@pikku/cli 0.12.136 → 0.12.141

package/dist/src/deploy/bundler/bundler.interface.d.ts

@@ -28,8 +28,14 @@ export interface CompileInput {
     bannerJs?: string;
     sourcemap: boolean;
     emitMetafile: boolean;
-    /** Regexes for modules to replace with an empty `export {}` module. */
+    /** Regexes for modules to replace with an empty module. */
     deadPatterns: RegExp[];
+    /**
+     * Whether the compile may rename identifiers. False when the bundle is an
+     * INPUT to a second bundler rather than the shipped artifact — see
+     * `getMangleIdentifiers` on the provider adapter.
+     */
+    mangleIdentifiers: boolean;
 }
 export interface CompileResult {
     /** Real npm package names kept external — drive the unit's package.json. */
@@ -47,6 +53,8 @@ export interface BundleUnitsOptions {
     sourcemap?: boolean;
     emitMetafile?: boolean;
     stubModules?: string[];
+    /** Defaults to true; see {@link CompileInput.mangleIdentifiers}. */
+    mangleIdentifiers?: boolean;
     resolveOutputDir?: (unit: DeploymentUnit, baseOutputDir: string) => string;
 }
 export interface Bundler {

package/dist/src/deploy/bundler/bundler.js

@@ -172,6 +172,7 @@ export class BaseBundler {
             sourcemap,
             emitMetafile,
             deadPatterns,
+            mangleIdentifiers: options.mangleIdentifiers !== false,
         });
         // Metafile is large (~1.6MB/unit) and never needed at runtime — only
         // persisted for debugging.

package/dist/src/deploy/bundler/node-bundler.js

@@ -26,8 +26,11 @@ function createDeadModuleStubPlugin(patterns) {
                 path: args.path,
                 namespace: 'pikku-stub',
             }));
+            // CJS, not `export {}`: the stubbed packages are imported in every shape
+            // (`import pg from 'pg'`, `import { PostgresDialect } from 'kysely'`), and
+            // an ESM stub fails the build on each one it cannot statically satisfy.
             build.onLoad({ filter: /.*/, namespace: 'pikku-stub' }, () => ({
-                contents: 'export {}',
+                contents: 'module.exports = {}',
                 loader: 'js',
             }));
         },
@@ -60,7 +63,14 @@ export class NodeBundler extends BaseBundler {
             // runtime (CF Workers / container), tsc is never the bundler. keepNames
             // preserves Function.name / constructor.name so name-based reflection
             // still works.
-            minify: true,
+            //
+            // Whitespace and syntax always; identifiers only when this bundle is the
+            // shipped artifact. `minify: true` cannot express that — esbuild ORs it
+            // over the granular flags, so a `minifyIdentifiers: false` beside it is
+            // silently ignored.
+            minifyWhitespace: true,
+            minifySyntax: true,
+            minifyIdentifiers: input.mangleIdentifiers,
             keepNames: true,
             sourcemap: input.sourcemap,
             logLevel: 'warning',

package/dist/src/deploy/bundler/service-module-map.js

@@ -2,8 +2,8 @@
  * Mapping of service name -> npm module patterns to stub when the service is
  * NOT required by a deployment unit. These are external packages, not gen
  * files: a unit that doesn't wire the service never executes the code path
- * that imports them, so replacing them with `export {}` keeps their (often
- * large) trees out of the bundle.
+ * that imports them, so replacing them with an empty module keeps their
+ * (often large) trees out of the bundle.
  *
  * The AI SDKs (@pikku/ai-vercel + @ai-sdk/* + `ai`, ~3MB) are only constructed
  * when a model-bearing service is wired. Every other unit stubs them. The

