@pikku/cli 0.12.100 → 0.12.103

package/dist/.pikku/trigger/pikku-trigger-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.100
+ * This file was generated by @pikku/cli@0.12.103
  */
 /**
  * Trigger-specific type definitions for tree-shaking optimization

package/dist/.pikku/trigger/pikku-trigger-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.100
+ * This file was generated by @pikku/cli@0.12.103
  */
 /**
  * Trigger-specific type definitions for tree-shaking optimization

package/dist/.pikku/variables/pikku-variable-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.100
+ * This file was generated by @pikku/cli@0.12.103
  */
 export { defineVariable } from '@pikku/core/variable';
 export type { CoreVariable, VariableDefinitionMeta, VariableDefinitionsMeta } from '@pikku/core/variable';

package/dist/.pikku/variables/pikku-variable-types.gen.js

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.100
+ * This file was generated by @pikku/cli@0.12.103
  */
 export { defineVariable } from '@pikku/core/variable';

package/dist/.pikku/variables/pikku-variables.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.100
+ * This file was generated by @pikku/cli@0.12.103
  */
 import { TypedVariablesService as CoreTypedVariablesService } from '@pikku/core/services';
 import type { VariablesService } from '@pikku/core/services';

package/dist/.pikku/variables/pikku-variables.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.100
+ * This file was generated by @pikku/cli@0.12.103
  */
 import { TypedVariablesService as CoreTypedVariablesService } from '@pikku/core/services';
 import variablesMeta from './pikku-variables-meta.gen.json' with { type: 'json' };

package/dist/.pikku/workflow/meta/allWorkflow.gen.json

@@ -231,9 +231,15 @@
         "AI agent": {
             "nodeId": "AI agent",
             "rpcName": "pikkuAIAgent",
-            "next": "Public agent scaffold",
+            "next": "AI scorer",
             "stepHash": "b40cd11dc611"
         },
+        "AI scorer": {
+            "nodeId": "AI scorer",
+            "rpcName": "pikkuAIScorer",
+            "next": "Public agent scaffold",
+            "stepHash": "4671def89706"
+        },
         "Public agent scaffold": {
             "nodeId": "Public agent scaffold",
             "rpcName": "pikkuPublicAgent",
@@ -634,5 +640,5 @@
     "entryNodeIds": [
         "Bootstrap inspect"
     ],
-    "graphHash": "c8f162576369"
+    "graphHash": "dd727be4816c"
 }

package/dist/.pikku/workflow/pikku-personas.gen.d.ts

@@ -1,4 +1,5 @@
-import type { HttpPersonasConfig, ScenarioPersona, ResolvedPersona } from '@pikku/core/services';
+import type { HttpPersonasConfig } from '@pikku/core/persona';
+import type { ScenarioPersona, ResolvedPersona } from '@pikku/core/services';
 import type { AgentMap } from '../agent/pikku-agent-map.gen.d.js';
 import type { FlattenedRPCMap } from '../rpc/pikku-rpc-wirings-map.gen.d.js';
 export declare const personaConfigs: {};

package/dist/.pikku/workflow/pikku-personas.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.100
+ * This file was generated by @pikku/cli@0.12.103
  */
 /** Personas declared with definePersonas() */
 import { createHttpPersonas } from '@pikku/core/persona';

