@pikku/cli 0.12.96 → 0.12.100

package/dist/src/functions/wirings/workflow/serialize-workflow-types.js

@@ -9,7 +9,7 @@ import {
 import type { PikkuWorkflowWire, PikkuScenarioWire, WorkflowStepOptions, ScenarioStepOptions } from '@pikku/core/workflow'
 
 export { WorkflowCancelledException }
-import type { PikkuFunctionSessionless, PikkuFunctionConfig } from '${functionTypesImportPath}'
+import type { PikkuFunctionSessionless, PikkuFunctionConfig, WiredServices } from '${functionTypesImportPath}'
 import type { FlattenedRPCMap } from '${rpcMapImportPath}'
 import type { FlattenedWorkflowMap } from '${workflowMapImportPath}'
 import type { AgentMap as FlattenedAgentMap } from '${agentMapImportPath}'
@@ -43,18 +43,12 @@ export interface TypedWorkflow extends PikkuWorkflowWire {
 }
 
 /**
- * The typed half of a scenario wire: \`step\` and its \`given\`/\`when\`/\`then\`
- * sugar, narrowed to the names declared by \`pikkuScenarioStep\` in this project.
- * The phase only changes the prose the reporter renders.
+ * The typed half of a scenario wire: \`given\`/\`when\`/\`then\`, narrowed to the
+ * names declared by \`pikkuScenarioStep\` in this project. \`given\` and \`when\`
+ * differ only in the prose the reporter renders; \`then\` additionally makes the
+ * step's bindings witnesses rather than alternatives.
  */
 export interface TypedScenarioSteps {
-  step<K extends keyof FlattenedScenarioStepMap>(
-    stepName: string,
-    stepFunc: K,
-    data?: FlattenedScenarioStepMap[K]['input'],
-    options?: ScenarioStepOptions
-  ): Promise<FlattenedScenarioStepMap[K]['output']>
-
   given<K extends keyof FlattenedScenarioStepMap>(
     stepName: string,
     stepFunc: K,
@@ -77,8 +71,12 @@ export interface TypedScenarioSteps {
   ): Promise<FlattenedScenarioStepMap[K]['output']>
 }
 
-export type TypedScenario = TypedWorkflow &
-  Omit<PikkuScenarioWire, keyof PikkuWorkflowWire | keyof TypedScenarioSteps> &
+/**
+ * \`Out\` types \`scenario.context\` — the scratch the body shares with its
+ * \`before\`/\`after\` hooks — as a partial of what a completed run produces.
+ */
+export type TypedScenario<Out = unknown> = TypedWorkflow &
+  Omit<PikkuScenarioWire<Out>, keyof PikkuWorkflowWire | keyof TypedScenarioSteps> &
   TypedScenarioSteps
 
 import type { StandardSchemaV1 } from '@standard-schema/spec'
@@ -92,10 +90,16 @@ export type PikkuFunctionWorkflow<
   Out = never
 > = PikkuFunctionSessionless<In, Out, 'workflow'>
 
+/**
+ * \`Ctx\` types \`scenario.context\` and defaults to the function's own output,
+ * which is what a scenario body wants. A hook returns void but shares the
+ * scenario's context, so it passes the scenario's output here instead.
+ */
 export type PikkuFunctionScenario<
   In = unknown,
-  Out = never
-> = PikkuFunctionSessionless<In, Out, 'scenario' | 'actors'>
+  Out = never,
+  Ctx = Out
+> = PikkuFunctionSessionless<In, Out, 'scenario' | 'actors', WiredServices, Ctx>
 
