils/resolve-scaffold-feature.js';
 import { createDevAgentRunner } from './dev-agent-runner.js';
 import { resolveConsoleMount } from './serve-console.js';
 import { serverReadyLine } from '../../server/server-ready.js';
@@ -42,7 +41,7 @@ export const serve = pikkuSessionlessFunc({
         // into the project — an app bootstrap is what a deployed bundle imports,
         // and coverage endpoints have no business in one.
         if (config.scaffold?.scenarios) {
-            registerScenarioInstrumentation(resolveScaffoldFeature('scenarios', config.scaffold.scenarios).auth);
+            registerScenarioInstrumentation();
         }
         const workflowService = new InMemoryWorkflowService();
         const configModule = await loadUserModule(pikkuConfigFactory.file);

package/dist/src/functions/runtimes/tanstack-start/pikku-command-tanstack-start.js

@@ -5,23 +5,23 @@ import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-
 import { serializeTanStackStartShim } from './serialize-tanstack-start-shim.js';
 export const pikkuTanStackStart = pikkuSessionlessFunc({
     func: async ({ logger, config }) => {
-        const startServerFnsFile = config.clientFiles?.startServerFnsFile;
+        const tanstackStartFile = config.clientFiles?.tanstackStartFile;
         const rpcWiringsFile = config.clientFiles?.rpcWiringsFile;
         const { packageMappings } = config;
-        if (!startServerFnsFile) {
+        if (!tanstackStartFile) {
             logger.debug({
-                message: "Skipping generating TanStack Start shim since startServerFnsFile isn't set in the pikku config.",
+                message: "Skipping generating TanStack Start shim since tanstackStartFile isn't set in the pikku config.",
                 type: 'skip',
             });
             return;
         }
         if (!rpcWiringsFile) {
-            logger.warn('Skipping TanStack Start shim: startServerFnsFile is set but rpcWiringsFile is not — the shim imports the PikkuRPC class from rpcWiringsFile.');
+            logger.warn('Skipping TanStack Start shim: tanstackStartFile is set but rpcWiringsFile is not — the shim imports the PikkuRPC class from rpcWiringsFile.');
             return;
         }
-        const rpcWiringsPath = getFileImportRelativePath(startServerFnsFile, rpcWiringsFile, packageMappings);
+        const rpcWiringsPath = getFileImportRelativePath(tanstackStartFile, rpcWiringsFile, packageMappings);
         const content = serializeTanStackStartShim(rpcWiringsPath);
-        await writeFileInDir(logger, startServerFnsFile, content);
+        await writeFileInDir(logger, tanstackStartFile, content);
     },
     middleware: [
         logCommandInfoAndTime({

package/dist/src/functions/validate/shared-checks.js

@@ -139,7 +139,7 @@ export async function runSharedProjectChecks(root) {
             if (pikkuConfig.scaffold?.[s.key])
                 continue;
             const report = s.severity === 'error' ? e : w;
-            report(`pikku-config-no-scaffold-${s.key}`, `pikku.config.json scaffold is missing "${s.key}" — ${s.surface} is never generated, so the console 404s for it`, pikkuConfigPath, lines(`Add "${s.key}" to the scaffold block in pikku.config.json:`, '"scaffold": {', '  "pikkuDir": "packages/functions/src/scaffold",', `  "${s.key}": true`, '}', 'true means enabled and authenticated; write { "auth": false } to go public.', 'Then re-run codegen (`pikku all`) and restart the dev server.'));
+            report(`pikku-config-no-scaffold-${s.key}`, `pikku.config.json scaffold is missing "${s.key}" — ${s.surface} is never generated, so the console 404s for it`, pikkuConfigPath, lines(`Add "${s.key}" to the scaffold block in pikku.config.json:`, '"scaffold": {', '  "pikkuDir": "packages/functions/src/scaffold",', `  "${s.key}": true`, '}', 'Then re-run codegen (`pikku all`) and restart the dev server.'));
         }
     }
     const dbEngine = pikkuConfig?.db?.engine ?? 'sqlite';