package/dist/.pikku/workflow/pikku-workflow-types.gen.d.ts

@@ -1,10 +1,11 @@
 /**
- * This file was generated by @pikku/cli@0.12.100
+ * This file was generated by @pikku/cli@0.12.103
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import { template } from '@pikku/core/workflow';
 import { type PikkuWorkflowGraphConfig, type PikkuWorkflowGraphResult } from '@pikku/core/workflow';
-import type { PikkuWorkflowWire, PikkuScenarioWire, WorkflowStepOptions, ScenarioStepOptions } from '@pikku/core/workflow';
+import type { PikkuWorkflowWire, WorkflowStepOptions } from '@pikku/core/workflow';
+import type { PikkuScenarioWire, ScenarioStepOptions } from '@pikku/core/scenario';
 export { WorkflowCancelledException };
 import type { PikkuFunctionSessionless, PikkuFunctionConfig, WiredServices } from '../function/pikku-function-types.gen.js';
 import type { FlattenedRPCMap } from '../rpc/pikku-rpc-wirings-map.internal.gen.d.js';
@@ -30,10 +31,7 @@ export interface TypedScenarioSteps {
     when<K extends keyof FlattenedScenarioStepMap>(stepName: string, stepFunc: K, data?: FlattenedScenarioStepMap[K]['input'], options?: ScenarioStepOptions): Promise<FlattenedScenarioStepMap[K]['output']>;
     then<K extends keyof FlattenedScenarioStepMap>(stepName: string, stepFunc: K, data?: FlattenedScenarioStepMap[K]['input'], options?: ScenarioStepOptions): Promise<FlattenedScenarioStepMap[K]['output']>;
 }
-/**
- * `Out` types `scenario.context` — the scratch the body shares with its
- * `before`/`after` hooks — as a partial of what a completed run produces.
- */
+/** `Out` types `scenario.context`. */
 export type TypedScenario<Out = unknown> = TypedWorkflow & Omit<PikkuScenarioWire<Out>, keyof PikkuWorkflowWire | keyof TypedScenarioSteps> & TypedScenarioSteps;
 import type { StandardSchemaV1 } from '@standard-schema/spec';
 import type { InferSchemaOutput, PikkuPermission, PikkuMiddleware, NodeConfig, PikkuApprovalDescription } from '../function/pikku-function-types.gen.js';
@@ -42,9 +40,9 @@ import { PikkuError } from '@pikku/core/errors';
 import type { CorePermissionGroup } from '@pikku/core';
 export type PikkuFunctionWorkflow<In = unknown, Out = never> = PikkuFunctionSessionless<In, Out, 'workflow'>;
 /**
- * `Ctx` types `scenario.context` and defaults to the function's own output,
- * which is what a scenario body wants. A hook returns void but shares the
- * scenario's context, so it passes the scenario's output here instead.
+ * `Ctx` types `scenario.context`, defaulting to the body's own output. A hook
+ * returns void but shares the scenario's context, so it passes that scenario's
+ * output here instead.
  */
 export type PikkuFunctionScenario<In = unknown, Out = never, Ctx = Out> = PikkuFunctionSessionless<In, Out, 'scenario' | 'actors', WiredServices, Ctx>;
 export type PikkuWorkflowConfigWithSchema<InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined> = {
@@ -92,10 +90,8 @@ export type PikkuScenarioConfigWithSchema<InputSchema extends StandardSchemaV1 |
      * Always runs after the scenario body, in a `finally`, whether it passed or
      * failed. Throwing fails a run that would otherwise have passed; on an
      * already-failed run it attaches as the `cause` and never replaces the
-     * original error.
-     *
-     * Reads `scenario.context` for whatever the body managed to record before it
-     * stopped — that is how teardown learns the ids a failed run created.
+     * original error. Reads `scenario.context` for whatever the body managed to
+     * record before it stopped.
      */
     after?: PikkuScenarioHook<InputSchema, OutputSchema>;
     /**
@@ -108,11 +104,8 @@ export type PikkuScenarioConfigWithSchema<InputSchema extends StandardSchemaV1 |
 };
 /**
  * A scenario lifecycle hook: the scenario's own `(services, data, wire)`
- * signature with its result discarded.
- *
- * The hook returns void but shares the scenario's `context`, so the output
- * schema types `scenario.context` while the return type stays `void` — a hook
- * is setup and teardown, never a step, and nothing it returns is recorded.
+ * signature with its result discarded. `OutputSchema` types
+ * `scenario.context` while the return type stays `void`.
  */
 export type PikkuScenarioHook<InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined> = PikkuFunctionScenario<InputSchema extends StandardSchemaV1 ? InferSchemaOutput<InputSchema> : unknown, void, OutputSchema extends StandardSchemaV1 ? InferSchemaOutput<OutputSchema> : unknown>;
 /**

package/dist/.pikku/workflow/pikku-workflow-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.100
+ * This file was generated by @pikku/cli@0.12.103
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import { template } from '@pikku/core/workflow';

package/dist/.pikku/workflow/pikku-workflow-wirings-meta.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.100
+ * This file was generated by @pikku/cli@0.12.103
  */
 import { pikkuState } from '@pikku/core/ecosystem';
 import allWorkflowMeta from './meta/allWorkflow.gen.json' with { type: 'json' };

