@pikku/cli 0.12.99 → 0.12.102

package/dist/src/functions/wirings/ai-agent/pikku-command-ai-agent.d.ts

@@ -1 +1 @@
-export declare const pikkuAIAgent: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuAIAgent: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/ai-agent/pikku-command-ai-agent.js

@@ -4,11 +4,15 @@ import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-
 import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
 import { stripVerboseFields, hasVerboseFields, } from '../../../utils/strip-verbose-meta.js';
 import { serializeAgentMap } from './serialize-agent-map.js';
+import { serializeModelAliases } from './serialize-model-aliases.js';
 export const pikkuAIAgent = pikkuSessionlessFunc({
     func: async ({ logger, config, getInspectorState }) => {
         const { agents, functions } = await getInspectorState();
-        const { agentWiringsFile, agentWiringMetaFile, agentWiringMetaJsonFile, agentMapDeclarationFile, packageMappings, schema, addonName, } = config;
+        const { agentWiringsFile, agentWiringMetaFile, agentWiringMetaJsonFile, agentMapDeclarationFile, modelAliasesFile, packageMappings, schema, addonName, models, } = config;
         const agentFiles = agents.files;
+        // Written even with no agents: the image/speech/embedding runner methods
+        // take a model too.
+        await writeFileInDir(logger, modelAliasesFile, serializeModelAliases(models, addonName ?? null));
         if (agentFiles.size === 0 || Object.keys(agents.agentsMeta).length === 0) {
             // Still need to generate an empty agent map for the types import
             await writeFileInDir(logger, agentMapDeclarationFile, `export type AgentMap = {}\n`);
@@ -45,7 +49,7 @@ export const pikkuAIAgent = pikkuSessionlessFunc({
         const importStatement = supportsImportAttributes
             ? `import metaData from '${jsonImportPath}' with { type: 'json' }`
             : `import metaData from '${jsonImportPath}'`;
-        await writeFileInDir(logger, agentWiringMetaFile, `import { pikkuState } from '@pikku/core/internal'
+        await writeFileInDir(logger, agentWiringMetaFile, `import { pikkuState } from '@pikku/core/ecosystem'
 import type { AIAgentMeta } from '@pikku/core/ai-agent'
 ${importStatement}
 pikkuState(${addonName ? `'${addonName}'` : 'null'}, 'agent', 'agentsMeta', metaData.agentsMeta as AIAgentMeta)`);

package/dist/src/functions/wirings/ai-agent/pikku-command-public-agent.d.ts

@@ -1 +1 @@
-export declare const pikkuPublicAgent: import("#pikku").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuPublicAgent: import("#pikku").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/ai-agent/serialize-ai-agent-types.d.ts

@@ -1 +1 @@
-export declare const serializeAIAgentTypes: (functionTypesImportPath: string, agentMapImportPath: string, scopesImportPath: string) => string;
+export declare const serializeAIAgentTypes: (functionTypesImportPath: string, agentMapImportPath: string, scopesImportPath: string, scorerNamesImportPath: string) => string;

package/dist/src/functions/wirings/ai-agent/serialize-ai-agent-types.js

@@ -1,4 +1,4 @@
-export const serializeAIAgentTypes = (functionTypesImportPath, agentMapImportPath, scopesImportPath) => {
+export const serializeAIAgentTypes = (functionTypesImportPath, agentMapImportPath, scopesImportPath, scorerNamesImportPath) => {
     return `import {
   CoreAIAgent,
   PikkuAIMiddlewareHooks,
@@ -9,16 +9,21 @@ import {
   agentResume as coreAgentResume,
   agentApprove as coreAgentApprove,
 } from '@pikku/core/ai-agent'
+import {
+  pikkuAIScorer as corePikkuAIScorer,
+  pikkuAIJudge as corePikkuAIJudge,
+} from '@pikku/core/ai-scorer'
 import type { PikkuPermission, PikkuMiddleware, Services, PikkuFunctionConfig } from '${functionTypesImportPath}'
 import type { StandardSchemaV1 } from '@standard-schema/spec'
 import type { AIAgentMemoryConfig, AIAgentInput } from '@pikku/core/ai-agent'
 import type { AgentMap } from '${agentMapImportPath}'
 import type { ScopeId } from '${scopesImportPath}'
+import type { ScorerName } from '${scorerNamesImportPath}'
 
