@pikku/core 0.12.72 → 0.12.77

package/dist/wirings/channel/local/local-eventhub-service.d.ts

@@ -1,44 +1,11 @@
 import type { PikkuChannelHandler } from '../channel.types.js';
 import type { EventHubService } from '../eventhub-service.js';
-/**
- * Implementation of the SubscriptionService interface.
- * Manages subscriptions and publishes messages to subscribers.
- */
 export declare class LocalEventHubService<Data extends Record<string, any> = {}> implements EventHubService<Data> {
     private channels;
-    /**
-     * A map storing topics and their associated connection IDs.
-     */
     private subscriptions;
-    /**
-     * Subscribes a connection to a specific topic.
-     * Creates the topic if it does not already exist.
-     * @param topic - The topic to subscribe to.
-     * @param channelId - The unique ID of the connection to subscribe.
-     */
     subscribe<T extends keyof Data>(topic: T, channelId: string): void | Promise<void>;
-    /**
-     * Unsubscribes a connection from a specific topic.
-     * Removes the topic if it has no more subscribers.
-     * @param topic - The topic to unsubscribe from.
-     * @param channelId - The unique ID of the connection to unsubscribe.
-     */
     unsubscribe<T extends keyof Data>(topic: T, channelId: string): void | Promise<void>;
-    /**
-     * Sends data to all connections subscribed to a topic.
-     * @param topic - The topic to send data to.
-     * @param data - The data to send to the subscribers.
-     */
     publish<T extends keyof Data>(topic: T, channelId: string | null, data: Data[T], isBinary?: boolean): void | Promise<void>;
-    /**
-     * Registers a channel on open
-     */
     onChannelOpened(channelHandler: PikkuChannelHandler): void;
-    /**
-     * Handles cleanup when a channel is closed.
-     * Removes the channel from all topics it is subscribed to.
-     * Deletes the topic if no more channels are subscribed to it.
-     * @param channelId - The ID of the channel that was closed.
-     */
     onChannelClosed(channelId: string): void;
 }

package/dist/wirings/channel/local/local-eventhub-service.js

@@ -1,31 +1,12 @@
-/**
- * Implementation of the SubscriptionService interface.
- * Manages subscriptions and publishes messages to subscribers.
- */
 export class LocalEventHubService {
     channels = new Map();
-    /**
-     * A map storing topics and their associated connection IDs.
-     */
     subscriptions = new Map();
-    /**
-     * Subscribes a connection to a specific topic.
-     * Creates the topic if it does not already exist.
-     * @param topic - The topic to subscribe to.
-     * @param channelId - The unique ID of the connection to subscribe.
-     */
     subscribe(topic, channelId) {
         if (!this.subscriptions.has(topic)) {
             this.subscriptions.set(topic, new Set());
         }
         this.subscriptions.get(topic).add(channelId);
     }
-    /**
-     * Unsubscribes a connection from a specific topic.
-     * Removes the topic if it has no more subscribers.
-     * @param topic - The topic to unsubscribe from.
-     * @param channelId - The unique ID of the connection to unsubscribe.
-     */
     unsubscribe(topic, channelId) {
         const topicSubscriptions = this.subscriptions.get(topic);
         if (topicSubscriptions) {
@@ -35,11 +16,6 @@ export class LocalEventHubService {
             }
         }
     }
-    /**
-     * Sends data to all connections subscribed to a topic.
-     * @param topic - The topic to send data to.
-     * @param data - The data to send to the subscribers.
-     */
     publish(topic, channelId, data, isBinary) {
         const subscribedChannelIds = this.subscriptions.get(topic);
         if (!subscribedChannelIds) {
@@ -47,36 +23,26 @@ export class LocalEventHubService {
         }
         for (const toChannelId of subscribedChannelIds) {
             if (channelId === toChannelId)
-                continue; // Skip sending to the sender
+                continue;
             const channel = this.channels.get(toChannelId);
             if (channel) {
                 try {
                     channel.send(data, isBinary);
                 }
                 catch {
-                    // Channel closed (e.g. SSE ReadableStream controller already closed on browser disconnect) — clean up
                     this.onChannelClosed(toChannelId);
                 }
             }
         }
     }
-    /**
-     * Registers a channel on open
-     */
     onChannelOpened(channelHandler) {
         this.channels.set(channelHandler.getChannel().channelId, channelHandler);
     }
-    /**
-     * Handles cleanup when a channel is closed.
-     * Removes the channel from all topics it is subscribed to.
-     * Deletes the topic if no more channels are subscribed to it.
-     * @param channelId - The ID of the channel that was closed.
-     */
     onChannelClosed(channelId) {
         for (const [topic, channelIds] of this.subscriptions.entries()) {
             channelIds.delete(channelId);
             if (channelIds.size === 0) {
-                this.subscriptions.delete(topic); // Cleanup empty topics
+                this.subscriptions.delete(topic);
             }
         }
         this.channels.delete(channelId);