package/dist/.pikku/workflow/pikku-workflow-wirings.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.100
+ * This file was generated by @pikku/cli@0.12.103
  */
 import { addWorkflow } from '@pikku/core/workflow';
 import './pikku-workflow-wirings-meta.gen.js';

package/dist/bin/pikku-bin.mjs

@@ -11,8 +11,8 @@ async function checkForUpdate() {
     })
     if (!res.ok) return
     const { version: latest } = await res.json()
-    if (latest !== '0.12.100') {
-      process.stderr.write(`\n  Update available  0.12.100 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
+    if (latest !== '0.12.103') {
+      process.stderr.write(`\n  Update available  0.12.103 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
     }
   } catch {}
 }

package/dist/src/cli.wiring.js

@@ -29,7 +29,7 @@ import { scopesPrune } from './functions/commands/scopes-prune.js';
 import { rolesAudit } from './functions/commands/roles-audit.js';
 import { rolesPrune } from './functions/commands/roles-prune.js';
 import { pikkuAudit } from './functions/commands/audit.js';
-import { workspaceValidate, renderWorkspaceValidate, } from './functions/commands/workspace-validate.js';
+import { validate, renderValidate } from './functions/commands/validate.js';
 import { knowledgeValidate, renderKnowledgeValidate, } from './functions/commands/knowledge-validate.js';
 import { knowledgeIndex, renderKnowledgeIndex, } from './functions/commands/knowledge-index.js';
 import { scenarioRun, scenarioList } from './functions/commands/scenario.js';
@@ -240,6 +240,9 @@ wireCLI({
                     description: 'Test mode: record service calls for scenario assertions and set PIKKU_TEST_RUN for isTestRun()',
                     default: false,
                 },
+                model: {
+                    description: 'Repoint model aliases for this run, e.g. \'cheap:openai/gpt-5-nano,tool:anthropic/claude-haiku-4-5\'. Overrides the "models" table in pikku.config.json without editing it',
+                },
             },
         }),
         serve: pikkuCLICommand({
@@ -255,6 +258,9 @@ wireCLI({
                     description: 'Also serve the Pikku Console same-origin at /console',
                     default: false,
                 },
+                model: {
+                    description: 'Repoint model aliases for this run, e.g. \'cheap:openai/gpt-5-nano,tool:anthropic/claude-haiku-4-5\'. Overrides the "models" table in pikku.config.json without editing it',
+                },
             },
         }),
         login: pikkuCLICommand({
@@ -427,16 +433,11 @@ wireCLI({
                 }),
             },
         },
-        workspace: {
-            description: 'Workspace-level validation and maintenance commands',
-            subcommands: {
-                validate: pikkuCLICommand({
-                    func: workspaceValidate,
-                    render: renderWorkspaceValidate,
-                    description: 'Check the project structure for Pikku workspace compatibility',
-                }),
-            },
-        },
+        validate: pikkuCLICommand({
+            func: validate,
+            render: renderValidate,
+            description: 'Run every check that applies to this project — app structure, and the published file set of any addon it contains',
+        }),
         scenario: {
             description: 'Run and inspect scenarios (pikkuScenario)',
             subcommands: {
@@ -487,6 +488,14 @@ wireCLI({
                             description: 'Keep every stack frame on a failure. Without it, only the project’s own frames are shown',
                             default: false,
                         },
+                        screenshots: {
+                            description: 'Write the screenshots scenarios ask for to disk, under .pikku/scenario-runs/<run>/<scenario>. Without it `browser.screenshot()` still returns the bytes and nothing is written',
+                            default: false,
+                        },
+                        video: {
+                            description: 'Record a video per scenario alongside the screenshots (implies --screenshots)',
+                            default: false,
+                        },
                         apiUrl: {
                             description: "Override the environment's apiUrl for this run — for a target that only exists at run time, such as a freshly deployed sandbox",
                         },

