@pikku/cli 0.12.110 → 0.12.112

package/dist/.pikku/trigger/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.110
+ * This file was generated by @pikku/cli@0.12.112
  */
 /**
  * Subpath entry — `#pikku/trigger` resolves here.

package/dist/.pikku/trigger/index.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.110
+ * This file was generated by @pikku/cli@0.12.112
  */
 /**
  * Subpath entry — `#pikku/trigger` resolves here.

package/dist/.pikku/trigger/pikku-trigger-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.110
+ * This file was generated by @pikku/cli@0.12.112
  */
 /**
  * Trigger-specific type definitions for tree-shaking optimization

package/dist/.pikku/trigger/pikku-trigger-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.110
+ * This file was generated by @pikku/cli@0.12.112
  */
 /**
  * Trigger-specific type definitions for tree-shaking optimization

package/dist/.pikku/variables/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.110
+ * This file was generated by @pikku/cli@0.12.112
  */
 /**
  * Subpath entry — `#pikku/variables` resolves here.

package/dist/.pikku/variables/index.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.110
+ * This file was generated by @pikku/cli@0.12.112
  */
 /**
  * Subpath entry — `#pikku/variables` resolves here.

package/dist/.pikku/variables/pikku-variable-types.gen.d.ts

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.110
+ * This file was generated by @pikku/cli@0.12.112
  */
 export { defineVariable } from '@pikku/core/variable';

package/dist/.pikku/variables/pikku-variable-types.gen.js

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.110
+ * This file was generated by @pikku/cli@0.12.112
  */
 export { defineVariable } from '@pikku/core/variable';

package/dist/.pikku/variables/pikku-variables.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.110
+ * This file was generated by @pikku/cli@0.12.112
  */
 import { TypedVariablesService as CoreTypedVariablesService } from '@pikku/core/services';
 import type { VariablesService } from '@pikku/core/services';

package/dist/.pikku/variables/pikku-variables.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.110
+ * This file was generated by @pikku/cli@0.12.112
  */
 import { TypedVariablesService as CoreTypedVariablesService, } from '@pikku/core/services';
 /**

package/dist/.pikku/workflow/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.110
+ * This file was generated by @pikku/cli@0.12.112
  */
 /**
  * Subpath entry — `#pikku/workflow` resolves here.

package/dist/.pikku/workflow/index.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.110
+ * This file was generated by @pikku/cli@0.12.112
  */
 /**
  * Subpath entry — `#pikku/workflow` resolves here.

package/dist/.pikku/workflow/pikku-workflow-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.110
+ * This file was generated by @pikku/cli@0.12.112
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import type { PikkuWorkflowGraphConfig, PikkuWorkflowGraphResult } from '@pikku/core/workflow';

package/dist/.pikku/workflow/pikku-workflow-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.110
+ * This file was generated by @pikku/cli@0.12.112
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import { pikkuWorkflowGraph as corePikkuWorkflowGraph } from '@pikku/core/workflow';

package/dist/.pikku/workflow/pikku-workflow-wirings-meta.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.110
+ * This file was generated by @pikku/cli@0.12.112
  */
 import { pikkuState } from '@pikku/core/state';
 import allWorkflowMeta from './meta/allWorkflow.gen.json' with { type: 'json' };

package/dist/.pikku/workflow/pikku-workflow-wirings.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.110
+ * This file was generated by @pikku/cli@0.12.112
  */
 import { addWorkflow } from '@pikku/core/workflow';
 import './pikku-workflow-wirings-meta.gen.js';

package/dist/bin/pikku-bin.mjs

@@ -11,8 +11,8 @@ async function checkForUpdate() {
     })
     if (!res.ok) return
     const { version: latest } = await res.json()
-    if (latest !== '0.12.110') {
-      process.stderr.write(`\n  Update available  0.12.110 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
+    if (latest !== '0.12.112') {
+      process.stderr.write(`\n  Update available  0.12.112 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
     }
   } catch {}
 }

