@pikku/cli 0.12.65 → 0.12.67

package/dist/src/functions/commands/enable.js

@@ -4,7 +4,7 @@ import { pikkuVoidFunc } from '#pikku';
 const FEATURE_DEFAULTS = {
     rpc: 'auth',
     agent: 'auth',
-    console: 'no-auth',
+    console: 'auth',
     workflow: 'auth',
     events: 'auth',
     remoteRpc: 'no-auth',
@@ -20,9 +20,9 @@ async function enableFeature(feature, logger, config, data) {
     if (!json.scaffold.pikkuDir) {
         json.scaffold.pikkuDir = 'pikku';
     }
-    const value = noAuth
-        ? 'no-auth'
-        : FEATURE_DEFAULTS[feature];
+    // The console is an admin surface — every RPC requires a session, so it can
+    // never be scaffolded no-auth (the --no-auth flag is ignored for it).
+    const value = feature === 'console' ? 'auth' : noAuth ? 'no-auth' : FEATURE_DEFAULTS[feature];
     json.scaffold[feature] = value;
     await writeFile(configPath, JSON.stringify(json, null, 2) + '\n', 'utf-8');
     logger.info(`Enabled scaffold.${feature} = '${value}' in ${configPath}`);

package/dist/src/functions/validate/workspace-validate.js

@@ -97,7 +97,7 @@ export async function runWorkspaceValidate(startDir = process.cwd()) {
         }
         const scaffold = pikkuConfig.scaffold;
         if (!scaffold?.console) {
-            e('pikku-config-no-console-scaffold', 'pikku.config.json missing "scaffold.console" — Fabric cannot introspect the running app (console:getFunctionsMeta and friends 404), so the sandbox builder shows no functions', pikkuConfigPath, 'Add "console": "no-auth" under "scaffold" in pikku.config.json (use "auth" to require a session)');
+            e('pikku-config-no-console-scaffold', 'pikku.config.json missing "scaffold.console" — Fabric cannot introspect the running app (console:getFunctionsMeta and friends 404), so the sandbox builder shows no functions', pikkuConfigPath, 'Add "console": "auth" under "scaffold" in pikku.config.json — the console requires an authenticated session, so Better Auth must be set up (see the pikku-better-auth skill)');
         }
     }
     const rootPkgPath = join(root, 'package.json');

package/dist/src/functions/wirings/console/pikku-command-console-functions.js

@@ -2,6 +2,7 @@ import { pikkuSessionlessFunc } from '#pikku';
 import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
+import { projectDeclaresBetterAuth } from '../../../utils/detect-better-auth.js';
 import { serializeConsoleFunctions } from './serialize-console-functions.js';
 export const pikkuConsoleFunctions = pikkuSessionlessFunc({
     func: async ({ logger, config, variables }) => {
@@ -10,6 +11,18 @@ export const pikkuConsoleFunctions = pikkuSessionlessFunc({
             return false;
         }
         if (config.scaffold?.console) {
+            // Every console RPC now requires an authenticated session (the console is
+            // an admin surface), so scaffolding it without an auth strategy produces a
+            // console that 403s on every call. Better Auth is the supported strategy —
+            // fail fast rather than ship a dead console.
+            const hasBetterAuth = await projectDeclaresBetterAuth(config.rootDir, config.srcDirectories, config.ignoreFiles);
+            if (!hasBetterAuth) {
+                throw new Error(`"scaffold.console" is enabled but no pikkuBetterAuth(...) was found in the project.\n` +
+                    `The console addon requires an authenticated session on every RPC — a console without auth ` +
+                    `returns 403 on every call.\n` +
+                    `Fix: set up Better Auth (add a pikkuBetterAuth(...) config) before scaffolding the console, ` +
+                    `or remove "scaffold.console" from pikku.config.json.`);
+            }
             const pathToPikkuTypes = getFileImportRelativePath(config.consoleFunctionsFile, config.typesDeclarationFile, config.packageMappings);
             const pathToAgentTypes = getFileImportRelativePath(config.consoleFunctionsFile, config.agentTypesFile, config.packageMappings);
             await writeFileInDir(logger, config.consoleFunctionsFile, serializeConsoleFunctions(pathToPikkuTypes, pathToAgentTypes, config.globalHTTPPrefix || ''));

