@pikku/cli 0.12.127 → 0.12.128

package/dist/.pikku/variables/pikku-variable-types.gen.d.ts

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.127
+ * This file was generated by @pikku/cli@0.12.128
  */
 export { defineVariable } from '@pikku/core/variable';

package/dist/.pikku/variables/pikku-variable-types.gen.js

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.127
+ * This file was generated by @pikku/cli@0.12.128
  */
 export { defineVariable } from '@pikku/core/variable';

package/dist/.pikku/variables/pikku-variables.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.127
+ * This file was generated by @pikku/cli@0.12.128
  */
 import { TypedVariablesService as CoreTypedVariablesService } from '@pikku/core/services';
 import type { VariablesService } from '@pikku/core/services';

package/dist/.pikku/variables/pikku-variables.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.127
+ * This file was generated by @pikku/cli@0.12.128
  */
 import { TypedVariablesService as CoreTypedVariablesService, } from '@pikku/core/services';
 /**

package/dist/.pikku/workflow/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.127
+ * This file was generated by @pikku/cli@0.12.128
  */
 /**
  * Subpath entry — `#pikku/workflow` resolves here.

package/dist/.pikku/workflow/index.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.127
+ * This file was generated by @pikku/cli@0.12.128
  */
 /**
  * Subpath entry — `#pikku/workflow` resolves here.

package/dist/.pikku/workflow/pikku-workflow-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.127
+ * This file was generated by @pikku/cli@0.12.128
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import type { PikkuWorkflowGraphConfig, PikkuWorkflowGraphResult } from '@pikku/core/workflow';

package/dist/.pikku/workflow/pikku-workflow-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.127
+ * This file was generated by @pikku/cli@0.12.128
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import { pikkuWorkflowGraph as corePikkuWorkflowGraph } from '@pikku/core/workflow';

package/dist/.pikku/workflow/pikku-workflow-wirings-meta.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.127
+ * This file was generated by @pikku/cli@0.12.128
  */
 import { pikkuState } from '@pikku/core/state';
 import allWorkflowMeta from './meta/allWorkflow.gen.json' with { type: 'json' };

package/dist/.pikku/workflow/pikku-workflow-wirings.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.127
+ * This file was generated by @pikku/cli@0.12.128
  */
 import { addWorkflow } from '@pikku/core/workflow';
 import './pikku-workflow-wirings-meta.gen.js';

package/dist/bin/pikku-bin.mjs

@@ -11,8 +11,8 @@ async function checkForUpdate() {
     })
     if (!res.ok) return
     const { version: latest } = await res.json()
-    if (latest !== '0.12.127') {
-      process.stderr.write(`\n  Update available  0.12.127 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
+    if (latest !== '0.12.128') {
+      process.stderr.write(`\n  Update available  0.12.128 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
     }
   } catch {}
 }

package/dist/src/cli.wiring.js

@@ -12,6 +12,7 @@ import { pikkuCLICommand, wireCLI } from '../.pikku/cli/pikku-cli-types.gen.js';
 import { fabricCommands } from './fabric/fabric-commands.js';
 import { all } from './functions/commands/all.js';
 import { bootstrap } from './functions/commands/bootstrap.js';
+import { pikkuDist } from './functions/commands/dist.js';
 import { watch } from './functions/commands/watch.js';
 import { login, logout, whoami } from './functions/commands/login.js';
 import { dev } from './functions/commands/dev.js';
@@ -231,6 +232,16 @@ wireCLI({
             func: bootstrap,
             description: 'Generate only type files (setup phase only)',
         }),
+        dist: pikkuCLICommand({
+            func: pikkuDist,
+            description: "Copy the generated files tsc cannot emit — the .gen.json meta, and hand-authored .d.ts — into the build output. Run it after tsc, as a package's build script",
+            options: {
+                distDir: {
+                    description: "Where to copy to. Defaults to the tsconfig's compilerOptions.outDir",
+                    type: 'string',
+                },
+            },
+        }),
         audit: pikkuCLICommand({
             func: pikkuAudit,
             description: 'Audit dependencies for security advisories (always) and available updates (--outdated); writes .pikku/audit.json',
@@ -635,7 +646,7 @@ wireCLI({
                 }),
                 sync: pikkuCLICommand({
                     func: personaSync,
-                    description: "Report which personas an environment will provision, with which roles, and why any of them were skipped. The provisioning itself happens in the deployment — call provisionPersonas from '@pikku/better-auth' in your server lifecycle — because the CLI has no connection to a deployed environment's database.",
+                    description: "Report which personas an environment will provision, with which roles, and why any of them were skipped. The provisioning itself happens in the deployment — pass the generated personas to pikkuFabric from '@pikku/better-auth' — because the CLI has no connection to a deployed environment's database.",
                     parameters: '<environment>',
                 }),
                 list: pikkuCLICommand({
@@ -829,6 +840,10 @@ wireCLI({
                             description: 'Convert snake_case property names to camelCase in generated Zod schemas',
                             default: false,
                         },
+                        build: {
+                            description: 'Install and build the generated addon (an unbuilt addon exports a dist/ that does not exist yet, so every ref() into it is dead at runtime)',
+                            default: true,
+                        },
                     },
                 }),
             },

