@pikku/cli 0.12.126 → 0.12.128

package/dist/src/fabric/lib/finding.js

@@ -0,0 +1,156 @@
+import { z } from 'zod';
+export const FindingInput = z.object({
+    title: z.string(),
+    kind: z.enum(['product', 'harness']),
+    model: z.string(),
+    expected: z.string(),
+    actual: z.string(),
+    skill: z.string().optional(),
+    passage: z.string().optional(),
+    command: z.string().optional(),
+    error: z.string().optional(),
+    repro: z.string().optional(),
+    workaround: z.string().optional(),
+    proposal: z.string().optional(),
+    tried: z.string().optional(),
+    unresolved: z.boolean().optional(),
+    area: z.string().optional(),
+    surface: z.enum(['local', 'deployed', 'both']).optional(),
+    cost: z.string().optional(),
+    run: z.string().optional(),
+    deployTarget: z.string().optional(),
+});
+/** Shape-check a finding from either path, naming every field that is wrong. */
+export function parseFinding(value) {
+    const result = FindingInput.safeParse(value);
+    if (result.success)
+        return { finding: result.data };
+    return {
+        problems: result.error.issues.map((issue) => `${issue.path.join('.') || 'finding'}: ${issue.message}`),
+    };
+}
+/**
+ * A finding read as JSON rather than assembled out of flags.
+ *
+ * Half the fields are prose, and prose carries apostrophes, quotes, backticks
+ * and newlines — every one of them a shell metacharacter before it is a
+ * character in a sentence. An error message pasted into `--error` breaks the
+ * command at its first newline; one carrying a backtick runs whatever follows
+ * it. JSON has its own escaping, so this path has none of that.
+ *
+ * Returns the finding or the problems with it, never throws: a malformed
+ * payload is a usage mistake worth naming precisely.
+ */
+export function parseFindingJson(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (error) {
+        return {
+            problems: [`--stdin expected a JSON object (${error.message}).`],
+        };
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        return { problems: ['--stdin expected a JSON object.'] };
+    }
+    return parseFinding(parsed);
+}
+/**
+ * The rules the field set exists to enforce, checked before anything is sent.
+ *
+ * A usage mistake is the agent's own and is worth failing loudly for — unlike a
+ * failed send, which must never surface as a build failure. Every problem is
+ * returned at once so a malformed call is fixed in one pass.
+ */
+export function validateFinding(input) {
+    const problems = [];
+    if (input.kind === 'harness' && !input.skill) {
+        problems.push('A harness finding names the skill that misled you — pass --skill (and --passage for the line it contradicts).');
+    }
+    if (input.unresolved) {
+        if (!input.tried) {
+            problems.push('An unresolved finding carries what you tried and how each attempt failed — pass --tried.');
+        }
+        if (input.workaround) {
+            problems.push('Unresolved means no workaround was found. Drop --unresolved, or drop --workaround.');
+        }
+    }
+    else if (!input.workaround && !input.proposal) {
+        problems.push('A resolved finding carries the workaround you used — pass --workaround, or --unresolved if there was none.');
+    }
+    return problems;
+}
+export function buildFindingPayload(input, environment, now = new Date()) {
+    const { run, ...rest } = input;
+    return { ...rest, runId: run, environment, reportedAt: now.toISOString() };
+}
+/**
+ * Best-effort by construction. A finding is worth having and never worth
+ * failing a build for, so a refused, slow or unreachable endpoint is reported
+ * to the terminal and swallowed.
+ */
+export async function postFinding(opts) {
+    try {
+        const response = await fetch(`${opts.apiUrl}/findings`, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/json',
+                authorization: `Bearer ${opts.token}`,
+            },
+            body: JSON.stringify({
+                projectId: opts.projectId,
+                finding: opts.payload,
+            }),
+            signal: AbortSignal.timeout(opts.timeoutMs ?? 5000),
+        });
+        if (!response.ok) {
+            return { sent: false, reason: `fabric answered ${response.status}` };
+        }
+        return { sent: true };
+    }
+    catch (error) {
+        return { sent: false, reason: error?.message ?? 'request failed' };
+    }
+}
+/**
+ * The receipt. Nothing is written to disk, so the terminal is the only place
+ * the user sees what left their machine. Printed before the request goes out,
+ * so it is there whether or not the send succeeds.
+ */
+export function renderReceipt(payload) {
+    const lines = [`[fabric] reporting: ${payload.title}`];
+    const field = (label, value) => {
+        if (value)
+            lines.push(`  ${label}: ${value}`);
+    };
+    field('kind', payload.unresolved ? `${payload.kind} (unresolved)` : payload.kind);
+    field('area', payload.area);
+    field('skill', payload.passage ? `${payload.skill} — ${payload.passage}` : payload.skill);
+    field('command', payload.command);
+    field('expected', payload.expected);
+    field('actual', payload.actual);
+    field('error', payload.error);
+    field('surface', payload.surface);
+    field('cost', payload.cost);
+    field('repro', payload.repro);
+    field('workaround', payload.workaround);
+    field('tried', payload.tried);
+    field('proposal', payload.proposal);
+    field('model', payload.model);
+    field('run', payload.runId);
+    field('deploy target', payload.deployTarget);
+    field('reported at', payload.reportedAt);
+    const env = payload.environment;
+    field('versions', env.packages
+        .map((p) => `${p.name}@${p.version}${p.linked ? ' (linked)' : ''}`)
+        .join(' ') || 'no @pikku/* found');
+    if (env.versionSkew) {
+        lines.push('  note: the installed @pikku/* versions are not all the same');
+    }
+    if (env.linkedFramework) {
+        lines.push('  note: an @pikku/* resolves to a workspace or link — this app is running framework code that may be modified');
+    }
+    field('runtime', `node ${env.node} ${env.platform} ${env.packageManager ?? ''}`.trim());
+    return lines.join('\n');
+}

