@pikku/core 0.12.84 → 0.12.88

package/knowledge/decisions/internals/workflow-run-timeline-is-a-pure-fold-over-durable-history.md

@@ -7,7 +7,7 @@ tags: workflow
 
 # The workflow run timeline is a pure fold over durable history, with the row's status as the authority
 
-`run-timeline.ts` turns `getRunHistory` — one row per step *attempt*, each with
+`run-timeline.ts` turns `getRunHistory` — one row per step _attempt_, each with
 lifecycle timestamps — into a flat, chronologically ordered event stream, and
 folds that stream up to any point to recover what the run "knew" then: the same
 step cache a replay would hold, plus the walked path. Both functions are pure,

package/knowledge/decisions/internals/workflow-scenario-assertions-never-retry-and-record-one-step.md

@@ -30,11 +30,15 @@ caller, who is the only one who knows what was being waited for. Its own
 defaults are shorter than the assertion wrappers': `within` 15s, `interval`
 250ms.
 
-`requireActor` and `requireScenarioEnv` (`scenario-step-guards.ts`) exist for
-the mirror-image reason: `actor` and `env` are optional on the step wire because
-a pure assertion step needs neither, so the narrowing happens in one place with
-a message that says what to do, instead of every step file writing its own
-guard. `scenarioStep`'s `verifyStepName` call doubles as the guard for `then`
+`requireScenarioEnv` (`scenario-step-guards.ts`) exists for the mirror-image
+reason: `env` is optional on the step wire because most steps need nothing from
+it, so the narrowing happens in one place with a message that says what to do,
+instead of every step file writing its own guard. The actor is not narrowed at
+all — a step that runs as somebody declares `actor: true` (or a `browser`
+binding, which cannot be provisioned without a window to open), and the runner
+injects `wire.actor` non-optionally into every binding and refuses to dispatch
+the step without one. A wire member can be required per binding; a property of
+one cannot, which is why it is not on `scenarioStep`. `scenarioStep`'s `verifyStepName` call doubles as the guard for `then`
 being a wire member — an accidental `await scenario` calls it with a resolve
 function, which lands as a loud named error instead of a silent hang.
 

package/knowledge/decisions/internals/workflow-scenario-hooks-are-a-scenario-only-affordance.md

@@ -25,7 +25,7 @@ saying which phase it happened in.
 suspended or waiting and teardown would fire mid-flight. When the scenario has
 already failed for its own reason, an `after`-hook failure is attached as
 `cause` and logged rather than replacing the headline; only a teardown failure
-after a *passing* scenario fails the run.
+after a _passing_ scenario fails the run.
 
 At the feature level (`workflow.types.ts`, `CoreFeature`), hooks run once around
 the whole group — `before → a → b → c → after` — not per scenario. That is the

package/knowledge/decisions/internals/workflow-step-rpc-name-is-provenance-only.md

@@ -15,7 +15,7 @@ ran it.
 
 It earns its keep when the durable step name was built at runtime. A scenario
 step called in a loop reaches the run as, say, `sees @pikku/addon-todos` while
-it was declared as ``sees ${packageName}``; the recorded step-function name is
+it was declared as `sees ${packageName}`; the recorded step-function name is
 then the only way to join that row back to its declaration. `inlineStep` also
 records the `data` the step was called with for the same reason: a reporter
 renders each step's prose from it, so two calls to one step stay
@@ -23,7 +23,7 @@ distinguishable by what they were asked to check.
 
 Step lineage is recorded alongside it. `fromStepName` is the predecessor that
 scheduled a step — the walked transition — captured by `rpcStep`/`inlineStep`
-*before* `nextStepKey` advances the lineage, and surfaced to a step as
+_before_ `nextStepKey` advances the lineage, and surfaced to a step as
 `fromInvocationId`. In a cyclic graph `a → b → a → c`, the second `a` therefore
 carries `b`'s id, which is what lets the walked path be reconstructed from the
 chain alone.

package/knowledge/decisions/internals/workflow-suspend-and-approval-reasons-are-durable-step-identities.md

@@ -28,7 +28,7 @@ one key per gate means two gates resolving concurrently cannot clobber each
 other through a read-modify-write.
 
