@pikku/cli 0.12.85 → 0.12.88

package/dist/src/fabric/functions/login.function.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { spawn } from 'node:child_process';
 import { pikkuSessionlessFunc } from '../../../.pikku/pikku-types.gen.js';
 import { readAuthFile, writeAuthFile, resolveApiContext, } from '../lib/config.js';
 import { getFabricRPC } from '../lib/http.js';
@@ -8,6 +9,7 @@ export const FabricLoginInput = z.object({
     token: z.string().optional(),
     apiUrl: z.string().optional(),
     consoleUrl: z.string().optional(),
+    browser: z.boolean().optional(),
 });
 export const FabricLoginOutput = z.object({
     ok: z.boolean(),
@@ -15,6 +17,33 @@ export const FabricLoginOutput = z.object({
 });
 const POLL_INTERVAL_MS = 2000;
 const POLL_TIMEOUT_MS = 5 * 60 * 1000;
+/**
+ * Best-effort browser launch. The URL is always printed first, so a failure
+ * here costs the user a click, not the login — hence a warning rather than a
+ * throw. Skipped over SSH and in CI, where opening a browser on the wrong
+ * machine is worse than not opening one.
+ */
+function openBrowser(url) {
+    if (process.env.SSH_TTY || process.env.CI)
+        return;
+    const cmd = process.platform === 'darwin'
+        ? 'open'
+        : process.platform === 'win32'
+            ? 'start'
+            : 'xdg-open';
+    try {
+        const child = spawn(cmd, [url], {
+            stdio: 'ignore',
+            detached: true,
+            shell: process.platform === 'win32',
+        });
+        child.on('error', (err) => console.warn(`[fabric] could not open a browser (${err.message}) — open the URL above.`));
+        child.unref();
+    }
+    catch (err) {
+        console.warn(`[fabric] could not open a browser (${err.message}) — open the URL above.`);
+    }
+}
 /**
  * Device-authorization-style CLI login. Server mints a short code, user types
  * it on the console's /cli-auth page (logging in via Better Auth if not already
@@ -25,7 +54,7 @@ export const FabricLogin = pikkuSessionlessFunc({
     description: 'Authenticate the CLI against fabric-api via a one-time code.',
     input: FabricLoginInput,
     output: FabricLoginOutput,
-    func: async (_services, { apiKey, token, apiUrl: apiUrlOverride, consoleUrl: consoleUrlOverride }) => {
+    func: async (_services, { apiKey, token, apiUrl: apiUrlOverride, consoleUrl: consoleUrlOverride, browser, }) => {
         const ctx = await resolveApiContext({ apiUrlOverride });
         const apiUrl = ctx.apiUrl;
         // Static-token fast paths — useful for CI and "I already have a token".
@@ -40,14 +69,21 @@ export const FabricLogin = pikkuSessionlessFunc({
         const consoleUrl = (consoleUrlOverride ?? deriveConsoleUrl(apiUrl)).replace(/\/$/, '');
         const rpc = getFabricRPC({ apiUrl, token: null });
         const { code, expiresAt } = await rpc.invoke('requestCliAuth');
+        // Deliberately no ?code= — the browser opens the page, but the code is
+        // typed. That hand-off is what proves the person authorizing the token is
+        // the person who ran this command; a link carrying its own code is a
+        // one-click grant for anyone who can put it in front of a signed-in user.
+        const authUrl = `${consoleUrl}/cli-auth`;
         console.log('');
-        console.log('  Enter this code at:');
-        console.log(`    ${consoleUrl}/cli-auth`);
+        console.log('  Enter this code to finish signing in:');
+        console.log(`    ${code}`);
         console.log('');
-        console.log(`  Code: ${code}`);
+        console.log(`  at ${authUrl}`);
         console.log(`  (expires ${new Date(expiresAt).toLocaleTimeString()})`);
         console.log('');
         console.log('  Waiting for confirmation…');
+        if (browser !== false)
+            openBrowser(authUrl);
         const deadline = Date.now() + POLL_TIMEOUT_MS;
         while (Date.now() < deadline) {
             await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
@@ -55,6 +91,11 @@ export const FabricLogin = pikkuSessionlessFunc({
             if (result.status === 'expired') {
                 throw new Error('Code expired before confirmation. Run `pikku fabric login` again.');
             }
+            // Distinct from expired: the user pressed Cancel, so stop immediately
+            // rather than sitting here until the TTL runs out.
+            if (result.status === 'rejected') {
+                throw new Error('Sign-in was cancelled in the browser. Run `pikku fabric login` again to retry.');
+            }
             if (result.status === 'confirmed' && result.token) {
                 const auth = await readAuthFile();
                 auth.tokens[apiUrl] = result.token;

