@pikku/cli 0.12.126 → 0.12.128

package/dist/src/functions/commands/persona.js

@@ -4,6 +4,7 @@ import { pikkuSessionlessFunc } from '#pikku/function';
 import { createHttpPersonas, deriveActorSecret, personaEnvironmentRefusal, roleMismatchMessage, verifyPersonaRoles, } from '@pikku/core/persona';
 import { personaVirtualUserTarget, runVirtualUser, catalogueClassification, DISPOSITIONS, prepareVirtualUserRun, } from '@pikku/core/virtual-user';
 import { getSingletonServices, setSingletonServices } from '@pikku/core/state';
+import { PikkuError } from '@pikku/core/errors';
 import { resolvePersonas } from '../../utils/resolve-personas.js';
 import { ACTOR_SECRET_VARIABLE, PERSONA_SECRETS_VARIABLE, resolvePersonaCredentials, } from '../../utils/persona-credentials.js';
 import { resolveEnvironment } from './environment.js';
@@ -108,13 +109,14 @@ export const personaRun = pikkuSessionlessFunc({
             agentsMeta: state.agents?.agentsMeta ?? {},
         });
         if (catalogue.length === 0) {
-            throw new Error('This project exposes no RPCs, so there is nothing for a virtual user to do.');
+            throw new PikkuError('This project exposes no RPCs, so there is nothing for a virtual user to do.');
         }
         const signedIn = createHttpPersonas({
             apiUrl: env.apiUrl,
             ...credentials,
             personas,
             signInPath: env.signInPath,
+            sessionPath: env.sessionPath,
             rpcPath: env.rpcPath,
             model: resolvedModel,
         });
@@ -131,7 +133,10 @@ export const personaRun = pikkuSessionlessFunc({
             else {
                 const message = roleMismatchMessage(verifyPersonaRoles(personaId, persona.roles, actual));
                 if (message) {
-                    throw new Error(message);
+                    // A refusal, not a crash: `PikkuError` is what tells the CLI to print
+                    // the message on its own, since the seed drift it names is the whole
+                    // finding and the frames underneath it are noise.
+                    throw new PikkuError(message);
                 }
             }
         }

package/dist/src/functions/commands/scenario.js

@@ -176,6 +176,7 @@ export const scenarioRun = pikkuSessionlessFunc({
             ...credentials,
             personas: scenarioActors,
             signInPath: env.signInPath,
+            sessionPath: env.sessionPath,
             rpcPath: env.rpcPath,
             model: config.scenarios?.model,
         });

package/dist/src/functions/validate/auth-plugin-checks.d.ts

@@ -10,7 +10,7 @@ export type AuthPluginCheckConfig = {
  * running two authorization models and projecting one onto the other. The
  * inspector refuses it outright at prebuild; this reports the same thing
  * without one, and additionally catches the quieter half of the migration, an
- * app that dropped `admin()` and never wired `ban()`, which keeps its ban
+ * app that dropped `admin()` and never wired `pikkuBan()`, which keeps its ban
  * columns and its ban UI while silently enforcing nothing.
  */
 export declare const runAuthPluginChecks: (root: string, config: AuthPluginCheckConfig | null) => Promise<ValidateFinding[]>;

package/dist/src/functions/validate/auth-plugin-checks.js

@@ -113,7 +113,7 @@ const configuresPlugin = (text, module, exported) => {
  * running two authorization models and projecting one onto the other. The
  * inspector refuses it outright at prebuild; this reports the same thing
  * without one, and additionally catches the quieter half of the migration, an
- * app that dropped `admin()` and never wired `ban()`, which keeps its ban
+ * app that dropped `admin()` and never wired `pikkuBan()`, which keeps its ban
  * columns and its ban UI while silently enforcing nothing.
  */
 export const runAuthPluginChecks = async (root, config) => {
@@ -131,7 +131,11 @@ export const runAuthPluginChecks = async (root, config) => {
             continue;
         if (configuresPlugin(text, 'better-auth/plugins', 'admin'))
             adminFiles.push(file);
-        if (configuresPlugin(text, '@pikku/better-auth', 'ban'))
+        // `pikkuBan` is the export. `ban` was its alias until it was removed, and
+        // an app written against an older version still configures exactly the same
+        // plugin under that name, so it must satisfy the check too.
+        if (configuresPlugin(text, '@pikku/better-auth', 'pikkuBan') ||
+            configuresPlugin(text, '@pikku/better-auth', 'ban'))
             bansAnywhere = true;
     }
     for (const file of adminFiles) {
@@ -140,7 +144,7 @@ export const runAuthPluginChecks = async (root, config) => {
             severity: 'error',
             message: "better-auth's admin() plugin is not supported — it authorizes against a user.role column while pikku authorizes on scopes, so one has to be projected onto the other",
             path: file,
-            fixHint: lines('Replace it with ban(), which keeps the one capability admin() had that', 'pikku cannot supply from outside better-auth — refusing a banned user a', 'session:', "  import { ban } from '@pikku/better-auth'", '  betterAuth({ plugins: [ban()] })', 'User management is already scoped RPCs in @pikku/addon-admin: list,', 'create, ban, remove, revoke sessions and set password.'),
+            fixHint: lines('Replace it with pikkuBan(), which keeps the one capability admin() had', 'that pikku cannot supply from outside better-auth — refusing a banned', 'user a session:', "  import { pikkuBan } from '@pikku/better-auth'", '  betterAuth({ plugins: [pikkuBan()] })', 'User management is already scoped RPCs in @pikku/addon-admin: list,', 'create, ban, remove, revoke sessions and set password.'),
         });
     }
     if (!bansAnywhere && adminFiles.length === 0) {
@@ -153,9 +157,9 @@ export const runAuthPluginChecks = async (root, config) => {
                 findings.push({
                     id: 'better-auth-no-ban-plugin',
                     severity: 'warn',
-                    message: 'better-auth is configured without ban() — the banned/banReason/banExpires columns do not exist, so banning a user through @pikku/addon-admin has nothing to write and nothing refuses their next sign-in',
+                    message: 'better-auth is configured without pikkuBan() — the banned/banReason/banExpires columns do not exist, so banning a user through @pikku/addon-admin has nothing to write and nothing refuses their next sign-in',
                     path: file,
-                    fixHint: lines("  import { ban } from '@pikku/better-auth'", '  betterAuth({ plugins: [ban()] })', 'Wire it wherever the rest of your plugins are, then run', '`pikku db migrate` to add the columns.'),
+                    fixHint: lines("  import { pikkuBan } from '@pikku/better-auth'", '  betterAuth({ plugins: [pikkuBan()] })', 'Wire it wherever the rest of your plugins are, then run', '`pikku db migrate` to add the columns.'),
                 });
                 break;
             }

package/dist/src/functions/validate/persona-checks.js

@@ -81,17 +81,20 @@ const countPersonas = async (root, config, sourceFiles) => {
 /**
  * Whether a persona can actually sign in.
  *
- * Two shapes count. `actor()` from `@pikku/better-auth` is the one the scaffold
- * wires, and a hand-rolled `/sign-in/actor` route is the one a project that does
- * not use better-auth ends up with. Both terminate at the same endpoint, so
- * either satisfies the check.
+ * Two shapes count. `pikkuActor()` from `@pikku/better-auth` is the one the
+ * scaffold wires, and a hand-rolled `/sign-in/actor` route is the one a project
+ * that does not use better-auth ends up with. Both terminate at the same
+ * endpoint, so either satisfies the check. The deprecated `actor()` alias is
+ * matched too — an app on an older version wires the same plugin under that
+ * name, which was removed from the library.
  */
 const hasActorSignIn = async (sourceFiles) => {
     for (const file of sourceFiles) {
         const text = await readTextSafe(file);
         if (!text)
             continue;
-        const wiresPlugin = /@pikku\/better-auth/.test(text) && /\bactor\s*\(/.test(text);
+        const wiresPlugin = /@pikku\/better-auth/.test(text) &&
+            /(^|[^\w$.])(pikkuActor|actor)\s*\(/.test(text);
         if (wiresPlugin || /sign-in\/actor/.test(text))
             return true;
     }
@@ -123,7 +126,7 @@ export const runPersonaChecks = async (root, config) => {
         return findings;
     }
     if (!(await hasActorSignIn(sourceFiles))) {
-        w('personas-no-actor-sign-in', `${personas} persona${personas === 1 ? ' is' : 's are'} declared, but nothing wires actor sign-in — a scenario run signs in over POST /auth/sign-in/actor, so every persona fails to acquire a session`, pikkuConfigPath, lines('Wire the actor plugin where better-auth is configured:', "  import { actor } from '@pikku/better-auth'", '  plugins: [actor({ secret: SCENARIO_ACTOR_SECRET })]', '`pikku dev` turns the endpoint on and mints the secret itself, so there', 'is nothing to configure locally. A deployed stage that must run', 'scenarios opts in with', 'PIKKU_ALLOW_ACTOR_SIGN_IN=passwordless-actor-sign-in; everywhere else', 'the endpoint stays off whatever the environment happens to contain.'));
+        w('personas-no-actor-sign-in', `${personas} persona${personas === 1 ? ' is' : 's are'} declared, but nothing wires actor sign-in — a scenario run signs in over POST /auth/sign-in/actor, so every persona fails to acquire a session`, pikkuConfigPath, lines('Wire the actor plugin where better-auth is configured:', "  import { pikkuActor } from '@pikku/better-auth'", '  plugins: [pikkuActor({ secret: SCENARIO_ACTOR_SECRET })]', '`pikku dev` turns the endpoint on and mints the secret itself, so there', 'is nothing to configure locally. A deployed stage that must run', 'scenarios opts in with', 'PIKKU_ALLOW_ACTOR_SIGN_IN=passwordless-actor-sign-in; everywhere else', 'the endpoint stays off whatever the environment happens to contain.'));
     }
     const environments = config?.environments;
     const hasEnvironment = typeof environments === 'object' &&

package/dist/src/functions/wirings/user-admin/pikku-command-user-admin-functions.js

