@pikku/core 0.12.79 → 0.12.82

package/dist/wirings/ai-scorer/index.d.ts

@@ -0,0 +1,6 @@
+export { pikkuAIScorer, pikkuAIJudge } from './ai-scorer.js';
+export { addAIScorer, getAIScorers, getAIScorersMeta, } from './ai-scorer-registry.js';
+export { gradeRun } from './ai-scorer-grade.js';
+export { enableScoreSnapshots, getScoreSnapshot, } from './ai-scorer-snapshots.js';
+export { wireAIScorerQueueWorkers, } from './ai-scorer-worker.js';
+export type { AIRunScore, PikkuAIScorer, ScoreJob, ScorerInput, ScorerJudgeConfig, ScorerLane, ScorerMeta, ScorerOutput, } from './ai-scorer.types.js';

package/dist/wirings/ai-scorer/index.js

@@ -0,0 +1,5 @@
+export { pikkuAIScorer, pikkuAIJudge } from './ai-scorer.js';
+export { addAIScorer, getAIScorers, getAIScorersMeta, } from './ai-scorer-registry.js';
+export { gradeRun } from './ai-scorer-grade.js';
+export { enableScoreSnapshots, getScoreSnapshot, } from './ai-scorer-snapshots.js';
+export { wireAIScorerQueueWorkers, } from './ai-scorer-worker.js';

package/dist/wirings/channel/channel-common.js

@@ -12,6 +12,7 @@ export const runChannelLifecycleWithMiddleware = async ({ channelConfig, meta, l
     });
     const allChannelMiddleware = combineChannelMiddleware('channel', `${channelConfig.name}:${lifecycleType}:cm`, {
         wireInheritedChannelMiddleware: channelMiddlewareMeta,
+        // knowledge: questions/channel-middleware-accepts-bare-factories-that-nothing-resolves.md
         wireChannelMiddleware: channelConfig.channelMiddleware,
     });
     let wire = {

package/dist/wirings/channel/channel-handler.js

@@ -46,7 +46,7 @@ export const processMessageHandlers = (services, channelConfig, channelHandler,
                 ? `route '${routingProperty}:${routerValue}'`
                 : 'the default message route';
             logger.error(`Channel ${channelConfig.name} with id ${channelHandler.getChannel().channelId} requires a session for ${routeMessage}. No session is attached to this websocket connection. Ensure auth middleware establishes a session during websocket upgrade, and configure sessionStore when the runtime needs persisted sessions.`);
-            // TODO: Send error message back breaks typescript, but should be implemented somehow
+            // knowledge: questions/unauthorized-channel-replies-escape-the-declared-out-type.md
             channelHandler.getChannel().send(`Unauthorized for ${routeMessage}`);
             return;
         }
@@ -55,10 +55,7 @@ export const processMessageHandlers = (services, channelConfig, channelHandler,
         const pikkuFuncId = routeMeta.pikkuFuncId;
         // Get wire middleware: channel-level middleware + message-specific middleware
         const channelWireMiddleware = channelConfig.middleware || [];
-        // Check if onMessage is a wrapper object vs direct function config:
-        // - Direct config: onMessage.func is a plain Function
-        // - Wrapper: onMessage.func is a CorePikkuFunctionConfig (has onMessage.func.func)
-        // - Simple wrapper: onMessage has both func (plain Function) and middleware properties
+        // knowledge: decisions/internals/channel-message-handlers-accept-three-config-shapes.md
         const isWrapper = onMessage &&
             typeof onMessage === 'object' &&
             'func' in onMessage &&
@@ -83,6 +80,7 @@ export const processMessageHandlers = (services, channelConfig, channelHandler,
             inheritedMiddleware,
             wireMiddleware,
             inheritedChannelMiddleware: channelMeta?.channelMiddleware,
+            // knowledge: questions/channel-middleware-accepts-bare-factories-that-nothing-resolves.md
             wireChannelMiddleware: wireChannelMiddleware,
             coerceDataFromSchema: true,
             tags: channelConfig.tags,

package/dist/wirings/channel/channel-rpc-service.d.ts

@@ -1,12 +1,6 @@
 import type { DeploymentService } from '../../services/deployment-service.js';
 import { ChannelRPCRegistry } from './channel-rpc-registry.js';
 import { type ChannelRPCValidator } from './channel-rpc.types.js';
-/**
- * `remote` for channels that only ever flow one way — a server-sent stream, an
- * agent's output, a local CLI. Nothing is listening for a request on them, so
- * the call is refused rather than waiting out a timeout.
- */
-export declare const unsupportedChannelRemote: (funcName: string) => Promise<never>;
 /**
  * A `DeploymentService` whose transport is an open channel rather than an
  * address, so a server-side function can call back into a peer that has no

