@pikku/cli 0.12.105 → 0.12.109

package/dist/src/fabric/functions/validate.function.js

@@ -3,11 +3,13 @@ import { readFile, readdir } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { createRequire } from 'node:module';
-import { pikkuSessionlessFunc } from '../../../.pikku/pikku-types.gen.js';
+import { pikkuSessionlessFunc } from '../../../.pikku/function/index.js';
 import { added, changed, removed, dim } from '../lib/output.js';
 import { typeCheckFrontends } from '../lib/frontend-typecheck.js';
 import { readJsonSafe, readTextSafe, runSharedProjectChecks, } from '../../functions/validate/shared-checks.js';
 import { runTypeIdentityChecks } from '../../functions/validate/type-identity-checks.js';
+import { migrationCreatesTable } from '../../functions/validate/shared-checks.js';
+import { isGitRepo, isTracked } from '../lib/git.js';
 const FindingSchema = z.object({
     id: z.string(),
     severity: z.enum(['error', 'warn', 'info']),
@@ -132,11 +134,17 @@ const LOGIN_FILE_PATTERN = /(?:^|\/)[\w[\]-]*(?:login|sign-?in)[\w[\]-]*(?:\/|\.
 // these means the app actually wires actor sign-in — the component's own
 // definition is excluded, since defining it without rendering it locks the
 // reviewer out just as thoroughly.
-// Canonical implementation: starter-template's DevActorSwitcher, rendered from
-// LoginPage and backed by signInAsActor() → POST /auth/sign-in/actor.
+//
+// Canonical implementation is now `<DevActorSwitcher>` from `@pikku/mantine/dev`
+// (built on `useDevActors` from `@pikku/react`), rendered from the login screen.
+// The hand-rolled shape the templates used to copy — a local component backed by
+// `signInAsActor()` → POST /auth/sign-in/actor — still passes: apps that predate
+// the package keep working, and the useDevActors call site is matched for apps
+// that want their own UI on the shared logic.
 const ACTOR_QUICK_LOGIN_PATTERNS = [
     /<\s*DevActorSwitcher\b/,
     /(?<!function\s)\bsignInAsActor\s*\(/,
+    /(?<!function\s)\buseDevActors\s*\(/,
     /\/auth\/sign-in\/actor/,
 ];
 // Minimum @pikku/* versions Fabric requires. The pikku packages are versioned
@@ -148,9 +156,14 @@ const ACTOR_QUICK_LOGIN_PATTERNS = [
 //     listening (the sandbox never serves routes).
 //   - @pikku/core mismatches split pikkuState into duplicate copies, so app
 //     and console routes 404; pin the floor that matches the runtime.
+//   - @pikku/cloudflare < 0.12.20 imports '@pikku/core/internal', a subpath no
+//     published @pikku/core exports, so every worker fails to resolve and the
+//     deploy ends at "0 workers bundled (0B total)". The broken import is in
+//     the dependency's own dist, which no source-level check can see.
 const PIKKU_MIN_VERSIONS = {
     '@pikku/cli': '0.12.43',
     '@pikku/core': '0.12.34',
+    '@pikku/cloudflare': '0.12.20',
 };
 // Pull major.minor.patch from a spec, ignoring range prefixes (^ ~ >=),
 // npm: aliases, and pre-release/build suffixes. null if no semver is present
@@ -213,6 +226,21 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
     const pikkuConfigPath = join(root, 'pikku.config.json');
     const rootPkgPath = join(root, 'package.json');
     const rootPkg = await readJsonSafe(rootPkgPath);
+    // ── packageManager ─────────────────────────────────────────────────────
+    // The build container is bun-only end to end — install, pikku codegen and
+    // the frontend build all run under bun — and it refuses the repository
+    // before cloning finishes if package.json declares anything else. Nothing
+    // else in validate reads packageManager, so a yarn or pnpm project passed
+    // every check here and then died on the first line of the deploy.
+    {
+        const declared = rootPkg?.packageManager;
+        if (!declared) {
+            e('package-manager-undeclared', 'package.json does not declare "packageManager" — Fabric is bun-only and the build container aborts with "Unsupported packageManager"', rootPkgPath, lines('Add it to the root package.json:', '  "packageManager": "bun@1.3.14"', 'then run `bun install` to generate bun.lock and commit both.'));
+        }
+        else if (!declared.startsWith('bun@')) {
+            e('package-manager-not-bun', `package.json declares packageManager "${declared}" — Fabric is bun-only and the build container aborts with "Unsupported packageManager"`, rootPkgPath, lines('Set the root package.json to bun:', '  "packageManager": "bun@1.3.14"', 'then migrate the lockfile:', '  bun install && rm -f yarn.lock pnpm-lock.yaml package-lock.json', 'and commit bun.lock.'));
+        }
+    }
     // ── pikkufabric.config.json ────────────────────────────────────────────
     // Not required to run validate — downgraded to info so any pikku project
     // can be checked for compatibility before it is linked to a fabric account.
@@ -224,6 +252,18 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
     else if (!fabricConfig.projectId) {
         info('fabric-config-no-project-id', 'pikkufabric.config.json is missing "projectId"', fabricConfigPath, lines('Edit `pikkufabric.config.json` and add:', '{', '  "projectId": "<your-project-id>"', '}', 'If you do not know the id yet, run `pikku fabric link`.'));
     }
+    else if ((await isGitRepo(root)) &&
+        !(await isTracked('pikkufabric.config.json', root))) {
+        // An error, unlike the three states around it. Those describe a project
+        // that has not been linked yet, which is a legitimate thing to validate.
+        // This one is a project that *is* linked and still cannot deploy: the build
+        // container clones the repository, so a config that exists only in the
+        // working tree is absent the moment it matters. Locally everything passes;
+        // remotely the deploy aborts with "pikkufabric.config.json not found in
