@pikku/cli 0.12.145 → 0.12.152

package/dist/src/fabric/functions/secrets-set.function.d.ts

@@ -17,7 +17,7 @@ export declare const FabricSecretsSet: import("../../../.pikku/function/pikku-fu
 }, {
     name: string;
     keyId: string;
-}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
     name: string;
     branch?: string | undefined;
     value?: string | undefined;
@@ -25,7 +25,7 @@ export declare const FabricSecretsSet: import("../../../.pikku/function/pikku-fu
 }, {
     name: string;
     keyId: string;
-}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices> | import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
     name: string;
     branch?: string | undefined;
     value?: string | undefined;
@@ -33,4 +33,4 @@ export declare const FabricSecretsSet: import("../../../.pikku/function/pikku-fu
 }, {
     name: string;
     keyId: string;
-}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices>, undefined, undefined>;
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown>, undefined, undefined>;

package/dist/src/fabric/functions/smoke.function.d.ts

@@ -47,7 +47,7 @@ export declare const FabricSmoke: import("../../../.pikku/function/pikku-functio
     }[];
     failure?: string | undefined;
     logTail?: string | undefined;
-}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
     keepTemp?: boolean | undefined;
     timeoutSeconds?: number | undefined;
     startupTimeoutSeconds?: number | undefined;
@@ -68,7 +68,7 @@ export declare const FabricSmoke: import("../../../.pikku/function/pikku-functio
     }[];
     failure?: string | undefined;
     logTail?: string | undefined;
-}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices> | import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
     keepTemp?: boolean | undefined;
     timeoutSeconds?: number | undefined;
     startupTimeoutSeconds?: number | undefined;
@@ -89,5 +89,5 @@ export declare const FabricSmoke: import("../../../.pikku/function/pikku-functio
     }[];
     failure?: string | undefined;
     logTail?: string | undefined;
-}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices>, undefined, undefined>;
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown>, undefined, undefined>;
 export declare const renderSmoke: (_services: unknown, output: z.infer<typeof FabricSmokeOutput>) => void;

package/dist/src/fabric/functions/status.function.d.ts

@@ -7,13 +7,13 @@ export declare const FabricStatusOutput: z.ZodObject<{
 export declare const FabricStatus: import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<Record<string, never>, {
     projectId: string;
     status: any;
-}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<Record<string, never>, {
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<Record<string, never>, {
     projectId: string;
     status: any;
-}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<Record<string, never>, {
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices> | import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<Record<string, never>, {
     projectId: string;
     status: any;
-}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices>, undefined, undefined>;
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown>, undefined, undefined>;
 type StageState = {
     stageBranch: string;
     gitSha?: string | null;

package/dist/src/fabric/functions/trace.function.d.ts

@@ -13,16 +13,16 @@ export declare const FabricTrace: import("../../../.pikku/function/pikku-functio
     json?: boolean | undefined;
 }, {
     count: number;
-}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
     branch: string;
     traceId: string;
     json?: boolean | undefined;
 }, {
     count: number;
-}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices> | import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
     branch: string;
     traceId: string;
     json?: boolean | undefined;
 }, {
     count: number;
-}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices>, undefined, undefined>;
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown>, undefined, undefined>;

package/dist/src/fabric/functions/validate.function.d.ts

@@ -8,9 +8,9 @@ export declare const FabricValidateOutput: z.ZodObject<{
     findings: z.ZodArray<z.ZodObject<{
         id: z.ZodString;
         severity: z.ZodEnum<{
-            warn: "warn";
             error: "error";
             info: "info";
+            warn: "warn";
         }>;
         message: z.ZodString;
         path: z.ZodString;
@@ -27,34 +27,34 @@ export declare const FabricValidate: import("../../../.pikku/function/pikku-func
     root: string;
     findings: {
         id: string;
-        severity: "warn" | "error" | "info";
+        severity: "error" | "info" | "warn";
         message: string;
         path: string;
         fixHint: string;
     }[];
-}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
     skipTypecheck?: boolean | undefined;
 }, {
     ok: boolean;
     root: string;
     findings: {
         id: string;
-        severity: "warn" | "error" | "info";
+        severity: "error" | "info" | "warn";
         message: string;
         path: string;
         fixHint: string;
     }[];
-}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices> | import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
     skipTypecheck?: boolean | undefined;
 }, {
     ok: boolean;
     root: string;
     findings: {
         id: string;
-        severity: "warn" | "error" | "info";
+        severity: "error" | "info" | "warn";
         message: string;
         path: string;
         fixHint: string;
     }[];
-}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices>, undefined, undefined>;
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown>, undefined, undefined>;
 export declare const renderValidate: (_s: unknown, { ok, root, findings }: z.infer<typeof FabricValidateOutput>) => void;