 export type PikkuWorkflowConfigWithSchema<
   InputSchema extends StandardSchemaV1 | undefined = undefined,
@@ -176,14 +180,17 @@ export type PikkuScenarioConfigWithSchema<
    * on the ladder. Throwing skips the body and fails the run; \`after\` still
    * runs.
    */
-  before?: PikkuScenarioHook<InputSchema>
+  before?: PikkuScenarioHook<InputSchema, OutputSchema>
   /**
    * Always runs after the scenario body, in a \`finally\`, whether it passed or
    * failed. Throwing fails a run that would otherwise have passed; on an
    * already-failed run it attaches as the \`cause\` and never replaces the
    * original error.
+   *
+   * Reads \`scenario.context\` for whatever the body managed to record before it
+   * stopped — that is how teardown learns the ids a failed run created.
    */
-  after?: PikkuScenarioHook<InputSchema>
+  after?: PikkuScenarioHook<InputSchema, OutputSchema>
   /**
    * Why this scenario is held out of a default run, stated where the scenario
    * is. The scenario still appears in the plan and is reported as skipped
@@ -196,12 +203,18 @@ export type PikkuScenarioConfigWithSchema<
 /**
  * A scenario lifecycle hook: the scenario's own \`(services, data, wire)\`
  * signature with its result discarded.
+ *
+ * The hook returns void but shares the scenario's \`context\`, so the output
+ * schema types \`scenario.context\` while the return type stays \`void\` — a hook
+ * is setup and teardown, never a step, and nothing it returns is recorded.
  */
 export type PikkuScenarioHook<
-  InputSchema extends StandardSchemaV1 | undefined = undefined
+  InputSchema extends StandardSchemaV1 | undefined = undefined,
+  OutputSchema extends StandardSchemaV1 | undefined = undefined
 > = PikkuFunctionScenario<
   InputSchema extends StandardSchemaV1 ? InferSchemaOutput<InputSchema> : unknown,
-  void
+  void,
+  OutputSchema extends StandardSchemaV1 ? InferSchemaOutput<OutputSchema> : unknown
 >
 
 /**
@@ -209,9 +222,9 @@ export type PikkuScenarioHook<
  * registered, so this exists purely to give an inline hook a call site to be
  * contextually typed from, the way every other pikku primitive is.
  */
-export function pikkuScenarioHook<In = unknown>(
-  hook: PikkuFunctionScenario<In, void>
-): PikkuFunctionScenario<In, void> {
+export function pikkuScenarioHook<In = unknown, Ctx = unknown>(
+  hook: PikkuFunctionScenario<In, void, Ctx>
+): PikkuFunctionScenario<In, void, Ctx> {
   return hook
 }
 
@@ -329,7 +342,7 @@ export type PikkuScenarioStepConfigWithSchema<
   InputSchema extends StandardSchemaV1 | undefined = undefined,
   OutputSchema extends StandardSchemaV1 | undefined = undefined
 > = {
-  /** Registered name — this is the string \`scenario.step()\` references. */
+  /** Registered name — this is the string \`scenario.given()\` references. */
   name: string
   /**
    * What this step does, for the console and for whoever reads the source. It