+        // repository root". Nothing downstream of here can detect that, which is
+        // why it is caught at the one point that can.
+        e('fabric-config-untracked', 'pikkufabric.config.json is not committed — deploy clones the repository, so the build container will not see it and aborts with "pikkufabric.config.json not found in repository root"', fabricConfigPath, lines('Commit the file:', '  git add pikkufabric.config.json && git commit -m "chore: link to fabric"', 'Then check it is not being excluded:', '  git check-ignore -v pikkufabric.config.json', 'A .gitignore rule such as `*.config.json` or a broad `*.json` will swallow it.'));
+    }
     else if (fabricConfig.projectId === '__PROJECT_ID__') {
         info('fabric-config-placeholder-project-id', 'pikkufabric.config.json has a placeholder projectId ("__PROJECT_ID__") — project is not linked', fabricConfigPath, lines('The file exists but still contains the placeholder project id.', 'Run `pikku fabric link` to replace it automatically, or edit the file and set:', '"projectId": "<real-project-id>"'));
     }
@@ -315,7 +355,7 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
             const floorStr = PIKKU_MIN_VERSIONS[pkg];
             const floor = parseSemver(floorStr);
             if (floor && semverLt(seen.version, floor)) {
-                e(`pikku-version-below-min-${pkg.replace(/[@/]/g, '-')}`, `${pkg} is ${seen.version.join('.')} (spec "${seen.spec}") — Fabric requires >= ${floorStr}`, seen.manifest, lines(`Bump ${pkg} to ^${floorStr} (or newer) and reinstall:`, `  yarn up ${pkg}@^${floorStr}`, 'Then run `yarn install` and re-run `pikku fabric validate`.'));
+                e(`pikku-version-below-min-${pkg.replace(/[@/]/g, '-')}`, `${pkg} is ${seen.version.join('.')} (spec "${seen.spec}") — Fabric requires >= ${floorStr}`, seen.manifest, lines(`Bump ${pkg} to ^${floorStr} (or newer) and reinstall:`, `  bun add ${pkg}@^${floorStr}`, 'Then run `bun install` and re-run `pikku fabric validate`.'));
             }
         }
     }
@@ -505,30 +545,34 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
         const fnPkgPath = join(fnDir, 'package.json');
         const fnPkg = await readJsonSafe(fnPkgPath);
         if (fnPkg) {
-            // #pikku bare import — required by the injected fabric-telemetry.wiring.ts
-            if (!fnPkg.imports?.['#pikku']) {
-                e('functions-pkg-missing-pikku-import', 'packages/functions/package.json is missing a bare "#pikku" entry in "imports" — the Fabric-injected telemetry middleware imports from "#pikku" and will fail to bundle without it', fnPkgPath, 'Add to "imports": { "#pikku": "./.pikku/pikku-types.gen.ts", "#pikku/*": "./.pikku/*" }');
+            // Both patterns are required, and both are load-bearing: the `.js`-suffixed
+            // key resolves a deep generated file, the bare wildcard resolves a leaf
+            // name at that leaf's index. Node picks the longer suffix, so declaring
+            // only one silently loses half the surface.
+            const PIKKU_IMPORTS = 'Add to "imports": { "#pikku/*.js": "./.pikku/*.ts", "#pikku/*": "./.pikku/*/index.ts" }';
+            if (!fnPkg.imports?.['#pikku/*.js']) {
+                e('functions-pkg-missing-pikku-import', 'packages/functions/package.json is missing "#pikku/*.js" in "imports" — wiring files that import e.g. "#pikku/pikku-fetch.gen.js" fail at runtime with "Cannot find module"', fnPkgPath, PIKKU_IMPORTS);
             }
             if (!fnPkg.imports?.['#pikku/*']) {
-                e('functions-pkg-missing-pikku-wildcard-import', 'packages/functions/package.json is missing "#pikku/*" in "imports" — wiring files that import e.g. "#pikku/pikku-types.gen.js" fail at runtime with "Cannot find module"', fnPkgPath, 'Add to "imports": { "#pikku": "./.pikku/pikku-types.gen.ts", "#pikku/*": "./.pikku/*" }');
+                e('functions-pkg-missing-pikku-wildcard-import', 'packages/functions/package.json is missing "#pikku/*" in "imports" — files that import a leaf such as "#pikku/function" fail at runtime with "Cannot find module"', fnPkgPath, PIKKU_IMPORTS);
             }
-            // .pikku/pikku-types.gen.js wrapper — the sandbox runs `pikku dev` via
-            // bare Node.js (no tsx), which cannot load .ts files. Every .gen.ts in
-            // .pikku/ needs a matching .gen.js wrapper. The sandbox entrypoint creates
+            // .pikku leaf index .js wrapper — the sandbox runs `pikku dev` via
+            // bare Node.js (no tsx), which cannot load .ts files. Every .ts in
+            // .pikku/ needs a matching .js wrapper. The sandbox entrypoint creates
             // these during provisioning but NOT on subsequent restarts after agent
             // edits — so after any restart pikku dev crashes with
-            // "Cannot find module '#pikku/pikku-types.gen.js'". Run `pikku fabric smoke`
+            // "Cannot find module '#pikku/function'". Run `pikku fabric smoke`
             // to test locally; the smoke command recreates the wrappers automatically.
             {
-                const pikkuGenDir = join(fnDir, '.pikku');
-                const typesGenTs = join(pikkuGenDir, 'pikku-types.gen.ts');
-                const typesGenJs = join(pikkuGenDir, 'pikku-types.gen.js');
+                const leafDir = join(fnDir, '.pikku', 'function');
+                const indexTs = join(leafDir, 'index.ts');
+                const indexJs = join(leafDir, 'index.js');
                 // A warning, not an error: the wrapper is gitignored and recreated by
                 // the sandbox entrypoint and `fabric smoke`, so a freshly cloned or
                 // freshly scaffolded project never has it. As an error, "validate must
                 // pass clean" was unachievable from a clean checkout.
