@pikku/cli 0.12.93 → 0.12.96

package/dist/.pikku/function/pikku-function-types.gen.d.ts

@@ -1,10 +1,10 @@
 /**
- * This file was generated by @pikku/cli@0.12.93
+ * This file was generated by @pikku/cli@0.12.96
  */
 /**
  * Core function, middleware, and permission types for all wirings
  */
-import type { CorePikkuMiddleware, CorePermissionGroup, ListInput, ListOutput, PikkuWire, PickRequired } from '@pikku/core';
+import type { CorePikkuMiddleware, CorePermissionGroup, ListInput, ListOutput, PikkuWire, PickRequired, SecretlessServices, SecretService } from '@pikku/core';
 import type { CorePikkuFunctionConfig, CorePikkuAuth, CorePikkuAuthConfig, CorePikkuPermission } from '@pikku/core/function';
 import { CreateWireServices } from '@pikku/core/internal';
 import type { NodeType } from '@pikku/core/node';
@@ -17,7 +17,7 @@ import type { Services } from '../../types/application-types.d.js';
 import type { Config } from '../../types/application-types.d.js';
 import type { TypedPikkuRPC, FlattenedRPCMap } from '../rpc/pikku-rpc-wirings-map.internal.gen.d.js';
 import type { RequiredSingletonServices, RequiredWireServices } from '../pikku-services.gen.js';
-import type { TypedWorkflow, TypedScenario, TypedScenarioActors } from '../workflow/pikku-workflow-types.gen.js';
+import type { TypedWorkflow, TypedScenario, TypedPersonas } from '../workflow/pikku-workflow-types.gen.js';
 export type { SingletonServices as SingletonServices };
 export type { Services as Services };
 export type Session = UserSession;
@@ -30,7 +30,20 @@ export type Session = UserSession;
  * why an `if (!service)` guard inside a function body is always dead code.
  */
 export type WiredSingletonServices = RequiredSingletonServices & SingletonServices;
-export type WiredServices = RequiredSingletonServices & Services;
+export type WiredServices = SecretlessServices<RequiredSingletonServices & Services>;
+/** `WiredSingletonServices` without `secrets`, for auth gates. */
+export type WiredAuthServices = SecretlessServices<WiredSingletonServices>;
+/**
+ * `WiredServices` with `secrets` restored, for the console's secret-admin
+ * functions. Reached by declaring `secretBroker: true` on a `pikkuFunc` config.
+ *
+ * Declaring it does not grant the service. The runner hands out the real
+ * `SecretService` only to the functions the inspector marks as secret brokers;
+ * every other function still receives the throwing accessor.
+ */
+export type WiredSecretBrokerServices = WiredServices & {
+    secrets: SecretService;
+};
 /**
  * Inline node configuration for function definitions.
  */
@@ -47,7 +60,7 @@ export type NodeConfig = {
  * @template In - The input type that the permission check will receive
  * @template RequiredServices - The services required for this permission check
  */
-export type PikkuPermission<In = unknown, RequiredServices extends Services = WiredServices> = CorePikkuPermission<In, RequiredServices, PikkuWire<In, never, false, Session>>;
+export type PikkuPermission<In = unknown, RequiredServices extends SecretlessServices<Services> = WiredServices> = CorePikkuPermission<In, RequiredServices, PikkuWire<In, never, false, Session>>;
 /**
  * Type-safe middleware definition that can access your application's services and session.
  * Use this to define reusable middleware that can be applied to multiple wirings.
@@ -58,7 +71,7 @@ export type PikkuMiddleware<RequiredServices extends SingletonServices = WiredSi
 /**
  * Configuration object for creating a permission with metadata
  */
-export type PikkuPermissionConfig<In = unknown, RequiredServices extends Services = WiredServices> = {
+export type PikkuPermissionConfig<In = unknown, RequiredServices extends SecretlessServices<Services> = WiredServices> = {
     /** The permission function */
     func: PikkuPermission<In, RequiredServices>;
     /** Optional human-readable name for the permission */
@@ -97,11 +110,11 @@ export declare const pikkuPermission: <In>(permission: PikkuPermission<In> | Pik
  *
  * @template RequiredServices - The services required for this auth check
  */
-export type PikkuAuth<RequiredServices extends SingletonServices = WiredSingletonServices> = CorePikkuAuth<RequiredServices, Session>;
+export type PikkuAuth<RequiredServices extends SecretlessServices<SingletonServices> = WiredAuthServices> = CorePikkuAuth<RequiredServices, Session>;
 /**
  * Configuration object for creating an auth permission with metadata
  */
-export type PikkuAuthConfig<RequiredServices extends SingletonServices = WiredSingletonServices> = CorePikkuAuthConfig<RequiredServices, Session>;
