@pikku/cli 0.12.67 → 0.12.68

package/dist/.pikku/schemas/schemas/PikkuCLIConfig.schema.json

@@ -1 +1 @@
-{ "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "additionalProperties": false, "properties": { "configFile": { "type": "string" }, "tags": { "type": "array", "items": { "type": "string" } }, "wires": { "type": "array", "items": { "type": "string" } }, "excludeWires": { "type": "array", "items": { "type": "string" } }, "userSessionType": { "type": "string" }, "singletonServicesFactoryType": { "type": "string" }, "wireServicesFactoryType": { "type": "string" }, "outDir": { "type": "string" }, "schemaDirectory": { "type": "string" }, "typesDeclarationFile": { "type": "string" }, "functionsFile": { "type": "string" }, "functionsMetaFile": { "type": "string" }, "functionsMetaJsonFile": { "type": "string" }, "functionTypesFile": { "type": "string" }, "httpWiringsFile": { "type": "string" }, "httpWiringMetaFile": { "type": "string" }, "httpWiringMetaJsonFile": { "type": "string" }, "httpContractsMetaJsonFile": { "type": "string" }, "httpContractsMetaFile": { "type": "string" }, "httpMapDeclarationFile": { "type": "string" }, "httpTypesFile": { "type": "string" }, "gatewaysWiringFile": { "type": "string" }, "gatewaysWiringMetaFile": { "type": "string" }, "gatewaysWiringMetaJsonFile": { "type": "string" }, "channelsWiringFile": { "type": "string" }, "channelsWiringMetaFile": { "type": "string" }, "channelsWiringMetaJsonFile": { "type": "string" }, "channelContractsMetaJsonFile": { "type": "string" }, "channelContractsMetaFile": { "type": "string" }, "channelsMapDeclarationFile": { "type": "string" }, "channelsTypesFile": { "type": "string" }, "rpcInternalWiringMetaFile": { "type": "string" }, "rpcInternalWiringMetaJsonFile": { "type": "string" }, "rpcInternalMapDeclarationFile": { "type": "string" }, "rpcMapDeclarationFile": { "type": "string" }, "remoteRpcWorkersFile": { "type": "string" }, "publicRpcFile": { "type": "string" }, "publicAgentFile": { "type": "string" }, "consoleFunctionsFile": { "type": "string" }, "workflowRoutesFile": { "type": "string" }, "eventsChannelFile": { "type": "string" }, "triggersTypesFile": { "type": "string" }, "triggersWiringFile": { "type": "string" }, "triggersWiringMetaFile": { "type": "string" }, "triggersWiringMetaJsonFile": { "type": "string" }, "triggerSourcesMetaFile": { "type": "string" }, "triggerSourcesMetaJsonFile": { "type": "string" }, "schedulersWiringFile": { "type": "string" }, "schedulersWiringMetaFile": { "type": "string" }, "schedulersWiringMetaJsonFile": { "type": "string" }, "schedulersTypesFile": { "type": "string" }, "queueWorkersWiringFile": { "type": "string" }, "queueWorkersWiringMetaFile": { "type": "string" }, "queueWorkersWiringMetaJsonFile": { "type": "string" }, "queueMapDeclarationFile": { "type": "string" }, "queueTypesFile": { "type": "string" }, "workflowsWiringFile": { "type": "string" }, "workflowsWiringMetaFile": { "type": "string" }, "workflowsWorkersFile": { "type": "string" }, "workflowMapDeclarationFile": { "type": "string" }, "workflowTypesFile": { "type": "string" }, "workflowMetaDir": { "type": "string" }, "userFlowActorsFile": { "type": "string" }, "mcpWiringsFile": { "type": "string" }, "mcpWiringsMetaFile": { "type": "string" }, "mcpWiringsMetaJsonFile": { "type": "string" }, "mcpTypesFile": { "type": "string" }, "mcpJsonFile": { "type": "string" }, "agentWiringsFile": { "type": "string" }, "agentWiringMetaFile": { "type": "string" }, "agentWiringMetaJsonFile": { "type": "string" }, "agentTypesFile": { "type": "string" }, "agentMapDeclarationFile": { "type": "string" }, "cliWiringsFile": { "type": "string" }, "cliWiringMetaFile": { "type": "string" }, "cliWiringMetaJsonFile": { "type": "string" }, "cliContractsMetaJsonFile": { "type": "string" }, "cliContractsMetaFile": { "type": "string" }, "cliBootstrapFile": { "type": "string" }, "cliTypesFile": { "type": "string" }, "servicesFile": { "type": "string" }, "middlewareFile": { "type": "string" }, "middlewareGroupsMetaJsonFile": { "type": "string" }, "permissionsFile": { "type": "string" }, "permissionsGroupsMetaJsonFile": { "type": "string" }, "bootstrapFile": { "type": "string" }, "packageFile": { "type": "string" }, "addonTypesFile": { "type": "string" }, "nodeTypesFile": { "type": "string" }, "secretTypesFile": { "type": "string" }, "secretsFile": { "type": "string" }, "secretsMetaJsonFile": { "type": "string" }, "credentialsFile": { "type": "string" }, "credentialsMetaJsonFile": { "type": "string" }, "variableTypesFile": { "type": "string" }, "variablesFile": { "type": "string" }, "variablesMetaJsonFile": { "type": "string" }, "$schema": { "type": "string" }, "extends": { "type": "string" }, "rootDir": { "type": "string" }, "runtimeDir": { "type": "string", "description": "Runtime