@@ -28,12 +28,17 @@ export const pikkuUserAdminFunctions = pikkuSessionlessFunc({
         // Ban is the one capability with a schema requirement of its own, and it is
         // only one of the six — a warning rather than a failure, so an app that
         // never bans anyone is not forced to carry the columns.
-        if (!definition.plugins.includes('ban')) {
-            logger.warn(`"scaffold.userAdmin" is enabled but better-auth is configured without the ban() plugin, ` +
+        // The plugin ids here are the callee names read off the `plugins: [...]`
+        // array, so both the current `pikkuBan()` and the deprecated `ban()` alias
+        // have to count as wired.
+        const bansUsers = definition.plugins.includes('pikkuBan') ||
+            definition.plugins.includes('ban');
+        if (!bansUsers) {
+            logger.warn(`"scaffold.userAdmin" is enabled but better-auth is configured without the pikkuBan() plugin, ` +
                 `so the banned/banReason/banExpires columns do not exist and setUserBanned will fail.\n` +
-                `Fix: add ban() to the plugins array in ${definition.sourceFile}:\n` +
-                `  import { ban } from '@pikku/better-auth'\n` +
-                `  betterAuth({ plugins: [ban()] })`);
+                `Fix: add pikkuBan() to the plugins array in ${definition.sourceFile}:\n` +
+                `  import { pikkuBan } from '@pikku/better-auth'\n` +
+                `  betterAuth({ plugins: [pikkuBan()] })`);
         }
         const leaf = (name) => getLeafImportPath(config.userAdminFunctionsFile, name, config);
         const { schemas, functions } = serializeUserAdminFunctions(leaf);

package/dist/src/functions/wirings/user-admin/serialize-user-admin-functions.d.ts

@@ -13,7 +13,7 @@ export interface UserAdminGenOutput {
  * codegen on conflicting declarations.
  *
  * Each function is gated on its own `admin:users:*` scope, and works through
- * better-auth's internal adapter. Banning additionally needs the `ban()` plugin
+ * better-auth's internal adapter. Banning additionally needs the `pikkuBan()` plugin
  * from `@pikku/better-auth` for the columns it writes to exist.
  *
  * Emitted as two files. The schemas are zod, and the inspector reads a zod

package/dist/src/functions/wirings/user-admin/serialize-user-admin-functions.js

@@ -9,7 +9,7 @@
  * codegen on conflicting declarations.
  *
  * Each function is gated on its own `admin:users:*` scope, and works through
- * better-auth's internal adapter. Banning additionally needs the `ban()` plugin
+ * better-auth's internal adapter. Banning additionally needs the `pikkuBan()` plugin
  * from `@pikku/better-auth` for the columns it writes to exist.
  *
  * Emitted as two files. The schemas are zod, and the inspector reads a zod
@@ -27,7 +27,7 @@ import { z } from 'zod'
 
 /**
  * A user, as the directory sees one. Ban state is optional because those
- * columns belong to the \`ban()\` plugin: a host without it reports no ban state
+ * columns belong to the \`pikkuBan()\` plugin: a host without it reports no ban state
  * at all, which a client can render as "unknown" rather than as a misleading
  * "not banned".
  */
@@ -224,7 +224,7 @@ export const pikkuAdminSetUserBanned = pikkuFunc({
   tags: ['pikku'],
   title: 'Ban or Unban User',
   description:
-    'Bans a user — revoking their sessions and blocking sign-in — or lifts an existing ban. An expiry lets the ban lapse on its own; without one it holds until it is lifted. Requires better-auth wired with the \`ban()\` plugin.',
+    'Bans a user — revoking their sessions and blocking sign-in — or lifts an existing ban. An expiry lets the ban lapse on its own; without one it holds until it is lifted. Requires better-auth wired with the \`pikkuBan()\` plugin.',
   expose: true,
   scopes: ['admin:users:ban'],
   input: SetUserBannedInput,

package/dist/src/services.js

@@ -71,12 +71,21 @@ export const defaultCLIRenderer = pikkuCLIRender((_services, data) => {
  * `skills install` writes agent skills into a repo that has no pikku.config.json
  * yet — that is the whole point of it — so it cannot require one to start, and
  * `doc` answers from the surface shipped inside the CLI rather than the project.
+ * `fabric report` files a finding about pikku itself: a scaffold that never
+ * produced a config, or a command run from the wrong directory, is exactly the
+ * kind of thing worth reporting, so demanding a config would refuse the finding
+ * at the moment it is most worth having.
  */
 const CONFIG_FREE_COMMANDS = new Set([
     'skills',
     'skills.list',
     'skills.install',
     'doc',
+    'fabric.report',
+    'fabric.findings',
+    'fabric.findings.list',
+    'fabric.findings.flush',
+    'fabric.findings.clear',
 ]);
 export const createConfig = async (_variablesService, data, commandPath = []) => {
     // Determine log level based on CLI flags with precedence:

package/dist/src/utils/persona-credentials.d.ts

@@ -14,8 +14,6 @@ export declare const ACTOR_SECRET_VARIABLE = "SCENARIO_ACTOR_SECRET";
  * list is the whole of what this run can be.
  */
 export declare const PERSONA_SECRETS_VARIABLE = "PIKKU_PERSONA_SECRETS";
-/** Opt in to creating persona accounts the target does not already have. */
-export declare const CREATE_MISSING_VARIABLE = "PIKKU_PERSONA_CREATE_MISSING";
 export type PersonaCredentials = Pick<HttpPersonasConfig, 'secret' | 'operator'>;
 /**
  * `id=secret,id=secret` into a lookup. A value containing `=` is kept whole —

package/dist/src/utils/persona-credentials.js

@@ -12,8 +12,6 @@ export const ACTOR_SECRET_VARIABLE = 'SCENARIO_ACTOR_SECRET';
  * list is the whole of what this run can be.
  */
 export const PERSONA_SECRETS_VARIABLE = 'PIKKU_PERSONA_SECRETS';
-/** Opt in to creating persona accounts the target does not already have. */
-export const CREATE_MISSING_VARIABLE = 'PIKKU_PERSONA_CREATE_MISSING';
 /**
  * `id=secret,id=secret` into a lookup. A value containing `=` is kept whole —
  * base64url never produces one, but a hand-written credential might.
@@ -65,12 +63,7 @@ export const personaSecretResolver = (secrets) => {
 export const resolvePersonaCredentials = async (variables, what) => {
     const token = await variables.get(OPERATOR_TOKEN_VARIABLE);
     if (token) {
-        // `variables.get` JSON-parses, so `PIKKU_PERSONA_CREATE_MISSING=true`
-        // arrives as the boolean `true` and never equalled the string. The
-        // operator token survives the same parse only because a JWT is not
-        // valid JSON.
-        const createMissing = String(await variables.get(CREATE_MISSING_VARIABLE)) === 'true';
-        return { operator: { token, createMissing } };
+        return { operator: { token } };
     }
     const personaSecrets = await variables.get(PERSONA_SECRETS_VARIABLE);
     if (personaSecrets) {

