@pikku/cli 0.12.127 → 0.12.133

package/dist/src/cli.wiring.js

@@ -12,6 +12,7 @@ import { pikkuCLICommand, wireCLI } from '../.pikku/cli/pikku-cli-types.gen.js';
 import { fabricCommands } from './fabric/fabric-commands.js';
 import { all } from './functions/commands/all.js';
 import { bootstrap } from './functions/commands/bootstrap.js';
+import { pikkuDist } from './functions/commands/dist.js';
 import { watch } from './functions/commands/watch.js';
 import { login, logout, whoami } from './functions/commands/login.js';
 import { dev } from './functions/commands/dev.js';
@@ -34,6 +35,7 @@ import { renderSemver } from './functions/commands/semver-render.js';
 import { validate, renderValidate } from './functions/commands/validate.js';
 import { knowledgeValidate, renderKnowledgeValidate, } from './functions/commands/knowledge-validate.js';
 import { knowledgeIndex, renderKnowledgeIndex, } from './functions/commands/knowledge-index.js';
+import { knowledgePlanDefer, knowledgePlanProgress, knowledgePlanSchema, knowledgePlanSet, knowledgePlanShow, renderKnowledgePlanDefer, renderKnowledgePlanProgress, renderKnowledgePlanSchema, renderKnowledgePlanSet, renderKnowledgePlanShow, } from './functions/commands/knowledge-plan.js';
 import { scenarioRun, scenarioList } from './functions/commands/scenario.js';
 import { personaList, personaRun, personaSecret, } from './functions/commands/persona.js';
 import { personaSync } from './functions/commands/persona-sync.js';
@@ -231,6 +233,16 @@ wireCLI({
             func: bootstrap,
             description: 'Generate only type files (setup phase only)',
         }),
+        dist: pikkuCLICommand({
+            func: pikkuDist,
+            description: "Copy the generated files tsc cannot emit — the .gen.json meta, and hand-authored .d.ts — into the build output. Run it after tsc, as a package's build script",
+            options: {
+                distDir: {
+                    description: "Where to copy to. Defaults to the tsconfig's compilerOptions.outDir",
+                    type: 'string',
+                },
+            },
+        }),
         audit: pikkuCLICommand({
             func: pikkuAudit,
             description: 'Audit dependencies for security advisories (always) and available updates (--outdated); writes .pikku/audit.json',
@@ -513,6 +525,52 @@ wireCLI({
                         },
                     },
                 }),
+                plan: {
+                    description: "Read and write a milestone's technical plan — the shape of the work, checked before it is built rather than after",
+                    subcommands: {
+                        schema: pikkuCLICommand({
+                            func: knowledgePlanSchema,
+                            render: renderKnowledgePlanSchema,
+                            description: 'Print the plan schema, so a plan is written against what is enforced rather than guessed at',
+                        }),
+                        show: pikkuCLICommand({
+                            func: knowledgePlanShow,
+                            render: renderKnowledgePlanShow,
+                            description: "Print a milestone's plan",
+                            parameters: '<milestone>',
+                            options: {
+                                forBuild: {
+                                    description: 'Render it as the ordered list of work a build follows, rather than as stored',
+                                    default: false,
+                                },
+                            },
+                        }),
+                        progress: pikkuCLICommand({
+                            func: knowledgePlanProgress,
+                            render: renderKnowledgePlanProgress,
+                            description: 'Say what the milestone still owes its plan, read from the generated meta rather than from what was claimed',
+                            parameters: '<milestone>',
+                        }),
+                        set: pikkuCLICommand({
+                            func: knowledgePlanSet,
+                            render: renderKnowledgePlanSet,
+                            description: 'Validate a plan against its milestone note and write it, or write nothing and say what is wrong',
+                            parameters: '<milestone> <file>',
+                        }),
+                        defer: pikkuCLICommand({
+                            func: knowledgePlanDefer,
+                            render: renderKnowledgePlanDefer,
+                            description: 'Move one first-pass item to the next pass, with the reason on the record',
+                            parameters: '<milestone> <item>',
+                            options: {
+                                reason: {
+                                    description: 'Why this item cannot land in the first pass',
+                                    short: 'r',
+                                },
+                            },
+                        }),
+                    },
+                },
             },
         },
         validate: pikkuCLICommand({
@@ -635,7 +693,7 @@ wireCLI({
                 }),
                 sync: pikkuCLICommand({
                     func: personaSync,
-                    description: "Report which personas an environment will provision, with which roles, and why any of them were skipped. The provisioning itself happens in the deployment — call provisionPersonas from '@pikku/better-auth' in your server lifecycle — because the CLI has no connection to a deployed environment's database.",
+                    description: "Report which personas an environment will provision, with which roles, and why any of them were skipped. The provisioning itself happens in the deployment — pass the generated personas to pikkuFabric from '@pikku/better-auth' — because the CLI has no connection to a deployed environment's database.",
                     parameters: '<environment>',
                 }),
                 list: pikkuCLICommand({
@@ -829,6 +887,10 @@ wireCLI({
                             description: 'Convert snake_case property names to camelCase in generated Zod schemas',
                             default: false,
                         },
+                        build: {
+                            description: 'Install and build the generated addon (an unbuilt addon exports a dist/ that does not exist yet, so every ref() into it is dead at runtime)',
+                            default: true,
+                        },
                     },
                 }),
             },

