@pikku/cli 0.12.82 → 0.12.85

package/dist/.pikku/workflow/meta/allWorkflow.gen.json

@@ -6,7 +6,19 @@
         "Bootstrap inspect": {
             "nodeId": "Bootstrap inspect",
             "flow": "inline",
-            "next": "Bootstrap function types split"
+            "next": "Bootstrap scope definition types"
+        },
+        "Bootstrap scope definition types": {
+            "nodeId": "Bootstrap scope definition types",
+            "rpcName": "pikkuScopeDefinitionTypes",
+            "next": "Bootstrap scopes",
+            "stepHash": "94d48581c462"
+        },
+        "Bootstrap scopes": {
+            "nodeId": "Bootstrap scopes",
+            "rpcName": "pikkuScopes",
+            "next": "Bootstrap function types split",
+            "stepHash": "41fa180b51ca"
         },
         "Bootstrap function types split": {
             "nodeId": "Bootstrap function types split",
@@ -213,9 +225,15 @@
         "Public agent scaffold": {
             "nodeId": "Public agent scaffold",
             "rpcName": "pikkuPublicAgent",
-            "next": "Public RPC",
+            "next": "Graph wirings",
             "stepHash": "64d807033007"
         },
+        "Graph wirings": {
+            "nodeId": "Graph wirings",
+            "rpcName": "pikkuGraphWirings",
+            "next": "Public RPC",
+            "stepHash": "441f296ab859"
+        },
         "Public RPC": {
             "nodeId": "Public RPC",
             "rpcName": "pikkuPublicRPC",
@@ -267,9 +285,21 @@
         "Credentials": {
             "nodeId": "Credentials",
             "rpcName": "pikkuCredentials",
-            "next": "Variable definition types",
+            "next": "Scope definition types",
             "stepHash": "3e4cb364d6f2"
         },
+        "Scope definition types": {
+            "nodeId": "Scope definition types",
+            "rpcName": "pikkuScopeDefinitionTypes",
+            "next": "Scopes",
+            "stepHash": "578ebaf38e55"
+        },
+        "Scopes": {
+            "nodeId": "Scopes",
+            "rpcName": "pikkuScopes",
+            "next": "Variable definition types",
+            "stepHash": "1ca929a3b6de"
+        },
         "Variable definition types": {
             "nodeId": "Variable definition types",
             "rpcName": "pikkuVariableDefinitionTypes",
@@ -326,9 +356,15 @@
         "RPC exposed map": {
             "nodeId": "RPC exposed map",
             "rpcName": "pikkuRPCExposedMap",
-            "next": "Workflow",
+            "next": "RPC remote map",
             "stepHash": "20b6c409e9fb"
         },
+        "RPC remote map": {
+            "nodeId": "RPC remote map",
+            "rpcName": "pikkuRPCRemoteMap",
+            "next": "Workflow",
+            "stepHash": "218a42566e2c"
+        },
         "Workflow": {
             "nodeId": "Workflow",
             "rpcName": "pikkuWorkflow",
@@ -338,9 +374,15 @@
         "Remote RPC": {
             "nodeId": "Remote RPC",
             "rpcName": "pikkuRemoteRPC",
-            "next": "Workflow routes",
+            "next": "Webhook",
             "stepHash": "82751ee2ed4b"
         },
+        "Webhook": {
+            "nodeId": "Webhook",
+            "rpcName": "pikkuWebhook",
+            "next": "Workflow routes",
+            "stepHash": "a7d0991ef74f"
+        },
         "Workflow routes": {
             "nodeId": "Workflow routes",
             "rpcName": "pikkuWorkflowRoutes",
@@ -546,7 +588,7 @@
             "nodeId": "Bootstrap",
             "rpcName": "pikkuBootstrap",
             "next": "Summary",
-            "stepHash": "3d656d5f2b03"
+            "stepHash": "a41cc2fd83b5"
         },
         "Summary": {
             "nodeId": "Summary",
@@ -562,5 +604,5 @@
     "entryNodeIds": [
         "Bootstrap inspect"
     ],
-    "graphHash": "e21b048b1456"
+    "graphHash": "c0662311ac02"
 }

