@pikku/cli 0.12.20 → 0.12.22

package/dist/src/deploy/analyzer/analyzer.js

@@ -6,27 +6,10 @@
  * Gateways (MCP, agents, channels) dispatch to function units via RPC.
  * Workflow orchestrators dispatch to step units via queue or RPC (inline).
  */
-/**
- * Determine deploy target for a function based on its explicit flag
- * and service compatibility.
- */
-function resolveDeployTarget(funcMeta, serverlessIncompatible) {
-    // Explicit flag takes priority
-    if (funcMeta.deploy === 'serverless')
-        return 'serverless';
-    if (funcMeta.deploy === 'server')
-        return 'server';
-    // Auto: check if any service is serverless-incompatible
-    if (funcMeta.services?.services) {
-        for (const svc of funcMeta.services.services) {
-            if (serverlessIncompatible.has(svc))
-                return 'server';
-        }
-    }
-    return 'serverless';
-}
+import { resolveDeployTarget, } from '@pikku/inspector';
 export function analyzeDeployment(state, options) {
     const serverlessIncompatible = new Set(options.serverlessIncompatible ?? []);
+    const workflowQueues = options.workflowQueues ?? true;
     const units = [];
     const queues = [];
     const scheduledTasks = [];
@@ -56,7 +39,11 @@ export function analyzeDeployment(state, options) {
             funcId === 'agentCaller' ||
             funcId === 'agentStreamCaller' ||
             funcId === 'agentApproveCaller' ||
-            funcId === 'agentResumeCaller') {
+            funcId === 'agentResumeCaller' ||
+            funcId === 'getAgentThreads' ||
+            funcId === 'getAgentThreadMessages' ||
+            funcId === 'getAgentThreadRuns' ||
+            funcId === 'deleteAgentThread') {
             continue;
         }
         const handlers = [];
@@ -131,7 +118,7 @@ export function analyzeDeployment(state, options) {
         units.push({
             name: toSafeKebab(funcId),
             role: 'function',
-            target: resolveDeployTarget(funcMeta, serverlessIncompatible),
+            target: resolveDeployTarget(funcMeta, serverlessIncompatible, funcId),
             functionIds: [funcId],
             services: collectServicesForFunction(funcMeta),
             dependsOn: [],
@@ -186,7 +173,14 @@ export function analyzeDeployment(state, options) {
             tags: agentMeta.tags ?? [],
         });
         agents.push({
-            name: agentMeta.name,
+            // The registry KEY (export name, e.g. `kanbanAgent`), NOT the
+            // human-facing `agentMeta.name` (e.g. `kanban-agent`). Routes,
+            // `addAIAgent(...)`, and the inspector-state name filter all key off
+            // this identifier — per-unit codegen passes it to `--names`, and the
+            // filter matches it against the `agentsMeta` key. Using the human name
+            // here makes the filter prune the agent, so its registration never gets
+            // bundled into the deployed unit ("AI agent not found: <key>").
+            name: agentName,
             unitName,
             toolFunctionIds: toolIds,
             subAgentNames,
@@ -252,7 +246,7 @@ export function analyzeDeployment(state, options) {
         });
     }
     // ── Step 5: Workflows ──────────────────────────────────────────────
-    buildWorkflows(state.workflows.graphMeta, functionsMeta, httpMeta, units, workflows, queues);
+    buildWorkflows(state.workflows.graphMeta, functionsMeta, httpMeta, units, workflows, queues, workflowQueues);
     // ── Step 6: Ensure function units exist for gateway dependencies ───
     // Gateways depend on function units. If a function is only used via
     // a gateway (not directly wired to HTTP/queue/cron), it still needs
@@ -269,7 +263,7 @@ export function analyzeDeployment(state, options) {
                     units.push({
                         name: dep,
                         role: 'function',
-                        target: resolveDeployTarget(funcMeta, serverlessIncompatible),
+                        target: resolveDeployTarget(funcMeta, serverlessIncompatible, funcId),
                         functionIds: [funcId],
                         services: collectServicesForFunction(funcMeta),
                         dependsOn: [],
@@ -309,6 +303,36 @@ export function analyzeDeployment(state, options) {
             }
         }
     }
+    // ── Step 8: Scaffold workflow function units need workflow-state ──
+    // Scaffold endpoints like workflowStarter destructure { workflowService }
+    // and call rpc.startWorkflow / workflowService.runToCompletion. The
+    // function-meta inspector doesn't always surface those destructured
+    // services into funcMeta.services.services, so collectServicesForFunction
+    // returns [] and per-unit codegen omits workflow queue meta — the unit
+    // then falls back to the shared 'pikku-workflow-step-worker' queue name
+    // at runtime. Force the capability for the known scaffold ids so the
+    // queue meta is bundled and the runtime can resolve per-step queues.
+    const SCAFFOLD_WORKFLOW_FUNCS = new Set([
+        'workflowStarter',
+        'workflowRunner',
+        'workflowStatusChecker',
+        'workflowStatusStream',
+        'workflowStatusStreamFull',
+        'graphStarter',
