@pikku/cli 0.12.123 → 0.12.125

package/dist/src/fabric/functions/projects-list.function.js

@@ -0,0 +1,63 @@
+import { z } from 'zod';
+import { pikkuSessionlessFunc } from '../../../.pikku/function/index.js';
+import { findProjectConfig, resolveApiContext } from '../lib/config.js';
+import { getFabricRPC } from '../lib/http.js';
+import { dim } from '../lib/output.js';
+export const FabricProjectsListInput = z.object({
+    apiUrl: z.string().optional(),
+});
+export const FabricProjectsListOutput = z.object({
+    projects: z.array(z.object({
+        projectId: z.string(),
+        name: z.string(),
+        slug: z.string(),
+        status: z.string(),
+        productionBranch: z.string(),
+        gitRepoUrl: z.string().nullable(),
+        createdAt: z.string(),
+        linked: z.boolean(),
+    })),
+});
+/**
+ * The only fabric command that does not need a linked project, which is the
+ * point of it: a checkout whose config still holds `__PROJECT_ID__` can run
+ * nothing else, and `fabric init` cannot recover the id either — it creates,
+ * so against an existing project it fails with a 409 that carries no id.
+ */
+export const FabricProjectsList = pikkuSessionlessFunc({
+    description: 'List the projects in your organization.',
+    input: FabricProjectsListInput,
+    output: FabricProjectsListOutput,
+    func: async (_services, { apiUrl: apiUrlOverride }) => {
+        const ctx = await resolveApiContext({ apiUrlOverride });
+        if (!ctx.token)
+            throw new Error('Not logged in. Run `pikku fabric login` first.');
+        const rpc = getFabricRPC({ apiUrl: ctx.apiUrl, token: ctx.token });
+        const { projects } = await rpc.invoke('fabricCliProjects', {});
+        const local = await findProjectConfig();
+        const linkedId = local?.config.projectId;
+        return {
+            projects: projects.map((project) => ({
+                ...project,
+                linked: linkedId !== undefined && project.projectId === linkedId,
+            })),
+        };
+    },
+});
+export const renderProjectsList = (_s, { projects }) => {
+    console.log('');
+    if (projects.length === 0) {
+        console.log(dim('  No projects yet. Run `pikku fabric link` to create one.'));
+        console.log('');
+        return;
+    }
+    const width = Math.max(...projects.map((p) => p.name.length));
+    for (const project of projects) {
+        console.log(`  ${project.linked ? '*' : ' '} ${project.name.padEnd(width)}  ${project.projectId}  ${dim(project.gitRepoUrl ?? 'no repo')}`);
+    }
+    console.log('');
+    if (projects.some((p) => p.linked)) {
+        console.log(dim('  * this checkout'));
+        console.log('');
+    }
+};