package/dist/src/fabric/fabric-commands.d.ts

@@ -50,7 +50,7 @@ export declare const fabricCommands: {
         notes: string[];
         steps: {
             name: string;
-            status: "skipped" | "failed" | "passed";
+            status: "failed" | "passed" | "skipped";
             durationMs: number;
             detail?: string | undefined;
             command?: string | undefined;
@@ -71,7 +71,7 @@ export declare const fabricCommands: {
         notes: string[];
         steps: {
             name: string;
-            status: "skipped" | "failed" | "passed";
+            status: "failed" | "passed" | "skipped";
             durationMs: number;
             detail?: string | undefined;
             command?: string | undefined;
@@ -92,7 +92,7 @@ export declare const fabricCommands: {
         notes: string[];
         steps: {
             name: string;
-            status: "skipped" | "failed" | "passed";
+            status: "failed" | "passed" | "skipped";
             durationMs: number;
             detail?: string | undefined;
             command?: string | undefined;
@@ -161,6 +161,9 @@ export declare const fabricCommands: {
     }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").WiredServices>, undefined, undefined>, import("../../.pikku/middleware/pikku-middleware-types.gen.js").PikkuMiddleware, (services: import("../../types/application-types.js").SingletonServices, data: any, session?: import("../../types/application-types.js").UserSession | undefined) => void | Promise<void>, string>;
     link: import("@pikku/core/cli").CoreCLICommandConfig<import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<{
         apiUrl?: string | undefined;
+        github?: boolean | undefined;
+        gitea?: boolean | undefined;
+        repoName?: string | undefined;
     }, {
         projectId: string;
         projectSlug: string;
@@ -168,6 +171,9 @@ export declare const fabricCommands: {
         stageId: string;
     }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
         apiUrl?: string | undefined;
+        github?: boolean | undefined;
+        gitea?: boolean | undefined;
+        repoName?: string | undefined;
     }, {
         projectId: string;
         projectSlug: string;
@@ -175,6 +181,9 @@ export declare const fabricCommands: {
         stageId: string;
     }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
         apiUrl?: string | undefined;
+        github?: boolean | undefined;
+        gitea?: boolean | undefined;
+        repoName?: string | undefined;
     }, {
         projectId: string;
         projectSlug: string;
@@ -291,7 +300,7 @@ export declare const fabricCommands: {
                 json?: boolean | undefined;
             }, {
                 event: "result";
-                outcome: "queued" | "failed" | "timeout" | "succeeded" | "blocked";
+                outcome: "failed" | "queued" | "succeeded" | "blocked" | "timeout";
                 projectId: string;
                 deploymentId: string;
                 branch?: string | undefined;
@@ -354,7 +363,7 @@ export declare const fabricCommands: {
                 json?: boolean | undefined;
             }, {
                 event: "result";
-                outcome: "queued" | "failed" | "timeout" | "succeeded" | "blocked";
+                outcome: "failed" | "queued" | "succeeded" | "blocked" | "timeout";
                 projectId: string;
                 deploymentId: string;
                 branch?: string | undefined;
@@ -417,7 +426,7 @@ export declare const fabricCommands: {
                 json?: boolean | undefined;
             }, {
                 event: "result";
-                outcome: "queued" | "failed" | "timeout" | "succeeded" | "blocked";
+                outcome: "failed" | "queued" | "succeeded" | "blocked" | "timeout";
                 projectId: string;
                 deploymentId: string;
                 branch?: string | undefined;
@@ -1069,7 +1078,7 @@ export declare const fabricCommands: {
             }, {
                 proxyUrl: string;
                 apiKey: string;
-                format: "text" | "json" | "env" | "shell";
+                format: "text" | "json" | "shell" | "env";
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
                 shell?: boolean | undefined;
                 env?: boolean | undefined;
@@ -1077,7 +1086,7 @@ export declare const fabricCommands: {
             }, {
                 proxyUrl: string;
                 apiKey: string;
-                format: "text" | "json" | "env" | "shell";
+                format: "text" | "json" | "shell" | "env";
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
                 shell?: boolean | undefined;
                 env?: boolean | undefined;
@@ -1085,7 +1094,7 @@ export declare const fabricCommands: {
             }, {
                 proxyUrl: string;
                 apiKey: string;
-                format: "text" | "json" | "env" | "shell";
+                format: "text" | "json" | "shell" | "env";
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").WiredServices>, undefined, undefined>, import("../../.pikku/middleware/pikku-middleware-types.gen.js").PikkuMiddleware, (services: import("../../types/application-types.js").SingletonServices, data: any, session?: import("../../types/application-types.js").UserSession | undefined) => void | Promise<void>, string>;
         };
     };