+    ]);
+    for (const unit of units) {
+        if (unit.role !== 'function')
+            continue;
+        const hasScaffold = unit.functionIds.some((id) => SCAFFOLD_WORKFLOW_FUNCS.has(id));
+        if (!hasScaffold)
+            continue;
+        if (!unit.services.some((s) => s.capability === 'workflow-state')) {
+            unit.services.push({
+                capability: 'workflow-state',
+                sourceServiceName: 'workflowService',
+            });
+        }
+    }
     // ── Secrets & Variables ────────────────────────────────────────────
     const secrets = state.secrets.definitions.map((s) => ({
         secretId: s.secretId,
@@ -337,7 +361,7 @@ export function analyzeDeployment(state, options) {
 // ---------------------------------------------------------------------------
 // Workflow builder
 // ---------------------------------------------------------------------------
-function buildWorkflows(graphMeta, _functionsMeta, _httpMeta, units, workflows, queues) {
+function buildWorkflows(graphMeta, _functionsMeta, _httpMeta, units, workflows, queues, workflowQueues) {
     for (const [_wfName, graph] of entries(graphMeta)) {
         const steps = [];
         const stepUnitNames = [];
@@ -355,13 +379,24 @@ function buildWorkflows(graphMeta, _functionsMeta, _httpMeta, units, workflows,
                 functionId: node.rpcName,
                 unitName: stepUnitName,
             });
+            // Every step gets its own unit (for log/metric isolation). The
+            // dispatch mechanism differs at runtime: async steps consume a
+            // dedicated queue; inline steps are invoked via CF dispatch
+            // namespace remote-call from the orchestrator.
             stepUnitNames.push(stepUnitName);
         }
         // Build orchestrator unit — no function code, just orchestration
         const orchUnitName = `wf-${toSafeKebab(graph.name)}`;
         const orchServices = [
             { capability: 'workflow-state', sourceServiceName: 'workflowService' },
-            { capability: 'queue', sourceServiceName: 'queueService' },
+            ...(workflowQueues
+                ? [
+                    {
+                        capability: 'queue',
+                        sourceServiceName: 'queueService',
+                    },
+                ]
+                : []),
         ];
         // Concrete routes for this workflow via catch-all
         const wfRoutes = [
@@ -386,11 +421,14 @@ function buildWorkflows(graphMeta, _functionsMeta, _httpMeta, units, workflows,
                 pikkuFuncId: `graphStart:${graph.name}`,
             },
         ];
-        // Orchestrator queue — the orchestrator consumes from this
+        // Orchestrator queue — the orchestrator consumes from this. Only emitted
+        // when the provider's workflow runtime needs queue dispatch.
         const orchQueueName = `wf-orchestrator-${toSafeKebab(graph.name)}`;
         const orchHandlers = [
             { type: 'fetch', routes: wfRoutes },
-            { type: 'queue', queueName: orchQueueName },
+            ...(workflowQueues
+                ? [{ type: 'queue', queueName: orchQueueName }]
+                : []),
         ];
         units.push({
             name: orchUnitName,
@@ -402,23 +440,25 @@ function buildWorkflows(graphMeta, _functionsMeta, _httpMeta, units, workflows,
             handlers: orchHandlers,
             tags: [],
         });
-        queues.push({
-            name: orchQueueName,
-            consumerUnit: orchUnitName,
-            consumerFunctionId: `pikkuWorkflowOrchestrator:${graph.name}`,
-        });
-        // Per-step queues — each step function worker consumes its own queue.
-        // The step units may not exist yet (created in step 6), so we just
-        // create queue definitions here. Step 7 wires them to units.
-        for (const step of steps) {
-            if (step.inline || !step.functionId)
-                continue;
-            const stepQueueName = `wf-step-${toSafeKebab(step.functionId)}`;
+        if (workflowQueues) {
             queues.push({
-                name: stepQueueName,
-                consumerUnit: toSafeKebab(step.functionId),
-                consumerFunctionId: `pikkuWorkflowWorker:${step.functionId}`,
+                name: orchQueueName,
+                consumerUnit: orchUnitName,
+                consumerFunctionId: `pikkuWorkflowOrchestrator:${graph.name}`,
             });
+            // Per-step queues — each step function worker consumes its own queue.
+            // The step units may not exist yet (created in step 6), so we just
+            // create queue definitions here. Step 7 wires them to units.
+            for (const step of steps) {
+                if (step.inline || !step.functionId)
+                    continue;
+                const stepQueueName = `wf-step-${toSafeKebab(step.functionId)}`;
+                queues.push({
+                    name: stepQueueName,
+                    consumerUnit: toSafeKebab(step.functionId),
+                    consumerFunctionId: `pikkuWorkflowWorker:${step.functionId}`,
+                });
+            }
         }
         workflows.push({
             name: graph.name,

