@pikku/cli 0.12.105 → 0.12.109

package/dist/.pikku/workflow/pikku-workflow-types.gen.js

@@ -1,78 +1,15 @@
 /**
- * This file was generated by @pikku/cli@0.12.105
+ * This file was generated by @pikku/cli@0.12.109
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
-import { template } from '@pikku/core/ecosystem/workflow';
 import { pikkuWorkflowGraph as corePikkuWorkflowGraph } from '@pikku/core/workflow';
 export { WorkflowCancelledException };
-export { template };
 export function pikkuWorkflowFunc(func) {
     return typeof func === 'function' ? { func } : func;
 }
 export function pikkuWorkflowComplexFunc(func) {
     return typeof func === 'function' ? { func } : func;
 }
-/**
- * Declares a scenario hook. Returns the function verbatim — a hook is never
- * registered, so this exists purely to give an inline hook a call site to be
- * contextually typed from, the way every other pikku primitive is.
- */
-export function pikkuScenarioHook(hook) {
-    return hook;
-}
-export function pikkuScenario(func) {
-    return typeof func === 'function' ? { func } : func;
-}
-/**
- * A feature: an ordered group of scenarios, mirroring gherkin's Feature ↔
- * Scenario structure. Scenarios are referenced by imported identifier, so a
- * renamed or deleted scenario is a compile error rather than a silent skip.
- *
- * A scenario does not have to belong to a feature — a void-input scenario
- * still runs standalone.
- *
- * ```ts
- * export const credentialFeature = pikkuFeature({
- *   name: 'Credential API',
- *   tags: ['credential'],
- *   before: startsMockOAuthServer,
- *   after: stopsMockOAuthServer,
- *   scenarios: [
- *     credentialLazyLoadScenario,
- *     ...['stripe', 'google'].map((name) => ({
- *       scenario: credentialRoundTripScenario,
- *       data: { name },
- *     })),
- *   ],
- * })
- * ```
- */
-export function pikkuFeature(config) {
-    return config;
-}
-export function pikkuScenarioStep(config) {
-    const surfaces = ['browser', 'cli', 'default'].filter((surface) => typeof config[surface] === 'function');
-    if (surfaces.length === 0) {
-        throw new Error(`[scenario] step '${config.name}' declares no surface bindings. Add at least a \`default\` (server-side) implementation.`);
-    }
-    return {
-        ...config,
-        surfaces,
-        // The runner sets the surface on the wire and calls this once per binding it
-        // resolved — every witness of a `then`, exactly one for an action step.
-        func: (services, data, wire) => {
-            const surface = wire?.scenarioStep?.surface ?? 'default';
-            const binding = config[surface] ?? config.default;
-            return binding(services, data, wire);
-        },
-    };
-}
-export function pikkuPlatformScenarioStep(config) {
-    return { ...config, surfaces: ['default'] };
-}
-export function pikkuAddonScenarioStep(config) {
-    return { ...config, surfaces: ['default'] };
-}
 export function pikkuWorkflowGraph(config) {
     return corePikkuWorkflowGraph(config);
 }

package/dist/.pikku/workflow/pikku-workflow-wirings-meta.gen.js

@@ -1,7 +1,7 @@
 /**
- * This file was generated by @pikku/cli@0.12.105
+ * This file was generated by @pikku/cli@0.12.109
  */
-import { pikkuState } from '@pikku/core/ecosystem';
+import { pikkuState } from '@pikku/core/state';
 import allWorkflowMeta from './meta/allWorkflow.gen.json' with { type: 'json' };
 const workflowsMeta = {
     'allWorkflow': allWorkflowMeta,

package/dist/.pikku/workflow/pikku-workflow-wirings.gen.d.ts

@@ -1,2 +1 @@
 import './pikku-workflow-wirings-meta.gen.js';
-export type WorkflowNames = 'allWorkflow';

