@pikku/cli 0.12.43 → 0.12.45

package/dist/bin/pikku-bin.mjs

@@ -11,8 +11,8 @@ async function checkForUpdate() {
     })
     if (!res.ok) return
     const { version: latest } = await res.json()
-    if (latest !== '0.12.43') {
-      process.stderr.write(`\n  Update available  0.12.43 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
+    if (latest !== '0.12.45') {
+      process.stderr.write(`\n  Update available  0.12.45 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
     }
   } catch {}
 }

package/dist/src/cli.wiring.js

@@ -67,6 +67,18 @@ wireCLI({
             default: false,
             short: 'j',
         },
+        failOnError: {
+            description: 'Fail the build on error-severity diagnostics (e.g. data-classification leaks). Default: only critical diagnostics fail.',
+            default: false,
+        },
+        failOnWarn: {
+            description: 'Fail the build on warn-severity diagnostics (implies --fail-on-error).',
+            default: false,
+        },
+        failOnCritical: {
+            description: 'Fail the build on critical diagnostics. Always on; accepted for symmetry with --fail-on-error/--fail-on-warn.',
+            default: true,
+        },
         userSessionType: {
             description: 'Specify which UserSession type to use (when multiple exist)',
         },

package/dist/src/fabric/fabric-commands.d.ts

@@ -4,7 +4,7 @@ export declare const fabricCommands: {
         root: string;
         findings: {
             id: string;
-            severity: "info" | "warn" | "error";
+            severity: "warn" | "error" | "info";
             message: string;
             path: string;
             fixHint: string;
@@ -14,7 +14,7 @@ export declare const fabricCommands: {
         root: string;
         findings: {
             id: string;
-            severity: "info" | "warn" | "error";
+            severity: "warn" | "error" | "info";
             message: string;
             path: string;
             fixHint: string;
@@ -24,7 +24,7 @@ export declare const fabricCommands: {
         root: string;
         findings: {
             id: string;
-            severity: "info" | "warn" | "error";
+            severity: "warn" | "error" | "info";
             message: string;
             path: string;
             fixHint: string;
@@ -172,6 +172,64 @@ export declare const fabricCommands: {
         deploymentId: string;
         stageId: string;
     }, "session" | "rpc", import("../../types/application-types.js").Services>, undefined, undefined>, import("../../.pikku/pikku-types.gen.js").PikkuMiddleware, (services: import("../../types/application-types.js").SingletonServices, data: any, session?: import("../../types/application-types.js").UserSession | undefined) => void | Promise<void>, string>;
+    addon: {
+        description: string;
+        subcommands: {
+            publish: import("@pikku/core/cli").CoreCLICommandConfig<import("../../.pikku/pikku-types.gen.js").PikkuFunctionConfig<{
+                dir?: string | undefined;
+                apiUrl?: string | undefined;
+            }, {
+                id: string;
+                name: string;
+                version: string;
+                publisher: string | null;
+            }, "session" | "rpc", import("../../.pikku/pikku-types.gen.js").PikkuFunctionSessionless<{
+                dir?: string | undefined;
+                apiUrl?: string | undefined;
+            }, {
+                id: string;
+                name: string;
+                version: string;
+                publisher: string | null;
+            }, "session" | "rpc", import("../../types/application-types.js").Services> | import("../../.pikku/pikku-types.gen.js").PikkuFunction<{
+                dir?: string | undefined;
+                apiUrl?: string | undefined;
+            }, {
+                id: string;
+                name: string;
+                version: string;
+                publisher: string | null;
+            }, "session" | "rpc", import("../../types/application-types.js").Services>, undefined, undefined>, import("../../.pikku/pikku-types.gen.js").PikkuMiddleware, (services: import("../../types/application-types.js").SingletonServices, data: any, session?: import("../../types/application-types.js").UserSession | undefined) => void | Promise<void>, string>;
+            add: import("@pikku/core/cli").CoreCLICommandConfig<import("../../.pikku/pikku-types.gen.js").PikkuFunctionConfig<{
+                id: string;
+                dir?: string | undefined;
+                apiUrl?: string | undefined;
+            }, {
+                id: string;
+                name: string;
+                version: string;
+                path: string;
+            }, "session" | "rpc", import("../../.pikku/pikku-types.gen.js").PikkuFunctionSessionless<{
+                id: string;
+                dir?: string | undefined;
+                apiUrl?: string | undefined;
+            }, {
+                id: string;
+                name: string;
+                version: string;
+                path: string;
+            }, "session" | "rpc", import("../../types/application-types.js").Services> | import("../../.pikku/pikku-types.gen.js").PikkuFunction<{
+                id: string;
+                dir?: string | undefined;
+                apiUrl?: string | undefined;
+            }, {
+                id: string;
+                name: string;
+                version: string;
+                path: string;
+            }, "session" | "rpc", import("../../types/application-types.js").Services>, undefined, undefined>, import("../../.pikku/pikku-types.gen.js").PikkuMiddleware, (services: import("../../types/application-types.js").SingletonServices, data: any, session?: import("../../types/application-types.js").UserSession | undefined) => void | Promise<void>, string>;
+        };
+    };
     deploy: {
         description: string;
         subcommands: {