package/dist/src/deploy/analyzer/manifest.d.ts

@@ -44,6 +44,16 @@ export interface DeploymentUnit {
     /** What runtime handlers this unit needs to export */
     handlers: DeploymentHandler[];
     tags: string[];
+    /** SHA-256 of final bundled artifact (set by build pipeline) */
+    bundleHash?: string;
+    /** Final bundle size in bytes (set by build pipeline) */
+    bundleSizeBytes?: number;
+    /** SHA-256 of sorted exact dependency map (set by build pipeline) */
+    exactDependenciesHash?: string;
+    /** Top-level exact runtime dependency versions for this unit (set by build pipeline) */
+    exactDependencies?: Record<string, string>;
+    /** Top-level exact optional runtime dependency versions for this unit (set by build pipeline) */
+    exactOptionalDependencies?: Record<string, string>;
 }
 export interface QueueDefinition {
     name: string;

package/dist/src/deploy/build-pipeline.d.ts

@@ -16,6 +16,8 @@ export interface BuildLogger {
 export interface BuildPipelineResult {
     manifest: DeploymentManifest;
     providerDir: string;
+    deploymentManifestPath: string;
+    infraPath: string | null;
     projectId: string;
     bundled: BundleResult[];
     bundleErrors: Array<{

package/dist/src/deploy/build-pipeline.js

@@ -10,6 +10,25 @@ import { mkdir, writeFile, copyFile } from 'node:fs/promises';
 import { analyzeDeployment } from './analyzer/index.js';
 import { generatePerUnitCodegen } from './codegen/per-unit-codegen.js';
 import { bundleUnits } from './bundler/index.js';
+import { generateServerEntrySource, SERVER_DOCKERFILE, SERVER_DOCKERIGNORE, } from './server-entry.js';
+const MERGED_SERVER_UNIT_NAME = 'pikku-server-container';
+const UNITS_DIR_NAME = 'units';
+const CONTAINER_DIR_NAME = 'container';
+function attachBundleMetadata(manifest, bundled) {
+    if (bundled.length === 0)
+        return;
+    const byUnitName = new Map(bundled.map((b) => [b.unitName, b]));
+    for (const unit of manifest.units) {
+        const bundle = byUnitName.get(unit.name);
+        if (!bundle)
+            continue;
+        unit.bundleHash = bundle.bundleHash;
+        unit.bundleSizeBytes = bundle.bundleSizeBytes;
+        unit.exactDependenciesHash = bundle.exactDependenciesHash;
+        unit.exactDependencies = bundle.exactDependencies;
+        unit.exactOptionalDependencies = bundle.exactOptionalDependencies;
+    }
+}
 function findLockfile(projectDir) {
     for (const name of ['yarn.lock', 'package-lock.json', 'pnpm-lock.yaml']) {
         const p = join(projectDir, name);
@@ -23,13 +42,19 @@ export async function runBuildPipeline(options) {
     const deployDir = options.deployDir ?? join(projectDir, '.deploy');
     const providerDir = join(deployDir, provider.deployDirName);
     // Step 1: Analyze
+    const workflowQueues = provider.workflowQueues ?? true;
     const manifest = analyzeDeployment(inspectorState, {
         projectId,
         serverlessIncompatible: options.serverlessIncompatible,
+        workflowQueues,
     });
     let bundled = [];
     let bundleErrors = [];
     let codegenErrors = [];
+    let infraPath = null;
+    const deploymentManifestPath = join(providerDir, 'deployment-manifest.json');
+    const unitsDir = join(providerDir, UNITS_DIR_NAME);
+    const containerDir = join(providerDir, CONTAINER_DIR_NAME);
     if (provider.singleUnit) {
         // Single-unit mode: bundle everything into one unit, use project's .pikku/ directly
         logger.info('Building standalone bundle...');
@@ -60,9 +85,11 @@ export async function runBuildPipeline(options) {
             define: provider.getDefine?.(),
             platform: provider.getPlatform?.(),
             format: provider.getFormat?.(),
+            noRequireShim: provider.getNoRequireShim?.(),
         });
         bundled = bundleResult.results;
         bundleErrors = bundleResult.errors;
+        attachBundleMetadata(manifest, bundled);
         logger.info(`Bundled standalone${bundleErrors.length > 0 ? ` (${bundleErrors.length} errors)` : ''}`);
     }
     else {
@@ -74,6 +101,8 @@ export async function runBuildPipeline(options) {
             return {
                 manifest,
                 providerDir,
+                deploymentManifestPath,
+                infraPath,
                 projectId,
                 bundled: [],
                 bundleErrors: [],
@@ -88,7 +117,8 @@ export async function runBuildPipeline(options) {
             projectDir,
             manifest: serverlessManifest,
             inspectorState,
-            deployDir: providerDir,
+            deployDir: unitsDir,
+            workflowQueues,
             onProgress: (unitName, status, error) => {
                 if (status === 'start') {
                     logger.info(`  Codegen: ${unitName}...`);
@@ -104,7 +134,7 @@ export async function runBuildPipeline(options) {
         codegenErrors = serverlessCodegenErrors;
         // Step 2b: Server units — single codegen pass with all server function IDs
         if (serverUnits.length > 0) {
-            const serverUnitName = 'server';
+            const serverUnitName = MERGED_SERVER_UNIT_NAME;
             // Create a merged server unit with all server function IDs
             const mergedServerUnit = {
                 name: serverUnitName,
@@ -122,7 +152,9 @@ export async function runBuildPipeline(options) {
                 projectDir,
                 manifest: serverManifest,
                 inspectorState,
-                deployDir: providerDir,
+                deployDir: containerDir,
+                resolveUnitDir: () => containerDir,
+                workflowQueues,
                 onProgress: (unitName, status, error) => {
                     if (status === 'start')
                         logger.info(`  Codegen: ${unitName}...`);
@@ -142,28 +174,77 @@ export async function runBuildPipeline(options) {
         logger.info(`Codegen complete: ${unitPikkuDirs.size} units`);
         // Step 3: Generate entry points + Bundle
         logger.info('Bundling...');
-        const entryFiles = new Map();
+        const serverlessEntryFiles = new Map();
+        const serverEntryFiles = new Map();
         for (const unit of manifest.units) {
             const pikkuDir = unitPikkuDirs.get(unit.name);
             if (!pikkuDir)
                 continue;
-            const unitDir = join(providerDir, unit.name);
+            const unitDir = unit.target === 'server' ? containerDir : join(unitsDir, unit.name);
             const entryPath = join(unitDir, 'entry.ts');
             await mkdir(unitDir, { recursive: true });
             const ctx = getEntryContext(unitDir, pikkuDir, unit, inspectorState);
-            const source = provider.generateEntrySource(ctx);
+            const source = unit.target === 'server'
+                ? generateServerEntrySource(ctx)
+                : provider.generateEntrySource(ctx);
             await writeFile(entryPath, source, 'utf-8');
-            entryFiles.set(unit.name, entryPath);
+            if (unit.target === 'server') {
+                serverEntryFiles.set(unit.name, entryPath);
+            }
+            else {
+                serverlessEntryFiles.set(unit.name, entryPath);
+            }
         }
-        const bundleResult = await bundleUnits(projectDir, manifest, entryFiles, providerDir, {
-            externals: provider.getExternals?.(),
-            aliases: provider.getAliases?.(),
-            define: provider.getDefine?.(),
-            platform: provider.getPlatform?.(),
-            format: provider.getFormat?.(),
-        });
-        bundled = bundleResult.results;
-        bundleErrors = bundleResult.errors;
+        const aggregated = [];
+        const aggregatedErrors = [];
+        if (serverlessEntryFiles.size > 0) {
+            const serverlessManifestForBundle = {
+                ...manifest,
+                units: manifest.units.filter((u) => u.target !== 'server'),
+            };
+            const result = await bundleUnits(projectDir, serverlessManifestForBundle, serverlessEntryFiles, providerDir, {
+                externals: provider.getExternals?.(),
+                aliases: provider.getAliases?.(),
+                define: provider.getDefine?.(),
+                platform: provider.getPlatform?.(),
+                format: provider.getFormat?.(),
+                noRequireShim: provider.getNoRequireShim?.(),
+                resolveOutputDir: (unit) => join(unitsDir, unit.name),
+            });
+            aggregated.push(...result.results);
+            aggregatedErrors.push(...result.errors);
+        }