package/dist/src/deploy/analyzer/analyzer.js

@@ -127,15 +127,17 @@ export function analyzeDeployment(state, options) {
         if (handlers.length === 0) {
             continue;
         }
+        const invokedAgents = collectInvokedAgents(state, funcId);
         units.push({
             name: toSafeKebab(funcId),
             role: 'function',
             target: resolveDeployTarget(funcMeta, serverlessIncompatible, funcId, defaultTarget),
             functionIds: [funcId],
-            services: collectServicesForFunction(funcMeta),
+            services: withAgentServices(collectServicesForFunction(funcMeta), invokedAgents),
             dependsOn: [],
             handlers,
             tags: funcMeta.tags ?? [],
+            ...(invokedAgents.length > 0 && { invokedAgents }),
         });
     }
     // ── Step 2: Agent gateways ─────────────────────────────────────────
@@ -147,10 +149,7 @@ export function analyzeDeployment(state, options) {
         const toolUnitNames = toolIds.map((id) => toSafeKebab(id));
         const subAgentUnitNames = subAgentNames.map((sa) => `agent-${toSafeKebab(sa)}`);
         // Agent needs AI services
-        const agentServices = [
-            { capability: 'ai-model', sourceServiceName: 'agentRunner' },
-            { capability: 'ai-storage', sourceServiceName: 'agentStorage' },
-        ];
+        const agentServices = agentServiceRequirements();
         // Concrete routes for this agent via catch-all
         const agentRoutes = [
             {
@@ -282,15 +281,17 @@ export function analyzeDeployment(state, options) {
                 const funcId = fromKebab(dep);
                 const funcMeta = functionsMeta[funcId];
                 if (funcMeta) {
+                    const invokedAgents = collectInvokedAgents(state, funcId);
                     units.push({
                         name: dep,
                         role: 'function',
                         target: resolveDeployTarget(funcMeta, serverlessIncompatible, funcId, defaultTarget),
                         functionIds: [funcId],
-                        services: collectServicesForFunction(funcMeta),
+                        services: withAgentServices(collectServicesForFunction(funcMeta), invokedAgents),
                         dependsOn: [],
                         handlers: [{ type: 'fetch', routes: [] }],
                         tags: funcMeta.tags ?? [],
+                        ...(invokedAgents.length > 0 && { invokedAgents }),
                     });
                     existingUnitNames.add(dep);
                 }
@@ -597,6 +598,41 @@ function mapServiceToRequirement(serviceName) {
         return null;
     return { capability, sourceServiceName: serviceName };
 }
+function agentServiceRequirements() {
+    return [
+        { capability: 'ai-model', sourceServiceName: 'agentRunner' },
+        { capability: 'ai-storage', sourceServiceName: 'agentStorage' },
+    ];
+}
+/**
+ * Agents named by a `runAgent`/`rpc.agent.run` call inside a function body.
+ *
+ * The inspector attributes those calls to the source FILE, so every function
+ * declared alongside the caller inherits them. That is deliberate: the unit
+ * bundles the file either way, and registering an agent the caller never
+ * reaches is cheaper than the run-time "AI agent not found" a missed one
+ * causes.
+ */
+function collectInvokedAgents(state, funcId) {
+    const path = state.functions?.files?.get(funcId)?.path;
+    if (!path)
+        return [];
+    const invoked = state.agents?.invokedAgentsByFile?.get(path);
+    if (!invoked)
+        return [];
+    return [...invoked].filter((name) => Boolean(state.agents?.agentsMeta[name]));
+}
+function withAgentServices(services, invokedAgents) {
+    if (invokedAgents.length === 0)
+        return services;
+    const merged = [...services];
+    for (const requirement of agentServiceRequirements()) {
+        if (!merged.some((s) => s.capability === requirement.capability)) {
+            merged.push(requirement);
+        }
+    }
+    return merged;
+}
 function collectServicesForFunction(funcMeta) {
     if (!funcMeta?.services?.services)
         return [];