package/dist/src/fabric/functions/validate.function.js

@@ -66,6 +66,15 @@ async function listSourceFiles(dir) {
         return [];
     }
 }
+/**
+ * Blanks comment bodies so a raw-text scan cannot read prose as code. Prose in a
+ * scenario description ("Converted from the Gherkin scenario...") otherwise
+ * matches the import scanner's `from "..."` and reports a package that is really
+ * a sentence.
+ */
+const stripCommentText = (text) => text
+    .replace(/\/\*[\s\S]*?\*\//g, (m) => m.replace(/[^\n]/g, ' '))
+    .replace(/(^|[^:'"`\\])\/\/[^\n]*/g, (_m, p1) => p1);
 // Heavy/generated dirs pruned during a source walk.
 const SKIP_WALK_DIRS = new Set([
     'node_modules',
@@ -487,11 +496,14 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
                 const txt = await readTextSafe(file);
                 if (!txt)
                     continue;
+                const src = stripCommentText(txt);
                 const re = /(?:from|import|require)\s*\(?\s*['"]([^'".#][^'"]*)['"]/g;
                 let m;
-                while ((m = re.exec(txt))) {
+                while ((m = re.exec(src))) {
                     const spec = m[1];
-                    if (spec.startsWith('node:') ||
+                    if (/\s/.test(spec) ||
+                        spec.startsWith('node:') ||
+                        spec.startsWith('bun:') ||
                         spec.startsWith('@/') ||
                         spec.startsWith('~') ||
                         spec.startsWith('virtual:') ||
@@ -1180,23 +1192,74 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
         }
         if (keysByValue.size > 0) {
             const STRING_LITERAL = /(?<![A-Za-z0-9_$])(['"])((?:[^\\\n]|\\.){2,200}?)\1/g;
+            // A literal in `someKey: '...'` position is only copy when the key names
+            // something the browser renders. `unit: 'kg'` is an RPC payload field that
+            // happens to read like the catalogue's `unit_kg` label for a form suffix —
+            // rewriting it to a message lookup would bind a stored value to UI copy.
+            const PROPERTY_KEY = /([A-Za-z_$][A-Za-z0-9_$]*)\s*:\s*$/;
+            // The innermost call whose argument list `index` sits in. Walks back
+            // balancing brackets, so in `expect(await page.getByText('Save'), ...)`
+            // the literal belongs to `getByText`, which is a locator and is still
+            // scanned.
+            const enclosingCall = (code, index) => {
+                let depth = 0;
+                for (let i = index - 1; i >= 0; i--) {
+                    const ch = code[i];
+                    if (ch === ')' || ch === ']' || ch === '}')
+                        depth++;
+                    else if (ch === '(' || ch === '[' || ch === '{') {
+                        if (depth > 0) {
+                            depth--;
+                            continue;
+                        }
+                        if (ch !== '(')
+                            return null;
+                        return (/([A-Za-z_$][A-Za-z0-9_$]*)\s*$/.exec(code.slice(0, i))?.[1] ??
+                            null);
+                    }
+                }
+                return null;
+            };
+            const UI_TEXT_KEYS = new Set([
+                'alt',
+                'button',
+                'caption',
+                'heading',
+                'label',
+                'link',
+                'name',
+                'option',
+                'placeholder',
+                'tab',
+                'text',
+                'title',
+                'value',
+            ]);
             for (const file of await walkSourceFiles(root)) {
                 if (!/\.(steps|scenario)\.tsx?$/.test(file))
                     continue;
                 const text = await readTextSafe(file);
                 if (!text)
                     continue;
-                const code = text
-                    .replace(/\/\*[\s\S]*?\*\//g, '')
-                    .replace(/(^|[^:'"`\\])\/\/[^\n]*/g, '$1');
+                const code = stripCommentText(text);
                 const hits = [];
                 for (const match of code.matchAll(STRING_LITERAL)) {
                     const literal = match[2];
                     if (!literal)
                         continue;
                     const keys = keysByValue.get(literal);
-                    if (keys)
-                        hits.push(`"${literal}" → ${keys.join(' | ')}`);
+                    if (!keys)
+                        continue;
+                    // `expect(item.unit, 'kg')` asserts on a value the RPC returned,
+                    // not on anything the browser rendered. Reading it from the
+                    // catalogue would bind a stored value to UI copy, and the assertion
+                    // would then pass against whatever the label happened to say.
+                    if (enclosingCall(code, match.index) === 'expect')
+                        continue;
+                    const property = PROPERTY_KEY.exec(code.slice(0, match.index));
+                    if (property && !UI_TEXT_KEYS.has(property[1]))
+                        continue;
+                    hits.push(`"${literal}" → ${keys.join(' | ')}`);
                 }
                 if (hits.length === 0)
                     continue;