package/dist/tsconfig.tsbuildinfo

@@ -1 +1 @@
-{"root":["../bin/pikku.ts","../src/cli.wiring.ts","../src/services.ts","../src/deploy/build-pipeline.ts","../src/deploy/frontend-assets.ts","../src/deploy/server-entry.ts","../src/deploy/analyzer/analyzer.ts","../src/deploy/analyzer/index.ts","../src/deploy/bundler/bun-bundler.ts","../src/deploy/bundler/bundler.interface.ts","../src/deploy/bundler/bundler.ts","../src/deploy/bundler/dep-extractor.ts","../src/deploy/bundler/index.ts","../src/deploy/bundler/node-bundler.ts","../src/deploy/bundler/service-module-map.ts","../src/deploy/bundler/types.ts","../src/deploy/codegen/index.ts","../src/deploy/codegen/per-unit-codegen.ts","../src/deploy/plan/executor.ts","../src/deploy/plan/formatter.ts","../src/deploy/plan/index.ts","../src/deploy/plan/planner.ts","../src/deploy/plan/provider.ts","../src/deploy/plan/types.ts","../src/fabric/fabric-commands.ts","../src/fabric/functions/add.function.ts","../src/fabric/functions/addon-verify.function.ts","../src/fabric/functions/db-schema.function.ts","../src/fabric/functions/deploy-list.function.ts","../src/fabric/functions/deploy-units.function.ts","../src/fabric/functions/deploy.function.ts","../src/fabric/functions/domains-add.function.ts","../src/fabric/functions/domains-list.function.ts","../src/fabric/functions/domains-remove.function.ts","../src/fabric/functions/errors.function.ts","../src/fabric/functions/init.function.ts","../src/fabric/functions/link.function.ts","../src/fabric/functions/llm-key.function.ts","../src/fabric/functions/login.function.ts","../src/fabric/functions/logs.function.ts","../src/fabric/functions/metrics.function.ts","../src/fabric/functions/projects-list.function.ts","../src/fabric/functions/publish.function.ts","../src/fabric/functions/rollback.function.ts","../src/fabric/functions/secrets-list.function.ts","../src/fabric/functions/secrets-rotate.function.ts","../src/fabric/functions/secrets-set.function.ts","../src/fabric/functions/smoke.function.ts","../src/fabric/functions/status.function.ts","../src/fabric/functions/trace.function.ts","../src/fabric/functions/validate.function.ts","../src/fabric/functions/variables-get.function.ts","../src/fabric/functions/variables-set.function.ts","../src/fabric/lib/blank-comments.ts","../src/fabric/lib/blank-scenario-meta.ts","../src/fabric/lib/config.ts","../src/fabric/lib/console-url.ts","../src/fabric/lib/deployment.ts","../src/fabric/lib/frontend-typecheck.ts","../src/fabric/lib/git.ts","../src/fabric/lib/http.ts","../src/fabric/lib/not-implemented.ts","../src/fabric/lib/output.ts","../src/fabric/lib/prompt.ts","../src/fabric/lib/sealed-box.ts","../src/fabric/lib/stage.ts","../src/fabric/lib/variable-value.ts","../src/fabric/sdk/http-map.gen.d.ts","../src/fabric/sdk/pikku-fetch.gen.ts","../src/fabric/sdk/pikku-rpc.gen.ts","../src/fabric/sdk/rpc-map.gen.d.ts","../src/functions/commands/all.ts","../src/functions/commands/audit.ts","../src/functions/commands/binary.ts","../src/functions/commands/bootstrap.ts","../src/functions/commands/bun-coverage-loader.ts","../src/functions/commands/db-audit.ts","../src/functions/commands/db-baseline.ts","../src/functions/commands/db-check.ts","../src/functions/commands/db-codegen.ts","../src/functions/commands/db-export.ts","../src/functions/commands/db-generate.ts","../src/functions/commands/db-migrate.ts","../src/functions/commands/db-reset.ts","../src/functions/commands/db-shared.ts","../src/functions/commands/deploy-apply.ts","../src/functions/commands/deploy-info.ts","../src/functions/commands/deploy-plan.ts","../src/functions/commands/dev-agent-runner.ts","../src/functions/commands/dev.ts","../src/functions/commands/doc.ts","../src/functions/commands/emails-init.ts","../src/functions/commands/enable.ts","../src/functions/commands/environment.ts","../src/functions/commands/import-n8n.ts","../src/functions/commands/info.ts","../src/functions/commands/knowledge-index.ts","../src/functions/commands/knowledge-validate.ts","../src/functions/commands/load-user-project.ts","../src/functions/commands/login.ts","../src/functions/commands/meta.ts","../src/functions/commands/new-addon.ts","../src/functions/commands/new-function.ts","../src/functions/commands/new-middleware.ts","../src/functions/commands/new-permission.ts","../src/functions/commands/new-wiring.ts","../src/functions/commands/persona-sync.ts","../src/functions/commands/persona.ts","../src/functions/commands/pikku-command-bootstrap.ts","../src/functions/commands/pikku-command-summary.ts","../src/functions/commands/roles-audit.ts","../src/functions/commands/roles-prune.ts","../src/functions/commands/roles-shared.ts","../src/functions/commands/scenario-browser.ts","../src/functions/commands/scenario-formatter.ts","../src/functions/commands/scenario-ladder.ts","../src/functions/commands/scenario-plan.ts","../src/functions/commands/scenario.ts","../src/functions/commands/scopes-audit.ts","../src/functions/commands/scopes-prune.ts","../src/functions/commands/scopes-shared.ts","../src/functions/commands/semver-render.ts","../src/functions/commands/semver.ts","../src/functions/commands/serve-console.ts","../src/functions/commands/serve-frontend.ts","../src/functions/commands/serve.ts","../src/functions/commands/skills.ts","../src/functions/commands/start-coverage.ts","../src/functions/commands/update-render.ts","../src/functions/commands/update.ts","../src/functions/commands/validate.ts","../src/functions/commands/versions-check.ts","../src/functions/commands/versions-init.ts","../src/functions/commands/versions-update.ts","../src/functions/commands/virtual-user-formatter.ts","../src/functions/commands/watch.ts","../src/functions/db/annotation-parser.ts","../src/functions/db/better-auth-schema.ts","../src/functions/db/check-enums.ts","../src/functions/db/db-codegen.ts","../src/functions/db/db-introspector.ts","../src/functions/db/db-migrator.ts","../src/functions/db/local-db.ts","../src/functions/db/migration-identifiers.ts","../src/functions/db/migration-provenance.ts","../src/functions/db/schema-sql.ts","../src/functions/db/zod-codegen.ts","../src/functions/db/postgres/pglite-kysely.ts","../src/functions/db/postgres/postgres-introspector.ts","../src/functions/db/postgres/postgres-migrator.ts","../src/functions/db/sqlite/dev-seed.ts","../src/functions/db/sqlite/sqlite-introspector.ts","../src/functions/db/sqlite/sqlite-kysely.ts","../src/functions/db/sqlite/sqlite-migrator.ts","../src/functions/db/sqlite/sqlite-runtime-bun.ts","../src/functions/db/sqlite/sqlite-runtime-node.ts","../src/functions/db/sqlite/sqlite-runtime.ts","../src/functions/knowledge/render.ts","../src/functions/knowledge/schemas.ts","../src/functions/runtimes/fetch/index.ts","../src/functions/runtimes/nextjs/pikku-command-nextjs.ts","../src/functions/runtimes/nextjs/serialize-nextjs-backend-worker-rpc-wrapper.ts","../src/functions/runtimes/nextjs/serialize-nextjs-backend-wrapper.ts","../src/functions/runtimes/nextjs/serialize-nextjs-http-wrapper.ts","../src/functions/runtimes/tanstack-start/pikku-command-tanstack-start.ts","../src/functions/runtimes/tanstack-start/serialize-tanstack-start-shim.ts","../src/functions/runtimes/websocket/pikku-command-websocket-typed.ts","../src/functions/runtimes/websocket/serialize-websocket-wrapper.ts","../src/functions/surface/build-surface-doc.ts","../src/functions/surface/collect-snippets.ts","../src/functions/surface/collect-surface-usage.ts","../src/functions/surface/collect-surface.ts","../src/functions/surface/generate-surface-doc.ts","../src/functions/surface/render-surface-doc.ts","../src/functions/surface/shipped-surface-doc.ts","../src/functions/surface/surface-doc.types.ts","../src/functions/surface/surface-editorial.ts","../src/functions/surface/write-surface-usage.ts","../src/functions/validate/addon-package-checks.ts","../src/functions/validate/auth-plugin-checks.ts","../src/functions/validate/bootstrap-checks.ts","../src/functions/validate/persona-checks.ts","../src/functions/validate/pikku-barrel-checks.ts","../src/functions/validate/scenario-file-checks.ts","../src/functions/validate/shared-checks.ts","../src/functions/validate/type-identity-checks.ts","../src/functions/validate/validate-registry.ts","../src/functions/validate/validate.ts","../src/functions/validate/websocket-deps-checks.ts","../src/functions/validate/workspace-exports-checks.ts","../src/functions/wirings/agent/pikku-command-agent-types.ts","../src/functions/wirings/agent/pikku-command-agent.ts","../src/functions/wirings/agent/pikku-command-public-agent.ts","../src/functions/wirings/agent/serialize-agent-map.ts","../src/functions/wirings/agent/serialize-agent-types.ts","../src/functions/wirings/agent/serialize-model-aliases.ts","../src/functions/wirings/agent/serialize-public-agent.ts","../src/functions/wirings/agent-scorer/pikku-command-agent-scorer.ts","../src/functions/wirings/agent-scorer/serialize-scorer-names.ts","../src/functions/wirings/auth/pikku-command-auth.ts","../src/functions/wirings/auth/serialize-auth-gen.ts","../src/functions/wirings/auth/serialize-auth-guards.ts","../src/functions/wirings/auth/serialize-auth-meta.ts","../src/functions/wirings/auth/serialize-auth-types.ts","../src/functions/wirings/channels/pikku-channels.ts","../src/functions/wirings/channels/pikku-command-channel-types.ts","../src/functions/wirings/channels/pikku-command-channels-map.ts","../src/functions/wirings/channels/pikku-command-channels.ts","../src/functions/wirings/channels/serialize-channel-types.ts","../src/functions/wirings/channels/serialize-typed-channel-map.ts","../src/functions/wirings/cli/pikku-command-cli-entry.ts","../src/functions/wirings/cli/pikku-command-cli-types.ts","../src/functions/wirings/cli/pikku-command-cli.ts","../src/functions/wirings/cli/serialize-channel-cli-client.ts","../src/functions/wirings/cli/serialize-channel-cli.ts","../src/functions/wirings/cli/serialize-cli-entrypoint-guard.ts","../src/functions/wirings/cli/serialize-cli-types.ts","../src/functions/wirings/cli/serialize-local-cli-bootstrap.ts","../src/functions/wirings/console/pikku-command-console-functions.ts","../src/functions/wirings/console/pikku-command-nodes-meta.ts","../src/functions/wirings/console/serialize-console-functions.ts","../src/functions/wirings/credentials/pikku-command-credentials.ts","../src/functions/wirings/credentials/serialize-credentials-types.ts","../src/functions/wirings/emails/pikku-command-emails.ts","../src/functions/wirings/emails/serialize-emails.ts","../src/functions/wirings/errors/pikku-command-error-types.ts","../src/functions/wirings/errors/serialize-error-types.ts","../src/functions/wirings/functions/pikku-command-addon-types.ts","../src/functions/wirings/functions/pikku-command-function-types-split.ts","../src/functions/wirings/functions/pikku-command-functions.ts","../src/functions/wirings/functions/pikku-command-leaf-indexes.ts","../src/functions/wirings/functions/pikku-command-services.ts","../src/functions/wirings/functions/schemas.ts","../src/functions/wirings/functions/serialize-addon-refs.ts","../src/functions/wirings/functions/serialize-addon-types.ts","../src/functions/wirings/functions/serialize-function-imports.ts","../src/functions/wirings/functions/serialize-function-types.ts","../src/functions/wirings/functions/serialize-leaf-index.ts","../src/functions/wirings/gateway/pikku-command-gateway-types.ts","../src/functions/wirings/gateway/pikku-command-gateway.ts","../src/functions/wirings/gateway/serialize-gateway-meta.ts","../src/functions/wirings/gateway/serialize-gateway-types.ts","../src/functions/wirings/graph/pikku-command-graph-wirings.ts","../src/functions/wirings/graph/serialize-graph-wirings.ts","../src/functions/wirings/http/pikku-command-http-map.ts","../src/functions/wirings/http/pikku-command-http-routes.ts","../src/functions/wirings/http/pikku-command-http-types.ts","../src/functions/wirings/http/pikku-command-openapi.ts","../src/functions/wirings/http/pikku-http-routes.ts","../src/functions/wirings/http/serialize-fetch-wrapper.ts","../src/functions/wirings/http/serialize-http-types.ts","../src/functions/wirings/http/serialize-typed-http-map.ts","../src/functions/wirings/mcp/pikku-command-mcp-json.ts","../src/functions/wirings/mcp/pikku-command-mcp-types.ts","../src/functions/wirings/mcp/pikku-command-mcp.ts","../src/functions/wirings/mcp/serialize-mcp-types.ts","../src/functions/wirings/middleware/pikku-command-middleware.ts","../src/functions/wirings/middleware/serialize-middleware-imports.ts","../src/functions/wirings/middleware/serialize-middleware-types.ts","../src/functions/wirings/package/pikku-command-package-types.ts","../src/functions/wirings/package/pikku-command-package.ts","../src/functions/wirings/package/serialize-package-types.ts","../src/functions/wirings/package/serialize-package.ts","../src/functions/wirings/permissions/pikku-command-permissions.ts","../src/functions/wirings/permissions/serialize-permissions-imports.ts","../src/functions/wirings/personas/personas-secrets-file.ts","../src/functions/wirings/personas/pikku-command-personas.ts","../src/functions/wirings/personas/serialize-personas-secrets.ts","../src/functions/wirings/personas/serialize-personas-types.ts","../src/functions/wirings/queue/pikku-command-queue-map.ts","../src/functions/wirings/queue/pikku-command-queue-service.ts","../src/functions/wirings/queue/pikku-command-queue-types.ts","../src/functions/wirings/queue/pikku-command-queue.ts","../src/functions/wirings/queue/pikku-queue-map.ts","../src/functions/wirings/queue/pikku-queue.ts","../src/functions/wirings/queue/serialize-queue-map.ts","../src/functions/wirings/queue/serialize-queue-meta.ts","../src/functions/wirings/queue/serialize-queue-types.ts","../src/functions/wirings/queue/serialize-queue-wrapper.ts","../src/functions/wirings/realtime/pikku-command-events-scaffold.ts","../src/functions/wirings/realtime/pikku-command-realtime.ts","../src/functions/wirings/realtime/serialize-events-scaffold.ts","../src/functions/wirings/realtime/serialize-realtime-client.ts","../src/functions/wirings/roles/pikku-command-roles.ts","../src/functions/wirings/roles/serialize-roles-types.ts","../src/functions/wirings/rpc/pikku-command-public-rpc.ts","../src/functions/wirings/rpc/pikku-command-react-query.ts","../src/functions/wirings/rpc/pikku-command-remote-rpc.ts","../src/functions/wirings/rpc/pikku-command-rpc-client.ts","../src/functions/wirings/rpc/pikku-command-rpc-map.ts","../src/functions/wirings/rpc/pikku-command-rpc.ts","../src/functions/wirings/rpc/serialize-public-rpc.ts","../src/functions/wirings/rpc/serialize-react-query-hooks.ts","../src/functions/wirings/rpc/serialize-remote-rpc.ts","../src/functions/wirings/rpc/serialize-rpc-wrapper.ts","../src/functions/wirings/rpc/serialize-typed-rpc-map.ts","../src/functions/wirings/scenarios/register-scenario-instrumentation.ts","../src/functions/wirings/scenarios/scenario-partition.ts","../src/functions/wirings/scenarios/scenario-schema-partition.ts","../src/functions/wirings/scenarios/serialize-feature-meta.ts","../src/functions/wirings/scenarios/serialize-scenario-meta.ts","../src/functions/wirings/scenarios/serialize-scenario-registration.ts","../src/functions/wirings/scheduler/pikku-command-scheduler-types.ts","../src/functions/wirings/scheduler/pikku-command-scheduler.ts","../src/functions/wirings/scheduler/serialize-scheduler-meta.ts","../src/functions/wirings/scheduler/serialize-scheduler-types.ts","../src/functions/wirings/scopes/pikku-command-scopes.ts","../src/functions/wirings/scopes/serialize-scopes-client.ts","../src/functions/wirings/scopes/serialize-scopes-types.ts","../src/functions/wirings/secrets/pikku-command-secrets.ts","../src/functions/wirings/secrets/serialize-secrets-types.ts","../src/functions/wirings/setup/serialize-setup-types.ts","../src/functions/wirings/triggers/pikku-command-trigger-types.ts","../src/functions/wirings/triggers/pikku-command-trigger.ts","../src/functions/wirings/triggers/serialize-trigger-meta.ts","../src/functions/wirings/triggers/serialize-trigger-types.ts","../src/functions/wirings/user-admin/pikku-command-user-admin-functions.ts","../src/functions/wirings/user-admin/serialize-user-admin-functions.ts","../src/functions/wirings/variables/pikku-command-variables.ts","../src/functions/wirings/variables/serialize-variables-types.ts","../src/functions/wirings/virtual-user/pikku-command-virtual-user-functions.ts","../src/functions/wirings/virtual-user/serialize-virtual-user-functions.ts","../src/functions/wirings/webhook/pikku-command-webhook.ts","../src/functions/wirings/webhook/serialize-webhook.ts","../src/functions/wirings/workflow/pikku-command-workflow-routes.ts","../src/functions/wirings/workflow/pikku-command-workflow.ts","../src/functions/wirings/workflow/serialize-personas.ts","../src/functions/wirings/workflow/serialize-scenario-step-map.ts","../src/functions/wirings/workflow/serialize-scenario-types.ts","../src/functions/wirings/workflow/serialize-workflow-bootstrap-map.ts","../src/functions/wirings/workflow/serialize-workflow-map.ts","../src/functions/wirings/workflow/serialize-workflow-meta.ts","../src/functions/wirings/workflow/serialize-workflow-registration.ts","../src/functions/wirings/workflow/serialize-workflow-routes.ts","../src/functions/wirings/workflow/serialize-workflow-types.ts","../src/functions/workflows/all.workflow.ts","../src/middleware/log-command-info-and-time.ts","../src/server/actor-sign-in.ts","../src/server/bun-server-runner.ts","../src/server/content-signing-jwt.ts","../src/server/dev-server-runner.interface.ts","../src/server/node-server-runner.ts","../src/server/server-ready.ts","../src/server/spawn-dev-server.ts","../src/services/cli-logger-forwarder.service.ts","../src/services/cli-logger.service.ts","../src/utils/assert-single-core-version.ts","../src/utils/check-required-types.ts","../src/utils/cli-session.ts","../src/utils/command-summary.ts","../src/utils/contract-versions.ts","../src/utils/detect-better-auth.ts","../src/utils/device-auth.ts","../src/utils/file-import-path.ts","../src/utils/file-imports-serializer.ts","../src/utils/file-writer.ts","../src/utils/frontend.ts","../src/utils/generate-bootstrap-file.ts","../src/utils/get-cli-version.ts","../src/utils/is-deploy-codegen.ts","../src/utils/leaf-import-path.ts","../src/utils/meta-diff.ts","../src/utils/model-alias-override.ts","../src/utils/parse-cli-filters.ts","../src/utils/persona-credentials.ts","../src/utils/pikku-cli-config-error.ts","../src/utils/pikku-cli-config.ts","../src/utils/pikku-files-and-methods.ts","../src/utils/precise-coverage-map.ts","../src/utils/remove-legacy-scaffold-file.ts","../src/utils/resolve-from-project.ts","../src/utils/resolve-personas.ts","../src/utils/resolve-scaffold-feature.ts","../src/utils/schema-diff.ts","../