package/dist/src/fabric/functions/variables-get.function.d.ts

@@ -17,7 +17,7 @@ export declare const FabricVariablesGet: import("../../../.pikku/function/pikku-
     name: string;
     exists: boolean;
     value: unknown;
-}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
     name: string;
     branch?: string | undefined;
     json?: boolean | undefined;
@@ -25,7 +25,7 @@ export declare const FabricVariablesGet: import("../../../.pikku/function/pikku-
     name: string;
     exists: boolean;
     value: unknown;
-}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices> | import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
     name: string;
     branch?: string | undefined;
     json?: boolean | undefined;
@@ -33,4 +33,4 @@ export declare const FabricVariablesGet: import("../../../.pikku/function/pikku-
     name: string;
     exists: boolean;
     value: unknown;
-}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices>, undefined, undefined>;
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown>, undefined, undefined>;

package/dist/src/fabric/functions/variables-set.function.d.ts

@@ -10,23 +10,23 @@ export declare const FabricVariablesSetOutput: z.ZodObject<{
 }, z.core.$strip>;
 export declare const FabricVariablesSet: import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<{
     name: string;
-    value: string;
     branch?: string | undefined;
+    value: string;
 }, {
     name: string;
     success: boolean;
-}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
     name: string;
-    value: string;
     branch?: string | undefined;
+    value: string;
 }, {
     name: string;
     success: boolean;
-}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices> | import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
     name: string;
-    value: string;
     branch?: string | undefined;
+    value: string;
 }, {
     name: string;
     success: boolean;
-}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices>, undefined, undefined>;
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown>, undefined, undefined>;

package/dist/src/fabric/lib/changes.d.ts

@@ -0,0 +1,38 @@
+import type { PikkuRPC } from '../sdk/pikku-rpc.gen.js';
+/**
+ * Resolve the three things every `changes` command needs: the api url, a
+ * bearer, and the project the queue belongs to.
+ *
+ * `requireProject` is false for the per-item commands, which address a change
+ * by id and so work from any directory — a harness reading a queue is often
+ * not sitting in the checkout it is about to edit.
+ */
+export declare function changesContext(apiUrlOverride: string | undefined, projectIdOverride?: string): Promise<{
+    rpc: PikkuRPC;
+    projectId: string | null;
+}>;
+export declare function requireProjectId(projectId: string | null): string;
+/**
+ * Split a repeatable comma-separated option into ids. `--change-ids a,b
+ * --change-ids c` and `--change-ids a --change-ids b` both mean the same list,
+ * because a harness building the flag from a shell loop will produce either.
+ */
+export declare function idList(values: string[] | undefined): string[] | undefined;
+/** How long ago something happened — for timestamps in the past. */
+export declare function age(at: Date | string): string;
+/**
+ * How long is left — for a lease expiry, which is in the future. Passing one of
+ * those to `age` renders it as `-30m`, and an expiry already behind us is `0m`
+ * rather than a negative number, because the lease is simply over.
+ */
+export declare function remaining(at: Date | string): string;
+declare const CONTENT_TYPES: {
+    readonly '.png': 'image/png';
+    readonly '.jpg': 'image/jpeg';
+    readonly '.jpeg': 'image/jpeg';
+    readonly '.webp': 'image/webp';
+};
+export type ImageContentType = (typeof CONTENT_TYPES)[keyof typeof CONTENT_TYPES];
+/** The content type an image path implies, or undefined if the name says nothing. */
+export declare function imageContentType(path: string): ImageContentType | undefined;
+export {};

