@pikku/cli 0.12.133 → 0.12.136

package/dist/src/fabric/functions/deploy.function.js

@@ -2,7 +2,7 @@ import { z } from 'zod';
 import { pikkuSessionlessFunc } from '../../../.pikku/function/index.js';
 import { resolveApiContext } from '../lib/config.js';
 import { getFabricRPC } from '../lib/http.js';
-import { assertNamedBranchDeploySafety, resolveRef } from '../lib/git.js';
+import { assertNamedBranchDeploySafety, currentBranch, resolveRef, } from '../lib/git.js';
 import { promptConfirm } from '../lib/prompt.js';
 import { added, changed, removed, dim, table } from '../lib/output.js';
 import { blockedReason, blockedSummary, missingConfigHints, changesAreEmpty, classifyStatus, describeDeployment, destructiveMigrations, isApprovable, readDeploymentStatus, readWorkers, reconcileDeployedRef, stateLabel, waitForDeployment, } from '../lib/deployment.js';
@@ -12,7 +12,7 @@ export const FabricDeployInput = z.object({
     production: z.boolean().optional(),
     ref: z.string().optional(),
     deploymentId: z.string().optional(),
-    sync: z.boolean().optional(),
+    detach: z.boolean().optional(),
     autoApprove: z.boolean().optional(),
     allowDestructive: z.boolean().optional(),
     timeout: z.number().optional(),
@@ -23,15 +23,15 @@ export const FabricDeployValidatedInput = FabricDeployInput.superRefine((value,
         if (value.branch || value.production) {
             ctx.addIssue({
                 code: z.ZodIssueCode.custom,
-                message: '--deployment-id already names its target — drop --branch/--production.',
+                message: '--deployment-id already names its target — drop the branch/--production.',
             });
         }
         return;
     }
-    if (!!value.branch === !!value.production) {
+    if (value.branch && value.production) {
         ctx.addIssue({
             code: z.ZodIssueCode.custom,
-            message: 'Pass exactly one of --branch or --production.',
+            message: 'Pass a branch or --production, not both — --production is always main.',
         });
     }
 });
@@ -96,16 +96,25 @@ async function prepDeploy({ branch, production, ref }) {
     if (!ctx.projectId) {
         throw new Error('No fabric project linked. Run `pikku fabric link` first.');
     }
-    // Guarded rather than asserted: the schema-level refine is bypassed whenever
-    // the function is called outside CLI arg parsing, and `branch!` turned that
-    // into "local branch undefined does not exist" — an error that names nothing.
-    if (!production && !branch) {
-        throw new Error('Pass exactly one of --branch or --production.');
-    }
-    const targetBranch = production ? 'main' : branch;
+    // With no target named, deploy the branch that is checked out — the common
+    // case, and the one worth not making people type twice. It is only safe to
+    // infer because `assertNamedBranchDeploySafety` below refuses any branch that
+    // is missing an upstream or out of sync with it, so an inferred target cannot
+    // ship something that was never pushed.
+    const inferred = !production && !branch;
+    const targetBranch = production
+        ? 'main'
+        : (branch ?? branchFromHead(await currentBranch()));
     const safety = await assertNamedBranchDeploySafety(targetBranch);
     const resolved = ref ? ((await resolveRef(ref)) ?? ref) : safety.headSha;
-    return { ctx, projectId: ctx.projectId, targetBranch, resolved, safety };
+    return {
+        ctx,
+        projectId: ctx.projectId,
+        targetBranch,
+        resolved,
+        safety,
+        inferred,
+    };
 }
 async function prepAttach() {
     const ctx = await resolveApiContext();
@@ -124,6 +133,20 @@ const EXIT_BY_OUTCOME = {
     blocked: 3,
     timeout: 4,
 };
+/**
+ * The branch to deploy when none was named, read off the checkout.
+ *
+ * `git rev-parse --abbrev-ref HEAD` answers the literal string `HEAD` on a
+ * detached checkout, which is not a branch and would be reported downstream as
+ * a branch that does not exist locally. Naming the real problem here is the
+ * difference between "check out a branch" and a puzzle.
+ */
+export const branchFromHead = (head) => {
+    if (head === 'HEAD' || head === '') {
+        throw new Error('Deployment blocked: HEAD is detached, so there is no current branch to deploy.\nCheck out a branch, or name the target: `pikku fabric deploy apply <branch>`.');
+    }
+    return head;
+};
 export const FabricDeployApply = pikkuSessionlessFunc({
     description: 'Build + deploy a named branch or production (main), or attach to an existing deployment.',
     input: FabricDeployValidatedInput,
@@ -137,7 +160,7 @@ export const FabricDeployApply = pikkuSessionlessFunc({
             throw new Error('--timeout must be a positive number of seconds.');
         }
         if (input.deploymentId && (input.branch || input.production)) {
-            throw new Error('--deployment-id already names its target — drop --branch/--production.');
+            throw new Error('--deployment-id already names its target — drop the branch/--production.');
         }
         const attaching = Boolean(input.deploymentId);
         let projectId;
@@ -158,11 +181,17 @@ export const FabricDeployApply = pikkuSessionlessFunc({
             emit({ event: 'attached', deploymentId, status: current.status });
         }
         else {
-            const { ctx, projectId: id, targetBranch, resolved, safety, } = await prepDeploy(input);
+            const { ctx, projectId: id, targetBranch, resolved, safety, inferred, } = await prepDeploy(input);
             projectId = id;
             branch = targetBranch;
             ref = resolved;
             rpc = getFabricRPC({ apiUrl: ctx.apiUrl, token: ctx.token });
+            // An inferred target is said out loud before anything is built. Under -y
+            // there is no confirmation prompt to name it, and a deploy that never
+            // told you which branch it picked is the one that ships the wrong branch.
+            if (inferred && !input.json) {
+                console.log(dim(`Deploying the current branch: ${targetBranch}`));
+            }
             if (!input.autoApprove) {
                 const target = `${branch} @ ${resolved.slice(0, 8)}`;
                 if (!process.stdin.isTTY) {
@@ -202,7 +231,7 @@ export const FabricDeployApply = pikkuSessionlessFunc({
             ...(stageId ? { stageId } : {}),
             ...(runId ? { runId } : {}),
         };
-        if (!input.sync && !attaching) {
+        if (input.detach && !attaching) {
             return { ...base, outcome: 'queued' };
         }
         let approvalWithheld;
@@ -225,7 +254,7 @@ export const FabricDeployApply = pikkuSessionlessFunc({
                 : '';
             return promptConfirm(`Plan for ${branch ?? deploymentId} is ready to publish (${stateLabel(status.status, status.statusReason)}).${warning} Approve?`);
         };
-        if (!input.sync) {
+        if (input.detach) {
             const status = await readDeploymentStatus(rpc, deploymentId);
             const klass = classifyStatus(status.status);
             const outcome = klass === 'in_flight' ? 'queued' : klass;
@@ -324,7 +353,7 @@ const missingLines = (label, entries) => {
         ...entries.map((e) => `    ${e.name}${e.displayName ? dim(` (${e.displayName})`) : ''}${e.docsUrl ? dim(` — ${e.docsUrl}`) : ''}`),
     ];
 };
-const reattachHint = (deploymentId) => dim(`Re-attach with \`pikku fabric deploy apply --deployment-id ${deploymentId} --sync\`.`);
+const reattachHint = (deploymentId) => dim(`Re-attach with \`pikku fabric deploy apply --deployment-id ${deploymentId}\`.`);
 export const renderDeployApply = (_s, result) => {
     const { outcome, branch, ref, deploymentId, status, statusReason, changes, workers, url, elapsedMs, timeoutSeconds, approved, } = result;
     const where = branch ?? 'deployment';
@@ -363,10 +392,10 @@ export const renderDeployApply = (_s, result) => {
             console.log(line);
         if (result.approvalWithheld === 'destructive_migrations') {
             console.log(dim('The plan drops or rewrites data. Nothing was published — review the migrations above, then re-run with `--allow-destructive` to accept them.'));
-            console.log(dim(`\`pikku fabric deploy apply --deployment-id ${deploymentId} --sync --auto-approve --allow-destructive\``));
+            console.log(dim(`\`pikku fabric deploy apply --deployment-id ${deploymentId} -y --allow-destructive\``));
         }
         else if (isApprovable(reason) && !approved) {
-            console.log(dim(`Approve it with \`pikku fabric deploy apply --deployment-id ${deploymentId} --sync --auto-approve\`.`));
+            console.log(dim(`Approve it with \`pikku fabric deploy apply --deployment-id ${deploymentId} -y\`.`));
         }
         else if (reason === 'needs_config') {
             for (const hint of missingConfigHints(result.missingSecrets, result.missingVariables)) {

package/dist/src/fabric/lib/stage.js

@@ -23,7 +23,7 @@ export async function resolveStage(rpc, projectId, branch) {
             return { stageId: only.stageId, branch: only.branch };
         }
         throw new Error(stages.length === 0
-            ? 'No stages deployed for this project yet — run `pikku fabric deploy apply --branch <branch>` first.'
+            ? 'No stages deployed for this project yet — run `pikku fabric deploy apply <branch>` first.'
             : `--branch is required — this project has ${stages.length} stages: ${known.join(', ')}`);
     }
     const stage = stages.find((s) => s.branch === branch);

package/dist/src/functions/validate/shared-checks.js

@@ -118,10 +118,12 @@ export const staticStubbedImports = (code) => {
                 .every((binding) => /^type\s/.test(binding.trim()))) {
             continue;
         }
-        for (const [service, patterns] of Object.entries(SERVICE_MODULE_MAP)) {
-            if (patterns.some((pattern) => pattern.test(specifier))) {
-                found.push({ module: specifier, service });
-            }
+        // Services share pattern arrays — the AI SDKs gate on both `agentRunner`
+        // and `ai` — so a per-service push reports one import as many findings.
+        // The remedy is the same whichever service names it: one entry per import.
+        const service = Object.entries(SERVICE_MODULE_MAP).find(([, patterns]) => patterns.some((pattern) => pattern.test(specifier)))?.[0];
+        if (service) {
+            found.push({ module: specifier, service });
         }
     }
     return found;

package/dist/src/functions/workflows/all.workflow.js

@@ -20,11 +20,6 @@ const scaffoldFiles = (config) => {
             file: config.consoleFunctionsFile,
             generator: 'pikkuConsoleFunctions',
         });
-    if (config.scaffold?.userAdmin && config.userAdminFunctionsFile)
-        files.push({
-            file: config.userAdminFunctionsFile,
-            generator: 'pikkuUserAdminFunctions',
-        });
     if (config.scaffold?.virtualUser && config.virtualUserFunctionsFile)
         files.push({
             file: config.virtualUserFunctionsFile,
@@ -209,7 +204,6 @@ export const allWorkflow = pikkuWorkflowComplexFunc({
             workflow.do('Graph wirings', 'pikkuGraphWirings', null),
             workflow.do('Public RPC', 'pikkuPublicRPC', null),
             workflow.do('Console functions', 'pikkuConsoleFunctions', null),
-            workflow.do('User admin functions', 'pikkuUserAdminFunctions', null),
             workflow.do('Virtual user functions', 'pikkuVirtualUserFunctions', null),
             workflow.do('Events scaffold', 'pikkuEventsScaffold', null),
             workflow.do('Emails', 'pikkuEmails', null),