package/dist/src/deploy/build-pipeline.js

@@ -4,9 +4,9 @@
  * Runs: analyze → per-unit codegen → entry generation → bundle → configs
  * Outputs everything to .deploy/<provider>/ without deploying.
  */
-import { join } from 'node:path';
-import { existsSync } from 'node:fs';
-import { mkdir, writeFile, copyFile } from 'node:fs/promises';
+import { join, relative } from 'node:path';
+import { existsSync, readFileSync } from 'node:fs';
+import { cp, mkdir, writeFile, copyFile } from 'node:fs/promises';
 import { PikkuError } from '@pikku/core/errors';
 import { analyzeDeployment } from './analyzer/index.js';
 import { withoutScenarios } from '../functions/wirings/scenarios/scenario-partition.js';
@@ -61,6 +61,88 @@ function findLockfile(projectDir) {
     }
     return null;
 }
+/**
+ * The database a standalone bundle has to open for itself.
+ *
+ * Every other provider deploys onto a host that supplies `kysely` — `pikku dev`
+ * builds one, a Cloudflare deploy binds one — so `createSingletonServices` is
+ * written expecting it. A standalone artifact has no host, and shipped one that
+ * never got a connection at all: the app booted straight into whatever its
+ * services factory does when the database is missing, which for the generated
+ * templates is a throw.
+ *
+ * Engine comes from the migrations directory rather than the user config,
+ * because that is the same signal `loadUserConfigForDb` falls back to and it
+ * needs no module loading here. `db/sqlite` and `db/postgres` are the two
+ * conventions the migrator already writes to, so a project declares its engine
+ * by having written migrations for it.
+ *
+ * Both at once is refused rather than resolved. Picking one would be picking
+ * which database the deployed app talks to on the strength of directory order,
+ * and the failure — an app running happily against the wrong, fully valid
+ * schema — is invisible until someone reads the data.
+ *
+ * The migrations are copied in beside the bundle under the same `db/<engine>/`
+ * path they have in the project, which is also where Fabric's build container
+ * stages them. Two producers writing the artifact cannot disagree about where
+ * the SQL lives, and `bundle.js db migrate` finds it either way.
+ */
+/**
+ * The project's declared version, or nothing.
+ *
+ * Absent is a real answer — a project need not version itself — and is better
+ * reported as unknown than as a number this made up.
+ */
+function resolveProjectVersion(projectDir) {
+    try {
+        const pkg = JSON.parse(readFileSync(join(projectDir, 'package.json'), 'utf-8'));
+        return typeof pkg.version === 'string' ? pkg.version : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function resolveStandaloneDb(projectDir, pikkuDir, unitDir) {
+    const hasSqlite = existsSync(join(projectDir, 'db', 'sqlite'));
+    const hasPostgres = existsSync(join(projectDir, 'db', 'postgres'));
+    if (hasSqlite && hasPostgres) {