package/dist/.pikku/workflow/pikku-workflow-wirings.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.105
+ * This file was generated by @pikku/cli@0.12.109
  */
 import { addWorkflow } from '@pikku/core/workflow';
 import './pikku-workflow-wirings-meta.gen.js';

package/dist/bin/pikku-bin.mjs

@@ -11,8 +11,8 @@ async function checkForUpdate() {
     })
     if (!res.ok) return
     const { version: latest } = await res.json()
-    if (latest !== '0.12.105') {
-      process.stderr.write(`\n  Update available  0.12.105 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
+    if (latest !== '0.12.109') {
+      process.stderr.write(`\n  Update available  0.12.109 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
     }
   } catch {}
 }

package/dist/src/cli.wiring.js

@@ -143,51 +143,66 @@ wireCLI({
                 },
                 filter: {
                     description: 'Named filter(s) from pikku.config.json filters map (comma-separated)',
+                    type: 'string[]',
                 },
                 tags: {
                     description: 'Include functions by tags (comma-separated)',
                     short: 't',
+                    type: 'string[]',
                 },
                 wires: {
                     description: 'Filter direct wirings by category (comma-separated)',
+                    type: 'string[]',
                 },
                 excludeWires: {
                     description: 'Exclude direct wirings by category (comma-separated)',
+                    type: 'string[]',
                 },
                 excludeTags: {
                     description: 'Exclude functions by tags (comma-separated)',
+                    type: 'string[]',
                 },
                 directories: {
                     description: 'Include functions by directories (comma-separated)',
                     short: 'd',
+                    type: 'string[]',
                 },
                 excludeDirectories: {
                     description: 'Exclude functions by directories (comma-separated)',
+                    type: 'string[]',
                 },
                 httpMethods: {
                     description: 'Include HTTP routes by methods (comma-separated)',
+                    type: 'string[]',
                 },
                 excludeHttpMethods: {
                     description: 'Exclude HTTP routes by methods (comma-separated)',
+                    type: 'string[]',
                 },
                 httpRoutes: {
                     description: 'Include HTTP routes by route patterns (comma-separated)',
+                    type: 'string[]',
                 },
                 excludeHttpRoutes: {
                     description: 'Exclude HTTP routes by route patterns (comma-separated)',
+                    type: 'string[]',
                 },
                 names: {
                     description: 'Include functions by name patterns (supports wildcards)',
                     short: 'n',
+                    type: 'string[]',
                 },
                 excludeNames: {
                     description: 'Exclude functions by name patterns (supports wildcards)',
+                    type: 'string[]',
                 },
                 target: {
                     description: 'Include functions by deploy target (comma-separated: serverless, server)',
+                    type: 'string[]',
                 },
                 excludeTarget: {
                     description: 'Exclude functions by deploy target (comma-separated: serverless, server)',
+                    type: 'string[]',
                 },
                 forceRelativeImports: {
                     description: 'Emit relative imports even when packageMappings would apply (used by per-unit deploy codegen)',
@@ -539,14 +554,15 @@ wireCLI({
                             default: false,
                         },
                         video: {
-                            description: 'Record a video per scenario alongside the screenshots (implies --screenshots)',
-                            default: false,
+                            description: 'Which scenarios keep their recording: "failed" (the default), "all", or "off" to record nothing. Recording is decided when a window opens, before the outcome is known, so keeping only failures still records every scenario and discards the passes',
+                            choices: ['off', 'failed', 'all'],
+                            default: 'failed',
                         },
                         apiUrl: {
                             description: "Override the environment's apiUrl for this run — for a target that only exists at run time, such as a freshly deployed sandbox",
                         },
                         appUrl: {
-                            description: "Override the environment's appUrl for this run (the frontend browser steps navigate against)",
+                            description: "Override the environment's appUrl for this run (the frontend browser steps navigate against). One url for everybody, or `<app>=<url>` pairs for a product whose personas sign into different apps — comma-separated, and a bare url is the fallback",
                         },
                     },
                 }),
@@ -665,72 +681,30 @@ wireCLI({
                 rpc: pikkuCLICommand({
                     func: enableRpc,
                     description: 'Enable public RPC endpoint',
-                    options: {
-                        noAuth: {
-                            description: 'Disable auth requirement',
-                            default: false,
-                        },
-                    },
                 }),
                 console: pikkuCLICommand({
                     func: enableConsole,
                     description: 'Enable console functions',
-                    options: {
-                        noAuth: {
-                            description: 'Disable auth requirement',
-                            default: false,
-                        },
-                    },
                 }),
                 scenarios: pikkuCLICommand({
                     func: enableScenarios,
                     description: 'Enable scenario instrumentation functions',
-                    options: {
-                        noAuth: {
-                            description: 'Disable auth requirement',
-                            default: false,
-                        },
-                    },
                 }),
                 agent: pikkuCLICommand({
                     func: enableAgent,
                     description: 'Enable public agent endpoints',
-                    options: {
-                        noAuth: {
-                            description: 'Disable auth requirement',
-                            default: false,
-                        },
-                    },
                 }),
                 workflow: pikkuCLICommand({
                     func: enableWorkflow,
                     description: 'Enable workflow workers',
-                    options: {
-                        noAuth: {
-                            description: 'Disable auth requirement',
-                            default: false,
-                        },
-                    },
                 }),
                 events: pikkuCLICommand({
                     func: enableEvents,
                     description: 'Enable the realtime events channel + SSE stream (scaffolds events.gen.ts)',
-                    options: {
-                        noAuth: {
-                            description: 'Disable auth requirement',
-                            default: false,
-                        },
-                    },
                 }),
                 'remote-rpc': pikkuCLICommand({
                     func: enableRemoteRpc,
                     description: 'Enable the remote internal RPC queue worker + HTTP endpoint (scaffolds rpc-remote.gen.ts)',
-                    options: {
-                        noAuth: {
-                            description: 'Disable auth requirement',
-                            default: false,
-                        },
-                    },
                 }),
                 webhook: pikkuCLICommand({
                     func: enableWebhook,