package/dist/src/utils/pikku-cli-config.js

@@ -365,6 +365,7 @@ const _getPikkuCLIConfig = async (logger, configFile = undefined, requiredFields
         const resolvedScaffoldDir = isAbsolute(scaffoldDir)
             ? scaffoldDir
             : join(result.rootDir, scaffoldDir);
+        result.resolvedScaffoldDir = resolvedScaffoldDir;
         // Per-unit deploy codegen re-runs the whole of `pikku all` with `--outDir`
         // pointed at one unit's `.pikku`. It needs the `.pikku` artifacts and
         // nothing else — the scaffold is project source, and regenerating it under
@@ -385,7 +386,6 @@ const _getPikkuCLIConfig = async (logger, configFile = undefined, requiredFields
             agent: 'publicAgentFile',
             console: 'consoleFunctionsFile',
             scenarios: 'scenariosFunctionsFile',
-            userAdmin: 'userAdminFunctionsFile',
             virtualUser: 'virtualUserFunctionsFile',
             workflow: 'workflowRoutesFile',
             events: 'eventsChannelFile',
@@ -439,12 +439,6 @@ const _getPikkuCLIConfig = async (logger, configFile = undefined, requiredFields
         if (result.scaffold?.console && !result.consoleSchemasFile) {
             result.consoleSchemasFile = join(resolvedScaffoldDir, 'console', 'console.schemas.gen.ts');
         }
-        if (result.scaffold?.userAdmin && !result.userAdminFunctionsFile) {
-            result.userAdminFunctionsFile = join(resolvedScaffoldDir, 'admin', 'user-admin.gen.ts');
-        }
-        if (result.scaffold?.userAdmin && !result.userAdminSchemasFile) {
-            result.userAdminSchemasFile = join(resolvedScaffoldDir, 'admin', 'user-admin.schemas.gen.ts');
-        }
         if (result.scaffold?.virtualUser && !result.virtualUserFunctionsFile) {
             result.virtualUserFunctionsFile = join(resolvedScaffoldDir, 'virtual-user', 'virtual-user.gen.ts');
         }

package/dist/src/utils/remove-legacy-scaffold-file.d.ts

@@ -10,6 +10,11 @@ export declare const removeLegacyScaffoldFile: (file: string) => Promise<void>;
  * an unregenerated project is already safe, but the file is then dead code that
  * still imports `zod`, so it goes.
  *
+ * A leftover user-admin scaffold still registers `pikkuAdminListUsers` and its
+ * five siblings, so a project installing `@pikku/addon-admin` would answer to
+ * two spellings of the same six calls. Named by path: there is no longer a
+ * `scaffold.userAdmin` field to derive one from.
+ *
  * Unlike `pruneLegacyScaffoldFiles`, which removes a file from a path pikku used
  * to write to, this removes a file pikku no longer writes at all.
  */

package/dist/src/utils/remove-legacy-scaffold-file.js

@@ -19,8 +19,6 @@ const scaffoldFiles = (config) => {
         config.consoleSchemasFile,
         config.scenariosFunctionsFile,
         config.scenariosSchemasFile,
-        config.userAdminFunctionsFile,
-        config.userAdminSchemasFile,
         config.eventsChannelFile,
         config.eventsSchemasFile,
         config.authFile,
@@ -44,6 +42,11 @@ export const removeLegacyScaffoldFile = async (file) => {
  * an unregenerated project is already safe, but the file is then dead code that
  * still imports `zod`, so it goes.
  *
+ * A leftover user-admin scaffold still registers `pikkuAdminListUsers` and its
+ * five siblings, so a project installing `@pikku/addon-admin` would answer to
+ * two spellings of the same six calls. Named by path: there is no longer a
+ * `scaffold.userAdmin` field to derive one from.
+ *
  * Unlike `pruneLegacyScaffoldFiles`, which removes a file from a path pikku used
  * to write to, this removes a file pikku no longer writes at all.
  */
@@ -51,6 +54,12 @@ export const removeRetiredScaffoldFiles = async (config) => {
     for (const file of [
         config.scenariosFunctionsFile,
         config.scenariosSchemasFile,
+        ...(config.resolvedScaffoldDir
+            ? [
+                join(config.resolvedScaffoldDir, 'admin', 'user-admin.gen.ts'),
+                join(config.resolvedScaffoldDir, 'admin', 'user-admin.schemas.gen.ts'),
+            ]
+            : []),
     ]) {
         if (file && existsSync(file)) {
             await rm(file, { force: true });

