@pikku/cli 0.12.162 → 0.12.163

package/dist/.pikku/services/pikku-meta-service.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.162
+ * This file was generated by @pikku/cli@0.12.163
  */
 import { LocalMetaService } from '@pikku/core/services/local-meta';
 export declare class PikkuMetaService extends LocalMetaService {

package/dist/.pikku/services/pikku-meta-service.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.162
+ * This file was generated by @pikku/cli@0.12.163
  */
 import { LocalMetaService } from '@pikku/core/services/local-meta';
 export class PikkuMetaService extends LocalMetaService {

package/dist/.pikku/setup/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.162
+ * This file was generated by @pikku/cli@0.12.163
  */
 /**
  * Subpath entry — `#pikku/setup` resolves here.

package/dist/.pikku/setup/index.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.162
+ * This file was generated by @pikku/cli@0.12.163
  */
 /**
  * Subpath entry — `#pikku/setup` resolves here.

package/dist/.pikku/setup/pikku-setup-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.162
+ * This file was generated by @pikku/cli@0.12.163
  */
 /**
  * Config and service factory definitions, declared once per application

package/dist/.pikku/setup/pikku-setup-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.162
+ * This file was generated by @pikku/cli@0.12.163
  */
 /**
  * Config and service factory definitions, declared once per application

package/dist/.pikku/trigger/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.162
+ * This file was generated by @pikku/cli@0.12.163
  */
 /**
  * Subpath entry — `#pikku/trigger` resolves here.

package/dist/.pikku/trigger/index.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.162
+ * This file was generated by @pikku/cli@0.12.163
  */
 /**
  * Subpath entry — `#pikku/trigger` resolves here.

package/dist/.pikku/trigger/pikku-trigger-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.162
+ * This file was generated by @pikku/cli@0.12.163
  */
 /**
  * Trigger-specific type definitions for tree-shaking optimization

package/dist/.pikku/trigger/pikku-trigger-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.162
+ * This file was generated by @pikku/cli@0.12.163
  */
 /**
  * Trigger-specific type definitions for tree-shaking optimization

package/dist/.pikku/variables/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.162
+ * This file was generated by @pikku/cli@0.12.163
  */
 /**
  * Subpath entry — `#pikku/variables` resolves here.

package/dist/.pikku/variables/index.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.162
+ * This file was generated by @pikku/cli@0.12.163
  */
 /**
  * Subpath entry — `#pikku/variables` resolves here.

package/dist/.pikku/variables/pikku-variable-types.gen.d.ts

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.162
+ * This file was generated by @pikku/cli@0.12.163
  */
 export { defineVariable } from '@pikku/core/variable';

package/dist/.pikku/variables/pikku-variable-types.gen.js

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.162
+ * This file was generated by @pikku/cli@0.12.163
  */
 export { defineVariable } from '@pikku/core/variable';

package/dist/.pikku/variables/pikku-variables.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.162
+ * This file was generated by @pikku/cli@0.12.163
  */
 import { TypedVariablesService as CoreTypedVariablesService } from '@pikku/core/services';
 import type { VariablesService } from '@pikku/core/services';

package/dist/.pikku/variables/pikku-variables.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.162
+ * This file was generated by @pikku/cli@0.12.163
  */
 import { TypedVariablesService as CoreTypedVariablesService, } from '@pikku/core/services';
 /**

package/dist/.pikku/workflow/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.162
+ * This file was generated by @pikku/cli@0.12.163
  */
 /**
  * Subpath entry — `#pikku/workflow` resolves here.

package/dist/.pikku/workflow/index.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.162
+ * This file was generated by @pikku/cli@0.12.163
  */
 /**
  * Subpath entry — `#pikku/workflow` resolves here.

