@pikku/core 0.12.79 → 0.12.80

package/src/wirings/channel/channel-runner.ts

@@ -1,10 +1,9 @@
 import { NotFoundError } from '../../errors/errors.js'
 import { addFunction } from '../../function/function-runner.js'
-import type { CorePikkuPermission } from '../../function/functions.types.js'
+import type { CorePikkuFunctionConfig } from '../../function/functions.types.js'
 import { pikkuState, getSingletonServices } from '../../pikku-state.js'
 import { coerceTopLevelDataFromSchema, validateSchema } from '../../schema.js'
 import type { SessionService } from '../../services/user-session-service.js'
-import type { CorePikkuMiddleware } from '../../types/core.types.js'
 import { httpRouter } from '../http/routers/http-router.js'
 import type {
   ChannelMeta,
@@ -13,19 +12,34 @@ import type {
   RunChannelParams,
 } from './channel.types.js'
 
+type HandlerConfig = CorePikkuFunctionConfig<any, any>
+
+/**
+ * The config to register for a channel handler: the handler itself when it is a
+ * direct function config, or its inner `func` when it is a wrapper.
+ *
+ * knowledge: decisions/internals/channel-message-handlers-accept-three-config-shapes.md
+ */
+const registeredHandler = (handler: unknown): HandlerConfig => {
+  const candidate = handler as { func?: unknown }
+  return typeof candidate.func === 'function'
+    ? (handler as HandlerConfig)
+    : (candidate.func as HandlerConfig)
+}
+
 export const wireChannel = <
   In,
   Channel extends string,
-  PikkuPermission extends CorePikkuPermission<In>,
-  PikkuMiddleware extends CorePikkuMiddleware,
-  ChannelFunction,
+  ChannelConnect,
+  ChannelDisconnect,
+  ChannelFunctionMessage,
 >(
   channel: CoreChannel<
     In,
     Channel,
-    PikkuPermission,
-    PikkuMiddleware,
-    ChannelFunction
+    ChannelConnect,
+    ChannelDisconnect,
+    ChannelFunctionMessage
   >
 ) => {
   const channelsMeta = pikkuState(null, 'channel', 'meta')
@@ -38,19 +52,23 @@ export const wireChannel = <
   }
 
   if (channel.onConnect && channelMeta.connect) {
-    addFunction(channelMeta.connect.pikkuFuncId, channel.onConnect as any)
+    addFunction(
+      channelMeta.connect.pikkuFuncId,
+      registeredHandler(channel.onConnect)
+    )
   }
 
   if (channel.onDisconnect && channelMeta.disconnect) {
-    addFunction(channelMeta.disconnect.pikkuFuncId, channel.onDisconnect as any)
+    addFunction(
+      channelMeta.disconnect.pikkuFuncId,
+      registeredHandler(channel.onDisconnect)
+    )
   }
 
   if (channel.onMessage && channelMeta.message?.pikkuFuncId) {
     addFunction(
       channelMeta.message.pikkuFuncId,
-      (channel.onMessage as any).func instanceof Function
-        ? channel.onMessage
-        : (channel.onMessage as any).func
+      registeredHandler(channel.onMessage)
     )
   }
 
@@ -63,17 +81,12 @@ export const wireChannel = <
         const wiringMeta = channelWirings[wiringKey]
         if (!wiringMeta) return
 
-        addFunction(
-          wiringMeta.pikkuFuncId,
-          (handler as any).func instanceof Function
-            ? handler
-            : (handler as any).func
-        )
+        addFunction(wiringMeta.pikkuFuncId, registeredHandler(handler))
       })
     })
   }
 
-  pikkuState(null, 'channel', 'channels').set(channel.name, channel as any)
+  pikkuState(null, 'channel', 'channels').set(channel.name, channel)
 }
 
 const getMatchingChannelConfig = (path: string) => {

package/src/wirings/channel/channel.types.ts

@@ -64,6 +64,8 @@ export interface ChannelMeta {
   message: ChannelMessageMeta | null
   messageWirings: Record<string, Record<string, ChannelMessageMeta>>
   binary?: boolean | null
+  /** Set when the channel was wired by a gateway rather than declared directly. */
+  gateway?: boolean
   summary?: string
   description?: string
   errors?: string[]

package/src/wirings/channel/local/local-channel-runner.ts

@@ -206,7 +206,7 @@ export const runLocalChannel = async ({
 
       const { onMessage, onBinaryMessage } = processMessageHandlers(
         services,
-        channelConfig as any,
+        channelConfig,
         channelHandler,
         userSession
       )