package/dist/wirings/channel/channel-rpc-service.js

@@ -1,13 +1,5 @@
 import { ChannelRPCRegistry } from './channel-rpc-registry.js';
 import { CHANNEL_RPC_REQUEST, CHANNEL_RPC_RESPONSE, ChannelRPCError, isChannelRPCPending, isChannelRPCResponse, } from './channel-rpc.types.js';
-/**
- * `remote` for channels that only ever flow one way — a server-sent stream, an
- * agent's output, a local CLI. Nothing is listening for a request on them, so
- * the call is refused rather than waiting out a timeout.
- */
-export const unsupportedChannelRemote = async (funcName) => {
-    throw new ChannelRPCError(`Cannot call "${funcName}" remotely: this channel has no peer that answers`, 'unsupported');
-};
 /**
  * A `DeploymentService` whose transport is an open channel rather than an
  * address, so a server-side function can call back into a peer that has no

package/dist/wirings/channel/channel-rpc.types.d.ts

@@ -88,3 +88,9 @@ export type ApprovalRequester = (request: {
 }) => Promise<boolean> | boolean;
 /** Checks one end of a call — arguments going out, or the answer coming back. */
 export type ChannelRPCValidator = (funcName: string, value: unknown) => Promise<void> | void;
+/**
+ * `remote` for wires with no peer that answers — a server-sent stream, an
+ * agent's output, a local CLI. Nothing is listening for a request on them, so
+ * the call is refused rather than waiting out a timeout.
+ */
+export declare const unsupportedChannelRemote: (funcName: string) => Promise<never>;

package/dist/wirings/channel/channel-rpc.types.js

@@ -48,3 +48,11 @@ export const isCapabilityDef = (capability) => typeof capability === 'object' &&
 export const resolveCapability = (capability) => isCapabilityDef(capability)
     ? capability
     : { execute: capability, needsApproval: true };
+/**
+ * `remote` for wires with no peer that answers — a server-sent stream, an
+ * agent's output, a local CLI. Nothing is listening for a request on them, so
+ * the call is refused rather than waiting out a timeout.
+ */
+export const unsupportedChannelRemote = async (funcName) => {
+    throw new ChannelRPCError(`Cannot call "${funcName}" remotely: this channel has no peer that answers`, 'unsupported');
+};

package/dist/wirings/channel/channel-runner.d.ts

@@ -1,8 +1,6 @@
-import type { CorePikkuPermission } from '../../function/functions.types.js';
 import type { SessionService } from '../../services/user-session-service.js';
-import type { CorePikkuMiddleware } from '../../types/core.types.js';
 import type { ChannelMeta, CoreChannel, RunChannelOptions, RunChannelParams } from './channel.types.js';
-export declare const wireChannel: <In, Channel extends string, PikkuPermission extends CorePikkuPermission<In>, PikkuMiddleware extends CorePikkuMiddleware, ChannelFunction>(channel: CoreChannel<In, Channel, PikkuPermission, PikkuMiddleware, ChannelFunction>) => void;
+export declare const wireChannel: <In, Channel extends string, ChannelConnect, ChannelDisconnect, ChannelFunctionMessage>(channel: CoreChannel<In, Channel, ChannelConnect, ChannelDisconnect, ChannelFunctionMessage>) => void;
 export declare const openChannel: ({ route, coerceDataFromSchema, request, }: Pick<CoreChannel<unknown, string>, "route"> & RunChannelParams<unknown> & {
     userSession: SessionService<any>;
 } & RunChannelOptions) => Promise<{

package/dist/wirings/channel/channel-runner.js

@@ -3,6 +3,18 @@ import { addFunction } from '../../function/function-runner.js';
 import { pikkuState, getSingletonServices } from '../../pikku-state.js';
 import { coerceTopLevelDataFromSchema, validateSchema } from '../../schema.js';
 import { httpRouter } from '../http/routers/http-router.js';
+/**
+ * The config to register for a channel handler: the handler itself when it is a
+ * direct function config, or its inner `func` when it is a wrapper.
+ *
+ * knowledge: decisions/internals/channel-message-handlers-accept-three-config-shapes.md
+ */
+const registeredHandler = (handler) => {
+    const candidate = handler;
+    return typeof candidate.func === 'function'
+        ? handler
+        : candidate.func;
+};
 export const wireChannel = (channel) => {
     const channelsMeta = pikkuState(null, 'channel', 'meta');
     const channelMeta = channelsMeta[channel.name];
@@ -11,15 +23,13 @@ export const wireChannel = (channel) => {
         return;
     }
     if (channel.onConnect && channelMeta.connect) {
-        addFunction(channelMeta.connect.pikkuFuncId, channel.onConnect);
+        addFunction(channelMeta.connect.pikkuFuncId, registeredHandler(channel.onConnect));
     }
     if (channel.onDisconnect && channelMeta.disconnect) {
-        addFunction(channelMeta.disconnect.pikkuFuncId, channel.onDisconnect);
+        addFunction(channelMeta.disconnect.pikkuFuncId, registeredHandler(channel.onDisconnect));
     }
     if (channel.onMessage && channelMeta.message?.pikkuFuncId) {
-        addFunction(channelMeta.message.pikkuFuncId, channel.onMessage.func instanceof Function
-            ? channel.onMessage
-            : channel.onMessage.func);
+        addFunction(channelMeta.message.pikkuFuncId, registeredHandler(channel.onMessage));
     }
     if (channel.onMessageWiring && channelMeta.messageWirings) {
         Object.entries(channel.onMessageWiring).forEach(([channelKey, wirings]) => {
@@ -30,9 +40,7 @@ export const wireChannel = (channel) => {
                 const wiringMeta = channelWirings[wiringKey];
                 if (!wiringMeta)
                     return;
-                addFunction(wiringMeta.pikkuFuncId, handler.func instanceof Function
-                    ? handler
-                    : handler.func);
+                addFunction(wiringMeta.pikkuFuncId, registeredHandler(handler));
             });
         });
     }

