@pikku/cli 0.12.124 → 0.12.125

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/cli",
-  "version": "0.12.124",
+  "version": "0.12.125",
   "description": "Pikku CLI — code generation, dev server, migrations and deployment",
   "author": "yasser.fadl@gmail.com",
   "license": "BUSL-1.1",
@@ -31,17 +31,17 @@
     "@jridgewell/trace-mapping": "^0.3.31",
     "@openapi-contrib/json-schema-to-openapi-schema": "^4.3.4",
     "@pikku/ai-vercel": "^0.12.13",
-    "@pikku/better-auth": "^0.12.31",
-    "@pikku/bun-server": "^0.12.9",
+    "@pikku/better-auth": "^0.12.32",
+    "@pikku/bun-server": "^0.12.10",
     "@pikku/code-edit": "^0.12.1",
-    "@pikku/deploy": "^0.12.1",
+    "@pikku/deploy": "^0.12.2",
     "@pikku/deploy-cloudflare": "^0.12.13",
     "@pikku/fetch": "^0.12.10",
     "@pikku/inspector": "^0.12.67",
     "@pikku/knowledge": "^0.12.7",
-    "@pikku/kysely": "^0.13.22",
+    "@pikku/kysely": "^0.13.23",
     "@pikku/n8n-import": "^0.0.7",
-    "@pikku/node-http-server": "^0.12.11",
+    "@pikku/node-http-server": "^0.12.12",
     "@pikku/openapi-parser": "^0.12.20",
     "@pikku/schedule": "^0.12.7",
     "@pikku/skills": "^0.12.19",
@@ -67,14 +67,14 @@
     "zod-to-ts": "^2.1.0"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.97",
+    "@pikku/core": "^0.12.98",
     "@pikku/playwright": "^0.12.79",
     "@pikku/ws": "^0.12.9",
     "better-auth": "^1.6.0",
     "ws": "^8.21.3"
   },
   "devDependencies": {
-    "@pikku/core": "^0.12.97",
+    "@pikku/core": "^0.12.98",
     "@pikku/playwright": "^0.12.79",
     "@pikku/ws": "^0.12.9",
     "@playwright/test": "^1.50.0",