+        throw new Error('This project has both db/sqlite and db/postgres migrations, so a standalone build cannot tell which database the app is meant to open. Keep the one this app deploys against.');
+    }
+    const engine = hasSqlite ? 'sqlite' : hasPostgres ? 'postgres' : undefined;
+    if (!engine)
+        return undefined;
+    await cp(join(projectDir, 'db', engine), join(unitDir, 'db', engine), {
+        recursive: true,
+    });
+    // Absent for an app that annotates no columns, which is a database with
+    // nothing to coerce rather than a reason to hand the app no database.
+    const coercionFile = join(pikkuDir, 'db', 'coercion.gen.ts');
+    if (!existsSync(coercionFile))
+        return { engine };
+    let rel = relative(unitDir, coercionFile).replace(/\\/g, '/');
+    if (!rel.startsWith('.'))
+        rel = `./${rel}`;
+    return { engine, coercionImportPath: rel.replace(/\.ts$/, '.js') };
+}
+/**
+ * The app's server lifecycle, for entries that can call it.
+ *
+ * The hooks are resolved to an import rather than read at build time because
+ * they are the app's own code and have to run in the app's own process, with
+ * the services that process built.
+ */
+function resolveLifecycle(unitDir, state) {
+    const factory = state.filesAndMethods.serverLifecycleFactory;
+    if (!factory)
+        return undefined;
+    let rel = relative(unitDir, factory.file).replace(/\\/g, '/');
+    if (!rel.startsWith('.'))
+        rel = `./${rel}`;
+    return {
+        importPath: rel.replace(/\.tsx?$/, '.js'),
+        variable: factory.variable,
+    };
+}
 export async function runBuildPipeline(options) {
     const { projectDir, projectId, provider, inspectorState, getEntryContext, debugArtifacts, logger, bundler, } = options;
     const deployDir = options.deployDir ?? join(projectDir, '.deploy');
@@ -115,6 +197,9 @@ export async function runBuildPipeline(options) {
         const ctx = {
             ...getEntryContext(unitDir, pikkuDir, singleUnit, inspectorState),
             frontend: frontendMount,
+            version: resolveProjectVersion(projectDir),
+            db: await resolveStandaloneDb(projectDir, pikkuDir, unitDir),
+            lifecycle: resolveLifecycle(unitDir, inspectorState),
         };
         const source = provider.generateEntrySource(ctx);
         const entryPath = join(unitDir, 'entry.ts');
@@ -228,7 +313,10 @@ export async function runBuildPipeline(options) {
             const unitDir = unit.target === 'server' ? containerDir : join(unitsDir, unit.name);
             const entryPath = join(unitDir, 'entry.ts');
             await mkdir(unitDir, { recursive: true });
-            const ctx = getEntryContext(unitDir, pikkuDir, unit, inspectorState);
+            const ctx = {
+                ...getEntryContext(unitDir, pikkuDir, unit, inspectorState),
+                lifecycle: resolveLifecycle(unitDir, inspectorState),
+            };
             const source = unit.target === 'server'
                 ? (provider.generateServerEntrySource?.(ctx) ??
                     generateServerEntrySource(ctx))

