@pikku/cli 0.12.43 → 0.12.45

package/dist/src/fabric/functions/validate.function.js

@@ -59,6 +59,41 @@ async function readTextSafe(path) {
         return null;
     }
 }
+// Minimum @pikku/* versions Fabric requires. The pikku packages are versioned
+// independently (e.g. @pikku/cli moves faster than @pikku/core), so this is a
+// per-package floor map, not a single number. Only listed packages are
+// enforced — others are skipped to avoid false positives on packages with
+// their own (lower) version lines. Bump these as the supported floor moves.
+//   - @pikku/cli  < 0.12.43 ships a `pikku dev` that hangs without ever
+//     listening (the sandbox never serves routes).
+//   - @pikku/core mismatches split pikkuState into duplicate copies, so app
+//     and console routes 404; pin the floor that matches the runtime.
+const PIKKU_MIN_VERSIONS = {
+    '@pikku/cli': '0.12.43',
+    '@pikku/core': '0.12.34',
+};
+// Pull major.minor.patch from a spec, ignoring range prefixes (^ ~ >=),
+// npm: aliases, and pre-release/build suffixes. null if no semver is present
+// (file:, workspace:, *, latest — resolved only at install time).
+function parseSemver(spec) {
+    const m = spec.match(/(\d+)\.(\d+)\.(\d+)/);
+    if (!m)
+        return null;
+    return [parseInt(m[1], 10), parseInt(m[2], 10), parseInt(m[3], 10)];
+}
+function semverLt(a, b) {
+    for (let i = 0; i < 3; i++) {
+        if (a[i] !== b[i])
+            return a[i] < b[i];
+    }
+    return false;
+}
+// Fall back to the installed version when the spec carries no semver
+// (file:/workspace:/* deps resolve to a concrete version on disk).
+async function installedSemver(root, pkg) {
+    const j = await readJsonSafe(join(root, 'node_modules', pkg, 'package.json'));
+    return j?.version ? parseSemver(j.version) : null;
+}
 // PostgreSQL-specific syntax that won't work on SQLite/libSQL (Turso)
 const POSTGRES_SQL_PATTERNS = [
     {
@@ -146,6 +181,59 @@ export async function runValidate(startDir = process.cwd()) {
             }
         }
     }
+    // ── @pikku/* minimum versions ──────────────────────────────────────────
+    // Scan every workspace manifest for @pikku/* deps below the required floor.
+    // A stale @pikku/cli hangs `pikku dev`; a stale @pikku/core duplicates
+    // pikkuState and 404s every route — both are hard blockers, so error.
+    {
+        const manifestPaths = [rootPkgPath];
+        for (const group of ['packages', 'apps']) {
+            const groupDir = join(root, group);
+            if (!existsSync(groupDir))
+                continue;
+            try {
+                for (const d of await readdir(groupDir, { withFileTypes: true })) {
+                    if (d.isDirectory()) {
+                        manifestPaths.push(join(groupDir, d.name, 'package.json'));
+                    }
+                }
+            }
+            catch {
+                // ignore
+            }
+        }
+        const lowestByPkg = new Map();
+        for (const mPath of manifestPaths) {
+            const m = await readJsonSafe(mPath);
+            if (!m)
+                continue;
+            const deps = {
+                ...m.dependencies,
+                ...m.devDependencies,
+                ...m.peerDependencies,
+            };
+            for (const [pkg, spec] of Object.entries(deps)) {
+                if (!pkg.startsWith('@pikku/') || !(pkg in PIKKU_MIN_VERSIONS))
+                    continue;
+                if (typeof spec !== 'string')
+                    continue;
+                const version = parseSemver(spec) ?? (await installedSemver(root, pkg));
+                if (!version)
+                    continue;
