@pikku/cli 0.12.102 → 0.12.104

package/dist/src/functions/surface/collect-surface.js

@@ -0,0 +1,215 @@
+import { existsSync, readdirSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { join, relative, resolve } from 'node:path';
+import ts from 'typescript';
+const SOURCE_EXTENSIONS = ['.ts', '.tsx', '.mts', '.cts'];
+const MODULE_EXTENSIONS = [...SOURCE_EXTENSIONS, '.js', '.jsx', '.mjs', '.cjs'];
+const wildcardStem = (fileName) => {
+    if (fileName.endsWith('.map'))
+        return null;
+    if (/\.d\.(ts|mts|cts)$/.test(fileName))
+        return null;
+    const extension = MODULE_EXTENSIONS.find((each) => fileName.endsWith(each));
+    return extension ? fileName.slice(0, -extension.length) : null;
+};
+const subpathMap = (exports) => {
+    if (typeof exports === 'string')
+        return { '.': exports };
+    return Object.keys(exports).some((key) => key.startsWith('.'))
+        ? exports
+        : { '.': exports };
+};
+const publishesCode = (target) => !/\.(css|scss|json|svg|png|woff2?|txt|md)$/.test(target);
+const sourceForTarget = (packageDir, target, outDir) => {
+    const withoutPrefix = target.replace(/^\.\//, '');
+    const isDeclaration = /\.d\.(ts|mts|cts)$/.test(withoutPrefix);
+    if (!isDeclaration &&
+        SOURCE_EXTENSIONS.some((extension) => withoutPrefix.endsWith(extension))) {
+        return existsSync(join(packageDir, withoutPrefix)) ? withoutPrefix : null;
+    }
+    const stripped = withoutPrefix.startsWith(`${outDir}/`)
+        ? withoutPrefix.slice(outDir.length + 1)
+        : withoutPrefix;
+    const base = stripped
+        .replace(/\.d\.(ts|mts|cts)$/, '')
+        .replace(/\.(js|jsx|mjs|cjs)$/, '');
+    const withoutSrc = base.startsWith('src/') ? base.slice(4) : base;
+    const candidates = [];
+    for (const extension of SOURCE_EXTENSIONS) {
+        candidates.push(join('src', `${base}${extension}`), `${base}${extension}`, join('src', `${withoutSrc}${extension}`), join('src', base, `index${extension}`), join(base, `index${extension}`));
+    }
+    for (const candidate of candidates) {
+        if (existsSync(join(packageDir, candidate)))
+            return candidate;
+    }
+    return null;
+};
+const expandWildcard = (packageDir, subpath, target) => {
+    const targetDir = target.replace(/^\.\//, '').split('*')[0] ?? '';
+    const suffix = target.slice(target.indexOf('*') + 1);
+    const absolute = join(packageDir, targetDir);
+    if (!existsSync(absolute))
+        return [];
+    const expanded = [];
+    const walk = (directory, prefix) => {
+        for (const entry of readdirSync(directory, { withFileTypes: true })) {
+            if (entry.isDirectory()) {
+                walk(join(directory, entry.name), `${prefix}${entry.name}/`);
+                continue;
+            }
+            if (!entry.isFile())
+                continue;
+            if (suffix && !entry.name.endsWith(suffix))
+                continue;
+            const stem = wildcardStem(entry.name);
+            if (stem === null)
+                continue;
+            expanded.push({
+                subpath: subpath.replace('*', `${prefix}${stem}`),
+                target: `${targetDir}${prefix}${entry.name}`,
+            });
+        }
+    };
+    walk(absolute, '');
+    return expanded;
+};
+const targetOf = (value) => {
+    if (typeof value === 'string')
+        return value;
+    if (!value || typeof value !== 'object')
+        return null;
+    const conditions = value;
+    for (const key of ['types', 'import', 'default', 'require']) {
+        const resolved = targetOf(conditions[key]);
+        if (resolved)
+            return resolved;
+    }
+    return null;
+};
+const readJson = async (path) => {
+    try {
+        return JSON.parse(await readFile(path, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+};
+const readCompilerOptions = async (packageDir) => {
+    const configPath = join(packageDir, 'tsconfig.json');
+    if (!existsSync(configPath))
+        return { outDir: 'dist', paths: {} };
+    const configFile = ts.readConfigFile(configPath, ts.sys.readFile);
+    if (configFile.error)
+        return { outDir: 'dist', paths: {} };
+    const { options } = ts.parseJsonConfigFileContent(configFile.config, ts.sys, packageDir);
+    const { baseUrl, paths, pathsBasePath } = options;
+    return {
+        outDir: options.outDir ? relative(packageDir, options.outDir) : 'dist',
+        paths: {
+            ...(baseUrl !== undefined ? { baseUrl } : {}),
+            ...(paths !== undefined ? { paths } : {}),
+            ...(pathsBasePath !== undefined ? { pathsBasePath } : {}),
+        },
+    };
+};
+const KIND_BY_FLAG = [
+    [ts.SymbolFlags.Class, 'class'],
+    [ts.SymbolFlags.Interface, 'interface'],
+    [ts.SymbolFlags.RegularEnum | ts.SymbolFlags.ConstEnum, 'enum'],
+    [ts.SymbolFlags.Function, 'function'],
+    [ts.SymbolFlags.TypeAlias, 'type'],
+    [ts.SymbolFlags.Namespace, 'namespace'],
+];
+const kindOf = (symbol, checker) => {
+    const target = symbol.flags & ts.SymbolFlags.Alias
+        ? checker.getAliasedSymbol(symbol)
+        : symbol;
+    for (const [flag, kind] of KIND_BY_FLAG) {
+        if (target.flags & flag)
+            return kind;
+    }
+    if (target.flags & ts.SymbolFlags.Variable) {
+        const declaration = target.declarations?.[0];
+        if (declaration) {
+            const type = checker.getTypeOfSymbolAtLocation(target, declaration);
+            if (type.getCallSignatures().length > 0)
+                return 'function';
+        }
+        return 'const';
+    }
+    return 'const';
+};
+const isDeprecated = (symbol) => symbol.getJsDocTags().some((tag) => tag.name === 'deprecated');
+const declarationFileOf = (symbol, checker) => {
+    const target = symbol.flags & ts.SymbolFlags.Alias
+        ? checker.getAliasedSymbol(symbol)
+        : symbol;
+    const declaration = target.declarations?.[0] ?? symbol.declarations?.[0];
+    return declaration?.getSourceFile().fileName ?? null;
+};
+export const collectSurface = async (packageDir) => {
+    const root = resolve(packageDir);
+    const packageJson = await readJson(join(root, 'package.json'));
+    if (!packageJson?.exports)
+        return [];
+    const { outDir, paths } = await readCompilerOptions(root);
+    const packageName = packageJson.name ?? '';
+    const entries = [];
+    const seenEntryFiles = new Set();
+    for (const [subpath, value] of Object.entries(subpathMap(packageJson.exports))) {
+        if (!subpath.startsWith('.'))
+            continue;
+        const target = targetOf(value);
+        if (!target || !publishesCode(target))
+            continue;
+        const declared = target.includes('*')
+            ? expandWildcard(root, subpath, target)
+            : [{ subpath, target }];
+        for (const each of declared) {
+            const entryFile = sourceForTarget(root, each.target, outDir);
+            if (!entryFile || seenEntryFiles.has(entryFile))
+                continue;
+            seenEntryFiles.add(entryFile);
+            entries.push({
+                subpath: each.subpath,
+                specifier: each.subpath === '.'
+                    ? packageName
+                    : `${packageName}${each.subpath.slice(1)}`,
+                entryFile,
+            });
+        }
+    }
+    if (entries.length === 0)
+        return [];
+    const program = ts.createProgram(entries.map((entry) => join(root, entry.entryFile)), {
+        ...paths,
+        target: ts.ScriptTarget.ESNext,
+        module: ts.ModuleKind.Node16,
+        moduleResolution: ts.ModuleResolutionKind.Node16,
+        skipLibCheck: true,
+        skipDefaultLibCheck: true,
+        types: [],
+        allowJs: false,
+        checkJs: false,
+    });
+    const checker = program.getTypeChecker();
+    return entries.map((entry) => {
+        const sourceFile = program.getSourceFile(join(root, entry.entryFile));
+        const moduleSymbol = sourceFile
+            ? checker.getSymbolAtLocation(sourceFile)
+            : undefined;
+        const symbols = [];
+        for (const symbol of moduleSymbol
+            ? checker.getExportsOfModule(moduleSymbol)
+            : []) {
+            const file = declarationFileOf(symbol, checker);
+            symbols.push({
+                name: symbol.getName(),
+                kind: kindOf(symbol, checker),
+                declaredAt: file ? relative(root, file) : entry.entryFile,
+                deprecated: isDeprecated(symbol),
+            });
+        }
+        return { ...entry, symbols };
+    });
+};

