@pikku/cli 0.12.118 → 0.12.119

package/dist/.pikku/setup/index.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.118
+ * This file was generated by @pikku/cli@0.12.119
  */
 /**
  * Subpath entry — `#pikku/setup` resolves here.

package/dist/.pikku/setup/pikku-setup-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.118
+ * This file was generated by @pikku/cli@0.12.119
  */
 /**
  * Config and service factory definitions, declared once per application

package/dist/.pikku/setup/pikku-setup-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.118
+ * This file was generated by @pikku/cli@0.12.119
  */
 /**
  * Config and service factory definitions, declared once per application

package/dist/.pikku/trigger/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.118
+ * This file was generated by @pikku/cli@0.12.119
  */
 /**
  * Subpath entry — `#pikku/trigger` resolves here.

package/dist/.pikku/trigger/index.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.118
+ * This file was generated by @pikku/cli@0.12.119
  */
 /**
  * Subpath entry — `#pikku/trigger` resolves here.

package/dist/.pikku/trigger/pikku-trigger-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.118
+ * This file was generated by @pikku/cli@0.12.119
  */
 /**
  * Trigger-specific type definitions for tree-shaking optimization

package/dist/.pikku/trigger/pikku-trigger-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.118
+ * This file was generated by @pikku/cli@0.12.119
  */
 /**
  * Trigger-specific type definitions for tree-shaking optimization

package/dist/.pikku/variables/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.118
+ * This file was generated by @pikku/cli@0.12.119
  */
 /**
  * Subpath entry — `#pikku/variables` resolves here.

package/dist/.pikku/variables/index.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.118
+ * This file was generated by @pikku/cli@0.12.119
  */
 /**
  * Subpath entry — `#pikku/variables` resolves here.

package/dist/.pikku/variables/pikku-variable-types.gen.d.ts

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.118
+ * This file was generated by @pikku/cli@0.12.119
  */
 export { defineVariable } from '@pikku/core/variable';

package/dist/.pikku/variables/pikku-variable-types.gen.js

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.118
+ * This file was generated by @pikku/cli@0.12.119
  */
 export { defineVariable } from '@pikku/core/variable';

package/dist/.pikku/variables/pikku-variables.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.118
+ * This file was generated by @pikku/cli@0.12.119
  */
 import { TypedVariablesService as CoreTypedVariablesService } from '@pikku/core/services';
 import type { VariablesService } from '@pikku/core/services';

package/dist/.pikku/variables/pikku-variables.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.118
+ * This file was generated by @pikku/cli@0.12.119
  */
 import { TypedVariablesService as CoreTypedVariablesService, } from '@pikku/core/services';
 /**

package/dist/.pikku/workflow/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.118
+ * This file was generated by @pikku/cli@0.12.119
  */
 /**
  * Subpath entry — `#pikku/workflow` resolves here.

package/dist/.pikku/workflow/index.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.118
+ * This file was generated by @pikku/cli@0.12.119
  */
 /**
  * Subpath entry — `#pikku/workflow` resolves here.

package/dist/.pikku/workflow/pikku-workflow-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.118
+ * This file was generated by @pikku/cli@0.12.119
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import type { PikkuWorkflowGraphConfig, PikkuWorkflowGraphResult } from '@pikku/core/workflow';

package/dist/.pikku/workflow/pikku-workflow-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.118
+ * This file was generated by @pikku/cli@0.12.119
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import { pikkuWorkflowGraph as corePikkuWorkflowGraph } from '@pikku/core/workflow';

package/dist/.pikku/workflow/pikku-workflow-wirings-meta.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.118
+ * This file was generated by @pikku/cli@0.12.119
  */
 import { pikkuState } from '@pikku/core/state';
 import allWorkflowMeta from './meta/allWorkflow.gen.json' with { type: 'json' };

package/dist/.pikku/workflow/pikku-workflow-wirings.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.118
+ * This file was generated by @pikku/cli@0.12.119
  */
 import { addWorkflow } from '@pikku/core/workflow';
 import './pikku-workflow-wirings-meta.gen.js';

