@pikku/cli 0.12.83 → 0.12.86

package/dist/src/functions/wirings/ai-agent/serialize-public-agent.js

@@ -1,56 +1,132 @@
 export const serializePublicAgent = (pathToPikkuTypes, requireAuth = true, globalHTTPPrefix = '') => {
     const authFlag = requireAuth ? 'true' : 'false';
-    return `import { MissingServiceError } from '@pikku/core/errors'
-import { pikkuSessionlessFunc, defineHTTPRoutes, wireHTTPRoutes } from '${pathToPikkuTypes}'
+    const schemas = `/**
+ * Auto-generated public agent schemas
+ * Do not edit manually - regenerate with 'npx pikku'
+ */
+import { z } from 'zod'
 
-export const agentCaller = pikkuSessionlessFunc<
-  { agentName: string; message: string; threadId: string; resourceId: string },
-  unknown
->({
+export const Attachment = z.object({
+  type: z.enum(['image', 'file']),
+  data: z.string().optional(),
+  url: z.string().optional(),
+  mediaType: z.string().optional(),
+  filename: z.string().optional(),
+})
+
+export const AgentCall = z.object({
+  agentName: z.string(),
+  message: z.string(),
+  threadId: z.string(),
+  resourceId: z.string(),
+  attachments: z.array(Attachment).optional(),
+  model: z.string().optional(),
+  temperature: z.number().optional(),
+  context: z.string().optional(),
+})
+
+export const AgentApproval = z.object({
+  agentName: z.string(),
+  runId: z.string(),
+  approvals: z.array(
+    z.object({ toolCallId: z.string(), approved: z.boolean() })
+  ),
+})
+
+export const AgentResume = z.object({
+  agentName: z.string(),
+  runId: z.string(),
+  toolCallId: z.string(),
+  approved: z.boolean(),
+})
+
+export const ThreadsQuery = z.object({
+  agentName: z.string().optional(),
+  resourceId: z.string().optional(),
+  limit: z.number().optional(),
+  offset: z.number().optional(),
+})
+
+export const ThreadRef = z.object({
+  threadId: z.string(),
+  resourceId: z.string().optional(),
+})
+
+export const ThreadDeleted = z.object({ deleted: z.boolean() })
+`;
+    const functions = `import { canAccessThread, threadOwnerConstraint } from '@pikku/core/ai-agent'
+import { pikkuSessionlessFunc, pikkuPermission, defineHTTPRoutes, wireHTTPRoutes } from '${pathToPikkuTypes}'
+import {
+  AgentCall,
+  AgentApproval,
+  AgentResume,
+  ThreadsQuery,
+  ThreadRef,
+  ThreadDeleted,
+} from './agent.schemas.gen.js'
+
+/**
+ * Thread reads are keyed by a caller-supplied \`threadId\`, so ownership cannot
+ * come from the request — it is derived from the session and checked against
+ * the stored thread's resourceId.
+ */
+export const isThreadOwner = pikkuPermission<{ threadId: string }>(
+  async ({ agentRunService }, { threadId }, { session }) => {
+    const thread = await agentRunService.getThread(threadId)
+    // A missing thread is denied rather than 404'd so it is indistinguishable
+    // from one owned by someone else — no existence oracle.
+    if (!thread) return false
+    return canAccessThread(thread.resourceId, session)
+  }
+)
+
+export const agentCaller = pikkuSessionlessFunc({
   tags: ['pikku'],
   auth: ${authFlag},
+  input: AgentCall,
   func: async (_services, data, { rpc }) => {
     return await rpc.agent.run(data.agentName as any, {
       message: data.message,
       threadId: data.threadId,
       resourceId: data.resourceId,
+      ...(data.attachments ? { attachments: data.attachments } : {}),
+      ...(data.model ? { model: data.model } : {}),
+      ...(data.temperature !== undefined ? { temperature: data.temperature } : {}),
+      ...(data.context ? { context: data.context } : {}),
     })
   },
 })
 
-export const agentStreamCaller = pikkuSessionlessFunc<
-  { agentName: string; message: string; threadId: string; resourceId: string; context?: string },
-  void
->({
+export const agentStreamCaller = pikkuSessionlessFunc({
   tags: ['pikku'],
   auth: ${authFlag},
+  input: AgentCall,
   func: async (_services, data, { rpc }) => {
     await rpc.agent.stream(data.agentName as any, {
       message: data.message,
       threadId: data.threadId,
       resourceId: data.resourceId,
+      ...(data.attachments ? { attachments: data.attachments } : {}),
+      ...(data.model ? { model: data.model } : {}),
+      ...(data.temperature !== undefined ? { temperature: data.temperature } : {}),
       ...(data.context ? { context: data.context } : {}),
     })
   },
 })
 