package/dist/src/functions/validate/type-identity-checks.d.ts

@@ -0,0 +1,25 @@
+import type { ValidateFinding } from './persona-checks.js';
+/**
+ * A linked dependency resolves its own imports from its own checkout, so it can
+ * hand the project types built against a different version of a shared package.
+ * The symptom is a typecheck that OOMs rather than one that fails, so nothing
+ * else in this validator would catch it.
+ *
+ * Runs against the workspace root only. The mismatch is a property of the
+ * install, not of any one package in it, so running per workspace package would
+ * report the same pair once per package.
+ */
+export declare function runTypeIdentityChecks(root: string): Promise<ValidateFinding[]>;
+/**
+ * Preflight for codegen. Runs BEFORE the typecheck, because the failure it
+ * explains kills the process rather than failing it: a V8 heap OOM aborts, so
+ * nothing printed after the fact is ever seen. By the time the user has a
+ * symptom, the only thing that can help them is already on screen above it.
+ *
+ * Warns rather than throws. A skewed linked dependency is a strong signal, not
+ * a certainty — plenty of them are harmless, and refusing to build on one would
+ * break working setups over a heuristic.
+ */
+export declare function warnOnSplitTypeIdentity(rootDir: string, logger: {
+    warn: (message: string) => void;
+}): Promise<void>;

