@pikku/cli 0.12.93 → 0.12.99

package/dist/.pikku/cli/pikku-cli-wirings-meta.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.93
+ * This file was generated by @pikku/cli@0.12.99
  */
 import { pikkuState } from '@pikku/core/internal';
 import metaData from './pikku-cli-wirings-meta.gen.json' with { type: 'json' };

package/dist/.pikku/cli/pikku-cli-wirings-meta.gen.json

@@ -258,17 +258,16 @@
                             "options": {},
                             "description": "Publish this package's schema so projects consuming it as an addon can create its tables"
                         },
-                        "seed": {
-                            "pikkuFuncId": "dbSeed",
-                            "positionals": [],
-                            "options": {},
-                            "description": "Apply db/seed.sql to the dev database"
-                        },
                         "reset": {
                             "pikkuFuncId": "dbReset",
                             "positionals": [],
-                            "options": {},
-                            "description": "Wipe and recreate the dev database (migrate + seed)"
+                            "options": {
+                                "noSeed": {
+                                    "description": "Stop after migrating, leaving the database empty. For working on an empty-state or onboarding flow the test data would hide",
+                                    "default": false
+                                }
+                            },
+                            "description": "Wipe and recreate the dev database: migrate, then apply db/<engine>-dev-seed.sql. Dev only — it refuses to run in production"
                         },
                         "audit": {
                             "pikkuFuncId": "dbAudit",
@@ -304,6 +303,32 @@
                         }
                     }
                 },
+                "roles": {
+                    "pikkuFuncId": "",
+                    "positionals": [],
+                    "options": {},
+                    "description": "Inspect and maintain the roles declared with defineSystemRole",
+                    "subcommands": {
+                        "audit": {
+                            "pikkuFuncId": "rolesAudit",
+                            "positionals": [],
+                            "options": {},
+                            "description": "Report system roles in the database that are no longer declared in code, and how many people hold them"
+                        },
+                        "prune": {
+                            "pikkuFuncId": "rolesPrune",
+                            "positionals": [],
+                            "options": {
+                                "yes": {
+                                    "description": "Actually delete. Without it, prune only reports the blast radius",
+                                    "short": "y",
+                                    "default": false
+                                }
+                            },
+                            "description": "Remove system roles that are no longer declared in code, cascading them out of every user grant"
+                        }
+                    }
+                },
                 "knowledge": {
                     "pikkuFuncId": "",
                     "positionals": [],
@@ -380,9 +405,22 @@
                                     "default": false
                                 },
                                 "browser": {
-                                    "description": "Run scenarios with browser steps. --no-browser skips them (they are reported as skipped, not failed)",
+                                    "description": "Shorthand for --run default when false: takes the server-side path instead of driving a browser",
                                     "default": true
                                 },
+                                "run": {
+                                    "description": "Which surface every actor drives the system through: 'browser' (as a human), 'cli' (over the websocket), or 'default' (server-side, the fast path)",
+                                    "default": "default",
+                                    "choices": [
+                                        "cli",
+                                        "browser",
+                                        "default"
+                                    ]
+                                },
+                                "strict": {
+                                    "description": "Fail rather than pass a `then` that has no witness for --run, i.e. an assertion nobody checked on the surface its prose claims",
+                                    "default": false
+                                },
                                 "spawn": {
                                     "description": "Start `pikku dev` on the environment's apiUrl for the run and stop it afterwards. Without it, the environment must already be serving",
                                     "default": false
@@ -402,7 +440,7 @@
                                     "description": "Override the environment's appUrl for this run (the frontend browser steps navigate against)"
                                 }
                             },
-                            "description": "Run scenarios against a configured environment (scenarios.environments in pikku.config.json). Actor secret comes from SCENARIO_ACTOR_SECRET.",
+                            "description": "Run scenarios against a configured environment (environments in pikku.config.json). Actor secret comes from SCENARIO_ACTOR_SECRET.",
                             "parameters": "<environment>"
                         },
                         "list": {
@@ -413,6 +451,90 @@
                         }
                     }
                 },
+                "persona": {
+                    "pikkuFuncId": "",
+                    "positionals": [],
+                    "options": {},
+                    "description": "The people this app is for, and running one against a real stage",
+                    "subcommands": {
+                        "run": {
+                            "pikkuFuncId": "personaRun",
+                            "positionals": [
+                                {
+                                    "name": "environment",
+                                    "required": true
+                                },
+                                {
+                                    "name": "persona",
+                                    "required": true
+                                }
+                            ],
+                            "options": {
+                                "disposition": {
+                                    "description": "How they behave: realistic (default), careless, newcomer, stale, auditor, adversarial",