package/dist/src/fabric/fabric-commands.js

@@ -120,6 +120,17 @@ export const fabricCommands = defineCLICommands({
         func: FabricLink,
         description: 'Register the current git repo as a fabric project and queue an initial deploy',
         options: {
+            github: {
+                description: 'Assert the repo is on github.com (fails if origin points elsewhere)',
+                default: false,
+            },
+            gitea: {
+                description: "Host the repo on fabric's git server — creates and pushes to it when there is no origin",
+                default: false,
+            },
+            repoName: {
+                description: 'Name for a repo created by --gitea (defaults to the directory name)',
+            },
             apiUrl: {
                 description: 'Override the fabric-api URL stored in fabric.config.json',
             },

package/dist/src/fabric/functions/deploy.function.d.ts

@@ -24,11 +24,11 @@ export declare const FabricDeployValidatedInput: z.ZodObject<{
 export declare const FabricDeployApplyOutput: z.ZodObject<{
     event: z.ZodLiteral<"result">;
     outcome: z.ZodEnum<{
-        queued: "queued";
         failed: "failed";
-        timeout: "timeout";
+        queued: "queued";
         succeeded: "succeeded";
         blocked: "blocked";
+        timeout: "timeout";
     }>;
     projectId: z.ZodString;
     deploymentId: z.ZodString;
@@ -111,7 +111,7 @@ export declare const FabricDeployApply: import("../../../.pikku/function/pikku-f
     json?: boolean | undefined;
 }, {
     event: "result";
-    outcome: "queued" | "failed" | "timeout" | "succeeded" | "blocked";
+    outcome: "failed" | "queued" | "succeeded" | "blocked" | "timeout";
     projectId: string;
     deploymentId: string;
     branch?: string | undefined;
@@ -174,7 +174,7 @@ export declare const FabricDeployApply: import("../../../.pikku/function/pikku-f
     json?: boolean | undefined;
 }, {
     event: "result";
-    outcome: "queued" | "failed" | "timeout" | "succeeded" | "blocked";
+    outcome: "failed" | "queued" | "succeeded" | "blocked" | "timeout";
     projectId: string;
     deploymentId: string;
     branch?: string | undefined;
@@ -237,7 +237,7 @@ export declare const FabricDeployApply: import("../../../.pikku/function/pikku-f
     json?: boolean | undefined;
 }, {
     event: "result";
-    outcome: "queued" | "failed" | "timeout" | "succeeded" | "blocked";
+    outcome: "failed" | "queued" | "succeeded" | "blocked" | "timeout";
     projectId: string;
     deploymentId: string;
     branch?: string | undefined;

package/dist/src/fabric/functions/link.function.d.ts

@@ -1,6 +1,9 @@
 import { z } from 'zod';
 export declare const FabricLinkInput: z.ZodObject<{
     apiUrl: z.ZodOptional<z.ZodString>;
+    github: z.ZodOptional<z.ZodBoolean>;
+    gitea: z.ZodOptional<z.ZodBoolean>;
+    repoName: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export declare const FabricLinkOutput: z.ZodObject<{
     projectId: z.ZodString;
@@ -10,6 +13,9 @@ export declare const FabricLinkOutput: z.ZodObject<{
 }, z.core.$strip>;
 export declare const FabricLink: import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<{
     apiUrl?: string | undefined;
+    github?: boolean | undefined;
+    gitea?: boolean | undefined;
+    repoName?: string | undefined;
 }, {
     projectId: string;
     projectSlug: string;
@@ -17,6 +23,9 @@ export declare const FabricLink: import("../../../.pikku/function/pikku-function
     stageId: string;
 }, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
     apiUrl?: string | undefined;
+    github?: boolean | undefined;
+    gitea?: boolean | undefined;
+    repoName?: string | undefined;
 }, {
     projectId: string;
     projectSlug: string;
@@ -24,6 +33,9 @@ export declare const FabricLink: import("../../../.pikku/function/pikku-function
     stageId: string;
 }, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
     apiUrl?: string | undefined;
+    github?: boolean | undefined;
+    gitea?: boolean | undefined;
+    repoName?: string | undefined;
 }, {
     projectId: string;
     projectSlug: string;