-                if (existsSync(typesGenTs) && !existsSync(typesGenJs)) {
-                    w('pikku-types-js-wrapper-missing', 'packages/functions/.pikku/pikku-types.gen.js is missing — the sandbox runs pikku dev via bare Node.js, which cannot load .ts files; without the .js wrapper it crashes with "Cannot find module \'#pikku/pikku-types.gen.js\'" on every restart', typesGenTs, lines('Create packages/functions/.pikku/pikku-types.gen.js:', "  import './pikku-types.gen.ts';", "  export * from './pikku-types.gen.ts';", 'Or run `pikku fabric smoke` to test the full boot locally (it creates the wrappers).', 'This file is gitignored — it must be recreated after every `pikku all` run.'));
+                if (existsSync(indexTs) && !existsSync(indexJs)) {
+                    w('pikku-types-js-wrapper-missing', 'packages/functions/.pikku/function/index.js is missing — the sandbox runs pikku dev via bare Node.js, which cannot load .ts files; without the .js wrapper it crashes with "Cannot find module \'#pikku/function\'" on every restart', indexTs, lines('Create packages/functions/.pikku/function/index.js:', "  import './index.ts';", "  export * from './index.ts';", 'Or run `pikku fabric smoke` to test the full boot locally (it creates the wrappers).', 'This file is gitignored — it must be recreated after every `pikku all` run.'));
                 }
             }
             const fnAllDeps = {
@@ -542,10 +586,10 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
             // CF worker runtime deps — must be in dependencies (not dev), every
             // worker entry resolves them at deploy time.
             if (!fnPkg.dependencies?.['@pikku/schema-cfworker']) {
-                e('missing-schema-cfworker', '@pikku/schema-cfworker is not in packages/functions dependencies — every Cloudflare worker entry requires it', fnPkgPath, 'Run `yarn add @pikku/schema-cfworker` in packages/functions — must be in dependencies, not devDependencies');
+                e('missing-schema-cfworker', '@pikku/schema-cfworker is not in packages/functions dependencies — every Cloudflare worker entry requires it', fnPkgPath, 'Run `bun add @pikku/schema-cfworker` in packages/functions — must be in dependencies, not devDependencies');
             }
             if (!fnPkg.dependencies?.['@pikku/kysely']) {
-                e('missing-pikku-kysely', '@pikku/kysely is not in packages/functions dependencies — every Cloudflare worker entry requires it (KyselySecretService)', fnPkgPath, 'Run `yarn add @pikku/kysely` in packages/functions — must be in dependencies, not devDependencies');
+                e('missing-pikku-kysely', '@pikku/kysely is not in packages/functions dependencies — every Cloudflare worker entry requires it (KyselySecretService)', fnPkgPath, 'Run `bun add @pikku/kysely` in packages/functions — must be in dependencies, not devDependencies');
             }
         }
         // Agent units require the AI SDK deps explicitly (not CI-injected). Gate on
@@ -554,16 +598,16 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
         if (agentMeta && Object.keys(agentMeta.agentsMeta ?? {}).length > 0) {
             const fnPkgPath = join(fnDir, 'package.json');
             if (!fnPkg?.dependencies?.['@pikku/ai-vercel']) {
-                e('missing-ai-vercel', 'Project declares agent units but @pikku/ai-vercel is not in packages/functions dependencies', fnPkgPath, 'Run `yarn add @pikku/ai-vercel` in packages/functions — must be in dependencies, not devDependencies');
+                e('missing-ai-vercel', 'Project declares agent units but @pikku/ai-vercel is not in packages/functions dependencies', fnPkgPath, 'Run `bun add @pikku/ai-vercel` in packages/functions — must be in dependencies, not devDependencies');
             }
             if (!fnPkg?.dependencies?.['@ai-sdk/openai-compatible']) {
-                e('missing-ai-sdk-openai-compatible', 'Project declares agent units but @ai-sdk/openai-compatible is not in packages/functions dependencies', fnPkgPath, 'Run `yarn add @ai-sdk/openai-compatible` in packages/functions — must be in dependencies, not devDependencies');
+                e('missing-ai-sdk-openai-compatible', 'Project declares agent units but @ai-sdk/openai-compatible is not in packages/functions dependencies', fnPkgPath, 'Run `bun add @ai-sdk/openai-compatible` in packages/functions — must be in dependencies, not devDependencies');
             }
             // `ai` is a peer dep of @pikku/ai-vercel — not auto-installed. Without it
             // `pikku dev` can't construct the agent runner and agents 503 with
             // AIProviderNotConfiguredError.
             if (!fnPkg?.dependencies?.['ai']) {
-                e('missing-ai-sdk-core', 'Project declares agent units but `ai` (the Vercel AI SDK) is not in packages/functions dependencies — it is a peer dependency of @pikku/ai-vercel and is not installed automatically', fnPkgPath, 'Run `yarn add ai` in packages/functions — must be in dependencies, not devDependencies');
+                e('missing-ai-sdk-core', 'Project declares agent units but `ai` (the Vercel AI SDK) is not in packages/functions dependencies — it is a peer dependency of @pikku/ai-vercel and is not installed automatically', fnPkgPath, 'Run `bun add ai` in packages/functions — must be in dependencies, not devDependencies');
             }
         }
         // services.ts — its absence is reported by runSharedProjectChecks; what
@@ -718,8 +762,7 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
         if (existsSync(migrationsDir)) {
             try {
                 const migFiles = (await readdir(migrationsDir)).filter((f) => f.endsWith('.sql'));
-                const hasAuditTable = (await Promise.all(migFiles.map((f) => readTextSafe(join(migrationsDir, f))))).some((sql) => sql &&