package/snippets.json

@@ -40,7 +40,7 @@
   "cronWirings": "wireScheduler({\n  name: 'dailySalesReport',\n  schedule: '0 6 * * *', // 06:00 UTC every day\n  func: dailySalesReport,\n  middleware: [timingMiddleware],\n})\n\nwireScheduler({\n  name: 'cleanupAbandonedBaskets',\n  schedule: '0 3 * * *', // 03:00 UTC every day\n  func: cleanupAbandonedBaskets,\n})",
   "dailySalesReport": "export const dailySalesReport = pikkuVoidFunc({\n  // Exposed so an operator can run the sweep on demand and a scenario can\n  // prove it still works. A job reachable only by its schedule is a job\n  // nobody can test and nobody can force when it matters.\n  expose: true,\n  description: 'Cron job: compute and log a daily sales summary.',\n  func: async ({ kysely, logger }) => {\n    const yesterday = new Date()\n    yesterday.setDate(yesterday.getDate() - 1)\n    yesterday.setHours(0, 0, 0, 0)\n    const dayStart = yesterday.toISOString()\n\n    const today = new Date(yesterday)\n    today.setDate(today.getDate() + 1)\n    const dayEnd = today.toISOString()\n\n    const [summary, topItems] = await Promise.all([\n      kysely\n        .selectFrom('order')\n        .select([\n          (eb) => eb.fn.countAll<number>().as('orderCount'),\n          (eb) => eb.fn.sum<number>('totalCents').as('revenueCents'),\n        ])\n        .where('status', '=', 'paid')\n        .where('createdAt', '>=', dayStart)\n        .where('createdAt', '<', dayEnd)\n        .executeTakeFirst(),\n      kysely\n        .selectFrom('orderItem')\n        .innerJoin('order', 'order.orderId', 'orderItem.orderId')\n        .innerJoin('item', 'item.itemId', 'orderItem.itemId')\n        .select([\n          'item.name',\n          (eb) => eb.fn.sum<number>('orderItem.quantity').as('unitsSold'),\n        ])\n        .where('order.status', '=', 'paid')\n        .where('order.createdAt', '>=', dayStart)\n        .where('order.createdAt', '<', dayEnd)\n        .groupBy('orderItem.itemId')\n        .orderBy('unitsSold', 'desc')\n        .limit(5)\n        .execute(),\n    ])\n\n    logger.info({\n      event: 'daily_sales_report',\n      date: yesterday.toISOString().split('T')[0],\n      orders: Number(summary?.orderCount ?? 0),\n      revenueCents: Number(summary?.revenueCents ?? 0),\n      topItems,\n    })\n  },\n})",
   "definePersonas": "definePersonas({\n  visitor: {\n    // A customer, like the people this app is for. The catalogue happens to be\n    // readable without a session, so this is not what makes the smoke gate\n    // pass — it is what stops the gate depending on that staying true.\n    name: 'Visitor',\n    jobTitle: 'Synthetic health-check user',\n    roles: ['customer'],\n    personality:\n      'Signs in and checks their own session — proves auth end to end',\n    account: {},\n  },\n  shopper: {\n    name: 'Susan',\n    jobTitle: 'Buys for a small caf\\u00e9',\n    description: 'Orders stock every week and watches the margins',\n    roles: ['customer'],\n    personality:\n      'Hunts cheap deals. Tries three coupon codes before giving up, and abandons a basket if checkout asks for anything unexpected.',\n    goals: ['Get the weekly order in under five minutes'],\n    disposition: 'careless',\n    account: {},\n  },\n  /**\n   * Holds `orders:refund` without owning any order — the seam that makes the\n   * scope-versus-permission split worth demonstrating. A scenario run as Priya\n   * proves support can act on somebody else's order; one run as Susan proves a\n   * customer cannot.\n   */\n  priya: {\n    name: 'Priya from Support',\n    jobTitle: 'Customer support',\n    description:\n      'Handles refunds and cancellations for other people\\u2019s orders',\n    roles: ['support'],\n    personality:\n      'Methodical. Reads the order history before touching anything, and says what she changed.',\n    goals: ['Resolve the customer\\u2019s problem without escalating'],\n    account: {},\n  },\n  alex: {\n    name: 'Alex the Owner',\n    jobTitle: 'Shop owner',\n    description: 'Runs the shop \\u2014 prices, stock and who works here',\n    roles: ['admin'],\n    personality:\n      'Impatient. Knows the catalogue by heart and expects bulk actions to exist.',\n    goals: ['Keep stock accurate', 'See what sold this week'],\n    account: {},\n  },\n})",
-  "defineRoles": "defineSystemRole({\n  customer: {\n    displayName: 'Customer',\n    description: 'Browse the catalogue, place and track their own orders',\n    scopes: [\n      'catalogue:read',\n      'orders:create',\n      'orders:read',\n      'payments:charge',\n    ],\n  },\n  /**\n   * Handles orders but cannot change what is for sale. `orders:refund` without\n   * `catalogue:write` is the seam worth having in a template: support staff\n   * routinely need to undo a payment and routinely should not be able to\n   * reprice the shop.\n   */\n  support: {\n    displayName: 'Support',\n    description: 'Handle customer orders, including refunds',\n    scopes: [\n      'catalogue:read',\n      'orders:read',\n      'orders:cancel',\n      'orders:refund',\n      'payments:manage',\n    ],\n  },\n  /**\n   * Names the parents rather than enumerating their children — pikku's\n   * parent-grant rule means holding a node grants everything beneath it, so\n   * `catalogue` is `catalogue:read` and `catalogue:write` in one word instead\n   * of a list that drifts as the tree grows.\n   *\n   * `pikku:console` comes from `@pikku/addon-console`, not from this app: the\n   * console's own surface is the addon's to declare, and the shop composes with\n   * it rather than declaring a competing tree.\n   */\n  admin: {\n    displayName: 'Administrator',\n    description: 'Everything the shop can do, plus console administration',\n    scopes: ['catalogue', 'orders', 'payments', 'reports', 'pikku:console'],\n  },\n})",