-export const agentApproveCaller = pikkuSessionlessFunc<
-  { agentName: string; runId: string; approvals: { toolCallId: string; approved: boolean }[] },
-  unknown
->({
+export const agentApproveCaller = pikkuSessionlessFunc({
   tags: ['pikku'],
   auth: ${authFlag},
+  input: AgentApproval,
   func: async (_services, { runId, approvals, agentName }, { rpc }) => {
     return await rpc.agent.approve(runId, approvals, agentName)
   },
 })
 
-export const agentResumeCaller = pikkuSessionlessFunc<
-  { agentName: string; runId: string; toolCallId: string; approved: boolean },
-  void
->({
+export const agentResumeCaller = pikkuSessionlessFunc({
   tags: ['pikku'],
   auth: ${authFlag},
+  input: AgentResume,
   func: async (_services, data, { rpc }) => {
     await rpc.agent.resume(data.runId, {
       toolCallId: data.toolCallId,
@@ -59,71 +135,66 @@ export const agentResumeCaller = pikkuSessionlessFunc<
   },
 })
 
-export const getAgentThreads = pikkuSessionlessFunc<
-  { agentName?: string; resourceId?: string; limit?: number; offset?: number },
-  any[]
->({
+export const getAgentThreads = pikkuSessionlessFunc({
   tags: ['pikku', 'pikku:agent'],
+  input: ThreadsQuery,
   title: 'Get Agent Threads',
   description:
-    'Returns a list of AI agent threads from storage. Accepts optional filters: agentName, resourceId, limit, and offset for pagination.',
+    'Returns the caller\\'s AI agent threads from storage. Accepts optional filters: agentName, resourceId, limit, and offset for pagination.',
   expose: true,
   auth: ${authFlag},
-  func: async ({ agentRunService }, input) => {
-    if (!agentRunService) throw new MissingServiceError('agentRunService is not available')
+  func: async ({ agentRunService }, input, { session }) => {
+    // \`owners\` is an authorization constraint derived from the session, never
+    // from input — \`resourceId\` remains a caller-supplied filter within it.
     return await agentRunService.listThreads({
       agentName: input?.agentName,
       resourceId: input?.resourceId,
+      owners: threadOwnerConstraint(session),
       limit: input?.limit,
       offset: input?.offset,
     })
   },
 })
 
-export const getAgentThreadMessages = pikkuSessionlessFunc<
-  { threadId: string; resourceId?: string },
-  any[]
->({
+export const getAgentThreadMessages = pikkuSessionlessFunc({
   tags: ['pikku', 'pikku:agent'],
+  input: ThreadRef,
   title: 'Get Agent Thread Messages',
   description:
     'Returns all messages for a given AI agent thread, ordered by creation time.',
   expose: true,
   auth: ${authFlag},
+  permissions: { owner: isThreadOwner },
   func: async ({ agentRunService }, input) => {
-    if (!agentRunService) throw new MissingServiceError('agentRunService is not available')
     return await agentRunService.getThreadMessages(input.threadId)
   },
 })
 
-export const getAgentThreadRuns = pikkuSessionlessFunc<
-  { threadId: string; resourceId?: string },
-  any[]
->({
+export const getAgentThreadRuns = pikkuSessionlessFunc({
   tags: ['pikku', 'pikku:agent'],
+  input: ThreadRef,
   title: 'Get Agent Thread Runs',
   description:
     'Returns the run history for a given AI agent thread, ordered by creation time.',
   expose: true,
   auth: ${authFlag},
+  permissions: { owner: isThreadOwner },
   func: async ({ agentRunService }, input) => {
-    if (!agentRunService) throw new MissingServiceError('agentRunService is not available')
     return await agentRunService.getThreadRuns(input.threadId)
   },
 })
 
