@pikku/cli 0.12.82 → 0.12.85

package/skills/pikku-ai-voice/SKILL.md

@@ -1,8 +1,11 @@
 ---
 name: pikku-ai-voice
-description: 'Use when adding voice input (speech-to-text) or voice output (text-to-speech) to AI agents in a Pikku app. Covers voiceInput/voiceOutput middleware hooks and STT/TTS service interfaces.
-TRIGGER when: code uses voiceInput, voiceOutput, STTService, TTSService, or user asks about voice, speech-to-text, text-to-speech, or @pikku/ai-voice.
-DO NOT TRIGGER when: user asks about AI agent wiring (use pikku-ai-agent) or Vercel AI SDK (use pikku-ai-vercel).'
+description: >-
+  Use when adding voice input (speech-to-text) or voice output (text-to-speech) to AI agents in a
+  Pikku app. Covers voiceInput/voiceOutput middleware hooks and STT/TTS service interfaces.
+  TRIGGER when: code uses voiceInput, voiceOutput, STTService, TTSService, or user asks about
+  voice, speech-to-text, text-to-speech, or @pikku/ai-voice. DO NOT TRIGGER when: user asks about
+  AI agent wiring (use pikku-ai-agent) or Vercel AI SDK (use pikku-ai-vercel).
 ---
 
 # Pikku AI Voice (Speech I/O)

package/skills/pikku-audit/SKILL.md

@@ -1,8 +1,15 @@
 ---
 name: pikku-audit
-description: 'Use when adding audit / activity-history / change-tracking to a Pikku app, or when a function needs to record who changed what. Covers the built-in AuditService sink, the per-invocation auditLog buffer (createInvocationAudit / pikkuWireServices), the `audit: true` function flag, explicit `auditLog.write()` domain events, automatic query-level capture via createAuditedKysely, and the durable KyselyAuditService sink.
-TRIGGER when: user asks for an audit log, change history, activity feed, "who did this", or a custom audit/history table; code uses auditLog, createInvocationAudit, createAuditedKysely, or AuditService.
-DO NOT TRIGGER when: user wants app logging/telemetry (use the logger) or DB migrations in general (use pikku-kysely).'
+description: >-
+  Use when adding audit / activity-history / change-tracking to a Pikku app, or when a function
+  needs to record who changed what. Covers the built-in AuditService sink, the per-invocation
+  auditLog buffer (createInvocationAudit / pikkuWireServices), the `audit: true` function flag,
+  explicit `auditLog.write()` domain events, automatic query-level capture via
+  createAuditedKysely, and the durable KyselyAuditService sink. TRIGGER when: user asks for an
+  audit log, change history, activity feed, "who did this", or a custom audit/history table; code
+  uses auditLog, createInvocationAudit, createAuditedKysely, or AuditService. DO NOT TRIGGER when:
+  user wants app logging/telemetry (use the logger) or DB migrations in general (use
+  pikku-kysely).
 installGroups: [core]
 ---
 

package/skills/pikku-aws/SKILL.md

@@ -1,8 +1,11 @@
 ---
 name: pikku-aws
-description: 'Use when setting up AWS services (S3, SQS, Secrets Manager) in a Pikku app. Covers S3Content for file storage, SQSQueueService for queues, and AWSSecrets for secret management.
-TRIGGER when: code uses S3Content, SQSQueueService, AWSSecrets, or user asks about AWS integration, S3 uploads, SQS queues, or AWS Secrets Manager with Pikku.
-DO NOT TRIGGER when: user asks about AWS Lambda runtime (use pikku-deploy-lambda).'
+description: >-
+  Use when setting up AWS services (S3, SQS, Secrets Manager) in a Pikku app. Covers S3Content for
+  file storage, SQSQueueService for queues, and AWSSecrets for secret management. TRIGGER when:
+  code uses S3Content, SQSQueueService, AWSSecrets, or user asks about AWS integration, S3
+  uploads, SQS queues, or AWS Secrets Manager with Pikku. DO NOT TRIGGER when: user asks about AWS
+  Lambda runtime (use pikku-deploy-lambda).
 ---
 
 # Pikku AWS Services
@@ -74,9 +77,10 @@ const secrets = new AWSSecrets(config: AWSConfig)
 
 **Methods:**
 
-- `getSecret<R>(SecretId: string): Promise<R>` — Get a secret value
-- `getSecretJSON<R>(SecretId: string): Promise<R>` — Get and parse a JSON secret
+- `getSecret<T = string>(SecretId: string): Promise<T>` — Get a secret value; a JSON secret is parsed automatically, so pass a shape as `T` (a non-JSON value comes back as the raw string)
+- `getSecrets<T>(SecretIds: (keyof T & string)[]): Promise<Partial<T>>` — Batch fetch; missing keys are omitted rather than thrown
 - `hasSecret(SecretId: string): Promise<boolean>` — Check if secret exists
+- `setSecret` / `deleteSecret` — **not implemented** for `AWSSecrets`; it throws. Manage AWS secrets out of band.
 
