@pikku/cli 0.12.81 → 0.12.83

package/dist/src/functions/commands/info.js

@@ -159,19 +159,6 @@ export const pikkuInfoTags = pikkuSessionlessFunc({
                 tagMap.get(tag).middlewareNames.push(...(group.instanceIds ?? []));
             }
         }
-        const tagPermissions = state.permissions?.tagPermissions;
-        if (tagPermissions) {
-            for (const [tag, group] of tagPermissions) {
-                if (!tagMap.has(tag)) {
-                    tagMap.set(tag, {
-                        funcIds: [],
-                        middlewareNames: [],
-                        permissionNames: [],
-                    });
-                }
-                tagMap.get(tag).permissionNames.push(...(group.instanceIds ?? []));
-            }
-        }
         const tags = [...tagMap.entries()].sort((a, b) => a[0].localeCompare(b[0]));
         if (tags.length === 0) {
             console.log('No tags found.');

package/dist/src/functions/commands/new-addon.js

@@ -227,18 +227,28 @@ export const createWireServices = pikkuAddonWireServices(
 `;
     }
     else if (flags.oauth || flags.credential === 'oauth2') {
+        // The OAuth2 access token is owned and refreshed by the platform credential
+        // service (better-auth). Resolve a ready token per-request via the wire and
+        // hand it to the service — the addon does not do its own token exchange.
         files['src/services.ts'] =
-            `import { ${pascalName}Service } from './${name}-api.service.js'
-import { pikkuAddonServices } from '#pikku'
+            `import { UnauthorizedError } from '@pikku/core/errors'
+import { ${pascalName}Service } from './${name}-api.service.js'
+import { pikkuAddonWireServices } from '#pikku'
 
-export const createSingletonServices = pikkuAddonServices(async (
-  config,
-  { secrets, variables }
-) => {
-  const ${camelName} = new ${pascalName}Service(secrets, variables)
+export const createWireServices = pikkuAddonWireServices(
+  async ({ variables }, wire) => {
+    if (!wire.getCredential) {
+      throw new Error('Credential resolution is not available in this runtime')
+    }
+    const cred = await wire.getCredential<{ accessToken: string }>('${camelName}')
+    if (!cred?.accessToken) {
+      throw new UnauthorizedError('No ${displayName} connection — connect ${displayName} first')
+    }
+    const ${camelName} = new ${pascalName}Service(cred, variables)
 
-  return { ${camelName} }
-})
+    return { ${camelName} }
+  }
+)
 `;
     }
     else if (flags.secret) {
@@ -329,41 +339,30 @@ export class ${pascalName}Service {
 `;
     }
     else if (flags.oauth) {
+        // The access token is resolved (and refreshed) by the platform credential
+        // service and injected via createWireServices — this service just uses it.
         files[`src/${name}-api.service.ts`] =
-            `import { OAuth2Client } from '@pikku/core/oauth2'
-import type { TypedSecretService } from '#pikku/secrets/pikku-secrets.gen.js'
+            `import type { TypedVariablesService } from '#pikku/variables/pikku-variables.gen.js'
 
 const BASE_URL = 'https://api.example.com/v1'
 
-export const ${screamingName}_OAUTH2_CONFIG = {
-  tokenSecretId: '${screamingName}_TOKENS',
-  authorizationUrl: 'https://example.com/oauth2/authorize',
-  tokenUrl: 'https://example.com/oauth2/token',
-  scopes: ['read', 'write'],
-}
-
 export interface RequestOptions {
   body?: unknown
   qs?: Record<string, string | number | boolean | undefined>
 }
 
 export class ${pascalName}Service {
-  private oauth: OAuth2Client
-
-  constructor(secrets: TypedSecretService) {
-    this.oauth = new OAuth2Client(
-      ${screamingName}_OAUTH2_CONFIG,
-      '${screamingName}_APP_CREDENTIALS',
-      secrets
-    )
-  }
+  constructor(
+    private creds: { accessToken: string },
+    _variables?: TypedVariablesService
+  ) {}
 
   async request<T>(
     method: 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH',
     endpoint: string,
     options?: RequestOptions
   ): Promise<T> {
-    const url = new URL(\`\${BASE_URL}\${endpoint}\`)
+    const url = new URL(endpoint, BASE_URL)
 
     if (options?.qs) {
       for (const [key, value] of Object.entries(options.qs)) {
@@ -373,10 +372,11 @@ export class ${pascalName}Service {
       }
     }
 
