@pikku/cli 0.12.125 → 0.12.127

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/cli",
-  "version": "0.12.125",
+  "version": "0.12.127",
   "description": "Pikku CLI — code generation, dev server, migrations and deployment",
   "author": "yasser.fadl@gmail.com",
   "license": "BUSL-1.1",
@@ -31,20 +31,20 @@
     "@jridgewell/trace-mapping": "^0.3.31",
     "@openapi-contrib/json-schema-to-openapi-schema": "^4.3.4",
     "@pikku/ai-vercel": "^0.12.13",
-    "@pikku/better-auth": "^0.12.32",
+    "@pikku/better-auth": "^0.12.34",
     "@pikku/bun-server": "^0.12.10",
     "@pikku/code-edit": "^0.12.1",
     "@pikku/deploy": "^0.12.2",
     "@pikku/deploy-cloudflare": "^0.12.13",
     "@pikku/fetch": "^0.12.10",
-    "@pikku/inspector": "^0.12.67",
+    "@pikku/inspector": "^0.12.69",
     "@pikku/knowledge": "^0.12.7",
     "@pikku/kysely": "^0.13.23",
     "@pikku/n8n-import": "^0.0.7",
     "@pikku/node-http-server": "^0.12.12",
     "@pikku/openapi-parser": "^0.12.20",
     "@pikku/schedule": "^0.12.7",
-    "@pikku/skills": "^0.12.19",
+    "@pikku/skills": "^0.12.21",
     "@types/cookie": "^1.0.0",
     "@types/json-schema": "^7.0.15",
     "ai": "^7.0.66",
@@ -67,15 +67,15 @@
     "zod-to-ts": "^2.1.0"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.98",
-    "@pikku/playwright": "^0.12.79",
+    "@pikku/core": "^0.12.100",
+    "@pikku/playwright": "^0.12.81",
     "@pikku/ws": "^0.12.9",
     "better-auth": "^1.6.0",
     "ws": "^8.21.3"
   },
   "devDependencies": {
-    "@pikku/core": "^0.12.98",
-    "@pikku/playwright": "^0.12.79",
+    "@pikku/core": "^0.12.100",
+    "@pikku/playwright": "^0.12.81",
     "@pikku/ws": "^0.12.9",
     "@playwright/test": "^1.50.0",
     "@types/istanbul-lib-instrument": "^1.7.8",

