@pikku/cli 0.12.134 → 0.12.136

package/snippets.json

@@ -14,7 +14,7 @@
   "aiAgentStream": "// Streaming endpoint — sends text-delta, tool-call, and usage events as they arrive.\nwireHTTP({\n  method: 'post',\n  route: '/agents/shop/stream',\n  func: agentStream('shopAssistant'),\n  auth: true,\n})",
   "aiAgentStreamClient": "export async function agentStreamExamples() {\n  pikkuRPC.setServerUrl('http://localhost:4000')\n  pikkuRPC.setAuthorizationJWT('user-jwt-token')\n\n  const stream = await pikkuRPC.agent.stream('shopAssistant', {\n    message: 'Add the cheapest USB hub to my basket',\n    threadId: 'thread-123',\n    resourceId: 'user-456',\n  })\n  return stream\n}",
   "auditDispatch": "await audit?.audit({\n  type: 'order.created',\n  source: 'explicit',\n  occurredAt: new Date().toISOString(),\n  metadata: { orderId, userId },\n})",
-  "betterAuthConfig": "export const auth = pikkuBetterAuth(\n  async ({\n    kysely,\n    secrets,\n    variables,\n    emailService,\n    scopeService,\n    logger,\n  }) => {\n    // `.reveal()` at the sink, not earlier: getSecret hands back a nominal\n    // SecretValue that no concretely-typed parameter accepts, so every disclosure\n    // is one greppable call. Better Auth wants the raw string, and this is where\n    // it stops being a secret in the type system.\n    const BETTER_AUTH_SECRET = (\n      await secrets.getSecret('BETTER_AUTH_SECRET')\n    ).reveal()\n    // Genuinely optional: unset simply disables /api/auth/sign-in/actor (scenarios\n    // off for this deployment) — the actor plugin refuses all sign-ins\n    // without it.\n    const SCENARIO_ACTOR_SECRET = await secrets\n      .getSecret('SCENARIO_ACTOR_SECRET')\n      .then((value) => value?.reveal())\n      .catch(() => undefined)\n    // Fabric operator admin: the RSA public key the control plane's token is\n    // verified against. The Fabric deployer pushes FABRIC_AUTH_PUBLIC_KEY onto\n    // every stage; locally it's simply absent, which disables /sign-in/fabric.\n    // Asymmetric — the app verifies, it can never forge an operator login.\n    const FABRIC_AUTH_PUBLIC_KEY = await variables.get('FABRIC_AUTH_PUBLIC_KEY')\n\n    return betterAuth({\n      secret: BETTER_AUTH_SECRET,\n      database: { db: kysely, type: 'sqlite' },\n      emailAndPassword: {\n        enabled: true,\n        // Without this, `requestPasswordReset` succeeds on the client and silently\n        // sends nothing — the \"Forgot password?\" flow looks wired and dead-ends.\n        // Better Auth builds `url` from its baseURL + the client's redirectTo, so\n        // the app only supplies the message. Errors are logged, never swallowed:\n        // a reset the user never receives must be visible in the logs.\n        sendResetPassword: async ({ user, url }) => {\n          await emailService.send({\n            to: user.email,\n            template: {\n              name: 'reset-password',\n              data: { email: user.email, resetUrl: url },\n            },\n          })\n        },\n      },\n      // Stateless session: CLI splits out betterAuthStatelessSession so non-auth\n      // units verify the signed cookie instead of bundling better-auth. pikku #737.\n      session: { cookieCache: { enabled: true } },\n      advanced: { database: { generateId: 'uuid' } },\n      // Scenario actors: synthetic users (user.actor = true, see\n      // db/sqlite/0002-user-actor.sql) signed in by pikkuScenario via\n      // POST /api/auth/sign-in/actor { email, secret }. Never signs in real users.\n      //\n      // pikkuBan(): adds the banned/banExpires/banReason columns (see\n      // db/sqlite/0003-admin.sql) and the session hook that refuses a banned\n      // user a session. better-auth's own admin() is refused by the inspector:\n      // it authorizes on a `user.role` column while pikku authorizes on scopes,\n      // and everything else it offered — list, create, ban, remove, revoke\n      // sessions, set password — is scoped RPCs in @pikku/addon-admin.\n      //\n      // pikkuFabric(): exposes /api/auth/sign-in/fabric — the Fabric control plane\n      // mints a short-lived RS256 token and signs in as a synthetic `fabric: true`\n      // admin operator (db/sqlite/0004-fabric.sql), so the console Users tab can\n      // list/impersonate real users without the operator being one of them. It\n      // verifies against FABRIC_AUTH_PUBLIC_KEY; a missing key disables the\n      // endpoint.\n      //\n      // `personas` is what provisions the scenario actors. The plugin creates a\n      // declared persona's account the first time an operator asks to act as an\n      // address the stage has no row for, so a deploy carries its actors with it\n      // without a bootstrap step. This does NOT belong in `pikkuServerLifecycle`'s\n      // afterStart: that hook only ever runs under `pikku dev` and `pikku serve`,\n      // so a deployed stage would provision nobody.\n      plugins: [\n        pikkuActor({ secret: SCENARIO_ACTOR_SECRET }),\n        pikkuBan(),\n        pikkuFabric({\n          publicKey: FABRIC_AUTH_PUBLIC_KEY,\n          scopeService,\n          logger,\n          personas: {\n            personas: personaConfigs,\n            environments: personaEnvironments,\n          },\n        }),\n      ],\n    })\n  }\n)",
+  "betterAuthConfig": "export const auth = pikkuBetterAuth(\n  async ({\n    kysely,\n    secrets,\n    variables,\n    emailService,\n    scopeService,\n    logger,\n  }) => {\n    // `.reveal()` at the sink, not earlier: getSecret hands back a nominal\n    // SecretValue that no concretely-typed parameter accepts, so every disclosure\n    // is one greppable call. Better Auth wants the raw string, and this is where\n    // it stops being a secret in the type system.\n    const BETTER_AUTH_SECRET = (\n      await secrets.getSecret('BETTER_AUTH_SECRET')\n    ).reveal()\n    // Genuinely optional: unset simply disables /api/auth/sign-in/actor (scenarios\n    // off for this deployment) — the actor plugin refuses all sign-ins\n    // without it.\n    const SCENARIO_ACTOR_SECRET = await secrets\n      .getSecret('SCENARIO_ACTOR_SECRET')\n      .then((value) => value?.reveal())\n      .catch(() => undefined)\n    // Fabric operator admin: the RSA public key the control plane's token is\n    // verified against. The Fabric deployer pushes FABRIC_AUTH_PUBLIC_KEY onto\n    // every stage; locally it's simply absent, which disables /sign-in/fabric.\n    // Asymmetric — the app verifies, it can never forge an operator login.