package/dist/src/fabric/lib/report-environment.d.ts

@@ -0,0 +1,53 @@
+/** One installed `@pikku/*` package as it actually resolves on disk. */
+export interface PikkuPackageVersion {
+    name: string;
+    version: string;
+    /**
+     * Resolved through a symlink — a yarn workspace or a `yarn link`ed checkout
+     * rather than a published tarball. The framework is read-only during a build
+     * run, so a linked package is code that may already have been modified, and a
+     * finding describing it is describing something other than a release.
+     */
+    linked: boolean;
+}
+export interface ReportEnvironment {
+    packages: PikkuPackageVersion[];
+    /**
+     * The resolved `@pikku/*` versions are not all the same. Pinning the CLI does
+     * not pin its `@pikku/*` dependencies, so a mixed tree is a common cause of
+     * behaviour that looks like a framework bug.
+     */
+    versionSkew: boolean;
+    /** Any package is `linked` — see {@link PikkuPackageVersion.linked}. */
+    linkedFramework: boolean;
+    node: string;
+    packageManager: string | null;
+    platform: string;
+}
+/**
+ * Walk up from `startDir` for the first `node_modules/@pikku` that holds
+ * packages. A monorepo hoists to the root, an app installs locally, and either
+ * way the nearest populated scope is the one that was loaded.
+ *
+ * Populated means holding something `readPikkuPackages` would read, so the
+ * hidden entries it skips cannot qualify a scope either: a stray `.DS_Store` in
+ * an empty nested scope would otherwise end the walk there and report a tree
+ * with no packages in it.
+ */
+export declare function findPikkuScope(startDir: string): Promise<string | null>;
+/**
+ * Versions read off the installed tree rather than out of `package.json`. A
+ * range like `^0.12.35` says nothing about what ran, and the version that ran
+ * is the only one worth reporting.
+ */
+export declare function readPikkuPackages(scopeDir: string): Promise<PikkuPackageVersion[]>;
+/**
+ * `packageManager` in the nearest manifest is authoritative when it is set;
+ * otherwise the lockfile is the only evidence of what installed the tree.
+ */
+export declare function detectPackageManager(startDir: string): Promise<string | null>;
+/**
+ * Everything about the run a finding needs and no agent should be asked for.
+ * All of it is a directory read — no network, no prompting.
+ */
+export declare function collectReportEnvironment(startDir?: string): Promise<ReportEnvironment>;

