@pikku/cli 0.12.66 → 0.12.68

package/dist/.pikku/trigger/pikku-trigger-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.66
+ * This file was generated by @pikku/cli@0.12.68
  */
 /**
  * Trigger-specific type definitions for tree-shaking optimization

package/dist/.pikku/trigger/pikku-trigger-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.66
+ * This file was generated by @pikku/cli@0.12.68
  */
 /**
  * Trigger-specific type definitions for tree-shaking optimization

package/dist/.pikku/variables/pikku-variable-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.66
+ * This file was generated by @pikku/cli@0.12.68
  */
 export { wireVariable } from '@pikku/core/variable';
 export type { CoreVariable, VariableDefinitionMeta, VariableDefinitionsMeta } from '@pikku/core/variable';

package/dist/.pikku/variables/pikku-variable-types.gen.js

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.66
+ * This file was generated by @pikku/cli@0.12.68
  */
 export { wireVariable } from '@pikku/core/variable';

package/dist/.pikku/variables/pikku-variables.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.66
+ * This file was generated by @pikku/cli@0.12.68
  */
 import { TypedVariablesService as CoreTypedVariablesService } from '@pikku/core/services';
 import type { VariablesService } from '@pikku/core/services';

package/dist/.pikku/variables/pikku-variables.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.66
+ * This file was generated by @pikku/cli@0.12.68
  */
 import { TypedVariablesService as CoreTypedVariablesService } from '@pikku/core/services';
 const VARIABLES_META = {};

package/dist/.pikku/workflow/meta/allWorkflow.gen.json

@@ -545,11 +545,16 @@
         "Summary": {
             "nodeId": "Summary",
             "rpcName": "pikkuSummary",
+            "next": "Type check",
             "stepHash": "a6c8f33339e2"
+        },
+        "Type check": {
+            "nodeId": "Type check",
+            "flow": "inline"
         }
     },
     "entryNodeIds": [
         "Bootstrap inspect"
     ],
-    "graphHash": "7b64c5235ba0"
+    "graphHash": "0c9134fe80d5"
 }

package/dist/.pikku/workflow/pikku-workflow-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.66
+ * This file was generated by @pikku/cli@0.12.68
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import { template } from '@pikku/core/workflow';

package/dist/.pikku/workflow/pikku-workflow-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.66
+ * This file was generated by @pikku/cli@0.12.68
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import { template } from '@pikku/core/workflow';

package/dist/.pikku/workflow/pikku-workflow-wirings-meta.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.66
+ * This file was generated by @pikku/cli@0.12.68
  */
 import { pikkuState } from '@pikku/core/internal';
 import allWorkflowMeta from './meta/allWorkflow.gen.json' with { type: 'json' };

package/dist/.pikku/workflow/pikku-workflow-wirings.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.66
+ * This file was generated by @pikku/cli@0.12.68
  */
 import { addWorkflow } from '@pikku/core/workflow';
 import './pikku-workflow-wirings-meta.gen.js';

package/dist/bin/pikku-bin.mjs

@@ -11,8 +11,8 @@ async function checkForUpdate() {
     })
     if (!res.ok) return
     const { version: latest } = await res.json()
-    if (latest !== '0.12.66') {
-      process.stderr.write(`\n  Update available  0.12.66 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
+    if (latest !== '0.12.68') {
+      process.stderr.write(`\n  Update available  0.12.68 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
     }
   } catch {}
 }

package/dist/src/cli.wiring.js

@@ -86,6 +86,14 @@ wireCLI({
             description: 'Fail the build on critical diagnostics. Always on; accepted for symmetry with --fail-on-error/--fail-on-warn.',
             default: true,
         },
+        tsc: {
+            description: "After codegen, run a real tsc --noEmit over the project's tsconfig and fail on type errors. Prints full diagnostics with code frames. Off by default.",
+            default: false,
+        },
+        tscSummary: {
+            description: 'Like --tsc but prints a compact one-line-per-error summary (no code frames, node_modules filtered, capped) — cheap for AI agents / CI. Fails on type errors.',
+            default: false,
+        },
         userSessionType: {
             description: 'Specify which UserSession type to use (when multiple exist)',
         },

package/dist/src/fabric/functions/validate.function.js

@@ -228,7 +228,7 @@ export async function runValidate(startDir = process.cwd()) {
                 key: 'console',
                 severity: 'error',
                 surface: 'app introspection (console:getFunctionsMeta and friends) — the sandbox builder shows no functions',
-                value: '"no-auth"',
+                value: '"auth"',
             },
             {
                 key: 'rpc',

package/dist/src/functions/commands/audit.js

@@ -4,6 +4,9 @@ import { spawnSync } from 'node:child_process';
 import { pikkuSessionlessFunc } from '#pikku';
 const SCHEMA_VERSION = 1;
 const SEVERITY_ORDER = ['critical', 'high', 'moderate', 'low', 'info'];
+// Artifact shape (SecurityAuditReport / …Issue / …Update) is the canonical type
+// from @pikku/core — imported above. `Severity`/`PackageManager` below are local
+// runtime-helper aliases, not a second copy of the artifact.
 const stripAnsi = (s) => s.replace(/\x1b\[[0-9;]*m/g, '');
 // Walk up from startDir to the nearest workspace root — the dir whose lockfile
 // the package manager audits. Falls back to startDir.
@@ -30,10 +33,17 @@ function runBun(args, cwd) {
         cwd,
         encoding: 'utf8',
         maxBuffer: 32 * 1024 * 1024,
+        timeout: 120_000,
         env: { ...process.env, NO_COLOR: '1' },
     });
-    // bun audit exits non-zero when advisories are found — the payload is still on
-    // stdout, so read it regardless of exit code.
+    // A launch failure (bun missing, timeout, maxBuffer exceeded) or a non-zero
+    // exit with *no* output means the audit never produced data — surface it so a
+    // failed run can't masquerade as "0 advisories". (bun audit exits non-zero
+    // WHEN it finds advisories, but still writes the payload to stdout, so a
+    // non-zero exit *with* stdout is fine.)
+    if (res.error || (res.status !== 0 && !res.stdout)) {
+        throw new Error(`bun ${args.join(' ')} failed: ${res.error?.message ?? res.stderr ?? `exit ${res.status}`}`);
+    }
     return res.stdout || '';
 }
 function normaliseSeverity(sev) {
@@ -138,12 +148,19 @@ export const pikkuAudit = pikkuSessionlessFunc({
         const { root, pm } = findProjectRoot(config.rootDir);
         let report;
         if (pm === 'bun') {
-            const issues = parseBunAudit(runBun(['audit', '--json'], root));
-            const updates = includeOutdated ? parseBunOutdated(runBun(['outdated'], root)) : [];
-            const latestByPkg = new Map(updates.map((u) => [u.package, u.latest]));
-            for (const i of issues)
-                i.recommendedVersion = latestByPkg.get(i.package) ?? null;
-            report = summarise('bun', issues, updates);
+            try {
+                const issues = parseBunAudit(runBun(['audit', '--json'], root));
+                const updates = includeOutdated ? parseBunOutdated(runBun(['outdated'], root)) : [];
+                const latestByPkg = new Map(updates.map((u) => [u.package, u.latest]));
+                for (const i of issues)
+                    i.recommendedVersion = latestByPkg.get(i.package) ?? null;
+                report = summarise('bun', issues, updates);
+            }
+            catch (e) {
+                // A failed run must NOT read as clean — emit a note so the UI shows
+                // "audit not run" instead of a reassuring "no vulnerabilities".
+                report = summarise('bun', [], [], `Security audit could not run: ${e instanceof Error ? e.message : String(e)}`);
+            }
         }
         else {
             report = summarise(pm, [], [], `Security audit is not yet supported for the '${pm}' package manager — only bun is implemented.`);

package/dist/src/functions/commands/console.js

@@ -27,7 +27,7 @@ export const consoleCommand = pikkuSessionlessFunc({
             ...new Set([config.emailTemplatesDir, ...config.srcDirectories].filter(Boolean)),
         ];
         if (!config.scaffold?.console) {
-            logger.error('Console is not enabled. Add { "scaffold": { "console": "no-auth" } } to your pikku.config.json');
+            logger.error('Console is not enabled. Add { "scaffold": { "console": "auth" } } to your pikku.config.json (the console requires an authenticated session — set up Better Auth)');
             return;
         }
         const consoleDir = join(fileURLToPath(import.meta.url), '..', '..', '..', '..', '..', 'console-app');