package/dist/src/fabric/fabric-commands.js

@@ -39,7 +39,9 @@ import { FabricDomainsAdd } from './functions/domains-add.function.js';
 import { FabricDomainsRemove } from './functions/domains-remove.function.js';
 import { FabricLLMKey, renderLLMKey } from './functions/llm-key.function.js';
 import { FabricValidate, renderValidate, } from './functions/validate.function.js';
-import { FabricSmoke, renderSmoke, } from './functions/smoke.function.js';
+import { FabricSmoke, renderSmoke } from './functions/smoke.function.js';
+import { FabricPublish } from './functions/publish.function.js';
+import { FabricAdd } from './functions/add.function.js';
 export const fabricCommands = defineCLICommands({
     validate: pikkuCLICommand({
         func: FabricValidate,
@@ -103,6 +105,30 @@ export const fabricCommands = defineCLICommands({
             },
         },
     }),
+    addon: {
+        description: 'Publish and install Fabric community-registry addons',
+        subcommands: {
+            publish: pikkuCLICommand({
+                parameters: '[dir]',
+                func: FabricPublish,
+                description: 'Publish the addon in this directory to the community registry (pack + upload)',
+                options: {
+                    apiUrl: { description: 'Override the fabric-api URL for this call' },
+                },
+            }),
+            add: pikkuCLICommand({
+                parameters: '<id>',
+                func: FabricAdd,
+                description: 'Install an addon from the community registry into addons/ (shadcn-style)',
+                options: {
+                    dir: {
+                        description: 'Addon dir (overrides pikku.config.json addons.addonDir, default addons/)',
+                    },
+                    apiUrl: { description: 'Override the fabric-api URL for this call' },
+                },
+            }),
+        },
+    },
     deploy: {
         description: 'Plan and apply deploys for a named branch or production',
         subcommands: {