package/dist/src/fabric/lib/report-environment.js

@@ -0,0 +1,119 @@
+import { readFile, lstat, readdir } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+/**
+ * Walk up from `startDir` for the first `node_modules/@pikku` that holds
+ * packages. A monorepo hoists to the root, an app installs locally, and either
+ * way the nearest populated scope is the one that was loaded.
+ *
+ * Populated means holding something `readPikkuPackages` would read, so the
+ * hidden entries it skips cannot qualify a scope either: a stray `.DS_Store` in
+ * an empty nested scope would otherwise end the walk there and report a tree
+ * with no packages in it.
+ */
+export async function findPikkuScope(startDir) {
+    let dir = startDir;
+    while (true) {
+        const candidate = join(dir, 'node_modules', '@pikku');
+        if (existsSync(candidate)) {
+            const entries = await readdir(candidate).catch(() => []);
+            if (entries.some((entry) => !entry.startsWith('.')))
+                return candidate;
+        }
+        const parent = dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+/**
+ * Versions read off the installed tree rather than out of `package.json`. A
+ * range like `^0.12.35` says nothing about what ran, and the version that ran
+ * is the only one worth reporting.
+ */
+export async function readPikkuPackages(scopeDir) {
+    const entries = await readdir(scopeDir).catch(() => []);
+    const packages = [];
+    for (const entry of entries.sort()) {
+        if (entry.startsWith('.'))
+            continue;
+        const packageDir = join(scopeDir, entry);
+        const manifest = join(packageDir, 'package.json');
+        const raw = await readFile(manifest, 'utf8').catch(() => null);
+        if (!raw)
+            continue;
+        let version;
+        try {
+            version = JSON.parse(raw).version;
+        }
+        catch {
+            continue;
+        }
+        if (typeof version !== 'string')
+            continue;
+        const stats = await lstat(packageDir).catch(() => null);
+        packages.push({
+            name: `@pikku/${entry}`,
+            version,
+            linked: stats?.isSymbolicLink() ?? false,
+        });
+    }
+    return packages;
+}
+const LOCKFILES = [
+    ['yarn.lock', 'yarn'],
+    ['pnpm-lock.yaml', 'pnpm'],
+    ['bun.lockb', 'bun'],
+    ['bun.lock', 'bun'],
+    ['package-lock.json', 'npm'],
+];
+/**
+ * `packageManager` in the nearest manifest is authoritative when it is set;
+ * otherwise the lockfile is the only evidence of what installed the tree.
+ */
+export async function detectPackageManager(startDir) {
+    let dir = startDir;
+    while (true) {
+        const manifest = join(dir, 'package.json');
+        if (existsSync(manifest)) {
+            const raw = await readFile(manifest, 'utf8').catch(() => null);
+            if (raw) {
+                try {
+                    const declared = JSON.parse(raw)
+                        .packageManager;
+                    if (typeof declared === 'string' && declared.length > 0) {
+                        return declared;
+                    }
+                }
+                catch {
+                    // An unparseable manifest tells us nothing; keep walking up.
+                }
+            }
+        }
+        for (const [lockfile, manager] of LOCKFILES) {
+            if (existsSync(join(dir, lockfile)))
+                return manager;
+        }
+        const parent = dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+/**
+ * Everything about the run a finding needs and no agent should be asked for.
+ * All of it is a directory read — no network, no prompting.
+ */
+export async function collectReportEnvironment(startDir = process.cwd()) {
+    const scope = await findPikkuScope(startDir);
+    const packages = scope ? await readPikkuPackages(scope) : [];
+    const versions = new Set(packages.map((p) => p.version));
+    return {
+        packages,
+        versionSkew: versions.size > 1,
+        linkedFramework: packages.some((p) => p.linked),
+        node: process.version,
+        packageManager: await detectPackageManager(startDir),
+        platform: `${process.platform}-${process.arch}`,
+    };
+}