 One consequence to know about: `approveStep`'s optional `reason` argument
-addresses the *first* reach of a gate only. If a gate is reached again on a
+addresses the _first_ reach of a gate only. If a gate is reached again on a
 later loop iteration, `nextStepKey` gives that row a `#N` suffix, and there is
 currently no way for a caller to name it.
 

package/knowledge/decisions/security/a-function-never-receives-the-secret-service.md

@@ -24,7 +24,7 @@ impossible rather than merely reported: secrets are resolved where things are
 constructed — `pikkuServices`, `pikkuWireServices`, addon service factories,
 middleware — and the function is handed the configured client.
 
-The cost is that a function which needs to *ask about* a secret rather than read
+The cost is that a function which needs to _ask about_ a secret rather than read
 one — "is this key set?", for a readiness or provisioning check — cannot do it
 directly either. It goes through a service that holds `secrets` and exposes only
 that question, which is how `@pikku/addon-console` checks whether an installed

package/knowledge/decisions/security/a-scaffold-flag-says-a-surface-exists-not-who-may-call-it.md

@@ -0,0 +1,47 @@
+---
+type: decision
+title: A scaffold flag says a surface exists, not who may call it
+description: scaffold.<feature> is boolean | { path } — the auth field is gone, because the function runner already enforces each generated function's own auth, wiring, scopes and addon
+tags: config, authorization, codegen, scaffold
+---
+
+# A scaffold flag says a surface exists, not who may call it
+
+`scaffold.<feature>` carried an `auth` field, defaulting closed — see
+[[scaffold-features-are-authenticated-unless-opted-out]], which this supersedes.
+The field is gone. `PikkuScaffoldFeature` is now `boolean | { path?: string }`:
+whether the surface is generated, and where the file goes.
+
+The field was a second gate in front of one that already runs. `resolveSession`
+in `packages/core/src/function/function-runner.ts` throws `ForbiddenError` for a
+`pikkuFunc` with no session, unconditionally; a `pikkuSessionlessFunc` requires
+one when its own `auth: true` says so, when its wiring says so, or when
+`resolveAddonAuth` does. That is where authentication is decided, per function,
+by whoever wrote it. A config flag three directories away could only be coarser
+than that, and being coarser was the whole problem the earlier decision was
+trying to work around by defaulting it closed.
+
+So the generated dispatchers — public RPC, public agent, workflow routes and the
+events channel — emit a fixed `auth: false` on every function and wiring they
+write. That is not the scaffold declaring the surface public. It is the
+dispatcher declining to gate, because it does not know what it is forwarding to:
+`rpcCaller` hands whatever name it was given to `rpc.exposed`, and the function
+that resolves there is the one that answers for itself. Omitting the field would
+not have been neutral — a wiring with no `auth` requires a session — so the
+wrapper would reject the call before the gate that decides ever ran, which is a
+harder gate than the config field it replaced, applied by the layer least
+qualified to apply it.
+
+The scoped admin surfaces do not emit it. `userAdmin` and `virtualUser` generate
+`pikkuFunc` with `scopes: ['admin:users:...']` — session-required by
+construction, and the function that decides rather than a wrapper in front of
+one. `auth: false` there is refused by `runPikkuFunc` with a warning telling you
+to use `pikkuSessionlessFunc` instead, and `auth: true` would only restate the
+type.
+
+`pikku enable <feature>` lost its `--noAuth` flag with the field it wrote.
+
+**What this rules out:** reading a scaffold flag as an authorization decision;
+gating a surface in the config instead of on the function that answers it; and
+letting a generated dispatcher inherit the default `auth: true`, which reads as
+"undecided" and behaves as "denied".

package/knowledge/decisions/security/a-step-runs-the-function-the-workflow-dispatched-it-with.md

@@ -11,7 +11,7 @@ tags: workflow
 off the queue message and hands it to `executeWorkflowStep`. That call runs as
 the run's owner — `invokeStepRpc` copies `run.wire.pikkuUserId` onto the wire —
 and `rpcWithWire` does not apply the `expose` gate that the public `/rpc` route
-applies. So the message decided both *what* ran and *as whom*.
+applies. So the message decided both _what_ ran and _as whom_.
 