+export type PikkuAuthConfig<RequiredServices extends SecretlessServices<SingletonServices> = WiredAuthServices> = CorePikkuAuthConfig<RequiredServices, Session>;
 /**
  * Factory function for creating auth-only permissions with tree-shaking support.
  * Auth permissions only receive services and session (no request data),
@@ -122,7 +135,7 @@ export type PikkuAuthConfig<RequiredServices extends SingletonServices = WiredSi
  * })
  * \`\`\`
  */
-export declare const pikkuAuth: <RequiredServices extends SingletonServices = WiredSingletonServices>(auth: PikkuAuth<RequiredServices> | PikkuAuthConfig<RequiredServices>) => PikkuPermission<any, any>;
+export declare const pikkuAuth: <RequiredServices extends SecretlessServices<SingletonServices> = WiredAuthServices>(auth: PikkuAuth<RequiredServices> | PikkuAuthConfig<RequiredServices>) => PikkuPermission<any, any>;
 /**
  * Configuration object for creating middleware with metadata
  */
@@ -203,7 +216,7 @@ export declare const pikkuPermissionFactory: <In = any>(factory: (input: In) =>
  * @template In - The input type (same as the function it describes)
  * @template RequiredServices - The services required for this description function
  */
-export type PikkuApprovalDescription<In = unknown, RequiredServices extends Services = WiredServices> = (services: RequiredServices, data: In) => Promise<string>;
+export type PikkuApprovalDescription<In = unknown, RequiredServices extends SecretlessServices<Services> = WiredServices> = (services: RequiredServices, data: In) => Promise<string>;
 /**
  * Factory function for creating approval description functions with tree-shaking support.
  *
@@ -217,7 +230,7 @@ export type PikkuApprovalDescription<In = unknown, RequiredServices extends Serv
  * )
  * ```
  */
-export declare const pikkuApprovalDescription: <In = unknown, RequiredServices extends Services = WiredServices>(fn: PikkuApprovalDescription<In, RequiredServices>) => PikkuApprovalDescription<In, RequiredServices>;
+export declare const pikkuApprovalDescription: <In = unknown, RequiredServices extends SecretlessServices<Services> = WiredServices>(fn: PikkuApprovalDescription<In, RequiredServices>) => PikkuApprovalDescription<In, RequiredServices>;
 /**
  * A sessionless API function that doesn't require user authentication.
  * Use this for public endpoints, health checks, or operations that don't need user context.
@@ -226,7 +239,7 @@ export declare const pikkuApprovalDescription: <In = unknown, RequiredServices e
  * @template Out - The output type that the function returns
  * @template RequiredServices - Services required by this function
  */
-export type PikkuFunctionSessionless<In = unknown, Out = never, RequiredWires extends keyof PikkuWire = never, RequiredServices extends Services = WiredServices> = CorePikkuFunctionSessionless<In, Out, RequiredServices, Session, PickRequired<PikkuWire<In, Out, false, Session, TypedPikkuRPC, null, any, TypedWorkflow, unknown, TypedScenario, TypedScenarioActors>, RequiredWires>>;
+export type PikkuFunctionSessionless<In = unknown, Out = never, RequiredWires extends keyof PikkuWire = never, RequiredServices extends SecretlessServices<Services> = WiredServices> = CorePikkuFunctionSessionless<In, Out, RequiredServices, Session, PickRequired<PikkuWire<In, Out, false, Session, TypedPikkuRPC, null, any, TypedWorkflow, unknown, TypedScenario, TypedPersonas>, RequiredWires>>;
 /**
  * A session-aware API function that requires user authentication.
  * Use this for protected endpoints that need access to user session data.
@@ -235,7 +248,7 @@ export type PikkuFunctionSessionless<In = unknown, Out = never, RequiredWires ex
  * @template Out - The output type that the function returns
  * @template RequiredServices - Services required by this function
  */
-export type PikkuFunction<In = unknown, Out = never, RequiredWires extends keyof PikkuWire = 'session', RequiredServices extends Services = WiredServices> = CorePikkuFunction<In, Out, RequiredServices, Session, PickRequired<PikkuWire<In, Out, true, Session, TypedPikkuRPC, null, any, TypedWorkflow, unknown, TypedScenario, TypedScenarioActors>, RequiredWires>>;
+export type PikkuFunction<In = unknown, Out = never, RequiredWires extends keyof PikkuWire = 'session', RequiredServices extends SecretlessServices<Services> = WiredServices> = CorePikkuFunction<In, Out, RequiredServices, Session, PickRequired<PikkuWire<In, Out, true, Session, TypedPikkuRPC, null, any, TypedWorkflow, unknown, TypedScenario, TypedPersonas>, RequiredWires>>;
 /**
  * Helper type to infer the output type from a Standard Schema
  */