package/dist/src/fabric/functions/validate.function.js

@@ -605,8 +605,12 @@ export async function runValidate(startDir = process.cwd()) {
                 const pikkuGenDir = join(fnDir, '.pikku');
                 const typesGenTs = join(pikkuGenDir, 'pikku-types.gen.ts');
                 const typesGenJs = join(pikkuGenDir, 'pikku-types.gen.js');
+                // A warning, not an error: the wrapper is gitignored and recreated by
+                // the sandbox entrypoint and `fabric smoke`, so a freshly cloned or
+                // freshly scaffolded project never has it. As an error, "validate must
+                // pass clean" was unachievable from a clean checkout.
                 if (existsSync(typesGenTs) && !existsSync(typesGenJs)) {
-                    e('pikku-types-js-wrapper-missing', 'packages/functions/.pikku/pikku-types.gen.js is missing — the sandbox runs pikku dev via bare Node.js, which cannot load .ts files; without the .js wrapper it crashes with "Cannot find module \'#pikku/pikku-types.gen.js\'" on every restart', typesGenTs, lines('Create packages/functions/.pikku/pikku-types.gen.js:', "  import './pikku-types.gen.ts';", "  export * from './pikku-types.gen.ts';", 'Or run `pikku fabric smoke` to test the full boot locally (it creates the wrappers).', 'This file is gitignored — it must be recreated after every `pikku all` run.'));
+                    w('pikku-types-js-wrapper-missing', 'packages/functions/.pikku/pikku-types.gen.js is missing — the sandbox runs pikku dev via bare Node.js, which cannot load .ts files; without the .js wrapper it crashes with "Cannot find module \'#pikku/pikku-types.gen.js\'" on every restart', typesGenTs, lines('Create packages/functions/.pikku/pikku-types.gen.js:', "  import './pikku-types.gen.ts';", "  export * from './pikku-types.gen.ts';", 'Or run `pikku fabric smoke` to test the full boot locally (it creates the wrappers).', 'This file is gitignored — it must be recreated after every `pikku all` run.'));
                 }
             }
             const fnAllDeps = {
@@ -655,7 +659,13 @@ export async function runValidate(startDir = process.cwd()) {
             const usesLibsql = servicesText.includes('@pikku/kysely-sqlite') ||
                 servicesText.includes('LibsqlWebDialect');
             const usesProcessEnv = /\bprocess\.env\.[A-Z_]/.test(servicesText);
-            if (dbEngine !== 'postgres' && usesKysely && !usesLibsql) {
+            // Only a services.ts that BUILDS its own client can pick the wrong
+            // dialect. The starter template takes kysely from injection (pikku dev
+            // supplies node:sqlite, the Worker supplies libsql) and constructs
+            // nothing — flagging it told every fresh scaffold to import a dialect it
+            // must not use.
+            const constructsKysely = /new\s+Kysely\s*[<(]/.test(servicesText);
+            if (dbEngine !== 'postgres' && usesKysely && constructsKysely && !usesLibsql) {
                 e('services-wrong-db-adapter', 'services.ts uses Kysely but not LibsqlWebDialect — Fabric injects a Turso/libSQL DATABASE_URL at runtime, not a PostgreSQL URL', servicesPath, 'Import LibsqlWebDialect from @pikku/kysely-sqlite and replace the dialect: new Kysely({ dialect: new LibsqlWebDialect({ url: databaseUrl }) })');
             }
             if (usesProcessEnv) {

