@pikku/skills 0.12.9 → 0.12.11

package/skills/pikku-mongodb/SKILL.md

@@ -49,17 +49,17 @@ await mongo.close()
 
 ### Available Services
 
-| Service                     | Interface                             | Purpose                                        |
-| --------------------------- | ------------------------------------- | ---------------------------------------------- |
-| `MongoDBChannelStore`       | `ChannelStore`                        | WebSocket channel state persistence            |
-| `MongoDBEventHubStore`      | `EventHubStore`                       | Event hub state persistence                    |
-| `MongoDBWorkflowService`    | `PikkuWorkflowService`                | Workflow definition storage                    |
-| `MongoDBWorkflowRunService` | `WorkflowRunService`                  | Workflow execution tracking                    |
-| `MongoDBDeploymentService`  | `DeploymentService`                   | Deployment state management                    |
-| `MongoDBAIStorageService`   | `AIStorageService, AIRunStateService` | AI conversation/run storage                    |
-| `MongoDBAgentRunService`    | `AgentRunService`                     | Agent execution tracking                       |
-| `MongoDBSecretService`      | `SecretService`                       | Encrypted secret storage (envelope encryption) |
-| `MongoDBSessionStore`       | `SessionStore`                        | Persisted user sessions                        |
+| Service                      | Interface                                   | Purpose                                        |
+| ---------------------------- | ------------------------------------------- | ---------------------------------------------- |
+| `MongoDBChannelStore`        | `ChannelStore`                              | WebSocket channel state persistence            |
+| `MongoDBEventHubStore`       | `EventHubStore`                             | Event hub state persistence                    |
+| `MongoDBWorkflowService`     | `PikkuWorkflowService`                      | Workflow definition storage                    |
+| `MongoDBWorkflowRunService`  | `WorkflowRunService`                        | Workflow execution tracking                    |
+| `MongoDBDeploymentService`   | `DeploymentService`                         | Deployment state management                    |
+| `MongoDBAgentStorageService` | `AgentStorageService, AgentRunStateService` | AI conversation/run storage                    |
+| `MongoDBAgentRunService`     | `AgentRunService`                           | Agent execution tracking                       |
+| `MongoDBSecretService`       | `SecretService`                             | Encrypted secret storage (envelope encryption) |
+| `MongoDBSessionStore`        | `SessionStore`                              | Persisted user sessions                        |
 
 All services take a `Db` instance in their constructor and have an `init()` method that creates collections/indexes.
 

package/skills/pikku-n8n-import/SKILL.md

@@ -59,13 +59,13 @@ than the exit code to know what landed. Relay every skipped workflow to the user
 Every unmapped node is a stub that throws `… — implement me`. Classify each by its
 JSDoc marker and route to the matching reference:
 
-| Stub marker / signal | Handle via |
-|---|---|
-| `STUB — generated from n8n node "…" (type "n8n-nodes-base.<svc>…")` | `references/addon-mapping.md` |
-| `STUB — generated from n8n Code node "…"` | `references/code-translation.md` |
-| A `control` stub — Loop Over Items / **splitInBatches**, Switch expr-mode | `references/loops-and-control.md` |
-| `STUB — … vector-store … #902` | rare now (RAG ships as `<store>:query`/`:ingest`); a residual one = an unmapped store → report it, don't guess |
-| Importer `diagnostics` (already exited 1) | explain the reason; the workflow is un-importable as-is |
+| Stub marker / signal                                                      | Handle via                                                                                                     |
+| ------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- |
+| `STUB — generated from n8n node "…" (type "n8n-nodes-base.<svc>…")`       | `references/addon-mapping.md`                                                                                  |
+| `STUB — generated from n8n Code node "…"`                                 | `references/code-translation.md`                                                                               |
+| A `control` stub — Loop Over Items / **splitInBatches**, Switch expr-mode | `references/loops-and-control.md`                                                                              |
+| `STUB — … vector-store … #902`                                            | rare now (RAG ships as `<store>:query`/`:ingest`); a residual one = an unmapped store → report it, don't guess |
+| Importer `diagnostics` (already exited 1)                                 | explain the reason; the workflow is un-importable as-is                                                        |
 
 Read a reference file only when you actually hit that stub class.
 