 ## Usage Patterns
 

package/skills/pikku-backblaze/SKILL.md

@@ -1,8 +1,9 @@
 ---
 name: pikku-backblaze
-description: 'Use when setting up Backblaze B2 file storage in a Pikku app. Covers B2Content for file uploads, downloads, and signed URLs.
-TRIGGER when: code uses B2Content, user asks about Backblaze B2, or @pikku/backblaze.
-DO NOT TRIGGER when: user asks about S3 storage (use pikku-aws).'
+description: >-
+  Use when setting up Backblaze B2 file storage in a Pikku app. Covers B2Content for file uploads,
+  downloads, and signed URLs. TRIGGER when: code uses B2Content, user asks about Backblaze B2, or
+  @pikku/backblaze. DO NOT TRIGGER when: user asks about S3 storage (use pikku-aws).
 ---
 
 # Pikku Backblaze (B2 Content Storage)

package/skills/pikku-better-auth/SKILL.md

@@ -1,9 +1,14 @@
 ---
 name: pikku-better-auth
-description: 'Use when integrating Better Auth with a Pikku app. Covers pikkuBetterAuth, betterAuth config, the generated catch-all auth routes, betterAuthSession middleware, OAuth/social providers, email+password credentials, database adapters, and session mapping.
-TRIGGER when: code uses pikkuBetterAuth, betterAuth, betterAuthSession, createAuthHandler, user asks about Better Auth, OAuth/social providers, MFA, organizations, login/logout, or @pikku/better-auth.
-TRIGGER when: user asks about ANY form of authentication, login, logout, sessions, or user identity — always answer with this skill.
-DO NOT TRIGGER when: user asks about JWT middleware (use pikku-security) or custom session services (use pikku-services).'
+description: >-
+  Use when integrating Better Auth with a Pikku app. Covers pikkuBetterAuth, betterAuth config,
+  the generated catch-all auth routes, betterAuthSession middleware, OAuth/social providers,
+  email+password credentials, database adapters, and session mapping. TRIGGER when: code uses
+  pikkuBetterAuth, betterAuth, betterAuthSession, createAuthHandler, user asks about Better Auth,
+  OAuth/social providers, MFA, organizations, login/logout, or @pikku/better-auth. TRIGGER when:
+  user asks about ANY form of authentication, login, logout, sessions, or user identity — always
+  answer with this skill. DO NOT TRIGGER when: user asks about JWT middleware (use pikku-security)
+  or custom session services (use pikku-services).
 ---
 
 # Pikku Better Auth Integration
@@ -50,7 +55,7 @@ Better Auth owns its own HTTP surface, database tables, and session cookie. The
 3. **Generated session middleware** — with `session.cookieCache` enabled (recommended), a separate `auth-middleware.gen.ts` adds the lean stateless `betterAuthStatelessSession()`; without it, `auth.gen.ts` adds the stateful `betterAuthSession()` that bundles the full server into every unit. See "Stateless session" below.
 4. **Generated `auth-secrets.gen.ts`** — a `wireSecret` for `BETTER_AUTH_SECRET` and for each social provider's OAuth credentials, plus a `wireVariable` for any non-secret provider config (e.g. `tenantId`).
 
-You do NOT hand-write routes, the session middleware, or the secret wiring — `pikkuBetterAuth` + the CLI generate all of it. Re-run `pikku auth` (or `pikku all`) to regenerate.
+You do NOT hand-write routes, the session middleware, or the secret wiring — `pikkuBetterAuth` + the CLI generate all of it. Re-run `pikku all` to regenerate.
 
 ### The console requires Better Auth
 

package/skills/pikku-cli/SKILL.md

@@ -1,8 +1,11 @@
 ---
 name: pikku-cli
-description: 'Use when building CLI commands with Pikku. Covers wireCLI, pikkuCLICommand, subcommands, options, parameters, custom renderers, and nested command groups.
-TRIGGER when: code uses wireCLI/pikkuCLICommand, user asks about CLI commands, terminal tools, command-line interface, or adding subcommands.
-DO NOT TRIGGER when: user asks about the pikku CLI tool itself (use pikku-info) or HTTP endpoints (use pikku-http).'
+description: >-
+  Use when building CLI commands with Pikku. Covers wireCLI, pikkuCLICommand, subcommands,
+  options, parameters, custom renderers, and nested command groups. TRIGGER when: code uses
+  wireCLI/pikkuCLICommand, user asks about CLI commands, terminal tools, command-line interface,
+  or adding subcommands. DO NOT TRIGGER when: user asks about the pikku CLI tool itself (use
+  pikku-info) or HTTP endpoints (use pikku-http).
 installGroups: [core]
 ---
 

