@pikku/cli 0.12.96 → 0.12.100

package/dist/src/functions/wirings/channels/pikku-channels.js

@@ -26,7 +26,7 @@ export const pikkuChannels = pikkuVoidFunc({
             const importStatement = supportsImportAttributes
                 ? `import metaData from '${jsonImportPath}' with { type: 'json' }`
                 : `import metaData from '${jsonImportPath}'`;
-            await writeFileInDir(logger, channelsWiringMetaFile, `import { pikkuState } from '@pikku/core/internal'\nimport { ChannelsMeta } from '@pikku/core/channel'\n${importStatement}\npikkuState(null, 'channel', 'meta', metaData as ChannelsMeta)`);
+            await writeFileInDir(logger, channelsWiringMetaFile, `import { pikkuState } from '@pikku/core/ecosystem'\nimport { ChannelsMeta } from '@pikku/core/channel'\n${importStatement}\npikkuState(null, 'channel', 'meta', metaData as ChannelsMeta)`);
         }
     },
     middleware: [

package/dist/src/functions/wirings/channels/pikku-command-channel-types.d.ts

@@ -1 +1 @@
-export declare const pikkuChannelTypes: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuChannelTypes: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/channels/pikku-command-channels-map.d.ts

@@ -1 +1 @@
-export declare const pikkuChannelsMap: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuChannelsMap: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/channels/pikku-command-channels.d.ts

@@ -1 +1 @@
-export declare const pikkuCommandChannels: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuCommandChannels: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/channels/pikku-command-channels.js

@@ -41,7 +41,7 @@ export const pikkuCommandChannels = pikkuSessionlessFunc({
         const importStatement = supportsImportAttributes
             ? `import metaData from '${jsonImportPath}' with { type: 'json' }`
             : `import metaData from '${jsonImportPath}'`;
-        await writeFileInDir(logger, channelsWiringMetaFile, `import { pikkuState } from '@pikku/core/internal'\nimport type { ChannelsMeta } from '@pikku/core/channel'\n${importStatement}\npikkuState(null, 'channel', 'meta', metaData as ChannelsMeta)`);
+        await writeFileInDir(logger, channelsWiringMetaFile, `import { pikkuState } from '@pikku/core/ecosystem'\nimport type { ChannelsMeta } from '@pikku/core/channel'\n${importStatement}\npikkuState(null, 'channel', 'meta', metaData as ChannelsMeta)`);
         return true;
     },
     middleware: [

package/dist/src/functions/wirings/channels/serialize-typed-channel-map.js

@@ -109,15 +109,23 @@ function generateChannels(logger, typesMap, functionsMeta, addonFunctions, chann
             }
         }
     }
+    /**
+     * A route or message key that is not a bare identifier has to be quoted to be
+     * a legal property name. Channel routes are author-chosen strings and a CLI
+     * channel's are command ids, where `app-smoke` and `registry.search` are the
+     * norm — unquoted, each one ends the property early and the whole map fails
+     * to parse. Quoted only when it has to be, so existing output is unchanged.
+     */
+    const propertyKey = (key) => /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key) ? key : `'${key}'`;
     let routesStr = 'export type ChannelsMap = {\n';
     for (const [channelPath, { routes, message }] of Object.entries(channelsObject)) {
         routesStr += `  readonly '${channelPath}': {\n`;
         // Add `routes` object
         routesStr += `    readonly routes: {\n`;
         for (const [key, methods] of Object.entries(routes)) {
-            routesStr += `      readonly ${key}: {\n`;
+            routesStr += `      readonly ${propertyKey(key)}: {\n`;
             for (const [method, handler] of Object.entries(methods)) {
-                routesStr += `        readonly ${method}: ChannelHandler<${formatTypeArray(handler.inputTypes) || 'void'}, ${formatTypeArray(handler.outputTypes) || 'never'}>,\n`;
+                routesStr += `        readonly ${propertyKey(method)}: ChannelHandler<${formatTypeArray(handler.inputTypes) || 'void'}, ${formatTypeArray(handler.outputTypes) || 'never'}>,\n`;
             }
             routesStr += '      },\n';
         }

package/dist/src/functions/wirings/cli/pikku-command-cli-entry.d.ts

@@ -1 +1 @@
-export declare const pikkuCLIEntry: import("#pikku").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuCLIEntry: import("#pikku").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/cli/pikku-command-cli-entry.js

