@pikku/cli 0.12.110 → 0.12.111

package/dist/src/deploy/plan/provider.d.ts

@@ -1,4 +1,4 @@
-import type { DeploymentManifest } from '../analyzer/manifest.js';
+import type { DeploymentManifest } from '@pikku/deploy';
 import type { PlanChange } from './types.js';
 export interface CurrentState {
     units: Array<{

package/dist/src/deploy/server-entry.d.ts

@@ -10,7 +10,7 @@
  * fly.io, ECS, bare VM. Provider-specific config (Dockerfile, infra) is
  * emitted by the provider adapter on top of this entry + bundle.js.
  */
-import type { EntryGenerationContext } from './provider-adapter.js';
+import type { EntryGenerationContext } from '@pikku/deploy';
 export declare function generateServerEntrySource(ctx: EntryGenerationContext): string;
 export declare const SERVER_DOCKERFILE = "# Generated by @pikku/cli \u2014 do not edit\n# Full image (not -slim): carries the build toolchain so externalised deps with\n# native addons can compile from source at `npm install` time.\nFROM node:26\n\nRUN apt-get update \\\n  && apt-get install -y --no-install-recommends tini ca-certificates \\\n  && rm -rf /var/lib/apt/lists/*\n\nRUN groupadd -r pikku && useradd -r -g pikku -u 1001 pikku\n\nWORKDIR /app\n\n# Pikku bundles user code + first-party deps inline; only externalised deps\n# (typically empty for pure-JS apps) are listed in package.json. We ship no\n# lockfile because the bundle has already pinned everything via the\n# extracted exact-dependencies \u2014 `npm install --omit=dev` resolves the\n# leftover externals (if any) at build time.\nCOPY --chown=pikku:pikku package.json ./\nRUN npm install --omit=dev --no-audit --no-fund\n\nCOPY --chown=pikku:pikku bundle.js ./\n\nUSER pikku\nENV NODE_ENV=production\nENV PORT=8080\nEXPOSE 8080\n\nENTRYPOINT [\"/usr/bin/tini\", \"--\"]\nCMD [\"node\", \"bundle.js\"]\n";
 export declare const SERVER_DOCKERIGNORE = "node_modules\n.git\n*.log\nmetafile.json\nexact-dependencies.json\n";

package/dist/src/fabric/fabric-commands.d.ts

@@ -698,7 +698,7 @@ export declare const fabricCommands: {
             }, {
                 proxyUrl: string;
                 apiKey: string;
-                format: "json" | "text" | "env" | "shell";
+                format: "text" | "json" | "env" | "shell";
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
                 shell?: boolean | undefined;
                 env?: boolean | undefined;
@@ -706,7 +706,7 @@ export declare const fabricCommands: {
             }, {
                 proxyUrl: string;
                 apiKey: string;
-                format: "json" | "text" | "env" | "shell";
+                format: "text" | "json" | "env" | "shell";
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
                 shell?: boolean | undefined;
                 env?: boolean | undefined;
@@ -714,7 +714,7 @@ export declare const fabricCommands: {
             }, {
                 proxyUrl: string;
                 apiKey: string;
-                format: "json" | "text" | "env" | "shell";
+                format: "text" | "json" | "env" | "shell";
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").WiredServices>, undefined, undefined>, import("../../.pikku/middleware/pikku-middleware-types.gen.js").PikkuMiddleware, (services: import("../../types/application-types.js").SingletonServices, data: any, session?: import("../../types/application-types.js").UserSession | undefined) => void | Promise<void>, string>;
         };
     };