-                    /CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?audit\b/i.test(sql));
+                const hasAuditTable = (await Promise.all(migFiles.map((f) => readTextSafe(join(migrationsDir, f))))).some((sql) => !!sql && migrationCreatesTable(sql, 'audit'));
                 if (!hasAuditTable) {
                     info('audit-table-missing', 'No migration creates the audit table — Fabric audit events will be dropped', migrationsDir, lines('Add a new migration in this directory that creates an `audit` table.', 'Use the starter-template audit migration as the reference shape.', 'Expected columns come from `AuditEvent`:', '- eventId', '- type', '- source', '- outcome', '- occurredAt', '- functionId', '- wireType', '- wireId', '- traceId', '- transactionId', '- queryId', '- actor', '- input', '- metadata', 'At minimum, create the table so Fabric audit writes are not silently dropped.'));
                 }
@@ -736,6 +779,7 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
     // was supposed to report the broken config. Shape-check the entries once here
     // and let the apps/ and type-check passes consume the narrowed list.
     const declaredFrontends = [];
+    let hasMantineFrontend = false;
     /** every syntactically valid cwd, including ones whose directory is missing */
     const declaredCwdList = [];
     const rawFrontends = fabricConfig?.frontends;
@@ -821,6 +865,9 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
             const isReactFrontend = !!(appAllDeps['@mantine/core'] ||
                 appAllDeps['@pikku/mantine'] ||
                 appAllDeps['react']);
+            if (appAllDeps['@mantine/core'] || appAllDeps['@pikku/mantine']) {
+                hasMantineFrontend = true;
+            }
             if (isReactFrontend) {
                 const srcFiles = await listSourceFiles(join(appPath, 'src'));
                 let usesMessages = false;
@@ -914,7 +961,7 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
                     }
                 }
                 if (loginFiles.length > 0 && !hasQuickLogin) {
-                    e(`app-missing-actor-quick-login-${name}`, `apps/${name} has a login screen (${loginFiles[0]}) but no one-click actor sign-in — nobody can view the app as a scenario persona without a password`, join(appPath, loginFiles[0]), lines('Add the dev-only "Sign in as …" switcher and render it from the login screen:', '1. lib/auth: devActors() reading the DEV_ACTORS env var, and', '   signInAsActor(email) → POST `${apiUrl()}/auth/sign-in/actor`', '   with { email, secret } and credentials: "include".', '2. components/DevActorSwitcher.tsx: a Menu of the declared actors,', '   each Menu.Item signing in as that persona. Render null when', '   devActors() is empty, so it disappears in production.', `3. Render <DevActorSwitcher /> from ${loginFiles[0]}.`, 'Reference: templates/starter-template/apps/app/src/components/DevActorSwitcher.tsx.'));
+                    e(`app-missing-actor-quick-login-${name}`, `apps/${name} has a login screen (${loginFiles[0]}) but no one-click actor sign-in — nobody can view the app as a scenario persona without a password`, join(appPath, loginFiles[0]), lines('Render the dev-only "Sign in as …" switcher from the login screen.', `In ${loginFiles[0]}:`, "  import { DevActorSwitcher } from '@pikku/mantine/dev'", '  <DevActorSwitcher', '    actors={import.meta.env.DEV ? import.meta.env.VITE_DEV_ACTORS : undefined}', '    secret={import.meta.env.DEV ? import.meta.env.VITE_SCENARIO_ACTOR_SECRET : undefined}', '    apiUrl={apiUrl()}', "    onSignedIn={() => navigate({ to: '/' })}", '  />', 'The sandbox dev server bakes both env vars from your declared personas;', 'neither is set in production, so the control renders null there.', 'Gate the reads on import.meta.env.DEV as above so the secret never', 'reaches a production bundle. Next.js apps read the NEXT_PUBLIC_* pair.', 'For custom UI, build on useDevActors() from @pikku/react instead.'));
                 }
             }
         }
@@ -943,7 +990,7 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
                     }
                 }
                 if (installDirs.size > 1) {
-                    e(`dup-physical-copy-${name}-${pkg.replace(/[@/]/g, '-')}`, `apps/${name}: "${pkg}" resolves to ${installDirs.size} distinct physical copies — a module-singleton split (breaks TanStack Start dev SSR → frontend 404)`, appPath, lines(`"${pkg}" is installed more than once (e.g. one hoisted to the repo root and one nested under apps/${name}).`, `Declare "${pkg}" in exactly ONE workspace manifest (the root OR apps/${name}, not both), delete yarn.lock, and reinstall so it hoists to a single copy.`, '`resolutions` version-pins do NOT collapse a peer-virtualized duplicate.'));
+                    e(`dup-physical-copy-${name}-${pkg.replace(/[@/]/g, '-')}`, `apps/${name}: "${pkg}" resolves to ${installDirs.size} distinct physical copies — a module-singleton split (breaks TanStack Start dev SSR → frontend 404)`, appPath, lines(`"${pkg}" is installed more than once (e.g. one hoisted to the repo root and one nested under apps/${name}).`, `Declare "${pkg}" in exactly ONE workspace manifest (the root OR apps/${name}, not both), delete bun.lock, and reinstall so it hoists to a single copy.`, '`resolutions` version-pins do NOT collapse a peer-virtualized duplicate.'));
                 }
             }
         }
@@ -1016,9 +1063,12 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
     }
     // ── packages/theme + packages/components ──────────────────────────────
     const designDocUrl = 'https://pikkufabric.dev/docs/design';
+    const designSeverity = hasMantineFrontend ? w : info;
     const themePkgDir = join(root, 'packages', 'mantine-theme');
