@pikku/cli 0.12.99 → 0.12.102

package/dist/.pikku/schemas/register.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.99
+ * This file was generated by @pikku/cli@0.12.102
  */
 import { addSchema } from '@pikku/core/schema';
 import * as BinaryInput from './schemas/BinaryInput.schema.json' with { type: 'json' };
@@ -146,6 +146,8 @@ import * as PersonaSyncInput from './schemas/PersonaSyncInput.schema.json' with
 addSchema('PersonaSyncInput', PersonaSyncInput);
 import * as PikkuAIAgentOutput from './schemas/PikkuAIAgentOutput.schema.json' with { type: 'json' };
 addSchema('PikkuAIAgentOutput', PikkuAIAgentOutput);
+import * as PikkuAIScorerOutput from './schemas/PikkuAIScorerOutput.schema.json' with { type: 'json' };
+addSchema('PikkuAIScorerOutput', PikkuAIScorerOutput);
 import * as PikkuAuthInput from './schemas/PikkuAuthInput.schema.json' with { type: 'json' };
 addSchema('PikkuAuthInput', PikkuAuthInput);
 import * as PikkuCLIEntryOutput from './schemas/PikkuCLIEntryOutput.schema.json' with { type: 'json' };
@@ -288,11 +290,11 @@ import * as ScopesPruneInput from './schemas/ScopesPruneInput.schema.json' with
 addSchema('ScopesPruneInput', ScopesPruneInput);
 import * as ServeInput from './schemas/ServeInput.schema.json' with { type: 'json' };
 addSchema('ServeInput', ServeInput);
+import * as ValidateInput from './schemas/ValidateInput.schema.json' with { type: 'json' };
+addSchema('ValidateInput', ValidateInput);
+import * as ValidateOutput from './schemas/ValidateOutput.schema.json' with { type: 'json' };
+addSchema('ValidateOutput', ValidateOutput);
 import * as WatchInput from './schemas/WatchInput.schema.json' with { type: 'json' };
 addSchema('WatchInput', WatchInput);
 import * as WhoamiInput from './schemas/WhoamiInput.schema.json' with { type: 'json' };
 addSchema('WhoamiInput', WhoamiInput);
-import * as WorkspaceValidateInput from './schemas/WorkspaceValidateInput.schema.json' with { type: 'json' };
-addSchema('WorkspaceValidateInput', WorkspaceValidateInput);
-import * as WorkspaceValidateOutput from './schemas/WorkspaceValidateOutput.schema.json' with { type: 'json' };
-addSchema('WorkspaceValidateOutput', WorkspaceValidateOutput);

package/dist/.pikku/schemas/schemas/DevInput.schema.json

@@ -1 +1 @@
-{ "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "port": { "type": "string" }, "watch": { "type": "boolean" }, "hmr": { "type": "boolean" }, "coverage": { "type": "boolean" }, "test": { "type": "boolean" } }, "additionalProperties": false, "definitions": {} }
+{ "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "port": { "type": "string" }, "watch": { "type": "boolean" }, "hmr": { "type": "boolean" }, "coverage": { "type": "boolean" }, "test": { "type": "boolean" }, "model": { "type": "string" } }, "additionalProperties": false, "definitions": {} }

package/dist/.pikku/schemas/schemas/PikkuAIScorerOutput.schema.json

@@ -0,0 +1 @@
+{ "$schema": "http://json-schema.org/draft-07/schema#", "type": "boolean", "enum": [false, true], "definitions": {} }

package/dist/.pikku/schemas/schemas/ServeInput.schema.json

@@ -1 +1 @@
-{ "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "port": { "type": "string" }, "console": { "type": "boolean" } }, "additionalProperties": false, "definitions": {} }
+{ "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "port": { "type": "string" }, "console": { "type": "boolean" }, "model": { "type": "string" } }, "additionalProperties": false, "definitions": {} }