package/dist/wirings/channel/log-channels.d.ts

@@ -1,6 +1,2 @@
 import type { Logger } from '../../services/index.js';
-/**
- * Logs all the loaded channels.
- * @param logger - A logger for logging information.
- */
 export declare const logChannels: (logger: Logger) => void;

package/dist/wirings/channel/log-channels.js

@@ -1,8 +1,4 @@
 import { pikkuState } from '../../pikku-state.js';
-/**
- * Logs all the loaded channels.
- * @param logger - A logger for logging information.
- */
 export const logChannels = (logger) => {
     const channels = pikkuState(null, 'channel', 'channels');
     if (channels.size === 0) {

package/dist/wirings/channel/pikku-abstract-channel-handler.js

@@ -1,3 +1,4 @@
+import { channelRemote, releaseChannelHostRPC } from './channel-host-rpc.js';
 export class PikkuAbstractChannelHandler {
     channelId;
     channelName;
@@ -25,6 +26,7 @@ export class PikkuAbstractChannelHandler {
                 clearState: () => {
                     channelState = undefined;
                 },
+                remote: (funcName, data) => channelRemote(this.getChannel(), funcName, data),
             };
         }
         return this.channel;
@@ -34,5 +36,9 @@ export class PikkuAbstractChannelHandler {
     }
     close() {
         this.getChannel().state = 'closed';
+        // Fails anything the departing peer still owed an answer to. Not awaited:
+        // `close` is on every runtime's synchronous path, and nothing here can fail
+        // in a way a closing channel could act on.
+        void releaseChannelHostRPC(this.channelId);
     }
 }

package/dist/wirings/channel/serverless/serverless-channel-runner.js

@@ -78,9 +78,9 @@ export const runChannelConnect = async ({ channelId, channelObject, request, res
                 channel,
                 data: openingData,
                 channelMiddlewareMeta: meta.channelMiddleware,
+                userSession,
             });
         }
-        // Store the pikkuUserId mapping after auth middleware has run
         const pikkuUserId = userSession.getPikkuUserId();
         if (pikkuUserId) {
             await channelStore.setPikkuUserId(channelId, pikkuUserId);
@@ -100,10 +100,6 @@ export const runChannelDisconnect = async ({ channelId, channelStore, channelHan
     const singletonServices = getSingletonServices();
     const createWireServices = getCreateWireServices();
     let wireServices;
-    // Try to get channel from store. In serverless environments (especially with
-    // serverless-offline or worker threads), disconnect can be called multiple times
-    // or after the channel has already been cleaned up. If channel doesn't exist,
-    // there's nothing to disconnect, so we can return early.
     let channelData;
     try {
         channelData = await channelStore.getChannel(channelId);
@@ -151,6 +147,7 @@ export const runChannelDisconnect = async ({ channelId, channelStore, channelHan
                 services,
                 channel,
                 channelMiddlewareMeta: meta.channelMiddleware,
+                userSession,
             });
         }
         catch (e) {