     if (!existsSync(themePkgDir)) {
-        info('theme-missing', 'packages/mantine-theme/ not found — Fabric design features require a theme package', themePkgDir, `Create packages/mantine-theme/ with your Mantine theme tokens. See ${designDocUrl}`);
+        designSeverity('theme-missing', hasMantineFrontend
+            ? 'packages/mantine-theme/ not found — the Fabric console Design tab has no themes to list and reports "No themes yet"'
+            : 'packages/mantine-theme/ not found — Fabric design features require a theme package', themePkgDir, `Create packages/mantine-theme/ with your Mantine theme tokens. See ${designDocUrl}`);
     }
     else {
         // The Fabric console's Design tab lists a theme only when it can read a
@@ -1042,7 +1092,7 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
             }
         }
         if (specIds.length === 0) {
-            info('theme-no-spec', 'packages/mantine-theme/ has no themes/<id>.json spec — the Fabric console Design tab reports "no theme set" (and cannot edit the theme) even if the app is branded via a hand-written createTheme()', themesDir, lines('Add a theme spec the console can read:', '1. Create packages/mantine-theme/themes/<id>.json (id is kebab-case), e.g.:', '{', '  "name": "My Brand",', '  "brand": { "colors": { "primary": "#4f46e5" }, "fonts": { "body": "Inter" } },', '  "structure": { "defaultRadius": "md", "defaultColorScheme": "light" }', '}', '2. Create packages/mantine-theme/active.json: { "id": "<id>" }', '3. Build the Mantine theme from the active spec in index.ts.', `See ${designDocUrl}`));
+            designSeverity('theme-no-spec', 'packages/mantine-theme/ has no themes/<id>.json spec — the Fabric console Design tab reports "no theme set" (and cannot edit the theme) even if the app is branded via a hand-written createTheme()', themesDir, lines('Add a theme spec the console can read:', '1. Create packages/mantine-theme/themes/<id>.json (id is kebab-case), e.g.:', '{', '  "name": "My Brand",', '  "brand": { "colors": { "primary": "#4f46e5" }, "fonts": { "body": "Inter" } },', '  "structure": { "defaultRadius": "md", "defaultColorScheme": "light" }', '}', '2. Create packages/mantine-theme/active.json: { "id": "<id>" }', '3. Build the Mantine theme from the active spec in index.ts.', `See ${designDocUrl}`));
         }
         else {
             // A spec exists — active.json must point at one, else the console has no
@@ -1059,8 +1109,21 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
             }
         }
     }
-    if (!existsSync(join(root, 'packages', 'components'))) {
-        info('components-missing', 'packages/components/ not found — Fabric design features require a components package', join(root, 'packages', 'components'), `Create packages/components/ with your shared UI components. See ${designDocUrl}`);
+    // The design server globs stories from apps/*/src/components, not packages/components.
+    const storyFiles = [];
+    let hasComponentKit = false;
+    for (const name of existsSync(appsDir) ? await readdir(appsDir) : []) {
+        const kitDir = join(appsDir, name, 'src', 'components');
+        if (!existsSync(kitDir))
+            continue;
+        hasComponentKit = true;
+        for (const file of await listSourceFiles(kitDir)) {
+            if (file.endsWith('.stories.tsx'))
+                storyFiles.push(file);
+        }
+    }
+    if (hasComponentKit && storyFiles.length === 0) {
+        designSeverity('design-no-stories', "no apps/*/src/components/**/*.stories.tsx found — the Fabric console Design tab's Library and App lenses have nothing to show", join(appsDir, '*', 'src', 'components'), lines('Add a story beside a component. The Library lens reads <Name>.stories.tsx', '(each named export is a visual variant); the App lens reads', '<Name>.app.stories.tsx (each named export is one data state of the query', 'or mutation the page drives it with). A minimal Library story:', '', "  import type { Story, StoryMeta } from './csf.types'", "  import { Wordmark } from './Wordmark'", '', '  export default {', "    title: 'Wordmark',", '    component: Wordmark,', '  } satisfies StoryMeta', '', "  export const Default: Story = { args: { name: 'Acme' } }", `See ${designDocUrl}`));
     }
     // ── frontend type-check (what the build container actually runs) ───────
     // Every check above is a heuristic standing in for this compile. The build
@@ -1129,6 +1192,26 @@ export const renderValidate = (_s, { ok, root, findings }) => {
     console.log(counts.join('  '));
     if (ok) {
         console.log();
-        console.log(added('✓') + '  ' + dim('no errors — project can be linked to fabric'));
+        // "can be linked" is not "will deploy", and conflating them is how a green
+        // validate is followed straight by a failed deploy. The three
+        // fabric-config findings are info on purpose — an unlinked project is
+        // still worth validating — but reporting unqualified success while the
+        // build container is guaranteed to abort on a missing config is the part
+        // that misleads. So the success line says which of the two it earned.
+        const notLinked = findings.find((f) => [
+            'fabric-config-missing',
+            'fabric-config-no-project-id',
+            'fabric-config-placeholder-project-id',
+        ].includes(f.id));
+        if (notLinked) {
+            console.log(added('✓') +
+                '  ' +
+                dim('no errors — but the project is not linked, so it cannot deploy yet'));
+            console.log('   ' +
+                dim(`${notLinked.message.split(' — ')[0]}. Run \`pikku fabric link\`.`));
+        }
+        else {
+            console.log(added('✓') + '  ' + dim('no errors — project can be linked to fabric'));
+        }
     }
 };