 type AIAgentConfig<
   InputSchema extends StandardSchemaV1 | undefined = undefined,
   OutputSchema extends StandardSchemaV1 | undefined = undefined
-> = Omit<CoreAIAgent<PikkuPermission, PikkuMiddleware, ScopeId>, 'tools' | 'agents' | 'workflows' | 'memory' | 'input' | 'output'> & {
+> = Omit<CoreAIAgent<PikkuPermission, PikkuMiddleware, ScopeId, ScorerName>, 'tools' | 'agents' | 'workflows' | 'memory' | 'input' | 'output'> & {
   input?: InputSchema
   output?: OutputSchema
   memory?: Omit<AIAgentMemoryConfig, 'workingMemory'> & { workingMemory?: StandardSchemaV1 }
@@ -36,6 +41,14 @@ export const pikkuAIAgent = <
   return agent
 }
 
+export const pikkuAIScorer = (
+  config: Parameters<typeof corePikkuAIScorer<Services>>[0]
+) => corePikkuAIScorer<Services>(config)
+
+export const pikkuAIJudge = (
+  config: Parameters<typeof corePikkuAIJudge<Services>>[0]
+) => corePikkuAIJudge<Services>(config)
+
 export const pikkuAIMiddleware = <
   State extends Record<string, unknown> = Record<string, unknown>,
   RequiredServices extends Services = Services,

package/dist/src/functions/wirings/ai-agent/serialize-model-aliases.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Bakes the `models` alias table into pikku state. Generated rather than read
+ * at runtime: a deployed unit never sees pikku.config.json.
+ */
+export declare const serializeModelAliases: (models: Record<string, string> | undefined, addonName: string | null) => string;

package/dist/src/functions/wirings/ai-agent/serialize-model-aliases.js

@@ -0,0 +1,12 @@
+/**
+ * Bakes the `models` alias table into pikku state. Generated rather than read
+ * at runtime: a deployed unit never sees pikku.config.json.
+ */
+export const serializeModelAliases = (models, addonName) => {
+    const packageArg = addonName ? `'${addonName}'` : 'null';
+    const table = JSON.stringify(models ?? {}, null, 2);
+    return `import { pikkuState } from '@pikku/core/ecosystem'
+
+pikkuState(${packageArg}, 'agent', 'modelAliases', ${table})
+`;
+};

package/dist/src/functions/wirings/ai-scorer/pikku-command-ai-scorer.d.ts

@@ -0,0 +1 @@
+export declare const pikkuAIScorer: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/ai-scorer/pikku-command-ai-scorer.js