package/dist/src/fabric/functions/llm-key.function.d.ts

@@ -8,8 +8,8 @@ export declare const FabricLLMKeyOutput: z.ZodObject<{
     proxyUrl: z.ZodString;
     apiKey: z.ZodString;
     format: z.ZodEnum<{
-        json: "json";
         text: "text";
+        json: "json";
         env: "env";
         shell: "shell";
     }>;
@@ -21,7 +21,7 @@ export declare const FabricLLMKey: import("../../../.pikku/function/pikku-functi
 }, {
     proxyUrl: string;
     apiKey: string;
-    format: "json" | "text" | "env" | "shell";
+    format: "text" | "json" | "env" | "shell";
 }, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
     shell?: boolean | undefined;
     env?: boolean | undefined;
@@ -29,7 +29,7 @@ export declare const FabricLLMKey: import("../../../.pikku/function/pikku-functi
 }, {
     proxyUrl: string;
     apiKey: string;
-    format: "json" | "text" | "env" | "shell";
+    format: "text" | "json" | "env" | "shell";
 }, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
     shell?: boolean | undefined;
     env?: boolean | undefined;
@@ -37,7 +37,7 @@ export declare const FabricLLMKey: import("../../../.pikku/function/pikku-functi
 }, {
     proxyUrl: string;
     apiKey: string;
-    format: "json" | "text" | "env" | "shell";
+    format: "text" | "json" | "env" | "shell";
 }, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices>, undefined, undefined>;
 export declare const renderLLMKey: (_services: unknown, data: {
     proxyUrl: string;

package/dist/src/functions/commands/db-generate.js

@@ -14,7 +14,7 @@ export const dbGenerate = pikkuSessionlessFunc({
         }
         const state = await getInspectorState();
         const addons = [...state.rpc.wireAddonDeclarations.values()].map(({ package: pkg, remote }) => ({ package: pkg, remote }));
-        const { upToDate, written } = await generateMigrations(resolved, config.rootDir, config.srcDirectories, logger, addons);
+        const { upToDate, written } = await generateMigrations(resolved, config.rootDir, config.srcDirectories, logger, addons, state.serviceAggregation.requiredServices);
         for (const source of upToDate) {
             logger.info(`db generate: ${source} is already covered by existing migrations`);
         }

package/dist/src/functions/commands/deploy-apply.d.ts

@@ -1,4 +1,4 @@
-import type { ProviderAdapter, EntryGenerationContext } from '../../deploy/provider-adapter.js';
+import type { ProviderAdapter, EntryGenerationContext } from '@pikku/deploy';
 import type { InspectorState } from '@pikku/inspector';
 export declare function getEntryContext(unitDir: string, pikkuDir: string, unit: EntryGenerationContext['unit'], inspectorState: InspectorState): EntryGenerationContext;
 export declare function resolveProvider(config?: {

package/dist/src/functions/commands/new-addon.js

@@ -139,17 +139,20 @@ export function getAddonFiles(vars, flags) {
         // these never have to point at the source tree.
         imports: {
             '#pikku/*.js': './dist/.pikku/*.js',
-            '#pikku/*': './dist/.pikku/*/index.js',
+            '#pikku/*': ['./dist/.pikku/*/index.js', './dist/.pikku/*'],
         },
+        // An addon's generated tree roots at `.pikku/addon/`, but a consumer
+        // reaches it by the same subpath an application would — the leaf is the
+        // package's business, not its callers'.
         exports: {
             '.': {
                 types: './dist/src/index.d.ts',
                 import: './dist/src/index.js',
             },
-            './.pikku/*': './dist/.pikku/*',
-            './.pikku/pikku-metadata.gen.json': './dist/.pikku/pikku-metadata.gen.json',
+            './.pikku/*': './dist/.pikku/addon/*',
+            './.pikku/pikku-metadata.gen.json': './dist/.pikku/addon/pikku-metadata.gen.json',
             './.pikku/rpc/pikku-rpc-wirings-map.internal.gen.js': {
-                types: './dist/.pikku/rpc/pikku-rpc-wirings-map.internal.gen.d.ts',
+                types: './dist/.pikku/addon/rpc/pikku-rpc-wirings-map.internal.gen.d.ts',
             },
         },
         files: ['dist'],
@@ -204,7 +207,7 @@ export function getAddonFiles(vars, flags) {
             resolveJsonModule: true,
             paths: {
                 '#pikku/*.js': ['./.pikku/*.ts'],
-                '#pikku/*': ['./.pikku/*/index.ts'],
+                '#pikku/*': ['./.pikku/*/index.ts', './.pikku/*'],
             },
         },
         include: ['src/**/*', 'types/**/*', '.pikku/**/*.ts'],
@@ -322,15 +325,14 @@ export const createSingletonServices = pikkuAddonServices(async (
 `;
     }
     else {
+        // The plain service takes no constructor argument — the secret, credential
+        // and oauth variants are the ones handed something to authenticate with.
         files['src/services.ts'] =
             `import { ${pascalName}Service } from './${name}-api.service.js'
 import { pikkuAddonServices } from '#pikku/addon/setup'
 