artifacts directory (dev.db, content, tmp). Resolved relative to rootDir. Defaults to <rootDir>/.pikku-runtime." }, "srcDirectories": { "type": "array", "items": { "type": "string" } }, "ignoreFiles": { "type": "array", "items": { "type": "string" } }, "packageMappings": { "type": "object", "additionalProperties": { "type": "string" } }, "addon": { "anyOf": [{ "type": "boolean" }, { "type": "object", "properties": { "categories": { "type": "array", "items": { "type": "string" } }, "icon": { "type": "string" }, "displayName": { "type": "string" }, "description": { "type": "string" }, "serverlessIncompatible": { "type": "array", "items": { "type": "string" } }, "openapi": { "type": "object", "properties": { "version": { "type": "string" }, "hash": { "type": "string" } }, "required": ["version", "hash"], "additionalProperties": false } }, "additionalProperties": false }] }, "addonName": { "type": "string" }, "configDir": { "type": "string" }, "tsconfig": { "type": "string" }, "clientFiles": { "type": "object", "properties": { "fetchFile": { "type": "string" }, "websocketFile": { "type": "string" }, "rpcWiringsFile": { "type": "string" }, "reactQueryFile": { "type": "string" }, "realtimeFile": { "type": "string" }, "realtimeEventHubTopicsImport": { "type": "string", "description": "Optional import for the EventHubTopics type so the realtime client is fully typed. Format: `<path>#<TypeName>` resolved relative to `realtimeFile`. Example: `../types/eventhub-topics.js#EventHubTopics`. If unset, the generated client treats topics as `Record<string, unknown>`." }, "queueWiringsFile": { "type": "string" }, "mcpJsonFile": { "type": "string" }, "nextBackendFile": { "type": "string" }, "nextHTTPFile": { "type": "string" }, "nextBackendTransport": { "type": "string", "enum": ["local", "worker-rpc", "http"], "description": "Transport used by the generated nextBackendFile wrapper.\n- `'local'` (default): function code is loaded in-process via bootstrap +   createSingletonServices. Required for Node/dev runs.\n- `'worker-rpc'`: SSR dispatches every call through an injected `Fetcher`   ({ fetch(req): Promise<Response> }). Function code is NOT bundled into   the SSR worker. Pair with `nextBackendFetcherImport` to point at your   resolver module.\n- `'http'`: SSR dispatches every call through the generated `PikkuFetch`   client. Use this when your Next app should call a separately running   local/server API instead of importing function code in-process." }, "nextBackendFetcherImport": { "type": "string", "description": "Module that exports a `fetcher: Fetcher` (or default export) used by the worker-RPC variant of the next backend wrapper. Resolved relative to `nextBackendFile`. Required when `nextBackendTransport === 'worker-rpc'`." }, "startServerFnsFile": { "type": "string", "description": "Emit a TanStack Start server-function shim into this file. The shim exports `makeApi(): PikkuRPC` — a typed caller over the generated RPC map for use in Start loaders, actions and components. It reads the API base URL from `import.meta.env.VITE_API_URL` (throws if unset). Requires `rpcWiringsFile` (where the `PikkuRPC` class is generated)." } }, "additionalProperties": false }, "emailTemplatesDir": { "type": "string", "description": "Directory containing email templates, locales, partials, and theme.json." }, "authFile": { "type": "string", "description": "Path to write the generated Better Auth wiring file (auth.gen.ts). Must be within srcDirectories so wireSecret calls are picked up by the inspector. Example: \"src/auth.gen.ts\"" }, "authTypesFile": { "type": "string", "description": "Path to write the generated typed `pikkuBetterAuth` re-export (auth.types.ts). Defaults to `{outDir}/auth/auth.types.ts`. Re-exported from `#pikku` so user code can `import { pikkuBetterAuth } from '#pikku'` with project-typed services." }, "authMetaJsonFile": { "type": "string", "description": "Path to write the generated Better Auth metadata (auth-meta.gen.json) — the enabled social providers and plugins the console SSO page reads via getAuthProviders. Defaults to `{outDir}/auth/pikku-auth-meta.gen.json`." }, "openAPI": { "type": "object", "properties": { "outputFile": { "type": "string" }, "additionalInfo": { "$ref": "#/definitions/OpenAPISpecInfo" } }, "required": ["outputFile", "additionalInfo"], "additionalProperties": false }, "schema": { "type": "object", "properties": { "additionalProperties": { "type": "boolean" }, "supportsImportAttributes": { "type": "boolean" } }, "additionalProperties": false }, "db": { "type": "object", "properties": { "engine": { "type": "string", "enum": ["sqlite", "postgres"] }, "pgVersion": { "type": "number" } }, "additionalProperties": false }, "cli": { "type": "object", "properties": { "entrypoints": { "type": "object", "additionalProperties": { "anyOf": [{ "type": "string" }, { "type": "object", "properties": { "type": { "type": "string", "const": "local" }, "path": { "type": "string" } }, "required": ["type", "path"], "additionalProperties": false }, { "type": "object", "properties": { "type": { "type": "string", "const": "channel" }, "name": { "type": "string" }, "route": { "type": "string" }, "wirePath": { "type": "string" }, "path": { "type": "string" } }, "required": ["type", "wirePath"], "additionalProperties": false }, { "type": "array", "items": { "anyOf": [{ "type": "string" }, { "type": "object", "properties": { "type": { "type": "string", "const": "local" }, "path": { "type": "string" } }, "required": ["type", "path"], "additionalProperties": false }, { "type": "object", "properties": { "type": { "type": "string", "const": "channel" }, "name": { "type": "string" }, "route": { "type": "string" }, "wirePath": { "type": "string" }, "path": { "type": "string" } }, "required": ["type", "wirePath"], "additionalProperties": false }] } }] } } }, "additionalProperties": false }, "workflows": { "type": "object", "properties": { "orchestratorQueue": { "type": "string" }, "workerQueue": { "type": "string" } }, "additionalProperties": false }, "userFlows": { "type": "object", "properties": { "actors": { "type": "object", "additionalProperties": { "type": "object", "properties": { "email": { "type": "string" }, "name": { "type": "string" }, "jobTitle": { "type": "string" }, "personality": { "type": "string" } }, "required": ["email"], "additionalProperties": false }, "description": "Global user-flow actor registry — any user flow can impersonate any actor. Generates a typed `createUserFlowActors` factory (see `userFlowActorsFile`) and surfaces the personas in the console." }, "environments": { "type": "object", "additionalProperties": { "type": "object", "properties": { "apiUrl": { "type": "string" }, "signInPath": { "type": "string", "description": "Actor sign-in path under apiUrl. Default: /auth/sign-in/actor" }, "rpcPath": { "type": "string", "description": "Exposed-RPC prefix under apiUrl. Default: /rpc" } }, "required": ["apiUrl"], "additionalProperties": false }, "description": "Environments `pikku userflow run <environment>` can target. `apiUrl` includes the HTTP prefix (e.g. https://app.example.com/api). The actor secret is NEVER configured here — it comes from the USER_FLOW_ACTOR_SECRET environment variable at run time." } }, "additionalProperties": false }, "scaffold": { "type": "object", "properties": { "addonDir": { "type": "string" }, "functionDir": { "type": "string" }, "wiringDir": { "type": "string" }, "middlewareDir": { "type": "string" }, "permissionDir": { "type": "string" }, "pikkuDir": { "type": "string" }, "rpc": { "$ref": "#/definitions/PikkuScaffoldFeature" }, "console": { "$ref": "#/definitions/PikkuScaffoldFeature" }, "agent": { "$ref": "#/definitions/PikkuScaffoldFeature" }, "workflow": { "$ref": "#/definitions/PikkuScaffoldFeature" }, "events": { "$ref": "#/definitions/PikkuScaffoldFeature" }, "remoteRpc": { "$ref": "#/definitions/PikkuScaffoldFeature" } }, "additionalProperties": false }, "addons": { "type": "object", "properties": { "addonDir": { "type": "string" } }, "additionalProperties": false, "description": "Community-registry addons installed via `pikku fabric addon add`. The source is copied into the project shadcn-style; each lands in `<addonDir>/<name>/` and the dir is registered as a yarn workspace so `wireAddon({ package })` resolves it by name. `addonDir` defaults to `addons` (top-level, outside the app's TS scan). Install provenance is tracked in pikku-addons.json." }, "tests": { "type": "object", "properties": { "outputDir": { "type": "string" } }, "additionalProperties": false }, "forceRequiredServices": { "type": "array", "items": { "type": "string" } }, "schemasFromTypes": { "type": "array", "items": { "type": "string" } }, "stateOutput": { "type": "string" }, "stateInput": { "type": "string" }, "verboseMeta": { "type": "boolean" }, "security": { "type": "boolean", "description": "Run the data-classification security lint (scans function return types for Private/Pii/Secret leaks). Off by default — it forces expensive return-type inference on every function and is not part of codegen. Enable here to always run it, or per-invocation via `pikku all --security`. Pair with `failOnError` to gate a build/CI on leaks." }, "lint": { "type": "object", "properties": { "servicesNotDestructured": { "type": "string", "enum": ["off", "warn", "error"] }, "wiresNotDestructured": { "type": "string", "enum": ["off", "warn", "error"] } }, "additionalProperties": false }, "addonMetaJsonFile": { "type": "string" }, "globalHTTPPrefix": { "type": "string" }, "binary": { "type": "object", "properties": { "entrypoint": { "type": "string" }, "output": { "type": "string" }, "targets": { "type": "array", "items": { "type": "string" } } }, "required": ["entrypoint", "output"], "additionalProperties": false }, "deploy": { "type": "object", "properties": { "providers": { "type": "object", "additionalProperties": { "type": "string" } }, "defaultProvider": { "type": "string" }, "serverlessIncompatible": { "type": "array", "items": { "type": "string" } }, "defaultTarget": { "type": "string", "enum": ["serverless", "server"], "description": "Default deploy target for functions that don't declare an explicit `deploy` flag and don't use a serverless-incompatible service. Defaults to 'serverless'." } }, "required": ["providers"], "additionalProperties": false }, "namedFilters": { "type": "object", "additionalProperties": { "$ref": "#/definitions/InspectorFilters" }, "description": "Named filter presets keyed by name, used via CLI --filter <name>." }, "filters": { "$ref": "#/definitions/InspectorFilters" } }, "required": ["addonTypesFile", "agentMapDeclarationFile", "agentTypesFile", "agentWiringMetaFile", "agentWiringMetaJsonFile", "agentWiringsFile", "bootstrapFile", "channelContractsMetaFile", "channelContractsMetaJsonFile", "channelsMapDeclarationFile", "channelsTypesFile", "channelsWiringFile", "channelsWiringMetaFile", "channelsWiringMetaJsonFile", "cliBootstrapFile", "cliContractsMetaFile", "cliContractsMetaJsonFile", "cliTypesFile", "cliWiringMetaFile", "cliWiringMetaJsonFile", "cliWiringsFile", "configDir", "consoleFunctionsFile", "credentialsFile", "credentialsMetaJsonFile", "eventsChannelFile", "filters", "functionTypesFile", "functionsFile", "functionsMetaFile", "functionsMetaJsonFile", "gatewaysWiringFile", "gatewaysWiringMetaFile", "gatewaysWiringMetaJsonFile", "httpContractsMetaFile", "httpContractsMetaJsonFile", "httpMapDeclarationFile", "httpTypesFile", "httpWiringMetaFile", "httpWiringMetaJsonFile", "httpWiringsFile", "mcpJsonFile", "mcpTypesFile", "mcpWiringsFile", "mcpWiringsMetaFile", "mcpWiringsMetaJsonFile", "middlewareFile", "middlewareGroupsMetaJsonFile", "nodeTypesFile", "outDir", "packageFile", "packageMappings", "permissionsFile", "permissionsGroupsMetaJsonFile", "publicAgentFile", "publicRpcFile", "queueMapDeclarationFile", "queueTypesFile", "queueWorkersWiringFile", "queueWorkersWiringMetaFile", "queueWorkersWiringMetaJsonFile", "rootDir", "rpcInternalMapDeclarationFile", "rpcInternalWiringMetaFile", "rpcInternalWiringMetaJsonFile", "rpcMapDeclarationFile", "schedulersTypesFile", "schedulersWiringFile", "schedulersWiringMetaFile", "schedulersWiringMetaJsonFile", "schemaDirectory", "secretTypesFile", "secretsFile", "secretsMetaJsonFile", "servicesFile", "srcDirectories", "triggerSourcesMetaFile", "triggerSourcesMetaJsonFile", "triggersTypesFile", "triggersWiringFile", "triggersWiringMetaFile", "triggersWiringMetaJsonFile", "tsconfig", "typesDeclarationFile", "userFlowActorsFile", "variableTypesFile", "variablesFile", "variablesMetaJsonFile", "workflowMapDeclarationFile", "workflowMetaDir", "workflowRoutesFile", "workflowTypesFile", "workflowsWiringFile", "workflowsWiringMetaFile", "workflowsWorkersFile"], "definitions": { "OpenAPISpecInfo": { "type": "object", "properties": { "info": { "type": "object", "properties": { "title": { "type": "string" }, "version": { "type": "string" }, "description": { "type": "string" }, "termsOfService": { "type": "string" }, "contact": { "type": "object", "properties": { "name": { "type": "string" }, "url": { "type": "string" }, "email": { "type": "string" } }, "additionalProperties": false }, "license": { "type": "object", "properties": { "name": { "type": "string" }, "url": { "type": "string" } }, "required": ["name"], "additionalProperties": false } }, "required": ["title", "version", "description"], "additionalProperties": false }, "servers": { "type": "array", "items": { "type": "object", "properties": { "url": { "type": "string" }, "description": { "type": "string" } }, "required": ["url"], "additionalProperties": false } }, "tags": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "description": { "type": "string" } }, "required": ["name"], "additionalProperties": false } }, "externalDocs": { "type": "object", "properties": { "description": { "type": "string" }, "url": { "type": "string" } }, "required": ["url"], "additionalProperties": false }, "securitySchemes": { "type": "object" }, "security": { "type": "array", "items": { "type": "object", "additionalProperties": { "type": "array", "items": {} } } } }, "required": ["info", "servers"], "additionalProperties": false }, "PikkuScaffoldFeature": { "type": ["string", "boolean"], "enum": ["auth", "no-auth", false] }, "InspectorFilters": { "type": "object", "properties": { "names": { "type": "array", "items": { "type": "string" } }, "tags": { "type": "array", "items": { "type": "string" } }, "wires": { "type": "array", "items": { "type": "string" } }, "directories": { "type": "array", "items": { "type": "string" } }, "httpRoutes": { "type": "array", "items": { "type": "string" } }, "httpMethods": { "type": "array", "items": { "type": "string" } }, "excludeNames": { "type": "array", "items": { "type": "string" } }, "excludeTags": { "type": "array", "items": { "type": "string" } }, "excludeWires": { "type": "array", "items": { "type": "string" } }, "excludeDirectories": { "type": "array", "items": { "type": "string" } }, "excludeHttpRoutes": { "type": "array", "items": { "type": "string" } }, "excludeHttpMethods": { "type": "array", "items": { "type": "string" } }, "target": { "type": "array", "items": { "type": "string", "enum": ["serverless", "server"] } }, "excludeTarget": { "type": "array", "items": { "type": "string", "enum": ["serverless", "server"] } }, "serverlessIncompatible": { "type": "array", "items": { "type": "string" } }, "defaultTarget": { "type": "string", "enum": ["serverless", "server"] } }, "additionalProperties": false } } }
+{ "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "additionalProperties": false, "properties": { "configFile": { "type": "string" }, "tags": { "type": "array", "items": { "type": "string" } }, "wires": { "type": "array", "items": { "type": "string" } }, "excludeWires": { "type": "array", "items": { "type": "string" } }, "userSessionType": { "type": "string" }, "singletonServicesFactoryType": { "type": "string" }, "wireServicesFactoryType": { "type": "string" }, "outDir": { "type": "string" }, "schemaDirectory": { "type": "string" }, "typesDeclarationFile": { "type": "string" }, "functionsFile": { "type": "string" }, "functionsMetaFile": { "type": "string" }, "functionsMetaJsonFile": { "type": "string" }, "functionTypesFile": { "type": "string" }, "httpWiringsFile": { "type": "string" }, "httpWiringMetaFile": { "type": "string" }, "httpWiringMetaJsonFile": { "type": "string" }, "httpContractsMetaJsonFile": { "type": "string" }, "httpContractsMetaFile": { "type": "string" }, "httpMapDeclarationFile": { "type": "string" }, "httpTypesFile": { "type": "string" }, "gatewaysWiringFile": { "type": "string" }, "gatewaysWiringMetaFile": { "type": "string" }, "gatewaysWiringMetaJsonFile": { "type": "string" }, "channelsWiringFile": { "type": "string" }, "channelsWiringMetaFile": { "type": "string" }, "channelsWiringMetaJsonFile": { "type": "string" }, "channelContractsMetaJsonFile": { "type": "string" }, "channelContractsMetaFile": { "type": "string" }, "channelsMapDeclarationFile": { "type": "string" }, "channelsTypesFile": { "type": "string" }, "rpcInternalWiringMetaFile": { "type": "string" }, "rpcInternalWiringMetaJsonFile": { "type": "string" }, "rpcInternalMapDeclarationFile": { "type": "string" }, "rpcMapDeclarationFile": { "type": "string" }, "remoteRpcWorkersFile": { "type": "string" }, "publicRpcFile": { "type": "string" }, "publicAgentFile": { "type": "string" }, "consoleFunctionsFile": { "type": "string" }, "workflowRoutesFile": { "type": "string" }, "eventsChannelFile": { "type": "string" }, "triggersTypesFile": { "type": "string" }, "triggersWiringFile": { "type": "string" }, "triggersWiringMetaFile": { "type": "string" }, "triggersWiringMetaJsonFile": { "type": "string" }, "triggerSourcesMetaFile": { "type": "string" }, "triggerSourcesMetaJsonFile": { "type": "string" }, "schedulersWiringFile": { "type": "string" }, "schedulersWiringMetaFile": { "type": "string" }, "schedulersWiringMetaJsonFile": { "type": "string" }, "schedulersTypesFile": { "type": "string" }, "queueWorkersWiringFile": { "type": "string" }, "queueWorkersWiringMetaFile": { "type": "string" }, "queueWorkersWiringMetaJsonFile": { "type": "string" }, "queueMapDeclarationFile": { "type": "string" }, "queueTypesFile": { "type": "string" }, "workflowsWiringFile": { "type": "string" }, "workflowsWiringMetaFile": { "type": "string" }, "workflowsWorkersFile": { "type": "string" }, "workflowMapDeclarationFile": { "type": "string" }, "workflowTypesFile": { "type": "string" }, "workflowMetaDir": { "type": "string" }, "userFlowActorsFile": { "type": "string" }, "mcpWiringsFile": { "type": "string" }, "mcpWiringsMetaFile": { "type": "string" }, "mcpWiringsMetaJsonFile": { "type": "string" }, "mcpTypesFile": { "type": "string" }, "mcpJsonFile": { "type": "string" }, "agentWiringsFile": { "type": "string" }, "agentWiringMetaFile": { "type": "string" }, "agentWiringMetaJsonFile": { "type": "string" }, "agentTypesFile": { "type": "string" }, "agentMapDeclarationFile": { "type": "string" }, "cliWiringsFile": { "type": "string" }, "cliWiringMetaFile": { "type": "string" }, "cliWiringMetaJsonFile": { "type": "string" }, "cliContractsMetaJsonFile": { "type": "string" }, "cliContractsMetaFile": { "type": "string" }, "cliBootstrapFile": { "type": "string" }, "cliTypesFile": { "type": "string" }, "servicesFile": { "type": "string" }, "middlewareFile": { "type": "string" }, "middlewareGroupsMetaJsonFile": { "type": "string" }, "permissionsFile": { "type": "string" }, "permissionsGroupsMetaJsonFile": { "type": "string" }, "bootstrapFile": { "type": "string" }, "packageFile": { "type": "string" }, "addonTypesFile": { "type": "string" }, "nodeTypesFile": { "type": "string" }, "secretTypesFile": { "type": "string" }, "secretsFile": { "type": "string" }, "secretsMetaJsonFile": { "type": "string" }, "credentialsFile": { "type": "string" }, "credentialsMetaJsonFile": { "type": "string" }, "variableTypesFile": { "type": "string" }, "variablesFile": { "type": "string" }, "variablesMetaJsonFile": { "type": "string" }, "$schema": { "type": "string" }, "extends": { "type": "string" }, "rootDir": { "type": "string" }, "runtimeDir": { "type": "string", "description": "Runtime artifacts directory (dev.db, content, tmp). Resolved relative to rootDir. Defaults to <rootDir>/.pikku-runtime." }, "srcDirectories": { "type": "array", "items": { "type": "string" } }, "ignoreFiles": { "type": "array", "items": { "type": "string" } }, "packageMappings": { "type": "object", "additionalProperties": { "type": "string" } }, "addon": { "anyOf": [{ "type": "boolean" }, { "type": "object", "properties": { "categories": { "type": "array", "items": { "type": "string" } }, "icon": { "type": "string" }, "displayName": { "type": "string" }, "description": { "type": "string" }, "serverlessIncompatible": { "type": "array", "items": { "type": "string" } }, "openapi": { "type": "object", "properties": { "version": { "type": "string" }, "hash": { "type": "string" } }, "required": ["version", "hash"], "additionalProperties": false } }, "additionalProperties": false }] }, "addonName": { "type": "string" }, "configDir": { "type": "string" }, "tsconfig": { "type": "string" }, "clientFiles": { "type": "object", "properties": { "fetchFile": { "type": "string" }, "websocketFile": { "type": "string" }, "rpcWiringsFile": { "type": "string" }, "reactQueryFile": { "type": "string" }, "realtimeFile": { "type": "string" }, "realtimeEventHubTopicsImport": { "type": "string", "description": "Optional import for the EventHubTopics type so the realtime client is fully typed. Format: `<path>#<TypeName>` resolved relative to `realtimeFile`. Example: `../types/eventhub-topics.js#EventHubTopics`. If unset, the generated client treats topics as `Record<string, unknown>`." }, "queueWiringsFile": { "type": "string" }, "mcpJsonFile": { "type": "string" }, "nextBackendFile": { "type": "string" }, "nextHTTPFile": { "type": "string" }, "nextBackendTransport": { "type": "string", "enum": ["local", "worker-rpc", "http"], "description": "Transport used by the generated nextBackendFile wrapper.