@pikku/cli 0.12.21 → 0.12.23

package/dist/src/deploy/analyzer/analyzer.js

@@ -6,27 +6,10 @@
  * Gateways (MCP, agents, channels) dispatch to function units via RPC.
  * Workflow orchestrators dispatch to step units via queue or RPC (inline).
  */
-/**
- * Determine deploy target for a function based on its explicit flag
- * and service compatibility.
- */
-function resolveDeployTarget(funcMeta, serverlessIncompatible) {
-    // Explicit flag takes priority
-    if (funcMeta.deploy === 'serverless')
-        return 'serverless';
-    if (funcMeta.deploy === 'server')
-        return 'server';
-    // Auto: check if any service is serverless-incompatible
-    if (funcMeta.services?.services) {
-        for (const svc of funcMeta.services.services) {
-            if (serverlessIncompatible.has(svc))
-                return 'server';
-        }
-    }
-    return 'serverless';
-}
+import { resolveDeployTarget, } from '@pikku/inspector';
 export function analyzeDeployment(state, options) {
     const serverlessIncompatible = new Set(options.serverlessIncompatible ?? []);
+    const workflowQueues = options.workflowQueues ?? true;
     const units = [];
     const queues = [];
     const scheduledTasks = [];
@@ -56,7 +39,11 @@ export function analyzeDeployment(state, options) {
             funcId === 'agentCaller' ||
             funcId === 'agentStreamCaller' ||
             funcId === 'agentApproveCaller' ||
-            funcId === 'agentResumeCaller') {
+            funcId === 'agentResumeCaller' ||
+            funcId === 'getAgentThreads' ||
+            funcId === 'getAgentThreadMessages' ||
+            funcId === 'getAgentThreadRuns' ||
+            funcId === 'deleteAgentThread') {
             continue;
         }
         const handlers = [];
@@ -131,7 +118,7 @@ export function analyzeDeployment(state, options) {
         units.push({
             name: toSafeKebab(funcId),
             role: 'function',
-            target: resolveDeployTarget(funcMeta, serverlessIncompatible),
+            target: resolveDeployTarget(funcMeta, serverlessIncompatible, funcId),
             functionIds: [funcId],
             services: collectServicesForFunction(funcMeta),
             dependsOn: [],
@@ -186,7 +173,14 @@ export function analyzeDeployment(state, options) {
             tags: agentMeta.tags ?? [],
         });
         agents.push({
-            name: agentMeta.name,
+            // The registry KEY (export name, e.g. `kanbanAgent`), NOT the
+            // human-facing `agentMeta.name` (e.g. `kanban-agent`). Routes,
+            // `addAIAgent(...)`, and the inspector-state name filter all key off
+            // this identifier — per-unit codegen passes it to `--names`, and the
+            // filter matches it against the `agentsMeta` key. Using the human name
+            // here makes the filter prune the agent, so its registration never gets
+            // bundled into the deployed unit ("AI agent not found: <key>").
+            name: agentName,
             unitName,
             toolFunctionIds: toolIds,
             subAgentNames,
@@ -252,7 +246,7 @@ export function analyzeDeployment(state, options) {
         });
     }
     // ── Step 5: Workflows ──────────────────────────────────────────────
-    buildWorkflows(state.workflows.graphMeta, functionsMeta, httpMeta, units, workflows, queues);
+    buildWorkflows(state.workflows.graphMeta, functionsMeta, httpMeta, units, workflows, queues, workflowQueues);