package/dist/src/fabric/lib/changes.js

@@ -0,0 +1,70 @@
+import { extname } from 'node:path';
+import { resolveApiContext } from './config.js';
+import { getFabricRPC } from './http.js';
+/**
+ * Resolve the three things every `changes` command needs: the api url, a
+ * bearer, and the project the queue belongs to.
+ *
+ * `requireProject` is false for the per-item commands, which address a change
+ * by id and so work from any directory — a harness reading a queue is often
+ * not sitting in the checkout it is about to edit.
+ */
+export async function changesContext(apiUrlOverride, projectIdOverride) {
+    const ctx = await resolveApiContext({ apiUrlOverride });
+    if (!ctx.token)
+        throw new Error('Not logged in. Run `pikku fabric login` first.');
+    return {
+        rpc: getFabricRPC({ apiUrl: ctx.apiUrl, token: ctx.token }),
+        projectId: projectIdOverride ?? ctx.projectId,
+    };
+}
+export function requireProjectId(projectId) {
+    if (!projectId)
+        throw new Error('No fabric project. Pass --project-id, or run `pikku fabric link` in the checkout.');
+    return projectId;
+}
+/**
+ * Split a repeatable comma-separated option into ids. `--change-ids a,b
+ * --change-ids c` and `--change-ids a --change-ids b` both mean the same list,
+ * because a harness building the flag from a shell loop will produce either.
+ */
+export function idList(values) {
+    if (!values?.length)
+        return undefined;
+    const ids = values
+        .flatMap((value) => value.split(','))
+        .map((id) => id.trim())
+        .filter(Boolean);
+    return ids.length ? ids : undefined;
+}
+const span = (minutes) => {
+    if (minutes < 60)
+        return `${minutes}m`;
+    if (minutes < 60 * 24)
+        return `${Math.round(minutes / 60)}h`;
+    return `${Math.round(minutes / (60 * 24))}d`;
+};
+/** How long ago something happened — for timestamps in the past. */
+export function age(at) {
+    return span(Math.round((Date.now() - new Date(at).getTime()) / 60_000));
+}
+/**
+ * How long is left — for a lease expiry, which is in the future. Passing one of
+ * those to `age` renders it as `-30m`, and an expiry already behind us is `0m`
+ * rather than a negative number, because the lease is simply over.
+ */
+export function remaining(at) {
+    const minutes = Math.round((new Date(at).getTime() - Date.now()) / 60_000);
+    return span(Math.max(0, minutes));
+}
+const CONTENT_TYPES = {
+    '.png': 'image/png',
+    '.jpg': 'image/jpeg',
+    '.jpeg': 'image/jpeg',
+    '.webp': 'image/webp',
+};
+/** The content type an image path implies, or undefined if the name says nothing. */
+export function imageContentType(path) {
+    const extension = extname(path).toLowerCase();
+    return CONTENT_TYPES[extension];
+}

package/dist/src/fabric/lib/errors.d.ts

@@ -0,0 +1,21 @@
+import { PikkuError } from '@pikku/core/errors';
+/**
+ * A fabric command refusing to run because something the user controls is not
+ * ready yet — a dirty tree, a branch with no upstream, a local head that is not
+ * the remote's, a required argument left off.
+ *
+ * These are not crashes. They are the outcomes the command exists to check for,
+ * and every message is already written as an instruction ("Push or pull main
+ * before deploying"). Raised as a `PikkuError`, which is how the rest of the
+ * repo marks an error whose message is the whole output: `formatCLIError` prints
+ * it alone, and keeps the full stack for everything else — an unexpected
+ * `TypeError` with its frames removed is a bug nobody can diagnose. `--verbose`
+ * or `PIKKU_DEBUG` still shows the stack when someone wants it.
+ *
+ * Thrown as a plain `Error` these read as a crash in pikku: ten frames of
+ * `@pikku/core` function-runner and cli-runner internals in front of the one
+ * sentence that says what to do. The exit code is unchanged — non-zero either
+ * way.
+ */
+export declare class FabricPreconditionError extends PikkuError {
+}