package/dist/.pikku/schemas/schemas/ValidateOutput.schema.json

@@ -0,0 +1 @@
+{ "$schema": "https://json-schema.org/draft/2020-12/schema", "type": "object", "properties": { "ok": { "type": "boolean" }, "root": { "type": "string" }, "ran": { "type": "array", "items": { "type": "object", "properties": { "checkId": { "type": "string" }, "subject": { "type": "string" }, "target": { "type": "string" } }, "required": ["checkId", "subject", "target"], "additionalProperties": false } }, "findings": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "severity": { "type": "string", "enum": ["error", "warn", "info"] }, "message": { "type": "string" }, "path": { "type": "string" }, "fixHint": { "type": "string" } }, "required": ["id", "severity", "message", "path", "fixHint"], "additionalProperties": false } } }, "required": ["ok", "root", "ran", "findings"], "additionalProperties": false }

package/dist/.pikku/scopes/pikku-personas.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.99
+ * This file was generated by @pikku/cli@0.12.102
  */
 /**
  * This file was generated by the @pikku/cli

package/dist/.pikku/scopes/pikku-roles.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.99
+ * This file was generated by @pikku/cli@0.12.102
  */
 /**
  * This file was generated by the @pikku/cli

package/dist/.pikku/scopes/pikku-scope-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.99
+ * This file was generated by @pikku/cli@0.12.102
  */
 export { defineScope } from '@pikku/core/scope';
 export type { CoreScopes, CoreScopeNode, FlatScope, ScopeDefinitionMeta, ScopeDefinitionsMeta } from '@pikku/core/scope';

package/dist/.pikku/scopes/pikku-scope-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.99
+ * This file was generated by @pikku/cli@0.12.102
  */
 export { defineScope } from '@pikku/core/scope';
 export { defineSystemRole } from '@pikku/core/role';

package/dist/.pikku/scopes/pikku-scopes.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.99
+ * This file was generated by @pikku/cli@0.12.102
  */
 /**
  * This file was generated by the @pikku/cli

package/dist/.pikku/secrets/pikku-secret-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.99
+ * This file was generated by @pikku/cli@0.12.102
  */
 export { defineSecret } from '@pikku/core/secret';
 export type { CoreSecret, SecretDefinitionMeta, SecretDefinitionsMeta } from '@pikku/core/secret';

package/dist/.pikku/secrets/pikku-secret-types.gen.js

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.99
+ * This file was generated by @pikku/cli@0.12.102
  */
 export { defineSecret } from '@pikku/core/secret';

package/dist/.pikku/secrets/pikku-secrets.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.99
+ * This file was generated by @pikku/cli@0.12.102
  */
 import { TypedSecretService as CoreTypedSecretService } from '@pikku/core/services';
 import type { SecretService } from '@pikku/core/services';

package/dist/.pikku/secrets/pikku-secrets.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.99
+ * This file was generated by @pikku/cli@0.12.102
  */
 import { TypedSecretService as CoreTypedSecretService } from '@pikku/core/services';
 import secretsMeta from './pikku-secrets-meta.gen.json' with { type: 'json' };

package/dist/.pikku/trigger/pikku-trigger-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.99
+ * This file was generated by @pikku/cli@0.12.102
  */
 /**
  * Trigger-specific type definitions for tree-shaking optimization

package/dist/.pikku/trigger/pikku-trigger-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.99
+ * This file was generated by @pikku/cli@0.12.102
  */
 /**
  * Trigger-specific type definitions for tree-shaking optimization

package/dist/.pikku/variables/pikku-variable-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.99
+ * This file was generated by @pikku/cli@0.12.102
  */
 export { defineVariable } from '@pikku/core/variable';
 export type { CoreVariable, VariableDefinitionMeta, VariableDefinitionsMeta } from '@pikku/core/variable';

package/dist/.pikku/variables/pikku-variable-types.gen.js

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.99
+ * This file was generated by @pikku/cli@0.12.102
  */
 export { defineVariable } from '@pikku/core/variable';

package/dist/.pikku/variables/pikku-variables.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.99
+ * This file was generated by @pikku/cli@0.12.102
  */
 import { TypedVariablesService as CoreTypedVariablesService } from '@pikku/core/services';
 import type { VariablesService } from '@pikku/core/services';

package/dist/.pikku/variables/pikku-variables.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.99
+ * This file was generated by @pikku/cli@0.12.102
  */
 import { TypedVariablesService as CoreTypedVariablesService } from '@pikku/core/services';
 import variablesMeta from './pikku-variables-meta.gen.json' with { type: 'json' };