package/dist/src/fabric/lib/config.d.ts

@@ -42,6 +42,14 @@ export declare function findProjectConfig(startDir?: string): Promise<{
     path: string;
     config: ProjectConfig;
 } | null>;
+/**
+ * Templates ship `pikkufabric.config.json` with a `__PROJECT_ID__` placeholder
+ * so the file's shape is visible before the repo is linked. A placeholder is
+ * not a link: without this, `fabric init` on a fresh scaffold reports
+ * "Already linked: __PROJECT_ID__" and every other command sends the
+ * placeholder to the API as if it were a real id.
+ */
+export declare function isLinkedProjectId(projectId?: string | null): boolean;
 export declare function writeProjectConfig(cwd: string, config: ProjectConfig): Promise<string>;
 export declare function readAuthFile(): Promise<AuthFile>;
 export declare function writeAuthFile(file: AuthFile): Promise<void>;

package/dist/src/fabric/lib/config.js

@@ -19,6 +19,18 @@ export async function findProjectConfig(startDir = process.cwd()) {
         dir = parent;
     }
 }
+/**
+ * Templates ship `pikkufabric.config.json` with a `__PROJECT_ID__` placeholder
+ * so the file's shape is visible before the repo is linked. A placeholder is
+ * not a link: without this, `fabric init` on a fresh scaffold reports
+ * "Already linked: __PROJECT_ID__" and every other command sends the
+ * placeholder to the API as if it were a real id.
+ */
+export function isLinkedProjectId(projectId) {
+    if (!projectId)
+        return false;
+    return !/^__.*__$/.test(projectId);
+}
 export async function writeProjectConfig(cwd, config) {
     const path = join(cwd, projectConfigName);
     await mkdir(dirname(path), { recursive: true });
@@ -57,6 +69,8 @@ export async function resolveApiContext(opts = {}) {
     return {
         apiUrl,
         token: auth.tokens[apiUrl] ?? null,
-        projectId: projectFile?.config.projectId ?? null,
+        projectId: isLinkedProjectId(projectFile?.config.projectId)
+            ? projectFile.config.projectId
+            : null,
     };
 }

package/dist/src/fabric/lib/git.js

@@ -136,8 +136,8 @@ export async function assertNamedBranchDeploySafety(branch, cwd) {
     try {
         head = await localBranchHeadSha(branch, cwd);
     }
-    catch {
-        throw new Error(`Deployment blocked: local branch ${branch} does not exist.\nFetch or create it before deploying.`);
+    catch (error) {
+        throw new Error(`Deployment blocked: local branch ${branch} does not exist (${error.message}).\nFetch or create it before deploying.`);
     }
     const upstream = await upstreamForBranch(branch, cwd);
     if (!upstream) {

package/dist/src/functions/wirings/ai-agent/pikku-command-public-agent.js

@@ -2,12 +2,16 @@ import { pikkuSessionlessFunc } from '#pikku';
 import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
+import { removeLegacyScaffoldFile } from '../../../utils/remove-legacy-scaffold-file.js';
 import { serializePublicAgent } from './serialize-public-agent.js';
 export const pikkuPublicAgent = pikkuSessionlessFunc({
     func: async ({ logger, config }) => {
-        if (config.scaffold?.agent) {
+        if (config.scaffold?.agent && config.publicAgentSchemasFile) {
             const pathToPikkuTypes = getFileImportRelativePath(config.publicAgentFile, config.typesDeclarationFile, config.packageMappings);
-            await writeFileInDir(logger, config.publicAgentFile, serializePublicAgent(pathToPikkuTypes, config.scaffold.agent === 'auth', config.globalHTTPPrefix || ''));
+            const { schemas, functions } = serializePublicAgent(pathToPikkuTypes, config.scaffold.agent === 'auth', config.globalHTTPPrefix || '');
+            await writeFileInDir(logger, config.publicAgentSchemasFile, schemas);
+            await writeFileInDir(logger, config.publicAgentFile, functions);
+            await removeLegacyScaffoldFile(config.publicAgentFile);
             return true;
         }
         return false;