package/dist/src/deploy/codegen/per-unit-codegen.d.ts

@@ -42,6 +42,16 @@ export interface PerUnitCodegenResult {
         error: string;
     }>;
 }
+/**
+ * Collect the full set of filter names for a deployment unit.
+ *
+ * The --names filter matches against different identifier types depending
+ * on the metadata being filtered (function names, agent names, channel
+ * names, etc.).  For a unit to get its complete metadata, we need to
+ * include both the function IDs and any wiring-level names (e.g. agent
+ * names, channel names) that reference those functions.
+ */
+export declare function collectFilterNames(unit: DeploymentUnit, manifest: DeploymentManifest, inspectorState: InspectorState, workflowQueues: boolean): string[];
 /**
  * Runs filtered codegen for each deployment unit.
  *

package/dist/src/deploy/codegen/per-unit-codegen.js

@@ -34,7 +34,7 @@ function resolvePikkuBin() {
  * include both the function IDs and any wiring-level names (e.g. agent
  * names, channel names) that reference those functions.
  */
-function collectFilterNames(unit, manifest, inspectorState, workflowQueues) {
+export function collectFilterNames(unit, manifest, inspectorState, workflowQueues) {
     const names = new Set(unit.functionIds);
     // Include catch-all scaffold routes based on unit contents
     const functionsMeta = inspectorState.functions.meta;
@@ -103,6 +103,17 @@ function collectFilterNames(unit, manifest, inspectorState, workflowQueues) {
                 if (handler.type === 'scheduled')
                     names.add(handler.taskName);
             }
+            // `runAgent(...)` / `rpc.agent.run(...)` look the agent up in the
+            // in-process registry, so a function that calls one needs the agent's
+            // wiring — and its tools — bundled into its OWN unit, not just into
+            // the agent gateway unit.
+            for (const agentName of unit.invokedAgents ?? []) {
+                names.add(agentName);
+                const agentDef = manifest.agents.find((a) => a.name === agentName);
+                for (const id of agentDef?.toolFunctionIds ?? [])
+                    names.add(id);
+                names.add('/rpc/:rpcName');
+            }
             // Function units with workflow-state capability (workflow-starter,
             // workflow-runner, workflow-status-checker) call rpc.startWorkflow
             // and look workflows up by name in the registry. The registry is

package/dist/src/deploy/server-entry.js

@@ -18,6 +18,11 @@ export function generateServerEntrySource(ctx) {
         ctx.configImport,
         ctx.servicesImport,
         ctx.mcpImport,
+        ...(ctx.lifecycle
+            ? [
+                `import { ${ctx.lifecycle.variable} as __pikkuLifecycle } from '${ctx.lifecycle.importPath}'`,
+            ]
+            : []),
         `import '${ctx.bootstrapPath}'`,
         ``,
         `const PORT = Number(process.env.PORT ?? 8080)`,
@@ -33,9 +38,17 @@ export function generateServerEntrySource(ctx) {
         `    singletonServices.logger,`,
         `    { ${ctx.mcpServerOption}}`,
         `  )`,
-        `  server.enableExitOnSignals()`,
+        `  server.enableExitOnSignals(${ctx.lifecycle
+            ? `{ beforeStop: () => __pikkuLifecycle?.beforeStop?.(singletonServices), afterStop: () => __pikkuLifecycle?.afterStop?.(singletonServices) }`
+            : ''})`,
         `  await server.init()`,
+        ...(ctx.lifecycle
+            ? [`  await __pikkuLifecycle?.beforeStart?.(singletonServices)`]
+            : []),
         `  await server.start()`,
+        ...(ctx.lifecycle
+            ? [`  await __pikkuLifecycle?.afterStart?.(singletonServices)`]
+            : []),
         `}`,
         ``,
         `main().catch((err) => {`,