package/dist/wirings/channel/channel.types.d.ts

@@ -37,6 +37,8 @@ export interface ChannelMeta {
     message: ChannelMessageMeta | null;
     messageWirings: Record<string, Record<string, ChannelMessageMeta>>;
     binary?: boolean | null;
+    /** Set when the channel was wired by a gateway rather than declared directly. */
+    gateway?: boolean;
     summary?: string;
     description?: string;
     errors?: string[];

package/dist/wirings/channel/index.d.ts

@@ -1,13 +1,12 @@
-export { wireChannel, openChannel } from './channel-runner.js';
-export { addChannelMiddleware, combineChannelMiddleware, wrapChannelWithMiddleware, } from './channel-middleware-runner.js';
+export { wireChannel } from './channel-runner.js';
+export { addChannelMiddleware, combineChannelMiddleware, } from './channel-middleware-runner.js';
 export { logChannels } from './log-channels.js';
 export { PikkuAbstractChannelHandler } from './pikku-abstract-channel-handler.js';
 export type { EventHubService } from './eventhub-service.js';
 export { ChannelStore } from './channel-store.js';
 export type { Channel } from './channel-store.js';
 export { EventHubStore } from './eventhub-store.js';
-export type { BinaryData, ChannelsMeta, CoreChannel, CorePikkuChannelMiddleware, CorePikkuChannelMiddlewareFactory, ChannelMessageMeta, ChannelMeta, ChannelRemote, PikkuChannel, PikkuChannelHandlerFactory, } from './channel.types.js';
+export type { BinaryData, ChannelsMeta, CoreChannel, CorePikkuChannelMiddleware, CorePikkuChannelMiddlewareFactory, ChannelMessageMeta, ChannelMeta, PikkuChannel, PikkuChannelHandlerFactory, } from './channel.types.js';
 export { defineChannelRoutes } from './define-channel-routes.js';
-export { CHANNEL_RPC_PENDING, CHANNEL_RPC_REQUEST, CHANNEL_RPC_RESPONSE, ChannelDeploymentService, ChannelRPCError, ChannelRPCRegistry, createChannelRPCResponder, createChannelRPCInputValidator, createChannelRPCResultValidator, isChannelRPCPending, isChannelRPCRequest, isChannelRPCResponse, resolveCapability, unsupportedChannelRemote, } from './channel-rpc.js';
-export type { ApprovalPolicy, ApprovalRequester, Capabilities, Capability, CapabilityDef, CapabilityHandler, ChannelRPCPending, ChannelRPCRequest, ChannelRPCResponse, ChannelRPCValidator, } from './channel-rpc.js';
-export { channelRemote, getChannelHostRPC, handleChannelRPCResponse, releaseChannelHostRPC, } from './channel-host-rpc.js';
+export { ChannelDeploymentService, ChannelRPCError, ChannelRPCRegistry, unsupportedChannelRemote, } from './channel-rpc.js';
+export type { ApprovalPolicy, ApprovalRequester, Capabilities, Capability, CapabilityHandler, ChannelRPCPending, ChannelRPCRequest, ChannelRPCResponse, ChannelRPCValidator, } from './channel-rpc.js';

package/dist/wirings/channel/index.js

@@ -1,9 +1,8 @@
-export { wireChannel, openChannel } from './channel-runner.js';
-export { addChannelMiddleware, combineChannelMiddleware, wrapChannelWithMiddleware, } from './channel-middleware-runner.js';
+export { wireChannel } from './channel-runner.js';
+export { addChannelMiddleware, combineChannelMiddleware, } from './channel-middleware-runner.js';
 export { logChannels } from './log-channels.js';
 export { PikkuAbstractChannelHandler } from './pikku-abstract-channel-handler.js';
 export { ChannelStore } from './channel-store.js';
 export { EventHubStore } from './eventhub-store.js';
 export { defineChannelRoutes } from './define-channel-routes.js';
-export { CHANNEL_RPC_PENDING, CHANNEL_RPC_REQUEST, CHANNEL_RPC_RESPONSE, ChannelDeploymentService, ChannelRPCError, ChannelRPCRegistry, createChannelRPCResponder, createChannelRPCInputValidator, createChannelRPCResultValidator, isChannelRPCPending, isChannelRPCRequest, isChannelRPCResponse, resolveCapability, unsupportedChannelRemote, } from './channel-rpc.js';
-export { channelRemote, getChannelHostRPC, handleChannelRPCResponse, releaseChannelHostRPC, } from './channel-host-rpc.js';
+export { ChannelDeploymentService, ChannelRPCError, ChannelRPCRegistry, unsupportedChannelRemote, } from './channel-rpc.js';