package/dist/tsconfig.tsbuildinfo

@@ -1 +1 @@
-{"root":["../bin/pikku.ts","../src/cli.wiring.ts","../src/services.ts","../src/deploy/build-pipeline.ts","../src/deploy/frontend-assets.ts","../src/deploy/server-entry.ts","../src/deploy/analyzer/analyzer.ts","../src/deploy/analyzer/index.ts","../src/deploy/bundler/bun-bundler.ts","../src/deploy/bundler/bundler.interface.ts","../src/deploy/bundler/bundler.ts","../src/deploy/bundler/dep-extractor.ts","../src/deploy/bundler/index.ts","../src/deploy/bundler/node-bundler.ts","../src/deploy/bundler/service-module-map.ts","../src/deploy/bundler/types.ts","../src/deploy/codegen/index.ts","../src/deploy/codegen/per-unit-codegen.ts","../src/deploy/plan/executor.ts","../src/deploy/plan/formatter.ts","../src/deploy/plan/index.ts","../src/deploy/plan/planner.ts","../src/deploy/plan/provider.ts","../src/deploy/plan/types.ts","../src/fabric/fabric-commands.ts","../src/fabric/functions/add.function.ts","../src/fabric/functions/addon-verify.function.ts","../src/fabric/functions/db-schema.function.ts","../src/fabric/functions/deploy-list.function.ts","../src/fabric/functions/deploy-units.function.ts","../src/fabric/functions/deploy.function.ts","../src/fabric/functions/domains-add.function.ts","../src/fabric/functions/domains-list.function.ts","../src/fabric/functions/domains-remove.function.ts","../src/fabric/functions/errors.function.ts","../src/fabric/functions/findings-clear.function.ts","../src/fabric/functions/findings-flush.function.ts","../src/fabric/functions/findings-list.function.ts","../src/fabric/functions/init.function.ts","../src/fabric/functions/link.function.ts","../src/fabric/functions/llm-key.function.ts","../src/fabric/functions/login.function.ts","../src/fabric/functions/logs.function.ts","../src/fabric/functions/metrics.function.ts","../src/fabric/functions/projects-list.function.ts","../src/fabric/functions/publish.function.ts","../src/fabric/functions/report.function.ts","../src/fabric/functions/rollback.function.ts","../src/fabric/functions/secrets-delete.function.ts","../src/fabric/functions/secrets-list.function.ts","../src/fabric/functions/secrets-rotate.function.ts","../src/fabric/functions/secrets-set.function.ts","../src/fabric/functions/smoke.function.ts","../src/fabric/functions/status.function.ts","../src/fabric/functions/trace.function.ts","../src/fabric/functions/validate.function.ts","../src/fabric/functions/variables-get.function.ts","../src/fabric/functions/variables-set.function.ts","../src/fabric/lib/blank-comments.ts","../src/fabric/lib/blank-scenario-meta.ts","../src/fabric/lib/config.ts","../src/fabric/lib/console-url.ts","../src/fabric/lib/deployment.ts","../src/fabric/lib/finding-spool.ts","../src/fabric/lib/finding.ts","../src/fabric/lib/frontend-typecheck.ts","../src/fabric/lib/git.ts","../src/fabric/lib/http.ts","../src/fabric/lib/not-implemented.ts","../src/fabric/lib/output.ts","../src/fabric/lib/prompt.ts","../src/fabric/lib/report-environment.ts","../src/fabric/lib/sealed-box.ts","../src/fabric/lib/stage.ts","../src/fabric/lib/variable-value.ts","../src/fabric/sdk/http-map.gen.d.ts","../src/fabric/sdk/pikku-fetch.gen.ts","../src/fabric/sdk/pikku-rpc.gen.ts","../src/fabric/sdk/rpc-map.gen.d.ts","../src/functions/commands/all.ts","../src/functions/commands/audit.ts","../src/functions/commands/binary.ts","../src/functions/commands/bootstrap.ts","../src/functions/commands/bun-coverage-loader.ts","../src/functions/commands/db-audit.ts","../src/functions/commands/db-baseline.ts","../src/functions/commands/db-check.ts","../src/functions/commands/db-codegen.ts","../src/functions/commands/db-export.ts","../src/functions/commands/db-generate.ts","../src/functions/commands/db-migrate.ts","../src/functions/commands/db-reset.ts","../src/functions/commands/db-shared.ts","../src/functions/commands/deploy-apply.ts","../src/functions/commands/deploy-info.ts","../src/functions/commands/deploy-plan.ts","../src/functions/commands/dev-agent-runner.ts","../src/functions/commands/dev.ts","../src/functions/commands/dist.ts","../src/functions/commands/doc.ts","../src/functions/commands/emails-init.ts","../src/functions/commands/enable.ts","../src/functions/commands/environment.ts","../src/functions/commands/import-n8n.ts","../src/functions/commands/info.ts","../src/functions/commands/knowledge-index.ts","../src/functions/commands/knowledge-plan.ts","../src/functions/commands/knowledge-validate.ts","../src/functions/commands/load-user-project.ts","../src/functions/commands/login.ts","../src/functions/commands/meta.ts","../src/functions/commands/new-addon.ts","../src/functions/commands/new-function.ts","../src/functions/commands/new-middleware.ts","../src/functions/commands/new-permission.ts","../src/functions/commands/new-wiring.ts","../src/functions/commands/persona-sync.ts","../src/functions/commands/persona.ts","../src/functions/commands/pikku-command-bootstrap.ts","../src/functions/commands/pikku-command-summary.ts","../src/functions/commands/roles-audit.ts","../src/functions/commands/roles-prune.ts","../src/functions/commands/roles-shared.ts","../src/functions/commands/scenario-browser.ts","../src/functions/commands/scenario-formatter.ts","../src/functions/commands/scenario-ladder.ts","../src/functions/commands/scenario-plan.ts","../src/functions/commands/scenario.ts","../src/functions/commands/scopes-audit.ts","../src/functions/commands/scopes-prune.ts","../src/functions/commands/scopes-shared.ts","../src/functions/commands/semver-render.ts","../src/functions/commands/semver.ts","../src/functions/commands/serve-console.ts","../src/functions/commands/serve-frontend.ts","../src/functions/commands/serve.ts","../src/functions/commands/skills.ts","../src/functions/commands/start-coverage.ts","../src/functions/commands/update-render.ts","../src/functions/commands/update.ts","../src/functions/commands/validate.ts","../src/functions/commands/versions-check.ts","../src/functions/commands/versions-init.ts","../src/functions/commands/versions-update.ts","../src/functions/commands/virtual-user-formatter.ts","../src/functions/commands/watch.ts","../src/functions/db/annotation-parser.ts","../src/functions/db/better-auth-schema.ts","../src/functions/db/check-enums.ts","../src/functions/db/db-codegen.ts","../src/functions/db/db-introspector.ts","../src/functions/db/local-db.ts","../src/functions/db/migration-provenance.ts","../src/functions/db/zod-codegen.ts","../src/functions/db/postgres/pglite-kysely.ts","../src/functions/db/postgres/postgres-introspector.ts","../src/functions/db/sqlite/dev-seed.ts","../src/functions/db/sqlite/sqlite-introspector.ts","../src/functions/db/sqlite/sqlite-kysely.ts","../src/functions/knowledge/render.ts","../src/functions/knowledge/schemas.ts","../src/functions/runtimes/fetch/index.ts","../src/functions/runtimes/nextjs/pikku-command-nextjs.ts","../src/functions/runtimes/nextjs/serialize-nextjs-backend-worker-rpc-wrapper.ts","../src/functions/runtimes/nextjs/serialize-nextjs-backend-wrapper.ts","../src/functions/runtimes/nextjs/serialize-nextjs-http-wrapper.ts","../src/functions/runtimes/tanstack-start/pikku-command-tanstack-start.ts","../src/functions/runtimes/tanstack-start/serialize-tanstack-start-shim.ts","../src/functions/runtimes/websocket/pikku-command-websocket-typed.ts","../src/functions/runtimes/websocket/serialize-websocket-wrapper.ts","../src/functions/surface/build-surface-doc.ts","../src/functions/surface/collect-snippets.ts","../src/functions/surface/collect-surface-usage.ts","../src/functions/surface/collect-surface.ts","../src/functions/surface/generate-surface-doc.ts","../src/functions/surface/render-surface-doc.ts","../src/functions/surface/shipped-surface-doc.ts","../src/functions/surface/surface-doc.types.ts","../src/functions/surface/surface-editorial.ts","../src/functions/surface/write-surface-usage.ts","../src/functions/validate/addon-package-checks.ts","../src/functions/validate/auth-plugin-checks.ts","../src/functions/validate/bootstrap-checks.ts","../src/functions/validate/persona-checks.ts","../src/functions/validate/pikku-barrel-checks.ts","../src/functions/validate/scenario-file-checks.ts","../src/functions/validate/shared-checks.ts","../src/functions/validate/type-identity-checks.ts","../src/functions/validate/validate-registry.ts","../src/functions/validate/validate.ts","../src/functions/validate/websocket-deps-checks.ts","../src/functions/validate/workspace-exports-checks.ts","../src/functions/wirings/agent/pikku-command-agent-types.ts","../src/functions/wirings/agent/pikku-command-agent.ts","../src/functions/wirings/agent/pikku-command-public-agent.ts","../src/functions/wirings/agent/serialize-agent-map.ts","../src/functions/wirings/agent/serialize-agent-types.ts","../src/functions/wirings/agent/serialize-model-aliases.ts","../src/functions/wirings/agent/serialize-public-agent.ts","../src/functions/wirings/agent-scorer/pikku-command-agent-scorer.ts","../src/functions/wirings/agent-scorer/serialize-scorer-names.ts","../src/functions/wirings/auth/pikku-command-auth.ts","../src/functions/wirings/auth/serialize-auth-gen.ts","../src/functions/wirings/auth/serialize-auth-guards.ts","../src/functions/wirings/auth/serialize-auth-meta.ts","../src/functions/wirings/auth/serialize-auth-types.ts","../src/functions/wirings/channels/pikku-channels.ts","../src/functions/wirings/channels/pikku-command-channel-types.ts","../src/functions/wirings/channels/pikku-command-channels-map.ts","../src/functions/wirings/channels/pikku-command-channels.ts","../src/functions/wirings/channels/serialize-channel-types.ts","../src/functions/wirings/channels/serialize-typed-channel-map.ts","../src/functions/wirings/cli/pikku-command-cli-entry.ts","../src/functions/wirings/cli/pikku-command-cli-types.ts","../src/functions/wirings/cli/pikku-command-cli.ts","../src/functions/wirings/cli/serialize-channel-cli-client.ts","../src/functions/wirings/cli/serialize-channel-cli.ts","../src/functions/wirings/cli/serialize-cli-entrypoint-guard.ts","../src/functions/wirings/cli/serialize-cli-types.ts","../src/functions/wirings/cli/serialize-local-cli-bootstrap.ts","../src/functions/wirings/console/pikku-command-console-functions.ts","../src/functions/wirings/console/pikku-command-nodes-meta.ts","../src/functions/wirings/console/serialize-console-functions.ts","../src/functions/wirings/credentials/pikku-command-credentials.ts","../src/functions/wirings/credentials/serialize-credentials-types.ts","../src/functions/wirings/emails/pikku-command-emails.ts","../src/functions/wirings/emails/serialize-emails.ts","../src/functions/wirings/errors/pikku-command-error-types.ts","../src/functions/wirings/errors/serialize-error-types.ts","../src/functions/wirings/functions/pikku-command-addon-types.ts","../src/functions/wirings/functions/pikku-command-function-types-split.ts","../src/functions/wirings/functions/pikku-command-functions.ts","../src/functions/wirings/functions/pikku-command-leaf-indexes.ts","../src/functions/wirings/functions/pikku-command-services.ts","../src/functions/wirings/functions/schemas.ts","../src/functions/wirings/functions/serialize-addon-refs.ts","../src/functions/wirings/functions/serialize-addon-types.ts","../src/functions/wirings/functions/serialize-function-imports.ts","../src/functions/wirings/functions/serialize-function-types.ts","../src/functions/wirings/functions/serialize-leaf-index.ts","../src/functions/wirings/gateway/pikku-command-gateway-types