-export const deleteAgentThread = pikkuSessionlessFunc<
-  { threadId: string; resourceId?: string },
-  { deleted: boolean }
->({
+export const deleteAgentThread = pikkuSessionlessFunc({
   tags: ['pikku', 'pikku:agent'],
+  input: ThreadRef,
+  output: ThreadDeleted,
   title: 'Delete Agent Thread',
   description:
     'Deletes an AI agent thread and all of its persisted state.',
   expose: true,
   auth: ${authFlag},
+  permissions: { owner: isThreadOwner },
   func: async ({ agentRunService }, input) => {
-    if (!agentRunService) throw new MissingServiceError('agentRunService is not available')
     const deleted = await agentRunService.deleteThread(input.threadId)
     return { deleted }
   },
@@ -160,4 +231,5 @@ export const agentRoutes = defineHTTPRoutes({
 
 wireHTTPRoutes({ routes: { agent: agentRoutes } })
 `;
+    return { schemas, functions };
 };

package/dist/src/functions/wirings/auth/pikku-command-auth.d.ts

@@ -2,6 +2,6 @@ export declare const pikkuAuth: import("#pikku").PikkuFunctionConfig<{
     bootstrap?: boolean;
 }, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{
     bootstrap?: boolean;
-}, void, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<{
+}, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<{
     bootstrap?: boolean;
-}, void, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+}, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/auth/pikku-command-auth.js

@@ -4,6 +4,7 @@ import { rm } from 'node:fs/promises';
 import { pikkuSessionlessFunc } from '#pikku';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
+import { removeLegacyScaffoldFile } from '../../../utils/remove-legacy-scaffold-file.js';
 import { serializeAuthGen } from './serialize-auth-gen.js';
 import { serializeAuthTypes, serializeAuthTypesBootstrap, } from './serialize-auth-types.js';
 import { serializeAuthMeta } from './serialize-auth-meta.js';
@@ -49,6 +50,9 @@ export const pikkuAuth = pikkuSessionlessFunc({
         else if (existsSync(middlewareFile)) {
             await rm(middlewareFile, { force: true });
         }
+        for (const file of [authFile, secretsFile, middlewareFile]) {
+            await removeLegacyScaffoldFile(file);
+        }
         // Static metadata of the enabled providers/plugins for the console SSO page,
         // following the `*-meta.gen.json` convention. Read at runtime by the console
         // getAuthProviders function instead of a runtime registry.

package/dist/src/functions/wirings/channels/pikku-channels.d.ts

@@ -1 +1 @@
-export declare const pikkuChannels: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+export declare const pikkuChannels: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/channels/pikku-command-channel-types.d.ts

@@ -1 +1 @@
-export declare const pikkuChannelTypes: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+export declare const pikkuChannelTypes: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/channels/pikku-command-channels-map.d.ts

@@ -1 +1 @@
-export declare const pikkuChannelsMap: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+export declare const pikkuChannelsMap: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/channels/pikku-command-channels.d.ts

@@ -1 +1 @@
-export declare const pikkuCommandChannels: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+export declare const pikkuCommandChannels: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/cli/pikku-command-cli-entry.d.ts

@@ -1 +1 @@
-export declare const pikkuCLIEntry: import("#pikku").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+export declare const pikkuCLIEntry: import("#pikku").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/cli/pikku-command-cli-types.d.ts

@@ -1,5 +1,5 @@
 type CLITypesCommandInput = {
     bootstrap?: boolean;
 };
-export declare const pikkuCLITypes: import("#pikku").PikkuFunctionConfig<CLITypesCommandInput, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<CLITypesCommandInput, void, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<CLITypesCommandInput, void, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+export declare const pikkuCLITypes: import("#pikku").PikkuFunctionConfig<CLITypesCommandInput, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<CLITypesCommandInput, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<CLITypesCommandInput, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
 export {};

package/dist/src/functions/wirings/cli/pikku-command-cli.d.ts

@@ -1 +1 @@
-export declare const pikkuCLI: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+export declare const pikkuCLI: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/console/pikku-command-console-functions.d.ts

@@ -1 +1 @@
-export declare const pikkuConsoleFunctions: import("#pikku").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+export declare const pikkuConsoleFunctions: import("#pikku").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/console/pikku-command-console-functions.js