package/dist/bin/pikku-bin.mjs

@@ -11,8 +11,8 @@ async function checkForUpdate() {
     })
     if (!res.ok) return
     const { version: latest } = await res.json()
-    if (latest !== '0.12.118') {
-      process.stderr.write(`\n  Update available  0.12.118 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
+    if (latest !== '0.12.119') {
+      process.stderr.write(`\n  Update available  0.12.119 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
     }
   } catch {}
 }

package/dist/src/cli.wiring.js

@@ -635,16 +635,8 @@ wireCLI({
                 }),
                 sync: pikkuCLICommand({
                     func: personaSync,
-                    description: "Provision the declared personas into an environment: create each account and apply the roles it declares. Additive — it never revokes. Needs both the environment's API (to sign in) and its database (to write the grants), and the sign-in secret from SCENARIO_ACTOR_SECRET.",
+                    description: "Report which personas an environment will provision, with which roles, and why any of them were skipped. The provisioning itself happens in the deployment — call provisionPersonas from '@pikku/better-auth' in your server lifecycle — because the CLI has no connection to a deployed environment's database.",
                     parameters: '<environment>',
-                    options: {
-                        dryRun: {
-                            description: 'Report who would be provisioned, with which roles, and why anyone was skipped — without touching anything',
-                        },
-                        apiUrl: {
-                            description: "Override the environment's apiUrl — for a target that only exists at run time, such as a freshly deployed sandbox",
-                        },
-                    },
                 }),
                 list: pikkuCLICommand({
                     func: personaList,

package/dist/src/fabric/lib/git.js

@@ -15,9 +15,39 @@ export class GitError extends Error {
         this.stderr = stderr;
     }
 }
+/**
+ * Repository-location variables git exports to its hooks. `git push` from a
+ * worktree sets GIT_DIR, and a hook's children inherit it — after which git
+ * answers about the hook's repository no matter which directory it is run in,
+ * so a probe given a `cwd` outside any repository reports that repository's
+ * state instead of "no repository". Every probe below picks its repository by
+ * `cwd`, so the inherited pointer is always wrong here and is dropped.
+ */
+const REPO_LOCATION_ENV = [
+    'GIT_DIR',
+    'GIT_COMMON_DIR',
+    'GIT_WORK_TREE',
+    'GIT_INDEX_FILE',
+    'GIT_PREFIX',
+    'GIT_NAMESPACE',
+    'GIT_OBJECT_DIRECTORY',
+    'GIT_ALTERNATE_OBJECT_DIRECTORIES',
+    'GIT_CEILING_DIRECTORIES',
+];
+function envWithoutInheritedRepo() {
+    const env = { ...process.env };
+    for (const key of REPO_LOCATION_ENV) {
+        delete env[key];
+    }
+    return env;
+}
 function git(args, cwd = process.cwd()) {
     return new Promise((resolve, reject) => {
-        const child = spawn('git', args, { cwd, stdio: ['ignore', 'pipe', 'pipe'] });
+        const child = spawn('git', args, {
+            cwd,
+            env: envWithoutInheritedRepo(),
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
         let stdout = '';
         let stderr = '';
         child.stdout.on('data', (b) => (stdout += b.toString()));

package/dist/src/functions/commands/dev.js

@@ -22,11 +22,13 @@ import { createDevAgentRunner } from './dev-agent-runner.js';
 import { resolveConsoleMount } from './serve-console.js';
 import { serverReadyLine } from '../../server/server-ready.js';
 import { createEphemeralContentSigningJWT } from '../../server/content-signing-jwt.js';
+import { enableDevActorSignIn } from '../../server/actor-sign-in.js';
 import { applyModelAliasOverride } from '../../utils/model-alias-override.js';
 export const dev = pikkuSessionlessFunc({
     remote: true,
     func: async ({ logger, config, getInspectorState, invalidateInspectorState, variables, devServerRunner, }, { port, watch, hmr, coverage, test, model }, { rpc }) => {
         process.env.PIKKU_DEV_QUICK_LOGIN ??= 'true';
+        enableDevActorSignIn(logger);
         applyModelAliasOverride(logger, model, config.models);
         if (test) {
             process.env.PIKKU_TEST_RUN = 'true';