@@ -64,15 +64,20 @@ export const pikkuCLIEntry = pikkuSessionlessFunc({
                     // Generate client code if clientPath is provided
                     if (channelClientPath) {
                         const channelClientFile = join(config.rootDir, channelClientPath);
-                        // Validate that renderers don't depend on services (client-side renderers can't access server services)
+                        // A renderer for a CLI-over-channel program runs on the client, where
+                        // there is no service container to resolve from — the only thing the
+                        // runtime can hand it is a logger. Anything else it destructures
+                        // would be undefined at runtime, so it fails generation instead.
                         const rendererNames = collectRendererNames(programMeta);
                         const problematicRenderers = [];
                         for (const rendererName of rendererNames) {
                             const rendererMeta = visitState.cli.meta.renderers[rendererName];
-                            if (rendererMeta?.services?.services?.length > 0) {
+                            const services = rendererMeta?.services?.services ?? [];
+                            const unavailable = services.filter((name) => name !== 'logger');
+                            if (unavailable.length > 0) {
                                 problematicRenderers.push({
                                     name: rendererName,
-                                    services: rendererMeta.services.services,
+                                    services: unavailable,
                                 });
                             }
                         }
@@ -81,7 +86,7 @@ export const pikkuCLIEntry = pikkuSessionlessFunc({
                             const details = problematicRenderers
                                 .map((r) => `  - ${r.name} depends on: ${r.services.join(', ')}`)
                                 .join('\n');
-                            logger.critical(ErrorCode.CLI_CLIENTSIDE_RENDERER_HAS_SERVICES, `Cannot generate CLI channel client for '${programName}': renderers cannot depend on services (client-side execution)\n${details}\n\nRenderers used in CLI-over-channel must be service-free since they execute on the client.`);
+                            logger.critical(ErrorCode.CLI_CLIENTSIDE_RENDERER_HAS_SERVICES, `Cannot generate CLI channel client for '${programName}': a renderer reached for a service that does not exist on the client\n${details}\n\nRenderers in a CLI-over-channel program run on the client side of the socket, where the only available service is 'logger'.`);
                             // Delete existing client file if it exists
                             if (existsSync(channelClientFile)) {
                                 await rm(channelClientFile);

package/dist/src/functions/wirings/cli/pikku-command-cli-types.d.ts

@@ -1,5 +1,5 @@
 type CLITypesCommandInput = {
     bootstrap?: boolean;
 };
-export declare const pikkuCLITypes: import("#pikku").PikkuFunctionConfig<CLITypesCommandInput, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<CLITypesCommandInput, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<CLITypesCommandInput, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuCLITypes: import("#pikku").PikkuFunctionConfig<CLITypesCommandInput, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<CLITypesCommandInput, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<CLITypesCommandInput, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
 export {};

package/dist/src/functions/wirings/cli/pikku-command-cli.d.ts

@@ -1 +1 @@
-export declare const pikkuCLI: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuCLI: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/cli/pikku-command-cli.js

@@ -41,7 +41,7 @@ export const pikkuCLI = pikkuSessionlessFunc({
         const importStatement = supportsImportAttributes
             ? `import metaData from '${jsonImportPath}' with { type: 'json' }`
             : `import metaData from '${jsonImportPath}'`;
-        await writeFileInDir(logger, cliWiringMetaFile, `import { pikkuState } from '@pikku/core/internal'\nimport { CLIMeta } from '@pikku/core/cli'\n${importStatement}\npikkuState(null, 'cli', 'meta', metaData as CLIMeta)`);
+        await writeFileInDir(logger, cliWiringMetaFile, `import { pikkuState } from '@pikku/core/ecosystem'\nimport { CLIMeta } from '@pikku/core/cli'\n${importStatement}\npikkuState(null, 'cli', 'meta', metaData as CLIMeta)`);
         return true;
     },
     middleware: [