package/dist/src/fabric/fabric-commands.d.ts

@@ -611,6 +611,31 @@ export declare const fabricCommands: {
                     updatedAt: string;
                 }[];
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").WiredServices>, undefined, undefined>, import("../../.pikku/middleware/pikku-middleware-types.gen.js").PikkuMiddleware, (services: import("../../types/application-types.js").SingletonServices, data: any, session?: import("../../types/application-types.js").UserSession | undefined) => void | Promise<void>, string>;
+            delete: import("@pikku/core/cli").CoreCLICommandConfig<import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<{
+                name: string;
+                branch?: string | undefined;
+                force?: boolean | undefined;
+            }, {
+                name: string;
+                runId: string | null;
+                deploymentId: string | null;
+            }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
+                name: string;
+                branch?: string | undefined;
+                force?: boolean | undefined;
+            }, {
+                name: string;
+                runId: string | null;
+                deploymentId: string | null;
+            }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
+                name: string;
+                branch?: string | undefined;
+                force?: boolean | undefined;
+            }, {
+                name: string;
+                runId: string | null;
+                deploymentId: string | null;
+            }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").WiredServices>, undefined, undefined>, import("../../.pikku/middleware/pikku-middleware-types.gen.js").PikkuMiddleware, (services: import("../../types/application-types.js").SingletonServices, data: any, session?: import("../../types/application-types.js").UserSession | undefined) => void | Promise<void>, string>;
             rotate: import("@pikku/core/cli").CoreCLICommandConfig<import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<{
                 branch?: string | undefined;
                 force?: boolean | undefined;

package/dist/src/fabric/fabric-commands.js

@@ -32,6 +32,7 @@ import { FabricDbSchema, renderDbSchema, } from './functions/db-schema.function.
 import { FabricRollback } from './functions/rollback.function.js';
 import { FabricSecretsSet } from './functions/secrets-set.function.js';
 import { FabricSecretsList } from './functions/secrets-list.function.js';
+import { FabricSecretsDelete } from './functions/secrets-delete.function.js';
 import { FabricSecretsRotate } from './functions/secrets-rotate.function.js';
 import { FabricVariablesSet } from './functions/variables-set.function.js';
 import { FabricVariablesGet } from './functions/variables-get.function.js';
@@ -254,6 +255,18 @@ export const fabricCommands = defineCLICommands({
                     json: { description: 'Machine-readable output', default: false },
                 },
             }),
+            delete: pikkuCLICommand({
+                parameters: '<name>',
+                func: FabricSecretsDelete,
+                description: 'Delete a single stage-scoped secret',
+                options: {
+                    branch: { description: 'Target branch', short: 'b' },
+                    force: {
+                        description: 'Delete without confirmation',
+                        default: false,
+                    },
+                },
+            }),
             rotate: pikkuCLICommand({
                 func: FabricSecretsRotate,
                 description: "Retire a stage's sealing key (secrets must be set again)",