package/dist/.pikku/workflow/pikku-workflow-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.162
+ * This file was generated by @pikku/cli@0.12.163
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import type { PikkuWorkflowGraphConfig, PikkuWorkflowGraphResult } from '@pikku/core/workflow';

package/dist/.pikku/workflow/pikku-workflow-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.162
+ * This file was generated by @pikku/cli@0.12.163
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import { pikkuWorkflowGraph as corePikkuWorkflowGraph } from '@pikku/core/workflow';

package/dist/.pikku/workflow/pikku-workflow-wirings-meta.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.162
+ * This file was generated by @pikku/cli@0.12.163
  */
 import { pikkuState } from '@pikku/core/state';
 import allWorkflowMeta from './meta/allWorkflow.gen.json' with { type: 'json' };

package/dist/.pikku/workflow/pikku-workflow-wirings.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.162
+ * This file was generated by @pikku/cli@0.12.163
  */
 import { addWorkflow } from '@pikku/core/workflow';
 import './pikku-workflow-wirings-meta.gen.js';

package/dist/bin/pikku-bin.mjs

@@ -11,8 +11,8 @@ async function checkForUpdate() {
     })
     if (!res.ok) return
     const { version: latest } = await res.json()
-    if (latest !== '0.12.162') {
-      process.stderr.write(`\n  Update available  0.12.162 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
+    if (latest !== '0.12.163') {
+      process.stderr.write(`\n  Update available  0.12.163 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
     }
   } catch {}
 }

package/dist/src/cli.wiring.js

@@ -958,14 +958,32 @@ wireCLI({
                             default: false,
                         },
                         credential: {
-                            description: 'Include per-user credential wiring (apikey, bearer, or oauth2)',
+                            description: 'Per-user credential type (apikey, bearer, basic, or oauth2); with --openapi it defaults to what the spec declares',
+                        },
+                        auth: {
+                            description: 'With --openapi: user (default — each user connects their own credential), shared (one secret behind every user), or none (public API)',
                         },
                         test: {
                             description: 'Include test harness (default: true)',
                             default: true,
                         },
                         openapi: {
-                            description: 'Path to OpenAPI YAML/JSON spec to generate functions from',
+                            description: 'Path or URL of an OpenAPI 3.x / Swagger 2.0 spec (YAML or JSON) to generate functions from',
+                        },
+                        openapiHeader: {
+                            description: 'Header sent when fetching --openapi from a URL, as "Name: value" (repeatable), for specs published only to authenticated requests',
+                        },
+                        tags: {
+                            description: 'With --openapi: keep only operations with these tags',
+                        },
+                        include: {
+                            description: 'With --openapi: keep only operations matching these globs (operationId, /path or "METHOD /path")',
+                        },
+                        exclude: {
+                            description: 'With --openapi: drop operations matching these globs (operationId, /path or "METHOD /path")',
+                        },
+                        install: {
+                            description: 'With --openapi inside an app: add the addon to the app — dependencies, wireAddon, auth wiring, base URL (default: on inside an app)',
                         },
                         authConfig: {
                             description: 'Path to an auth-config JSON overriding the spec (custom auth header, delegated login)',

package/dist/src/functions/commands/dev-credentials.d.ts

@@ -0,0 +1,18 @@
+import { type CredentialService, type Logger } from '@pikku/core/services';
+export declare const DEV_CREDENTIALS_KEY_ENV = "PIKKU_DEV_CREDENTIALS_KEY";
+/**
+ * The key the dev server encrypts stored credentials with. It must outlive the
+ * process, or every credential written before a restart becomes unreadable
+ * while the session that owns it stays valid.
+ */
+export declare const resolveDevCredentialsKey: (runtimeDir: string, env?: NodeJS.ProcessEnv) => string;
+/**
+ * A credential store that survives `pikku dev` restarts when the project has a
+ * database with the credential tables, and the in-memory one otherwise.
+ */
+export declare const createDevCredentialService: ({ kysely, runtimeDir, logger, expectsCredentials, }: {
+    kysely: unknown;
+    runtimeDir: string;
+    logger: Logger;
+    expectsCredentials: boolean;
+}) => Promise<CredentialService>;