package/dist/src/functions/wirings/agent/pikku-command-public-agent.js

@@ -4,12 +4,11 @@ import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { removeLegacyScaffoldFile } from '../../../utils/remove-legacy-scaffold-file.js';
 import { serializePublicAgent } from './serialize-public-agent.js';
-import { resolveScaffoldFeature } from '../../../utils/resolve-scaffold-feature.js';
 export const pikkuPublicAgent = pikkuSessionlessFunc({
     func: async ({ logger, config }) => {
         if (config.scaffold?.agent && config.publicAgentSchemasFile) {
             const leaf = (name) => getLeafImportPath(config.publicAgentFile, name, config);
-            const { schemas, functions } = serializePublicAgent(leaf, resolveScaffoldFeature('agent', config.scaffold.agent).auth, config.globalHTTPPrefix || '');
+            const { schemas, functions } = serializePublicAgent(leaf, config.globalHTTPPrefix || '');
             await writeFileInDir(logger, config.publicAgentSchemasFile, schemas);
             await writeFileInDir(logger, config.publicAgentFile, functions);
             await removeLegacyScaffoldFile(config.publicAgentFile);

package/dist/src/functions/wirings/agent/serialize-public-agent.d.ts

@@ -2,4 +2,4 @@ export interface PublicAgentGenOutput {
     schemas: string;
     functions: string;
 }
-export declare const serializePublicAgent: (leaf: (name: string) => string, requireAuth?: boolean, globalHTTPPrefix?: string) => PublicAgentGenOutput;
+export declare const serializePublicAgent: (leaf: (name: string) => string, globalHTTPPrefix?: string) => PublicAgentGenOutput;

package/dist/src/functions/wirings/agent/serialize-public-agent.js

@@ -1,5 +1,4 @@
-export const serializePublicAgent = (leaf, requireAuth = true, globalHTTPPrefix = '') => {
-    const authFlag = requireAuth ? 'true' : 'false';
+export const serializePublicAgent = (leaf, globalHTTPPrefix = '') => {
     const schemas = `/**
  * Auto-generated public agent schemas
  * Do not edit manually - regenerate with 'npx pikku'
@@ -85,7 +84,7 @@ export const isThreadOwner = pikkuPermission<{ threadId: string }>(
 export const agentCaller = pikkuSessionlessFunc({
   description: 'Run a named AI agent with a message and return its reply',
   tags: ['pikku'],
-  auth: ${authFlag},
+  auth: false,
   input: AgentCall,
   func: async (_services, data, { rpc }) => {
     return await rpc.agent.run(data.agentName as any, {
@@ -102,7 +101,7 @@ export const agentCaller = pikkuSessionlessFunc({
 
 export const agentStreamCaller = pikkuSessionlessFunc({
   tags: ['pikku'],
-  auth: ${authFlag},
+  auth: false,
   input: AgentCall,
   func: async (_services, data, { rpc }) => {
     await rpc.agent.stream(data.agentName as any, {
@@ -119,7 +118,7 @@ export const agentStreamCaller = pikkuSessionlessFunc({
 
 export const agentApproveCaller = pikkuSessionlessFunc({
   tags: ['pikku'],
-  auth: ${authFlag},
+  auth: false,
   input: AgentApproval,
   func: async (_services, { runId, approvals, agentName }, { rpc }) => {
     return await rpc.agent.approve(runId, approvals, agentName)
@@ -128,7 +127,7 @@ export const agentApproveCaller = pikkuSessionlessFunc({
 