package/dist/src/functions/validate/type-identity-checks.js

@@ -0,0 +1,218 @@
+import { existsSync } from 'node:fs';
+import { lstat, readdir, realpath } from 'node:fs/promises';
+import { dirname, join, relative } from 'node:path';
+import { ErrorCode } from '@pikku/inspector';
+import { readJsonSafe } from './shared-checks.js';
+/**
+ * Packages whose TYPE identity matters, not just their runtime identity.
+ *
+ * Two copies of one of these at different versions give TypeScript two
+ * unrelated declarations of the same interface, and every place they meet
+ * becomes a structural comparison of the full shape. Inside a generic inference
+ * chain that compounds: one project went from a 1.3GB/13s typecheck to an
+ * unbounded OOM (8GB and 12GB ceilings both died, 7.7M types, single
+ * assignability checks taking 8s) because one dependency's `dist` was symlinked
+ * into a sibling checkout that carried its own better-auth. It reads as "codegen
+ * is slow", never as a version problem, which is why it is worth a check.
+ *
+ * Distinct from the duplicate-copy check, which is two copies of the SAME
+ * version splitting module state at runtime. This is a compile-time blow-up and
+ * only fires when the versions differ.
+ */
+const TYPE_IDENTITY_PKGS = [
+    'better-auth',
+    '@better-auth/core',
+    '@pikku/core',
+    'kysely',
+    'zod',
+];
+/**
+ * Installed version of `pkg` as seen FROM `fromDir`, walking parent
+ * node_modules the way node resolution does. Used to ask what a linked
+ * dependency resolves in its own checkout, which is not what the project
+ * resolves.
+ */
+async function versionResolvedFrom(fromDir, pkg) {
+    let dir = fromDir;
+    for (;;) {
+        const j = await readJsonSafe(join(dir, 'node_modules', pkg, 'package.json'));
+        if (j?.version)
+            return j.version;
+        const parent = dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+/**
+ * Where `pkg` resolves for the project itself. The root alone is not enough:
+ * an isolated/pnpm-style install (bun's default) links dependencies under the
+ * workspace package that declares them and leaves the root node_modules
+ * without them, so probing only the root silently finds nothing.
+ */
+async function projectResolvedVersion(root, pkg) {
+    const bases = [root];
+    for (const group of ['packages', 'apps', 'backends']) {
+        const groupDir = join(root, group);
+        if (!existsSync(groupDir))
+            continue;
+        const entries = await readdir(groupDir, { withFileTypes: true }).catch(() => []);
+        for (const d of entries) {
+            if (d.isDirectory())
+                bases.push(join(groupDir, d.name));
+        }
+    }
+    for (const base of bases) {
+        const j = await readJsonSafe(join(base, 'node_modules', pkg, 'package.json'));
+        if (j?.version)
+            return { version: j.version, from: base };
+    }
+    return null;
+}
+/**
+ * Dependencies whose code physically lives outside the project: a `link:` or
+ * `portal:` dep, or a hand-made symlink into a sibling checkout. Only these can
+ * introduce a second version of a type-identity package, because a normal
+ * install dedupes through the lockfile.
+ *
+ * The symlink is often NOT the package directory but a build output inside it
+ * (`node_modules/@scope/pkg/dist -> ../../../other-repo/packages/pkg/dist`),
+ * which still moves type resolution to the other tree since TypeScript resolves
+ * symlinks to their realpath. So each candidate subdir is probed too.
+ *
+ * Only symlinks are resolved. `realpath` lstats every component of the path, so
+ * running it over every installed package costs 20x more on a hoisted install
+ * (1781 packages at the root) than on an isolated one (35) — and a path that
+ * traverses no symlink cannot leave the project anyway. `readdir` already hands
+ * back the entry type, so ruling a package out is free.
+ */
+async function externalDependencyRoots(root) {
+    const found = new Map();
+    const nodeModules = join(root, 'node_modules');
+    if (!existsSync(nodeModules))
+        return found;
+    // Compare realpath against realpath: on macOS the temp/project path is often
+    // itself a symlink (/var -> /private/var), which would otherwise make every
+    // dependency look external.
+    const realRoot = await realpath(root).catch(() => root);
+    const topLevel = await readdir(nodeModules, { withFileTypes: true }).catch(() => []);
+    const pkgDirs = [];
+    for (const entry of topLevel) {
+        if (entry.name.startsWith('.'))
+            continue;
+        if (entry.name.startsWith('@')) {
+            const scoped = await readdir(join(nodeModules, entry.name), {
+                withFileTypes: true,
+            }).catch(() => []);
+            for (const inner of scoped) {
+                pkgDirs.push({
+                    dir: join(nodeModules, entry.name, inner.name),
+                    link: inner.isSymbolicLink(),
+                });
+            }
+        }
+        else {
+            pkgDirs.push({
+                dir: join(nodeModules, entry.name),