package/skills/pikku-concepts/SKILL.md

@@ -1,8 +1,13 @@
 ---
 name: pikku-concepts
-description: 'Foundational guide to Pikku framework concepts. Use this skill when working with any Pikku codebase, starting a new Pikku project, or migrating a backend to Pikku. Covers the core mental model, function types, project structure, code generation, testing, and how Pikku maps to traditional backend patterns.
-TRIGGER when: user asks "what is Pikku?", starts a new Pikku project, migrates from Express/NestJS/Hono, or needs to understand how Pikku works.
-DO NOT TRIGGER when: user is doing a specific wiring task (use the specific skill instead, e.g. pikku-http, pikku-websocket).'
+description: >-
+  Foundational guide to Pikku framework concepts. Use this skill when working with any Pikku
+  codebase, starting a new Pikku project, or migrating a backend to Pikku. Covers the core mental
+  model, function types, project structure, code generation, testing, and how Pikku maps to
+  traditional backend patterns. TRIGGER when: user asks "what is Pikku?", starts a new Pikku
+  project, migrates from Express/NestJS/Hono, or needs to understand how Pikku works. DO NOT
+  TRIGGER when: user is doing a specific wiring task (use the specific skill instead, e.g.
+  pikku-http, pikku-websocket).
 installGroups: [core]
 ---
 
@@ -149,7 +154,7 @@ await server.start()
 
 ## Code Generation
 
-Run `npx pikku prebuild` to generate:
+Run `npx pikku all` to generate:
 
 - `pikku-types.gen.ts` — Typed function factories and wiring functions
 - `pikku-fetch.gen.ts` — Type-safe HTTP client

package/skills/pikku-concepts/references/concept-mapping.md

@@ -18,7 +18,7 @@ Authoritative mapping table plus side-by-side code examples showing how common b
 | **Cron / Scheduled tasks**              | `wireScheduler`                                                 | `pikku-cron`      |
 | **Module / Feature grouping**           | Tags + wiring files                                             | `pikku-concepts`  |
 | **Error handling**                      | Throw typed errors (`NotFoundError`, `ForbiddenError`)          | `pikku-concepts`  |
-| **Type-safe API client**                | `npx pikku prebuild` generates clients                          | `pikku-concepts`  |
+| **Type-safe API client**                | `npx pikku all` generates clients                          | `pikku-concepts`  |
 | **Secrets / Config**                    | `wireSecret`, `wireVariable`, `services.variables`              | `pikku-config`    |
 
 ## Route Handler / Controller → pikkuFunc
@@ -197,20 +197,22 @@ const isAdmin = pikkuPermission(async (services, data, wire) => {
   return session?.role === 'admin'
 })
 
-// Apply to route pattern
-addHTTPPermission('/admin/*', { admin: [isAdmin] })
-
-// Or inline on specific wiring
-wireHTTP({
-  route: '/users/:id',
-  method: 'delete',
-  func: deleteUser,
+// Declare on the function definition (the only place permissions live)
+export const deleteUser = pikkuFunc({
+  func: async (services, data) => {
+    /* ... */
+  },
   permissions: { admin: [isAdmin] },
 })
+
+// App-wide baseline every function must also pass (AND gate, narrow-only)
+addGlobalPermission([signedInUser])
 ```
 
 **Permission groups:** `{ groupA: [perm1, perm2], groupB: [perm3] }` means `(perm1 AND perm2) OR perm3`.
 
+> Route-pattern (`addHTTPPermission`) and wire-level `permissions` were removed in #972 — permissions live on the function, plus the optional global gate.
+
 ---
 
 ## DTO / Request Validation → Standard Schema
@@ -549,4 +551,4 @@ const result = await client.post('/todos', { title: 'New todo' })
 // result is fully typed as TodoOutput - no manual type casting
 ```
 
-Generated by running `npx pikku prebuild`. Both HTTP and WebSocket clients available.
+Generated by running `npx pikku all`. Both HTTP and WebSocket clients available.