package/dist/src/fabric/fabric-commands.d.ts

@@ -611,6 +611,31 @@ export declare const fabricCommands: {
                     updatedAt: string;
                 }[];
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").WiredServices>, undefined, undefined>, import("../../.pikku/middleware/pikku-middleware-types.gen.js").PikkuMiddleware, (services: import("../../types/application-types.js").SingletonServices, data: any, session?: import("../../types/application-types.js").UserSession | undefined) => void | Promise<void>, string>;
+            delete: import("@pikku/core/cli").CoreCLICommandConfig<import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<{
+                name: string;
+                branch?: string | undefined;
+                force?: boolean | undefined;
+            }, {
+                name: string;
+                runId: string | null;
+                deploymentId: string | null;
+            }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
+                name: string;
+                branch?: string | undefined;
+                force?: boolean | undefined;
+            }, {
+                name: string;
+                runId: string | null;
+                deploymentId: string | null;
+            }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
+                name: string;
+                branch?: string | undefined;
+                force?: boolean | undefined;
+            }, {
+                name: string;
+                runId: string | null;
+                deploymentId: string | null;
+            }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").WiredServices>, undefined, undefined>, import("../../.pikku/middleware/pikku-middleware-types.gen.js").PikkuMiddleware, (services: import("../../types/application-types.js").SingletonServices, data: any, session?: import("../../types/application-types.js").UserSession | undefined) => void | Promise<void>, string>;
             rotate: import("@pikku/core/cli").CoreCLICommandConfig<import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<{
                 branch?: string | undefined;
                 force?: boolean | undefined;

package/dist/src/fabric/fabric-commands.js

@@ -32,6 +32,7 @@ import { FabricDbSchema, renderDbSchema, } from './functions/db-schema.function.
 import { FabricRollback } from './functions/rollback.function.js';
 import { FabricSecretsSet } from './functions/secrets-set.function.js';
 import { FabricSecretsList } from './functions/secrets-list.function.js';
+import { FabricSecretsDelete } from './functions/secrets-delete.function.js';
 import { FabricSecretsRotate } from './functions/secrets-rotate.function.js';
 import { FabricVariablesSet } from './functions/variables-set.function.js';
 import { FabricVariablesGet } from './functions/variables-get.function.js';
@@ -254,6 +255,18 @@ export const fabricCommands = defineCLICommands({
                     json: { description: 'Machine-readable output', default: false },
                 },
             }),
+            delete: pikkuCLICommand({
+                parameters: '<name>',
+                func: FabricSecretsDelete,
+                description: 'Delete a single stage-scoped secret',
+                options: {
+                    branch: { description: 'Target branch', short: 'b' },
+                    force: {
+                        description: 'Delete without confirmation',
+                        default: false,
+                    },
+                },
+            }),
             rotate: pikkuCLICommand({
                 func: FabricSecretsRotate,
                 description: "Retire a stage's sealing key (secrets must be set again)",

package/dist/src/fabric/functions/secrets-delete.function.d.ts

@@ -0,0 +1,36 @@
+import { z } from 'zod';
+export declare const FabricSecretsDeleteInput: z.ZodObject<{
+    name: z.ZodString;
+    branch: z.ZodOptional<z.ZodString>;
+    force: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const FabricSecretsDeleteOutput: z.ZodObject<{
+    name: z.ZodString;
+    runId: z.ZodNullable<z.ZodString>;
+    deploymentId: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export declare const FabricSecretsDelete: import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<{
+    name: string;
+    branch?: string | undefined;
+    force?: boolean | undefined;
+}, {
+    name: string;
+    runId: string | null;
+    deploymentId: string | null;
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
+    name: string;
+    branch?: string | undefined;
+    force?: boolean | undefined;
+}, {
+    name: string;
+    runId: string | null;
+    deploymentId: string | null;
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
+    name: string;
+    branch?: string | undefined;
+    force?: boolean | undefined;
+}, {
+    name: string;
+    runId: string | null;
+    deploymentId: string | null;
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices>, undefined, undefined>;