package/dist/src/functions/wirings/cli/serialize-channel-cli-client.js

@@ -1,4 +1,5 @@
 import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
+import { DIRECT_EXECUTION_GUARD } from './serialize-cli-entrypoint-guard.js';
 /**
  * Collect all unique renderer names from CLI metadata (populated by inspector)
  */
@@ -107,10 +108,11 @@ export function serializeChannelCLIClient(programName, programMeta, clientFile,
         ? resolveRendererBinding(programMeta.defaultRenderName, renderersMeta)
         : null;
     const defaultRendererCode = defaultRendererBinding
-        ? `,\n    defaultRenderer: ${defaultRendererBinding}`
+        ? `,\n    defaultRenderer: ${defaultRendererBinding} as CorePikkuCLIClientRender<any>`
         : '';
     return `
 import { executeRawCLIViaChannel } from '@pikku/core/cli/channel'
+import type { CorePikkuCLIClientRender } from '@pikku/core/cli/channel'
 import type { Capabilities } from '@pikku/core/channel'
 import { CorePikkuWebsocket } from '@pikku/websocket'
 ${rendererImports}
@@ -136,8 +138,12 @@ export async function ${capitalizedName}CLIClient(
   // Create Pikku WebSocket wrapper
   const pikkuWS = new CorePikkuWebsocket(ws)
 
-  // Register renderers for CLI commands
-  const renderers = ${renderersMap}
+  // Renderers are declared against this app's \`SingletonServices\`, but on this
+  // side of the socket the only service that exists is a logger. The cast is
+  // sound because generation refuses to emit this file at all when a renderer
+  // reaches for anything else — see CLI_CLIENTSIDE_RENDERER_HAS_SERVICES. It is
+  // localised here so \`executeRawCLIViaChannel\` can keep an honest signature.
+  const renderers = ${renderersMap} as Record<string, CorePikkuCLIClientRender<any>>
 
   return executeRawCLIViaChannel({
     pikkuWS,
@@ -151,15 +157,17 @@ export async function ${capitalizedName}CLIClient(
 export default ${capitalizedName}CLIClient
 
 // For direct execution (if this file is run directly)
-if (import.meta.url === \`file://\${process.argv[1]}\`) {
+${DIRECT_EXECUTION_GUARD}
+
+if (isDirectExecution) {
   const url = process.env.PIKKU_WS_URL || 'ws://localhost:4002${finalChannelRoute}'
 
   // Attach credentials so the channel authenticates like any other pikku client.
   // A machine API key (PIKKU_API_KEY -> x-api-key) takes precedence; otherwise
   // the human session token saved by \`pikku login\` (~/.pikku/session.json ->
-  // Authorization: Bearer) is used. This block only runs under Node (direct
-  // execution), so reading the session file and using the 'ws' headers option
-  // is safe — the browser WebSocket cannot set custom headers anyway.
+  // Authorization: Bearer) is used. This block only runs on a server runtime
+  // (direct execution), so reading the session file is safe — a browser could
+  // neither reach it nor set custom headers on its WebSocket.
   const headers: Record<string, string> = {}
   if (process.env.PIKKU_API_KEY) {
     headers['x-api-key'] = process.env.PIKKU_API_KEY
@@ -186,12 +194,26 @@ if (import.meta.url === \`file://\${process.argv[1]}\`) {
   }
   const hasAuth = Object.keys(headers).length > 0
 
-  // Custom headers require the Node 'ws' module — the global/browser WebSocket
-  // cannot set them — so prefer 'ws' whenever we have credentials to send.
+  // Node's global WebSocket reads its second argument as subprotocols and drops
+  // custom headers on the floor, so credentials there need the 'ws' module.
+  // Bun's honours them natively, and reaching for 'ws' under Bun would load its
+  // compatibility shim for nothing. Detected once, the way the CLI picks its
+  // dev-server runner.
+  const isBun = typeof (globalThis as { Bun?: unknown }).Bun !== 'undefined'
+
+  // Only the header-carrying Bun call needs the cast: the DOM lib types the
+  // second argument as subprotocols, which is what Node implements.
+  type WebSocketWithHeaders = new (
+    url: string,
+    options: { headers: Record<string, string> }
+  ) => WebSocket
+
   let ws: WebSocket
-  if (hasAuth || typeof WebSocket === 'undefined') {
+  if (!isBun && (hasAuth || typeof WebSocket === 'undefined')) {
     const wsModule = await import('ws')
     ws = new wsModule.default(url, { headers }) as unknown as WebSocket
+  } else if (hasAuth) {
+    ws = new (WebSocket as unknown as WebSocketWithHeaders)(url, { headers })
   } else {
     ws = new WebSocket(url)
   }