+  "defineRoles": "defineSystemRole({\n  customer: {\n    displayName: 'Customer',\n    description: 'Browse the catalogue, place and track their own orders',\n    scopes: [\n      'catalogue:read',\n      'orders:create',\n      'orders:read',\n      'payments:charge',\n    ],\n  },\n  /**\n   * Handles orders but cannot change what is for sale. `orders:refund` without\n   * `catalogue:write` is the seam worth having in a template: support staff\n   * routinely need to undo a payment and routinely should not be able to\n   * reprice the shop.\n   */\n  support: {\n    displayName: 'Support',\n    description: 'Handle customer orders, including refunds',\n    scopes: [\n      'catalogue:read',\n      'orders:read',\n      'orders:cancel',\n      'orders:refund',\n      'payments:manage',\n    ],\n  },\n  /**\n   * Names the parents rather than enumerating their children — pikku's\n   * parent-grant rule means holding a node grants everything beneath it, so\n   * `catalogue` is `catalogue:read` and `catalogue:write` in one word instead\n   * of a list that drifts as the tree grows.\n   *\n   * `pikku:console` comes from `@pikku/addon-console`, not from this app, and\n   * `virtualUser` from the virtual-user scaffold, whose RPCs no role could\n   * otherwise reach. Both are parents rather than `virtualUser:*`: a wildcard\n   * has no row in pikku_scopes for pikku_role_scopes to reference.\n   */\n  admin: {\n    displayName: 'Administrator',\n    description: 'Everything the shop can do, plus console administration',\n    scopes: [\n      'catalogue',\n      'orders',\n      'payments',\n      'reports',\n      'pikku:console',\n      'virtualUser',\n    ],\n  },\n})",
   "defineScopes": "defineScope({\n  catalogue: {\n    displayName: 'Catalogue',\n    description: 'Browse and manage what is for sale',\n    scopes: {\n      read: { description: 'Browse items and categories' },\n      write: { description: 'Create, edit and withdraw items' },\n    },\n  },\n  orders: {\n    displayName: 'Orders',\n    description: 'Placing and handling orders',\n    scopes: {\n      read: { description: 'Read orders' },\n      create: { description: 'Place an order' },\n      cancel: { description: 'Cancel an order before it ships' },\n      refund: { description: 'Refund a paid order' },\n    },\n  },\n  payments: {\n    displayName: 'Payments',\n    description: 'Reaching the payment provider',\n    scopes: {\n      charge: { description: 'Create a payment intent for your own order' },\n      manage: {\n        description: 'Refunds, customers and everything else Stripe offers',\n      },\n    },\n  },\n  reports: {\n    displayName: 'Reports',\n    description: 'Sales and stock reporting',\n    scopes: {\n      read: { description: 'Read sales and stock reports' },\n    },\n  },\n})",
   "fetchClient": "export async function shopApiExamples() {\n  pikkuFetch.setServerUrl('http://localhost:4000')\n\n  const categories = await pikkuFetch.get('/categories')\n  const item = await pikkuFetch.get('/items/:itemId', { itemId: 'item-001' })\n\n  pikkuFetch.setAuthorizationJWT('user-jwt-token')\n  const order = await pikkuFetch.post('/orders', {\n    basketId: 'basket-123',\n    shippingAddress: {\n      line1: '1 High St',\n      city: 'London',\n      postcode: 'SW1A 1AA',\n      country: 'GB',\n    },\n  })\n\n  return { categories, item, order }\n}",
   "funcMultiWire": "// The same function can be wired to multiple transports without any changes.\n// Define once, wire everywhere.\nwireHTTP({ method: 'get', route: '/items/:itemId', func: getItem, auth: false })",
@@ -105,7 +105,7 @@
   "shopIsOrderOwner": "export const isOrderOwner = pikkuPermission(\n  async ({ kysely }, { orderId }: { orderId: string }, { session }) => {\n    const order = await kysely\n      .selectFrom('order')\n      .select('userId')\n      .where('orderId', '=', orderId)\n      .executeTakeFirst()\n    return order?.userId === session?.userId\n  }\n)",
   "shopRoutes": "export const shopRoutes = defineHTTPRoutes({\n  auth: false,\n  routes: {\n    // Categories\n    listCategories: {\n      method: 'get',\n      route: '/categories',\n      func: listCategories,\n    },\n    createCategory: {\n      method: 'post',\n      route: '/categories',\n      func: createCategory,\n      auth: true,\n    },\n\n    // Items\n    listItems: { method: 'get', route: '/items', func: listItems },\n    getItem: { method: 'get', route: '/items/:itemId', func: getItem },\n    createItem: {\n      method: 'post',\n      route: '/items',\n      func: createItem,\n      auth: true,\n    },\n    updateItem: {\n      method: 'patch',\n      route: '/items/:itemId',\n      func: updateItem,\n      auth: true,\n    },\n\n    // Account\n    getProfile: {\n      method: 'get',\n      route: '/profile',\n      func: getProfile,\n      auth: true,\n    },\n\n    // Basket (sessionless — works for guests too)\n    getBasket: { method: 'get', route: '/basket', func: getBasket },\n    addToBasket: { method: 'post', route: '/basket/items', func: addToBasket },\n    removeFromBasket: {\n      method: 'delete',\n      route: '/basket/items/:itemId',\n      func: removeFromBasket,\n    },\n\n    // Orders (require auth)\n    createOrder: {\n      method: 'post',\n      route: '/orders',\n      func: createOrder,\n      auth: true,\n    },\n    listOrders: {\n      method: 'get',\n      route: '/orders',\n      func: listOrders,\n      auth: true,\n    },\n    getOrder: {\n      method: 'get',\n      route: '/orders/:orderId',\n      func: getOrder,\n      auth: true,\n    },\n    cancelOrder: {\n      method: 'post',\n      route: '/orders/:orderId/cancel',\n      func: cancelOrder,\n      auth: true,\n    },\n  },\n})",