package/dist/.pikku/workflow/pikku-workflow-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.82
+ * This file was generated by @pikku/cli@0.12.85
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import { template } from '@pikku/core/workflow';
@@ -19,6 +19,7 @@ export interface TypedWorkflow extends PikkuWorkflowWire {
 export type TypedScenario = TypedWorkflow & Omit<PikkuScenarioWire, keyof PikkuWorkflowWire>;
 import type { StandardSchemaV1 } from '@standard-schema/spec';
 import type { InferSchemaOutput, PikkuPermission, PikkuMiddleware, NodeConfig, PikkuApprovalDescription } from '../function/pikku-function-types.gen.js';
+import type { ScopeId } from '../scopes/pikku-scopes.gen.js';
 import { PikkuError } from '@pikku/core/errors';
 import type { CorePermissionGroup } from '@pikku/core';
 export type PikkuFunctionWorkflow<In = unknown, Out = never> = PikkuFunctionSessionless<In, Out, 'workflow'>;
@@ -38,6 +39,11 @@ export type PikkuWorkflowConfigWithSchema<InputSchema extends StandardSchemaV1 |
     approvalDescription?: InputSchema extends StandardSchemaV1 ? PikkuApprovalDescription<InferSchemaOutput<InputSchema>> : never;
     func: PikkuFunctionWorkflow<InputSchema extends StandardSchemaV1 ? InferSchemaOutput<InputSchema> : unknown, OutputSchema extends StandardSchemaV1 ? InferSchemaOutput<OutputSchema> : unknown>;
     auth?: boolean;
+    /**
+     * Scopes the session must hold to run this workflow. All of them are required
+     * (AND), and they are checked before `permissions`.
+     */
+    scopes?: ScopeId[];
     permissions?: InputSchema extends StandardSchemaV1 ? CorePermissionGroup<PikkuPermission<InferSchemaOutput<InputSchema>>> : undefined;
     middleware?: PikkuMiddleware[];
     input?: InputSchema;
@@ -50,7 +56,7 @@ export declare function pikkuWorkflowFunc<InputSchema extends StandardSchemaV1 |
 export declare function pikkuWorkflowFunc<In, Out = unknown>(func: PikkuFunctionWorkflow<In, Out> | PikkuFunctionConfig<In, Out, 'workflow', PikkuFunctionWorkflow<In, Out>>): PikkuFunctionConfig<In, Out, 'workflow'>;
 export declare function pikkuWorkflowComplexFunc<InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined>(config: PikkuWorkflowConfigWithSchema<InputSchema, OutputSchema>): PikkuFunctionConfig<InputSchema extends StandardSchemaV1 ? InferSchemaOutput<InputSchema> : unknown, OutputSchema extends StandardSchemaV1 ? InferSchemaOutput<OutputSchema> : unknown, 'workflow', PikkuFunctionWorkflow<InputSchema extends StandardSchemaV1 ? InferSchemaOutput<InputSchema> : unknown, OutputSchema extends StandardSchemaV1 ? InferSchemaOutput<OutputSchema> : unknown>, InputSchema, OutputSchema>;
 export declare function pikkuWorkflowComplexFunc<In, Out = unknown>(func: PikkuFunctionWorkflow<In, Out> | PikkuFunctionConfig<In, Out, 'workflow', PikkuFunctionWorkflow<In, Out>>): PikkuFunctionConfig<In, Out, 'workflow'>;
-export type PikkuScenarioConfigWithSchema<InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined> = Omit<PikkuWorkflowConfigWithSchema<InputSchema, OutputSchema>, 'func'> & {
+export type PikkuScenarioConfigWithSchema<InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined> = Omit<PikkuWorkflowConfigWithSchema<InputSchema, OutputSchema>, 'func' | 'auth' | 'scopes' | 'permissions'> & {
     func: PikkuFunctionScenario<InputSchema extends StandardSchemaV1 ? InferSchemaOutput<InputSchema> : unknown, OutputSchema extends StandardSchemaV1 ? InferSchemaOutput<OutputSchema> : unknown>;
 };
 /**
@@ -85,6 +91,7 @@ type NodeInputType<FuncMap extends Record<string, string>, K extends keyof FuncM
 type NodeOutputKeys<FuncMap extends Record<string, string>, N extends string> = N extends keyof FuncMap ? FuncMap[N] extends keyof FlattenedRPCMap ? keyof FlattenedRPCMap[FuncMap[N]]['output'] & string : FuncMap[N] extends keyof FlattenedWorkflowMap ? keyof FlattenedWorkflowMap[FuncMap[N]]['output'] & string : FuncMap[N] extends keyof FlattenedAgentMap ? keyof FlattenedAgentMap[FuncMap[N]]['output'] & string : string : string;
 type RefFunction<FuncMap extends Record<string, string>> = {
     <N extends Extract<keyof FuncMap, string>>(nodeId: N, path: NodeOutputKeys<FuncMap, N>): TypedRef<unknown>;
+    <N extends Extract<keyof FuncMap, string>>(nodeId: N): TypedRef<unknown>;
     (nodeId: 'trigger' | '$item', path?: string): TypedRef<unknown>;
 };
 type TemplateFunction = (templateStr: string, refs: TypedRef<unknown>[]) => TemplateString;
@@ -93,6 +100,8 @@ type GraphNodeConfigMap<FuncMap extends Record<string, string>> = {
         next?: NextConfig<Extract<keyof FuncMap, string>>;
         input?: NodeInputType<FuncMap, K> | (() => NodeInputType<FuncMap, K>) | ((ref: RefFunction<FuncMap>, template: TemplateFunction) => NodeInputType<FuncMap, K>);
         onError?: Extract<keyof FuncMap, string> | Extract<keyof FuncMap, string>[];
+        /** Free-text node documentation. Non-semantic — excluded from graphHash. */
+        notes?: string;
     };
 };
 type NextConfig<NodeIds extends string> = NodeIds | NodeIds[] | {