\n    const FABRIC_AUTH_PUBLIC_KEY = await variables.get('FABRIC_AUTH_PUBLIC_KEY')\n    // The opt-in that lets a deployed stage run scenarios. Read through\n    // `variables` rather than left to `process.env`, because a Worker receives\n    // it as a binding and has no populated environment to find it in.\n    const ALLOW_ACTOR_SIGN_IN = await variables.get(ACTOR_SIGN_IN_OPT_IN_ENV)\n\n    return betterAuth({\n      secret: BETTER_AUTH_SECRET,\n      database: { db: kysely, type: 'sqlite' },\n      emailAndPassword: {\n        enabled: true,\n        // Without this, `requestPasswordReset` succeeds on the client and silently\n        // sends nothing — the \"Forgot password?\" flow looks wired and dead-ends.\n        // Better Auth builds `url` from its baseURL + the client's redirectTo, so\n        // the app only supplies the message. Errors are logged, never swallowed:\n        // a reset the user never receives must be visible in the logs.\n        sendResetPassword: async ({ user, url }) => {\n          await emailService.send({\n            to: user.email,\n            template: {\n              name: 'reset-password',\n              data: { email: user.email, resetUrl: url },\n            },\n          })\n        },\n      },\n      // Stateless session: CLI splits out betterAuthStatelessSession so non-auth\n      // units verify the signed cookie instead of bundling better-auth. pikku #737.\n      session: { cookieCache: { enabled: true } },\n      advanced: { database: { generateId: 'uuid' } },\n      // Scenario actors: synthetic users (user.actor = true, see\n      // db/sqlite/0002-user-actor.sql) signed in by pikkuScenario via\n      // POST /api/auth/sign-in/actor { email, secret }. Never signs in real users.\n      //\n      // pikkuBan(): adds the banned/banExpires/banReason columns (see\n      // db/sqlite/0003-admin.sql) and the session hook that refuses a banned\n      // user a session. better-auth's own admin() is refused by the inspector:\n      // it authorizes on a `user.role` column while pikku authorizes on scopes,\n      // and everything else it offered — list, create, ban, remove, revoke\n      // sessions, set password — is scoped RPCs in @pikku/addon-admin.\n      //\n      // pikkuFabric(): exposes /api/auth/sign-in/fabric — the Fabric control plane\n      // mints a short-lived RS256 token and signs in as a synthetic `fabric: true`\n      // admin operator (db/sqlite/0004-fabric.sql), so the console Users tab can\n      // list/impersonate real users without the operator being one of them. It\n      // verifies against FABRIC_AUTH_PUBLIC_KEY; a missing key disables the\n      // endpoint.\n      //\n      // `personas` is what provisions the scenario actors. The plugin creates a\n      // declared persona's account the first time an operator asks to act as an\n      // address the stage has no row for, so a deploy carries its actors with it\n      // without a bootstrap step. This does NOT belong in `pikkuServerLifecycle`'s\n      // afterStart: that hook only ever runs under `pikku dev` and `pikku serve`,\n      // so a deployed stage would provision nobody.\n      plugins: [\n        pikkuActor({\n          secret: SCENARIO_ACTOR_SECRET,\n          allowSignIn: ALLOW_ACTOR_SIGN_IN,\n        }),\n        pikkuBan(),\n        pikkuFabric({\n          publicKey: FABRIC_AUTH_PUBLIC_KEY,\n          scopeService,\n          logger,\n          personas: {\n            personas: personaConfigs,\n            environments: personaEnvironments,\n          },\n        }),\n      ],\n    })\n  }\n)",
   "cancelOrder": "export const cancelOrder = pikkuFunc({\n  expose: true,\n  description: 'Cancel a pending order and restore stock.',\n  input: CancelOrderInput,\n  // Authorization is declared, not written. `scopes` is what the role\n  // entitles the caller to and is AND-ed; `permissions` is what is true of\n  // this particular row and is OR-ed across keys. Both run before the body,\n  // so the function below only ever sees a caller who is allowed to be there.\n  //\n  // The `support` role holds `orders:cancel` without owning the order, so it\n  // passes on the scope; a customer passes on ownership. Neither case needs a\n  // branch in the body.\n  scopes: ['orders:cancel'],\n  permissions: {\n    owner: isOrderOwner,\n  },\n  // `node` describes this function as a step someone can drop into a visual\n  // flow: what to call it, where it files, and whether it starts a flow\n  // ('trigger'), continues one ('action') or ends it ('end'). Without it the\n  // function still works everywhere else — it just does not appear as a node.\n  node: {\n    displayName: 'Cancel Order',\n    category: 'Orders',\n    type: 'action',\n  },\n  func: async ({ kysely, queueService }, { orderId }, { session }) => {\n    const order = await kysely\n      .selectFrom('order')\n      .select(['orderId', 'userId', 'status'])\n      .where('orderId', '=', orderId)\n      .executeTakeFirst()\n\n    if (!order) throw new Error('Order not found')\n    if (!['pending', 'paid'].includes(order.status)) {\n      throw new Error(`Cannot cancel order in status: ${order.status}`)\n    }\n\n    // Restore stock\n    const items = await kysely\n      .selectFrom('orderItem')\n      .select(['itemId', 'quantity'])\n      .where('orderId', '=', orderId)\n      .execute()\n\n    const now = new Date().toISOString()\n    for (const item of items) {\n      await kysely\n        .updateTable('item')\n        .set((eb) => ({\n          stock: eb('stock', '+', item.quantity),\n          updatedAt: now,\n        }))\n        .where('itemId', '=', item.itemId)\n        .execute()\n    }\n\n    await kysely\n      .updateTable('order')\n      .set({ status: 'cancelled', updatedAt: now })\n      .where('orderId', '=', orderId)\n      .execute()\n\n    await queueService.add('audit-event', {\n      entityType: 'order',\n      entityId: orderId,\n      action: 'cancelled',\n      actorId: session.userId,\n    })\n  },\n})",
   "channelLifecycle": "export const onConnect = pikkuChannelConnectionFunc(\n  async ({ logger }, _, { channel }) => {\n    logger.info({ event: 'ws_connected', channelId: channel.channelId })\n  }\n)\n\nexport const onDisconnect = pikkuChannelDisconnectionFunc(\n  async ({ logger }, _, { channel }) => {\n    logger.info({ event: 'ws_disconnected', channelId: channel.channelId })\n  }\n)",
   "channelMiddleware": "export const traceAgentStream = pikkuChannelMiddleware<any, AgentStreamEvent>(\n  async ({ logger }, event, next) => {\n    logger.debug({ event: 'agent_stream', type: event.type })\n    await next(event)\n  }\n)",