package/dist/wirings/channel/local/local-channel-runner.js

@@ -135,7 +135,14 @@ export const runLocalChannel = async ({ channelId, request, response, route, ski
             channelHandler.registerOnMessage(async (data) => {
                 try {
                     const result = await onMessage(data);
-                    await channel.send(result);
+                    // Guarded exactly as the connect path above is. A handler with nothing
+                    // to say is normal — a gateway websocket's generated message handler
+                    // always returns undefined — and sending that raised `send requires a
+                    // non-empty message`, which surfaced as a channel that accepted a
+                    // connection and then silently delivered nothing.
+                    if (result !== undefined) {
+                        await channel.send(result);
+                    }
                 }
                 catch (e) {
                     singletonServices.logger.error(e);

package/dist/wirings/channel/pikku-abstract-channel-handler.js

@@ -22,6 +22,7 @@ export class PikkuAbstractChannelHandler {
                 setState: (s) => {
                     channelState = s;
                 },
+                // knowledge: decisions/internals/channel-state-accessors-are-unsound-generics-that-every-implementation-asserts.md
                 getState: () => channelState,
                 clearState: () => {
                     channelState = undefined;

package/dist/wirings/channel/serverless/serverless-channel-runner.js

@@ -55,6 +55,7 @@ export const runChannelConnect = async ({ channelId, channelObject, request, res
             channelName: channelConfig.name,
         });
         channel.setState = (state) => channelStore.setState(channelId, state);
+        // knowledge: decisions/internals/channel-state-accessors-are-unsound-generics-that-every-implementation-asserts.md
         channel.getState = () => channelStore.getState(channelId);
         channel.clearState = () => channelStore.clearState(channelId);
         const wire = {
@@ -116,6 +117,7 @@ export const runChannelDisconnect = async ({ channelId, channelStore, channelHan
         channelName,
     });
     channel.setState = (state) => channelStore.setState(channelId, state);
+    // knowledge: decisions/internals/channel-state-accessors-are-unsound-generics-that-every-implementation-asserts.md
     channel.getState = () => channelStore.getState(channelId);
     channel.clearState = () => channelStore.clearState(channelId);
     const userSession = new PikkuSessionService(singletonServices.sessionStore);
@@ -171,6 +173,7 @@ export const runChannelMessage = async ({ channelId, channelStore, channelHandle
         channelName,
     });
     channel.setState = (state) => channelStore.setState(channelId, state);
+    // knowledge: decisions/internals/channel-state-accessors-are-unsound-generics-that-every-implementation-asserts.md
     channel.getState = () => channelStore.getState(channelId);
     channel.clearState = () => channelStore.clearState(channelId);
     const userSession = new PikkuSessionService(singletonServices.sessionStore);

package/dist/wirings/cli/channel/cli-channel-runner.js

@@ -50,6 +50,8 @@ export async function executeCLIViaChannel({ programName, pikkuWS, args = proces
                 resolve(undefined);
                 return;
             }
+            // A CLI channel response is rendered off-process: there are no services
+            // to hand the renderer, and every CLI renderer ignores the argument.
             renderer(null, response, undefined);
         };
         commandRoute.subscribe(commandId, responseHandler);

package/dist/wirings/cli/channel/cli-raw-channel-runner.js

@@ -1,4 +1,5 @@
 import { pikkuState } from '../../../pikku-state.js';
+import { isProduction } from '../../../env.js';
 import { parseCLIArguments, generateCommandHelp } from '../command-parser.js';
 import { runCLICommand } from '../cli-runner.js';
 /**
@@ -61,6 +62,13 @@ export async function handleRawCLI({ programName, args, singletonServices, creat
         // A command can throw anything; `.message` off a string is undefined, and
         // the run would then exit 1 saying nothing at all.
         const message = e instanceof Error ? e.message : String(e);
-        return { error: message || 'Command failed', exitCode: 1, commandId };
+        // The raw message can carry internals (a stack, a DB error, a path). This
+        // runs over a channel that may be remote, so return a generic error in
+        // production and keep the detail server-side. Dev keeps the message inline.
+        singletonServices.logger.error?.(`CLI channel command failed: ${message}`, e);
+        const clientError = isProduction()
+            ? 'Command failed'
+            : message || 'Command failed';
+        return { error: clientError, exitCode: 1, commandId };
     }
 }

package/dist/wirings/cli/channel/index.d.ts

@@ -2,6 +2,5 @@ export { executeCLIViaChannel } from './cli-channel-runner.js';
 export { handleRawCLI } from './cli-raw-channel-runner.js';
 export type { RawCLIFrame, RawCLIResult } from './cli-raw-channel-runner.js';
 export { executeRawCLIViaChannel } from './cli-raw-client-runner.js';
-export type { ClientCLIRenderServices, CorePikkuCLIClientRender, } from './cli-raw-client-runner.js';
-export { APPROVAL_FLAGS, approverForMode, createTerminalApprover, takeApprovalFlags, } from './cli-approval.js';
+export type { CorePikkuCLIClientRender, } from './cli-raw-client-runner.js';
 export type { ApprovalMode } from './cli-approval.js';

