@pikku/cli 0.12.162 → 0.12.163

package/dist/src/functions/commands/new-addon.js

@@ -5,7 +5,8 @@ import { spawnSync } from 'node:child_process';
 import { findInstallRoot } from './update.js';
 import { createEmptyManifest, saveManifest, } from '../../utils/contract-versions.js';
 import { pikkuSessionlessFunc } from '#pikku/function';
-import { parseOpenAPISpec, computeContractHash, generateAddonFromOpenAPI, loadAuthConfig, } from '@pikku/openapi-parser';
+import { parseOpenAPISpec, computeContractHash, detectLoginOperation, filterOperations, generateAddonFromOpenAPI, loadAuthConfig, specCoverageWarning, } from '@pikku/openapi-parser';
+import { installAddonIntoApp } from './install-addon.js';
 /**
  * Pick the protocol the generated test app uses to depend on its parent addon.
  *
@@ -128,6 +129,27 @@ const literal = (value) => JSON.stringify(value);
 const inTemplate = (value) => value.replace(/\\/g, '\\\\').replace(/`/g, '\\`').replace(/\$\{/g, '\\${');
 /** The same prose on a `//` comment line, where a newline ends the comment. */
 const inComment = (value) => value.replace(/\s+/g, ' ').trim();
+const CREDENTIAL_SHAPES = {
+    apikey: '{ apiKey: string }',
+    bearer: '{ token: string }',
+    basic: '{ username: string; password: string }',
+};
+const CREDENTIAL_FIELDS = { apikey: 'apiKey', bearer: 'token' };
+const ICON_COLOURS = [
+    '#2563eb',
+    '#7c3aed',
+    '#db2777',
+    '#ea580c',
+    '#16a34a',
+    '#0891b2',
+];
+function placeholderIcon(displayName) {
+    const letter = (displayName.match(/[A-Za-z0-9]/)?.[0] ?? '?').toUpperCase();
+    const colour = ICON_COLOURS[[...displayName].reduce((sum, c) => sum + c.charCodeAt(0), 0) %
+        ICON_COLOURS.length];
+    return `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64"><rect width="64" height="64" rx="14" fill="${colour}"/><text x="32" y="43" font-family="system-ui, sans-serif" font-size="30" font-weight="600" fill="#fff" text-anchor="middle">${letter}</text></svg>
+`;
+}
 export function getAddonFiles(vars, flags) {
     const { name, camelName, pascalName, screamingName, displayName, description, category, } = vars;
     const files = {};
@@ -183,14 +205,15 @@ export function getAddonFiles(vars, flags) {
         tsconfig: './tsconfig.json',
         srcDirectories: ['src', 'types'],
         outDir: './.pikku',
-        addon: true,
-        node: {
+        addon: {
             displayName,
             description,
             categories: [category],
             icon: `./${name}.svg`,
         },
+        forceRequiredServices: [camelName],
     }, null, 2);
+    files[`${name}.svg`] = placeholderIcon(displayName);
     // tsconfig.json
     files['tsconfig.json'] = JSON.stringify({
         compilerOptions: {
@@ -222,7 +245,7 @@ ${description}
 
 ## Setup
 
-1. Add icon SVG at \`${name}.svg\`
+1. Replace the placeholder icon at \`${name}.svg\`
 2. Update secret schema with required fields
 3. Implement API service methods
 4. Create function files for each operation
@@ -234,11 +257,7 @@ ${description}
 // export { ${camelName}Operation } from './functions/operation.function.js'
 `;
     // src/services.ts
-    if (flags.delegated) {
-        // Delegated login: the credential is the upstream token captured at
-        // sign-in; an expired token is the re-auth signal (UnauthorizedError).
-        files['src/services.ts'] =
-            `import { UnauthorizedError } from '@pikku/core/errors'
+    const wireCredential = (shape, check, missing, extra = '') => `import { ${missing.startsWith('new MissingCredentialError') ? 'MissingCredentialError' : 'CredentialRejectedError'} } from '@pikku/core/errors'
 import { ${pascalName}Service } from './${name}-api.service.js'
 import { pikkuAddonWireServices } from '#pikku/addon/setup'
 