 export const agentResumeCaller = pikkuSessionlessFunc({
   tags: ['pikku'],
-  auth: ${authFlag},
+  auth: false,
   input: AgentResume,
   func: async (_services, data, { rpc }) => {
     await rpc.agent.resume(data.runId, {
@@ -145,7 +144,7 @@ export const getAgentThreads = pikkuSessionlessFunc({
   description:
     'Returns the caller\\'s AI agent threads from storage. Accepts optional filters: agentName, resourceId, limit, and offset for pagination.',
   expose: true,
-  auth: ${authFlag},
+  auth: false,
   func: async ({ agentRunService }, input, { session }) => {
     // \`owners\` is an authorization constraint derived from the session, never
     // from input — \`resourceId\` remains a caller-supplied filter within it.
@@ -166,7 +165,7 @@ export const getAgentThreadMessages = pikkuSessionlessFunc({
   description:
     'Returns all messages for a given AI agent thread, ordered by creation time.',
   expose: true,
-  auth: ${authFlag},
+  auth: false,
   permissions: { owner: isThreadOwner },
   func: async ({ agentRunService }, input) => {
     return await agentRunService.getThreadMessages(input.threadId)
@@ -180,7 +179,7 @@ export const getAgentThreadRuns = pikkuSessionlessFunc({
   description:
     'Returns the run history for a given AI agent thread, ordered by creation time.',
   expose: true,
-  auth: ${authFlag},
+  auth: false,
   permissions: { owner: isThreadOwner },
   func: async ({ agentRunService }, input) => {
     return await agentRunService.getThreadRuns(input.threadId)
@@ -195,7 +194,7 @@ export const deleteAgentThread = pikkuSessionlessFunc({
   description:
     'Deletes an AI agent thread and all of its persisted state.',
   expose: true,
-  auth: ${authFlag},
+  auth: false,
   permissions: { owner: isThreadOwner },
   func: async ({ agentRunService }, input) => {
     const deleted = await agentRunService.deleteThread(input.threadId)
@@ -204,7 +203,7 @@ export const deleteAgentThread = pikkuSessionlessFunc({
 })
 
 export const agentRoutes = defineHTTPRoutes({
-  auth: ${authFlag},
+  auth: false,
   tags: ['pikku:public'],
   routes: {
     agentRun: {

package/dist/src/functions/wirings/emails/pikku-command-emails.js

@@ -27,8 +27,8 @@ function collectTemplateVariables(rootSources, locales, partials) {
         const source = queue.shift();
         if (!source)
             continue;
-        for (const match of source.matchAll(/\{\{\s*([^}]+?)\s*\}\}/g)) {
-            const key = String(match[1]).trim();
+        for (const match of source.matchAll(/\{\{\{\s*([^{}]+?)\s*\}\}\}|\{\{\s*([^}]+?)\s*\}\}/g)) {
+            const key = String(match[1] ?? match[2]).trim();
             if (!key)
                 continue;
             if (key.startsWith('>')) {

package/dist/src/functions/wirings/emails/serialize-emails.js

@@ -62,32 +62,103 @@ function getNestedValue(source: Record<string, unknown>, path: string): string {
     : ''
 }
 
-function applyTemplate(source: string, context: Record<string, unknown>): string {
-  return source.replace(/\\{\\{\\s*([^}]+?)\\s*\\}\\}/g, (_match, rawKey) => {
-    const key = String(rawKey).trim()
-    if (key === 'content') {
-      return typeof context.content === 'string' ? context.content : ''
-    }
-    if (key.startsWith('>')) {
-      return ''
-    }
-    return getNestedValue(context, key)
+const HTML_ESCAPES: Record<string, string> = {
+  '&': '&amp;',
+  '<': '&lt;',
+  '>': '&gt;',
+  '"': '&quot;',
+  "'": '&#39;',
+}
+
+function escapeHtml(value: string): string {
+  return value.replace(/[&<>"']/g, (char) => HTML_ESCAPES[char] ?? char)
+}
+
+// Matches the raw {{{ value }}} form before the escaped {{ value }} form, so the
+// opt-in escape hatch is never mistaken for a normal substitution.
+const TEMPLATE_TOKEN = /\\{\\{\\{\\s*([^{}]+?)\\s*\\}\\}\\}|\\{\\{\\s*([^}]+?)\\s*\\}\\}/g
+
+const PARTIAL_TOKEN = /\\{\\{\\s*>\\s*([a-zA-Z0-9-_/.]+)\\s*\\}\\}/g
+
+const MAX_TEMPLATE_DEPTH = 5
+
+// theme.json and the locale files ship with the templates, so they are treated as
+// template-author input: expanded before caller data and allowed to contain their
+// own placeholders. Everything else is caller-supplied.
+const TRUSTED_ROOTS = ['theme', 't']
+
+function isTrustedKey(key: string): boolean {
+  return TRUSTED_ROOTS.includes(String(key.split('.')[0]))
+}
+
+function readToken(rawTriple: unknown, rawDouble: unknown) {
+  const raw = typeof rawTriple === 'string'
+  return { raw, key: String(raw ? rawTriple : rawDouble).trim() }
+}
+
+function expandPartials(source: string, depth = 0): string {
+  if (depth >= MAX_TEMPLATE_DEPTH) return source
+  let found = false
+  const expanded = source.replace(PARTIAL_TOKEN, (_match, partialName) => {
+    found = true
+    const partial =
+      EMAIL_PARTIALS[String(partialName).trim() as keyof typeof EMAIL_PARTIALS]
+    return typeof partial === 'string' ? partial : ''
   })
+  return found ? expandPartials(expanded, depth + 1) : expanded
 }
 