+        if (serverEntryFiles.size > 0) {
+            // Server bundles use `@pikku/node-http-server` (pure JS), so esbuild
+            // can inline everything except node builtins. The bundler still
+            // emits a package.json from the metafile; if a user pulls in a
+            // native module the dep extractor surfaces it and `npm install`
+            // inside the container picks it up.
+            const serverManifestForBundle = {
+                ...manifest,
+                units: manifest.units.filter((u) => u.target === 'server'),
+            };
+            const result = await bundleUnits(projectDir, serverManifestForBundle, serverEntryFiles, providerDir, {
+                externals: ['node:*'],
+                aliases: undefined,
+                define: undefined,
+                platform: 'node',
+                format: 'esm',
+                noRequireShim: false,
+                resolveOutputDir: () => containerDir,
+            });
+            aggregated.push(...result.results);
+            aggregatedErrors.push(...result.errors);
+            // Emit Dockerfile + .dockerignore alongside bundle.js for any
+            // orchestrator that wants to `docker build` the container directly.
+            if (result.results.length > 0) {
+                await writeFile(join(containerDir, 'Dockerfile'), SERVER_DOCKERFILE, 'utf-8');
+                await writeFile(join(containerDir, '.dockerignore'), SERVER_DOCKERIGNORE, 'utf-8');
+            }
+        }
+        bundled = aggregated;
+        bundleErrors = aggregatedErrors;
+        attachBundleMetadata(manifest, bundled);
         logger.info(`Bundled ${bundled.length} units${bundleErrors.length > 0 ? ` (${bundleErrors.length} failed)` : ''}`);
     }
     if (bundleErrors.length > 0) {
@@ -172,11 +253,22 @@ export async function runBuildPipeline(options) {
         }
     }
     // Step 4: Generate configs + infra manifest
+    await mkdir(providerDir, { recursive: true });
+    await writeFile(deploymentManifestPath, JSON.stringify(manifest, null, 2), 'utf-8');
+    logger.info('Generated deployment manifest');
     const infraContent = provider.generateInfraManifest(manifest);
     if (infraContent) {
-        await writeFile(join(providerDir, 'infra.json'), infraContent, 'utf-8');
+        infraPath = join(providerDir, 'infra.json');
+        await writeFile(infraPath, infraContent, 'utf-8');
         logger.info('Generated infrastructure manifest');
     }
+    if (provider.emitSideArtifacts) {
+        await provider.emitSideArtifacts({
+            buildDir: providerDir,
+            manifest,
+            logger,
+        });
+    }
     if (provider.generateProviderConfigs) {
         const providerConfigs = provider.generateProviderConfigs(manifest);
         for (const [filename, content] of providerConfigs) {
@@ -186,8 +278,17 @@ export async function runBuildPipeline(options) {
         }
     }
     const lockfileSrc = findLockfile(projectDir);
+    let configCount = 0;
     for (const unit of manifest.units) {
-        const unitDir = join(providerDir, unit.name);
+        // Server units don't take per-unit provider configs (no wrangler.toml,
+        // etc.) — their runtime is the emitted Dockerfile + bundle.js. Skip
+        // both the provider config emit and the lockfile copy; the bundle is
+        // self-contained and the Docker build uses npm install on its own.
+        if (unit.target === 'server')
+            continue;
+        const unitDir = provider.singleUnit
+            ? join(providerDir, unit.name)
+            : join(unitsDir, unit.name);
         await mkdir(unitDir, { recursive: true });
         const configs = provider.generateUnitConfigs(unit, manifest, projectId);
         for (const [filename, content] of configs) {
@@ -196,11 +297,14 @@ export async function runBuildPipeline(options) {
         if (lockfileSrc) {
             await copyFile(lockfileSrc, join(unitDir, 'yarn.lock'));
         }
+        configCount++;
     }
-    logger.info(`Generated ${manifest.units.length} provider config files`);
+    logger.info(`Generated ${configCount} provider config files`);
     return {
         manifest,
         providerDir,
+        deploymentManifestPath,
+        infraPath,
         projectId,
         bundled,
         bundleErrors,