   "shopSecretUsage": "// Note what is *absent* here: `secrets`.\n//\n// Every function-, permission- and auth-facing services type in pikku is\n// bounded by `SecretlessServices`, which omits `secrets` outright. A function\n// cannot read one, so a secret cannot leak through a return value, a log line\n// or an error thrown from business logic — the class of bug you only find in\n// somebody else's incident report.\n//\n// Secrets are read once, where they are needed. `chargeCard` asks the Stripe\n// addon to create a payment intent; `STRIPE_SECRET_KEY` is the addon's secret\n// and never crosses into this function, so it cannot be logged here, returned\n// here, or attached to an error thrown here.\n//\n// This is the step the checkout workflow actually runs. The point used to be\n// made by a second, unwired copy of the same call that existed only to be\n// quoted — so the documented example was the one piece of payment code no\n// shopper ever reached.\nexport const chargeCard = pikkuSessionlessFunc({\n  // Invoked by name from `createOrder` as well as by the workflow, so one\n  // charge path exists rather than two that can drift.\n  expose: true,\n  description: 'Charge the card through Stripe.',\n  func: async (\n    { logger },\n    data: { orderId: string; totalCents: number; cardToken?: string },\n    { rpc }\n  ) => {\n    // The order id goes in the payment intent's metadata because that is the\n    // only way it comes back: `applyStripeEvent` reads it off the verified\n    // webhook event to decide which order was paid. Stripe knows nothing about\n    // our ids otherwise.\n    const intent = await rpc.invoke('stripe:paymentIntentCreate', {\n      amount: data.totalCents,\n      currency: 'gbp',\n      ...(data.cardToken\n        ? { paymentMethod: data.cardToken, confirm: true }\n        : {}),\n      metadata: { orderId: data.orderId },\n      // Charging twice for one order is the expensive failure here, and a\n      // workflow step is retried by design.\n      idempotencyKey: `order_${data.orderId}`,\n      description: `Order ${data.orderId}`,\n    })\n\n    logger.info({\n      event: 'payment_intent_created',\n      orderId: data.orderId,\n      status: intent.status,\n    })\n\n    return intent.status === 'succeeded'\n      ? { status: 'succeeded' as const, providerRef: intent.id }\n      : { status: 'failed' as const, reason: intent.status }\n  },\n})",
-  "shopServices": "export const createSingletonServices = pikkuServices(\n  async (config, existingServices) => {\n    const variables =\n      existingServices?.variables ??\n      new TypedVariablesService(new LocalVariablesService())\n    const secrets =\n      existingServices?.secrets ??\n      new TypedSecretService(new LocalSecretService(variables))\n    const logger = existingServices?.logger ?? new JsonConsoleLogger()\n    const schema = existingServices?.schema ?? new CFWorkerSchemaService(logger)\n    const emailService =\n      existingServices?.emailService ??\n      new GeneratedTemplateEmailService({\n        delegate: new LocalEmailService(),\n      })\n    // The durable audit sink. In a deployed stage fabric injects the platform's\n    // audit service; locally it falls back to a no-op so nothing is persisted.\n    const audit = existingServices?.audit ?? new NoopAuditService()\n    // kysely is injected by pikku dev (node:sqlite) or the CF Worker workflow (libsql).\n    // The template never constructs its own dialect — dialects are fabric/runtime\n    // concerns — so it must always be provided by the runtime.\n    if (!existingServices?.kysely) {\n      throw new Error(\n        'kysely service was not injected by the runtime (pikku dev / fabric)'\n      )\n    }\n    const kysely: Kysely<DB> = existingServices.kysely\n\n    // Per-user credential store (wire.getCredential) — needed by addons imported\n    // with --auth per-user/delegated. A deployed stage injects it: credentials are\n    // sealed to the stage, and only its secrets Worker holds the key. There is no\n    // fallback because there is no key to fall back to — the template used to\n    // build a `KyselyCredentialService` from a `CREDENTIALS_KEY` secret, which was\n    // the stage's own KEK handed to every unit. Outside a stage the app runs fine\n    // and credential-using addon calls fail with a clear error from the addon's\n    // wire services; wire your own `credentialService` here if you need one.\n    const credentialService = existingServices?.credentialService\n\n    const litellmProxyUrl = process.env.LITELLM_PROXY_URL ?? null\n    const litellmApiKey = process.env.LITELLM_API_KEY ?? null\n    let aiAgentRunner: VercelAgentRunner | undefined\n    if (litellmProxyUrl && litellmApiKey) {\n      // The AI SDKs (~3MB) are stubbed out of non-agent units at bundle time —\n      // only units with the `ai-model` capability keep them. So import them\n      // dynamically and guard on the module resolving to a real export; in a\n      // stubbed unit the import yields `{}` and the runner is simply not built.