package/dist/src/functions/wirings/console/pikku-command-nodes-meta.js

@@ -34,7 +34,8 @@ export const pikkuNodesMeta = pikkuSessionlessFunc({
         const hasNodes = Object.keys(nodes.meta).length > 0;
         const hasSecrets = secrets.definitions.length > 0;
         const hasPackageMeta = !!addonMeta?.icon || !!addonMeta?.displayName;
-        if (!hasNodes && !hasSecrets && !hasPackageMeta) {
+        const hasParentServices = (state.addonRequiredParentServices?.length ?? 0) > 0;
+        if (!hasNodes && !hasSecrets && !hasPackageMeta && !hasParentServices) {
             return undefined;
         }
         const allowedCategories = addonMeta?.categories;
@@ -68,6 +69,9 @@ export const pikkuNodesMeta = pikkuSessionlessFunc({
         if (serverlessIncompatible && serverlessIncompatible.length > 0) {
             metaData.serverlessIncompatible = serverlessIncompatible;
         }
+        if (hasParentServices) {
+            metaData.requiredParentServices = state.addonRequiredParentServices;
+        }
         if (addonMetaJsonFile && (config.scaffold?.console || config.addon)) {
             const minimalMeta = stripVerboseFields(metaData);
             await writeFileInDir(logger, addonMetaJsonFile, JSON.stringify(minimalMeta, null, 2), { ignoreModifyComment: true });

package/dist/src/functions/wirings/console/serialize-console-functions.js

@@ -1,7 +1,7 @@
 export const serializeConsoleFunctions = (pathToPikkuTypes, _pathToAgentTypes, globalHTTPPrefix = '') => {
-    return `import { pikkuSessionlessFunc, defineHTTPRoutes, wireHTTPRoutes, ref, wireAddon } from '${pathToPikkuTypes}'
+    return `import { pikkuFunc, defineHTTPRoutes, wireHTTPRoutes, ref, wireAddon } from '${pathToPikkuTypes}'
 
-export const pikkuConsoleSetSecret = pikkuSessionlessFunc<{
+export const pikkuConsoleSetSecret = pikkuFunc<{
   secretId: string
   value: unknown
 }, {
@@ -10,21 +10,19 @@ export const pikkuConsoleSetSecret = pikkuSessionlessFunc<{
   tags: ['pikku'],
   description: 'Set the value of a secret',
   expose: true,
-  auth: false,
   func: async ({ secrets }, { secretId, value }) => {
     await secrets.setSecret(secretId, value)
     return { success: true }
   },
 })
 
-export const pikkuConsoleGetVariable = pikkuSessionlessFunc<
+export const pikkuConsoleGetVariable = pikkuFunc<
   { variableId: string },
   { exists: boolean; value: unknown | null }
 >({
   tags: ['pikku'],
   description: 'Get the current value of a variable',
   expose: true,
-  auth: false,
   func: async ({ variables }, { variableId }) => {
     const exists = await variables.has(variableId)
     if (!exists) {
@@ -40,14 +38,13 @@ export const pikkuConsoleGetVariable = pikkuSessionlessFunc<
   },
 })
 
-export const pikkuConsoleSetVariable = pikkuSessionlessFunc<
+export const pikkuConsoleSetVariable = pikkuFunc<
   { variableId: string; value: unknown },
   { success: boolean }
 >({
   tags: ['pikku'],
   description: 'Set the value of a variable',
   expose: true,
-  auth: false,
   func: async ({ variables }, { variableId, value }) => {
     if (typeof value === 'string') {
       await variables.set(variableId, value)
@@ -58,28 +55,26 @@ export const pikkuConsoleSetVariable = pikkuSessionlessFunc<
   },
 })
 