     // ── Step 6: Ensure function units exist for gateway dependencies ───
     // Gateways depend on function units. If a function is only used via
     // a gateway (not directly wired to HTTP/queue/cron), it still needs
@@ -269,7 +263,7 @@ export function analyzeDeployment(state, options) {
                     units.push({
                         name: dep,
                         role: 'function',
-                        target: resolveDeployTarget(funcMeta, serverlessIncompatible),
+                        target: resolveDeployTarget(funcMeta, serverlessIncompatible, funcId),
                         functionIds: [funcId],
                         services: collectServicesForFunction(funcMeta),
                         dependsOn: [],
@@ -309,6 +303,36 @@ export function analyzeDeployment(state, options) {
             }
         }
     }
+    // ── Step 8: Scaffold workflow function units need workflow-state ──
+    // Scaffold endpoints like workflowStarter destructure { workflowService }
+    // and call rpc.startWorkflow / workflowService.runToCompletion. The
+    // function-meta inspector doesn't always surface those destructured
+    // services into funcMeta.services.services, so collectServicesForFunction
+    // returns [] and per-unit codegen omits workflow queue meta — the unit
+    // then falls back to the shared 'pikku-workflow-step-worker' queue name
+    // at runtime. Force the capability for the known scaffold ids so the
+    // queue meta is bundled and the runtime can resolve per-step queues.
+    const SCAFFOLD_WORKFLOW_FUNCS = new Set([
+        'workflowStarter',
+        'workflowRunner',
+        'workflowStatusChecker',
+        'workflowStatusStream',
+        'workflowStatusStreamFull',
+        'graphStarter',
+    ]);
+    for (const unit of units) {
+        if (unit.role !== 'function')
+            continue;
+        const hasScaffold = unit.functionIds.some((id) => SCAFFOLD_WORKFLOW_FUNCS.has(id));
+        if (!hasScaffold)
+            continue;
+        if (!unit.services.some((s) => s.capability === 'workflow-state')) {
+            unit.services.push({
+                capability: 'workflow-state',
+                sourceServiceName: 'workflowService',
+            });
+        }
+    }
     // ── Secrets & Variables ────────────────────────────────────────────
     const secrets = state.secrets.definitions.map((s) => ({
         secretId: s.secretId,
@@ -337,7 +361,7 @@ export function analyzeDeployment(state, options) {
 // ---------------------------------------------------------------------------
 // Workflow builder
 // ---------------------------------------------------------------------------
-function buildWorkflows(graphMeta, _functionsMeta, _httpMeta, units, workflows, queues) {
+function buildWorkflows(graphMeta, _functionsMeta, _httpMeta, units, workflows, queues, workflowQueues) {
     for (const [_wfName, graph] of entries(graphMeta)) {
         const steps = [];
         const stepUnitNames = [];
@@ -355,13 +379,24 @@ function buildWorkflows(graphMeta, _functionsMeta, _httpMeta, units, workflows,
                 functionId: node.rpcName,
                 unitName: stepUnitName,
             });
+            // Every step gets its own unit (for log/metric isolation). The
+            // dispatch mechanism differs at runtime: async steps consume a
+            // dedicated queue; inline steps are invoked via CF dispatch
+            // namespace remote-call from the orchestrator.