-export const createSingletonServices = pikkuAddonServices(async (
-  config,
-  { variables }
-) => {
-  const ${camelName} = new ${pascalName}Service(variables)
+export const createSingletonServices = pikkuAddonServices(async () => {
+  const ${camelName} = new ${pascalName}Service()
 
   return { ${camelName} }
 })
@@ -688,7 +690,7 @@ export function getTestFiles(vars) {
         type: 'module',
         imports: {
             '#pikku/*.js': './.pikku/*.ts',
-            '#pikku/*': './.pikku/*/index.ts',
+            '#pikku/*': ['./.pikku/*/index.ts', './.pikku/*'],
         },
         scripts: {
             pretest: 'pikku all',
@@ -727,7 +729,7 @@ export function getTestFiles(vars) {
             types: ['node'],
             paths: {
                 '#pikku/*.js': ['./.pikku/*.ts'],
-                '#pikku/*': ['./.pikku/*/index.ts'],
+                '#pikku/*': ['./.pikku/*/index.ts', './.pikku/*'],
             },
         },
         include: ['src/*', '.pikku/**/*', 'types/**/*'],

package/dist/src/functions/db/better-auth-schema.js

@@ -97,6 +97,11 @@ function fakeSecretService() {
     const placeholder = 'schema-introspection-only';
     return {
         getSecret: async () => createSecretValue(placeholder),
+        // Every key resolves, for the same reason `hasSecret` says yes to all of
+        // them: an auth factory that batches its secrets must come back with the
+        // whole batch, or it throws on the one it considers required and the
+        // schema is never read at all.
+        getSecrets: async (keys) => Object.fromEntries(keys.map((key) => [key, createSecretValue(placeholder)])),
         hasSecret: async () => true,
         setSecret: async () => { },
     };

package/dist/src/functions/db/local-db.d.ts

@@ -197,10 +197,18 @@ export interface DesiredRuntimeSchema extends DesiredSchema {
  * scope tables, so the schemas that wanted them are left out and returned in
  * `skipped` — reported rather than dropped, because the tables they would have
  * recognised now have nothing to explain them.
+ *
+ * `services` narrows the declaration to the schemas the services a project's
+ * code actually reaches own, for the caller that is about to write a migration:
+ * a project with no agents should not carry `agent_threads` in its migrations
+ * forever. Omit it and the whole declaration answers, which is what the caller
+ * that is *recognising* tables wants — a table created by a service that has
+ * since been dropped still has to read as a runtime table rather than as an
+ * unexplained one.
  */
 export declare function desiredRuntimeSchema(resolved: ResolvedDb, rootDir: string, srcDirectories: string[], logger: {
     error: (msg: string) => void;
-}): Promise<DesiredRuntimeSchema>;
+}, services?: ReadonlySet<string>): Promise<DesiredRuntimeSchema>;
 export declare function introspectSchema(resolved: ResolvedDb): Promise<SchemaMap>;
 export interface SchemaDriftResult {
     /** In the migrations, absent from the database — it is behind. */
@@ -367,7 +375,7 @@ export declare function addonSchemaSources(rootDir: string, dialect: ResolvedDb[
  */
 export declare function schemaSources(resolved: ResolvedDb, rootDir: string, srcDirectories: string[], logger: {
     error: (msg: string) => void;
-}, addons?: AddonDeclaration[]): Promise<SchemaSource[]>;
+}, addons?: AddonDeclaration[], services?: ReadonlySet<string>): Promise<SchemaSource[]>;
 export interface GeneratedMigration {
     source: string;
     file: string;
@@ -402,5 +410,5 @@ export interface GenerateResult {
  */
 export declare function generateMigrations(resolved: ResolvedDb, rootDir: string, srcDirectories: string[], logger: {
     error: (msg: string) => void;
-}, addons?: AddonDeclaration[]): Promise<GenerateResult>;
+}, addons?: AddonDeclaration[], services?: ReadonlySet<string>): Promise<GenerateResult>;
 export {};