\n      const aiVercel = await import('@pikku/ai-vercel')\n      const aiSdk = await import('@ai-sdk/openai-compatible')\n      if (aiVercel.VercelAgentRunner && aiSdk.createOpenAICompatible) {\n        const litellmProvider = aiSdk.createOpenAICompatible({\n          name: 'litellm',\n          baseURL: litellmProxyUrl,\n          apiKey: litellmApiKey,\n        })\n        aiAgentRunner = new aiVercel.VercelAgentRunner({\n          openai: (modelId: string) => litellmProvider.chatModel(modelId),\n          anthropic: (modelId: string) => litellmProvider.chatModel(modelId),\n          google: (modelId: string) => litellmProvider.chatModel(modelId),\n          deepseek: (modelId: string) => litellmProvider.chatModel(modelId),\n        })\n      }\n    }\n\n    // Without a ScopeService no user can hold any scope, so every function that\n    // requires one denies everybody — `defineScope`, `defineSystemRole` and the\n    // role grants `pikku persona sync` writes all exist and none of them reach a\n    // request. It resolves userId -> roles -> scopes out of the four pikku_* tables.\n    //\n    // Built as the concrete class rather than the `ScopeService` interface because\n    // `init()` (which creates those tables if they are absent) is the\n    // implementation's, not the contract's. The cast is the app's own `DB` — which\n    // includes the pikku_* tables — against the narrower shape the service\n    // declares; the two differ only in kysely's internal builder generics.\n    let scopeService = existingServices?.scopeService\n    if (!scopeService) {\n      const kyselyScopes = new KyselyScopeService(\n        kysely as unknown as Kysely<KyselyPikkuDB>\n      )\n      await kyselyScopes.init()\n      scopeService = kyselyScopes\n    }\n\n    return {\n      ...(existingServices ?? {}),\n      config,\n      scopeService,\n      workflowService: existingServices?.workflowService,\n      workflowRunService: existingServices?.workflowRunService,\n      variables,\n      secrets,\n      schema,\n      logger,\n      emailService,\n      audit,\n      kysely,\n      // Constructed once here rather than read per call: the payment provider's\n      // credentials belong to service construction, and functions cannot reach\n      // `secrets` at all (every function-facing services type is bounded by\n      // SecretlessServices).\n      ...(credentialService ? { credentialService } : {}),\n      ...(aiAgentRunner ? { aiAgentRunner } : {}),\n    }\n  }\n)",
+  "shopServices": "export const createSingletonServices = pikkuServices(\n  async (config, existingServices) => {\n    const variables =\n      existingServices?.variables ??\n      new TypedVariablesService(new LocalVariablesService())\n    const secrets =\n      existingServices?.secrets ??\n      new TypedSecretService(new LocalSecretService(variables))\n    const logger = existingServices?.logger ?? new JsonConsoleLogger()\n    const schema = existingServices?.schema ?? new CFWorkerSchemaService(logger)\n    const emailService =\n      existingServices?.emailService ??\n      new GeneratedTemplateEmailService({\n        delegate: new LocalEmailService(),\n      })\n    // The durable audit sink. In a deployed stage fabric injects the platform's\n    // audit service; locally it falls back to a no-op so nothing is persisted.\n    const audit = existingServices?.audit ?? new NoopAuditService()\n    // kysely is injected by pikku dev (node:sqlite) or the CF Worker workflow (libsql).\n    // The template never constructs its own dialect — dialects are fabric/runtime\n    // concerns — so it must always be provided by the runtime.\n    if (!existingServices?.kysely) {\n      throw new Error(\n        'kysely service was not injected by the runtime (pikku dev / fabric)'\n      )\n    }\n    const kysely: Kysely<DB> = existingServices.kysely\n\n    // Per-user credential store (wire.getCredential) — needed by addons imported\n    // with --auth per-user/delegated. A deployed stage injects it: credentials are\n    // sealed to the stage, and only its secrets Worker holds the key. There is no\n    // fallback because there is no key to fall back to — the template used to\n    // build a `KyselyCredentialService` from a `CREDENTIALS_KEY` secret, which was\n    // the stage's own KEK handed to every unit. Outside a stage the app runs fine\n    // and credential-using addon calls fail with a clear error from the addon's\n    // wire services; wire your own `credentialService` here if you need one.\n    const credentialService = existingServices?.credentialService\n\n    const litellmProxyUrl = process.env.LITELLM_PROXY_URL ?? null\n    const litellmApiKey = process.env.LITELLM_API_KEY ?? null\n    let aiAgentRunner: VercelAgentRunner | undefined\n    if (litellmProxyUrl && litellmApiKey) {\n      // The AI SDKs (~3MB) are stubbed out of non-agent units at bundle time —\n      // only units with the `ai-model` capability keep them. So import them\n      // dynamically and guard on the module resolving to a real export; in a\n      // stubbed unit the import yields `{}` and the runner is simply not built.