package/dist/src/functions/commands/dev.js

@@ -4,7 +4,7 @@ import { pikkuSessionlessFunc } from '#pikku/function';
 import chokidar from 'chokidar';
 import { pikkuDevReloader, reloadGeneratedMeta, reconcileAddonRegistry, } from '@pikku/core/dev';
 import { InMemoryQueueService, QueueWebhookService } from '@pikku/core/services';
-import { ConsoleLogger, LocalEmailService, spy, InMemoryAgentRunStateService, } from '@pikku/core/services';
+import { ConsoleLogger, LocalEmailService, LocalCredentialService, spy, InMemoryAgentRunStateService, } from '@pikku/core/services';
 import { InMemoryTriggerService } from '@pikku/core/services';
 import { InMemoryWorkflowService } from '@pikku/core/services';
 import { KyselyAgentStorageService, KyselyAgentRunStateService, KyselyAgentRunService, } from '@pikku/kysely';
@@ -230,6 +230,7 @@ export const dev = pikkuSessionlessFunc({
             workflowService,
             workflowRunService: workflowService,
             triggerService: new InMemoryTriggerService(),
+            credentialService: new LocalCredentialService(),
             agentStorage,
             agentRunState,
             agentRunService,

package/dist/src/functions/commands/dist.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Carry into the build output the files `tsc` compiles around but never emits.
+ *
+ * `tsc` turns the generated `.ts` under the pikku out dir into JavaScript, so
+ * that half arrives on its own. Two kinds of file do not:
+ *
+ *  - the `*.gen.json` meta pikku writes beside them. `resolveJsonModule` lets
+ *    TypeScript *read* a json, it never copies one to `outDir`, and the meta is
+ *    read off disk at runtime — `MetaService` opens it by path — so a package
+ *    that ships only tsc's output answers every meta lookup with nothing.
+ *  - a hand-authored `.d.ts` such as `types/application-types.d.ts`. A
+ *    declaration file is an input, and `declaration: true` does not re-emit it.
+ *
+ * Packages used to do this with `cp -r .pikku types dist/`, which also dumped
+ * every `.ts` source into the published output and needed a POSIX shell.
+ */
+export type DistCopy = {
+    from: string;
+    to: string;
+};
+export declare const planDistCopies: (rootDir: string, distDir: string, files: string[]) => DistCopy[];
+export declare const pikkuDist: import("#pikku/function").PikkuFunctionConfig<{
+    distDir?: string;
+}, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<{
+    distDir?: string;
+}, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<{
+    distDir?: string;
+}, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/dist.js