package/snippets.json

@@ -14,7 +14,7 @@
   "aiAgentStream": "// Streaming endpoint — sends text-delta, tool-call, and usage events as they arrive.\nwireHTTP({\n  method: 'post',\n  route: '/agents/shop/stream',\n  func: agentStream('shopAssistant'),\n  auth: true,\n})",
   "aiAgentStreamClient": "export async function agentStreamExamples() {\n  pikkuRPC.setServerUrl('http://localhost:4000')\n  pikkuRPC.setAuthorizationJWT('user-jwt-token')\n\n  const stream = await pikkuRPC.agent.stream('shopAssistant', {\n    message: 'Add the cheapest USB hub to my basket',\n    threadId: 'thread-123',\n    resourceId: 'user-456',\n  })\n  return stream\n}",
   "auditDispatch": "await audit?.audit({\n  type: 'order.created',\n  source: 'explicit',\n  occurredAt: new Date().toISOString(),\n  metadata: { orderId, userId },\n})",
-  "betterAuthConfig": "export const auth = pikkuBetterAuth(\n  async ({ kysely, secrets, variables, emailService }) => {\n    // `.reveal()` at the sink, not earlier: getSecret hands back a nominal\n    // SecretValue that no concretely-typed parameter accepts, so every disclosure\n    // is one greppable call. Better Auth wants the raw string, and this is where\n    // it stops being a secret in the type system.\n    const BETTER_AUTH_SECRET = (\n      await secrets.getSecret('BETTER_AUTH_SECRET')\n    ).reveal()\n    // Genuinely optional: unset simply disables /api/auth/sign-in/actor (scenarios\n    // off for this deployment) — the actor plugin refuses all sign-ins\n    // without it.\n    const SCENARIO_ACTOR_SECRET = await secrets\n      .getSecret('SCENARIO_ACTOR_SECRET')\n      .then((value) => value?.reveal())\n      .catch(() => undefined)\n    // Fabric operator admin: the RSA public key the control plane's token is\n    // verified against. The Fabric deployer pushes FABRIC_AUTH_PUBLIC_KEY onto\n    // every stage; locally it's simply absent, which disables /sign-in/fabric.\n    // Asymmetric — the app verifies, it can never forge an operator login.\n    const FABRIC_AUTH_PUBLIC_KEY = await variables.get('FABRIC_AUTH_PUBLIC_KEY')\n\n    return betterAuth({\n      secret: BETTER_AUTH_SECRET,\n      database: { db: kysely, type: 'sqlite' },\n      emailAndPassword: {\n        enabled: true,\n        // Without this, `requestPasswordReset` succeeds on the client and silently\n        // sends nothing — the \"Forgot password?\" flow looks wired and dead-ends.\n        // Better Auth builds `url` from its baseURL + the client's redirectTo, so\n        // the app only supplies the message. Errors are logged, never swallowed:\n        // a reset the user never receives must be visible in the logs.\n        sendResetPassword: async ({ user, url }) => {\n          await emailService.send({\n            to: user.email,\n            template: {\n              name: 'reset-password',\n              data: { email: user.email, resetUrl: url },\n            },\n          })\n        },\n      },\n      // Stateless session: CLI splits out betterAuthStatelessSession so non-auth\n      // units verify the signed cookie instead of bundling better-auth. pikku #737.\n      session: { cookieCache: { enabled: true } },\n      advanced: { database: { generateId: 'uuid' } },\n      // Scenario actors: synthetic users (user.actor = true, see\n      // db/sqlite/0002-user-actor.sql) signed in by pikkuScenario via\n      // POST /api/auth/sign-in/actor { email, secret }. Never signs in real users.\n      //\n      // ban(): adds the banned/banExpires/banReason columns (see\n      // db/sqlite/0003-admin.sql) and the session hook that refuses a banned\n      // user a session. better-auth's own admin() is refused by the inspector:\n      // it authorizes on a `user.role` column while pikku authorizes on scopes,\n      // and everything else it offered — list, create, ban, remove, revoke\n      // sessions, set password — is scoped RPCs in @pikku/addon-admin.\n      //\n      // fabric(): exposes /api/auth/sign-in/fabric — the Fabric control plane\n      // mints a short-lived RS256 token and signs in as a synthetic `fabric: true`\n      // admin operator (db/sqlite/0004-fabric.sql), so the console Users tab can\n      // list/impersonate real users without the operator being one of them. It\n      // verifies against FABRIC_AUTH_PUBLIC_KEY; a missing key disables the\n      // endpoint.\n      plugins: [\n        actor({ secret: SCENARIO_ACTOR_SECRET }),\n        ban(),\n        fabric({ publicKey: FABRIC_AUTH_PUBLIC_KEY }),\n      ],\n    })\n  }\n)",
+  "betterAuthConfig": "export const auth = pikkuBetterAuth(\n  async ({ kysely, secrets, variables, emailService }) => {\n    // `.reveal()` at the sink, not earlier: getSecret hands back a nominal\n    // SecretValue that no concretely-typed parameter accepts, so every disclosure\n    // is one greppable call. Better Auth wants the raw string, and this is where\n    // it stops being a secret in the type system.\n    const BETTER_AUTH_SECRET = (\n      await secrets.getSecret('BETTER_AUTH_SECRET')\n    ).reveal()\n    // Genuinely optional: unset simply disables /api/auth/sign-in/actor (scenarios\n    // off for this deployment) — the actor plugin refuses all sign-ins\n    // without it.\n    const SCENARIO_ACTOR_SECRET = await secrets\n      .getSecret('SCENARIO_ACTOR_SECRET')\n      .then((value) => value?.reveal())\n      .catch(() => undefined)\n    // Fabric operator admin: the RSA public key the control plane's token is\n    // verified against. The Fabric deployer pushes FABRIC_AUTH_PUBLIC_KEY onto\n    // every stage; locally it's simply absent, which disables /sign-in/fabric.