 The claim in `executeWorkflowStepInner` read the step's status and nothing else;
 there was no stored function name to compare against. `StepState` now carries

package/knowledge/decisions/security/a-virtual-user-is-never-offered-a-step-that-would-forge-its-own-oracle.md

@@ -11,11 +11,10 @@ tags: core, virtual-user
 platform and addon steps, from what a virtual user may call.
 
 For scenario bodies the argument is only efficiency: they are held out of every
-deployed unit and are not network-callable, so offering one wastes a turn on a
-404.
+deployed unit and are not network-callable, so offering one wastes a turn on a 404.
 
 For a platform or addon step the argument is the oracle itself. A virtual user's
-findings are worth something *because* it cannot manufacture the outcomes it is
+findings are worth something _because_ it cannot manufacture the outcomes it is
 meant to discover. A user that could invoke "Stripe's webhook arrives" forges its
 own payment success, and every finding downstream of that forgery is worthless —
 not merely unreliable, but actively misleading, because it looks like evidence.

package/knowledge/decisions/security/actor-sign-in-is-proven-by-set-cookie-not-a-non-empty-jar.md

@@ -15,7 +15,7 @@ header even though the response was a 2xx.
 A cookie jar cannot answer "did sign-in happen". A target app may set a cookie on
 any request — a CSRF token, an anonymous session, a locale — so a non-empty jar
 after a failed or skipped sign-in looks exactly like a successful one. What
-actually proves a session was established is *this* response setting a cookie. A
+actually proves a session was established is _this_ response setting a cookie. A
 2xx alone is not enough either: an endpoint that returns 200 while quietly
 declining to issue a session would leave the actor running every subsequent
 request unauthenticated, and the scenario would report the resulting refusals as

package/knowledge/decisions/security/addon-auth-and-tags-only-tighten.md

@@ -18,7 +18,7 @@ it is closed the same way: `runPikkuFunc` resolves both from the addon config.
 `auth` merges as an OR and `auth: false` is ignored. The RPC path treats it as a
 default (`addonConfig?.auth ?? options.requiresAuth`) because there the addon
 config is the only statement of intent. On a direct wiring the route already
-carries its own `auth`, so honouring `false` would let an addon *weaken* a gate
+carries its own `auth`, so honouring `false` would let an addon _weaken_ a gate
 the app wrote — the inverse of what a wiring-level declaration should be able to
 do. An addon may require a session the wiring did not; it may never waive one
 the wiring did.

package/knowledge/decisions/security/agent-gate-requires-a-session-only-when-auth-is-true.md

@@ -13,7 +13,7 @@ session presence (only when `CoreAgent.auth === true`), then `scopes`, then
 `permissions`. The ordering mirrors the function runner — scopes AND together so
 they can only narrow access, and a missing scope short-circuits before any
 permission function does I/O. Declared `scopes` are narrowed to the generated
-`ScopeId` union in a project's `pikku-types.gen.ts`, so an undeclared scope is a
+`ScopeId` union in a project's `#pikku/scopes`, so an undeclared scope is a
 compile error.
 
 `auth` defaults to `false` (i.e. `pikkuSessionlessFunc`, not `pikkuFunc`) because

package/knowledge/decisions/security/an-approval-answer-outlives-the-run-it-answered.md

@@ -11,7 +11,7 @@ An approval gate is asked for so it can be answered for afterwards. "Who
 released the funds" is the entire point of four-eyes sign-off, and until this
 change none of it was kept.
 
-Run state is where a decision *waits*, not where it is kept. The record under
+Run state is where a decision _waits_, not where it is kept. The record under
 `workflowRuns.state.__approval_<hex>` is overwritten by the next write to that
 key, and cleared outright — `decidedBy: undefined` included — whenever a
 decision is refused on replay. A trail that erases exactly the events worth
@@ -31,7 +31,7 @@ shape it had before there was anything to record.
 
 `deleteRun` cascades: `workflowStep` is `onDelete('cascade')` from
 `workflowRuns`, and `workflowStepHistory` from `workflowStep`. Deleting a run
-therefore deletes the sign-off with it — and a *refused* attempt never reaches a
+therefore deletes the sign-off with it — and a _refused_ attempt never reaches a
 step at all, so it was never in that trail to begin with.
 