package/dist/src/fabric/lib/errors.js

@@ -0,0 +1,21 @@
+import { PikkuError } from '@pikku/core/errors';
+/**
+ * A fabric command refusing to run because something the user controls is not
+ * ready yet — a dirty tree, a branch with no upstream, a local head that is not
+ * the remote's, a required argument left off.
+ *
+ * These are not crashes. They are the outcomes the command exists to check for,
+ * and every message is already written as an instruction ("Push or pull main
+ * before deploying"). Raised as a `PikkuError`, which is how the rest of the
+ * repo marks an error whose message is the whole output: `formatCLIError` prints
+ * it alone, and keeps the full stack for everything else — an unexpected
+ * `TypeError` with its frames removed is a bug nobody can diagnose. `--verbose`
+ * or `PIKKU_DEBUG` still shows the stack when someone wants it.
+ *
+ * Thrown as a plain `Error` these read as a crash in pikku: ten frames of
+ * `@pikku/core` function-runner and cli-runner internals in front of the one
+ * sentence that says what to do. The exit code is unchanged — non-zero either
+ * way.
+ */
+export class FabricPreconditionError extends PikkuError {
+}

package/dist/src/fabric/lib/finding.d.ts

@@ -3,8 +3,8 @@ import type { ReportEnvironment } from './report-environment.js';
 export declare const FindingInput: z.ZodObject<{
     title: z.ZodString;
     kind: z.ZodEnum<{
-        product: "product";
         harness: "harness";
+        product: "product";
     }>;
     model: z.ZodString;
     expected: z.ZodString;
@@ -20,9 +20,9 @@ export declare const FindingInput: z.ZodObject<{
     unresolved: z.ZodOptional<z.ZodBoolean>;
     area: z.ZodOptional<z.ZodString>;
     surface: z.ZodOptional<z.ZodEnum<{
-        local: "local";
-        deployed: "deployed";
         both: "both";
+        deployed: "deployed";
+        local: "local";
     }>>;
     cost: z.ZodOptional<z.ZodString>;
     run: z.ZodOptional<z.ZodString>;

package/dist/src/fabric/lib/git.d.ts

@@ -41,8 +41,9 @@ export interface DeploySafetyResult {
     remoteSha: string;
 }
 /**
- * Spec §10 deploy ref safety checks. Throws on any failure with a CLI-friendly
- * message; returns the resolved commit context on pass.
+ * Spec §10 deploy ref safety checks. Throws `FabricPreconditionError` on any
+ * failure, with a message written to be the whole output; returns the resolved
+ * commit context on pass.
  */
 export declare function assertDeploySafety(cwd?: string): Promise<DeploySafetyResult>;
 /**

package/dist/src/fabric/lib/git.js

@@ -1,4 +1,5 @@
 import { spawn } from 'node:child_process';
+import { FabricPreconditionError } from './errors.js';
 /**
  * Local git probes for the deploy safety checks (clean tree, HEAD == remote,
  * ref resolution). Shell out to `git` rather than depend on simple-git —
@@ -137,22 +138,23 @@ export async function isAncestor(candidate, mainRef, cwd) {
     }
 }
 /**
- * Spec §10 deploy ref safety checks. Throws on any failure with a CLI-friendly
- * message; returns the resolved commit context on pass.
+ * Spec §10 deploy ref safety checks. Throws `FabricPreconditionError` on any
+ * failure, with a message written to be the whole output; returns the resolved
+ * commit context on pass.
  */
 export async function assertDeploySafety(cwd) {
     if (!(await isWorkingTreeClean(cwd))) {
-        throw new Error('Deployment blocked: uncommitted changes detected.\nCommit and push your changes before deploying.');
+        throw new FabricPreconditionError('Deployment blocked: uncommitted changes detected.\nCommit and push your changes before deploying.');
     }
     const branch = await currentBranch(cwd);
     const upstream = await upstreamBranch(cwd);
     if (!upstream) {
-        throw new Error(`Deployment blocked: branch ${branch} has no upstream.\nPush it (\`git push -u origin ${branch}\`) before deploying.`);
+        throw new FabricPreconditionError(`Deployment blocked: branch ${branch} has no upstream.\nPush it (\`git push -u origin ${branch}\`) before deploying.`);
     }
     const head = await headSha(cwd);
     const remote = await remoteHeadSha(upstream, cwd);
     if (head !== remote) {
-        throw new Error(`Deployment blocked: local HEAD ${head.slice(0, 8)} ≠ remote ${remote.slice(0, 8)} (${upstream}).\nPush or pull before deploying.`);
+        throw new FabricPreconditionError(`Deployment blocked: local HEAD ${head.slice(0, 8)} ≠ remote ${remote.slice(0, 8)} (${upstream}).\nPush or pull before deploying.`);
     }
     return { branch, headSha: head, upstream, remoteSha: remote };
 }
@@ -167,15 +169,15 @@ export async function assertNamedBranchDeploySafety(branch, cwd) {
         head = await localBranchHeadSha(branch, cwd);
     }
     catch (error) {
-        throw new Error(`Deployment blocked: local branch ${branch} does not exist (${error.message}).\nFetch or create it before deploying.`);
+        throw new FabricPreconditionError(`Deployment blocked: local branch ${branch} does not exist (${error.message}).\nFetch or create it before deploying.`);
     }
     const upstream = await upstreamForBranch(branch, cwd);
     if (!upstream) {
-        throw new Error(`Deployment blocked: branch ${branch} has no upstream.\nPush it (\`git push -u origin ${branch}\`) before deploying.`);
+        throw new FabricPreconditionError(`Deployment blocked: branch ${branch} has no upstream.\nPush it (\`git push -u origin ${branch}\`) before deploying.`);
     }
     const remote = await remoteHeadSha(upstream, cwd);
     if (head !== remote) {
-        throw new Error(`Deployment blocked: ${branch} ${head.slice(0, 8)} ≠ remote ${remote.slice(0, 8)} (${upstream}).\nPush or pull ${branch} before deploying.`);
+        throw new FabricPreconditionError(`Deployment blocked: ${branch} ${head.slice(0, 8)} ≠ remote ${remote.slice(0, 8)} (${upstream}).\nPush or pull ${branch} before deploying.`);
     }
     return { branch, headSha: head, upstream, remoteSha: remote };
 }