package/dist/src/fabric/lib/git.d.ts

@@ -51,3 +51,26 @@ export declare function assertDeploySafety(cwd?: string): Promise<DeploySafetyRe
  * target branch, not "whatever branch I happen to be on".
  */
 export declare function assertNamedBranchDeploySafety(branch: string, cwd?: string): Promise<DeploySafetyResult>;
+/**
+ * Is `relPath` tracked by git in `cwd`?
+ *
+ * Deploy clones the repository rather than uploading the working tree, so a
+ * file that exists only on disk does not exist for the build container. Any
+ * check that reads a required file locally has to ask this too, or it passes
+ * on the developer's machine and fails after the clone.
+ *
+ * Returns false rather than throwing when `cwd` is not a git repository. Note
+ * what that means for a caller: "not tracked" and "no repository at all" are
+ * the same answer, and only the first is a problem worth reporting — a project
+ * with no repository cannot be deployed by a clone in any case, and flagging an
+ * uncommitted file there is noise. Pair this with `isGitRepo` when the
+ * distinction matters.
+ */
+export declare function isTracked(relPath: string, cwd?: string): Promise<boolean>;
+/**
+ * Is `cwd` inside a git working tree?
+ *
+ * Separate from `isTracked` so a caller can tell "this repository does not have
+ * the file" from "there is no repository", which are the same `false` there.
+ */
+export declare function isGitRepo(cwd?: string): Promise<boolean>;

package/dist/src/fabric/lib/git.js

@@ -149,3 +149,42 @@ export async function assertNamedBranchDeploySafety(branch, cwd) {
     }
     return { branch, headSha: head, upstream, remoteSha: remote };
 }
+/**
+ * Is `relPath` tracked by git in `cwd`?
+ *
+ * Deploy clones the repository rather than uploading the working tree, so a
+ * file that exists only on disk does not exist for the build container. Any
+ * check that reads a required file locally has to ask this too, or it passes
+ * on the developer's machine and fails after the clone.
+ *
+ * Returns false rather than throwing when `cwd` is not a git repository. Note
+ * what that means for a caller: "not tracked" and "no repository at all" are
+ * the same answer, and only the first is a problem worth reporting — a project
+ * with no repository cannot be deployed by a clone in any case, and flagging an
+ * uncommitted file there is noise. Pair this with `isGitRepo` when the
+ * distinction matters.
+ */
+export async function isTracked(relPath, cwd = process.cwd()) {
+    try {
+        await git(['ls-files', '--error-unmatch', '--', relPath], cwd);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Is `cwd` inside a git working tree?
+ *
+ * Separate from `isTracked` so a caller can tell "this repository does not have
+ * the file" from "there is no repository", which are the same `false` there.
+ */
+export async function isGitRepo(cwd = process.cwd()) {
+    try {
+        const out = await git(['rev-parse', '--is-inside-work-tree'], cwd);
+        return out.trim() === 'true';
+    }
+    catch {
+        return false;
+    }
+}

package/dist/src/functions/commands/all.d.ts

@@ -1 +1 @@
-export declare const all: import("#pikku").PikkuFunctionSessionlessConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices, unknown>, undefined, undefined>;
+export declare const all: import("#pikku/function").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/all.js