 Every answer — accepted, refused at submission, or cleared on replay — is
@@ -55,5 +55,5 @@ in `pikkuSchemas`.
 **What this rules out:** a dedicated `workflowApprovals` table. It would have to
 be implemented in all seven backends and would still be deleted with the run
 unless it deliberately broke the cascade — at which point it is the audit table
-with extra steps. If approvals later need to be *queried* as a first-class
+with extra steps. If approvals later need to be _queried_ as a first-class
 entity rather than read back from the trail, that is when to revisit.

package/knowledge/decisions/security/console-addon-privileged-functions-gate-themselves.md

@@ -62,9 +62,10 @@ checked whether or not the host registered a global permission — an app that
 hand-wires `wireAddon({ name: 'console', package: '@pikku/addon-console' })`
 still cannot reach `execFileSync` unauthenticated.
 
-The scopes are spelled as literals here because they are scope ids in the
-addon's own `wireScope` tree — the same tree the `pikku:console:scopes:*` gates
-on the scope-admin functions come from. The generated secret and variable
+The scopes are spelled as literals here because they are scope ids in this
+addon's own `wireScope` tree. The `admin:scopes:*` gates on the scope-admin
+functions come from a different tree — those functions now live in
+`@pikku/addon-admin`, which declares its own. The generated secret and variable
 brokers live in the app's own scaffold rather than the addon, so the addon
 boundary never covered them; they carry `pikku:console:secrets:*` and
 `pikku:console:variables:*` themselves.

package/knowledge/decisions/security/core-safe-fetch-blocks-ssrf-by-host-literal-not-dns.md

@@ -10,7 +10,7 @@ tags: core
 `packages/core/src/utils/safe-fetch.ts` guards every outbound fetch that core
 makes on a caller-supplied URL. `@pikku/core` runs in edge runtimes (Cloudflare
 Workers) that have no Node `dns` module, so the guard cannot resolve a hostname
-and inspect the resulting address. It instead rejects address *literals* that are
+and inspect the resulting address. It instead rejects address _literals_ that are
 obviously internal — loopback, `10/8`, `172.16/12`, `192.168/16`, `0.0.0.0/8`,
 link-local `169.254/16` (the cloud metadata endpoint), IPv6 `::`, `::1`,
 `fe80::/10` and `fc00::/7` — plus the alias forms that reach the same targets:

package/knowledge/decisions/security/gateway-middleware-sessions-must-be-bridged-onto-the-wire.md

@@ -13,8 +13,8 @@ every `runPikkuFunc` call in the gateway runner, copying `await wire.getSession(
 onto `wire.session` when the latter is unset. Gateway middleware is the only
 place a webhook can acquire a session at all — typically by mapping a verified
 platform sender id to a user. Middleware that assigns `wire.session` directly
-needs no help, but the idiomatic `wire.setSession()` writes into the *enclosing
-wiring's* session service, and the handler's own invocation does not read that
+needs no help, but the idiomatic `wire.setSession()` writes into the _enclosing
+wiring's_ session service, and the handler's own invocation does not read that
 service.
 
 Without the bridge, the failure mode is silent and it fails open in the way that

package/knowledge/decisions/security/global-permissions-and-function-permissions-are-independent-gates.md

@@ -23,7 +23,7 @@ satisfy an admin-only function's requirements, because the two gates are
 evaluated independently against separate inputs. An empty or absent group passes,
 so declaring no permissions means "globals only", not "deny".
 