+                                    "short": "d"
+                                },
+                                "goals": {
+                                    "description": "Comma-separated goals in your own words, run alongside the persona's own and the ones derived from scenarios"
+                                },
+                                "steps": {
+                                    "description": "Model turns before it stops (default 40)"
+                                },
+                                "mutations": {
+                                    "description": "Non-read calls before it stops"
+                                },
+                                "duration": {
+                                    "description": "Wall clock before it stops, e.g. '30m'"
+                                },
+                                "seed": {
+                                    "description": "Replay a previous run — the same seed schedules the same run"
+                                },
+                                "model": {
+                                    "description": "Model they think with. Defaults to scenarios.model in pikku.config.json"
+                                },
+                                "allowApproval": {
+                                    "description": "Offer the endpoints the app marked as needing a human’s approval. Off by default: those are the ones that spend money"
+                                },
+                                "skipRoleCheck": {
+                                    "description": "Start without verifying the declared roles against the stage. For a target whose auth reports roles somewhere pikku cannot read — findings from an unverified run may be seed drift rather than product bugs"
+                                },
+                                "apiUrl": {
+                                    "description": "Override the environment's apiUrl for this run — for a target that only exists at run time, such as a freshly deployed sandbox"
+                                },
+                                "out": {
+                                    "description": "Write the whole run — every step, response and finding — as JSON to this path"
+                                }
+                            },
+                            "description": "Sign in as a declared persona and work the API in character against a configured environment. Not a test runner: it asserts nothing and reports what came back that should not have. The sign-in secret comes from SCENARIO_ACTOR_SECRET.",
+                            "parameters": "<environment> <persona>"
+                        },
+                        "sync": {
+                            "pikkuFuncId": "personaSync",
+                            "positionals": [
+                                {
+                                    "name": "environment",
+                                    "required": true
+                                }
+                            ],
+                            "options": {
+                                "dryRun": {
+                                    "description": "Report who would be provisioned, with which roles, and why anyone was skipped — without touching anything"
+                                },
+                                "apiUrl": {
+                                    "description": "Override the environment's apiUrl — for a target that only exists at run time, such as a freshly deployed sandbox"
+                                }
+                            },
+                            "description": "Provision the declared personas into an environment: create each account and apply the roles it declares. Additive — it never revokes. Needs both the environment's API (to sign in) and its database (to write the grants), and the sign-in secret from SCENARIO_ACTOR_SECRET.",
+                            "parameters": "<environment>"
+                        },
+                        "list": {
+                            "pikkuFuncId": "personaList",
+                            "positionals": [],
+                            "options": {},
+                            "description": "List the declared personas — who each one is, what they may do, and what they are trying to get done"
+                        }
+                    }
+                },
                 "fabric": {
                     "pikkuFuncId": "",
                     "positionals": [],
@@ -1706,6 +1828,10 @@
                     "description": "Fail the build on critical diagnostics. Always on; accepted for symmetry with --fail-on-error/--fail-on-warn.",
                     "default": true
                 },
+                "strictMeta": {
+                    "description": "Fail the build when an AI agent's tool has no description. Without one the model is offered the tool under its own name, so this is a quality gate rather than a correctness one — hence off by default. A 'title' does not satisfy it.",
+                    "default": false
+                },
                 "tsc": {
                     "description": "After codegen, run a real tsc --noEmit over the project's tsconfig and fail on type errors. Prints full diagnostics with code frames. Off by default.",
                     "default": false

package/dist/.pikku/cli/pikku-cli-wirings.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.93
+ * This file was generated by @pikku/cli@0.12.99
  */
 import '../../src/cli.wiring.js';
 import '../../src/services.js';

package/dist/.pikku/cli/pikku-cli-wirings.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.93
+ * This file was generated by @pikku/cli@0.12.99
  */
 /* The files with an wireCLI function call */
 import '../../src/cli.wiring.js';

package/dist/.pikku/cli/pikku-cli.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.93
+ * This file was generated by @pikku/cli@0.12.99
  */
 import '../pikku-bootstrap.gen.js';
 export declare function PikkuCLI(args: string[]): Promise<void>;

package/dist/.pikku/cli/pikku-cli.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.93
+ * This file was generated by @pikku/cli@0.12.99
  */
 import { executeCLI, CLIError } from '@pikku/core/cli';
 import { createConfig as createConfig } from '../../src/services.js';
@@ -26,7 +26,23 @@ export async function PikkuCLI(args) {
 // Export as default for easy importing
 export default PikkuCLI;
 // For direct execution (if this file is run directly)
-if (import.meta.url === `file://${process.argv[1]}`) {
+const isDirectExecution = await (async () => {
+    if (typeof import.meta.main === 'boolean') {
+        return import.meta.main;
+    }
+    // Node exposes import.meta.main from 24.2; earlier 24.x compares realpaths,
+    // which is what it is shorthand for.