package/dist/src/deploy/analyzer/analyzer.js

@@ -370,6 +370,46 @@ export function analyzeDeployment(state, options) {
         allowedHosts: s.allowedHosts,
         read: readSecretIds.has(s.secretId),
     }));
+    const unscopedSecretAddons = [];
+    const unscopedCredentialAddons = [];
+    const grantedSecretAddons = [];
+    const grantedCredentialAddons = [];
+    // An override's key is a grant too: scoping is checked before the rename, so
+    // the key is a name the addon may read that it never declared.
+    const grantedNames = (grants, overrides) => [...new Set([...(grants ?? []), ...Object.keys(overrides ?? {})])].sort();
+    for (const [namespace, addon] of state.rpc?.wireAddonDeclarations ?? []) {
+        if (addon.globalSecrets) {
+            unscopedSecretAddons.push({
+                namespace,
+                package: addon.package,
+                reason: addon.globalSecrets,
+            });
+        }
+        else {
+            const granted = grantedNames(addon.secretGrants, addon.secretOverrides);
+            if (granted.length > 0) {
+                grantedSecretAddons.push({ namespace, package: addon.package, granted });
+            }
+        }
+        if (addon.globalCredentials) {
+            unscopedCredentialAddons.push({
+                namespace,
+                package: addon.package,
+                reason: addon.globalCredentials,
+            });
+        }
+        else {
+            const granted = grantedNames(addon.credentialGrants, addon.credentialOverrides);
+            if (granted.length > 0) {
+                grantedCredentialAddons.push({
+                    namespace,
+                    package: addon.package,
+                    granted,
+                });
+            }
+        }
+    }
+    const byNamespace = (a, b) => a.namespace.localeCompare(b.namespace);
     const variables = state.variables.definitions.map((v) => ({
         variableId: v.variableId,
         displayName: v.displayName,
@@ -387,6 +427,10 @@ export function analyzeDeployment(state, options) {
         workflows,
         secrets,
         unresolvedSecretReads: unresolvedSecretReads.sort(),
+        unscopedSecretAddons: unscopedSecretAddons.sort(byNamespace),
+        unscopedCredentialAddons: unscopedCredentialAddons.sort(byNamespace),
+        grantedSecretAddons: grantedSecretAddons.sort(byNamespace),
+        grantedCredentialAddons: grantedCredentialAddons.sort(byNamespace),
         variables,
     };
 }

package/dist/src/deploy/analyzer/manifest.d.ts

@@ -108,6 +108,23 @@ export interface SecretDeclaration {
 }
 /** Secret reads whose key the inspector could not resolve, as `file:line:source`. */
 export type UnresolvedSecretRead = string;
+/** A `wireAddon` instance the app exempted from secret or credential scoping. */
+export interface UnscopedAddon {
+    namespace: string;
+    package: string;
+    /** The app's stated reason, from `wireAddon({ globalSecrets | globalCredentials })`. */
+    reason: string;
+}
+/** A `wireAddon` instance the app lent named secrets or credentials it never declared. */
+export interface GrantedAddon {
+    namespace: string;
+    package: string;
+    /**
+     * The names the addon may now read, as the addon reads them — grants and
+     * override keys alike, since scoping is checked before an override renames.
+     */
+    granted: string[];
+}
 export interface VariableDeclaration {
     variableId: string;
     displayName: string;
@@ -129,5 +146,25 @@ export interface DeploymentManifest {
      * scope to the declared set when this is empty.
      */
     unresolvedSecretReads: UnresolvedSecretRead[];
+    /**
+     * Addon instances exempted from secret scoping. Every other addon reads only
+     * the secrets it declared, so this is the full list of packages that can
+     * reach a secret the app never named for them.
+     */
+    unscopedSecretAddons: UnscopedAddon[];
+    /**
+     * Addon instances exempted from credential scoping. Every other addon reaches
+     * only the credentials it declared, and none can enumerate the app's users.
+     */
+    unscopedCredentialAddons: UnscopedAddon[];
+    /**
+     * Addon instances lent named secrets on top of the ones they declared. The
+     * other half of the same waiver as `unscopedSecretAddons` — narrower, because
+     * the app named the set — so between them a deployment sees every secret an
+     * addon can reach that it did not declare for itself.
+     */
+    grantedSecretAddons: GrantedAddon[];
+    /** Addon instances lent named credentials on top of the ones they declared. */
+    grantedCredentialAddons: GrantedAddon[];
     variables: VariableDeclaration[];
 }