package/dist/src/deploy/analyzer/analyzer.d.ts

@@ -7,7 +7,7 @@
  * Workflow orchestrators dispatch to step units via queue or RPC (inline).
  */
 import { type InspectorState } from '@pikku/inspector';
-import type { DeploymentManifest } from './manifest.js';
+import type { DeploymentManifest } from '@pikku/deploy';
 export interface AnalyzerOptions {
     projectId: string;
     /** Services that can't run serverless — functions using them get target: 'server' */

package/dist/src/deploy/analyzer/index.d.ts

@@ -1,3 +1,2 @@
 export { analyzeDeployment } from './analyzer.js';
 export type { AnalyzerOptions } from './analyzer.js';
-export type { DeploymentManifest, DeploymentUnit, DeploymentUnitRole, ServiceCapability, ServiceRequirement, HttpRouteInfo, QueueDefinition, ScheduledTaskDefinition, ChannelDefinition, AgentDefinition, MCPEndpointDefinition, WorkflowStepDefinition, WorkflowDefinition, SecretDeclaration, VariableDeclaration, } from './manifest.js';

package/dist/src/deploy/build-pipeline.d.ts

@@ -6,10 +6,10 @@
  */
 import type { InspectorState } from '@pikku/inspector';
 import { PikkuError } from '@pikku/core/errors';
-import type { DeploymentManifest } from './analyzer/manifest.js';
+import type { DeploymentManifest } from '@pikku/deploy';
 import type { Bundler } from './bundler/bundler.interface.js';
 import type { BundleResult } from './bundler/types.js';
-import type { ProviderAdapter } from './provider-adapter.js';
+import type { ProviderAdapter } from '@pikku/deploy';
 export interface BuildLogger {
     info(msg: string): void;
     error(msg: string): void;

package/dist/src/deploy/bundler/types.d.ts

@@ -2,7 +2,7 @@
  * Types for the Pikku esbuild bundling pipeline.
  * Imports DeploymentManifest from the analyzer — single source of truth.
  */
-export type { DeploymentManifest, DeploymentUnit, DeploymentUnitRole, } from '../analyzer/manifest.js';
+export type { DeploymentManifest, DeploymentUnit, DeploymentUnitRole, } from '@pikku/deploy';
 export interface BundleResult {
     unitName: string;
     bundlePath: string;

package/dist/src/deploy/codegen/per-unit-codegen.d.ts

@@ -8,7 +8,7 @@
  * Uses --stateInput to avoid re-inspecting the codebase for each unit.
  */
 import type { InspectorState } from '@pikku/inspector';
-import type { DeploymentManifest, DeploymentUnit } from '../analyzer/manifest.js';
+import type { DeploymentManifest, DeploymentUnit } from '@pikku/deploy';
 export interface PerUnitCodegenOptions {
     /** Root directory of the project (where pikku.config.json lives) */
     projectDir: string;

package/dist/src/deploy/plan/executor.d.ts

@@ -1,4 +1,4 @@
-import type { DeploymentManifest } from '../analyzer/manifest.js';
+import type { DeploymentManifest } from '@pikku/deploy';
 import type { DeployProvider } from './provider.js';
 import type { ApplyResult, DeploymentPlan, PlanChange } from './types.js';
 type ProgressStatus = 'start' | 'done' | 'error';

package/dist/src/deploy/plan/planner.d.ts

@@ -1,4 +1,4 @@
-import type { DeploymentManifest } from '../analyzer/manifest.js';
+import type { DeploymentManifest } from '@pikku/deploy';
 import type { CurrentState, DeployProvider } from './provider.js';
 import type { DeploymentPlan } from './types.js';
 export declare function generatePlan(manifest: DeploymentManifest, currentState: CurrentState, provider: DeployProvider): Promise<DeploymentPlan>;

package/dist/src/deploy/plan/provider.d.ts

@@ -1,4 +1,4 @@
-import type { DeploymentManifest } from '../analyzer/manifest.js';
+import type { DeploymentManifest } from '@pikku/deploy';
 import type { PlanChange } from './types.js';
 export interface CurrentState {
     units: Array<{