.ts","../src/functions/wirings/gateway/pikku-command-gateway.ts","../src/functions/wirings/gateway/serialize-gateway-meta.ts","../src/functions/wirings/gateway/serialize-gateway-types.ts","../src/functions/wirings/graph/pikku-command-graph-wirings.ts","../src/functions/wirings/graph/serialize-graph-wirings.ts","../src/functions/wirings/http/pikku-command-http-map.ts","../src/functions/wirings/http/pikku-command-http-routes.ts","../src/functions/wirings/http/pikku-command-http-types.ts","../src/functions/wirings/http/pikku-command-openapi.ts","../src/functions/wirings/http/pikku-http-routes.ts","../src/functions/wirings/http/serialize-fetch-wrapper.ts","../src/functions/wirings/http/serialize-http-types.ts","../src/functions/wirings/http/serialize-typed-http-map.ts","../src/functions/wirings/mcp/pikku-command-mcp-json.ts","../src/functions/wirings/mcp/pikku-command-mcp-types.ts","../src/functions/wirings/mcp/pikku-command-mcp.ts","../src/functions/wirings/mcp/serialize-mcp-types.ts","../src/functions/wirings/middleware/pikku-command-middleware.ts","../src/functions/wirings/middleware/serialize-middleware-imports.ts","../src/functions/wirings/middleware/serialize-middleware-types.ts","../src/functions/wirings/package/pikku-command-package-types.ts","../src/functions/wirings/package/pikku-command-package.ts","../src/functions/wirings/package/serialize-package-types.ts","../src/functions/wirings/package/serialize-package.ts","../src/functions/wirings/permissions/pikku-command-permissions.ts","../src/functions/wirings/permissions/serialize-permissions-imports.ts","../src/functions/wirings/personas/personas-secrets-file.ts","../src/functions/wirings/personas/pikku-command-personas.ts","../src/functions/wirings/personas/serialize-personas-secrets.ts","../src/functions/wirings/personas/serialize-personas-types.ts","../src/functions/wirings/queue/pikku-command-queue-map.ts","../src/functions/wirings/queue/pikku-command-queue-service.ts","../src/functions/wirings/queue/pikku-command-queue-types.ts","../src/functions/wirings/queue/pikku-command-queue.ts","../src/functions/wirings/queue/pikku-queue-map.ts","../src/functions/wirings/queue/pikku-queue.ts","../src/functions/wirings/queue/serialize-queue-map.ts","../src/functions/wirings/queue/serialize-queue-meta.ts","../src/functions/wirings/queue/serialize-queue-types.ts","../src/functions/wirings/queue/serialize-queue-wrapper.ts","../src/functions/wirings/realtime/pikku-command-events-scaffold.ts","../src/functions/wirings/realtime/pikku-command-realtime.ts","../src/functions/wirings/realtime/serialize-events-scaffold.ts","../src/functions/wirings/realtime/serialize-realtime-client.ts","../src/functions/wirings/roles/pikku-command-roles.ts","../src/functions/wirings/roles/serialize-roles-types.ts","../src/functions/wirings/rpc/pikku-command-public-rpc.ts","../src/functions/wirings/rpc/pikku-command-react-query.ts","../src/functions/wirings/rpc/pikku-command-remote-rpc.ts","../src/functions/wirings/rpc/pikku-command-rpc-client.ts","../src/functions/wirings/rpc/pikku-command-rpc-map.ts","../src/functions/wirings/rpc/pikku-command-rpc.ts","../src/functions/wirings/rpc/serialize-public-rpc.ts","../src/functions/wirings/rpc/serialize-react-query-hooks.ts","../src/functions/wirings/rpc/serialize-remote-rpc.ts","../src/functions/wirings/rpc/serialize-rpc-wrapper.ts","../src/functions/wirings/rpc/serialize-typed-rpc-map.ts","../src/functions/wirings/scenarios/register-scenario-instrumentation.ts","../src/functions/wirings/scenarios/scenario-partition.ts","../src/functions/wirings/scenarios/scenario-schema-partition.ts","../src/functions/wirings/scenarios/serialize-feature-meta.ts","../src/functions/wirings/scenarios/serialize-scenario-meta.ts","../src/functions/wirings/scenarios/serialize-scenario-registration.ts","../src/functions/wirings/scheduler/pikku-command-scheduler-types.ts","../src/functions/wirings/scheduler/pikku-command-scheduler.ts","../src/functions/wirings/scheduler/serialize-scheduler-meta.ts","../src/functions/wirings/scheduler/serialize-scheduler-types.ts","../src/functions/wirings/scopes/pikku-command-scopes.ts","../src/functions/wirings/scopes/serialize-scopes-client.ts","../src/functions/wirings/scopes/serialize-scopes-types.ts","../src/functions/wirings/secrets/pikku-command-secrets.ts","../src/functions/wirings/secrets/serialize-secrets-types.ts","../src/functions/wirings/setup/serialize-setup-types.ts","../src/functions/wirings/triggers/pikku-command-trigger-types.ts","../src/functions/wirings/triggers/pikku-command-trigger.ts","../src/functions/wirings/triggers/serialize-trigger-meta.ts","../src/functions/wirings/triggers/serialize-trigger-types.ts","../src/functions/wirings/user-admin/pikku-command-user-admin-functions.ts","../src/functions/wirings/user-admin/serialize-user-admin-functions.ts","../src/functions/wirings/variables/pikku-command-variables.ts","../src/functions/wirings/variables/serialize-variables-types.ts","../src/functions/wirings/virtual-user/pikku-command-virtual-user-functions.ts","../src/functions/wirings/virtual-user/serialize-virtual-user-functions.ts","../src/functions/wirings/webhook/pikku-command-webhook.ts","../src/functions/wirings/webhook/serialize-webhook.ts","../src/functions/wirings/workflow/pikku-command-workflow-routes.ts","../src/functions/wirings/workflow/pikku-command-workflow.ts","../src/functions/wirings/workflow/serialize-personas.ts","../src/functions/wirings/workflow/serialize-scenario-step-map.ts","../src/functions/wirings/workflow/serialize-scenario-types.ts","../src/functions/wirings/workflow/serialize-workflow-bootstrap-map.ts","../src/functions/wirings/workflow/serialize-workflow-map.ts","../src/functions/wirings/workflow/serialize-workflow-meta.ts","../src/functions/wirings/workflow/serialize-workflow-registration.ts","../src/functions/wirings/workflow/serialize-workflow-routes.ts","../src/functions/wirings/workflow/serialize-workflow-types.ts","../src/functions/workflows/all.workflow.ts","../src/middleware/log-command-info-and-time.ts","../src/server/actor-sign-in.ts","../src/server/bun-server-runner.ts","../src/server/content-signing-jwt.ts","../src/server/dev-server-runner.interface.ts","../src/server/node-server-runner.ts","../src/server/server-ready.ts","../src/server/spawn-dev-server.ts","../src/services/cli-logger-forwarder.service.ts","../src/services/cli-logger.service.ts","../src/utils/assert-single-core-version.ts","../src/utils/check-required-types.ts","../src/utils/cli-session.ts","../src/utils/command-summary.ts","../src/utils/contract-versions.ts","../src/utils/detect-better-auth.ts","../src/utils/device-auth.ts","../src/utils/file-import-path.ts","../src/utils/file-imports-serializer.ts","../src/utils/file-writer.ts","../src/utils/frontend.ts","../src/utils/generate-bootstrap-file.ts","../src/utils/get-cli-version.ts","../src/utils/is-deploy-codegen.ts","../src/utils/leaf-import-path.ts","../src/utils/meta-diff.ts","../src/utils/model-alias-override.ts","../src/utils/parse-cli-filters.ts","../src/utils/persona-credentials.ts","../src/utils/pikku-cli-config-error.ts","../src/utils/pikku-cli-config.ts","../src/utils/pikku-files-and-methods.ts","../src/utils/precise-coverage-map.ts","../src/utils/remove-legacy-scaffold-file.ts","../src/utils/resolve-from-project.ts","../src/utils/resolve-personas.ts","../src/utils/resolve-scaffold-feature.ts","../src/utils/schema-diff.ts","../src/utils/serialize-import-map.ts","../src/utils/serialize-meta-ts.ts","../src/utils/serialize-schemas.ts","../src/utils/strip-verbose-meta.ts","../src/utils/surface-diff.ts","../src/utils/surface.ts","../src/utils/tsc-check.ts","../.pikku/pikku-bootstrap-scenarios.gen.ts","../.pikku/pikku-bootstrap.gen.ts","../.pikku/pikku-services.gen.ts","../.pikku/addon/index.ts","../.pikku/addon/pikku-addon-types.gen.ts","../.pikku/agent/index.ts","../.pikku/agent/pikku-agent-map.gen.d.ts","../.pikku/agent/pikku-agent-types.gen.ts","../.pikku/agent/pikku-model-aliases.gen.ts","../.pikku/agent/pikku-scorer-names.gen.d.ts","../.pikku/auth/auth.types.ts","../.pikku/auth/index.ts","../.pikku/auth/pikku-auth-types.gen.ts","../.pikku/channel/index.ts","../.pikku/channel/pikku-channel-types.gen.ts","../.pikku/cli/index.ts","../.pikku/cli/pikku-cli-channel.ts","../.pikku/cli/pikku-cli-client.gen.ts","../.pikku/cli/pikku-cli-contracts-meta.gen.ts","../.pikku/cli/pikku-cli-types.gen.ts","../.pikku/cli/pikku-cli-wirings-meta.gen.ts","../.pikku/cli/pikku-cli-wirings.gen.ts","../.pikku/cli/pikku-cli.gen.ts","../.pikku/error/index.ts","../.pikku/error/pikku-error-types.gen.ts","../.pikku/function/index.ts","../.pikku/function/pikku-function-types.gen.ts","../.pikku/function/pikku-functions-meta.gen.ts","../.pikku/function/pikku-functions.gen.ts","../.pikku/gateway/index.ts","../.pikku/gateway/pikku-gateway-types.gen.ts","../.pikku/http/index.ts","../.pikku/http/pikku-http-types.gen.ts","../.pikku/mcp/index.ts","../.pikku/mcp/pikku-mcp-types.gen.ts","../.pikku/middleware/index.ts","../.pikku/middleware/pikku-middleware-types.gen.ts","../.pikku/node/pikku-node-types.gen.ts","../.pikku/queue/index.ts","../.pikku/queue/pikku-queue-types.gen.ts","../.pikku/queue/pikku-queue-workers-wirings-map.gen.d.ts","../.pikku/queue/pikku-queue-workers-wirings-meta.gen.ts","../.pikku/queue/pikku-queue-workers-wirings.gen.ts","../.pikku/rpc/pikku-rpc-wirings-map.gen.d.ts","../.pikku/rpc/pikku-rpc-wirings-map.internal.gen.d.ts","../.pikku/rpc/pikku-rpc-wirings-map.remote.gen.d.ts","../.pikku/rpc/pikku-rpc-wirings-meta.internal.gen.ts","../.pikku/scenarios/index.ts","../.pikku/scenarios/pikku-personas.gen.ts","../.pikku/scenarios/pikku-scenario-functions-meta.gen.ts","../.pikku/scenarios/pikku-scenario-functions.gen.ts","../.pikku/scenarios/pikku-scenario-types.gen.ts","../.pikku/scenarios/pikku-scenario-wirings-meta.gen.ts","../.pikku/scenarios/pikku-scenario-wirings.gen.ts","../.pikku/scenarios/schemas/register.gen.ts","../.pikku/scheduler/index.ts","../.pikku/scheduler/pikku-scheduler-types.gen.ts","../.pikku/schemas/register.gen.ts","../.pikku/scopes/index.ts","../.pikku/scopes/pikku-personas.gen.ts","../.pikku/scopes/pikku-roles.gen.ts","../.pikku/scopes/pikku-scope-types.gen.ts","../.pikku/scopes/pikku-scopes.gen.ts","../.pikku/secrets/index.ts","../.pikku/secrets/pikku-secret-types.gen.ts","../.pikku/secrets/pikku-secrets.gen.ts","../.pikku/services/pikku-meta-service.gen.ts","../.pikku/setup/index.ts","../.pikku/setup/pikku-setup-types.gen.ts","../.pikku/trigger/index.ts","../.pikku/trigger/pikku-trigger-types.gen.ts","../.pikku/variables/index.ts","../.pikku/variables/pikku-variable-types.gen.ts","../.pikku/variables/pikku-variables.gen.ts","../.pikku/workflow/index.ts","../.pikku/workflow/pikku-scenario-step-map.gen.d.ts","../.pikku/workflow/pikku-workflow-map.gen.d.ts","../.pikku/workflow/pikku-workflow-types.gen.ts","../.pikku/workflow/pikku-workflow-wirings-meta.gen.ts","../.pikku/workflow/pikku-workflow-wirings.gen.ts","../types/application-types.d.ts","../types/bun-sqlite.d.ts","../types/config.d.ts"],"version":"6.0.3"}