+                const prev = lowestByPkg.get(pkg);
+                if (!prev || semverLt(version, prev.version)) {
+                    lowestByPkg.set(pkg, { version, manifest: mPath, spec });
+                }
+            }
+        }
+        for (const [pkg, seen] of lowestByPkg) {
+            const floorStr = PIKKU_MIN_VERSIONS[pkg];
+            const floor = parseSemver(floorStr);
+            if (floor && semverLt(seen.version, floor)) {
+                e(`pikku-version-below-min-${pkg.replace(/[@/]/g, '-')}`, `${pkg} is ${seen.version.join('.')} (spec "${seen.spec}") — Fabric requires >= ${floorStr}`, seen.manifest, lines(`Bump ${pkg} to ^${floorStr} (or newer) and reinstall:`, `  yarn up ${pkg}@^${floorStr}`, 'Then run `yarn install` and re-run `pikku fabric validate`.'));
+            }
+        }
+    }
     // ── packages/functions/ ────────────────────────────────────────────────
     const fnDir = join(root, 'packages', 'functions');
     const functionsSdkPkgName = (await readJsonSafe(join(root, 'packages', 'functions-sdk', 'package.json')))?.name;
@@ -199,6 +287,37 @@ export async function runValidate(startDir = process.cwd()) {
                 e('missing-kysely-sqlite', 'services.ts imports @pikku/kysely-sqlite but it is not in root package.json', rootPkgPath, 'Add "@pikku/kysely-sqlite": "file:./vendor/pikku-kysely-sqlite.tgz" to dependencies');
             }
         }
+        // ── better-auth client baseURL must include the /auth segment ──────────
+        // The Fabric deploy edge keeps the /api prefix for the better-auth unit
+        // (it registers /api/auth/*) and strips /api only for the other units; the
+        // sandbox Caddy mirrors that with a non-stripping /api/auth/* handler. So
+        // the DEFAULT basePath (/api/auth) is the CORRECT server config — do NOT
+        // override it. The real footgun is the client: better-auth appends the
+        // endpoint to baseURL verbatim, so a bare /api baseURL yields
+        // /api/sign-in/email (no /auth) and 404s. The client baseURL must resolve
+        // to /api/auth.
+        const appsDir = join(root, 'apps');
+        if (existsSync(appsDir)) {
+            try {
+                const appFiles = (await readdir(appsDir, { recursive: true })).filter((f) => typeof f === 'string' &&
+                    (f.endsWith('.ts') || f.endsWith('.tsx')) &&
+                    !f.includes('node_modules'));
+                for (const rel of appFiles) {
+                    const text = await readTextSafe(join(appsDir, rel));
+                    if (!text || !/\bcreateAuthClient\s*\(/.test(text))
+                        continue;
+                    const baseURL = text.match(/createAuthClient\s*\([^)]*baseURL\s*:\s*([^,)\n]+)/)?.[1];
+                    // Heuristic: flag a bare /api baseURL with no /auth segment anywhere
+                    // near the client config.
+                    if (baseURL && /['"`]\/api['"`]/.test(baseURL) && !/auth/i.test(baseURL)) {
+                        w('better-auth-client-baseurl-missing-auth', `createAuthClient baseURL is ${baseURL.trim()} — it omits the /auth segment, so the client calls /api/sign-in/email instead of /api/auth/sign-in/email and auth 404s`, join(appsDir, rel), "Append the auth basePath: baseURL: `${apiUrl()}/auth` (resolving to /api/auth)");
+                    }
+                }
+            }
+            catch {
+                // readdir failure — skip
+            }
+        }
         // Database layout is declared by pikku.config.json db.engine.
         const migrationsDir = join(root, 'db', dbEngine === 'postgres' ? 'postgres' : 'sqlite');
         if (!existsSync(migrationsDir)) {