package/dist/src/fabric/functions/secrets-delete.function.d.ts

@@ -0,0 +1,36 @@
+import { z } from 'zod';
+export declare const FabricSecretsDeleteInput: z.ZodObject<{
+    name: z.ZodString;
+    branch: z.ZodOptional<z.ZodString>;
+    force: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const FabricSecretsDeleteOutput: z.ZodObject<{
+    name: z.ZodString;
+    runId: z.ZodNullable<z.ZodString>;
+    deploymentId: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export declare const FabricSecretsDelete: import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<{
+    name: string;
+    branch?: string | undefined;
+    force?: boolean | undefined;
+}, {
+    name: string;
+    runId: string | null;
+    deploymentId: string | null;
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
+    name: string;
+    branch?: string | undefined;
+    force?: boolean | undefined;
+}, {
+    name: string;
+    runId: string | null;
+    deploymentId: string | null;
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
+    name: string;
+    branch?: string | undefined;
+    force?: boolean | undefined;
+}, {
+    name: string;
+    runId: string | null;
+    deploymentId: string | null;
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices>, undefined, undefined>;

package/dist/src/fabric/functions/secrets-delete.function.js

@@ -0,0 +1,51 @@
+import { z } from 'zod';
+import { pikkuSessionlessFunc } from '../../../.pikku/function/index.js';
+import { resolveApiContext } from '../lib/config.js';
+import { getFabricRPC } from '../lib/http.js';
+import { promptConfirm } from '../lib/prompt.js';
+import { resolveStage } from '../lib/stage.js';
+export const FabricSecretsDeleteInput = z.object({
+    name: z.string(),
+    branch: z.string().optional(),
+    force: z.boolean().optional(),
+});
+export const FabricSecretsDeleteOutput = z.object({
+    name: z.string(),
+    runId: z.string().nullable(),
+    deploymentId: z.string().nullable(),
+});
+export const FabricSecretsDelete = pikkuSessionlessFunc({
+    description: 'Remove a single stage-scoped secret. Unlike `secrets rotate`, the rest of the stage keeps its sealing key and its other secrets.',
+    input: FabricSecretsDeleteInput,
+    output: FabricSecretsDeleteOutput,
+    func: async (_services, { name, branch: requested, force }) => {
+        const ctx = await resolveApiContext();
+        if (!ctx.token)
+            throw new Error('Not logged in. Run `pikku fabric login` first.');
+        if (!ctx.projectId)
+            throw new Error('No fabric project linked. Run `pikku fabric link` first.');
+        // Resolved before the prompt so the confirmation names the stage that
+        // would actually lose the secret, not an argument that may be absent.
+        const rpc = getFabricRPC({ apiUrl: ctx.apiUrl, token: ctx.token });
+        const { stageId, branch } = await resolveStage(rpc, ctx.projectId, requested);
+        if (!force) {
+            if (!process.stdin.isTTY) {
+                throw new Error(`Refusing to delete ${name} from ${branch} without confirmation — re-run with --force to delete non-interactively.`);
+            }
+            // Fabric cannot read the sealed value back, so this is not recoverable
+            // by re-reading it — the plaintext has to be supplied again.
+            if (!(await promptConfirm(`Delete ${name} from ${branch}? It cannot be recovered — the value must be set again.`))) {
+                throw new Error('Delete aborted.');
+            }
+        }
+        const result = await rpc.invoke('deleteStageSecret', { stageId, name });
+        console.log(`[fabric] deleted ${result.name} from ${branch}`);
+        if (result.runId) {
+            console.log(`[fabric] republishing the stage as run ${result.runId} — units serve the old value until it lands`);
+        }
+        else {
+            console.log('[fabric] deploy the stage to stop its units serving the old value');
+        }
+        return result;
+    },
+});