package/dist/src/functions/wirings/ai-agent/serialize-public-agent.d.ts

@@ -1 +1,5 @@
-export declare const serializePublicAgent: (pathToPikkuTypes: string, requireAuth?: boolean, globalHTTPPrefix?: string) => string;
+export interface PublicAgentGenOutput {
+    schemas: string;
+    functions: string;
+}
+export declare const serializePublicAgent: (pathToPikkuTypes: string, requireAuth?: boolean, globalHTTPPrefix?: string) => PublicAgentGenOutput;

package/dist/src/functions/wirings/ai-agent/serialize-public-agent.js

@@ -1,28 +1,69 @@
 export const serializePublicAgent = (pathToPikkuTypes, requireAuth = true, globalHTTPPrefix = '') => {
     const authFlag = requireAuth ? 'true' : 'false';
-    // Emitted inline at each call site rather than as a shared named alias: the
-    // schema extractor only reads type literals in the generic position, and
-    // synthesises the schema name from the function name. Behind a named alias it
-    // records an `inputSchemaName` with no schema behind it, and every agent call
-    // then fails at runtime with MissingSchemaError.
-    const callerInput = `{
-    agentName: string
-    message: string
-    threadId: string
-    resourceId: string
-    attachments?: {
-      type: 'image' | 'file'
-      data?: string
-      url?: string
-      mediaType?: string
-      filename?: string
-    }[]
-    model?: string
-    temperature?: number
-    context?: string
-  }`;
-    return `import { canAccessThread, threadOwnerConstraint } from '@pikku/core/ai-agent'
+    const schemas = `/**
+ * Auto-generated public agent schemas
+ * Do not edit manually - regenerate with 'npx pikku'
+ */
+import { z } from 'zod'
+
+export const Attachment = z.object({
+  type: z.enum(['image', 'file']),
+  data: z.string().optional(),
+  url: z.string().optional(),
+  mediaType: z.string().optional(),
+  filename: z.string().optional(),
+})
+
+export const AgentCall = z.object({
+  agentName: z.string(),
+  message: z.string(),
+  threadId: z.string(),
+  resourceId: z.string(),
+  attachments: z.array(Attachment).optional(),
+  model: z.string().optional(),
+  temperature: z.number().optional(),
+  context: z.string().optional(),
+})
+
+export const AgentApproval = z.object({
+  agentName: z.string(),
+  runId: z.string(),
+  approvals: z.array(
+    z.object({ toolCallId: z.string(), approved: z.boolean() })
+  ),
+})
+
+export const AgentResume = z.object({
+  agentName: z.string(),
+  runId: z.string(),
+  toolCallId: z.string(),
+  approved: z.boolean(),
+})
+
+export const ThreadsQuery = z.object({
+  agentName: z.string().optional(),
+  resourceId: z.string().optional(),
+  limit: z.number().optional(),
+  offset: z.number().optional(),
+})
+
+export const ThreadRef = z.object({
+  threadId: z.string(),
+  resourceId: z.string().optional(),
+})
+
+export const ThreadDeleted = z.object({ deleted: z.boolean() })
+`;
+    const functions = `import { canAccessThread, threadOwnerConstraint } from '@pikku/core/ai-agent'
 import { pikkuSessionlessFunc, pikkuPermission, defineHTTPRoutes, wireHTTPRoutes } from '${pathToPikkuTypes}'
+import {
+  AgentCall,
+  AgentApproval,
+  AgentResume,
+  ThreadsQuery,
+  ThreadRef,
+  ThreadDeleted,
+} from './agent.schemas.gen.js'
 
 /**
  * Thread reads are keyed by a caller-supplied \`threadId\`, so ownership cannot
@@ -39,9 +80,10 @@ export const isThreadOwner = pikkuPermission<{ threadId: string }>(
   }
 )
 