@@ -0,0 +1,58 @@
+import { existsSync } from 'node:fs';
+import { cp, mkdir, readdir } from 'node:fs/promises';
+import { dirname, join, relative, resolve } from 'node:path';
+import ts from 'typescript';
+import { pikkuSessionlessFunc } from '#pikku/function';
+/**
+ * `tsc` compiles a `.ts` and emits it. Everything else it either reads without
+ * emitting — a `.d.ts` is an input, `declaration: true` does not re-emit one —
+ * or ignores entirely, like the generated json.
+ */
+const tscEmitsIt = (file) => file.endsWith('.ts') && !file.endsWith('.d.ts');
+const walk = async (dir) => {
+    if (!existsSync(dir)) {
+        return [];
+    }
+    const entries = await readdir(dir, { withFileTypes: true });
+    const files = await Promise.all(entries.map(async (entry) => {
+        const path = join(dir, entry.name);
+        return entry.isDirectory() ? walk(path) : [path];
+    }));
+    return files.flat();
+};
+export const planDistCopies = (rootDir, distDir, files) => {
+    return files
+        .filter((file) => !tscEmitsIt(file))
+        .map((from) => ({
+        from,
+        to: join(distDir, relative(rootDir, from)),
+    }));
+};
+const readTsOutDir = (tsconfig) => {
+    const parsed = ts.getParsedCommandLineOfConfigFile(tsconfig, {}, {
+        ...ts.sys,
+        onUnRecoverableConfigFileDiagnostic: () => { },
+    });
+    return parsed?.options.outDir;
+};
+export const pikkuDist = pikkuSessionlessFunc({
+    func: async ({ logger, config }, data) => {
+        const { rootDir, outDir, srcDirectories, tsconfig } = config;
+        const distDir = data.distDir
+            ? resolve(rootDir, data.distDir)
+            : readTsOutDir(resolve(rootDir, tsconfig));
+        if (!distDir) {
+            logger.error(`${tsconfig} sets no compilerOptions.outDir, so there is nowhere to copy to. Set one, or pass --dist-dir.`);
+            process.exit(1);
+        }
+        const copies = planDistCopies(rootDir, distDir, [
+            ...(await walk(outDir)),
+            ...(await Promise.all(srcDirectories.map((dir) => walk(resolve(rootDir, dir))))).flat(),
+        ]);
+        for (const { from, to } of copies) {
+            await mkdir(dirname(to), { recursive: true });
+            await cp(from, to);
+        }
+        logger.info(`Copied ${copies.length} generated file(s) into ${relative(rootDir, distDir) || distDir}`);
+    },
+});

package/dist/src/functions/commands/environment.d.ts

@@ -11,6 +11,11 @@
 export interface PikkuEnvironment {
     apiUrl: string;
     signInPath?: string;
+    /**
+     * Where the session and its roles are read back, for a stage that reports
+     * them somewhere other than `get-session` under the sign-in path's own mount.
+     */
+    sessionPath?: string;
     rpcPath?: string;
     appUrl?: string;
     /**

package/dist/src/functions/commands/new-addon.d.ts

@@ -28,6 +28,33 @@ export declare function getAddonFiles(vars: AddonVars, flags: {
     delegated?: boolean;
 }): Record<string, string>;
 export declare function getTestFiles(vars: AddonVars): Record<string, string>;
+/**
+ * Does `root`'s `workspaces` field cover `dir`?
+ *
+ * Declaring workspaces is not enough — a root with `packages/*` does not own an
+ * addon written to `addons/crm`, and yarn, npm and pnpm all skip a nested
+ * package they were never told about.
+ */
+export declare function workspaceCovers(root: string, dir: string): boolean;
+/**
+ * An addon that has not been built is dead at runtime.
+ *
+ * The generated package exports `./dist/...` — that is what an installed
+ * consumer resolves, and what the app's own `pikku-bootstrap.gen.ts` imports.
+ * Until `build` has run, every `ref('<addon>:...')` resolves to nothing and the
+ * app fails at boot with PKU340 plus an ERR_MODULE_NOT_FOUND on a dist path
+ * nobody wrote. Nothing about the generated files shows the problem, so the
+ * generator finishes the job: install at the root that owns the lockfile, then
+ * run the addon's own `build` script (whose `prebuild` is `pikku all`).
+ */
+export type AddonBuildRunner = (command: string, args: string[], cwd: string) => {
+    status: number | null;
+    error?: Error;
+};
+export declare const buildGeneratedAddon: (addonDir: string, logger: {
+    info: (message: string) => void;
+    error: (message: string) => void;
+}, run?: AddonBuildRunner) => boolean;
 export declare const pikkuNewAddon: import("#pikku/function").PikkuFunctionConfig<{
     name: string;
     displayName?: string;
@@ -43,6 +70,7 @@ export declare const pikkuNewAddon: import("#pikku/function").PikkuFunctionConfi
     authConfig?: string;
     mcp?: boolean;
     camelCase?: boolean;
+    build?: boolean;
 }, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<{
     name: string;
     displayName?: string;
@@ -58,6 +86,7 @@ export declare const pikkuNewAddon: import("#pikku/function").PikkuFunctionConfi
     authConfig?: string;
     mcp?: boolean;
     camelCase?: boolean;
+    build?: boolean;
 }, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<{
     name: string;
     displayName?: string;
@@ -73,4 +102,5 @@ export declare const pikkuNewAddon: import("#pikku/function").PikkuFunctionConfi
     authConfig?: string;
     mcp?: boolean;
     camelCase?: boolean;
+    build?: boolean;
 }, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/new-addon.js