-function renderTemplate(source: string, context: Record<string, unknown>): string {
+function expandTrusted(
+  source: string,
+  context: Record<string, unknown>,
+  escape: boolean
+): string {
   let rendered = source
-  for (let i = 0; i < 5; i += 1) {
-    const next = applyTemplate(rendered, context)
-    if (next === rendered) break
+  for (let i = 0; i < MAX_TEMPLATE_DEPTH; i += 1) {
+    let found = false
+    const next = rendered.replace(
+      TEMPLATE_TOKEN,
+      (match, rawTriple, rawDouble) => {
+        const { raw, key } = readToken(rawTriple, rawDouble)
+        if (!isTrustedKey(key)) return match
+        found = true
+        const value = getNestedValue(context, key)
+        return raw || !escape ? value : escapeHtml(value)
+      }
+    )
+    if (!found || next === rendered) break
     rendered = next
   }
   return rendered
 }
 
-function renderPartial(name: string, context: Record<string, unknown>): string {
-  const partial = EMAIL_PARTIALS[name as keyof typeof EMAIL_PARTIALS]
-  return partial ? renderTemplate(partial, context) : ''
+// A single substitution pass — the replacement text is never rescanned, so a
+// caller-supplied value can never be reinterpreted as a template.
+function substitute(
+  source: string,
+  context: Record<string, unknown>,
+  escape: boolean
+): string {
+  return source.replace(TEMPLATE_TOKEN, (_match, rawTriple, rawDouble) => {
+    const { raw, key } = readToken(rawTriple, rawDouble)
+    if (key === 'content') {
+      return typeof context.content === 'string' ? context.content : ''
+    }
+    if (key.startsWith('>')) {
+      return ''
+    }
+    const value = getNestedValue(context, key)
+    return raw || !escape ? value : escapeHtml(value)
+  })
+}
+
+function renderTemplate(
+  source: string,
+  context: Record<string, unknown>,
+  escape: boolean
+): string {
+  const composed = expandTrusted(expandPartials(source), context, escape)
+  return substitute(composed, context, escape)
 }
 
 export const EMAILS = EMAIL_TEMPLATES
@@ -119,39 +190,38 @@ export function renderEmailTemplate<TName extends EmailTemplateName>(
     appName,
   }
 
-  const subject = renderTemplate(template.subject, baseContext).trim()
-  const htmlWithPartials = template.html.replace(
-    /\\{\\{\\s*>\\s*([a-zA-Z0-9-_/.]+)\\s*\\}\\}/g,
-    (_match, partialName) => \`@@PARTIAL:\${String(partialName).trim()}@@\`
-  )
-
-  let htmlBody = renderTemplate(htmlWithPartials, {
-    ...baseContext,
-    subject,
-  })
+  const subject = renderTemplate(template.subject, baseContext, false).trim()
 
-  const partialMatches = [...htmlBody.matchAll(/@@PARTIAL:([^@]+)@@/g)]
-  for (const match of partialMatches) {
-    const rendered = renderPartial(match[1], {
+  const htmlBody = renderTemplate(
+    template.html,
+    {
       ...baseContext,
       subject,
-    })
-    htmlBody = htmlBody.replace(match[0], rendered)
-  }
+    },
+    true
+  )
 
   const html = EMAIL_PARTIALS.layout
-    ? renderTemplate(EMAIL_PARTIALS.layout, {
-        ...baseContext,
-        subject,
-        content: htmlBody,
-      })
+    ? renderTemplate(
+        EMAIL_PARTIALS.layout,
+        {
+          ...baseContext,
+          subject,
+          content: htmlBody,
+        },
+        true
+      )
     : htmlBody
 