package/skills/pikku-config/SKILL.md

@@ -1,8 +1,12 @@
 ---
 name: pikku-config
-description: 'Use when managing secrets, environment variables, config, or OAuth2 credentials in a Pikku app. Covers wireSecret, wireVariable, wireOAuth2Credential, and typed config access.
-TRIGGER when: code uses wireSecret/wireVariable/wireOAuth2Credential, user asks about env vars, secrets, config, OAuth2, or "how do I access environment variables".
-DO NOT TRIGGER when: user asks about API versioning/breaking changes (use pikku-versioning), service factories (use pikku-services), or auth middleware (use pikku-security).'
+description: >-
+  Use when managing secrets, environment variables, config, or OAuth2 credentials in a Pikku app.
+  Covers wireSecret, wireVariable, wireOAuth2Credential, and typed config access. TRIGGER when:
+  code uses wireSecret/wireVariable/wireOAuth2Credential, user asks about env vars, secrets,
+  config, OAuth2, or "how do I access environment variables". DO NOT TRIGGER when: user asks about
+  API versioning/breaking changes (use pikku-versioning), service factories (use pikku-services),
+  or auth middleware (use pikku-security).
 installGroups: [core]
 ---
 
@@ -57,7 +61,7 @@ wireVariable({
 
 ```typescript
 // Secrets — encrypted, sensitive values
-const config = await services.secrets.getSecretJSON('SECRET_NAME')
+const config = await services.secrets.getSecret('SECRET_NAME')
 
 // Variables — plain-text configuration
 const flags = await services.variables.getVariableJSON('VARIABLE_NAME')
@@ -90,7 +94,7 @@ wireSecret({
 })
 
 // In your function — fully typed
-const config = await secrets.getSecretJSON('STRIPE_CONFIG')
+const config = await secrets.getSecret('STRIPE_CONFIG')
 // config.apiKey       → string (autocompleted)
 // config.webhookSecret → string (autocompleted)
 

package/skills/pikku-cron/SKILL.md

@@ -1,8 +1,11 @@
 ---
 name: pikku-cron
-description: 'Use when adding scheduled tasks, recurring jobs, or cron-based automation to a Pikku app. Covers wireScheduler, cron expressions, scheduled task wire object, and scheduler middleware.
-TRIGGER when: code uses wireScheduler, user asks about cron, scheduled tasks, recurring jobs, or "run every X minutes/hours".
-DO NOT TRIGGER when: user asks about background jobs with retries (use pikku-queue) or event-driven triggers (use pikku-trigger).'
+description: >-
+  Use when adding scheduled tasks, recurring jobs, or cron-based automation to a Pikku app. Covers
+  wireScheduler, cron expressions, scheduled task wire object, and scheduler middleware. TRIGGER
+  when: code uses wireScheduler, user asks about cron, scheduled tasks, recurring jobs, or "run
+  every X minutes/hours". DO NOT TRIGGER when: user asks about background jobs with retries (use
+  pikku-queue) or event-driven triggers (use pikku-trigger).
 ---
 
 # Pikku Cron/Scheduler Wiring

package/skills/pikku-deploy-azure/SKILL.md

@@ -1,8 +1,10 @@
 ---
 name: pikku-deploy-azure
-description: 'Use when deploying a Pikku app to Azure Functions. Covers PikkuAzFunctionsLogger and PikkuAzTimerRequest for Azure Functions runtime.
-TRIGGER when: user asks about Azure Functions, Azure deployment, or @pikku/azure-functions.
-DO NOT TRIGGER when: user asks about AWS Lambda (use pikku-deploy-lambda) or Cloudflare Workers (use pikku-deploy-cloudflare).'
+description: >-
+  Use when deploying a Pikku app to Azure Functions. Covers PikkuAzFunctionsLogger and
+  PikkuAzTimerRequest for Azure Functions runtime. TRIGGER when: user asks about Azure Functions,
+  Azure deployment, or @pikku/azure-functions. DO NOT TRIGGER when: user asks about AWS Lambda
+  (use pikku-deploy-lambda) or Cloudflare Workers (use pikku-deploy-cloudflare).
 ---
 
 # Pikku Azure Functions Deployment

package/skills/pikku-deploy-cloudflare/SKILL.md

@@ -1,8 +1,10 @@
 ---
 name: pikku-deploy-cloudflare
-description: 'Use when deploying a Pikku app to Cloudflare Workers. Covers HTTP fetch handler, scheduled tasks, and WebSocket via Durable Objects.
-TRIGGER when: code imports @pikku/cloudflare, user mentions Cloudflare Workers deployment, or worker entry uses ExportedHandler/wrangler.toml.
-DO NOT TRIGGER when: just defining functions/wirings without Cloudflare-specific code.'
+description: >-
+  Use when deploying a Pikku app to Cloudflare Workers. Covers HTTP fetch handler, scheduled
+  tasks, and WebSocket via Durable Objects. TRIGGER when: code imports @pikku/cloudflare, user
+  mentions Cloudflare Workers deployment, or worker entry uses ExportedHandler/wrangler.toml. DO
+  NOT TRIGGER when: just defining functions/wirings without Cloudflare-specific code.
 installGroups: [fabric]
 ---
 

package/skills/pikku-deploy-express/SKILL.md

@@ -1,8 +1,11 @@
 ---
 name: pikku-deploy-express
-description: 'Use when deploying a Pikku app with Express. Covers PikkuExpressServer standalone and pikkuExpressMiddleware for existing Express apps.