\n    // Asymmetric — the app verifies, it can never forge an operator login.\n    const FABRIC_AUTH_PUBLIC_KEY = await variables.get('FABRIC_AUTH_PUBLIC_KEY')\n\n    return betterAuth({\n      secret: BETTER_AUTH_SECRET,\n      database: { db: kysely, type: 'sqlite' },\n      emailAndPassword: {\n        enabled: true,\n        // Without this, `requestPasswordReset` succeeds on the client and silently\n        // sends nothing — the \"Forgot password?\" flow looks wired and dead-ends.\n        // Better Auth builds `url` from its baseURL + the client's redirectTo, so\n        // the app only supplies the message. Errors are logged, never swallowed:\n        // a reset the user never receives must be visible in the logs.\n        sendResetPassword: async ({ user, url }) => {\n          await emailService.send({\n            to: user.email,\n            template: {\n              name: 'reset-password',\n              data: { email: user.email, resetUrl: url },\n            },\n          })\n        },\n      },\n      // Stateless session: CLI splits out betterAuthStatelessSession so non-auth\n      // units verify the signed cookie instead of bundling better-auth. pikku #737.\n      session: { cookieCache: { enabled: true } },\n      advanced: { database: { generateId: 'uuid' } },\n      // Scenario actors: synthetic users (user.actor = true, see\n      // db/sqlite/0002-user-actor.sql) signed in by pikkuScenario via\n      // POST /api/auth/sign-in/actor { email, secret }. Never signs in real users.\n      //\n      // pikkuBan(): adds the banned/banExpires/banReason columns (see\n      // db/sqlite/0003-admin.sql) and the session hook that refuses a banned\n      // user a session. better-auth's own admin() is refused by the inspector:\n      // it authorizes on a `user.role` column while pikku authorizes on scopes,\n      // and everything else it offered — list, create, ban, remove, revoke\n      // sessions, set password — is scoped RPCs in @pikku/addon-admin.\n      //\n      // pikkuFabric(): exposes /api/auth/sign-in/fabric — the Fabric control plane\n      // mints a short-lived RS256 token and signs in as a synthetic `fabric: true`\n      // admin operator (db/sqlite/0004-fabric.sql), so the console Users tab can\n      // list/impersonate real users without the operator being one of them. It\n      // verifies against FABRIC_AUTH_PUBLIC_KEY; a missing key disables the\n      // endpoint.\n      plugins: [\n        pikkuActor({ secret: SCENARIO_ACTOR_SECRET }),\n        pikkuBan(),\n        pikkuFabric({ publicKey: FABRIC_AUTH_PUBLIC_KEY }),\n      ],\n    })\n  }\n)",
   "cancelOrder": "export const cancelOrder = pikkuFunc({\n  expose: true,\n  description: 'Cancel a pending order and restore stock.',\n  input: CancelOrderInput,\n  // Authorization is declared, not written. `scopes` is what the role\n  // entitles the caller to and is AND-ed; `permissions` is what is true of\n  // this particular row and is OR-ed across keys. Both run before the body,\n  // so the function below only ever sees a caller who is allowed to be there.\n  //\n  // The `support` role holds `orders:cancel` without owning the order, so it\n  // passes on the scope; a customer passes on ownership. Neither case needs a\n  // branch in the body.\n  scopes: ['orders:cancel'],\n  permissions: {\n    owner: isOrderOwner,\n  },\n  // `node` describes this function as a step someone can drop into a visual\n  // flow: what to call it, where it files, and whether it starts a flow\n  // ('trigger'), continues one ('action') or ends it ('end'). Without it the\n  // function still works everywhere else — it just does not appear as a node.\n  node: {\n    displayName: 'Cancel Order',\n    category: 'Orders',\n    type: 'action',\n  },\n  func: async ({ kysely, queueService }, { orderId }, { session }) => {\n    const order = await kysely\n      .selectFrom('order')\n      .select(['orderId', 'userId', 'status'])\n      .where('orderId', '=', orderId)\n      .executeTakeFirst()\n\n    if (!order) throw new Error('Order not found')\n    if (!['pending', 'paid'].includes(order.status)) {\n      throw new Error(`Cannot cancel order in status: ${order.status}`)\n    }\n\n    // Restore stock\n    const items = await kysely\n      .selectFrom('orderItem')\n      .select(['itemId', 'quantity'])\n      .where('orderId', '=', orderId)\n      .execute()\n\n    const now = new Date().toISOString()\n    for (const item of items) {\n      await kysely\n        .updateTable('item')\n        .set((eb) => ({\n          stock: eb('stock', '+', item.quantity),\n          updatedAt: now,\n        }))\n        .where('itemId', '=', item.itemId)\n        .execute()\n    }\n\n    await kysely\n      .updateTable('order')\n      .set({ status: 'cancelled', updatedAt: now })\n      .where('orderId', '=', orderId)\n      .execute()\n\n    await queueService.add('audit-event', {\n      entityType: 'order',\n      entityId: orderId,\n      action: 'cancelled',\n      actorId: session.userId,\n    })\n  },\n})",
   "channelLifecycle": "export const onConnect = pikkuChannelConnectionFunc(\n  async ({ logger }, _, { channel }) => {\n    logger.info({ event: 'ws_connected', channelId: channel.channelId })\n  }\n)\n\nexport const onDisconnect = pikkuChannelDisconnectionFunc(\n  async ({ logger }, _, { channel }) => {\n    logger.info({ event: 'ws_disconnected', channelId: channel.channelId })\n  }\n)",
   "channelMiddleware": "export const traceAgentStream = pikkuChannelMiddleware<any, AgentStreamEvent>(\n  async ({ logger }, event, next) => {\n    logger.debug({ event: 'agent_stream', type: event.type })\n    await next(event)\n  }\n)",