package/dist/.pikku/workflow/meta/allWorkflow.gen.json

@@ -231,9 +231,15 @@
         "AI agent": {
             "nodeId": "AI agent",
             "rpcName": "pikkuAIAgent",
-            "next": "Public agent scaffold",
+            "next": "AI scorer",
             "stepHash": "b40cd11dc611"
         },
+        "AI scorer": {
+            "nodeId": "AI scorer",
+            "rpcName": "pikkuAIScorer",
+            "next": "Public agent scaffold",
+            "stepHash": "4671def89706"
+        },
         "Public agent scaffold": {
             "nodeId": "Public agent scaffold",
             "rpcName": "pikkuPublicAgent",
@@ -634,5 +640,5 @@
     "entryNodeIds": [
         "Bootstrap inspect"
     ],
-    "graphHash": "c8f162576369"
+    "graphHash": "dd727be4816c"
 }

package/dist/.pikku/workflow/pikku-personas.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.99
+ * This file was generated by @pikku/cli@0.12.102
  */
 /** Personas declared with definePersonas() */
 import { createHttpPersonas } from '@pikku/core/persona';

package/dist/.pikku/workflow/pikku-workflow-types.gen.d.ts

@@ -1,12 +1,12 @@
 /**
- * This file was generated by @pikku/cli@0.12.99
+ * This file was generated by @pikku/cli@0.12.102
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import { template } from '@pikku/core/workflow';
 import { type PikkuWorkflowGraphConfig, type PikkuWorkflowGraphResult } from '@pikku/core/workflow';
 import type { PikkuWorkflowWire, PikkuScenarioWire, WorkflowStepOptions, ScenarioStepOptions } from '@pikku/core/workflow';
 export { WorkflowCancelledException };
-import type { PikkuFunctionSessionless, PikkuFunctionConfig } from '../function/pikku-function-types.gen.js';
+import type { PikkuFunctionSessionless, PikkuFunctionConfig, WiredServices } from '../function/pikku-function-types.gen.js';
 import type { FlattenedRPCMap } from '../rpc/pikku-rpc-wirings-map.internal.gen.d.js';
 import type { FlattenedWorkflowMap } from './pikku-workflow-map.gen.d.js';
 import type { AgentMap as FlattenedAgentMap } from '../agent/pikku-agent-map.gen.d.js';
@@ -30,14 +30,20 @@ export interface TypedScenarioSteps {
     when<K extends keyof FlattenedScenarioStepMap>(stepName: string, stepFunc: K, data?: FlattenedScenarioStepMap[K]['input'], options?: ScenarioStepOptions): Promise<FlattenedScenarioStepMap[K]['output']>;
     then<K extends keyof FlattenedScenarioStepMap>(stepName: string, stepFunc: K, data?: FlattenedScenarioStepMap[K]['input'], options?: ScenarioStepOptions): Promise<FlattenedScenarioStepMap[K]['output']>;
 }
-export type TypedScenario = TypedWorkflow & Omit<PikkuScenarioWire, keyof PikkuWorkflowWire | keyof TypedScenarioSteps> & TypedScenarioSteps;
+/** `Out` types `scenario.context`. */
+export type TypedScenario<Out = unknown> = TypedWorkflow & Omit<PikkuScenarioWire<Out>, keyof PikkuWorkflowWire | keyof TypedScenarioSteps> & TypedScenarioSteps;
 import type { StandardSchemaV1 } from '@standard-schema/spec';
 import type { InferSchemaOutput, PikkuPermission, PikkuMiddleware, NodeConfig, PikkuApprovalDescription } from '../function/pikku-function-types.gen.js';
 import type { ScopeId } from '../scopes/pikku-scopes.gen.js';
 import { PikkuError } from '@pikku/core/errors';
 import type { CorePermissionGroup } from '@pikku/core';
 export type PikkuFunctionWorkflow<In = unknown, Out = never> = PikkuFunctionSessionless<In, Out, 'workflow'>;
-export type PikkuFunctionScenario<In = unknown, Out = never> = PikkuFunctionSessionless<In, Out, 'scenario' | 'actors'>;
+/**
+ * `Ctx` types `scenario.context`, defaulting to the body's own output. A hook
+ * returns void but shares the scenario's context, so it passes that scenario's
+ * output here instead.
+ */
+export type PikkuFunctionScenario<In = unknown, Out = never, Ctx = Out> = PikkuFunctionSessionless<In, Out, 'scenario' | 'actors', WiredServices, Ctx>;
 export type PikkuWorkflowConfigWithSchema<InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined> = {
     title?: string;
     description?: string;
@@ -78,14 +84,15 @@ export type PikkuScenarioConfigWithSchema<InputSchema extends StandardSchemaV1 |
      * on the ladder. Throwing skips the body and fails the run; `after` still
      * runs.
      */
-    before?: PikkuScenarioHook<InputSchema>;
+    before?: PikkuScenarioHook<InputSchema, OutputSchema>;
     /**
      * Always runs after the scenario body, in a `finally`, whether it passed or
      * failed. Throwing fails a run that would otherwise have passed; on an
      * already-failed run it attaches as the `cause` and never replaces the
-     * original error.
+     * original error. Reads `scenario.context` for whatever the body managed to
+     * record before it stopped.
      */
-    after?: PikkuScenarioHook<InputSchema>;
+    after?: PikkuScenarioHook<InputSchema, OutputSchema>;
     /**
      * Why this scenario is held out of a default run, stated where the scenario
      * is. The scenario still appears in the plan and is reported as skipped
@@ -96,15 +103,16 @@ export type PikkuScenarioConfigWithSchema<InputSchema extends StandardSchemaV1 |
 };
 /**
  * A scenario lifecycle hook: the scenario's own `(services, data, wire)`
- * signature with its result discarded.
+ * signature with its result discarded. `OutputSchema` types
+ * `scenario.context` while the return type stays `void`.
  */
-export type PikkuScenarioHook<InputSchema extends StandardSchemaV1 | undefined = undefined> = PikkuFunctionScenario<InputSchema extends StandardSchemaV1 ? InferSchemaOutput<InputSchema> : unknown, void>;
+export type PikkuScenarioHook<InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined> = PikkuFunctionScenario<InputSchema extends StandardSchemaV1 ? InferSchemaOutput<InputSchema> : unknown, void, OutputSchema extends StandardSchemaV1 ? InferSchemaOutput<OutputSchema> : unknown>;
 /**
  * Declares a scenario hook. Returns the function verbatim — a hook is never
  * registered, so this exists purely to give an inline hook a call site to be
  * contextually typed from, the way every other pikku primitive is.
  */
-export declare function pikkuScenarioHook<In = unknown>(hook: PikkuFunctionScenario<In, void>): PikkuFunctionScenario<In, void>;
+export declare function pikkuScenarioHook<In = unknown, Ctx = unknown>(hook: PikkuFunctionScenario<In, void, Ctx>): PikkuFunctionScenario<In, void, Ctx>;
 /**
  * A scenario: a complex workflow that drives the app the way users do.
  * Steps run as actors over the REAL transport — `scenario.do(step, rpc,