@@ -0,0 +1,51 @@
+import { pikkuSessionlessFunc } from '#pikku';
+import { writeFileInDir } from '../../../utils/file-writer.js';
+import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
+import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
+import { serializeScorerNames } from './serialize-scorer-names.js';
+export const pikkuAIScorer = pikkuSessionlessFunc({
+    func: async ({ logger, config, getInspectorState }) => {
+        const { scorers } = await getInspectorState();
+        const { scorerWiringsFile, scorerWiringMetaFile, scorerWiringMetaJsonFile, scorerNamesDeclarationFile, packageMappings, schema, addonName, } = config;
+        const scorerFiles = scorers.files;
+        // Written even when empty: the agent types file imports ScorerName
+        // unconditionally, so a project with no scorers still has to typecheck.
+        await writeFileInDir(logger, scorerNamesDeclarationFile, serializeScorerNames(scorers.scorersMeta));
+        if (scorerFiles.size === 0 ||
+            Object.keys(scorers.scorersMeta).length === 0) {
+            return undefined;
+        }
+        const lines = [];
+        lines.push(`import { addAIScorer } from '@pikku/core/ai-scorer'`);
+        // Ahead of the registrations: addAIScorer refuses a scorer whose metadata
+        // has not landed yet.
+        lines.push(`import '${getFileImportRelativePath(scorerWiringsFile, scorerWiringMetaFile, packageMappings)}'`);
+        const sortedScorers = Array.from(scorerFiles.entries()).sort((a, b) => a[0].localeCompare(b[0]));
+        for (const [, { path, exportedName }] of sortedScorers) {
+            const importPath = getFileImportRelativePath(scorerWiringsFile, path, packageMappings);
+            lines.push(`import { ${exportedName} } from '${importPath}'`);
+        }
+        lines.push('');
+        const packageArg = addonName ? `, '${addonName}'` : '';
+        for (const [scorerName, { exportedName }] of sortedScorers) {
+            lines.push(`addAIScorer('${scorerName}', ${exportedName}${packageArg})`);
+        }
+        await writeFileInDir(logger, scorerWiringsFile, lines.join('\n'));
+        await writeFileInDir(logger, scorerWiringMetaJsonFile, JSON.stringify({ scorersMeta: scorers.scorersMeta }, null, 2));
+        const jsonImportPath = getFileImportRelativePath(scorerWiringMetaFile, scorerWiringMetaJsonFile, packageMappings);
+        const importStatement = schema?.supportsImportAttributes
+            ? `import metaData from '${jsonImportPath}' with { type: 'json' }`
+            : `import metaData from '${jsonImportPath}'`;
+        await writeFileInDir(logger, scorerWiringMetaFile, `import { pikkuState } from '@pikku/core/ecosystem'
+import type { ScorerMeta } from '@pikku/core/ai-scorer'
+${importStatement}
+pikkuState(${addonName ? `'${addonName}'` : 'null'}, 'agent', 'scorersMeta', metaData.scorersMeta as ScorerMeta)`);
+        return true;
+    },
+    middleware: [
+        logCommandInfoAndTime({
+            commandStart: 'Finding AI scorers',
+            commandEnd: 'Found AI scorers',
+        }),
+    ],
+});

package/dist/src/functions/wirings/ai-scorer/serialize-scorer-names.d.ts

@@ -0,0 +1,10 @@
+import type { ScorerMeta } from '@pikku/core/ai-scorer';
+/**
+ * The names an agent may ask to be graded by.
+ *
+ * Emitted even when there are none — the agent types file imports it
+ * unconditionally, so a project with no scorers still has to typecheck. `never`
+ * is what makes `scorers: ['typo']` a type error there rather than a silent
+ * no-op at runtime.
+ */
+export declare const serializeScorerNames: (scorersMeta: ScorerMeta) => string;

package/dist/src/functions/wirings/ai-scorer/serialize-scorer-names.js

@@ -0,0 +1,17 @@
+/**
+ * The names an agent may ask to be graded by.
+ *
+ * Emitted even when there are none — the agent types file imports it
+ * unconditionally, so a project with no scorers still has to typecheck. `never`
+ * is what makes `scorers: ['typo']` a type error there rather than a silent
+ * no-op at runtime.
+ */
+export const serializeScorerNames = (scorersMeta) => {
+    const names = Object.keys(scorersMeta).sort();
+    return `/**
+ * The AI scorers declared in this project.
+ */
+
+export type ScorerName = ${names.length === 0 ? 'never' : names.map((name) => `'${name}'`).join(' | ')}
+`;
+};

package/dist/src/functions/wirings/auth/pikku-command-auth.d.ts

@@ -2,6 +2,6 @@ export declare const pikkuAuth: import("#pikku").PikkuFunctionConfig<{
     bootstrap?: boolean;
 }, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{
     bootstrap?: boolean;
-}, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<{
+}, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<{
     bootstrap?: boolean;
 }, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/auth/serialize-auth-gen.js