package/dist/src/functions/db/local-db.js

@@ -6,7 +6,7 @@ import { runInNewContext } from 'node:vm';
 import { transformSync } from 'esbuild';
 import { CamelCasePlugin, Kysely, PostgresDialect } from 'kysely';
 import { migrate, baselineMigrations, } from './db-migrator.js';
-import { applyPikkuSchemas, compilePikkuSchemas, pikkuSchemas, resolveRequirements, createCoercionPlugin, } from '@pikku/kysely';
+import { applyPikkuSchemas, compilePikkuSchemas, pikkuSchemas, requiredPikkuSchemas, resolveRequirements, createCoercionPlugin, } from '@pikku/kysely';
 import { loadAuthOptions, getAuthMigrations } from './better-auth-schema.js';
 import { generateSchemaTypes } from './db-codegen.js';
 import { generateZodTypes } from './zod-codegen.js';
@@ -797,13 +797,22 @@ async function applyAuthSchema(kysely, rootDir, srcDirectories, logger) {
  * scope tables, so the schemas that wanted them are left out and returned in
  * `skipped` — reported rather than dropped, because the tables they would have
  * recognised now have nothing to explain them.
+ *
+ * `services` narrows the declaration to the schemas the services a project's
+ * code actually reaches own, for the caller that is about to write a migration:
+ * a project with no agents should not carry `agent_threads` in its migrations
+ * forever. Omit it and the whole declaration answers, which is what the caller
+ * that is *recognising* tables wants — a table created by a service that has
+ * since been dropped still has to read as a runtime table rather than as an
+ * unexplained one.
  */
-export async function desiredRuntimeSchema(resolved, rootDir, srcDirectories, logger) {
+export async function desiredRuntimeSchema(resolved, rootDir, srcDirectories, logger, services) {
+    const declared = services ? requiredPikkuSchemas(services) : pikkuSchemas;
     const skipped = [];
     const collect = async (db, introspect) => {
         await applyAuthSchema(db, rootDir, srcDirectories, logger);
         const before = await introspect();
-        const { types, unmet } = await resolveRequirements(db);
+        const { types, unmet } = await resolveRequirements(db, declared);
         for (const { schema, requirement } of unmet) {
             skipped.push({
                 schema: schema.name,
@@ -812,7 +821,7 @@ export async function desiredRuntimeSchema(resolved, rootDir, srcDirectories, lo
             });
         }
         const unavailable = new Set(unmet.map(({ schema }) => schema.name));
-        const schemas = pikkuSchemas.filter((s) => !unavailable.has(s.name));
+        const schemas = declared.filter((s) => !unavailable.has(s.name));
         await applyPikkuSchemas(db, schemas);
         const after = await introspect();
         for (const table of before.keys())
@@ -1109,7 +1118,7 @@ export async function addonSchemaSources(rootDir, dialect, addons, logger) {
  * Auth comes first because the runtime's scope tables reference its `user`
  * table; addons come last because they may reference either.
  */
-export async function schemaSources(resolved, rootDir, srcDirectories, logger, addons = []) {
+export async function schemaSources(resolved, rootDir, srcDirectories, logger, addons = [], services) {
     const sources = [];
     const auth = await desiredAuthSchema(resolved, rootDir, srcDirectories, logger);
     if (auth) {
@@ -1119,7 +1128,7 @@ export async function schemaSources(resolved, rootDir, srcDirectories, logger, a
             origin: 'pikkuBetterAuth (Better Auth)',
         });
     }
-    const runtime = await desiredRuntimeSchema(resolved, rootDir, srcDirectories, logger);
+    const runtime = await desiredRuntimeSchema(resolved, rootDir, srcDirectories, logger, services);
     if (runtime.tables.size > 0) {
         sources.push({
             name: 'pikku-runtime',
@@ -1185,8 +1194,8 @@ function addColumnStatements(table, columns) {
  * Migrations are written one file per source, numbered in dependency order, so
  * a project can review and apply them independently.
  */
-export async function generateMigrations(resolved, rootDir, srcDirectories, logger, addons = []) {
-    const sources = await schemaSources(resolved, rootDir, srcDirectories, logger, addons);
+export async function generateMigrations(resolved, rootDir, srcDirectories, logger, addons = [], services) {
+    const sources = await schemaSources(resolved, rootDir, srcDirectories, logger, addons, services);
     const result = { upToDate: [], written: [] };
     for (const source of sources) {
         // Re-read after each write: a migration just written for an earlier source