package/dist/wirings/cli/channel/index.js

@@ -1,4 +1,3 @@
 export { executeCLIViaChannel } from './cli-channel-runner.js';
 export { handleRawCLI } from './cli-raw-channel-runner.js';
 export { executeRawCLIViaChannel } from './cli-raw-client-runner.js';
-export { APPROVAL_FLAGS, approverForMode, createTerminalApprover, takeApprovalFlags, } from './cli-approval.js';

package/dist/wirings/cli/cli-runner.js

@@ -2,7 +2,7 @@ import { NotFoundError } from '../../errors/errors.js';
 import { isExpectedError } from '../../errors/error-handler.js';
 import { addFunction, runPikkuFunc } from '../../function/function-runner.js';
 import { pikkuState } from '../../pikku-state.js';
-import { unsupportedChannelRemote } from '../channel/channel-rpc.js';
+import { unsupportedChannelRemote } from '../channel/channel-rpc.types.js';
 import { PikkuSessionService, createMiddlewareSessionWireProps, } from '../../services/user-session-service.js';
 import { LocalVariablesService } from '../../services/local-variables.js';
 import { generateCommandHelp, parseCLIArguments } from './command-parser.js';
@@ -87,7 +87,19 @@ function registerCLICommands(commands, path = [], inheritedOptions = {}, program
                 programs[program].commandMiddleware[commandId] = command.middleware;
             }
         }
-        addFunction(funcName, unwrapFunc(command), currentMeta?.packageName);
+        // Merge the command-level auth/permissions into the registered config so
+        // they are actually enforced by the function runner. They were accepted by
+        // the types but dropped here, making a command's declared access control a
+        // silent no-op. Command-level wins over the handler's own, then falls back
+        // to it.
+        const unwrapped = unwrapFunc(command);
+        const commandAuth = typeof command === 'object' ? command.auth : undefined;
+        const commandPermissions = typeof command === 'object' ? command.permissions : undefined;
+        addFunction(funcName, {
+            ...unwrapped,
+            auth: commandAuth ?? unwrapped.auth,
+            permissions: commandPermissions ?? unwrapped.permissions,
+        }, currentMeta?.packageName);
         if (typeof command === 'object' && command.render) {
             if (programs[program]) {
                 programs[program].renderers[commandId] = command.render;
@@ -186,6 +198,7 @@ export async function runCLICommand({ program, commandPath, data, singletonServi
         setState: (s) => {
             cliState = s;
         },
+        // knowledge: decisions/internals/channel-state-accessors-are-unsound-generics-that-every-implementation-asserts.md
         getState: () => cliState,
         clearState: () => {
             cliState = undefined;
@@ -230,7 +243,8 @@ export async function runCLICommand({ program, commandPath, data, singletonServi
         // caller, and emitting it here too would deliver it twice.
         if (result !== undefined && !onOutput) {
             const commandRenderer = programData?.renderers[commandId];
-            const jsonMode = data.json === true || data.output === 'json';
+            const jsonMode = data.json === true ||
+                data.output === 'json';
             const finalRenderer = jsonMode && commandRenderer !== undefined
                 ? defaultJSONRenderer
                 : (commandRenderer ?? programData?.defaultRenderer);

package/dist/wirings/cli/cli.types.d.ts

@@ -135,10 +135,6 @@ type AllParamsValid<Params extends readonly any[], Input> = Params extends reado
  * Validate that all parameter names are valid keys of the function input
  */
 export type ValidateParameters<Params extends string, Input> = AllParamsValid<ExtractParameterNames<Params>, Input> extends true ? Params : never;
-/**
- * Extract output type from a Pikku function config type
- */
-export type ExtractFunctionOutput<Func> = Func extends CorePikkuFunctionConfig<infer FuncType, any, any> ? FuncType extends CorePikkuFunction<any, infer Output, any, any, any> | CorePikkuFunctionSessionless<any, infer Output, any, any, any> ? Output : never : never;
 /**
  * CLI command configuration that infers options from function input type.
  * This is a helper type for creating type-safe CLI commands.
@@ -184,10 +180,6 @@ export interface CoreCLICommand<In, Out, PikkuFunctionConfig extends CorePikkuFu
  * Shorthand command definition (just a function)
  */
 export type CLICommandShorthand<In, Out, PikkuFunctionConfig extends CorePikkuFunctionConfig<CorePikkuFunction<In, Out, any, any, any> | CorePikkuFunctionSessionless<In, Out, any, any, any>>> = PikkuFunctionConfig;
-/**
- * Command definition (either full or shorthand)
- */
-export type CLICommandDefinition<In, Out, PikkuFunctionConfig extends CorePikkuFunctionConfig<CorePikkuFunction<In, Out, any, any, any> | CorePikkuFunctionSessionless<In, Out, any, any, any>>, PikkuPermission extends CorePikkuPermission<any, any, any>, PikkuMiddleware extends CorePikkuMiddleware, Options = any, Subcommands extends Record<string, CoreCLICommandConfig<any, any, any>> = Record<string, CoreCLICommandConfig<any, any, any>>> = CoreCLICommand<In, Out, PikkuFunctionConfig, PikkuPermission, PikkuMiddleware, Options, Subcommands> | CLICommandShorthand<In, Out, PikkuFunctionConfig>;
 /**
  * CLI wiring configuration
  */