package/dist/src/deploy/analyzer/analyzer.js

@@ -363,13 +363,29 @@ export function analyzeDeployment(state, options) {
             unresolvedSecretReads.push(`${relative(state.rootDir, file)}:${read}`);
         }
     }
-    const secrets = state.secrets.definitions.map((s) => ({
-        secretId: s.secretId,
-        displayName: s.displayName,
-        description: s.description,
-        allowedHosts: s.allowedHosts,
-        read: readSecretIds.has(s.secretId),
-    }));
+    // Keyed by `secretId`, because the manifest describes *provisioned resources*
+    // and the secretId is the resource. Two `defineSecret` calls may legally name
+    // the same secretId under different local `name`s — the auth scaffold's
+    // `betterAuthSecret` and a hand-written `authSecret` both pointing at
+    // BETTER_AUTH_SECRET is the everyday case — and validation permits it. Mapped
+    // straight through, that emitted the same secret twice, so the plan printed
+    // two identical `create` lines for one resource and `countUnchanged` counted
+    // it twice. First definition wins, matching validate-secret-definitions.
+    // Variables are already collapsed downstream in the planner; doing both here
+    // keeps the manifest itself canonical rather than relying on each consumer.
+    const secretsById = new Map();
+    for (const s of state.secrets.definitions) {
+        if (secretsById.has(s.secretId))
+            continue;
+        secretsById.set(s.secretId, {
+            secretId: s.secretId,
+            displayName: s.displayName,
+            description: s.description,
+            allowedHosts: s.allowedHosts,
+            read: readSecretIds.has(s.secretId),
+        });
+    }
+    const secrets = [...secretsById.values()];
     const unscopedSecretAddons = [];
     const unscopedCredentialAddons = [];
     const grantedSecretAddons = [];
@@ -410,11 +426,17 @@ export function analyzeDeployment(state, options) {
         }
     }
     const byNamespace = (a, b) => a.namespace.localeCompare(b.namespace);
-    const variables = state.variables.definitions.map((v) => ({
-        variableId: v.variableId,
-        displayName: v.displayName,
-        description: v.description,
-    }));
+    const variablesById = new Map();
+    for (const v of state.variables.definitions) {
+        if (variablesById.has(v.variableId))
+            continue;
+        variablesById.set(v.variableId, {
+            variableId: v.variableId,
+            displayName: v.displayName,
+            description: v.description,
+        });
+    }
+    const variables = [...variablesById.values()];
     return {
         projectId: options.projectId,
         manifestVersion: 1,