package/surface.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.12.134",
+  "version": "0.12.136",
   "entryPoints": [
     {
       "id": "app",
@@ -3356,7 +3356,7 @@
               "docs": "Builds this project's Better Auth instance. The factory is handed the\nsingleton services, with typed `secrets` and `variables`, and is called\nlazily so config and secrets are resolved before auth is constructed.",
               "signature": "<I extends BetterAuthInstance>(factory: (services: AuthSingletonServices) => I | Promise<I>) => PikkuBetterAuthFactory<I>",
               "examples": [
-                "export const auth = pikkuBetterAuth(\n  async ({\n    kysely,\n    secrets,\n    variables,\n    emailService,\n    scopeService,\n    logger,\n  }) => {\n    // `.reveal()` at the sink, not earlier: getSecret hands back a nominal\n    // SecretValue that no concretely-typed parameter accepts, so every disclosure\n    // is one greppable call. Better Auth wants the raw string, and this is where\n    // it stops being a secret in the type system.\n    const BETTER_AUTH_SECRET = (\n      await secrets.getSecret('BETTER_AUTH_SECRET')\n    ).reveal()\n    // Genuinely optional: unset simply disables /api/auth/sign-in/actor (scenarios\n    // off for this deployment) — the actor plugin refuses all sign-ins\n    // without it.\n    const SCENARIO_ACTOR_SECRET = await secrets\n      .getSecret('SCENARIO_ACTOR_SECRET')\n      .then((value) => value?.reveal())\n      .catch(() => undefined)\n    // Fabric operator admin: the RSA public key the control plane's token is\n    // verified against. The Fabric deployer pushes FABRIC_AUTH_PUBLIC_KEY onto\n    // every stage; locally it's simply absent, which disables /sign-in/fabric.\n    // Asymmetric — the app verifies, it can never forge an operator login.\n    const FABRIC_AUTH_PUBLIC_KEY = await variables.get('FABRIC_AUTH_PUBLIC_KEY')\n\n    return betterAuth({\n      secret: BETTER_AUTH_SECRET,\n      database: { db: kysely, type: 'sqlite' },\n      emailAndPassword: {\n        enabled: true,\n        // Without this, `requestPasswordReset` succeeds on the client and silently\n        // sends nothing — the \"Forgot password?\" flow looks wired and dead-ends.\n        // Better Auth builds `url` from its baseURL + the client's redirectTo, so\n        // the app only supplies the message. Errors are logged, never swallowed:\n        // a reset the user never receives must be visible in the logs.\n        sendResetPassword: async ({ user, url }) => {\n          await emailService.send({\n            to: user.email,\n            template: {\n              name: 'reset-password',\n              data: { email: user.email, resetUrl: url },\n            },\n          })\n        },\n      },\n      // Stateless session: CLI splits out betterAuthStatelessSession so non-auth\n      // units verify the signed cookie instead of bundling better-auth. pikku #737.\n      session: { cookieCache: { enabled: true } },\n      advanced: { database: { generateId: 'uuid' } },\n      // Scenario actors: synthetic users (user.actor = true, see\n      // db/sqlite/0002-user-actor.sql) signed in by pikkuScenario via\n      // POST /api/auth/sign-in/actor { email, secret }. Never signs in real users.\n      //\n      // pikkuBan(): adds the banned/banExpires/banReason columns (see\n      // db/sqlite/0003-admin.sql) and the session hook that refuses a banned\n      // user a session. better-auth's own admin() is refused by the inspector:\n      // it authorizes on a `user.role` column while pikku authorizes on scopes,\n      // and everything else it offered — list, create, ban, remove, revoke\n      // sessions, set password — is scoped RPCs in @pikku/addon-admin.\n      //\n      // pikkuFabric(): exposes /api/auth/sign-in/fabric — the Fabric control plane\n      // mints a short-lived RS256 token and signs in as a synthetic `fabric: true`\n      // admin operator (db/sqlite/0004-fabric.sql), so the console Users tab can\n      // list/impersonate real users without the operator being one of them. It\n      // verifies against FABRIC_AUTH_PUBLIC_KEY; a missing key disables the\n      // endpoint.\n      //\n      // `personas` is what provisions the scenario actors. The plugin creates a\n      // declared persona's account the first time an operator asks to act as an\n      // address the stage has no row for, so a deploy carries its actors with it\n      // without a bootstrap step. This does NOT belong in `pikkuServerLifecycle`'s\n      // afterStart: that hook only ever runs under `pikku dev` and `pikku serve`,\n      // so a deployed stage would provision nobody.\n      plugins: [\n        pikkuActor({ secret: SCENARIO_ACTOR_SECRET }),\n        pikkuBan(),\n        pikkuFabric({\n          publicKey: FABRIC_AUTH_PUBLIC_KEY,\n          scopeService,\n          logger,\n          personas: {\n            personas: personaConfigs,\n            environments: personaEnvironments,\n          },\n        }),\n      ],\n    })\n  }\n)"