-export const agentCaller = pikkuSessionlessFunc<${callerInput}, unknown>({
+export const agentCaller = pikkuSessionlessFunc({
   tags: ['pikku'],
   auth: ${authFlag},
+  input: AgentCall,
   func: async (_services, data, { rpc }) => {
     return await rpc.agent.run(data.agentName as any, {
       message: data.message,
@@ -55,9 +97,10 @@ export const agentCaller = pikkuSessionlessFunc<${callerInput}, unknown>({
   },
 })
 
-export const agentStreamCaller = pikkuSessionlessFunc<${callerInput}, void>({
+export const agentStreamCaller = pikkuSessionlessFunc({
   tags: ['pikku'],
   auth: ${authFlag},
+  input: AgentCall,
   func: async (_services, data, { rpc }) => {
     await rpc.agent.stream(data.agentName as any, {
       message: data.message,
@@ -71,23 +114,19 @@ export const agentStreamCaller = pikkuSessionlessFunc<${callerInput}, void>({
   },
 })
 
-export const agentApproveCaller = pikkuSessionlessFunc<
-  { agentName: string; runId: string; approvals: { toolCallId: string; approved: boolean }[] },
-  unknown
->({
+export const agentApproveCaller = pikkuSessionlessFunc({
   tags: ['pikku'],
   auth: ${authFlag},
+  input: AgentApproval,
   func: async (_services, { runId, approvals, agentName }, { rpc }) => {
     return await rpc.agent.approve(runId, approvals, agentName)
   },
 })
 
-export const agentResumeCaller = pikkuSessionlessFunc<
-  { agentName: string; runId: string; toolCallId: string; approved: boolean },
-  void
->({
+export const agentResumeCaller = pikkuSessionlessFunc({
   tags: ['pikku'],
   auth: ${authFlag},
+  input: AgentResume,
   func: async (_services, data, { rpc }) => {
     await rpc.agent.resume(data.runId, {
       toolCallId: data.toolCallId,
@@ -96,11 +135,9 @@ export const agentResumeCaller = pikkuSessionlessFunc<
   },
 })
 
-export const getAgentThreads = pikkuSessionlessFunc<
-  { agentName?: string; resourceId?: string; limit?: number; offset?: number },
-  any[]
->({
+export const getAgentThreads = pikkuSessionlessFunc({
   tags: ['pikku', 'pikku:agent'],
+  input: ThreadsQuery,
   title: 'Get Agent Threads',
   description:
     'Returns the caller\\'s AI agent threads from storage. Accepts optional filters: agentName, resourceId, limit, and offset for pagination.',
@@ -119,11 +156,9 @@ export const getAgentThreads = pikkuSessionlessFunc<
   },
 })
 
-export const getAgentThreadMessages = pikkuSessionlessFunc<
-  { threadId: string; resourceId?: string },
-  any[]
->({
+export const getAgentThreadMessages = pikkuSessionlessFunc({
   tags: ['pikku', 'pikku:agent'],
+  input: ThreadRef,
   title: 'Get Agent Thread Messages',
   description:
     'Returns all messages for a given AI agent thread, ordered by creation time.',
@@ -135,11 +170,9 @@ export const getAgentThreadMessages = pikkuSessionlessFunc<
   },
 })
 
-export const getAgentThreadRuns = pikkuSessionlessFunc<
-  { threadId: string; resourceId?: string },
-  any[]
->({
+export const getAgentThreadRuns = pikkuSessionlessFunc({
   tags: ['pikku', 'pikku:agent'],
+  input: ThreadRef,
   title: 'Get Agent Thread Runs',
   description:
     'Returns the run history for a given AI agent thread, ordered by creation time.',
@@ -151,11 +184,10 @@ export const getAgentThreadRuns = pikkuSessionlessFunc<
   },
 })
 