\n- `'local'` (default): function code is loaded in-process via bootstrap +   createSingletonServices. Required for Node/dev runs.\n- `'worker-rpc'`: SSR dispatches every call through an injected `Fetcher`   ({ fetch(req): Promise<Response> }). Function code is NOT bundled into   the SSR worker. Pair with `nextBackendFetcherImport` to point at your   resolver module.\n- `'http'`: SSR dispatches every call through the generated `PikkuFetch`   client. Use this when your Next app should call a separately running   local/server API instead of importing function code in-process." }, "nextBackendFetcherImport": { "type": "string", "description": "Module that exports a `fetcher: Fetcher` (or default export) used by the worker-RPC variant of the next backend wrapper. Resolved relative to `nextBackendFile`. Required when `nextBackendTransport === 'worker-rpc'`." }, "startServerFnsFile": { "type": "string", "description": "Emit a TanStack Start server-function shim into this file. The shim exports `makeApi(): PikkuRPC` — a typed caller over the generated RPC map for use in Start loaders, actions and components. It reads the API base URL from `import.meta.env.VITE_API_URL` (throws if unset). Requires `rpcWiringsFile` (where the `PikkuRPC` class is generated)." } }, "additionalProperties": false }, "emailTemplatesDir": { "type": "string", "description": "Directory containing email templates, locales, partials, and theme.json." }, "authFile": { "type": "string", "description": "Path to write the generated Better Auth wiring file (auth.gen.ts). Must be within srcDirectories so wireSecret calls are picked up by the inspector. Example: \"src/auth.gen.ts\"" }, "authTypesFile": { "type": "string", "description": "Path to write the generated typed `pikkuBetterAuth` re-export (auth.types.ts). Defaults to `{outDir}/auth/auth.types.ts`. Re-exported from `#pikku` so user code can `import { pikkuBetterAuth } from '#pikku'` with project-typed services." }, "authMetaJsonFile": { "type": "string", "description": "Path to write the generated Better Auth metadata (auth-meta.gen.json) — the enabled social providers and plugins the console SSO page reads via getAuthProviders. Defaults to `{outDir}/auth/pikku-auth-meta.gen.json`." }, "openAPI": { "type": "object", "properties": { "outputFile": { "type": "string" }, "additionalInfo": { "$ref": "#/definitions/OpenAPISpecInfo" } }, "required": ["outputFile", "additionalInfo"], "additionalProperties": false }, "schema": { "type": "object", "properties": { "additionalProperties": { "type": "boolean" }, "supportsImportAttributes": { "type": "boolean" } }, "additionalProperties": false }, "db": { "type": "object", "properties": { "engine": { "type": "string", "enum": ["sqlite", "postgres"] }, "pgVersion": { "type": "number" } }, "additionalProperties": false }, "cli": { "type": "object", "properties": { "entrypoints": { "type": "object", "additionalProperties": { "anyOf": [{ "type": "string" }, { "type": "object", "properties": { "type": { "type": "string", "const": "local" }, "path": { "type": "string" } }, "required": ["type", "path"], "additionalProperties": false }, { "type": "object", "properties": { "type": { "type": "string", "const": "channel" }, "name": { "type": "string" }, "route": { "type": "string" }, "wirePath": { "type": "string" }, "path": { "type": "string" } }, "required": ["type", "wirePath"], "additionalProperties": false }, { "type": "array", "items": { "anyOf": [{ "type": "string" }, { "type": "object", "properties": { "type": { "type": "string", "const": "local" }, "path": { "type": "string" } }, "required": ["type", "path"], "additionalProperties": false }, { "type": "object", "properties": { "type": { "type": "string", "const": "channel" }, "name": { "type": "string" }, "route": { "type": "string" }, "wirePath": { "type": "string" }, "path": { "type": "string" } }, "required": ["type", "wirePath"], "additionalProperties": false }] } }] } } }, "additionalProperties": false }, "workflows": { "type": "object", "properties": { "orchestratorQueue": { "type": "string" }, "workerQueue": { "type": "string" } }, "additionalProperties": false }, "userFlows": { "type": "object", "properties": { "actors": { "type": "object", "additionalProperties": { "type": "object", "properties": { "email": { "type": "string" }, "name": { "type": "string" }, "jobTitle": { "type": "string" }, "personality": { "type": "string" } }, "required": ["email"], "additionalProperties": false }, "description": "Global user-flow actor registry — any user flow can impersonate