             stepUnitNames.push(stepUnitName);
         }
         // Build orchestrator unit — no function code, just orchestration
         const orchUnitName = `wf-${toSafeKebab(graph.name)}`;
         const orchServices = [
             { capability: 'workflow-state', sourceServiceName: 'workflowService' },
-            { capability: 'queue', sourceServiceName: 'queueService' },
+            ...(workflowQueues
+                ? [
+                    {
+                        capability: 'queue',
+                        sourceServiceName: 'queueService',
+                    },
+                ]
+                : []),
         ];
         // Concrete routes for this workflow via catch-all
         const wfRoutes = [
@@ -386,11 +421,14 @@ function buildWorkflows(graphMeta, _functionsMeta, _httpMeta, units, workflows,
                 pikkuFuncId: `graphStart:${graph.name}`,
             },
         ];
-        // Orchestrator queue — the orchestrator consumes from this
+        // Orchestrator queue — the orchestrator consumes from this. Only emitted
+        // when the provider's workflow runtime needs queue dispatch.
         const orchQueueName = `wf-orchestrator-${toSafeKebab(graph.name)}`;
         const orchHandlers = [
             { type: 'fetch', routes: wfRoutes },
-            { type: 'queue', queueName: orchQueueName },
+            ...(workflowQueues
+                ? [{ type: 'queue', queueName: orchQueueName }]
+                : []),
         ];
         units.push({
             name: orchUnitName,
@@ -402,23 +440,25 @@ function buildWorkflows(graphMeta, _functionsMeta, _httpMeta, units, workflows,
             handlers: orchHandlers,
             tags: [],
         });
-        queues.push({
-            name: orchQueueName,
-            consumerUnit: orchUnitName,
-            consumerFunctionId: `pikkuWorkflowOrchestrator:${graph.name}`,
-        });
-        // Per-step queues — each step function worker consumes its own queue.
-        // The step units may not exist yet (created in step 6), so we just
-        // create queue definitions here. Step 7 wires them to units.
-        for (const step of steps) {
-            if (step.inline || !step.functionId)
-                continue;
-            const stepQueueName = `wf-step-${toSafeKebab(step.functionId)}`;
+        if (workflowQueues) {
             queues.push({
-                name: stepQueueName,
-                consumerUnit: toSafeKebab(step.functionId),
-                consumerFunctionId: `pikkuWorkflowWorker:${step.functionId}`,
+                name: orchQueueName,
+                consumerUnit: orchUnitName,
+                consumerFunctionId: `pikkuWorkflowOrchestrator:${graph.name}`,
             });
+            // Per-step queues — each step function worker consumes its own queue.
+            // The step units may not exist yet (created in step 6), so we just
+            // create queue definitions here. Step 7 wires them to units.
+            for (const step of steps) {
+                if (step.inline || !step.functionId)
+                    continue;
+                const stepQueueName = `wf-step-${toSafeKebab(step.functionId)}`;
+                queues.push({
+                    name: stepQueueName,
+                    consumerUnit: toSafeKebab(step.functionId),
+                    consumerFunctionId: `pikkuWorkflowWorker:${step.functionId}`,
+                });
+            }
         }
         workflows.push({
             name: graph.name,