package/dist/src/functions/commands/pikku-command-summary.js

@@ -54,8 +54,9 @@ export const pikkuSummary = pikkuSessionlessFunc({
             // stdout (which would break NDJSON consumers).
             logger.info({ message: summary.format(), type: 'summary' });
         }
-        if (logger.hasCriticalErrors()) {
-            throw new Error('Pikku inspection failed due to critical diagnostics');
+        if (logger.hasBlockingDiagnostics()) {
+            const severities = logger.blockingSeverities().join(', ');
+            throw new Error(`Pikku inspection failed due to ${severities} diagnostics`);
         }
     },
 });

package/dist/src/functions/commands/versions-update.js

@@ -12,11 +12,17 @@ export const pikkuVersionsUpdate = pikkuSessionlessFunc({
         }
         const immutabilityErrors = visitState.manifest.errors.filter((e) => e.code === ErrorCode.FUNCTION_VERSION_MODIFIED);
         if (immutabilityErrors.length > 0) {
+            // A published contract changed without a version bump. We must not save
+            // (that would overwrite an immutable record), but a contract drift should
+            // not crash `pikku all` / the dev server. Surface it as an `error`
+            // diagnostic: printed always, blocking only under `--fail-on-error`.
+            // `pikku versions check` remains the hard deploy gate.
             for (const e of immutabilityErrors) {
-                logger.critical(ErrorCode.FUNCTION_VERSION_MODIFIED, e.message);
-            }
-            if (logger.hasCriticalErrors()) {
-                process.exit(1);
+                logger.diagnostic({
+                    severity: 'error',
+                    code: ErrorCode.FUNCTION_VERSION_MODIFIED,
+                    message: e.message,
+                });
             }
             return;
         }

package/dist/src/functions/commands/workspace-validate.d.ts

@@ -4,7 +4,7 @@ export declare const workspaceValidate: import("#pikku").PikkuFunctionConfig<Rec
     root: string;
     findings: {
         id: string;
-        severity: "info" | "warn" | "error";
+        severity: "warn" | "error" | "info";
         message: string;
         path: string;
         fixHint: string;
@@ -14,7 +14,7 @@ export declare const workspaceValidate: import("#pikku").PikkuFunctionConfig<Rec
     root: string;
     findings: {
         id: string;
-        severity: "info" | "warn" | "error";
+        severity: "warn" | "error" | "info";
         message: string;
         path: string;
         fixHint: string;
@@ -24,7 +24,7 @@ export declare const workspaceValidate: import("#pikku").PikkuFunctionConfig<Rec
     root: string;
     findings: {
         id: string;
-        severity: "info" | "warn" | "error";
+        severity: "warn" | "error" | "info";
         message: string;
         path: string;
         fixHint: string;

package/dist/src/functions/db/better-auth-schema.js

@@ -3,7 +3,7 @@ import { pathToFileURL } from 'node:url';
 import { readdirSync, statSync, readFileSync, existsSync } from 'node:fs';
 import { join, extname, dirname } from 'node:path';
 import { PIKKU_BETTER_AUTH } from '@pikku/better-auth';
-import { LocalSecretService, LocalVariablesService } from '@pikku/core/services';
+import { LocalVariablesService } from '@pikku/core/services';
 import { loadUserModule } from '../commands/load-user-project.js';
 let cachedGetMigrations = null;
 async function loadGetMigrations() {
@@ -87,9 +87,22 @@ async function loadAuthFactory(sourceFile) {
     }
     return null;
 }
+// Schema-only auth introspection never executes auth — it just reads the Better
+// Auth options to derive the table/column shape. Secret *values* don't affect the
+// schema, so we hand the factory a fake secret service that resolves every key to
+// a placeholder. This keeps `pikku db migrate`'s drift check from requiring the
+// app's real secrets (BETTER_AUTH_SECRET etc.) to be present in the environment.
+function fakeSecretService() {
+    const placeholder = 'schema-introspection-only';
+    return {
+        getSecret: async () => placeholder,
+        hasSecret: async () => true,
+        setSecret: async () => { },
+    };
+}
 function schemaServicesStub(kysely, logger) {
     const variables = new LocalVariablesService();
-    const secrets = new LocalSecretService(variables);
+    const secrets = fakeSecretService();
     const base = {
         kysely,
         logger,