@@ -248,7 +261,7 @@ export type InferSchemaOutput<T> = T extends StandardSchemaV1<any, infer Output>
  * @template Out - The output type
  * @template PikkuFunc - The function type (can be narrowed to PikkuFunction or PikkuFunctionSessionless)
  */
-export type PikkuFunctionConfig<In = unknown, Out = unknown, RequiredWires extends keyof PikkuWire = never, PikkuFunc extends PikkuFunction<In, Out, RequiredWires> | PikkuFunctionSessionless<In, Out, RequiredWires> = PikkuFunction<In, Out, RequiredWires> | PikkuFunctionSessionless<In, Out, RequiredWires>, InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined> = CorePikkuFunctionConfig<PikkuFunc, PikkuPermission<In>, PikkuMiddleware, InputSchema, OutputSchema, ScopeId>;
+export type PikkuFunctionConfig<In = unknown, Out = unknown, RequiredWires extends keyof PikkuWire = never, PikkuFunc extends PikkuFunction<In, Out, RequiredWires, any> | PikkuFunctionSessionless<In, Out, RequiredWires, any> = PikkuFunction<In, Out, RequiredWires> | PikkuFunctionSessionless<In, Out, RequiredWires>, InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined> = CorePikkuFunctionConfig<PikkuFunc, PikkuPermission<In>, PikkuMiddleware, InputSchema, OutputSchema, ScopeId>;
 /**
  * Configuration object for Pikku functions with Zod schema validation.
  * Use this when you want to define input/output schemas using Zod.
@@ -259,8 +272,8 @@ type SchemaInferred<S, Fallback = unknown> = S extends StandardSchemaV1 ? InferS
  * Schema-overload variant for pikkuFunc. Derived from CorePikkuFunctionConfig
  * so adding a field on the core type automatically propagates here.
  */
-export type PikkuFunctionConfigWithSchema<InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined, RequiredWires extends keyof PikkuWire = never> = Omit<CorePikkuFunctionConfig<PikkuFunction<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires> | PikkuFunctionSessionless<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires>, CorePikkuPermission<any>, PikkuMiddleware, undefined, undefined, ScopeId>, 'func' | 'input' | 'output' | 'permissions' | 'approvalDescription'> & {
-    func: PikkuFunction<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires> | PikkuFunctionSessionless<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires>;
+export type PikkuFunctionConfigWithSchema<InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined, RequiredWires extends keyof PikkuWire = never, RequiredServices extends SecretlessServices<Services> = WiredServices> = Omit<CorePikkuFunctionConfig<PikkuFunction<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires, RequiredServices> | PikkuFunctionSessionless<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires, RequiredServices>, CorePikkuPermission<any>, PikkuMiddleware, undefined, undefined, ScopeId>, 'func' | 'input' | 'output' | 'permissions' | 'approvalDescription'> & {
+    func: PikkuFunction<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires, RequiredServices> | PikkuFunctionSessionless<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires, RequiredServices>;
     input?: InputSchema;
     output?: OutputSchema;
     permissions?: InputSchema extends StandardSchemaV1 ? CorePermissionGroup<PikkuPermission<InferSchemaOutput<InputSchema>>> : undefined;
@@ -292,6 +305,9 @@ export type PikkuFunctionConfigWithSchema<InputSchema extends StandardSchemaV1 |
  * })
  * ```
  */
+export declare function pikkuFunc<InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined>(config: PikkuFunctionConfigWithSchema<InputSchema, OutputSchema, 'session' | 'rpc', WiredSecretBrokerServices> & {
+    secretBroker: true;
+}): PikkuFunctionConfig<InputSchema extends StandardSchemaV1 ? InferSchemaOutput<InputSchema> : unknown, OutputSchema extends StandardSchemaV1 ? InferSchemaOutput<OutputSchema> : unknown, 'session' | 'rpc'>;
 export declare function pikkuFunc<InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined>(config: PikkuFunctionConfigWithSchema<InputSchema, OutputSchema, 'session' | 'rpc'>): PikkuFunctionConfig<InputSchema extends StandardSchemaV1 ? InferSchemaOutput<InputSchema> : unknown, OutputSchema extends StandardSchemaV1 ? InferSchemaOutput<OutputSchema> : unknown, 'session' | 'rpc'>;
 export declare function pikkuFunc<In, Out = unknown>(func: PikkuFunction<In, Out, 'session' | 'rpc'> | PikkuFunctionConfig<In, Out, 'session' | 'rpc'>): PikkuFunctionConfig<In, Out, 'session' | 'rpc'>;
 export type PikkuListFunction<F extends Record<string, unknown> = {}, Row = unknown, S extends string = never> = PikkuFunction<ListInput<F, S>, ListOutput<Row>, 'session' | 'rpc'> | PikkuFunctionSessionless<ListInput<F, S>, ListOutput<Row>, 'session' | 'rpc'>;