+    try {
+        const { fileURLToPath } = await import('node:url');
+        const { realpathSync } = await import('node:fs');
+        return (process.argv[1] !== undefined &&
+            realpathSync(process.argv[1]) === fileURLToPath(import.meta.url));
+    }
+    catch {
+        return false;
+    }
+})();
+if (isDirectExecution) {
     PikkuCLI(process.argv.slice(2)).catch(error => {
         console.error('Fatal error:', error.message);
         process.exit(1);

package/dist/.pikku/console/pikku-node-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.93
+ * This file was generated by @pikku/cli@0.12.99
  */
 import type { FlattenedRPCMap } from '../rpc/pikku-rpc-wirings-map.internal.gen.js';
 export type NodeCategory = never;

package/dist/.pikku/function/pikku-function-types.gen.d.ts

@@ -1,11 +1,11 @@
 /**
- * This file was generated by @pikku/cli@0.12.93
+ * This file was generated by @pikku/cli@0.12.99
  */
 /**
  * Core function, middleware, and permission types for all wirings
  */
-import type { CorePikkuMiddleware, CorePermissionGroup, ListInput, ListOutput, PikkuWire, PickRequired } from '@pikku/core';
-import type { CorePikkuFunctionConfig, CorePikkuAuth, CorePikkuAuthConfig, CorePikkuPermission } from '@pikku/core/function';
+import type { CorePikkuMiddleware, CorePermissionGroup, ListInput, ListOutput, PikkuWire, PickRequired, SecretlessServices, SecretService } from '@pikku/core';
+import type { CorePikkuFunctionConfig, CorePikkuSessionlessFunctionConfig, CorePikkuAuth, CorePikkuAuthConfig, CorePikkuPermission } from '@pikku/core/function';
 import { CreateWireServices } from '@pikku/core/internal';
 import type { NodeType } from '@pikku/core/node';
 import type { ScopeId } from '../scopes/pikku-scopes.gen.js';
@@ -17,7 +17,7 @@ import type { Services } from '../../types/application-types.d.js';
 import type { Config } from '../../types/application-types.d.js';
 import type { TypedPikkuRPC, FlattenedRPCMap } from '../rpc/pikku-rpc-wirings-map.internal.gen.d.js';
 import type { RequiredSingletonServices, RequiredWireServices } from '../pikku-services.gen.js';
-import type { TypedWorkflow, TypedScenario, TypedScenarioActors } from '../workflow/pikku-workflow-types.gen.js';
+import type { TypedWorkflow, TypedScenario, TypedPersonas } from '../workflow/pikku-workflow-types.gen.js';
 export type { SingletonServices as SingletonServices };
 export type { Services as Services };
 export type Session = UserSession;
@@ -30,7 +30,20 @@ export type Session = UserSession;
  * why an `if (!service)` guard inside a function body is always dead code.