package/dist/src/functions/workflows/all.workflow.js

@@ -22,6 +22,11 @@ const scaffoldFiles = (config) => {
             file: config.userAdminFunctionsFile,
             generator: 'pikkuUserAdminFunctions',
         });
+    if (config.scaffold?.virtualUser && config.virtualUserFunctionsFile)
+        files.push({
+            file: config.virtualUserFunctionsFile,
+            generator: 'pikkuVirtualUserFunctions',
+        });
     if (config.scaffold?.agent && config.publicAgentFile)
         files.push({
             file: config.publicAgentFile,
@@ -46,7 +51,17 @@ export const allWorkflow = pikkuWorkflowComplexFunc({
         let typesDeclarationFileExists = true;
         if (!existsSync(config.outDir)) {
             logger.debug(`• .pikku directory not found, running bootstrap first...`);
-            await workflow.do('Bootstrap inspect', async () => getInspectorState(false, true, true));
+            // Every `getInspectorState` step below discards its result on purpose. A
+            // step's return value is stored as the step result and stays reachable for
+            // the life of the run, and an InspectorState holds a whole ts.Program — so
+            // returning it pins one TypeScript program per inspection instead of
+            // letting the previous one be collected. On a large project that is the
+            // difference between ~1.7GB and ~2.6GB peak RSS, i.e. between fitting in a
+            // 2GB CI heap and dying in it. Callers that need the state call
+            // `getInspectorState()` directly (it caches), never through a step.
+            await workflow.do('Bootstrap inspect', async () => {
+                await getInspectorState(false, true, true);
+            });
             // Both before function types: pikku-types.gen.ts re-exports the scope
             // definition types and imports ScopeId from the scopes codegen, so any
             // later import of '#pikku' — the inspector reading a project's zod
@@ -90,7 +105,9 @@ export const allWorkflow = pikkuWorkflowComplexFunc({
                     bootstrap: true,
                 });
             }
-            await workflow.do('Bootstrap re-inspect', async () => getInspectorState(true, true));
+            await workflow.do('Bootstrap re-inspect', async () => {
+                await getInspectorState(true, true);
+            });
         }
         if (!existsSync(config.typesDeclarationFile)) {
             typesDeclarationFileExists = false;
@@ -104,7 +121,9 @@ export const allWorkflow = pikkuWorkflowComplexFunc({
         await workflow.do('Generate function types', 'pikkuFunctionTypes', {});
         if (!typesDeclarationFileExists || missingScaffolds.length > 0) {
             logger.debug(`• Type file or scaffolds first created, inspecting again...`);
-            await workflow.do('Re-inspect after types', async () => getInspectorState(true));
+            await workflow.do('Re-inspect after types', async () => {
+                await getInspectorState(true);
+            });
         }
         // Type generators are independent of each other
         const typeGenerators = [
@@ -151,6 +170,7 @@ export const allWorkflow = pikkuWorkflowComplexFunc({
             workflow.do('Public RPC', 'pikkuPublicRPC', null),
             workflow.do('Console functions', 'pikkuConsoleFunctions', null),
             workflow.do('User admin functions', 'pikkuUserAdminFunctions', null),
+            workflow.do('Virtual user functions', 'pikkuVirtualUserFunctions', null),
             workflow.do('Events scaffold', 'pikkuEventsScaffold', null),
             workflow.do('Emails', 'pikkuEmails', null),
             workflow.do('Secret definition types', 'pikkuSecretDefinitionTypes', null),
@@ -169,18 +189,25 @@ export const allWorkflow = pikkuWorkflowComplexFunc({
             allImports.push(config.rpcInternalWiringMetaFile);
         }
         if (agents || !config.addon) {
-            await workflow.do('Re-inspect after agents', async () => getInspectorState(true));
+            await workflow.do('Re-inspect after agents', async () => {
+                await getInspectorState(true);
+            });
         }
-        // pikkuAuth generates auth-secrets.gen.ts (with defineSecret calls) inside the
-        // Promise.all above, but pikkuSecrets runs concurrently from the pre-auth
-        // inspector state. Re-run secret/credential/variable codegen now so that the
-        // freshly-generated auth-secrets.gen.ts (just picked up by Re-inspect above)
-        // is reflected in pikku-secrets-meta.gen.json.
-        if ((await getInspectorState()).auth.definition) {
+        // pikkuAuth generates auth-secrets.gen.ts and pikkuPersonas generates
+        // pikku-personas-secrets.gen.ts (both full of defineSecret calls) inside the
+        // Promise.all above, but pikkuSecrets runs concurrently from the inspector
+        // state as it was before either wrote anything. Re-run secret/credential/
+        // variable codegen now so those freshly-generated files — just picked up by
+        // Re-inspect above — are reflected in pikku-secrets-meta.gen.json. Without
+        // this the declaration only lands on a second `pikku` run, and a cold
+        // project deploys without ever being asked for the value.
+        const stateAfterScaffold = await getInspectorState();
+        if (stateAfterScaffold.auth.definition ||
+            stateAfterScaffold.personas.definitions.length > 0) {
             await Promise.all([
-                workflow.do('Secrets (post-auth)', 'pikkuSecrets', null),
-                workflow.do('Credentials (post-auth)', 'pikkuCredentials', null),
-                workflow.do('Variables (post-auth)', 'pikkuVariables', null),
+                workflow.do('Secrets (post-scaffold)', 'pikkuSecrets', null),
+                workflow.do('Credentials (post-scaffold)', 'pikkuCredentials', null),
+                workflow.do('Variables (post-scaffold)', 'pikkuVariables', null),
             ]);
         }
         const schemas = await workflow.do('Schemas', 'pikkuSchemas', null);
@@ -204,7 +231,9 @@ export const allWorkflow = pikkuWorkflowComplexFunc({
             }
         }
         if (workflows || remoteRPC || webhook || workflowRoutes) {
-            await workflow.do('Re-inspect after workflows', async () => getInspectorState(true));
+            await workflow.do('Re-inspect after workflows', async () => {
+                await getInspectorState(true);
+            });
             const regeneratedSchemas = await workflow.do('Re-generate schemas', 'pikkuSchemas', null);
             if (regeneratedSchemas && !schemas) {
                 allImports.push(`${config.schemaDirectory}/register.gen.ts`);
@@ -282,7 +311,9 @@ export const allWorkflow = pikkuWorkflowComplexFunc({
                 const cliChannelGenerated = await workflow.do('CLI entry', 'pikkuCLIEntry', null);
                 allImports.push(config.cliWiringMetaFile, config.cliWiringsFile);
                 if (cliChannelGenerated) {
-                    await workflow.do('Re-inspect after CLI channel', async () => getInspectorState(true));
+                    await workflow.do('Re-inspect after CLI channel', async () => {
+                        await getInspectorState(true);
+                    });
                     const cliChannels = await workflow.do('Channels after CLI', 'pikkuCommandChannels', null);
                     await workflow.do('Functions after CLI', 'pikkuFunctions', null);
                     await workflow.do('Schemas after CLI', 'pikkuSchemas', null);
@@ -302,7 +333,9 @@ export const allWorkflow = pikkuWorkflowComplexFunc({
         }
         if (config.openAPI) {
             logger.debug(`• OpenAPI requires a reinspection to pickup new generated types..`);
-            await workflow.do('OpenAPI re-inspect', async () => getInspectorState(true));
+            await workflow.do('OpenAPI re-inspect', async () => {
+                await getInspectorState(true);
+            });
             await workflow.do('OpenAPI', 'pikkuOpenAPI', null);
         }
         await workflow.do('Versions update', 'pikkuVersionsUpdate', null);