@@ -99,11 +99,11 @@ Missing integrations — install these or the nodes stay stubs:
 
 ## References
 
-| Open when you need to… | Read |
-|---|---|
-| map an integration stub (gmailTool, slackTool, googleSheets, plain action nodes) to an installed addon `ref(...)` | `references/addon-mapping.md` |
-| translate an n8n Code node body into a Pikku function body | `references/code-translation.md` |
-| lower a Loop Over Items / splitInBatches loop, or a Switch that stayed a stub | `references/loops-and-control.md` |
+| Open when you need to…                                                                                            | Read                              |
+| ----------------------------------------------------------------------------------------------------------------- | --------------------------------- |
+| map an integration stub (gmailTool, slackTool, googleSheets, plain action nodes) to an installed addon `ref(...)` | `references/addon-mapping.md`     |
+| translate an n8n Code node body into a Pikku function body                                                        | `references/code-translation.md`  |
+| lower a Loop Over Items / splitInBatches loop, or a Switch that stayed a stub                                     | `references/loops-and-control.md` |
 
 ## Final summary
 

package/skills/pikku-n8n-import/SPEC.md

@@ -11,6 +11,7 @@ remainder with judgment, report gaps that need a human decision, and verify.
 ## Scope
 
 In scope:
+
 - Running `pikku import n8n` and triaging its output.
 - Filling integration stubs (→ addon refs), Code stubs (→ function bodies), and
   loop/control stubs (→ `graph:map`/reduce/branch).
@@ -18,6 +19,7 @@ In scope:
 - Verifying via `pikku all` + `tsc` + a zero-surviving-stub check.
 
 Out of scope:
+
 - Extending `@pikku/n8n-import` itself (it is frozen; do not add per-service tables
   or new compiler rules to it).
 - Authoring workflows from scratch (`pikku-workflow`) or hand-written addon wiring
@@ -47,6 +49,7 @@ Out of scope:
 ## Source And Evidence Model
 
 Authoritative sources:
+
 - `@pikku/n8n-import` codegen (stub markers, manifest shape, `import-n8n` command).
 - `@pikku/addon-graph` function contracts (`graph:map`/`fanout`, `branch`).
 - Installed `@pikku/addon-*` source (function names verified by grep, never guessed).

package/skills/pikku-n8n-import/references/addon-mapping.md

@@ -18,9 +18,11 @@ rewrite the stub.
      "n8nType": "n8n-nodes-base.gmailTool",
      "n8nName": "Send a message in Gmail",
      "parameters": { "sendTo": "...", "message": "...", "subject": "..." },
-     "credentials": { "gmailOAuth2": { "id": "...", "name": "Personal Gmail" } },
+     "credentials": {
+       "gmailOAuth2": { "id": "...", "name": "Personal Gmail" },
+     },
      "isAgentTool": true,
-     "agentName": "Inbox Assistant"
+     "agentName": "Inbox Assistant",
    }
    ```
 2. **Installed addons** — `@pikku/addon-*` in the project's `package.json`
@@ -35,12 +37,12 @@ rewrite the stub.
 Map `n8nType` to a package by reading its source. Common shapes (**guesses, not
 authoritative** — always verify against installed source):
 
-| n8n type prefix | typical addon candidate |
-|---|---|
-| `n8n-nodes-base.gmail` / `gmailTool` | `@pikku/addon-email-gmail` |
-| `n8n-nodes-base.slack` / `slackTool` | `@pikku/addon-chat-slack` |
-| `n8n-nodes-base.googleSheets` / `…Tool` | `@pikku/addon-sheets-google` |
-| `n8n-nodes-base.notion` / `notionTool` | `@pikku/addon-docs-notion` |
+| n8n type prefix                            | typical addon candidate      |
+| ------------------------------------------ | ---------------------------- |
+| `n8n-nodes-base.gmail` / `gmailTool`       | `@pikku/addon-email-gmail`   |
+| `n8n-nodes-base.slack` / `slackTool`       | `@pikku/addon-chat-slack`    |
+| `n8n-nodes-base.googleSheets` / `…Tool`    | `@pikku/addon-sheets-google` |
+| `n8n-nodes-base.notion` / `notionTool`     | `@pikku/addon-docs-notion`   |
 | `n8n-nodes-base.telegram` / `telegramTool` | `@pikku/addon-chat-telegram` |
 