package/dist/src/functions/commands/dev-credentials.js

@@ -0,0 +1,59 @@
+import { randomBytes } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { KyselyCredentialService } from '@pikku/kysely';
+import { LocalCredentialService, } from '@pikku/core/services';
+export const DEV_CREDENTIALS_KEY_ENV = 'PIKKU_DEV_CREDENTIALS_KEY';
+const KEY_FILE = 'dev-credentials.key';
+/**
+ * The key the dev server encrypts stored credentials with. It must outlive the
+ * process, or every credential written before a restart becomes unreadable
+ * while the session that owns it stays valid.
+ */
+export const resolveDevCredentialsKey = (runtimeDir, env = process.env) => {
+    const fromEnv = env[DEV_CREDENTIALS_KEY_ENV]?.trim();
+    if (fromEnv)
+        return fromEnv;
+    const file = join(runtimeDir, KEY_FILE);
+    if (existsSync(file)) {
+        const stored = readFileSync(file, 'utf8').trim();
+        if (stored)
+            return stored;
+    }
+    const key = randomBytes(32).toString('base64');
+    mkdirSync(runtimeDir, { recursive: true });
+    try {
+        writeFileSync(file, `${key}\n`, {
+            encoding: 'utf8',
+            mode: 0o600,
+            flag: 'wx',
+        });
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+        return readFileSync(file, 'utf8').trim();
+    }
+    return key;
+};
+/**
+ * A credential store that survives `pikku dev` restarts when the project has a
+ * database with the credential tables, and the in-memory one otherwise.
+ */
+export const createDevCredentialService = async ({ kysely, runtimeDir, logger, expectsCredentials, }) => {
+    if (!kysely)
+        return new LocalCredentialService();
+    const service = new KyselyCredentialService(kysely, {
+        key: resolveDevCredentialsKey(runtimeDir),
+    });
+    try {
+        await service.init();
+        return service;
+    }
+    catch (error) {
+        if (expectsCredentials) {
+            logger.warn(`Stored credentials will not survive a restart: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        return new LocalCredentialService();
+    }
+};

package/dist/src/functions/commands/dev.js

@@ -6,7 +6,7 @@ import { pikkuDevReloader, reloadGeneratedMeta, reconcileAddonRegistry, } from '
 import { InMemoryQueueService, QueueWebhookService } from '@pikku/core/services';
 import { flattenScopeDefinitions } from '@pikku/core/scope';
 import { flattenSystemRoleDefinitions } from '@pikku/core/role';
-import { ConsoleLogger, LocalEmailService, LocalCredentialService, spy, InMemoryAgentRunStateService, } from '@pikku/core/services';
+import { ConsoleLogger, LocalEmailService, spy, InMemoryAgentRunStateService, } from '@pikku/core/services';
 import { InMemoryTriggerService } from '@pikku/core/services';
 import { InMemoryWorkflowService } from '@pikku/core/services';
 import { KyselyAgentStorageService, KyselyAgentRunStateService, KyselyAgentRunService, KyselyAnalyticsService, KyselyFeatureFlagStore, KyselyScopeService, KyselyWebhookService, } from '@pikku/kysely';
@@ -19,6 +19,7 @@ import { InMemorySchedulerService } from '@pikku/schedule';
 import { resolveDb, createKysely, parseDatabaseUrl, } from '../db/local-db.js';
 import { loadUserBootstrap, loadUserModule } from './load-user-project.js';
 import { initOrWarn } from './init-or-warn.js';
+import { createDevCredentialService } from './dev-credentials.js';
 import { registerScenarioInstrumentation } from '../wirings/scenarios/register-scenario-instrumentation.js';
 import { startCoverageService } from './start-coverage.js';
 import { resolveDevEnvironmentName } from './environment.js';
@@ -254,6 +255,14 @@ export const dev = pikkuSessionlessFunc({
         if (devWebhookService instanceof KyselyWebhookService) {
             await devWebhookService.init();
         }
+        const credentialService = await createDevCredentialService({
+            kysely,
+            runtimeDir: resolvedRuntimeDir,
+            logger,
+            expectsCredentials: requiredServices.has('credentialService') ||
+                inspectorState.credentials.definitions.length > 0 ||
+                inspectorState.rpc.wireAddonDeclarations.size > 0,
+        });
         const inMemoryServices = {
             logger: devLogger,
             ...(agentRunner ? { agentRunner } : {}),
@@ -269,7 +278,7 @@ export const dev = pikkuSessionlessFunc({
             workflowService,
             workflowRunService: workflowService,
             triggerService: new InMemoryTriggerService(),
-            credentialService: new LocalCredentialService(),
+            credentialService,
             agentStorage,
             agentRunState,
             agentRunService,