+{"root":["../bin/pikku.ts","../src/cli.wiring.ts","../src/services.ts","../src/deploy/build-pipeline.ts","../src/deploy/frontend-assets.ts","../src/deploy/server-entry.ts","../src/deploy/analyzer/analyzer.ts","../src/deploy/analyzer/index.ts","../src/deploy/bundler/bun-bundler.ts","../src/deploy/bundler/bundler.interface.ts","../src/deploy/bundler/bundler.ts","../src/deploy/bundler/dep-extractor.ts","../src/deploy/bundler/index.ts","../src/deploy/bundler/node-bundler.ts","../src/deploy/bundler/service-module-map.ts","../src/deploy/bundler/types.ts","../src/deploy/codegen/index.ts","../src/deploy/codegen/per-unit-codegen.ts","../src/deploy/plan/executor.ts","../src/deploy/plan/formatter.ts","../src/deploy/plan/index.ts","../src/deploy/plan/planner.ts","../src/deploy/plan/provider.ts","../src/deploy/plan/types.ts","../src/fabric/fabric-commands.ts","../src/fabric/functions/add.function.ts","../src/fabric/functions/addon-verify.function.ts","../src/fabric/functions/db-schema.function.ts","../src/fabric/functions/deploy-list.function.ts","../src/fabric/functions/deploy-units.function.ts","../src/fabric/functions/deploy.function.ts","../src/fabric/functions/domains-add.function.ts","../src/fabric/functions/domains-list.function.ts","../src/fabric/functions/domains-remove.function.ts","../src/fabric/functions/errors.function.ts","../src/fabric/functions/findings-clear.function.ts","../src/fabric/functions/findings-flush.function.ts","../src/fabric/functions/findings-list.function.ts","../src/fabric/functions/init.function.ts","../src/fabric/functions/link.function.ts","../src/fabric/functions/llm-key.function.ts","../src/fabric/functions/login.function.ts","../src/fabric/functions/logs.function.ts","../src/fabric/functions/metrics.function.ts","../src/fabric/functions/projects-list.function.ts","../src/fabric/functions/publish.function.ts","../src/fabric/functions/report.function.ts","../src/fabric/functions/rollback.function.ts","../src/fabric/functions/secrets-delete.function.ts","../src/fabric/functions/secrets-list.function.ts","../src/fabric/functions/secrets-rotate.function.ts","../src/fabric/functions/secrets-set.function.ts","../src/fabric/functions/smoke.function.ts","../src/fabric/functions/status.function.ts","../src/fabric/functions/trace.function.ts","../src/fabric/functions/validate.function.ts","../src/fabric/functions/variables-get.function.ts","../src/fabric/functions/variables-set.function.ts","../src/fabric/lib/blank-comments.ts","../src/fabric/lib/blank-scenario-meta.ts","../src/fabric/lib/config.ts","../src/fabric/lib/console-url.ts","../src/fabric/lib/deployment.ts","../src/fabric/lib/finding-spool.ts","../src/fabric/lib/finding.ts","../src/fabric/lib/frontend-typecheck.ts","../src/fabric/lib/git.ts","../src/fabric/lib/http.ts","../src/fabric/lib/not-implemented.ts","../src/fabric/lib/output.ts","../src/fabric/lib/prompt.ts","../src/fabric/lib/report-environment.ts","../src/fabric/lib/sealed-box.ts","../src/fabric/lib/stage.ts","../src/fabric/lib/variable-value.ts","../src/fabric/sdk/http-map.gen.d.ts","../src/fabric/sdk/pikku-fetch.gen.ts","../src/fabric/sdk/pikku-rpc.gen.ts","../src/fabric/sdk/rpc-map.gen.d.ts","../src/functions/commands/all.ts","../src/functions/commands/audit.ts","../src/functions/commands/binary.ts","../src/functions/commands/bootstrap.ts","../src/functions/commands/bun-coverage-loader.ts","../src/functions/commands/db-audit.ts","../src/functions/commands/db-baseline.ts","../src/functions/commands/db-check.ts","../src/functions/commands/db-codegen.ts","../src/functions/commands/db-export.ts","../src/functions/commands/db-generate.ts","../src/functions/commands/db-migrate.ts","../src/functions/commands/db-reset.ts","../src/functions/commands/db-shared.ts","../src/functions/commands/deploy-apply.ts","../src/functions/commands/deploy-info.ts","../src/functions/commands/deploy-plan.ts","../src/functions/commands/dev-agent-runner.ts","../src/functions/commands/dev.ts","../src/functions/commands/dist.ts","../src/functions/commands/doc.ts","../src/functions/commands/emails-init.ts","../src/functions/commands/enable.ts","../src/functions/commands/environment.ts","../src/functions/commands/import-n8n.ts","../src/functions/commands/info.ts","../src/functions/commands/knowledge-index.ts","../src/functions/commands/knowledge-plan.ts","../src/functions/commands/knowledge-validate.ts","../src/functions/commands/load-user-project.ts","../src/functions/commands/login.ts","../src/functions/commands/meta.ts","../src/functions/commands/new-addon.ts","../src/functions/commands/new-function.ts","../src/functions/commands/new-middleware.ts","../src/functions/commands/new-permission.ts","../src/functions/commands/new-wiring.ts","../src/functions/commands/persona-sync.ts","../src/functions/commands/persona.ts","../src/functions/commands/pikku-command-bootstrap.ts","../src/functions/commands/pikku-command-summary.ts","../src/functions/commands/roles-audit.ts","../src/functions/commands/roles-prune.ts","../src/functions/commands/roles-shared.ts","../src/functions/commands/scenario-browser.ts","../src/functions/commands/scenario-formatter.ts","../src/functions/commands/scenario-ladder.ts","../src/functions/commands/scenario-plan.ts","../src/functions/commands/scenario.ts","../src/functions/commands/scopes-audit.ts","../src/functions/commands/scopes-prune.ts","../src/functions/commands/scopes-shared.ts","../src/functions/commands/semver-render.ts","../src/functions/commands/semver.ts","../src/functions/commands/serve-console.ts","../src/functions/commands/serve-frontend.ts","../src/functions/commands/serve.ts","../src/functions/commands/skills.ts","../src/functions/commands/start-coverage.ts","../src/functions/commands/update-render.ts","../src/functions/commands/update.ts","../src/functions/commands/validate.ts","../src/functions/commands/versions-check.ts","../src/functions/commands/versions-init.ts","../src/functions/commands/versions-update.ts","../src/functions/commands/virtual-user-formatter.ts","../src/functions/commands/watch.ts","../src/functions/db/annotation-parser.ts","../src/functions/db/better-auth-schema.ts","../src/functions/db/check-enums.ts","../src/functions/db/db-codegen.ts","../src/functions/db/db-introspector.ts","../src/functions/db/local-db.ts","../src/functions/db/migration-provenance.ts","../src/functions/db/zod-codegen.ts","../src/functions/db/postgres/pglite-kysely.ts","../src/functions/db/postgres/postgres-introspector.ts","../src/functions/db/sqlite/dev-seed.ts","../src/functions/db/sqlite/sqlite-introspector.ts","../src/functions/db/sqlite/sqlite-kysely.ts","../src/functions/knowledge/render.ts","../src/functions/knowledge/schemas.ts","../src/functions/runtimes/fetch/index.ts","../src/functions/runtimes/nextjs/pikku-command-nextjs.ts","../src/functions/runtimes/nextjs/serialize-nextjs-backend-worker-rpc-wrapper.ts","../src/functions/runtimes/nextjs/serialize-nextjs-backend-wrapper.ts","../src/functions/runtimes/nextjs/serialize-nextjs-http-wrapper.ts","../src/functions/runtimes/tanstack-start/pikku-command-tanstack-start.ts","../src/functions/runtimes/tanstack-start/serialize-tanstack-start-shim.ts","../src/functions/runtimes/websocket/pikku-command-websocket-typed.ts","../src/functions/runtimes/websocket/serialize-websocket-wrapper.ts","../src/functions/surface/build-surface-doc.ts","../src/functions/surface/collect-snippets.ts","../src/functions/surface/collect-surface-usage.ts","../src/functions/surface/collect-surface.ts","../src/functions/surface/generate-surface-doc.ts","../src/functions/surface/render-surface-doc.ts","../src/functions/surface/shipped-surface-doc.ts","../src/functions/surface/surface-doc.types.ts","../src/functions/surface/surface-editorial.ts","../src/functions/surface/write-surface-usage.ts","../src/functions/validate/addon-package-checks.ts","../src/functions/validate/auth-plugin-checks.ts","../src/functions/validate/bootstrap-checks.ts","../src/functions/validate/persona-checks.ts","../src/functions/validate/pikku-barrel-checks.ts","../src/functions/validate/scenario-file-checks.ts","../src/functions/validate/shared-checks.ts","../src/functions/validate/type-identity-checks.ts","../src/functions/validate/validate-registry.ts","../src/functions/validate/validate.ts","../src/functions/validate/websocket-deps-checks.ts","../src/functions/validate/workspace-exports-checks.ts","../src/functions/wirings/agent/pikku-command-agent-types.ts","../src/functions/wirings/agent/pikku-command-agent.ts","../src/functions/wirings/agent/pikku-command-public-agent.ts","../src/functions/wirings/agent/serialize-agent-map.ts","../src/functions/wirings/agent/serialize-agent-types.ts","../src/functions/wirings/agent/serialize-model-aliases.ts","../src/functions/wirings/agent/serialize-public-agent.ts","../src/functions/wirings/agent-scorer/pikku-command-agent-scorer.ts","../src/functions/wirings/agent-scorer/serialize-scorer-names.ts","../src/functions/wirings/auth/pikku-command-auth.ts","../src/functions/wirings/auth/serialize-auth-gen.ts","../src/functions/wirings/auth/serialize-auth-guards.ts","../src/functions/wirings/auth/serialize-auth-meta.ts","../src/functions/wirings/auth/serialize-auth-types.ts","../src/functions/wirings/channels/pikku-channels.ts","../src/functions/wirings/channels/pikku-command-channel-types.ts","../src/functions/wirings/channels/pikku-command-channels-map.ts","../src/functions/wirings/channels/pikku-command-channels.ts","../src/functions/wirings/channels/serialize-channel-types.ts","../src/functions/wirings/channels/serialize-typed-channel-map.ts","../src/functions/wirings/cli/pikku-command-cli-entry.ts","../src/functions/wirings/cli/pikku-command-cli-types.ts","../src/functions/wirings/cli/pikku-command-cli.ts","../src/functions/wirings/cli/serialize-channel-cli-client.ts","../src/functions/wirings/cli/serialize-channel-cli.ts","../src/functions/wirings/cli/serialize-cli-entrypoint-guard.ts","../src/functions/wirings/cli/serialize-cli-types.ts","../src/functions/wirings/cli/serialize-local-cli-bootstrap.ts","../src/functions/wirings/console/pikku-command-console-functions.ts","../src/functions/wirings/console/pikku-command-nodes-meta.ts","../src/functions/wirings/console/serialize-console-functions.ts","../src/functions/wirings/credentials/pikku-command-credentials.ts","../src/functions/wirings/credentials/serialize-credentials-types.ts","../src/functions/wirings/emails/pikku-command-emails.ts","../src/functions/wirings/emails/serialize-emails.ts","../src/functions/wirings/errors/pikku-command-error-types.ts","../src/functions/wirings/errors/serialize-error-types.ts","../src/functions/wirings/functions/pikku-command-addon-types.ts","../src/functions/wirings/functions/pikku-command-function-types-split.ts","../src/functions/wirings/functions/pikku-command-functions.ts","../src/functions/wirings/functions/pikku-command-leaf-indexes.ts","../src/functions/wirings/functions/pikku-command-services.ts","../src/functions/wirings/functions/schemas.ts","../src/functions/wirings/functions/serialize-addon-refs.ts","../src/functions/wirings/functions/serialize-addon-types.ts","../src/functions/wirings/functions/serialize-function-imports.ts","../src/functions/wirings/functions/serialize-function-types.ts","../src/functions/wirings/functions/serialize-leaf-index.ts","../src/functions/wirings/gateway/pikku-command-gateway-types.ts","../src/functions/wirings/gateway/pikku-command-gateway.ts","../src/functions/wirings/gateway/serialize-gateway-meta.ts","../src/functions/wirings/gateway/serialize-gateway-types.ts","../src/functions/wirings/graph/pikku-command-graph-wirings.ts","../src/functions/wirings/graph/serialize-graph-wirings.ts","../src/functions/wirings/http/pikku-command-http-map.ts","../src/functions/wirings/http/pikku-command-http-routes.ts","../src/functions/wirings/http/pikku-command-http-types.ts","../src/functions/wirings/http/pikku-command-openapi.ts","../src/functions/wirings/http/pikku-http-routes.ts","../src/functions/wirings/http/serialize-fetch-wrapper.ts","../src/functions/wirings/http/serialize-http-types.ts","../src/functions/wirings/http/serialize-typed-http-map.ts","../src/functions/wirings/mcp/pikku-command-mcp-json.ts","../src/functions/wirings/mcp/pikku-command-mcp-types.ts","../src/functions/wirings/mcp/pikku-command-mcp.ts","../src/functions/wirings/mcp/serialize-mcp-types.ts","../src/functions/wirings/middleware/pikku-command-middleware.ts","../src/functions/wirings/middleware/serialize-middleware-imports.ts","../src/functions/wirings/middleware/serialize-middleware-types.ts","../src/functions/wirings/package/pikku-command-package-types.ts","../src/functions/wirings/package/pikku-command-package.ts","../src/functions/wirings/package/serialize-package-types.ts","../src/functions/wirings/package/serialize-package.ts","../src/functions/wirings/permissions/pikku-command-permissions.ts","../src/functions/wirings/permissions/serialize-permissions-imports.ts","../src/functions/wirings/personas/personas-secrets-file.ts","../src/functions/wirings/personas/pikku-command-personas.ts","../src/functions/wirings/personas/serialize-personas-secrets.ts","../src/functions/wirings/personas/serialize-personas-types.ts","../src/functions/wirings/queue/pikku-command-queue-map.ts","../src/functions/wirings/queue/pikku-command-queue-service.ts","../src/functions/wirings/queue/pikku-command-queue-types.ts","../src/functions/wirings/queue/pikku-command-queue.ts","../src/functions/wirings/queue/pikku-queue-map.ts","../src/functions/wirings/queue/pikku-queue.ts","../src/functions/wirings/queue/serialize-queue-map.ts","../src/functions/wirings/queue/serialize-queue-meta.ts","../src/functions/wirings/queue/serialize-queue-types.ts","../src/functions/wirings/queue/serialize-queue-wrapper.ts","../src/functions/wirings/realtime/pikku-command-events-scaffold.ts","../src/functions/wirings/realtime/pikku-command-realtime.ts","../src/functions/wirings/realtime/serialize-events-scaffold.ts","../src/functions/wirings/realtime/serialize-realtime-client.ts","../src/functions/wirings/roles/pikku-command-roles.ts","../src/functions/wirings/roles/serialize-roles-types.ts","../src/functions/wirings/rpc/pikku-command-public-rpc.ts","../src/functions/wirings/rpc/pikku-command-react-query.ts","../src/functions/wirings/rpc/pikku-command-remote-rpc.ts","../src/functions/wirings/rpc/pikku-command-rpc-client.ts","../src/functions/wirings/rpc/pikku-command-rpc-map.ts","../src/functions/wirings/rpc/pikku-command-rpc.ts","../src/functions/wirings/rpc/serialize-public-rpc.ts","../src/functions/wirings/rpc/serialize-react-query-hooks.ts","../src/functions/wirings/rpc/serialize-remote-rpc.ts","../src/functions/wirings/rpc/serialize-rpc-wrapper.ts","../src/functions/wirings/rpc/serialize-typed-rpc-map.ts","../src/functions/wirings/scenarios/register-scenario-instrumentation.ts","../src/functions/wirings/scenarios/scenario-partition.ts","../src/functions/wirings/scenarios/scenario-schema-partition.ts","../src/functions/wirings/scenarios/serialize-feature-meta.ts","../src/functions/wirings/scenarios/serialize-scenario-meta.ts","../src/functions/wirings/scenarios/serialize-scenario-registration.ts","../src/functions/wirings/scheduler/pikku-command-scheduler-types.ts","../src/functions/wirings/scheduler/pikku-command-scheduler.ts","../src/functions/wirings/scheduler/serialize-scheduler-meta.ts","../src/functions/wirings/scheduler/serialize-scheduler-types.ts","../src/functions/wirings/scopes/pikku-command-scopes.ts","../src/functions/wirings/scopes/serialize-scopes-client.ts","../src/functions/wirings/scopes/serialize-scopes-types.ts","../src/functions/wirings/secrets/pikku-command-secrets.ts","../src/functions/wirings/secrets/serialize-secrets-types.ts","../src/functions/wirings/setup/serialize-setup-types.ts","../src/functions/wirings/triggers/pikku-command-trigger-types.ts","../src/functions/wirings/triggers/pikku-command-trigger.ts","../src/functions/wirings/triggers/serialize-trigger-meta.ts","../src/functions/wirings/triggers/serialize-trigger-types.ts","../src/functions/wirings/variables/pikku-command-variables.ts","../src/functions/wirings/variables/serialize-variables-types.ts","../src/functions/wirings/virtual-user/pikku-command-virtual-user-functions.ts","../src/functions/wirings/virtual-user/serialize-virtual-user-functions.ts","../src/functions/wirings/webhook/pikku-command-webhook.ts","../src/functions/wirings/webhook/serialize-webhook.ts","../src/functions/wirings/workflow/pikku-command-workflow-routes.ts","../src/functions/wirings/workflow/pikku-command-workflow.ts","../src/functions/wirings/workflow/serialize-personas.ts","../src/functions/wirings/workflow/serialize-scenario-step-map.ts","../src/functions/wirings/workflow/serialize-scenario-types.ts","../src/functions/wirings/workflow/serialize-workflow-bootstrap-map.ts","../src/functions/wirings/workflow/serialize-workflow-map.ts","../src/functions/wirings/workflow/serialize-workflow-meta.ts","../src/functions/wirings/workflow/serialize-workflow-registration.ts","../src/functions/wirings/workflow/serialize-workflow-routes.ts","../src/functions/wirings/workflow/serialize-workflow-types.ts","../src/functions/workflows/all.workflow.ts","../src/middleware/log-command-info-and-time.ts","../src/server/actor-sign-in.ts","../src/server/bun-server-runner.ts","../src/server/content-signing-jwt.ts","../src/server/dev-server-runner.interface.ts","../src/server/node-server-runner.ts","../src/server/server-ready.ts","../src/server/spawn-dev-server.ts","../src/services/cli-logger-forwarder.service.ts","../src/services/cli-logger.service.ts","../src/utils/assert-single-core-version.ts","../src/utils/check-required-types.ts","../src/utils/cli-session.ts","../src/utils/command-summary.ts","../src/utils/contract-versions.ts","../src/utils/detect-better-auth.ts","../src/utils/device-auth.ts","../src/utils/file-import-path.ts","../src/utils/file-imports-serializer.ts","../src/utils/file-writer.ts","../src/utils/frontend.ts","../src/utils/generate-bootstrap-file.ts","../src/utils/get-cli-version.ts","../src/utils/is-deploy-codegen.ts","../src/utils/leaf-import-path.ts","../src/utils/meta-diff.ts","../src/utils/model-alias-override.ts","../src/utils/parse-cli-filters.ts","../src/utils/persona-credentials.ts","../src/utils/pikku-cli-config-error.ts","../src/utils/pikku-cli-config.ts","../src/utils/pikku-files-and-methods.ts","../src/utils/precise-coverage-map.ts","../src/utils/remove-legacy-scaffold-file.ts","../src/utils/resolve-from-project.ts","../src/utils/resolve-personas.ts","../src/utils/resolve-scaffold-feature.ts","../src/utils/schema-diff.ts","../src/utils/serialize-import-map.ts","../src/utils/serialize-meta-ts.ts","../src/utils/serialize-schemas.ts","../src/utils/strip-verbose-meta.ts","../src/utils/surface-diff.ts","../src/utils/surface.ts","../src/utils/tsc-check.ts","../.pikku/pikku-bootstrap-scenarios.gen.ts","../.pikku/pikku-bootstrap.gen.ts","../.pikku/pikku-services.gen.ts","../.pikku/addon/index.ts","../.pikku/addon/pikku-addon-types.gen.ts","../.pikku/agent/index.ts","../.pikku/agent/pikku-agent-map.gen.d.ts","../.pikku/agent/pikku-agent-types.gen.ts","../.pikku/agent/pikku-model-aliases.gen.ts","../.pikku/agent/pikku-scorer-names.gen.d.ts","../.pikku/auth/auth.types.ts","../.pikku/auth/index.ts","../.pikku/auth/pikku-auth-types.gen.ts","../.pikku/channel/index.ts","../.pikku/channel/pikku-channel-types.gen.ts","../.pikku/cli/index.ts","../.pikku/cli/pikku-cli-channel.ts","../.pikku/cli/pikku-cli-client.gen.ts","../.pikku/cli/pikku-cli-contracts-meta.gen.ts","../.pikku/cli/pikku-cli-types.gen.ts","../.pikku/cli/pikku-cli-wirings-meta.gen.ts","../.pikku/cli/pikku-cli-wirings.gen.ts","../.pikku/cli/pikku-cli.gen.ts","../.pikku/error/index.ts","../.pikku/error/pikku-error-types.gen.ts","../.pikku/function/index.ts","../.pikku/function/pikku-function-types.gen.ts","../.pikku/function/pikku-functions-meta.gen.ts","../.pikku/function/pikku-functions.gen.ts","../.pikku/gateway/index.ts","../.pikku/gateway/pikku-gateway-types.gen.ts","../.pikku/http/index.ts","../.pikku/http/pikku-http-types.gen.ts","../.pikku/mcp/index.ts","../.pikku/mcp/pikku-mcp-types.gen.ts","../.pikku/middleware/index.ts","../.pikku/middleware/pikku-middleware-types.gen.ts","../.pikku/node/pikku-node-types.gen.ts","../.pikku/queue/index.ts","../.pikku/queue/pikku-queue-types.gen.ts","../.pikku/queue/pikku-queue-workers-wirings-map.gen.d.ts","../.pikku/queue/pikku-queue-workers-wirings-meta.gen.ts","../.pikku/queue/pikku-queue-workers-wirings.gen.ts","../.pikku/rpc/pikku-rpc-wirings-map.gen.d.ts","../.pikku/rpc/pikku-rpc-wirings-map.internal.gen.d.ts","../.pikku/rpc/pikku-rpc-wirings-map.remote.gen.d.ts","../.pikku/rpc/pikku-rpc-wirings-meta.internal.gen.ts","../.pikku/scenarios/index.ts","../.pikku/scenarios/pikku-personas.gen.ts","../.pikku/scenarios/pikku-scenario-functions-meta.gen.ts","../.pikku/scenarios/pikku-scenario-functions.gen.ts","../.pikku/scenarios/pikku-scenario-types.gen.ts","../.pikku/scenarios/pikku-scenario-wirings-meta.gen.ts","../.pikku/scenarios/pikku-scenario-wirings.gen.ts","../.pikku/scenarios/schemas/register.gen.ts","../.pikku/scheduler/index.ts","../.pikku/scheduler/pikku-scheduler-types.gen.ts","../.pikku/schemas/register.gen.ts","../.pikku/scopes/index.ts","../.pikku/scopes/pikku-personas.gen.ts","../.pikku/scopes/pikku-roles.gen.ts","../.pikku/scopes/pikku-scope-types.gen.ts","../.pikku/scopes/pikku-scopes.gen.ts","../.pikku/secrets/index.ts","../.pikku/secrets/pikku-secret-types.gen.ts","../.pikku/secrets/pikku-secrets.gen.ts","../.pikku/services/pikku-meta-service.gen.ts","../.pikku/setup/index.ts","../.pikku/setup/pikku-setup-types.gen.ts","../.pikku/trigger/index.ts","../.pikku/trigger/pikku-trigger-types.gen.ts","../.pikku/variables/index.ts","../.pikku/variables/pikku-variable-types.gen.ts","../.pikku/variables/pikku-variables.gen.ts","../.pikku/workflow/index.ts","../.pikku/workflow/pikku-scenario-step-map.gen.d.ts","../.pikku/workflow/pikku-workflow-map.gen.d.ts","../.pikku/workflow/pikku-workflow-types.gen.ts","../.pikku/workflow/pikku-workflow-wirings-meta.gen.ts","../.pikku/workflow/pikku-workflow-wirings.gen.ts","../types/application-types.d.ts","../types/bun-sqlite.d.ts","../types/config.d.ts"],"version":"6.0.3"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/cli",
-  "version": "0.12.133",
+  "version": "0.12.136",
   "description": "Pikku CLI — code generation, dev server, migrations and deployment",
   "author": "yasser.fadl@gmail.com",
   "license": "BUSL-1.1",
@@ -31,14 +31,14 @@
     "@jridgewell/trace-mapping": "^0.3.31",
     "@openapi-contrib/json-schema-to-openapi-schema": "^4.3.4",
     "@pikku/ai-vercel": "^0.12.13",
-    "@pikku/better-auth": "^0.12.36",
+    "@pikku/better-auth": "^0.12.38",
     "@pikku/bun-server": "^0.12.11",
     "@pikku/code-edit": "^0.12.1",
     "@pikku/deploy": "^0.12.5",
     "@pikku/deploy-cloudflare": "^0.12.13",
     "@pikku/fetch": "^0.12.10",
     "@pikku/inspector": "^0.12.71",
-    "@pikku/knowledge": "^0.12.9",
+    "@pikku/knowledge": "^0.12.10",
     "@pikku/kysely": "^0.13.23",
     "@pikku/migrator-sql": "^0.12.3",
     "@pikku/n8n-import": "^0.0.7",