package/dist/src/server/bun-server-runner.d.ts

@@ -8,10 +8,10 @@
  */
 import type { EventHubService } from '@pikku/core';
 import type { Logger } from '@pikku/core/services';
-import type { DevServerRunner, DevServerInstance, DevServerConfig } from './dev-server-runner.interface.js';
+import type { DevServerRunner, DevServerInstance, DevServerConfig, DevServerOptions } from './dev-server-runner.interface.js';
 export declare class BunServerRunner implements DevServerRunner {
     private mod?;
     private eventHub?;
     createEventHub(): Promise<EventHubService<any>>;
-    createServer(config: DevServerConfig, logger: Logger): DevServerInstance;
+    createServer(config: DevServerConfig, logger: Logger, options?: DevServerOptions): DevServerInstance;
 }

package/dist/src/server/bun-server-runner.js

@@ -14,12 +14,16 @@ export class BunServerRunner {
         this.eventHub = new this.mod.BunEventHubService();
         return this.eventHub;
     }
-    createServer(config, logger) {
+    createServer(config, logger, options = {}) {
         if (!this.mod || !this.eventHub) {
             throw new Error('createEventHub() must be called before createServer()');
         }
         return new this.mod.PikkuBunServer(config, logger, {
             eventHub: this.eventHub,
+            // Dropped here until now, which silently disabled signed asset reads for
+            // every Bun project: `config.content` arrived, but the service that
+            // verifies its signatures did not.
+            contentSigningJWT: options.contentSigningJWT,
         });
     }
 }