package/dist/src/functions/commands/persona-sync.d.ts

@@ -1,33 +1,25 @@
 /**
- * Provision the declared personas into an environment: their accounts, and the
- * roles they declare.
+ * Report which personas an environment will provision, and which it will not.
  *
- * This is deployment, not seeding. `pikku db reset` applies a project's test
- * fixtures and does not run in production; an accountable persona doing a real
- * job in production still needs an account and its grants, and this is where
- * they come from.
+ * It reports rather than writes, because the writing happens somewhere this
+ * command cannot reach. Provisioning a persona means creating a user row and
+ * granting it roles, and both of those live in the deployment's database — one
+ * the CLI has no connection to for any environment that is not the developer's
+ * own. This command used to open a Kysely connection from the local project
+ * config and write through it, which provisioned a local stage correctly and
+ * silently provisioned the wrong database for every other environment.
  *
- * Additive in the same way `syncSystemRoles` is: it creates and grants, and
- * never deletes or revokes. Removing a persona from the code leaves their
- * account and their grants standing until somebody decides otherwise — which is
- * the point, because the alternative is a rolling deploy quietly locking out the
- * teammate that the older replica is still running.
- *
- * It needs both halves of an environment: its API, to sign the persona in, and
- * its database, to write the grants. They must be the same deployment — the
- * command has no way to check that, so pointing it at a stage's API and a local
- * database provisions nobody usefully.
+ * So the deployment provisions itself: an app calls `provisionPersonas` from
+ * `@pikku/better-auth` in its server lifecycle, where the database connection
+ * and better-auth's own adapter are both already open, and a deploy carries its
+ * personas with it. What is left here is the half that needs no database — the
+ * declaration, and the environment rule applied to it — which is what tells you
+ * before a deploy whether the accounts you expect will appear.
  */
 export declare const personaSync: import("#pikku/function").PikkuFunctionConfig<{
     environment: string;
-    apiUrl?: string;
-    dryRun?: boolean;
 }, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<{
     environment: string;
-    apiUrl?: string;
-    dryRun?: boolean;
 }, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<{
     environment: string;
-    apiUrl?: string;
-    dryRun?: boolean;
 }, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/persona-sync.js