@@ -247,67 +266,36 @@ export const createWireServices = pikkuAddonWireServices(
     if (!wire.getCredential) {
       throw new Error('Credential resolution is not available in this runtime')
     }
-    const cred = await wire.getCredential<{ token: string; expiresAt?: number }>('${camelName}')
-    if (!cred?.token) {
-      throw new UnauthorizedError(${literal(`No ${displayName} session — sign in again`)})
-    }
-    if (cred.expiresAt && cred.expiresAt * 1000 < Date.now()) {
-      throw new UnauthorizedError(${literal(`${displayName} session expired — sign in again`)})
-    }
+    const cred = await wire.getCredential<${shape}>('${camelName}')
+    if (!${check}) {
+      throw ${missing}
+    }${extra}
     const ${camelName} = new ${pascalName}Service(cred, variables)
 
     return { ${camelName} }
   }
 )
 `;
+    if (flags.delegated) {
+        // Delegated login: the credential is the upstream token captured at
+        // sign-in, so a missing or expired one means signing in again.
+        files['src/services.ts'] = wireCredential('{ token: string; expiresAt?: number }', 'cred?.token', `new CredentialRejectedError('${camelName}', 'sign-in', ${literal(`No ${displayName} session — sign in again`)})`, `
+    if (cred.expiresAt && cred.expiresAt * 1000 < Date.now()) {
+      throw new CredentialRejectedError('${camelName}', 'sign-in', ${literal(`${displayName} session expired — sign in again`)})
+    }`);
     }
     else if (flags.credential && flags.credential !== 'oauth2') {
-        // Per-user credential: use createWireServices with wire.getCredential()
-        const credField = flags.credential === 'bearer' ? 'token' : 'apiKey';
-        files['src/services.ts'] =
-            `import { ${pascalName}Service } from './${name}-api.service.js'
-import { pikkuAddonWireServices } from '#pikku/addon/setup'
-
-export const createWireServices = pikkuAddonWireServices(
-  async ({ variables }, wire) => {
-    if (!wire.getCredential) {
-      throw new Error('Credential resolution is not available in this runtime')
-    }
-    const cred = await wire.getCredential<{ ${credField}: string }>('${camelName}')
-    if (!cred?.${credField}) {
-      throw new Error('Missing ${camelName} credential')
-    }
-    const ${camelName} = new ${pascalName}Service(cred, variables)
-
-    return { ${camelName} }
-  }
-)
-`;
+        const shape = CREDENTIAL_SHAPES[flags.credential];
+        const field = flags.credential === 'basic'
+            ? 'username'
+            : CREDENTIAL_FIELDS[flags.credential];
+        files['src/services.ts'] = wireCredential(shape, `cred?.${field}`, `new MissingCredentialError('${camelName}', 'apikey')`);
     }
     else if (flags.oauth || flags.credential === 'oauth2') {
         // The OAuth2 access token is owned and refreshed by the platform credential
         // service (better-auth). Resolve a ready token per-request via the wire and
         // hand it to the service — the addon does not do its own token exchange.
-        files['src/services.ts'] =
-            `import { UnauthorizedError } from '@pikku/core/errors'
-import { ${pascalName}Service } from './${name}-api.service.js'
-import { pikkuAddonWireServices } from '#pikku/addon/setup'
-
-export const createWireServices = pikkuAddonWireServices(
-  async ({ variables }, wire) => {
-    if (!wire.getCredential) {
-      throw new Error('Credential resolution is not available in this runtime')
-    }
-    const cred = await wire.getCredential<{ accessToken: string }>('${camelName}')
-    if (!cred?.accessToken) {
-      throw new UnauthorizedError(${literal(`No ${displayName} connection — connect ${displayName} first`)})
-    }
-    const ${camelName} = new ${pascalName}Service(cred, variables)
-
-    return { ${camelName} }
-  }
-)
-`;
+        files['src/services.ts'] = wireCredential('{ accessToken: string }', 'cred?.accessToken', `new MissingCredentialError('${camelName}', 'oauth2')`);
     }
     else if (flags.secret) {
         files['src/services.ts'] =
@@ -317,24 +305,25 @@ import { pikkuAddonServices } from '#pikku/addon/setup'
 
 export const createSingletonServices = pikkuAddonServices(async (
   config,
-  { secrets }
+  { secrets, variables }
 ) => {
   const creds = await secrets.getSecret<${pascalName}Secrets>('${screamingName}_CREDENTIALS')
-  const ${camelName} = new ${pascalName}Service(creds.reveal())
+  const ${camelName} = new ${pascalName}Service(creds.reveal(), variables)
 
   return { ${camelName} }
 })
 `;
     }
     else {
-        // The plain service takes no constructor argument — the secret, credential
-        // and oauth variants are the ones handed something to authenticate with.
         files['src/services.ts'] =
             `import { ${pascalName}Service } from './${name}-api.service.js'
 import { pikkuAddonServices } from '#pikku/addon/setup'
 