package/dist/src/functions/commands/deploy-apply.d.ts

@@ -8,23 +8,33 @@ export declare function resolveProvider(config?: {
     };
 }, providerName?: string, options?: {
     runtime?: string;
+    desktop?: boolean;
+    projectDir?: string;
+    desktopIdentifier?: string;
+    desktopUrl?: string;
 }): Promise<ProviderAdapter>;
 export declare const deployApply: import("#pikku/function").PikkuFunctionConfig<{
     fromPlan?: boolean;
     provider?: string;
     runtime?: string;
+    desktop?: boolean;
+    desktopUrl?: string;
     resultFile?: string;
     debugArtifacts?: boolean;
 }, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<{
     fromPlan?: boolean;
     provider?: string;
     runtime?: string;
+    desktop?: boolean;
+    desktopUrl?: string;
     resultFile?: string;
     debugArtifacts?: boolean;
 }, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<{
     fromPlan?: boolean;
     provider?: string;
     runtime?: string;
+    desktop?: boolean;
+    desktopUrl?: string;
     resultFile?: string;
     debugArtifacts?: boolean;
 }, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/deploy-apply.js

@@ -178,8 +178,15 @@ async function runDeploy(provider, providerDir, logger, resultFile) {
 export const deployApply = pikkuSessionlessFunc({
     func: async ({ logger, config, getInspectorState, bundler }, data) => {
         const projectDir = config.rootDir;
+        // A url on its own is a request for a shell — asking for both flags would
+        // only leave `--desktop-url` alone as a silent no-op.
+        const desktopUrl = data?.desktopUrl ?? config.deploy?.desktop?.url;
         const provider = await resolveProvider(config, data?.provider, {
             runtime: data?.runtime,
+            desktop: data?.desktop || Boolean(desktopUrl),
+            projectDir,
+            desktopIdentifier: config.deploy?.desktop?.identifier,
+            desktopUrl,
         });
         const fromPlan = data?.fromPlan ?? false;
         const resultFile = data?.resultFile;
@@ -212,6 +219,7 @@ export const deployApply = pikkuSessionlessFunc({
             defaultTarget: config.deploy?.defaultTarget,
             globalHTTPPrefix: config.globalHTTPPrefix,
             getEntryContext,
+            frontend: config.frontend,
             outDir: config.outDir,
             debugArtifacts: data?.debugArtifacts ?? false,
             logger,

package/dist/src/functions/commands/deploy-plan.js

@@ -59,6 +59,7 @@ export const deployPlan = pikkuSessionlessFunc({
             defaultTarget: config.deploy?.defaultTarget,
             globalHTTPPrefix: config.globalHTTPPrefix,
             getEntryContext,
+            frontend: config.frontend,
             outDir: config.outDir,
             debugArtifacts: data?.debugArtifacts ?? false,
             logger,

package/dist/src/functions/commands/dev.js

@@ -18,6 +18,7 @@ import { resolveDb, createKysely, parseDatabaseUrl, } from '../db/local-db.js';
 import { loadUserBootstrap, loadUserModule } from './load-user-project.js';
 import { registerScenarioInstrumentation } from '../wirings/scenarios/register-scenario-instrumentation.js';
 import { startCoverageService } from './start-coverage.js';
+import { resolveDevEnvironmentName } from './environment.js';
 import { createDevAgentRunner } from './dev-agent-runner.js';
 import { resolveConsoleMount } from './serve-console.js';
 import { serverReadyLine } from '../../server/server-ready.js';
@@ -28,6 +29,7 @@ export const dev = pikkuSessionlessFunc({
     remote: true,
     func: async ({ logger, config, getInspectorState, invalidateInspectorState, variables, devServerRunner, }, { port, watch, hmr, coverage, test, model }, { rpc }) => {
         process.env.PIKKU_DEV_QUICK_LOGIN ??= 'true';
+        process.env.PIKKU_ENV ??= resolveDevEnvironmentName(config.environments ?? {});
         enableDevActorSignIn(logger);
         applyModelAliasOverride(logger, model, config.models);
         if (test) {
@@ -296,10 +298,19 @@ export const dev = pikkuSessionlessFunc({
         await lifecycle?.beforeStart?.(resolvedServices);
         await pikkuServer.start();
         await lifecycle?.afterStart?.(resolvedServices);
+        // Not `resolvedPort`: `--port 0` asks the OS for a free port, and every URL
+        // announced from here has to name the one it actually handed out.
+        const boundPort = pikkuServer.port;
         if (consoleMount) {
-            logger.info(`Pikku Console available at http://${hostname}:${resolvedPort}${consoleMount.urlPrefix}`);
+            logger.info(`Pikku Console available at http://${hostname}:${boundPort}${consoleMount.urlPrefix}`);
         }
-        logger.info(serverReadyLine(hostname, resolvedPort));
+        // Serving the built frontend here would hand you whatever the last build
+        // produced, with no HMR and no warning that it is stale. The frontend's own
+        // dev server owns dev; it proxies its API calls back to this port.
+        if (config.frontend) {
+            logger.info(`Frontend not served in dev — run your frontend dev server and proxy its API calls to http://${hostname}:${boundPort}`);
+        }
+        logger.info(serverReadyLine(hostname, boundPort));
         let watcher;
         process.once('SIGINT', async () => {
             logger.info('Stopping dev server...');