@@ -1,51 +1,26 @@
 import { pikkuSessionlessFunc } from '#pikku/function';
-import { createHttpPersonas } from '@pikku/core/persona';
 import { personaEnvironmentRefusal } from '@pikku/core/persona';
 import { resolvePersonas } from '../../utils/resolve-personas.js';
-import { resolvePersonaCredentials } from '../../utils/persona-credentials.js';
-import { resolveEnvironment } from './environment.js';
-import { loadDeclaredRoles, openScopeServiceForRoles } from './roles-shared.js';
 /**
- * The user id behind a persona's address.
+ * Report which personas an environment will provision, and which it will not.
  *
- * Read straight off better-auth's own `user` table rather than through the
- * ScopeService, because the ScopeService has no notion of an address — its
- * grants are keyed by user id, and `pikku_user_role.user_id` already FKs into
- * this exact table. Looking it up anywhere else would mean inventing a second
- * account concept for personas, which is the one thing this command exists to
- * avoid: a persona is a user, provisioned the way users are.
- */
-const userIdByEmail = async (db, email) => {
-    const row = await db
-        .selectFrom('user')
-        .select('id')
-        .where('email', '=', email)
-        .executeTakeFirst();
-    return row ? String(row.id) : null;
-};
-/**
- * Provision the declared personas into an environment: their accounts, and the
- * roles they declare.
- *
- * This is deployment, not seeding. `pikku db reset` applies a project's test
- * fixtures and does not run in production; an accountable persona doing a real
- * job in production still needs an account and its grants, and this is where
- * they come from.
- *
- * Additive in the same way `syncSystemRoles` is: it creates and grants, and
- * never deletes or revokes. Removing a persona from the code leaves their
- * account and their grants standing until somebody decides otherwise — which is
- * the point, because the alternative is a rolling deploy quietly locking out the
- * teammate that the older replica is still running.
+ * It reports rather than writes, because the writing happens somewhere this
+ * command cannot reach. Provisioning a persona means creating a user row and
+ * granting it roles, and both of those live in the deployment's database — one
+ * the CLI has no connection to for any environment that is not the developer's
+ * own. This command used to open a Kysely connection from the local project
+ * config and write through it, which provisioned a local stage correctly and
+ * silently provisioned the wrong database for every other environment.
  *
- * It needs both halves of an environment: its API, to sign the persona in, and
- * its database, to write the grants. They must be the same deployment — the
- * command has no way to check that, so pointing it at a stage's API and a local
- * database provisions nobody usefully.
+ * So the deployment provisions itself: an app calls `provisionPersonas` from
+ * `@pikku/better-auth` in its server lifecycle, where the database connection
+ * and better-auth's own adapter are both already open, and a deploy carries its
+ * personas with it. What is left here is the half that needs no database — the
+ * declaration, and the environment rule applied to it — which is what tells you
+ * before a deploy whether the accounts you expect will appear.
  */
 export const personaSync = pikkuSessionlessFunc({
-    remote: true,
-    func: async ({ logger, config, getInspectorState, variables }, { environment, apiUrl, dryRun }) => {
+    func: async ({ logger, config, getInspectorState }, { environment }) => {
         const state = await getInspectorState(true, false, false, true);
         const personas = resolvePersonas(state.personas?.definitions ?? [], config.scenarios?.emailDomain);
         if (Object.keys(personas).length === 0) {
@@ -53,9 +28,11 @@ export const personaSync = pikkuSessionlessFunc({
             return;
         }
         const environments = config.environments ?? {};
-        const env = resolveEnvironment({ environment, environments, apiUrl });
+        if (!environments[environment]) {
+            throw new Error(`Unknown environment '${environment}'. Configured environments: ${Object.keys(environments).join(', ') || 'none'}.`);
+        }
         // The same rule that decides who may *run* against an environment decides
-        // who may be provisioned into it. Two rules would drift, and the one that
+        // who is provisioned into it. Two rules would drift, and the one that
         // drifted would leave an account standing in production for a persona the
         // engine then refuses to sign in.
         //
@@ -73,76 +50,21 @@ export const personaSync = pikkuSessionlessFunc({
         }
         if (eligible.length === 0) {
             logger.info(`persona sync: no persona may act in '${environment}' — ${skipped.length} declared persona(s) were all skipped.`);
-            logger.info('  Run with --dry-run for the reasons, or give the persona this environment and disposition `accountable` if it is production.');
-            return;
-        }
-        if (dryRun) {
-            logger.info(`persona sync (dry run): ${eligible.length} persona(s) would be provisioned into '${environment}' at ${env.apiUrl}:`);
-            for (const [id, persona] of eligible) {
-                logger.info(`  ${id.padEnd(20)} ${persona.email}${persona.roles.length
-                    ? ` -> ${persona.roles.join(' + ')}`
-                    : ' (no roles)'}`);
-            }
             for (const refusal of skipped) {
-                logger.info(`  skipped: ${refusal}`);
+                logger.info(`  ${refusal}`);
             }
-            logger.info('Re-run without --dry-run to apply.');
-            return;
-        }
-        const credentials = await resolvePersonaCredentials(variables, 'a persona account');
-        const declaredRoles = await loadDeclaredRoles(config.rolesMetaJsonFile, logger);
-        if (!declaredRoles) {
-            throw new Error('role metadata not found');
-        }
-        const signedIn = createHttpPersonas({
-            apiUrl: env.apiUrl,
-            ...credentials,
-            personas: Object.fromEntries(eligible),
-            signInPath: env.signInPath,
-            rpcPath: env.rpcPath,
-        });
-        // Roles are synced on the way in, so a grant can name a role this deploy
-        // introduced. Both that sync and everything below are additive.
-        const opened = await openScopeServiceForRoles({ config, logger }, declaredRoles, 'pikku persona sync');
-        if (!opened) {
+            logger.info('  Give the persona this environment, and disposition `accountable` if it is production.');
             return;
         }
-        try {
-            let accounts = 0;
-            let granted = 0;
-            let held = 0;
-            for (const [id, persona] of eligible) {
-                // Signing in is what creates the account: the actor plugin upserts an
-                // `actor: true` user row on first sign-in, and nothing else does.
-                // `sessionRoles()` is the public call that forces it — its answer is a
-                // by-product here, not the reason for the call.
-                await signedIn[id].sessionRoles();
-                accounts++;
-                if (persona.roles.length === 0) {
-                    logger.info(`  ${id.padEnd(20)} ${persona.email} (no roles)`);
-                    continue;
-                }
-                const userId = await userIdByEmail(opened.db, persona.email);
-                if (!userId) {
-                    throw new Error(`persona sync: signed '${id}' in at ${env.apiUrl}, but no user row for ${persona.email} exists in the database this command opened. ` +
-                        `That database is not the one '${environment}' runs on, so its grants would land nowhere.`);
-                }
-                const already = new Set(await opened.service.listUserRoles(userId));
-                const missing = persona.roles.filter((role) => !already.has(role));
-                for (const role of missing) {
-                    await opened.service.addUserToRole(userId, role);
-                }
-                granted += missing.length;
-                held += persona.roles.length - missing.length;
-                logger.info(`  ${id.padEnd(20)} ${persona.email} -> ${persona.roles.join(' + ')}${missing.length === 0 ? ' (already held)' : ''}`);
-            }
-            logger.info(`persona sync: ${accounts} account(s) in '${environment}', ${granted} role grant(s) applied, ${held} already held`);
-            if (skipped.length > 0) {
-                logger.info(`  ${skipped.length} persona(s) skipped — they do not act in '${environment}'. Run with --dry-run for the reasons.`);
-            }
+        logger.info(`persona sync: ${eligible.length} persona(s) will be provisioned when a deployment of '${environment}' starts:`);
+        for (const [id, persona] of eligible) {
+            logger.info(`  ${id.padEnd(20)} ${persona.email}${persona.roles.length
+                ? ` -> ${persona.roles.join(' + ')}`
+                : ' (no roles)'}`);
         }
-        finally {
-            await opened.destroy();
+        for (const refusal of skipped) {
+            logger.info(`  skipped: ${refusal}`);
         }
+        logger.info("  Provisioning runs in the deployment: call `provisionPersonas` from '@pikku/better-auth' in your server lifecycle, passing `personaConfigs` and `personaEnvironments` from the generated personas file.");
     },
 });