-export const createSingletonServices = pikkuAddonServices(async () => {
-  const ${camelName} = new ${pascalName}Service()
+export const createSingletonServices = pikkuAddonServices(async (
+  config,
+  { variables }
+) => {
+  const ${camelName} = new ${pascalName}Service(variables)
 
   return { ${camelName} }
 })
@@ -342,16 +331,16 @@ export const createSingletonServices = pikkuAddonServices(async () => {
     }
     // src/{name}-api.service.ts
     if (flags.credential && flags.credential !== 'oauth2') {
-        const credField = flags.credential === 'bearer' ? 'token' : 'apiKey';
-        const credType = `{ ${credField}: string }`;
-        const authHeader = flags.credential === 'bearer'
-            ? `\`Bearer \${this.creds.token}\``
-            : `this.creds.apiKey`;
-        const authLine = flags.credential === 'bearer'
-            ? `'Authorization': ${authHeader},`
-            : `'Authorization': \`Bearer \${this.creds.apiKey}\`,`;
+        const credType = CREDENTIAL_SHAPES[flags.credential];
+        const authLine = {
+            bearer: `'Authorization': \`Bearer \${this.creds.token}\`,`,
+            apikey: `'Authorization': \`Bearer \${this.creds.apiKey}\`,`,
+            basic: `'Authorization': \`Basic \${btoa(\`\${this.creds.username}:\${this.creds.password}\`)}\`,`,
+        }[flags.credential];
         files[`src/${name}-api.service.ts`] =
-            `const BASE_URL = 'https://api.example.com/v1'
+            `import type { TypedVariablesService } from '#pikku/addon/variables/pikku-variables.gen.js'
+
+const BASE_URL = 'https://api.example.com/v1'
 
 export interface RequestOptions {
   body?: unknown
@@ -359,7 +348,10 @@ export interface RequestOptions {
 }
 
 export class ${pascalName}Service {
-  constructor(private creds: ${credType}) {}
+  constructor(
+    private creds: ${credType},
+    _variables?: TypedVariablesService
+  ) {}
 
   async request<T>(
     method: 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH',
@@ -451,6 +443,7 @@ export class ${pascalName}Service {
     else if (flags.secret) {
         files[`src/${name}-api.service.ts`] =
             `import type { ${pascalName}Secrets } from './${name}.secret.js'
+import type { TypedVariablesService } from '#pikku/addon/variables/pikku-variables.gen.js'
 
 const BASE_URL = 'https://api.example.com/v1'
 
@@ -460,7 +453,10 @@ export interface RequestOptions {
 }
 
 export class ${pascalName}Service {
-  constructor(private creds: ${pascalName}Secrets) {}
+  constructor(
+    private creds: ${pascalName}Secrets,
+    _variables?: TypedVariablesService
+  ) {}
 
   async request<T>(
     method: 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH',
@@ -498,7 +494,9 @@ export class ${pascalName}Service {
     }
     else {
         files[`src/${name}-api.service.ts`] =
-            `const BASE_URL = 'https://api.example.com/v1'
+            `import type { TypedVariablesService } from '#pikku/addon/variables/pikku-variables.gen.js'
+
+const BASE_URL = 'https://api.example.com/v1'
 
 export interface RequestOptions {
   body?: unknown
@@ -506,6 +504,8 @@ export interface RequestOptions {
 }
 
 export class ${pascalName}Service {
+  constructor(_variables?: TypedVariablesService) {}
+
   async request<T>(
     method: 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH',
     endpoint: string,
@@ -580,6 +580,24 @@ export const ${camelName}CredentialSchema = z.object({
   apiKey: z.string().describe(${literal(`${displayName} API key`)}),
 })
 