package/dist/.pikku/workflow/pikku-workflow-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.99
+ * This file was generated by @pikku/cli@0.12.102
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import { template } from '@pikku/core/workflow';

package/dist/.pikku/workflow/pikku-workflow-wirings-meta.gen.js

@@ -1,7 +1,7 @@
 /**
- * This file was generated by @pikku/cli@0.12.99
+ * This file was generated by @pikku/cli@0.12.102
  */
-import { pikkuState } from '@pikku/core/internal';
+import { pikkuState } from '@pikku/core/ecosystem';
 import allWorkflowMeta from './meta/allWorkflow.gen.json' with { type: 'json' };
 const workflowsMeta = {
     'allWorkflow': allWorkflowMeta,

package/dist/.pikku/workflow/pikku-workflow-wirings.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.99
+ * This file was generated by @pikku/cli@0.12.102
  */
 import { addWorkflow } from '@pikku/core/workflow';
 import './pikku-workflow-wirings-meta.gen.js';

package/dist/bin/pikku-bin.mjs

@@ -11,8 +11,8 @@ async function checkForUpdate() {
     })
     if (!res.ok) return
     const { version: latest } = await res.json()
-    if (latest !== '0.12.99') {
-      process.stderr.write(`\n  Update available  0.12.99 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
+    if (latest !== '0.12.102') {
+      process.stderr.write(`\n  Update available  0.12.102 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
     }
   } catch {}
 }