package/dist/src/deploy/build-pipeline.js

@@ -10,6 +10,7 @@ import { mkdir, writeFile, copyFile } from 'node:fs/promises';
 import { analyzeDeployment } from './analyzer/index.js';
 import { generatePerUnitCodegen } from './codegen/per-unit-codegen.js';
 import { bundleUnits } from './bundler/index.js';
+import { generateServerEntrySource, SERVER_DOCKERFILE, SERVER_DOCKERIGNORE, } from './server-entry.js';
 const MERGED_SERVER_UNIT_NAME = 'pikku-server-container';
 const UNITS_DIR_NAME = 'units';
 const CONTAINER_DIR_NAME = 'container';
@@ -41,9 +42,11 @@ export async function runBuildPipeline(options) {
     const deployDir = options.deployDir ?? join(projectDir, '.deploy');
     const providerDir = join(deployDir, provider.deployDirName);
     // Step 1: Analyze
+    const workflowQueues = provider.workflowQueues ?? true;
     const manifest = analyzeDeployment(inspectorState, {
         projectId,
         serverlessIncompatible: options.serverlessIncompatible,
+        workflowQueues,
     });
     let bundled = [];
     let bundleErrors = [];
@@ -82,6 +85,7 @@ export async function runBuildPipeline(options) {
             define: provider.getDefine?.(),
             platform: provider.getPlatform?.(),
             format: provider.getFormat?.(),
+            noRequireShim: provider.getNoRequireShim?.(),
         });
         bundled = bundleResult.results;
         bundleErrors = bundleResult.errors;
@@ -114,6 +118,7 @@ export async function runBuildPipeline(options) {
             manifest: serverlessManifest,
             inspectorState,
             deployDir: unitsDir,
+            workflowQueues,
             onProgress: (unitName, status, error) => {
                 if (status === 'start') {
                     logger.info(`  Codegen: ${unitName}...`);
@@ -149,6 +154,7 @@ export async function runBuildPipeline(options) {
                 inspectorState,
                 deployDir: containerDir,
                 resolveUnitDir: () => containerDir,
+                workflowQueues,
                 onProgress: (unitName, status, error) => {
                     if (status === 'start')
                         logger.info(`  Codegen: ${unitName}...`);
@@ -168,7 +174,8 @@ export async function runBuildPipeline(options) {
         logger.info(`Codegen complete: ${unitPikkuDirs.size} units`);
         // Step 3: Generate entry points + Bundle
         logger.info('Bundling...');
-        const entryFiles = new Map();
+        const serverlessEntryFiles = new Map();
+        const serverEntryFiles = new Map();
         for (const unit of manifest.units) {
             const pikkuDir = unitPikkuDirs.get(unit.name);
             if (!pikkuDir)
@@ -177,20 +184,66 @@ export async function runBuildPipeline(options) {
             const entryPath = join(unitDir, 'entry.ts');
             await mkdir(unitDir, { recursive: true });
             const ctx = getEntryContext(unitDir, pikkuDir, unit, inspectorState);
-            const source = provider.generateEntrySource(ctx);
+            const source = unit.target === 'server'
+                ? generateServerEntrySource(ctx)
+                : provider.generateEntrySource(ctx);
             await writeFile(entryPath, source, 'utf-8');
-            entryFiles.set(unit.name, entryPath);
+            if (unit.target === 'server') {
+                serverEntryFiles.set(unit.name, entryPath);
+            }
+            else {
+                serverlessEntryFiles.set(unit.name, entryPath);
+            }
         }
-        const bundleResult = await bundleUnits(projectDir, manifest, entryFiles, providerDir, {
-            externals: provider.getExternals?.(),
-            aliases: provider.getAliases?.(),
-            define: provider.getDefine?.(),
-            platform: provider.getPlatform?.(),
-            format: provider.getFormat?.(),
-            resolveOutputDir: (unit) => unit.target === 'server' ? containerDir : join(unitsDir, unit.name),
-        });
-        bundled = bundleResult.results;
-        bundleErrors = bundleResult.errors;
+        const aggregated = [];
+        const aggregatedErrors = [];
+        if (serverlessEntryFiles.size > 0) {
+            const serverlessManifestForBundle = {
+                ...manifest,
+                units: manifest.units.filter((u) => u.target !== 'server'),
+            };