@@ -3,6 +3,7 @@ import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { projectDeclaresBetterAuth } from '../../../utils/detect-better-auth.js';
+import { removeLegacyScaffoldFile } from '../../../utils/remove-legacy-scaffold-file.js';
 import { serializeConsoleFunctions } from './serialize-console-functions.js';
 export const pikkuConsoleFunctions = pikkuSessionlessFunc({
     func: async ({ logger, config, variables }) => {
@@ -10,7 +11,7 @@ export const pikkuConsoleFunctions = pikkuSessionlessFunc({
         if (deployCodegenFlag === '1') {
             return false;
         }
-        if (config.scaffold?.console) {
+        if (config.scaffold?.console && config.consoleSchemasFile) {
             // Every console RPC now requires an authenticated session (the console is
             // an admin surface), so scaffolding it without an auth strategy produces a
             // console that 403s on every call. Better Auth is the supported strategy —
@@ -25,7 +26,10 @@ export const pikkuConsoleFunctions = pikkuSessionlessFunc({
             }
             const pathToPikkuTypes = getFileImportRelativePath(config.consoleFunctionsFile, config.typesDeclarationFile, config.packageMappings);
             const pathToAgentTypes = getFileImportRelativePath(config.consoleFunctionsFile, config.agentTypesFile, config.packageMappings);
-            await writeFileInDir(logger, config.consoleFunctionsFile, serializeConsoleFunctions(pathToPikkuTypes, pathToAgentTypes, config.globalHTTPPrefix || ''));
+            const { schemas, functions } = serializeConsoleFunctions(pathToPikkuTypes, pathToAgentTypes, config.globalHTTPPrefix || '');
+            await writeFileInDir(logger, config.consoleSchemasFile, schemas);
+            await writeFileInDir(logger, config.consoleFunctionsFile, functions);
+            await removeLegacyScaffoldFile(config.consoleFunctionsFile);
             return true;
         }
         return false;

package/dist/src/functions/wirings/console/pikku-command-node-types.d.ts

@@ -1 +1 @@
-export declare const pikkuNodeTypes: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+export declare const pikkuNodeTypes: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/console/pikku-command-nodes-meta.d.ts

@@ -1 +1 @@
-export declare const pikkuNodesMeta: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+export declare const pikkuNodesMeta: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/console/serialize-console-functions.d.ts

@@ -1 +1,5 @@
-export declare const serializeConsoleFunctions: (pathToPikkuTypes: string, _pathToAgentTypes: string, globalHTTPPrefix?: string) => string;
+export interface ConsoleGenOutput {
+    schemas: string;
+    functions: string;
+}
+export declare const serializeConsoleFunctions: (pathToPikkuTypes: string, _pathToAgentTypes: string, globalHTTPPrefix?: string) => ConsoleGenOutput;

package/dist/src/functions/wirings/console/serialize-console-functions.js

@@ -1,28 +1,62 @@
 export const serializeConsoleFunctions = (pathToPikkuTypes, _pathToAgentTypes, globalHTTPPrefix = '') => {
-    return `import { pikkuFunc, defineHTTPRoutes, wireHTTPRoutes, ref, wireAddon } from '${pathToPikkuTypes}'
+    const schemas = `/**
+ * Auto-generated console function schemas
+ * Do not edit manually - regenerate with 'npx pikku'
+ */
+import { z } from 'zod'
 
-export const pikkuConsoleSetSecret = pikkuFunc<{
-  secretId: string
-  value: unknown
-}, {
-  success: boolean
-}>({
+export const SecretRef = z.object({ secretId: z.string() })
+
+export const SetSecret = z.object({
+  secretId: z.string(),
+  value: z.unknown(),
+})
+
+export const VariableRef = z.object({ variableId: z.string() })
+
+export const SetVariable = z.object({
+  variableId: z.string(),
+  value: z.unknown(),
+})
+
+export const ValueResult = z.object({
+  exists: z.boolean(),
+  value: z.unknown().nullable(),
+})
+
+export const Exists = z.object({ exists: z.boolean() })
+
+export const Success = z.object({ success: z.boolean() })
+`;
+    const functions = `import { pikkuFunc, defineHTTPRoutes, wireHTTPRoutes, ref, wireAddon } from '${pathToPikkuTypes}'
+import {
+  SecretRef,
+  SetSecret,
+  VariableRef,
+  SetVariable,
+  ValueResult,
+  Exists,
+  Success,
+} from './console.schemas.gen.js'
+
+export const pikkuConsoleSetSecret = pikkuFunc({
   tags: ['pikku'],
   description: 'Set the value of a secret',
   expose: true,
+  input: SetSecret,
+  output: Success,
   func: async ({ secrets }, { secretId, value }) => {
     await secrets.setSecret(secretId, value)
     return { success: true }
   },
 })
 
-export const pikkuConsoleGetVariable = pikkuFunc<
-  { variableId: string },
-  { exists: boolean; value: unknown | null }
->({
+export const pikkuConsoleGetVariable = pikkuFunc({
   tags: ['pikku'],
   description: 'Get the current value of a variable',
   expose: true,
+  input: VariableRef,
+  output: ValueResult,
   func: async ({ variables }, { variableId }) => {
     const exists = await variables.has(variableId)
     if (!exists) {
@@ -38,13 +72,12 @@ export const pikkuConsoleGetVariable = pikkuFunc<
   },
 })
 