package/src/wirings/channel/pikku-abstract-channel-handler.ts

@@ -34,7 +34,8 @@ export abstract class PikkuAbstractChannelHandler<
         setState: (s) => {
           channelState = s
         },
-        getState: () => channelState as any,
+        // knowledge: decisions/internals/channel-state-accessors-are-unsound-generics-that-every-implementation-asserts.md
+        getState: () => channelState as never,
         clearState: () => {
           channelState = undefined
         },

package/src/wirings/channel/serverless/serverless-channel-runner.ts

@@ -117,7 +117,8 @@ export const runChannelConnect = async ({
       channelName: channelConfig.name,
     })
     channel.setState = (state) => channelStore.setState(channelId, state)
-    channel.getState = () => channelStore.getState(channelId) as any
+    // knowledge: decisions/internals/channel-state-accessors-are-unsound-generics-that-every-implementation-asserts.md
+    channel.getState = () => channelStore.getState(channelId) as never
     channel.clearState = () => channelStore.clearState(channelId)
 
     const wire: PikkuRawWire = {
@@ -198,7 +199,8 @@ export const runChannelDisconnect = async ({
     channelName,
   })
   channel.setState = (state) => channelStore.setState(channelId, state)
-  channel.getState = () => channelStore.getState(channelId) as any
+  // knowledge: decisions/internals/channel-state-accessors-are-unsound-generics-that-every-implementation-asserts.md
+  channel.getState = () => channelStore.getState(channelId) as never
   channel.clearState = () => channelStore.clearState(channelId)
 
   const userSession = new PikkuSessionService<CoreUserSession>(
@@ -271,7 +273,8 @@ export const runChannelMessage = async (
     channelName,
   })
   channel.setState = (state) => channelStore.setState(channelId, state)
-  channel.getState = () => channelStore.getState(channelId) as any
+  // knowledge: decisions/internals/channel-state-accessors-are-unsound-generics-that-every-implementation-asserts.md
+  channel.getState = () => channelStore.getState(channelId) as never
   channel.clearState = () => channelStore.clearState(channelId)
 
   const userSession = new PikkuSessionService<CoreUserSession>(

package/src/wirings/cli/channel/cli-channel-runner.ts

@@ -90,7 +90,9 @@ export async function executeCLIViaChannel({
         return
       }
 
-      renderer(null as any, response, undefined)
+      // A CLI channel response is rendered off-process: there are no services
+      // to hand the renderer, and every CLI renderer ignores the argument.
+      renderer(null as never, response, undefined)
     }
 
     commandRoute.subscribe(commandId, responseHandler)

package/src/wirings/cli/channel/cli-raw-client-runner.ts

@@ -32,7 +32,10 @@ export type CorePikkuCLIClientRender<Data> = (
 ) => void | Promise<void>
 
 /** The normal case once the server owns the command tree. */
-const defaultJSONRenderer: CorePikkuCLIClientRender<any> = (_services, data) => {
+const defaultJSONRenderer: CorePikkuCLIClientRender<any> = (
+  _services,
+  data
+) => {
   console.log(JSON.stringify(data))
 }
 

package/src/wirings/cli/cli-runner.ts

@@ -16,6 +16,7 @@ import type {
   CLIMeta,
 } from './cli.types.js'
 import type {
+  CoreConfig,
   CoreSingletonServices,
   CoreServices,
   CreateWireServices,
@@ -24,7 +25,7 @@ import type {
   CreateSingletonServices,
 } from '../../types/core.types.js'
 import type { PikkuChannel } from '../channel/channel.types.js'
-import { unsupportedChannelRemote } from '../channel/channel-rpc.js'
+import { unsupportedChannelRemote } from '../channel/channel-rpc.types.js'
 import {
   PikkuSessionService,
   createMiddlewareSessionWireProps,
@@ -321,7 +322,8 @@ export async function runCLICommand({
     setState: (s) => {
       cliState = s
     },
-    getState: () => cliState as any,
+    // knowledge: decisions/internals/channel-state-accessors-are-unsound-generics-that-every-implementation-asserts.md
+    getState: () => cliState as never,
     clearState: () => {
       cliState = undefined
     },
@@ -372,7 +374,8 @@ export async function runCLICommand({
     if (result !== undefined && !onOutput) {
       const commandRenderer = programData?.renderers[commandId]
       const jsonMode =
-        (data as any).json === true || (data as any).output === 'json'
+        (data as { json?: unknown; output?: unknown }).json === true ||
+        (data as { json?: unknown; output?: unknown }).output === 'json'
       const finalRenderer: CorePikkuCLIRender<any> | undefined =
         jsonMode && commandRenderer !== undefined
           ? defaultJSONRenderer
@@ -491,7 +494,7 @@ export async function executeCLI({
 