package/dist/src/functions/commands/dev.js

@@ -4,7 +4,7 @@ import { pikkuSessionlessFunc } from '#pikku/function';
 import chokidar from 'chokidar';
 import { pikkuDevReloader, reloadGeneratedMeta, reconcileAddonRegistry, } from '@pikku/core/dev';
 import { InMemoryQueueService, QueueWebhookService } from '@pikku/core/services';
-import { ConsoleLogger, LocalEmailService, spy, InMemoryAgentRunStateService, } from '@pikku/core/services';
+import { ConsoleLogger, LocalEmailService, LocalCredentialService, spy, InMemoryAgentRunStateService, } from '@pikku/core/services';
 import { InMemoryTriggerService } from '@pikku/core/services';
 import { InMemoryWorkflowService } from '@pikku/core/services';
 import { KyselyAgentStorageService, KyselyAgentRunStateService, KyselyAgentRunService, } from '@pikku/kysely';
@@ -230,6 +230,7 @@ export const dev = pikkuSessionlessFunc({
             workflowService,
             workflowRunService: workflowService,
             triggerService: new InMemoryTriggerService(),
+            credentialService: new LocalCredentialService(),
             agentStorage,
             agentRunState,
             agentRunService,

package/dist/src/functions/commands/dist.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Carry into the build output the files `tsc` compiles around but never emits.
+ *
+ * `tsc` turns the generated `.ts` under the pikku out dir into JavaScript, so
+ * that half arrives on its own. Two kinds of file do not:
+ *
+ *  - the `*.gen.json` meta pikku writes beside them. `resolveJsonModule` lets
+ *    TypeScript *read* a json, it never copies one to `outDir`, and the meta is
+ *    read off disk at runtime — `MetaService` opens it by path — so a package
+ *    that ships only tsc's output answers every meta lookup with nothing.
+ *  - a hand-authored `.d.ts` such as `types/application-types.d.ts`. A
+ *    declaration file is an input, and `declaration: true` does not re-emit it.
+ *
+ * Packages used to do this with `cp -r .pikku types dist/`, which also dumped
+ * every `.ts` source into the published output and needed a POSIX shell.
+ */
+export type DistCopy = {
+    from: string;
+    to: string;
+};
+export declare const planDistCopies: (rootDir: string, distDir: string, files: string[]) => DistCopy[];
+export declare const pikkuDist: import("#pikku/function").PikkuFunctionConfig<{
+    distDir?: string;
+}, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<{
+    distDir?: string;
+}, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<{
+    distDir?: string;
+}, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/dist.js

@@ -0,0 +1,58 @@
+import { existsSync } from 'node:fs';
+import { cp, mkdir, readdir } from 'node:fs/promises';
+import { dirname, join, relative, resolve } from 'node:path';
+import ts from 'typescript';
+import { pikkuSessionlessFunc } from '#pikku/function';
+/**
+ * `tsc` compiles a `.ts` and emits it. Everything else it either reads without
+ * emitting — a `.d.ts` is an input, `declaration: true` does not re-emit one —
+ * or ignores entirely, like the generated json.
+ */
+const tscEmitsIt = (file) => file.endsWith('.ts') && !file.endsWith('.d.ts');
+const walk = async (dir) => {
+    if (!existsSync(dir)) {
+        return [];
+    }
+    const entries = await readdir(dir, { withFileTypes: true });
+    const files = await Promise.all(entries.map(async (entry) => {
+        const path = join(dir, entry.name);
+        return entry.isDirectory() ? walk(path) : [path];
+    }));
+    return files.flat();
+};
+export const planDistCopies = (rootDir, distDir, files) => {
+    return files
+        .filter((file) => !tscEmitsIt(file))
+        .map((from) => ({
+        from,
+        to: join(distDir, relative(rootDir, from)),
+    }));
+};
+const readTsOutDir = (tsconfig) => {
+    const parsed = ts.getParsedCommandLineOfConfigFile(tsconfig, {}, {
+        ...ts.sys,
+        onUnRecoverableConfigFileDiagnostic: () => { },
+    });
+    return parsed?.options.outDir;
+};
+export const pikkuDist = pikkuSessionlessFunc({
+    func: async ({ logger, config }, data) => {
+        const { rootDir, outDir, srcDirectories, tsconfig } = config;
+        const distDir = data.distDir
+            ? resolve(rootDir, data.distDir)
+            : readTsOutDir(resolve(rootDir, tsconfig));
+        if (!distDir) {
+            logger.error(`${tsconfig} sets no compilerOptions.outDir, so there is nowhere to copy to. Set one, or pass --dist-dir.`);
+            process.exit(1);
+        }
+        const copies = planDistCopies(rootDir, distDir, [
+            ...(await walk(outDir)),
+            ...(await Promise.all(srcDirectories.map((dir) => walk(resolve(rootDir, dir))))).flat(),
+        ]);
+        for (const { from, to } of copies) {
+            await mkdir(dirname(to), { recursive: true });
+            await cp(from, to);
+        }
+        logger.info(`Copied ${copies.length} generated file(s) into ${relative(rootDir, distDir) || distDir}`);
+    },
+});