 If no installed addon plausibly covers the n8n type, stop and report it — do not
@@ -74,6 +76,7 @@ over guessing.
 Two outcomes, by `isAgentTool`:
 
 **A) `isAgentTool: true`** — the stub is an agent tool referenced via `ref()`:
+
 1. Delete the stub file.
 2. In the agent file, replace `ref('agentGmailtool__sendAMessageInGmail')` in
    `tools: [...]` with `ref('messageSend')` (the resolved addon function).
@@ -81,13 +84,16 @@ Two outcomes, by `isAgentTool`:
    `node_modules/@pikku/addon-*`).
 
 If you can't delete safely, leave a one-line re-export instead of a stub:
+
 ```ts
 import { messageSend } from '@pikku/addon-email-gmail'
 export const agentGmailtool__sendAMessageInGmail = messageSend
 ```
+
 Default is delete + retarget; wrappers add maintenance burden.
 
 **B) `isAgentTool: false`** — the stub is a graph node:
+
 1. Open `<workflow>.graph.ts`.
 2. In `nodes: { … }` find the entry whose value is the stub rpc name.
 3. Replace it with the addon function name (`'messageSend'`).

package/skills/pikku-n8n-import/references/code-translation.md

@@ -20,39 +20,39 @@ refactor, add error handling, or invent fields.
 3. **Apply the rubric.**
 4. **Edit only the function body.** Leave imports, schemas, JSDoc, name, description, refs untouched unless step 5 forces it.
 5. **If the schemas are wrong** (code reads `$json.userId: string` but input is `items: z.array(z.unknown())`), tighten with the smallest change. Prefer `z.unknown()` over `z.any()`. Never widen output to `z.any()`.
-6. **Add one comment** at the top of the body noting the mode: `// translated from n8n Code node, mode: runOnceForAllItems`. This is the *only* comment you may add.
+6. **Add one comment** at the top of the body noting the mode: `// translated from n8n Code node, mode: runOnceForAllItems`. This is the _only_ comment you may add.
 7. **Typecheck** (`yarn tsc` from the package root); fix errors with the smallest change.
 
 ## Rubric
 
 ### Envelope unwrapping — all-items mode
 
-| n8n | Pikku |
-|---|---|
-| `items` | `(data.items ?? []) as any[]` (or typed if known) |
-| `items[i].json.X` | `items[i].X` |
-| `items[i].json` | `items[i]` |
-| `items[i].binary` | **NOT supported** — leave a TODO and explain |
-| `items.length` | `items.length` |
-| `items.map(i => i.json.X)` | `items.map((i: any) => i.X)` |
+| n8n                        | Pikku                                             |
+| -------------------------- | ------------------------------------------------- |
+| `items`                    | `(data.items ?? []) as any[]` (or typed if known) |
+| `items[i].json.X`          | `items[i].X`                                      |
+| `items[i].json`            | `items[i]`                                        |
+| `items[i].binary`          | **NOT supported** — leave a TODO and explain      |
+| `items.length`             | `items.length`                                    |
+| `items.map(i => i.json.X)` | `items.map((i: any) => i.X)`                      |
 
 ### Envelope unwrapping — each-item mode
 
-| n8n | Pikku |
-|---|---|
-| `$json.X` / `$input.item.json.X` | `data.X` (input is the item itself) |
-| `$input.item.json` | `data` |
-| `$input.all()` | not available per-item — change to all-items mode |
+| n8n                              | Pikku                                             |
+| -------------------------------- | ------------------------------------------------- |
+| `$json.X` / `$input.item.json.X` | `data.X` (input is the item itself)               |
+| `$input.item.json`               | `data`                                            |
+| `$input.all()`                   | not available per-item — change to all-items mode |
 