package/dist/src/fabric/functions/smoke.function.js

@@ -1,6 +1,6 @@
 import { spawn } from 'node:child_process';
 import { existsSync, createWriteStream } from 'node:fs';
-import { mkdtemp, mkdir, readFile, realpath, rm, writeFile } from 'node:fs/promises';
+import { mkdtemp, mkdir, readFile, realpath, rm, writeFile, } from 'node:fs/promises';
 import { createServer } from 'node:net';
 import { tmpdir } from 'node:os';
 import { join, relative, resolve } from 'node:path';
@@ -8,7 +8,7 @@ import { fileURLToPath } from 'node:url';
 import { setTimeout as delay } from 'node:timers/promises';
 import { z } from 'zod';
 import { pikkuSessionlessFunc } from '../../../.pikku/pikku-types.gen.js';
-import { findProjectRoot, readJsonSafe, } from '../../functions/validate/workspace-validate.js';
+import { findProjectRoot, readJsonSafe, } from '../../functions/validate/validate.js';
 import { headSha, isWorkingTreeClean } from '../lib/git.js';
 import { added, changed, dim, removed } from '../lib/output.js';
 const DEFAULT_YARN_VERSION = 'yarn@4.9.2';
@@ -52,7 +52,9 @@ function truncateTail(text, maxBytes = DEV_LOG_TAIL_BYTES) {
     if (Buffer.byteLength(trimmed, 'utf8') <= maxBytes) {
         return trimmed;
     }
-    const slice = Buffer.from(trimmed, 'utf8').subarray(-maxBytes).toString('utf8');
+    const slice = Buffer.from(trimmed, 'utf8')
+        .subarray(-maxBytes)
+        .toString('utf8');
     const newlineIndex = slice.indexOf('\n');
     return newlineIndex === -1 ? slice : slice.slice(newlineIndex + 1);
 }
@@ -322,7 +324,8 @@ async function startFrontends(args) {
             };
         }
         const rewritten = rewriteFrontendCommand(devConfig.command);
-        const healthPath = typeof devConfig.healthPath === 'string' && devConfig.healthPath.length > 0
+        const healthPath = typeof devConfig.healthPath === 'string' &&
+            devConfig.healthPath.length > 0
             ? devConfig.healthPath
             : '/';
         const normalizedHealthPath = healthPath.startsWith('/')

package/dist/src/fabric/functions/validate.function.js

@@ -7,6 +7,7 @@ import { pikkuSessionlessFunc } from '../../../.pikku/pikku-types.gen.js';
 import { added, changed, removed, dim } from '../lib/output.js';
 import { typeCheckFrontends } from '../lib/frontend-typecheck.js';
 import { readJsonSafe, readTextSafe, runSharedProjectChecks, } from '../../functions/validate/shared-checks.js';
+import { runTypeIdentityChecks } from '../../functions/validate/type-identity-checks.js';
 const FindingSchema = z.object({
     id: z.string(),
     severity: z.enum(['error', 'warn', 'info']),
@@ -200,7 +201,7 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
     };
     const lines = (...parts) => parts.join('\n');
     // ── everything true of any pikku project ───────────────────────────────
-    // Fabric validate is workspace validate plus the deploy-shaped checks. The
+    // Fabric validate is the app-project check plus the deploy-shaped checks. The
     // two used to be separate walks over the same project that duplicated sixteen
     // findings verbatim, and each carried checks the other lacked for no reason
     // anyone could name.
@@ -318,6 +319,7 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
             }
         }
     }
+    findings.push(...(await runTypeIdentityChecks(root)));
     // ── scaffold-implied dependencies ──────────────────────────────────────
     // `scaffold.console` makes codegen import
     // `@pikku/addon-console/.pikku/pikku-bootstrap.gen.js` from the generated

package/dist/src/functions/commands/db-export.js

@@ -16,7 +16,7 @@ import { exportSchema } from '../db/local-db.js';
 export const dbExport = pikkuSessionlessFunc({
     remote: true,
     func: async ({ logger, config }) => {
-        const artifact = await exportSchema(config.rootDir);
+        const artifact = await exportSchema(config.rootDir, config.db?.pgliteExtensions);
         const dialects = Object.keys(artifact);
         if (dialects.length === 0) {
             logger.info('db export: no db/sqlite or db/postgres migrations — nothing to publish');