package/dist/.pikku/workflow/pikku-workflow-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.82
+ * This file was generated by @pikku/cli@0.12.85
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import { template } from '@pikku/core/workflow';

package/dist/.pikku/workflow/pikku-workflow-wirings-meta.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.82
+ * This file was generated by @pikku/cli@0.12.85
  */
 import { pikkuState } from '@pikku/core/internal';
 import allWorkflowMeta from './meta/allWorkflow.gen.json' with { type: 'json' };

package/dist/.pikku/workflow/pikku-workflow-wirings.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.82
+ * This file was generated by @pikku/cli@0.12.85
  */
 import { addWorkflow } from '@pikku/core/workflow';
 import './pikku-workflow-wirings-meta.gen.js';

package/dist/bin/pikku-bin.mjs

@@ -11,8 +11,8 @@ async function checkForUpdate() {
     })
     if (!res.ok) return
     const { version: latest } = await res.json()
-    if (latest !== '0.12.82') {
-      process.stderr.write(`\n  Update available  0.12.82 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
+    if (latest !== '0.12.85') {
+      process.stderr.write(`\n  Update available  0.12.85 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
     }
   } catch {}
 }

package/dist/src/cli.wiring.js

@@ -21,6 +21,8 @@ import { dbGenerate } from './functions/commands/db-generate.js';
 import { dbSeed } from './functions/commands/db-seed.js';
 import { dbReset } from './functions/commands/db-reset.js';
 import { dbAudit } from './functions/commands/db-audit.js';
+import { scopesAudit } from './functions/commands/scopes-audit.js';
+import { scopesPrune } from './functions/commands/scopes-prune.js';
 import { pikkuAudit } from './functions/commands/audit.js';
 import { workspaceValidate, renderWorkspaceValidate, } from './functions/commands/workspace-validate.js';
 import { scenarioRun, scenarioList } from './functions/commands/scenario.js';
@@ -33,8 +35,9 @@ import { pikkuNewWiring } from './functions/commands/new-wiring.js';
 import { pikkuNewMiddleware } from './functions/commands/new-middleware.js';
 import { pikkuNewPermission } from './functions/commands/new-permission.js';
 import { pikkuNewAddon } from './functions/commands/new-addon.js';
+import { pikkuImportN8n } from './functions/commands/import-n8n.js';
 import { pikkuInfoFunctions, pikkuInfoTags, pikkuInfoMiddleware, pikkuInfoPermissions, } from './functions/commands/info.js';
-import { enableRpc, enableConsole, enableScenarios, enableAgent, enableWorkflow, enableEvents, enableRemoteRpc, } from './functions/commands/enable.js';
+import { enableRpc, enableConsole, enableScenarios, enableAgent, enableWorkflow, enableEvents, enableRemoteRpc, enableWebhook, } from './functions/commands/enable.js';
 import { pikkuRealtime } from './functions/wirings/realtime/pikku-command-realtime.js';
 import { binary } from './functions/commands/binary.js';
 import { deployPlan } from './functions/commands/deploy-plan.js';
@@ -332,6 +335,26 @@ wireCLI({
                 }),
             },
         },
+        scopes: {
+            description: 'Inspect and maintain declared authorization scopes',
+            subcommands: {
+                audit: pikkuCLICommand({
+                    func: scopesAudit,
+                    description: 'Report scopes in the database that are no longer declared in code, and the roles holding them',
+                }),
+                prune: pikkuCLICommand({
+                    func: scopesPrune,
+                    description: 'Remove scopes that are no longer declared in code, cascading them out of every role',
+                    options: {
+                        yes: {
+                            description: 'Actually delete. Without it, prune only reports the blast radius',
+                            short: 'y',
+                            default: false,