 ### Return statement
 
-| n8n | Pikku |
-|---|---|
-| `return [{ json: X }]` | `return { items: [X] }` |
-| `return items.map(i => ({ json: ... }))` | `return { items: items.map(...) }` |
-| `return [{ json: X }, { json: Y }]` | `return { items: [X, Y] }` |
-| `return { json: X }` (each-item) | `return X` |
-| `return [...]` (already plain) | wrap in `{ items: [...] }` only if the output schema expects it |
+| n8n                                      | Pikku                                                           |
+| ---------------------------------------- | --------------------------------------------------------------- |
+| `return [{ json: X }]`                   | `return { items: [X] }`                                         |
+| `return items.map(i => ({ json: ... }))` | `return { items: items.map(...) }`                              |
+| `return [{ json: X }, { json: Y }]`      | `return { items: [X, Y] }`                                      |
+| `return { json: X }` (each-item)         | `return X`                                                      |
+| `return [...]` (already plain)           | wrap in `{ items: [...] }` only if the output schema expects it |
 
 ### Built-ins — do NOT auto-translate
 
@@ -80,6 +80,7 @@ the first param).
 ## Example
 
 Before (stub):
+
 ```ts
 /**
  * STUB — generated from n8n Code node "Custom Code".
@@ -90,12 +91,15 @@ export const codeStubCustomCode = pikkuSessionlessFunc({
   input: CodeStubCustomCodeInput,
   output: CodeStubCustomCodeOutput,
   func: async (_services, _data) => {
-    throw new Error('Stub: ported from n8n Code node "Custom Code" — implement me')
+    throw new Error(
+      'Stub: ported from n8n Code node "Custom Code" — implement me'
+    )
   },
 })
 ```
 
 After:
+
 ```ts
 export const codeStubCustomCode = pikkuSessionlessFunc({
   description: 'Ported from n8n Code node "Custom Code"',

package/skills/pikku-n8n-import/references/loops-and-control.md

@@ -32,11 +32,11 @@ predecessor and any `$('<loop node>')` become `$item`.
 
 ### Decide the shape first
 
-| Loop body does… | Emit |
-|---|---|
-| transform each item independently (enrich, format, call one thing) | `graph:map` — child = the body |
-| accumulate across items (running total, build one object/array) | a **reduce**: a single generated function over the whole array, not a map — `graph:map` collects per-item results and *loses* the accumulator |
-| pure side-effect per item, nothing downstream consumes results | `graph:map` with **no `next`** (done branch empty) — the safest, unambiguous case |
+| Loop body does…                                                    | Emit                                                                                                                                          |
+| ------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------- |
+| transform each item independently (enrich, format, call one thing) | `graph:map` — child = the body                                                                                                                |
+| accumulate across items (running total, build one object/array)    | a **reduce**: a single generated function over the whole array, not a map — `graph:map` collects per-item results and _loses_ the accumulator |
+| pure side-effect per item, nothing downstream consumes results     | `graph:map` with **no `next`** (done branch empty) — the safest, unambiguous case                                                             |
 
 ### Child arity
 
@@ -49,8 +49,8 @@ predecessor and any `$('<loop node>')` become `$item`.
 
 ### Done-branch semantics (ask if it matters)
 
-n8n's done output is version-dependent: it may carry the *original* items or the
-*accumulated* results. `graph:map`'s `next` receives the array of child results.
+n8n's done output is version-dependent: it may carry the _original_ items or the
+_accumulated_ results. `graph:map`'s `next` receives the array of child results.
 If a downstream node reads that array's shape and the distinction matters, add:
 
 ```ts

package/skills/pikku-paraglide/SKILL.md

@@ -18,7 +18,7 @@ Use this as an execution checklist, not reference material.
 ## The rules that don't change
 
 - **Never resolve an enum key dynamically.** No `mKey('status.' + value)`, no `m['enum__status__' + value]()`, no `mExists`/`mList` helpers. Dynamic keys can't be type-checked or tree-shaken. Everything is a static `m.<literal>()` reference, generated into the map.
-- **The `enum__<group>__<member>` namespace.** `__` separates the prefix / group / member segments; a single `_` joins words *within* a segment (`enum__booking_status__form_received`). The prefix (`enum`) and separator (`__`) are configurable but leave them at the defaults.
+- **The `enum__<group>__<member>` namespace.** `__` separates the prefix / group / member segments; a single `_` joins words _within_ a segment (`enum__booking_status__form_received`). The prefix (`enum`) and separator (`__`) are configurable but leave them at the defaults.
 - **Members must be valid JS identifiers.** Spell out leading digits — `two_guests`, not `2_guests`. The generator quotes an invalid member as a fallback but warns you to rename it.
 - **`asI18n(...)` is only for opaque server data** (names, slugs, ids returned from the API). Never `asI18n()` a hardcoded English string or an enum value — an enum value goes through its label map.
 