package/dist/src/fabric/functions/add.function.d.ts

@@ -0,0 +1,50 @@
+import { z } from 'zod';
+export declare const FabricAddInput: z.ZodObject<{
+    id: z.ZodString;
+    dir: z.ZodOptional<z.ZodString>;
+    apiUrl: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const FabricAddOutput: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    version: z.ZodString;
+    path: z.ZodString;
+}, z.core.$strip>;
+/**
+ * Install a community-registry addon shadcn-style: the source is copied into
+ * `<addonDir>/<name>/` (default `addons/`, top-level so it sits outside the
+ * app's TS scan and never collides with the project's own CoreConfig). The dir
+ * is registered as a yarn workspace, so `yarn install` symlinks it into
+ * node_modules and `wireAddon({ package })` resolves it by name unchanged.
+ *
+ * Provenance (registry id + version) is recorded in pikku-addons.json, which is
+ * CLI-owned and survives the user editing/forking the copied source.
+ */
+export declare const FabricAdd: import("../../../.pikku/pikku-types.gen.js").PikkuFunctionConfig<{
+    id: string;
+    dir?: string | undefined;
+    apiUrl?: string | undefined;
+}, {
+    id: string;
+    name: string;
+    version: string;
+    path: string;
+}, "session" | "rpc", import("../../../.pikku/pikku-types.gen.js").PikkuFunctionSessionless<{
+    id: string;
+    dir?: string | undefined;
+    apiUrl?: string | undefined;
+}, {
+    id: string;
+    name: string;
+    version: string;
+    path: string;
+}, "session" | "rpc", import("../../../types/application-types.js").Services> | import("../../../.pikku/pikku-types.gen.js").PikkuFunction<{
+    id: string;
+    dir?: string | undefined;
+    apiUrl?: string | undefined;
+}, {
+    id: string;
+    name: string;
+    version: string;
+    path: string;
+}, "session" | "rpc", import("../../../types/application-types.js").Services>, undefined, undefined>;