     const config = createConfig
       ? await createConfig(new LocalVariablesService(), data)
-      : ({} as any)
+      : ({} as CoreConfig)
 
     const singletonServices = await createSingletonServices(config)
     pikkuState(null, 'package', 'singletonServices', singletonServices)

package/src/wirings/cli/cli.types.ts

@@ -197,18 +197,6 @@ export type ValidateParameters<Params extends string, Input> =
     ? Params
     : never
 
-/**
- * Extract output type from a Pikku function config type
- */
-export type ExtractFunctionOutput<Func> =
-  Func extends CorePikkuFunctionConfig<infer FuncType, any, any>
-    ? FuncType extends
-        | CorePikkuFunction<any, infer Output, any, any, any>
-        | CorePikkuFunctionSessionless<any, infer Output, any, any, any>
-      ? Output
-      : never
-    : never
-
 /**
  * CLI command configuration that infers options from function input type.
  * This is a helper type for creating type-safe CLI commands.
@@ -290,33 +278,6 @@ export type CLICommandShorthand<
   >,
 > = PikkuFunctionConfig
 
-/**
- * Command definition (either full or shorthand)
- */
-export type CLICommandDefinition<
-  In,
-  Out,
-  PikkuFunctionConfig extends CorePikkuFunctionConfig<
-    | CorePikkuFunction<In, Out, any, any, any>
-    | CorePikkuFunctionSessionless<In, Out, any, any, any>
-  >,
-  PikkuPermission extends CorePikkuPermission<any, any, any>,
-  PikkuMiddleware extends CorePikkuMiddleware,
-  Options = any,
-  Subcommands extends Record<string, CoreCLICommandConfig<any, any, any>> =
-    Record<string, CoreCLICommandConfig<any, any, any>>,
-> =
-  | CoreCLICommand<
-      In,
-      Out,
-      PikkuFunctionConfig,
-      PikkuPermission,
-      PikkuMiddleware,
-      Options,
-      Subcommands
-    >
-  | CLICommandShorthand<In, Out, PikkuFunctionConfig>
-
 /**
  * CLI wiring configuration
  */

package/src/wirings/cli/command-parser.test.ts

@@ -710,5 +710,24 @@ describe('Command Parser', () => {
       assert.ok(result.errors.some((e) => e.includes('Unknown option: -x')))
       assert.deepStrictEqual(result.warnings, [])
     })
+    describe('short-flag cluster is bounded (DoS)', () => {
+      test('a huge short-flag cluster yields a single error, not one per char', () => {
+        const huge = '-' + 'a'.repeat(200_000)
+        const result = parseCLIArguments(
+          ['greet', 'Alice', huge],
+          'test-cli',
+          testMeta
+        )
+        const clusterErrors = result.errors.filter((e) =>
+          e.includes('Unknown option')
+        )
+        // Without the cap this would be ~200k errors (one per character).
+        assert.ok(
+          clusterErrors.length <= 2,
+          `expected the oversized cluster to collapse to a single error, got ${clusterErrors.length}`
+        )
+        assert.ok(result.errors.some((e) => e.includes('too long')))
+      })
+    })
   })
 })

package/src/wirings/cli/command-parser.ts

@@ -86,6 +86,15 @@ export interface ParsedCommand {
   warnings: string[]
 }
 
+/**
+ * A real short-flag cluster is a handful of characters (`-abc`). Anything past
+ * this is treated as a single malformed token rather than scanned per
+ * character — the parser runs over untrusted CLI-channel frames, and a
+ * multi-megabyte `-aaaa…` would otherwise be O(length) work that also pushed
+ * one error per character.
+ */
+const MAX_SHORT_FLAG_CLUSTER = 64
+
 export function parseCLIArguments(
   args: string[],
   programName: string,
@@ -238,6 +247,13 @@ export function parseCLIArguments(
         }
       }
     } else if (arg.startsWith('-') && arg.length > 1) {
+      if (arg.length > MAX_SHORT_FLAG_CLUSTER) {
+        result.errors.push(
+          `Unknown option: ${arg.slice(0, MAX_SHORT_FLAG_CLUSTER)}… (too long)`
+        )
+        currentIndex++
+        continue
+      }
       for (let i = 1; i < arg.length; i++) {
         const shortFlag = arg[i]
 