package/dist/src/functions/commands/environment.d.ts

@@ -60,3 +60,13 @@ export declare const parseAppUrls: (value: string) => {
     base?: string;
     byApp: Record<string, string>;
 };
+/**
+ * The environment name `pikku dev` is running as, for anything that gates on
+ * `PIKKU_ENV` — persona provisioning above all, which fails closed and so
+ * provisions nothing at all when nobody says where the process is.
+ *
+ * Local means a configured, non-production environment whose `apiUrl` is a
+ * loopback host; `local` wins when several qualify. A project that configures
+ * none gets `undefined` rather than a guess.
+ */
+export declare const resolveDevEnvironmentName: (environments: Record<string, PikkuEnvironment>) => string | undefined;

package/dist/src/functions/commands/environment.js

@@ -94,3 +94,27 @@ export const parseAppUrls = (value) => {
     }
     return { base, byApp };
 };
+/**
+ * The environment name `pikku dev` is running as, for anything that gates on
+ * `PIKKU_ENV` — persona provisioning above all, which fails closed and so
+ * provisions nothing at all when nobody says where the process is.
+ *
+ * Local means a configured, non-production environment whose `apiUrl` is a
+ * loopback host; `local` wins when several qualify. A project that configures
+ * none gets `undefined` rather than a guess.
+ */
+export const resolveDevEnvironmentName = (environments) => {
+    const candidates = Object.entries(environments).filter(([, environment]) => {
+        if (environment.production) {
+            return false;
+        }
+        try {
+            return LOCAL_HOSTNAMES.has(new URL(environment.apiUrl).hostname);
+        }
+        catch {
+            return false;
+        }
+    });
+    const preferred = candidates.find(([name]) => name === 'local');
+    return (preferred ?? candidates[0])?.[0];
+};

package/dist/src/functions/commands/serve-frontend.d.ts

@@ -0,0 +1,11 @@
+import type { StaticMount } from '@pikku/node-http-server';
+import type { PikkuCLIConfig } from '../../../types/config.js';
+/**
+ * Turn a resolved `frontend` config into the mount that serves it.
+ *
+ * The directory is checked rather than trusted because pikku only ever reads a
+ * frontend's output: an unbuilt `dir` means the project's own build has not run,
+ * and saying so here is far cheaper than a server that boots fine and answers
+ * every page with a 404.
+ */
+export declare function resolveFrontendMount(frontend: NonNullable<PikkuCLIConfig['frontend']>): Promise<StaticMount>;