package/dist/src/functions/db/sqlite/sqlite-kysely.js

@@ -12,12 +12,19 @@ function coerce(v) {
         return JSON.stringify(v);
     return v;
 }
+// A statement returns rows when it is a SELECT or carries a RETURNING clause.
+// node:sqlite's StatementSync has no `reader` flag (always undefined), so without
+// this kysely would run INSERT ... RETURNING via `.run()` and drop the returned
+// rows — which breaks better-auth sign-up (it inserts and expects the row back).
+function isReaderSql(sql) {
+    return /^\s*select/i.test(sql) || /\breturning\b/i.test(sql);
+}
 class RuntimeSqliteStatement {
     stmt;
     reader;
-    constructor(stmt) {
+    constructor(stmt, reader) {
         this.stmt = stmt;
-        this.reader = Boolean(stmt.reader);
+        this.reader = reader;
     }
     all(parameters) {
         return this.stmt.all(...parameters.map(coerce));
@@ -41,7 +48,8 @@ class RuntimeSqliteDatabase {
         this.db = db;
     }
     prepare(sql) {
-        return new RuntimeSqliteStatement(this.db.prepare(sql));
+        const stmt = this.db.prepare(sql);
+        return new RuntimeSqliteStatement(stmt, Boolean(stmt.reader) || isReaderSql(sql));
     }
     close() {
         this.db.close();

package/dist/src/functions/validate/workspace-validate.d.ts

@@ -2,9 +2,9 @@ import { z } from 'zod';
 export declare const FindingSchema: z.ZodObject<{
     id: z.ZodString;
     severity: z.ZodEnum<{
-        info: "info";
         warn: "warn";
         error: "error";
+        info: "info";
     }>;
     message: z.ZodString;
     path: z.ZodString;
@@ -18,9 +18,9 @@ export declare const WorkspaceValidateOutput: z.ZodObject<{
     findings: z.ZodArray<z.ZodObject<{
         id: z.ZodString;
         severity: z.ZodEnum<{
-            info: "info";
             warn: "warn";
             error: "error";
+            info: "info";
         }>;
         message: z.ZodString;
         path: z.ZodString;

package/dist/src/functions/validate/workspace-validate.js

@@ -95,6 +95,10 @@ export async function runWorkspaceValidate(startDir = process.cwd()) {
         if (!pikkuConfig.clientFiles) {
             info('pikku-config-no-client-files', 'pikku.config.json missing "clientFiles" — generated RPC client files and React Query hooks will not be written', pikkuConfigPath, 'Add clientFiles.rpcMapDeclarationFile and clientFiles.reactQueryFile pointing to packages/functions-sdk/src/pikku/ (for example: rpc-map.gen.d.ts and api.gen.ts)');
         }
+        const scaffold = pikkuConfig.scaffold;
+        if (!scaffold?.console) {
+            e('pikku-config-no-console-scaffold', 'pikku.config.json missing "scaffold.console" — Fabric cannot introspect the running app (console:getFunctionsMeta and friends 404), so the sandbox builder shows no functions', pikkuConfigPath, 'Add "console": "no-auth" under "scaffold" in pikku.config.json (use "auth" to require a session)');
+        }
     }
     const rootPkgPath = join(root, 'package.json');
     const rootPkg = await readJsonSafe(rootPkgPath);