+            const result = await bundleUnits(projectDir, serverlessManifestForBundle, serverlessEntryFiles, providerDir, {
+                externals: provider.getExternals?.(),
+                aliases: provider.getAliases?.(),
+                define: provider.getDefine?.(),
+                platform: provider.getPlatform?.(),
+                format: provider.getFormat?.(),
+                noRequireShim: provider.getNoRequireShim?.(),
+                resolveOutputDir: (unit) => join(unitsDir, unit.name),
+            });
+            aggregated.push(...result.results);
+            aggregatedErrors.push(...result.errors);
+        }
+        if (serverEntryFiles.size > 0) {
+            // Server bundles use `@pikku/node-http-server` (pure JS), so esbuild
+            // can inline everything except node builtins. The bundler still
+            // emits a package.json from the metafile; if a user pulls in a
+            // native module the dep extractor surfaces it and `npm install`
+            // inside the container picks it up.
+            const serverManifestForBundle = {
+                ...manifest,
+                units: manifest.units.filter((u) => u.target === 'server'),
+            };
+            const result = await bundleUnits(projectDir, serverManifestForBundle, serverEntryFiles, providerDir, {
+                externals: ['node:*'],
+                aliases: undefined,
+                define: undefined,
+                platform: 'node',
+                format: 'esm',
+                noRequireShim: false,
+                resolveOutputDir: () => containerDir,
+            });
+            aggregated.push(...result.results);
+            aggregatedErrors.push(...result.errors);
+            // Emit Dockerfile + .dockerignore alongside bundle.js for any
+            // orchestrator that wants to `docker build` the container directly.
+            if (result.results.length > 0) {
+                await writeFile(join(containerDir, 'Dockerfile'), SERVER_DOCKERFILE, 'utf-8');
+                await writeFile(join(containerDir, '.dockerignore'), SERVER_DOCKERIGNORE, 'utf-8');
+            }
+        }
+        bundled = aggregated;
+        bundleErrors = aggregatedErrors;
         attachBundleMetadata(manifest, bundled);
         logger.info(`Bundled ${bundled.length} units${bundleErrors.length > 0 ? ` (${bundleErrors.length} failed)` : ''}`);
     }
@@ -209,6 +262,13 @@ export async function runBuildPipeline(options) {
         await writeFile(infraPath, infraContent, 'utf-8');
         logger.info('Generated infrastructure manifest');
     }
+    if (provider.emitSideArtifacts) {
+        await provider.emitSideArtifacts({
+            buildDir: providerDir,
+            manifest,
+            logger,
+        });
+    }
     if (provider.generateProviderConfigs) {
         const providerConfigs = provider.generateProviderConfigs(manifest);
         for (const [filename, content] of providerConfigs) {
@@ -218,12 +278,17 @@ export async function runBuildPipeline(options) {
         }
     }
     const lockfileSrc = findLockfile(projectDir);
+    let configCount = 0;
     for (const unit of manifest.units) {
+        // Server units don't take per-unit provider configs (no wrangler.toml,
+        // etc.) — their runtime is the emitted Dockerfile + bundle.js. Skip
+        // both the provider config emit and the lockfile copy; the bundle is
+        // self-contained and the Docker build uses npm install on its own.
+        if (unit.target === 'server')
+            continue;
         const unitDir = provider.singleUnit
             ? join(providerDir, unit.name)
-            : unit.target === 'server'
-                ? containerDir
-                : join(unitsDir, unit.name);
+            : join(unitsDir, unit.name);
         await mkdir(unitDir, { recursive: true });
         const configs = provider.generateUnitConfigs(unit, manifest, projectId);
         for (const [filename, content] of configs) {
@@ -232,8 +297,9 @@ export async function runBuildPipeline(options) {
         if (lockfileSrc) {
             await copyFile(lockfileSrc, join(unitDir, 'yarn.lock'));
         }
+        configCount++;
     }
-    logger.info(`Generated ${manifest.units.length} provider config files`);
+    logger.info(`Generated ${configCount} provider config files`);
     return {
         manifest,
         providerDir,