@@ -303,8 +319,8 @@ export declare const pikkuListFunc: <F extends Record<string, unknown> = {}, Row
  * Schema-overload variant for pikkuSessionlessFunc. Derived from
  * CorePikkuFunctionConfig to stay in sync with the generic-typed config.
  */
-export type PikkuFunctionSessionlessConfigWithSchema<InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined, RequiredWires extends keyof PikkuWire = never> = Omit<CorePikkuFunctionConfig<PikkuFunctionSessionless<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires>>, 'func' | 'input' | 'output' | 'permissions' | 'approvalDescription'> & {
-    func: PikkuFunctionSessionless<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires>;
+export type PikkuFunctionSessionlessConfigWithSchema<InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined, RequiredWires extends keyof PikkuWire = never, RequiredServices extends SecretlessServices<Services> = WiredServices> = Omit<CorePikkuFunctionConfig<PikkuFunctionSessionless<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires, RequiredServices>>, 'func' | 'input' | 'output' | 'permissions' | 'approvalDescription'> & {
+    func: PikkuFunctionSessionless<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires, RequiredServices>;
     input?: InputSchema;
     output?: OutputSchema;
     permissions?: InputSchema extends StandardSchemaV1 ? CorePermissionGroup<PikkuPermission<InferSchemaOutput<InputSchema>>> : undefined;
@@ -334,8 +350,8 @@ export type PikkuFunctionSessionlessConfigWithSchema<InputSchema extends Standar
  * })
  * ```
  */
-export declare function pikkuSessionlessFunc<InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined>(config: PikkuFunctionSessionlessConfigWithSchema<InputSchema, OutputSchema, 'session' | 'rpc'>): PikkuFunctionConfig<InputSchema extends StandardSchemaV1 ? InferSchemaOutput<InputSchema> : unknown, OutputSchema extends StandardSchemaV1 ? InferSchemaOutput<OutputSchema> : unknown, 'session' | 'rpc'>;
-export declare function pikkuSessionlessFunc<In, Out = unknown>(func: PikkuFunctionSessionless<In, Out, 'session' | 'rpc'> | PikkuFunctionConfig<In, Out, 'session' | 'rpc'>): PikkuFunctionConfig<In, Out, 'session' | 'rpc'>;
+export declare function pikkuSessionlessFunc<InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined, RequiredServices extends SecretlessServices<Services> = WiredServices>(config: PikkuFunctionSessionlessConfigWithSchema<InputSchema, OutputSchema, 'session' | 'rpc', RequiredServices>): PikkuFunctionConfig<InputSchema extends StandardSchemaV1 ? InferSchemaOutput<InputSchema> : unknown, OutputSchema extends StandardSchemaV1 ? InferSchemaOutput<OutputSchema> : unknown, 'session' | 'rpc'>;
+export declare function pikkuSessionlessFunc<In, Out = unknown, RequiredServices extends SecretlessServices<Services> = WiredServices>(func: PikkuFunctionSessionless<In, Out, 'session' | 'rpc', RequiredServices> | PikkuFunctionConfig<In, Out, 'session' | 'rpc', PikkuFunctionSessionless<In, Out, 'session' | 'rpc', RequiredServices>>): PikkuFunctionConfig<In, Out, 'session' | 'rpc'>;
 /**
  * Creates a function that takes no input and returns no output.
  * Useful for health checks, triggers, or cleanup operations.
@@ -371,6 +387,25 @@ export declare const pikkuVoidFunc: (func: PikkuFunctionSessionless<void, void,
  * ```
  */
 export declare const ref: <Name extends keyof FlattenedRPCMap>(rpcName: Name) => PikkuFunctionConfig<FlattenedRPCMap[Name]["input"], FlattenedRPCMap[Name]["output"], "session" | "rpc">;
+/**
+ * Declares a capability the connected client answers, reachable from any
+ * `wireChannel` function as `channel.remote(name, input)`.
+ *
+ * There is no `func`: this side owns the contract, the client owns the body.
+ * The `description` is what a person is shown when asked to approve the call,
+ * so write it for them rather than for the caller.
+ *
+ * @example
+ * ```typescript
+ * export const localCheckoutOutput = z.object({ sha: z.string(), branch: z.string() })
+ *
+ * export const localCheckout = pikkuRemoteChannelFunc({
+ *   description: 'Read the current commit and branch of your working tree',
+ *   output: localCheckoutOutput,
+ * })
+ * ```
+ */
+export declare function pikkuRemoteChannelFunc<InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined>(config: Omit<PikkuFunctionSessionlessConfigWithSchema<InputSchema, OutputSchema, 'session' | 'rpc'>, 'func'>): PikkuFunctionConfig<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, 'session' | 'rpc'>;
 /**
  * Creates a Pikku config factory.
  * Use this to define your application's configuration factory.