@@ -354,7 +370,7 @@ function parseOptionValue(value: string, optionDef?: CLIOption): any {
     return parseFloat(value)
   }
 
-  if (optionDef.choices && !optionDef.choices.includes(value as any)) {
+  if (optionDef.choices && !optionDef.choices.includes(value as never)) {
     // Deliberately not an error here — applyOptionDefaults reports bad choices.
     return value
   }

package/src/wirings/gateway/gateway-channel-meta.test.ts

@@ -0,0 +1,44 @@
+import { describe, test } from 'node:test'
+import assert from 'node:assert/strict'
+
+import { pikkuState, resetPikkuState } from '../../pikku-state.js'
+import { wireGateway } from './gateway-runner.js'
+
+const wireWebsocketGateway = (name: string) => {
+  resetPikkuState()
+  wireGateway({
+    name,
+    type: 'websocket',
+    route: `/${name}`,
+    adapter: { name: 'test', parse: () => null, send: async () => {} },
+    func: { func: async () => undefined },
+  } as any)
+  return pikkuState(null, 'channel', 'meta')[name]!
+}
+
+describe('a gateway-wired websocket channel writes complete channel meta', () => {
+  test('the fields every channel reader indexes are present', () => {
+    const meta = wireWebsocketGateway('chatGateway')
+
+    // channel-handler.ts indexes messageWirings without a guard, and the
+    // serverless and local runners read disconnect directly.
+    assert.deepEqual(
+      meta.messageWirings,
+      {},
+      'messageWirings must be an object — channel-handler indexes it unguarded'
+    )
+    assert.equal(meta.disconnect, null)
+    assert.equal(meta.input, null)
+  })
+
+  test('it is marked as gateway-wired', () => {
+    assert.equal(wireWebsocketGateway('flagged').gateway, true)
+  })
+
+  test('connect and message point at the generated handlers', () => {
+    const meta = wireWebsocketGateway('handlers')
+
+    assert.equal(meta.connect?.pikkuFuncId, 'gateway__handlers__connect')
+    assert.equal(meta.message?.pikkuFuncId, 'gateway__handlers__message')
+  })
+})

package/src/wirings/gateway/gateway-runner.ts

@@ -3,6 +3,7 @@ import { NotFoundError, UnauthorizedError } from '../../errors/errors.js'
 import { addFunction, runPikkuFunc } from '../../function/function-runner.js'
 import { runMiddleware } from '../../middleware-runner.js'
 import { httpRouter } from '../http/routers/http-router.js'
+import type { CoreHTTPFunctionWiring } from '../http/http.types.js'
 import type {
   CoreGateway,
   GatewayAdapter,
@@ -50,7 +51,7 @@ const registerGatewayHandler = (config: CoreGateway): string => {
     outputSchemaName: declared?.outputSchemaName ?? null,
     sessionless: declared?.sessionless ?? true,
   }
-  addFunction(funcId, config.func as any)
+  addFunction(funcId, config.func)
   return funcId
 }
 
@@ -99,7 +100,7 @@ export const wireGateway = (config: CoreGateway): void => {
       break
     default:
       throw new Error(
-        `Unknown gateway type '${(config as any).type}' for gateway '${config.name}'`
+        `Unknown gateway type '${config.type}' for gateway '${config.name}'`
       )
   }
 }
@@ -118,7 +119,7 @@ const wireWebhookGateway = (config: CoreGateway): void => {
     func: createWebhookPostHandler(config),
   }
 
-  addFunction(postFuncId, postHandler as any)
+  addFunction(postFuncId, postHandler)
 
   if (!routes.has('post')) {
     routes.set('post', new Map())
@@ -128,7 +129,10 @@ const wireWebhookGateway = (config: CoreGateway): void => {
     route,
     func: postHandler,
     auth: false,
-  } as any)
+    // A gateway handler takes (services, data, wire) rather than a pikku
+    // function's shape, so it never matches CorePikkuFunctionConfig. It is only
+    // ever invoked through runPikkuFunc, which is what makes that safe.
+  } as unknown as CoreHTTPFunctionWiring<unknown, unknown, string>)
 
   // knowledge: decisions/internals/gateway-adapters-resolve-lazily-and-are-promise-cached.md
   if (typeof adapter === 'function' || adapter.verifyWebhook) {
@@ -139,7 +143,7 @@ const wireWebhookGateway = (config: CoreGateway): void => {
       func: createWebhookVerifyHandler(config),
     }
 