@@ -35,8 +35,8 @@ export type I18nMessage = () => I18nString
 export type EnumLabel<E extends string> = Record<E, I18nMessage>
 
 export const bookingStatus = {
-  enquiry:   m.enum__booking_status__enquiry,
-  reserved:  m.enum__booking_status__reserved,
+  enquiry: m.enum__booking_status__enquiry,
+  reserved: m.enum__booking_status__reserved,
   confirmed: m.enum__booking_status__confirmed,
 } satisfies EnumLabel<BookingStatus>
 export type BookingStatusKey = keyof typeof bookingStatus
@@ -61,18 +61,20 @@ const items = [{ label: m.common__nav__items__dashboard /* ← reference */ }]
 The DB column is the real source of truth for what an enum can be. The pikku CLI's db codegen emits a bare unions module — `.pikku/db/enums.gen.ts` — covering **both** Postgres native enums and SQLite `CHECK (col IN ('a','b',…))` constraints:
 
 ```ts
-export type BookingStatus = 'enquiry' | 'reserved' | 'confirmed' | 'ended' | 'cancelled'
+export type BookingStatus =
+  'enquiry' | 'reserved' | 'confirmed' | 'ended' | 'cancelled'
 ```
 
 Point `@pikku/paraglide` at that file (`enumsFile`) and each catalog group whose member set **exactly matches** a DB enum is typed `satisfies EnumLabel<DbEnum>`. The label map then **is** the reconciliation — no separate assertion:
 
 - catalog drops a DB member, or `en.json` is missing the key → `m.enum__…` doesn't exist / `Record<DbEnum,…>` isn't exhaustive → **`tsc` error naming the gap**.
 - a DB enum with **no** catalog group → `unmatchedDbEnums: 'emit'` (default) generates a label map referencing `enum__<table>_<column>__<member>` keys, so `tsc` tells you exactly which keys to add; `'warn'` only reports it.
-- a group with a member the DB lacks (a *derived* UI state, e.g. a `waitlisted` view of a `pending` row) → a drift warning. Make that a **standalone `m.<key>()` message**, not an enum member — the enum group must mirror the DB column exactly.
+- a group with a member the DB lacks (a _derived_ UI state, e.g. a `waitlisted` view of a `pending` row) → a drift warning. Make that a **standalone `m.<key>()` message**, not an enum member — the enum group must mirror the DB column exactly.
 
 Labelling an enum that's never rendered costs nothing: Paraglide compiles only the messages actually referenced, so unused labels are tree-shaken away. So label every DB enum; don't add an opt-out.
 
 **To make a column an enum**, give it a closed domain in the migration so codegen can see it:
+
 - SQLite: `status TEXT NOT NULL CHECK (status IN ('enquiry','reserved','confirmed'))`
 - Postgres: a native `CREATE TYPE … AS ENUM (…)` column.
 
@@ -88,7 +90,10 @@ import { paraglideEnums } from '@pikku/paraglide/vite'
 
 export default defineConfig({
   plugins: [
-    paraglideVitePlugin({ project: './project.inlang', outdir: './src/paraglide' }),
+    paraglideVitePlugin({
+      project: './project.inlang',
+      outdir: './src/paraglide',
+    }),
     paraglideEnums({
       catalog: './messages/en.json',
       outFile: './src/i18n/i18n-enum.gen.ts',

package/skills/pikku-permissions/SKILL.md

@@ -26,14 +26,14 @@ export const deleteBook = pikkuFunc({
     await db.deleteBook(bookId)
   },
   permissions: {
-    owner: isBookOwner,   // ← authorization here
+    owner: isBookOwner, // ← authorization here
   },
 })
 