package/dist/.pikku/function/pikku-function-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.93
+ * This file was generated by @pikku/cli@0.12.96
  */
 /**
  * Core function, middleware, and permission types for all wirings
@@ -192,6 +192,32 @@ export const ref = (rpcName) => {
         }
     };
 };
+/**
+ * Declares a capability the connected client answers, reachable from any
+ * `wireChannel` function as `channel.remote(name, input)`.
+ *
+ * There is no `func`: this side owns the contract, the client owns the body.
+ * The `description` is what a person is shown when asked to approve the call,
+ * so write it for them rather than for the caller.
+ *
+ * @example
+ * ```typescript
+ * export const localCheckoutOutput = z.object({ sha: z.string(), branch: z.string() })
+ *
+ * export const localCheckout = pikkuRemoteChannelFunc({
+ *   description: 'Read the current commit and branch of your working tree',
+ *   output: localCheckoutOutput,
+ * })
+ * ```
+ */
+export function pikkuRemoteChannelFunc(config) {
+    return {
+        ...config,
+        func: async (_services, _data, _wire) => {
+            throw new Error(`${config.title ?? 'This'} is a remote channel capability and has no local implementation — reach it with channel.remote() on the channel whose client exposes it.`);
+        },
+    };
+}
 /**
  * Creates a Pikku config factory.
  * Use this to define your application's configuration factory.