-Globals are bucketed per package, and a function reads *both* the root bucket and
+Globals are bucketed per package, and a function reads _both_ the root bucket and
 its own package's — root first. The generated `addGlobalPermission` wrapper takes
 no package argument, so an application's rules only ever land in the root bucket;
 resolving the package bucket alone meant a host rule like "every request needs a

package/knowledge/decisions/security/http-request-bodies-are-bounded-before-they-are-buffered.md

@@ -26,11 +26,11 @@ they divide into two kinds, and the difference is what can actually be
 prevented rather than merely reported:
 
 - **Prevention.** uWebSockets drives `res.onData` itself, so it counts bytes and
-  *drops* chunks past the limit rather than concatenating, replying 413 before
+  _drops_ chunks past the limit rather than concatenating, replying 413 before
   routing — the only point at which the buffering can be stopped, which is why
   it deviates from the fetch adapter's 404-an-unmatched-route order. Fastify
   delegates to native `bodyLimit`, set only when `maxBodySize` is configured so
-  the default never *loosens* fastify's stricter 1 MB. `PikkuExpressServer`
+  the default never _loosens_ fastify's stricter 1 MB. `PikkuExpressServer`
   feeds the limit into `express.json`/`text`/`urlencoded`.
 - **Rejection only.** `express-middleware` is handed an already-parsed body, so
   its guard makes the rejection uniform but cannot reclaim the memory; a

package/knowledge/decisions/security/index.md

@@ -9,6 +9,7 @@ description: Who may do what in core — gates, defaults, and the failures they
 A rule about who may do what, and which way it fails when it is unsure.
 
 <!-- pikku:knowledge-index -->
+
 - [A dropped audit write is always logged](a-dropped-audit-write-is-always-logged.md) — The no-op audit service falls back to the singleton logger when the wire carries none, so an unconfigured audit call is never silent
 - [A function never receives the secret service](a-function-never-receives-the-secret-service.md) — Every function-, permission- and auth-facing services type is bounded by SecretlessServices, so reaching for `secrets` in a function body is a type error rather than a lint
 - [A graph run starts at an entry node the graph declared](a-graph-run-starts-at-an-entry-node-the-graph-declared.md) — startNode may only name a node in meta.entryNodeIds, and no generated route offers it, because otherwise a caller picks which half of the graph to skip
@@ -49,7 +50,8 @@ A rule about who may do what, and which way it fails when it is unsure.
 - [Queue job identities are signed at enqueue](queue-job-identities-are-signed-at-enqueue.md) — A job's pikkuUserId is an HMAC claim bound to the queue and payload; an unverifiable claim is dropped, never trusted
 - [Queue jobs carry the producer's pikku user id](queue-jobs-carry-the-producers-pikku-user-id.md) — A job's pikkuUserId is trusted as identity by the worker, so enqueue rights are effectively act-as-user rights
 - [Remote addon tokens are client credentials, not mesh trust](remote-addon-tokens-are-client-credentials-not-mesh-trust.md) — wireRemoteAddon authenticates as a client to a hosted library and fails closed on an empty token; it never uses PIKKU_REMOTE_SECRET
-- [A scaffolded surface is authenticated unless the config opts out in writing](scaffold-features-are-authenticated-unless-opted-out.md) — scaffold.<feature> became boolean | { auth, path }, where true means authenticated — going public requires typing { auth: false }, and the legacy 'auth' | 'no-auth' strings are refused rather than coerced
+- [A scaffold flag says a surface exists, not who may call it](a-scaffold-flag-says-a-surface-exists-not-who-may-call-it.md) — scaffold.<feature> is boolean | { path }; the auth field is gone because the function runner already enforces each generated function's own auth, wiring, scopes and addon
+- [A scaffolded surface is authenticated unless the config opts out in writing](scaffold-features-are-authenticated-unless-opted-out.md) — SUPERSEDED; retains why the legacy 'auth' | 'no-auth' strings are refused rather than coerced
 - [Scenario-step functions are never externally invocable over RPC](scenario-step-functions-are-never-externally-invocable.md) — rpcExposed requires expose and rejects scenarioStep, so test steps stay reachable only from inside a scenario run
 - [Scope resolution happens at the session boundary and scope sync never deletes](scope-resolution-happens-at-the-session-boundary-and-sync-never-deletes.md) — ScopeService is called when a session is built, never by the function runner, and syncScopes only ever adds — revoking is an explicit operation
 - [Self-authentication is declared, not detected](self-authentication-is-declared-not-detected.md) — A function that authorizes callers in its own body says so with selfAuthenticated; codegen never tries to infer it
@@ -60,4 +62,5 @@ A rule about who may do what, and which way it fails when it is unsure.
 - [A queued workflow step rehydrates its session from the persisted run wire](workflow-queued-steps-rehydrate-their-session-from-the-run-wire.md) — The queue job payload is just `{ runId }`, so without threading `pikkuUserId` an authed step sees no session and throws
 - [Scenario sessions are isolated per actor and reset between scenarios](workflow-scenario-sessions-are-isolated-per-actor-and-per-scenario.md) — One jar per actor keeps two personas from sharing a session; a browser reset keeps one scenario from leaving the next signed in as somebody else
 - [A scenario step is never registered as a callable RPC and never dispatched on the queue](workflow-scenario-steps-are-never-network-invocable.md) — A step drives a browser and holds an actor's session, so exposing it as an RPC would put that reach on the network
+
 <!-- /pikku:knowledge-index -->