package/dist/src/functions/wirings/auth/serialize-auth-guards.d.ts

@@ -9,4 +9,4 @@
  * references it; that config imports it back, which is a type-only edge and
  * carries no runtime cycle.
  */
-export declare const serializeAuthGuards: (functionTypesImportPath: string, packageName?: string) => string;
+export declare const serializeAuthGuards: (functionTypesImportPath: string, requiredServicesTypeImport: string, packageName?: string) => string;

package/dist/src/functions/wirings/auth/serialize-auth-guards.js

@@ -9,7 +9,7 @@
  * references it; that config imports it back, which is a type-only edge and
  * carries no runtime cycle.
  */
-export const serializeAuthGuards = (functionTypesImportPath, packageName) => {
+export const serializeAuthGuards = (functionTypesImportPath, requiredServicesTypeImport, packageName) => {
     const packageNameValue = packageName ? `'${packageName}'` : 'null';
     return `/**
  * Permission, auth gate and credential definitions
@@ -29,11 +29,18 @@ import type {
   Session,
   SingletonServices,
   WiredServices,
-  WiredSingletonServices,
 } from '${functionTypesImportPath}'
+${requiredServicesTypeImport}
 
 export { defineCredential } from '@pikku/core/credential'
 
+/**
+ * Derived here rather than imported: nothing outside a generated leaf ever
+ * names this intersection, so the function leaf keeps it to itself and the
+ * leaves that want it spell it out.
+ */
+type WiredSingletonServices = RequiredSingletonServices & SingletonServices
+
 /** \`WiredSingletonServices\` without \`secrets\`, for auth gates. */
 type WiredAuthServices = SecretlessServices<WiredSingletonServices>
 

package/dist/src/functions/wirings/functions/pikku-command-function-types-split.js