-    addFunction(verifyFuncId, verifyHandler as any)
+    addFunction(verifyFuncId, verifyHandler)
 
     if (!routes.has('get')) {
       routes.set('get', new Map())
@@ -151,7 +155,7 @@ const wireWebhookGateway = (config: CoreGateway): void => {
       auth: false,
       // knowledge: decisions/internals/gateway-webhook-challenges-echo-bytes-not-json.md
       returnsJSON: false,
-    } as any)
+    } as unknown as CoreHTTPFunctionWiring<unknown, unknown, string>)
   }
 
   httpRouter.reset()
@@ -187,17 +191,17 @@ const createWebhookPostHandler = (config: CoreGateway) => {
       platform: adapter.name,
       send: (msg: GatewayOutboundMessage) => adapter.send(parsed.senderId, msg),
     }
-    ;(wire as any).gateway = gateway
+    wire.gateway = gateway
 
     // Gateway middleware runs outside the gate so it can establish the session the gate checks.
     const invoke = async () => {
-      await bridgeMiddlewareSession(wire as any)
+      await bridgeMiddlewareSession(wire)
       return await runPikkuFunc('gateway', name, handlerFuncId, {
         singletonServices: services,
         data: () => parsed,
         auth: config.auth,
         inheritedMiddleware,
-        wire: wire as any,
+        wire,
       })
     }
 
@@ -275,9 +279,12 @@ const wireWebsocketGateway = (config: CoreGateway): void => {
     name,
     route,
     gateway: true,
+    input: null,
     connect: { pikkuFuncId: connectFuncId },
+    disconnect: null,
     message: { pikkuFuncId: messageFuncId },
-  } as any
+    messageWirings: {},
+  }
 
   const userMiddleware = config.middleware as CorePikkuMiddleware[] | undefined
   const handlerFuncId = registerGatewayHandler(config)
@@ -287,7 +294,7 @@ const wireWebsocketGateway = (config: CoreGateway): void => {
     auth: false,
     func: async (services: any, _data: unknown, wire: PikkuWire) => {
       const adapter = await resolveGatewayAdapter(config, services)
-      ;(wire as any).gateway = {
+      wire.gateway = {
         gatewayName: name,
         senderId: '',
         platform: adapter.name,
@@ -296,7 +303,7 @@ const wireWebsocketGateway = (config: CoreGateway): void => {
         },
       } satisfies PikkuGateway
     },
-  } as any)
+  })
 
   addFunction(messageFuncId, {
     auth: false,
@@ -313,16 +320,16 @@ const wireWebsocketGateway = (config: CoreGateway): void => {
           wire.channel?.send(msg)
         },
       }
-      ;(wire as any).gateway = gateway
+      wire.gateway = gateway
 
       const invoke = async () => {
-        await bridgeMiddlewareSession(wire as any)
+        await bridgeMiddlewareSession(wire)
         return await runPikkuFunc('gateway', name, handlerFuncId, {
           singletonServices: services,
           data: () => parsed,
           auth: config.auth,
           inheritedMiddleware,
-          wire: wire as any,
+          wire,
         })
       }
 
@@ -337,7 +344,7 @@ const wireWebsocketGateway = (config: CoreGateway): void => {
         wire.channel?.send(result)
       }
     },
-  } as any)
+  })
 
   // knowledge: decisions/internals/gateway-wiring-is-a-meta-wiring-over-http-and-channels.md
   channels.set(name, {
@@ -346,7 +353,7 @@ const wireWebsocketGateway = (config: CoreGateway): void => {
     auth: false,
     onConnect: { func: async () => {} },
     onMessage: { func: async () => {} },
-  } as any)
+  })
 
   httpRouter.reset()
 }
@@ -377,7 +384,7 @@ export const createListenerMessageHandler = (
       platform: adapter.name,
       send: (msg: GatewayOutboundMessage) => adapter.send(parsed.senderId, msg),
     }
-    ;(wire as any).gateway = gateway
+    wire.gateway = gateway
 
     const invoke = async () => {
       await bridgeMiddlewareSession(wire)
@@ -390,10 +397,11 @@ export const createListenerMessageHandler = (
       })
     }
 