@@ -36,10 +36,12 @@ function variableSchemaName(name, field) {
 // External consoles (served from another origin) cannot carry the session
 // cookie, so they authenticate with 'Authorization: Bearer <PIKKU_CONSOLE_TOKEN>'.
 // The expected token resolves through the secrets service per request and the
-// middleware is a no-op while the secret is unset. Emitted into the same
-// addHTTPMiddleware('*') call as the session middleware: the inspector keys
-// route-middleware groups by pattern, so a second '*' registration from another
-// file would silently displace this one in deployed units.
+// middleware is a no-op while the secret is unset. Emitted alongside the session
+// middleware in one addGlobalMiddleware call. This used to be an
+// addHTTPMiddleware('*') call and had to be a single one, because the inspector
+// keys route-middleware groups by pattern and a second '*' registration would
+// silently displace it; global middleware is an append-only list, so that
+// hazard is gone.
 //
 // The session carries the two scope roots the console addon gates itself on.
 // Without them this token authenticates but authorizes nothing: `wireAddon`
@@ -157,7 +159,7 @@ export const serializeAuthGen = (definition, providers, authFile, typesDeclarati
         '// AUTO-GENERATED by pikku CLI — do not edit',
         '',
         emitStatefulSession
-            ? `import { pikkuSessionlessFunc, wireHTTPRoutes, addHTTPMiddleware } from '${pikkuTypesImportPath}'`
+            ? `import { pikkuSessionlessFunc, wireHTTPRoutes } from '${pikkuTypesImportPath}'\nimport { addGlobalMiddleware } from '@pikku/core/middleware'`
             : `import { pikkuSessionlessFunc, wireHTTPRoutes } from '${pikkuTypesImportPath}'`,
         emitStatefulSession
             ? `import { createAuthHandler, betterAuthSession } from '@pikku/better-auth'`
@@ -183,10 +185,10 @@ export const serializeAuthGen = (definition, providers, authFile, typesDeclarati
         // Stateful: betterAuthSession calls services.auth(), so it stays here with
         // the auth.wiring import.
         if (includeConsoleToken) {
-            wiring.push(`addHTTPMiddleware('*', [`, `  betterAuthSession(),`, ...consoleTokenMiddlewareLines(), `])`, '');
+            wiring.push(`addGlobalMiddleware([`, `  betterAuthSession(),`, ...consoleTokenMiddlewareLines(), `])`, '');
         }
         else {
-            wiring.push(`addHTTPMiddleware('*', [betterAuthSession()])`, '');
+            wiring.push(`addGlobalMiddleware([betterAuthSession()])`, '');
         }
     }
     // `pikku` tag marks these as scaffold plumbing (not user-authored wiring) so
@@ -208,10 +210,25 @@ export const serializeAuthGen = (definition, providers, authFile, typesDeclarati
     if (stateless) {
         // Stateless session middleware in its own file — imports neither auth.wiring
         // nor the better-auth server, so every unit's bootstrap stays lean.
+        // Global, not `addHTTPMiddleware('*')`.
+        //
+        // Both entries resolve a session from whatever request the call arrived on;
+        // neither is an HTTP routing concern. Registered as HTTP middleware they ran
+        // for HTTP wirings alone, so an MCP tool fronting a session-requiring
+        // function could only answer 'Authentication required' however the caller
+        // authenticated — the cookie was sent and never looked at.
+        //
+        // Wirings that carry no request are unaffected: every one of these opens
+        // with `if (!http?.request) return`, so queue, scheduler and CLI invocations
+        // pass straight through as before.
+        //
+        // This also retires the displacement hazard that kept both entries in one
+        // call — global middleware is a list rather than a map keyed by route
+        // pattern, so a second registration appends instead of overwriting.
         const middleware = [
             '// AUTO-GENERATED by pikku CLI — do not edit',
             '',
-            `import { addHTTPMiddleware } from '${pikkuTypesImportPath}'`,
+            `import { addGlobalMiddleware } from '@pikku/core/middleware'`,
             `import { betterAuthStatelessSession } from '@pikku/better-auth'`,
             ...(includeConsoleToken
                 ? [`import { authBearer } from '@pikku/core/middleware'`]
@@ -219,12 +236,12 @@ export const serializeAuthGen = (definition, providers, authFile, typesDeclarati
             '',
             ...(includeConsoleToken
                 ? [
-                    `addHTTPMiddleware('*', [`,
+                    `addGlobalMiddleware([`,
                     `  betterAuthStatelessSession(),`,
                     ...consoleTokenMiddlewareLines(),
                     `])`,
                 ]
-                : [`addHTTPMiddleware('*', [betterAuthStatelessSession()])`]),
+                : [`addGlobalMiddleware([betterAuthStatelessSession()])`]),
             '',
         ];
         output.middleware = middleware.join('\n');