-    const response = await this.oauth.request(url.toString(), {
+    const response = await fetch(url.toString(), {
       method,
       headers: {
         'Content-Type': 'application/json',
+        'Authorization': \`Bearer \${this.creds.accessToken}\`,
       },
       body: options?.body ? JSON.stringify(options.body) : undefined,
     })
@@ -386,11 +386,7 @@ export class ${pascalName}Service {
       throw new Error(\`${displayName} API error (\${response.status}): \${errorText}\`)
     }
 
-    const text = await response.text()
-    if (!text) {
-      return {} as T
-    }
-    return JSON.parse(text) as T
+    return response.json() as Promise<T>
   }
 }
 `;
@@ -811,7 +807,9 @@ export const pikkuNewAddon = pikkuSessionlessFunc({
         const resolvedDescription = description || `${resolvedDisplayName} integration for Pikku`;
         // Resolve target directory
         const baseDir = dir || config.scaffold?.addonDir || process.cwd();
-        const addonDir = join(baseDir, name);
+        // Folder mirrors the package name (@pikku/addon-<name>) so a packages/
+        // listing reads as packages/addon-<name>, distinct from app workspaces.
+        const addonDir = join(baseDir, `addon-${name}`);
         if (existsSync(addonDir)) {
             logger.error(`Directory already exists: ${addonDir}`);
             process.exit(1);

package/dist/src/functions/commands/pikku-command-bootstrap.js

@@ -9,6 +9,12 @@ export const pikkuBootstrap = pikkuSessionlessFunc({
         const addonBootstraps = [];
         for (const [, decl] of stateBeforeBootstrap.rpc?.wireAddonDeclarations ??
             []) {
+            // Remote addons (wireRemoteAddon) run on the host — never import their
+            // runtime bootstrap here; that would register their functions locally
+            // and drag in the runtime deps remote consumption exists to avoid. The
+            // consumer's own wireRemoteAddon() call registers the remote binding.
+            if (decl.remote)
+                continue;
             addonBootstraps.push(`${decl.package}/.pikku/pikku-bootstrap.gen.js`);
             logger.debug(`• Addon bootstrap: ${decl.package}`);
         }

package/dist/src/functions/commands/scopes-audit.d.ts

@@ -0,0 +1 @@
+export declare const scopesAudit: import("#pikku").PikkuFunctionConfig<{}, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{}, void, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<{}, void, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;

package/dist/src/functions/commands/scopes-audit.js

@@ -0,0 +1,37 @@
+import { pikkuSessionlessFunc } from '#pikku';
+import { loadDeclaredScopes, openScopeService, reportStaleScopes, } from './scopes-shared.js';
+export const scopesAudit = pikkuSessionlessFunc({
+    remote: true,
+    func: async ({ logger, config }) => {
+        const declared = await loadDeclaredScopes(config.scopesMetaJsonFile, logger);
+        if (!declared) {
+            throw new Error('scope metadata not found');
+        }
+        const opened = await openScopeService({ config, logger }, declared, 'pikku scopes audit');
+        if (!opened) {
+            return;
+        }
+        try {
+            const stale = await opened.service.findStaleScopes();
+            logger.info(`Scope audit: ${declared.length} scope(s) declared in code`);
+            if (stale.length === 0) {
+                logger.info('  every scope in the database is still declared');
+                return;
+            }
+            logger.info('');
+            logger.info(`${stale.length} scope(s) no longer declared in code:`);
+            reportStaleScopes(stale, logger);
+            const granted = stale.filter((s) => s.roles.length > 0);
+            logger.info('');
+            if (granted.length > 0) {
+                logger.warn(`${granted.length} undeclared scope(s) are still granted by a role. ` +
+                    `They authorize nothing — no function can require a scope that is not declared — ` +
+                    `but the grants persist until removed.`);
+            }
+            logger.info('Run `pikku scopes prune --yes` to remove them.');
+        }
+        finally {
+            await opened.destroy();
+        }
+    },
+});