package/dist/src/functions/commands/enable.js

@@ -4,7 +4,7 @@ import { pikkuVoidFunc } from '#pikku';
 const FEATURE_DEFAULTS = {
     rpc: 'auth',
     agent: 'auth',
-    console: 'no-auth',
+    console: 'auth',
     workflow: 'auth',
     events: 'auth',
     remoteRpc: 'no-auth',
@@ -20,9 +20,9 @@ async function enableFeature(feature, logger, config, data) {
     if (!json.scaffold.pikkuDir) {
         json.scaffold.pikkuDir = 'pikku';
     }
-    const value = noAuth
-        ? 'no-auth'
-        : FEATURE_DEFAULTS[feature];
+    // The console is an admin surface — every RPC requires a session, so it can
+    // never be scaffolded no-auth (the --no-auth flag is ignored for it).
+    const value = feature === 'console' ? 'auth' : noAuth ? 'no-auth' : FEATURE_DEFAULTS[feature];
     json.scaffold[feature] = value;
     await writeFile(configPath, JSON.stringify(json, null, 2) + '\n', 'utf-8');
     logger.info(`Enabled scaffold.${feature} = '${value}' in ${configPath}`);

package/dist/src/functions/validate/workspace-validate.js

@@ -97,7 +97,7 @@ export async function runWorkspaceValidate(startDir = process.cwd()) {
         }
         const scaffold = pikkuConfig.scaffold;
         if (!scaffold?.console) {
-            e('pikku-config-no-console-scaffold', 'pikku.config.json missing "scaffold.console" — Fabric cannot introspect the running app (console:getFunctionsMeta and friends 404), so the sandbox builder shows no functions', pikkuConfigPath, 'Add "console": "no-auth" under "scaffold" in pikku.config.json (use "auth" to require a session)');
+            e('pikku-config-no-console-scaffold', 'pikku.config.json missing "scaffold.console" — Fabric cannot introspect the running app (console:getFunctionsMeta and friends 404), so the sandbox builder shows no functions', pikkuConfigPath, 'Add "console": "auth" under "scaffold" in pikku.config.json — the console requires an authenticated session, so Better Auth must be set up (see the pikku-better-auth skill)');
         }
     }
     const rootPkgPath = join(root, 'package.json');

package/dist/src/functions/wirings/console/pikku-command-console-functions.js

@@ -2,6 +2,7 @@ import { pikkuSessionlessFunc } from '#pikku';
 import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
 import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
+import { projectDeclaresBetterAuth } from '../../../utils/detect-better-auth.js';
 import { serializeConsoleFunctions } from './serialize-console-functions.js';
 export const pikkuConsoleFunctions = pikkuSessionlessFunc({
     func: async ({ logger, config, variables }) => {
@@ -10,6 +11,18 @@ export const pikkuConsoleFunctions = pikkuSessionlessFunc({
             return false;
         }
         if (config.scaffold?.console) {
+            // Every console RPC now requires an authenticated session (the console is
+            // an admin surface), so scaffolding it without an auth strategy produces a
+            // console that 403s on every call. Better Auth is the supported strategy —
+            // fail fast rather than ship a dead console.
+            const hasBetterAuth = await projectDeclaresBetterAuth(config.rootDir, config.srcDirectories, config.ignoreFiles);
+            if (!hasBetterAuth) {
+                throw new Error(`"scaffold.console" is enabled but no pikkuBetterAuth(...) was found in the project.\n` +
+                    `The console addon requires an authenticated session on every RPC — a console without auth ` +
+                    `returns 403 on every call.\n` +
+                    `Fix: set up Better Auth (add a pikkuBetterAuth(...) config) before scaffolding the console, ` +
+                    `or remove "scaffold.console" from pikku.config.json.`);
+            }
             const pathToPikkuTypes = getFileImportRelativePath(config.consoleFunctionsFile, config.typesDeclarationFile, config.packageMappings);
             const pathToAgentTypes = getFileImportRelativePath(config.consoleFunctionsFile, config.agentTypesFile, config.packageMappings);
             await writeFileInDir(logger, config.consoleFunctionsFile, serializeConsoleFunctions(pathToPikkuTypes, pathToAgentTypes, config.globalHTTPPrefix || ''));