package/dist/src/functions/wirings/channels/pikku-channels.d.ts

@@ -1 +1 @@
-export declare const pikkuChannels: import("#pikku").PikkuFunctionSessionlessConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuChannels: import("#pikku").PikkuFunctionSessionlessConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices, unknown>, undefined, undefined>;

package/dist/src/functions/wirings/channels/pikku-channels.js

@@ -26,7 +26,7 @@ export const pikkuChannels = pikkuVoidFunc({
             const importStatement = supportsImportAttributes
                 ? `import metaData from '${jsonImportPath}' with { type: 'json' }`
                 : `import metaData from '${jsonImportPath}'`;
-            await writeFileInDir(logger, channelsWiringMetaFile, `import { pikkuState } from '@pikku/core/internal'\nimport { ChannelsMeta } from '@pikku/core/channel'\n${importStatement}\npikkuState(null, 'channel', 'meta', metaData as ChannelsMeta)`);
+            await writeFileInDir(logger, channelsWiringMetaFile, `import { pikkuState } from '@pikku/core/ecosystem'\nimport { ChannelsMeta } from '@pikku/core/channel'\n${importStatement}\npikkuState(null, 'channel', 'meta', metaData as ChannelsMeta)`);
         }
     },
     middleware: [

package/dist/src/functions/wirings/channels/pikku-command-channel-types.d.ts

@@ -1 +1 @@
-export declare const pikkuChannelTypes: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuChannelTypes: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/channels/pikku-command-channels-map.d.ts

@@ -1 +1 @@
-export declare const pikkuChannelsMap: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuChannelsMap: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/channels/pikku-command-channels.d.ts

@@ -1 +1 @@
-export declare const pikkuCommandChannels: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuCommandChannels: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/channels/pikku-command-channels.js

@@ -41,7 +41,7 @@ export const pikkuCommandChannels = pikkuSessionlessFunc({
         const importStatement = supportsImportAttributes
             ? `import metaData from '${jsonImportPath}' with { type: 'json' }`
             : `import metaData from '${jsonImportPath}'`;
-        await writeFileInDir(logger, channelsWiringMetaFile, `import { pikkuState } from '@pikku/core/internal'\nimport type { ChannelsMeta } from '@pikku/core/channel'\n${importStatement}\npikkuState(null, 'channel', 'meta', metaData as ChannelsMeta)`);
+        await writeFileInDir(logger, channelsWiringMetaFile, `import { pikkuState } from '@pikku/core/ecosystem'\nimport type { ChannelsMeta } from '@pikku/core/channel'\n${importStatement}\npikkuState(null, 'channel', 'meta', metaData as ChannelsMeta)`);
         return true;
     },
     middleware: [

package/dist/src/functions/wirings/cli/pikku-command-cli-entry.d.ts

@@ -1 +1 @@
-export declare const pikkuCLIEntry: import("#pikku").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuCLIEntry: import("#pikku").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/cli/pikku-command-cli-types.d.ts