-TRIGGER when: code imports @pikku/express or @pikku/express-middleware, user mentions Express deployment, or start.ts creates a PikkuExpressServer.
-DO NOT TRIGGER when: just defining functions/wirings without Express-specific code.'
+description: >-
+  Use when deploying a Pikku app with Express. Covers PikkuExpressServer standalone and
+  pikkuExpressMiddleware for existing Express apps. TRIGGER when: code imports @pikku/express or
+  @pikku/express-middleware, user mentions Express deployment, or start.ts creates a
+  PikkuExpressServer. DO NOT TRIGGER when: just defining functions/wirings without
+  Express-specific code.
 ---
 
 # Pikku Express Deployment

package/skills/pikku-deploy-fastify/SKILL.md

@@ -1,8 +1,11 @@
 ---
 name: pikku-deploy-fastify
-description: 'Use when deploying a Pikku app with Fastify. Covers PikkuFastifyServer standalone and pikkuFastifyPlugin for existing Fastify apps.
-TRIGGER when: code imports @pikku/fastify or @pikku/fastify-plugin, user mentions Fastify deployment, or start.ts creates a PikkuFastifyServer.
-DO NOT TRIGGER when: just defining functions/wirings without Fastify-specific code.'
+description: >-
+  Use when deploying a Pikku app with Fastify. Covers PikkuFastifyServer standalone and
+  pikkuFastifyPlugin for existing Fastify apps. TRIGGER when: code imports @pikku/fastify or
+  @pikku/fastify-plugin, user mentions Fastify deployment, or start.ts creates a
+  PikkuFastifyServer. DO NOT TRIGGER when: just defining functions/wirings without
+  Fastify-specific code.
 ---
 
 # Pikku Fastify Deployment

package/skills/pikku-deploy-lambda/SKILL.md

@@ -1,8 +1,11 @@
 ---
 name: pikku-deploy-lambda
-description: 'Use when deploying a Pikku app to AWS Lambda. Covers HTTP handlers, scheduled tasks, SQS queue workers, WebSocket via API Gateway, and cold start caching.
-TRIGGER when: code imports @pikku/lambda, user mentions Lambda/serverless/AWS deployment, or handler files export Lambda-typed functions.
-DO NOT TRIGGER when: just defining functions/wirings without Lambda-specific code.'
+description: >-
+  Use when deploying a Pikku app to AWS Lambda. Covers HTTP handlers, scheduled tasks, SQS queue
+  workers, WebSocket via API Gateway, and cold start caching. TRIGGER when: code imports
+  @pikku/lambda, user mentions Lambda/serverless/AWS deployment, or handler files export
+  Lambda-typed functions. DO NOT TRIGGER when: just defining functions/wirings without
+  Lambda-specific code.
 ---
 
 # Pikku AWS Lambda Deployment

package/skills/pikku-deploy-nextjs/SKILL.md

@@ -1,8 +1,10 @@
 ---
 name: pikku-deploy-nextjs
-description: 'Use when deploying a Pikku app with Next.js. Covers API route handlers, server-side data fetching, and RPC calls from Server Components.
-TRIGGER when: code imports @pikku/next, user mentions Next.js integration, or app/api route files use pikkuAPIRequest.
-DO NOT TRIGGER when: just defining functions/wirings without Next.js-specific code.'
+description: >-
+  Use when deploying a Pikku app with Next.js. Covers API route handlers, server-side data
+  fetching, and RPC calls from Server Components. TRIGGER when: code imports @pikku/next, user
+  mentions Next.js integration, or app/api route files use pikkuAPIRequest. DO NOT TRIGGER when:
+  just defining functions/wirings without Next.js-specific code.
 ---
 
 # Pikku Next.js Deployment

package/skills/pikku-deploy-uws/SKILL.md

@@ -1,8 +1,11 @@
 ---
 name: pikku-deploy-uws
-description: 'Use when deploying a Pikku app with uWebSockets.js. Covers PikkuUWSServer with built-in HTTP and WebSocket support, and pikkuWebsocketHandler for standalone ws library.
-TRIGGER when: code imports @pikku/uws or @pikku/ws, user mentions uWebSockets or high-performance server, or start.ts creates a PikkuUWSServer.
-DO NOT TRIGGER when: just defining functions/wirings without uWS-specific code.'
+description: >-
+  Use when deploying a Pikku app with uWebSockets.js. Covers PikkuUWSServer with built-in HTTP and
+  WebSocket support, and pikkuWebsocketHandler for standalone ws library. TRIGGER when: code
+  imports @pikku/uws or @pikku/ws, user mentions uWebSockets or high-performance server, or
+  start.ts creates a PikkuUWSServer. DO NOT TRIGGER when: just defining functions/wirings without
+  uWS-specific code.
 ---
 
 # Pikku uWebSockets.js Deployment
@@ -17,7 +20,7 @@ Use this skill as an execution checklist, not reference material.
 4. Validate with the narrowest relevant command first, then run `pikku-verify` or `pikku all` when functions, wirings, schemas, or generated clients may have changed.
 5. If validation fails, fix the source cause and rerun validation. Do not paper over generated errors by editing generated files.
 
-Highest performance option. Handles both HTTP and WebSocket automatically.
+Highest-throughput option among Pikku's runtimes. Handles both HTTP and WebSocket automatically.
 