package/dist/src/fabric/functions/secrets-delete.function.js

@@ -0,0 +1,51 @@
+import { z } from 'zod';
+import { pikkuSessionlessFunc } from '../../../.pikku/function/index.js';
+import { resolveApiContext } from '../lib/config.js';
+import { getFabricRPC } from '../lib/http.js';
+import { promptConfirm } from '../lib/prompt.js';
+import { resolveStage } from '../lib/stage.js';
+export const FabricSecretsDeleteInput = z.object({
+    name: z.string(),
+    branch: z.string().optional(),
+    force: z.boolean().optional(),
+});
+export const FabricSecretsDeleteOutput = z.object({
+    name: z.string(),
+    runId: z.string().nullable(),
+    deploymentId: z.string().nullable(),
+});
+export const FabricSecretsDelete = pikkuSessionlessFunc({
+    description: 'Remove a single stage-scoped secret. Unlike `secrets rotate`, the rest of the stage keeps its sealing key and its other secrets.',
+    input: FabricSecretsDeleteInput,
+    output: FabricSecretsDeleteOutput,
+    func: async (_services, { name, branch: requested, force }) => {
+        const ctx = await resolveApiContext();
+        if (!ctx.token)
+            throw new Error('Not logged in. Run `pikku fabric login` first.');
+        if (!ctx.projectId)
+            throw new Error('No fabric project linked. Run `pikku fabric link` first.');
+        // Resolved before the prompt so the confirmation names the stage that
+        // would actually lose the secret, not an argument that may be absent.
+        const rpc = getFabricRPC({ apiUrl: ctx.apiUrl, token: ctx.token });
+        const { stageId, branch } = await resolveStage(rpc, ctx.projectId, requested);
+        if (!force) {
+            if (!process.stdin.isTTY) {
+                throw new Error(`Refusing to delete ${name} from ${branch} without confirmation — re-run with --force to delete non-interactively.`);
+            }
+            // Fabric cannot read the sealed value back, so this is not recoverable
+            // by re-reading it — the plaintext has to be supplied again.
+            if (!(await promptConfirm(`Delete ${name} from ${branch}? It cannot be recovered — the value must be set again.`))) {
+                throw new Error('Delete aborted.');
+            }
+        }
+        const result = await rpc.invoke('deleteStageSecret', { stageId, name });
+        console.log(`[fabric] deleted ${result.name} from ${branch}`);
+        if (result.runId) {
+            console.log(`[fabric] republishing the stage as run ${result.runId} — units serve the old value until it lands`);
+        }
+        else {
+            console.log('[fabric] deploy the stage to stop its units serving the old value');
+        }
+        return result;
+    },
+});

package/dist/src/functions/commands/dev.js

@@ -4,7 +4,7 @@ import { pikkuSessionlessFunc } from '#pikku/function';
 import chokidar from 'chokidar';
 import { pikkuDevReloader, reloadGeneratedMeta, reconcileAddonRegistry, } from '@pikku/core/dev';
 import { InMemoryQueueService, QueueWebhookService } from '@pikku/core/services';
-import { ConsoleLogger, LocalEmailService, spy, InMemoryAgentRunStateService, } from '@pikku/core/services';
+import { ConsoleLogger, LocalEmailService, LocalCredentialService, spy, InMemoryAgentRunStateService, } from '@pikku/core/services';
 import { InMemoryTriggerService } from '@pikku/core/services';
 import { InMemoryWorkflowService } from '@pikku/core/services';
 import { KyselyAgentStorageService, KyselyAgentRunStateService, KyselyAgentRunService, } from '@pikku/kysely';
@@ -230,6 +230,7 @@ export const dev = pikkuSessionlessFunc({
             workflowService,
             workflowRunService: workflowService,
             triggerService: new InMemoryTriggerService(),
+            credentialService: new LocalCredentialService(),
             agentStorage,
             agentRunState,
             agentRunService,

