@pikku/cli 0.12.85 → 0.12.86

package/dist/.pikku/schemas/schemas/PikkuCLIConfig.schema.json

@@ -1 +1 @@
-{ "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "additionalProperties": false, "properties": { "configFile": { "type": "string" }, "tags": { "type": "array", "items": { "type": "string" } }, "wires": { "type": "array", "items": { "type": "string" } }, "excludeWires": { "type": "array", "items": { "type": "string" } }, "userSessionType": { "type": "string" }, "singletonServicesFactoryType": { "type": "string" }, "wireServicesFactoryType": { "type": "string" }, "outDir": { "type": "string" }, "schemaDirectory": { "type": "string" }, "typesDeclarationFile": { "type": "string" }, "functionsFile": { "type": "string" }, "functionsMetaFile": { "type": "string" }, "functionsMetaJsonFile": { "type": "string" }, "functionTypesFile": { "type": "string" }, "httpWiringsFile": { "type": "string" }, "httpWiringMetaFile": { "type": "string" }, "httpWiringMetaJsonFile": { "type": "string" }, "httpContractsMetaJsonFile": { "type": "string" }, "httpContractsMetaFile": { "type": "string" }, "httpMapDeclarationFile": { "type": "string" }, "httpTypesFile": { "type": "string" }, "gatewaysWiringFile": { "type": "string" }, "gatewaysWiringMetaFile": { "type": "string" }, "gatewaysWiringMetaJsonFile": { "type": "string" }, "channelsWiringFile": { "type": "string" }, "channelsWiringMetaFile": { "type": "string" }, "channelsWiringMetaJsonFile": { "type": "string" }, "channelContractsMetaJsonFile": { "type": "string" }, "channelContractsMetaFile": { "type": "string" }, "channelsMapDeclarationFile": { "type": "string" }, "channelsTypesFile": { "type": "string" }, "rpcInternalWiringMetaFile": { "type": "string" }, "rpcInternalWiringMetaJsonFile": { "type": "string" }, "rpcInternalMapDeclarationFile": { "type": "string" }, "rpcMapDeclarationFile": { "type": "string" }, "rpcRemoteMapDeclarationFile": { "type": "string" }, "remoteRpcWorkersFile": { "type": "string" }, "graphWiringsFile": { "type": "string" }, "webhookWorkersFile": { "type": "string" }, "publicRpcFile": { "type": "string" }, "publicAgentFile": { "type": "string" }, "consoleFunctionsFile": { "type": "string" }, "scenariosFunctionsFile": { "type": "string" }, "workflowRoutesFile": { "type": "string" }, "eventsChannelFile": { "type": "string" }, "triggersTypesFile": { "type": "string" }, "triggersWiringFile": { "type": "string" }, "triggersWiringMetaFile": { "type": "string" }, "triggersWiringMetaJsonFile": { "type": "string" }, "triggerSourcesMetaFile": { "type": "string" }, "triggerSourcesMetaJsonFile": { "type": "string" }, "schedulersWiringFile": { "type": "string" }, "schedulersWiringMetaFile": { "type": "string" }, "schedulersWiringMetaJsonFile": { "type": "string" }, "schedulersTypesFile": { "type": "string" }, "queueWorkersWiringFile": { "type": "string" }, "queueWorkersWiringMetaFile": { "type": "string" }, "queueWorkersWiringMetaJsonFile": { "type": "string" }, "queueMapDeclarationFile": { "type": "string" }, "queueTypesFile": { "type": "string" }, "workflowsWiringFile": { "type": "string" }, "workflowsWiringMetaFile": { "type": "string" }, "workflowsWorkersFile": { "type": "string" }, "workflowMapDeclarationFile": { "type": "string" }, "workflowTypesFile": { "type": "string" }, "workflowMetaDir": { "type": "string" }, "scenarioActorsFile": { "type": "string" }, "mcpWiringsFile": { "type": "string" }, "mcpWiringsMetaFile": { "type": "string" }, "mcpWiringsMetaJsonFile": { "type": "string" }, "mcpTypesFile": { "type": "string" }, "mcpJsonFile": { "type": "string" }, "agentWiringsFile": { "type": "string" }, "agentWiringMetaFile": { "type": "string" }, "agentWiringMetaJsonFile": { "type": "string" }, "agentTypesFile": { "type": "string" }, "agentMapDeclarationFile": { "type": "string" }, "cliWiringsFile": { "type": "string" }, "cliWiringMetaFile": { "type": "string" }, "cliWiringMetaJsonFile": { "type": "string" }, "cliContractsMetaJsonFile": { "type": "string" }, "cliContractsMetaFile": { "type": "string" }, "cliBootstrapFile": { "type": "string" }, "cliTypesFile": { "type": "string" }, "servicesFile": { "type": "string" }, "middlewareFile": { "type": "string" }, "middlewareGroupsMetaJsonFile": { "type": "string" }, "permissionsFile": { "type": "string" }, "permissionsGroupsMetaJsonFile": { "type": "string" }, "bootstrapFile": { "type": "string" }, "packageFile": { "type": "string" }, "addonTypesFile": { "type": "string" }, "nodeTypesFile": { "type": "string" }, "secretTypesFile": { "type": "string" }, "secretsFile": { "type": "string" }, "secretsMetaJsonFile": { "type": "string" }, "credentialsFile": { "type": "string" }, "credentialsMetaJsonFile": { "type": "string" }, "scopeTypesFile": { "type": "string" }, "scopesFile": { "type": "string" }, "scopesMetaJsonFile": { "type": "string" }, "variableTypesFile": { "type": "string" }, "variablesFile": { "type": "string" }, "variablesMetaJsonFile": { "type": "string" }, "$schema": { "type": "string" }, "extends": { "type": "string" }, "rootDir": { "type": "string" }, "runtimeDir": { "type": "string", "description": "Runtime artifacts directory (dev.db, content, tmp). Resolved relative to rootDir. Defaults to <rootDir>/.pikku-runtime." }, "srcDirectories": { "type": "array", "items": { "type": "string" } }, "ignoreFiles": { "type": "array", "items": { "type": "string" } }, "packageMappings": { "type": "object", "additionalProperties": { "type": "string" } }, "addon": { "anyOf": [{ "type": "boolean" }, { "type": "object", "properties": { "categories": { "type": "array", "items": { "type": "string" } }, "icon": { "type": "string" }, "displayName": { "type": "string" }, "description": { "type": "string" }, "serverlessIncompatible": { "type": "array", "items": { "type": "string" } }, "openapi": { "type": "object", "properties": { "version": { "type": "string" }, "hash": { "type": "string" } }, "required": ["version", "hash"], "additionalProperties": false } }, "additionalProperties": false }] }, "addonName": { "type": "string" }, "configDir": { "type": "string" }, "tsconfig": { "type": "string" }, "clientFiles": { "type": "object", "properties": { "fetchFile": { "type": "string" }, "websocketFile": { "type": "string" }, "rpcWiringsFile": { "type": "string" }, "reactQueryFile": { "type": "string" }, "realtimeFile": { "type": "string" }, "realtimeEventHubTopicsImport": { "type": "string", "description": "Optional import for the EventHubTopics type so the realtime client is fully typed. Format: `<path>#<TypeName>` resolved relative to `realtimeFile`. Example: `../types/eventhub-topics.js#EventHubTopics`. If unset, the generated client treats topics as `Record<string, unknown>`." }, "queueWiringsFile": { "type": "string" }, "mcpJsonFile": { "type": "string" }, "nextBackendFile": { "type": "string" }, "nextHTTPFile": { "type": "string" }, "nextBackendTransport": { "type": "string", "enum": ["local", "worker-rpc", "http"], "description": "Transport used by the generated nextBackendFile wrapper.\n- `'local'` (default): function code is loaded in-process via bootstrap +   createSingletonServices. Required for Node/dev runs.\n- `'worker-rpc'`: SSR dispatches every call through an injected `Fetcher`   ({ fetch(req): Promise<Response> }). Function code is NOT bundled into   the SSR worker. Pair with `nextBackendFetcherImport` to point at your   resolver module.\n- `'http'`: SSR dispatches every call through the generated `PikkuFetch`   client. Use this when your Next app should call a separately running   local/server API instead of importing function code in-process." }, "nextBackendFetcherImport": { "type": "string", "description": "Module that exports a `fetcher: Fetcher` (or default export) used by the worker-RPC variant of the next backend wrapper. Resolved relative to `nextBackendFile`. Required when `nextBackendTransport === 'worker-rpc'`." }, "startServerFnsFile": { "type": "string", "description": "Emit a TanStack Start server-function shim into this file. The shim exports `makeApi(): PikkuRPC` — a typed caller over the generated RPC map for use in Start loaders, actions and components. It reads the API base URL from `import.meta.env.VITE_API_URL` (throws if unset). Requires `rpcWiringsFile` (where the `PikkuRPC` class is generated)." } }, "additionalProperties": false }, "emailTemplatesDir": { "type": "string", "description": "Directory containing email templates, locales, partials, and theme.json." }, "authFile": { "type": "string", "description": "Path to write the generated Better Auth wiring file (auth.gen.ts). Must be within srcDirectories so wireSecret calls are picked up by the inspector. Example: \"src/auth.gen.ts\"" }, "authTypesFile": { "type": "string", "description": "Path to write the generated typed `pikkuBetterAuth` re-export (auth.types.ts). Defaults to `{outDir}/auth/auth.types.ts`. Re-exported