package/dist/src/functions/commands/new-addon.d.ts

@@ -28,6 +28,33 @@ export declare function getAddonFiles(vars: AddonVars, flags: {
     delegated?: boolean;
 }): Record<string, string>;
 export declare function getTestFiles(vars: AddonVars): Record<string, string>;
+/**
+ * Does `root`'s `workspaces` field cover `dir`?
+ *
+ * Declaring workspaces is not enough — a root with `packages/*` does not own an
+ * addon written to `addons/crm`, and yarn, npm and pnpm all skip a nested
+ * package they were never told about.
+ */
+export declare function workspaceCovers(root: string, dir: string): boolean;
+/**
+ * An addon that has not been built is dead at runtime.
+ *
+ * The generated package exports `./dist/...` — that is what an installed
+ * consumer resolves, and what the app's own `pikku-bootstrap.gen.ts` imports.
+ * Until `build` has run, every `ref('<addon>:...')` resolves to nothing and the
+ * app fails at boot with PKU340 plus an ERR_MODULE_NOT_FOUND on a dist path
+ * nobody wrote. Nothing about the generated files shows the problem, so the
+ * generator finishes the job: install at the root that owns the lockfile, then
+ * run the addon's own `build` script (whose `prebuild` is `pikku all`).
+ */
+export type AddonBuildRunner = (command: string, args: string[], cwd: string) => {
+    status: number | null;
+    error?: Error;
+};
+export declare const buildGeneratedAddon: (addonDir: string, logger: {
+    info: (message: string) => void;
+    error: (message: string) => void;
+}, run?: AddonBuildRunner) => boolean;
 export declare const pikkuNewAddon: import("#pikku/function").PikkuFunctionConfig<{
     name: string;
     displayName?: string;
@@ -43,6 +70,7 @@ export declare const pikkuNewAddon: import("#pikku/function").PikkuFunctionConfi
     authConfig?: string;
     mcp?: boolean;
     camelCase?: boolean;
+    build?: boolean;
 }, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<{
     name: string;
     displayName?: string;
@@ -58,6 +86,7 @@ export declare const pikkuNewAddon: import("#pikku/function").PikkuFunctionConfi
     authConfig?: string;
     mcp?: boolean;
     camelCase?: boolean;
+    build?: boolean;
 }, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<{
     name: string;
     displayName?: string;
@@ -73,4 +102,5 @@ export declare const pikkuNewAddon: import("#pikku/function").PikkuFunctionConfi
     authConfig?: string;
     mcp?: boolean;
     camelCase?: boolean;
+    build?: boolean;
 }, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/new-addon.js