package/dist/src/functions/commands/install-addon.d.ts

@@ -0,0 +1,45 @@
+export type AddonAuthMode = 'delegated' | 'connect' | 'oauth2' | 'shared' | 'none';
+export interface AddonInstall {
+    projectRoot: string;
+    srcDir: string;
+    name: string;
+    camelName: string;
+    pascalName: string;
+    screamingName: string;
+    packageName: string;
+    addonDir: string;
+    inWorkspace: boolean;
+    mode: AddonAuthMode;
+    /** Generated function file contents by function name. */
+    functions: Record<string, string>;
+    baseUrl?: string;
+}
+export interface InstallResult {
+    written: string[];
+    notes: string[];
+}
+/** The package.json that owns `dir`, walking up to `stopAt`. */
+export declare function owningPackageDir(dir: string, stopAt: string): string | undefined;
+export declare function addDependency(packageJsonPath: string, packageName: string, version: string): boolean;
+/**
+ * What a signed-in user may call directly. Per-user modes expose every
+ * function, since the upstream enforces the user's own permissions; a shared
+ * secret acts with one identity for everyone, so only reads are exposed.
+ */
+export declare function exposedFunctions(install: AddonInstall): string[];
+export declare function wireAddonFile(install: AddonInstall): string;
+/**
+ * Wires the addon's auth into the app's Better Auth config: delegated sign-in
+ * against the upstream, and upstream credentials carried by scenario actors.
+ * Text edits, so each one is skipped (and reported) when its anchor is gone.
+ */
+export declare function wireAuth(source: string, install: AddonInstall): {
+    source: string;
+    notes: string[];
+};
+/**
+ * Installs a freshly generated addon into the app it was generated in: the
+ * dependency on the root and functions packages, the wireAddon file, the auth
+ * wiring and the base-URL variable. The caller installs and builds after.
+ */
+export declare function installAddonIntoApp(install: AddonInstall): InstallResult;