-export const pikkuConsoleHasSecret = pikkuSessionlessFunc<
+export const pikkuConsoleHasSecret = pikkuFunc<
   { secretId: string },
   { exists: boolean }
 >({
   tags: ['pikku'],
   description: 'Check if a secret exists without reading its value',
   expose: true,
-  auth: false,
   func: async ({ secrets }, { secretId }) => {
     const exists = await secrets.hasSecret(secretId)
     return { exists }
   },
 })
 
-export const pikkuConsoleGetSecret = pikkuSessionlessFunc<
+export const pikkuConsoleGetSecret = pikkuFunc<
   { secretId: string },
   { exists: boolean; value: unknown | null }
 >({
   tags: ['pikku'],
   description: 'Get the current value of a secret',
   expose: true,
-  auth: false,
   func: async ({ secrets }, { secretId }) => {
     const exists = await secrets.hasSecret(secretId)
     if (!exists) {

package/dist/src/functions/wirings/functions/pikku-command-functions.js

@@ -3,13 +3,15 @@ import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { serializeFunctionImports } from './serialize-function-imports.js';
 import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
-import { stripVerboseFields, hasVerboseFields, } from '../../../utils/strip-verbose-meta.js';
+import { stripVerboseFields, hasVerboseFields, reattachFunctionServices, } from '../../../utils/strip-verbose-meta.js';
 export const pikkuFunctions = pikkuSessionlessFunc({
     func: async ({ logger, config, getInspectorState }) => {
         const { functions, rpc } = await getInspectorState();
         const { functionsMetaFile, functionsMetaJsonFile, functionsFile, packageMappings, schema, } = config;
-        // Write minimal JSON (runtime-only fields)
-        const minimalMeta = stripVerboseFields(functions.meta);
+        let minimalMeta = stripVerboseFields(functions.meta);
+        if (config.addonName) {
+            minimalMeta = reattachFunctionServices(minimalMeta, functions.meta);
+        }
         await writeFileInDir(logger, functionsMetaJsonFile, JSON.stringify(minimalMeta, null, 2));
         // Write verbose JSON only if it has additional fields
         if (hasVerboseFields(functions.meta)) {

package/dist/src/functions/wirings/workflow/pikku-command-workflow.js

@@ -10,7 +10,7 @@ import { serializeWorkflowBootstrapMap } from './serialize-workflow-bootstrap-ma
 import { serializeWorkflowMeta } from './serialize-workflow-meta.js';
 import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
 import { stripVerboseFields, hasVerboseFields, } from '../../../utils/strip-verbose-meta.js';
-import { join } from 'path';
+import { join, dirname } from 'path';
 export const pikkuWorkflow = pikkuSessionlessFunc({
     func: async ({ logger, config, getInspectorState }, input) => {
         const bootstrap = input?.bootstrap === true;
@@ -66,6 +66,10 @@ export const pikkuWorkflow = pikkuSessionlessFunc({
         const userFlowActors = config.userFlows?.actors;
         if (userFlowActors && Object.keys(userFlowActors).length > 0) {
             await writeFileInDir(logger, config.userFlowActorsFile, serializeUserFlowActors(userFlowActors));
+            // JSON twin for the runtime meta service (console personas view). Lives
+            // next to workflow/meta but NOT inside it — getWorkflowMeta() treats
+            // every workflow/meta/*.gen.json as a workflow.
+            await writeFileInDir(logger, join(dirname(config.userFlowActorsFile), 'user-flow-actors.gen.json'), JSON.stringify(userFlowActors, null, 2));
         }
         await writeFileInDir(logger, workflowMapDeclarationFile, bootstrap
             ? serializeWorkflowBootstrapMap(workflows.meta, workflows.graphMeta)

package/dist/src/utils/strip-verbose-meta.d.ts

@@ -29,6 +29,9 @@
  * Also strips addon namespace prefixes from pikkuFuncId values where packageName is present.
  */
 export declare function stripVerboseFields<T>(obj: T): T;
+export declare function reattachFunctionServices<T extends Record<string, {
+    services?: unknown;
+}>>(minimalMeta: T, fullMeta: T): T;
 /**
  * Check if an object has any verbose fields that would be stripped
  */