package/dist/src/functions/wirings/cli/serialize-channel-cli.js

@@ -61,7 +61,7 @@ import { wireChannel } from '${channelTypesPath}'
 import { pikkuMiddleware${hasAddonFuncs ? ', ref' : ''}, pikkuSessionlessFunc } from '${functionTypesPath}'
 import { generateCommandHelp } from '@pikku/core/cli'
 import { handleRawCLI, type RawCLIFrame } from '@pikku/core/cli/channel'
-import { pikkuState } from '@pikku/core/internal'
+import { pikkuState } from '@pikku/core/ecosystem'
 ${imports}
 
 // Middleware to close the channel after CLI command completes
@@ -143,7 +143,7 @@ export const cliRaw = pikkuSessionlessFunc<{ args: string[] }, RawCLIFrame>({
   },
 })
 
-${programMeta.auth === true
+${programMeta.auth !== false
         ? `/**
  * Refuses a connection that arrives without a session.
  *
@@ -168,8 +168,8 @@ export const cliRequireSession = pikkuSessionlessFunc<void, RawCLIFrame | void>(
 wireChannel({
   name: '${finalChannelName}',
   route: '${finalChannelRoute}',
-  auth: ${programMeta.auth === true},
-${programMeta.auth === true ? '  onConnect: cliRequireSession,\n' : ''}  onMessageWiring: {
+  auth: ${programMeta.auth !== false},
+${programMeta.auth !== false ? '  onConnect: cliRequireSession,\n' : ''}  onMessageWiring: {
     command: {
       '__help': {
         func: cliHelp,

package/dist/src/functions/wirings/cli/serialize-cli-entrypoint-guard.d.ts

@@ -0,0 +1,12 @@
+/**
+ * The snippet every generated CLI entrypoint uses to decide whether it is being
+ * run or merely imported. It declares `isDirectExecution`; the caller writes the
+ * `if`.
+ *
+ * `import.meta.url === \`file://${process.argv[1]}\`` — the shape this replaces —
+ * is false for any CLI invoked through a symlinked bin, because Node reports the
+ * symlink in argv and the realpath in the URL, so the block never ran for an
+ * installed `node_modules/.bin/<name>`. It also fails on paths the URL has to
+ * percent-encode, such as one containing a space.
+ */
+export declare const DIRECT_EXECUTION_GUARD = "const isDirectExecution = await (async () => {\n  if (typeof import.meta.main === 'boolean') {\n    return import.meta.main\n  }\n  // Node exposes import.meta.main from 24.2; earlier 24.x compares realpaths,\n  // which is what it is shorthand for.\n  try {\n    const { fileURLToPath } = await import('node:url')\n    const { realpathSync } = await import('node:fs')\n    return (\n      process.argv[1] !== undefined &&\n      realpathSync(process.argv[1]) === fileURLToPath(import.meta.url)\n    )\n  } catch {\n    return false\n  }\n})()";

package/dist/src/functions/wirings/cli/serialize-cli-entrypoint-guard.js

@@ -0,0 +1,28 @@
+/**
+ * The snippet every generated CLI entrypoint uses to decide whether it is being
+ * run or merely imported. It declares `isDirectExecution`; the caller writes the
+ * `if`.
+ *
+ * `import.meta.url === \`file://${process.argv[1]}\`` — the shape this replaces —
+ * is false for any CLI invoked through a symlinked bin, because Node reports the
+ * symlink in argv and the realpath in the URL, so the block never ran for an
+ * installed `node_modules/.bin/<name>`. It also fails on paths the URL has to
+ * percent-encode, such as one containing a space.
+ */
+export const DIRECT_EXECUTION_GUARD = `const isDirectExecution = await (async () => {
+  if (typeof import.meta.main === 'boolean') {
+    return import.meta.main
+  }
+  // Node exposes import.meta.main from 24.2; earlier 24.x compares realpaths,
+  // which is what it is shorthand for.
+  try {
+    const { fileURLToPath } = await import('node:url')
+    const { realpathSync } = await import('node:fs')
+    return (
+      process.argv[1] !== undefined &&
+      realpathSync(process.argv[1]) === fileURLToPath(import.meta.url)
+    )
+  } catch {
+    return false
+  }
+})()`;