from `#pikku` so user code can `import { pikkuBetterAuth } from '#pikku'` with project-typed services." }, "authMetaJsonFile": { "type": "string", "description": "Path to write the generated Better Auth metadata (auth-meta.gen.json) — the enabled social providers and plugins the console SSO page reads via getAuthProviders. Defaults to `{outDir}/auth/pikku-auth-meta.gen.json`." }, "openAPI": { "type": "object", "properties": { "outputFile": { "type": "string" }, "additionalInfo": { "$ref": "#/definitions/OpenAPISpecInfo" } }, "required": ["outputFile", "additionalInfo"], "additionalProperties": false }, "schema": { "type": "object", "properties": { "additionalProperties": { "type": "boolean" }, "supportsImportAttributes": { "type": "boolean" } }, "additionalProperties": false }, "db": { "type": "object", "properties": { "engine": { "type": "string", "enum": ["sqlite", "postgres"] }, "pgVersion": { "type": "number" } }, "additionalProperties": false }, "cli": { "type": "object", "properties": { "entrypoints": { "type": "object", "additionalProperties": { "anyOf": [{ "type": "string" }, { "type": "object", "properties": { "type": { "type": "string", "const": "local" }, "path": { "type": "string" } }, "required": ["type", "path"], "additionalProperties": false }, { "type": "object", "properties": { "type": { "type": "string", "const": "channel" }, "name": { "type": "string" }, "route": { "type": "string" }, "wirePath": { "type": "string" }, "path": { "type": "string" } }, "required": ["type", "wirePath"], "additionalProperties": false }, { "type": "array", "items": { "anyOf": [{ "type": "string" }, { "type": "object", "properties": { "type": { "type": "string", "const": "local" }, "path": { "type": "string" } }, "required": ["type", "path"], "additionalProperties": false }, { "type": "object", "properties": { "type": { "type": "string", "const": "channel" }, "name": { "type": "string" }, "route": { "type": "string" }, "wirePath": { "type": "string" }, "path": { "type": "string" } }, "required": ["type", "wirePath"], "additionalProperties": false }] } }] } } }, "additionalProperties": false }, "workflows": { "type": "object", "properties": { "orchestratorQueue": { "type": "string" }, "workerQueue": { "type": "string" } }, "additionalProperties": false }, "scenarios": { "type": "object", "properties": { "actors": { "type": "object", "additionalProperties": { "type": "object", "properties": { "email": { "type": "string" }, "name": { "type": "string" }, "jobTitle": { "type": "string" }, "personality": { "type": "string" } }, "required": ["email"], "additionalProperties": false }, "description": "Global scenario actor registry — any scenario can impersonate any actor" }, "environments": { "type": "object", "additionalProperties": { "type": "object", "properties": { "apiUrl": { "type": "string" }, "signInPath": { "type": "string", "description": "Actor sign-in path under apiUrl. Default: /auth/sign-in/actor" }, "rpcPath": { "type": "string", "description": "Exposed-RPC prefix under apiUrl. Default: /rpc" } }, "required": ["apiUrl"], "additionalProperties": false }, "description": "Environments `pikku scenario run <environment>` can target; the actor secret comes from SCENARIO_ACTOR_SECRET, never config" } }, "additionalProperties": false }, "scaffold": { "type": "object", "properties": { "addonDir": { "type": "string" }, "functionDir": { "type": "string" }, "wiringDir": { "type": "string" }, "middlewareDir": { "type": "string" }, "permissionDir": { "type": "string" }, "pikkuDir": { "type": "string" }, "graph": { "type": "boolean", "description": "Wire the pikku addon-graph package so pikkuWorkflowGraph can reference its native transforms like graph:editFields." }, "rpc": { "$ref": "#/definitions/PikkuScaffoldFeature" }, "console": { "$ref": "#/definitions/PikkuScaffoldFeature" }, "scenarios": { "$ref": "#/definitions/PikkuScaffoldFeature" }, "agent": { "$ref": "#/definitions/PikkuScaffoldFeature" }, "workflow": { "$ref": "#/definitions/PikkuScaffoldFeature" }, "events": { "$ref": "#/definitions/PikkuScaffoldFeature" }, "remoteRpc": { "$ref": "#/definitions/PikkuScaffoldFeature" }, "webhook": { "type": "boolean", "description": "The outgoing webhook delivery worker exposes no endpoint of its own, so it has no auth dimension — it is on or off." } }, "additionalProperties": false }, "addons": { "type": "object", "properties": { "addonDir": { "type": "string" } }, "additionalProperties": false, "description": "Community-registry addons installed via `pikku fabric addon add`. The source is copied into the project shadcn-style; each lands in `<addonDir>/<name>/` and the dir is registered as a yarn workspace so `wireAddon({ package })` resolves it by name. `addonDir` defaults to `addons` (top-level, outside the app's TS scan). Install provenance is tracked in pikku-addons.json." }, "tests": { "type": "object", "properties": { "outputDir": { "type": "string" } }, "additionalProperties": false }, "forceRequiredServices": { "type": "array", "items": { "type": "string" } }, "schemasFromTypes": { "type": "array", "items": { "type": "string" } }, "stateOutput": { "type": "string" }, "stateInput": { "type": "string" }, "verboseMeta": { "type": "boolean" }, "security": { "type": "boolean", "description": "Run the data-classification security lint (scans function return types for Private/Pii/Secret leaks). Off by default — it forces expensive return-type inference on every function and is not part of codegen. Enable here to always run it, or per-invocation via `pikku all --security`. Pair with `failOnError` to gate a build/CI on leaks." }, "tsc": { "type": "boolean", "description": "After codegen, run a real `tsc --noEmit` over the project's tsconfig and fail on type errors. `tsc` prints full diagnostics with code frames; `tscSummary` prints a compact one-line-per-error render (no code frames, capped) that's cheap for AI agents / CI logs. Off by default; enable per invocation via `pikku all --tsc` / `--tsc-summary`." }, "tscSummary": { "type": "boolean" }, "diff": { "type": "boolean", "description": "After a successful codegen run, emit a structural diff of the generated `.pikku` meta (functions/wirings/workflows/emails added/removed/changed vs the state before this run) as a `PIKKU_DIFF <json>` line on stdout. Only emitted on exit 0. Off by default; enable per invocation via `pikku all --diff`. Consumed by the sandbox \"what changed\" build card." }, "lint": { "type": "object", "properties": { "servicesNotDestructured": { "type": "string", "enum": ["off", "warn", "error"] }, "wiresNotDestructured": { "type": "string", "enum": ["off", "warn", "error"] }, "functionDynamicImport": { "type": "string", "enum": ["off", "warn", "error"] } }, "additionalProperties": false }, "addonMetaJsonFile": { "type": "string" }, "globalHTTPPrefix": { "type": "string" }, "binary": { "type": "object", "properties": { "entrypoint": { "type": "string" }, "output": { "type": "string" }, "targets": { "type": "array", "items": { "type": "string" } } }, "required": ["entrypoint", "output"], "additionalProperties": false }, "deploy": { "type": "object", "properties": { "providers": { "type": "object", "additionalProperties": { "type": "string" } }, "defaultProvider": { "type": "string" }, "serverlessIncompatible": { "type": "array", "items": { "type": "string" } }, "defaultTarget": { "type": "string", "enum": ["serverless", "server"], "description": "Default deploy target for functions that don't declare an explicit `deploy` flag and don't use a serverless-incompatible service. Defaults to 'serverless'." } }, "required": ["providers"], "additionalProperties": false }, "namedFilters": { "type": "object", "additionalProperties": { "$ref": "#/definitions/InspectorFilters" }, "description": "Named filter presets keyed by name, used via CLI --filter <name>." }, "filters": { "$ref": "#/definitions/InspectorFilters" } }, "required": ["addonTypesFile", "agentMapDeclarationFile", "agentTypesFile", "agentWiringMetaFile", "agentWiringMetaJsonFile", "agentWiringsFile", "bootstrapFile", "channelContractsMetaFile", "channelContractsMetaJsonFile", "channelsMapDeclarationFile", "channelsTypesFile", "channelsWiringFile", "channelsWiringMetaFile", "channelsWiringMetaJsonFile", "cliBootstrapFile", "cliContractsMetaFile", "cliContractsMetaJsonFile", "cliTypesFile", "cliWiringMetaFile", "cliWiringMetaJsonFile", "cliWiringsFile", "configDir", "consoleFunctionsFile", "credentialsFile", "credentialsMetaJsonFile", "eventsChannelFile", "filters", "functionTypesFile", "functionsFile", "functionsMetaFile", "functionsMetaJsonFile", "gatewaysWiringFile", "gatewaysWiringMetaFile", "gatewaysWiringMetaJsonFile", "httpContractsMetaFile", "httpContractsMetaJsonFile", "httpMapDeclarationFile", "httpTypesFile", "httpWiringMetaFile", "httpWiringMetaJsonFile", "httpWiringsFile", "mcpJsonFile", "mcpTypesFile", "mcpWiringsFile", "mcpWiringsMetaFile", "mcpWiringsMetaJsonFile", "middlewareFile", "middlewareGroupsMetaJsonFile", "nodeTypesFile", "outDir", "packageFile", "packageMappings", "permissionsFile", "permissionsGroupsMetaJsonFile", "publicAgentFile", "publicRpcFile", "queueMapDeclarationFile", "queueTypesFile", "queueWorkersWiringFile", "queueWorkersWiringMetaFile", "queueWorkersWiringMetaJsonFile", "rootDir", "rpcInternalMapDeclarationFile", "rpcInternalWiringMetaFile", "rpcInternalWiringMetaJsonFile", "rpcMapDeclarationFile", "rpcRemoteMapDeclarationFile", "scenarioActorsFile", "scenariosFunctionsFile", "schedulersTypesFile", "schedulersWiringFile", "schedulersWiringMetaFile", "schedulersWiringMetaJsonFile", "schemaDirectory", "scopeTypesFile", "scopesFile", "scopesMetaJsonFile", "secretTypesFile", "secretsFile", "secretsMetaJsonFile", "servicesFile", "srcDirectories", "triggerSourcesMetaFile", "triggerSourcesMetaJsonFile", "triggersTypesFile", "triggersWiringFile", "triggersWiringMetaFile", "triggersWiringMetaJsonFile", "tsconfig", "typesDeclarationFile", "variableTypesFile", "variablesFile", "variablesMetaJsonFile", "workflowMapDeclarationFile", "workflowMetaDir", "workflowRoutesFile", "workflowTypesFile", "workflowsWiringFile", "workflowsWiringMetaFile", "workflowsWorkersFile"], "definitions": { "OpenAPISpecInfo": { "type": "object", "properties": { "info": { "type": "object", "properties": { "title": { "type": "string" }, "version": { "type": "string" }, "description": { "type": "string" }, "termsOfService": { "type": "string" }, "contact": { "type": "object", "properties": { "name": { "type": "string" }, "url": { "type": "string" }, "email": { "type": "string" } }, "additionalProperties": false }, "license": { "type": "object", "properties": { "name": { "type": "string" }, "url": { "type": "string" } }, "required": ["name"], "additionalProperties": false } }, "required": ["title", "version", "description"], "additionalProperties": false }, "servers": { "type": "array", "items": { "type": "object", "properties": { "url": { "type": "string" }, "description": { "type": "string" } }, "required": ["url"], "additionalProperties": false } }, "tags": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "description": { "type": "string" } }, "required": ["name"], "additionalProperties": false } }, "externalDocs": { "type": "object", "properties": { "description": { "type": "string" }, "url": { "type": "string" } }, "required": ["url"], "additionalProperties": false }, "securitySchemes": { "type": "object" }, "security": { "type": "array", "items": { "type": "object", "additionalProperties": { "type": "array", "items": {} } } } }, "required": ["info", "servers"], "additionalProperties": false }, "PikkuScaffoldFeature": { "type": ["string", "boolean"], "enum": ["auth", "no-auth", false] }, "InspectorFilters": { "type": "object", "properties": { "names": { "type": "array", "items": { "type": "string" } }, "tags": { "type": "array", "items": { "type": "string" } }, "wires": { "type": "array", "items": { "type": "string" } }, "directories": { "type": "array", "items": { "type": "string" } }, "httpRoutes": { "type": "array", "items": { "type": "string" } }, "httpMethods": { "type": "array", "items": { "type": "string" } }, "excludeNames": { "type": "array", "items": { "type": "string" } }, "excludeTags": { "type": "array", "items": { "type": "string" } }, "excludeWires": { "type": "array", "items": { "type": "string" } }, "excludeDirectories": { "type": "array", "items": { "type": "string" } }, "excludeHttpRoutes": { "type": "array", "items": { "type": "string" } }, "excludeHttpMethods": { "type": "array", "items": { "type": "string" } }, "target": { "type": "array", "items": { "type": "string", "enum": ["serverless", "server"] } }, "excludeTarget": { "type": "array", "items": { "type": "string", "enum": ["serverless", "server"] } }, "serverlessIncompatible": { "type": "array", "items": { "type": "string" } }, "defaultTarget": { "type": "string", "enum": ["serverless", "server"] } }, "additionalProperties": false } } }
+{ "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "additionalProperties": false, "properties": { "configFile": { "type": "string" }, "tags": { "type": "array", "items": { "type": "string" } }, "wires": { "type": "array", "items": { "type": "string" } }, "excludeWires": { "type": "array", "items": { "type": "string" } }, "userSessionType": { "type": "string" }, "singletonServicesFactoryType": { "type": "string" }, "wireServicesFactoryType": { "type": "string" }, "outDir": { "type": "string" }, "schemaDirectory": { "type": "string" }, "typesDeclarationFile": { "type": "string" }, "functionsFile": { "type": "string" }, "functionsMetaFile": { "type": "string" }, "functionsMetaJsonFile": { "type": "string" }, "functionTypesFile": { "type": "string" }, "httpWiringsFile": { "type": "string" }, "httpWiringMetaFile": { "type": "string" }, "httpWiringMetaJsonFile": { "type": "string" }, "httpContractsMetaJsonFile": { "type": "string" }, "httpContractsMetaFile": { "type": "string" }, "httpMapDeclarationFile": { "type": "string" }, "httpTypesFile": { "type": "string" }, "gatewaysWiringFile": { "type": "string" }, "gatewaysWiringMetaFile": { "type": "string" }, "gatewaysWiringMetaJsonFile": { "type": "string" }, "channelsWiringFile": { "type": "string" }, "channelsWiringMetaFile": { "type": "string" }, "channelsWiringMetaJsonFile": { "type": "string" }, "channelContractsMetaJsonFile": { "type": "string" }, "channelContractsMetaFile": { "type": "string" }, "channelsMapDeclarationFile": { "type": "string" }, "channelsTypesFile": { "type": "string" }, "rpcInternalWiringMetaFile": { "type": "string" }, "rpcInternalWiringMetaJsonFile": { "type": "string" }, "rpcInternalMapDeclarationFile": { "type": "string" }, "rpcMapDeclarationFile": { "type": "string" }, "rpcRemoteMapDeclarationFile": { "type": "string" }, "remoteRpcWorkersFile": { "type": "string" }, "remoteRpcSchemasFile": { "type": "string" }, "graphWiringsFile": { "type": "string" }, "webhookWorkersFile": { "type": "string" }, "webhookSchemasFile": { "type": "string" }, "publicRpcFile": { "type": "string" }, "publicRpcSchemasFile": { "type": "string" }, "publicAgentFile": { "type": "string" }, "publicAgentSchemasFile": { "type": "string" }, "consoleFunctionsFile": { "type": "string" }, "consoleSchemasFile": { "type": "string" }, "scenariosFunctionsFile": { "type": "string" }, "scenariosSchemasFile": { "type": "string" }, "userAdminFunctionsFile": { "type": "string" }, "userAdminSchemasFile": { "type": "string" }, "workflowRoutesFile": { "type": "string" }, "workflowRoutesSchemasFile": { "type": "string" }, "eventsChannelFile": { "type": "string" }, "eventsSchemasFile": { "type": "string" }, "triggersTypesFile": { "type": "string" }, "triggersWiringFile": { "type": "string" }, "triggersWiringMetaFile": { "type": "string" }, "triggersWiringMetaJsonFile": { "type": "string" }, "triggerSourcesMetaFile": { "type": "string" }, "triggerSourcesMetaJsonFile": { "type": "string" }, "schedulersWiringFile": { "type": "string" }, "schedulersWiringMetaFile": { "type": "string" }, "schedulersWiringMetaJsonFile": { "type": "string" }, "schedulersTypesFile": { "type": "string" }, "queueWorkersWiringFile": { "type": "string" }, "queueWorkersWiringMetaFile": { "type": "string" }, "queueWorkersWiringMetaJsonFile": { "type": "string" }, "queueMapDeclarationFile": { "type": "string" }, "queueTypesFile": { "type": "string" }, "workflowsWiringFile": { "type": "string" }, "workflowsWiringMetaFile": { "type": "string" }, "workflowsWorkersFile": { "type": "string" }, "workflowMapDeclarationFile": { "type": "string" }, "workflowTypesFile": { "type": "string" }, "workflowMetaDir": { "type": "string" }, "scenarioActorsFile": { "type": "string" }, "mcpWiringsFile": { "type": "string" }, "mcpWiringsMetaFile": { "type": "string" }, "mcpWiringsMetaJsonFile": { "type": "string" }, "mcpTypesFile": { "type": "string" }, "mcpJsonFile": { "type": "string" }, "agentWiringsFile": { "type": "string" }, "agentWiringMetaFile": { "type": "string" }, "agentWiringMetaJsonFile": { "type": "string" }, "agentTypesFile": { "type": "string" }, "agentMapDeclarationFile": { "type": "string" }, "cliWiringsFile": { "type": "string" }, "cliWiringMetaFile": { "type": "string" }, "cliWiringMetaJsonFile": { "type": "string" }, "cliContractsMetaJsonFile": { "type": "string" }, "cliContractsMetaFile": { "type": "string" }, "cliBootstrapFile": { "type": "string" }, "cliTypesFile": { "type": "string" }, "servicesFile": { "type": "string" }, "middlewareFile": { "type": "string" }, "middlewareGroupsMetaJsonFile": { "type": "string" }, "permissionsFile": { "type": "string" }, "permissionsGroupsMetaJsonFile": { "type": "string" }, "bootstrapFile": { "type": "string" }, "packageFile": { "type": "string" }, "addonTypesFile": { "type": "string" }, "nodeTypesFile": { "type": "string" }, "secretTypesFile": { "type": "string" }, "secretsFile": { "type": "string" }, "secretsMetaJsonFile": { "type": "string" }, "credentialsFile": { "type": "string" }, "credentialsMetaJsonFile": { "type": "string" }, "scopeTypesFile": { "type": "string" }, "scopesFile": { "type": "string" }, "scopesMetaJsonFile": { "type": "string" }, "variableTypesFile": { "type": "string" }, "variablesFile": { "type": "string" }, "variablesMetaJsonFile": { "type": "string" }, "$schema": { "type": "string" }, "extends": { "type": "string" }, "rootDir": { "type": "string" }, "runtimeDir": { "type": "string", "description": "Runtime