 // WRONG — permission check inside func body
 export const deleteBook = pikkuFunc({
   func: async ({ db }, { bookId }, { session }) => {
-    if (!session) throw new UnauthorizedError()  // ← never do this
+    if (!session) throw new UnauthorizedError() // ← never do this
     await db.deleteBook(bookId)
   },
 })
@@ -54,7 +54,7 @@ Use for checks that read the session but need no request data — and that asser
 something **beyond** merely having a session (a flag, a tier, a claim).
 
 ```typescript
-import { pikkuAuth } from '#pikku'
+import { pikkuAuth } from '#pikku/function'
 
 // Good: a real gate on the session's contents, not just its existence.
 export const isVerified = pikkuAuth(
@@ -71,21 +71,21 @@ function already enforces. A function that needs a signed-in user sets
 ```typescript
 // WRONG — redundant with auth: true; adds a permission that gates nothing.
 export const isSignedIn = pikkuAuth(async (_s, session) => !!session)
-pikkuFunc({ auth: true, permissions: { signedIn: isSignedIn }, /* ... */ })
+pikkuFunc({ auth: true, permissions: { signedIn: isSignedIn } /* ... */ })
 
 // RIGHT — auth: true already requires the session; permissions are for capability.
-pikkuFunc({ auth: true, /* ... */ })
+pikkuFunc({ auth: true /* ... */ })
 ```
 
-A permission answers "*may this user do this?*" (role, ownership, tier) — never
-"*is there a session?*".
+A permission answers "_may this user do this?_" (role, ownership, tier) — never
+"_is there a session?_".
 
 ### `pikkuPermission(fn)` — Data-Aware Checks
 
 Use when authorization depends on the actual request data (e.g., resource ownership).
 
 ```typescript
-import { pikkuPermission } from '#pikku'
+import { pikkuPermission } from '#pikku/function'
 
 export const isBookOwner = pikkuPermission(
   async ({ db }, { bookId }, { session }) => {
@@ -132,24 +132,24 @@ export const deleteBook = pikkuFunc({
 
 ### Global (`addGlobalPermission`) — App-Wide AND Gate
 
-A global permission is an app-wide baseline that **every** function must additionally pass. It is an independent AND gate: it can only ever *narrow* access — it never grants access a function's own `permissions` would deny.
+A global permission is an app-wide baseline that **every** function must additionally pass. It is an independent AND gate: it can only ever _narrow_ access — it never grants access a function's own `permissions` would deny.
 
 ```typescript
-import { addGlobalPermission } from '#pikku'
+import { addGlobalPermission } from '#pikku/function'
 
 addGlobalPermission([isEmployee]) // every function now also requires an employee session
 ```
 
 Multiple `addGlobalPermission` calls accumulate and are AND'd together.
 
-> Wire-, tag-, and HTTP-route-level permissions (`addHTTPPermission`, `addTagPermission`, and a `permissions` field on HTTP/channel/MCP wirings) were **removed in #972**. Permissions now live only on the function definition, plus the optional global gate. Tags are organizational only — use tag/HTTP *middleware* (`addTagMiddleware`, `addHTTPMiddleware`) for cross-cutting request handling, not authorization.
+> Wire-, tag-, and HTTP-route-level permissions (`addHTTPPermission`, `addTagPermission`, and a `permissions` field on HTTP/channel/MCP wirings) were **removed in #972**. Permissions now live only on the function definition, plus the optional global gate. Tags are organizational only — use tag/HTTP _middleware_ (`addTagMiddleware`, `addHTTPMiddleware`) for cross-cutting request handling, not authorization.
 
 ## Scopes — the AND Gate Above Permissions
 
 Scopes answer "what was this session granted?" before permissions ask "may this
 user do this to this resource?". They are AND-ed: every scope listed must be
 held. Because they are checked first and fail closed, a scope can only ever
-*narrow* access — it never grants what `permissions` would deny.
+_narrow_ access — it never grants what `permissions` would deny.
 