-export const pikkuConsoleSetVariable = pikkuFunc<
-  { variableId: string; value: unknown },
-  { success: boolean }
->({
+export const pikkuConsoleSetVariable = pikkuFunc({
   tags: ['pikku'],
   description: 'Set the value of a variable',
   expose: true,
+  input: SetVariable,
+  output: Success,
   func: async ({ variables }, { variableId, value }) => {
     if (typeof value === 'string') {
       await variables.set(variableId, value)
@@ -55,26 +88,24 @@ export const pikkuConsoleSetVariable = pikkuFunc<
   },
 })
 
-export const pikkuConsoleHasSecret = pikkuFunc<
-  { secretId: string },
-  { exists: boolean }
->({
+export const pikkuConsoleHasSecret = pikkuFunc({
   tags: ['pikku'],
   description: 'Check if a secret exists without reading its value',
   expose: true,
+  input: SecretRef,
+  output: Exists,
   func: async ({ secrets }, { secretId }) => {
     const exists = await secrets.hasSecret(secretId)
     return { exists }
   },
 })
 
-export const pikkuConsoleGetSecret = pikkuFunc<
-  { secretId: string },
-  { exists: boolean; value: unknown | null }
->({
+export const pikkuConsoleGetSecret = pikkuFunc({
   tags: ['pikku'],
   description: 'Get the current value of a secret',
   expose: true,
+  input: SecretRef,
+  output: ValueResult,
   func: async ({ secrets }, { secretId }) => {
     const exists = await secrets.hasSecret(secretId)
     if (!exists) {
@@ -107,4 +138,5 @@ export const consoleRoutes = defineHTTPRoutes({
 wireAddon({ name: 'console', package: '@pikku/addon-console' })
 wireHTTPRoutes({ basePath: '${globalHTTPPrefix}', routes: { console: consoleRoutes } })
 `;
+    return { schemas, functions };
 };

package/dist/src/functions/wirings/credentials/pikku-command-credentials.d.ts

@@ -1 +1 @@
-export declare const pikkuCredentials: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+export declare const pikkuCredentials: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/emails/pikku-command-emails.d.ts

@@ -1,6 +1,6 @@
 import type { PikkuCLIConfig } from '../../../../types/config.js';
 import type { CLILogger } from '../../../services/cli-logger.service.js';
-export declare const pikkuEmails: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+export declare const pikkuEmails: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
 export declare function generateEmailsArtifacts(logger: CLILogger, config: Pick<PikkuCLIConfig, 'outDir'> & {
     emailTemplatesDir?: string;
 }): Promise<true | undefined>;

package/dist/src/functions/wirings/functions/pikku-command-addon-types.d.ts

@@ -1,5 +1,5 @@
 type AddonTypesCommandInput = {
     bootstrap?: boolean;
 };
-export declare const pikkuAddonTypes: import("#pikku").PikkuFunctionConfig<AddonTypesCommandInput, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<AddonTypesCommandInput, void, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<AddonTypesCommandInput, void, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+export declare const pikkuAddonTypes: import("#pikku").PikkuFunctionConfig<AddonTypesCommandInput, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<AddonTypesCommandInput, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<AddonTypesCommandInput, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
 export {};

package/dist/src/functions/wirings/functions/pikku-command-function-types-split.d.ts

@@ -2,6 +2,6 @@ export declare const pikkuFunctionTypesSplit: import("#pikku").PikkuFunctionConf
     bootstrap?: boolean;
 }, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{
     bootstrap?: boolean;
-}, void, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<{
+}, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<{
     bootstrap?: boolean;
-}, void, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+}, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/functions/pikku-command-function-types.d.ts

@@ -2,6 +2,6 @@ export declare const pikkuFunctionTypes: import("#pikku").PikkuFunctionConfig<{
     bootstrap?: boolean;
 }, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{
     bootstrap?: boolean;
-}, void, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<{
+}, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<{
     bootstrap?: boolean;
-}, void, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+}, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/functions/pikku-command-functions.d.ts

@@ -1 +1 @@
-export declare const pikkuFunctions: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+export declare const pikkuFunctions: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/functions/pikku-command-services.d.ts