package/dist/src/functions/wirings/channels/pikku-channels.js

@@ -6,19 +6,28 @@ import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
 export const pikkuChannels = pikkuVoidFunc({
     func: async ({ logger, config, getInspectorState }) => {
         const visitState = await getInspectorState();
-        const { channelsWiringFile, channelsWiringMetaFile, channelsWiringMetaJsonFile, packageMappings, schema, } = config;
-        const { channels } = visitState;
-        if (channels.files.size === 0 || Object.keys(channels.meta).length === 0) {
+        const { channelsWiringFile, channelsWiringMetaFile, channelsWiringMetaJsonFile, channelContractsMetaJsonFile, packageMappings, schema, } = config;
+        const { channels, exportedContracts } = visitState;
+        const hasChannelContracts = Object.keys(exportedContracts.channel).length > 0;
+        if ((channels.files.size === 0 || Object.keys(channels.meta).length === 0) &&
+            !hasChannelContracts) {
             return;
         }
-        await writeFileInDir(logger, channelsWiringFile, serializeFileImports('addChannel', channelsWiringFile, channels.files, packageMappings));
-        await writeFileInDir(logger, channelsWiringMetaJsonFile, JSON.stringify(channels.meta, null, 2));
-        const jsonImportPath = getFileImportRelativePath(channelsWiringMetaFile, channelsWiringMetaJsonFile, packageMappings);
-        const supportsImportAttributes = schema?.supportsImportAttributes ?? false;
-        const importStatement = supportsImportAttributes
-            ? `import metaData from '${jsonImportPath}' with { type: 'json' }`
-            : `import metaData from '${jsonImportPath}'`;
-        await writeFileInDir(logger, channelsWiringMetaFile, `import { pikkuState } from '@pikku/core/internal'\nimport { ChannelsMeta } from '@pikku/core/channel'\n${importStatement}\npikkuState(null, 'channel', 'meta', metaData as ChannelsMeta)`);
+        if (channels.files.size > 0 && Object.keys(channels.meta).length > 0) {
+            await writeFileInDir(logger, channelsWiringFile, serializeFileImports('addChannel', channelsWiringFile, channels.files, packageMappings));
+        }
+        if (Object.keys(channels.meta).length > 0) {
+            await writeFileInDir(logger, channelsWiringMetaJsonFile, JSON.stringify(channels.meta, null, 2));
+        }
+        await writeFileInDir(logger, channelContractsMetaJsonFile, JSON.stringify(exportedContracts.channel, null, 2));
+        if (Object.keys(channels.meta).length > 0) {
+            const jsonImportPath = getFileImportRelativePath(channelsWiringMetaFile, channelsWiringMetaJsonFile, packageMappings);
+            const supportsImportAttributes = schema?.supportsImportAttributes ?? false;
+            const importStatement = supportsImportAttributes
+                ? `import metaData from '${jsonImportPath}' with { type: 'json' }`
+                : `import metaData from '${jsonImportPath}'`;
+            await writeFileInDir(logger, channelsWiringMetaFile, `import { pikkuState } from '@pikku/core/internal'\nimport { ChannelsMeta } from '@pikku/core/channel'\n${importStatement}\npikkuState(null, 'channel', 'meta', metaData as ChannelsMeta)`);
+        }
     },
     middleware: [
         logCommandInfoAndTime({

package/dist/src/functions/wirings/channels/pikku-command-channels-map.js

@@ -5,8 +5,8 @@ import { serializeTypedChannelsMap } from './serialize-typed-channel-map.js';
 export const pikkuChannelsMap = pikkuSessionlessFunc({
     func: async ({ logger, config, getInspectorState }) => {
         const state = await getInspectorState();
-        const { channelsMapDeclarationFile, packageMappings } = config;
-        const content = serializeTypedChannelsMap(logger, channelsMapDeclarationFile, packageMappings, state.functions.typesMap, state.functions.meta, state.addonFunctions, state.channels.meta);
+        const { channelsMapDeclarationFile, packageMappings, rpcInternalMapDeclarationFile, } = config;
+        const content = serializeTypedChannelsMap(logger, channelsMapDeclarationFile, packageMappings, state.functions.typesMap, state.functions.meta, state.addonFunctions, state.channels.meta, rpcInternalMapDeclarationFile);
         await writeFileInDir(logger, channelsMapDeclarationFile, content);
     },
     middleware: [