+                link: entry.isSymbolicLink(),
+            });
+        }
+    }
+    const linkTarget = async (path) => {
+        const stats = await lstat(path).catch(() => null);
+        if (!stats?.isSymbolicLink())
+            return null;
+        return realpath(path).catch(() => null);
+    };
+    const isExternal = (real) => relative(realRoot, real).startsWith('..');
+    for (const { dir: pkgDir, link } of pkgDirs) {
+        // A package linked to a path inside the project (bun's .bun store) is not
+        // external, but the build output *inside* that target still can be.
+        const target = link ? await realpath(pkgDir).catch(() => null) : null;
+        if (link && !target)
+            continue;
+        const candidates = [
+            target && isExternal(target) ? target : null,
+            await linkTarget(join(target ?? pkgDir, 'dist')),
+        ];
+        for (const real of candidates) {
+            if (!real || !isExternal(real))
+                continue;
+            const name = relative(nodeModules, pkgDir);
+            // `real` may point at a build output (…/pkg/dist); report the linked
+            // package's own root so the message names something a reader can act on.
+            let owner = real;
+            while (!existsSync(join(owner, 'package.json')) &&
+                dirname(owner) !== owner) {
+                owner = dirname(owner);
+            }
+            if (!found.has(name))
+                found.set(name, owner);
+            break;
+        }
+    }
+    return found;
+}
+/**
+ * A linked dependency resolves its own imports from its own checkout, so it can
+ * hand the project types built against a different version of a shared package.
+ * The symptom is a typecheck that OOMs rather than one that fails, so nothing
+ * else in this validator would catch it.
+ *
+ * Runs against the workspace root only. The mismatch is a property of the
+ * install, not of any one package in it, so running per workspace package would
+ * report the same pair once per package.
+ */
+export async function runTypeIdentityChecks(root) {
+    const findings = [];
+    const external = await externalDependencyRoots(root);
+    if (external.size === 0)
+        return findings;
+    for (const pkg of TYPE_IDENTITY_PKGS) {
+        const local = await projectResolvedVersion(root, pkg);
+        if (!local)
+            continue;
+        const ours = local.version;
+        for (const [depName, depRoot] of external) {
+            const theirs = await versionResolvedFrom(depRoot, pkg);
+            if (!theirs || theirs === ours)
+                continue;
+            findings.push({
+                id: `split-type-identity-${depName.replace(/[@/]/g, '-')}-${pkg.replace(/[@/]/g, '-')}`,
+                severity: 'error',
+                message: `"${depName}" is linked to ${depRoot} and resolves ${pkg}@${theirs} there, while this project resolves ${pkg}@${ours} — two type identities for ${pkg}`,
+                path: join(root, 'node_modules', depName),
+                fixHint: [
+                    `TypeScript treats the two ${pkg} declarations as unrelated types and structurally compares them wherever they meet, which can make a typecheck OOM instead of fail.`,
+                    `Align the versions so both trees resolve one ${pkg}: either bump ${pkg} to ${theirs} here, or to ${ours} in ${depRoot}.`,
+                    `If the link is no longer needed, remove it and reinstall so "${depName}" comes from the registry.`,
+                ].join('\n'),
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * Preflight for codegen. Runs BEFORE the typecheck, because the failure it
+ * explains kills the process rather than failing it: a V8 heap OOM aborts, so
+ * nothing printed after the fact is ever seen. By the time the user has a
+ * symptom, the only thing that can help them is already on screen above it.
+ *
+ * Warns rather than throws. A skewed linked dependency is a strong signal, not
+ * a certainty — plenty of them are harmless, and refusing to build on one would
+ * break working setups over a heuristic.
+ */
+export async function warnOnSplitTypeIdentity(rootDir, logger) {
+    if (process.env?.PIKKU_SKIP_TYPE_IDENTITY_CHECK)
+        return;
+    const findings = await runTypeIdentityChecks(rootDir).catch(() => []);
+    if (findings.length === 0)
+        return;
+    logger.warn(`[${ErrorCode.SPLIT_TYPE_IDENTITY}] ${findings.length === 1 ? 'A linked dependency resolves a shared package' : 'Linked dependencies resolve shared packages'} at a different version than this project:\n` +
+        findings.map((f) => `  ${f.message}`).join('\n') +
+        `\nTypeScript treats each pair as two unrelated types and structurally compares them\n` +
+        `wherever they meet, which inside a generic inference chain can exhaust the heap —\n` +
+        `codegen then dies of memory pressure instead of reporting an error.\n\n` +
+        `Fix: align the versions so both trees resolve one copy, or drop the link and\n` +
+        `reinstall. Set PIKKU_SKIP_TYPE_IDENTITY_CHECK=1 to silence this.`);
+}