@@ -1,4 +1,4 @@
-import { pikkuVoidFunc } from '#pikku';
+import { pikkuVoidFunc } from '#pikku/function';
 import { computeMetaDiff, readMetaSnapshot } from '../../utils/meta-diff.js';
 export const all = pikkuVoidFunc({
     remote: true,

package/dist/src/functions/commands/audit.d.ts

@@ -1,5 +1,15 @@
+import type { SecurityAuditIssue, SecurityAuditReport, SecurityAuditUpdate } from '@pikku/core/types';
 type AuditInput = {
     outdated?: boolean;
 };
-export declare const pikkuAudit: import("#pikku").PikkuFunctionConfig<AuditInput, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<AuditInput, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<AuditInput, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+type PackageManager = 'bun' | 'npm' | 'yarn' | 'pnpm' | 'unknown';
+export declare function findProjectRoot(startDir: string): {
+    root: string;
+    pm: PackageManager;
+};
+export declare function parseBunAudit(raw: string): SecurityAuditIssue[];
+export declare function semverLevel(current: string, latest: string): SecurityAuditUpdate['level'];
+export declare function parseBunOutdated(raw: string): SecurityAuditUpdate[];
+export declare function summarise(tool: PackageManager, issues: SecurityAuditIssue[], updates: SecurityAuditUpdate[], note?: string): SecurityAuditReport;
+export declare const pikkuAudit: import("#pikku/function").PikkuFunctionConfig<AuditInput, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<AuditInput, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<AuditInput, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;
 export {};

package/dist/src/functions/commands/audit.js

@@ -1,7 +1,7 @@
 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { spawnSync } from 'node:child_process';
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 const SCHEMA_VERSION = 1;
 const SEVERITY_ORDER = ['critical', 'high', 'moderate', 'low', 'info'];
 // Artifact shape (SecurityAuditReport / …Issue / …Update) is the canonical type
@@ -10,7 +10,7 @@ const SEVERITY_ORDER = ['critical', 'high', 'moderate', 'low', 'info'];
 const stripAnsi = (s) => s.replace(/\x1b\[[0-9;]*m/g, '');
 // Walk up from startDir to the nearest workspace root — the dir whose lockfile
 // the package manager audits. Falls back to startDir.
-function findProjectRoot(startDir) {
+export function findProjectRoot(startDir) {
     let dir = startDir;
     for (let i = 0; i < 12; i++) {
         if (existsSync(join(dir, 'bun.lock')) || existsSync(join(dir, 'bun.lockb')))
@@ -53,7 +53,7 @@ function normaliseSeverity(sev) {
         : 'info';
 }
 // bun audit --json → { "<pkg>": [ { id, url, title, severity, vulnerable_versions, cwe[], cvss:{score} } ] }
-function parseBunAudit(raw) {
+export function parseBunAudit(raw) {
     const issues = [];
     let obj;
     try {
@@ -90,7 +90,7 @@ function parseBunAudit(raw) {
     }
     return issues;
 }
-function semverLevel(current, latest) {
+export function semverLevel(current, latest) {
     const c = String(current)
         .replace(/^[^\d]*/, '')
         .split('.')
@@ -101,16 +101,24 @@ function semverLevel(current, latest) {
         .map((n) => parseInt(n, 10));
     if (Number.isNaN(c[0]) || Number.isNaN(l[0]))
         return 'unknown';
-    if (l[0] > c[0])
-        return 'major';
-    if ((l[1] || 0) > (c[1] || 0))
-        return 'minor';
-    if ((l[2] || 0) > (c[2] || 0))
-        return 'patch';
+    // Compare component by component, stopping at the first that differs. Testing
+    // each component independently would read 2.0.0 → 1.9.9 as a "minor" bump,
+    // and the console offers `patch`/`minor` as the safe one-click update.
+    const pairs = [
+        [0, 'major'],
+        [1, 'minor'],
+        [2, 'patch'],
+    ];
+    for (const [i, level] of pairs) {
+        const from = c[i] || 0;
+        const to = l[i] || 0;
+        if (to !== from)
+            return to > from ? level : 'unknown';
+    }
     return 'unknown';
 }
 // bun outdated has no --json; it prints a table: | Package | Current | Update | Latest |
-function parseBunOutdated(raw) {
+export function parseBunOutdated(raw) {
     const updates = [];
     const seen = new Set();
     for (const line of stripAnsi(raw).split('\n')) {
@@ -122,9 +130,13 @@ function parseBunOutdated(raw) {
             .filter((c) => c.length > 0);
         if (cells.length !== 4)
             continue;
-        const [pkg, current, , latest] = cells;
-        if (pkg === 'Package' || /^-+$/.test(pkg))
+        const [cell, current, , latest] = cells;
+        if (cell === 'Package' || /^-+$/.test(cell))
             continue;
+        // bun annotates the section a dependency comes from — `lodash (dev)`. The
+        // name is the key everything downstream joins on (package.json bumps, the
+        // advisory → update join), so the annotation cannot travel with it.
+        const pkg = cell.replace(/\s+\((?:dev|peer|optional)\)$/, '');
         if (!/^\d/.test(current) || !/^\d/.test(latest))
             continue;
         if (seen.has(pkg))
@@ -139,7 +151,7 @@ function parseBunOutdated(raw) {
     }
     return updates;
 }
-function summarise(tool, issues, updates, note) {
+export function summarise(tool, issues, updates, note) {
     issues.sort((a, b) => SEVERITY_ORDER.indexOf(a.severity) - SEVERITY_ORDER.indexOf(b.severity));
     const count = (arr, key, val) => arr.filter((x) => x[key] === val).length;
     return {