package/dist/wirings/cli/channel/cli-approval.d.ts

@@ -0,0 +1,41 @@
+import type { ApprovalRequester } from '../../channel/channel-rpc.js';
+/**
+ * - `prompt`   — ask about anything not classified `needsApproval: false`.
+ * - `auto`     — run the classified-safe set, refuse the rest without asking.
+ * - `dangerous`— run everything.
+ */
+export type ApprovalMode = 'prompt' | 'auto' | 'dangerous';
+export declare const APPROVAL_FLAGS: {
+    readonly auto: "--auto-approve";
+    readonly dangerous: "--dangerously-auto-approve";
+};
+/**
+ * Stripped from argv, not just read: the server owns the command tree and has
+ * never heard of these, and a flag the server can see is one it could act on.
+ */
+export declare const takeApprovalFlags: (args: string[], env?: Record<string, string | undefined>) => {
+    mode: ApprovalMode;
+    args: string[];
+};
+/**
+ * `a` is scoped to the one capability and to this run: widening it to every
+ * capability would quietly turn an interactive run into
+ * `--dangerously-auto-approve`, and persisting it would outlive anyone's memory
+ * of agreeing.
+ */
+export declare const createTerminalApprover: ({ input, output, signal, }?: {
+    input?: NodeJS.ReadStream;
+    output?: NodeJS.WritableStream;
+    /** Aborted when the run ends, so a prompt nobody can answer stops waiting. */
+    signal?: AbortSignal;
+}) => ApprovalRequester;
+/**
+ * Undefined reads as "nobody to ask", which refuses rather than runs. That is
+ * what a non-interactive run gets: CI is exactly where an unattended push would
+ * otherwise happen.
+ */
+export declare const approverForMode: (mode: ApprovalMode, { isTTY, warn, signal, }?: {
+    isTTY?: boolean;
+    warn?: (message: string) => void;
+    signal?: AbortSignal;
+}) => ApprovalRequester | undefined;

package/dist/wirings/cli/channel/cli-approval.js

@@ -0,0 +1,81 @@
+export const APPROVAL_FLAGS = {
+    auto: '--auto-approve',
+    dangerous: '--dangerously-auto-approve',
+};
+/**
+ * Stripped from argv, not just read: the server owns the command tree and has
+ * never heard of these, and a flag the server can see is one it could act on.
+ */
+export const takeApprovalFlags = (args, env = process.env) => {
+    const remaining = args.filter((arg) => arg !== APPROVAL_FLAGS.auto && arg !== APPROVAL_FLAGS.dangerous);
+    const dangerous = args.includes(APPROVAL_FLAGS.dangerous) ||
+        env.PIKKU_DANGEROUSLY_AUTO_APPROVE === '1';
+    const auto = args.includes(APPROVAL_FLAGS.auto) || env.PIKKU_AUTO_APPROVE === '1';
+    return {
+        mode: dangerous ? 'dangerous' : auto ? 'auto' : 'prompt',
+        args: remaining,
+    };
+};
+/**
+ * `a` is scoped to the one capability and to this run: widening it to every
+ * capability would quietly turn an interactive run into
+ * `--dangerously-auto-approve`, and persisting it would outlive anyone's memory
+ * of agreeing.
+ */
+export const createTerminalApprover = ({ input = process.stdin, output = process.stderr, signal, } = {}) => {
+    const allowed = new Set();
+    const ask = async ({ funcName, description }) => {
+        if (allowed.has(funcName) || signal?.aborted) {
+            return allowed.has(funcName);
+        }
+        // stderr, so a command whose stdout is piped still shows the prompt rather
+        // than corrupting the stream it is asking about.
+        output.write(`\nThe server is asking to run "${funcName}" on this machine.\n` +
+            (description ? `  ${description}\n` : '') +
+            `Allow? [y]es / [n]o / [a]lways for "${funcName}": `);
+        const answer = await new Promise((resolve) => {
+            const done = (value) => {
+                input.off('data', onData);
+                signal?.removeEventListener('abort', onAbort);
+                // Reading resumed stdin, which holds the event loop open.
+                input.pause?.();
+                resolve(value);
+            };
+            const onData = (chunk) => done(String(chunk).trim().toLowerCase());
+            // An aborted prompt is a refusal: its command is already over.
+            const onAbort = () => done('n');
+            input.on('data', onData);
+            signal?.addEventListener('abort', onAbort, { once: true });
+        });
+        if (answer === 'a' || answer === 'always') {
+            allowed.add(funcName);
+            return true;
+        }
+        return answer === 'y' || answer === 'yes';
+    };
+    // Requests are dispatched without awaiting, so two can be in flight at once.
+    // Unserialized, both prompts print interleaved and the first keystroke
+    // answers both — approving something the user never read.
+    let queue = Promise.resolve();
+    return (request) => {
+        const answered = queue.then(() => ask(request));
+        queue = answered.catch(() => { });
+        return answered;
+    };
+};
+/**
+ * Undefined reads as "nobody to ask", which refuses rather than runs. That is
+ * what a non-interactive run gets: CI is exactly where an unattended push would
+ * otherwise happen.
+ */
+export const approverForMode = (mode, { isTTY = process.stdin.isTTY, warn = console.error, signal, } = {}) => {
+    if (mode === 'dangerous') {
+        // Once, on stderr, so the log of a run that went wrong records it.
+        warn(`${APPROVAL_FLAGS.dangerous}: every capability this client exposes will run without asking.`);
+        return () => true;
+    }
+    if (mode === 'auto' || !isTTY) {
+        return undefined;
+    }
+    return createTerminalApprover({ signal });
+};