@@ -1,5 +1,5 @@
 type CLITypesCommandInput = {
     bootstrap?: boolean;
 };
-export declare const pikkuCLITypes: import("#pikku").PikkuFunctionConfig<CLITypesCommandInput, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<CLITypesCommandInput, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<CLITypesCommandInput, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuCLITypes: import("#pikku").PikkuFunctionConfig<CLITypesCommandInput, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<CLITypesCommandInput, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<CLITypesCommandInput, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
 export {};

package/dist/src/functions/wirings/cli/pikku-command-cli.d.ts

@@ -1 +1 @@
-export declare const pikkuCLI: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuCLI: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/cli/pikku-command-cli.js

@@ -41,7 +41,7 @@ export const pikkuCLI = pikkuSessionlessFunc({
         const importStatement = supportsImportAttributes
             ? `import metaData from '${jsonImportPath}' with { type: 'json' }`
             : `import metaData from '${jsonImportPath}'`;
-        await writeFileInDir(logger, cliWiringMetaFile, `import { pikkuState } from '@pikku/core/internal'\nimport { CLIMeta } from '@pikku/core/cli'\n${importStatement}\npikkuState(null, 'cli', 'meta', metaData as CLIMeta)`);
+        await writeFileInDir(logger, cliWiringMetaFile, `import { pikkuState } from '@pikku/core/ecosystem'\nimport { CLIMeta } from '@pikku/core/cli'\n${importStatement}\npikkuState(null, 'cli', 'meta', metaData as CLIMeta)`);
         return true;
     },
     middleware: [

package/dist/src/functions/wirings/cli/serialize-channel-cli.js

@@ -61,7 +61,7 @@ import { wireChannel } from '${channelTypesPath}'
 import { pikkuMiddleware${hasAddonFuncs ? ', ref' : ''}, pikkuSessionlessFunc } from '${functionTypesPath}'
 import { generateCommandHelp } from '@pikku/core/cli'
 import { handleRawCLI, type RawCLIFrame } from '@pikku/core/cli/channel'
-import { pikkuState } from '@pikku/core/internal'
+import { pikkuState, getSingletonServices, getCreateWireServices } from '@pikku/core/ecosystem'
 ${imports}
 
 // Middleware to close the channel after CLI command completes
@@ -108,12 +108,17 @@ export const cliHelp = pikkuSessionlessFunc<{ args?: string[] }, { help: string
  */
 export const cliRaw = pikkuSessionlessFunc<{ args: string[] }, RawCLIFrame>({
   auth: false,
-  func: async (services, data: { args: string[] }, { channel, session }) => {
+  func: async (_services, data: { args: string[] }, { channel, session }) => {
     const { help, result, error, exitCode, commandId } = await handleRawCLI({
       programName: '${programName}',
       args: data.args,
-      singletonServices: services as any,
-      createWireServices: pikkuState(null, 'package', 'factories')?.createWireServices,
+      // The singletons, not this function's own view of them: a function body
+      // is handed \`secrets\` as a throwing accessor, and passing that down
+      // would strip every command run on this channel of a service its
+      // middleware is entitled to. Each command is stripped again by its own
+      // runner, so nothing gains access it would not have over HTTP.
+      singletonServices: getSingletonServices() as any,
+      createWireServices: getCreateWireServices(),
       // The connection authenticated during its upgrade — commands run as it.
       session,
       // The socket the command arrived on, so \`channel.remote(...)\` inside a
@@ -143,7 +148,7 @@ export const cliRaw = pikkuSessionlessFunc<{ args: string[] }, RawCLIFrame>({
   },
 })
 
-${programMeta.auth === true
+${programMeta.auth !== false
         ? `/**
  * Refuses a connection that arrives without a session.
  *
@@ -168,8 +173,8 @@ export const cliRequireSession = pikkuSessionlessFunc<void, RawCLIFrame | void>(
 wireChannel({
   name: '${finalChannelName}',
   route: '${finalChannelRoute}',
-  auth: ${programMeta.auth === true},
-${programMeta.auth === true ? '  onConnect: cliRequireSession,\n' : ''}  onMessageWiring: {
+  auth: ${programMeta.auth !== false},
+${programMeta.auth !== false ? '  onConnect: cliRequireSession,\n' : ''}  onMessageWiring: {
     command: {
       '__help': {
         func: cliHelp,

package/dist/src/functions/wirings/console/pikku-command-console-functions.d.ts

@@ -1 +1 @@
-export declare const pikkuConsoleFunctions: import("#pikku").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuConsoleFunctions: import("#pikku").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/console/pikku-command-node-types.d.ts