artifacts directory (dev.db, content, tmp). Resolved relative to rootDir. Defaults to <rootDir>/.pikku-runtime." }, "srcDirectories": { "type": "array", "items": { "type": "string" } }, "ignoreFiles": { "type": "array", "items": { "type": "string" } }, "packageMappings": { "type": "object", "additionalProperties": { "type": "string" } }, "addon": { "anyOf": [{ "type": "boolean" }, { "type": "object", "properties": { "categories": { "type": "array", "items": { "type": "string" } }, "icon": { "type": "string" }, "displayName": { "type": "string" }, "description": { "type": "string" }, "serverlessIncompatible": { "type": "array", "items": { "type": "string" } }, "openapi": { "type": "object", "properties": { "version": { "type": "string" }, "hash": { "type": "string" } }, "required": ["version", "hash"], "additionalProperties": false } }, "additionalProperties": false }] }, "addonName": { "type": "string" }, "configDir": { "type": "string" }, "tsconfig": { "type": "string" }, "clientFiles": { "type": "object", "properties": { "fetchFile": { "type": "string" }, "websocketFile": { "type": "string" }, "rpcWiringsFile": { "type": "string" }, "reactQueryFile": { "type": "string" }, "realtimeFile": { "type": "string" }, "realtimeEventHubTopicsImport": { "type": "string", "description": "Optional import for the EventHubTopics type so the realtime client is fully typed. Format: `<path>#<TypeName>` resolved relative to `realtimeFile`. Example: `../types/eventhub-topics.js#EventHubTopics`. If unset, the generated client treats topics as `Record<string, unknown>`." }, "queueWiringsFile": { "type": "string" }, "mcpJsonFile": { "type": "string" }, "nextBackendFile": { "type": "string" }, "nextHTTPFile": { "type": "string" }, "nextBackendTransport": { "type": "string", "enum": ["local", "worker-rpc", "http"], "description": "Transport used by the generated nextBackendFile wrapper.\n- `'local'` (default): function code is loaded in-process via bootstrap +   createSingletonServices. Required for Node/dev runs.\n- `'worker-rpc'`: SSR dispatches every call through an injected `Fetcher`   ({ fetch(req): Promise<Response> }). Function code is NOT bundled into   the SSR worker. Pair with `nextBackendFetcherImport` to point at your   resolver module.\n- `'http'`: SSR dispatches every call through the generated `PikkuFetch`   client. Use this when your Next app should call a separately running   local/server API instead of importing function code in-process." }, "nextBackendFetcherImport": { "type": "string", "description": "Module that exports a `fetcher: Fetcher` (or default export) used by the worker-RPC variant of the next backend wrapper. Resolved relative to `nextBackendFile`. Required when `nextBackendTransport === 'worker-rpc'`." }, "startServerFnsFile": { "type": "string", "description": "Emit a TanStack Start server-function shim into this file. The shim exports `makeApi(): PikkuRPC` — a typed caller over the generated RPC map for use in Start loaders, actions and components. It reads the API base URL from `import.meta.env.VITE_API_URL` (throws if unset). Requires `rpcWiringsFile` (where the `PikkuRPC` class is generated)." } }, "additionalProperties": false }, "emailTemplatesDir": { "type": "string", "description": "Directory containing email templates, locales, partials, and theme.json." }, "authFile": { "type": "string", "description": "Path to write the generated Better Auth wiring file (auth.gen.ts). Must be within srcDirectories so wireSecret calls are picked up by the inspector. Example: \"src/auth.gen.ts\"" }, "authTypesFile": { "type": "string", "description": "Path to write the generated typed `pikkuBetterAuth` re-export (auth.types.ts). Defaults to `{outDir}/auth/auth.types.ts`. Re-exported from `#pikku` so user code can `import { pikkuBetterAuth } from '#pikku'` with project-typed services." }, "authMetaJsonFile": { "type": "string", "description": "Path to write the generated Better Auth metadata (auth-meta.gen.json) — the enabled social providers and plugins the console SSO page reads via getAuthProviders. Defaults to `{outDir}/auth/pikku-auth-meta.gen.json`." }, "openAPI": { "type": "object", "properties": { "outputFile": { "type": "string" }, "additionalInfo": { "$ref": "#/definitions/OpenAPISpecInfo" } }, "required": ["outputFile", "additionalInfo"], "additionalProperties": false }, "schema": { "type": "object", "properties": { "additionalProperties": { "type": "boolean" }, "supportsImportAttributes": { "type": "boolean" } }, "additionalProperties": false }, "db": { "type": "object", "properties": { "engine": { "type": "string", "enum": ["sqlite", "postgres"] }, "pgVersion": { "type": "number" } }, "additionalProperties": false }, "cli": { "type": "object", "properties": { "entrypoints": { "type": "object", "additionalProperties": { "anyOf": [{ "type": "string" }, { "type": "object", "properties": { "type": { "type": "string", "const": "local" }, "path": { "type": "string" } }, "required": ["type", "path"], "additionalProperties": false }, { "type": "object", "properties": { "type": { "type": "string", "const": "channel" }, "name": { "type": "string" }, "route": { "type": "string" }, "wirePath": { "type": "string" }, "path": { "type": "string" } }, "required": ["type", "wirePath"], "additionalProperties": false }, { "type": "array", "items": { "anyOf": [{ "type": "string" }, { "type": "object", "properties": { "type": { "type": "string", "const": "local" }, "path": { "type": "string" } }, "required": ["type", "path"], "additionalProperties": false }, { "type": "object", "properties": { "type": { "type": "string", "const": "channel" }, "name": { "type": "string" }, "route": { "type": "string" }, "wirePath": { "type": "string" }, "path": { "type": "string" } }, "required": ["type", "wirePath"], "additionalProperties": false }] } }] } } }, "additionalProperties": false }, "workflows": { "type": "object", "properties": { "orchestratorQueue": { "type": "string" }, "workerQueue": { "type": "string" } }, "additionalProperties": false }, "scenarios": { "type": "object", "properties": { "actors": { "type": "object", "additionalProperties": { "type": "object", "properties": { "email": { "type": "string" }, "name": { "type": "string" }, "jobTitle": { "type": "string" }, "personality": { "type": "string" } }, "required": ["email"], "additionalProperties": false }, "description": "Global scenario actor registry — any scenario can impersonate any actor" }, "environments": { "type": "object", "additionalProperties": { "type": "object", "properties": { "apiUrl": { "type": "string" }, "signInPath": { "type": "string", "description": "Actor sign-in path under apiUrl. Default: /auth/sign-in/actor" }, "rpcPath": { "type": "string", "description": "Exposed-RPC prefix under apiUrl. Default: /rpc" } }, "required": ["apiUrl"], "additionalProperties": false }, "description": "Environments `pikku scenario run <environment>` can target; the actor secret comes from SCENARIO_ACTOR_SECRET, never config" } }, "additionalProperties": false }, "scaffold": { "type": "object", "properties": { "addonDir": { "type": "string" }, "functionDir": { "type": "string" }, "wiringDir": { "type": "string" }, "middlewareDir": { "type": "string" }, "permissionDir": { "type": "string" }, "pikkuDir": { "type": "string" }, "graph": { "type": "boolean", "description": "Wire the pikku addon-graph package so pikkuWorkflowGraph can reference its native transforms like graph:editFields." }, "rpc": { "$ref": "#/definitions/PikkuScaffoldFeature" }, "console": { "$ref": "#/definitions/PikkuScaffoldFeature" }, "scenarios": { "$ref": "#/definitions/PikkuScaffoldFeature" }, "userAdmin": { "$ref": "#/definitions/PikkuScaffoldFeature", "description": "Ban, delete, session-revocation and set-password functions wrapping better-auth's admin() endpoints. Requires that plugin to be wired — codegen fails if it is not." }, "agent": { "$ref": "#/definitions/PikkuScaffoldFeature" }, "workflow": { "$ref": "#/definitions/PikkuScaffoldFeature" }, "events": { "$ref": "#/definitions/PikkuScaffoldFeature" }, "remoteRpc": { "$ref": "#/definitions/PikkuScaffoldFeature" }, "webhook": { "type": "boolean", "description": "The