-export const deleteAgentThread = pikkuSessionlessFunc<
-  { threadId: string; resourceId?: string },
-  { deleted: boolean }
->({
+export const deleteAgentThread = pikkuSessionlessFunc({
   tags: ['pikku', 'pikku:agent'],
+  input: ThreadRef,
+  output: ThreadDeleted,
   title: 'Delete Agent Thread',
   description:
     'Deletes an AI agent thread and all of its persisted state.',
@@ -199,4 +231,5 @@ export const agentRoutes = defineHTTPRoutes({
 
 wireHTTPRoutes({ routes: { agent: agentRoutes } })
 `;
+    return { schemas, functions };
 };

package/dist/src/functions/wirings/auth/pikku-command-auth.js

@@ -4,6 +4,7 @@ import { rm } from 'node:fs/promises';
 import { pikkuSessionlessFunc } from '#pikku';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
+import { removeLegacyScaffoldFile } from '../../../utils/remove-legacy-scaffold-file.js';
 import { serializeAuthGen } from './serialize-auth-gen.js';
 import { serializeAuthTypes, serializeAuthTypesBootstrap, } from './serialize-auth-types.js';
 import { serializeAuthMeta } from './serialize-auth-meta.js';
@@ -49,6 +50,9 @@ export const pikkuAuth = pikkuSessionlessFunc({
         else if (existsSync(middlewareFile)) {
             await rm(middlewareFile, { force: true });
         }
+        for (const file of [authFile, secretsFile, middlewareFile]) {
+            await removeLegacyScaffoldFile(file);
+        }
         // Static metadata of the enabled providers/plugins for the console SSO page,
         // following the `*-meta.gen.json` convention. Read at runtime by the console
         // getAuthProviders function instead of a runtime registry.

package/dist/src/functions/wirings/console/pikku-command-console-functions.js

@@ -3,6 +3,7 @@ import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { projectDeclaresBetterAuth } from '../../../utils/detect-better-auth.js';
+import { removeLegacyScaffoldFile } from '../../../utils/remove-legacy-scaffold-file.js';
 import { serializeConsoleFunctions } from './serialize-console-functions.js';
 export const pikkuConsoleFunctions = pikkuSessionlessFunc({
     func: async ({ logger, config, variables }) => {
@@ -10,7 +11,7 @@ export const pikkuConsoleFunctions = pikkuSessionlessFunc({
         if (deployCodegenFlag === '1') {
             return false;
         }
-        if (config.scaffold?.console) {
+        if (config.scaffold?.console && config.consoleSchemasFile) {
             // Every console RPC now requires an authenticated session (the console is
             // an admin surface), so scaffolding it without an auth strategy produces a
             // console that 403s on every call. Better Auth is the supported strategy —
@@ -25,7 +26,10 @@ export const pikkuConsoleFunctions = pikkuSessionlessFunc({
             }
             const pathToPikkuTypes = getFileImportRelativePath(config.consoleFunctionsFile, config.typesDeclarationFile, config.packageMappings);
             const pathToAgentTypes = getFileImportRelativePath(config.consoleFunctionsFile, config.agentTypesFile, config.packageMappings);
-            await writeFileInDir(logger, config.consoleFunctionsFile, serializeConsoleFunctions(pathToPikkuTypes, pathToAgentTypes, config.globalHTTPPrefix || ''));
+            const { schemas, functions } = serializeConsoleFunctions(pathToPikkuTypes, pathToAgentTypes, config.globalHTTPPrefix || '');
+            await writeFileInDir(logger, config.consoleSchemasFile, schemas);
+            await writeFileInDir(logger, config.consoleFunctionsFile, functions);
+            await removeLegacyScaffoldFile(config.consoleFunctionsFile);
             return true;
         }
         return false;

package/dist/src/functions/wirings/console/serialize-console-functions.d.ts

@@ -1 +1,5 @@
-export declare const serializeConsoleFunctions: (pathToPikkuTypes: string, _pathToAgentTypes: string, globalHTTPPrefix?: string) => string;
+export interface ConsoleGenOutput {
+    schemas: string;
+    functions: string;
+}
+export declare const serializeConsoleFunctions: (pathToPikkuTypes: string, _pathToAgentTypes: string, globalHTTPPrefix?: string) => ConsoleGenOutput;