package/dist/src/functions/commands/db-shared.d.ts

@@ -1,20 +1,6 @@
 export interface UserConfigShape {
     sqliteDb?: string;
     postgresUrl?: string;
-    /**
-     * Postgres extensions the CLI's embedded PGlite databases must load — the
-     * local dev database, and the shadow one every `db` command migrates to type
-     * and diff a schema.
-     *
-     * A bare name is one of PGlite's bundled contrib extensions (`hstore`,
-     * `citext`, `uuid_ossp`, …) and needs nothing installed. Anything else is a
-     * package the project depends on, such as `@electric-sql/pglite-pgvector`.
-     *
-     * Needed even when `postgresUrl` points at a server that already has the
-     * extension: the shadow database is PGlite regardless, so a `CREATE EXTENSION`
-     * in a migration fails there unless it is declared here.
-     */
-    pgliteExtensions?: string[];
     [key: string]: unknown;
 }
 interface LoadOptions {

package/dist/src/functions/commands/dev.d.ts

@@ -4,16 +4,19 @@ export declare const dev: import("#pikku").PikkuFunctionConfig<{
     hmr?: boolean;
     coverage?: boolean;
     test?: boolean;
+    model?: string;
 }, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{
     port?: string;
     watch?: boolean;
     hmr?: boolean;
     coverage?: boolean;
     test?: boolean;
+    model?: string;
 }, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<{
     port?: string;
     watch?: boolean;
     hmr?: boolean;
     coverage?: boolean;
     test?: boolean;
+    model?: string;
 }, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/dev.js

@@ -1,4 +1,5 @@
 import { join, resolve } from 'path';
+import { existsSync, readFileSync } from 'node:fs';
 import { pikkuSessionlessFunc } from '#pikku';
 import chokidar from 'chokidar';
 import { pikkuDevReloader, reloadGeneratedMeta, reconcileAddonRegistry, } from '@pikku/core/dev';
@@ -6,6 +7,7 @@ import { ConsoleLogger, LocalEmailService, spy, InMemoryQueueService, InMemoryWo
 import { KyselyAIStorageService, KyselyAIRunStateService, KyselyAgentRunService, } from '@pikku/kysely';
 import { stopSingletonServices } from '@pikku/core';
 import { pikkuState } from '@pikku/core/ecosystem';
+import { wireAIScorerQueueWorkers } from '@pikku/core/ai-scorer';
 import { LocalMetaService } from '@pikku/core/services/local-meta';
 import { LocalContent, } from '@pikku/core/services/local-content';
 import { InMemorySchedulerService } from '@pikku/schedule';
@@ -18,10 +20,12 @@ import { resolveConsoleMount } from './serve-console.js';
 import { serverReadyLine } from '../../server/server-ready.js';
 import { createEphemeralContentSigningJWT } from '../../server/content-signing-jwt.js';
 import { resolveScaffoldFeature } from '../../utils/resolve-scaffold-feature.js';
+import { applyModelAliasOverride } from '../../utils/model-alias-override.js';
 export const dev = pikkuSessionlessFunc({
     remote: true,
-    func: async ({ logger, config, getInspectorState, invalidateInspectorState, variables, devServerRunner, }, { port, watch, hmr, coverage, test }, { rpc }) => {
+    func: async ({ logger, config, getInspectorState, invalidateInspectorState, variables, devServerRunner, }, { port, watch, hmr, coverage, test, model }, { rpc }) => {
         process.env.PIKKU_DEV_QUICK_LOGIN ??= 'true';
+        applyModelAliasOverride(logger, model, config.models);
         if (test) {
             process.env.PIKKU_TEST_RUN = 'true';
         }
@@ -230,6 +234,7 @@ export const dev = pikkuSessionlessFunc({
         };
         pikkuState(null, 'package', 'singletonServices', resolvedServices);
         resolvedServices.workflowService?.wireQueueWorkers?.();
+        wireAIScorerQueueWorkers();
         const { serverLifecycleFactory } = inspectorState.filesAndMethods;
         const loadLifecycle = async () => {
             if (!serverLifecycleFactory)
@@ -238,13 +243,46 @@ export const dev = pikkuSessionlessFunc({
             return m[serverLifecycleFactory.variable];
         };
         const consoleMount = await resolveConsoleMount();
+        /**
+         * Hand the server the generated MCP manifest so it actually serves MCP.
+         *
+         * Codegen reports "N MCP endpoints" and both transports mount them at
+         * `mcpPath` — but only when given `mcpJson`, and dev never passed it.
+         *
+         * It goes in the runner *options*, not in the config: the transport reads it
+         * off its third argument, and the runners forward a hand-picked list of
+         * fields. Putting it in `config` type-checks and is discarded in silence.
+         * So every pikku app announced an MCP surface at startup and served a 404,
+         * and the only way to exercise a tool was to deploy. `deploy-apply` even
+         * carries a comment saying the deployed bundle should match "the dev server"
+         * — which had never served it either.
+         *
+         * Absent or unparseable is not an error: an app with no MCP wirings has no
+         * manifest, and that is the common case.
+         */
+        const mcpJson = await (async () => {
+            const file = join(pikkuDir, 'mcp', 'mcp.gen.json');
+            if (!existsSync(file))
+                return undefined;
+            try {
+                const parsed = JSON.parse(readFileSync(file, 'utf-8'));
+                const count = (parsed.tools?.length ?? 0) +
+                    (parsed.resources?.length ?? 0) +
+                    (parsed.prompts?.length ?? 0);
+                return count > 0 ? parsed : undefined;
+            }
+            catch (err) {
+                logger.warn(`[pikku] could not parse ${file} — MCP will not be served: ${err instanceof Error ? err.message : String(err)}`);
+                return undefined;
+            }
+        })();
         const pikkuServer = devServerRunner.createServer({
             ...userConfig,
             hostname: bindHostname,
             port: resolvedPort,
             content: localContentConfig,
             ...(consoleMount ? { staticMounts: [consoleMount] } : {}),
-        }, logger, { contentSigningJWT });
+        }, logger, { contentSigningJWT, mcpJson });
         const lifecycle = await loadLifecycle();
         await pikkuServer.init();
         await lifecycle?.beforeStart?.(resolvedServices);
@@ -296,6 +334,7 @@ export const dev = pikkuSessionlessFunc({
                             invalidateInspectorState();
                             await runAllWithCommandState();
                             workflowService.wireQueueWorkers();
+                            wireAIScorerQueueWorkers();
                             // Pull the regenerated meta + JSON schemas into the running
                             // process so new/changed functions are callable without a
                             // restart (the hot-reloader registers their implementations).