package/dist/src/fabric/functions/link.function.js

@@ -1,10 +1,18 @@
 import { z } from 'zod';
+import { basename } from 'node:path';
 import { pikkuSessionlessFunc } from '../../../.pikku/function/index.js';
 import { resolveApiContext, writeProjectConfig } from '../lib/config.js';
 import { getFabricRPC } from '../lib/http.js';
-import { assertDeploySafety, getRemoteUrl } from '../lib/git.js';
+import { addRemote, assertDeploySafety, currentBranch, getRemoteUrl, hasCommits, hasRemote, isWorkingTreeClean, pushWithCredential, removeRemote, } from '../lib/git.js';
+import { promptConfirm } from '../lib/prompt.js';
 export const FabricLinkInput = z.object({
     apiUrl: z.string().optional(),
+    /** Assert the project lives on GitHub. */
+    github: z.boolean().optional(),
+    /** Assert — or, with no `origin`, request — a repo on Fabric's git server. */
+    gitea: z.boolean().optional(),
+    /** Name for a repo created here. Defaults to the directory name. */
+    repoName: z.string().optional(),
 });
 export const FabricLinkOutput = z.object({
     projectId: z.string(),
@@ -14,22 +22,38 @@ export const FabricLinkOutput = z.object({
 });
 const GITHUB_POLL_INTERVAL_MS = 2000;
 const GITHUB_POLL_TIMEOUT_MS = 5 * 60 * 1000;
+/** github.com or not. Everything else Fabric supports is reached the Gitea way. */
+const isGithubUrl = (url) => /github\.com/i.test(url);
 export const FabricLink = pikkuSessionlessFunc({
     description: 'Register the current git repo as a fabric project and queue an initial deploy.',
     input: FabricLinkInput,
     output: FabricLinkOutput,
-    func: async (_services, { apiUrl: apiUrlOverride }) => {
+    func: async (_services, { apiUrl: apiUrlOverride, github, gitea, repoName }) => {
         const ctx = await resolveApiContext({ apiUrlOverride });
         if (!ctx.token) {
             throw new Error('Not logged in. Run `pikku fabric login` first.');
         }
-        const remoteUrl = await getRemoteUrl();
-        const safety = await assertDeploySafety();
+        if (github && gitea) {
+            throw new Error('--github and --gitea name two different places to keep one repo. Pass one, or neither to use whatever `origin` already points at.');
+        }
         const rpc = getFabricRPC({ apiUrl: ctx.apiUrl, token: ctx.token });
+        // Both of these are checked BEFORE anything is created. `assertDeploySafety`
+        // below covers them too, but it runs after the repo exists — and refusing to
+        // link because of a dirty tree, having already provisioned a repo the user
+        // now has to clean up, is a worse answer than refusing first.
+        if (!(await hasCommits())) {
+            throw new Error('Nothing to link: this repository has no commits yet. Commit your work first — fabric deploys a pushed commit, not a working directory.');
+        }
+        if (!(await isWorkingTreeClean())) {
+            throw new Error('Deployment blocked: uncommitted changes detected.\nCommit and push your changes before deploying.');
+        }
+        const remoteUrl = (await hasRemote())
+            ? await adoptExistingRemote({ github, gitea })
+            : await createRemote({ rpc, github, gitea, repoName });
+        const safety = await assertDeploySafety();
         // Only check GitHub App installation for github.com repos.
         // Gitea (local dev) and other hosts use shared tokens — no App needed.
-        const isGithub = /github\.com/i.test(remoteUrl);
-        if (isGithub) {
+        if (isGithubUrl(remoteUrl)) {
             const ghInstall = await rpc.invoke('checkGithubInstall', {});
             if (!ghInstall.installed) {
                 if (!ghInstall.installUrl) {
@@ -80,3 +104,68 @@ export const FabricLink = pikkuSessionlessFunc({
         };
     },
 });
+/**
+ * The common case: `origin` exists, so that is the repo, whichever host it is on.
+ *
+ * The flags are read as ASSERTIONS here rather than as instructions. `--gitea`
+ * against a github.com origin could plausibly mean "move this to Fabric's git
+ * server", but re-pointing somebody's `origin` is not something a link command
+ * should decide on its own — so it is a question, answered by an error that says
+ * what to do instead.
+ */
+async function adoptExistingRemote({ github, gitea, }) {
+    const remoteUrl = await getRemoteUrl();
+    const onGithub = isGithubUrl(remoteUrl);
+    if (github && !onGithub) {
+        throw new Error(`--github was passed, but origin is ${remoteUrl}, which is not on github.com.\nDrop the flag to link that remote, or repoint origin at the GitHub repo you meant.`);
+    }
+    if (gitea && onGithub) {
+        throw new Error(`--gitea was passed, but origin is already ${remoteUrl}.\nDrop the flag to link the GitHub repo. To host it on fabric instead, remove the remote first (\`git remote remove origin\`) and run link again.`);
+    }
+    return remoteUrl;
+}
+/**
+ * No `origin` — the case `link` used to fail on with a bare "no such remote".
+ *
+ * Fabric creates the repo on its own git server and pushes to it, then the
+ * caller carries on down the ordinary import path. It does NOT create GitHub
+ * repos: doing that on the user's behalf needs a separate consent (a device-flow
+ * authorization against their GitHub account), and the Fabric GitHub App cannot
+ * stand in for it without asking every existing installation to re-approve an
+ * `administration: write` permission.
+ *
+ * Nothing here happens unasked. Without a flag the user is asked, and a session
+ * with nobody at the terminal is told which flag to pass instead of hanging on a
+ * prompt no one will answer.
+ */
+async function createRemote({ rpc, github, gitea, repoName, }) {
+    if (github) {
+        throw new Error('There is no `origin` to link, and fabric cannot create a GitHub repository for you.\nCreate it on github.com, `git remote add origin <url>`, and run `pikku fabric link` again — or pass --gitea to host it on fabric instead.');
+    }
+    if (!gitea) {
+        if (!process.stdin.isTTY) {
+            throw new Error('There is no `origin` to link.\nPass --gitea to create a repository on fabric and push to it, or add a remote yourself and run link again.');
+        }
+        const confirmed = await promptConfirm('This project has no git remote. Create one on fabric and push this branch to it?', true);
+        if (!confirmed) {
+            throw new Error('Nothing linked. Add a remote yourself (`git remote add origin <url>`) and run `pikku fabric link` again.');
+        }
+    }
+    const name = repoName ?? basename(process.cwd());
+    const branch = await currentBranch();
+    const repo = await rpc.invoke('provisionRepo', { name });
+    console.log(`[fabric] created ${repo.repoUrl}`);
+    await addRemote('origin', repo.cloneUrl);
+    try {
+        await pushWithCredential('origin', branch, repo);
+    }
+    catch (error) {
+        // Leave no half-linked repository behind. The remote is ours — added a line
+        // ago — so removing it is safe, and it is what stops a retry dying on
+        // "remote origin already exists" instead of on the real problem.
+        await removeRemote('origin');
+        throw new Error(`Created ${repo.repoUrl} but could not push to it: ${error instanceof Error ? error.message : String(error)}\nThe repository exists and is empty; push to it yourself, or run link again to get a fresh one.`);
+    }
+    console.log(`[fabric] pushed ${branch} to origin`);
+    return repo.repoUrl;
+}