@@ -32,11 +32,11 @@ export const pikkuFunctionTypesSplit = pikkuSessionlessFunc({
             ? `import type { ${pikkuConfigType.type} } from '${getFileImportRelativePath(functionTypesFile, pikkuConfigType.typePath, packageMappings)}'`
             : '// Config type not found, will use fallback';
         const content = serializeFunctionTypes(`import type { ${userSessionType.type} } from '${getFileImportRelativePath(functionTypesFile, userSessionType.typePath, packageMappings)}'`, userSessionType.type, `import type { ${singletonServicesType.type} } from '${getFileImportRelativePath(functionTypesFile, singletonServicesType.typePath, packageMappings)}'`, singletonServicesType.type, `import type { ${wireServicesType.type} } from '${getFileImportRelativePath(functionTypesFile, wireServicesType.typePath, packageMappings)}'`, wireServicesType.type, `import type { TypedPikkuRPC, FlattenedRPCMap } from '${getFileImportRelativePath(functionTypesFile, rpcInternalMapDeclarationFile, packageMappings)}'`, `import type { RequiredSingletonServices } from '${getFileImportRelativePath(functionTypesFile, servicesFile, packageMappings)}'`, configTypeImport, getFileImportRelativePath(functionTypesFile, authGuardsFile, packageMappings), undefined, typeof config.addon === 'object' ? config.addon?.categories : undefined, `import type { ScopeId } from '${getFileImportRelativePath(functionTypesFile, config.scopesFile, packageMappings)}'`, credentialsTypeImport, getFileImportRelativePath(functionTypesFile, middlewareTypesFile, packageMappings), { addon: !!config.addon });
-        await writeFileInDir(logger, middlewareTypesFile, serializeMiddlewareTypes(getFileImportRelativePath(middlewareTypesFile, functionTypesFile, packageMappings), config.addonName));
+        await writeFileInDir(logger, middlewareTypesFile, serializeMiddlewareTypes(getFileImportRelativePath(middlewareTypesFile, functionTypesFile, packageMappings), `import type { RequiredSingletonServices } from '${getFileImportRelativePath(middlewareTypesFile, servicesFile, packageMappings)}'`, config.addonName));
         await writeFileInDir(logger, setupTypesFile, serializeSetupTypes(getFileImportRelativePath(setupTypesFile, functionTypesFile, packageMappings), pikkuConfigType
             ? `import type { ${pikkuConfigType.type} } from '${getFileImportRelativePath(setupTypesFile, pikkuConfigType.typePath, packageMappings)}'`
             : '// Config type not found, will use fallback', pikkuConfigType?.type, `import type { RequiredSingletonServices, RequiredWireServices } from '${getFileImportRelativePath(setupTypesFile, servicesFile, packageMappings)}'`));
-        await writeFileInDir(logger, authGuardsFile, serializeAuthGuards(getFileImportRelativePath(authGuardsFile, functionTypesFile, packageMappings), config.addonName));
+        await writeFileInDir(logger, authGuardsFile, serializeAuthGuards(getFileImportRelativePath(authGuardsFile, functionTypesFile, packageMappings), `import type { RequiredSingletonServices } from '${getFileImportRelativePath(authGuardsFile, servicesFile, packageMappings)}'`, config.addonName));
         const addonRefs = serializeAddonRefs({
             addonHttp: visitState.exportedContracts.addonHttp,
             addonChannel: visitState.exportedContracts.addonChannel,

package/dist/src/functions/wirings/functions/serialize-function-types.js

@@ -60,8 +60,18 @@ ${userSessionTypeName !== 'Session' ? `export type Session = ${userSessionTypeNa
  * services **non-optional** at every call site. A service is optional only when
  * nothing destructures it — in which case it is never created either. This is
  * why an \`if (!service)\` guard inside a function body is always dead code.
+ *
+ * Only the wire-services half lives here. The singleton half is declared by the
+ * auth and middleware leaves that use it, because whether a name earns its
+ * export is measured rather than chosen: emit declarations for a project and
+ * \`WiredServices\` is named by 147 of its \`.d.ts\` files, while the singleton
+ * intersection is named by none outside the leaves that declare it. Export the
+ * latter and it is a compatibility promise nothing asked for; unexport
+ * \`WiredServices\` and every wired module inlines the intersection instead,
+ * which asks it to name each member service through a specifier it does not
+ * have — 3308 TS2883s. \`--noEmit\` cannot surface any of that, so re-check with
+ * \`tsc --declaration --emitDeclarationOnly\` before moving either one.
  */
-export type WiredSingletonServices = RequiredSingletonServices & SingletonServices
 export type WiredServices = SecretlessServices<RequiredSingletonServices & Services>
 