+                "export const auth = pikkuBetterAuth(\n  async ({\n    kysely,\n    secrets,\n    variables,\n    emailService,\n    scopeService,\n    logger,\n  }) => {\n    // `.reveal()` at the sink, not earlier: getSecret hands back a nominal\n    // SecretValue that no concretely-typed parameter accepts, so every disclosure\n    // is one greppable call. Better Auth wants the raw string, and this is where\n    // it stops being a secret in the type system.\n    const BETTER_AUTH_SECRET = (\n      await secrets.getSecret('BETTER_AUTH_SECRET')\n    ).reveal()\n    // Genuinely optional: unset simply disables /api/auth/sign-in/actor (scenarios\n    // off for this deployment) — the actor plugin refuses all sign-ins\n    // without it.\n    const SCENARIO_ACTOR_SECRET = await secrets\n      .getSecret('SCENARIO_ACTOR_SECRET')\n      .then((value) => value?.reveal())\n      .catch(() => undefined)\n    // Fabric operator admin: the RSA public key the control plane's token is\n    // verified against. The Fabric deployer pushes FABRIC_AUTH_PUBLIC_KEY onto\n    // every stage; locally it's simply absent, which disables /sign-in/fabric.\n    // Asymmetric — the app verifies, it can never forge an operator login.\n    const FABRIC_AUTH_PUBLIC_KEY = await variables.get('FABRIC_AUTH_PUBLIC_KEY')\n    // The opt-in that lets a deployed stage run scenarios. Read through\n    // `variables` rather than left to `process.env`, because a Worker receives\n    // it as a binding and has no populated environment to find it in.\n    const ALLOW_ACTOR_SIGN_IN = await variables.get(ACTOR_SIGN_IN_OPT_IN_ENV)\n\n    return betterAuth({\n      secret: BETTER_AUTH_SECRET,\n      database: { db: kysely, type: 'sqlite' },\n      emailAndPassword: {\n        enabled: true,\n        // Without this, `requestPasswordReset` succeeds on the client and silently\n        // sends nothing — the \"Forgot password?\" flow looks wired and dead-ends.\n        // Better Auth builds `url` from its baseURL + the client's redirectTo, so\n        // the app only supplies the message. Errors are logged, never swallowed:\n        // a reset the user never receives must be visible in the logs.\n        sendResetPassword: async ({ user, url }) => {\n          await emailService.send({\n            to: user.email,\n            template: {\n              name: 'reset-password',\n              data: { email: user.email, resetUrl: url },\n            },\n          })\n        },\n      },\n      // Stateless session: CLI splits out betterAuthStatelessSession so non-auth\n      // units verify the signed cookie instead of bundling better-auth. pikku #737.\n      session: { cookieCache: { enabled: true } },\n      advanced: { database: { generateId: 'uuid' } },\n      // Scenario actors: synthetic users (user.actor = true, see\n      // db/sqlite/0002-user-actor.sql) signed in by pikkuScenario via\n      // POST /api/auth/sign-in/actor { email, secret }. Never signs in real users.\n      //\n      // pikkuBan(): adds the banned/banExpires/banReason columns (see\n      // db/sqlite/0003-admin.sql) and the session hook that refuses a banned\n      // user a session. better-auth's own admin() is refused by the inspector:\n      // it authorizes on a `user.role` column while pikku authorizes on scopes,\n      // and everything else it offered — list, create, ban, remove, revoke\n      // sessions, set password — is scoped RPCs in @pikku/addon-admin.\n      //\n      // pikkuFabric(): exposes /api/auth/sign-in/fabric — the Fabric control plane\n      // mints a short-lived RS256 token and signs in as a synthetic `fabric: true`\n      // admin operator (db/sqlite/0004-fabric.sql), so the console Users tab can\n      // list/impersonate real users without the operator being one of them. It\n      // verifies against FABRIC_AUTH_PUBLIC_KEY; a missing key disables the\n      // endpoint.\n      //\n      // `personas` is what provisions the scenario actors. The plugin creates a\n      // declared persona's account the first time an operator asks to act as an\n      // address the stage has no row for, so a deploy carries its actors with it\n      // without a bootstrap step. This does NOT belong in `pikkuServerLifecycle`'s\n      // afterStart: that hook only ever runs under `pikku dev` and `pikku serve`,\n      // so a deployed stage would provision nobody.\n      plugins: [\n        pikkuActor({\n          secret: SCENARIO_ACTOR_SECRET,\n          allowSignIn: ALLOW_ACTOR_SIGN_IN,\n        }),\n        pikkuBan(),\n        pikkuFabric({\n          publicKey: FABRIC_AUTH_PUBLIC_KEY,\n          scopeService,\n          logger,\n          personas: {\n            personas: personaConfigs,\n            environments: personaEnvironments,\n          },\n        }),\n      ],\n    })\n  }\n)"
               ]
             },
             {