package/dist/src/deploy/server-entry.d.ts

@@ -10,7 +10,7 @@
  * fly.io, ECS, bare VM. Provider-specific config (Dockerfile, infra) is
  * emitted by the provider adapter on top of this entry + bundle.js.
  */
-import type { EntryGenerationContext } from './provider-adapter.js';
+import type { EntryGenerationContext } from '@pikku/deploy';
 export declare function generateServerEntrySource(ctx: EntryGenerationContext): string;
 export declare const SERVER_DOCKERFILE = "# Generated by @pikku/cli \u2014 do not edit\n# Full image (not -slim): carries the build toolchain so externalised deps with\n# native addons can compile from source at `npm install` time.\nFROM node:26\n\nRUN apt-get update \\\n  && apt-get install -y --no-install-recommends tini ca-certificates \\\n  && rm -rf /var/lib/apt/lists/*\n\nRUN groupadd -r pikku && useradd -r -g pikku -u 1001 pikku\n\nWORKDIR /app\n\n# Pikku bundles user code + first-party deps inline; only externalised deps\n# (typically empty for pure-JS apps) are listed in package.json. We ship no\n# lockfile because the bundle has already pinned everything via the\n# extracted exact-dependencies \u2014 `npm install --omit=dev` resolves the\n# leftover externals (if any) at build time.\nCOPY --chown=pikku:pikku package.json ./\nRUN npm install --omit=dev --no-audit --no-fund\n\nCOPY --chown=pikku:pikku bundle.js ./\n\nUSER pikku\nENV NODE_ENV=production\nENV PORT=8080\nEXPOSE 8080\n\nENTRYPOINT [\"/usr/bin/tini\", \"--\"]\nCMD [\"node\", \"bundle.js\"]\n";
 export declare const SERVER_DOCKERIGNORE = "node_modules\n.git\n*.log\nmetafile.json\nexact-dependencies.json\n";

package/dist/src/fabric/fabric-commands.d.ts

@@ -698,7 +698,7 @@ export declare const fabricCommands: {
             }, {
                 proxyUrl: string;
                 apiKey: string;
-                format: "json" | "text" | "env" | "shell";
+                format: "text" | "json" | "env" | "shell";
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
                 shell?: boolean | undefined;
                 env?: boolean | undefined;
@@ -706,7 +706,7 @@ export declare const fabricCommands: {
             }, {
                 proxyUrl: string;
                 apiKey: string;
-                format: "json" | "text" | "env" | "shell";
+                format: "text" | "json" | "env" | "shell";
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
                 shell?: boolean | undefined;
                 env?: boolean | undefined;
@@ -714,7 +714,7 @@ export declare const fabricCommands: {
             }, {
                 proxyUrl: string;
                 apiKey: string;
-                format: "json" | "text" | "env" | "shell";
+                format: "text" | "json" | "env" | "shell";
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").WiredServices>, undefined, undefined>, import("../../.pikku/middleware/pikku-middleware-types.gen.js").PikkuMiddleware, (services: import("../../types/application-types.js").SingletonServices, data: any, session?: import("../../types/application-types.js").UserSession | undefined) => void | Promise<void>, string>;
         };
     };

package/dist/src/fabric/functions/llm-key.function.d.ts

@@ -8,8 +8,8 @@ export declare const FabricLLMKeyOutput: z.ZodObject<{
     proxyUrl: z.ZodString;
     apiKey: z.ZodString;
     format: z.ZodEnum<{
-        json: "json";
         text: "text";
+        json: "json";
         env: "env";
         shell: "shell";
     }>;
@@ -21,7 +21,7 @@ export declare const FabricLLMKey: import("../../../.pikku/function/pikku-functi
 }, {
     proxyUrl: string;
     apiKey: string;
-    format: "json" | "text" | "env" | "shell";
+    format: "text" | "json" | "env" | "shell";
 }, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
     shell?: boolean | undefined;
     env?: boolean | undefined;
@@ -29,7 +29,7 @@ export declare const FabricLLMKey: import("../../../.pikku/function/pikku-functi
 }, {
     proxyUrl: string;
     apiKey: string;
-    format: "json" | "text" | "env" | "shell";
+    format: "text" | "json" | "env" | "shell";
 }, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
     shell?: boolean | undefined;
     env?: boolean | undefined;
@@ -37,7 +37,7 @@ export declare const FabricLLMKey: import("../../../.pikku/function/pikku-functi
 }, {
     proxyUrl: string;
     apiKey: string;
-    format: "json" | "text" | "env" | "shell";
+    format: "text" | "json" | "env" | "shell";
 }, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices>, undefined, undefined>;
 export declare const renderLLMKey: (_services: unknown, data: {
     proxyUrl: string;