 /**

package/dist/src/functions/wirings/middleware/serialize-middleware-types.d.ts

@@ -6,4 +6,4 @@
  * here rather than alongside the function types that consume it; those types
  * import it back, which is a type-only edge and carries no runtime cycle.
  */
-export declare const serializeMiddlewareTypes: (functionTypesImportPath: string, packageName?: string) => string;
+export declare const serializeMiddlewareTypes: (functionTypesImportPath: string, requiredServicesTypeImport: string, packageName?: string) => string;

package/dist/src/functions/wirings/middleware/serialize-middleware-types.js

@@ -6,7 +6,7 @@
  * here rather than alongside the function types that consume it; those types
  * import it back, which is a type-only edge and carries no runtime cycle.
  */
-export const serializeMiddlewareTypes = (functionTypesImportPath, packageName) => {
+export const serializeMiddlewareTypes = (functionTypesImportPath, requiredServicesTypeImport, packageName) => {
     const packageNameValue = packageName ? `'${packageName}'` : 'null';
     return `/**
  * Middleware type definitions and registration for all wirings
@@ -21,11 +21,19 @@ import {
   addChannelMiddleware as addChannelMiddlewareCore,
 } from '@pikku/core/channel'
 import type { PikkuAgentMiddlewareHooks } from '@pikku/core/agent'
-import type { Services, SingletonServices, WiredSingletonServices } from '${functionTypesImportPath}'
+import type { Services, SingletonServices } from '${functionTypesImportPath}'
+${requiredServicesTypeImport}
 
 export { cors } from '@pikku/core/middleware'
 export type { MiddlewarePriority }
 
+/**
+ * Derived here rather than imported: nothing outside a generated leaf ever
+ * names this intersection, so the function leaf keeps it to itself and the
+ * leaves that want it spell it out.
+ */
+type WiredSingletonServices = RequiredSingletonServices & SingletonServices
+
 /**
  * Type-safe middleware definition that can access your application's services and session.
  * Use this to define reusable middleware that can be applied to multiple wirings.

package/dist/src/utils/pikku-cli-config-error.d.ts

@@ -0,0 +1,9 @@
+/**
+ * A config that was found and parsed, but says something impossible.
+ *
+ * Its message reaches the developer verbatim — every other error out of the
+ * loader is reported as "failed to load", which sends the reader hunting for a
+ * broken file rather than the line that is wrong.
+ */
+export declare class PikkuCLIConfigError extends Error {
+}

package/dist/src/utils/pikku-cli-config-error.js

@@ -0,0 +1,9 @@
+/**
+ * A config that was found and parsed, but says something impossible.
+ *
+ * Its message reaches the developer verbatim — every other error out of the
+ * loader is reported as "failed to load", which sends the reader hunting for a
+ * broken file rather than the line that is wrong.
+ */
+export class PikkuCLIConfigError extends Error {
+}

package/dist/src/utils/pikku-cli-config.d.ts

@@ -1,5 +1,6 @@
 import type { PikkuCLIConfig } from '../../types/config.js';
 import type { CLILogger } from '../services/cli-logger.service.js';
+import { PikkuCLIConfigError } from './pikku-cli-config-error.js';
 export declare const getPikkuCLIConfig: (logger: CLILogger, configFile: string | undefined, requiredFields: Array<keyof PikkuCLIConfig>, exitProcess?: boolean, outDirOverride?: string) => Promise<PikkuCLIConfig>;
 /**
  * Like `getPikkuCLIConfig`, but returns null when the project has no config at
@@ -12,9 +13,7 @@ export declare const getPikkuCLIConfig: (logger: CLILogger, configFile: string |
  * a real error, and staying quiet about it would hide it.
  */
 export declare const tryGetPikkuCLIConfig: (logger: CLILogger, configFile: string | undefined, requiredFields: Array<keyof PikkuCLIConfig>, outDirOverride?: string) => Promise<PikkuCLIConfig | null>;
-/** A config that was found and parsed, but says something impossible. */
-export declare class PikkuCLIConfigError extends Error {
-}
+export { PikkuCLIConfigError };
 /**
  * The two schema registers must be two directories.
  *