package/dist/src/functions/commands/scopes-prune.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Removes scopes that are no longer declared in code, cascading them out of
+ * every role that holds them.
+ *
+ * This revokes access, so it never runs implicitly — not at boot, not as part
+ * of `pikku all`. Without `--yes` it only reports the blast radius.
+ */
+export declare const scopesPrune: import("#pikku").PikkuFunctionConfig<{
+    yes?: boolean;
+}, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{
+    yes?: boolean;
+}, void, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<{
+    yes?: boolean;
+}, void, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;

package/dist/src/functions/commands/scopes-prune.js

@@ -0,0 +1,50 @@
+import { pikkuSessionlessFunc } from '#pikku';
+import { loadDeclaredScopes, openScopeService, reportStaleScopes, } from './scopes-shared.js';
+/**
+ * Removes scopes that are no longer declared in code, cascading them out of
+ * every role that holds them.
+ *
+ * This revokes access, so it never runs implicitly — not at boot, not as part
+ * of `pikku all`. Without `--yes` it only reports the blast radius.
+ */
+export const scopesPrune = pikkuSessionlessFunc({
+    remote: true,
+    func: async ({ logger, config }, { yes }) => {
+        const declared = await loadDeclaredScopes(config.scopesMetaJsonFile, logger);
+        if (!declared) {
+            throw new Error('scope metadata not found');
+        }
+        const opened = await openScopeService({ config, logger }, declared, 'pikku scopes prune');
+        if (!opened) {
+            return;
+        }
+        try {
+            const stale = await opened.service.findStaleScopes();
+            if (stale.length === 0) {
+                logger.info('scopes prune: nothing to prune');
+                return;
+            }
+            logger.info(`${stale.length} scope(s) no longer declared in code:`);
+            reportStaleScopes(stale, logger);
+            const granted = stale.filter((s) => s.roles.length > 0);
+            const affectedRoles = new Set(stale.flatMap(({ roles }) => roles));
+            if (!yes) {
+                logger.info('');
+                if (granted.length > 0) {
+                    logger.warn(`Pruning would revoke ${granted.length} scope(s) from the roles above.`);
+                }
+                logger.info('Re-run with --yes to remove them.');
+                return;
+            }
+            const pruned = await opened.service.pruneScopes();
+            logger.info('');
+            logger.info(`scopes prune: removed ${pruned.length} scope(s)`);
+            if (granted.length > 0) {
+                logger.warn(`Revoked from ${affectedRoles.size} role(s). Users holding those roles lose these scopes on their next request.`);
+            }
+        }
+        finally {
+            await opened.destroy();
+        }
+    },
+});

package/dist/src/functions/commands/scopes-shared.d.ts

@@ -0,0 +1,39 @@
+import type { FlatScope } from '@pikku/core/scope';
+import { KyselyScopeService } from '@pikku/kysely';
+type Logger = {
+    info: (msg: string) => void;
+    warn: (msg: string) => void;
+    error: (msg: string) => void;
+};
+export declare const loadDeclaredScopes: (scopesMetaJsonFile: string, logger: Logger) => Promise<FlatScope[] | null>;
+export type OpenedScopeService = {
+    service: KyselyScopeService;
+    destroy: () => Promise<void>;
+};
+/**
+ * Opens a ScopeService against the project's configured database and brings the
+ * `declared` marks up to date with the code.
+ *
+ * The sync is deliberate: the marks are otherwise only as fresh as the last app
+ * boot, so an audit run straight after a code change would report stale
+ * answers. It is safe to do here because syncing is purely additive — it
+ * upserts and marks, and never deletes a scope or revokes a grant.
+ */
+export declare const openScopeService: ({ config, logger, }: {
+    config: {
+        rootDir: string;
+        outDir: string;
+        runtimeDir?: string;
+        srcDirectories: string[];
+    };
+    logger: Logger;
+}, declared: FlatScope[], command: string) => Promise<OpenedScopeService | null>;
+/**
+ * Renders undeclared scopes and the roles that would lose them — the blast
+ * radius, shown before anything is deleted.
+ */
+export declare const reportStaleScopes: (stale: Array<{
+    scope: string;
+    roles: string[];
+}>, logger: Logger) => void;
+export {};