package/console-app/assets/architecture-TIHT7OUA-G_ldr-C2.js

@@ -1 +0,0 @@
-import"./chunk-KEIR6QF5-BICK3FdT.js";import{M as e}from"./mermaid-parser.core-DxPo1qbR.js";export{e as createArchitectureServices};

package/console-app/assets/channel-CuDpOUYn.js

@@ -1 +0,0 @@
-import{at as e,ot as t}from"./chunk-I66GZJ75-CbpQtX8e.js";var n=(n,r)=>t.lang.round(e.parse(n)[r]);export{n as t};

package/console-app/assets/chunk-XXDRQBXY-DRMEt0Gf.js

@@ -1 +0,0 @@
-import{p as e}from"./index-DqNqujdF.js";import{n as t}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import"./src-DF-84qwJ.js";var n=t((t,n)=>{let r;return n===`sandbox`&&(r=e(`#i`+t)),e(n===`sandbox`?r.nodes()[0].contentDocument.body:`body`).select(`[id="${t}"]`)},`getDiagramElement`);export{n as t};

package/console-app/assets/classDiagram-JCYQIIEL-Bjgk6QkN.js

@@ -1 +0,0 @@
-import{n as e}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import"./src-DF-84qwJ.js";import"./chunk-I66GZJ75-CbpQtX8e.js";import"./chunk-NSK5VX7P-Bo-dbDZD.js";import"./chunk-4I5QYGJK-DCgTj78f.js";import"./chunk-WRU74C26-DXijYjrx.js";import"./chunk-7BUUIJ7U-Bb538aSH.js";import"./chunk-UBXNYLIW-D9OoHV5X.js";import"./chunk-2GRJ4B5K-BLGsmyy4.js";import"./chunk-XXDRQBXY-DRMEt0Gf.js";import"./chunk-KBJHAD2P-Brvmen34.js";import"./chunk-W5SLKNZC-BNTcVpi3.js";import"./chunk-QR6OTTB3-B5Al5KEo.js";import"./chunk-7Z6QIM7H-CbBMe7ej.js";import{i as t,n,r,t as i}from"./chunk-GF5L2VYU-BXraqZ7w.js";import"./mermaid.core-DpvXaF3y.js";var a={parser:n,get db(){return new i},renderer:r,styles:t,init:e(e=>{e.class||={},e.class.arrowMarkerAbsolute=e.arrowMarkerAbsolute},`init`)};export{a as diagram};

package/console-app/assets/classDiagram-v2-OCEON4UE-Bjgk6QkN.js

@@ -1 +0,0 @@
-import{n as e}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import"./src-DF-84qwJ.js";import"./chunk-I66GZJ75-CbpQtX8e.js";import"./chunk-NSK5VX7P-Bo-dbDZD.js";import"./chunk-4I5QYGJK-DCgTj78f.js";import"./chunk-WRU74C26-DXijYjrx.js";import"./chunk-7BUUIJ7U-Bb538aSH.js";import"./chunk-UBXNYLIW-D9OoHV5X.js";import"./chunk-2GRJ4B5K-BLGsmyy4.js";import"./chunk-XXDRQBXY-DRMEt0Gf.js";import"./chunk-KBJHAD2P-Brvmen34.js";import"./chunk-W5SLKNZC-BNTcVpi3.js";import"./chunk-QR6OTTB3-B5Al5KEo.js";import"./chunk-7Z6QIM7H-CbBMe7ej.js";import{i as t,n,r,t as i}from"./chunk-GF5L2VYU-BXraqZ7w.js";import"./mermaid.core-DpvXaF3y.js";var a={parser:n,get db(){return new i},renderer:r,styles:t,init:e(e=>{e.class||={},e.class.arrowMarkerAbsolute=e.arrowMarkerAbsolute},`init`)};export{a as diagram};

package/console-app/assets/eventmodeling-45OFAUF4-DWRslJcU.js

@@ -1 +0,0 @@
-import"./chunk-KEIR6QF5-BICK3FdT.js";import{O as e}from"./mermaid-parser.core-DxPo1qbR.js";export{e as createEventModelingServices};

package/console-app/assets/flowDiagram-UKHOOZJN-CE3qN_pH.js

@@ -1 +0,0 @@
-import"./src-DF-84qwJ.js";import"./chunk-I66GZJ75-CbpQtX8e.js";import"./chunk-NSK5VX7P-Bo-dbDZD.js";import"./chunk-4I5QYGJK-DCgTj78f.js";import"./chunk-WRU74C26-DXijYjrx.js";import"./chunk-7BUUIJ7U-Bb538aSH.js";import"./chunk-UBXNYLIW-D9OoHV5X.js";import"./chunk-2GRJ4B5K-BLGsmyy4.js";import"./chunk-XXDRQBXY-DRMEt0Gf.js";import"./chunk-KBJHAD2P-Brvmen34.js";import"./chunk-W5SLKNZC-BNTcVpi3.js";import"./chunk-QR6OTTB3-B5Al5KEo.js";import"./chunk-7Z6QIM7H-CbBMe7ej.js";import{n as e}from"./chunk-JQJVKLGR-Cp9FHSH6.js";import"./mermaid.core-DpvXaF3y.js";export{e as diagram};

package/console-app/assets/railroad-abnf-AHOZXSZD-BfGOy69e.js

@@ -1 +0,0 @@
-import"./chunk-KEIR6QF5-BICK3FdT.js";import{m as e}from"./mermaid-parser.core-DxPo1qbR.js";export{e as createRailroadAbnfServices};

package/console-app/assets/railroad-ebnf-EBAXGLYW-BbGv9WfS.js

@@ -1 +0,0 @@
-import"./chunk-KEIR6QF5-BICK3FdT.js";import{f as e}from"./mermaid-parser.core-DxPo1qbR.js";export{e as createRailroadEbnfServices};

package/console-app/assets/railroad-peg-LSFZ7HO6-CCiPI8BL.js

@@ -1 +0,0 @@
-import"./chunk-KEIR6QF5-BICK3FdT.js";import{u as e}from"./mermaid-parser.core-DxPo1qbR.js";export{e as createRailroadPegServices};