package/dist/src/fabric/functions/llm-key.function.d.ts

@@ -10,8 +10,8 @@ export declare const FabricLLMKeyOutput: z.ZodObject<{
     format: z.ZodEnum<{
         text: "text";
         json: "json";
-        env: "env";
         shell: "shell";
+        env: "env";
     }>;
 }, z.core.$strip>;
 export declare const FabricLLMKey: import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<{
@@ -21,7 +21,7 @@ export declare const FabricLLMKey: import("../../../.pikku/function/pikku-functi
 }, {
     proxyUrl: string;
     apiKey: string;
-    format: "text" | "json" | "env" | "shell";
+    format: "text" | "json" | "shell" | "env";
 }, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
     shell?: boolean | undefined;
     env?: boolean | undefined;
@@ -29,7 +29,7 @@ export declare const FabricLLMKey: import("../../../.pikku/function/pikku-functi
 }, {
     proxyUrl: string;
     apiKey: string;
-    format: "text" | "json" | "env" | "shell";
+    format: "text" | "json" | "shell" | "env";
 }, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
     shell?: boolean | undefined;
     env?: boolean | undefined;
@@ -37,7 +37,7 @@ export declare const FabricLLMKey: import("../../../.pikku/function/pikku-functi
 }, {
     proxyUrl: string;
     apiKey: string;
-    format: "text" | "json" | "env" | "shell";
+    format: "text" | "json" | "shell" | "env";
 }, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices>, undefined, undefined>;
 export declare const renderLLMKey: (_services: unknown, data: {
     proxyUrl: string;