package/surface.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.12.125",
+  "version": "0.12.127",
   "entryPoints": [
     {
       "id": "app",
@@ -2132,17 +2132,20 @@
                   "doc": "Hosts this secret may be sent to, e.g. `['api.notion.com']` or `'*.notion.com'`. Omitted means unrestricted unless `config.secrets.requireAllowedHosts` is set."
                 },
                 {
-                  "line": "description?: string"
+                  "line": "description?: string",
+                  "doc": "What this secret is for, shown beside the field someone has to fill in."
                 },
                 {
-                  "line": "displayName: string"
+                  "line": "displayName: string",
+                  "doc": "How the secret is labelled wherever a person is asked to supply it."
                 },
                 {
                   "line": "docsUrl?: string",
                   "doc": "Where a user goes to obtain this value, surfaced beside a missing one."
                 },
                 {
-                  "line": "name: string"
+                  "line": "name: string",
+                  "doc": "The key code reads it by: `secrets.getSecret('NAME')`. SCREAMING_SNAKE_CASE."
                 },
                 {
                   "line": "optional?: boolean",
@@ -2153,10 +2156,12 @@
                   "doc": "Rotation cadence as a duration string, e.g. `'1d'`, `'30day'`, `'1w'`."
                 },
                 {
-                  "line": "schema: T"
+                  "line": "schema: T",
+                  "doc": "The shape of the value, as a schema. This is what types `getSecret`'s result — pass the schema itself, not an instance of it."
                 },
                 {
-                  "line": "secretId: string"
+                  "line": "secretId: string",
+                  "doc": "The id under the backing store, which is where the value actually lives."
                 }
               ],
               "examples": [
@@ -2614,21 +2619,24 @@
               "docs": "What a gateway integration implements: parse an incoming event into a\nmessage, send one back, and open and close the connection.",
               "members": [
                 {
-                  "line": "close: () => Promise<void>"
+                  "line": "close: () => Promise<void>",
+                  "doc": "Called by GatewayService.stop(); release the connection init() opened."
                 },
                 {
                   "line": "init: (onMessage: (data: unknown) => Promise<void>) => Promise<void>",
                   "doc": "Called by GatewayService.start(); must call onMessage per incoming event."
                 },
                 {
-                  "line": "name: string"
+                  "line": "name: string",
+                  "doc": "Identifies the gateway in wirings and logs, e.g. `'slack'`."
                 },
                 {
                   "line": "parse: (data: unknown) => GatewayInboundMessage | null",
                   "doc": "Return null to ignore the event, e.g. a delivery receipt."
                 },
                 {
-                  "line": "send: (senderId: string, message: GatewayOutboundMessage) => Promise<void>"
+                  "line": "send: (senderId: string, message: GatewayOutboundMessage) => Promise<void>",
+                  "doc": "Deliver a reply back to the sender the message came from."
                 },
                 {
                   "line": "verifyWebhook?: ((data: unknown, request?: PikkuHTTPRequest) => WebhookVerificationResult | Promise<WebhookVerificationResult>)",
@@ -2647,20 +2655,24 @@
               "docs": "One message arriving from a gateway, normalised: who sent it, in which\nconversation, and what they said.",
               "members": [
                 {
-                  "line": "attachments?: GatewayAttachment[]"
+                  "line": "attachments?: GatewayAttachment[]",
+                  "doc": "Files and media that came with the message."
                 },
                 {
-                  "line": "metadata?: Record<string, unknown>"
+                  "line": "metadata?: Record<string, unknown>",
+                  "doc": "Anything else the adapter wants to carry through to the wiring."
                 },
                 {
-                  "line": "raw: unknown"
+                  "line": "raw: unknown",
+                  "doc": "The provider's own event, untouched, for anything this shape drops."
                 },
                 {
                   "line": "senderId: string",
                   "doc": "Platform-specific: a phone number, a Slack user id, and so on."
                 },
                 {
-                  "line": "text: string"
+                  "line": "text: string",
+                  "doc": "What they said, as plain text, with the provider's markup stripped."
                 }
               ]
             },
@@ -2675,13 +2687,16 @@
               "docs": "One message to send back through a gateway — plain text, or the provider's\nown rich content.",
               "members": [
                 {
-                  "line": "attachments?: GatewayAttachment[]"
+                  "line": "attachments?: GatewayAttachment[]",
+                  "doc": "Files and media to send alongside."
                 },
                 {
-                  "line": "richContent?: Record<string, unknown>"
+                  "line": "richContent?: Record<string, unknown>",
+                  "doc": "The provider's own rich payload, e.g. Slack blocks. Passed through as-is."
                 },
                 {
-                  "line": "text?: string"
+                  "line": "text?: string",
+                  "doc": "The reply as plain text. Every provider can render this."
                 }
               ]
             },
@@ -2778,7 +2793,8 @@
               "docs": "What a gateway's `verifyWebhook` returns — verified, with the response the\nprovider expects back, or not.",
               "members": [
                 {
-                  "line": "verified: boolean"
+                  "line": "verified: boolean",
+                  "doc": "True when the request really came from the provider. False when the signature or challenge did not check out."
                 }
               ]
             },
@@ -3343,7 +3359,7 @@
               "docs": "Builds this project's Better Auth instance. The factory is handed the\nsingleton services, with typed `secrets` and `variables`, and is called\nlazily so config and secrets are resolved before auth is constructed.",
               "signature": "<I extends BetterAuthInstance>(factory: (services: AuthSingletonServices) => I | Promise<I>) => PikkuBetterAuthFactory<I>",
               "examples": [
-                "export const auth = pikkuBetterAuth(\n  async ({ kysely, secrets, variables, emailService }) => {\n    // `.reveal()` at the sink, not earlier: getSecret hands back a nominal\n    // SecretValue that no concretely-typed parameter accepts, so every disclosure\n    // is one greppable call. Better Auth wants the raw string, and this is where\n    // it stops being a secret in the type system.\n    const BETTER_AUTH_SECRET = (\n      await secrets.getSecret('BETTER_AUTH_SECRET')\n    ).reveal()\n    // Genuinely optional: unset simply disables /api/auth/sign-in/actor (scenarios\n    // off for this deployment) — the actor plugin refuses all sign-ins\n    // without it.\n    const SCENARIO_ACTOR_SECRET = await secrets\n      .getSecret('SCENARIO_ACTOR_SECRET')\n      .then((value) => value?.reveal())\n      .catch(() => undefined)\n    // Fabric operator admin: the RSA public key the control plane's token is\n    // verified against. The Fabric deployer pushes FABRIC_AUTH_PUBLIC_KEY onto\n    // every stage; locally it's simply absent, which disables /sign-in/fabric.\n    // Asymmetric — the app verifies, it can never forge an operator login.\n    const FABRIC_AUTH_PUBLIC_KEY = await variables.get('FABRIC_AUTH_PUBLIC_KEY')\n\n    return betterAuth({\n      secret: BETTER_AUTH_SECRET,\n      database: { db: kysely, type: 'sqlite' },\n      emailAndPassword: {\n        enabled: true,\n        // Without this, `requestPasswordReset` succeeds on the client and silently\n        // sends nothing — the \"Forgot password?\" flow looks wired and dead-ends.\n        // Better Auth builds `url` from its baseURL + the client's redirectTo, so\n        // the app only supplies the message. Errors are logged, never swallowed:\n        // a reset the user never receives must be visible in the logs.