package/dist/src/functions/wirings/console/serialize-console-functions.js

@@ -1,28 +1,62 @@
 export const serializeConsoleFunctions = (pathToPikkuTypes, _pathToAgentTypes, globalHTTPPrefix = '') => {
-    return `import { pikkuFunc, defineHTTPRoutes, wireHTTPRoutes, ref, wireAddon } from '${pathToPikkuTypes}'
+    const schemas = `/**
+ * Auto-generated console function schemas
+ * Do not edit manually - regenerate with 'npx pikku'
+ */
+import { z } from 'zod'
 
-export const pikkuConsoleSetSecret = pikkuFunc<{
-  secretId: string
-  value: unknown
-}, {
-  success: boolean
-}>({
+export const SecretRef = z.object({ secretId: z.string() })
+
+export const SetSecret = z.object({
+  secretId: z.string(),
+  value: z.unknown(),
+})
+
+export const VariableRef = z.object({ variableId: z.string() })
+
+export const SetVariable = z.object({
+  variableId: z.string(),
+  value: z.unknown(),
+})
+
+export const ValueResult = z.object({
+  exists: z.boolean(),
+  value: z.unknown().nullable(),
+})
+
+export const Exists = z.object({ exists: z.boolean() })
+
+export const Success = z.object({ success: z.boolean() })
+`;
+    const functions = `import { pikkuFunc, defineHTTPRoutes, wireHTTPRoutes, ref, wireAddon } from '${pathToPikkuTypes}'
+import {
+  SecretRef,
+  SetSecret,
+  VariableRef,
+  SetVariable,
+  ValueResult,
+  Exists,
+  Success,
+} from './console.schemas.gen.js'
+
+export const pikkuConsoleSetSecret = pikkuFunc({
   tags: ['pikku'],
   description: 'Set the value of a secret',
   expose: true,
+  input: SetSecret,
+  output: Success,
   func: async ({ secrets }, { secretId, value }) => {
     await secrets.setSecret(secretId, value)
     return { success: true }
   },
 })
 
-export const pikkuConsoleGetVariable = pikkuFunc<
-  { variableId: string },
-  { exists: boolean; value: unknown | null }
->({
+export const pikkuConsoleGetVariable = pikkuFunc({
   tags: ['pikku'],
   description: 'Get the current value of a variable',
   expose: true,
+  input: VariableRef,
+  output: ValueResult,
   func: async ({ variables }, { variableId }) => {
     const exists = await variables.has(variableId)
     if (!exists) {
@@ -38,13 +72,12 @@ export const pikkuConsoleGetVariable = pikkuFunc<
   },
 })
 
-export const pikkuConsoleSetVariable = pikkuFunc<
-  { variableId: string; value: unknown },
-  { success: boolean }
->({
+export const pikkuConsoleSetVariable = pikkuFunc({
   tags: ['pikku'],
   description: 'Set the value of a variable',
   expose: true,
+  input: SetVariable,
+  output: Success,
   func: async ({ variables }, { variableId, value }) => {
     if (typeof value === 'string') {
       await variables.set(variableId, value)
@@ -55,26 +88,24 @@ export const pikkuConsoleSetVariable = pikkuFunc<
   },
 })
 
-export const pikkuConsoleHasSecret = pikkuFunc<
-  { secretId: string },
-  { exists: boolean }
->({
+export const pikkuConsoleHasSecret = pikkuFunc({
   tags: ['pikku'],
   description: 'Check if a secret exists without reading its value',
   expose: true,
+  input: SecretRef,
+  output: Exists,
   func: async ({ secrets }, { secretId }) => {
     const exists = await secrets.hasSecret(secretId)
     return { exists }
   },
 })
 