   const text = template.text
-    ? renderTemplate(template.text, {
-        ...baseContext,
-        subject,
-      }).trim()
+    ? renderTemplate(
+        template.text,
+        {
+          ...baseContext,
+          subject,
+        },
+        false
+      ).trim()
     : undefined
   const hash = (template.hashes[locale]?.contentHash ??
     '') as RenderedEmail<TName>['hash']

package/dist/src/functions/wirings/middleware/serialize-middleware-types.js

@@ -168,7 +168,7 @@ export const addChannelMiddleware = (tag: string, middleware: PikkuChannelMiddle
 
 export const pikkuAgentMiddleware = <
   State extends Record<string, unknown> = Record<string, unknown>,
-  RequiredServices extends Services = Services,
+  RequiredServices extends SingletonServices = WiredSingletonServices,
 >(
   hooks: PikkuAgentMiddlewareHooks<State, RequiredServices>
 ): PikkuAgentMiddlewareHooks<State, RequiredServices> => hooks

package/dist/src/functions/wirings/personas/serialize-personas-secrets.d.ts

@@ -10,6 +10,11 @@
  * regardless of what the user wired should be collected by the platform, not
  * discovered missing at the first sign-in.
  *
+ * It is `optional` because a stage that runs no scenarios is a supported state:
+ * the actor sign-in then refuses every request, which is how the surface is
+ * switched off. A required declaration fails the deploy config gate on every
+ * such stage instead.
+ *
  * The schema is a named const because the inspector only accepts a variable
  * reference for `schema`, never an inline expression.
  */

package/dist/src/functions/wirings/personas/serialize-personas-secrets.js

@@ -10,6 +10,11 @@
  * regardless of what the user wired should be collected by the platform, not
  * discovered missing at the first sign-in.
  *
+ * It is `optional` because a stage that runs no scenarios is a supported state:
+ * the actor sign-in then refuses every request, which is how the surface is
+ * switched off. A required declaration fails the deploy config gate on every
+ * such stage instead.
+ *
  * The schema is a named const because the inspector only accepts a variable
  * reference for `schema`, never an inline expression.
  */
@@ -27,6 +32,7 @@ defineSecret({
   displayName: 'Scenario Actor Secret',
   description:
     'Signing secret that lets scenarios and virtual users sign in as a declared persona',
+  optional: true,
   secretId: 'SCENARIO_ACTOR_SECRET',
   schema: ScenarioActorSecretSchema,
 })

package/dist/src/functions/wirings/realtime/pikku-command-events-scaffold.js

@@ -4,7 +4,6 @@ import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { removeLegacyScaffoldFile } from '../../../utils/remove-legacy-scaffold-file.js';
 import { serializeEventsScaffold } from './serialize-events-scaffold.js';
-import { resolveScaffoldFeature } from '../../../utils/resolve-scaffold-feature.js';
 export const pikkuEventsScaffold = pikkuSessionlessFunc({
     func: async ({ logger, config }) => {
         if (!config.scaffold?.events ||
@@ -16,8 +15,7 @@ export const pikkuEventsScaffold = pikkuSessionlessFunc({
             });
             return false;
         }
-        const authRequired = resolveScaffoldFeature('events', config.scaffold.events).auth;
-        const { schemas, functions } = serializeEventsScaffold(authRequired, (name) => getLeafImportPath(config.eventsChannelFile, name, config));
+        const { schemas, functions } = serializeEventsScaffold((name) => getLeafImportPath(config.eventsChannelFile, name, config));
         await writeFileInDir(logger, config.eventsSchemasFile, schemas);
         await writeFileInDir(logger, config.eventsChannelFile, functions);
         await removeLegacyScaffoldFile(config.eventsChannelFile);

package/dist/src/functions/wirings/realtime/serialize-events-scaffold.d.ts

@@ -21,4 +21,4 @@ export interface EventsGenOutput {
  * publish-side ergonomics (envelope shape) are documented in the
  * pikku-realtime skill.
  */
-export declare const serializeEventsScaffold: (authRequired: boolean, leaf: (name: string) => string) => EventsGenOutput;
+export declare const serializeEventsScaffold: (leaf: (name: string) => string) => EventsGenOutput;