package/dist/src/utils/strip-verbose-meta.js

@@ -179,6 +179,14 @@ function _stripVerboseFieldsInner(obj) {
     }
     return result;
 }
+export function reattachFunctionServices(minimalMeta, fullMeta) {
+    for (const [id, meta] of Object.entries(fullMeta)) {
+        if (meta?.services && minimalMeta[id]) {
+            minimalMeta[id].services = meta.services;
+        }
+    }
+    return minimalMeta;
+}
 /**
  * Check if an object has any verbose fields that would be stripped
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/cli",
-  "version": "0.12.65",
+  "version": "0.12.67",
   "author": "yasser.fadl@gmail.com",
   "license": "BUSL-1.1",
   "imports": {
@@ -29,10 +29,10 @@
     "@openapi-contrib/json-schema-to-openapi-schema": "^4.3.1",
     "@pikku/better-auth": "^0.12.14",
     "@pikku/bun-server": "^0.12.2",
-    "@pikku/core": "^0.12.49",
+    "@pikku/core": "^0.12.51",
     "@pikku/deploy-cloudflare": "^0.12.8",
     "@pikku/fetch": "^0.12.6",
-    "@pikku/inspector": "^0.12.33",
+    "@pikku/inspector": "^0.12.35",
     "@pikku/kysely": "^0.13.0",
     "@pikku/kysely-node-sqlite": "^0.12.3",
     "@pikku/node-http-server": "^0.12.4",

package/skills/pikku-better-auth/SKILL.md

@@ -52,6 +52,10 @@ Better Auth owns its own HTTP surface, database tables, and session cookie. The
 
 You do NOT hand-write routes, the session middleware, or the secret wiring — `pikkuBetterAuth` + the CLI generate all of it. Re-run `pikku auth` (or `pikku all`) to regenerate.
 
+### The console requires Better Auth
+
+The Pikku console (`@pikku/addon-console`, enabled via `scaffold.console` in `pikku.config.json`) is an admin surface: **every console RPC now requires an authenticated session** (the functions are `pikkuFunc`; unauthenticated calls return `403`). So `scaffold.console` alone is **no longer the minimum** — you also need an auth strategy, and Better Auth is the supported one. `pikku all` **throws** if `scaffold.console` is set but no `pikkuBetterAuth(...)` is found in the project. Baseline is "must be logged in"; finer policy (admin-only, org scoping) is layered host-side via tag/HTTP middleware. See `pikku-deps` for the console's Security screen.
+
 ---
 