package/dist/src/functions/commands/dist.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Carry into the build output the files `tsc` compiles around but never emits.
+ *
+ * `tsc` turns the generated `.ts` under the pikku out dir into JavaScript, so
+ * that half arrives on its own. Two kinds of file do not:
+ *
+ *  - the `*.gen.json` meta pikku writes beside them. `resolveJsonModule` lets
+ *    TypeScript *read* a json, it never copies one to `outDir`, and the meta is
+ *    read off disk at runtime — `MetaService` opens it by path — so a package
+ *    that ships only tsc's output answers every meta lookup with nothing.
+ *  - a hand-authored `.d.ts` such as `types/application-types.d.ts`. A
+ *    declaration file is an input, and `declaration: true` does not re-emit it.
+ *
+ * Packages used to do this with `cp -r .pikku types dist/`, which also dumped
+ * every `.ts` source into the published output and needed a POSIX shell.
+ */
+export type DistCopy = {
+    from: string;
+    to: string;
+};
+export declare const planDistCopies: (rootDir: string, distDir: string, files: string[]) => DistCopy[];
+export declare const pikkuDist: import("#pikku/function").PikkuFunctionConfig<{
+    distDir?: string;
+}, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<{
+    distDir?: string;
+}, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<{
+    distDir?: string;
+}, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/dist.js

@@ -0,0 +1,58 @@
+import { existsSync } from 'node:fs';
+import { cp, mkdir, readdir } from 'node:fs/promises';
+import { dirname, join, relative, resolve } from 'node:path';
+import ts from 'typescript';
+import { pikkuSessionlessFunc } from '#pikku/function';
+/**
+ * `tsc` compiles a `.ts` and emits it. Everything else it either reads without
+ * emitting — a `.d.ts` is an input, `declaration: true` does not re-emit one —
+ * or ignores entirely, like the generated json.
+ */
+const tscEmitsIt = (file) => file.endsWith('.ts') && !file.endsWith('.d.ts');
+const walk = async (dir) => {
+    if (!existsSync(dir)) {
+        return [];
+    }
+    const entries = await readdir(dir, { withFileTypes: true });
+    const files = await Promise.all(entries.map(async (entry) => {
+        const path = join(dir, entry.name);
+        return entry.isDirectory() ? walk(path) : [path];
+    }));
+    return files.flat();
+};
+export const planDistCopies = (rootDir, distDir, files) => {
+    return files
+        .filter((file) => !tscEmitsIt(file))
+        .map((from) => ({
+        from,
+        to: join(distDir, relative(rootDir, from)),
+    }));
+};
+const readTsOutDir = (tsconfig) => {
+    const parsed = ts.getParsedCommandLineOfConfigFile(tsconfig, {}, {
+        ...ts.sys,
+        onUnRecoverableConfigFileDiagnostic: () => { },
+    });
+    return parsed?.options.outDir;
+};
+export const pikkuDist = pikkuSessionlessFunc({
+    func: async ({ logger, config }, data) => {
+        const { rootDir, outDir, srcDirectories, tsconfig } = config;
+        const distDir = data.distDir
+            ? resolve(rootDir, data.distDir)
+            : readTsOutDir(resolve(rootDir, tsconfig));
+        if (!distDir) {
+            logger.error(`${tsconfig} sets no compilerOptions.outDir, so there is nowhere to copy to. Set one, or pass --dist-dir.`);
+            process.exit(1);
+        }
+        const copies = planDistCopies(rootDir, distDir, [
+            ...(await walk(outDir)),
+            ...(await Promise.all(srcDirectories.map((dir) => walk(resolve(rootDir, dir))))).flat(),
+        ]);
+        for (const { from, to } of copies) {
+            await mkdir(dirname(to), { recursive: true });
+            await cp(from, to);
+        }
+        logger.info(`Copied ${copies.length} generated file(s) into ${relative(rootDir, distDir) || distDir}`);
+    },
+});