package/knowledge/decisions/security/mcp-internal-error-details-are-double-gated-on-production.md

@@ -9,7 +9,7 @@ tags: mcp
 
 `RunMCPEndpointParams.exposeErrors` in
 `packages/core/src/wirings/mcp/mcp-runner.ts` defaults to `!isProduction()`, and
-`runMCPPikkuFunc` checks `exposeErrors && !isProduction()` *again* when building
+`runMCPPikkuFunc` checks `exposeErrors && !isProduction()` _again_ when building
 the `-32603` internal-error response that carries `{ message, stack }`. The
 second check looks redundant against the default — it is not. The default only
 applies when the caller omits the option; a caller that passes

package/knowledge/decisions/security/queue-jobs-carry-the-producers-pikku-user-id.md

@@ -19,10 +19,10 @@ set by whoever enqueues the job. The adapter surfaces it as
 The claim is now HMAC-signed at enqueue and verified in `runQueueJob` — see
 [[queue-job-identities-are-signed-at-enqueue]], which supersedes the "any
 producer may name any user" reading below. Everything here still holds for the
-*authorization* question: signing proves the producer held the deployment
+_authorization_ question: signing proves the producer held the deployment
 secret, not that it was entitled to name that user.
 
-There is no re-authentication at the worker boundary — the queue payload *is* the
+There is no re-authentication at the worker boundary — the queue payload _is_ the
 credential. Workers run with `auth: false`, so nothing downstream re-checks that
 the producer was entitled to name that user. This is deliberate: the whole point
 is to let a background job resolve the same per-user credentials the original
@@ -35,5 +35,5 @@ client-supplied field flow into `JobOptions.pikkuUserId` without an authorizatio
 check first. It also rules out treating the queue as an authorization boundary —
 do not add a "the worker validated the producer's rights" assumption anywhere
 downstream, and do not drop the id from the wire on the theory that workers are
-unauthenticated anyway. Dropping an id that fails *signature* verification is a
+unauthenticated anyway. Dropping an id that fails _signature_ verification is a
 different matter and is what the worker now does.

package/knowledge/decisions/security/remote-addon-tokens-are-client-credentials-not-mesh-trust.md

@@ -23,7 +23,7 @@ logged or traced. Binding a `credentialId` without a wire that supports
 credentials throws rather than falling back to a shared secret.
 
 Resolution fails closed. `null` is returned only when no auth is bound at all,
-which is the addon declaring its remote surface public. Once auth *is* bound, a
+which is the addon declaring its remote surface public. Once auth _is_ bound, a
 resolved value of `null`, `undefined` or `''` raises `RemoteAddonAuthError` (401)
 instead of dispatching an unauthenticated request that the host might accept as
 anonymous.

package/knowledge/decisions/security/scaffold-features-are-authenticated-unless-opted-out.md

@@ -7,6 +7,12 @@ tags: config, authorization, codegen, scaffold
 
 # A scaffolded surface is authenticated unless the config opts out in writing
 
+**Superseded by
+[[a-scaffold-flag-says-a-surface-exists-not-who-may-call-it]]**: the `auth`
+field is gone entirely, because the function runner already enforces each
+generated function's own auth. The reasoning below still explains why the
+legacy `'auth' | 'no-auth'` strings are refused rather than coerced.
+
 `scaffold.<feature>` was `'auth' | 'no-auth' | false`. Two things were wrong
 with it, and they compounded.
 