package/dist/src/functions/commands/serve-frontend.js

@@ -0,0 +1,17 @@
+import { assertFrontendBuilt } from '../../utils/frontend.js';
+/**
+ * Turn a resolved `frontend` config into the mount that serves it.
+ *
+ * The directory is checked rather than trusted because pikku only ever reads a
+ * frontend's output: an unbuilt `dir` means the project's own build has not run,
+ * and saying so here is far cheaper than a server that boots fine and answers
+ * every page with a 404.
+ */
+export async function resolveFrontendMount(frontend) {
+    await assertFrontendBuilt(frontend.dir);
+    return {
+        urlPrefix: frontend.urlPrefix,
+        directory: frontend.dir,
+        spaFallback: frontend.spaFallback,
+    };
+}

package/dist/src/functions/commands/serve.js

@@ -16,6 +16,7 @@ import { loadUserBootstrap, loadUserModule } from './load-user-project.js';
 import { registerScenarioInstrumentation } from '../wirings/scenarios/register-scenario-instrumentation.js';
 import { createDevAgentRunner } from './dev-agent-runner.js';
 import { resolveConsoleMount } from './serve-console.js';
+import { resolveFrontendMount } from './serve-frontend.js';
 import { serverReadyLine } from '../../server/server-ready.js';
 import { createEphemeralContentSigningJWT } from '../../server/content-signing-jwt.js';
 import { disableDevActorSignIn } from '../../server/actor-sign-in.js';
@@ -144,22 +145,34 @@ export const serve = pikkuSessionlessFunc({
         if (serveConsole && !consoleMount) {
             logger.warn('Console app not found. Please rebuild @pikku/cli with the console app bundled.');
         }
+        const frontendMount = config.frontend
+            ? await resolveFrontendMount(config.frontend)
+            : undefined;
+        // The console goes first so a frontend mounted at `/` cannot claim
+        // `/console` before the console's own mount is offered the request.
+        const staticMounts = [consoleMount, frontendMount].filter((mount) => Boolean(mount));
         const pikkuServer = devServerRunner.createServer({
             ...userConfig,
             hostname: bindHostname,
             port: resolvedPort,
             content: localContentConfig,
-            ...(consoleMount ? { staticMounts: [consoleMount] } : {}),
+            ...(staticMounts.length ? { staticMounts } : {}),
         }, logger, { contentSigningJWT });
         const lifecycle = await loadLifecycle();
         await pikkuServer.init();
         await lifecycle?.beforeStart?.(resolvedServices);
         await pikkuServer.start();
         await lifecycle?.afterStart?.(resolvedServices);
+        // Not `resolvedPort`: `--port 0` asks the OS for a free port, and every URL
+        // announced from here has to name the one it actually handed out.
+        const boundPort = pikkuServer.port;
         if (consoleMount) {
-            logger.info(`Pikku Console available at http://${hostname}:${resolvedPort}${consoleMount.urlPrefix}`);
+            logger.info(`Pikku Console available at http://${hostname}:${boundPort}${consoleMount.urlPrefix}`);
+        }
+        if (frontendMount) {
+            logger.info(`Frontend available at http://${hostname}:${boundPort}${frontendMount.urlPrefix}`);
         }
-        logger.info(serverReadyLine(hostname, resolvedPort));
+        logger.info(serverReadyLine(hostname, boundPort));
         process.once('SIGINT', async () => {
             logger.info('Stopping server...');
             try {

package/dist/src/functions/db/annotation-parser.d.ts

@@ -30,6 +30,14 @@ export interface ColAnnotation {
      * insert/update brand on the generated column type. Absent means `plain`.
      */
     form?: ColumnForm;
+    /**
+     * Which key protects this column, for an encrypted `form`. Absent means the
+     * deployment's default key.
+     *
+     * Reported as authored rather than defaulted here, so the manifest emitter
+     * stays the single place the default is applied.
+     */
+    keyId?: string;
 }
 /** Per-table, per-column annotation map sourced from `db/annotations.ts`. */
 export type AnnotationMap = Record<string, Record<string, ColAnnotation>>;

package/dist/src/functions/db/annotation-parser.js

@@ -117,6 +117,8 @@ export function loadAnnotations(rootDir) {
                     COLUMN_FORMS.includes(ann.form)) {
                     entry.form = ann.form;
                 }
+                if (ann.keyId)
+                    entry.keyId = ann.keyId;
                 const strategy = parseStrategy(ann.classification);
                 if (strategy !== null)
                     entry.anonymize = strategy;