package/dist/src/functions/wirings/channels/pikku-command-channels.js

@@ -7,21 +7,35 @@ import { stripVerboseFields, hasVerboseFields, } from '../../../utils/strip-verb
 export const pikkuCommandChannels = pikkuSessionlessFunc({
     func: async ({ logger, config, getInspectorState }) => {
         const visitState = await getInspectorState();
-        const { channelsWiringFile, channelsWiringMetaFile, channelsWiringMetaJsonFile, packageMappings, schema, } = config;
-        const { channels } = visitState;
-        if (channels.files.size === 0 || Object.keys(channels.meta).length === 0) {
+        const { channelsWiringFile, channelsWiringMetaFile, channelsWiringMetaJsonFile, channelContractsMetaJsonFile, channelContractsMetaFile, packageMappings, schema, } = config;
+        const { channels, exportedContracts } = visitState;
+        const hasChannelContracts = Object.keys(exportedContracts.channel).length > 0;
+        if ((channels.files.size === 0 || Object.keys(channels.meta).length === 0) &&
+            !hasChannelContracts) {
             return undefined;
         }
+        // The bootstrap imports channelsWiringFile and channelsWiringMetaFile
+        // whenever this command reports channels as active (truthy return), so both
+        // must always be written once past the guard above — including the
+        // contracts-only case where there are no local channel source files
+        // (channels.files is empty). Skipping either leaves the bootstrap importing
+        // a file that was never generated and the per-unit deploy bundle fails.
         await writeFileInDir(logger, channelsWiringFile, serializeFileImports('addChannel', channelsWiringFile, channels.files, packageMappings));
-        // Write minimal JSON (runtime-only fields)
         const minimalMeta = stripVerboseFields(channels.meta);
         await writeFileInDir(logger, channelsWiringMetaJsonFile, JSON.stringify(minimalMeta, null, 2));
-        // Write verbose JSON only if it has additional fields
         if (hasVerboseFields(channels.meta)) {
             const verbosePath = channelsWiringMetaJsonFile.replace(/\.gen\.json$/, '-verbose.gen.json');
             await writeFileInDir(logger, verbosePath, JSON.stringify(channels.meta, null, 2));
         }
-        // Generate TypeScript file that imports the minimal JSON
+        await writeFileInDir(logger, channelContractsMetaJsonFile, JSON.stringify(exportedContracts.channel, null, 2));
+        if (hasChannelContracts) {
+            const contractsJsonImportPath = getFileImportRelativePath(channelContractsMetaFile, channelContractsMetaJsonFile, packageMappings);
+            const supportsImportAttributes = schema?.supportsImportAttributes ?? false;
+            const contractsImportStatement = supportsImportAttributes
+                ? `import contractsMeta from '${contractsJsonImportPath}' with { type: 'json' }`
+                : `import contractsMeta from '${contractsJsonImportPath}'`;
+            await writeFileInDir(logger, channelContractsMetaFile, `${contractsImportStatement}\nexport default contractsMeta`);
+        }
         const jsonImportPath = getFileImportRelativePath(channelsWiringMetaFile, channelsWiringMetaJsonFile, packageMappings);
         const supportsImportAttributes = schema?.supportsImportAttributes ?? false;
         const importStatement = supportsImportAttributes

package/dist/src/functions/wirings/channels/serialize-typed-channel-map.d.ts

@@ -2,4 +2,4 @@ import type { ChannelsMeta } from '@pikku/core/channel';
 import type { TypesMap } from '@pikku/inspector';
 import type { FunctionsMeta } from '@pikku/core';
 import type { Logger } from '@pikku/core/services';
-export declare const serializeTypedChannelsMap: (logger: Logger, relativeToPath: string, packageMappings: Record<string, string>, typesMap: TypesMap, functionsMeta: FunctionsMeta, addonFunctions: Record<string, FunctionsMeta>, channelsMeta: ChannelsMeta) => string;
+export declare const serializeTypedChannelsMap: (logger: Logger, relativeToPath: string, packageMappings: Record<string, string>, typesMap: TypesMap, functionsMeta: FunctionsMeta, addonFunctions: Record<string, FunctionsMeta>, channelsMeta: ChannelsMeta, rpcInternalMapDeclarationFile: string) => string;

package/dist/src/functions/wirings/channels/serialize-typed-channel-map.js

@@ -1,7 +1,8 @@
 import { serializeImportMap } from '../../../utils/serialize-import-map.js';
+import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
 import { generateCustomTypes, resolveFunctionMeta } from '@pikku/inspector';
-export const serializeTypedChannelsMap = (logger, relativeToPath, packageMappings, typesMap, functionsMeta, addonFunctions, channelsMeta) => {
-    const { channels, requiredTypes } = generateChannels(functionsMeta, addonFunctions, channelsMeta);
+export const serializeTypedChannelsMap = (logger, relativeToPath, packageMappings, typesMap, functionsMeta, addonFunctions, channelsMeta, rpcInternalMapDeclarationFile) => {
+    const { channels, requiredTypes } = generateChannels(logger, typesMap, functionsMeta, addonFunctions, channelsMeta);
     typesMap.customTypes.forEach(({ references }) => {
         for (const reference of references) {
             if (reference !== '__object' && !reference.startsWith('__object_')) {
@@ -9,13 +10,25 @@ export const serializeTypedChannelsMap = (logger, relativeToPath, packageMapping
             }
         }
     });
+    const needsFlattenedRPCMap = Array.from(requiredTypes).some((t) => t.includes('FlattenedRPCMap'));
+    if (needsFlattenedRPCMap) {
+        for (const t of Array.from(requiredTypes)) {
+            if (t.includes('FlattenedRPCMap')) {
+                requiredTypes.delete(t);
+            }
+        }
+    }
     const imports = serializeImportMap(logger, relativeToPath, packageMappings, typesMap, requiredTypes);
+    const rpcMapImport = needsFlattenedRPCMap
+        ? `import type { FlattenedRPCMap } from '${getFileImportRelativePath(relativeToPath, rpcInternalMapDeclarationFile, packageMappings)}'`
+        : '';
     const serializedCustomTypes = generateCustomTypes(typesMap, requiredTypes);
     return `/**
  * This provides the structure needed for TypeScript to be aware of channels
  */
 