 Declare the scope tree once with `defineScope`. The body is a no-op that
 tree-shakes away; the CLI reads the call by AST and generates a `ScopeId` union,
@@ -158,7 +158,7 @@ gating on nothing.
 
 ```typescript
 // src/scopes.ts
-import { defineScope } from '#pikku'
+import { defineScope } from '#pikku/scopes'
 
 defineScope({
   admin: {
@@ -222,7 +222,11 @@ export const handleStripeWebhook = pikkuSessionlessFunc({
   permissionsInBody: true,
   auth: false,
   func: async ({ stripe }, data, { http }) => {
-    stripe.webhooks.constructEvent(data.raw, http.request.header('stripe-signature'), secret)
+    stripe.webhooks.constructEvent(
+      data.raw,
+      http.request.header('stripe-signature'),
+      secret
+    )
     // ...
   },
 })
@@ -240,7 +244,7 @@ declared, inspectable, and reusable.
 
 ```typescript
 // src/permissions.ts
-import { pikkuAuth, pikkuPermission } from '#pikku'
+import { pikkuAuth, pikkuPermission } from '#pikku/function'
 
 export const isVerified = pikkuAuth(
   async (_services, session) => !!session?.emailVerified

package/skills/pikku-product-second-opinion/README.md

@@ -11,8 +11,8 @@ Existing repo → pikku-software-archaeology → .knowledge/ blueprint → pikku
 
 ## The split from pikku-software-archaeology
 
-- **pikku-software-archaeology** extracts *facts* into `.knowledge/` for a machine (Pikku) to rebuild from. Engineer/generator audience.
-- **pikku-product-second-opinion** reads that blueprint and writes an *opinionated report* for a human to decide from. Non-technical audience.
+- **pikku-software-archaeology** extracts _facts_ into `.knowledge/` for a machine (Pikku) to rebuild from. Engineer/generator audience.
+- **pikku-product-second-opinion** reads that blueprint and writes an _opinionated report_ for a human to decide from. Non-technical audience.
 
 One extracts; one advises. This skill consumes the other's output — it doesn't re-read the code.
 
@@ -30,7 +30,7 @@ One extracts; one advises. This skill consumes the other's output — it doesn't
 4. **Argue improvements in business outcomes** (more reliable / faster / cheaper / safer / easier to hand off), and say whether each is a cheap **rewire** or an expensive **rebuild** — never recommend a rewrite just because the code is messy.
 5. **Mark confidence.** Certain and "I'd need to check" are different sentences.
 6. **Cover the frontend and the other ways the app is used** when the blueprint has them — walk the screens as a journey, call out consistency, and flag the custom-logic pieces (charts/tables/editors) as the real work vs the cheap standard pieces. Name the ways the product can be driven (people/web, developers/API+SDK, AI agents/MCP, power users/CLI) — often a genuine strength.
-7. **Give honest technology tradeoffs — both sides.** Every stack bet (framework, auth, hosting, key libraries) gets what-it-buys AND what-it-costs in business terms, tied to the founder's stage/goals. Don't cheerlead, don't trash, and **don't soften the disadvantages**. The app's own bets are derived from the blueprint (`architecture.json`/`integrations.json`/`frontend.json` + the repo's manifest) — never from a list in the skill, because a verdict you could write before reading the blueprint isn't a second opinion. Separately, and only when a rebuild is actually being recommended, the target stack (Pikku, Better Auth, TanStack Start) gets the *same* both-sides treatment with cons first-class — pinning someone's dependency for being pre-1.0 while staying quiet about the replacement being pre-1.0 too is a pitch, not an opinion.
+7. **Give honest technology tradeoffs — both sides.** Every stack bet (framework, auth, hosting, key libraries) gets what-it-buys AND what-it-costs in business terms, tied to the founder's stage/goals. Don't cheerlead, don't trash, and **don't soften the disadvantages**. The app's own bets are derived from the blueprint (`architecture.json`/`integrations.json`/`frontend.json` + the repo's manifest) — never from a list in the skill, because a verdict you could write before reading the blueprint isn't a second opinion. Separately, and only when a rebuild is actually being recommended, the target stack (Pikku, Better Auth, TanStack Start) gets the _same_ both-sides treatment with cons first-class — pinning someone's dependency for being pre-1.0 while staying quiet about the replacement being pre-1.0 too is a pitch, not an opinion.
 
 ## Files