package/dist/src/functions/wirings/realtime/serialize-events-scaffold.js

@@ -17,8 +17,7 @@
  * publish-side ergonomics (envelope shape) are documented in the
  * pikku-realtime skill.
  */
-export const serializeEventsScaffold = (authRequired, leaf) => {
-    const auth = authRequired ? 'true' : 'false';
+export const serializeEventsScaffold = (leaf) => {
     const schemas = `/**
  * Auto-generated realtime event schemas
  * Do not edit manually - regenerate with 'npx pikku'
@@ -67,7 +66,7 @@ export const realtimeRoutes = defineChannelRoutes({
 wireChannel({
   name: 'events',
   route: '/events',
-  auth: ${auth},
+  auth: false,
   onMessageWiring: {
     action: realtimeRoutes,
   },
@@ -95,7 +94,7 @@ wireHTTP({
   method: 'get',
   route: '/events/:topic',
   func: realtimeEventStream,
-  auth: ${auth},
+  auth: false,
   sse: true,
   tags: ['pikku:realtime', 'sse'],
 })

package/dist/src/functions/wirings/rpc/pikku-command-public-rpc.js

@@ -4,7 +4,6 @@ import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { removeLegacyScaffoldFile } from '../../../utils/remove-legacy-scaffold-file.js';
 import { serializePublicRPC } from './serialize-public-rpc.js';
-import { resolveScaffoldFeature } from '../../../utils/resolve-scaffold-feature.js';
 import { isDeployCodegen } from '../../../utils/is-deploy-codegen.js';
 export const pikkuPublicRPC = pikkuSessionlessFunc({
     func: async ({ logger, config, variables }) => {
@@ -13,7 +12,7 @@ export const pikkuPublicRPC = pikkuSessionlessFunc({
         }
         if (config.scaffold?.rpc && config.publicRpcSchemasFile) {
             const leaf = (name) => getLeafImportPath(config.publicRpcFile, name, config);
-            const { schemas, functions } = serializePublicRPC(leaf, resolveScaffoldFeature('rpc', config.scaffold.rpc).auth, config.globalHTTPPrefix || '');
+            const { schemas, functions } = serializePublicRPC(leaf, config.globalHTTPPrefix || '');
             await writeFileInDir(logger, config.publicRpcSchemasFile, schemas);
             await writeFileInDir(logger, config.publicRpcFile, functions);
             await removeLegacyScaffoldFile(config.publicRpcFile);

package/dist/src/functions/wirings/rpc/serialize-public-rpc.d.ts

@@ -5,4 +5,4 @@ export interface PublicRPCGenOutput {
 /**
  * Generate public RPC HTTP endpoint
  */
-export declare const serializePublicRPC: (leaf: (name: string) => string, requireAuth?: boolean, globalHTTPPrefix?: string) => PublicRPCGenOutput;
+export declare const serializePublicRPC: (leaf: (name: string) => string, globalHTTPPrefix?: string) => PublicRPCGenOutput;

package/dist/src/functions/wirings/rpc/serialize-public-rpc.js

@@ -1,8 +1,7 @@
 /**
  * Generate public RPC HTTP endpoint
  */
-export const serializePublicRPC = (leaf, requireAuth = true, globalHTTPPrefix = '') => {
-    const authFlag = requireAuth ? 'true' : 'false';
+export const serializePublicRPC = (leaf, globalHTTPPrefix = '') => {
     const schemas = `/**
  * Auto-generated public RPC endpoint schemas
  * Do not edit manually - regenerate with 'npx pikku'
@@ -24,7 +23,7 @@ import { RPCCall } from './rpc-public.schemas.gen.js'
 
 export const rpcCaller = pikkuSessionlessFunc({
   tags: ['pikku'],
-  auth: ${authFlag},
+  auth: false,
   input: RPCCall,
   func: async (_services, { rpcName, data }, { rpc }) => {
     return await rpc.exposed(rpcName, data)
@@ -34,7 +33,7 @@ export const rpcCaller = pikkuSessionlessFunc({
 wireHTTP({
   route: '${globalHTTPPrefix}/rpc/:rpcName',
   method: 'post',
-  auth: ${authFlag},
+  auth: false,
   tags: ['pikku'],
   func: rpcCaller,
 })

package/dist/src/functions/wirings/scenarios/register-scenario-instrumentation.d.ts