package/dist/src/services/cli-logger.service.d.ts

@@ -1,7 +1,17 @@
 import type { Logger } from '@pikku/core/services';
+import type { Safe } from '@pikku/core';
 import { LogLevel } from '@pikku/core/services';
 import type { ErrorCode, DiagnosticSeverity, CodedDiagnostic } from '@pikku/inspector';
 export type CLIOutputMode = 'text' | 'json';
+/**
+ * The structured form a CLI log line may take. The `Record<string, any>` arm
+ * mirrors the `Logger` interface, which admits any object as a message.
+ */
+export type CLILogMessage = string | {
+    message: string;
+    type?: string;
+    data?: Record<string, unknown>;
+} | Record<string, any>;
 export declare class CLILogger implements Logger {
     private silent;
     private level;
@@ -23,25 +33,27 @@ export declare class CLILogger implements Logger {
     private ensureJSONFlushHook;
     flushJSONBuffer(): void;
     private emit;
-    info(message: string | {
-        message: string;
-        type?: string;
-        data?: Record<string, unknown>;
+    /**
+     * Splits a log line into the parts `emit` needs.
+     *
+     * The public methods declare their message as `Safe<M>`, which distributes
+     * over the `CLILogMessage` union and cannot be narrowed by `typeof`. The
+     * guard's job is done once the call site has been checked, so the message is
+     * converted back to its domain type here — in one place rather than in each
+     * method.
+     */
+    private messageParts;
+    info<M extends CLILogMessage, A extends unknown[]>(message: Safe<M>, ...__meta: {
+        [K in keyof A]: Safe<A[K]>;
     }): void;
-    error(message: string | Error | {
-        message: string;
-        type?: string;
-        data?: Record<string, unknown>;
+    error<M extends CLILogMessage | Error, A extends unknown[]>(message: Safe<M>, ...__meta: {
+        [K in keyof A]: Safe<A[K]>;
     }): void;
-    warn(message: string | {
-        message: string;
-        type?: string;
-        data?: Record<string, unknown>;
+    warn<M extends CLILogMessage, A extends unknown[]>(message: Safe<M>, ...__meta: {
+        [K in keyof A]: Safe<A[K]>;
     }): void;
-    debug(message: string | {
-        message: string;
-        type?: string;
-        data?: Record<string, unknown>;
+    debug<M extends CLILogMessage, A extends unknown[]>(message: Safe<M>, ...__meta: {
+        [K in keyof A]: Safe<A[K]>;
     }): void;
     diagnostic({ severity, code, message }: CodedDiagnostic): void;
     /** Sugar for `diagnostic({ severity: 'critical', code, message })`. */

package/dist/src/services/cli-logger.service.js

@@ -108,15 +108,30 @@ export class CLILogger {
         }
         console.log(c(normalizedMessage));
     }
-    info(message) {
+    /**
+     * Splits a log line into the parts `emit` needs.
+     *
+     * The public methods declare their message as `Safe<M>`, which distributes
+     * over the `CLILogMessage` union and cannot be narrowed by `typeof`. The
+     * guard's job is done once the call site has been checked, so the message is
+     * converted back to its domain type here — in one place rather than in each
+     * method.
+     */
+    messageParts(message) {
+        const value = message;
+        return {
+            msg: typeof value === 'string' ? value : value.message,
+            type: typeof value === 'string' ? undefined : value.type,
+            data: typeof value === 'string' ? undefined : value.data,
+        };
+    }
+    info(message, ...__meta) {
         if (this.level > LogLevel.info || this.silent)
             return;
-        const msg = typeof message === 'string' ? message : message.message;
-        const type = typeof message === 'string' ? undefined : message.type;
-        const data = typeof message === 'string' ? undefined : message.data;
+        const { msg, type, data } = this.messageParts(message);
         this.emit('info', msg, type, undefined, data);
     }
-    error(message) {
+    error(message, ...__meta) {
         if (this.level > LogLevel.error)
             return;
         if (message instanceof Error) {
@@ -128,25 +143,19 @@ export class CLILogger {
                 : (message.stack ?? message.message));
             return;
         }
-        const msg = typeof message === 'string' ? message : message.message;
-        const type = typeof message === 'string' ? undefined : message.type;
-        const data = typeof message === 'string' ? undefined : message.data;
+        const { msg, type, data } = this.messageParts(message);
         this.emit('error', msg, type, undefined, data);
     }
-    warn(message) {
+    warn(message, ...__meta) {
         if (this.level > LogLevel.warn)
             return;
-        const msg = typeof message === 'string' ? message : message.message;
-        const type = typeof message === 'string' ? undefined : message.type;
-        const data = typeof message === 'string' ? undefined : message.data;
+        const { msg, type, data } = this.messageParts(message);
         this.emit('warn', msg, type, undefined, data);
     }
-    debug(message) {
+    debug(message, ...__meta) {
         if (this.level > LogLevel.debug || this.silent)
             return;
-        const msg = typeof message === 'string' ? message : message.message;
-        const type = typeof message === 'string' ? undefined : message.type;
-        const data = typeof message === 'string' ? undefined : message.data;
+        const { msg, type, data } = this.messageParts(message);
         this.emit('debug', msg, type, undefined, data);
     }
     diagnostic({ severity, code, message }) {