package/dist/src/functions/wirings/cli/serialize-local-cli-bootstrap.js

@@ -1,4 +1,5 @@
 import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
+import { DIRECT_EXECUTION_GUARD } from './serialize-cli-entrypoint-guard.js';
 /**
  * Serializes the local (in-program) CLI bootstrap code
  */
@@ -40,7 +41,9 @@ ${wireServicesFactory ? '      createWireServices,' : ''}
 export default ${capitalizedName}CLI
 
 // For direct execution (if this file is run directly)
-if (import.meta.url === \`file://\${process.argv[1]}\`) {
+${DIRECT_EXECUTION_GUARD}
+
+if (isDirectExecution) {
   ${capitalizedName}CLI(process.argv.slice(2)).catch(error => {
     console.error('Fatal error:', error.message)
     process.exit(1)

package/dist/src/functions/wirings/console/pikku-command-console-functions.d.ts

@@ -1 +1 @@
-export declare const pikkuConsoleFunctions: import("#pikku").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuConsoleFunctions: import("#pikku").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/console/pikku-command-node-types.d.ts

@@ -1 +1 @@
-export declare const pikkuNodeTypes: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuNodeTypes: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/console/pikku-command-nodes-meta.d.ts

@@ -1 +1 @@
-export declare const pikkuNodesMeta: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuNodesMeta: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/console/serialize-console-functions.js

@@ -115,7 +115,7 @@ export const pikkuConsoleGetSecret = pikkuFunc({
       return { exists: false, value: null }
     }
     const value = await secrets.getSecret(secretId)
-    return { exists: true, value }
+    return { exists: true, value: value.reveal() }
   },
 })
 

package/dist/src/functions/wirings/credentials/pikku-command-credentials.d.ts

@@ -1 +1 @@
-export declare const pikkuCredentials: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuCredentials: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/emails/pikku-command-emails.d.ts

@@ -1,6 +1,6 @@
 import type { PikkuCLIConfig } from '../../../../types/config.js';
 import type { CLILogger } from '../../../services/cli-logger.service.js';
-export declare const pikkuEmails: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuEmails: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
 export declare function generateEmailsArtifacts(logger: CLILogger, config: Pick<PikkuCLIConfig, 'outDir'> & {
     emailTemplatesDir?: string;
 }): Promise<true | undefined>;

package/dist/src/functions/wirings/functions/pikku-command-addon-types.d.ts

@@ -1,5 +1,5 @@
 type AddonTypesCommandInput = {
     bootstrap?: boolean;
 };
-export declare const pikkuAddonTypes: import("#pikku").PikkuFunctionConfig<AddonTypesCommandInput, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<AddonTypesCommandInput, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<AddonTypesCommandInput, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuAddonTypes: import("#pikku").PikkuFunctionConfig<AddonTypesCommandInput, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<AddonTypesCommandInput, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<AddonTypesCommandInput, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
 export {};

package/dist/src/functions/wirings/functions/pikku-command-function-types-split.d.ts

@@ -2,6 +2,6 @@ export declare const pikkuFunctionTypesSplit: import("#pikku").PikkuFunctionConf
     bootstrap?: boolean;
 }, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{
     bootstrap?: boolean;
-}, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<{
+}, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<{
     bootstrap?: boolean;
 }, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/functions/pikku-command-function-types.d.ts

@@ -2,6 +2,6 @@ export declare const pikkuFunctionTypes: import("#pikku").PikkuFunctionConfig<{
     bootstrap?: boolean;
 }, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{
     bootstrap?: boolean;
-}, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<{
+}, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<{
     bootstrap?: boolean;
 }, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/functions/pikku-command-functions.d.ts

@@ -1 +1 @@
-export declare const pikkuFunctions: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuFunctions: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/functions/pikku-command-functions.js