src/utils/serialize-import-map.ts","../src/utils/serialize-meta-ts.ts","../src/utils/serialize-schemas.ts","../src/utils/strip-verbose-meta.ts","../src/utils/surface-diff.ts","../src/utils/surface.ts","../src/utils/tsc-check.ts","../.pikku/pikku-bootstrap-scenarios.gen.ts","../.pikku/pikku-bootstrap.gen.ts","../.pikku/pikku-services.gen.ts","../.pikku/addon/index.ts","../.pikku/addon/pikku-addon-types.gen.ts","../.pikku/agent/index.ts","../.pikku/agent/pikku-agent-map.gen.d.ts","../.pikku/agent/pikku-agent-types.gen.ts","../.pikku/agent/pikku-model-aliases.gen.ts","../.pikku/agent/pikku-scorer-names.gen.d.ts","../.pikku/auth/auth.types.ts","../.pikku/auth/index.ts","../.pikku/auth/pikku-auth-types.gen.ts","../.pikku/channel/index.ts","../.pikku/channel/pikku-channel-types.gen.ts","../.pikku/cli/index.ts","../.pikku/cli/pikku-cli-channel.ts","../.pikku/cli/pikku-cli-client.gen.ts","../.pikku/cli/pikku-cli-contracts-meta.gen.ts","../.pikku/cli/pikku-cli-types.gen.ts","../.pikku/cli/pikku-cli-wirings-meta.gen.ts","../.pikku/cli/pikku-cli-wirings.gen.ts","../.pikku/cli/pikku-cli.gen.ts","../.pikku/error/index.ts","../.pikku/error/pikku-error-types.gen.ts","../.pikku/function/index.ts","../.pikku/function/pikku-function-types.gen.ts","../.pikku/function/pikku-functions-meta.gen.ts","../.pikku/function/pikku-functions.gen.ts","../.pikku/gateway/index.ts","../.pikku/gateway/pikku-gateway-types.gen.ts","../.pikku/http/index.ts","../.pikku/http/pikku-http-types.gen.ts","../.pikku/mcp/index.ts","../.pikku/mcp/pikku-mcp-types.gen.ts","../.pikku/middleware/index.ts","../.pikku/middleware/pikku-middleware-types.gen.ts","../.pikku/node/pikku-node-types.gen.ts","../.pikku/queue/index.ts","../.pikku/queue/pikku-queue-types.gen.ts","../.pikku/queue/pikku-queue-workers-wirings-map.gen.d.ts","../.pikku/queue/pikku-queue-workers-wirings-meta.gen.ts","../.pikku/queue/pikku-queue-workers-wirings.gen.ts","../.pikku/rpc/pikku-rpc-wirings-map.gen.d.ts","../.pikku/rpc/pikku-rpc-wirings-map.internal.gen.d.ts","../.pikku/rpc/pikku-rpc-wirings-map.remote.gen.d.ts","../.pikku/rpc/pikku-rpc-wirings-meta.internal.gen.ts","../.pikku/scenarios/index.ts","../.pikku/scenarios/pikku-personas.gen.ts","../.pikku/scenarios/pikku-scenario-functions-meta.gen.ts","../.pikku/scenarios/pikku-scenario-functions.gen.ts","../.pikku/scenarios/pikku-scenario-types.gen.ts","../.pikku/scenarios/pikku-scenario-wirings-meta.gen.ts","../.pikku/scenarios/pikku-scenario-wirings.gen.ts","../.pikku/scenarios/schemas/register.gen.ts","../.pikku/scheduler/index.ts","../.pikku/scheduler/pikku-scheduler-types.gen.ts","../.pikku/schemas/register.gen.ts","../.pikku/scopes/index.ts","../.pikku/scopes/pikku-personas.gen.ts","../.pikku/scopes/pikku-roles.gen.ts","../.pikku/scopes/pikku-scope-types.gen.ts","../.pikku/scopes/pikku-scopes.gen.ts","../.pikku/secrets/index.ts","../.pikku/secrets/pikku-secret-types.gen.ts","../.pikku/secrets/pikku-secrets.gen.ts","../.pikku/services/pikku-meta-service.gen.ts","../.pikku/setup/index.ts","../.pikku/setup/pikku-setup-types.gen.ts","../.pikku/trigger/index.ts","../.pikku/trigger/pikku-trigger-types.gen.ts","../.pikku/variables/index.ts","../.pikku/variables/pikku-variable-types.gen.ts","../.pikku/variables/pikku-variables.gen.ts","../.pikku/workflow/index.ts","../.pikku/workflow/pikku-scenario-step-map.gen.d.ts","../.pikku/workflow/pikku-workflow-map.gen.d.ts","../.pikku/workflow/pikku-workflow-types.gen.ts","../.pikku/workflow/pikku-workflow-wirings-meta.gen.ts","../.pikku/workflow/pikku-workflow-wirings.gen.ts","../types/application-types.d.ts","../types/bun-sqlite.d.ts","../types/config.d.ts"],"version":"6.0.3"}
+{"root":["../bin/pikku.ts","../src/cli.wiring.ts","../src/services.ts","../src/deploy/build-pipeline.ts","../src/deploy/frontend-assets.ts","../src/deploy/server-entry.ts","../src/deploy/analyzer/analyzer.ts","../src/deploy/analyzer/index.ts","../src/deploy/bundler/bun-bundler.ts","../src/deploy/bundler/bundler.interface.ts","../src/deploy/bundler/bundler.ts","../src/deploy/bundler/dep-extractor.ts","../src/deploy/bundler/index.ts","../src/deploy/bundler/node-bundler.ts","../src/deploy/bundler/service-module-map.ts","../src/deploy/bundler/types.ts","../src/deploy/codegen/index.ts","../src/deploy/codegen/per-unit-codegen.ts","../src/deploy/plan/executor.ts","../src/deploy/plan/formatter.ts","../src/deploy/plan/index.ts","../src/deploy/plan/planner.ts","../src/deploy/plan/provider.ts","../src/deploy/plan/types.ts","../src/fabric/fabric-commands.ts","../src/fabric/functions/add.function.ts","../src/fabric/functions/addon-verify.function.ts","../src/fabric/functions/db-schema.function.ts","../src/fabric/functions/deploy-list.function.ts","../src/fabric/functions/deploy-units.function.ts","../src/fabric/functions/deploy.function.ts","../src/fabric/functions/domains-add.function.ts","../src/fabric/functions/domains-list.function.ts","../src/fabric/functions/domains-remove.function.ts","../src/fabric/functions/errors.function.ts","../src/fabric/functions/findings-clear.function.ts","../src/fabric/functions/findings-flush.function.ts","../src/fabric/functions/findings-list.function.ts","../src/fabric/functions/init.function.ts","../src/fabric/functions/link.function.ts","../src/fabric/functions/llm-key.function.ts","../src/fabric/functions/login.function.ts","../src/fabric/functions/logs.function.ts","../src/fabric/functions/metrics.function.ts","../src/fabric/functions/projects-list.function.ts","../src/fabric/functions/publish.function.ts","../src/fabric/functions/report.function.ts","../src/fabric/functions/rollback.function.ts","../src/fabric/functions/secrets-delete.function.ts","../src/fabric/functions/secrets-list.function.ts","../src/fabric/functions/secrets-rotate.function.ts","../src/fabric/functions/secrets-set.function.ts","../src/fabric/functions/smoke.function.ts","../src/fabric/functions/status.function.ts","../src/fabric/functions/trace.function.ts","../src/fabric/functions/validate.function.ts","../src/fabric/functions/variables-get.function.ts","../src/fabric/functions/variables-set.function.ts","../src/fabric/lib/blank-comments.ts","../src/fabric/lib/blank-scenario-meta.ts","../src/fabric/lib/config.ts","../src/fabric/lib/console-url.ts","../src/fabric/lib/deployment.ts","../src/fabric/lib/finding-spool.ts","../src/fabric/lib/finding.ts","../src/fabric/lib/frontend-typecheck.ts","../src/fabric/lib/git.ts","../src/fabric/lib/http.ts","../src/fabric/lib/not-implemented.ts","../src/fabric/lib/output.ts","../src/fabric/lib/prompt.ts","../src/fabric/lib/report-environment.ts","../src/fabric/lib/sealed-box.ts","../src/fabric/lib/stage.ts","../src/fabric/lib/variable-value.ts","../src/fabric/sdk/http-map.gen.d.ts","../src/fabric/sdk/pikku-fetch.gen.ts","../src/fabric/sdk/pikku-rpc.gen.ts","../src/fabric/sdk/rpc-map.gen.d.ts","../src/functions/commands/all.ts","../src/functions/commands/audit.ts","../src/functions/commands/binary.ts","../src/functions/commands/bootstrap.ts","../src/functions/commands/bun-coverage-loader.ts","../src/functions/commands/db-audit.ts","../src/functions/commands/db-baseline.ts","../src/functions/commands/db-check.ts","../src/functions/commands/db-codegen.ts","../src/functions/commands/db-export.ts","../src/functions/commands/db-generate.ts","../src/functions/commands/db-migrate.ts","../src/functions/commands/db-reset.ts","../src/functions/commands/db-shared.ts","../src/functions/commands/deploy-apply.ts","../src/functions/commands/deploy-info.ts","../src/functions/commands/deploy-plan.ts","../src/functions/commands/dev-agent-runner.ts","../src/functions/commands/dev.ts","../src/functions/commands/dist.ts","../src/functions/commands/doc.ts","../src/functions/commands/emails-init.ts","../src/functions/commands/enable.ts","../src/functions/commands/environment.ts","../src/functions/commands/import-n8n.ts","../src/functions/commands/info.ts","../src/functions/commands/knowledge-index.ts","../src/functions/commands/knowledge-validate.ts","../src/functions/commands/load-user-project.ts","../src/functions/commands/login.ts","../src/functions/commands/meta.ts","../src/functions/commands/new-addon.ts","../src/functions/commands/new-function.ts","../src/functions/commands/new-middleware.ts","../src/functions/commands/new-permission.ts","../src/functions/commands/new-wiring.ts","../src/functions/commands/persona-sync.ts","../src/functions/commands/persona.ts","../src/functions/commands/pikku-command-bootstrap.ts","../src/functions/commands/pikku-command-summary.ts","../src/functions/commands/roles-audit.ts","../src/functions/commands/roles-prune.ts","../src/functions/commands/roles-shared.ts","../src/functions/commands/scenario-browser.ts","../src/functions/commands/scenario-formatter.ts","../src/functions/commands/scenario-ladder.ts","../src/functions/commands/scenario-plan.ts","../src/functions/commands/scenario.ts","../src/functions/commands/scopes-audit.ts","../src/functions/commands/scopes-prune.ts","../src/functions/commands/scopes-shared.ts","../src/functions/commands/semver-render.ts","../src/functions/commands/semver.ts","../src/functions/commands/serve-console.ts","../src/functions/commands/serve-frontend.ts","../src/functions/commands/serve.ts","../src/functions/commands/skills.ts","../src/functions/commands/start-coverage.ts","../src/functions/commands/update-render.ts","../src/functions/commands/update.ts