package/dist/wirings/cli/channel/cli-channel-runner.d.ts

@@ -1,8 +1,4 @@
 import type { CorePikkuCLIRender } from '../cli.types.js';
-/**
- * Execute a CLI program via WebSocket channel
- * This is the main entry point for CLI-over-Channel clients
- */
 export declare function executeCLIViaChannel({ programName, pikkuWS, args, renderers, defaultRenderer, }: {
     programName: string;
     pikkuWS: any;

package/dist/wirings/cli/channel/cli-channel-runner.js

@@ -1,19 +1,10 @@
 import { pikkuState } from '../../../pikku-state.js';
 import { generateCommandHelp, parseCLIArguments } from '../command-parser.js';
-/**
- * Default JSON renderer for CLI output. Emits single-line NDJSON so
- * the output stays machine-parseable when the CLI is run with
- * `--output json`; pretty-printing here would break NDJSON consumers.
- */
+// knowledge: decisions/internals/cli-stdout-is-reserved-for-machine-readable-output.md
 const defaultJSONRenderer = (_services, data) => {
     console.log(JSON.stringify(data));
 };
-/**
- * Execute a CLI program via WebSocket channel
- * This is the main entry point for CLI-over-Channel clients
- */
 export async function executeCLIViaChannel({ programName, pikkuWS, args = process.argv.slice(2), renderers = {}, defaultRenderer, }) {
-    // Get CLI metadata from state
     const cliMeta = pikkuState(null, 'cli', 'meta');
     if (!cliMeta || !('programs' in cliMeta)) {
         throw new Error('[PKU342] CLI metadata not found. No CLI wirings were registered. See https://pikku.dev/docs/pikku-cli/errors/pku342 for more information.');
@@ -24,54 +15,44 @@ export async function executeCLIViaChannel({ programName, pikkuWS, args = proces
         console.error(`Error: CLI program "${programName}" not found`);
         process.exit(1);
     }
-    // Parse arguments for this specific program
     const parsed = parseCLIArguments(args, programName, allCLIMeta);
-    // Handle help (check after parsing to support subcommand help)
+    // Parsed first so that `<command> --help` resolves to that command's help.
     if (args.includes('--help') || args.includes('-h') || args.length === 0) {
         const helpText = generateCommandHelp(programName, allCLIMeta, parsed.commandPath);
         console.log(helpText);
         return;
     }
     if (parsed.errors.length > 0) {
-        // Check if any error is about an unknown command
+        // knowledge: decisions/internals/cli-parse-errors-are-routed-by-message-prefix.md
         const hasUnknownCommand = parsed.errors.some((error) => error.startsWith('Unknown command:') ||
             error.startsWith('Command not found:'));
         if (hasUnknownCommand) {
-            // Show help instead of error for unknown commands
             const helpText = generateCommandHelp(programName, allCLIMeta, parsed.commandPath);
             console.log(helpText);
             process.exit(1);
         }
         else {
-            // Show errors for other types of errors
             console.error('Errors:');
             parsed.errors.forEach((error) => console.error(`  ${error}`));
             process.exit(1);
         }
     }
-    // Merge positionals and options into single data object
     const data = { ...parsed.positionals, ...parsed.options };
-    // Get the renderer for this command
     const commandId = parsed.commandPath.join('.');
     const renderer = renderers[commandId] || defaultRenderer || defaultJSONRenderer;
     return new Promise((resolve, reject) => {
-        // Subscribe to responses for this command
         const commandRoute = pikkuWS.getRoute('command');
         const responseHandler = (response) => {
-            // Check if this is a control message
             if (response?.action === 'cli-control' &&
                 response?.event === 'complete') {
-                // Server signals command is complete, close the connection client-side
                 commandRoute.unsubscribe(commandId, responseHandler);
                 pikkuWS.ws.close();
                 resolve(undefined);
                 return;
             }
-            // Call renderer for any output
             renderer(null, response, undefined);
         };
         commandRoute.subscribe(commandId, responseHandler);
-        // Handle connection close
         pikkuWS.ws.addEventListener('close', () => {
             commandRoute.unsubscribe(commandId, responseHandler);
             resolve(undefined);
@@ -80,13 +61,10 @@ export async function executeCLIViaChannel({ programName, pikkuWS, args = proces
             commandRoute.unsubscribe(commandId, responseHandler);
             reject(error);
         });
-        // Send the command once connected
         if (pikkuWS.ws.readyState === 1) {
-            // Already open
             commandRoute.send(commandId, data);
         }
         else {
-            // Wait for open
             pikkuWS.ws.addEventListener('open', () => {
                 commandRoute.send(commandId, data);
             });