@@ -2,9 +2,8 @@
  * Register the instrumentation into the running dev server's state, so the
  * scenario runner can reach it over `/rpc/<name>` exactly as before.
  *
- * They are registered sessionless: `auth` decides whether a session is
- * *required*, and a sessioned function would demand one regardless of the flag.
- * `scaffold.scenarios: true` therefore requires a session; `{ auth: false }` is
- * what opens them.
+ * They are registered sessionless with `auth: true`, so a caller still needs a
+ * session: the `/rpc/:rpcName` dispatcher declines to gate, which leaves each
+ * function to answer for itself.
  */
-export declare const registerScenarioInstrumentation: (requireAuth: boolean) => void;
+export declare const registerScenarioInstrumentation: () => void;

package/dist/src/functions/wirings/scenarios/register-scenario-instrumentation.js

@@ -104,19 +104,18 @@ const instrumentation = {
  * Register the instrumentation into the running dev server's state, so the
  * scenario runner can reach it over `/rpc/<name>` exactly as before.
  *
- * They are registered sessionless: `auth` decides whether a session is
- * *required*, and a sessioned function would demand one regardless of the flag.
- * `scaffold.scenarios: true` therefore requires a session; `{ auth: false }` is
- * what opens them.
+ * They are registered sessionless with `auth: true`, so a caller still needs a
+ * session: the `/rpc/:rpcName` dispatcher declines to gate, which leaves each
+ * function to answer for itself.
  */
-export const registerScenarioInstrumentation = (requireAuth) => {
+export const registerScenarioInstrumentation = () => {
     const meta = pikkuState(null, 'function', 'meta');
     // Retaining finished runs is what makes them gradeable, and this is the only
     // place that can grade one — so the buffer is turned on here rather than by a
     // flag someone has to remember, and stays absent from every other process.
     enableScoreSnapshots();
     for (const [name, { func, title, description }] of Object.entries(instrumentation)) {
-        addFunction(name, { func, auth: requireAuth });
+        addFunction(name, { func, auth: true });
         meta[name] = {
             pikkuFuncId: name,
             inputSchemaName: null,

package/dist/src/functions/wirings/scopes/pikku-command-scopes.js

@@ -2,10 +2,12 @@ import { pikkuSessionlessFunc } from '#pikku/function';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { serializeScopesTypes } from './serialize-scopes-types.js';
+import { serializeScopesClient } from './serialize-scopes-client.js';
 import { validateAndBuildScopeDefinitionsMeta } from '@pikku/core/scope';
 export const pikkuScopes = pikkuSessionlessFunc({
     func: async ({ logger, config, getInspectorState }, data) => {
         const { scopesFile, scopesMetaJsonFile } = config;
+        const scopesClientFile = config.clientFiles?.scopesFile;
         if (!scopesFile) {
             return;
         }
@@ -21,6 +23,9 @@ export const pikkuScopes = pikkuSessionlessFunc({
             definitions: state.scopes.definitions,
         });
         await writeFileInDir(logger, scopesFile, content);
+        if (scopesClientFile) {
+            await writeFileInDir(logger, scopesClientFile, serializeScopesClient({ definitions: state.scopes.definitions }));
+        }
         if (scopesMetaJsonFile) {
             const meta = validateAndBuildScopeDefinitionsMeta(state.scopes.definitions);
             await writeFileInDir(logger, scopesMetaJsonFile, JSON.stringify(meta, null, 2));

package/dist/src/functions/wirings/scopes/serialize-scopes-client.d.ts

@@ -0,0 +1,16 @@
+import type { ScopeDefinitions } from '@pikku/core/scope';
+export interface SerializeScopesClientOptions {
+    definitions: ScopeDefinitions;
+}
+/**
+ * Generates the browser-side scope client: the `ScopeId` union and a
+ * `hasScopes` that decides whether held grants satisfy a requirement.
+ *
+ * The cascade is emitted inline rather than imported, so the file a frontend
+ * bundles has no imports at all. `@pikku/core` is a server package — it pulls
+ * AsyncLocalStorage and the wiring runtime behind it — so a UI reaching for
+ * `@pikku/core/scope` to render a permission drags the server into the bundle.
+ * `serialize-scopes-client.test.ts` checks this copy against core's over a
+ * shared case table.
+ */
+export declare const serializeScopesClient: ({ definitions, }: SerializeScopesClientOptions) => string;