package/dist/src/services.d.ts

@@ -1,6 +1,6 @@
 import type { Config, Services, SingletonServices, UserSession } from '../types/application-types.js';
 import type { CreateConfig } from '@pikku/core';
-import type { CreateWireServices, CreateSingletonServices } from '@pikku/core/internal';
+import type { CreateWireServices, CreateSingletonServices } from '@pikku/core/ecosystem';
 import { LogLevel } from '@pikku/core/services';
 import { CLILogger } from './services/cli-logger.service.js';
 import type { InspectorDiagnostic } from '@pikku/inspector';

package/dist/src/services.js

@@ -17,6 +17,7 @@ import { BunBundler } from './deploy/bundler/bun-bundler.js';
 import { NodeServerRunner } from './server/node-server-runner.js';
 import { BunServerRunner } from './server/bun-server-runner.js';
 import { parseCLIFilters } from './utils/parse-cli-filters.js';
+import { personasSecretsFilePath } from './functions/wirings/personas/personas-secrets-file.js';
 const DIAGNOSTIC_CODE_TO_LINT_KEY = {
     [ErrorCode.SERVICES_NOT_DESTRUCTURED]: 'servicesNotDestructured',
     [ErrorCode.WIRES_NOT_DESTRUCTURED]: 'wiresNotDestructured',
@@ -228,6 +229,12 @@ export const createSingletonServices = async (config) => {
                 config.authFile
                     ? path.join(path.dirname(config.authFile), 'auth-middleware.gen.ts')
                     : undefined,
+                // The personas scaffold's sibling secrets file (SCENARIO_ACTOR_SECRET),
+                // generated into outDir where nothing imports it — same reasoning as the
+                // auth files above.
+                config.personasFile
+                    ? personasSecretsFilePath(config.personasFile)
+                    : undefined,
             ];
             for (const file of scaffoldFiles) {
                 if (file && !wiringFiles.includes(file) && existsSync(file)) {
@@ -260,6 +267,7 @@ export const createSingletonServices = async (config) => {
                 // cost. Never runs during a plain `pikku all`.
                 classificationCheck: !setupOnly && !!config.security,
                 strictMeta: !!config.strictMeta,
+                allow: config.allow ?? {},
                 schemaConfig: !setupOnly
                     ? {
                         tsconfig: config.tsconfig,

package/dist/src/utils/file-import-path.js

@@ -4,6 +4,15 @@ export const getFileImportRelativePath = (from, to, packageMappings,
  *  Use for generated files that live outside the workspace (e.g. .deploy/)
  *  where package-name imports can't be resolved by the bundler. */
 forceRelative = false) => {
+    // `to` is normally a file on disk, but the bootstrap zero state records core's
+    // types as `typePath: '@pikku/core'` — already an import specifier. Doing path
+    // arithmetic on one yields a directory that does not exist ('../../@pikku/core')
+    // and, being extensionless, one that nodenext then refuses to resolve. The
+    // node_modules branch below cannot catch these: a bare specifier has no
+    // 'node_modules/' in it to key off.
+    if (!to.startsWith('.') && !to.startsWith('/') && !/^[a-zA-Z]:/.test(to)) {
+        return to;
+    }
     let filePath = relative(dirname(from), to);
     if (!/^\.+\//.test(filePath)) {
         filePath = `./${filePath}`;