","../src/functions/commands/validate.ts","../src/functions/commands/versions-check.ts","../src/functions/commands/versions-init.ts","../src/functions/commands/versions-update.ts","../src/functions/commands/virtual-user-formatter.ts","../src/functions/commands/watch.ts","../src/functions/db/annotation-parser.ts","../src/functions/db/better-auth-schema.ts","../src/functions/db/check-enums.ts","../src/functions/db/db-codegen.ts","../src/functions/db/db-introspector.ts","../src/functions/db/db-migrator.ts","../src/functions/db/local-db.ts","../src/functions/db/migration-identifiers.ts","../src/functions/db/migration-provenance.ts","../src/functions/db/schema-sql.ts","../src/functions/db/zod-codegen.ts","../src/functions/db/postgres/pglite-kysely.ts","../src/functions/db/postgres/postgres-introspector.ts","../src/functions/db/postgres/postgres-migrator.ts","../src/functions/db/sqlite/dev-seed.ts","../src/functions/db/sqlite/sqlite-introspector.ts","../src/functions/db/sqlite/sqlite-kysely.ts","../src/functions/db/sqlite/sqlite-migrator.ts","../src/functions/db/sqlite/sqlite-runtime-bun.ts","../src/functions/db/sqlite/sqlite-runtime-node.ts","../src/functions/db/sqlite/sqlite-runtime.ts","../src/functions/knowledge/render.ts","../src/functions/knowledge/schemas.ts","../src/functions/runtimes/fetch/index.ts","../src/functions/runtimes/nextjs/pikku-command-nextjs.ts","../src/functions/runtimes/nextjs/serialize-nextjs-backend-worker-rpc-wrapper.ts","../src/functions/runtimes/nextjs/serialize-nextjs-backend-wrapper.ts","../src/functions/runtimes/nextjs/serialize-nextjs-http-wrapper.ts","../src/functions/runtimes/tanstack-start/pikku-command-tanstack-start.ts","../src/functions/runtimes/tanstack-start/serialize-tanstack-start-shim.ts","../src/functions/runtimes/websocket/pikku-command-websocket-typed.ts","../src/functions/runtimes/websocket/serialize-websocket-wrapper.ts","../src/functions/surface/build-surface-doc.ts","../src/functions/surface/collect-snippets.ts","../src/functions/surface/collect-surface-usage.ts","../src/functions/surface/collect-surface.ts","../src/functions/surface/generate-surface-doc.ts","../src/functions/surface/render-surface-doc.ts","../src/functions/surface/shipped-surface-doc.ts","../src/functions/surface/surface-doc.types.ts","../src/functions/surface/surface-editorial.ts","../src/functions/surface/write-surface-usage.ts","../src/functions/validate/addon-package-checks.ts","../src/functions/validate/auth-plugin-checks.ts","../src/functions/validate/bootstrap-checks.ts","../src/functions/validate/persona-checks.ts","../src/functions/validate/pikku-barrel-checks.ts","../src/functions/validate/scenario-file-checks.ts","../src/functions/validate/shared-checks.ts","../src/functions/validate/type-identity-checks.ts","../src/functions/validate/validate-registry.ts","../src/functions/validate/validate.ts","../src/functions/validate/websocket-deps-checks.ts","../src/functions/validate/workspace-exports-checks.ts","../src/functions/wirings/agent/pikku-command-agent-types.ts","../src/functions/wirings/agent/pikku-command-agent.ts","../src/functions/wirings/agent/pikku-command-public-agent.ts","../src/functions/wirings/agent/serialize-agent-map.ts","../src/functions/wirings/agent/serialize-agent-types.ts","../src/functions/wirings/agent/serialize-model-aliases.ts","../src/functions/wirings/agent/serialize-public-agent.ts","../src/functions/wirings/agent-scorer/pikku-command-agent-scorer.ts","../src/functions/wirings/agent-scorer/serialize-scorer-names.ts","../src/functions/wirings/auth/pikku-command-auth.ts","../src/functions/wirings/auth/serialize-auth-gen.ts","../src/functions/wirings/auth/serialize-auth-guards.ts","../src/functions/wirings/auth/serialize-auth-meta.ts","../src/functions/wirings/auth/serialize-auth-types.ts","../src/functions/wirings/channels/pikku-channels.ts","../src/functions/wirings/channels/pikku-command-channel-types.ts","../src/functions/wirings/channels/pikku-command-channels-map.ts","../src/functions/wirings/channels/pikku-command-channels.ts","../src/functions/wirings/channels/serialize-channel-types.ts","../src/functions/wirings/channels/serialize-typed-channel-map.ts","../src/functions/wirings/cli/pikku-command-cli-entry.ts","../src/functions/wirings/cli/pikku-command-cli-types.ts","../src/functions/wirings/cli/pikku-command-cli.ts","../src/functions/wirings/cli/serialize-channel-cli-client.ts","../src/functions/wirings/cli/serialize-channel-cli.ts","../src/functions/wirings/cli/serialize-cli-entrypoint-guard.ts","../src/functions/wirings/cli/serialize-cli-types.ts","../src/functions/wirings/cli/serialize-local-cli-bootstrap.ts","../src/functions/wirings/console/pikku-command-console-functions.ts","../src/functions/wirings/console/pikku-command-nodes-meta.ts","../src/functions/wirings/console/serialize-console-functions.ts","../src/functions/wirings/credentials/pikku-command-credentials.ts","../src/functions/wirings/credentials/serialize-credentials-types.ts","../src/functions/wirings/emails/pikku-command-emails.ts","../src/functions/wirings/emails/serialize-emails.ts","../src/functions/wirings/errors/pikku-command-error-types.ts","../src/functions/wirings/errors/serialize-error-types.ts","../src/functions/wirings/functions/pikku-command-addon-types.ts","../src/functions/wirings/functions/pikku-command-function-types-split.ts","../src/functions/wirings/functions/pikku-command-functions.ts","../src/functions/wirings/functions/pikku-command-leaf-indexes.ts","../src/functions/wirings/functions/pikku-command-services.ts","../src/functions/wirings/functions/schemas.ts","../src/functions/wirings/functions/serialize-addon-refs.ts","../src/functions/wirings/functions/serialize-addon-types.ts","../src/functions/wirings/functions/serialize-function-imports.ts","../src/functions/wirings/functions/serialize-function-types.ts","../src/functions/wirings/functions/serialize-leaf-index.ts","../src/functions/wirings/gateway/pikku-command-gateway-types.ts","../src/functions/wirings/gateway/pikku-command-gateway.ts","../src/functions/wirings/gateway/serialize-gateway-meta.ts","../src/functions/wirings/gateway/serialize-gateway-types.ts","../src/functions/wirings/graph/pikku-command-graph-wirings.ts","../src/functions/wirings/graph/serialize-graph-wirings.ts","../src/functions/wirings/http/pikku-command-http-map.ts","../src/functions/wirings/http/pikku-command-http-routes.ts","../src/functions/wirings/http/pikku-command-http-types.ts","../src/functions/wirings/http/pikku-command-openapi.ts","../src/functions/wirings/http/pikku-http-routes.ts","../src/functions/wirings/http/serialize-fetch-wrapper.ts","../src/functions/wirings/http/serialize-http-types.ts","../src/functions/wirings/http/serialize-typed-http-map.ts","../src/functions/wirings/mcp/pikku-command-mcp-json.ts","../src/functions/wirings/mcp/pikku-command-mcp-types.ts","../src/functions/wirings/mcp/pikku-command-mcp.ts","../src/functions/wirings/mcp/serialize-mcp-types.ts","../src/functions/wirings/middleware/pikku-command-middleware.ts","../src/functions/wirings/middleware/serialize-middleware-imports.ts","../src/functions/wirings/middleware/serialize-middleware-types.ts","../src/functions/wirings/package/pikku-command-package-types.ts","../src/functions/wirings/package/pikku-command-package.ts","../src/functions/wirings/package/serialize-package-types.ts","../src/functions/wirings/package/serialize-package.ts","../src/functions/wirings/permissions/pikku-command-permissions.ts","../src/functions/wirings/permissions/serialize-permissions-imports.ts","../src/functions/wirings/personas/personas-secrets-file.ts","../src/functions/wirings/personas/pikku-command-personas.ts","../src/functions/wirings/personas/serialize-personas-secrets.ts","../src/functions/wirings/personas/serialize-personas-types.ts","../src/functions/wirings/queue/pikku-command-queue-map.ts","../src/functions/wirings/queue/pikku-command-queue-service.ts","../src/functions/wirings/queue/pikku-command-queue-types.ts","../src/functions/wirings/queue/pikku-command-queue.ts","../src/functions/wirings/queue/pikku-queue-map.ts","../src/functions/wirings/queue/pikku-queue.ts","../src/functions/wirings/queue/serialize-queue-map.ts","../src/functions/wirings/queue/serialize-queue-meta.ts","../src/functions/wirings/queue/serialize-queue-types.ts","../src/functions/wirings/queue/serialize-queue-wrapper.ts","../src/functions/wirings/realtime/pikku-command-events-scaffold.ts","../src/functions/wirings/realtime/pikku-command-realtime.ts","../src/functions/wirings/realtime/serialize-events-scaffold.ts","../src/functions/wirings/realtime/serialize-realtime-client.ts","../src/functions/wirings/roles/pikku-command-roles.ts","../src/functions/wirings/roles/serialize-roles-types.ts","../src/functions/wirings/rpc/pikku-command-public-rpc.ts","../src/functions/wirings/rpc/pikku-command-react-query.ts","../src/functions/wirings/rpc/pikku-command-remote-rpc.ts","../src/functions/wirings/rpc/pikku-command-rpc-client.ts","../src/functions/wirings/rpc/pikku-command-rpc-map.ts","../src/functions/wirings/rpc/pikku-command-rpc.ts","../src/functions/wirings/rpc/serialize-public-rpc.ts","../src/functions/wirings/rpc/serialize-react-query-hooks.ts","../src/functions/wirings/rpc/serialize-remote-rpc.ts","../src/functions/wirings/rpc/serialize-rpc-wrapper.ts","../src/functions/wirings/rpc/serialize-typed-rpc-map.ts","