  */
 export type WiredSingletonServices = RequiredSingletonServices & SingletonServices;
-export type WiredServices = RequiredSingletonServices & Services;
+export type WiredServices = SecretlessServices<RequiredSingletonServices & Services>;
+/** `WiredSingletonServices` without `secrets`, for auth gates. */
+export type WiredAuthServices = SecretlessServices<WiredSingletonServices>;
+/**
+ * `WiredServices` with `secrets` restored, for the console's secret-admin
+ * functions. Reached by declaring `secretBroker: true` on a `pikkuFunc` config.
+ *
+ * Declaring it does not grant the service. The runner hands out the real
+ * `SecretService` only to the functions the inspector marks as secret brokers;
+ * every other function still receives the throwing accessor.
+ */
+export type WiredSecretBrokerServices = WiredServices & {
+    secrets: SecretService;
+};
 /**
  * Inline node configuration for function definitions.
  */
@@ -47,7 +60,7 @@ export type NodeConfig = {
  * @template In - The input type that the permission check will receive
  * @template RequiredServices - The services required for this permission check
  */
-export type PikkuPermission<In = unknown, RequiredServices extends Services = WiredServices> = CorePikkuPermission<In, RequiredServices, PikkuWire<In, never, false, Session>>;
+export type PikkuPermission<In = unknown, RequiredServices extends SecretlessServices<Services> = WiredServices> = CorePikkuPermission<In, RequiredServices, PikkuWire<In, never, false, Session>>;
 /**
  * Type-safe middleware definition that can access your application's services and session.
  * Use this to define reusable middleware that can be applied to multiple wirings.
@@ -58,7 +71,7 @@ export type PikkuMiddleware<RequiredServices extends SingletonServices = WiredSi
 /**
  * Configuration object for creating a permission with metadata
  */
-export type PikkuPermissionConfig<In = unknown, RequiredServices extends Services = WiredServices> = {
+export type PikkuPermissionConfig<In = unknown, RequiredServices extends SecretlessServices<Services> = WiredServices> = {
     /** The permission function */
     func: PikkuPermission<In, RequiredServices>;
     /** Optional human-readable name for the permission */
@@ -97,11 +110,11 @@ export declare const pikkuPermission: <In>(permission: PikkuPermission<In> | Pik
  *
  * @template RequiredServices - The services required for this auth check
  */
-export type PikkuAuth<RequiredServices extends SingletonServices = WiredSingletonServices> = CorePikkuAuth<RequiredServices, Session>;
+export type PikkuAuth<RequiredServices extends SecretlessServices<SingletonServices> = WiredAuthServices> = CorePikkuAuth<RequiredServices, Session>;
 /**
  * Configuration object for creating an auth permission with metadata
  */
-export type PikkuAuthConfig<RequiredServices extends SingletonServices = WiredSingletonServices> = CorePikkuAuthConfig<RequiredServices, Session>;
+export type PikkuAuthConfig<RequiredServices extends SecretlessServices<SingletonServices> = WiredAuthServices> = CorePikkuAuthConfig<RequiredServices, Session>;
 /**
  * Factory function for creating auth-only permissions with tree-shaking support.
  * Auth permissions only receive services and session (no request data),
@@ -122,7 +135,7 @@ export type PikkuAuthConfig<RequiredServices extends SingletonServices = WiredSi
  * })
  * \`\`\`
  */
-export declare const pikkuAuth: <RequiredServices extends SingletonServices = WiredSingletonServices>(auth: PikkuAuth<RequiredServices> | PikkuAuthConfig<RequiredServices>) => PikkuPermission<any, any>;
+export declare const pikkuAuth: <RequiredServices extends SecretlessServices<SingletonServices> = WiredAuthServices>(auth: PikkuAuth<RequiredServices> | PikkuAuthConfig<RequiredServices>) => PikkuPermission<any, any>;
 /**
  * Configuration object for creating middleware with metadata
  */
@@ -203,7 +216,7 @@ export declare const pikkuPermissionFactory: <In = any>(factory: (input: In) =>
  * @template In - The input type (same as the function it describes)
  * @template RequiredServices - The services required for this description function
  */
-export type PikkuApprovalDescription<In = unknown, RequiredServices extends Services = WiredServices> = (services: RequiredServices, data: In) => Promise<string>;
+export type PikkuApprovalDescription<In = unknown, RequiredServices extends SecretlessServices<Services> = WiredServices> = (services: RequiredServices, data: In) => Promise<string>;
 /**
  * Factory function for creating approval description functions with tree-shaking support.