\n        sendResetPassword: async ({ user, url }) => {\n          await emailService.send({\n            to: user.email,\n            template: {\n              name: 'reset-password',\n              data: { email: user.email, resetUrl: url },\n            },\n          })\n        },\n      },\n      // Stateless session: CLI splits out betterAuthStatelessSession so non-auth\n      // units verify the signed cookie instead of bundling better-auth. pikku #737.\n      session: { cookieCache: { enabled: true } },\n      advanced: { database: { generateId: 'uuid' } },\n      // Scenario actors: synthetic users (user.actor = true, see\n      // db/sqlite/0002-user-actor.sql) signed in by pikkuScenario via\n      // POST /api/auth/sign-in/actor { email, secret }. Never signs in real users.\n      //\n      // ban(): adds the banned/banExpires/banReason columns (see\n      // db/sqlite/0003-admin.sql) and the session hook that refuses a banned\n      // user a session. better-auth's own admin() is refused by the inspector:\n      // it authorizes on a `user.role` column while pikku authorizes on scopes,\n      // and everything else it offered — list, create, ban, remove, revoke\n      // sessions, set password — is scoped RPCs in @pikku/addon-admin.\n      //\n      // fabric(): exposes /api/auth/sign-in/fabric — the Fabric control plane\n      // mints a short-lived RS256 token and signs in as a synthetic `fabric: true`\n      // admin operator (db/sqlite/0004-fabric.sql), so the console Users tab can\n      // list/impersonate real users without the operator being one of them. It\n      // verifies against FABRIC_AUTH_PUBLIC_KEY; a missing key disables the\n      // endpoint.\n      plugins: [\n        actor({ secret: SCENARIO_ACTOR_SECRET }),\n        ban(),\n        fabric({ publicKey: FABRIC_AUTH_PUBLIC_KEY }),\n      ],\n    })\n  }\n)"
+                "export const auth = pikkuBetterAuth(\n  async ({ kysely, secrets, variables, emailService }) => {\n    // `.reveal()` at the sink, not earlier: getSecret hands back a nominal\n    // SecretValue that no concretely-typed parameter accepts, so every disclosure\n    // is one greppable call. Better Auth wants the raw string, and this is where\n    // it stops being a secret in the type system.\n    const BETTER_AUTH_SECRET = (\n      await secrets.getSecret('BETTER_AUTH_SECRET')\n    ).reveal()\n    // Genuinely optional: unset simply disables /api/auth/sign-in/actor (scenarios\n    // off for this deployment) — the actor plugin refuses all sign-ins\n    // without it.\n    const SCENARIO_ACTOR_SECRET = await secrets\n      .getSecret('SCENARIO_ACTOR_SECRET')\n      .then((value) => value?.reveal())\n      .catch(() => undefined)\n    // Fabric operator admin: the RSA public key the control plane's token is\n    // verified against. The Fabric deployer pushes FABRIC_AUTH_PUBLIC_KEY onto\n    // every stage; locally it's simply absent, which disables /sign-in/fabric.\n    // Asymmetric — the app verifies, it can never forge an operator login.\n    const FABRIC_AUTH_PUBLIC_KEY = await variables.get('FABRIC_AUTH_PUBLIC_KEY')\n\n    return betterAuth({\n      secret: BETTER_AUTH_SECRET,\n      database: { db: kysely, type: 'sqlite' },\n      emailAndPassword: {\n        enabled: true,\n        // Without this, `requestPasswordReset` succeeds on the client and silently\n        // sends nothing — the \"Forgot password?\" flow looks wired and dead-ends.\n        // Better Auth builds `url` from its baseURL + the client's redirectTo, so\n        // the app only supplies the message. Errors are logged, never swallowed:\n        // a reset the user never receives must be visible in the logs.\n        sendResetPassword: async ({ user, url }) => {\n          await emailService.send({\n            to: user.email,\n            template: {\n              name: 'reset-password',\n              data: { email: user.email, resetUrl: url },\n            },\n          })\n        },\n      },\n      // Stateless session: CLI splits out betterAuthStatelessSession so non-auth\n      // units verify the signed cookie instead of bundling better-auth. pikku #737.\n      session: { cookieCache: { enabled: true } },\n      advanced: { database: { generateId: 'uuid' } },\n      // Scenario actors: synthetic users (user.actor = true, see\n      // db/sqlite/0002-user-actor.sql) signed in by pikkuScenario via\n      // POST /api/auth/sign-in/actor { email, secret }. Never signs in real users.\n      //\n      // pikkuBan(): adds the banned/banExpires/banReason columns (see\n      // db/sqlite/0003-admin.sql) and the session hook that refuses a banned\n      // user a session. better-auth's own admin() is refused by the inspector:\n      // it authorizes on a `user.role` column while pikku authorizes on scopes,\n      // and everything else it offered — list, create, ban, remove, revoke\n      // sessions, set password — is scoped RPCs in @pikku/addon-admin.\n      //\n      // pikkuFabric(): exposes /api/auth/sign-in/fabric — the Fabric control plane\n      // mints a short-lived RS256 token and signs in as a synthetic `fabric: true`\n      // admin operator (db/sqlite/0004-fabric.sql), so the console Users tab can\n      // list/impersonate real users without the operator being one of them. It\n      // verifies against FABRIC_AUTH_PUBLIC_KEY; a missing key disables the\n      // endpoint.\n      plugins: [\n        pikkuActor({ secret: SCENARIO_ACTOR_SECRET }),\n        pikkuBan(),\n        pikkuFabric({ publicKey: FABRIC_AUTH_PUBLIC_KEY }),\n      ],\n    })\n  }\n)"
               ]
             },
             {
@@ -3598,19 +3614,24 @@
               "signature": "(config: Parameters<typeof corePikkuAgentJudge<Services>>[0]) => PikkuAgentScorer<Services>",
               "members": [
                 {
-                  "line": "description: string"
+                  "line": "description: string",
+                  "doc": "What this judge grades, in one line, for whoever reads the score later."
                 },
                 {
-                  "line": "goal: string"
+                  "line": "goal: string",
+                  "doc": "The rubric: what a good answer looks like, phrased as the goal it should meet."
                 },
                 {
-                  "line": "model: string"
+                  "line": "model: string",
+                  "doc": "The model that grades, e.g. `'claude-sonnet-4-5'`. Not the model under test."
                 },
                 {
-                  "line": "name: string"
+                  "line": "name: string",
+                  "doc": "Identifies the judge in results and in the Console. Unique per project."
                 },
                 {
-                  "line": "prompt?: ((input: ScorerInput) => string)"
+                  "line": "prompt?: ((input: ScorerInput) => string)",
+                  "doc": "Replaces the generated rubric prompt outright, for framing `goal` cannot express. The `{ score, reason }` response is still forced."
                 },
                 {
                   "line": "requiresReference?: boolean",
@@ -3640,10 +3661,12 @@
               "signature": "(config: Parameters<typeof corePikkuAgentScorer<Services>>[0]) => PikkuAgentScorer<Services>",
               "members": [
                 {
-                  "line": "description: string"
+                  "line": "description: string",
+                  "doc": "What this scorer grades, in one line, for whoever reads the score later."
                 },
                 {
-                  "line": "name: string"
+                  "line": "name: string",
+                  "doc": "Identifies the scorer in results and in the Console. Unique per project."
                 },
                 {
                   "line": "requiresReference?: boolean",
@@ -3654,7 +3677,8 @@
                   "doc": "0..1 fraction of live runs to grade. Defaults to all of them."
                 },
                 {
-                  "line": "score: (input: ScorerInput, services: Services) => ScorerOutput | Promise<ScorerOutput>"
+                  "line": "score: (input: ScorerInput, services: Services) => ScorerOutput | Promise<ScorerOutput>",
+                  "doc": "The grade itself: read the finished run and return `{ score, reason }`. Runs in-process, so it may use your own services."
                 }
               ],
               "examples": [
@@ -8578,17 +8602,20 @@
                   "doc": "Hosts this secret may be sent to, e.g. `['api.notion.com']` or `'*.notion.com'`. Omitted means unrestricted unless `config.secrets.requireAllowedHosts` is set."
                 },
                 {
-                  "line": "description?: string"
+                  "line": "description?: string",
+                  "doc": "What this secret is for, shown beside the field someone has to fill in."
                 },
                 {
-                  "line": "displayName: string"
+                  "line": "displayName: string",