package/dist/src/functions/db/db-codegen.js

@@ -340,6 +340,14 @@ function emitInterface(table, camelCase, explicitAnnotations, dialect, enumByNam
     return `export interface ${ifaceName} {\n${fields}\n}`;
 }
 // ─── Manifest emitter ────────────────────────────────────────────────────────
+/**
+ * The key an encrypted column is protected by when it names none.
+ *
+ * Spelled out in every entry rather than left implicit, so the set of keys a
+ * deployment has to resolve can be read off the manifest without knowing the
+ * rule that produced it.
+ */
+const DEFAULT_COLUMN_KEY_ID = 'default';
 function emitManifest(tables, explicitAnnotations) {
     const tableEntries = tables
         .map((table) => {
@@ -354,8 +362,15 @@ function emitManifest(tables, explicitAnnotations) {
             // tell "held in the clear, stated" from "nobody has said yet", and a
             // defaulted 'plain' would erase exactly that difference.
             const formLiteral = ann?.form ? `, form: '${ann.form}'` : '';
+            // Only a column that is actually encrypted names a key. Emitting one
+            // on a plain or hashed column would claim a protection it has not
+            // got — and a hash has no key to be opened with in the first place.
+            const encrypted = ann?.form === 'wrapped' || ann?.form === 'sealed';
+            const keyIdLiteral = encrypted
+                ? `, keyId: '${ann?.keyId ?? DEFAULT_COLUMN_KEY_ID}'`
+                : '';
             return (`      ${JSON.stringify(col.name)}: ` +
-                `{ classification: '${classification}', anonymize_strategy: ${strategyLiteral}${formLiteral} }`);
+                `{ classification: '${classification}', anonymize_strategy: ${strategyLiteral}${formLiteral}${keyIdLiteral} }`);
         })
             .join(',\n');
         return `    ${JSON.stringify(table.name)}: {\n${colEntries}\n    }`;
@@ -391,6 +406,10 @@ function emitClassificationMap(tables) {
         `   *  real encrypt/seal/hash result can be written to it. Defaults to 'plain',`,
         `   *  which on a \`secret\` column is warned about (PKU483) until stated here. */`,
         `  form?: 'plain' | 'hashed' | 'wrapped' | 'sealed'`,
+        `  /** Which key protects this column, for a 'wrapped' or 'sealed' form. It is a`,
+        `   *  purpose, not a tenant: naming one here says these columns open together and`,
+        `   *  separately from the rest. Defaults to 'default'. */`,
+        `  keyId?: string`,
         `  /** Anonymize strategy used by \`pikku db anonymize\`. */`,
         `  classification?: 'fake:email' | 'fake:name' | 'hash' | 'keep'`,
         `  /** Column kind override for codegen coercion + typing. */`,

package/dist/src/functions/validate/shared-checks.d.ts

@@ -55,6 +55,31 @@ export declare function readTextSafe(path: string): Promise<string | null>;
  * optional schema qualifier, since `main.audit` is the same table.
  */
 export declare function migrationCreatesTable(sql: string, tableName: string): boolean;
+/**
+ * Every table name one better-auth model can be sitting under.
+ *
+ * `modelName` renames a model's table — `user: { modelName: 'authUser' }` is
+ * how an app keeps better-auth's rows out of a `user` table it already owns —
+ * and the adapter's CamelCasePlugin then writes that as `auth_user`. An app
+ * that renames all four models has none of the default names in its
+ * migrations, so a default-names-only check reported it as having no auth
+ * schema at all. Accept the default, the override, and the override's
+ * snake_case form.
+ */
+export declare const betterAuthTableAliases: (model: string, configText: string) => string[];
+/**
+ * Static value imports of a package the deploy bundler stubs.
+ *
+ * A unit that does not require the service gets the package rewritten to
+ * `export {}`, so a static named import fails to bundle — once per unit, with
+ * an esbuild message that names the stub rather than the mistake. Type-only
+ * imports are erased before bundling and a side-effect import binds nothing,
+ * so neither is reported.
+ */
+export declare const staticStubbedImports: (code: string) => Array<{
+    module: string;
+    service: string;
+}>;
 /**
  * Every check that is true of any pikku project, regardless of where it deploys.
  *