package/dist/src/fabric/lib/output.d.ts

@@ -7,6 +7,26 @@
  * the json case. They just turn returned data into a pretty, coloured table.
  */
 type Cell = string | number | null | undefined;
+/**
+ * Text that came back over the wire — a change title, an id, a route, an
+ * attachment label — was typed by whoever filed it and is about to be printed
+ * to a terminal. Escape sequences in it would move the cursor, repaint the
+ * screen or set the window title, so every remote string passes through here on
+ * the way to `console.log`.
+ *
+ * This is the inline one, and it takes the line endings with it: a title
+ * printed as one field of one row can otherwise carry a newline and forge a
+ * whole further line of output — a second change, a different status — that
+ * nothing in the response ever said. Multi-line text goes through `safeBlock`.
+ */
+export declare const safe: (s: string) => string;
+/**
+ * The same, for the two places a remote string is genuinely a block of prose —
+ * a change body and a thread message. Newlines and tabs survive there because
+ * the text was written with them; a lone carriage return does not, since it
+ * rewrites the line already printed rather than starting a new one.
+ */
+export declare const safeBlock: (s: string) => string;
 /** Dim, secondary text (hints, empty-state lines, labels). */
 export declare const dim: (s: string) => string;
 /** Status / change colours — mirror the console UI: green = good/added,