package/dist/src/deploy/bundler/bundler.d.ts

@@ -27,5 +27,6 @@ export declare function bundleUnits(projectDir: string, manifest: DeploymentMani
     define?: Record<string, string>;
     platform?: 'node' | 'neutral' | 'browser';
     format?: 'esm' | 'cjs';
+    noRequireShim?: boolean;
     resolveOutputDir?: (unit: DeploymentUnit, baseOutputDir: string) => string;
 }): Promise<BundleOutput>;

package/dist/src/deploy/bundler/bundler.js

@@ -104,13 +104,21 @@ async function bundleUnit(options) {
             break;
         dir = parent;
     }
-    // For ESM + node platform, CJS deps may use require() for builtins.
-    // esbuild wraps these as __require() which fails at runtime in ESM.
-    // The banner shims require via createRequire so CJS builtins resolve.
+    // For ESM + node platform, CJS deps may use require() / __filename / __dirname
+    // for builtins or to locate native addons (the `bindings` package, used
+    // transitively by `pg` and many others, calls `__filename` directly). esbuild
+    // wraps require() as __require() which fails at runtime in ESM, and leaves
+    // `__filename` / `__dirname` as undefined references. The banner shims all
+    // three via createRequire / fileURLToPath so CJS builtins resolve and native-
+    // addon loaders find their .node files.
+    // Skipped when the provider opts out via `noRequireShim` (e.g. CF Workers
+    // — `import.meta.url` is undefined there, so the shim crashes at boot).
     const resolvedFormat = format ?? 'esm';
-    const banner = resolvedFormat === 'esm' && (platform ?? 'node') === 'node'
+    const banner = resolvedFormat === 'esm' &&
+        (platform ?? 'node') === 'node' &&
+        !options.noRequireShim
         ? {
-            js: `import { createRequire } from 'module'; const require = createRequire(import.meta.url);`,
+            js: `import { createRequire as __pikkuCreateRequire } from 'node:module'; import { fileURLToPath as __pikkuFileURLToPath } from 'node:url'; import { dirname as __pikkuDirname } from 'node:path'; const require = __pikkuCreateRequire(import.meta.url); const __filename = __pikkuFileURLToPath(import.meta.url); const __dirname = __pikkuDirname(__filename);`,
         }
         : undefined;
     const result = await build({

package/dist/src/deploy/codegen/per-unit-codegen.d.ts

@@ -24,6 +24,14 @@ export interface PerUnitCodegenOptions {
     onProgress?: (unitName: string, status: 'start' | 'done' | 'error', error?: string) => void;
     /** Resolve unit output directory (defaults to <deployDir>/<unit-name>) */
     resolveUnitDir?: (unit: DeploymentUnit, baseDeployDir: string) => string;
+    /**
+     * Whether the deploy pipeline emits per-step workflow queues. When `false`
+     * the per-unit codegen filter does NOT include `wf-orchestrator-*` /
+     * `wf-step-*` queue names — they don't exist in the manifest, and pulling
+     * them through codegen would force the workflow runtime to register queue
+     * meta the provider doesn't actually use. Defaults to `true`.
+     */
+    workflowQueues?: boolean;
 }
 export interface PerUnitCodegenResult {
     /** Map of unit name -> path to the unit's .pikku directory */