  *
@@ -217,7 +230,7 @@ export type PikkuApprovalDescription<In = unknown, RequiredServices extends Serv
  * )
  * ```
  */
-export declare const pikkuApprovalDescription: <In = unknown, RequiredServices extends Services = WiredServices>(fn: PikkuApprovalDescription<In, RequiredServices>) => PikkuApprovalDescription<In, RequiredServices>;
+export declare const pikkuApprovalDescription: <In = unknown, RequiredServices extends SecretlessServices<Services> = WiredServices>(fn: PikkuApprovalDescription<In, RequiredServices>) => PikkuApprovalDescription<In, RequiredServices>;
 /**
  * A sessionless API function that doesn't require user authentication.
  * Use this for public endpoints, health checks, or operations that don't need user context.
@@ -226,7 +239,7 @@ export declare const pikkuApprovalDescription: <In = unknown, RequiredServices e
  * @template Out - The output type that the function returns
  * @template RequiredServices - Services required by this function
  */
-export type PikkuFunctionSessionless<In = unknown, Out = never, RequiredWires extends keyof PikkuWire = never, RequiredServices extends Services = WiredServices> = CorePikkuFunctionSessionless<In, Out, RequiredServices, Session, PickRequired<PikkuWire<In, Out, false, Session, TypedPikkuRPC, null, any, TypedWorkflow, unknown, TypedScenario, TypedScenarioActors>, RequiredWires>>;
+export type PikkuFunctionSessionless<In = unknown, Out = never, RequiredWires extends keyof PikkuWire = never, RequiredServices extends SecretlessServices<Services> = WiredServices> = CorePikkuFunctionSessionless<In, Out, RequiredServices, Session, PickRequired<PikkuWire<In, Out, false, Session, TypedPikkuRPC, null, any, TypedWorkflow, unknown, TypedScenario, TypedPersonas>, RequiredWires>>;
 /**
  * A session-aware API function that requires user authentication.
  * Use this for protected endpoints that need access to user session data.
@@ -235,7 +248,7 @@ export type PikkuFunctionSessionless<In = unknown, Out = never, RequiredWires ex
  * @template Out - The output type that the function returns
  * @template RequiredServices - Services required by this function
  */
-export type PikkuFunction<In = unknown, Out = never, RequiredWires extends keyof PikkuWire = 'session', RequiredServices extends Services = WiredServices> = CorePikkuFunction<In, Out, RequiredServices, Session, PickRequired<PikkuWire<In, Out, true, Session, TypedPikkuRPC, null, any, TypedWorkflow, unknown, TypedScenario, TypedScenarioActors>, RequiredWires>>;
+export type PikkuFunction<In = unknown, Out = never, RequiredWires extends keyof PikkuWire = 'session', RequiredServices extends SecretlessServices<Services> = WiredServices> = CorePikkuFunction<In, Out, RequiredServices, Session, PickRequired<PikkuWire<In, Out, true, Session, TypedPikkuRPC, null, any, TypedWorkflow, unknown, TypedScenario, TypedPersonas>, RequiredWires>>;
 /**
  * Helper type to infer the output type from a Standard Schema
  */
@@ -248,7 +261,12 @@ export type InferSchemaOutput<T> = T extends StandardSchemaV1<any, infer Output>
  * @template Out - The output type
  * @template PikkuFunc - The function type (can be narrowed to PikkuFunction or PikkuFunctionSessionless)
  */
-export type PikkuFunctionConfig<In = unknown, Out = unknown, RequiredWires extends keyof PikkuWire = never, PikkuFunc extends PikkuFunction<In, Out, RequiredWires> | PikkuFunctionSessionless<In, Out, RequiredWires> = PikkuFunction<In, Out, RequiredWires> | PikkuFunctionSessionless<In, Out, RequiredWires>, InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined> = CorePikkuFunctionConfig<PikkuFunc, PikkuPermission<In>, PikkuMiddleware, InputSchema, OutputSchema, ScopeId>;
+export type PikkuFunctionConfig<In = unknown, Out = unknown, RequiredWires extends keyof PikkuWire = never, PikkuFunc extends PikkuFunction<In, Out, RequiredWires, any> | PikkuFunctionSessionless<In, Out, RequiredWires, any> = PikkuFunction<In, Out, RequiredWires> | PikkuFunctionSessionless<In, Out, RequiredWires>, InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined> = CorePikkuFunctionConfig<PikkuFunc, PikkuPermission<In>, PikkuMiddleware, InputSchema, OutputSchema, ScopeId>;
+/**
+ * {@link PikkuFunctionConfig} for a function that runs without a session.