package/dist/src/functions/commands/db-generate.js

@@ -14,7 +14,7 @@ export const dbGenerate = pikkuSessionlessFunc({
         }
         const state = await getInspectorState();
         const addons = [...state.rpc.wireAddonDeclarations.values()].map(({ package: pkg, remote }) => ({ package: pkg, remote }));
-        const { upToDate, written } = await generateMigrations(resolved, config.rootDir, config.srcDirectories, logger, addons);
+        const { upToDate, written } = await generateMigrations(resolved, config.rootDir, config.srcDirectories, logger, addons, state.serviceAggregation.requiredServices);
         for (const source of upToDate) {
             logger.info(`db generate: ${source} is already covered by existing migrations`);
         }

package/dist/src/functions/commands/deploy-apply.d.ts

@@ -1,4 +1,4 @@
-import type { ProviderAdapter, EntryGenerationContext } from '../../deploy/provider-adapter.js';
+import type { ProviderAdapter, EntryGenerationContext } from '@pikku/deploy';
 import type { InspectorState } from '@pikku/inspector';
 export declare function getEntryContext(unitDir: string, pikkuDir: string, unit: EntryGenerationContext['unit'], inspectorState: InspectorState): EntryGenerationContext;
 export declare function resolveProvider(config?: {

package/dist/src/functions/commands/new-addon.js

@@ -139,17 +139,20 @@ export function getAddonFiles(vars, flags) {
         // these never have to point at the source tree.
         imports: {
             '#pikku/*.js': './dist/.pikku/*.js',
-            '#pikku/*': './dist/.pikku/*/index.js',
+            '#pikku/*': ['./dist/.pikku/*/index.js', './dist/.pikku/*'],
         },
+        // An addon's generated tree roots at `.pikku/addon/`, but a consumer
+        // reaches it by the same subpath an application would — the leaf is the
+        // package's business, not its callers'.
         exports: {
             '.': {
                 types: './dist/src/index.d.ts',
                 import: './dist/src/index.js',
             },
-            './.pikku/*': './dist/.pikku/*',
-            './.pikku/pikku-metadata.gen.json': './dist/.pikku/pikku-metadata.gen.json',
+            './.pikku/*': './dist/.pikku/addon/*',
+            './.pikku/pikku-metadata.gen.json': './dist/.pikku/addon/pikku-metadata.gen.json',
             './.pikku/rpc/pikku-rpc-wirings-map.internal.gen.js': {
-                types: './dist/.pikku/rpc/pikku-rpc-wirings-map.internal.gen.d.ts',
+                types: './dist/.pikku/addon/rpc/pikku-rpc-wirings-map.internal.gen.d.ts',
             },
         },
         files: ['dist'],
@@ -204,7 +207,7 @@ export function getAddonFiles(vars, flags) {
             resolveJsonModule: true,
             paths: {
                 '#pikku/*.js': ['./.pikku/*.ts'],
-                '#pikku/*': ['./.pikku/*/index.ts'],
+                '#pikku/*': ['./.pikku/*/index.ts', './.pikku/*'],
             },
         },
         include: ['src/**/*', 'types/**/*', '.pikku/**/*.ts'],
@@ -322,15 +325,14 @@ export const createSingletonServices = pikkuAddonServices(async (
 `;
     }
     else {
+        // The plain service takes no constructor argument — the secret, credential
+        // and oauth variants are the ones handed something to authenticate with.
         files['src/services.ts'] =
             `import { ${pascalName}Service } from './${name}-api.service.js'
 import { pikkuAddonServices } from '#pikku/addon/setup'
 