package/console-app/assets/stateDiagram-v2-UEYNNEHI-BJln5PLd.js

@@ -1 +0,0 @@
-import{n as e}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import"./src-DF-84qwJ.js";import"./chunk-I66GZJ75-CbpQtX8e.js";import"./chunk-NSK5VX7P-Bo-dbDZD.js";import"./chunk-4I5QYGJK-DCgTj78f.js";import"./chunk-WRU74C26-DXijYjrx.js";import"./chunk-7BUUIJ7U-Bb538aSH.js";import"./chunk-UBXNYLIW-D9OoHV5X.js";import"./chunk-2GRJ4B5K-BLGsmyy4.js";import"./chunk-XXDRQBXY-DRMEt0Gf.js";import"./chunk-KBJHAD2P-Brvmen34.js";import"./chunk-W5SLKNZC-BNTcVpi3.js";import"./chunk-QR6OTTB3-B5Al5KEo.js";import"./chunk-7Z6QIM7H-CbBMe7ej.js";import{i as t,n,r,t as i}from"./chunk-5RXB4S5H-CX9hS68x.js";import"./mermaid.core-DpvXaF3y.js";var a={parser:n,get db(){return new i(2)},renderer:r,styles:t,init:e(e=>{e.state||={},e.state.arrowMarkerAbsolute=e.arrowMarkerAbsolute},`init`)};export{a as diagram};

package/console-app/assets/swimlanesDiagram-ULZ7WXOC-CSLhmtbh.js

@@ -1,8 +0,0 @@
-import{n as e}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import"./src-DF-84qwJ.js";import"./chunk-I66GZJ75-CbpQtX8e.js";import"./chunk-NSK5VX7P-Bo-dbDZD.js";import"./chunk-4I5QYGJK-DCgTj78f.js";import"./chunk-WRU74C26-DXijYjrx.js";import"./chunk-7BUUIJ7U-Bb538aSH.js";import"./chunk-UBXNYLIW-D9OoHV5X.js";import"./chunk-2GRJ4B5K-BLGsmyy4.js";import"./chunk-XXDRQBXY-DRMEt0Gf.js";import"./chunk-KBJHAD2P-Brvmen34.js";import"./chunk-W5SLKNZC-BNTcVpi3.js";import"./chunk-QR6OTTB3-B5Al5KEo.js";import"./chunk-7Z6QIM7H-CbBMe7ej.js";import{r as t,t as n}from"./chunk-JQJVKLGR-Cp9FHSH6.js";import"./mermaid.core-DpvXaF3y.js";var r=n({defaultLayout:`swimlane`,styles:e(e=>`${t(e)}
-  .swimlane.cluster rect {
-    stroke: ${e.clusterBorder} !important;
-  }
-  [data-look="neo"].cluster rect {
-    filter: none;
-  }
-`,`getStyles`)});export{r as diagram};

package/dist/.pikku/schemas/schemas/PikkuUserAdminFunctionsOutput.schema.json

@@ -1 +0,0 @@
-{ "$schema": "http://json-schema.org/draft-07/schema#", "type": "boolean", "enum": [false, true], "definitions": {} }

package/dist/src/functions/wirings/user-admin/pikku-command-user-admin-functions.d.ts

@@ -1 +0,0 @@
-export declare const pikkuUserAdminFunctions: import("#pikku/function").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/user-admin/pikku-command-user-admin-functions.js

@@ -1,55 +0,0 @@
-import { pikkuSessionlessFunc } from '#pikku/function';
-import { getLeafImportPath } from '../../../utils/leaf-import-path.js';
-import { writeFileInDir } from '../../../utils/file-writer.js';
-import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
-import { serializeUserAdminFunctions } from './serialize-user-admin-functions.js';
-export const pikkuUserAdminFunctions = pikkuSessionlessFunc({
-    func: async ({ logger, config, getInspectorState }) => {
-        if (!config.scaffold?.userAdmin ||
-            !config.userAdminFunctionsFile ||
-            !config.userAdminSchemasFile) {
-            logger.debug({
-                message: 'Skipping user admin scaffold (set scaffold.userAdmin in pikku.config.json to enable).',
-                type: 'skip',
-            });
-            return false;
-        }
-        const { definition } = (await getInspectorState()).auth;
-        // Every one of these functions drives better-auth's internal adapter, so
-        // without a better-auth instance the scaffold would generate RPCs that
-        // throw on every call and scopes that grant nothing. Fail the codegen
-        // instead of shipping that.
-        if (!definition) {
-            throw new Error(`"scaffold.userAdmin" is enabled but no pikkuBetterAuth(...) was found in the project.\n` +
-                `User management works through better-auth's internal adapter, so there is nothing to manage.\n` +
-                `Fix: set up Better Auth before scaffolding user management, or remove ` +
-                `"scaffold.userAdmin" from pikku.config.json.`);
-        }
-        // Ban is the one capability with a schema requirement of its own, and it is
-        // only one of the six — a warning rather than a failure, so an app that
-        // never bans anyone is not forced to carry the columns.
-        // The plugin ids here are the callee names read off the `plugins: [...]`
-        // array, so both the current `pikkuBan()` and the deprecated `ban()` alias
-        // have to count as wired.
-        const bansUsers = definition.plugins.includes('pikkuBan') ||
-            definition.plugins.includes('ban');
-        if (!bansUsers) {
-            logger.warn(`"scaffold.userAdmin" is enabled but better-auth is configured without the pikkuBan() plugin, ` +
-                `so the banned/banReason/banExpires columns do not exist and setUserBanned will fail.\n` +
-                `Fix: add pikkuBan() to the plugins array in ${definition.sourceFile}:\n` +
-                `  import { pikkuBan } from '@pikku/better-auth'\n` +
-                `  betterAuth({ plugins: [pikkuBan()] })`);
-        }
-        const leaf = (name) => getLeafImportPath(config.userAdminFunctionsFile, name, config);
-        const { schemas, functions } = serializeUserAdminFunctions(leaf);
-        await writeFileInDir(logger, config.userAdminSchemasFile, schemas);
-        await writeFileInDir(logger, config.userAdminFunctionsFile, functions);
-        return true;
-    },
-    middleware: [
-        logCommandInfoAndTime({
-            commandStart: 'Generating user management functions',
-            commandEnd: 'Generated user management functions',
-        }),
-    ],
-});

package/dist/src/functions/wirings/user-admin/serialize-user-admin-functions.d.ts