\n      const aiVercel = await import('@pikku/ai-vercel')\n      const aiSdk = await import('@ai-sdk/openai-compatible')\n      if (aiVercel.VercelAgentRunner && aiSdk.createOpenAICompatible) {\n        const litellmProvider = aiSdk.createOpenAICompatible({\n          name: 'litellm',\n          baseURL: litellmProxyUrl,\n          apiKey: litellmApiKey,\n        })\n        aiAgentRunner = new aiVercel.VercelAgentRunner({\n          openai: (modelId: string) => litellmProvider.chatModel(modelId),\n          anthropic: (modelId: string) => litellmProvider.chatModel(modelId),\n          google: (modelId: string) => litellmProvider.chatModel(modelId),\n          deepseek: (modelId: string) => litellmProvider.chatModel(modelId),\n        })\n      }\n    }\n\n    // Without a ScopeService no user can hold any scope, so every function that\n    // requires one denies everybody — `defineScope`, `defineSystemRole` and the\n    // role grants `pikku persona sync` writes all exist and none of them reach a\n    // request. It resolves userId -> roles -> scopes out of the four pikku_* tables.\n    //\n    // Built as the concrete class rather than the `ScopeService` interface because\n    // `init()` (which creates those tables if they are absent) is the\n    // implementation's, not the contract's. The cast is the app's own `DB` — which\n    // includes the pikku_* tables — against the narrower shape the service\n    // declares; the two differ only in kysely's internal builder generics.\n    let scopeService = existingServices?.scopeService\n    if (!scopeService) {\n      const kyselyScopes = new KyselyScopeService(\n        kysely as unknown as Kysely<KyselyPikkuDB>\n      )\n      await kyselyScopes.init()\n      scopeService = kyselyScopes\n    }\n\n    // The definitions in scopes.ts and roles.ts are declarations until something\n    // writes them down. Nothing else does, and a role with no row cannot be\n    // granted — `addUserToRole` fails the pikku_role_scopes foreign key, which is\n    // how persona provisioning discovers it.\n    await scopeService.syncScopes(SCOPES)\n    await scopeService.syncSystemRoles(SYSTEM_ROLES)\n\n    return {\n      ...(existingServices ?? {}),\n      config,\n      scopeService,\n      workflowService: existingServices?.workflowService,\n      workflowRunService: existingServices?.workflowRunService,\n      variables,\n      secrets,\n      schema,\n      logger,\n      emailService,\n      audit,\n      kysely,\n      // Constructed once here rather than read per call: the payment provider's\n      // credentials belong to service construction, and functions cannot reach\n      // `secrets` at all (every function-facing services type is bounded by\n      // SecretlessServices).\n      ...(credentialService ? { credentialService } : {}),\n      ...(aiAgentRunner ? { aiAgentRunner } : {}),\n    }\n  }\n)",
   "shopVersionedItem": "export const GetItemOutputV1 = z.object({\n  itemId: z.string(),\n  name: z.string(),\n  priceCents: z.number(),\n})\n\nexport const getItemV1 = pikkuSessionlessFunc({\n  expose: true,\n  version: 1,\n  input: GetItemInput,\n  output: GetItemOutputV1,\n  func: async ({ kysely }, { itemId }) => {\n    const row = await kysely\n      .selectFrom('item')\n      .select(['itemId', 'name', 'priceCents'])\n      .where('itemId', '=', itemId)\n      .executeTakeFirstOrThrow()\n    return row\n  },\n})\n\n// v2 — adds stock and imageUrl to the response\nexport const getItemV2 = pikkuSessionlessFunc({\n  expose: true,\n  version: 2,\n  input: GetItemInput,\n  output: GetItemOutput,\n  func: async ({ kysely }, { itemId }) => {\n    const row = await kysely\n      .selectFrom('item')\n      .innerJoin('category', 'category.categoryId', 'item.categoryId')\n      .select([\n        'item.itemId',\n        'item.name',\n        'item.slug',\n        'item.description',\n        'item.priceCents',\n        'item.stock',\n        'item.imageUrl',\n        'item.isActive',\n        'item.createdAt',\n        'item.updatedAt',\n        'category.categoryId',\n        'category.name as categoryName',\n        'category.slug as categorySlug',\n      ])\n      .where('item.itemId', '=', itemId)\n      .executeTakeFirstOrThrow()\n    return {\n      ...row,\n      category: {\n        categoryId: row.categoryId,\n        name: row.categoryName,\n        slug: row.categorySlug,\n      },\n    }\n  },\n})",
   "shopWireServices": "export const createWireServices = pikkuWireServices(\n  async (singletonServices, wire) => {\n    if (!singletonServices.audit) {\n      return {}\n    }\n    const auditLog = createInvocationAudit(singletonServices.audit, wire)\n    // auditLog is ALWAYS injected, but `auditLog.write(...)` only PERSISTS when this\n    // function set `audit: true` — createInvocationAudit gates on wire.audit, so\n    // without it write() is a warn-only no-op (see @pikku/core audit-service.ts).\n    // `auditLog.config` is set ONLY when audit: true is on, and when it is, ALSO wrap\n    // kysely so every query is captured and the runner flushes the buffer on close.\n    // Without audit: true, leave the plain kysely untouched — no per-query overhead.\n    if (!auditLog.config) {\n      return { auditLog }\n    }\n    return {\n      auditLog,\n      kysely: createAuditedKysely(singletonServices.kysely, {\n        audit: auditLog,\n      }),\n    }\n  }\n)",
   "tagMiddleware": "addTagMiddleware('checkout', [auditMiddleware('checkout')])",