package/dist/src/cli.wiring.js

@@ -29,7 +29,7 @@ import { scopesPrune } from './functions/commands/scopes-prune.js';
 import { rolesAudit } from './functions/commands/roles-audit.js';
 import { rolesPrune } from './functions/commands/roles-prune.js';
 import { pikkuAudit } from './functions/commands/audit.js';
-import { workspaceValidate, renderWorkspaceValidate, } from './functions/commands/workspace-validate.js';
+import { validate, renderValidate } from './functions/commands/validate.js';
 import { knowledgeValidate, renderKnowledgeValidate, } from './functions/commands/knowledge-validate.js';
 import { knowledgeIndex, renderKnowledgeIndex, } from './functions/commands/knowledge-index.js';
 import { scenarioRun, scenarioList } from './functions/commands/scenario.js';
@@ -240,6 +240,9 @@ wireCLI({
                     description: 'Test mode: record service calls for scenario assertions and set PIKKU_TEST_RUN for isTestRun()',
                     default: false,
                 },
+                model: {
+                    description: 'Repoint model aliases for this run, e.g. \'cheap:openai/gpt-5-nano,tool:anthropic/claude-haiku-4-5\'. Overrides the "models" table in pikku.config.json without editing it',
+                },
             },
         }),
         serve: pikkuCLICommand({
@@ -255,6 +258,9 @@ wireCLI({
                     description: 'Also serve the Pikku Console same-origin at /console',
                     default: false,
                 },
+                model: {
+                    description: 'Repoint model aliases for this run, e.g. \'cheap:openai/gpt-5-nano,tool:anthropic/claude-haiku-4-5\'. Overrides the "models" table in pikku.config.json without editing it',
+                },
             },
         }),
         login: pikkuCLICommand({
@@ -427,16 +433,11 @@ wireCLI({
                 }),
             },
         },
-        workspace: {
-            description: 'Workspace-level validation and maintenance commands',
-            subcommands: {
-                validate: pikkuCLICommand({
-                    func: workspaceValidate,
-                    render: renderWorkspaceValidate,
-                    description: 'Check the project structure for Pikku workspace compatibility',
-                }),
-            },
-        },
+        validate: pikkuCLICommand({
+            func: validate,
+            render: renderValidate,
+            description: 'Run every check that applies to this project — app structure, and the published file set of any addon it contains',
+        }),
         scenario: {
             description: 'Run and inspect scenarios (pikkuScenario)',
             subcommands: {
@@ -487,6 +488,14 @@ wireCLI({
                             description: 'Keep every stack frame on a failure. Without it, only the project’s own frames are shown',
                             default: false,
                         },
+                        screenshots: {
+                            description: 'Write the screenshots scenarios ask for to disk, under .pikku/scenario-runs/<run>/<scenario>. Without it `browser.screenshot()` still returns the bytes and nothing is written',
+                            default: false,
+                        },
+                        video: {
+                            description: 'Record a video per scenario alongside the screenshots (implies --screenshots)',
+                            default: false,
+                        },
                         apiUrl: {
                             description: "Override the environment's apiUrl for this run — for a target that only exists at run time, such as a freshly deployed sandbox",
                         },