@@ -27,7 +27,7 @@ export const pikkuFunctions = pikkuSessionlessFunc({
             ? `import metaData from '${jsonImportPath}' with { type: 'json' }`
             : `import metaData from '${jsonImportPath}'`;
         const packageName = config.addonName ? `'${config.addonName}'` : 'null';
-        await writeFileInDir(logger, functionsMetaFile, `import { pikkuState } from '@pikku/core/internal'\nimport type { FunctionsMeta } from '@pikku/core'\n${importStatement}\npikkuState(${packageName}, 'function', 'meta', metaData as FunctionsMeta)`);
+        await writeFileInDir(logger, functionsMetaFile, `import { pikkuState } from '@pikku/core/ecosystem'\nimport type { FunctionsMeta } from '@pikku/core'\n${importStatement}\npikkuState(${packageName}, 'function', 'meta', metaData as FunctionsMeta)`);
         // For addon packages, register ALL functions (they'll be invoked by consumers)
         // For main packages, only register functions that are invoked via internal RPCs
         const isAddon = !!config.addonName;

package/dist/src/functions/wirings/functions/pikku-command-services.d.ts

@@ -1,2 +1,2 @@
 export declare const serializeServicesMap: (allSingletonServices: string[], allWireServices: string[], requiredServices: Set<string>, forceRequiredServices: string[] | undefined, servicesImport: string, wireServicesImport: string, addonRequiredParentServices?: string[], authInjected?: boolean, agentScaffoldEnabled?: boolean) => string;
-export declare const pikkuServices: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuServices: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/functions/schemas.d.ts

@@ -1 +1 @@
-export declare const pikkuSchemas: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuSchemas: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/functions/serialize-addon-types.js

@@ -53,7 +53,7 @@ export const pikkuAddonConfig = <ExistingServices extends Omit<Partial<Singleton
  *   { secrets }
  * ) => {
  *   const creds = await secrets.getSecret<GithubCredentials>('GITHUB_CREDENTIALS')
- *   const github = new GithubService(creds)
+ *   const github = new GithubService(creds.reveal())
  *   return { github }
  * })
  * \`\`\`

package/dist/src/functions/wirings/functions/serialize-function-types.js

@@ -16,14 +16,14 @@ export const serializeFunctionTypes = (userSessionTypeImport, userSessionTypeNam
  */
 
 import type { CorePikkuMiddleware, CorePermissionGroup, ListInput, ListOutput, PikkuWire, PickRequired, SecretlessServices, SecretService } from '@pikku/core'
-import type { CorePikkuFunctionConfig, CorePikkuAuth, CorePikkuAuthConfig, CorePikkuPermission } from '@pikku/core/function'
+import type { CorePikkuFunctionConfig, CorePikkuSessionlessFunctionConfig, CorePikkuAuth, CorePikkuAuthConfig, CorePikkuPermission } from '@pikku/core/function'
 import { pikkuAuth as pikkuAuthCore } from '@pikku/core/function'
 import {
   addTagMiddleware as addTagMiddlewareCore,
   addGlobalMiddleware as addGlobalMiddlewareCore,
   addGlobalPermission as addGlobalPermissionCore,
 } from '@pikku/core/middleware'
-import { pikkuState as __pikkuState, CreateWireServices } from '@pikku/core/internal'
+import { pikkuState as __pikkuState, CreateWireServices } from '@pikku/core/ecosystem'
 import type { NodeType } from '@pikku/core/node'
 ${scopesImport}
 import type { StandardSchemaV1 } from '@standard-schema/spec'
@@ -301,18 +301,28 @@ export const pikkuApprovalDescription = <In = unknown, RequiredServices extends
  * @template In - The input type
  * @template Out - The output type that the function returns
  * @template RequiredServices - Services required by this function
+ * @template ScenarioOut - Types \`scenario.context\`. Only scenarios set it:
+ *   \`PikkuFunctionScenario\` passes the scenario's own output, and a *hook*
+ *   passes the output of the scenario it belongs to (it returns void itself).
+ *
+ *   It deliberately does NOT default to \`Out\`. That would make every ordinary
+ *   function's wire type vary with its return type, and a \`func\` written
+ *   against the \`PikkuFunction | PikkuFunctionSessionless\` union then loses
+ *   contextual typing — its parameters fall back to \`any\` and the assignment
+ *   fails with no hint as to why.
  */
 export type PikkuFunctionSessionless<
   In = unknown,
   Out = never,
   RequiredWires extends keyof PikkuWire = never,
-  RequiredServices extends SecretlessServices<Services> = WiredServices
+  RequiredServices extends SecretlessServices<Services> = WiredServices,
+  ScenarioOut = unknown
 > = CorePikkuFunctionSessionless<
     In,
     Out,
     RequiredServices,
     Session,
-    PickRequired<PikkuWire<In, Out, false, Session, TypedPikkuRPC, null, any, TypedWorkflow, unknown, TypedScenario, TypedPersonas>, RequiredWires>
+    PickRequired<PikkuWire<In, Out, false, Session, TypedPikkuRPC, null, any, TypedWorkflow, unknown, TypedScenario<ScenarioOut>, TypedPersonas>, RequiredWires>
   >
 