package/dist/src/functions/validate/shared-checks.js

@@ -8,6 +8,7 @@ import { runAuthPluginChecks } from './auth-plugin-checks.js';
 import { runScenarioFileChecks } from './scenario-file-checks.js';
 import { projectWiresChannels, runWebsocketDepsChecks, } from './websocket-deps-checks.js';
 import { resolveFromProject } from '../../utils/resolve-from-project.js';
+import { SERVICE_MODULE_MAP } from '../../deploy/bundler/service-module-map.js';
 /**
  * A malformed config is named, never reported as absent.
  *
@@ -73,6 +74,81 @@ export function migrationCreatesTable(sql, tableName) {
 }
 /** better-auth's core schema — the tables its adapter queries on every request. */
 const BETTER_AUTH_TABLES = ['user', 'session', 'account', 'verification'];
+/**
+ * Every table name one better-auth model can be sitting under.
+ *
+ * `modelName` renames a model's table — `user: { modelName: 'authUser' }` is
+ * how an app keeps better-auth's rows out of a `user` table it already owns —
+ * and the adapter's CamelCasePlugin then writes that as `auth_user`. An app
+ * that renames all four models has none of the default names in its
+ * migrations, so a default-names-only check reported it as having no auth
+ * schema at all. Accept the default, the override, and the override's
+ * snake_case form.
+ */
+export const betterAuthTableAliases = (model, configText) => {
+    const override = configText.match(new RegExp(`\\b${model}\\s*:\\s*\\{[^{}]*?\\bmodelName\\s*:\\s*['"\`](\\w+)['"\`]`))?.[1];
+    if (!override)
+        return [model];
+    return [
+        model,
+        override,
+        override.replace(/([a-z0-9])([A-Z])/g, '$1_$2').toLowerCase(),
+    ];
+};
+/**
+ * Static value imports of a package the deploy bundler stubs.
+ *
+ * A unit that does not require the service gets the package rewritten to
+ * `export {}`, so a static named import fails to bundle — once per unit, with
+ * an esbuild message that names the stub rather than the mistake. Type-only
+ * imports are erased before bundling and a side-effect import binds nothing,
+ * so neither is reported.
+ */
+export const staticStubbedImports = (code) => {
+    const found = [];
+    const statements = code.matchAll(/^[ \t]*import\s+(?!type\s)([\s\S]*?)\s*from\s*['"`]([^'"`]+)['"`]/gm);
+    for (const statement of statements) {
+        const clause = statement[1];
+        const specifier = statement[2];
+        const named = clause.match(/^\{([\s\S]*)\}$/);
+        if (named &&
+            named[1]
+                .split(',')
+                .filter((binding) => binding.trim().length > 0)
+                .every((binding) => /^type\s/.test(binding.trim()))) {
+            continue;
+        }
+        for (const [service, patterns] of Object.entries(SERVICE_MODULE_MAP)) {
+            if (patterns.some((pattern) => pattern.test(specifier))) {
+                found.push({ module: specifier, service });
+            }
+        }
+    }
+    return found;
+};
+/**
+ * The text of every source file that configures better-auth, concatenated.
+ *
+ * Narrowed to files mentioning `betterAuth` so a `modelName` belonging to some
+ * other library cannot rename an auth table out from under the check.
+ */
+const readAuthConfigText = async (srcDir) => {
+    if (!existsSync(srcDir))
+        return '';
+    let entries;
+    try {
+        entries = (await readdir(srcDir, { recursive: true })).filter((f) => typeof f === 'string' &&
+            f.endsWith('.ts') &&
+            !f.includes('node_modules'));
+    }
+    catch {
+        return '';
+    }
+    const texts = await Promise.all(entries.map((f) => readTextSafe(join(srcDir, f))));
+    return texts
+        .filter((t) => Boolean(t) && /betterAuth/.test(t))
+        .join('\n');
+};
 /**
  * Scaffold flags that gate a generated surface the pikku console calls.
  *
@@ -223,9 +299,15 @@ export async function runSharedProjectChecks(root) {
             }
         }
         const servicesPath = join(fnDir, 'src', 'services.ts');
-        if (!(await readTextSafe(servicesPath))) {
+        const servicesText = await readTextSafe(servicesPath);
+        if (!servicesText) {
             w('services-missing', 'packages/functions/src/services.ts not found', servicesPath, 'Create services.ts and export your service factory for the workspace');
         }
+        else {
+            for (const { module, service } of staticStubbedImports(servicesText)) {
+                e('services-static-stubbed-import', `services.ts imports '${module}' statically, but the deploy bundler stubs it in every unit that does not require '${service}'`, servicesPath, lines(`Every unit without '${service}' gets '${module}' rewritten to \`export {}\`, so a static import fails to bundle there.`, 'Import the type only, then load the package when you build the service:', `  const mod = await import('${module}')`, '  if (mod.SomeExport) { ... }', 'See templates/starter-template/packages/functions/src/services.ts for the shape.'));
+            }
+        }
         // ── auth schema ──────────────────────────────────────────────────────
         // The tables are better-auth's own (`user`, `session`, `account`,
         // `verification`) because those are what the adapter queries. This check
@@ -257,8 +339,10 @@ export async function runSharedProjectChecks(root) {
                     const allSql = (await Promise.all(files.map((f) => readTextSafe(join(migrationsDir, f)))))
                         .filter((sql) => Boolean(sql))
                         .join('\n');
+                    const authConfigText = await readAuthConfigText(join(fnDir, 'src'));
                     for (const table of BETTER_AUTH_TABLES) {
-                        if (!migrationCreatesTable(allSql, table)) {
+                        const aliases = betterAuthTableAliases(table, authConfigText);
+                        if (!aliases.some((name) => migrationCreatesTable(allSql, name))) {
                             missingAuthTables.push(table);
                         }
                     }