package/dist/src/fabric/functions/smoke.function.d.ts

@@ -15,9 +15,9 @@ export declare const FabricSmokeOutput: z.ZodObject<{
     steps: z.ZodArray<z.ZodObject<{
         name: z.ZodString;
         status: z.ZodEnum<{
-            skipped: "skipped";
             failed: "failed";
             passed: "passed";
+            skipped: "skipped";
         }>;
         durationMs: z.ZodNumber;
         detail: z.ZodOptional<z.ZodString>;
@@ -40,7 +40,7 @@ export declare const FabricSmoke: import("../../../.pikku/function/pikku-functio
     notes: string[];
     steps: {
         name: string;
-        status: "skipped" | "failed" | "passed";
+        status: "failed" | "passed" | "skipped";
         durationMs: number;
         detail?: string | undefined;
         command?: string | undefined;
@@ -61,7 +61,7 @@ export declare const FabricSmoke: import("../../../.pikku/function/pikku-functio
     notes: string[];
     steps: {
         name: string;
-        status: "skipped" | "failed" | "passed";
+        status: "failed" | "passed" | "skipped";
         durationMs: number;
         detail?: string | undefined;
         command?: string | undefined;
@@ -82,7 +82,7 @@ export declare const FabricSmoke: import("../../../.pikku/function/pikku-functio
     notes: string[];
     steps: {
         name: string;
-        status: "skipped" | "failed" | "passed";
+        status: "failed" | "passed" | "skipped";
         durationMs: number;
         detail?: string | undefined;
         command?: string | undefined;

package/dist/src/fabric/lib/git.d.ts

@@ -74,3 +74,30 @@ export declare function isTracked(relPath: string, cwd?: string): Promise<boolea
  * the file" from "there is no repository", which are the same `false` there.
  */
 export declare function isGitRepo(cwd?: string): Promise<boolean>;
+/**
+ * Does this repository have the given remote?
+ *
+ * Separate from `getRemoteUrl` throwing, because "no origin" is an ordinary
+ * state that `link` acts on rather than an error it reports: a developer who
+ * has not pushed anywhere yet is exactly who repo provisioning is for.
+ */
+export declare function hasRemote(remote?: string, cwd?: string): Promise<boolean>;
+/** Does HEAD resolve? False in a repository with no commits yet. */
+export declare function hasCommits(cwd?: string): Promise<boolean>;
+export declare function addRemote(name: string, url: string, cwd?: string): Promise<void>;
+export declare function removeRemote(name: string, cwd?: string): Promise<void>;
+/**
+ * Push `branch` to `remote` and set it as upstream, authenticating with a
+ * one-shot credential.
+ *
+ * The credential is passed through the ENVIRONMENT and read back by an inline
+ * credential helper, rather than embedded in the remote URL. Both a URL like
+ * `https://user:token@host/...` and `-c http.<url>.extraheader=...` put the
+ * secret in the process's argv, where any other user on the machine can read it
+ * out of `ps`. This way argv holds only the shape of the helper, and the token
+ * never reaches `.git/config` either — so it cannot outlive the push.
+ */
+export declare function pushWithCredential(remote: string, branch: string, credential: {
+    username: string;
+    password: string;
+}, cwd?: string): Promise<void>;