outgoing webhook delivery worker exposes no endpoint of its own, so it has no auth dimension — it is on or off." } }, "additionalProperties": false }, "addons": { "type": "object", "properties": { "addonDir": { "type": "string" } }, "additionalProperties": false, "description": "Community-registry addons installed via `pikku fabric addon add`. The source is copied into the project shadcn-style; each lands in `<addonDir>/<name>/` and the dir is registered as a yarn workspace so `wireAddon({ package })` resolves it by name. `addonDir` defaults to `addons` (top-level, outside the app's TS scan). Install provenance is tracked in pikku-addons.json." }, "tests": { "type": "object", "properties": { "outputDir": { "type": "string" } }, "additionalProperties": false }, "forceRequiredServices": { "type": "array", "items": { "type": "string" } }, "schemasFromTypes": { "type": "array", "items": { "type": "string" } }, "stateOutput": { "type": "string" }, "stateInput": { "type": "string" }, "verboseMeta": { "type": "boolean" }, "security": { "type": "boolean", "description": "Run the data-classification security lint (scans function return types for Private/Pii/Secret leaks). Off by default — it forces expensive return-type inference on every function and is not part of codegen. Enable here to always run it, or per-invocation via `pikku all --security`. Pair with `failOnError` to gate a build/CI on leaks." }, "tsc": { "type": "boolean", "description": "After codegen, run a real `tsc --noEmit` over the project's tsconfig and fail on type errors. `tsc` prints full diagnostics with code frames; `tscSummary` prints a compact one-line-per-error render (no code frames, capped) that's cheap for AI agents / CI logs. Off by default; enable per invocation via `pikku all --tsc` / `--tsc-summary`." }, "tscSummary": { "type": "boolean" }, "diff": { "type": "boolean", "description": "After a successful codegen run, emit a structural diff of the generated `.pikku` meta (functions/wirings/workflows/emails added/removed/changed vs the state before this run) as a `PIKKU_DIFF <json>` line on stdout. Only emitted on exit 0. Off by default; enable per invocation via `pikku all --diff`. Consumed by the sandbox \"what changed\" build card." }, "lint": { "type": "object", "properties": { "servicesNotDestructured": { "type": "string", "enum": ["off", "warn", "error"] }, "wiresNotDestructured": { "type": "string", "enum": ["off", "warn", "error"] }, "functionDynamicImport": { "type": "string", "enum": ["off", "warn", "error"] } }, "additionalProperties": false }, "addonMetaJsonFile": { "type": "string" }, "globalHTTPPrefix": { "type": "string" }, "binary": { "type": "object", "properties": { "entrypoint": { "type": "string" }, "output": { "type": "string" }, "targets": { "type": "array", "items": { "type": "string" } } }, "required": ["entrypoint", "output"], "additionalProperties": false }, "deploy": { "type": "object", "properties": { "providers": { "type": "object", "additionalProperties": { "type": "string" } }, "defaultProvider": { "type": "string" }, "serverlessIncompatible": { "type": "array", "items": { "type": "string" } }, "defaultTarget": { "type": "string", "enum": ["serverless", "server"], "description": "Default deploy target for functions that don't declare an explicit `deploy` flag and don't use a serverless-incompatible service. Defaults to 'serverless'." } }, "required": ["providers"], "additionalProperties": false }, "namedFilters": { "type": "object", "additionalProperties": { "$ref": "#/definitions/InspectorFilters" }, "description": "Named filter presets keyed by name, used via CLI --filter <name>." }, "filters": { "$ref": "#/definitions/InspectorFilters" } }, "required": ["addonTypesFile", "agentMapDeclarationFile", "agentTypesFile", "agentWiringMetaFile", "agentWiringMetaJsonFile", "agentWiringsFile", "bootstrapFile", "channelContractsMetaFile", "channelContractsMetaJsonFile", "channelsMapDeclarationFile", "channelsTypesFile", "channelsWiringFile", "channelsWiringMetaFile", "channelsWiringMetaJsonFile", "cliBootstrapFile", "cliContractsMetaFile", "cliContractsMetaJsonFile", "cliTypesFile", "cliWiringMetaFile", "cliWiringMetaJsonFile", "cliWiringsFile", "configDir", "consoleFunctionsFile", "credentialsFile", "credentialsMetaJsonFile", "eventsChannelFile", "filters", "functionTypesFile", "functionsFile", "functionsMetaFile", "functionsMetaJsonFile", "gatewaysWiringFile", "gatewaysWiringMetaFile", "gatewaysWiringMetaJsonFile", "httpContractsMetaFile", "httpContractsMetaJsonFile", "httpMapDeclarationFile", "httpTypesFile", "httpWiringMetaFile", "httpWiringMetaJsonFile", "httpWiringsFile", "mcpJsonFile", "mcpTypesFile", "mcpWiringsFile", "mcpWiringsMetaFile", "mcpWiringsMetaJsonFile", "middlewareFile", "middlewareGroupsMetaJsonFile", "nodeTypesFile", "outDir", "packageFile", "packageMappings", "permissionsFile", "permissionsGroupsMetaJsonFile", "publicAgentFile", "publicRpcFile", "queueMapDeclarationFile", "queueTypesFile", "queueWorkersWiringFile", "queueWorkersWiringMetaFile", "queueWorkersWiringMetaJsonFile", "rootDir", "rpcInternalMapDeclarationFile", "rpcInternalWiringMetaFile", "rpcInternalWiringMetaJsonFile", "rpcMapDeclarationFile", "rpcRemoteMapDeclarationFile", "scenarioActorsFile", "scenariosFunctionsFile", "schedulersTypesFile", "schedulersWiringFile", "schedulersWiringMetaFile", "schedulersWiringMetaJsonFile", "schemaDirectory", "scopeTypesFile", "scopesFile", "scopesMetaJsonFile", "secretTypesFile", "secretsFile", "secretsMetaJsonFile", "servicesFile", "srcDirectories", "triggerSourcesMetaFile", "triggerSourcesMetaJsonFile", "triggersTypesFile", "triggersWiringFile", "triggersWiringMetaFile", "triggersWiringMetaJsonFile", "tsconfig", "typesDeclarationFile", "variableTypesFile", "variablesFile", "variablesMetaJsonFile", "workflowMapDeclarationFile", "workflowMetaDir", "workflowRoutesFile", "workflowTypesFile", "workflowsWiringFile", "workflowsWiringMetaFile", "workflowsWorkersFile"], "definitions": { "OpenAPISpecInfo": { "type": "object", "properties": { "info": { "type": "object", "properties": { "title": { "type": "string" }, "version": { "type": "string" }, "description": { "type": "string" }, "termsOfService": { "type": "string" }, "contact": { "type": "object", "properties": { "name": { "type": "string" }, "url": { "type": "string" }, "email": { "type": "string" } }, "additionalProperties": false }, "license": { "type": "object", "properties": { "name": { "type": "string" }, "url": { "type": "string" } }, "required": ["name"], "additionalProperties": false } }, "required": ["title", "version", "description"], "additionalProperties": false }, "servers": { "type": "array", "items": { "type": "object", "properties": { "url": { "type": "string" }, "description": { "type": "string" } }, "required": ["url"], "additionalProperties": false } }, "tags": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "description": { "type": "string" } }, "required": ["name"], "additionalProperties": false } }, "externalDocs": { "type": "object", "properties": { "description": { "type": "string" }, "url": { "type": "string" } }, "required": ["url"], "additionalProperties": false }, "securitySchemes": { "type": "object" }, "security": { "type": "array", "items": { "type": "object", "additionalProperties": { "type": "array", "items": {} } } } }, "required": ["info", "servers"], "additionalProperties": false }, "PikkuScaffoldFeature": { "type": ["string", "boolean"], "enum": ["auth", "no-auth", false] }, "InspectorFilters": { "type": "object", "properties": { "names": { "type": "array", "items": { "type": "string" } }, "tags": { "type": "array", "items": { "type": "string" } }, "wires": { "type": "array", "items": { "type": "string" } }, "directories": { "type": "array", "items": { "type": "string" } }, "httpRoutes": { "type": "array", "items": { "type": "string" } }, "httpMethods": { "type": "array", "items": { "type": "string" } }, "excludeNames": { "type": "array", "items": { "type": "string" } }, "excludeTags": { "type": "array", "items": { "type": "string" } }, "excludeWires": { "type": "array", "items": { "type": "string" } }, "excludeDirectories": { "type": "array", "items": { "type": "string" } }, "excludeHttpRoutes": { "type": "array", "items": { "type": "string" } }, "excludeHttpMethods": { "type": "array", "items": { "type": "string" } }, "target": { "type": "array", "items": { "type": "string", "enum": ["serverless", "server"] } }, "excludeTarget": { "type": "array", "items": { "type": "string", "enum": ["serverless", "server"] } }, "serverlessIncompatible": { "type": "array", "items": { "type": "string" } }, "defaultTarget": { "type": "string", "enum": ["serverless", "server"] } }, "additionalProperties": false } } }