package/dist/src/fabric/functions/add.function.js

@@ -0,0 +1,144 @@
+import { z } from 'zod';
+import { readFile, mkdir, rm, writeFile, rename } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { dirname, isAbsolute, join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { execFileSync } from 'node:child_process';
+import { pikkuSessionlessFunc } from '../../../.pikku/pikku-types.gen.js';
+import { resolveApiContext } from '../lib/config.js';
+export const FabricAddInput = z.object({
+    id: z.string(),
+    dir: z.string().optional(),
+    apiUrl: z.string().optional(),
+});
+export const FabricAddOutput = z.object({
+    id: z.string(),
+    name: z.string(),
+    version: z.string(),
+    path: z.string(),
+});
+/** Walk up from cwd to find the project root (the dir with package.json). */
+function resolveProjectRoot() {
+    let dir = process.cwd();
+    while (true) {
+        if (existsSync(join(dir, 'package.json')))
+            return dir;
+        const parent = dirname(dir);
+        if (parent === dir)
+            return process.cwd();
+        dir = parent;
+    }
+}
+/** Read `addons.addonDir` from pikku.config.json if present (json only). */
+async function readAddonDirFromConfig(root) {
+    const cfgPath = join(root, 'pikku.config.json');
+    if (!existsSync(cfgPath))
+        return undefined;
+    try {
+        const cfg = JSON.parse(await readFile(cfgPath, 'utf8'));
+        return cfg.addons?.addonDir;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Ensure the root package.json `workspaces` glob covers `<addonDir>/*`, so a
+ *  later `yarn install` symlinks the addon into node_modules and `wireAddon`
+ *  resolves it by package name. */
+async function ensureWorkspaceGlob(root, addonDir) {
+    const pkgPath = join(root, 'package.json');
+    const pkg = JSON.parse(await readFile(pkgPath, 'utf8'));
+    const glob = `${addonDir}/*`;
+    const objectForm = !Array.isArray(pkg.workspaces) && pkg.workspaces != null;
+    const list = Array.isArray(pkg.workspaces)
+        ? pkg.workspaces
+        : (pkg.workspaces?.packages ?? []);
+    if (list.includes(glob))
+        return;
+    list.push(glob);
+    if (objectForm)
+        pkg.workspaces.packages = list;
+    else
+        pkg.workspaces = list;
+    await writeFile(pkgPath, JSON.stringify(pkg, null, 2) + '\n');
+}
+/** Record install provenance in pikku-addons.json — CLI-owned, so we know which
+ *  registry package + version a folder came from even after the user forks it. */
+async function recordInstall(root, name, rec) {
+    const p = join(root, 'pikku-addons.json');
+    let data = {};
+    if (existsSync(p)) {
+        try {
+            data = JSON.parse(await readFile(p, 'utf8'));
+        }
+        catch {
+            data = {};
+        }
+    }
+    data[name] = rec;
+    await writeFile(p, JSON.stringify(data, null, 2) + '\n');
+}
+/**
+ * Install a community-registry addon shadcn-style: the source is copied into
+ * `<addonDir>/<name>/` (default `addons/`, top-level so it sits outside the
+ * app's TS scan and never collides with the project's own CoreConfig). The dir
+ * is registered as a yarn workspace, so `yarn install` symlinks it into
+ * node_modules and `wireAddon({ package })` resolves it by name unchanged.
+ *
+ * Provenance (registry id + version) is recorded in pikku-addons.json, which is
+ * CLI-owned and survives the user editing/forking the copied source.
+ */
+export const FabricAdd = pikkuSessionlessFunc({
+    description: 'Install an addon from the Fabric community registry into addons/ (shadcn-style).',
+    input: FabricAddInput,
+    output: FabricAddOutput,
+    func: async (_services, { id, dir, apiUrl: apiUrlOverride }) => {
+        const ctx = await resolveApiContext({ apiUrlOverride });
+        // 1. resolve a presigned download URL (public read)
+        const metaRes = await fetch(`${ctx.apiUrl}/registry/packages/${encodeURIComponent(id)}/download`);
+        if (!metaRes.ok)
+            throw new Error(`download lookup failed → ${metaRes.status}: ${await metaRes.text()}`);
+        const { url } = (await metaRes.json());
+        // 2. fetch the artifact
+        const dl = await fetch(url);
+        if (!dl.ok)
+            throw new Error(`artifact fetch failed → ${dl.status}`);
+        const artifact = Buffer.from(await dl.arrayBuffer());
+        const root = resolveProjectRoot();
+        const addonDir = dir ?? (await readAddonDirFromConfig(root)) ?? 'addons';
+        const addonRoot = isAbsolute(addonDir) ? addonDir : join(root, addonDir);
+        // 3. stage inside addonRoot (same filesystem — no EXDEV on the final move)
+        //    and strip npm-pack's `package/` prefix. The dir name isn't known until
+        //    we read the artifact's package.json.
+        await mkdir(addonRoot, { recursive: true });
+        const staging = join(addonRoot, `.pikku-add-${id}-${Date.now()}`);
+        await mkdir(staging, { recursive: true });
+        const tmp = join(tmpdir(), `pikku-add-${id}.tgz`);
+        await writeFile(tmp, artifact);
+        try {
+            execFileSync('tar', ['-xzf', tmp, '-C', staging, '--strip-components=1']);
+            await rm(tmp, { force: true });
+            const pkg = JSON.parse(await readFile(join(staging, 'package.json'), 'utf8'));
+            if (!pkg.name)
+                throw new Error('artifact package.json is missing a "name" field');
+            const version = pkg.version ?? '0.0.0';
+            // shadcn copy: folder is the last segment of the (scoped) package name
+            const folder = pkg.name.split('/').pop();
+            const target = join(addonRoot, folder);
+            await rm(target, { recursive: true, force: true });
+            await rename(staging, target);
+            // 4. register the workspace glob + record provenance (skip glob for an
+            //    absolute --dir override — it can't be a relative workspace pattern)
+            if (!isAbsolute(addonDir))
+                await ensureWorkspaceGlob(root, addonDir);
+            await recordInstall(root, pkg.name, { id, version });
+            console.log(`[fabric] installed ${pkg.name}@${version} → ${target}`);
+            console.log('[fabric] run `yarn install` to link it into node_modules');
+            return { id, name: pkg.name, version, path: target };
+        }
+        finally {
+            await rm(staging, { recursive: true, force: true });
+            await rm(tmp, { force: true });
+        }
+    },
+});