+defineCredential({
+  name: '${camelName}',
+  displayName: ${literal(displayName)},
+  description: ${literal(description)},
+  type: 'wire',
+  schema: ${camelName}CredentialSchema,
+})
+`;
+    }
+    else if (flags.credential === 'basic') {
+        files[`src/${name}.credential.ts`] = `import { z } from 'zod'
+import { defineCredential } from '#pikku/addon/auth'
+
+export const ${camelName}CredentialSchema = z.object({
+  username: z.string().describe(${literal(`${displayName} username`)}),
+  password: z.string().describe(${literal(`${displayName} password`)}),
+})
+
 defineCredential({
   name: '${camelName}',
   displayName: ${literal(displayName)},
@@ -926,8 +944,95 @@ export const buildGeneratedAddon = (addonDir, logger, run = spawnAddonBuildStep)
     }
     return true;
 };
+/**
+ * `string[]` options split on commas, which would cut a header value like
+ * `Accept: a, b` in two; a piece that does not start a new `Name:` rejoins the
+ * previous one.
+ */
+export function parseHeaderOptions(raw = []) {
+    const joined = [];
+    for (const piece of raw) {
+        if (/^[A-Za-z0-9!#$%&'*+.^_`|~-]+\s*:/.test(piece) || joined.length === 0) {
+            joined.push(piece);
+        }
+        else {
+            joined[joined.length - 1] += `, ${piece}`;
+        }
+    }
+    const headers = {};
+    for (const header of joined) {
+        const at = header.indexOf(':');
+        if (at <= 0) {
+            throw new Error(`--openapi-header "${header}" is not "Name: value"`);
+        }
+        headers[header.slice(0, at).trim()] = header.slice(at + 1).trim();
+    }
+    return headers;
+}
+/**
+ * How the addon authenticates, from the flags first and the spec second.
+ * Per-user is the default for anything the spec can authenticate: each user
+ * acts upstream as themselves. `--auth shared` puts one secret behind every
+ * user; `--auth none` is for public APIs.
+ */
+export function resolveAddonAuth(spec, flags) {
+    if (flags.auth && !['user', 'shared', 'none'].includes(flags.auth)) {
+        throw new Error(`--auth must be user, shared or none (got "${flags.auth}")`);
+    }
+    if (flags.authConfig?.delegated) {
+        return {
+            mode: 'delegated',
+            credential: 'bearer',
+            secret: false,
+            oauth: false,
+        };
+    }
+    if (flags.auth === 'none') {
+        return { mode: 'none', secret: false, oauth: false };
+    }
+    if (flags.auth === 'shared' ||
+        (flags.secret && !flags.credential && !flags.oauth)) {
+        return { mode: 'shared', secret: true, oauth: false };
+    }
+    const explicit = flags.credential ?? (flags.oauth ? 'oauth2' : undefined);
+    const fromSpec = flags.authConfig?.headerName
+        ? 'apikey'
+        : {
+            oauth2: 'oauth2',
+            apiKey: 'apikey',
+            bearer: 'bearer',
+            basic: 'basic',
+            none: undefined,
+        }[spec.authType];
+    const credential = (explicit ?? fromSpec);
+    if (!credential) {
+        throw new Error(`${spec.info.title} declares no security scheme, so the addon cannot tell how to authenticate. ` +
+            'Pass --auth none for a public API, --credential apikey|bearer|basic|oauth2 for a per-user key, ' +
+            '--auth shared for one key behind every user, or --auth-config <file> for a custom header or a delegated login (see pikku-build references/openapi.md).');
+    }
+    if (!['apikey', 'bearer', 'basic', 'oauth2'].includes(credential)) {
+        throw new Error(`Invalid credential type "${credential}": must be one of apikey, bearer, basic, oauth2`);
+    }
+    return {
+        mode: credential === 'oauth2' ? 'oauth2' : 'connect',
+        credential,
+        secret: false,
+        oauth: credential === 'oauth2',
+    };
+}
+/** The project `pikku new addon` runs in, when it is an app rather than an addon. */
+function findAppProject(config) {
+    const root = config?.rootDir;
+    if (!root || config.addon || !existsSync(join(root, 'pikku.config.json'))) {
+        return undefined;
+    }
+    const src = config.srcDirectories?.[0];
+    if (!src)
+        return undefined;
+    return { root, srcDir: join(root, src) };
+}
 export const pikkuNewAddon = pikkuSessionlessFunc({
-    func: async ({ logger, config }, { name, displayName, description, category = 'General', dir, secret = false, variable = false, oauth = false, credential, test = true, openapi, authConfig, mcp = false, camelCase = false, build = true, }) => {