package/dist/.pikku/function/pikku-functions-meta.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.93
+ * This file was generated by @pikku/cli@0.12.96
  */
 import { pikkuState } from '@pikku/core/internal';
 import metaData from './pikku-functions-meta.gen.json' with { type: 'json' };

package/dist/.pikku/function/pikku-functions-meta.gen.json

@@ -551,7 +551,7 @@
         "inputs": [],
         "outputs": [],
         "remote": true,
-        "implementationHash": "a68bb301aa2fd2b7"
+        "implementationHash": "ada89cdedc610d42"
     },
     "dbAudit": {
         "pikkuFuncId": "dbAudit",
@@ -750,7 +750,7 @@
         ],
         "outputs": [],
         "remote": true,
-        "implementationHash": "94987498de1905ff"
+        "implementationHash": "f84702bbe3753086"
     },
     "pikkuEmailsInit": {
         "pikkuFuncId": "pikkuEmailsInit",
@@ -1471,6 +1471,53 @@
         "inputHash": "7034161d",
         "outputHash": "fe940ba5"
     },
+    "personaSync": {
+        "pikkuFuncId": "personaSync",
+        "functionType": "user",
+        "funcWrapper": "pikkuSessionlessFunc",
+        "sessionless": true,
+        "name": "personaSync",
+        "inputSchemaName": "PersonaSyncInput",
+        "outputSchemaName": null,
+        "inputs": [
+            "PersonaSyncInput"
+        ],
+        "outputs": [],
+        "remote": true,
+        "implementationHash": "612c80e1814cadf5"
+    },
+    "personaRun": {
+        "pikkuFuncId": "personaRun",
+        "functionType": "user",
+        "funcWrapper": "pikkuSessionlessFunc",
+        "sessionless": true,
+        "name": "personaRun",
+        "inputSchemaName": "PersonaRunInput",
+        "outputSchemaName": null,
+        "inputs": [
+            "PersonaRunInput"
+        ],
+        "outputs": [],
+        "implementationHash": "f25d1104a05fb96a",
+        "contractHash": "b8d9a71fb0cde9b7",
+        "inputHash": "79b1ac3d",
+        "outputHash": "14154fe3"
+    },
+    "personaList": {
+        "pikkuFuncId": "personaList",
+        "functionType": "user",
+        "funcWrapper": "pikkuSessionlessFunc",
+        "sessionless": true,
+        "name": "personaList",
+        "inputSchemaName": null,
+        "outputSchemaName": null,
+        "inputs": [],
+        "outputs": [],
+        "implementationHash": "63b7e99179b4e2f9",
+        "contractHash": "4145e8286a5c52e0",
+        "inputHash": "67a062ca",
+        "outputHash": "b20ca8fc"
+    },
     "pikkuBootstrap": {
         "pikkuFuncId": "pikkuBootstrap",
         "functionType": "user",
@@ -1503,6 +1550,36 @@
         "inputHash": "914f8a46",
         "outputHash": "dc82a9b9"
     },
+    "rolesAudit": {
+        "pikkuFuncId": "rolesAudit",
+        "functionType": "user",
+        "funcWrapper": "pikkuSessionlessFunc",
+        "sessionless": true,
+        "name": "rolesAudit",
+        "inputSchemaName": "RolesAuditInput",
+        "outputSchemaName": null,
+        "inputs": [
+            "RolesAuditInput"
+        ],
+        "outputs": [],
+        "remote": true,
+        "implementationHash": "1a53646e97a53d66"
+    },
+    "rolesPrune": {
+        "pikkuFuncId": "rolesPrune",
+        "functionType": "user",
+        "funcWrapper": "pikkuSessionlessFunc",
+        "sessionless": true,
+        "name": "rolesPrune",
+        "inputSchemaName": "RolesPruneInput",
+        "outputSchemaName": null,
+        "inputs": [
+            "RolesPruneInput"
+        ],
+        "outputs": [],
+        "remote": true,
+        "implementationHash": "be08d55d26bdc4d0"
+    },
     "scenarioList": {
         "pikkuFuncId": "scenarioList",
         "functionType": "user",
@@ -1532,9 +1609,9 @@
             "ScenarioRunInput"
         ],
         "outputs": [],
-        "implementationHash": "affe4a39e48566db",
-        "contractHash": "aba3a8b79c67445a",
-        "inputHash": "257a9d3c",
+        "implementationHash": "4e21555c8e6a53cd",
+        "contractHash": "346e500e709d7f93",
+        "inputHash": "c033e2c4",
         "outputHash": "73729ce5"
     },
     "scopesAudit": {
@@ -1580,7 +1657,7 @@
         ],
         "outputs": [],
         "remote": true,
-        "implementationHash": "14a058c5e2987c14"
+        "implementationHash": "67fbbb819b0c3898"
     },
     "pikkuSkillsList": {
         "pikkuFuncId": "pikkuSkillsList",
@@ -1843,7 +1920,7 @@
         "outputs": [
             "PikkuPublicAgentOutput"
         ],
-        "implementationHash": "20cd376f3e7e90fa",
+        "implementationHash": "fad892b27fad1b99",
         "middleware": [
             {
                 "type": "wire",
@@ -2667,6 +2744,30 @@
         "inputHash": "d7b18af5",
         "outputHash": "09d7f16a"
     },
+    "pikkuPersonas": {
+        "pikkuFuncId": "pikkuPersonas",
+        "functionType": "user",
+        "funcWrapper": "pikkuSessionlessFunc",
+        "sessionless": true,
+        "name": "pikkuPersonas",
+        "inputSchemaName": "PikkuPersonasInput",
+        "outputSchemaName": null,
+        "inputs": [
+            "PikkuPersonasInput"
+        ],
+        "outputs": [],
+        "implementationHash": "9a04f80d68ac818f",
+        "middleware": [
+            {
+                "type": "wire",
+                "name": "logCommandInfoAndTime",
+                "inline": false
+            }
+        ],
+        "contractHash": "c2a10af2f542e3ca",
+        "inputHash": "52c1e871",
+        "outputHash": "090c7bc1"
+    },
     "pikkuCommandQueueMap": {
         "pikkuFuncId": "pikkuCommandQueueMap",
         "functionType": "user",
@@ -2815,7 +2916,7 @@
         "outputs": [
             "PikkuEventsScaffoldOutput"
         ],
-        "implementationHash": "59a5caca66a24f35",
+        "implementationHash": "6a86ff2af6fcb9e9",
         "middleware": [
             {
                 "type": "wire",
@@ -2849,6 +2950,30 @@
         "inputHash": "b8beaacf",
         "outputHash": "df7ce0f6"
     },
+    "pikkuRoles": {
+        "pikkuFuncId": "pikkuRoles",
+        "functionType": "user",
+        "funcWrapper": "pikkuSessionlessFunc",
+        "sessionless": true,
+        "name": "pikkuRoles",
+        "inputSchemaName": "PikkuRolesInput",
+        "outputSchemaName": null,
+        "inputs": [
+            "PikkuRolesInput"
+        ],
+        "outputs": [],
+        "implementationHash": "31d0fe86d21412d0",
+        "middleware": [
+            {
+                "type": "wire",
+                "name": "logCommandInfoAndTime",
+                "inline": false
+            }
+        ],
+        "contractHash": "0d5e9c9ad9b564bc",
+        "inputHash": "c432d4bb",
+        "outputHash": "306527ae"
+    },
     "pikkuPublicRPC": {
         "pikkuFuncId": "pikkuPublicRPC",
         "functionType": "user",
@@ -2861,7 +2986,7 @@
         "outputs": [
             "PikkuPublicRPCOutput"
         ],
-        "implementationHash": "c1362000becfea01",
+        "implementationHash": "9e532d246ad0f002",
         "middleware": [
             {
                 "type": "wire",
@@ -3183,7 +3308,7 @@
         "outputs": [
             "PikkuUserAdminFunctionsOutput"
         ],
-        "implementationHash": "02a648d9614ddac6",
+        "implementationHash": "2f56f5186bcbf7cf",
         "middleware": [
             {
                 "type": "wire",
@@ -3253,7 +3378,7 @@
         "outputs": [
             "PikkuWorkflowRoutesOutput"
         ],
-        "implementationHash": "e7bf1baed80d990f",
+        "implementationHash": "35983d43b838eaba",
         "middleware": [
             {
                 "type": "wire",
@@ -3279,7 +3404,7 @@
         "outputs": [
             "PikkuWorkflowOutput"
         ],
-        "implementationHash": "2b6fc206093884ae",
+        "implementationHash": "74146a47629d69d5",
         "middleware": [
             {
                 "type": "wire",
@@ -3301,7 +3426,7 @@
         "outputSchemaName": null,
         "inputs": [],
         "outputs": [],
-        "implementationHash": "19756e8c1224e730",
+        "implementationHash": "7e9b506e9d8a8c66",
         "contractHash": "5cf046fc5045a072",
         "inputHash": "d5ff2f31",
         "outputHash": "391c291d"