package/dist/src/functions/commands/knowledge-index.d.ts

@@ -6,7 +6,7 @@ export declare const knowledgeIndex: import("#pikku").PikkuFunctionConfig<{
     check: boolean;
     files: {
         path: string;
-        action: "unchanged" | "created" | "updated";
+        action: "created" | "updated" | "unchanged";
     }[];
 }, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{
     check?: boolean | undefined;
@@ -15,7 +15,7 @@ export declare const knowledgeIndex: import("#pikku").PikkuFunctionConfig<{
     check: boolean;
     files: {
         path: string;
-        action: "unchanged" | "created" | "updated";
+        action: "created" | "updated" | "unchanged";
     }[];
 }, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<{
     check?: boolean | undefined;
@@ -24,7 +24,7 @@ export declare const knowledgeIndex: import("#pikku").PikkuFunctionConfig<{
     check: boolean;
     files: {
         path: string;
-        action: "unchanged" | "created" | "updated";
+        action: "created" | "updated" | "unchanged";
     }[];
 }, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
 export { renderKnowledgeIndex };

package/dist/src/functions/commands/new-addon.js

@@ -134,9 +134,12 @@ export function getAddonFiles(vars, flags) {
         name: `@pikku/addon-${name}`,
         version: '0.0.1',
         type: 'module',
+        // Everything an installed package reaches for lives under dist. The
+        // addon's own build resolves #pikku through tsconfig `paths` instead, so
+        // these never have to point at the source tree.
         imports: {
-            '#pikku': './.pikku/pikku-types.gen.ts',
-            '#pikku/*': './.pikku/*',
+            '#pikku': './dist/.pikku/pikku-types.gen.js',
+            '#pikku/*': './dist/.pikku/*',
         },
         exports: {
             '.': {
@@ -153,7 +156,7 @@ export function getAddonFiles(vars, flags) {
         scripts: {
             prepublishOnly: 'yarn build',
             prebuild: 'pikku all',
-            build: 'tsc && cp -r .pikku dist/',
+            build: 'tsc && cp -r .pikku types dist/',
             pikku: 'pikku all',
         },
         peerDependencies: {