+ * Has no `scopes`: an anonymous caller holds none, so none can ever be met.
+ */
+export type PikkuFunctionSessionlessConfig<In = unknown, Out = unknown, RequiredWires extends keyof PikkuWire = never, PikkuFunc extends PikkuFunctionSessionless<In, Out, RequiredWires, any> = PikkuFunctionSessionless<In, Out, RequiredWires>, InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined> = CorePikkuSessionlessFunctionConfig<PikkuFunc, PikkuPermission<In>, PikkuMiddleware, InputSchema, OutputSchema>;
 /**
  * Configuration object for Pikku functions with Zod schema validation.
  * Use this when you want to define input/output schemas using Zod.
@@ -259,8 +277,8 @@ type SchemaInferred<S, Fallback = unknown> = S extends StandardSchemaV1 ? InferS
  * Schema-overload variant for pikkuFunc. Derived from CorePikkuFunctionConfig
  * so adding a field on the core type automatically propagates here.
  */
-export type PikkuFunctionConfigWithSchema<InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined, RequiredWires extends keyof PikkuWire = never> = Omit<CorePikkuFunctionConfig<PikkuFunction<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires> | PikkuFunctionSessionless<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires>, CorePikkuPermission<any>, PikkuMiddleware, undefined, undefined, ScopeId>, 'func' | 'input' | 'output' | 'permissions' | 'approvalDescription'> & {
-    func: PikkuFunction<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires> | PikkuFunctionSessionless<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires>;
+export type PikkuFunctionConfigWithSchema<InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined, RequiredWires extends keyof PikkuWire = never, RequiredServices extends SecretlessServices<Services> = WiredServices> = Omit<CorePikkuFunctionConfig<PikkuFunction<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires, RequiredServices> | PikkuFunctionSessionless<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires, RequiredServices>, CorePikkuPermission<any>, PikkuMiddleware, undefined, undefined, ScopeId>, 'func' | 'input' | 'output' | 'permissions' | 'approvalDescription'> & {
+    func: PikkuFunction<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires, RequiredServices> | PikkuFunctionSessionless<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires, RequiredServices>;
     input?: InputSchema;
     output?: OutputSchema;
     permissions?: InputSchema extends StandardSchemaV1 ? CorePermissionGroup<PikkuPermission<InferSchemaOutput<InputSchema>>> : undefined;
@@ -292,6 +310,9 @@ export type PikkuFunctionConfigWithSchema<InputSchema extends StandardSchemaV1 |
  * })
  * ```
  */
+export declare function pikkuFunc<InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined>(config: PikkuFunctionConfigWithSchema<InputSchema, OutputSchema, 'session' | 'rpc', WiredSecretBrokerServices> & {
+    secretBroker: true;
+}): PikkuFunctionConfig<InputSchema extends StandardSchemaV1 ? InferSchemaOutput<InputSchema> : unknown, OutputSchema extends StandardSchemaV1 ? InferSchemaOutput<OutputSchema> : unknown, 'session' | 'rpc'>;
 export declare function pikkuFunc<InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined>(config: PikkuFunctionConfigWithSchema<InputSchema, OutputSchema, 'session' | 'rpc'>): PikkuFunctionConfig<InputSchema extends StandardSchemaV1 ? InferSchemaOutput<InputSchema> : unknown, OutputSchema extends StandardSchemaV1 ? InferSchemaOutput<OutputSchema> : unknown, 'session' | 'rpc'>;
 export declare function pikkuFunc<In, Out = unknown>(func: PikkuFunction<In, Out, 'session' | 'rpc'> | PikkuFunctionConfig<In, Out, 'session' | 'rpc'>): PikkuFunctionConfig<In, Out, 'session' | 'rpc'>;
 export type PikkuListFunction<F extends Record<string, unknown> = {}, Row = unknown, S extends string = never> = PikkuFunction<ListInput<F, S>, ListOutput<Row>, 'session' | 'rpc'> | PikkuFunctionSessionless<ListInput<F, S>, ListOutput<Row>, 'session' | 'rpc'>;
@@ -301,10 +322,11 @@ export declare const pikkuListFunc: <F extends Record<string, unknown> = {}, Row
  */
 /**
  * Schema-overload variant for pikkuSessionlessFunc. Derived from
- * CorePikkuFunctionConfig to stay in sync with the generic-typed config.