package/dist/src/deploy/bundler/bundler.d.ts

@@ -9,7 +9,7 @@
  * 5. Generates a minimal package.json with exact versions
  * 6. Writes all artifacts to `<outputDir>/<unit-name>/`
  */
-import type { DeploymentManifest, BundleOutput } from './types.js';
+import type { DeploymentManifest, DeploymentUnit, BundleOutput } from './types.js';
 /**
  * Bundles all deployment units defined in a DeploymentManifest.
  *
@@ -27,4 +27,6 @@ export declare function bundleUnits(projectDir: string, manifest: DeploymentMani
     define?: Record<string, string>;
     platform?: 'node' | 'neutral' | 'browser';
     format?: 'esm' | 'cjs';
+    noRequireShim?: boolean;
+    resolveOutputDir?: (unit: DeploymentUnit, baseOutputDir: string) => string;
 }): Promise<BundleOutput>;

package/dist/src/deploy/bundler/bundler.js

@@ -12,6 +12,7 @@
 import { build } from 'esbuild';
 import { writeFile, mkdir, stat, readFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import { createHash } from 'node:crypto';
 import { extractDependencies, generateMinimalPackageJson, } from './dep-extractor.js';
 /**
  * Mapping of service name -> gen file pattern that should be stubbed
@@ -70,6 +71,7 @@ function createDeadModuleStubPlugin(patterns) {
 const BUNDLE_FILENAME = 'bundle.js';
 const METAFILE_FILENAME = 'metafile.json';
 const PACKAGE_JSON_FILENAME = 'package.json';
+const EXACT_DEPENDENCIES_FILENAME = 'exact-dependencies.json';
 /**
  * Bundles a single deployment unit using esbuild.
  *
@@ -84,6 +86,7 @@ async function bundleUnit(options) {
     const bundlePath = join(unitOutputDir, BUNDLE_FILENAME);
     const metafilePath = join(unitOutputDir, METAFILE_FILENAME);
     const packageJsonPath = join(unitOutputDir, PACKAGE_JSON_FILENAME);
+    const exactDependenciesPath = join(unitOutputDir, EXACT_DEPENDENCIES_FILENAME);
     // Determine which gen files to stub based on per-unit service requirements
     const deadPatterns = await getDeadGenFilePatterns(unitOutputDir);
     // Run esbuild — inline everything into a self-contained bundle.
@@ -101,12 +104,22 @@ async function bundleUnit(options) {
             break;
         dir = parent;
     }
-    // For ESM + node platform, CJS deps may use require() for builtins.
-    // esbuild wraps these as __require() which fails at runtime in ESM.
-    // The banner shims require via createRequire so CJS builtins resolve.
+    // For ESM + node platform, CJS deps may use require() / __filename / __dirname
+    // for builtins or to locate native addons (the `bindings` package, used
+    // transitively by `pg` and many others, calls `__filename` directly). esbuild
+    // wraps require() as __require() which fails at runtime in ESM, and leaves
+    // `__filename` / `__dirname` as undefined references. The banner shims all
+    // three via createRequire / fileURLToPath so CJS builtins resolve and native-
+    // addon loaders find their .node files.
+    // Skipped when the provider opts out via `noRequireShim` (e.g. CF Workers
+    // — `import.meta.url` is undefined there, so the shim crashes at boot).
     const resolvedFormat = format ?? 'esm';
-    const banner = resolvedFormat === 'esm' && (platform ?? 'node') === 'node'
-        ? { js: `import { createRequire } from 'module'; const require = createRequire(import.meta.url);` }
+    const banner = resolvedFormat === 'esm' &&
+        (platform ?? 'node') === 'node' &&
+        !options.noRequireShim
+        ? {
+            js: `import { createRequire as __pikkuCreateRequire } from 'node:module'; import { fileURLToPath as __pikkuFileURLToPath } from 'node:url'; import { dirname as __pikkuDirname } from 'node:path'; const require = __pikkuCreateRequire(import.meta.url); const __filename = __pikkuFileURLToPath(import.meta.url); const __dirname = __pikkuDirname(__filename);`,