-export const createSingletonServices = pikkuAddonServices(async (
-  config,
-  { variables }
-) => {
-  const ${camelName} = new ${pascalName}Service(variables)
+export const createSingletonServices = pikkuAddonServices(async () => {
+  const ${camelName} = new ${pascalName}Service()
 
   return { ${camelName} }
 })
@@ -688,7 +690,7 @@ export function getTestFiles(vars) {
         type: 'module',
         imports: {
             '#pikku/*.js': './.pikku/*.ts',
-            '#pikku/*': './.pikku/*/index.ts',
+            '#pikku/*': ['./.pikku/*/index.ts', './.pikku/*'],
         },
         scripts: {
             pretest: 'pikku all',
@@ -727,7 +729,7 @@ export function getTestFiles(vars) {
             types: ['node'],
             paths: {
                 '#pikku/*.js': ['./.pikku/*.ts'],
-                '#pikku/*': ['./.pikku/*/index.ts'],
+                '#pikku/*': ['./.pikku/*/index.ts', './.pikku/*'],
             },
         },
         include: ['src/*', '.pikku/**/*', 'types/**/*'],

package/dist/src/functions/commands/persona.js

@@ -3,6 +3,7 @@ import { mkdirSync, writeFileSync } from 'node:fs';
 import { pikkuSessionlessFunc } from '#pikku/function';
 import { createHttpPersonas, personaEnvironmentRefusal, roleMismatchMessage, verifyPersonaRoles, } from '@pikku/core/persona';
 import { personaVirtualUserTarget, runVirtualUser, catalogueClassification, DISPOSITIONS, prepareVirtualUserRun, } from '@pikku/core/virtual-user';
+import { getSingletonServices, setSingletonServices } from '@pikku/core/state';
 import { resolvePersonas } from '../../utils/resolve-personas.js';
 import { resolveEnvironment } from './environment.js';
 import { createDevAgentRunner } from './dev-agent-runner.js';
@@ -92,6 +93,11 @@ export const personaRun = pikkuSessionlessFunc({
         if (!agentRunner) {
             throw new Error('No AI provider is configured. Set OPENAI_BASE_URL + OPENAI_API_KEY (or LITELLM_PROXY_URL + LITELLM_API_KEY).');
         }
+        // `talkTo` reaches the runner through the singleton registry rather than
+        // through the `llm` handed to the engine, so a persona offered an agent
+        // dies on its first word without this — and only for a persona whose
+        // scopes reach one, which is why it survives a run as anybody else.
+        setSingletonServices({ ...getSingletonServices(), agentRunner });
         // Shared with the scaffolded `runVirtualUser` RPC, which does the same
         // derivation from `metaService` at runtime — the two have to agree, or the
         // same persona and seed explore a different API depending on how it was

package/dist/src/functions/db/better-auth-schema.js

@@ -97,6 +97,11 @@ function fakeSecretService() {
     const placeholder = 'schema-introspection-only';
     return {
         getSecret: async () => createSecretValue(placeholder),
+        // Every key resolves, for the same reason `hasSecret` says yes to all of
+        // them: an auth factory that batches its secrets must come back with the
+        // whole batch, or it throws on the one it considers required and the
+        // schema is never read at all.
+        getSecrets: async (keys) => Object.fromEntries(keys.map((key) => [key, createSecretValue(placeholder)])),
         hasSecret: async () => true,
         setSecret: async () => { },
     };