@@ -1 +1 @@
-export declare const pikkuNodeTypes: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuNodeTypes: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/console/pikku-command-nodes-meta.d.ts

@@ -1 +1 @@
-export declare const pikkuNodesMeta: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuNodesMeta: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/console/serialize-console-functions.js

@@ -5,13 +5,6 @@ export const serializeConsoleFunctions = (pathToPikkuTypes, _pathToAgentTypes, g
  */
 import { z } from 'zod'
 
-export const SecretRef = z.object({ secretId: z.string() })
-
-export const SetSecret = z.object({
-  secretId: z.string(),
-  value: z.unknown(),
-})
-
 export const VariableRef = z.object({ variableId: z.string() })
 
 export const SetVariable = z.object({
@@ -24,34 +17,16 @@ export const ValueResult = z.object({
   value: z.unknown().nullable(),
 })
 
-export const Exists = z.object({ exists: z.boolean() })
-
 export const Success = z.object({ success: z.boolean() })
 `;
     const functions = `import { pikkuFunc, defineHTTPRoutes, wireHTTPRoutes, ref, wireAddon } from '${pathToPikkuTypes}'
 import {
-  SecretRef,
-  SetSecret,
   VariableRef,
   SetVariable,
   ValueResult,
-  Exists,
   Success,
 } from './console.schemas.gen.js'
 
-export const pikkuConsoleSetSecret = pikkuFunc({
-  secretBroker: true,
-  tags: ['pikku'],
-  description: 'Set the value of a secret',
-  expose: true,
-  input: SetSecret,
-  output: Success,
-  func: async ({ secrets }, { secretId, value }) => {
-    await secrets.setSecret(secretId, value)
-    return { success: true }
-  },
-})
-
 export const pikkuConsoleGetVariable = pikkuFunc({
   tags: ['pikku'],
   description: 'Get the current value of a variable',
@@ -89,36 +64,6 @@ export const pikkuConsoleSetVariable = pikkuFunc({
   },
 })
 
-export const pikkuConsoleHasSecret = pikkuFunc({
-  secretBroker: true,
-  tags: ['pikku'],
-  description: 'Check if a secret exists without reading its value',
-  expose: true,
-  input: SecretRef,
-  output: Exists,
-  func: async ({ secrets }, { secretId }) => {
-    const exists = await secrets.hasSecret(secretId)
-    return { exists }
-  },
-})
-
-export const pikkuConsoleGetSecret = pikkuFunc({
-  secretBroker: true,
-  tags: ['pikku'],
-  description: 'Get the current value of a secret',
-  expose: true,
-  input: SecretRef,
-  output: ValueResult,
-  func: async ({ secrets }, { secretId }) => {
-    const exists = await secrets.hasSecret(secretId)
-    if (!exists) {
-      return { exists: false, value: null }
-    }
-    const value = await secrets.getSecret(secretId)
-    return { exists: true, value: value.reveal() }
-  },
-})
-
 export const consoleRoutes = defineHTTPRoutes({
   auth: false,
   tags: ['pikku'],
@@ -132,7 +77,15 @@ export const consoleRoutes = defineHTTPRoutes({
   },
 })
 