+    func: async ({ logger, config }, { name, displayName, description, category = 'General', dir, secret = false, variable = false, oauth = false, credential, test = true, openapi, openapiHeader, tags, include, exclude, auth, install, authConfig, mcp = false, camelCase = false, build = true, }) => {
         name = sanitizeAddonName(name);
         if (!/^[a-z][a-z0-9_-]*$/.test(name)) {
             logger.error(`Invalid addon name "${name}": must start with a lowercase letter and contain only lowercase alphanumerics, hyphens, and underscores`);
@@ -936,8 +1041,19 @@ export const pikkuNewAddon = pikkuSessionlessFunc({
         const pascalName = toPascalCase(name);
         const resolvedDisplayName = displayName || pascalName;
         const resolvedDescription = description || `${resolvedDisplayName} integration for Pikku`;
+        const app = findAppProject(config);
+        const installing = Boolean(openapi) && (install ?? Boolean(app));
+        if (installing && !app) {
+            logger.error('--install needs to run inside a pikku app (a pikku.config.json that is not an addon)');
+            process.exit(1);
+        }
         // Resolve target directory
-        const baseDir = dir || config.scaffold?.addonDir || process.cwd();
+        const workspacePackages = app ? join(app.root, 'packages') : undefined;
+        const baseDir = dir ||
+            config.scaffold?.addonDir ||
+            (installing && workspacePackages && existsSync(workspacePackages)
+                ? workspacePackages
+                : process.cwd());
         // Folder mirrors the package name (@pikku/addon-<name>) so a packages/
         // listing reads as packages/addon-<name>, distinct from app workspaces.
         const addonDir = join(baseDir, `addon-${name}`);
@@ -955,53 +1071,88 @@ export const pikkuNewAddon = pikkuSessionlessFunc({
             category,
             addonDepProtocol: resolveAddonDepProtocol(baseDir),
         };
-        // Load the auth config (custom auth header / delegated login overrides)
         let loadedAuthConfig;
         if (authConfig) {
             loadedAuthConfig = await loadAuthConfig(authConfig);
-            if (loadedAuthConfig.delegated) {
-                // Delegated login stores the upstream token per-user — bearer is the
-                // only coherent credential mode.
-                if (credential && credential !== 'bearer') {
-                    logger.error(`--auth-config with delegated login requires --credential bearer (got "${credential}")`);
-                    process.exit(1);
+            if (loadedAuthConfig.delegated && credential && credential !== 'bearer') {
+                logger.error(`--auth-config with delegated login stores the upstream token per user, so it cannot be combined with --credential ${credential}`);
+                process.exit(1);
+            }
+        }
+        let spec;
+        let resolved;
+        try {
+            if (openapi) {
+                spec = await parseOpenAPISpec(openapi, {
+                    headers: parseHeaderOptions(openapiHeader),
+                });
+                const total = spec.operations.length;
+                spec = filterOperations(spec, { tags, include, exclude });
+                if (spec.operations.length === 0) {
+                    throw new Error(`No operations left out of ${total} after --tags/--include/--exclude`);
+                }
+                const warning = specCoverageWarning(spec);
+                if (warning) {
+                    logger.warn(`\n⚠️  ${warning}\n`);
                 }
-                credential = 'bearer';
+                resolved = resolveAddonAuth(spec, {
+                    auth,
+                    credential,
+                    oauth,
+                    secret,
+                    authConfig: loadedAuthConfig,
+                });
+                const login = detectLoginOperation(spec);
+                if (login && resolved.mode !== 'delegated') {
+                    logger.info(`${spec.info.title} has a login route (${login.method.toUpperCase()} ${login.path}). To let users sign in to the app with their ${resolvedDisplayName} account, pass --auth-config with a "delegated" block (see pikku-build references/openapi.md).`);
+                }
+                logger.info(`${spec.operations.length} operations, auth: ${resolved.mode}${resolved.credential ? ` (${resolved.credential})` : ''}`);
+            }
+            else {
+                const credentialType = credential;
+                if (credentialType &&
+                    !['apikey', 'bearer', 'basic', 'oauth2'].includes(credentialType)) {