+ * CorePikkuSessionlessFunctionConfig to stay in sync with the generic-typed
+ * config — so it has no `scopes` either.
  */
-export type PikkuFunctionSessionlessConfigWithSchema<InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined, RequiredWires extends keyof PikkuWire = never> = Omit<CorePikkuFunctionConfig<PikkuFunctionSessionless<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires>>, 'func' | 'input' | 'output' | 'permissions' | 'approvalDescription'> & {
-    func: PikkuFunctionSessionless<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires>;
+export type PikkuFunctionSessionlessConfigWithSchema<InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined, RequiredWires extends keyof PikkuWire = never, RequiredServices extends SecretlessServices<Services> = WiredServices> = Omit<CorePikkuSessionlessFunctionConfig<PikkuFunctionSessionless<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires, RequiredServices>>, 'func' | 'input' | 'output' | 'permissions' | 'approvalDescription'> & {
+    func: PikkuFunctionSessionless<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires, RequiredServices>;
     input?: InputSchema;
     output?: OutputSchema;
     permissions?: InputSchema extends StandardSchemaV1 ? CorePermissionGroup<PikkuPermission<InferSchemaOutput<InputSchema>>> : undefined;
@@ -334,8 +356,8 @@ export type PikkuFunctionSessionlessConfigWithSchema<InputSchema extends Standar
  * })
  * ```
  */
-export declare function pikkuSessionlessFunc<InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined>(config: PikkuFunctionSessionlessConfigWithSchema<InputSchema, OutputSchema, 'session' | 'rpc'>): PikkuFunctionConfig<InputSchema extends StandardSchemaV1 ? InferSchemaOutput<InputSchema> : unknown, OutputSchema extends StandardSchemaV1 ? InferSchemaOutput<OutputSchema> : unknown, 'session' | 'rpc'>;
-export declare function pikkuSessionlessFunc<In, Out = unknown>(func: PikkuFunctionSessionless<In, Out, 'session' | 'rpc'> | PikkuFunctionConfig<In, Out, 'session' | 'rpc'>): PikkuFunctionConfig<In, Out, 'session' | 'rpc'>;
+export declare function pikkuSessionlessFunc<InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined, RequiredServices extends SecretlessServices<Services> = WiredServices>(config: PikkuFunctionSessionlessConfigWithSchema<InputSchema, OutputSchema, 'session' | 'rpc', RequiredServices>): PikkuFunctionConfig<InputSchema extends StandardSchemaV1 ? InferSchemaOutput<InputSchema> : unknown, OutputSchema extends StandardSchemaV1 ? InferSchemaOutput<OutputSchema> : unknown, 'session' | 'rpc'>;
+export declare function pikkuSessionlessFunc<In, Out = unknown, RequiredServices extends SecretlessServices<Services> = WiredServices>(func: PikkuFunctionSessionless<In, Out, 'session' | 'rpc', RequiredServices> | PikkuFunctionSessionlessConfig<In, Out, 'session' | 'rpc', PikkuFunctionSessionless<In, Out, 'session' | 'rpc', RequiredServices>>): PikkuFunctionConfig<In, Out, 'session' | 'rpc'>;
 /**
  * Creates a function that takes no input and returns no output.
  * Useful for health checks, triggers, or cleanup operations.