package/snippets.json

@@ -14,7 +14,7 @@
   "aiAgentStream": "// Streaming endpoint — sends text-delta, tool-call, and usage events as they arrive.\nwireHTTP({\n  method: 'post',\n  route: '/agents/shop/stream',\n  func: agentStream('shopAssistant'),\n  auth: true,\n})",
   "aiAgentStreamClient": "export async function agentStreamExamples() {\n  pikkuRPC.setServerUrl('http://localhost:4000')\n  pikkuRPC.setAuthorizationJWT('user-jwt-token')\n\n  const stream = await pikkuRPC.agent.stream('shopAssistant', {\n    message: 'Add the cheapest USB hub to my basket',\n    threadId: 'thread-123',\n    resourceId: 'user-456',\n  })\n  return stream\n}",
   "auditDispatch": "await audit?.audit({\n  type: 'order.created',\n  source: 'explicit',\n  occurredAt: new Date().toISOString(),\n  metadata: { orderId, userId },\n})",
-  "betterAuthConfig": "export const auth = pikkuBetterAuth(\n  async ({\n    kysely,\n    secrets,\n    variables,\n    emailService,\n    scopeService,\n    logger,\n  }) => {\n    // `.reveal()` at the sink, not earlier: getSecret hands back a nominal\n    // SecretValue that no concretely-typed parameter accepts, so every disclosure\n    // is one greppable call. Better Auth wants the raw string, and this is where\n    // it stops being a secret in the type system.\n    const BETTER_AUTH_SECRET = (\n      await secrets.getSecret('BETTER_AUTH_SECRET')\n    ).reveal()\n    // Genuinely optional: unset simply disables /api/auth/sign-in/actor (scenarios\n    // off for this deployment) — the actor plugin refuses all sign-ins\n    // without it.\n    const SCENARIO_ACTOR_SECRET = await secrets\n      .getSecret('SCENARIO_ACTOR_SECRET')\n      .then((value) => value?.reveal())\n      .catch(() => undefined)\n    // Fabric operator admin: the RSA public key the control plane's token is\n    // verified against. The Fabric deployer pushes FABRIC_AUTH_PUBLIC_KEY onto\n    // every stage; locally it's simply absent, which disables /sign-in/fabric.\n    // Asymmetric — the app verifies, it can never forge an operator login.\n    const FABRIC_AUTH_PUBLIC_KEY = await variables.get('FABRIC_AUTH_PUBLIC_KEY')\n\n    return betterAuth({\n      secret: BETTER_AUTH_SECRET,\n      database: { db: kysely, type: 'sqlite' },\n      emailAndPassword: {\n        enabled: true,\n        // Without this, `requestPasswordReset` succeeds on the client and silently\n        // sends nothing — the \"Forgot password?\" flow looks wired and dead-ends.\n        // Better Auth builds `url` from its baseURL + the client's redirectTo, so\n        // the app only supplies the message. Errors are logged, never swallowed:\n        // a reset the user never receives must be visible in the logs.\n        sendResetPassword: async ({ user, url }) => {\n          await emailService.send({\n            to: user.email,\n            template: {\n              name: 'reset-password',\n              data: { email: user.email, resetUrl: url },\n            },\n          })\n        },\n      },\n      // Stateless session: CLI splits out betterAuthStatelessSession so non-auth\n      // units verify the signed cookie instead of bundling better-auth. pikku #737.\n      session: { cookieCache: { enabled: true } },\n      advanced: { database: { generateId: 'uuid' } },\n      // Scenario actors: synthetic users (user.actor = true, see\n      // db/sqlite/0002-user-actor.sql) signed in by pikkuScenario via\n      // POST /api/auth/sign-in/actor { email, secret }. Never signs in real users.\n      //\n      // pikkuBan(): adds the banned/banExpires/banReason columns (see\n      // db/sqlite/0003-admin.sql) and the session hook that refuses a banned\n      // user a session. better-auth's own admin() is refused by the inspector:\n      // it authorizes on a `user.role` column while pikku authorizes on scopes,\n      // and everything else it offered — list, create, ban, remove, revoke\n      // sessions, set password — is scoped RPCs in @pikku/addon-admin.\n      //\n      // pikkuFabric(): exposes /api/auth/sign-in/fabric — the Fabric control plane\n      // mints a short-lived RS256 token and signs in as a synthetic `fabric: true`\n      // admin operator (db/sqlite/0004-fabric.sql), so the console Users tab can\n      // list/impersonate real users without the operator being one of them. It\n      // verifies against FABRIC_AUTH_PUBLIC_KEY; a missing key disables the\n      // endpoint.\n      //\n      // `personas` is what provisions the scenario actors. The plugin creates a\n      // declared persona's account the first time an operator asks to act as an\n      // address the stage has no row for, so a deploy carries its actors with it\n      // without a bootstrap step. This does NOT belong in `pikkuServerLifecycle`'s\n      // afterStart: that hook only ever runs under `pikku dev` and `pikku serve`,\n      // so a deployed stage would provision nobody.\n      plugins: [\n        pikkuActor({ secret: SCENARIO_ACTOR_SECRET }),\n        pikkuBan(),\n        pikkuFabric({\n          publicKey: FABRIC_AUTH_PUBLIC_KEY,\n          scopeService,\n          logger,\n          personas: {\n            personas: personaConfigs,\n            environments: personaEnvironments,\n          },\n        }),\n      ],\n    })\n  }\n)",
+  "betterAuthConfig": "export const auth = pikkuBetterAuth(\n  async ({\n    kysely,\n    secrets,\n    variables,\n    emailService,\n    scopeService,\n    logger,\n  }) => {\n    // `.reveal()` at the sink, not earlier: getSecret hands back a nominal\n    // SecretValue that no concretely-typed parameter accepts, so every disclosure\n    // is one greppable call. Better Auth wants the raw string, and this is where\n    // it stops being a secret in the type system.\n    const BETTER_AUTH_SECRET = (\n      await secrets.getSecret('BETTER_AUTH_SECRET')\n    ).reveal()\n    // Genuinely optional: unset simply disables /api/auth/sign-in/actor (scenarios\n    // off for this deployment) — the actor plugin refuses all sign-ins\n    // without it.\n    const SCENARIO_ACTOR_SECRET = await secrets\n      .getSecret('SCENARIO_ACTOR_SECRET')\n      .then((value) => value?.reveal())\n      .catch(() => undefined)\n    // Fabric operator admin: the RSA public key the control plane's token is\n    // verified against. The Fabric deployer pushes FABRIC_AUTH_PUBLIC_KEY onto\n    // every stage; locally it's simply absent, which disables /sign-in/fabric.\n    // Asymmetric — the app verifies, it can never forge an operator login.\n    const FABRIC_AUTH_PUBLIC_KEY = await variables.get('FABRIC_AUTH_PUBLIC_KEY')\n    // The opt-in that lets a deployed stage run scenarios. Read through\n    // `variables` rather than left to `process.env`, because a Worker receives\n    // it as a binding and has no populated environment to find it in.\n    const ALLOW_ACTOR_SIGN_IN = await variables.get(ACTOR_SIGN_IN_OPT_IN_ENV)\n\n    return betterAuth({\n      secret: BETTER_AUTH_SECRET,\n      database: { db: kysely, type: 'sqlite' },\n      emailAndPassword: {\n        enabled: true,\n        // Without this, `requestPasswordReset` succeeds on the client and silently\n        // sends nothing — the \"Forgot password?\" flow looks wired and dead-ends.\n        // Better Auth builds `url` from its baseURL + the client's redirectTo, so\n        // the app only supplies the message. Errors are logged, never swallowed:\n        // a reset the user never receives must be visible in the logs.\n        sendResetPassword: async ({ user, url }) => {\n          await emailService.send({\n            to: user.email,\n            template: {\n              name: 'reset-password',\n              data: { email: user.email, resetUrl: url },\n            },\n          })\n        },\n      },\n      // Stateless session: CLI splits out betterAuthStatelessSession so non-auth\n      // units verify the signed cookie instead of bundling better-auth. pikku #737.\n      session: { cookieCache: { enabled: true } },\n      advanced: { database: { generateId: 'uuid' } },\n      // Scenario actors: synthetic users (user.actor = true, see\n      // db/sqlite/0002-user-actor.sql) signed in by pikkuScenario via\n      // POST /api/auth/sign-in/actor { email, secret }. Never signs in real users.\n      //\n      // pikkuBan(): adds the banned/banExpires/banReason columns (see\n      // db/sqlite/0003-admin.sql) and the session hook that refuses a banned\n      // user a session. better-auth's own admin() is refused by the inspector:\n      // it authorizes on a `user.role` column while pikku authorizes on scopes,\n      // and everything else it offered — list, create, ban, remove, revoke\n      // sessions, set password — is scoped RPCs in @pikku/addon-admin.\n      //\n      // pikkuFabric(): exposes /api/auth/sign-in/fabric — the Fabric control plane\n      // mints a short-lived RS256 token and signs in as a synthetic `fabric: true`\n      // admin operator (db/sqlite/0004-fabric.sql), so the console Users tab can\n      // list/impersonate real users without the operator being one of them. It\n      // verifies against FABRIC_AUTH_PUBLIC_KEY; a missing key disables the\n      // endpoint.\n      //\n      // `personas` is what provisions the scenario actors. The plugin creates a\n      // declared persona's account the first time an operator asks to act as an\n      // address the stage has no row for, so a deploy carries its actors with it\n      // without a bootstrap step. This does NOT belong in `pikkuServerLifecycle`'s\n      // afterStart: that hook only ever runs under `pikku dev` and `pikku serve`,\n      // so a deployed stage would provision nobody.\n      plugins: [\n        pikkuActor({\n          secret: SCENARIO_ACTOR_SECRET,\n          allowSignIn: ALLOW_ACTOR_SIGN_IN,\n        }),\n        pikkuBan(),\n        pikkuFabric({\n          publicKey: FABRIC_AUTH_PUBLIC_KEY,\n          scopeService,\n          logger,\n          personas: {\n            personas: personaConfigs,\n            environments: personaEnvironments,\n          },\n        }),\n      ],\n    })\n  }\n)",
   "cancelOrder": "export const cancelOrder = pikkuFunc({\n  expose: true,\n  description: 'Cancel a pending order and restore stock.',\n  input: CancelOrderInput,\n  // Authorization is declared, not written. `scopes` is what the role\n  // entitles the caller to and is AND-ed; `permissions` is what is true of\n  // this particular row and is OR-ed across keys. Both run before the body,\n  // so the function below only ever sees a caller who is allowed to be there.\n  //\n  // The `support` role holds `orders:cancel` without owning the order, so it\n  // passes on the scope; a customer passes on ownership. Neither case needs a\n  // branch in the body.\n  scopes: ['orders:cancel'],\n  permissions: {\n    owner: isOrderOwner,\n  },\n  // `node` describes this function as a step someone can drop into a visual\n  // flow: what to call it, where it files, and whether it starts a flow\n  // ('trigger'), continues one ('action') or ends it ('end'). Without it the\n  // function still works everywhere else — it just does not appear as a node.\n  node: {\n    displayName: 'Cancel Order',\n    category: 'Orders',\n    type: 'action',\n  },\n  func: async ({ kysely, queueService }, { orderId }, { session }) => {\n    const order = await kysely\n      .selectFrom('order')\n      .select(['orderId', 'userId', 'status'])\n      .where('orderId', '=', orderId)\n      .executeTakeFirst()\n\n    if (!order) throw new Error('Order not found')\n    if (!['pending', 'paid'].includes(order.status)) {\n      throw new Error(`Cannot cancel order in status: ${order.status}`)\n    }\n\n    // Restore stock\n    const items = await kysely\n      .selectFrom('orderItem')\n      .select(['itemId', 'quantity'])\n      .where('orderId', '=', orderId)\n      .execute()\n\n    const now = new Date().toISOString()\n    for (const item of items) {\n      await kysely\n        .updateTable('item')\n        .set((eb) => ({\n          stock: eb('stock', '+', item.quantity),\n          updatedAt: now,\n        }))\n        .where('itemId', '=', item.itemId)\n        .execute()\n    }\n\n    await kysely\n      .updateTable('order')\n      .set({ status: 'cancelled', updatedAt: now })\n      .where('orderId', '=', orderId)\n      .execute()\n\n    await queueService.add('audit-event', {\n      entityType: 'order',\n      entityId: orderId,\n      action: 'cancelled',\n      actorId: session.userId,\n    })\n  },\n})",
   "channelLifecycle": "export const onConnect = pikkuChannelConnectionFunc(\n  async ({ logger }, _, { channel }) => {\n    logger.info({ event: 'ws_connected', channelId: channel.channelId })\n  }\n)\n\nexport const onDisconnect = pikkuChannelDisconnectionFunc(\n  async ({ logger }, _, { channel }) => {\n    logger.info({ event: 'ws_disconnected', channelId: channel.channelId })\n  }\n)",
   "channelMiddleware": "export const traceAgentStream = pikkuChannelMiddleware<any, AgentStreamEvent>(\n  async ({ logger }, event, next) => {\n    logger.debug({ event: 'agent_stream', type: event.type })\n    await next(event)\n  }\n)",

package/surface.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.12.133",
+  "version": "0.12.136",
   "entryPoints": [
     {
       "id": "app",
@@ -3356,7 +3356,7 @@
               "docs": "Builds this project's Better Auth instance. The factory is handed the\nsingleton services, with typed `secrets` and `variables`, and is called\nlazily so config and secrets are resolved before auth is constructed.",
               "signature": "<I extends BetterAuthInstance>(factory: (services: AuthSingletonServices) => I | Promise<I>) => PikkuBetterAuthFactory<I>",
               "examples": [
-                "export const auth = pikkuBetterAuth(\n  async ({\n    kysely,\n    secrets,\n    variables,\n    emailService,\n    scopeService,\n    logger,\n  }) => {\n    // `.reveal()` at the sink, not earlier: getSecret hands back a nominal\n    // SecretValue that no concretely-typed parameter accepts, so every disclosure\n    // is one greppable call. Better Auth wants the raw string, and this is where\n    // it stops being a secret in the type system.\n    const BETTER_AUTH_SECRET = (\n      await secrets.getSecret('BETTER_AUTH_SECRET')\n    ).reveal()\n    // Genuinely optional: unset simply disables /api/auth/sign-in/actor (scenarios\n    // off for this deployment) — the actor plugin refuses all sign-ins\n    // without it.\n    const SCENARIO_ACTOR_SECRET = await secrets\n      .getSecret('SCENARIO_ACTOR_SECRET')\n      .then((value) => value?.reveal())\n      .catch(() => undefined)\n    // Fabric operator admin: the RSA public key the control plane's token is\n    // verified against. The Fabric deployer pushes FABRIC_AUTH_PUBLIC_KEY onto\n    // every stage; locally it's simply absent, which disables /sign-in/fabric.\n    // Asymmetric — the app verifies, it can never forge an operator login.\n    const FABRIC_AUTH_PUBLIC_KEY = await variables.get('FABRIC_AUTH_PUBLIC_KEY')\n\n    return betterAuth({\n      secret: BETTER_AUTH_SECRET,\n      database: { db: kysely, type: 'sqlite' },\n      emailAndPassword: {\n        enabled: true,\n        // Without this, `requestPasswordReset` succeeds on the client and silently\n        // sends nothing — the \"Forgot password?\" flow looks wired and dead-ends.\n        // Better Auth builds `url` from its baseURL + the client's redirectTo, so\n        // the app only supplies the message. Errors are logged, never swallowed:\n        // a reset the user never receives must be visible in the logs.\n        sendResetPassword: async ({ user, url }) => {\n          await emailService.send({\n            to: user.email,\n            template: {\n              name: 'reset-password',\n              data: { email: user.email, resetUrl: url },\n            },\n          })\n        },\n      },\n      // Stateless session: CLI splits out betterAuthStatelessSession so non-auth\n      // units verify the signed cookie instead of bundling better-auth. pikku #737.\n      session: { cookieCache: { enabled: true } },\n      advanced: { database: { generateId: 'uuid' } },\n      // Scenario actors: synthetic users (user.actor = true, see\n      // db/sqlite/0002-user-actor.sql) signed in by pikkuScenario via\n      // POST /api/auth/sign-in/actor { email, secret }. Never signs in real users.\n      //\n      // pikkuBan(): adds the banned/banExpires/banReason columns (see\n      // db/sqlite/0003-admin.sql) and the session hook that refuses a banned\n      // user a session. better-auth's own admin() is refused by the inspector:\n      // it authorizes on a `user.role` column while pikku authorizes on scopes,\n      // and everything else it offered — list, create, ban, remove, revoke\n      // sessions, set password — is scoped RPCs in @pikku/addon-admin.\n      //\n      // pikkuFabric(): exposes /api/auth/sign-in/fabric — the Fabric control plane\n      // mints a short-lived RS256 token and signs in as a synthetic `fabric: true`\n      // admin operator (db/sqlite/0004-fabric.sql), so the console Users tab can\n      // list/impersonate real users without the operator being one of them. It\n      // verifies against FABRIC_AUTH_PUBLIC_KEY; a missing key disables the\n      // endpoint.\n      //\n      // `personas` is what provisions the scenario actors. The plugin creates a\n      // declared persona's account the first time an operator asks to act as an\n      // address the stage has no row for, so a deploy carries its actors with it\n      // without a bootstrap step. This does NOT belong in `pikkuServerLifecycle`'s\n      // afterStart: that hook only ever runs under `pikku dev` and `pikku serve`,\n      // so a deployed stage would provision nobody.\n      plugins: [\n        pikkuActor({ secret: SCENARIO_ACTOR_SECRET }),\n        pikkuBan(),\n        pikkuFabric({\n          publicKey: FABRIC_AUTH_PUBLIC_KEY,\n          scopeService,\n          logger,\n          personas: {\n            personas: personaConfigs,\n            environments: personaEnvironments,\n          },\n        }),\n      ],\n    })\n  }\n)"
+                "export const auth = pikkuBetterAuth(\n  async ({\n    kysely,\n    secrets,\n    variables,\n    emailService,\n    scopeService,\n    logger,\n  }) => {\n    // `.reveal()` at the sink, not earlier: getSecret hands back a nominal\n    // SecretValue that no concretely-typed parameter accepts, so every disclosure\n    // is one greppable call. Better Auth wants the raw string, and this is where\n    // it stops being a secret in the type system.\n    const BETTER_AUTH_SECRET = (\n      await secrets.getSecret('BETTER_AUTH_SECRET')\n    ).reveal()\n    // Genuinely optional: unset simply disables /api/auth/sign-in/actor (scenarios\n    // off for this deployment) — the actor plugin refuses all sign-ins\n    // without it.\n    const SCENARIO_ACTOR_SECRET = await secrets\n      .getSecret('SCENARIO_ACTOR_SECRET')\n      .then((value) => value?.reveal())\n      .catch(() => undefined)\n    // Fabric operator admin: the RSA public key the control plane's token is\n    // verified against. The Fabric deployer pushes FABRIC_AUTH_PUBLIC_KEY onto\n    // every stage; locally it's simply absent, which disables /sign-in/fabric.\n    // Asymmetric — the app verifies, it can never forge an operator login.\n    const FABRIC_AUTH_PUBLIC_KEY = await variables.get('FABRIC_AUTH_PUBLIC_KEY')\n    // The opt-in that lets a deployed stage run scenarios. Read through\n    // `variables` rather than left to `process.env`, because a Worker receives\n    // it as a binding and has no populated environment to find it in.\n    const ALLOW_ACTOR_SIGN_IN = await variables.get(ACTOR_SIGN_IN_OPT_IN_ENV)\n\n    return betterAuth({\n      secret: BETTER_AUTH_SECRET,\n      database: { db: kysely, type: 'sqlite' },\n      emailAndPassword: {\n        enabled: true,\n        // Without this, `requestPasswordReset` succeeds on the client and silently\n        // sends nothing — the \"Forgot password?\" flow looks wired and dead-ends.\n        // Better Auth builds `url` from its baseURL + the client's redirectTo, so\n        // the app only supplies the message. Errors are logged, never swallowed:\n        // a reset the user never receives must be visible in the logs.\n        sendResetPassword: async ({ user, url }) => {\n          await emailService.send({\n            to: user.email,\n            template: {\n              name: 'reset-password',\n              data: { email: user.email, resetUrl: url },\n            },\n          })\n        },\n      },\n      // Stateless session: CLI splits out betterAuthStatelessSession so non-auth\n      // units verify the signed cookie instead of bundling better-auth. pikku #737.\n      session: { cookieCache: { enabled: true } },\n      advanced: { database: { generateId: 'uuid' } },\n      // Scenario actors: synthetic users (user.actor = true, see\n      // db/sqlite/0002-user-actor.sql) signed in by pikkuScenario via\n      // POST /api/auth/sign-in/actor { email, secret }. Never signs in real users.\n      //\n      // pikkuBan(): adds the banned/banExpires/banReason columns (see\n      // db/sqlite/0003-admin.sql) and the session hook that refuses a banned\n      // user a session. better-auth's own admin() is refused by the inspector:\n      // it authorizes on a `user.role` column while pikku authorizes on scopes,\n      // and everything else it offered — list, create, ban, remove, revoke\n      // sessions, set password — is scoped RPCs in @pikku/addon-admin.\n      //\n      // pikkuFabric(): exposes /api/auth/sign-in/fabric — the Fabric control plane\n      // mints a short-lived RS256 token and signs in as a synthetic `fabric: true`\n      // admin operator (db/sqlite/0004-fabric.sql), so the console Users tab can\n      // list/impersonate real users without the operator being one of them. It\n      // verifies against FABRIC_AUTH_PUBLIC_KEY; a missing key disables the\n      // endpoint.\n      //\n      // `personas` is what provisions the scenario actors. The plugin creates a\n      // declared persona's account the first time an operator asks to act as an\n      // address the stage has no row for, so a deploy carries its actors with it\n      // without a bootstrap step. This does NOT belong in `pikkuServerLifecycle`'s\n      // afterStart: that hook only ever runs under `pikku dev` and `pikku serve`,\n      // so a deployed stage would provision nobody.\n      plugins: [\n        pikkuActor({\n          secret: SCENARIO_ACTOR_SECRET,\n          allowSignIn: ALLOW_ACTOR_SIGN_IN,\n        }),\n        pikkuBan(),\n        pikkuFabric({\n          publicKey: FABRIC_AUTH_PUBLIC_KEY,\n          scopeService,\n          logger,\n          personas: {\n            personas: personaConfigs,\n            environments: personaEnvironments,\n          },\n        }),\n      ],\n    })\n  }\n)"
               ]
             },
             {