+                    throw new Error(`Invalid credential type "${credential}": must be one of apikey, bearer, basic, oauth2`);
+                }
+                const effectiveOAuth = oauth || credentialType === 'oauth2';
+                resolved = {
+                    mode: effectiveOAuth
+                        ? 'oauth2'
+                        : credentialType
+                            ? 'connect'
+                            : secret
+                                ? 'shared'
+                                : 'none',
+                    credential: loadedAuthConfig?.delegated ? 'bearer' : credentialType,
+                    secret: (secret || effectiveOAuth) && !credentialType,
+                    oauth: effectiveOAuth,
+                };
+                if (loadedAuthConfig?.delegated)
+                    resolved.mode = 'delegated';
             }
         }
-        // Validate credential type if provided
-        const credentialType = credential;
-        if (credentialType &&
-            !['apikey', 'bearer', 'oauth2'].includes(credentialType)) {
-            logger.error(`Invalid credential type "${credential}": must be one of apikey, bearer, oauth2`);
+        catch (error) {
+            logger.error(error instanceof Error ? error.message : String(error));
             process.exit(1);
         }
-        // oauth implies secret (unless credential flag is used); credential oauth2 implies oauth
-        const effectiveOAuth = oauth || credentialType === 'oauth2';
         const addonFiles = getAddonFiles(vars, {
-            secret: (secret || effectiveOAuth) && !credentialType,
+            secret: resolved.secret,
             variable,
-            oauth: effectiveOAuth,
-            credential: credentialType,
-            delegated: Boolean(loadedAuthConfig?.delegated),
+            oauth: resolved.oauth,
+            credential: resolved.credential,
+            delegated: resolved.mode === 'delegated',
         });
-        // If openapi spec provided, generate typed files and merge over scaffold
-        if (openapi) {
-            const spec = await parseOpenAPISpec(openapi);
+        if (spec) {
             const openapiFiles = generateAddonFromOpenAPI(spec, vars, {
-                oauth: effectiveOAuth,
-                secret: (secret || effectiveOAuth) && !credentialType,
-                credential: credentialType,
+                oauth: resolved.oauth,
+                secret: resolved.secret,
+                credential: resolved.credential,
                 mcp,
                 camelCase,
                 authConfig: loadedAuthConfig,
             });
             Object.assign(addonFiles, openapiFiles);
-            // Inject openapi metadata into pikku.config.json
             const config = JSON.parse(addonFiles['pikku.config.json']);
-            if (typeof config.addon === 'boolean' || !config.addon) {
-                config.addon = {};
-            }
             config.addon.openapi = {
                 version: spec.info.version,
                 hash: computeContractHash(spec),
@@ -1024,6 +1175,33 @@ export const pikkuNewAddon = pikkuSessionlessFunc({
         for (const f of written) {
             logger.debug({ message: `  ${f}`, type: 'success' });
         }
+        if (installing && app && spec) {
+            const functions = Object.fromEntries(Object.entries(addonFiles)
+                .filter(([path]) => /^src\/functions\/[^/]+\.function\.ts$/.test(path))
+                .map(([path, source]) => [
+                path.slice('src/functions/'.length, -'.function.ts'.length),
+                source,
+            ]));
+            const baseUrl = spec.serverUrls.find((url) => /^https?:\/\//.test(url));
+            const { written: installed, notes } = installAddonIntoApp({
+                projectRoot: app.root,
+                srcDir: app.srcDir,
+                name,
+                camelName: vars.camelName,
+                pascalName,
+                screamingName: vars.screamingName,
+                packageName: `@pikku/addon-${name}`,
+                addonDir,
+                inWorkspace: workspaceCovers(app.root, addonDir),
+                mode: resolved.mode,
+                functions,
+                baseUrl: baseUrl?.replace(/\/+$/, ''),
+            });
+            for (const f of installed)
+                logger.info(`  updated ${f}`);
+            for (const note of notes)
+                logger.warn(note);
+        }
         if (build && !buildGeneratedAddon(addonDir, logger)) {
             process.exit(1);
         }