@@ -1,6 +1,8 @@
 import { existsSync, readFileSync } from 'fs';
-import { dirname, join } from 'path';
+import { dirname, join, relative as relativePath, sep } from 'path';
 import { mkdir, writeFile } from 'fs/promises';
+import { spawnSync } from 'node:child_process';
+import { findInstallRoot } from './update.js';
 import { createEmptyManifest, saveManifest, } from '../../utils/contract-versions.js';
 import { pikkuSessionlessFunc } from '#pikku/function';
 import { parseOpenAPISpec, computeContractHash, generateAddonFromOpenAPI, loadAuthConfig, } from '@pikku/openapi-parser';
@@ -159,7 +161,7 @@ export function getAddonFiles(vars, flags) {
         scripts: {
             prepublishOnly: 'yarn build',
             prebuild: 'pikku all',
-            build: 'tsc && cp -r .pikku types dist/',
+            build: 'tsc && pikku dist',
             pikku: 'pikku all',
         },
         peerDependencies: {
@@ -851,8 +853,81 @@ async function writeFiles(baseDir, files) {
     }
     return written;
 }
+/**
+ * Does `root`'s `workspaces` field cover `dir`?
+ *
+ * Declaring workspaces is not enough — a root with `packages/*` does not own an
+ * addon written to `addons/crm`, and yarn, npm and pnpm all skip a nested
+ * package they were never told about.
+ */
+export function workspaceCovers(root, dir) {
+    const relative = relativePath(root, dir).split(sep).join('/');
+    if (relative === '' || relative.startsWith('..')) {
+        return false;
+    }
+    let patterns;
+    try {
+        const manifest = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
+        patterns = Array.isArray(manifest.workspaces)
+            ? manifest.workspaces
+            : manifest.workspaces?.packages;
+    }
+    catch {
+        return false;
+    }
+    if (!Array.isArray(patterns)) {
+        return false;
+    }
+    return patterns.some((pattern) => {
+        if (typeof pattern !== 'string') {
+            return false;
+        }
+        const source = pattern
+            .split('/')
+            .map((segment) => segment === '**'
+            ? '.*'
+            : segment.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '[^/]*'))
+            .join('/');
+        return new RegExp(`^${source}$`).test(relative);
+    });
+}
+const spawnAddonBuildStep = (command, args, cwd) => {
+    const { status, error } = spawnSync(command, args, {
+        cwd,
+        stdio: 'inherit',
+        shell: process.platform === 'win32',
+    });
+    return { status, error };
+};
+export const buildGeneratedAddon = (addonDir, logger, run = spawnAddonBuildStep) => {
+    const { dir: installDir, packageManager } = findInstallRoot(addonDir);
+    if (packageManager === 'unknown') {
+        logger.error(`Could not tell which package manager owns ${addonDir} — the addon is generated but NOT built. Run install, then the addon's build script, in ${addonDir} before using it.`);
+        return false;
+    }
+    // A root install only reaches the addon when the root's workspace patterns
+    // cover it. A root that owns the lockfile but not this package installs
+    // nothing for it, so its devDependencies — `@pikku/cli` and `typescript`,
+    // which the build script needs — would never arrive.
+    const installIn = workspaceCovers(installDir, addonDir)
+        ? installDir
+        : addonDir;
+    const steps = [
+        [installIn, ['install']],
+        [addonDir, ['run', 'build']],
+    ];
+    for (const [cwd, args] of steps) {
+        logger.info(`${packageManager} ${args.join(' ')} (${cwd})`);
+        const result = run(packageManager, args, cwd);
+        if (result.status !== 0) {
+            logger.error(`${packageManager} ${args.join(' ')} failed in ${cwd}: ${result.error?.message ?? `exit ${result.status}`}`);
+            return false;
+        }
+    }
+    return true;
+};
 export const pikkuNewAddon = pikkuSessionlessFunc({
-    func: async ({ logger, config }, { name, displayName, description, category = 'General', dir, secret = false, variable = false, oauth = false, credential, test = true, openapi, authConfig, mcp = false, camelCase = false, }) => {
+    func: async ({ logger, config }, { name, displayName, description, category = 'General', dir, secret = false, variable = false, oauth = false, credential, test = true, openapi, authConfig, mcp = false, camelCase = false, build = true, }) => {
         name = sanitizeAddonName(name);
         if (!/^[a-z][a-z0-9_-]*$/.test(name)) {
             logger.error(`Invalid addon name "${name}": must start with a lowercase letter and contain only lowercase alphanumerics, hyphens, and underscores`);
@@ -949,6 +1024,9 @@ export const pikkuNewAddon = pikkuSessionlessFunc({
         for (const f of written) {
             logger.debug({ message: `  ${f}`, type: 'success' });
         }
+        if (build && !buildGeneratedAddon(addonDir, logger)) {
+            process.exit(1);
+        }
         console.log(addonDir);
     },
 });