package/dist/src/functions/commands/install-addon.js

@@ -0,0 +1,225 @@
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs';
+import { dirname, join, relative } from 'path';
+/** The package.json that owns `dir`, walking up to `stopAt`. */
+export function owningPackageDir(dir, stopAt) {
+    let current = dir;
+    while (current.startsWith(stopAt)) {
+        if (existsSync(join(current, 'package.json')))
+            return current;
+        const parent = dirname(current);
+        if (parent === current)
+            break;
+        current = parent;
+    }
+    return undefined;
+}
+const readJson = (path) => JSON.parse(readFileSync(path, 'utf8'));
+const writeJson = (path, value) => writeFileSync(path, `${JSON.stringify(value, null, 2)}\n`);
+export function addDependency(packageJsonPath, packageName, version) {
+    const pkg = readJson(packageJsonPath);
+    if (pkg.dependencies?.[packageName] ?? pkg.devDependencies?.[packageName]) {
+        return false;
+    }
+    pkg.dependencies = Object.fromEntries(Object.entries({ ...pkg.dependencies, [packageName]: version }).sort(([a], [b]) => a.localeCompare(b)));
+    writeJson(packageJsonPath, pkg);
+    return true;
+}
+/**
+ * What a signed-in user may call directly. Per-user modes expose every
+ * function, since the upstream enforces the user's own permissions; a shared
+ * secret acts with one identity for everyone, so only reads are exposed.
+ */
+export function exposedFunctions(install) {
+    const names = Object.keys(install.functions).sort();
+    if (install.mode !== 'shared')
+        return names;
+    return names.filter((fn) => /\.call\("GET"/.test(install.functions[fn]));
+}
+export function wireAddonFile(install) {
+    const expose = exposedFunctions(install);
+    const list = expose.length
+        ? `[\n${expose.map((fn) => `    '${fn}',`).join('\n')}\n  ]`
+        : 'false';
+    return `import { wireAddon } from '#pikku/addon'
+
+wireAddon({
+  name: '${install.camelName}',
+  package: '${install.packageName}',
+  auth: true,
+  expose: ${list},
+})
+`;
+}
+const BETTER_AUTH_IMPORT = /import\s*\{([^}]*)\}\s*from\s*'@pikku\/better-auth'/;
+function addNamedImport(source, name) {
+    const match = source.match(BETTER_AUTH_IMPORT);
+    if (match) {
+        const names = match[1]
+            .split(',')
+            .map((n) => n.trim())
+            .filter(Boolean);
+        if (names.includes(name))
+            return source;
+        return source.replace(match[0], `import { ${[...names, name].join(', ')} } from '@pikku/better-auth'`);
+    }
+    return `import { ${name} } from '@pikku/better-auth'\n${source}`;
+}
+const FACTORY_SERVICES = /pikkuBetterAuth\(\s*async\s*\(\{([^}]*)\}\)/;
+function addFactoryService(source, service) {
+    return source.replace(FACTORY_SERVICES, (whole, services) => {
+        const names = services
+            .split(',')
+            .map((n) => n.trim())
+            .filter(Boolean);
+        if (names.includes(service))
+            return whole;
+        return whole.replace(`{${services}}`, `{ ${[...names, service].join(', ')} }`);
+    });
+}
+function insertAfterImports(source, line) {
+    const imports = [
+        ...source.matchAll(/^import[\s\S]*?from\s+'[^']+'[ \t]*\n/gm),
+    ];
+    const last = imports[imports.length - 1];
+    if (!last)
+        return `${line}\n${source}`;
+    const at = last.index + last[0].length;
+    return `${source.slice(0, at)}${line}\n${source.slice(at)}`;
+}
+/**
+ * Wires the addon's auth into the app's Better Auth config: delegated sign-in
+ * against the upstream, and upstream credentials carried by scenario actors.
+ * Text edits, so each one is skipped (and reported) when its anchor is gone.
+ */
+export function wireAuth(source, install) {
+    const notes = [];
+    const { camelName, pascalName, screamingName, packageName } = install;
+    const perUser = install.mode !== 'shared' && install.mode !== 'none';
+    if (!perUser)
+        return { source, notes };
+    if (!FACTORY_SERVICES.test(source)) {
+        notes.push('auth.ts: pikkuBetterAuth is not `async ({ … }) =>`, so the upstream sign-in was not wired — add it by hand (see pikku-auth)');
+        return { source, notes };
+    }
+    const storeCredential = `if (!credentialService) throw new Error('credentialService is not configured')`;
+    let next = addFactoryService(source, 'credentialService');
+    if (install.mode === 'delegated' &&
+        !next.includes(`authenticate${pascalName}Upstream`)) {
+        if (next.search(/plugins:\s*\[/) === -1) {
+            notes.push(`auth.ts has no plugins: [ … ] — add pikkuDelegatedAuth by hand (see pikku-auth)`);
+        }
+        else {
+            next = addFactoryService(next, 'variables');