+        }
         : undefined;
     const result = await build({
         entryPoints: [entryPath],
@@ -132,18 +145,34 @@ async function bundleUnit(options) {
     const metafileJson = JSON.stringify(result.metafile, null, 2);
     await writeFile(metafilePath, metafileJson, 'utf-8');
     // Extract dependencies and generate minimal package.json
-    const dependencies = await extractDependencies(result.metafile, projectDir);
-    const packageJson = generateMinimalPackageJson(unit.name, dependencies);
+    const { exactDependencies, exactOptionalDependencies } = await extractDependencies(result.metafile, projectDir);
+    const packageJson = generateMinimalPackageJson(unit.name, exactDependencies, exactOptionalDependencies);
     await writeFile(packageJsonPath, JSON.stringify(packageJson, null, 2), 'utf-8');
+    await writeFile(exactDependenciesPath, JSON.stringify({
+        dependencies: Object.fromEntries(Object.entries(exactDependencies).sort(([a], [b]) => a.localeCompare(b))),
+        optionalDependencies: Object.fromEntries(Object.entries(exactOptionalDependencies).sort(([a], [b]) => a.localeCompare(b))),
+    }, null, 2), 'utf-8');
     // Get bundle size
     const bundleStat = await stat(bundlePath);
+    const bundleContents = await readFile(bundlePath);
+    const bundleHash = createHash('sha256').update(bundleContents).digest('hex');
+    const exactDependenciesHash = createHash('sha256')
+        .update(JSON.stringify({
+        dependencies: Object.entries(exactDependencies).sort(([a], [b]) => a.localeCompare(b)),
+        optionalDependencies: Object.entries(exactOptionalDependencies).sort(([a], [b]) => a.localeCompare(b)),
+    }))
+        .digest('hex');
     return {
         unitName: unit.name,
         bundlePath,
         packageJsonPath,
+        exactDependenciesPath,
         metafilePath,
         bundleSizeBytes: bundleStat.size,
-        externalPackages: dependencies,
+        bundleHash,
+        exactDependenciesHash,
+        exactDependencies,
+        exactOptionalDependencies,
     };
 }
 /**
@@ -173,7 +202,9 @@ export async function bundleUnits(projectDir, manifest, entryFiles, outputDir, o
             });
             continue;
         }
-        const unitOutputDir = join(buildDir, unit.name);
+        const unitOutputDir = options?.resolveOutputDir
+            ? options.resolveOutputDir(unit, buildDir)
+            : join(buildDir, unit.name);
         try {
             const result = await bundleUnit({
                 unit,

package/dist/src/deploy/bundler/dep-extractor.d.ts

@@ -28,8 +28,11 @@ export declare function parsePackageName(specifier: string): string | null;
  * Returns a record of package name to exact version, suitable for
  * writing into a minimal package.json.
  */
-export declare function extractDependencies(metafile: Metafile, projectDir: string): Promise<Record<string, string>>;
+export declare function extractDependencies(metafile: Metafile, projectDir: string): Promise<{
+    exactDependencies: Record<string, string>;
+    exactOptionalDependencies: Record<string, string>;
+}>;
 /**
  * Generates a minimal package.json content object for a unit bundle.
  */
-export declare function generateMinimalPackageJson(unitName: string, dependencies: Record<string, string>): Record<string, unknown>;
+export declare function generateMinimalPackageJson(unitName: string, dependencies: Record<string, string>, optionalDependencies: Record<string, string>): Record<string, unknown>;