@@ -16,7 +22,7 @@ dispatcher that cannot know what it dispatches to — wrong the moment one
 legitimately public sessionless function exists. For `userAdmin` it was
 redundant: the generated functions are `pikkuFunc` with `scopes:
 ['admin:users:list']`, gated twice over already. But for `agent`, `workflow`,
-`events` and `scenarios` it was the *only* gate, because those generate real
+`events` and `scenarios` it was the _only_ gate, because those generate real
 endpoints the app never authors and has nowhere else to declare a gate for.
 A uniform collapse to boolean would have silently opened four surfaces.
 
@@ -33,7 +39,7 @@ it.
 
 The object form is also what makes the legacy strings safe to remove. An
 earlier design used `string` for the output path, under which `"no-auth"` would
-have parsed as *a file named `no-auth`* — every unmigrated config silently
+have parsed as _a file named `no-auth`_ — every unmigrated config silently
 producing nonsense instead of failing. With `boolean | object`, a string is
 never valid, so `resolveScaffoldFeature` refuses `'auth'` and `'no-auth'` by
 name and prints the replacement. Coercing them was rejected outright: the value

package/knowledge/decisions/security/self-authentication-is-declared-not-detected.md

@@ -17,7 +17,7 @@ them on every build.
 The fix is a declaration — `selfAuthenticated: true` on the function config —
 not analysis of the body. Detection would have to recognise an open-ended set of
 authorization idioms, and it fails in the expensive direction: a body that
-*looks* like it checks something silences the warning for a function that
+_looks_ like it checks something silences the warning for a function that
 checks nothing. A declaration cannot be wrong by accident. Someone typed it,
 it is greppable, and it survives into meta where an audit reads it as what it
 is — a claim by a named author, not an inference.

package/knowledge/decisions/security/signed-content-urls-bind-the-request-path.md

@@ -13,8 +13,8 @@ requested. `LocalContent` requires a `JWTService` and throws without one; a
 verifier with no key available rejects with 403 rather than allowing the
 request, logging once per process so an attacker-triggerable path cannot flood.
 
-A signature over `{signedAt, expiresAt, notBefore}` alone proves only *when* a
-URL was issued, never *what* it was issued for. Any valid token was a skeleton
+A signature over `{signedAt, expiresAt, notBefore}` alone proves only _when_ a
+URL was issued, never _what_ it was issued for. Any valid token was a skeleton
 key: swap the pathname from a public thumbnail to a private document and the
 signature still verifies. Timestamps bound the window; only the path binds the
 asset.

package/knowledge/index.md

@@ -6,7 +6,7 @@ description: Why @pikku/core is built the way it is — the reasoning that used
 
 # Knowledge
 
-Pikku's source says *what* it does. These notes say *why*, for the handful of
+Pikku's source says _what_ it does. These notes say _why_, for the handful of
 choices where the code alone reads as arbitrary or, worse, reads as a mistake.
 
 The rule that produced this directory: **reasoning never lives in code.** A
@@ -19,6 +19,8 @@ meta files, the export surface. A note that repeats them is a copy that will
 drift.
 
 <!-- pikku:knowledge-index -->
+
 - [decisions](decisions/index.md) — a rule that was chosen, and what it rules out
 - [questions](questions/index.md) — something asked and not yet answered
+
 <!-- /pikku:knowledge-index -->

package/knowledge/questions/channel-middleware-accepts-bare-factories-that-nothing-resolves.md

@@ -14,7 +14,7 @@ tags: core, channel
 `channel-common.ts` and `channel-handler.ts` — assert across the gap.
 
 A factory is `(input: In) => CorePikkuChannelMiddleware`: the author is meant to
-*call* it at wiring time and put the result in the array.
+_call_ it at wiring time and put the result in the array.
 `combineChannelMiddleware` contains no factory-resolution branch, and neither
 does `combineMiddleware` for ordinary middleware — that is consistent and
 deliberate. So a bare, uncalled factory in `channelMiddleware` would be pushed

package/knowledge/questions/index.md

@@ -11,6 +11,8 @@ currently makes a choice that nobody has defended — the choice stays, the doub
 gets recorded.
 