package/dist/wirings/cli/command-parser.js

@@ -49,6 +49,14 @@ function warnUnknownOption(typed, availableOptions, result) {
     result.warnings.push(`Unknown option: --${typed} (ignored)` +
         (suggestion ? ` Did you mean --${suggestion}?` : ''));
 }
+/**
+ * A real short-flag cluster is a handful of characters (`-abc`). Anything past
+ * this is treated as a single malformed token rather than scanned per
+ * character — the parser runs over untrusted CLI-channel frames, and a
+ * multi-megabyte `-aaaa…` would otherwise be O(length) work that also pushed
+ * one error per character.
+ */
+const MAX_SHORT_FLAG_CLUSTER = 64;
 export function parseCLIArguments(args, programName, allMeta) {
     const result = {
         program: programName,
@@ -176,6 +184,11 @@ export function parseCLIArguments(args, programName, allMeta) {
             }
         }
         else if (arg.startsWith('-') && arg.length > 1) {
+            if (arg.length > MAX_SHORT_FLAG_CLUSTER) {
+                result.errors.push(`Unknown option: ${arg.slice(0, MAX_SHORT_FLAG_CLUSTER)}… (too long)`);
+                currentIndex++;
+                continue;
+            }
             for (let i = 1; i < arg.length; i++) {
                 const shortFlag = arg[i];
                 const longOption = findLongOption(shortFlag, availableOptions);

package/dist/wirings/credential/index.d.ts

@@ -1,3 +1,3 @@
 export { defineCredential } from './define-credential.js';
 export { validateAndBuildCredentialDefinitionsMeta } from './validate-credential-definitions.js';
-export type { CoreCredential, CredentialDefinitionMeta, CredentialDefinitionsMeta, CredentialDefinitions, } from './credential.types.js';
+export type { CoreCredential, CredentialDefinitionsMeta, CredentialDefinitions, } from './credential.types.js';

package/dist/wirings/gateway/gateway-runner.js

@@ -97,6 +97,9 @@ const wireWebhookGateway = (config) => {
         route,
         func: postHandler,
         auth: false,
+        // A gateway handler takes (services, data, wire) rather than a pikku
+        // function's shape, so it never matches CorePikkuFunctionConfig. It is only
+        // ever invoked through runPikkuFunc, which is what makes that safe.
     });
     // knowledge: decisions/internals/gateway-adapters-resolve-lazily-and-are-promise-cached.md
     if (typeof adapter === 'function' || adapter.verifyWebhook) {
@@ -151,7 +154,7 @@ const createWebhookPostHandler = (config) => {
                 data: () => parsed,
                 auth: config.auth,
                 inheritedMiddleware,
-                wire: wire,
+                wire,
             });
         };
         const gatewayMiddleware = userMiddleware;
@@ -211,8 +214,11 @@ const wireWebsocketGateway = (config) => {
         name,
         route,
         gateway: true,
+        input: null,
         connect: { pikkuFuncId: connectFuncId },
+        disconnect: null,
         message: { pikkuFuncId: messageFuncId },
+        messageWirings: {},
     };
     const userMiddleware = config.middleware;
     const handlerFuncId = registerGatewayHandler(config);
@@ -254,7 +260,7 @@ const wireWebsocketGateway = (config) => {
                     data: () => parsed,
                     auth: config.auth,
                     inheritedMiddleware,
-                    wire: wire,
+                    wire,
                 });
             };
             const gatewayMiddleware = userMiddleware;
@@ -307,6 +313,7 @@ export const createListenerMessageHandler = (name, config, singletonServices) =>
                 wire,
             });
         };
+        // knowledge: decisions/internals/gateway-listener-middleware-runs-without-an-rpc-on-the-wire.md
         const result = userMiddleware?.length
             ? await runMiddleware(singletonServices, wire, userMiddleware, invoke)
             : await invoke();

package/dist/wirings/gateway/index.d.ts

@@ -1,2 +1,2 @@
 export { wireGateway, createListenerMessageHandler, resolveGatewayAdapter, } from './gateway-runner.js';
-export type { GatewayAdapter, GatewayAdapterFactory, GatewayAttachment, GatewayInboundMessage, GatewayOutboundMessage, GatewayMeta, GatewaysMeta, GatewayTransportType, CoreGateway, PikkuGateway, WebhookVerificationResult, } from './gateway.types.js';
+export type { GatewayAdapter, GatewayAdapterFactory, GatewayInboundMessage, GatewayOutboundMessage, GatewaysMeta, GatewayTransportType, CoreGateway, WebhookVerificationResult, } from './gateway.types.js';