 /**
@@ -353,11 +363,28 @@ export type PikkuFunctionConfig<
   In = unknown,
   Out = unknown,
   RequiredWires extends keyof PikkuWire = never,
-  PikkuFunc extends PikkuFunction<In, Out, RequiredWires, any> | PikkuFunctionSessionless<In, Out, RequiredWires, any> = PikkuFunction<In, Out, RequiredWires> | PikkuFunctionSessionless<In, Out, RequiredWires>,
+  // \`any\` in the ScenarioOut slot, not \`unknown\`: a scenario body types its
+  // context as its own output, and a constraint pinned to one context type
+  // would refuse it. \`ScenarioContext<any>\` collapses to \`any\`, so the
+  // constraint stays open on that axis alone.
+  PikkuFunc extends PikkuFunction<In, Out, RequiredWires, any> | PikkuFunctionSessionless<In, Out, RequiredWires, any, any> = PikkuFunction<In, Out, RequiredWires> | PikkuFunctionSessionless<In, Out, RequiredWires>,
   InputSchema extends StandardSchemaV1 | undefined = undefined,
   OutputSchema extends StandardSchemaV1 | undefined = undefined
 > = CorePikkuFunctionConfig<PikkuFunc, PikkuPermission<In>, PikkuMiddleware, InputSchema, OutputSchema, ScopeId>
 
+/**
+ * {@link PikkuFunctionConfig} for a function that runs without a session.
+ * Has no \`scopes\`: an anonymous caller holds none, so none can ever be met.
+ */
+export type PikkuFunctionSessionlessConfig<
+  In = unknown,
+  Out = unknown,
+  RequiredWires extends keyof PikkuWire = never,
+  PikkuFunc extends PikkuFunctionSessionless<In, Out, RequiredWires, any> = PikkuFunctionSessionless<In, Out, RequiredWires>,
+  InputSchema extends StandardSchemaV1 | undefined = undefined,
+  OutputSchema extends StandardSchemaV1 | undefined = undefined
+> = CorePikkuSessionlessFunctionConfig<PikkuFunc, PikkuPermission<In>, PikkuMiddleware, InputSchema, OutputSchema>
+
 /**
  * Configuration object for Pikku functions with Zod schema validation.
  * Use this when you want to define input/output schemas using Zod.
@@ -479,7 +506,8 @@ export const pikkuListFunc = <
  */
 /**
  * Schema-overload variant for pikkuSessionlessFunc. Derived from
- * CorePikkuFunctionConfig to stay in sync with the generic-typed config.
+ * CorePikkuSessionlessFunctionConfig to stay in sync with the generic-typed
+ * config — so it has no \`scopes\` either.
  */
 export type PikkuFunctionSessionlessConfigWithSchema<
   InputSchema extends StandardSchemaV1 | undefined = undefined,
@@ -487,7 +515,7 @@ export type PikkuFunctionSessionlessConfigWithSchema<
   RequiredWires extends keyof PikkuWire = never,
   RequiredServices extends SecretlessServices<Services> = WiredServices
 > = Omit<
-  CorePikkuFunctionConfig<
+  CorePikkuSessionlessFunctionConfig<
     PikkuFunctionSessionless<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires, RequiredServices>
   >,
   'func' | 'input' | 'output' | 'permissions' | 'approvalDescription'
@@ -542,7 +570,7 @@ export function pikkuSessionlessFunc<
 export function pikkuSessionlessFunc<In, Out = unknown, RequiredServices extends SecretlessServices<Services> = WiredServices>(
   func:
     | PikkuFunctionSessionless<In, Out, 'session' | 'rpc', RequiredServices>
-    | PikkuFunctionConfig<In, Out, 'session' | 'rpc', PikkuFunctionSessionless<In, Out, 'session' | 'rpc', RequiredServices>>
+    | PikkuFunctionSessionlessConfig<In, Out, 'session' | 'rpc', PikkuFunctionSessionless<In, Out, 'session' | 'rpc', RequiredServices>>
 ): PikkuFunctionConfig<In, Out, 'session' | 'rpc'>
 export function pikkuSessionlessFunc(func: any) {
   return typeof func === 'function' ? { func } : func
@@ -567,7 +595,7 @@ export function pikkuSessionlessFunc(func: any) {
 export const pikkuVoidFunc = (
   func:
     | PikkuFunctionSessionless<void, void, 'session' | 'rpc'>
-    | PikkuFunctionConfig<void, void, 'session' | 'rpc'>
+    | PikkuFunctionSessionlessConfig<void, void, 'session' | 'rpc'>
 ) => {
   return typeof func === 'function' ? { func } : func
 }