package/dist/src/functions/db/better-auth-schema.d.ts

@@ -12,6 +12,7 @@ export interface GetMigrationsResult {
     runMigrations: () => Promise<void>;
     compileMigrations: () => Promise<string>;
 }
+export declare function withoutAuthSchemaCheck<DB>(kysely: Kysely<DB>): Kysely<DB>;
 export declare function loadAuthOptions(opts: {
     rootDir: string;
     srcDirectories: string[];

package/dist/src/functions/db/better-auth-schema.js

@@ -106,11 +106,28 @@ function fakeSecretService() {
         setSecret: async () => { },
     };
 }
+// Better Auth checks its tables against the database the moment it is built,
+// and logs "Database schema mismatch" when they are missing. Here they are
+// always missing: the database is a scratch one the auth migrations are about
+// to run into. The check reaches the database through `connection()` alone,
+// so parking that call keeps the instance quiet without touching the queries
+// the migrator runs.
+export function withoutAuthSchemaCheck(kysely) {
+    return new Proxy(kysely, {
+        get: (target, prop) => {
+            if (prop === 'connection') {
+                return () => ({ execute: () => new Promise(() => { }) });
+            }
+            const value = Reflect.get(target, prop, target);
+            return typeof value === 'function' ? value.bind(target) : value;
+        },
+    });
+}
 function schemaServicesStub(kysely, logger) {
     const variables = new LocalVariablesService();
     const secrets = fakeSecretService();
     const base = {
-        kysely,
+        kysely: withoutAuthSchemaCheck(kysely),
         logger,
         secrets,
         variables,
@@ -144,6 +161,62 @@ async function loadAuthConfig(opts) {
         return undefined;
     return userCreateConfig(new LocalVariablesService());
 }
+/**
+ * Build the auth instance without a plugin's background init being able to kill
+ * the process.
+ *
+ * Reading the schema means reading `options`, which Better Auth assembles while
+ * the constructor runs — but from 1.7 a plugin's `init` also starts real work
+ * and does not wait for it. The OAuth provider behind `@better-auth/mcp` seeds
+ * its `oauthResource` rows this way. Here that work has nowhere to go: the
+ * database it is handed is a throwaway whose auth tables do not exist yet, and
+ * on the SQLite path the handle is closed as soon as the options have been
+ * read. The seed then rejects with nothing awaiting it, and Node's default for
+ * an unhandled rejection is to terminate — so `pikku db generate` died on
+ * `database is not open`, from a write the schema derivation never wanted, in a
+ * project whose only offence was configuring MCP.
+ *
+ * Rejections are reported rather than swallowed: they say a plugin tried to
+ * touch the database while being introspected, which is worth seeing, but never
+ * worth failing the command over. Whatever the plugin was doing is irrelevant
+ * to the shape of its tables, which is all that is being read.
+ *
+ * The handler is installed only around the call and only added to whatever the
+ * host already has, so a real unhandled rejection anywhere else still behaves
+ * exactly as it did.
+ */
+async function withoutPluginInitCrashing(build) {
+    const existing = process.listeners('unhandledRejection');
+    const swallow = (reason) => {
+        const message = reason instanceof Error ? reason.message : String(reason);
+        debugInitRejection(message);
+    };
+    for (const listener of existing) {
+        process.off('unhandledRejection', listener);
+    }
+    process.on('unhandledRejection', swallow);
+    try {
+        const instance = await build();
+        // One turn of the loop, so an init that rejects immediately does so while
+        // the guard is still the only listener. A slower one is caught by the
+        // `swallow` handler that outlives this only if the host had none of its
+        // own — which is why the originals go back on before it comes off.
+        await new Promise((resolve) => setImmediate(resolve));
+        return instance;
+    }
+    finally {
+        for (const listener of existing) {
+            process.on('unhandledRejection', listener);
+        }
+        process.off('unhandledRejection', swallow);
+    }
+}
+function debugInitRejection(message) {
+    if (process.env.PIKKU_DEBUG) {
+        // eslint-disable-next-line no-console
+        console.debug(`[pikku] a Better Auth plugin's init failed while its schema was being read, which does not affect the schema: ${message}`);
+    }
+}
 export async function loadAuthOptions(opts) {
     const sourceFile = findAuthSourceFile(opts.rootDir, opts.srcDirectories);
     if (!sourceFile)
@@ -153,7 +226,7 @@ export async function loadAuthOptions(opts) {
         return null;
     const services = schemaServicesStub(opts.kysely, opts.logger);
     services.config = await loadAuthConfig(opts);
-    const instance = await factory(services);
+    const instance = await withoutPluginInitCrashing(() => factory(services));
     const options = instance.options;
     return options ?? null;
 }