package/dist/src/functions/commands/scopes-shared.js

@@ -0,0 +1,83 @@
+import { readFile } from 'node:fs/promises';
+import { flattenScopeDefinitions } from '@pikku/core/scope';
+import { KyselyScopeService } from '@pikku/kysely';
+import { createKysely, resolveDb } from '../db/local-db.js';
+import { loadUserConfigForDb } from './db-shared.js';
+/**
+ * Reads the generated scope metadata and flattens it to the declared scope set.
+ *
+ * Returns `null` — never an empty array — when the file cannot be read, so a
+ * caller can tell "nothing is declared" apart from "we failed to find out".
+ * `prune` deletes everything not in this set, so conflating the two would wipe
+ * every scope in the database.
+ */
+const isScopeDefinitionsMeta = (value) => typeof value === 'object' &&
+    value !== null &&
+    !Array.isArray(value) &&
+    Object.values(value).every((def) => typeof def === 'object' &&
+        def !== null &&
+        !Array.isArray(def) &&
+        typeof def.name === 'string');
+export const loadDeclaredScopes = async (scopesMetaJsonFile, logger) => {
+    let parsed;
+    try {
+        parsed = JSON.parse(await readFile(scopesMetaJsonFile, 'utf8'));
+    }
+    catch {
+        logger.error(`pikku scopes: no scope metadata at ${scopesMetaJsonFile}.\n` +
+            `  Run \`pikku all\` to generate it.`);
+        return null;
+    }
+    if (!isScopeDefinitionsMeta(parsed)) {
+        logger.error(`pikku scopes: the scope metadata at ${scopesMetaJsonFile} is malformed.\n` +
+            `  Run \`pikku all\` to regenerate it.`);
+        return null;
+    }
+    return flattenScopeDefinitions(Object.values(parsed));
+};
+/**
+ * Opens a ScopeService against the project's configured database and brings the
+ * `declared` marks up to date with the code.
+ *
+ * The sync is deliberate: the marks are otherwise only as fresh as the last app
+ * boot, so an audit run straight after a code change would report stale
+ * answers. It is safe to do here because syncing is purely additive — it
+ * upserts and marks, and never deletes a scope or revokes a grant.
+ */
+export const openScopeService = async ({ config, logger, }, declared, command) => {
+    const userConfig = await loadUserConfigForDb({
+        config,
+        logger,
+    });
+    if (!userConfig) {
+        return null;
+    }
+    const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir);
+    if (!resolved) {
+        logger.error(`${command}: no database configured — set sqliteDb or postgresUrl in your createConfig.`);
+        throw new Error('no database configured');
+    }
+    const db = await createKysely(resolved);
+    try {
+        const service = new KyselyScopeService(db);
+        await service.init();
+        await service.syncScopes(declared);
+        return { service, destroy: () => db.destroy() };
+    }
+    catch (e) {
+        await db.destroy();
+        throw e;
+    }
+};
+/**
+ * Renders undeclared scopes and the roles that would lose them — the blast
+ * radius, shown before anything is deleted.
+ */
+export const reportStaleScopes = (stale, logger) => {
+    for (const { scope, roles } of stale) {
+        const held = roles.length > 0
+            ? `held by ${roles.length} role(s): ${roles.join(', ')}`
+            : 'held by no role';
+        logger.info(`  ${scope.padEnd(40)} ${held}`);
+    }
+};