package/dist/src/deploy/analyzer/analyzer.js

@@ -338,7 +338,6 @@ export function analyzeDeployment(state, options) {
         'workflowStatusChecker',
         'workflowStatusStream',
         'workflowStatusStreamFull',
-        'graphStarter',
     ]);
     for (const unit of units) {
         if (unit.role !== 'function')
@@ -371,6 +370,25 @@ export function analyzeDeployment(state, options) {
         allowedHosts: s.allowedHosts,
         read: readSecretIds.has(s.secretId),
     }));
+    const unscopedSecretAddons = [];
+    const unscopedCredentialAddons = [];
+    for (const [namespace, addon] of state.rpc?.wireAddonDeclarations ?? []) {
+        if (addon.globalSecrets) {
+            unscopedSecretAddons.push({
+                namespace,
+                package: addon.package,
+                reason: addon.globalSecrets,
+            });
+        }
+        if (addon.globalCredentials) {
+            unscopedCredentialAddons.push({
+                namespace,
+                package: addon.package,
+                reason: addon.globalCredentials,
+            });
+        }
+    }
+    const byNamespace = (a, b) => a.namespace.localeCompare(b.namespace);
     const variables = state.variables.definitions.map((v) => ({
         variableId: v.variableId,
         displayName: v.displayName,
@@ -388,6 +406,8 @@ export function analyzeDeployment(state, options) {
         workflows,
         secrets,
         unresolvedSecretReads: unresolvedSecretReads.sort(),
+        unscopedSecretAddons: unscopedSecretAddons.sort(byNamespace),
+        unscopedCredentialAddons: unscopedCredentialAddons.sort(byNamespace),
         variables,
     };
 }
@@ -456,11 +476,6 @@ function buildWorkflows(graphMeta, functionsMeta, rpcMeta, _httpMeta, units, wor
                 route: `/workflow/${graph.name}/approve/:runId`,
                 pikkuFuncId: `workflowApprove:${graph.name}`,
             },
-            {
-                method: 'post',
-                route: `/workflow/${graph.name}/graph/:nodeId`,
-                pikkuFuncId: `graphStart:${graph.name}`,
-            },
         ];
         // Orchestrator queue — the orchestrator consumes from this. Only emitted
         // when the provider's workflow runtime needs queue dispatch.

package/dist/src/deploy/analyzer/manifest.d.ts

@@ -108,6 +108,13 @@ export interface SecretDeclaration {
 }
 /** Secret reads whose key the inspector could not resolve, as `file:line:source`. */
 export type UnresolvedSecretRead = string;
+/** A `wireAddon` instance the app exempted from secret or credential scoping. */
+export interface UnscopedAddon {
+    namespace: string;
+    package: string;
+    /** The app's stated reason, from `wireAddon({ globalSecrets | globalCredentials })`. */
+    reason: string;
+}
 export interface VariableDeclaration {
     variableId: string;
     displayName: string;
@@ -129,5 +136,16 @@ export interface DeploymentManifest {
      * scope to the declared set when this is empty.
      */
     unresolvedSecretReads: UnresolvedSecretRead[];
+    /**
+     * Addon instances exempted from secret scoping. Every other addon reads only
+     * the secrets it declared, so this is the full list of packages that can
+     * reach a secret the app never named for them.
+     */
+    unscopedSecretAddons: UnscopedAddon[];
+    /**
+     * Addon instances exempted from credential scoping. Every other addon reaches
+     * only the credentials it declared, and none can enumerate the app's users.
+     */
+    unscopedCredentialAddons: UnscopedAddon[];
     variables: VariableDeclaration[];
 }

package/dist/src/deploy/codegen/per-unit-codegen.js

@@ -146,17 +146,14 @@ function collectFilterNames(unit, manifest, inspectorState, workflowQueues) {
                 names.add('workflowRunner');
                 names.add('workflowStatusChecker');
                 names.add('workflowStatusStream');
-                names.add('graphStarter');
                 names.add('/workflow/:workflowName/start');
                 names.add('/workflow/:workflowName/run');
                 names.add('/workflow/:workflowName/status/:runId');
                 names.add('/workflow/:workflowName/status/:runId/stream');
-                names.add('/workflow/:workflowName/graph/:nodeId');
                 names.add('http:post:/workflow/:workflowName/start');
                 names.add('http:post:/workflow/:workflowName/run');
                 names.add('http:get:/workflow/:workflowName/status/:runId');
                 names.add('http:get:/workflow/:workflowName/status/:runId/stream');
-                names.add('http:post:/workflow/:workflowName/graph/:nodeId');
                 // Queue names for orchestrator and step workers — only when the
                 // provider's workflow runtime fans out via queues.
                 if (workflowQueues) {

package/dist/src/deploy/server-entry.js

@@ -14,7 +14,7 @@ export function generateServerEntrySource(ctx) {
     const lines = [
         `// Generated server entry for "${ctx.unit.name}" (${ctx.unit.role})`,
         `import { PikkuNodeHTTPServer } from '@pikku/node-http-server'`,
-        `import { pikkuState } from '@pikku/core/internal'`,
+        `import { pikkuState } from '@pikku/core/ecosystem'`,
         ctx.configImport,
         ctx.servicesImport,
         ctx.mcpImport,