+            next = addFactoryService(next, 'scopeService');
+            next = addFactoryService(next, 'logger');
+            next = addNamedImport(next, 'pikkuDelegatedAuth');
+            next = insertAfterImports(next, `import { authenticate${pascalName}Upstream } from '${packageName}'`);
+            const fallback = install.baseUrl
+                ? ` ?? ${JSON.stringify(install.baseUrl)}`
+                : '';
+            const plugin = `
+        pikkuDelegatedAuth({
+          authenticate: async (credentials) =>
+            authenticate${pascalName}Upstream(
+              credentials,
+              String((await variables.get('${screamingName}_BASE_URL'))${fallback})
+            ),
+          storeCredential: async (userId, identity) => {
+            ${storeCredential}
+            await credentialService.set('${camelName}', identity.credential, userId)
+          },
+          scopeService,
+          logger,
+        }),`;
+            const open = next.match(/plugins:\s*\[/);
+            const at = open.index + open[0].length;
+            next = `${next.slice(0, at)}${plugin}${next.slice(at)}`;
+        }
+    }
+    const actorAt = next.search(/pikkuActor\(\{/);
+    if (actorAt === -1) {
+        notes.push('auth.ts has no pikkuActor — scenario personas will not carry upstream credentials');
+    }
+    else {
+        const actorCall = next.slice(actorAt, next.indexOf('})', actorAt) + 2);
+        if (!actorCall.includes('credentials:')) {
+            const credentials = `pikkuActor({
+          credentials: {
+            names: ['${camelName}'],
+            store: async (name, value, userId) => {
+              ${storeCredential}
+              await credentialService.set(name, value, userId)
+            },
+            remove: async (name, userId) => {
+              await credentialService?.delete(name, userId)
+            },
+          },`;
+            next = next.replace(/pikkuActor\(\{/, credentials);
+        }
+    }
+    return { source: next, notes };
+}
+function addEnvLine(envPath, name, value) {
+    const current = existsSync(envPath) ? readFileSync(envPath, 'utf8') : '';
+    if (new RegExp(`^\\s*${name}\\s*=`, 'm').test(current))
+        return false;
+    const sep = current.length > 0 && !current.endsWith('\n') ? '\n' : '';
+    writeFileSync(envPath, `${current}${sep}${name}=${value}\n`);
+    return true;
+}
+/**
+ * Installs a freshly generated addon into the app it was generated in: the
+ * dependency on the root and functions packages, the wireAddon file, the auth
+ * wiring and the base-URL variable. The caller installs and builds after.
+ */
+export function installAddonIntoApp(install) {
+    const written = [];
+    const notes = [];
+    const rel = (path) => relative(install.projectRoot, path);
+    const functionsPkg = owningPackageDir(install.srcDir, install.projectRoot);
+    const packageDirs = [install.projectRoot];
+    if (functionsPkg && functionsPkg !== install.projectRoot)
+        packageDirs.push(functionsPkg);
+    for (const dir of packageDirs) {
+        const path = join(dir, 'package.json');
+        const spec = install.inWorkspace
+            ? 'workspace:*'
+            : `file:${relative(dir, install.addonDir)}`;
+        if (existsSync(path) && addDependency(path, install.packageName, spec)) {
+            written.push(rel(path));
+        }
+    }
+    const addonsDir = existsSync(join(install.srcDir, 'addons'))
+        ? join(install.srcDir, 'addons')
+        : install.srcDir;
+    const wirePath = join(addonsDir, `${install.name}.addon.ts`);
+    if (existsSync(wirePath)) {
+        notes.push(`${rel(wirePath)} already exists — left as it is`);
+    }
+    else {
+        mkdirSync(addonsDir, { recursive: true });
+        writeFileSync(wirePath, wireAddonFile(install));
+        written.push(rel(wirePath));
+    }
+    const authPath = join(install.srcDir, 'auth.ts');
+    if (existsSync(authPath)) {
+        const before = readFileSync(authPath, 'utf8');
+        const { source, notes: authNotes } = wireAuth(before, install);
+        notes.push(...authNotes);
+        if (source !== before) {
+            writeFileSync(authPath, source);
+            written.push(rel(authPath));
+        }
+    }
+    else if (install.mode === 'delegated') {
+        notes.push(`no ${rel(authPath)} — add pikkuDelegatedAuth to your Better Auth config by hand (see pikku-auth)`);
+    }
+    const envPath = join(install.projectRoot, '.env');
+    if (addEnvLine(envPath, `${install.screamingName}_BASE_URL`, install.baseUrl ?? '')) {
+        written.push(rel(envPath));
+    }
+    if (!install.baseUrl) {
+        notes.push(`the spec names no absolute server — set ${install.screamingName}_BASE_URL in .env`);
+    }
+    return { written, notes };
+}