package/console-app/assets/architecture-TIHT7OUA-G_ldr-C2.js

@@ -1 +0,0 @@
-import"./chunk-KEIR6QF5-BICK3FdT.js";import{M as e}from"./mermaid-parser.core-DxPo1qbR.js";export{e as createArchitectureServices};

package/console-app/assets/channel-CuDpOUYn.js

@@ -1 +0,0 @@
-import{at as e,ot as t}from"./chunk-I66GZJ75-CbpQtX8e.js";var n=(n,r)=>t.lang.round(e.parse(n)[r]);export{n as t};

package/console-app/assets/chunk-XXDRQBXY-DRMEt0Gf.js

@@ -1 +0,0 @@
-import{p as e}from"./index-DqNqujdF.js";import{n as t}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import"./src-DF-84qwJ.js";var n=t((t,n)=>{let r;return n===`sandbox`&&(r=e(`#i`+t)),e(n===`sandbox`?r.nodes()[0].contentDocument.body:`body`).select(`[id="${t}"]`)},`getDiagramElement`);export{n as t};

package/console-app/assets/classDiagram-JCYQIIEL-Bjgk6QkN.js

@@ -1 +0,0 @@
-import{n as e}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import"./src-DF-84qwJ.js";import"./chunk-I66GZJ75-CbpQtX8e.js";import"./chunk-NSK5VX7P-Bo-dbDZD.js";import"./chunk-4I5QYGJK-DCgTj78f.js";import"./chunk-WRU74C26-DXijYjrx.js";import"./chunk-7BUUIJ7U-Bb538aSH.js";import"./chunk-UBXNYLIW-D9OoHV5X.js";import"./chunk-2GRJ4B5K-BLGsmyy4.js";import"./chunk-XXDRQBXY-DRMEt0Gf.js";import"./chunk-KBJHAD2P-Brvmen34.js";import"./chunk-W5SLKNZC-BNTcVpi3.js";import"./chunk-QR6OTTB3-B5Al5KEo.js";import"./chunk-7Z6QIM7H-CbBMe7ej.js";import{i as t,n,r,t as i}from"./chunk-GF5L2VYU-BXraqZ7w.js";import"./mermaid.core-DpvXaF3y.js";var a={parser:n,get db(){return new i},renderer:r,styles:t,init:e(e=>{e.class||={},e.class.arrowMarkerAbsolute=e.arrowMarkerAbsolute},`init`)};export{a as diagram};

package/console-app/assets/classDiagram-v2-OCEON4UE-Bjgk6QkN.js

@@ -1 +0,0 @@
-import{n as e}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import"./src-DF-84qwJ.js";import"./chunk-I66GZJ75-CbpQtX8e.js";import"./chunk-NSK5VX7P-Bo-dbDZD.js";import"./chunk-4I5QYGJK-DCgTj78f.js";import"./chunk-WRU74C26-DXijYjrx.js";import"./chunk-7BUUIJ7U-Bb538aSH.js";import"./chunk-UBXNYLIW-D9OoHV5X.js";import"./chunk-2GRJ4B5K-BLGsmyy4.js";import"./chunk-XXDRQBXY-DRMEt0Gf.js";import"./chunk-KBJHAD2P-Brvmen34.js";import"./chunk-W5SLKNZC-BNTcVpi3.js";import"./chunk-QR6OTTB3-B5Al5KEo.js";import"./chunk-7Z6QIM7H-CbBMe7ej.js";import{i as t,n,r,t as i}from"./chunk-GF5L2VYU-BXraqZ7w.js";import"./mermaid.core-DpvXaF3y.js";var a={parser:n,get db(){return new i},renderer:r,styles:t,init:e(e=>{e.class||={},e.class.arrowMarkerAbsolute=e.arrowMarkerAbsolute},`init`)};export{a as diagram};

package/console-app/assets/eventmodeling-45OFAUF4-DWRslJcU.js

@@ -1 +0,0 @@
-import"./chunk-KEIR6QF5-BICK3FdT.js";import{O as e}from"./mermaid-parser.core-DxPo1qbR.js";export{e as createEventModelingServices};

package/console-app/assets/flowDiagram-UKHOOZJN-CE3qN_pH.js

@@ -1 +0,0 @@
-import"./src-DF-84qwJ.js";import"./chunk-I66GZJ75-CbpQtX8e.js";import"./chunk-NSK5VX7P-Bo-dbDZD.js";import"./chunk-4I5QYGJK-DCgTj78f.js";import"./chunk-WRU74C26-DXijYjrx.js";import"./chunk-7BUUIJ7U-Bb538aSH.js";import"./chunk-UBXNYLIW-D9OoHV5X.js";import"./chunk-2GRJ4B5K-BLGsmyy4.js";import"./chunk-XXDRQBXY-DRMEt0Gf.js";import"./chunk-KBJHAD2P-Brvmen34.js";import"./chunk-W5SLKNZC-BNTcVpi3.js";import"./chunk-QR6OTTB3-B5Al5KEo.js";import"./chunk-7Z6QIM7H-CbBMe7ej.js";import{n as e}from"./chunk-JQJVKLGR-Cp9FHSH6.js";import"./mermaid.core-DpvXaF3y.js";export{e as diagram};

package/console-app/assets/railroad-abnf-AHOZXSZD-BfGOy69e.js

@@ -1 +0,0 @@
-import"./chunk-KEIR6QF5-BICK3FdT.js";import{m as e}from"./mermaid-parser.core-DxPo1qbR.js";export{e as createRailroadAbnfServices};

package/console-app/assets/railroad-ebnf-EBAXGLYW-BbGv9WfS.js

@@ -1 +0,0 @@
-import"./chunk-KEIR6QF5-BICK3FdT.js";import{f as e}from"./mermaid-parser.core-DxPo1qbR.js";export{e as createRailroadEbnfServices};

package/console-app/assets/railroad-peg-LSFZ7HO6-CCiPI8BL.js

@@ -1 +0,0 @@
-import"./chunk-KEIR6QF5-BICK3FdT.js";import{u as e}from"./mermaid-parser.core-DxPo1qbR.js";export{e as createRailroadPegServices};

package/console-app/assets/stateDiagram-v2-UEYNNEHI-BJln5PLd.js

@@ -1 +0,0 @@
-import{n as e}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import"./src-DF-84qwJ.js";import"./chunk-I66GZJ75-CbpQtX8e.js";import"./chunk-NSK5VX7P-Bo-dbDZD.js";import"./chunk-4I5QYGJK-DCgTj78f.js";import"./chunk-WRU74C26-DXijYjrx.js";import"./chunk-7BUUIJ7U-Bb538aSH.js";import"./chunk-UBXNYLIW-D9OoHV5X.js";import"./chunk-2GRJ4B5K-BLGsmyy4.js";import"./chunk-XXDRQBXY-DRMEt0Gf.js";import"./chunk-KBJHAD2P-Brvmen34.js";import"./chunk-W5SLKNZC-BNTcVpi3.js";import"./chunk-QR6OTTB3-B5Al5KEo.js";import"./chunk-7Z6QIM7H-CbBMe7ej.js";import{i as t,n,r,t as i}from"./chunk-5RXB4S5H-CX9hS68x.js";import"./mermaid.core-DpvXaF3y.js";var a={parser:n,get db(){return new i(2)},renderer:r,styles:t,init:e(e=>{e.state||={},e.state.arrowMarkerAbsolute=e.arrowMarkerAbsolute},`init`)};export{a as diagram};