package/dist/.pikku/function/pikku-functions.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.93
+ * This file was generated by @pikku/cli@0.12.96
  */
 /* Import and register functions used by RPCs */
 import { addFunction } from '@pikku/core/function';
@@ -16,6 +16,7 @@ import { dbReset } from '../../src/functions/commands/db-reset.js';
 import { dbSeed } from '../../src/functions/commands/db-seed.js';
 import { dev } from '../../src/functions/commands/dev.js';
 import { FabricAddonVerify } from '../../src/fabric/functions/addon-verify.function.js';
+import { personaSync } from '../../src/functions/commands/persona-sync.js';
 import { pikkuAddonTypes } from '../../src/functions/wirings/functions/pikku-command-addon-types.js';
 import { pikkuAIAgent } from '../../src/functions/wirings/ai-agent/pikku-command-ai-agent.js';
 import { pikkuAIAgentTypes } from '../../src/functions/wirings/ai-agent/pikku-command-ai-agent-types.js';
@@ -52,6 +53,7 @@ import { pikkuNodeTypes } from '../../src/functions/wirings/console/pikku-comman
 import { pikkuOpenAPI } from '../../src/functions/wirings/http/pikku-command-openapi.js';
 import { pikkuPackage } from '../../src/functions/wirings/package/pikku-command-package.js';
 import { pikkuPermissions } from '../../src/functions/wirings/permissions/pikku-command-permissions.js';
+import { pikkuPersonas } from '../../src/functions/wirings/personas/pikku-command-personas.js';
 import { pikkuPublicAgent } from '../../src/functions/wirings/ai-agent/pikku-command-public-agent.js';
 import { pikkuPublicRPC } from '../../src/functions/wirings/rpc/pikku-command-public-rpc.js';
 import { pikkuQueueService } from '../../src/functions/wirings/queue/pikku-command-queue-service.js';
@@ -59,6 +61,7 @@ import { pikkuQueueTypes } from '../../src/functions/wirings/queue/pikku-command
 import { pikkuReactQuery } from '../../src/functions/wirings/rpc/pikku-command-react-query.js';
 import { pikkuRealtime } from '../../src/functions/wirings/realtime/pikku-command-realtime.js';
 import { pikkuRemoteRPC } from '../../src/functions/wirings/rpc/pikku-command-remote-rpc.js';
+import { pikkuRoles } from '../../src/functions/wirings/roles/pikku-command-roles.js';
 import { pikkuRPC } from '../../src/functions/wirings/rpc/pikku-command-rpc.js';
 import { pikkuRPCClient } from '../../src/functions/wirings/rpc/pikku-command-rpc-client.js';
 import { pikkuRPCExposedMap } from '../../src/functions/wirings/rpc/pikku-command-rpc-map.js';
@@ -84,6 +87,8 @@ import { pikkuWebhook } from '../../src/functions/wirings/webhook/pikku-command-
 import { pikkuWebSocketTyped } from '../../src/functions/runtimes/websocket/pikku-command-websocket-typed.js';
 import { pikkuWorkflow } from '../../src/functions/wirings/workflow/pikku-command-workflow.js';
 import { pikkuWorkflowRoutes } from '../../src/functions/wirings/workflow/pikku-command-workflow-routes.js';
+import { rolesAudit } from '../../src/functions/commands/roles-audit.js';
+import { rolesPrune } from '../../src/functions/commands/roles-prune.js';
 import { scopesAudit } from '../../src/functions/commands/scopes-audit.js';
 import { scopesPrune } from '../../src/functions/commands/scopes-prune.js';
 import { serve } from '../../src/functions/commands/serve.js';
@@ -101,6 +106,7 @@ addFunction('dbReset', dbReset);
 addFunction('dbSeed', dbSeed);
 addFunction('dev', dev);
 addFunction('FabricAddonVerify', FabricAddonVerify);
+addFunction('personaSync', personaSync);
 addFunction('pikkuAddonTypes', pikkuAddonTypes);
 addFunction('pikkuAIAgent', pikkuAIAgent);
 addFunction('pikkuAIAgentTypes', pikkuAIAgentTypes);
@@ -137,6 +143,7 @@ addFunction('pikkuNodeTypes', pikkuNodeTypes);
 addFunction('pikkuOpenAPI', pikkuOpenAPI);
 addFunction('pikkuPackage', pikkuPackage);
 addFunction('pikkuPermissions', pikkuPermissions);
+addFunction('pikkuPersonas', pikkuPersonas);
 addFunction('pikkuPublicAgent', pikkuPublicAgent);
 addFunction('pikkuPublicRPC', pikkuPublicRPC);
 addFunction('pikkuQueueService', pikkuQueueService);
@@ -144,6 +151,7 @@ addFunction('pikkuQueueTypes', pikkuQueueTypes);
 addFunction('pikkuReactQuery', pikkuReactQuery);
 addFunction('pikkuRealtime', pikkuRealtime);
 addFunction('pikkuRemoteRPC', pikkuRemoteRPC);
+addFunction('pikkuRoles', pikkuRoles);
 addFunction('pikkuRPC', pikkuRPC);
 addFunction('pikkuRPCClient', pikkuRPCClient);
 addFunction('pikkuRPCExposedMap', pikkuRPCExposedMap);
@@ -169,6 +177,8 @@ addFunction('pikkuWebhook', pikkuWebhook);
 addFunction('pikkuWebSocketTyped', pikkuWebSocketTyped);
 addFunction('pikkuWorkflow', pikkuWorkflow);
 addFunction('pikkuWorkflowRoutes', pikkuWorkflowRoutes);
+addFunction('rolesAudit', rolesAudit);
+addFunction('rolesPrune', rolesPrune);
 addFunction('scopesAudit', scopesAudit);
 addFunction('scopesPrune', scopesPrune);
 addFunction('serve', serve);