package/dist/.pikku/schemas/schemas/PikkuUserAdminFunctionsOutput.schema.json

@@ -0,0 +1 @@
+{ "$schema": "http://json-schema.org/draft-07/schema#", "type": "boolean", "enum": [false, true], "definitions": {} }

package/dist/.pikku/scopes/pikku-scope-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.85
+ * This file was generated by @pikku/cli@0.12.86
  */
 export { wireScope } from '@pikku/core/scope';
 export type { CoreScopes, CoreScopeNode, FlatScope, ScopeDefinitionMeta, ScopeDefinitionsMeta } from '@pikku/core/scope';

package/dist/.pikku/scopes/pikku-scope-types.gen.js

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.85
+ * This file was generated by @pikku/cli@0.12.86
  */
 export { wireScope } from '@pikku/core/scope';

package/dist/.pikku/scopes/pikku-scopes.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.85
+ * This file was generated by @pikku/cli@0.12.86
  */
 /**
  * This file was generated by the @pikku/cli

package/dist/.pikku/secrets/pikku-secret-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.85
+ * This file was generated by @pikku/cli@0.12.86
  */
 export { wireSecret } from '@pikku/core/secret';
 export type { CoreSecret, SecretDefinitionMeta, SecretDefinitionsMeta } from '@pikku/core/secret';

package/dist/.pikku/secrets/pikku-secret-types.gen.js

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.85
+ * This file was generated by @pikku/cli@0.12.86
  */
 export { wireSecret } from '@pikku/core/secret';

package/dist/.pikku/secrets/pikku-secrets.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.85
+ * This file was generated by @pikku/cli@0.12.86
  */
 import { TypedSecretService as CoreTypedSecretService } from '@pikku/core/services';
 import type { SecretService } from '@pikku/core/services';

package/dist/.pikku/secrets/pikku-secrets.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.85
+ * This file was generated by @pikku/cli@0.12.86
  */
 import { TypedSecretService as CoreTypedSecretService } from '@pikku/core/services';
 import secretsMeta from './pikku-secrets-meta.gen.json' with { type: 'json' };

package/dist/.pikku/trigger/pikku-trigger-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.85
+ * This file was generated by @pikku/cli@0.12.86
  */
 /**
  * Trigger-specific type definitions for tree-shaking optimization