package/dist/src/deploy/build-pipeline.d.ts

@@ -5,6 +5,7 @@
  * Outputs everything to .deploy/<provider>/ without deploying.
  */
 import type { InspectorState } from '@pikku/inspector';
+import { PikkuError } from '@pikku/core/errors';
 import type { DeploymentManifest } from './analyzer/manifest.js';
 import type { Bundler } from './bundler/bundler.interface.js';
 import type { BundleResult } from './bundler/types.js';
@@ -30,6 +31,18 @@ export interface BuildPipelineResult {
         error: string;
     }>;
 }
+/**
+ * A unit that failed codegen or bundling is an expected build outcome (the
+ * gate did its job) — a PikkuError makes the runner log the message alone,
+ * without a stack trace.
+ */
+export declare class PikkuDeployBuildFailedError extends PikkuError {
+}
+/**
+ * The message for a build that produced an incomplete artifact, or `null`
+ * when every unit was generated and bundled.
+ */
+export declare function describeBuildFailure(result: Pick<BuildPipelineResult, 'bundleErrors' | 'codegenErrors'>): string | null;
 export declare function runBuildPipeline(options: {
     projectDir: string;
     projectId: string;

package/dist/src/deploy/build-pipeline.js

@@ -7,10 +7,32 @@
 import { join } from 'node:path';
 import { existsSync } from 'node:fs';
 import { mkdir, writeFile, copyFile } from 'node:fs/promises';
+import { PikkuError } from '@pikku/core/errors';
 import { analyzeDeployment } from './analyzer/index.js';
 import { withoutScenarios } from '../functions/wirings/scenarios/scenario-partition.js';
 import { generatePerUnitCodegen } from './codegen/per-unit-codegen.js';
 import { generateServerEntrySource, SERVER_DOCKERFILE, SERVER_DOCKERIGNORE, } from './server-entry.js';
+/**
+ * A unit that failed codegen or bundling is an expected build outcome (the
+ * gate did its job) — a PikkuError makes the runner log the message alone,
+ * without a stack trace.
+ */
+export class PikkuDeployBuildFailedError extends PikkuError {
+}
+/**
+ * The message for a build that produced an incomplete artifact, or `null`
+ * when every unit was generated and bundled.
+ */
+export function describeBuildFailure(result) {
+    const failures = [
+        ...result.codegenErrors.map((e) => `codegen ${e.unitName}: ${e.error}`),
+        ...result.bundleErrors.map((e) => `bundle ${e.unitName}: ${e.error}`),
+    ];
+    if (failures.length === 0) {
+        return null;
+    }
+    return `Deploy build failed — ${failures.length} unit(s) did not build:\n  ${failures.join('\n  ')}`;
+}
 const MERGED_SERVER_UNIT_NAME = 'pikku-server-container';
 const UNITS_DIR_NAME = 'units';
 const CONTAINER_DIR_NAME = 'container';

package/dist/src/deploy/server-entry.js

@@ -14,7 +14,7 @@ export function generateServerEntrySource(ctx) {
     const lines = [
         `// Generated server entry for "${ctx.unit.name}" (${ctx.unit.role})`,
         `import { PikkuNodeHTTPServer } from '@pikku/node-http-server'`,
-        `import { pikkuState } from '@pikku/core/ecosystem'`,
+        `import { pikkuState } from '@pikku/core/state'`,
         ctx.configImport,
         ctx.servicesImport,
         ctx.mcpImport,