package/dist/.pikku/http/pikku-http-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.93
+ * This file was generated by @pikku/cli@0.12.96
  */
 /**
  * HTTP-specific type definitions for tree-shaking optimization

package/dist/.pikku/http/pikku-http-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.93
+ * This file was generated by @pikku/cli@0.12.96
  */
 /**
  * HTTP-specific type definitions for tree-shaking optimization

package/dist/.pikku/mcp/pikku-mcp-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.93
+ * This file was generated by @pikku/cli@0.12.96
  */
 /**
  * MCP-specific type definitions for tree-shaking optimization

package/dist/.pikku/mcp/pikku-mcp-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.93
+ * This file was generated by @pikku/cli@0.12.96
  */
 /**
  * MCP-specific type definitions for tree-shaking optimization

package/dist/.pikku/pikku-bootstrap-scenarios.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.93
+ * This file was generated by @pikku/cli@0.12.96
  */
 import './pikku-bootstrap.gen.js';
 import './scenarios/schemas/register.gen.js';

package/dist/.pikku/pikku-bootstrap-scenarios.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.93
+ * This file was generated by @pikku/cli@0.12.96
  */
 import './pikku-bootstrap.gen.js';
 import './scenarios/schemas/register.gen.js';

package/dist/.pikku/pikku-bootstrap.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.93
+ * This file was generated by @pikku/cli@0.12.96
  */
 import './rpc/pikku-rpc-wirings-meta.internal.gen.js';
 import './function/pikku-functions-meta.gen.js';

package/dist/.pikku/pikku-bootstrap.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.93
+ * This file was generated by @pikku/cli@0.12.96
  */
 import './rpc/pikku-rpc-wirings-meta.internal.gen.js';
 import './function/pikku-functions-meta.gen.js';

package/dist/.pikku/pikku-meta-service.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.93
+ * This file was generated by @pikku/cli@0.12.96
  */
 import { LocalMetaService } from '@pikku/core/services/local-meta';
 export declare class PikkuMetaService extends LocalMetaService {