package/dist/wirings/cli/channel/cli-raw-channel-runner.d.ts

@@ -1,15 +1,53 @@
-import type { CoreSingletonServices, CreateWireServices } from '../../../types/core.types.js';
+import type { CoreSingletonServices, CoreUserSession, CreateWireServices } from '../../../types/core.types.js';
+import type { PikkuChannel } from '../../channel/channel.types.js';
 /**
- * Handles raw CLI input from a WebSocket channel.
- * Parses the args, resolves the command, and either returns help or executes it.
+ * A frame sent from the server to a raw CLI client. `output` carries command
+ * data to render; `complete` terminates the command and carries the exit code
+ * so the client process can exit non-zero on failure.
  */
-export declare function handleRawCLI({ programName, args, singletonServices, createWireServices, }: {
+export type RawCLIFrame = {
+    action: 'cli-output';
+    commandId?: string;
+    data: unknown;
+} | {
+    action: 'cli-result';
+    commandId?: string;
+    result: unknown;
+} | {
+    action: 'cli-help';
+    help: string;
+} | {
+    action: 'cli-error';
+    error: string;
+} | {
+    action: 'cli-control';
+    event: 'complete';
+    exitCode: number;
+};
+export interface RawCLIResult {
+    help?: string;
+    result?: unknown;
+    error?: string;
+    /** 0 on success, 1 on any parse or execution failure. */
+    exitCode: number;
+    /** The command the server resolved, so a client can pick a renderer. */
+    commandId?: string;
+}
+/**
+ * The client sends argv untouched and this side owns parsing, so the command
+ * tree lives with the server and a client binary never needs to know it.
+ */
+export declare function handleRawCLI({ programName, args, singletonServices, createWireServices, onOutput, session, transport, }: {
     programName: string;
     args: string[];
     singletonServices: CoreSingletonServices;
     createWireServices?: CreateWireServices;
-}): Promise<{
-    help?: string;
-    result?: unknown;
-    error?: string;
-}>;
+    /** Established during the upgrade; commands run as that user. */
+    session?: CoreUserSession;
+    onOutput?: (data: unknown, commandId: string) => Promise<void> | void;
+    /**
+     * The channel the command arrived on, so `channel.remote(...)` reaches the
+     * calling client rather than being refused as a one-way stream.
+     */
+    transport?: PikkuChannel<unknown, any, any>;
+}): Promise<RawCLIResult>;