-export const pikkuConsoleGetSecret = pikkuFunc<
-  { secretId: string },
-  { exists: boolean; value: unknown | null }
->({
+export const pikkuConsoleGetSecret = pikkuFunc({
   tags: ['pikku'],
   description: 'Get the current value of a secret',
   expose: true,
+  input: SecretRef,
+  output: ValueResult,
   func: async ({ secrets }, { secretId }) => {
     const exists = await secrets.hasSecret(secretId)
     if (!exists) {
@@ -107,4 +138,5 @@ export const consoleRoutes = defineHTTPRoutes({
 wireAddon({ name: 'console', package: '@pikku/addon-console' })
 wireHTTPRoutes({ basePath: '${globalHTTPPrefix}', routes: { console: consoleRoutes } })
 `;
+    return { schemas, functions };
 };

package/dist/src/functions/wirings/functions/schemas.js

@@ -4,7 +4,16 @@ import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-
 export const pikkuSchemas = pikkuSessionlessFunc({
     func: async ({ logger, config, getInspectorState }) => {
         const visitState = await getInspectorState();
-        if (Object.keys(visitState.schemas).length === 0) {
+        // Bodies missing while functions still DECLARE schemas means the inspection pass
+        // was partial. Writing from it would empty register.gen.ts and delete the files
+        // behind schemas that are still required — unregistering the whole app off a bad
+        // read. Leave the previous output alone.
+        //
+        // Zero REQUIRED schemas is a different thing entirely and must still be written:
+        // that is a project whose last schema was removed, and it is the case where the
+        // files left by earlier runs have to be cleared.
+        if (visitState.requiredSchemas.size > 0 &&
+            Object.keys(visitState.schemas).length === 0) {
             return undefined;
         }
         await saveSchemas(logger, config.schemaDirectory, visitState.schemas, visitState.requiredSchemas, config.schema?.supportsImportAttributes ?? true, config.addonName || null);

package/dist/src/functions/wirings/graph/pikku-command-graph-wirings.js

@@ -2,12 +2,14 @@ import { pikkuSessionlessFunc } from '#pikku';
 import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
+import { removeLegacyScaffoldFile } from '../../../utils/remove-legacy-scaffold-file.js';
 import { serializeGraphWirings } from './serialize-graph-wirings.js';
 export const pikkuGraphWirings = pikkuSessionlessFunc({
     func: async ({ logger, config }) => {
         if (config.scaffold?.graph && config.graphWiringsFile) {
             const pathToPikkuTypes = getFileImportRelativePath(config.graphWiringsFile, config.typesDeclarationFile, config.packageMappings);
             await writeFileInDir(logger, config.graphWiringsFile, serializeGraphWirings(pathToPikkuTypes));
+            await removeLegacyScaffoldFile(config.graphWiringsFile);
             return true;
         }
         return false;

package/dist/src/functions/wirings/queue/pikku-command-queue.js

@@ -10,8 +10,16 @@ export const pikkuCommandQueue = pikkuSessionlessFunc({
         const visitState = await getInspectorState();
         const { queueWorkersWiringFile, queueWorkersWiringMetaFile, queueWorkersWiringMetaJsonFile, packageMappings, schema, } = config;
         const { queueWorkers } = visitState;
-        if (queueWorkers.files.size === 0 ||
-            Object.keys(queueWorkers.meta).length === 0) {
+        // Gate on the meta alone, never on `files`. Workflows synthesise their own
+        // `wf-orchestrator-*` / `wf-step-*` queue meta during post-processing, and
+        // those entries have no declaring source file — so a project that uses
+        // workflows but hand-declares no `wireQueueWorker` has a full `meta` and an
+        // empty `files`. Bailing on `files.size === 0` there skipped writing the
+        // queue meta entirely, which left `pikkuState(queue,meta)` empty at runtime:
+        // `getOrchestratorQueueName()` then never found a per-workflow queue and
+        // EVERY workflow fell back to the single shared `pikku-workflow-orchestrator`,
+        // where one slow job head-of-line-blocks everything queued behind it.
+        if (Object.keys(queueWorkers.meta).length === 0) {
             return undefined;
         }
         const fullMeta = serializeQueueMeta(queueWorkers.meta);