package/dist/src/functions/commands/serve.js

@@ -1,6 +1,6 @@
 import { join, resolve } from 'path';
 import { pikkuSessionlessFunc } from '#pikku';
-import { ConsoleLogger, LocalEmailService, InMemoryQueueService, InMemoryWorkflowService, InMemoryTriggerService, InMemoryAIRunStateService, } from '@pikku/core/services';
+import { ConsoleLogger, LocalEmailService, InMemoryQueueService, InMemoryWorkflowService, InMemoryTriggerService, InMemoryAIRunStateService, QueueWebhookService, } from '@pikku/core/services';
 import { KyselyAIStorageService, KyselyAIRunStateService, KyselyAgentRunService, } from '@pikku/kysely';
 import { stopSingletonServices } from '@pikku/core';
 import { pikkuState } from '@pikku/core/internal';
@@ -81,13 +81,15 @@ export const serve = pikkuSessionlessFunc({
             })
             : undefined;
         const eventHub = await devServerRunner.createEventHub();
+        const serveQueueService = new InMemoryQueueService();
         const inMemoryServices = {
             logger: devLogger,
             ...(aiAgentRunner ? { aiAgentRunner } : {}),
             emailService: new LocalEmailService(),
             metaService: new LocalMetaService(pikkuDir),
             schedulerService,
-            queueService: new InMemoryQueueService(),
+            queueService: serveQueueService,
+            webhookService: new QueueWebhookService(serveQueueService),
             workflowService,
             workflowRunService: workflowService,
             triggerService: new InMemoryTriggerService(),

package/dist/src/functions/commands/skills.js

@@ -1,6 +1,6 @@
 import { readdir, readFile, mkdir, writeFile } from 'fs/promises';
 import { existsSync } from 'fs';
-import { join, dirname } from 'path';
+import { join, dirname, sep } from 'path';
 import { fileURLToPath } from 'url';
 import { pikkuSessionlessFunc } from '#pikku';
 /**
@@ -46,6 +46,17 @@ async function copyDir(src, dest) {
         }
     }
 }
+/**
+ * Where each supported agent reads project-local skills from, relative to the
+ * project root. `pi` mirrors pi.dev's own resolution: it scans
+ * `<cwd>/<CONFIG_DIR_NAME>/skills` for project skills, where CONFIG_DIR_NAME
+ * defaults to `.pi`.
+ */
+const AGENT_SKILL_DIRS = {
+    claude: join('.claude', 'skills'),
+    opencode: join('.opencode', 'skills'),
+    pi: join('.pi', 'skills'),
+};
 function parseInstallGroups(frontmatter) {
     const inline = frontmatter.match(/^\s*installGroups\s*:\s*\[([^\]]*)\]/m);
     if (inline) {
@@ -113,10 +124,8 @@ export const pikkuSkillsList = pikkuSessionlessFunc({
             .map((e) => e.name)
             .sort();
         const installed = new Set();
-        for (const dir of [
-            join(process.cwd(), '.claude', 'skills'),
-            join(process.cwd(), '.opencode', 'skills'),
-        ]) {
+        for (const relative of Object.values(AGENT_SKILL_DIRS)) {
+            const dir = join(process.cwd(), relative);
             if (existsSync(dir)) {
                 for (const e of await readdir(dir, { withFileTypes: true })) {
                     if (e.isDirectory() || e.isSymbolicLink())
@@ -133,11 +142,12 @@ export const pikkuSkillsList = pikkuSessionlessFunc({
         console.log('Run `pikku skills install` to copy them into .claude/skills/');
         console.log('Run `pikku skills install --core --fabric` to install the Fabric sandbox skill set.');
         console.log('Run `pikku skills install --agent opencode` to copy them into .opencode/skills/');
+        console.log('Run `pikku skills install --agent pi` to copy them into .pi/skills/');
     },
 });
 export const pikkuSkillsInstall = pikkuSessionlessFunc({
     func: async ({ logger }, { agent = 'claude', only, core = false, fabric = false, update = false }) => {
-        const supportedAgents = ['claude', 'opencode'];
+        const supportedAgents = Object.keys(AGENT_SKILL_DIRS);
         if (!supportedAgents.includes(agent)) {
             logger.error(`Agent "${agent}" is not yet supported. Supported: ${supportedAgents.join(', ')}. ` +
                 `(codex/gemini will emit AGENTS.md/GEMINI.md from the same source — coming soon.)`);
@@ -160,9 +170,7 @@ export const pikkuSkillsInstall = pikkuSessionlessFunc({
             process.exitCode = 1;
             return;
         }
-        const installRoot = agent === 'opencode'
-            ? join(process.cwd(), '.opencode', 'skills')
-            : join(process.cwd(), '.claude', 'skills');
+        const installRoot = join(process.cwd(), AGENT_SKILL_DIRS[agent]);
         await mkdir(installRoot, { recursive: true });
         let installed = 0;
         let skipped = 0;
@@ -176,7 +184,7 @@ export const pikkuSkillsInstall = pikkuSessionlessFunc({
             await copyDir(src, dest);
             installed++;
         }
-        const destLabel = agent === 'opencode' ? '.opencode/skills/' : '.claude/skills/';
+        const destLabel = `${AGENT_SKILL_DIRS[agent].split(sep).join('/')}/`;
         logger.info(`Installed ${installed} skill(s) into ${destLabel}${skipped > 0
             ? ` (skipped ${skipped} already present — pass --update to overwrite)`
             : ''}`);