package/dist/src/functions/wirings/middleware/serialize-middleware-types.js

@@ -24,7 +24,7 @@ import type { PikkuAgentMiddlewareHooks } from '@pikku/core/agent'
 import type { Services, SingletonServices } from '${functionTypesImportPath}'
 ${requiredServicesTypeImport}
 
-export { cors, authAPIKey, authBearer, authCookie } from '@pikku/core/middleware'
+export { cors, requireOrigin, authAPIKey, authBearer, authCookie } from '@pikku/core/middleware'
 export type { MiddlewarePriority }
 
 /**

package/dist/src/functions/wirings/variables/serialize-variables-types.js

@@ -24,7 +24,11 @@ export const serializeVariablesTypes = ({ definitions, schemaLookup, variablesFi
                 }
                 schemaImports.get(schemaRef.sourceFile).add(schemaRef.variableName);
                 mapEntries.push(`  '${meta.variableId}': z.infer<typeof ${schemaRef.variableName}>`);
-                metaEntries.push(`  '${meta.variableId}': { name: '${name}', displayName: ${literal(meta.displayName)} }`);
+                // The schema is emitted behind a thunk because this file and the one
+                // declaring the schema import each other: reading it while the modules
+                // are still initializing throws `Cannot access '<schema>' before
+                // initialization`, and deferring the read to first use avoids the cycle.
+                metaEntries.push(`  '${meta.variableId}': { name: '${name}', displayName: ${literal(meta.displayName)}, schema: () => ${schemaRef.variableName} }`);
             }
         }
     }