+    // knowledge: decisions/internals/gateway-listener-middleware-runs-without-an-rpc-on-the-wire.md
     const result: any = userMiddleware?.length
       ? await runMiddleware(
           singletonServices,
-          wire as any,
+          wire as PikkuWire,
           userMiddleware,
           invoke
         )

package/src/wirings/http/http-routes.ts

@@ -1,4 +1,5 @@
 import type {
+  CoreHTTPFunctionWiring,
   HTTPRouteConfig,
   HTTPRouteMap,
   HTTPRouteContract,
@@ -84,7 +85,9 @@ function registerRoute(
     timeout: route.timeout,
     headers: route.headers,
     sse: route.sse,
-  } as any)
+    // `CoreHTTPFunctionWiring` is discriminated by `method`, and a group builds
+    // its routes from a method chosen at runtime — no arm can be narrowed to.
+  } as CoreHTTPFunctionWiring<unknown, unknown, string>)
 }
 
 function isRouteConfig(value: unknown): value is HTTPRouteConfig {

package/src/wirings/http/http-runner.ts

@@ -33,8 +33,10 @@ import { isProduction } from '../../env.js'
 import { pikkuState } from '../../pikku-state.js'
 import { PikkuFetchHTTPResponse } from './pikku-fetch-http-response.js'
 import { PikkuFetchHTTPRequest } from './pikku-fetch-http-request.js'
-import type { PikkuChannel } from '../channel/channel.types.js'
-import { unsupportedChannelRemote } from '../channel/channel-rpc.js'
+import type { BinaryData, PikkuChannel } from '../channel/channel.types.js'
+// The leaf module, not the channel-rpc barrel: http needs one refusal
+// function, and the barrel drags in 4,932 lines of channel RPC runtime.
+import { unsupportedChannelRemote } from '../channel/channel-rpc.types.js'
 import { addFunction, runPikkuFunc } from '../../function/function-runner.js'
 import { applyWebResponse } from './web-request.js'
 import { httpRouter } from './routers/http-router.js'
@@ -68,26 +70,6 @@ export const addHTTPMiddleware = <PikkuMiddleware extends CorePikkuMiddleware>(
   return middleware
 }
 
-/**
- * @deprecated HTTP-route-level permissions were removed in #972 — permissions
- * are now function-scoped only (declare them on the function via
- * `pikkuFunc({ permissions })`). This throwing stub exists solely so the pinned
- * bootstrap CLI (which still generates an `addHTTPPermission` wrapper) can
- * resolve the import at build time; it is never called. Delete once
- * `PIKKU_CLI_VERSION` in the CLI build is bumped past the release that removes
- * HTTP-route permissions.
- */
-export const addHTTPPermission = (
-  _pattern: string,
-  _permissions:
-    | Record<string, CorePikkuPermission | CorePikkuPermission[]>
-    | CorePikkuPermission[]
-): never => {
-  throw new Error(
-    'addHTTPPermission was removed in #972 — HTTP-route-level permissions no longer exist. Declare permissions on the function definition instead: pikkuFunc({ permissions }).'
-  )
-}
-
 export const wireHTTP = <
   In,
   Out,
@@ -126,7 +108,8 @@ export const wireHTTP = <
   }
   pikkuState(null, 'http', 'routes')
     .get(httpWiring.method)
-    ?.set(httpWiring.route, httpWiring as any)
+    // knowledge: decisions/internals/wiring-registries-erase-the-generics-their-wire-functions-capture.md
+    ?.set(httpWiring.route, httpWiring as CoreHTTPFunctionWiring<any, any, any>)
 }
 
 const getMatchingRoute = (requestType: string, requestPath: string) => {
@@ -261,7 +244,8 @@ const executeRoute = async (
       setState: (s) => {
         sseState = s
       },
-      getState: () => sseState as any,
+      // knowledge: decisions/internals/channel-state-accessors-are-unsound-generics-that-every-implementation-asserts.md
+      getState: () => sseState as never,
       clearState: () => {
         sseState = undefined
       },
@@ -275,7 +259,7 @@ const executeRoute = async (
       const channelHandler = {
         getChannel: () => channelRef,
         send: (data: unknown, isBinary?: boolean) => {
-          if (isBinary) channelRef.sendBinary(data as any)
+          if (isBinary) channelRef.sendBinary(data as BinaryData)
           else channelRef.send(data)
         },
         sendBinary: (data: any) => channelRef.sendBinary(data),
@@ -424,7 +408,8 @@ export const fetchData = async <In, Out>(
             globalMiddleware as CorePikkuMiddleware[]
           )
         }
-        response.status(204).json(undefined as any)
+        // 204 carries no body, and `json` has no no-content overload.
+        response.status(204).json(undefined as never)
         return
       }
       scopedLogger.info({