package/dist/src/fabric/functions/publish.function.d.ts

@@ -0,0 +1,45 @@
+import { z } from 'zod';
+export declare const FabricPublishInput: z.ZodObject<{
+    dir: z.ZodOptional<z.ZodString>;
+    apiUrl: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const FabricPublishOutput: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    version: z.ZodString;
+    publisher: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * Publish a package to the Fabric community registry. Packs the directory into
+ * a gzipped tar, requests a short-lived presigned upload URL, PUTs the artifact
+ * to R2, then finalizes the publish so the catalogue indexes it. Authenticated
+ * as the logged-in user (the package is attributed to their org or person).
+ *
+ * Generating the package contents (`.pikku/` meta etc.) is a separate step;
+ * this command only packages + uploads what's already in the directory.
+ */
+export declare const FabricPublish: import("../../../.pikku/pikku-types.gen.js").PikkuFunctionConfig<{
+    dir?: string | undefined;
+    apiUrl?: string | undefined;
+}, {
+    id: string;
+    name: string;
+    version: string;
+    publisher: string | null;
+}, "session" | "rpc", import("../../../.pikku/pikku-types.gen.js").PikkuFunctionSessionless<{
+    dir?: string | undefined;
+    apiUrl?: string | undefined;
+}, {
+    id: string;
+    name: string;
+    version: string;
+    publisher: string | null;
+}, "session" | "rpc", import("../../../types/application-types.js").Services> | import("../../../.pikku/pikku-types.gen.js").PikkuFunction<{
+    dir?: string | undefined;
+    apiUrl?: string | undefined;
+}, {
+    id: string;
+    name: string;
+    version: string;
+    publisher: string | null;
+}, "session" | "rpc", import("../../../types/application-types.js").Services>, undefined, undefined>;