package/dist/wirings/http/http-routes.js

@@ -54,6 +54,8 @@ function registerRoute(route, groupConfig) {
         timeout: route.timeout,
         headers: route.headers,
         sse: route.sse,
+        // `CoreHTTPFunctionWiring` is discriminated by `method`, and a group builds
+        // its routes from a method chosen at runtime — no arm can be narrowed to.
     });
 }
 function isRouteConfig(value) {

package/dist/wirings/http/http-runner.d.ts

@@ -3,16 +3,6 @@ import type { CorePikkuFunction, CorePikkuFunctionSessionless, CorePikkuPermissi
 import type { CorePikkuMiddleware, CorePikkuMiddlewareGroup } from '../../types/core.types.js';
 import { PikkuFetchHTTPResponse } from './pikku-fetch-http-response.js';
 export declare const addHTTPMiddleware: <PikkuMiddleware extends CorePikkuMiddleware>(pattern: string, middleware: CorePikkuMiddlewareGroup, packageName?: string | null) => CorePikkuMiddlewareGroup;
-/**
- * @deprecated HTTP-route-level permissions were removed in #972 — permissions
- * are now function-scoped only (declare them on the function via
- * `pikkuFunc({ permissions })`). This throwing stub exists solely so the pinned
- * bootstrap CLI (which still generates an `addHTTPPermission` wrapper) can
- * resolve the import at build time; it is never called. Delete once
- * `PIKKU_CLI_VERSION` in the CLI build is bumped past the release that removes
- * HTTP-route permissions.
- */
-export declare const addHTTPPermission: (_pattern: string, _permissions: Record<string, CorePikkuPermission | CorePikkuPermission[]> | CorePikkuPermission[]) => never;
 export declare const wireHTTP: <In, Out, Route extends string, PikkuFunction extends CorePikkuFunction<In, Out> = CorePikkuFunction<In, Out>, PikkuFunctionSessionless extends CorePikkuFunctionSessionless<In, Out> = CorePikkuFunctionSessionless<In, Out>, PikkuPermissionGroup extends CorePikkuPermission<In> = CorePikkuPermission<In>, PikkuMiddleware extends CorePikkuMiddleware = CorePikkuMiddleware>(httpWiring: CoreHTTPFunctionWiring<In, Out, Route, PikkuFunction, PikkuFunctionSessionless, PikkuPermissionGroup, PikkuMiddleware>) => void;
 export declare const createHTTPWire: (request: PikkuHTTPRequest | undefined, response: PikkuHTTPResponse | undefined) => PikkuHTTP | undefined;
 export declare const fetch: <In, Out>(request: Request, params?: RunHTTPWiringOptions) => Promise<Response>;

package/dist/wirings/http/http-runner.js

@@ -8,7 +8,9 @@ import { isProduction } from '../../env.js';
 import { pikkuState } from '../../pikku-state.js';
 import { PikkuFetchHTTPResponse } from './pikku-fetch-http-response.js';
 import { PikkuFetchHTTPRequest } from './pikku-fetch-http-request.js';
-import { unsupportedChannelRemote } from '../channel/channel-rpc.js';
+// The leaf module, not the channel-rpc barrel: http needs one refusal
+// function, and the barrel drags in 4,932 lines of channel RPC runtime.
+import { unsupportedChannelRemote } from '../channel/channel-rpc.types.js';
 import { addFunction, runPikkuFunc } from '../../function/function-runner.js';
 import { applyWebResponse } from './web-request.js';
 import { httpRouter } from './routers/http-router.js';
@@ -32,18 +34,6 @@ export const addHTTPMiddleware = (pattern, middleware, packageName = null) => {
         : middleware;
     return middleware;
 };
-/**
- * @deprecated HTTP-route-level permissions were removed in #972 — permissions
- * are now function-scoped only (declare them on the function via
- * `pikkuFunc({ permissions })`). This throwing stub exists solely so the pinned
- * bootstrap CLI (which still generates an `addHTTPPermission` wrapper) can
- * resolve the import at build time; it is never called. Delete once
- * `PIKKU_CLI_VERSION` in the CLI build is bumped past the release that removes
- * HTTP-route permissions.
- */
-export const addHTTPPermission = (_pattern, _permissions) => {
-    throw new Error('addHTTPPermission was removed in #972 — HTTP-route-level permissions no longer exist. Declare permissions on the function definition instead: pikkuFunc({ permissions }).');
-};
 export const wireHTTP = (httpWiring) => {
     const httpMeta = pikkuState(null, 'http', 'meta');
     const routeMeta = httpMeta[httpWiring.method][httpWiring.route];
@@ -60,6 +50,7 @@ export const wireHTTP = (httpWiring) => {
     }
     pikkuState(null, 'http', 'routes')
         .get(httpWiring.method)
+        // knowledge: decisions/internals/wiring-registries-erase-the-generics-their-wire-functions-capture.md
         ?.set(httpWiring.route, httpWiring);
 };
 const getMatchingRoute = (requestType, requestPath) => {
@@ -144,6 +135,7 @@ const executeRoute = async (services, matchedRoute, http, options) => {
             setState: (s) => {
                 sseState = s;
             },
+            // knowledge: decisions/internals/channel-state-accessors-are-unsound-generics-that-every-implementation-asserts.md
             getState: () => sseState,
             clearState: () => {
                 sseState = undefined;
@@ -181,6 +173,7 @@ const executeRoute = async (services, matchedRoute, http, options) => {
         getSession: () => userSession.get(),
         hasSessionChanged: () => userSession.sessionChanged,
     };
+    const statusBeforeRoute = http?.response?.statusCode;
     try {
         result = await runPikkuFunc('http', `${meta.method}:${meta.route}`, meta.pikkuFuncId, {
             singletonServices,
@@ -217,17 +210,22 @@ const executeRoute = async (services, matchedRoute, http, options) => {
         http?.response?.flushHeaders?.();
     }
     else {
+        const statusSetByRoute = http?.response?.statusCode !== statusBeforeRoute;
         if (result instanceof Response) {
             await applyWebResponse(http.response, result);
         }
         else if (result === undefined || result === null) {
-            http?.response?.status(204);
+            if (!statusSetByRoute) {
+                http?.response?.status(204);
+            }
         }
         else if (route.returnsJSON === false) {
             http?.response?.arrayBuffer(result);
         }
         else {
-            http?.response?.status(200);
+            if (!statusSetByRoute) {
+                http?.response?.status(200);
+            }
             http?.response?.json(result);
         }
     }
@@ -272,6 +270,7 @@ export const fetchData = async (request, response, { skipUserSession = false, re
                 if (globalMiddleware) {
                     await runMiddleware(singletonServices, wire, globalMiddleware);
                 }
+                // 204 carries no body, and `json` has no no-content overload.
                 response.status(204).json(undefined);
                 return;
             }