@@ -1,6 +1,8 @@
 import { existsSync, readFileSync } from 'fs';
-import { dirname, join } from 'path';
+import { dirname, join, relative as relativePath, sep } from 'path';
 import { mkdir, writeFile } from 'fs/promises';
+import { spawnSync } from 'node:child_process';
+import { findInstallRoot } from './update.js';
 import { createEmptyManifest, saveManifest, } from '../../utils/contract-versions.js';
 import { pikkuSessionlessFunc } from '#pikku/function';
 import { parseOpenAPISpec, computeContractHash, generateAddonFromOpenAPI, loadAuthConfig, } from '@pikku/openapi-parser';
@@ -159,7 +161,7 @@ export function getAddonFiles(vars, flags) {
         scripts: {
             prepublishOnly: 'yarn build',
             prebuild: 'pikku all',
-            build: 'tsc && cp -r .pikku types dist/',
+            build: 'tsc && pikku dist',
             pikku: 'pikku all',
         },
         peerDependencies: {
@@ -851,8 +853,81 @@ async function writeFiles(baseDir, files) {
     }
     return written;
 }
+/**
+ * Does `root`'s `workspaces` field cover `dir`?
+ *
+ * Declaring workspaces is not enough — a root with `packages/*` does not own an
+ * addon written to `addons/crm`, and yarn, npm and pnpm all skip a nested
+ * package they were never told about.
+ */
+export function workspaceCovers(root, dir) {
+    const relative = relativePath(root, dir).split(sep).join('/');
+    if (relative === '' || relative.startsWith('..')) {
+        return false;
+    }
+    let patterns;
+    try {
+        const manifest = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
+        patterns = Array.isArray(manifest.workspaces)
+            ? manifest.workspaces
+            : manifest.workspaces?.packages;
+    }
+    catch {
+        return false;
+    }
+    if (!Array.isArray(patterns)) {
+        return false;
+    }
+    return patterns.some((pattern) => {
+        if (typeof pattern !== 'string') {
+            return false;
+        }
+        const source = pattern
+            .split('/')
+            .map((segment) => segment === '**'
+            ? '.*'
+            : segment.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '[^/]*'))
+            .join('/');
+        return new RegExp(`^${source}$`).test(relative);
+    });
+}
+const spawnAddonBuildStep = (command, args, cwd) => {
+    const { status, error } = spawnSync(command, args, {
+        cwd,
+        stdio: 'inherit',
+        shell: process.platform === 'win32',
+    });
+    return { status, error };
+};
+export const buildGeneratedAddon = (addonDir, logger, run = spawnAddonBuildStep) => {
+    const { dir: installDir, packageManager } = findInstallRoot(addonDir);
+    if (packageManager === 'unknown') {
+        logger.error(`Could not tell which package manager owns ${addonDir} — the addon is generated but NOT built. Run install, then the addon's build script, in ${addonDir} before using it.`);
+        return false;
+    }
+    // A root install only reaches the addon when the root's workspace patterns
+    // cover it. A root that owns the lockfile but not this package installs
+    // nothing for it, so its devDependencies — `@pikku/cli` and `typescript`,
+    // which the build script needs — would never arrive.
+    const installIn = workspaceCovers(installDir, addonDir)
+        ? installDir
+        : addonDir;
+    const steps = [
+        [installIn, ['install']],
+        [addonDir, ['run', 'build']],
+    ];
+    for (const [cwd, args] of steps) {
+        logger.info(`${packageManager} ${args.join(' ')} (${cwd})`);
+        const result = run(packageManager, args, cwd);
+        if (result.status !== 0) {
+            logger.error(`${packageManager} ${args.join(' ')} failed in ${cwd}: ${result.error?.message ?? `exit ${result.status}`}`);
+            return false;
+        }
+    }
+    return true;
+};
 export const pikkuNewAddon = pikkuSessionlessFunc({
-    func: async ({ logger, config }, { name, displayName, description, category = 'General', dir, secret = false, variable = false, oauth = false, credential, test = true, openapi, authConfig, mcp = false, camelCase = false, }) => {
+    func: async ({ logger, config }, { name, displayName, description, category = 'General', dir, secret = false, variable = false, oauth = false, credential, test = true, openapi, authConfig, mcp = false, camelCase = false, build = true, }) => {
         name = sanitizeAddonName(name);
         if (!/^[a-z][a-z0-9_-]*$/.test(name)) {
             logger.error(`Invalid addon name "${name}": must start with a lowercase letter and contain only lowercase alphanumerics, hyphens, and underscores`);
@@ -949,6 +1024,9 @@ export const pikkuNewAddon = pikkuSessionlessFunc({
         for (const f of written) {
             logger.debug({ message: `  ${f}`, type: 'success' });
         }
+        if (build && !buildGeneratedAddon(addonDir, logger)) {
+            process.exit(1);
+        }
         console.log(addonDir);
     },
 });