 <!-- pikku:knowledge-index -->
+
 - [A channel's middleware list accepts bare factories that nothing ever resolves](channel-middleware-accepts-bare-factories-that-nothing-resolves.md) — CoreChannel.channelMiddleware admits CorePikkuChannelMiddlewareFactory, but no runner calls one, so a bare factory would stall the chain
 - [An unauthorized channel reply is sent outside the channel's declared Out type](unauthorized-channel-replies-escape-the-declared-out-type.md) — processMessageHandlers sends a bare string on auth failure, which no generated client type admits — nobody has decided what the typed shape should be
+
 <!-- /pikku:knowledge-index -->

package/package.json

@@ -1,11 +1,9 @@
 {
   "name": "@pikku/core",
-  "version": "0.12.84",
+  "version": "0.12.88",
   "description": "The Pikku runtime — functions, wirings, services, middleware and types",
   "author": "yasser.fadl@gmail.com",
   "license": "MIT",
-  "module": "dist/index.js",
-  "main": "dist/index.js",
   "type": "module",
   "scripts": {
     "tsc": "tsc && tsc -p tsconfig.type-tests.json",
@@ -21,14 +19,15 @@
   "sideEffects": [
     "./dist/errors/errors.js",
     "./dist/wirings/rpc/rpc-runner.js",
-    "./dist/wirings/rpc/remote-addon-auth.js",
+    "./dist/wirings/addon/remote-addon-auth.js",
     "./dist/wirings/workflow/workflow-approval-policy.js",
     "./dist/wirings/workflow/workflow-errors.js",
     "./dist/wirings/workflow/workflow-run-ownership.js",
     "./dist/wirings/workflow/pikku-scenario-service.js"
   ],
   "exports": {
-    ".": "./dist/index.js",
+    ".": "./dist/bootstrap-compat/root.js",
+    "./types": "./dist/types/index.js",
     "./middleware": "./dist/middleware/index.js",
     "./function": "./dist/function/index.js",
     "./channel": "./dist/wirings/channel/index.js",
@@ -46,6 +45,7 @@
     "./scheduler": "./dist/wirings/scheduler/index.js",
     "./trigger": "./dist/wirings/trigger/index.js",
     "./rpc": "./dist/wirings/rpc/index.js",
+    "./addon": "./dist/wirings/addon/index.js",
     "./safe-fetch": "./dist/utils/safe-fetch.js",
     "./node-host-resolver": "./dist/utils/node-host-resolver.js",
     "./mcp": "./dist/wirings/mcp/index.js",
@@ -73,8 +73,9 @@
     "./services/temporary-file-service": "./dist/services/temporary-file-service.js",
     "./crypto-utils": "./dist/crypto-utils.js",
     "./hmac": "./dist/utils/hmac.js",
-    "./ecosystem": "./dist/ecosystem.js",
-    "./ecosystem/*": "./dist/ecosystem/*.js",
+    "./state": "./dist/pikku-state.js",
+    "./classification": "./dist/classification/index.js",
+    "./utils": "./dist/utils.js",
     "./schema": "./dist/schema.js",
     "./testing": "./dist/testing/index.js",
     "./dev": "./dist/dev/hot-reload.js"
@@ -82,19 +83,19 @@
   "dependencies": {
     "@standard-schema/spec": "^1.1.0",
     "@types/json-schema": "^7.0.15",
-    "cookie": "^1.1.1",
+    "cookie": "^2.0.1",
     "json-schema": "^0.4.0",
-    "path-to-regexp": "^8.3.0",
+    "path-to-regexp": "^8.4.2",
     "picoquery": "^2.5.0"
   },
   "devDependencies": {
     "@ag-ui/core": "0.0.57",
-    "@types/node": "^24.11.0",
-    "esbuild": "~0.27.0",
-    "tsx": "^4.21.0",
+    "@types/node": "^24.13.3",
+    "esbuild": "~0.28.2",
+    "tsx": "^4.23.12",
     "typescript": "^6.0.3"
   },
   "engines": {
     "node": ">=24"
   }
-}
+}

package/scripts/generate-api-report.d.mts

@@ -1 +1 @@
-export {};
+export {}