package/dist/.pikku/trigger/pikku-trigger-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.85
+ * This file was generated by @pikku/cli@0.12.86
  */
 /**
  * Trigger-specific type definitions for tree-shaking optimization

package/dist/.pikku/variables/pikku-variable-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.85
+ * This file was generated by @pikku/cli@0.12.86
  */
 export { wireVariable } from '@pikku/core/variable';
 export type { CoreVariable, VariableDefinitionMeta, VariableDefinitionsMeta } from '@pikku/core/variable';

package/dist/.pikku/variables/pikku-variable-types.gen.js

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.85
+ * This file was generated by @pikku/cli@0.12.86
  */
 export { wireVariable } from '@pikku/core/variable';

package/dist/.pikku/variables/pikku-variables.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.85
+ * This file was generated by @pikku/cli@0.12.86
  */
 import { TypedVariablesService as CoreTypedVariablesService } from '@pikku/core/services';
 import type { VariablesService } from '@pikku/core/services';

package/dist/.pikku/variables/pikku-variables.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.85
+ * This file was generated by @pikku/cli@0.12.86
  */
 import { TypedVariablesService as CoreTypedVariablesService } from '@pikku/core/services';
 import variablesMeta from './pikku-variables-meta.gen.json' with { type: 'json' };

package/dist/.pikku/workflow/meta/allWorkflow.gen.json

@@ -249,9 +249,15 @@
         "Scenario functions": {
             "nodeId": "Scenario functions",
             "rpcName": "pikkuScenarioFunctions",
-            "next": "Events scaffold",
+            "next": "User admin functions",
             "stepHash": "2800aff85a24"
         },
+        "User admin functions": {
+            "nodeId": "User admin functions",
+            "rpcName": "pikkuUserAdminFunctions",
+            "next": "Events scaffold",
+            "stepHash": "831f37173651"
+        },
         "Events scaffold": {
             "nodeId": "Events scaffold",
             "rpcName": "pikkuEventsScaffold",
@@ -604,5 +610,5 @@
     "entryNodeIds": [
         "Bootstrap inspect"
     ],
-    "graphHash": "c0662311ac02"
+    "graphHash": "2501ebf2e7ce"
 }

package/dist/.pikku/workflow/pikku-workflow-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.85
+ * This file was generated by @pikku/cli@0.12.86
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import { template } from '@pikku/core/workflow';

package/dist/.pikku/workflow/pikku-workflow-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.85
+ * This file was generated by @pikku/cli@0.12.86
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import { template } from '@pikku/core/workflow';

package/dist/.pikku/workflow/pikku-workflow-wirings-meta.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.85
+ * This file was generated by @pikku/cli@0.12.86
  */
 import { pikkuState } from '@pikku/core/internal';
 import allWorkflowMeta from './meta/allWorkflow.gen.json' with { type: 'json' };

package/dist/.pikku/workflow/pikku-workflow-wirings.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.85
+ * This file was generated by @pikku/cli@0.12.86
  */
 import { addWorkflow } from '@pikku/core/workflow';
 import './pikku-workflow-wirings-meta.gen.js';

package/dist/bin/pikku-bin.mjs

@@ -11,8 +11,8 @@ async function checkForUpdate() {
     })
     if (!res.ok) return
     const { version: latest } = await res.json()
-    if (latest !== '0.12.85') {
-      process.stderr.write(`\n  Update available  0.12.85 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
+    if (latest !== '0.12.86') {
+      process.stderr.write(`\n  Update available  0.12.86 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
     }
   } catch {}
 }

package/dist/src/fabric/fabric-commands.d.ts

@@ -99,6 +99,7 @@ export declare const fabricCommands: {
         token?: string | undefined;
         apiUrl?: string | undefined;
         consoleUrl?: string | undefined;
+        browser?: boolean | undefined;
     }, {
         ok: boolean;
         apiUrl: string;
@@ -107,6 +108,7 @@ export declare const fabricCommands: {
         token?: string | undefined;
         apiUrl?: string | undefined;
         consoleUrl?: string | undefined;
+        browser?: boolean | undefined;
     }, {
         ok: boolean;
         apiUrl: string;
@@ -115,6 +117,7 @@ export declare const fabricCommands: {
         token?: string | undefined;
         apiUrl?: string | undefined;
         consoleUrl?: string | undefined;
+        browser?: boolean | undefined;
     }, {
         ok: boolean;
         apiUrl: string;
@@ -661,7 +664,7 @@ export declare const fabricCommands: {
             }, {
                 proxyUrl: string;
                 apiKey: string;
-                format: "json" | "text" | "shell" | "env";
+                format: "json" | "text" | "env" | "shell";
             }, "rpc" | "session", import("../../.pikku/pikku-types.gen.js").PikkuFunctionSessionless<{
                 shell?: boolean | undefined;
                 env?: boolean | undefined;
@@ -669,7 +672,7 @@ export declare const fabricCommands: {
             }, {
                 proxyUrl: string;
                 apiKey: string;
-                format: "json" | "text" | "shell" | "env";
+                format: "json" | "text" | "env" | "shell";
             }, "rpc" | "session", import("../../.pikku/pikku-types.gen.js").WiredServices> | import("../../.pikku/pikku-types.gen.js").PikkuFunction<{
                 shell?: boolean | undefined;
                 env?: boolean | undefined;
@@ -677,7 +680,7 @@ export declare const fabricCommands: {
             }, {
                 proxyUrl: string;
                 apiKey: string;
-                format: "json" | "text" | "shell" | "env";
+                format: "json" | "text" | "env" | "shell";
             }, "rpc" | "session", import("../../.pikku/pikku-types.gen.js").WiredServices>, undefined, undefined>, import("../../.pikku/pikku-types.gen.js").PikkuMiddleware, (services: import("../../types/application-types.js").SingletonServices, data: any, session?: import("../../types/application-types.js").UserSession | undefined) => void | Promise<void>, string>;
         };
     };

package/dist/src/fabric/fabric-commands.js

@@ -79,6 +79,10 @@ export const fabricCommands = defineCLICommands({
             },
             apiUrl: { description: 'Override the fabric-api URL for this login' },
             consoleUrl: { description: 'Override the console URL the browser opens' },
+            browser: {
+                description: 'Open the sign-in link automatically (--no-browser to just print it)',
+                default: true,
+            },
         },
     }),
     init: pikkuCLICommand({

package/dist/src/fabric/functions/llm-key.function.d.ts

@@ -10,8 +10,8 @@ export declare const FabricLLMKeyOutput: z.ZodObject<{
     format: z.ZodEnum<{
         json: "json";
         text: "text";
-        shell: "shell";
         env: "env";
+        shell: "shell";
     }>;
 }, z.core.$strip>;
 export declare const FabricLLMKey: import("../../../.pikku/pikku-types.gen.js").PikkuFunctionConfig<{
@@ -21,7 +21,7 @@ export declare const FabricLLMKey: import("../../../.pikku/pikku-types.gen.js").
 }, {
     proxyUrl: string;
     apiKey: string;
-    format: "json" | "text" | "shell" | "env";
+    format: "json" | "text" | "env" | "shell";
 }, "rpc" | "session", import("../../../.pikku/pikku-types.gen.js").PikkuFunctionSessionless<{
     shell?: boolean | undefined;
     env?: boolean | undefined;
@@ -29,7 +29,7 @@ export declare const FabricLLMKey: import("../../../.pikku/pikku-types.gen.js").
 }, {
     proxyUrl: string;
     apiKey: string;
-    format: "json" | "text" | "shell" | "env";
+    format: "json" | "text" | "env" | "shell";
 }, "rpc" | "session", import("../../../.pikku/pikku-types.gen.js").WiredServices> | import("../../../.pikku/pikku-types.gen.js").PikkuFunction<{
     shell?: boolean | undefined;
     env?: boolean | undefined;
@@ -37,7 +37,7 @@ export declare const FabricLLMKey: import("../../../.pikku/pikku-types.gen.js").
 }, {
     proxyUrl: string;
     apiKey: string;
-    format: "json" | "text" | "shell" | "env";
+    format: "json" | "text" | "env" | "shell";
 }, "rpc" | "session", import("../../../.pikku/pikku-types.gen.js").WiredServices>, undefined, undefined>;
 export declare const renderLLMKey: (_services: unknown, data: {
     proxyUrl: string;