package/dist/src/fabric/lib/output.js

@@ -1,5 +1,29 @@
 import chalk from 'chalk';
 const cell = (c) => c === null || c === undefined ? '' : String(c);
+/**
+ * Text that came back over the wire — a change title, an id, a route, an
+ * attachment label — was typed by whoever filed it and is about to be printed
+ * to a terminal. Escape sequences in it would move the cursor, repaint the
+ * screen or set the window title, so every remote string passes through here on
+ * the way to `console.log`.
+ *
+ * This is the inline one, and it takes the line endings with it: a title
+ * printed as one field of one row can otherwise carry a newline and forge a
+ * whole further line of output — a second change, a different status — that
+ * nothing in the response ever said. Multi-line text goes through `safeBlock`.
+ */
+export const safe = (s) => 
+// eslint-disable-next-line no-control-regex
+s.replace(/[\x00-\x1f\x7f-\x9f]/g, '');
+/**
+ * The same, for the two places a remote string is genuinely a block of prose —
+ * a change body and a thread message. Newlines and tabs survive there because
+ * the text was written with them; a lone carriage return does not, since it
+ * rewrites the line already printed rather than starting a new one.
+ */
+export const safeBlock = (s) => 
+// eslint-disable-next-line no-control-regex
+s.replace(/[\x00-\x08\x0b-\x1f\x7f-\x9f]/g, '');
 /** Dim, secondary text (hints, empty-state lines, labels). */
 export const dim = (s) => chalk.dim(s);
 /** Status / change colours — mirror the console UI: green = good/added,
@@ -12,13 +36,14 @@ const BUSY = /^(deploying|planned|suspended|pending|building|provisioning|queued
 const BAD = /^(failed|error|crashed|unhealthy|dead|removed|cancelled|canceled)$/i;
 /** Colour a status token by its meaning (falls back to dim). */
 export function statusColor(status) {
-    if (GOOD.test(status))
-        return added(status);
-    if (BUSY.test(status))
-        return changed(status);
-    if (BAD.test(status))
-        return removed(status);
-    return dim(status);
+    const token = safe(status);
+    if (GOOD.test(token))
+        return added(token);
+    if (BUSY.test(token))
+        return changed(token);
+    if (BAD.test(token))
+        return removed(token);
+    return dim(token);
 }
 // Strip ANSI so coloured cells still measure/align correctly.
 const visibleLen = (s) => s.replace(/\x1b\[[0-9;]*m/g, '').length;

package/dist/src/functions/commands/all.d.ts

@@ -1 +1 @@
-export declare const all: import("#pikku/function").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;
+export declare const all: import("#pikku/function").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku/function").PikkuFunction<void, void, "rpc" | "session", import("#pikku/function").WiredServices> | import("#pikku/function").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown>, undefined, undefined>;

package/dist/src/functions/commands/audit.d.ts

@@ -11,5 +11,5 @@ export declare function parseBunAudit(raw: string): SecurityAuditIssue[];
 export declare function semverLevel(current: string, latest: string): SecurityAuditUpdate['level'];
 export declare function parseBunOutdated(raw: string): SecurityAuditUpdate[];
 export declare function summarise(tool: PackageManager, issues: SecurityAuditIssue[], updates: SecurityAuditUpdate[], note?: string): SecurityAuditReport;
-export declare const pikkuAudit: import("#pikku/function").PikkuFunctionConfig<AuditInput, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<AuditInput, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<AuditInput, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;
+export declare const pikkuAudit: import("#pikku/function").PikkuFunctionConfig<AuditInput, void, "rpc" | "session", import("#pikku/function").PikkuFunction<AuditInput, void, "rpc" | "session", import("#pikku/function").WiredServices> | import("#pikku/function").PikkuFunctionSessionless<AuditInput, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown>, undefined, undefined>;
 export {};

package/dist/src/functions/commands/binary.d.ts

@@ -1,7 +1,7 @@
 export declare const binary: import("#pikku/function").PikkuFunctionConfig<{
     compileTarget?: string;
-}, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<{
+}, void, "rpc" | "session", import("#pikku/function").PikkuFunction<{
     compileTarget?: string;
-}, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<{
+}, void, "rpc" | "session", import("#pikku/function").WiredServices> | import("#pikku/function").PikkuFunctionSessionless<{
     compileTarget?: string;
-}, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;
+}, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown>, undefined, undefined>;

package/dist/src/functions/commands/bootstrap.d.ts

@@ -1 +1 @@
-export declare const bootstrap: import("#pikku/function").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;
+export declare const bootstrap: import("#pikku/function").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku/function").PikkuFunction<void, void, "rpc" | "session", import("#pikku/function").WiredServices> | import("#pikku/function").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown>, undefined, undefined>;

package/dist/src/functions/commands/bootstrap.js

@@ -7,6 +7,8 @@ export const bootstrap = pikkuVoidFunc({
         await rpc.invoke('pikkuScopes', { bootstrap: true });
         // Before function types too: personas import SystemRoleName.
         await rpc.invoke('pikkuRoles', { bootstrap: true });
+        // And before them too: they import FeatureFlagName from the flags codegen.
+        await rpc.invoke('pikkuFlags', { bootstrap: true });
         await rpc.invoke('pikkuPersonas', { bootstrap: true });
         await rpc.invoke('pikkuFunctionTypesSplit', { bootstrap: true });
         // Stub auth.types.ts (if better-auth is used) so the pikkuBetterAuth
@@ -24,6 +26,7 @@ export const bootstrap = pikkuVoidFunc({
         await rpc.invoke('pikkuSecretDefinitionTypes');
         await rpc.invoke('pikkuVariableDefinitionTypes');
         await rpc.invoke('pikkuScopeDefinitionTypes');
+        await rpc.invoke('pikkuAnalyticsDefinitionTypes');
         await rpc.invoke('pikkuCLITypes', { bootstrap: true });
         await rpc.invoke('pikkuLeafIndexes');
         if (logger.hasCriticalErrors()) {