+                  "doc": "How the secret is labelled wherever a person is asked to supply it."
                 },
                 {
                   "line": "docsUrl?: string",
                   "doc": "Where a user goes to obtain this value, surfaced beside a missing one."
                 },
                 {
-                  "line": "name: string"
+                  "line": "name: string",
+                  "doc": "The key code reads it by: `secrets.getSecret('NAME')`. SCREAMING_SNAKE_CASE."
                 },
                 {
                   "line": "optional?: boolean",
@@ -8599,10 +8626,12 @@
                   "doc": "Rotation cadence as a duration string, e.g. `'1d'`, `'30day'`, `'1w'`."
                 },
                 {
-                  "line": "schema: T"
+                  "line": "schema: T",
+                  "doc": "The shape of the value, as a schema. This is what types `getSecret`'s result — pass the schema itself, not an instance of it."
                 },
                 {
-                  "line": "secretId: string"
+                  "line": "secretId: string",
+                  "doc": "The id under the backing store, which is where the value actually lives."
                 }
               ],
               "examples": [
@@ -8689,17 +8718,20 @@
                   "doc": "Hosts this secret may be sent to, e.g. `['api.notion.com']` or `'*.notion.com'`. Omitted means unrestricted unless `config.secrets.requireAllowedHosts` is set."
                 },
                 {
-                  "line": "description?: string"
+                  "line": "description?: string",
+                  "doc": "What this secret is for, shown beside the field someone has to fill in."
                 },
                 {
-                  "line": "displayName: string"
+                  "line": "displayName: string",
+                  "doc": "How the secret is labelled wherever a person is asked to supply it."
                 },
                 {
                   "line": "docsUrl?: string",
                   "doc": "Where a user goes to obtain this value, surfaced beside a missing one."
                 },
                 {
-                  "line": "name: string"
+                  "line": "name: string",
+                  "doc": "The key code reads it by: `secrets.getSecret('NAME')`. SCREAMING_SNAKE_CASE."
                 },
                 {
                   "line": "optional?: boolean",
@@ -8710,10 +8742,12 @@
                   "doc": "Rotation cadence as a duration string, e.g. `'1d'`, `'30day'`, `'1w'`."
                 },
                 {
-                  "line": "schema: T"
+                  "line": "schema: T",
+                  "doc": "The shape of the value, as a schema. This is what types `getSecret`'s result — pass the schema itself, not an instance of it."
                 },
                 {
-                  "line": "secretId: string"
+                  "line": "secretId: string",
+                  "doc": "The id under the backing store, which is where the value actually lives."
                 }
               ],
               "examples": [
@@ -9805,19 +9839,24 @@
               "signature": "(config: Parameters<typeof corePikkuAgentJudge<Services>>[0]) => PikkuAgentScorer<Services>",
               "members": [
                 {
-                  "line": "description: string"
+                  "line": "description: string",
+                  "doc": "What this judge grades, in one line, for whoever reads the score later."
                 },
                 {
-                  "line": "goal: string"
+                  "line": "goal: string",
+                  "doc": "The rubric: what a good answer looks like, phrased as the goal it should meet."
                 },
                 {
-                  "line": "model: string"
+                  "line": "model: string",
+                  "doc": "The model that grades, e.g. `'claude-sonnet-4-5'`. Not the model under test."
                 },
                 {
-                  "line": "name: string"
+                  "line": "name: string",
+                  "doc": "Identifies the judge in results and in the Console. Unique per project."
                 },
                 {
-                  "line": "prompt?: ((input: ScorerInput) => string)"
+                  "line": "prompt?: ((input: ScorerInput) => string)",
+                  "doc": "Replaces the generated rubric prompt outright, for framing `goal` cannot express. The `{ score, reason }` response is still forced."
                 },
                 {
                   "line": "requiresReference?: boolean",
@@ -9847,10 +9886,12 @@
               "signature": "(config: Parameters<typeof corePikkuAgentScorer<Services>>[0]) => PikkuAgentScorer<Services>",
               "members": [
                 {
-                  "line": "description: string"
+                  "line": "description: string",
+                  "doc": "What this scorer grades, in one line, for whoever reads the score later."
                 },
                 {
-                  "line": "name: string"
+                  "line": "name: string",
+                  "doc": "Identifies the scorer in results and in the Console. Unique per project."
                 },
                 {
                   "line": "requiresReference?: boolean",
@@ -9861,7 +9902,8 @@
                   "doc": "0..1 fraction of live runs to grade. Defaults to all of them."
                 },
                 {
-                  "line": "score: (input: ScorerInput, services: Services) => ScorerOutput | Promise<ScorerOutput>"
+                  "line": "score: (input: ScorerInput, services: Services) => ScorerOutput | Promise<ScorerOutput>",
+                  "doc": "The grade itself: read the finished run and return `{ score, reason }`. Runs in-process, so it may use your own services."
                 }
               ],
               "examples": [
@@ -10053,19 +10095,24 @@
               "signature": "(config: Parameters<typeof corePikkuAgentJudge<Services>>[0]) => PikkuAgentScorer<Services>",
               "members": [
                 {
-                  "line": "description: string"
+                  "line": "description: string",
+                  "doc": "What this judge grades, in one line, for whoever reads the score later."
                 },
                 {
-                  "line": "goal: string"
+                  "line": "goal: string",
+                  "doc": "The rubric: what a good answer looks like, phrased as the goal it should meet."
                 },
                 {
-                  "line": "model: string"
+                  "line": "model: string",
+                  "doc": "The model that grades, e.g. `'claude-sonnet-4-5'`. Not the model under test."
                 },
                 {
-                  "line": "name: string"
+                  "line": "name: string",
+                  "doc": "Identifies the judge in results and in the Console. Unique per project."
                 },
                 {
-                  "line": "prompt?: ((input: ScorerInput) => string)"
+                  "line": "prompt?: ((input: ScorerInput) => string)",
+                  "doc": "Replaces the generated rubric prompt outright, for framing `goal` cannot express. The `{ score, reason }` response is still forced."
                 },
                 {
                   "line": "requiresReference?: boolean",
@@ -10096,10 +10143,12 @@
               "signature": "(config: Parameters<typeof corePikkuAgentScorer<Services>>[0]) => PikkuAgentScorer<Services>",
               "members": [
                 {
-                  "line": "description: string"
+                  "line": "description: string",
+                  "doc": "What this scorer grades, in one line, for whoever reads the score later."
                 },
                 {
-                  "line": "name: string"
+                  "line": "name: string",
+                  "doc": "Identifies the scorer in results and in the Console. Unique per project."
                 },
                 {
                   "line": "requiresReference?: boolean",
@@ -10110,7 +10159,8 @@
                   "doc": "0..1 fraction of live runs to grade. Defaults to all of them."
                 },
                 {
-                  "line": "score: (input: ScorerInput, services: Services) => ScorerOutput | Promise<ScorerOutput>"
+                  "line": "score: (input: ScorerInput, services: Services) => ScorerOutput | Promise<ScorerOutput>",
+                  "doc": "The grade itself: read the finished run and return `{ score, reason }`. Runs in-process, so it may use your own services."
                 }
               ],
               "examples": [