../src/functions/wirings/scenarios/register-scenario-instrumentation.ts","../src/functions/wirings/scenarios/scenario-partition.ts","../src/functions/wirings/scenarios/scenario-schema-partition.ts","../src/functions/wirings/scenarios/serialize-feature-meta.ts","../src/functions/wirings/scenarios/serialize-scenario-meta.ts","../src/functions/wirings/scenarios/serialize-scenario-registration.ts","../src/functions/wirings/scheduler/pikku-command-scheduler-types.ts","../src/functions/wirings/scheduler/pikku-command-scheduler.ts","../src/functions/wirings/scheduler/serialize-scheduler-meta.ts","../src/functions/wirings/scheduler/serialize-scheduler-types.ts","../src/functions/wirings/scopes/pikku-command-scopes.ts","../src/functions/wirings/scopes/serialize-scopes-client.ts","../src/functions/wirings/scopes/serialize-scopes-types.ts","../src/functions/wirings/secrets/pikku-command-secrets.ts","../src/functions/wirings/secrets/serialize-secrets-types.ts","../src/functions/wirings/setup/serialize-setup-types.ts","../src/functions/wirings/triggers/pikku-command-trigger-types.ts","../src/functions/wirings/triggers/pikku-command-trigger.ts","../src/functions/wirings/triggers/serialize-trigger-meta.ts","../src/functions/wirings/triggers/serialize-trigger-types.ts","../src/functions/wirings/user-admin/pikku-command-user-admin-functions.ts","../src/functions/wirings/user-admin/serialize-user-admin-functions.ts","../src/functions/wirings/variables/pikku-command-variables.ts","../src/functions/wirings/variables/serialize-variables-types.ts","../src/functions/wirings/virtual-user/pikku-command-virtual-user-functions.ts","../src/functions/wirings/virtual-user/serialize-virtual-user-functions.ts","../src/functions/wirings/webhook/pikku-command-webhook.ts","../src/functions/wirings/webhook/serialize-webhook.ts","../src/functions/wirings/workflow/pikku-command-workflow-routes.ts","../src/functions/wirings/workflow/pikku-command-workflow.ts","../src/functions/wirings/workflow/serialize-personas.ts","../src/functions/wirings/workflow/serialize-scenario-step-map.ts","../src/functions/wirings/workflow/serialize-scenario-types.ts","../src/functions/wirings/workflow/serialize-workflow-bootstrap-map.ts","../src/functions/wirings/workflow/serialize-workflow-map.ts","../src/functions/wirings/workflow/serialize-workflow-meta.ts","../src/functions/wirings/workflow/serialize-workflow-registration.ts","../src/functions/wirings/workflow/serialize-workflow-routes.ts","../src/functions/wirings/workflow/serialize-workflow-types.ts","../src/functions/workflows/all.workflow.ts","../src/middleware/log-command-info-and-time.ts","../src/server/actor-sign-in.ts","../src/server/bun-server-runner.ts","../src/server/content-signing-jwt.ts","../src/server/dev-server-runner.interface.ts","../src/server/node-server-runner.ts","../src/server/server-ready.ts","../src/server/spawn-dev-server.ts","../src/services/cli-logger-forwarder.service.ts","../src/services/cli-logger.service.ts","../src/utils/assert-single-core-version.ts","../src/utils/check-required-types.ts","../src/utils/cli-session.ts","../src/utils/command-summary.ts","../src/utils/contract-versions.ts","../src/utils/detect-better-auth.ts","../src/utils/device-auth.ts","../src/utils/file-import-path.ts","../src/utils/file-imports-serializer.ts","../src/utils/file-writer.ts","../src/utils/frontend.ts","../src/utils/generate-bootstrap-file.ts","../src/utils/get-cli-version.ts","../src/utils/is-deploy-codegen.ts","../src/utils/leaf-import-path.ts","../src/utils/meta-diff.ts","../src/utils/model-alias-override.ts","../src/utils/parse-cli-filters.ts","../src/utils/persona-credentials.ts","../src/utils/pikku-cli-config-error.ts","../src/utils/pikku-cli-config.ts","../src/utils/pikku-files-and-methods.ts","../src/utils/precise-coverage-map.ts","../src/utils/remove-legacy-scaffold-file.ts","../src/utils/resolve-from-project.ts","../src/utils/resolve-personas.ts","../src/utils/resolve-scaffold-feature.ts","../src/utils/schema-diff.ts","../src/utils/serialize-import-map.ts","../src/utils/serialize-meta-ts.ts","../src/utils/serialize-schemas.ts","../src/utils/strip-verbose-meta.ts","../src/utils/surface-diff.ts","../src/utils/surface.ts","../src/utils/tsc-check.ts","../.pikku/pikku-bootstrap-scenarios.gen.ts","../.pikku/pikku-bootstrap.gen.ts","../.pikku/pikku-services.gen.ts","../.pikku/addon/index.ts","../.pikku/addon/pikku-addon-types.gen.ts","../.pikku/agent/index.ts","../.pikku/agent/pikku-agent-map.gen.d.ts","../.pikku/agent/pikku-agent-types.gen.ts","../.pikku/agent/pikku-model-aliases.gen.ts","../.pikku/agent/pikku-scorer-names.gen.d.ts","../.pikku/auth/auth.types.ts","../.pikku/auth/index.ts","../.pikku/auth/pikku-auth-types.gen.ts","../.pikku/channel/index.ts","../.pikku/channel/pikku-channel-types.gen.ts","../.pikku/cli/index.ts","../.pikku/cli/pikku-cli-channel.ts","../.pikku/cli/pikku-cli-client.gen.ts","../.pikku/cli/pikku-cli-contracts-meta.gen.ts","../.pikku/cli/pikku-cli-types.gen.ts","../.pikku/cli/pikku-cli-wirings-meta.gen.ts","../.pikku/cli/pikku-cli-wirings.gen.ts","../.pikku/cli/pikku-cli.gen.ts","../.pikku/error/index.ts","../.pikku/error/pikku-error-types.gen.ts","../.pikku/function/index.ts","../.pikku/function/pikku-function-types.gen.ts","../.pikku/function/pikku-functions-meta.gen.ts","../.pikku/function/pikku-functions.gen.ts","../.pikku/gateway/index.ts","../.pikku/gateway/pikku-gateway-types.gen.ts","../.pikku/http/index.ts","../.pikku/http/pikku-http-types.gen.ts","../.pikku/mcp/index.ts","../.pikku/mcp/pikku-mcp-types.gen.ts","../.pikku/middleware/index.ts","../.pikku/middleware/pikku-middleware-types.gen.ts","../.pikku/node/pikku-node-types.gen.ts","../.pikku/queue/index.ts","../.pikku/queue/pikku-queue-types.gen.ts","../.pikku/queue/pikku-queue-workers-wirings-map.gen.d.ts","../.pikku/queue/pikku-queue-workers-wirings-meta.gen.ts","../.pikku/queue/pikku-queue-workers-wirings.gen.ts","../.pikku/rpc/pikku-rpc-wirings-map.gen.d.ts","../.pikku/rpc/pikku-rpc-wirings-map.internal.gen.d.ts","../.pikku/rpc/pikku-rpc-wirings-map.remote.gen.d.ts","../.pikku/rpc/pikku-rpc-wirings-meta.internal.gen.ts","../.pikku/scenarios/index.ts","../.pikku/scenarios/pikku-personas.gen.ts","../.pikku/scenarios/pikku-scenario-functions-meta.gen.ts","../.pikku/scenarios/pikku-scenario-functions.gen.ts","../.pikku/scenarios/pikku-scenario-types.gen.ts","../.pikku/scenarios/pikku-scenario-wirings-meta.gen.ts","../.pikku/scenarios/pikku-scenario-wirings.gen.ts","../.pikku/scenarios/schemas/register.gen.ts","../.pikku/scheduler/index.ts","../.pikku/scheduler/pikku-scheduler-types.gen.ts","../.pikku/schemas/register.gen.ts","../.pikku/scopes/index.ts","../.pikku/scopes/pikku-personas.gen.ts","../.pikku/scopes/pikku-roles.gen.ts","../.pikku/scopes/pikku-scope-types.gen.ts","../.pikku/scopes/pikku-scopes.gen.ts","../.pikku/secrets/index.ts","../.pikku/secrets/pikku-secret-types.gen.ts","../.pikku/secrets/pikku-secrets.gen.ts","../.pikku/services/pikku-meta-service.gen.ts","../.pikku/setup/index.ts","../.pikku/setup/pikku-setup-types.gen.ts","../.pikku/trigger/index.ts","../.pikku/trigger/pikku-trigger-types.gen.ts","../.pikku/variables/index.ts","../.pikku/variables/pikku-variable-types.gen.ts","../.pikku/variables/pikku-variables.gen.ts","../.pikku/workflow/index.ts","../.pikku/workflow/pikku-scenario-step-map.gen.d.ts","../.pikku/workflow/pikku-workflow-map.gen.d.ts","../.pikku/workflow/pikku-workflow-types.gen.ts","../.pikku/workflow/pikku-workflow-wirings-meta.gen.ts","../.pikku/workflow/pikku-workflow-wirings.gen.ts","../types/application-types.d.ts","../types/bun-sqlite.d.ts","../types/config.d.ts"],"version":"6.0.3"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/cli",
-  "version": "0.12.126",
+  "version": "0.12.128",
   "description": "Pikku CLI — code generation, dev server, migrations and deployment",
   "author": "yasser.fadl@gmail.com",
   "license": "BUSL-1.1",
@@ -31,20 +31,20 @@
     "@jridgewell/trace-mapping": "^0.3.31",
     "@openapi-contrib/json-schema-to-openapi-schema": "^4.3.4",
     "@pikku/ai-vercel": "^0.12.13",
-    "@pikku/better-auth": "^0.12.33",
+    "@pikku/better-auth": "^0.12.35",
     "@pikku/bun-server": "^0.12.10",
     "@pikku/code-edit": "^0.12.1",
     "@pikku/deploy": "^0.12.2",
     "@pikku/deploy-cloudflare": "^0.12.13",
     "@pikku/fetch": "^0.12.10",
-    "@pikku/inspector": "^0.12.68",
+    "@pikku/inspector": "^0.12.69",
     "@pikku/knowledge": "^0.12.7",
     "@pikku/kysely": "^0.13.23",
     "@pikku/n8n-import": "^0.0.7",
     "@pikku/node-http-server": "^0.12.12",
     "@pikku/openapi-parser": "^0.12.20",
     "@pikku/schedule": "^0.12.7",
-    "@pikku/skills": "^0.12.20",
+    "@pikku/skills": "^0.12.22",
     "@types/cookie": "^1.0.0",
     "@types/json-schema": "^7.0.15",
     "ai": "^7.0.66",
@@ -67,15 +67,15 @@
     "zod-to-ts": "^2.1.0"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.99",
-    "@pikku/playwright": "^0.12.80",
+    "@pikku/core": "^0.12.101",
+    "@pikku/playwright": "^0.12.81",
     "@pikku/ws": "^0.12.9",
     "better-auth": "^1.6.0",
     "ws": "^8.21.3"
   },
   "devDependencies": {
-    "@pikku/core": "^0.12.99",
-    "@pikku/playwright": "^0.12.80",
+    "@pikku/core": "^0.12.101",
+    "@pikku/playwright": "^0.12.81",
     "@pikku/ws": "^0.12.9",
     "@playwright/test": "^1.50.0",
     "@types/istanbul-lib-instrument": "^1.7.8",