package/dist/src/utils/pikku-cli-config.js

@@ -245,6 +245,7 @@ const _getPikkuCLIConfig = async (logger, configFile = undefined, requiredFields
             console: 'consoleFunctionsFile',
             scenarios: 'scenariosFunctionsFile',
             userAdmin: 'userAdminFunctionsFile',
+            virtualUser: 'virtualUserFunctionsFile',
             workflow: 'workflowRoutesFile',
             events: 'eventsChannelFile',
             remoteRpc: 'remoteRpcWorkersFile',
@@ -303,6 +304,12 @@ const _getPikkuCLIConfig = async (logger, configFile = undefined, requiredFields
         if (result.scaffold?.userAdmin && !result.userAdminSchemasFile) {
             result.userAdminSchemasFile = join(resolvedScaffoldDir, 'admin', 'user-admin.schemas.gen.ts');
         }
+        if (result.scaffold?.virtualUser && !result.virtualUserFunctionsFile) {
+            result.virtualUserFunctionsFile = join(resolvedScaffoldDir, 'virtual-user', 'virtual-user.gen.ts');
+        }
+        if (result.scaffold?.virtualUser && !result.virtualUserSchemasFile) {
+            result.virtualUserSchemasFile = join(resolvedScaffoldDir, 'virtual-user', 'virtual-user.schemas.gen.ts');
+        }
         if (result.scaffold?.scenarios && !result.scenariosFunctionsFile) {
             result.scenariosFunctionsFile = join(resolvedScaffoldDir, 'scenarios', 'scenarios.gen.ts');
         }

package/dist/src/utils/resolve-personas.d.ts

@@ -20,13 +20,8 @@ export declare const DEFAULT_PERSONA_EMAIL_DOMAIN = "personas.invalid";
  */
 export declare const resolvePersonas: (definitions: PersonaDefinitions, domain?: string, runId?: string) => Record<string, ResolvedPersona>;
 /**
- * The scopes a persona holds, resolved through its roles.
- *
- * Roles are the only thing a persona declares; scopes are what a function
- * checks. Narrowing a virtual user's catalogue needs the second, so the
- * expansion happens once, here, against the same `defineSystemRole` definitions
- * the seed grants from.
+ * Re-exported rather than declared here: the scaffolded `runVirtualUser` RPC
+ * needs the same expansion at runtime, so it lives in core beside
+ * `prepareVirtualUserRun` and this keeps the CLI's existing import sites.
  */
-export declare const personaScopes: (persona: {
-    roles?: readonly string[];
-}, roleScopes: Record<string, readonly string[]>) => string[];
+export { personaScopes } from '@pikku/core/virtual-user';

package/dist/src/utils/resolve-personas.js

@@ -28,19 +28,8 @@ export const resolvePersonas = (definitions, domain = DEFAULT_PERSONA_EMAIL_DOMA
     return resolved;
 };
 /**
- * The scopes a persona holds, resolved through its roles.
- *
- * Roles are the only thing a persona declares; scopes are what a function
- * checks. Narrowing a virtual user's catalogue needs the second, so the
- * expansion happens once, here, against the same `defineSystemRole` definitions
- * the seed grants from.
+ * Re-exported rather than declared here: the scaffolded `runVirtualUser` RPC
+ * needs the same expansion at runtime, so it lives in core beside
+ * `prepareVirtualUserRun` and this keeps the CLI's existing import sites.
  */
-export const personaScopes = (persona, roleScopes) => {
-    const scopes = new Set();
-    for (const role of persona.roles ?? []) {
-        for (const scope of roleScopes[role] ?? []) {
-            scopes.add(scope);
-        }
-    }
-    return [...scopes].sort();
-};
+export { personaScopes } from '@pikku/core/virtual-user';

package/dist/src/utils/serialize-meta-ts.js

@@ -3,7 +3,7 @@ export function serializeMetaTS({ jsonImportPath, supportsImportAttributes, pikk
         ? `import metaData from '${jsonImportPath}' with { type: 'json' }`
         : `import metaData from '${jsonImportPath}'`;
     const serializedOutput = [];
-    serializedOutput.push("import { pikkuState } from '@pikku/core/internal'");
+    serializedOutput.push("import { pikkuState } from '@pikku/core/ecosystem'");
     serializedOutput.push(`import { ${metaTypeName} } from '${metaTypeImport}'`);
     serializedOutput.push(importStatement);
     serializedOutput.push('');