package/dist/src/deploy/codegen/per-unit-codegen.js

@@ -34,7 +34,7 @@ function resolvePikkuBin() {
  * include both the function IDs and any wiring-level names (e.g. agent
  * names, channel names) that reference those functions.
  */
-function collectFilterNames(unit, manifest, inspectorState) {
+function collectFilterNames(unit, manifest, inspectorState, workflowQueues) {
     const names = new Set(unit.functionIds);
     // Include catch-all scaffold routes based on unit contents
     const functionsMeta = inspectorState.functions.meta;
@@ -62,6 +62,10 @@ function collectFilterNames(unit, manifest, inspectorState) {
                 names.add('agentStreamCaller');
                 names.add('agentApproveCaller');
                 names.add('agentResumeCaller');
+                names.add('getAgentThreads');
+                names.add('getAgentThreadMessages');
+                names.add('getAgentThreadRuns');
+                names.add('deleteAgentThread');
                 // Include RPC catch-all for agent tool dispatch
                 names.add('/rpc/:rpcName');
                 for (const id of agentDef.toolFunctionIds)
@@ -99,6 +103,37 @@ function collectFilterNames(unit, manifest, inspectorState) {
                 if (handler.type === 'scheduled')
                     names.add(handler.taskName);
             }
+            // Function units with workflow-state capability (workflow-starter,
+            // workflow-runner, workflow-status-checker) call rpc.startWorkflow
+            // and look workflows up by name in the registry. The registry is
+            // populated when the user's `pikkuWorkflowGraph(...)` calls execute
+            // at module load — so the per-unit bootstrap needs the workflow
+            // wirings file. We only pull in the workflow NAME (graph structure
+            // only — nodes reference step functions by string ID), not the step
+            // function bodies; those stay in their own per-step units and are
+            // reached via queue dispatch at runtime.
+            const usesWorkflowState = unit.services.some((s) => s.capability === 'workflow-state');
+            if (usesWorkflowState) {
+                for (const wf of manifest.workflows) {
+                    names.add(wf.name);
+                    // Include orchestrator + per-step queue NAMES so queue meta gets
+                    // emitted into this unit. The runtime needs these in
+                    // `pikkuState('queue', 'meta')` to map a step's rpcName to its
+                    // dedicated queue (otherwise it falls back to the shared
+                    // 'pikku-workflow-step-worker' queue which doesn't exist in
+                    // per-unit deploys). Names only — no function bodies bundled.
+                    // Skipped when the provider doesn't use workflow queues — its
+                    // workflow runtime dispatches steps natively.
+                    if (workflowQueues) {
+                        names.add(`wf-orchestrator-${toSafeKebab(wf.name)}`);
+                        for (const step of wf.steps) {
+                            if (step.functionId) {
+                                names.add(`wf-step-${toSafeKebab(step.functionId)}`);
+                            }
+                        }
+                    }
+                }
+            }
             break;
         }
         case 'workflow': {
@@ -122,12 +157,17 @@ function collectFilterNames(unit, manifest, inspectorState) {
                 names.add('http:get:/workflow/:workflowName/status/:runId');
                 names.add('http:get:/workflow/:workflowName/status/:runId/stream');
                 names.add('http:post:/workflow/:workflowName/graph/:nodeId');
-                // Queue names for orchestrator and step workers
-                names.add(`wf-orchestrator-${toSafeKebab(wfDef.name)}`);
+                // Queue names for orchestrator and step workers — only when the
+                // provider's workflow runtime fans out via queues.
+                if (workflowQueues) {
+                    names.add(`wf-orchestrator-${toSafeKebab(wfDef.name)}`);
+                }
                 for (const step of wfDef.steps) {
                     if (step.functionId) {
                         names.add(step.functionId);
-                        names.add(`wf-step-${toSafeKebab(step.functionId)}`);
+                        if (workflowQueues) {
+                            names.add(`wf-step-${toSafeKebab(step.functionId)}`);
+                        }
                     }
                 }
             }
@@ -149,6 +189,7 @@ function collectFilterNames(unit, manifest, inspectorState) {
  */
 export async function generatePerUnitCodegen(options) {
     const { projectDir, manifest, inspectorState, onProgress } = options;
+    const workflowQueues = options.workflowQueues ?? true;
     const baseDir = options.deployDir ?? join(projectDir, '.deploy');
     const pikkuBin = options.pikkuBin ?? resolvePikkuBin();
     const unitPikkuDirs = new Map();
@@ -162,7 +203,7 @@ export async function generatePerUnitCodegen(options) {
         await writeFile(stateFilePath, JSON.stringify(serialized), 'utf-8');
         // Generate codegen for each unit
         for (const unit of manifest.units) {
-            const filterNames = collectFilterNames(unit, manifest, inspectorState);
+            const filterNames = collectFilterNames(unit, manifest, inspectorState, workflowQueues);
             if (filterNames.length === 0) {
                 errors.push({
                     unitName: unit.name,