@@ -1,25 +0,0 @@
-export interface UserAdminGenOutput {
-    schemas: string;
-    functions: string;
-}
-/**
- * Generate the user-management functions into the project scaffold: the
- * directory read plus the writes that administer it.
- *
- * Superseded by `@pikku/addon-admin`, which ships these same functions plus
- * roles, credentials and the audit trail, and which an app can wire without
- * installing the console. Kept for hosts still on the scaffold; the scope tree
- * below must stay byte-identical to the addon's, or an app with both fails
- * codegen on conflicting declarations.
- *
- * Each function is gated on its own `admin:users:*` scope, and works through
- * better-auth's internal adapter. Banning additionally needs the `pikkuBan()` plugin
- * from `@pikku/better-auth` for the columns it writes to exist.
- *
- * Emitted as two files. The schemas are zod, and the inspector reads a zod
- * schema by importing the module that declares it — which it cannot do for the
- * functions file, whose relative pikku-types import per-unit deploy codegen
- * rewrites. Keeping the schemas in a sibling module that imports nothing but
- * zod sidesteps that entirely.
- */
-export declare const serializeUserAdminFunctions: (leaf: (name: string) => string) => UserAdminGenOutput;

package/dist/src/functions/wirings/user-admin/serialize-user-admin-functions.js

@@ -1,294 +0,0 @@
-/**
- * Generate the user-management functions into the project scaffold: the
- * directory read plus the writes that administer it.
- *
- * Superseded by `@pikku/addon-admin`, which ships these same functions plus
- * roles, credentials and the audit trail, and which an app can wire without
- * installing the console. Kept for hosts still on the scaffold; the scope tree
- * below must stay byte-identical to the addon's, or an app with both fails
- * codegen on conflicting declarations.
- *
- * Each function is gated on its own `admin:users:*` scope, and works through
- * better-auth's internal adapter. Banning additionally needs the `pikkuBan()` plugin
- * from `@pikku/better-auth` for the columns it writes to exist.
- *
- * Emitted as two files. The schemas are zod, and the inspector reads a zod
- * schema by importing the module that declares it — which it cannot do for the
- * functions file, whose relative pikku-types import per-unit deploy codegen
- * rewrites. Keeping the schemas in a sibling module that imports nothing but
- * zod sidesteps that entirely.
- */
-export const serializeUserAdminFunctions = (leaf) => {
-    const schemas = `/**
- * Auto-generated user management schemas
- * Do not edit manually - regenerate with 'npx pikku'
- */
-import { z } from 'zod'
-
-/**
- * A user, as the directory sees one. Ban state is optional because those
- * columns belong to the \`pikkuBan()\` plugin: a host without it reports no ban state
- * at all, which a client can render as "unknown" rather than as a misleading
- * "not banned".
- */
-export const User = z.object({
-  id: z.string(),
-  email: z.string(),
-  name: z.string().optional(),
-  image: z.string().optional(),
-  createdAt: z.string().optional(),
-  banned: z.boolean().optional(),
-  banReason: z.string().optional(),
-  banExpires: z.string().optional(),
-})
-
-export const ListUsersInput = z.object({
-  search: z.string().optional(),
-  limit: z.number().int().positive().optional(),
-})
-
-export const ListUsersOutput = z.object({
-  users: z.array(User),
-})
-
-export const CreateUserInput = z.object({
-  email: z.string(),
-  password: z.string(),
-  name: z.string().optional(),
-})
-
-export const CreateUserOutput = z.object({
-  userId: z.string(),
-})
-
-/** Every write targets one user by id. */
-export const UserRef = z.object({
-  userId: z.string(),
-})
-
-export const SetUserBannedInput = z.object({
-  userId: z.string(),
-  banned: z.boolean(),
-  reason: z.string().optional(),
-  expiresInSeconds: z.number().int().positive().optional(),
-})
-
-export const SetUserPasswordInput = z.object({
-  userId: z.string(),
-  newPassword: z.string(),
-})
-
-export const Success = z.object({
-  success: z.boolean(),
-})
-`;
-    const functions = `/**
- * Auto-generated user management functions
- * Do not edit manually - regenerate with 'npx pikku'
- */
-import { pikkuFunc } from '${leaf('function')}'
-import { defineScope } from '${leaf('scopes')}'
-import {
-  createAuthUser,
-  deleteAuthUser,
-  revokeAuthUserSessions,
-  setAuthUserBanned,
-  setAuthUserPassword,
-} from '@pikku/better-auth'
-import {
-  CreateUserInput,
-  CreateUserOutput,
-  ListUsersInput,
-  ListUsersOutput,
-  SetUserBannedInput,
-  SetUserPasswordInput,
-  Success,
-  UserRef,
-} from './user-admin.schemas.gen.js'
-
-// pikku requires every declaration of a shared scope root to be identical, so
-// this is the whole \`admin\` tree — not just the leaves gated below. It must stay
-// byte-identical to ADMIN_SCOPE_TREE in @pikku/better-auth and to the copy in
-// @pikku/addon-admin, or codegen fails with conflicting declarations.
-defineScope({
-  admin: {
-    displayName: 'Administration',
-    description: 'Capabilities that act on the application as a whole',
-    scopes: {
-      impersonate: { description: 'Act as another user' },
-      credentials: {
-        description: 'Application-wide credentials',
-        scopes: {
-          link: { description: 'Bind a shared credential for every user' },
-          read: { description: 'Read credential values and who holds them' },
-          manage: { description: 'Set and delete credentials' },
-        },
-      },
-      users: {