package/dist/src/functions/db/local-db.d.ts

@@ -197,10 +197,18 @@ export interface DesiredRuntimeSchema extends DesiredSchema {
  * scope tables, so the schemas that wanted them are left out and returned in
  * `skipped` — reported rather than dropped, because the tables they would have
  * recognised now have nothing to explain them.
+ *
+ * `services` narrows the declaration to the schemas the services a project's
+ * code actually reaches own, for the caller that is about to write a migration:
+ * a project with no agents should not carry `agent_threads` in its migrations
+ * forever. Omit it and the whole declaration answers, which is what the caller
+ * that is *recognising* tables wants — a table created by a service that has
+ * since been dropped still has to read as a runtime table rather than as an
+ * unexplained one.
  */
 export declare function desiredRuntimeSchema(resolved: ResolvedDb, rootDir: string, srcDirectories: string[], logger: {
     error: (msg: string) => void;
-}): Promise<DesiredRuntimeSchema>;
+}, services?: ReadonlySet<string>): Promise<DesiredRuntimeSchema>;
 export declare function introspectSchema(resolved: ResolvedDb): Promise<SchemaMap>;
 export interface SchemaDriftResult {
     /** In the migrations, absent from the database — it is behind. */
@@ -367,7 +375,7 @@ export declare function addonSchemaSources(rootDir: string, dialect: ResolvedDb[
  */
 export declare function schemaSources(resolved: ResolvedDb, rootDir: string, srcDirectories: string[], logger: {
     error: (msg: string) => void;
-}, addons?: AddonDeclaration[]): Promise<SchemaSource[]>;
+}, addons?: AddonDeclaration[], services?: ReadonlySet<string>): Promise<SchemaSource[]>;
 export interface GeneratedMigration {
     source: string;
     file: string;
@@ -402,5 +410,5 @@ export interface GenerateResult {
  */
 export declare function generateMigrations(resolved: ResolvedDb, rootDir: string, srcDirectories: string[], logger: {
     error: (msg: string) => void;
-}, addons?: AddonDeclaration[]): Promise<GenerateResult>;
+}, addons?: AddonDeclaration[], services?: ReadonlySet<string>): Promise<GenerateResult>;
 export {};

package/dist/src/functions/db/local-db.js

@@ -6,7 +6,7 @@ import { runInNewContext } from 'node:vm';
 import { transformSync } from 'esbuild';
 import { CamelCasePlugin, Kysely, PostgresDialect } from 'kysely';
 import { migrate, baselineMigrations, } from './db-migrator.js';
-import { applyPikkuSchemas, compilePikkuSchemas, pikkuSchemas, resolveRequirements, createCoercionPlugin, } from '@pikku/kysely';
+import { applyPikkuSchemas, compilePikkuSchemas, pikkuSchemas, requiredPikkuSchemas, resolveRequirements, createCoercionPlugin, } from '@pikku/kysely';
 import { loadAuthOptions, getAuthMigrations } from './better-auth-schema.js';
 import { generateSchemaTypes } from './db-codegen.js';
 import { generateZodTypes } from './zod-codegen.js';
@@ -797,13 +797,22 @@ async function applyAuthSchema(kysely, rootDir, srcDirectories, logger) {
  * scope tables, so the schemas that wanted them are left out and returned in
  * `skipped` — reported rather than dropped, because the tables they would have
  * recognised now have nothing to explain them.
+ *
+ * `services` narrows the declaration to the schemas the services a project's
+ * code actually reaches own, for the caller that is about to write a migration:
+ * a project with no agents should not carry `agent_threads` in its migrations
+ * forever. Omit it and the whole declaration answers, which is what the caller
+ * that is *recognising* tables wants — a table created by a service that has
+ * since been dropped still has to read as a runtime table rather than as an
+ * unexplained one.
  */
-export async function desiredRuntimeSchema(resolved, rootDir, srcDirectories, logger) {
+export async function desiredRuntimeSchema(resolved, rootDir, srcDirectories, logger, services) {
+    const declared = services ? requiredPikkuSchemas(services) : pikkuSchemas;
     const skipped = [];
     const collect = async (db, introspect) => {
         await applyAuthSchema(db, rootDir, srcDirectories, logger);
         const before = await introspect();
-        const { types, unmet } = await resolveRequirements(db);
+        const { types, unmet } = await resolveRequirements(db, declared);
         for (const { schema, requirement } of unmet) {
             skipped.push({
                 schema: schema.name,
@@ -812,7 +821,7 @@ export async function desiredRuntimeSchema(resolved, rootDir, srcDirectories, lo
             });
         }
         const unavailable = new Set(unmet.map(({ schema }) => schema.name));
-        const schemas = pikkuSchemas.filter((s) => !unavailable.has(s.name));
+        const schemas = declared.filter((s) => !unavailable.has(s.name));
         await applyPikkuSchemas(db, schemas);
         const after = await introspect();
         for (const table of before.keys())
@@ -1109,7 +1118,7 @@ export async function addonSchemaSources(rootDir, dialect, addons, logger) {
  * Auth comes first because the runtime's scope tables reference its `user`
  * table; addons come last because they may reference either.
  */
-export async function schemaSources(resolved, rootDir, srcDirectories, logger, addons = []) {
+export async function schemaSources(resolved, rootDir, srcDirectories, logger, addons = [], services) {
     const sources = [];
     const auth = await desiredAuthSchema(resolved, rootDir, srcDirectories, logger);
     if (auth) {
@@ -1119,7 +1128,7 @@ export async function schemaSources(resolved, rootDir, srcDirectories, logger, a
             origin: 'pikkuBetterAuth (Better Auth)',
         });
     }
-    const runtime = await desiredRuntimeSchema(resolved, rootDir, srcDirectories, logger);
+    const runtime = await desiredRuntimeSchema(resolved, rootDir, srcDirectories, logger, services);
     if (runtime.tables.size > 0) {
         sources.push({
             name: 'pikku-runtime',
@@ -1185,8 +1194,8 @@ function addColumnStatements(table, columns) {
  * Migrations are written one file per source, numbered in dependency order, so
  * a project can review and apply them independently.
  */
-export async function generateMigrations(resolved, rootDir, srcDirectories, logger, addons = []) {
-    const sources = await schemaSources(resolved, rootDir, srcDirectories, logger, addons);
+export async function generateMigrations(resolved, rootDir, srcDirectories, logger, addons = [], services) {
+    const sources = await schemaSources(resolved, rootDir, srcDirectories, logger, addons, services);
     const result = { upToDate: [], written: [] };
     for (const source of sources) {
         // Re-read after each write: a migration just written for an earlier source