package/dist/src/functions/wirings/ai-agent/serialize-ai-agent-types.js

@@ -17,12 +17,13 @@ import type { AgentMap } from '${agentMapImportPath}'
 type AIAgentConfig<
   InputSchema extends StandardSchemaV1 | undefined = undefined,
   OutputSchema extends StandardSchemaV1 | undefined = undefined
-> = Omit<CoreAIAgent<PikkuPermission, PikkuMiddleware>, 'tools' | 'agents' | 'memory' | 'input' | 'output'> & {
+> = Omit<CoreAIAgent<PikkuPermission, PikkuMiddleware>, 'tools' | 'agents' | 'workflows' | 'memory' | 'input' | 'output'> & {
   input?: InputSchema
   output?: OutputSchema
   memory?: Omit<AIAgentMemoryConfig, 'workingMemory'> & { workingMemory?: StandardSchemaV1 }
   tools?: object[]
   agents?: AIAgentConfig<StandardSchemaV1 | undefined, StandardSchemaV1 | undefined>[]
+  workflows?: object[]
 }
 
 export const pikkuAIAgent = <

package/dist/src/functions/wirings/console/serialize-console-functions.js

@@ -98,6 +98,12 @@ export const consoleRoutes = defineHTTPRoutes({
   },
 })
 
+// The console addon's functions have no authorization of their own. An app
+// gates the whole privileged surface (credential read/write, source editing,
+// package install) with a single package-scoped global permission —
+// addGlobalPermission([isAdmin], '@pikku/addon-console') — which is resolved in
+// the addon's package namespace, so it applies to every one of its functions at
+// once. Apps that don't register one are unaffected (no globals => allow).
 wireAddon({ name: 'console', package: '@pikku/addon-console' })
 wireHTTPRoutes({ basePath: '${globalHTTPPrefix}', routes: { console: consoleRoutes } })
 `;