@@ -352,7 +374,7 @@ export declare function pikkuSessionlessFunc<In, Out = unknown>(func: PikkuFunct
  * })
  * ```
  */
-export declare const pikkuVoidFunc: (func: PikkuFunctionSessionless<void, void, "session" | "rpc"> | PikkuFunctionConfig<void, void, "session" | "rpc">) => PikkuFunctionConfig<void, void, "rpc" | "session", PikkuFunctionSessionless<void, void, "rpc" | "session", WiredServices> | PikkuFunction<void, void, "rpc" | "session", WiredServices>, undefined, undefined>;
+export declare const pikkuVoidFunc: (func: PikkuFunctionSessionless<void, void, "session" | "rpc"> | PikkuFunctionSessionlessConfig<void, void, "session" | "rpc">) => PikkuFunctionSessionlessConfig<void, void, "rpc" | "session", PikkuFunctionSessionless<void, void, "rpc" | "session", WiredServices>, undefined, undefined>;
 /**
  * References a registered function by name for use in any wiring.
  * Works for both local and addon functions — resolves via RPC at runtime.
@@ -371,6 +393,25 @@ export declare const pikkuVoidFunc: (func: PikkuFunctionSessionless<void, void,
  * ```
  */
 export declare const ref: <Name extends keyof FlattenedRPCMap>(rpcName: Name) => PikkuFunctionConfig<FlattenedRPCMap[Name]["input"], FlattenedRPCMap[Name]["output"], "session" | "rpc">;
+/**
+ * Declares a capability the connected client answers, reachable from any
+ * `wireChannel` function as `channel.remote(name, input)`.
+ *
+ * There is no `func`: this side owns the contract, the client owns the body.
+ * The `description` is what a person is shown when asked to approve the call,
+ * so write it for them rather than for the caller.
+ *
+ * @example
+ * ```typescript
+ * export const localCheckoutOutput = z.object({ sha: z.string(), branch: z.string() })
+ *
+ * export const localCheckout = pikkuRemoteChannelFunc({
+ *   description: 'Read the current commit and branch of your working tree',
+ *   output: localCheckoutOutput,
+ * })
+ * ```
+ */
+export declare function pikkuRemoteChannelFunc<InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined>(config: Omit<PikkuFunctionSessionlessConfigWithSchema<InputSchema, OutputSchema, 'session' | 'rpc'>, 'func'>): PikkuFunctionConfig<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, 'session' | 'rpc'>;
 /**
  * Creates a Pikku config factory.
  * Use this to define your application's configuration factory.

package/dist/.pikku/function/pikku-function-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.93
+ * This file was generated by @pikku/cli@0.12.99
  */
 /**
  * Core function, middleware, and permission types for all wirings
@@ -192,6 +192,32 @@ export const ref = (rpcName) => {
         }
     };
 };
+/**
+ * Declares a capability the connected client answers, reachable from any
+ * `wireChannel` function as `channel.remote(name, input)`.
+ *
+ * There is no `func`: this side owns the contract, the client owns the body.
+ * The `description` is what a person is shown when asked to approve the call,
+ * so write it for them rather than for the caller.
+ *
+ * @example
+ * ```typescript
+ * export const localCheckoutOutput = z.object({ sha: z.string(), branch: z.string() })
+ *
+ * export const localCheckout = pikkuRemoteChannelFunc({
+ *   description: 'Read the current commit and branch of your working tree',
+ *   output: localCheckoutOutput,
+ * })
+ * ```
+ */
+export function pikkuRemoteChannelFunc(config) {
+    return {
+        ...config,
+        func: async (_services, _data, _wire) => {
+            throw new Error(`${config.title ?? 'This'} is a remote channel capability and has no local implementation — reach it with channel.remote() on the channel whose client exposes it.`);
+        },
+    };
+}
 /**
  * Creates a Pikku config factory.
  * Use this to define your application's configuration factory.

package/dist/.pikku/function/pikku-functions-meta.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.93
+ * This file was generated by @pikku/cli@0.12.99
  */
 import { pikkuState } from '@pikku/core/internal';
 import metaData from './pikku-functions-meta.gen.json' with { type: 'json' };