 ${imports}
+${rpcMapImport}
 ${serializedCustomTypes}
 
 interface ChannelHandler<I, O> {
@@ -40,7 +53,7 @@ export type ChannelWiringHandlerOf<
         : never;
 `;
 };
-function generateChannels(functionsMeta, addonFunctions, channelsMeta) {
+function generateChannels(logger, typesMap, functionsMeta, addonFunctions, channelsMeta) {
     const state = { functions: { meta: functionsMeta }, addonFunctions };
     const requiredTypes = new Set();
     const channelsObject = {};
@@ -57,17 +70,30 @@ function generateChannels(functionsMeta, addonFunctions, channelsMeta) {
             const inputTypes = func.inputs || null;
             const outputTypes = func.outputs || null;
             channelsObject[name].message = {
-                inputs: inputTypes,
-                outputs: outputTypes,
+                inputs: normalizeTypes(logger, typesMap, inputTypes),
+                outputs: normalizeTypes(logger, typesMap, outputTypes),
             };
-            inputTypes?.forEach((type) => requiredTypes.add(type));
-            outputTypes?.forEach((type) => requiredTypes.add(type));
+            channelsObject[name].message.inputs?.forEach((type) => requiredTypes.add(type));
+            channelsObject[name].message.outputs?.forEach((type) => requiredTypes.add(type));
         }
         for (const [key, route] of Object.entries(messageWirings)) {
             if (!channelsObject[name].routes[key]) {
                 channelsObject[name].routes[key] = {};
             }
             for (const [method, { pikkuFuncId }] of Object.entries(route)) {
+                // Addon functions are namespaced ('ns:fn') and their types aren't in
+                // the consumer's local typesMap, but are reachable via FlattenedRPCMap.
+                if (pikkuFuncId.includes(':')) {
+                    const inputType = `FlattenedRPCMap['${pikkuFuncId}']['input']`;
+                    const outputType = `FlattenedRPCMap['${pikkuFuncId}']['output']`;
+                    channelsObject[name].routes[key][method] = {
+                        inputTypes: [inputType],
+                        outputTypes: [outputType],
+                    };
+                    requiredTypes.add(inputType);
+                    requiredTypes.add(outputType);
+                    continue;
+                }
                 const func = resolveFunctionMeta(state, pikkuFuncId);
                 if (!func) {
                     throw new Error(`Function ${pikkuFuncId} not found in functionsMeta for channel ${name}, route ${key}, method ${method}`);
@@ -75,11 +101,11 @@ function generateChannels(functionsMeta, addonFunctions, channelsMeta) {
                 const inputTypes = func.inputs || null;
                 const outputTypes = func.outputs || null;
                 channelsObject[name].routes[key][method] = {
-                    inputTypes,
-                    outputTypes,
+                    inputTypes: normalizeTypes(logger, typesMap, inputTypes),
+                    outputTypes: normalizeTypes(logger, typesMap, outputTypes),
                 };
-                inputTypes?.forEach((type) => requiredTypes.add(type));
-                outputTypes?.forEach((type) => requiredTypes.add(type));
+                channelsObject[name].routes[key][method].inputTypes?.forEach((type) => requiredTypes.add(type));
+                channelsObject[name].routes[key][method].outputTypes?.forEach((type) => requiredTypes.add(type));
             }
         }
     }
@@ -112,3 +138,25 @@ function generateChannels(functionsMeta, addonFunctions, channelsMeta) {
 function formatTypeArray(types) {
     return types ? types.join(' | ') : 'null';
 }
+function normalizeTypes(logger, typesMap, types) {
+    if (!types || types.length === 0)
+        return types;
+    const resolved = types.filter((type) => hasType(typesMap, type));
+    if (resolved.length > 0) {
+        return resolved;
+    }
+    logger.warn(`Channel type '${types.join(' | ')}' not found in local typesMap, falling back to unknown`);
+    return ['unknown'];
+}
+function hasType(typesMap, type) {
+    if (['void', 'never', 'unknown', 'null', 'undefined'].includes(type)) {
+        return true;
+    }
+    try {
+        typesMap.getTypeMeta(type);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/src/functions/wirings/cli/pikku-command-cli.js