package/console-app/assets/architecture-TIHT7OUA-DmG0bXDT.js

@@ -1 +0,0 @@
-import"./chunk-KEIR6QF5-BICK3FdT.js";import{M as e}from"./mermaid-parser.core-b4yKyO56.js";export{e as createArchitectureServices};

package/console-app/assets/channel-BgCT5gon.js

@@ -1 +0,0 @@
-import{at as e,ot as t}from"./chunk-I66GZJ75-Cb2nDoa3.js";var n=(n,r)=>t.lang.round(e.parse(n)[r]);export{n as t};

package/console-app/assets/chunk-XXDRQBXY-EP2C9tTO.js

@@ -1 +0,0 @@
-import{p as e}from"./index-DMnbsgzs.js";import{n as t}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import"./src-DUC7tLWb.js";var n=t((t,n)=>{let r;return n===`sandbox`&&(r=e(`#i`+t)),e(n===`sandbox`?r.nodes()[0].contentDocument.body:`body`).select(`[id="${t}"]`)},`getDiagramElement`);export{n as t};

package/console-app/assets/classDiagram-JCYQIIEL-D9wGqB4J.js

@@ -1 +0,0 @@
-import{n as e}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import"./src-DUC7tLWb.js";import"./chunk-I66GZJ75-Cb2nDoa3.js";import"./chunk-NSK5VX7P-BO8vlGrO.js";import"./chunk-4I5QYGJK-Bep4akjR.js";import"./chunk-WRU74C26-DdS0mzXO.js";import"./chunk-7BUUIJ7U-Bb538aSH.js";import"./chunk-UBXNYLIW-BndMXU5r.js";import"./chunk-2GRJ4B5K-CwODIPP4.js";import"./chunk-XXDRQBXY-EP2C9tTO.js";import"./chunk-KBJHAD2P-DeP2Lqwp.js";import"./chunk-W5SLKNZC--VrZN8EC.js";import"./chunk-QR6OTTB3-sX5V0Lok.js";import"./chunk-7Z6QIM7H-D12vS1jX.js";import{i as t,n,r,t as i}from"./chunk-GF5L2VYU-kOLwTzIA.js";import"./mermaid.core-Cwfec1gr.js";var a={parser:n,get db(){return new i},renderer:r,styles:t,init:e(e=>{e.class||={},e.class.arrowMarkerAbsolute=e.arrowMarkerAbsolute},`init`)};export{a as diagram};

package/console-app/assets/classDiagram-v2-OCEON4UE-D9wGqB4J.js

@@ -1 +0,0 @@
-import{n as e}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import"./src-DUC7tLWb.js";import"./chunk-I66GZJ75-Cb2nDoa3.js";import"./chunk-NSK5VX7P-BO8vlGrO.js";import"./chunk-4I5QYGJK-Bep4akjR.js";import"./chunk-WRU74C26-DdS0mzXO.js";import"./chunk-7BUUIJ7U-Bb538aSH.js";import"./chunk-UBXNYLIW-BndMXU5r.js";import"./chunk-2GRJ4B5K-CwODIPP4.js";import"./chunk-XXDRQBXY-EP2C9tTO.js";import"./chunk-KBJHAD2P-DeP2Lqwp.js";import"./chunk-W5SLKNZC--VrZN8EC.js";import"./chunk-QR6OTTB3-sX5V0Lok.js";import"./chunk-7Z6QIM7H-D12vS1jX.js";import{i as t,n,r,t as i}from"./chunk-GF5L2VYU-kOLwTzIA.js";import"./mermaid.core-Cwfec1gr.js";var a={parser:n,get db(){return new i},renderer:r,styles:t,init:e(e=>{e.class||={},e.class.arrowMarkerAbsolute=e.arrowMarkerAbsolute},`init`)};export{a as diagram};