 ```bash
 yarn add @pikku/uws

package/skills/pikku-deps/SKILL.md

@@ -1,8 +1,14 @@
 ---
 name: pikku-deps
-description: 'Use for the Pikku dependency security audit: the `pikku audit` CLI command, the `.pikku/audit.json` artifact, the `SecurityAuditReport` type in @pikku/core, and the console Security screen (getSecurityAudit / runSecurityAudit / updateDependency + SecurityAuditView).
-TRIGGER when: user asks about `pikku audit`, dependency vulnerabilities/advisories, outdated dependencies, the Security screen/page in the console, updating a vulnerable dependency, or reading/rendering audit.json.
-DO NOT TRIGGER when: user asks about authentication/sessions/JWT (use pikku-security), permissions (use pikku-permissions), or secrets/env vars (use pikku-config).'
+description: >-
+  Use for the Pikku dependency security audit: the `pikku audit` CLI command, the
+  `.pikku/audit.json` artifact, the `SecurityAuditReport` type in @pikku/core, and the console
+  Security screen (getSecurityAudit / runSecurityAudit / updateDependency + SecurityAuditView).
+  TRIGGER when: user asks about `pikku audit`, dependency vulnerabilities/advisories, outdated
+  dependencies, the Security screen/page in the console, updating a vulnerable dependency, or
+  reading/rendering audit.json. DO NOT TRIGGER when: user asks about authentication/sessions/JWT
+  (use pikku-security), permissions (use pikku-permissions), or secrets/env vars (use
+  pikku-config).
 installGroups: [core]
 ---
 
@@ -21,9 +27,10 @@ installGroups: [core]
    `SecuritySeverity` / `SecurityUpdateLevel`) are exported from **@pikku/core**.
    The CLI writes it, the addon reads it, the UI renders it — never redeclare
    the type at a call site.
-3. Validate with `pikku tsc` after changes; the command never fails a build
-   (advisories are informational; a missing/failed audit yields an
-   empty-but-valid report).
+3. Validate with `pikku all --tsc` after changes — it type-checks and **fails on
+   type errors**, like any real build gate. Separately, `pikku audit` never fails
+   a build: advisories are informational, and a missing/failed audit yields an
+   empty-but-valid report.
 
 ## The `pikku audit` command
 

package/skills/pikku-emails/SKILL.md

@@ -1,10 +1,15 @@
 ---
 name: pikku-emails
-description: "Use when working with Pikku's file-based email templates: authoring HTML/subject/text templates, locales, partials and theme, running `pikku emails generate`, and rendering/sending them through an EmailService.
-TRIGGER when: code uses renderEmailTemplate, EmailTemplateName, EmailService, SendTemplateEmailInput, LocalEmailService, or imports from .pikku/email/pikku-emails.gen.
-TRIGGER when: the project has an emails/ directory (templates/, locales/, partials/, theme.json) or emailTemplatesDir in pikku.config.json.
-TRIGGER when: user asks to add/edit a transactional email (verification, password reset, invitation, receipt), wire email sending, or translate an email.
-DO NOT TRIGGER when: user asks about i18n for the app UI (use pikku-i18n) or auth flows in general (use pikku-better-auth)."
+description: >-
+  Use when working with Pikku's file-based email templates: authoring HTML/subject/text templates,
+  locales, partials and theme, running `pikku emails generate`, and rendering/sending them through
+  an EmailService. TRIGGER when: code uses renderEmailTemplate, EmailTemplateName, EmailService,
+  SendTemplateEmailInput, LocalEmailService, or imports from .pikku/email/pikku-emails.gen.
+  TRIGGER when: the project has an emails/ directory (templates/, locales/, partials/, theme.json)
+  or emailTemplatesDir in pikku.config.json. TRIGGER when: user asks to add/edit a transactional
+  email (verification, password reset, invitation, receipt), wire email sending, or translate an
+  email. DO NOT TRIGGER when: user asks about i18n for the app UI (use pikku-i18n) or auth flows
+  in general (use pikku-better-auth).
 ---
 