package/snippets.json

@@ -14,7 +14,7 @@
   "aiAgentStream": "// Streaming endpoint — sends text-delta, tool-call, and usage events as they arrive.\nwireHTTP({\n  method: 'post',\n  route: '/agents/shop/stream',\n  func: agentStream('shopAssistant'),\n  auth: true,\n})",
   "aiAgentStreamClient": "export async function agentStreamExamples() {\n  pikkuRPC.setServerUrl('http://localhost:4000')\n  pikkuRPC.setAuthorizationJWT('user-jwt-token')\n\n  const stream = await pikkuRPC.agent.stream('shopAssistant', {\n    message: 'Add the cheapest USB hub to my basket',\n    threadId: 'thread-123',\n    resourceId: 'user-456',\n  })\n  return stream\n}",
   "auditDispatch": "await audit?.audit({\n  type: 'order.created',\n  source: 'explicit',\n  occurredAt: new Date().toISOString(),\n  metadata: { orderId, userId },\n})",
-  "betterAuthConfig": "export const auth = pikkuBetterAuth(\n  async ({ kysely, secrets, variables, emailService }) => {\n    // `.reveal()` at the sink, not earlier: getSecret hands back a nominal\n    // SecretValue that no concretely-typed parameter accepts, so every disclosure\n    // is one greppable call. Better Auth wants the raw string, and this is where\n    // it stops being a secret in the type system.\n    const BETTER_AUTH_SECRET = (\n      await secrets.getSecret('BETTER_AUTH_SECRET')\n    ).reveal()\n    // Genuinely optional: unset simply disables /api/auth/sign-in/actor (scenarios\n    // off for this deployment) — the actor plugin refuses all sign-ins\n    // without it.\n    const SCENARIO_ACTOR_SECRET = await secrets\n      .getSecret('SCENARIO_ACTOR_SECRET')\n      .then((value) => value?.reveal())\n      .catch(() => undefined)\n    // Fabric operator admin: the RSA public key the control plane's token is\n    // verified against. The Fabric deployer pushes FABRIC_AUTH_PUBLIC_KEY onto\n    // every stage; locally it's simply absent, which disables /sign-in/fabric.\n    // Asymmetric — the app verifies, it can never forge an operator login.\n    const FABRIC_AUTH_PUBLIC_KEY = await variables.get('FABRIC_AUTH_PUBLIC_KEY')\n\n    return betterAuth({\n      secret: BETTER_AUTH_SECRET,\n      database: { db: kysely, type: 'sqlite' },\n      emailAndPassword: {\n        enabled: true,\n        // Without this, `requestPasswordReset` succeeds on the client and silently\n        // sends nothing — the \"Forgot password?\" flow looks wired and dead-ends.\n        // Better Auth builds `url` from its baseURL + the client's redirectTo, so\n        // the app only supplies the message. Errors are logged, never swallowed:\n        // a reset the user never receives must be visible in the logs.\n        sendResetPassword: async ({ user, url }) => {\n          await emailService.send({\n            to: user.email,\n            template: {\n              name: 'reset-password',\n              data: { email: user.email, resetUrl: url },\n            },\n          })\n        },\n      },\n      // Stateless session: CLI splits out betterAuthStatelessSession so non-auth\n      // units verify the signed cookie instead of bundling better-auth. pikku #737.\n      session: { cookieCache: { enabled: true } },\n      advanced: { database: { generateId: 'uuid' } },\n      // Scenario actors: synthetic users (user.actor = true, see\n      // db/sqlite/0002-user-actor.sql) signed in by pikkuScenario via\n      // POST /api/auth/sign-in/actor { email, secret }. Never signs in real users.\n      //\n      // ban(): adds the banned/banExpires/banReason columns (see\n      // db/sqlite/0003-admin.sql) and the session hook that refuses a banned\n      // user a session. better-auth's own admin() is refused by the inspector:\n      // it authorizes on a `user.role` column while pikku authorizes on scopes,\n      // and everything else it offered — list, create, ban, remove, revoke\n      // sessions, set password — is scoped RPCs in @pikku/addon-admin.\n      //\n      // fabric(): exposes /api/auth/sign-in/fabric — the Fabric control plane\n      // mints a short-lived RS256 token and signs in as a synthetic `fabric: true`\n      // admin operator (db/sqlite/0004-fabric.sql), so the console Users tab can\n      // list/impersonate real users without the operator being one of them. It\n      // verifies against FABRIC_AUTH_PUBLIC_KEY; a missing key disables the\n      // endpoint.\n      plugins: [\n        actor({ secret: SCENARIO_ACTOR_SECRET }),\n        ban(),\n        fabric({ publicKey: FABRIC_AUTH_PUBLIC_KEY }),\n      ],\n    })\n  }\n)",
+  "betterAuthConfig": "export const auth = pikkuBetterAuth(\n  async ({\n    kysely,\n    secrets,\n    variables,\n    emailService,\n    scopeService,\n    logger,\n  }) => {\n    // `.reveal()` at the sink, not earlier: getSecret hands back a nominal\n    // SecretValue that no concretely-typed parameter accepts, so every disclosure\n    // is one greppable call. Better Auth wants the raw string, and this is where\n    // it stops being a secret in the type system.\n    const BETTER_AUTH_SECRET = (\n      await secrets.getSecret('BETTER_AUTH_SECRET')\n    ).reveal()\n    // Genuinely optional: unset simply disables /api/auth/sign-in/actor (scenarios\n    // off for this deployment) — the actor plugin refuses all sign-ins\n    // without it.\n    const SCENARIO_ACTOR_SECRET = await secrets\n      .getSecret('SCENARIO_ACTOR_SECRET')\n      .then((value) => value?.reveal())\n      .catch(() => undefined)\n    // Fabric operator admin: the RSA public key the control plane's token is\n    // verified against. The Fabric deployer pushes FABRIC_AUTH_PUBLIC_KEY onto\n    // every stage; locally it's simply absent, which disables /sign-in/fabric.\n    // Asymmetric — the app verifies, it can never forge an operator login.\n    const FABRIC_AUTH_PUBLIC_KEY = await variables.get('FABRIC_AUTH_PUBLIC_KEY')\n\n    return betterAuth({\n      secret: BETTER_AUTH_SECRET,\n      database: { db: kysely, type: 'sqlite' },\n      emailAndPassword: {\n        enabled: true,\n        // Without this, `requestPasswordReset` succeeds on the client and silently\n        // sends nothing — the \"Forgot password?\" flow looks wired and dead-ends.\n        // Better Auth builds `url` from its baseURL + the client's redirectTo, so\n        // the app only supplies the message. Errors are logged, never swallowed:\n        // a reset the user never receives must be visible in the logs.\n        sendResetPassword: async ({ user, url }) => {\n          await emailService.send({\n            to: user.email,\n            template: {\n              name: 'reset-password',\n              data: { email: user.email, resetUrl: url },\n            },\n          })\n        },\n      },\n      // Stateless session: CLI splits out betterAuthStatelessSession so non-auth\n      // units verify the signed cookie instead of bundling better-auth. pikku #737.\n      session: { cookieCache: { enabled: true } },\n      advanced: { database: { generateId: 'uuid' } },\n      // Scenario actors: synthetic users (user.actor = true, see\n      // db/sqlite/0002-user-actor.sql) signed in by pikkuScenario via\n      // POST /api/auth/sign-in/actor { email, secret }. Never signs in real users.\n      //\n      // pikkuBan(): adds the banned/banExpires/banReason columns (see\n      // db/sqlite/0003-admin.sql) and the session hook that refuses a banned\n      // user a session. better-auth's own admin() is refused by the inspector:\n      // it authorizes on a `user.role` column while pikku authorizes on scopes,\n      // and everything else it offered — list, create, ban, remove, revoke\n      // sessions, set password — is scoped RPCs in @pikku/addon-admin.\n      //\n      // pikkuFabric(): exposes /api/auth/sign-in/fabric — the Fabric control plane\n      // mints a short-lived RS256 token and signs in as a synthetic `fabric: true`\n      // admin operator (db/sqlite/0004-fabric.sql), so the console Users tab can\n      // list/impersonate real users without the operator being one of them. It\n      // verifies against FABRIC_AUTH_PUBLIC_KEY; a missing key disables the\n      // endpoint.\n      //\n      // `personas` is what provisions the scenario actors. The plugin creates a\n      // declared persona's account the first time an operator asks to act as an\n      // address the stage has no row for, so a deploy carries its actors with it\n      // without a bootstrap step. This does NOT belong in `pikkuServerLifecycle`'s\n      // afterStart: that hook only ever runs under `pikku dev` and `pikku serve`,\n      // so a deployed stage would provision nobody.\n      plugins: [\n        pikkuActor({ secret: SCENARIO_ACTOR_SECRET }),\n        pikkuBan(),\n        pikkuFabric({\n          publicKey: FABRIC_AUTH_PUBLIC_KEY,\n          scopeService,\n          logger,\n          personas: {\n            personas: personaConfigs,\n            environments: personaEnvironments,\n          },\n        }),\n      ],\n    })\n  }\n)",
   "cancelOrder": "export const cancelOrder = pikkuFunc({\n  expose: true,\n  description: 'Cancel a pending order and restore stock.',\n  input: CancelOrderInput,\n  // Authorization is declared, not written. `scopes` is what the role\n  // entitles the caller to and is AND-ed; `permissions` is what is true of\n  // this particular row and is OR-ed across keys. Both run before the body,\n  // so the function below only ever sees a caller who is allowed to be there.\n  //\n  // The `support` role holds `orders:cancel` without owning the order, so it\n  // passes on the scope; a customer passes on ownership. Neither case needs a\n  // branch in the body.\n  scopes: ['orders:cancel'],\n  permissions: {\n    owner: isOrderOwner,\n  },\n  // `node` describes this function as a step someone can drop into a visual\n  // flow: what to call it, where it files, and whether it starts a flow\n  // ('trigger'), continues one ('action') or ends it ('end'). Without it the\n  // function still works everywhere else — it just does not appear as a node.\n  node: {\n    displayName: 'Cancel Order',\n    category: 'Orders',\n    type: 'action',\n  },\n  func: async ({ kysely, queueService }, { orderId }, { session }) => {\n    const order = await kysely\n      .selectFrom('order')\n      .select(['orderId', 'userId', 'status'])\n      .where('orderId', '=', orderId)\n      .executeTakeFirst()\n\n    if (!order) throw new Error('Order not found')\n    if (!['pending', 'paid'].includes(order.status)) {\n      throw new Error(`Cannot cancel order in status: ${order.status}`)\n    }\n\n    // Restore stock\n    const items = await kysely\n      .selectFrom('orderItem')\n      .select(['itemId', 'quantity'])\n      .where('orderId', '=', orderId)\n      .execute()\n\n    const now = new Date().toISOString()\n    for (const item of items) {\n      await kysely\n        .updateTable('item')\n        .set((eb) => ({\n          stock: eb('stock', '+', item.quantity),\n          updatedAt: now,\n        }))\n        .where('itemId', '=', item.itemId)\n        .execute()\n    }\n\n    await kysely\n      .updateTable('order')\n      .set({ status: 'cancelled', updatedAt: now })\n      .where('orderId', '=', orderId)\n      .execute()\n\n    await queueService.add('audit-event', {\n      entityType: 'order',\n      entityId: orderId,\n      action: 'cancelled',\n      actorId: session.userId,\n    })\n  },\n})",
   "channelLifecycle": "export const onConnect = pikkuChannelConnectionFunc(\n  async ({ logger }, _, { channel }) => {\n    logger.info({ event: 'ws_connected', channelId: channel.channelId })\n  }\n)\n\nexport const onDisconnect = pikkuChannelDisconnectionFunc(\n  async ({ logger }, _, { channel }) => {\n    logger.info({ event: 'ws_disconnected', channelId: channel.channelId })\n  }\n)",
   "channelMiddleware": "export const traceAgentStream = pikkuChannelMiddleware<any, AgentStreamEvent>(\n  async ({ logger }, event, next) => {\n    logger.debug({ event: 'agent_stream', type: event.type })\n    await next(event)\n  }\n)",