package/dist/src/functions/wirings/gateway/pikku-command-gateway.d.ts

@@ -1 +1 @@
-export declare const pikkuGateway: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuGateway: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/graph/pikku-command-graph-wirings.d.ts

@@ -1 +1 @@
-export declare const pikkuGraphWirings: import("#pikku").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuGraphWirings: import("#pikku").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/http/pikku-command-http-map.d.ts

@@ -1 +1 @@
-export declare const pikkuHTTPMap: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuHTTPMap: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/http/pikku-command-http-routes.d.ts

@@ -1 +1 @@
-export declare const pikkuCommandHTTP: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuCommandHTTP: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/http/pikku-command-http-routes.js

@@ -42,7 +42,7 @@ export const pikkuCommandHTTP = pikkuSessionlessFunc({
         const importStatement = supportsImportAttributes
             ? `import metaData from '${jsonImportPath}' with { type: 'json' }`
             : `import metaData from '${jsonImportPath}'`;
-        await writeFileInDir(logger, httpWiringMetaFile, `import { pikkuState } from '@pikku/core/internal'\nimport type { HTTPWiringsMeta } from '@pikku/core/http'\n${importStatement}\npikkuState(null, 'http', 'meta', metaData as HTTPWiringsMeta)`);
+        await writeFileInDir(logger, httpWiringMetaFile, `import { pikkuState } from '@pikku/core/ecosystem'\nimport type { HTTPWiringsMeta } from '@pikku/core/http'\n${importStatement}\npikkuState(null, 'http', 'meta', metaData as HTTPWiringsMeta)`);
         return true;
     },
     middleware: [

package/dist/src/functions/wirings/http/pikku-command-http-types.d.ts

@@ -1 +1 @@
-export declare const pikkuHTTPTypes: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuHTTPTypes: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/http/pikku-command-openapi.d.ts

@@ -1 +1 @@
-export declare const pikkuOpenAPI: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuOpenAPI: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/http/pikku-http-routes.d.ts

@@ -1 +1 @@
-export declare const pikkuHTTP: import("#pikku").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuHTTP: import("#pikku").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/http/pikku-http-routes.js

@@ -18,7 +18,7 @@ export const pikkuHTTP = pikkuSessionlessFunc({
         const importStatement = supportsImportAttributes
             ? `import metaData from '${jsonImportPath}' with { type: 'json' }`
             : `import metaData from '${jsonImportPath}'`;
-        await writeFileInDir(logger, httpWiringMetaFile, `import { pikkuState } from '@pikku/core/internal'\nimport type { HTTPWiringsMeta } from '@pikku/core/http'\n${importStatement}\npikkuState(null, 'http', 'meta', metaData as HTTPWiringsMeta)`);
+        await writeFileInDir(logger, httpWiringMetaFile, `import { pikkuState } from '@pikku/core/ecosystem'\nimport type { HTTPWiringsMeta } from '@pikku/core/http'\n${importStatement}\npikkuState(null, 'http', 'meta', metaData as HTTPWiringsMeta)`);
         return true;
     },
     middleware: [