package/dist/src/functions/wirings/console/pikku-command-nodes-meta.js

@@ -34,7 +34,8 @@ export const pikkuNodesMeta = pikkuSessionlessFunc({
         const hasNodes = Object.keys(nodes.meta).length > 0;
         const hasSecrets = secrets.definitions.length > 0;
         const hasPackageMeta = !!addonMeta?.icon || !!addonMeta?.displayName;
-        if (!hasNodes && !hasSecrets && !hasPackageMeta) {
+        const hasParentServices = (state.addonRequiredParentServices?.length ?? 0) > 0;
+        if (!hasNodes && !hasSecrets && !hasPackageMeta && !hasParentServices) {
             return undefined;
         }
         const allowedCategories = addonMeta?.categories;
@@ -68,6 +69,9 @@ export const pikkuNodesMeta = pikkuSessionlessFunc({
         if (serverlessIncompatible && serverlessIncompatible.length > 0) {
             metaData.serverlessIncompatible = serverlessIncompatible;
         }
+        if (hasParentServices) {
+            metaData.requiredParentServices = state.addonRequiredParentServices;
+        }
         if (addonMetaJsonFile && (config.scaffold?.console || config.addon)) {
             const minimalMeta = stripVerboseFields(metaData);
             await writeFileInDir(logger, addonMetaJsonFile, JSON.stringify(minimalMeta, null, 2), { ignoreModifyComment: true });

package/dist/src/functions/wirings/console/serialize-console-functions.js

@@ -1,7 +1,7 @@
 export const serializeConsoleFunctions = (pathToPikkuTypes, _pathToAgentTypes, globalHTTPPrefix = '') => {
-    return `import { pikkuSessionlessFunc, defineHTTPRoutes, wireHTTPRoutes, ref, wireAddon } from '${pathToPikkuTypes}'
+    return `import { pikkuFunc, defineHTTPRoutes, wireHTTPRoutes, ref, wireAddon } from '${pathToPikkuTypes}'
 
-export const pikkuConsoleSetSecret = pikkuSessionlessFunc<{
+export const pikkuConsoleSetSecret = pikkuFunc<{
   secretId: string
   value: unknown
 }, {
@@ -10,21 +10,19 @@ export const pikkuConsoleSetSecret = pikkuSessionlessFunc<{
   tags: ['pikku'],
   description: 'Set the value of a secret',
   expose: true,
-  auth: false,
   func: async ({ secrets }, { secretId, value }) => {
     await secrets.setSecret(secretId, value)
     return { success: true }
   },
 })
 
-export const pikkuConsoleGetVariable = pikkuSessionlessFunc<
+export const pikkuConsoleGetVariable = pikkuFunc<
   { variableId: string },
   { exists: boolean; value: unknown | null }
 >({
   tags: ['pikku'],
   description: 'Get the current value of a variable',
   expose: true,
-  auth: false,
   func: async ({ variables }, { variableId }) => {
     const exists = await variables.has(variableId)
     if (!exists) {
@@ -40,14 +38,13 @@ export const pikkuConsoleGetVariable = pikkuSessionlessFunc<
   },
 })
 
-export const pikkuConsoleSetVariable = pikkuSessionlessFunc<
+export const pikkuConsoleSetVariable = pikkuFunc<
   { variableId: string; value: unknown },
   { success: boolean }
 >({
   tags: ['pikku'],
   description: 'Set the value of a variable',
   expose: true,
-  auth: false,
   func: async ({ variables }, { variableId, value }) => {
     if (typeof value === 'string') {
       await variables.set(variableId, value)
@@ -58,28 +55,26 @@ export const pikkuConsoleSetVariable = pikkuSessionlessFunc<
   },
 })
 
-export const pikkuConsoleHasSecret = pikkuSessionlessFunc<
+export const pikkuConsoleHasSecret = pikkuFunc<
   { secretId: string },
   { exists: boolean }
 >({
   tags: ['pikku'],
   description: 'Check if a secret exists without reading its value',
   expose: true,
-  auth: false,
   func: async ({ secrets }, { secretId }) => {
     const exists = await secrets.hasSecret(secretId)
     return { exists }
   },
 })
 