package/surface.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.12.124",
+  "version": "0.12.125",
   "entryPoints": [
     {
       "id": "app",

package/console-app/assets/architecture-TIHT7OUA-D4Hj6824.js

@@ -1 +0,0 @@
-import"./chunk-KEIR6QF5-BICK3FdT.js";import{M as e}from"./mermaid-parser.core-CMBFGJ0U.js";export{e as createArchitectureServices};

package/console-app/assets/channel-09aKDzM0.js

@@ -1 +0,0 @@
-import{at as e,ot as t}from"./chunk-I66GZJ75-DDQhhfA0.js";var n=(n,r)=>t.lang.round(e.parse(n)[r]);export{n as t};

package/console-app/assets/chunk-XXDRQBXY-C1KaR4pt.js

@@ -1 +0,0 @@
-import{p as e}from"./index-DRfts2XF.js";import{n as t}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import"./src-Dg-KiSsV.js";var n=t((t,n)=>{let r;return n===`sandbox`&&(r=e(`#i`+t)),e(n===`sandbox`?r.nodes()[0].contentDocument.body:`body`).select(`[id="${t}"]`)},`getDiagramElement`);export{n as t};

package/console-app/assets/classDiagram-JCYQIIEL-23nagJMi.js

@@ -1 +0,0 @@
-import{n as e}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import"./src-Dg-KiSsV.js";import"./chunk-I66GZJ75-DDQhhfA0.js";import"./chunk-NSK5VX7P-DZhjvnHm.js";import"./chunk-4I5QYGJK-BXWo5Xyx.js";import"./chunk-WRU74C26-Ct8XrToU.js";import"./chunk-7BUUIJ7U-Bb538aSH.js";import"./chunk-UBXNYLIW-D85x6Zh2.js";import"./chunk-2GRJ4B5K-BFRr_H2V.js";import"./chunk-XXDRQBXY-C1KaR4pt.js";import"./chunk-KBJHAD2P-CQPQVDkD.js";import"./chunk-W5SLKNZC-B1Ps46_n.js";import"./chunk-QR6OTTB3-D1-TbcCP.js";import"./chunk-7Z6QIM7H-StNGH40U.js";import{i as t,n,r,t as i}from"./chunk-GF5L2VYU-QwXKtQxa.js";import"./mermaid.core-DYoDrSEJ.js";var a={parser:n,get db(){return new i},renderer:r,styles:t,init:e(e=>{e.class||={},e.class.arrowMarkerAbsolute=e.arrowMarkerAbsolute},`init`)};export{a as diagram};

package/console-app/assets/classDiagram-v2-OCEON4UE-23nagJMi.js

@@ -1 +0,0 @@
-import{n as e}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import"./src-Dg-KiSsV.js";import"./chunk-I66GZJ75-DDQhhfA0.js";import"./chunk-NSK5VX7P-DZhjvnHm.js";import"./chunk-4I5QYGJK-BXWo5Xyx.js";import"./chunk-WRU74C26-Ct8XrToU.js";import"./chunk-7BUUIJ7U-Bb538aSH.js";import"./chunk-UBXNYLIW-D85x6Zh2.js";import"./chunk-2GRJ4B5K-BFRr_H2V.js";import"./chunk-XXDRQBXY-C1KaR4pt.js";import"./chunk-KBJHAD2P-CQPQVDkD.js";import"./chunk-W5SLKNZC-B1Ps46_n.js";import"./chunk-QR6OTTB3-D1-TbcCP.js";import"./chunk-7Z6QIM7H-StNGH40U.js";import{i as t,n,r,t as i}from"./chunk-GF5L2VYU-QwXKtQxa.js";import"./mermaid.core-DYoDrSEJ.js";var a={parser:n,get db(){return new i},renderer:r,styles:t,init:e(e=>{e.class||={},e.class.arrowMarkerAbsolute=e.arrowMarkerAbsolute},`init`)};export{a as diagram};

package/console-app/assets/eventmodeling-45OFAUF4-RyG54ZHy.js

@@ -1 +0,0 @@
-import"./chunk-KEIR6QF5-BICK3FdT.js";import{O as e}from"./mermaid-parser.core-CMBFGJ0U.js";export{e as createEventModelingServices};