package/dist/src/fabric/functions/login.function.d.ts

@@ -4,6 +4,7 @@ export declare const FabricLoginInput: z.ZodObject<{
     token: z.ZodOptional<z.ZodString>;
     apiUrl: z.ZodOptional<z.ZodString>;
     consoleUrl: z.ZodOptional<z.ZodString>;
+    browser: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 export declare const FabricLoginOutput: z.ZodObject<{
     ok: z.ZodBoolean;
@@ -20,6 +21,7 @@ export declare const FabricLogin: import("../../../.pikku/pikku-types.gen.js").P
     token?: string | undefined;
     apiUrl?: string | undefined;
     consoleUrl?: string | undefined;
+    browser?: boolean | undefined;
 }, {
     ok: boolean;
     apiUrl: string;
@@ -28,6 +30,7 @@ export declare const FabricLogin: import("../../../.pikku/pikku-types.gen.js").P
     token?: string | undefined;
     apiUrl?: string | undefined;
     consoleUrl?: string | undefined;
+    browser?: boolean | undefined;
 }, {
     ok: boolean;
     apiUrl: string;
@@ -36,6 +39,7 @@ export declare const FabricLogin: import("../../../.pikku/pikku-types.gen.js").P
     token?: string | undefined;
     apiUrl?: string | undefined;
     consoleUrl?: string | undefined;
+    browser?: boolean | undefined;
 }, {
     ok: boolean;
     apiUrl: string;

package/dist/src/fabric/functions/login.function.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { spawn } from 'node:child_process';
 import { pikkuSessionlessFunc } from '../../../.pikku/pikku-types.gen.js';
 import { readAuthFile, writeAuthFile, resolveApiContext, } from '../lib/config.js';
 import { getFabricRPC } from '../lib/http.js';
@@ -8,6 +9,7 @@ export const FabricLoginInput = z.object({
     token: z.string().optional(),
     apiUrl: z.string().optional(),
     consoleUrl: z.string().optional(),
+    browser: z.boolean().optional(),
 });
 export const FabricLoginOutput = z.object({
     ok: z.boolean(),
@@ -15,6 +17,33 @@ export const FabricLoginOutput = z.object({
 });
 const POLL_INTERVAL_MS = 2000;
 const POLL_TIMEOUT_MS = 5 * 60 * 1000;
+/**
+ * Best-effort browser launch. The URL is always printed first, so a failure
+ * here costs the user a click, not the login — hence a warning rather than a
+ * throw. Skipped over SSH and in CI, where opening a browser on the wrong
+ * machine is worse than not opening one.
+ */
+function openBrowser(url) {
+    if (process.env.SSH_TTY || process.env.CI)
+        return;
+    const cmd = process.platform === 'darwin'
+        ? 'open'
+        : process.platform === 'win32'
+            ? 'start'
+            : 'xdg-open';
+    try {
+        const child = spawn(cmd, [url], {
+            stdio: 'ignore',
+            detached: true,
+            shell: process.platform === 'win32',
+        });
+        child.on('error', (err) => console.warn(`[fabric] could not open a browser (${err.message}) — open the URL above.`));
+        child.unref();
+    }
+    catch (err) {
+        console.warn(`[fabric] could not open a browser (${err.message}) — open the URL above.`);
+    }
+}
 /**
  * Device-authorization-style CLI login. Server mints a short code, user types
  * it on the console's /cli-auth page (logging in via Better Auth if not already
@@ -25,7 +54,7 @@ export const FabricLogin = pikkuSessionlessFunc({
     description: 'Authenticate the CLI against fabric-api via a one-time code.',
     input: FabricLoginInput,
     output: FabricLoginOutput,
-    func: async (_services, { apiKey, token, apiUrl: apiUrlOverride, consoleUrl: consoleUrlOverride }) => {
+    func: async (_services, { apiKey, token, apiUrl: apiUrlOverride, consoleUrl: consoleUrlOverride, browser, }) => {
         const ctx = await resolveApiContext({ apiUrlOverride });
         const apiUrl = ctx.apiUrl;
         // Static-token fast paths — useful for CI and "I already have a token".
@@ -40,14 +69,21 @@ export const FabricLogin = pikkuSessionlessFunc({
         const consoleUrl = (consoleUrlOverride ?? deriveConsoleUrl(apiUrl)).replace(/\/$/, '');
         const rpc = getFabricRPC({ apiUrl, token: null });
         const { code, expiresAt } = await rpc.invoke('requestCliAuth');
+        // Deliberately no ?code= — the browser opens the page, but the code is
+        // typed. That hand-off is what proves the person authorizing the token is
+        // the person who ran this command; a link carrying its own code is a
+        // one-click grant for anyone who can put it in front of a signed-in user.
+        const authUrl = `${consoleUrl}/cli-auth`;
         console.log('');
-        console.log('  Enter this code at:');
-        console.log(`    ${consoleUrl}/cli-auth`);
+        console.log('  Enter this code to finish signing in:');
+        console.log(`    ${code}`);
         console.log('');
-        console.log(`  Code: ${code}`);
+        console.log(`  at ${authUrl}`);
         console.log(`  (expires ${new Date(expiresAt).toLocaleTimeString()})`);
         console.log('');
         console.log('  Waiting for confirmation…');
+        if (browser !== false)
+            openBrowser(authUrl);
         const deadline = Date.now() + POLL_TIMEOUT_MS;
         while (Date.now() < deadline) {
             await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
@@ -55,6 +91,11 @@ export const FabricLogin = pikkuSessionlessFunc({
             if (result.status === 'expired') {
                 throw new Error('Code expired before confirmation. Run `pikku fabric login` again.');
             }
+            // Distinct from expired: the user pressed Cancel, so stop immediately
+            // rather than sitting here until the TTL runs out.
+            if (result.status === 'rejected') {
+                throw new Error('Sign-in was cancelled in the browser. Run `pikku fabric login` again to retry.');
+            }
             if (result.status === 'confirmed' && result.token) {
                 const auth = await readAuthFile();
                 auth.tokens[apiUrl] = result.token;

package/dist/src/functions/wirings/ai-agent/pikku-command-public-agent.js

@@ -2,12 +2,16 @@ import { pikkuSessionlessFunc } from '#pikku';
 import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
+import { removeLegacyScaffoldFile } from '../../../utils/remove-legacy-scaffold-file.js';
 import { serializePublicAgent } from './serialize-public-agent.js';
 export const pikkuPublicAgent = pikkuSessionlessFunc({
     func: async ({ logger, config }) => {
-        if (config.scaffold?.agent) {
+        if (config.scaffold?.agent && config.publicAgentSchemasFile) {
             const pathToPikkuTypes = getFileImportRelativePath(config.publicAgentFile, config.typesDeclarationFile, config.packageMappings);
-            await writeFileInDir(logger, config.publicAgentFile, serializePublicAgent(pathToPikkuTypes, config.scaffold.agent === 'auth', config.globalHTTPPrefix || ''));
+            const { schemas, functions } = serializePublicAgent(pathToPikkuTypes, config.scaffold.agent === 'auth', config.globalHTTPPrefix || '');
+            await writeFileInDir(logger, config.publicAgentSchemasFile, schemas);
+            await writeFileInDir(logger, config.publicAgentFile, functions);
+            await removeLegacyScaffoldFile(config.publicAgentFile);
             return true;
         }
         return false;

package/dist/src/functions/wirings/ai-agent/serialize-public-agent.d.ts

@@ -1 +1,5 @@
-export declare const serializePublicAgent: (pathToPikkuTypes: string, requireAuth?: boolean, globalHTTPPrefix?: string) => string;
+export interface PublicAgentGenOutput {
+    schemas: string;
+    functions: string;
+}
+export declare const serializePublicAgent: (pathToPikkuTypes: string, requireAuth?: boolean, globalHTTPPrefix?: string) => PublicAgentGenOutput;