-export const pikkuConsoleGetSecret = pikkuSessionlessFunc<
+export const pikkuConsoleGetSecret = pikkuFunc<
   { secretId: string },
   { exists: boolean; value: unknown | null }
 >({
   tags: ['pikku'],
   description: 'Get the current value of a secret',
   expose: true,
-  auth: false,
   func: async ({ secrets }, { secretId }) => {
     const exists = await secrets.hasSecret(secretId)
     if (!exists) {

package/dist/src/functions/wirings/functions/pikku-command-functions.js

@@ -3,13 +3,15 @@ import { writeFileInDir } from '../../../utils/file-writer.js';
 import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-time.js';
 import { serializeFunctionImports } from './serialize-function-imports.js';
 import { getFileImportRelativePath } from '../../../utils/file-import-path.js';
-import { stripVerboseFields, hasVerboseFields, } from '../../../utils/strip-verbose-meta.js';
+import { stripVerboseFields, hasVerboseFields, reattachFunctionServices, } from '../../../utils/strip-verbose-meta.js';
 export const pikkuFunctions = pikkuSessionlessFunc({
     func: async ({ logger, config, getInspectorState }) => {
         const { functions, rpc } = await getInspectorState();
         const { functionsMetaFile, functionsMetaJsonFile, functionsFile, packageMappings, schema, } = config;
-        // Write minimal JSON (runtime-only fields)
-        const minimalMeta = stripVerboseFields(functions.meta);
+        let minimalMeta = stripVerboseFields(functions.meta);
+        if (config.addonName) {
+            minimalMeta = reattachFunctionServices(minimalMeta, functions.meta);
+        }
         await writeFileInDir(logger, functionsMetaJsonFile, JSON.stringify(minimalMeta, null, 2));
         // Write verbose JSON only if it has additional fields
         if (hasVerboseFields(functions.meta)) {

package/dist/src/functions/workflows/all.workflow.js

@@ -1,6 +1,7 @@
 import { existsSync } from 'fs';
 import { pikkuWorkflowComplexFunc } from '#pikku/workflow/pikku-workflow-types.gen.js';
 import { assertSingleCoreVersion } from '../../utils/assert-single-core-version.js';
+import { PikkuTypecheckFailedError, renderTscFull, renderTscSummary, runProjectTypecheck, } from '../../utils/tsc-check.js';
 const scaffoldFiles = (config) => {
     const files = [];
     if (config.scaffold?.rpc && config.publicRpcFile)
@@ -272,5 +273,21 @@ export const allWorkflow = pikkuWorkflowComplexFunc({
         await workflow.do('Versions update', 'pikkuVersionsUpdate', null);
         await workflow.do('Bootstrap', 'pikkuBootstrap', { allImports });
         await workflow.do('Summary', 'pikkuSummary', null);
+        // Opt-in type-check gate (--tsc / --tsc-summary). Runs last, over the
+        // post-codegen project, so generated .pikku files are included — matching a
+        // real build. Printed inside the step; the throw lives in the workflow body
+        // (like assertSingleCoreVersion) so it reliably fails the run.
+        if (config.tsc || config.tscSummary) {
+            const errorCount = await workflow.do('Type check', async () => {
+                const { result, diagnostics, formatHost } = runProjectTypecheck(config.tsconfig, config.rootDir);
+                logger.info(config.tsc
+                    ? renderTscFull(diagnostics, config.rootDir, formatHost)
+                    : renderTscSummary(result));
+                return result.errorCount;
+            });
+            if (errorCount > 0) {
+                throw new PikkuTypecheckFailedError(`Type check failed: ${errorCount} error${errorCount === 1 ? '' : 's'}`);
+            }
+        }
     },
 });

package/dist/src/utils/strip-verbose-meta.d.ts

@@ -29,6 +29,9 @@
  * Also strips addon namespace prefixes from pikkuFuncId values where packageName is present.
  */
 export declare function stripVerboseFields<T>(obj: T): T;
+export declare function reattachFunctionServices<T extends Record<string, {
+    services?: unknown;
+}>>(minimalMeta: T, fullMeta: T): T;
 /**
  * Check if an object has any verbose fields that would be stripped
  */

package/dist/src/utils/strip-verbose-meta.js

@@ -179,6 +179,14 @@ function _stripVerboseFieldsInner(obj) {
     }
     return result;
 }
+export function reattachFunctionServices(minimalMeta, fullMeta) {
+    for (const [id, meta] of Object.entries(fullMeta)) {
+        if (meta?.services && minimalMeta[id]) {
+            minimalMeta[id].services = meta.services;
+        }
+    }
+    return minimalMeta;
+}
 /**
  * Check if an object has any verbose fields that would be stripped
  */