package/dist/src/deploy/provider-adapter.d.ts

@@ -39,6 +39,21 @@ export interface ProviderAdapter {
      * Used by standalone adapter.
      */
     readonly singleUnit?: boolean;
+    /**
+     * Whether the provider's workflow runtime needs synthesized per-step
+     * dispatch queues. Defaults to `true`.
+     *
+     * - `true` (default): The deploy pipeline synthesizes a `wf-orchestrator-*`
+     *   queue and a `wf-step-*` queue for every workflow step, plus producer
+     *   bindings, so the workflow runtime can fan out via queues.
+     * - `false`: No synthetic workflow queues are emitted into the manifest
+     *   or per-unit codegen. Use this when the provider's workflow runtime
+     *   dispatches steps natively (e.g. Cloudflare's Durable-Object-based
+     *   `CloudflareWorkflowService`, where the orchestrator DO advances
+     *   steps directly without a queue hop). Queues created via explicit
+     *   `wireQueue(...)` user code are unaffected.
+     */
+    readonly workflowQueues?: boolean;
     /**
      * Generate the entry file source for a deployment unit.
      * Called once per unit.
@@ -78,11 +93,30 @@ export interface ProviderAdapter {
      * pkg requires 'cjs' for standalone binaries.
      */
     getFormat?(): 'esm' | 'cjs';
+    /**
+     * Skip the createRequire banner. CF Workers should return true —
+     * `import.meta.url` is undefined there and the banner crashes at boot.
+     */
+    getNoRequireShim?(): boolean;
     /**
      * Generate additional provider-level config files (e.g. serverless.yml).
      * Returns a map of filename → content to write into the deploy directory.
      */
     generateProviderConfigs?(manifest: DeploymentManifest): Map<string, string>;
+    /**
+     * Emit any provider-specific artifacts that aren't tied to a single user
+     * unit — e.g. a synthesized proxy Worker that fronts a CF Container.
+     * Called after the infra manifest is written so providers can read it
+     * and key off resources that were provisioned in earlier steps.
+     */
+    emitSideArtifacts?(options: {
+        buildDir: string;
+        manifest: DeploymentManifest;
+        logger: {
+            info(msg: string): void;
+            error(msg: string): void;
+        };
+    }): Promise<void>;
     /**
      * Deploy the built artifacts to the provider.
      * Optional — if not implemented, the CLI just outputs the build directory.

package/dist/src/deploy/server-entry.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Provider-agnostic Node server entry generator for `target: 'server'` units.
+ *
+ * Produces a `node:http`-based HTTP entry built on `@pikku/node-http-server`
+ * — the same runtime `pikku dev` uses. Containers sit behind something
+ * (Cloudflare Workers, a load balancer) so raw uWS throughput isn't
+ * required; sharing the dev server keeps one HTTP path to maintain.
+ *
+ * The same bundle runs anywhere a Node process can run: CF Containers,
+ * fly.io, ECS, bare VM. Provider-specific config (Dockerfile, infra) is
+ * emitted by the provider adapter on top of this entry + bundle.js.
+ */
+import type { EntryGenerationContext } from './provider-adapter.js';
+export declare function generateServerEntrySource(ctx: EntryGenerationContext): string;
+export declare const SERVER_DOCKERFILE = "# Generated by @pikku/cli \u2014 do not edit\nFROM node:22-slim\n\nRUN apt-get update \\\n  && apt-get install -y --no-install-recommends tini ca-certificates \\\n  && rm -rf /var/lib/apt/lists/*\n\nRUN groupadd -r pikku && useradd -r -g pikku -u 1001 pikku\n\nWORKDIR /app\n\n# Pikku bundles user code + first-party deps inline; only externalised deps\n# (typically empty for pure-JS apps) are listed in package.json. We ship no\n# lockfile because the bundle has already pinned everything via the\n# extracted exact-dependencies \u2014 `npm install --omit=dev` resolves the\n# leftover externals (if any) at build time.\nCOPY --chown=pikku:pikku package.json ./\nRUN npm install --omit=dev --no-audit --no-fund\n\nCOPY --chown=pikku:pikku bundle.js ./\n\nUSER pikku\nENV NODE_ENV=production\nENV PORT=8080\nEXPOSE 8080\n\nENTRYPOINT [\"/usr/bin/tini\", \"--\"]\nCMD [\"node\", \"bundle.js\"]\n";
+export declare const SERVER_DOCKERIGNORE = "node_modules\n.git\n*.log\nmetafile.json\nexact-dependencies.json\n";