package/dist/src/fabric/lib/git.js

@@ -41,11 +41,11 @@ function envWithoutInheritedRepo() {
     }
     return env;
 }
-function git(args, cwd = process.cwd()) {
+function git(args, cwd = process.cwd(), extraEnv) {
     return new Promise((resolve, reject) => {
         const child = spawn('git', args, {
             cwd,
-            env: envWithoutInheritedRepo(),
+            env: { ...envWithoutInheritedRepo(), ...extraEnv },
             stdio: ['ignore', 'pipe', 'pipe'],
         });
         let stdout = '';
@@ -218,3 +218,71 @@ export async function isGitRepo(cwd = process.cwd()) {
         return false;
     }
 }
+/**
+ * Does this repository have the given remote?
+ *
+ * Separate from `getRemoteUrl` throwing, because "no origin" is an ordinary
+ * state that `link` acts on rather than an error it reports: a developer who
+ * has not pushed anywhere yet is exactly who repo provisioning is for.
+ */
+export async function hasRemote(remote = 'origin', cwd) {
+    try {
+        await git(['remote', 'get-url', remote], cwd);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Does HEAD resolve? False in a repository with no commits yet. */
+export async function hasCommits(cwd) {
+    try {
+        await git(['rev-parse', '--verify', 'HEAD'], cwd);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function addRemote(name, url, cwd) {
+    await git(['remote', 'add', name, url], cwd);
+}
+export async function removeRemote(name, cwd) {
+    try {
+        await git(['remote', 'remove', name], cwd);
+    }
+    catch {
+        /* best-effort: only used to undo a remote we just added */
+    }
+}
+/**
+ * Push `branch` to `remote` and set it as upstream, authenticating with a
+ * one-shot credential.
+ *
+ * The credential is passed through the ENVIRONMENT and read back by an inline
+ * credential helper, rather than embedded in the remote URL. Both a URL like
+ * `https://user:token@host/...` and `-c http.<url>.extraheader=...` put the
+ * secret in the process's argv, where any other user on the machine can read it
+ * out of `ps`. This way argv holds only the shape of the helper, and the token
+ * never reaches `.git/config` either — so it cannot outlive the push.
+ */
+export async function pushWithCredential(remote, branch, credential, cwd) {
+    await git([
+        '-c',
+        'credential.helper=',
+        '-c',
+        'credential.helper=!f() { echo "username=$PIKKU_GIT_USERNAME"; echo "password=$PIKKU_GIT_PASSWORD"; }; f',
+        'push',
+        '-u',
+        remote,
+        `HEAD:refs/heads/${branch}`,
+    ], cwd, {
+        PIKKU_GIT_USERNAME: credential.username,
+        PIKKU_GIT_PASSWORD: credential.password,
+        // Any configured interactive helper (osxkeychain, a GUI prompt) would be
+        // consulted first and could hang a CLI with no one at the terminal. The
+        // empty `credential.helper=` above resets the inherited list; this stops
+        // git falling back to a terminal prompt if ours somehow yields nothing.
+        GIT_TERMINAL_PROMPT: '0',
+    });
+}

package/dist/src/functions/commands/db-export.js

@@ -1,7 +1,5 @@
-import { mkdirSync, writeFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
 import { pikkuSessionlessFunc } from '#pikku/function';
-import { exportSchema } from '../db/local-db.js';
+import { writeSchemaArtifact } from '../db/local-db.js';
 /**
  * Publish this package's schema so a project consuming it as an addon can
  * create its tables.
@@ -16,15 +14,12 @@ import { exportSchema } from '../db/local-db.js';
 export const dbExport = pikkuSessionlessFunc({
     remote: true,
     func: async ({ logger, config }) => {
-        const artifact = await exportSchema(config.rootDir, config.db?.pgliteExtensions);
-        const dialects = Object.keys(artifact);
+        const { file, dialects } = await writeSchemaArtifact(config.rootDir, config.outDir, config.db?.pgliteExtensions);
         if (dialects.length === 0) {
-            logger.info('db export: no db/sqlite or db/postgres migrations — nothing to publish');
+            logger.info(`db export: no db/sqlite or db/postgres migrations — wrote ${file} empty, ` +
+                'which is how a consumer tells "no tables" from "never published"');
             return;
         }
-        const file = join(config.outDir, 'db', 'pikku-db-meta.gen.json');
-        mkdirSync(dirname(file), { recursive: true });
-        writeFileSync(file, `${JSON.stringify(artifact, null, 2)}\n`, 'utf8');
         logger.info(`db export: wrote ${file} for ${dialects.join(', ')}`);
         logger.info('  Ship it with the package — a consumer resolves it through the package name.');
     },

package/dist/src/functions/commands/enable.d.ts

@@ -5,4 +5,5 @@ export declare const enableAgent: import("#pikku/function").PikkuFunctionConfig<
 export declare const enableWorkflow: import("#pikku/function").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;
 export declare const enableEvents: import("#pikku/function").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;
 export declare const enableRemoteRpc: import("#pikku/function").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;
+export declare const enableRemoteJobs: import("#pikku/function").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;
 export declare const enableWebhook: import("#pikku/function").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;