package/dist/wirings/http/http.types.d.ts

@@ -39,7 +39,6 @@ export interface PikkuHTTP<In = unknown> {
     request?: PikkuHTTPRequest<In>;
     response?: PikkuHTTPResponse;
 }
-export type RequestHeaders = Record<string, string | string[] | undefined> | ((headerName: string) => string | string[] | undefined);
 export type PikkuQuery<T = Record<string, string | undefined>> = Record<string, string | T | null | Array<T | null>>;
 export type CoreHTTPFunctionWiring<In, Out, R extends string, PikkuFunction extends CorePikkuFunction<In, Out, any, any, any> = CorePikkuFunction<In, Out>, PikkuFunctionSessionless extends CorePikkuFunctionSessionless<In, Out, any, any, any> = CorePikkuFunctionSessionless<In, Out>, PikkuPermission extends CorePikkuPermission<In, any, any> = CorePikkuPermission<In, any, any>, PikkuMiddleware extends CorePikkuMiddleware<any, any> = CorePikkuMiddleware<any, any>> = (CoreHTTPFunction & {
     route: R;
@@ -114,15 +113,6 @@ export type HTTPWiringMeta = CommonWireMeta & {
     groupBasePath?: string;
 };
 export type HTTPWiringsMeta = Record<HTTPMethod, Record<string, HTTPWiringMeta>>;
-export type HTTPFunctionsMeta = Array<{
-    name: string;
-    inputs: string[] | null;
-    outputs: string[] | null;
-}>;
-export type HTTPWiringMiddleware = {
-    route: string;
-    middleware: CorePikkuMiddleware[];
-};
 export interface PikkuHTTPRequest<In = unknown> {
     method(): HTTPMethod;
     path(): string;

package/dist/wirings/http/index.d.ts

@@ -1,8 +1,7 @@
 export { PikkuFetchHTTPRequest, DEFAULT_MAX_BODY_SIZE, } from './pikku-fetch-http-request.js';
-export type { PikkuFetchHTTPRequestOptions } from './pikku-fetch-http-request.js';
 export { PikkuFetchHTTPResponse } from './pikku-fetch-http-response.js';
 export { logRoutes } from './log-http-routes.js';
-export { fetch, fetchData, wireHTTP, addHTTPMiddleware, addHTTPPermission, } from './http-runner.js';
+export { fetch, fetchData, wireHTTP, addHTTPMiddleware } from './http-runner.js';
 export { wireHTTPRoutes, defineHTTPRoutes } from './http-routes.js';
 export { toWebRequest, applyWebResponse } from './web-request.js';
-export type { AssertHTTPWiringParams, CoreHTTPFunctionWiring, HTTPMethod, HTTPRouteBaseConfig, HTTPRouteContract, HTTPRouteMap, HTTPWiringsMeta, PikkuHTTPRequest, PikkuHTTPResponse, PikkuQuery, RunHTTPWiringOptions, } from './http.types.js';
+export type { AssertHTTPWiringParams, CoreHTTPFunctionWiring, HTTPMethod, HTTPRouteBaseConfig, HTTPRouteContract, HTTPRouteMap, HTTPWiringsMeta, PikkuHTTP, PikkuHTTPRequest, PikkuHTTPResponse, PikkuQuery, RunHTTPWiringOptions, } from './http.types.js';