package/console-app/assets/flowDiagram-UKHOOZJN-DNdfrnRg.js

@@ -1 +0,0 @@
-import"./src-Dg-KiSsV.js";import"./chunk-I66GZJ75-DDQhhfA0.js";import"./chunk-NSK5VX7P-DZhjvnHm.js";import"./chunk-4I5QYGJK-BXWo5Xyx.js";import"./chunk-WRU74C26-Ct8XrToU.js";import"./chunk-7BUUIJ7U-Bb538aSH.js";import"./chunk-UBXNYLIW-D85x6Zh2.js";import"./chunk-2GRJ4B5K-BFRr_H2V.js";import"./chunk-XXDRQBXY-C1KaR4pt.js";import"./chunk-KBJHAD2P-CQPQVDkD.js";import"./chunk-W5SLKNZC-B1Ps46_n.js";import"./chunk-QR6OTTB3-D1-TbcCP.js";import"./chunk-7Z6QIM7H-StNGH40U.js";import{n as e}from"./chunk-JQJVKLGR-wFyF2bUv.js";import"./mermaid.core-DYoDrSEJ.js";export{e as diagram};

package/console-app/assets/railroad-abnf-AHOZXSZD-DX4FqVY6.js

@@ -1 +0,0 @@
-import"./chunk-KEIR6QF5-BICK3FdT.js";import{m as e}from"./mermaid-parser.core-CMBFGJ0U.js";export{e as createRailroadAbnfServices};

package/console-app/assets/railroad-ebnf-EBAXGLYW-DdyOtX1l.js

@@ -1 +0,0 @@
-import"./chunk-KEIR6QF5-BICK3FdT.js";import{f as e}from"./mermaid-parser.core-CMBFGJ0U.js";export{e as createRailroadEbnfServices};

package/console-app/assets/railroad-peg-LSFZ7HO6-CclC1sXF.js

@@ -1 +0,0 @@
-import"./chunk-KEIR6QF5-BICK3FdT.js";import{u as e}from"./mermaid-parser.core-CMBFGJ0U.js";export{e as createRailroadPegServices};

package/console-app/assets/stateDiagram-v2-UEYNNEHI-I34jrzP0.js

@@ -1 +0,0 @@
-import{n as e}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import"./src-Dg-KiSsV.js";import"./chunk-I66GZJ75-DDQhhfA0.js";import"./chunk-NSK5VX7P-DZhjvnHm.js";import"./chunk-4I5QYGJK-BXWo5Xyx.js";import"./chunk-WRU74C26-Ct8XrToU.js";import"./chunk-7BUUIJ7U-Bb538aSH.js";import"./chunk-UBXNYLIW-D85x6Zh2.js";import"./chunk-2GRJ4B5K-BFRr_H2V.js";import"./chunk-XXDRQBXY-C1KaR4pt.js";import"./chunk-KBJHAD2P-CQPQVDkD.js";import"./chunk-W5SLKNZC-B1Ps46_n.js";import"./chunk-QR6OTTB3-D1-TbcCP.js";import"./chunk-7Z6QIM7H-StNGH40U.js";import{i as t,n,r,t as i}from"./chunk-5RXB4S5H-BFnXfzzz.js";import"./mermaid.core-DYoDrSEJ.js";var a={parser:n,get db(){return new i(2)},renderer:r,styles:t,init:e(e=>{e.state||={},e.state.arrowMarkerAbsolute=e.arrowMarkerAbsolute},`init`)};export{a as diagram};

package/console-app/assets/swimlanesDiagram-ULZ7WXOC-C1PrPB0G.js

@@ -1,8 +0,0 @@
-import{n as e}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import"./src-Dg-KiSsV.js";import"./chunk-I66GZJ75-DDQhhfA0.js";import"./chunk-NSK5VX7P-DZhjvnHm.js";import"./chunk-4I5QYGJK-BXWo5Xyx.js";import"./chunk-WRU74C26-Ct8XrToU.js";import"./chunk-7BUUIJ7U-Bb538aSH.js";import"./chunk-UBXNYLIW-D85x6Zh2.js";import"./chunk-2GRJ4B5K-BFRr_H2V.js";import"./chunk-XXDRQBXY-C1KaR4pt.js";import"./chunk-KBJHAD2P-CQPQVDkD.js";import"./chunk-W5SLKNZC-B1Ps46_n.js";import"./chunk-QR6OTTB3-D1-TbcCP.js";import"./chunk-7Z6QIM7H-StNGH40U.js";import{r as t,t as n}from"./chunk-JQJVKLGR-wFyF2bUv.js";import"./mermaid.core-DYoDrSEJ.js";var r=n({defaultLayout:`swimlane`,styles:e(e=>`${t(e)}
-  .swimlane.cluster rect {
-    stroke: ${e.clusterBorder} !important;
-  }
-  [data-look="neo"].cluster rect {
-    filter: none;
-  }
-`,`getStyles`)});export{r as diagram};