package/dist/src/fabric/functions/publish.function.js

@@ -0,0 +1,85 @@
+import { z } from 'zod';
+import { readFile } from 'node:fs/promises';
+import { existsSync, readFileSync, mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { execFileSync } from 'node:child_process';
+import { pikkuSessionlessFunc } from '../../../.pikku/pikku-types.gen.js';
+import { resolveApiContext } from '../lib/config.js';
+export const FabricPublishInput = z.object({
+    dir: z.string().optional(),
+    apiUrl: z.string().optional(),
+});
+export const FabricPublishOutput = z.object({
+    id: z.string(),
+    name: z.string(),
+    version: z.string(),
+    publisher: z.string().nullable(),
+});
+/**
+ * Publish a package to the Fabric community registry. Packs the directory into
+ * a gzipped tar, requests a short-lived presigned upload URL, PUTs the artifact
+ * to R2, then finalizes the publish so the catalogue indexes it. Authenticated
+ * as the logged-in user (the package is attributed to their org or person).
+ *
+ * Generating the package contents (`.pikku/` meta etc.) is a separate step;
+ * this command only packages + uploads what's already in the directory.
+ */
+export const FabricPublish = pikkuSessionlessFunc({
+    description: 'Publish a package directory to the Fabric community registry.',
+    input: FabricPublishInput,
+    output: FabricPublishOutput,
+    func: async (_services, { dir, apiUrl: apiUrlOverride }) => {
+        const ctx = await resolveApiContext({ apiUrlOverride });
+        if (!ctx.token)
+            throw new Error('Not logged in. Run `pikku fabric login` first.');
+        const packageDir = dir ?? process.cwd();
+        const pkgPath = join(packageDir, 'package.json');
+        if (!existsSync(pkgPath))
+            throw new Error(`No package.json found in ${packageDir}`);
+        const pkg = JSON.parse(await readFile(pkgPath, 'utf8'));
+        if (!pkg.name || !pkg.version)
+            throw new Error('package.json must have a name and version');
+        // Pack via `npm pack` so the artifact honours the package's `files` field
+        // (ship src/.pikku/types, not build/VCS noise) and matches the layout a
+        // normal install produces. npm nests contents under `package/`; the
+        // registry ingestion and `pikku fabric add` both handle that prefix.
+        const packDir = join(tmpdir(), `pikku-publish-${Date.now()}`);
+        mkdirSync(packDir, { recursive: true });
+        const packOut = execFileSync('npm', ['pack', '--json', '--pack-destination', packDir], { cwd: packageDir, encoding: 'utf8' });
+        const tgzName = JSON.parse(packOut)[0].filename;
+        const artifact = readFileSync(join(packDir, tgzName));
+        const headers = {
+            authorization: `Bearer ${ctx.token}`,
+            'content-type': 'application/json',
+        };
+        const post = async (path, body) => {
+            const r = await fetch(`${ctx.apiUrl}${path}`, {
+                method: 'POST',
+                headers,
+                body: JSON.stringify(body),
+            });
+            if (!r.ok)
+                throw new Error(`POST ${path} → ${r.status}: ${await r.text()}`);
+            return r.json();
+        };
+        // 1. presigned upload URL (short-lived)
+        const { uploadUrl, artifactKey } = await post('/registry/packages/publish-url', { packageName: pkg.name, version: pkg.version });
+        // 2. PUT the artifact to the exact signed URL (no extra headers — the URL
+        //    is signed over host only; mismatched headers break the signature).
+        const put = await fetch(uploadUrl, { method: 'PUT', body: artifact });
+        if (!put.ok)
+            throw new Error(`upload failed → ${put.status}: ${await put.text()}`);
+        // 3. finalize — server reads the artifact back, extracts meta, indexes it
+        const entry = await post('/registry/packages/publish', { artifactKey });
+        const publisher = entry.publisher?.name ?? null;
+        console.log(`[fabric] published ${entry.name}@${entry.version} (id=${entry.id})` +
+            (publisher ? ` as ${publisher}` : ''));
+        return {
+            id: entry.id,
+            name: entry.name,
+            version: entry.version,
+            publisher,
+        };
+    },
+});

package/dist/src/fabric/functions/validate-core.d.ts

@@ -6,9 +6,9 @@ export declare const FabricValidateOutput: z.ZodObject<{
     findings: z.ZodArray<z.ZodObject<{
         id: z.ZodString;
         severity: z.ZodEnum<{
-            info: "info";
             warn: "warn";
             error: "error";
+            info: "info";
         }>;
         message: z.ZodString;
         path: z.ZodString;

package/dist/src/fabric/functions/validate.function.d.ts

@@ -6,9 +6,9 @@ export declare const FabricValidateOutput: z.ZodObject<{
     findings: z.ZodArray<z.ZodObject<{
         id: z.ZodString;
         severity: z.ZodEnum<{
-            info: "info";
             warn: "warn";
             error: "error";
+            info: "info";
         }>;
         message: z.ZodString;
         path: z.ZodString;
@@ -21,7 +21,7 @@ export declare const FabricValidate: import("../../../.pikku/pikku-types.gen.js"
     root: string;
     findings: {
         id: string;
-        severity: "info" | "warn" | "error";
+        severity: "warn" | "error" | "info";
         message: string;
         path: string;
         fixHint: string;
@@ -31,7 +31,7 @@ export declare const FabricValidate: import("../../../.pikku/pikku-types.gen.js"
     root: string;
     findings: {
         id: string;
-        severity: "info" | "warn" | "error";
+        severity: "warn" | "error" | "info";
         message: string;
         path: string;
         fixHint: string;
@@ -41,7 +41,7 @@ export declare const FabricValidate: import("../../../.pikku/pikku-types.gen.js"
     root: string;
     findings: {
         id: string;
-        severity: "info" | "warn" | "error";
+        severity: "warn" | "error" | "info";
         message: string;
         path: string;
         fixHint: string;