@@ -7,21 +7,35 @@ import { stripVerboseFields, hasVerboseFields, } from '../../../utils/strip-verb
 export const pikkuCLI = pikkuSessionlessFunc({
     func: async ({ logger, config, getInspectorState }) => {
         const visitState = await getInspectorState();
-        const { cliWiringsFile, cliWiringMetaFile, cliWiringMetaJsonFile, packageMappings, schema, } = config;
-        const { cli } = visitState;
-        if (cli.files.size === 0 || Object.keys(cli.meta).length === 0) {
+        const { cliWiringsFile, cliWiringMetaFile, cliWiringMetaJsonFile, cliContractsMetaJsonFile, cliContractsMetaFile, packageMappings, schema, } = config;
+        const { cli, exportedContracts } = visitState;
+        const hasCLIContracts = Object.keys(exportedContracts.cli).length > 0;
+        if ((cli.files.size === 0 || Object.keys(cli.meta).length === 0) &&
+            !hasCLIContracts) {
             return undefined;
         }
-        // Generate CLI wirings file
+        // The bootstrap imports cliWiringsFile and cliWiringMetaFile whenever this
+        // command reports CLI as active (truthy return), so both must always be
+        // written once past the guard above — including the contracts-only case
+        // where there are no local wireCLI source files (cli.files is empty).
+        // Skipping either leaves the bootstrap importing a file that was never
+        // generated and the per-unit deploy bundle fails.
         await writeFileInDir(logger, cliWiringsFile, serializeFileImports('wireCLI', cliWiringsFile, cli.files, packageMappings));
-        // Write minimal JSON (runtime-only fields)
         const minimalMeta = stripVerboseFields(cli.meta);
         await writeFileInDir(logger, cliWiringMetaJsonFile, JSON.stringify(minimalMeta, null, 2));
-        // Write verbose JSON only if it has additional fields
         if (hasVerboseFields(cli.meta)) {
             const verbosePath = cliWiringMetaJsonFile.replace(/\.gen\.json$/, '-verbose.gen.json');
             await writeFileInDir(logger, verbosePath, JSON.stringify(cli.meta, null, 2));
         }
+        await writeFileInDir(logger, cliContractsMetaJsonFile, JSON.stringify(exportedContracts.cli, null, 2));
+        if (hasCLIContracts) {
+            const contractsJsonImportPath = getFileImportRelativePath(cliContractsMetaFile, cliContractsMetaJsonFile, packageMappings);
+            const supportsImportAttributes = schema?.supportsImportAttributes ?? false;
+            const contractsImportStatement = supportsImportAttributes
+                ? `import contractsMeta from '${contractsJsonImportPath}' with { type: 'json' }`
+                : `import contractsMeta from '${contractsJsonImportPath}'`;
+            await writeFileInDir(logger, cliContractsMetaFile, `${contractsImportStatement}\nexport default contractsMeta`);
+        }
         const jsonImportPath = getFileImportRelativePath(cliWiringMetaFile, cliWiringMetaJsonFile, packageMappings);
         const supportsImportAttributes = schema?.supportsImportAttributes ?? false;
         const importStatement = supportsImportAttributes