@@ -1,2 +1,2 @@
-export declare const serializeServicesMap: (allSingletonServices: string[], allWireServices: string[], requiredServices: Set<string>, forceRequiredServices: string[] | undefined, servicesImport: string, wireServicesImport: string, addonRequiredParentServices?: string[], authInjected?: boolean) => string;
-export declare const pikkuServices: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+export declare const serializeServicesMap: (allSingletonServices: string[], allWireServices: string[], requiredServices: Set<string>, forceRequiredServices: string[] | undefined, servicesImport: string, wireServicesImport: string, addonRequiredParentServices?: string[], authInjected?: boolean, agentScaffoldEnabled?: boolean) => string;
+export declare const pikkuServices: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/functions/pikku-command-services.js

@@ -3,7 +3,7 @@ import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
 import { checkRequiredTypes } from '../../../utils/check-required-types.js';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
-export const serializeServicesMap = (allSingletonServices, allWireServices, requiredServices, forceRequiredServices = [], servicesImport, wireServicesImport, addonRequiredParentServices = [], authInjected = false) => {
+export const serializeServicesMap = (allSingletonServices, allWireServices, requiredServices, forceRequiredServices = [], servicesImport, wireServicesImport, addonRequiredParentServices = [], authInjected = false, agentScaffoldEnabled = false) => {
     // Use pre-aggregated services from inspector state
     // This includes services from:
     // - Wired functions (HTTP, channels, queues, schedulers, MCP, CLI, RPC)
@@ -40,6 +40,13 @@ export const serializeServicesMap = (allSingletonServices, allWireServices, requ
     if (authInjected) {
         usedServices.add('auth');
     }
+    // The generated public-agent permission (isThreadOwner) always destructures
+    // agentRunService, but agent.gen.ts is written after requiredServices is
+    // computed from inspecting hand-written sources, so the inspector never
+    // sees that usage — force it required whenever the agent scaffold runs.
+    if (agentScaffoldEnabled) {
+        usedServices.add('agentRunService');
+    }
     // Create singleton services map: all singleton services with true/false based on usage
     const singletonServicesMap = {};
     allSingletonServices.forEach((service) => {
@@ -111,7 +118,7 @@ export const pikkuServices = pikkuSessionlessFunc({
         }
         const servicesImport = `import type { ${singletonServicesType.type} } from '${getFileImportRelativePath(config.typesDeclarationFile, singletonServicesType.typePath, config.packageMappings)}'`;
         const wireServicesImport = `import type { ${wireServicesType.type} } from '${getFileImportRelativePath(config.typesDeclarationFile, wireServicesType.typePath, config.packageMappings)}'`;
-        const servicesCode = serializeServicesMap(visitState.serviceAggregation.allSingletonServices, visitState.serviceAggregation.allWireServices, visitState.serviceAggregation.requiredServices, config.forceRequiredServices, servicesImport, wireServicesImport, config.addonName ? visitState.addonRequiredParentServices : [], Boolean(visitState.auth?.definition));
+        const servicesCode = serializeServicesMap(visitState.serviceAggregation.allSingletonServices, visitState.serviceAggregation.allWireServices, visitState.serviceAggregation.requiredServices, config.forceRequiredServices, servicesImport, wireServicesImport, config.addonName ? visitState.addonRequiredParentServices : [], Boolean(visitState.auth?.definition), Boolean(config.scaffold?.agent));
         await writeFileInDir(logger, config.servicesFile, servicesCode);
     },
     middleware: [

package/dist/src/functions/wirings/functions/schemas.d.ts

@@ -1 +1 @@
-export declare const pikkuSchemas: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+export declare const pikkuSchemas: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/functions/schemas.js

@@ -4,7 +4,16 @@ import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-
 export const pikkuSchemas = pikkuSessionlessFunc({
     func: async ({ logger, config, getInspectorState }) => {
         const visitState = await getInspectorState();
-        if (Object.keys(visitState.schemas).length === 0) {
+        // Bodies missing while functions still DECLARE schemas means the inspection pass
+        // was partial. Writing from it would empty register.gen.ts and delete the files
+        // behind schemas that are still required — unregistering the whole app off a bad
+        // read. Leave the previous output alone.
+        //
+        // Zero REQUIRED schemas is a different thing entirely and must still be written:
+        // that is a project whose last schema was removed, and it is the case where the
+        // files left by earlier runs have to be cleared.
+        if (visitState.requiredSchemas.size > 0 &&
+            Object.keys(visitState.schemas).length === 0) {
             return undefined;
         }
         await saveSchemas(logger, config.schemaDirectory, visitState.schemas, visitState.requiredSchemas, config.schema?.supportsImportAttributes ?? true, config.addonName || null);