package/dist/src/functions/commands/persona-sync.d.ts

@@ -9,10 +9,11 @@
  * config and write through it, which provisioned a local stage correctly and
  * silently provisioned the wrong database for every other environment.
  *
- * So the deployment provisions itself: an app calls `provisionPersonas` from
- * `@pikku/better-auth` in its server lifecycle, where the database connection
- * and better-auth's own adapter are both already open, and a deploy carries its
- * personas with it. What is left here is the half that needs no database — the
+ * So the deployment provisions itself: an app hands its personas to
+ * `pikkuFabric` from `@pikku/better-auth`, and the plugin creates a missing one
+ * on the operator handshake that asks for it, where the database connection and
+ * better-auth's own adapter are both already open. What is left here is the
+ * half that needs no database — the
  * declaration, and the environment rule applied to it — which is what tells you
  * before a deploy whether the accounts you expect will appear.
  */

package/dist/src/functions/commands/persona-sync.js

@@ -12,10 +12,11 @@ import { resolvePersonas } from '../../utils/resolve-personas.js';
  * config and write through it, which provisioned a local stage correctly and
  * silently provisioned the wrong database for every other environment.
  *
- * So the deployment provisions itself: an app calls `provisionPersonas` from
- * `@pikku/better-auth` in its server lifecycle, where the database connection
- * and better-auth's own adapter are both already open, and a deploy carries its
- * personas with it. What is left here is the half that needs no database — the
+ * So the deployment provisions itself: an app hands its personas to
+ * `pikkuFabric` from `@pikku/better-auth`, and the plugin creates a missing one
+ * on the operator handshake that asks for it, where the database connection and
+ * better-auth's own adapter are both already open. What is left here is the
+ * half that needs no database — the
  * declaration, and the environment rule applied to it — which is what tells you
  * before a deploy whether the accounts you expect will appear.
  */
@@ -65,6 +66,6 @@ export const personaSync = pikkuSessionlessFunc({
         for (const refusal of skipped) {
             logger.info(`  skipped: ${refusal}`);
         }
-        logger.info("  Provisioning runs in the deployment: call `provisionPersonas` from '@pikku/better-auth' in your server lifecycle, passing `personaConfigs` and `personaEnvironments` from the generated personas file.");
+        logger.info("  Provisioning runs in the deployment: pass `personas: { personas: personaConfigs, environments: personaEnvironments }` from the generated personas file to `pikkuFabric` from '@pikku/better-auth'.");
     },
 });

package/dist/src/functions/commands/persona.js

@@ -4,6 +4,7 @@ import { pikkuSessionlessFunc } from '#pikku/function';
 import { createHttpPersonas, deriveActorSecret, personaEnvironmentRefusal, roleMismatchMessage, verifyPersonaRoles, } from '@pikku/core/persona';
 import { personaVirtualUserTarget, runVirtualUser, catalogueClassification, DISPOSITIONS, prepareVirtualUserRun, } from '@pikku/core/virtual-user';
 import { getSingletonServices, setSingletonServices } from '@pikku/core/state';
+import { PikkuError } from '@pikku/core/errors';
 import { resolvePersonas } from '../../utils/resolve-personas.js';
 import { ACTOR_SECRET_VARIABLE, PERSONA_SECRETS_VARIABLE, resolvePersonaCredentials, } from '../../utils/persona-credentials.js';
 import { resolveEnvironment } from './environment.js';
@@ -108,7 +109,7 @@ export const personaRun = pikkuSessionlessFunc({
             agentsMeta: state.agents?.agentsMeta ?? {},
         });
         if (catalogue.length === 0) {
-            throw new Error('This project exposes no RPCs, so there is nothing for a virtual user to do.');
+            throw new PikkuError('This project exposes no RPCs, so there is nothing for a virtual user to do.');
         }
         const signedIn = createHttpPersonas({
             apiUrl: env.apiUrl,
@@ -132,7 +133,10 @@ export const personaRun = pikkuSessionlessFunc({
             else {
                 const message = roleMismatchMessage(verifyPersonaRoles(personaId, persona.roles, actual));
                 if (message) {
-                    throw new Error(message);
+                    // A refusal, not a crash: `PikkuError` is what tells the CLI to print
+                    // the message on its own, since the seed drift it names is the whole
+                    // finding and the frames underneath it are noise.
+                    throw new PikkuError(message);
                 }
             }
         }