package/dist/src/functions/validate/validate-registry.js

@@ -3,6 +3,7 @@ import { readdir } from 'node:fs/promises';
 import { join, relative } from 'node:path';
 import { isAddonPackage, runAddonPackageChecks, } from './addon-package-checks.js';
 import { runSharedProjectChecks } from './shared-checks.js';
+import { runTypeIdentityChecks } from './type-identity-checks.js';
 /** A hand-written `types/application-types.d.ts` beside package.json. */
 const ADDON_MARKER = join('types', 'application-types.d.ts');
 const SKIP_DIRS = new Set([
@@ -68,6 +69,16 @@ export const CHECKS = [
         applies: async ({ dir }) => isAddonPackage(dir),
         run: async ({ dir }) => runAddonPackageChecks(dir),
     },
+    {
+        id: 'type-identity',
+        subject: 'linked dependencies',
+        // Root of an installed tree only. A linked dependency is a property of the
+        // install as a whole, so running this per workspace package reports the
+        // same pair N times — and with nothing installed there is nothing to
+        // compare.
+        applies: async ({ dir, label }) => label === '.' && existsSync(join(dir, 'node_modules')),
+        run: async ({ dir }) => runTypeIdentityChecks(dir),
+    },
 ];
 export async function planValidation(root) {
     const plan = [];

package/dist/src/functions/wirings/auth/serialize-auth-gen.js

@@ -43,14 +43,14 @@ function variableSchemaName(name, field) {
 // silently displace it; global middleware is an append-only list, so that
 // hazard is gone.
 //
-// The session carries the two scope roots the console addon gates itself on.
-// Without them this token authenticates but authorizes nothing: `wireAddon`
-// gates the whole addon on `admin`, so every console:* RPC — reads included —
-// answers MissingScopeError, and an external console can reach the deployment
-// while being unable to do a single thing in it.
+// The session carries the two scope roots the console's functions gate
+// themselves on. Without them this token authenticates but authorizes nothing:
+// every console:* RPC — reads included — answers MissingScopeError, and an
+// external console can reach the deployment while being unable to do a single
+// thing in it.
 //
 // Roots rather than a wildcard: a parent grant satisfies its children, so
-// `admin` covers `admin:*` and `pikku` covers `pikku:scopes:*`/`pikku:audit:*`,
+// `admin` covers `admin:*` and `pikku` covers every `pikku:console:*` area,
 // which is every scope the console's own functions require. A `*` would also
 // hand the token every scope the HOST app declares, which is authority the
 // console never asks for.