package/console-app/assets/eventmodeling-45OFAUF4-NKFCZ8Fj.js

@@ -1 +0,0 @@
-import"./chunk-KEIR6QF5-BICK3FdT.js";import{O as e}from"./mermaid-parser.core-b4yKyO56.js";export{e as createEventModelingServices};

package/console-app/assets/flowDiagram-UKHOOZJN-BpdPkmum.js

@@ -1 +0,0 @@
-import"./src-DUC7tLWb.js";import"./chunk-I66GZJ75-Cb2nDoa3.js";import"./chunk-NSK5VX7P-BO8vlGrO.js";import"./chunk-4I5QYGJK-Bep4akjR.js";import"./chunk-WRU74C26-DdS0mzXO.js";import"./chunk-7BUUIJ7U-Bb538aSH.js";import"./chunk-UBXNYLIW-BndMXU5r.js";import"./chunk-2GRJ4B5K-CwODIPP4.js";import"./chunk-XXDRQBXY-EP2C9tTO.js";import"./chunk-KBJHAD2P-DeP2Lqwp.js";import"./chunk-W5SLKNZC--VrZN8EC.js";import"./chunk-QR6OTTB3-sX5V0Lok.js";import"./chunk-7Z6QIM7H-D12vS1jX.js";import{n as e}from"./chunk-JQJVKLGR-B3a_ctfQ.js";import"./mermaid.core-Cwfec1gr.js";export{e as diagram};

package/console-app/assets/railroad-abnf-AHOZXSZD-B3CYVW4p.js

@@ -1 +0,0 @@
-import"./chunk-KEIR6QF5-BICK3FdT.js";import{m as e}from"./mermaid-parser.core-b4yKyO56.js";export{e as createRailroadAbnfServices};

package/console-app/assets/railroad-ebnf-EBAXGLYW-DrZ2yF62.js

@@ -1 +0,0 @@
-import"./chunk-KEIR6QF5-BICK3FdT.js";import{f as e}from"./mermaid-parser.core-b4yKyO56.js";export{e as createRailroadEbnfServices};

package/console-app/assets/railroad-peg-LSFZ7HO6-CWAmMyxd.js

@@ -1 +0,0 @@
-import"./chunk-KEIR6QF5-BICK3FdT.js";import{u as e}from"./mermaid-parser.core-b4yKyO56.js";export{e as createRailroadPegServices};

package/console-app/assets/stateDiagram-v2-UEYNNEHI-Celbgz4u.js

@@ -1 +0,0 @@
-import{n as e}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import"./src-DUC7tLWb.js";import"./chunk-I66GZJ75-Cb2nDoa3.js";import"./chunk-NSK5VX7P-BO8vlGrO.js";import"./chunk-4I5QYGJK-Bep4akjR.js";import"./chunk-WRU74C26-DdS0mzXO.js";import"./chunk-7BUUIJ7U-Bb538aSH.js";import"./chunk-UBXNYLIW-BndMXU5r.js";import"./chunk-2GRJ4B5K-CwODIPP4.js";import"./chunk-XXDRQBXY-EP2C9tTO.js";import"./chunk-KBJHAD2P-DeP2Lqwp.js";import"./chunk-W5SLKNZC--VrZN8EC.js";import"./chunk-QR6OTTB3-sX5V0Lok.js";import"./chunk-7Z6QIM7H-D12vS1jX.js";import{i as t,n,r,t as i}from"./chunk-5RXB4S5H-CGyCRU9L.js";import"./mermaid.core-Cwfec1gr.js";var a={parser:n,get db(){return new i(2)},renderer:r,styles:t,init:e(e=>{e.state||={},e.state.arrowMarkerAbsolute=e.arrowMarkerAbsolute},`init`)};export{a as diagram};

package/console-app/assets/swimlanesDiagram-ULZ7WXOC-zxpNaB4U.js

@@ -1,8 +0,0 @@
-import{n as e}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import"./src-DUC7tLWb.js";import"./chunk-I66GZJ75-Cb2nDoa3.js";import"./chunk-NSK5VX7P-BO8vlGrO.js";import"./chunk-4I5QYGJK-Bep4akjR.js";import"./chunk-WRU74C26-DdS0mzXO.js";import"./chunk-7BUUIJ7U-Bb538aSH.js";import"./chunk-UBXNYLIW-BndMXU5r.js";import"./chunk-2GRJ4B5K-CwODIPP4.js";import"./chunk-XXDRQBXY-EP2C9tTO.js";import"./chunk-KBJHAD2P-DeP2Lqwp.js";import"./chunk-W5SLKNZC--VrZN8EC.js";import"./chunk-QR6OTTB3-sX5V0Lok.js";import"./chunk-7Z6QIM7H-D12vS1jX.js";import{r as t,t as n}from"./chunk-JQJVKLGR-B3a_ctfQ.js";import"./mermaid.core-Cwfec1gr.js";var r=n({defaultLayout:`swimlane`,styles:e(e=>`${t(e)}
-  .swimlane.cluster rect {
-    stroke: ${e.clusterBorder} !important;
-  }
-  [data-look="neo"].cluster rect {
-    filter: none;
-  }
-`,`getStyles`)});export{r as diagram};