-        description: 'The user directory',
-        scopes: {
-          list: { description: 'List and search users' },
-          create: { description: 'Create users out of band' },
-          ban: { description: 'Ban and unban users' },
-          remove: { description: 'Delete users and all their data' },
-          sessions: { description: "Revoke a user's sessions" },
-          password: { description: "Set a user's password" },
-        },
-      },
-      scopes: {
-        description: 'Authorization management',
-        scopes: {
-          read: {
-            description: 'View declared scopes, roles, and who holds them',
-          },
-          manage: {
-            description:
-              'Create and delete roles, change their scopes, and grant roles to users',
-          },
-        },
-      },
-      audit: {
-        description: 'The audit trail',
-        scopes: {
-          read: {
-            description:
-              'Read the audit trail — every recorded action, and which user took it',
-          },
-        },
-      },
-    },
-  },
-})
-
-/**
- * Synthetic principals — the platform credential owner, fabric service users
- * and agent actors — are not people, so they never belong in a directory a
- * human picks from.
- */
-const isPerson = (row: any) =>
-  row.fabric !== true && row.actor !== true && row.id !== 'pikku-platform'
-
-export const pikkuAdminListUsers = pikkuFunc({
-  tags: ['pikku'],
-  title: 'List Users',
-  description:
-    'Lists and searches the user directory, read through the auth adapter so it works on any database better-auth supports.',
-  expose: true,
-  scopes: ['admin:users:list'],
-  input: ListUsersInput,
-  output: ListUsersOutput,
-  func: async ({ auth }, { search, limit }) => {
-    const ctx = await (await auth()).$context
-    const rows = (await ctx.adapter.findMany({
-      model: 'user',
-      limit: limit ?? 200,
-      where: search
-        ? [{ field: 'email', operator: 'contains', value: search }]
-        : undefined,
-    })) as any[]
-
-    return {
-      users: rows.filter(isPerson).map((row) => ({
-        id: row.id,
-        email: row.email,
-        name: row.name ?? undefined,
-        image: row.image ?? undefined,
-        createdAt: row.createdAt
-          ? new Date(row.createdAt).toISOString()
-          : undefined,
-        banned: typeof row.banned === 'boolean' ? row.banned : undefined,
-        banReason: row.banReason ?? undefined,
-        banExpires: row.banExpires
-          ? new Date(row.banExpires).toISOString()
-          : undefined,
-      })),
-    }
-  },
-})
-
-export const pikkuAdminCreateUser = pikkuFunc({
-  tags: ['pikku'],
-  title: 'Create User',
-  description:
-    'Creates a user directly, for provisioning an account out of band rather than through your sign-up flow. Enforces the configured password bounds and rejects a duplicate email.',
-  expose: true,
-  scopes: ['admin:users:create'],
-  input: CreateUserInput,
-  output: CreateUserOutput,
-  func: async ({ auth }, { email, password, name }) => ({
-    userId: await createAuthUser(auth, { email, password, name }),
-  }),
-})
-
-export const pikkuAdminSetUserBanned = pikkuFunc({
-  tags: ['pikku'],
-  title: 'Ban or Unban User',
-  description:
-    'Bans a user — revoking their sessions and blocking sign-in — or lifts an existing ban. An expiry lets the ban lapse on its own; without one it holds until it is lifted. Requires better-auth wired with the \`pikkuBan()\` plugin.',
-  expose: true,
-  scopes: ['admin:users:ban'],
-  input: SetUserBannedInput,
-  output: Success,
-  func: async (
-    { auth },
-    { userId, banned, reason, expiresInSeconds },
-    { session }
-  ) => {
-    if (banned && userId === session?.userId) {
-      throw new Error('You cannot ban yourself')
-    }
-    await setAuthUserBanned(auth, { userId, banned, reason, expiresInSeconds })
-    return { success: true }
-  },
-})
-
-export const pikkuAdminRemoveUser = pikkuFunc({
-  tags: ['pikku'],
-  title: 'Remove User',
-  description:
-    'Permanently deletes a user along with their sessions and linked accounts. Cannot be undone.',
-  expose: true,
-  scopes: ['admin:users:remove'],
-  input: UserRef,
-  output: Success,
-  func: async ({ auth }, { userId }, { session }) => {
-    if (userId === session?.userId) {
-      throw new Error('You cannot delete yourself')
-    }
-    await deleteAuthUser(auth, userId)
-    return { success: true }
-  },
-})
-
-export const pikkuAdminRevokeUserSessions = pikkuFunc({
-  tags: ['pikku'],
-  title: 'Revoke User Sessions',
-  description:
-    'Signs a user out of every device by deleting all of their sessions. They keep their account and can sign in again.',
-  expose: true,
-  scopes: ['admin:users:sessions'],
-  input: UserRef,
-  output: Success,
-  func: async ({ auth }, { userId }) => {
-    await revokeAuthUserSessions(auth, userId)
-    return { success: true }
-  },
-})
-
-export const pikkuAdminSetUserPassword = pikkuFunc({
-  tags: ['pikku'],
-  title: "Set User's Password",
-  description:
-    'Sets a user password out of band, for when they cannot complete a reset themselves. Enforces the configured length bounds, and gives a user who only ever signed in socially a credential account.',
-  expose: true,
-  scopes: ['admin:users:password'],
-  input: SetUserPasswordInput,
-  output: Success,
-  func: async ({ auth }, { userId, newPassword }) => {
-    await setAuthUserPassword(auth, { userId, newPassword })
-    return { success: true }
-  },
-})
-`;
-    return { schemas, functions };
-};