package/dist/src/functions/commands/persona-sync.d.ts

@@ -9,10 +9,11 @@
  * config and write through it, which provisioned a local stage correctly and
  * silently provisioned the wrong database for every other environment.
  *
- * So the deployment provisions itself: an app calls `provisionPersonas` from
- * `@pikku/better-auth` in its server lifecycle, where the database connection
- * and better-auth's own adapter are both already open, and a deploy carries its
- * personas with it. What is left here is the half that needs no database — the
+ * So the deployment provisions itself: an app hands its personas to
+ * `pikkuFabric` from `@pikku/better-auth`, and the plugin creates a missing one
+ * on the operator handshake that asks for it, where the database connection and
+ * better-auth's own adapter are both already open. What is left here is the
+ * half that needs no database — the
  * declaration, and the environment rule applied to it — which is what tells you
  * before a deploy whether the accounts you expect will appear.
  */

package/dist/src/functions/commands/persona-sync.js

@@ -12,10 +12,11 @@ import { resolvePersonas } from '../../utils/resolve-personas.js';
  * config and write through it, which provisioned a local stage correctly and
  * silently provisioned the wrong database for every other environment.
  *
- * So the deployment provisions itself: an app calls `provisionPersonas` from
- * `@pikku/better-auth` in its server lifecycle, where the database connection
- * and better-auth's own adapter are both already open, and a deploy carries its
- * personas with it. What is left here is the half that needs no database — the
+ * So the deployment provisions itself: an app hands its personas to
+ * `pikkuFabric` from `@pikku/better-auth`, and the plugin creates a missing one
+ * on the operator handshake that asks for it, where the database connection and
+ * better-auth's own adapter are both already open. What is left here is the
+ * half that needs no database — the
  * declaration, and the environment rule applied to it — which is what tells you
  * before a deploy whether the accounts you expect will appear.
  */
@@ -65,6 +66,6 @@ export const personaSync = pikkuSessionlessFunc({
         for (const refusal of skipped) {
             logger.info(`  skipped: ${refusal}`);
         }
-        logger.info("  Provisioning runs in the deployment: call `provisionPersonas` from '@pikku/better-auth' in your server lifecycle, passing `personaConfigs` and `personaEnvironments` from the generated personas file.");
+        logger.info("  Provisioning runs in the deployment: pass `personas: { personas: personaConfigs, environments: personaEnvironments }` from the generated personas file to `pikkuFabric` from '@pikku/better-auth'.");
     },
 });