package/dist/src/functions/wirings/credentials/serialize-credentials-types.js

@@ -7,6 +7,7 @@ export const serializeCredentialsTypes = ({ definitions, schemaLookup, credentia
     let needsZod = false;
     const mapEntries = [];
     const metaEntries = [];
+    const oauth2Entries = [];
     for (const [name, meta] of credentialEntries) {
         if (meta.schema && typeof meta.schema === 'string') {
             const schemaRef = schemaLookup.get(meta.schema);
@@ -26,12 +27,19 @@ export const serializeCredentialsTypes = ({ definitions, schemaLookup, credentia
         ];
         if (meta.oauth2) {
             metaParts.push(`oauth2: true`);
+            // `type` rides along so consumers can tell a platform-wide credential from
+            // a per-user one without a second lookup — they own different accounts.
+            const config = JSON.stringify({ ...meta.oauth2, type: meta.type }, null, 2).replace(/\n/g, '\n  ');
+            oauth2Entries.push(`  '${name}': ${config}`);
         }
         metaEntries.push(`  '${name}': { ${metaParts.join(', ')} }`);
     }
     const imports = [];
     imports.push(`import { TypedCredentialService as CoreTypedCredentialService, type CredentialMetaInfo } from '@pikku/core/services'`);
     imports.push(`import type { CredentialService } from '@pikku/core/services'`);
+    if (oauth2Entries.length > 0) {
+        imports.push(`import type { OAuth2CredentialConfig } from '@pikku/core/secret'`);
+    }
     if (needsZod) {
         imports.push(`import type { z } from 'zod'`);
     }
@@ -40,6 +48,19 @@ export const serializeCredentialsTypes = ({ definitions, schemaLookup, credentia
         const vars = Array.from(variableNames).join(', ');
         imports.push(`import { ${vars} } from '${importPath}'`);
     }
+    const oauth2Configs = oauth2Entries.length > 0
+        ? `
+export const CREDENTIAL_OAUTH2_CONFIGS = {
+${oauth2Entries.join(',\n')}
+} satisfies Record<
+  string,
+  OAuth2CredentialConfig & {
+    appCredentialSecretId: string
+    type: 'singleton' | 'wire'
+  }
+>
+`
+        : '';
     return `${imports.join('\n')}
 
 export interface CredentialsMap {
@@ -51,6 +72,7 @@ export type CredentialName = keyof CredentialsMap
 const CREDENTIALS_META: Record<string, CredentialMetaInfo> = {
 ${metaEntries.join(',\n')}
 }
+${oauth2Configs}
 
 export class TypedCredentialService extends CoreTypedCredentialService<CredentialsMap> {
   constructor(credentials: CredentialService) {

package/dist/src/functions/wirings/functions/pikku-command-function-types-split.js

@@ -22,7 +22,7 @@ export const pikkuFunctionTypesSplit = pikkuSessionlessFunc({
         const configTypeImport = pikkuConfigType
             ? `import type { ${pikkuConfigType.type} } from '${getFileImportRelativePath(functionTypesFile, pikkuConfigType.typePath, packageMappings)}'`
             : '// Config type not found, will use fallback';
-        const content = serializeFunctionTypes(`import type { ${userSessionType.type} } from '${getFileImportRelativePath(functionTypesFile, userSessionType.typePath, packageMappings)}'`, userSessionType.type, `import type { ${singletonServicesType.type} } from '${getFileImportRelativePath(functionTypesFile, singletonServicesType.typePath, packageMappings)}'`, singletonServicesType.type, `import type { ${wireServicesType.type} } from '${getFileImportRelativePath(functionTypesFile, wireServicesType.typePath, packageMappings)}'`, wireServicesType.type, `import type { TypedPikkuRPC, FlattenedRPCMap } from '${getFileImportRelativePath(functionTypesFile, rpcInternalMapDeclarationFile, packageMappings)}'`, `import type { RequiredSingletonServices, RequiredWireServices } from '${getFileImportRelativePath(functionTypesFile, servicesFile, packageMappings)}'`, configTypeImport, config.addonName, undefined, typeof config.addon === 'object' ? config.addon?.categories : undefined);
+        const content = serializeFunctionTypes(`import type { ${userSessionType.type} } from '${getFileImportRelativePath(functionTypesFile, userSessionType.typePath, packageMappings)}'`, userSessionType.type, `import type { ${singletonServicesType.type} } from '${getFileImportRelativePath(functionTypesFile, singletonServicesType.typePath, packageMappings)}'`, singletonServicesType.type, `import type { ${wireServicesType.type} } from '${getFileImportRelativePath(functionTypesFile, wireServicesType.typePath, packageMappings)}'`, wireServicesType.type, `import type { TypedPikkuRPC, FlattenedRPCMap } from '${getFileImportRelativePath(functionTypesFile, rpcInternalMapDeclarationFile, packageMappings)}'`, `import type { RequiredSingletonServices, RequiredWireServices } from '${getFileImportRelativePath(functionTypesFile, servicesFile, packageMappings)}'`, configTypeImport, config.addonName, undefined, typeof config.addon === 'object' ? config.addon?.categories : undefined, `import type { ScopeId } from '${getFileImportRelativePath(functionTypesFile, config.scopesFile, packageMappings)}'`);
         const addonRefs = serializeAddonRefs({
             addonHttp: visitState.exportedContracts.addonHttp,
             addonChannel: visitState.exportedContracts.addonChannel,