package/dist/src/functions/wirings/auth/serialize-auth-guards.d.ts

@@ -9,4 +9,4 @@
  * references it; that config imports it back, which is a type-only edge and
  * carries no runtime cycle.
  */
-export declare const serializeAuthGuards: (functionTypesImportPath: string, packageName?: string) => string;
+export declare const serializeAuthGuards: (functionTypesImportPath: string, requiredServicesTypeImport: string, packageName?: string) => string;

package/dist/src/functions/wirings/auth/serialize-auth-guards.js

@@ -9,7 +9,7 @@
  * references it; that config imports it back, which is a type-only edge and
  * carries no runtime cycle.
  */
-export const serializeAuthGuards = (functionTypesImportPath, packageName) => {
+export const serializeAuthGuards = (functionTypesImportPath, requiredServicesTypeImport, packageName) => {
     const packageNameValue = packageName ? `'${packageName}'` : 'null';
     return `/**
  * Permission, auth gate and credential definitions
@@ -29,11 +29,18 @@ import type {
   Session,
   SingletonServices,
   WiredServices,
-  WiredSingletonServices,
 } from '${functionTypesImportPath}'
+${requiredServicesTypeImport}
 
 export { defineCredential } from '@pikku/core/credential'
 
+/**
+ * Derived here rather than imported: nothing outside a generated leaf ever
+ * names this intersection, so the function leaf keeps it to itself and the
+ * leaves that want it spell it out.
+ */
+type WiredSingletonServices = RequiredSingletonServices & SingletonServices
+
 /** \`WiredSingletonServices\` without \`secrets\`, for auth gates. */
 type WiredAuthServices = SecretlessServices<WiredSingletonServices>
 

package/dist/src/functions/wirings/functions/pikku-command-function-types-split.js