package/dist/src/functions/commands/binary.d.ts

@@ -1,7 +1,7 @@
-export declare const binary: import("#pikku").PikkuFunctionConfig<{
+export declare const binary: import("#pikku/function").PikkuFunctionConfig<{
     compileTarget?: string;
-}, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{
+}, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<{
     compileTarget?: string;
-}, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<{
+}, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<{
     compileTarget?: string;
-}, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+}, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/binary.js

@@ -1,7 +1,7 @@
 import { resolve, dirname } from 'node:path';
 import { existsSync, mkdirSync } from 'node:fs';
 import { execFileSync } from 'node:child_process';
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 function targetSuffix(target) {
     return target.replace(/^bun-/, '').replace(/[^a-z0-9_-]/g, '-');
 }

package/dist/src/functions/commands/bootstrap.d.ts

@@ -1 +1 @@
-export declare const bootstrap: import("#pikku").PikkuFunctionSessionlessConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices, unknown>, undefined, undefined>;
+export declare const bootstrap: import("#pikku/function").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/bootstrap.js

@@ -1,4 +1,4 @@
-import { pikkuVoidFunc } from '#pikku';
+import { pikkuVoidFunc } from '#pikku/function';
 export const bootstrap = pikkuVoidFunc({
     remote: true,
     func: async ({ logger, getInspectorState }, _data, { rpc }) => {
@@ -12,19 +12,20 @@ export const bootstrap = pikkuVoidFunc({
         // Stub auth.types.ts (if better-auth is used) so the pikkuBetterAuth
         // re-export resolves before any user file is imported.
         await rpc.invoke('pikkuAuth', { bootstrap: true });
-        await rpc.invoke('pikkuFunctionTypes', { bootstrap: true });
         await rpc.invoke('pikkuHTTPTypes');
         await rpc.invoke('pikkuChannelTypes');
         await rpc.invoke('pikkuSchedulerTypes');
         await rpc.invoke('pikkuQueueTypes');
         await rpc.invoke('pikkuWorkflow', { bootstrap: true });
         await rpc.invoke('pikkuTriggerTypes', { bootstrap: true });
+        await rpc.invoke('pikkuGatewayTypes', { bootstrap: true });
         await rpc.invoke('pikkuMCPTypes');
         await rpc.invoke('pikkuAgentTypes');
-        await rpc.invoke('pikkuNodeTypes');
         await rpc.invoke('pikkuSecretDefinitionTypes');
+        await rpc.invoke('pikkuVariableDefinitionTypes');
         await rpc.invoke('pikkuScopeDefinitionTypes');
         await rpc.invoke('pikkuCLITypes', { bootstrap: true });
+        await rpc.invoke('pikkuLeafIndexes');
         if (logger.hasCriticalErrors()) {
             process.exit(1);
         }

package/dist/src/functions/commands/bun-coverage-loader.js

@@ -38,7 +38,10 @@ export async function registerBunCoverageLoader({ rootDir, }) {
                 const loader = args.path.endsWith('.tsx') ? 'tsx' : 'ts';
                 if (!shouldInstrument(args.path))
                     return { contents: source, loader };
-                return { contents: instrumenter.instrumentSync(source, args.path), loader };
+                return {
+                    contents: instrumenter.instrumentSync(source, args.path),
+                    loader,
+                };
             });
         },
     });

package/dist/src/functions/commands/db-audit.d.ts

@@ -1 +1 @@
-export declare const dbAudit: import("#pikku").PikkuFunctionConfig<{}, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{}, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<{}, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const dbAudit: import("#pikku/function").PikkuFunctionConfig<{}, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<{}, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<{}, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/db-audit.js

@@ -1,4 +1,4 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { resolveDb } from '../db/local-db.js';
 import { loadUserConfigForDb } from './db-shared.js';
 export const dbAudit = pikkuSessionlessFunc({

package/dist/src/functions/commands/db-baseline.d.ts

@@ -10,4 +10,4 @@
  * premise. A database that is behind gets the same report `db check` gives —
  * baselining it would bury a real gap under a history claiming otherwise.
  */
-export declare const dbBaseline: import("#pikku").PikkuFunctionConfig<{}, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{}, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<{}, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const dbBaseline: import("#pikku/function").PikkuFunctionConfig<{}, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<{}, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<{}, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/db-baseline.js

@@ -1,4 +1,4 @@
-import { pikkuSessionlessFunc } from '#pikku';
+import { pikkuSessionlessFunc } from '#pikku/function';
 import { resolveDb, baseline } from '../db/local-db.js';
 import { loadUserConfigForDb } from './db-shared.js';
 /**