package/dist/src/utils/pikku-cli-config.js

@@ -2,6 +2,7 @@ import { join, dirname, resolve, isAbsolute, parse as parsePath } from 'path';
 import { readdir, readFile } from 'fs/promises';
 import { resolveScaffoldFeature } from './resolve-scaffold-feature.js';
 import { setScaffoldWriteGuard } from './file-writer.js';
+import { PikkuCLIConfigError } from './pikku-cli-config-error.js';
 const CLIENT_FILE_KEYS = [
     'fetchFile',
     'websocketFile',
@@ -59,9 +60,7 @@ async function findConfigFile() {
     }
     return configFile;
 }
-/** A config that was found and parsed, but says something impossible. */
-export class PikkuCLIConfigError extends Error {
-}
+export { PikkuCLIConfigError };
 /**
  * The two schema registers must be two directories.
  *

package/dist/src/utils/resolve-scaffold-feature.d.ts

@@ -16,5 +16,11 @@ export type ResolvedScaffoldFeature = {
  * A bare string is refused rather than read as a path: under `boolean | object`
  * no string is valid, and guessing one into `path` would turn a typo into a
  * generated file nobody asked for.
+ *
+ * An unrecognised key is refused for the same reason, and `auth` is refused by
+ * name. It was a real key once, and one a config can still be carrying: a
+ * config that sets it is asking for a gate that no longer exists there, so
+ * ignoring it silently would leave the file saying something untrue about the
+ * surface it configures.
  */
 export declare const resolveScaffoldFeature: (feature: string, value: PikkuScaffoldFeature | undefined) => ResolvedScaffoldFeature;

package/dist/src/utils/resolve-scaffold-feature.js

@@ -1,3 +1,5 @@
+import { PikkuCLIConfigError } from './pikku-cli-config-error.js';
+const SCAFFOLD_FEATURE_KEYS = ['path'];
 /**
  * Reads one `scaffold.<feature>` value.
  *
@@ -9,6 +11,12 @@
  * A bare string is refused rather than read as a path: under `boolean | object`
  * no string is valid, and guessing one into `path` would turn a typo into a
  * generated file nobody asked for.
+ *
+ * An unrecognised key is refused for the same reason, and `auth` is refused by
+ * name. It was a real key once, and one a config can still be carrying: a
+ * config that sets it is asking for a gate that no longer exists there, so
+ * ignoring it silently would leave the file saying something untrue about the
+ * surface it configures.
  */
 export const resolveScaffoldFeature = (feature, value) => {
     if (value === undefined || value === false) {
@@ -17,11 +25,23 @@ export const resolveScaffoldFeature = (feature, value) => {
     if (value === true) {
         return { enabled: true };
     }
-    if (typeof value !== 'object') {
-        throw new Error(`pikku.config.json: scaffold.${feature} must be true, false, or an object ` +
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        throw new PikkuCLIConfigError(`pikku.config.json: scaffold.${feature} must be true, false, or an object ` +
             `like { "path": "src/${feature}.gen.ts" } — received ${JSON.stringify(value)}. ` +
             `A bare string is never a shorthand for a path.`);
     }
+    for (const key of Object.keys(value)) {
+        if (key === 'auth') {
+            throw new PikkuCLIConfigError(`pikku.config.json: scaffold.${feature} no longer takes "auth" — a scaffold ` +
+                `flag says whether a surface is generated, not who may call it. ` +
+                `Authentication is declared on the function, its wiring, its scopes and ` +
+                `its addon, and enforced there on every call. Remove the key.`);
+        }
+        if (!SCAFFOLD_FEATURE_KEYS.includes(key)) {
+            throw new PikkuCLIConfigError(`pikku.config.json: scaffold.${feature} has no "${key}" option — the only ` +
+                `key is "path", which overrides where the generated file is written.`);
+        }
+    }
     return {
         enabled: true,
         path: value.path,