package/dist/src/utils/tsc-check.d.ts

@@ -0,0 +1,46 @@
+import ts from 'typescript';
+import { PikkuError } from '@pikku/core';
+export declare class PikkuTypecheckFailedError extends PikkuError {
+}
+export interface TscDiagnostic {
+    file: string;
+    line: number;
+    column: number;
+    code: number;
+    category: 'error' | 'warning' | 'suggestion' | 'message';
+    message: string;
+}
+export interface TscCheckResult {
+    errorCount: number;
+    warningCount: number;
+    fileCount: number;
+    diagnostics: TscDiagnostic[];
+}
+/**
+ * Turn raw tsc diagnostics into a filtered, structured result. Pure — it takes
+ * already-computed diagnostics so it can be unit-tested without a program.
+ * Anything under node_modules or outside the project root is dropped so the
+ * output stays focused on the user's own code (and not lib .d.ts noise).
+ */
+export declare const collectTscDiagnostics: (diagnostics: readonly ts.Diagnostic[], rootDir: string) => TscCheckResult;
+/**
+ * Compact, token-frugal render of a type-check result: a one-line header plus
+ * one line per diagnostic (no code frames), capped. Used by `--tsc-summary` so
+ * AI agents and CI logs get the signal without the flood.
+ */
+export declare const renderTscSummary: (result: TscCheckResult, maxLines?: number) => string;
+/**
+ * Full render: tsc's own formatter with code frames, filtered to project files.
+ */
+export declare const renderTscFull: (diagnostics: readonly ts.Diagnostic[], rootDir: string, formatHost: ts.FormatDiagnosticsHost) => string;
+/**
+ * Run a real `tsc --noEmit` over the project's own tsconfig — the correct
+ * source of truth (lib, paths, strict), unlike the inspector's stripped-down
+ * traversal program. Returns both a structured result and the raw diagnostics
+ * so the caller can pick the compact (`--tsc-summary`) or full (`--tsc`) render.
+ */
+export declare const runProjectTypecheck: (tsconfigPath: string, rootDir: string) => {
+    result: TscCheckResult;
+    diagnostics: ts.Diagnostic[];
+    formatHost: ts.FormatDiagnosticsHost;
+};