 # Pikku Emails

package/skills/pikku-feature/SKILL.md

@@ -128,7 +128,7 @@ in-app features don't.
 - **Secrets and env-vars: NEVER `process.env`.** Declare them with
   `wireSecret` (sensitive) or `wireVariable` (non-sensitive) — both with a
   zod schema for type-safe access. Read with
-  `services.secrets.getSecretJSON('NAME')` or `services.variables.get('NAME')`.
+  `services.secrets.getSecret('NAME')` or `services.variables.get('NAME')`.
   See the **pikku-config** skill for the full pattern (including
   OAuth2 credentials). This applies even in `config.ts` and singleton
   service factories.

package/skills/pikku-gateway-slack/SKILL.md

@@ -1,8 +1,11 @@
 ---
 name: pikku-gateway-slack
-description: 'Use when integrating Slack with a Pikku app. Covers SlackGatewayAdapter, slash commands, OAuth flow, message handling, and signature verification.
-TRIGGER when: code uses SlackGatewayAdapter, parseSlashCommand, buildSlackInstallUrl, or user asks about Slack integration, Slack bots, or @pikku/gateway-slack.
-DO NOT TRIGGER when: user asks about general gateway/webhook patterns (use pikku-trigger).'
+description: >-
+  Use when integrating Slack with a Pikku app. Covers SlackGatewayAdapter, slash commands, OAuth
+  flow, message handling, and signature verification. TRIGGER when: code uses SlackGatewayAdapter,
+  parseSlashCommand, buildSlackInstallUrl, or user asks about Slack integration, Slack bots, or
+  @pikku/gateway-slack. DO NOT TRIGGER when: user asks about general gateway/webhook patterns (use
+  pikku-trigger).
 ---
 
 # Pikku Gateway Slack

package/skills/pikku-http/SKILL.md

@@ -1,8 +1,12 @@
 ---
 name: pikku-http
-description: 'Use when adding HTTP routes, REST APIs, web endpoints, or SSE streams to a Pikku app. Covers wireHTTP, defineHTTPRoutes, route groups, auth, middleware, permissions, SSE, and generated fetch client.
-TRIGGER when: code uses wireHTTP/defineHTTPRoutes/wireHTTPRoutes, user asks about REST endpoints, API routes, SSE, or the generated fetch client.
-DO NOT TRIGGER when: user asks about WebSocket (use pikku-websocket), queue workers (use pikku-queue), or deployment (use pikku-deploy-*).'
+description: >-
+  Use when adding HTTP routes, REST APIs, web endpoints, or SSE streams to a Pikku app. Covers
+  wireHTTP, defineHTTPRoutes, route groups, auth, middleware, SSE, and generated
+  fetch client. TRIGGER when: code uses wireHTTP/defineHTTPRoutes/wireHTTPRoutes, user asks about
+  REST endpoints, API routes, SSE, or the generated fetch client. DO NOT TRIGGER when: user asks
+  about WebSocket (use pikku-websocket), queue workers (use pikku-queue), or deployment (use
+  pikku-deploy-*).
 installGroups: [core]
 ---
 
@@ -18,7 +22,7 @@ Use this skill as an execution checklist, not reference material.
 4. Validate with the narrowest relevant command first, then run `pikku-verify` or `pikku all` when functions, wirings, schemas, or generated clients may have changed.
 5. If validation fails, fix the source cause and rerun validation. Do not paper over generated errors by editing generated files.
 
-Wire Pikku functions to HTTP endpoints. Supports single routes, composable route groups, auth, middleware, permissions, SSE, and auto-generated type-safe clients.
+Wire Pikku functions to HTTP endpoints. Supports single routes, composable route groups, auth, middleware, SSE, and auto-generated type-safe clients. (Authorization lives on the function, not the wiring — see `pikku-permissions`.)
 
 ## Before You Start
 
@@ -50,11 +54,7 @@ addHTTPMiddleware('*', [authBearer()]) // All routes
 addHTTPMiddleware('/api/*', [rateLimit()]) // Pattern match
 ```
 
-### `addHTTPPermission(pattern, permissions)`
-
-```typescript
-addHTTPPermission('/admin/*', { admin: [isAdmin] })
-```
+> HTTP-route-level permissions (`addHTTPPermission`, a `permissions` field on the wiring) were removed in #972. Declare authorization on the function definition (`pikkuFunc({ permissions })`, see `pikku-permissions`), or app-wide via `addGlobalPermission`. Tags/patterns are for *middleware* only now.
 
 ## Data Flow
 
@@ -107,24 +107,18 @@ wireHTTPRoutes({
 // Results in: GET /api/v1/books, POST /api/v1/books, GET /api/v1/todos, etc.
 ```
 