-wireAddon({ name: 'console', package: '@pikku/addon-console', scopes: ['admin'] })
+wireAddon({
+  name: 'console',
+  package: '@pikku/addon-console',
+  scopes: ['admin'],
+  globalSecrets:
+    'the console administers secrets an operator names at runtime, so no static declaration can cover them',
+  globalCredentials:
+    'the console lists and links credentials across every user, so it cannot be scoped to a declared set',
+})
 wireHTTPRoutes({ basePath: '${globalHTTPPrefix}', routes: { console: consoleRoutes } })
 `;
     return { schemas, functions };

package/dist/src/functions/wirings/credentials/pikku-command-credentials.d.ts

@@ -1 +1 @@
-export declare const pikkuCredentials: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuCredentials: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/emails/pikku-command-emails.d.ts

@@ -1,6 +1,6 @@
 import type { PikkuCLIConfig } from '../../../../types/config.js';
 import type { CLILogger } from '../../../services/cli-logger.service.js';
-export declare const pikkuEmails: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuEmails: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
 export declare function generateEmailsArtifacts(logger: CLILogger, config: Pick<PikkuCLIConfig, 'outDir'> & {
     emailTemplatesDir?: string;
 }): Promise<true | undefined>;

package/dist/src/functions/wirings/functions/pikku-command-addon-types.d.ts

@@ -1,5 +1,5 @@
 type AddonTypesCommandInput = {
     bootstrap?: boolean;
 };
-export declare const pikkuAddonTypes: import("#pikku").PikkuFunctionConfig<AddonTypesCommandInput, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<AddonTypesCommandInput, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<AddonTypesCommandInput, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuAddonTypes: import("#pikku").PikkuFunctionConfig<AddonTypesCommandInput, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<AddonTypesCommandInput, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<AddonTypesCommandInput, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
 export {};

package/dist/src/functions/wirings/functions/pikku-command-function-types-split.d.ts

@@ -2,6 +2,6 @@ export declare const pikkuFunctionTypesSplit: import("#pikku").PikkuFunctionConf
     bootstrap?: boolean;
 }, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{
     bootstrap?: boolean;
-}, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<{
+}, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<{
     bootstrap?: boolean;
 }, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/functions/pikku-command-function-types.d.ts

@@ -2,6 +2,6 @@ export declare const pikkuFunctionTypes: import("#pikku").PikkuFunctionConfig<{
     bootstrap?: boolean;
 }, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{
     bootstrap?: boolean;
-}, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<{
+}, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<{
     bootstrap?: boolean;
 }, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/functions/pikku-command-functions.d.ts

@@ -1 +1 @@
-export declare const pikkuFunctions: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuFunctions: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/functions/pikku-command-functions.js

@@ -27,7 +27,7 @@ export const pikkuFunctions = pikkuSessionlessFunc({
             ? `import metaData from '${jsonImportPath}' with { type: 'json' }`
             : `import metaData from '${jsonImportPath}'`;
         const packageName = config.addonName ? `'${config.addonName}'` : 'null';
-        await writeFileInDir(logger, functionsMetaFile, `import { pikkuState } from '@pikku/core/internal'\nimport type { FunctionsMeta } from '@pikku/core'\n${importStatement}\npikkuState(${packageName}, 'function', 'meta', metaData as FunctionsMeta)`);
+        await writeFileInDir(logger, functionsMetaFile, `import { pikkuState } from '@pikku/core/ecosystem'\nimport type { FunctionsMeta } from '@pikku/core'\n${importStatement}\npikkuState(${packageName}, 'function', 'meta', metaData as FunctionsMeta)`);
         // For addon packages, register ALL functions (they'll be invoked by consumers)
         // For main packages, only register functions that are invoked via internal RPCs
         const isAddon = !!config.addonName;

package/dist/src/functions/wirings/functions/pikku-command-services.d.ts

@@ -1,2 +1,2 @@
 export declare const serializeServicesMap: (allSingletonServices: string[], allWireServices: string[], requiredServices: Set<string>, forceRequiredServices: string[] | undefined, servicesImport: string, wireServicesImport: string, addonRequiredParentServices?: string[], authInjected?: boolean, agentScaffoldEnabled?: boolean) => string;
-export declare const pikkuServices: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuServices: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/functions/schemas.d.ts

@@ -1 +1 @@
-export declare const pikkuSchemas: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuSchemas: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;