package/dist/wirings/cli/channel/cli-raw-channel-runner.js

@@ -2,46 +2,47 @@ import { pikkuState } from '../../../pikku-state.js';
 import { parseCLIArguments, generateCommandHelp } from '../command-parser.js';
 import { runCLICommand } from '../cli-runner.js';
 /**
- * Handles raw CLI input from a WebSocket channel.
- * Parses the args, resolves the command, and either returns help or executes it.
+ * The client sends argv untouched and this side owns parsing, so the command
+ * tree lives with the server and a client binary never needs to know it.
  */
-export async function handleRawCLI({ programName, args, singletonServices, createWireServices, }) {
+export async function handleRawCLI({ programName, args, singletonServices, createWireServices, onOutput, session, transport, }) {
     const allCLIMeta = pikkuState(null, 'cli', 'meta');
     if (!allCLIMeta) {
-        return { error: 'CLI metadata not found' };
+        return { error: 'CLI metadata not found', exitCode: 1 };
     }
     const programMeta = allCLIMeta.programs[programName];
     if (!programMeta) {
-        return { error: `Program "${programName}" not found` };
+        return { error: `Program "${programName}" not found`, exitCode: 1 };
     }
-    // Handle empty input or explicit help
     if (args.length === 0 ||
         args.includes('--help') ||
         args.includes('-h') ||
         args[0] === 'help') {
         const helpArgs = args.filter((a) => a !== 'help' && a !== '--help' && a !== '-h');
         const helpText = generateCommandHelp(programName, allCLIMeta, helpArgs);
-        return { help: helpText };
+        return { help: helpText, exitCode: 0 };
     }
-    // Parse the args
     const parsed = parseCLIArguments(args, programName, allCLIMeta);
-    // If there are errors or the command resolves to a group (no function), show help
     if (parsed.errors.length > 0 || parsed.commandPath.length === 0) {
         const helpText = generateCommandHelp(programName, allCLIMeta, parsed.commandPath);
-        return { help: helpText };
+        // Help says what is available, not what they got wrong — so the parser's
+        // reason rides alongside it.
+        return {
+            help: helpText,
+            error: parsed.errors.length > 0 ? parsed.errors.join('\n') : undefined,
+            exitCode: 1,
+        };
     }
-    // Check if the resolved command has a pikkuFuncId (is executable)
     let current = programMeta.commands[parsed.commandPath[0]];
     for (let i = 1; i < parsed.commandPath.length; i++) {
         current = current?.subcommands?.[parsed.commandPath[i]];
     }
     if (!current?.pikkuFuncId) {
-        // It's a group command — show help scoped to that group
         const helpText = generateCommandHelp(programName, allCLIMeta, parsed.commandPath);
-        return { help: helpText };
+        return { help: helpText, exitCode: 0 };
     }
-    // Execute the command
     const data = { ...parsed.positionals, ...parsed.options };
+    const commandId = parsed.commandPath.join('.');
     try {
         const result = await runCLICommand({
             program: programName,
@@ -49,10 +50,17 @@ export async function handleRawCLI({ programName, args, singletonServices, creat
             data,
             singletonServices,
             createWireServices,
+            session,
+            // Not known until parsing finishes here, so it is supplied per-frame.
+            onOutput: onOutput && ((data) => onOutput(data, commandId)),
+            transport,
         });
-        return { result };
+        return { result, exitCode: 0, commandId };
     }
     catch (e) {
-        return { error: e.message };
+        // A command can throw anything; `.message` off a string is undefined, and
+        // the run would then exit 1 saying nothing at all.
+        const message = e instanceof Error ? e.message : String(e);
+        return { error: message || 'Command failed', exitCode: 1, commandId };
     }
 }

package/dist/wirings/cli/channel/cli-raw-client-runner.d.ts

@@ -0,0 +1,38 @@
+import type { ApprovalRequester, Capabilities } from '../../channel/channel-rpc.js';
+import type { Logger } from '../../../services/logger.js';
+/**
+ * Everything a renderer gets when the command ran on the server: a logger, and
+ * nothing else. There is no container on this side of the socket to resolve a
+ * service from, so this is the whole of it rather than a subset of
+ * `CoreSingletonServices` — which requires `config`, `variables` and `secrets`
+ * the client does not have and cannot invent.
+ */
+export type ClientCLIRenderServices = {
+    logger: Logger;
+};
+/**
+ * A renderer that runs on the client of a CLI-over-channel connection.
+ *
+ * Deliberately not `CorePikkuCLIRender`: that type's `Services` parameter is
+ * constrained to `CoreSingletonServices`, so the honest logger-only shape
+ * cannot be spelled through it.
+ */
+export type CorePikkuCLIClientRender<Data> = (services: ClientCLIRenderServices, data: Data, session?: undefined) => void | Promise<void>;
+/**
+ * Runs a CLI command entirely on the server. Unlike `executeCLIViaChannel`,
+ * argv is forwarded untouched and never parsed here, so the client carries no
+ * command metadata and its version may drift from the server's.
+ *
+ * `capabilities` are the functions this client agrees to run on the server's
+ * behalf: the map says what *can* run, and approval whether a call *should*.
+ * `approve` overrides the mode otherwise read from argv and from whether there
+ * is a terminal to ask at.
+ */
+export declare function executeRawCLIViaChannel({ pikkuWS, args, renderers, defaultRenderer, capabilities, approve, }: {
+    pikkuWS: any;
+    args?: string[];
+    renderers?: Record<string, CorePikkuCLIClientRender<any>>;
+    defaultRenderer?: CorePikkuCLIClientRender<any>;
+    capabilities?: Capabilities;
+    approve?: ApprovalRequester;
+}): Promise<number>;