package/dist/src/functions/wirings/scenarios/serialize-feature-meta.d.ts

@@ -1,4 +1,4 @@
-import type { FeaturesMeta } from '@pikku/core/workflow/types';
+import type { FeaturesMeta } from '@pikku/core/scenario';
 import type { InspectorFeature } from '@pikku/inspector';
 /**
  * The feature meta the console reads, built from what the inspector could read

package/dist/src/functions/wirings/scenarios/serialize-scenario-registration.js

@@ -11,11 +11,12 @@ export const serializeScenarioRegistration = (outputPath, metaImportPath, scenar
         return 'export {}';
     }
     const lines = [];
-    const registrars = [
-        ...(hasScenarios ? ['addWorkflow'] : []),
-        ...(hasFeatures ? ['addFeature'] : []),
-    ];
-    lines.push(`import { ${registrars.join(', ')} } from '@pikku/core/workflow'`);
+    if (hasScenarios) {
+        lines.push(`import { addWorkflow } from '@pikku/core/workflow'`);
+    }
+    if (hasFeatures) {
+        lines.push(`import { addFeature } from '@pikku/core/scenario'`);
+    }
     lines.push(`import '${metaImportPath}'`);
     const sortedScenarios = Array.from(scenarioFiles.entries()).sort((a, b) => a[0].localeCompare(b[0]));
     // A feature holds the very objects its scenarios were registered with, so it

package/dist/src/functions/wirings/workflow/serialize-personas.js

@@ -9,11 +9,8 @@
 export const serializePersonas = (personas, agentMapImportPath, rpcMapImportPath) => {
     return `/** Personas declared with definePersonas() */
 import { createHttpPersonas } from '@pikku/core/persona'
-import type {
-  HttpPersonasConfig,
-  ScenarioPersona,
-  ResolvedPersona,
-} from '@pikku/core/services'
+import type { HttpPersonasConfig } from '@pikku/core/persona'
+import type { ScenarioPersona, ResolvedPersona } from '@pikku/core/services'
 import type { AgentMap } from '${agentMapImportPath}'
 import type { FlattenedRPCMap } from '${rpcMapImportPath}'
 

package/dist/src/functions/wirings/workflow/serialize-workflow-types.js

@@ -6,7 +6,8 @@ import {
   type PikkuWorkflowGraphConfig,
   type PikkuWorkflowGraphResult,
 } from '@pikku/core/workflow'
-import type { PikkuWorkflowWire, PikkuScenarioWire, WorkflowStepOptions, ScenarioStepOptions } from '@pikku/core/workflow'
+import type { PikkuWorkflowWire, WorkflowStepOptions } from '@pikku/core/workflow'
+import type { PikkuScenarioWire, ScenarioStepOptions } from '@pikku/core/scenario'
 
 export { WorkflowCancelledException }
 import type { PikkuFunctionSessionless, PikkuFunctionConfig, WiredServices } from '${functionTypesImportPath}'

package/dist/src/functions/workflows/all.workflow.js

@@ -1,6 +1,7 @@
 import { existsSync } from 'fs';
 import { pikkuWorkflowComplexFunc } from '#pikku/workflow/pikku-workflow-types.gen.js';
 import { assertSingleCoreVersion } from '../../utils/assert-single-core-version.js';
+import { warnOnSplitTypeIdentity } from '../validate/type-identity-checks.js';
 import { pruneLegacyScaffoldFiles, removeRetiredScaffoldFiles, } from '../../utils/remove-legacy-scaffold-file.js';
 import { PikkuTypecheckFailedError, renderTscFull, renderTscSummary, runProjectTypecheck, } from '../../utils/tsc-check.js';
 const scaffoldFiles = (config) => {
@@ -45,6 +46,10 @@ export const allWorkflow = pikkuWorkflowComplexFunc({
         // Preflight: a split @pikku/core install silently breaks wiring registration
         // (workflows/RPCs "disappear"), so refuse to codegen against it.
         await assertSingleCoreVersion(config.rootDir, logger);
+        // Preflight: a linked dependency at a skewed version can exhaust the heap
+        // during the typecheck below, and an OOM aborts before anything can explain
+        // it. Say it now or never.
+        await warnOnSplitTypeIdentity(config.rootDir, logger);
         await pruneLegacyScaffoldFiles(config);
         await removeRetiredScaffoldFiles(config);
         const allImports = [];