-### Auth & Permissions
+### Auth
 
 ```typescript
 // Public route (no auth)
 wireHTTP({ method: 'get', route: '/books', func: listBooks, auth: false })
 
-// Route with permission check
-wireHTTP({
-  method: 'delete',
-  route: '/books/:bookId',
-  func: deleteBook,
-  permissions: { admin: isAdmin },
-})
-
-// Pattern-based permissions
-addHTTPPermission('/admin/*', { admin: isAdmin })
+// Authenticated route (default when a global auth middleware is set)
+wireHTTP({ method: 'delete', route: '/books/:bookId', func: deleteBook })
 ```
 
+Authorization is not a wiring concern — declare it on the function via `permissions` (see `pikku-permissions`), or app-wide via `addGlobalPermission`.
+
 ### Middleware
 
 ```typescript
@@ -178,7 +172,7 @@ const getTodos = pikkuFunc({
 
 ### Generated Fetch Client
 
-After `npx pikku prebuild`, a type-safe client is generated:
+After `npx pikku all`, a type-safe client is generated:
 
 ```typescript
 import { pikkuFetch } from '.pikku/pikku-fetch.gen.js'

package/skills/pikku-http/references/http-options.md

@@ -11,7 +11,6 @@ Wire a single function to an HTTP endpoint. Import from `@pikku/core/http`.
 | `func` | `PikkuFunc` | The function to call |
 | `auth?` | `boolean` | Override default auth (`true` = require session) |
 | `tags?` | `string[]` | For grouping, middleware targeting |
-| `permissions?` | `Record<string, PikkuPermission \| PikkuPermission[]>` | Permission checks |
 | `middleware?` | `PikkuMiddleware[]` | Per-route middleware |
 | `sse?` | `boolean` | Enable Server-Sent Events |
 | `contentType?` | `'xml' \| 'json'` | Response content type |
@@ -35,7 +34,6 @@ const routes = defineHTTPRoutes({
       route: string,
       func: PikkuFunc,
       auth?: boolean,      // Override group auth
-      permissions?: Record<string, PikkuPermission | PikkuPermission[]>,
       middleware?: PikkuMiddleware[],
     }
   }

package/skills/pikku-info/SKILL.md

@@ -1,8 +1,13 @@
 ---
 name: pikku-info
-description: 'Discover what exists in a Pikku project — functions, tags, middleware, permissions, HTTP routes, channels, schedulers, queues, and more. Use when you need to understand the project structure, find existing functions, or check what middleware and permissions are defined.
-TRIGGER when: user asks "what functions exist?", "show me the project structure", "list routes/middleware/permissions", or needs to understand an existing Pikku codebase.
-DO NOT TRIGGER when: user is writing new code (use the specific wiring skill) or asking about Pikku concepts (use pikku-concepts).'
+description: >-
+  Discover what exists in a Pikku project — functions, tags, middleware, permissions, HTTP routes,
+  channels, schedulers, queues, and more. Use when you need to understand the project structure,
+  find existing functions, or check what middleware and permissions are defined. TRIGGER when:
+  user asks "what functions exist?", "show me the project structure", "list
+  routes/middleware/permissions", or needs to understand an existing Pikku codebase. DO NOT
+  TRIGGER when: user is writing new code (use the specific wiring skill) or asking about Pikku
+  concepts (use pikku-concepts).
 installGroups: [core]
 allowed-tools: Bash(yarn pikku info *)
 argument-hint: '[functions|tags|middleware|permissions] [--verbose] [--limit N]'
@@ -42,7 +47,7 @@ yarn pikku info functions --verbose --silent
 
 ### Tags
 
-List all tags with counts of associated functions, middleware, and permissions:
+List all tags with counts of associated functions and middleware:
 
 ```bash
 yarn pikku info tags --silent

package/skills/pikku-jose/SKILL.md

@@ -1,8 +1,11 @@
 ---
 name: pikku-jose
-description: 'Use when setting up JWT authentication with the jose library in a Pikku app. Covers JoseJWTService constructor, secret rotation, token encoding/decoding/verification.
-TRIGGER when: code uses JoseJWTService, user asks about JWT setup, token signing, token verification, or @pikku/jose.
-DO NOT TRIGGER when: user asks about session middleware (use pikku-security) or general service setup (use pikku-services).'
+description: >-
+  Use when setting up JWT authentication with the jose library in a Pikku app. Covers
+  JoseJWTService constructor, secret rotation, token encoding/decoding/verification. TRIGGER when:
+  code uses JoseJWTService, user asks about JWT setup, token signing, token verification, or
+  @pikku/jose. DO NOT TRIGGER when: user asks about session middleware (use pikku-security) or
+  general service setup (use pikku-services).
 ---
 
 # Pikku Jose (JWT Service)