@@ -32,11 +32,11 @@ export const pikkuFunctionTypesSplit = pikkuSessionlessFunc({
             ? `import type { ${pikkuConfigType.type} } from '${getFileImportRelativePath(functionTypesFile, pikkuConfigType.typePath, packageMappings)}'`
             : '// Config type not found, will use fallback';
         const content = serializeFunctionTypes(`import type { ${userSessionType.type} } from '${getFileImportRelativePath(functionTypesFile, userSessionType.typePath, packageMappings)}'`, userSessionType.type, `import type { ${singletonServicesType.type} } from '${getFileImportRelativePath(functionTypesFile, singletonServicesType.typePath, packageMappings)}'`, singletonServicesType.type, `import type { ${wireServicesType.type} } from '${getFileImportRelativePath(functionTypesFile, wireServicesType.typePath, packageMappings)}'`, wireServicesType.type, `import type { TypedPikkuRPC, FlattenedRPCMap } from '${getFileImportRelativePath(functionTypesFile, rpcInternalMapDeclarationFile, packageMappings)}'`, `import type { RequiredSingletonServices } from '${getFileImportRelativePath(functionTypesFile, servicesFile, packageMappings)}'`, configTypeImport, getFileImportRelativePath(functionTypesFile, authGuardsFile, packageMappings), undefined, typeof config.addon === 'object' ? config.addon?.categories : undefined, `import type { ScopeId } from '${getFileImportRelativePath(functionTypesFile, config.scopesFile, packageMappings)}'`, credentialsTypeImport, getFileImportRelativePath(functionTypesFile, middlewareTypesFile, packageMappings), { addon: !!config.addon });
-        await writeFileInDir(logger, middlewareTypesFile, serializeMiddlewareTypes(getFileImportRelativePath(middlewareTypesFile, functionTypesFile, packageMappings), config.addonName));
+        await writeFileInDir(logger, middlewareTypesFile, serializeMiddlewareTypes(getFileImportRelativePath(middlewareTypesFile, functionTypesFile, packageMappings), `import type { RequiredSingletonServices } from '${getFileImportRelativePath(middlewareTypesFile, servicesFile, packageMappings)}'`, config.addonName));
         await writeFileInDir(logger, setupTypesFile, serializeSetupTypes(getFileImportRelativePath(setupTypesFile, functionTypesFile, packageMappings), pikkuConfigType
             ? `import type { ${pikkuConfigType.type} } from '${getFileImportRelativePath(setupTypesFile, pikkuConfigType.typePath, packageMappings)}'`
             : '// Config type not found, will use fallback', pikkuConfigType?.type, `import type { RequiredSingletonServices, RequiredWireServices } from '${getFileImportRelativePath(setupTypesFile, servicesFile, packageMappings)}'`));
-        await writeFileInDir(logger, authGuardsFile, serializeAuthGuards(getFileImportRelativePath(authGuardsFile, functionTypesFile, packageMappings), config.addonName));
+        await writeFileInDir(logger, authGuardsFile, serializeAuthGuards(getFileImportRelativePath(authGuardsFile, functionTypesFile, packageMappings), `import type { RequiredSingletonServices } from '${getFileImportRelativePath(authGuardsFile, servicesFile, packageMappings)}'`, config.addonName));
         const addonRefs = serializeAddonRefs({
             addonHttp: visitState.exportedContracts.addonHttp,
             addonChannel: visitState.exportedContracts.addonChannel,

package/dist/src/functions/wirings/functions/serialize-function-types.js

@@ -60,8 +60,18 @@ ${userSessionTypeName !== 'Session' ? `export type Session = ${userSessionTypeNa
  * services **non-optional** at every call site. A service is optional only when
  * nothing destructures it — in which case it is never created either. This is
  * why an \`if (!service)\` guard inside a function body is always dead code.
+ *
+ * Only the wire-services half lives here. The singleton half is declared by the
+ * auth and middleware leaves that use it, because whether a name earns its
+ * export is measured rather than chosen: emit declarations for a project and
+ * \`WiredServices\` is named by 147 of its \`.d.ts\` files, while the singleton
+ * intersection is named by none outside the leaves that declare it. Export the
+ * latter and it is a compatibility promise nothing asked for; unexport
+ * \`WiredServices\` and every wired module inlines the intersection instead,
+ * which asks it to name each member service through a specifier it does not
+ * have — 3308 TS2883s. \`--noEmit\` cannot surface any of that, so re-check with
+ * \`tsc --declaration --emitDeclarationOnly\` before moving either one.
  */
-export type WiredSingletonServices = RequiredSingletonServices & SingletonServices
 export type WiredServices = SecretlessServices<RequiredSingletonServices & Services>
 
 /**

package/dist/src/functions/wirings/middleware/serialize-middleware-types.d.ts

@@ -6,4 +6,4 @@
  * here rather than alongside the function types that consume it; those types
  * import it back, which is a type-only edge and carries no runtime cycle.
  */
-export declare const serializeMiddlewareTypes: (functionTypesImportPath: string, packageName?: string) => string;
+export declare const serializeMiddlewareTypes: (functionTypesImportPath: string, requiredServicesTypeImport: string, packageName?: string) => string;