package/dist/src/utils/tsc-check.js

@@ -0,0 +1,141 @@
+import ts from 'typescript';
+import { dirname, isAbsolute, relative } from 'node:path';
+import { PikkuError } from '@pikku/core';
+// A type-check failure is expected (the --tsc gate did its job) — throw a
+// PikkuError so the runner logs the message alone, not a stack trace.
+export class PikkuTypecheckFailedError extends PikkuError {
+}
+const CATEGORY = {
+    [ts.DiagnosticCategory.Error]: 'error',
+    [ts.DiagnosticCategory.Warning]: 'warning',
+    [ts.DiagnosticCategory.Suggestion]: 'suggestion',
+    [ts.DiagnosticCategory.Message]: 'message',
+};
+const MAX_MESSAGE_LENGTH = 200;
+const DEFAULT_MAX_LINES = 50;
+const NO_FILE = '(project)';
+const isProjectFile = (fileName, rootDir) => {
+    if (fileName.includes('/node_modules/'))
+        return false;
+    const rel = relative(rootDir, fileName);
+    return !rel.startsWith('..') && !isAbsolute(rel);
+};
+/**
+ * Turn raw tsc diagnostics into a filtered, structured result. Pure — it takes
+ * already-computed diagnostics so it can be unit-tested without a program.
+ * Anything under node_modules or outside the project root is dropped so the
+ * output stays focused on the user's own code (and not lib .d.ts noise).
+ */
+export const collectTscDiagnostics = (diagnostics, rootDir) => {
+    const files = new Set();
+    const collected = [];
+    let errorCount = 0;
+    let warningCount = 0;
+    for (const d of diagnostics) {
+        let file = NO_FILE;
+        let line = 0;
+        let column = 0;
+        if (d.file) {
+            if (!isProjectFile(d.file.fileName, rootDir))
+                continue;
+            file = relative(rootDir, d.file.fileName);
+            const lc = d.file.getLineAndCharacterOfPosition(d.start ?? 0);
+            line = lc.line + 1;
+            column = lc.character + 1;
+        }
+        const category = CATEGORY[d.category];
+        if (category === 'error')
+            errorCount++;
+        else if (category === 'warning')
+            warningCount++;
+        let message = ts.flattenDiagnosticMessageText(d.messageText, ' ');
+        if (message.length > MAX_MESSAGE_LENGTH) {
+            message = `${message.slice(0, MAX_MESSAGE_LENGTH - 1)}…`;
+        }
+        files.add(file);
+        collected.push({ file, line, column, code: d.code, category, message });
+    }
+    collected.sort((a, b) => a.file === b.file ? a.line - b.line : a.file < b.file ? -1 : 1);
+    return {
+        errorCount,
+        warningCount,
+        fileCount: files.size,
+        diagnostics: collected,
+    };
+};
+/**
+ * Compact, token-frugal render of a type-check result: a one-line header plus
+ * one line per diagnostic (no code frames), capped. Used by `--tsc-summary` so
+ * AI agents and CI logs get the signal without the flood.
+ */
+export const renderTscSummary = (result, maxLines = DEFAULT_MAX_LINES) => {
+    if (result.errorCount === 0 && result.warningCount === 0) {
+        return 'Type check passed — no errors.';
+    }
+    const counts = [];
+    if (result.errorCount > 0) {
+        counts.push(`${result.errorCount} error${result.errorCount === 1 ? '' : 's'}`);
+    }
+    if (result.warningCount > 0) {
+        counts.push(`${result.warningCount} warning${result.warningCount === 1 ? '' : 's'}`);
+    }
+    const fileLabel = `${result.fileCount} file${result.fileCount === 1 ? '' : 's'}`;
+    const lines = [`Type check: ${counts.join(', ')} in ${fileLabel}`];
+    const shown = result.diagnostics.slice(0, maxLines);
+    for (const d of shown) {
+        const at = d.line > 0 ? `${d.file}:${d.line}:${d.column}` : d.file;
+        lines.push(`  ${at}  TS${d.code}  ${d.message}`);
+    }
+    const remaining = result.diagnostics.length - shown.length;
+    if (remaining > 0) {
+        lines.push(`  … and ${remaining} more (run \`pikku all --tsc\` for full output)`);
+    }
+    return lines.join('\n');
+};
+/**
+ * Full render: tsc's own formatter with code frames, filtered to project files.
+ */
+export const renderTscFull = (diagnostics, rootDir, formatHost) => {
+    const filtered = diagnostics.filter((d) => !d.file || isProjectFile(d.file.fileName, rootDir));
+    if (filtered.length === 0)
+        return 'Type check passed — no errors.';
+    return ts.formatDiagnosticsWithColorAndContext(filtered, formatHost);
+};
+/**
+ * Run a real `tsc --noEmit` over the project's own tsconfig — the correct
+ * source of truth (lib, paths, strict), unlike the inspector's stripped-down
+ * traversal program. Returns both a structured result and the raw diagnostics
+ * so the caller can pick the compact (`--tsc-summary`) or full (`--tsc`) render.
+ */
+export const runProjectTypecheck = (tsconfigPath, rootDir) => {
+    const formatHost = {
+        getCanonicalFileName: (f) => f,
+        getCurrentDirectory: () => rootDir,
+        getNewLine: () => ts.sys.newLine,
+    };
+    const configFile = ts.readConfigFile(tsconfigPath, ts.sys.readFile);
+    if (configFile.error) {
+        const diagnostics = [configFile.error];
+        return {
+            result: collectTscDiagnostics(diagnostics, rootDir),
+            diagnostics,
+            formatHost,
+        };
+    }
+    const parsed = ts.parseJsonConfigFileContent(configFile.config, ts.sys, dirname(tsconfigPath));
+    const program = ts.createProgram({
+        rootNames: parsed.fileNames,
+        options: {
+            ...parsed.options,
+            noEmit: true,
+            incremental: false,
+            tsBuildInfoFile: undefined,
+        },
+    });
+    const diagnostics = [...parsed.errors, ...ts.getPreEmitDiagnostics(program)];
+    return {
+        result: collectTscDiagnostics(diagnostics, rootDir),
+        diagnostics,
+        formatHost,
+    };
+};