package/dist/src/functions/commands/serve.js

@@ -18,11 +18,13 @@ import { createDevAgentRunner } from './dev-agent-runner.js';
 import { resolveConsoleMount } from './serve-console.js';
 import { serverReadyLine } from '../../server/server-ready.js';
 import { createEphemeralContentSigningJWT } from '../../server/content-signing-jwt.js';
+import { disableDevActorSignIn } from '../../server/actor-sign-in.js';
 import { applyModelAliasOverride } from '../../utils/model-alias-override.js';
 export const serve = pikkuSessionlessFunc({
     remote: true,
     func: async ({ logger, config, getInspectorState, variables, devServerRunner }, { port, console: serveConsole, model }) => {
         process.env.PIKKU_DEV_QUICK_LOGIN ??= 'true';
+        disableDevActorSignIn(logger);
         applyModelAliasOverride(logger, model, config.models);
         const resolvedPort = parseInt(port || '3000', 10);
         const hostname = 'localhost';

package/dist/src/functions/validate/auth-plugin-checks.d.ts

@@ -0,0 +1,16 @@
+import type { ValidateFinding } from './persona-checks.js';
+export type AuthPluginCheckConfig = {
+    srcDirectories?: unknown;
+};
+/**
+ * Whether better-auth is configured the way pikku supports.
+ *
+ * Pikku authorizes on scopes, so better-auth's `admin()` — which authorizes its
+ * endpoints against a `user.role` column — is unsupported: wiring it means
+ * running two authorization models and projecting one onto the other. The
+ * inspector refuses it outright at prebuild; this reports the same thing
+ * without one, and additionally catches the quieter half of the migration, an
+ * app that dropped `admin()` and never wired `ban()`, which keeps its ban
+ * columns and its ban UI while silently enforcing nothing.
+ */
+export declare const runAuthPluginChecks: (root: string, config: AuthPluginCheckConfig | null) => Promise<ValidateFinding[]>;