package/dist/src/functions/commands/db-audit.d.ts

@@ -1 +1 @@
-export declare const dbAudit: import("#pikku/function").PikkuFunctionConfig<{}, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<{}, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<{}, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;
+export declare const dbAudit: import("#pikku/function").PikkuFunctionConfig<{}, void, "rpc" | "session", import("#pikku/function").PikkuFunction<{}, void, "rpc" | "session", import("#pikku/function").WiredServices> | import("#pikku/function").PikkuFunctionSessionless<{}, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown>, undefined, undefined>;

package/dist/src/functions/commands/db-baseline.d.ts

@@ -10,4 +10,4 @@
  * premise. A database that is behind gets the same report `db check` gives —
  * baselining it would bury a real gap under a history claiming otherwise.
  */
-export declare const dbBaseline: import("#pikku/function").PikkuFunctionConfig<{}, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<{}, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<{}, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;
+export declare const dbBaseline: import("#pikku/function").PikkuFunctionConfig<{}, void, "rpc" | "session", import("#pikku/function").PikkuFunction<{}, void, "rpc" | "session", import("#pikku/function").WiredServices> | import("#pikku/function").PikkuFunctionSessionless<{}, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown>, undefined, undefined>;

package/dist/src/functions/commands/db-check.d.ts

@@ -9,4 +9,4 @@
  * fail: something created them outside the migration history, which is worth
  * seeing but is not this command's to fix.
  */
-export declare const dbCheck: import("#pikku/function").PikkuFunctionConfig<{}, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<{}, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<{}, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;
+export declare const dbCheck: import("#pikku/function").PikkuFunctionConfig<{}, void, "rpc" | "session", import("#pikku/function").PikkuFunction<{}, void, "rpc" | "session", import("#pikku/function").WiredServices> | import("#pikku/function").PikkuFunctionSessionless<{}, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown>, undefined, undefined>;

package/dist/src/functions/commands/db-codegen.d.ts

@@ -8,4 +8,4 @@
  * introspects that, so `pikku all` can be given an accurate table zod on a
  * machine with no database reachable at all.
  */
-export declare const dbCodegen: import("#pikku/function").PikkuFunctionConfig<{}, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<{}, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<{}, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;
+export declare const dbCodegen: import("#pikku/function").PikkuFunctionConfig<{}, void, "rpc" | "session", import("#pikku/function").PikkuFunction<{}, void, "rpc" | "session", import("#pikku/function").WiredServices> | import("#pikku/function").PikkuFunctionSessionless<{}, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown>, undefined, undefined>;

package/dist/src/functions/commands/db-export.d.ts

@@ -9,4 +9,4 @@
  *
  * Run this from the addon's build, beside the rest of its codegen.
  */
-export declare const dbExport: import("#pikku/function").PikkuFunctionConfig<{}, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<{}, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<{}, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;
+export declare const dbExport: import("#pikku/function").PikkuFunctionConfig<{}, void, "rpc" | "session", import("#pikku/function").PikkuFunction<{}, void, "rpc" | "session", import("#pikku/function").WiredServices> | import("#pikku/function").PikkuFunctionSessionless<{}, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown>, undefined, undefined>;

package/dist/src/functions/commands/db-generate.d.ts

@@ -1 +1 @@
-export declare const dbGenerate: import("#pikku/function").PikkuFunctionConfig<{}, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<{}, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<{}, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;
+export declare const dbGenerate: import("#pikku/function").PikkuFunctionConfig<{}, void, "rpc" | "session", import("#pikku/function").PikkuFunction<{}, void, "rpc" | "session", import("#pikku/function").WiredServices> | import("#pikku/function").PikkuFunctionSessionless<{}, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown>, undefined, undefined>;