+                        },
+                    },
+                }),
+            },
+        },
         workspace: {
             description: 'Workspace-level validation and maintenance commands',
             subcommands: {
@@ -483,6 +506,10 @@ wireCLI({
                         },
                     },
                 }),
+                webhook: pikkuCLICommand({
+                    func: enableWebhook,
+                    description: 'Enable the outgoing webhook delivery queue worker (scaffolds webhook.gen.ts)',
+                }),
             },
         },
         new: {
@@ -564,7 +591,7 @@ wireCLI({
                             default: false,
                         },
                         oauth: {
-                            description: 'Include OAuth2 credential wiring and OAuth2Client-based API service',
+                            description: 'Include OAuth2 credential wiring; the API service reads its access token from the credential service',
                             default: false,
                         },
                         credential: {
@@ -592,6 +619,22 @@ wireCLI({
                 }),
             },
         },
+        import: {
+            description: 'Import workflows from other systems',
+            subcommands: {
+                n8n: pikkuCLICommand({
+                    func: pikkuImportN8n,
+                    description: 'Import an n8n workflow JSON export (a single workflow, an export array, or a directory of exports) into Pikku workflow graphs + stub functions',
+                    parameters: '<file>',
+                    options: {
+                        out: {
+                            description: 'Output directory (defaults to scaffold.functionDir or cwd)',
+                            short: 'o',
+                        },
+                    },
+                }),
+            },
+        },
         versions: {
             description: 'Manage function contract versions',
             subcommands: {
@@ -680,7 +723,7 @@ wireCLI({
             },
         },
         skills: {
-            description: 'Install bundled agent skills (Claude Code today; Codex/Gemini coming soon)',
+            description: 'Install bundled agent skills (Claude Code, opencode, pi; Codex/Gemini coming soon)',
             subcommands: {
                 list: pikkuCLICommand({
                     func: pikkuSkillsList,
@@ -691,7 +734,7 @@ wireCLI({
                     description: 'Copy bundled skills into the current project',
                     options: {
                         agent: {
-                            description: 'Target agent (claude | opencode | codex | gemini). Default: claude',
+                            description: 'Target agent (claude | opencode | pi). Default: claude',
                             default: 'claude',
                         },
                         only: {

package/dist/src/deploy/analyzer/analyzer.js

@@ -31,6 +31,7 @@ export function analyzeDeployment(state, options) {
             funcId.startsWith('workflowStart:') ||
             funcId.startsWith('workflow:') ||
             funcId.startsWith('workflowStatus:') ||
+            funcId.startsWith('workflowApprove:') ||
             funcId.startsWith('pikkuWorkflowWorker:') ||
             funcId.startsWith('pikkuWorkflowOrchestrator:')) {
             continue;
@@ -419,6 +420,11 @@ function buildWorkflows(graphMeta, functionsMeta, rpcMeta, _httpMeta, units, wor
                 route: `/workflow/${graph.name}/status/:runId`,
                 pikkuFuncId: `workflowStatus:${graph.name}`,
             },
+            {
+                method: 'post',
+                route: `/workflow/${graph.name}/approve/:runId`,
+                pikkuFuncId: `workflowApprove:${graph.name}`,
+            },
             {
                 method: 'post',
                 route: `/workflow/${graph.name}/graph/:nodeId`,