 ## Standard Setup

package/skills/pikku-deps/SKILL.md

@@ -0,0 +1,91 @@
+---
+name: pikku-deps
+description: 'Use for the Pikku dependency security audit: the `pikku audit` CLI command, the `.pikku/audit.json` artifact, the `SecurityAuditReport` type in @pikku/core, and the console Security screen (getSecurityAudit / runSecurityAudit / updateDependency + SecurityAuditView).
+TRIGGER when: user asks about `pikku audit`, dependency vulnerabilities/advisories, outdated dependencies, the Security screen/page in the console, updating a vulnerable dependency, or reading/rendering audit.json.
+DO NOT TRIGGER when: user asks about authentication/sessions/JWT (use pikku-security), permissions (use pikku-permissions), or secrets/env vars (use pikku-config).'
+installGroups: [core]
+---
+
+# Pikku Dependency Audit
+
+## Agent Operating Procedure
+
+1. The audit is a generated artifact, not live state. `pikku audit` writes the
+   normalised report to `.pikku/audit.json` (config `outDir`), so it rides the
+   same meta pipeline as every other codegen output — uploaded on deploy,
+   readable by the console addon and any tooling. Read it via
+   `metaService.readFile('audit.json')`, never by shelling out to the package
+   manager from a function.
+2. One source of truth for the shape: `SecurityAuditReport` (and
+   `SecurityAuditIssue` / `SecurityAuditUpdate` / `SecurityAuditSummary` +
+   `SecuritySeverity` / `SecurityUpdateLevel`) are exported from **@pikku/core**.
+   The CLI writes it, the addon reads it, the UI renders it — never redeclare
+   the type at a call site.
+3. Validate with `pikku tsc` after changes; the command never fails a build
+   (advisories are informational; a missing/failed audit yields an
+   empty-but-valid report).
+
+## The `pikku audit` command
+
+- `pikku audit` — reports **security advisories** only.
+- `pikku audit --outdated` — also reports **available dependency updates**.
+- Package-manager detection is by **lockfile** (walks up: `bun.lock`/`bun.lockb`,
+  then `yarn.lock`). Only **bun** runs a real audit (`bun audit --json` +
+  `bun outdated`, normalised into one `SecurityAuditReport` with per-severity /
+  per-update-level counts). Other PMs are detected but **stubbed** with a `note`
+  field until their shapes are normalised — issues/updates come back empty.
+- `bun audit` exits non-zero when it *finds* advisories but still writes a valid
+  report — treat any non-zero exit as data, not failure.
+
+## Console integration (@pikku/addon-console)
+
+Three RPCs, all reading/writing the same artifact via the meta service. Shared
+spawn/read helpers live in `lib/audit-exec.ts` (`readAuditReport`,
+`runPikkuAudit`, `spawnProcess`, `findBin`) — reuse them, don't re-implement.
+Like every console RPC these require an **authenticated session** (the console
+is admin-only), so the host must have Better Auth wired — see `pikku-better-auth`.
+
+- `getSecurityAudit` — reads `.pikku/audit.json`, returns the report (or `null`).
+- `runSecurityAudit` — runs `pikku audit --outdated` server-side (regenerates the
+  artifact) then returns the fresh report. Same shape as the Run Tests action.
+- `updateDependency({ package, version })` — bumps the package in `package.json`
+  (preserving the `^`/`~` range prefix), runs `bun install`, re-audits, and
+  returns the fresh report. Throws if the package is not a direct dependency.
+  NOTE: `bun install` must be scoped to a standalone project — do not run it
+  inside a yarn/bun monorepo member (it resolves the whole workspace).
+
+## Console UI (@pikku/console)
+
+- `SecurityPage` — the page: **Run audit** button (`lead`) + responsive
+  `ShellHeader` (structured `search` + `selection` for the Issues/Dependencies
+  lens; never cram raw controls into the non-collapsing `filters`/`view` escape
+  hatch). Empty state until an audit has run.
+- `SecurityAuditView` — exported presentational component. Two lenses
+  (Issues grouped by severity; Dependencies table). Each finding row carries its
+  actions **right-aligned in the row header** (`Accordion.Control` sibling, so a
+  click acts instead of toggling): "View advisory" + a per-finding
+  **remediation slot**.
+- `renderRemediation({ pkg, version, issue })` — the extension seam. OSS default
+  is `UpdateDependencyButton` (the free bump + `bun install`). Downstream
+  consoles (Fabric) pass their own sandbox-verified action here — replace the
+  action, keep the view.
+- Hooks: `useSecurityAudit` (read), `useRunSecurityAudit` (run),
+  `useUpdateDependency` (bump). All are `useMutation`/`useQuery` — surface
+  `mutation.error`, never hand-roll loading/error state or swallow the error.
+
+## Report shape (SecurityAuditReport)
+
+```ts
+{
+  tool: string                 // e.g. 'bun'
+  note?: string                // set when the audit could NOT run (unsupported PM);
+                               // render ONLY the note — never a reassuring "no vulnerabilities"
+  summary: { critical, high, moderate, low, info: number }
+  issues: SecurityAuditIssue[] // package, severity, title, advisoryId, cwe[], cvssScore?,
+                               // url?, vulnerableVersions, recommendedVersion?
+  updates: SecurityAuditUpdate[] // package, current, latest, level (major|minor|patch|unknown)
+}
+```
+
+When `note` is present the audit did not run — show only the note (an "Audit not
+run" state), never the "no known vulnerabilities / up to date" copy.