package/dist/src/functions/wirings/functions/pikku-command-function-types.js

@@ -6,7 +6,7 @@ import { serializePikkuTypesHub } from './serialize-pikku-types-hub.js';
 import { projectDeclaresBetterAuth } from '../../../utils/detect-better-auth.js';
 export const pikkuFunctionTypes = pikkuSessionlessFunc({
     func: async ({ logger, config, getInspectorState }, data) => {
-        const { typesDeclarationFile: typesFile, packageMappings, functionTypesFile, httpTypesFile, channelsTypesFile, triggersTypesFile, schedulersTypesFile, queueTypesFile, mcpTypesFile, cliTypesFile, nodeTypesFile, secretTypesFile, addonTypesFile, authTypesFile, } = config;
+        const { typesDeclarationFile: typesFile, packageMappings, functionTypesFile, httpTypesFile, channelsTypesFile, triggersTypesFile, schedulersTypesFile, queueTypesFile, mcpTypesFile, cliTypesFile, nodeTypesFile, secretTypesFile, scopeTypesFile, addonTypesFile, authTypesFile, } = config;
         const getImportPath = (file) => config.addon
             ? null
             : getFileImportRelativePath(typesFile, file, packageMappings);
@@ -31,7 +31,7 @@ export const pikkuFunctionTypes = pikkuSessionlessFunc({
         const authTypesImportPath = authTypesFile && hasAuth
             ? getFileImportRelativePath(typesFile, authTypesFile, packageMappings)
             : null;
-        const content = serializePikkuTypesHub(getFileImportRelativePath(typesFile, functionTypesFile, packageMappings), getImportPath(httpTypesFile), getImportPath(channelsTypesFile), getAlwaysImportPath(triggersTypesFile), getImportPath(schedulersTypesFile), getImportPath(queueTypesFile), getImportPath(mcpTypesFile), getImportPath(cliTypesFile), getAlwaysImportPath(nodeTypesFile), getAlwaysImportPath(secretTypesFile), config.addon ? getAlwaysImportPath(addonTypesFile) : null, authTypesImportPath);
+        const content = serializePikkuTypesHub(getFileImportRelativePath(typesFile, functionTypesFile, packageMappings), getImportPath(httpTypesFile), getImportPath(channelsTypesFile), getAlwaysImportPath(triggersTypesFile), getImportPath(schedulersTypesFile), getImportPath(queueTypesFile), getImportPath(mcpTypesFile), getImportPath(cliTypesFile), getAlwaysImportPath(nodeTypesFile), getAlwaysImportPath(secretTypesFile), config.addon ? getAlwaysImportPath(addonTypesFile) : null, authTypesImportPath, getAlwaysImportPath(scopeTypesFile));
         await writeFileInDir(logger, typesFile, content);
     },
     middleware: [

package/dist/src/functions/wirings/functions/serialize-function-types.d.ts

@@ -1,4 +1,4 @@
 /**
  * Generates core function, middleware, and permission type definitions
  */
-export declare const serializeFunctionTypes: (userSessionTypeImport: string, userSessionTypeName: string, singletonServicesTypeImport: string, singletonServicesTypeName: string, wireServicesTypeImport: string, wireServicesTypeName: string, rpcMapTypeImport: string, requiredServicesTypeImport: string, configTypeImport: string, packageName?: string, workflowTypesImport?: string, nodeCategories?: string[]) => string;
+export declare const serializeFunctionTypes: (userSessionTypeImport: string, userSessionTypeName: string, singletonServicesTypeImport: string, singletonServicesTypeName: string, wireServicesTypeImport: string, wireServicesTypeName: string, rpcMapTypeImport: string, requiredServicesTypeImport: string, configTypeImport: string, packageName?: string, workflowTypesImport?: string, nodeCategories?: string[], scopesTypeImport?: string) => string;