any actor. Generates a typed `createUserFlowActors` factory (see `userFlowActorsFile`) and surfaces the personas in the console." }, "environments": { "type": "object", "additionalProperties": { "type": "object", "properties": { "apiUrl": { "type": "string" }, "signInPath": { "type": "string", "description": "Actor sign-in path under apiUrl. Default: /auth/sign-in/actor" }, "rpcPath": { "type": "string", "description": "Exposed-RPC prefix under apiUrl. Default: /rpc" } }, "required": ["apiUrl"], "additionalProperties": false }, "description": "Environments `pikku userflow run <environment>` can target. `apiUrl` includes the HTTP prefix (e.g. https://app.example.com/api). The actor secret is NEVER configured here — it comes from the USER_FLOW_ACTOR_SECRET environment variable at run time." } }, "additionalProperties": false }, "scaffold": { "type": "object", "properties": { "addonDir": { "type": "string" }, "functionDir": { "type": "string" }, "wiringDir": { "type": "string" }, "middlewareDir": { "type": "string" }, "permissionDir": { "type": "string" }, "pikkuDir": { "type": "string" }, "rpc": { "$ref": "#/definitions/PikkuScaffoldFeature" }, "console": { "$ref": "#/definitions/PikkuScaffoldFeature" }, "agent": { "$ref": "#/definitions/PikkuScaffoldFeature" }, "workflow": { "$ref": "#/definitions/PikkuScaffoldFeature" }, "events": { "$ref": "#/definitions/PikkuScaffoldFeature" }, "remoteRpc": { "$ref": "#/definitions/PikkuScaffoldFeature" } }, "additionalProperties": false }, "addons": { "type": "object", "properties": { "addonDir": { "type": "string" } }, "additionalProperties": false, "description": "Community-registry addons installed via `pikku fabric addon add`. The source is copied into the project shadcn-style; each lands in `<addonDir>/<name>/` and the dir is registered as a yarn workspace so `wireAddon({ package })` resolves it by name. `addonDir` defaults to `addons` (top-level, outside the app's TS scan). Install provenance is tracked in pikku-addons.json." }, "tests": { "type": "object", "properties": { "outputDir": { "type": "string" } }, "additionalProperties": false }, "forceRequiredServices": { "type": "array", "items": { "type": "string" } }, "schemasFromTypes": { "type": "array", "items": { "type": "string" } }, "stateOutput": { "type": "string" }, "stateInput": { "type": "string" }, "verboseMeta": { "type": "boolean" }, "security": { "type": "boolean", "description": "Run the data-classification security lint (scans function return types for Private/Pii/Secret leaks). Off by default — it forces expensive return-type inference on every function and is not part of codegen. Enable here to always run it, or per-invocation via `pikku all --security`. Pair with `failOnError` to gate a build/CI on leaks." }, "tsc": { "type": "boolean", "description": "After codegen, run a real `tsc --noEmit` over the project's tsconfig and fail on type errors. `tsc` prints full diagnostics with code frames; `tscSummary` prints a compact one-line-per-error render (no code frames, capped) that's cheap for AI agents / CI logs. Off by default; enable per invocation via `pikku all --tsc` / `--tsc-summary`." }, "tscSummary": { "type": "boolean" }, "lint": { "type": "object", "properties": { "servicesNotDestructured": { "type": "string", "enum": ["off", "warn", "error"] }, "wiresNotDestructured": { "type": "string", "enum": ["off", "warn", "error"] } }, "additionalProperties": false }, "addonMetaJsonFile": { "type": "string" }, "globalHTTPPrefix": { "type": "string" }, "binary": { "type": "object", "properties": { "entrypoint": { "type": "string" }, "output": { "type": "string" }, "targets": { "type": "array", "items": { "type": "string" } } }, "required": ["entrypoint", "output"], "additionalProperties": false }, "deploy": { "type": "object", "properties": { "providers": { "type": "object", "additionalProperties": { "type": "string" } }, "defaultProvider": { "type": "string" }, "serverlessIncompatible": { "type": "array", "items": { "type": "string" } }, "defaultTarget": { "type": "string", "enum": ["serverless", "server"], "description": "Default deploy target for functions that don't declare an explicit `deploy` flag and don't use a serverless-incompatible service. Defaults to 'serverless'." } }, "required": ["providers"], "additionalProperties": false }, "namedFilters": { "type": "object", "additionalProperties": { "$ref": "#/definitions/InspectorFilters" }, "description": "Named filter presets keyed by name, used via CLI --filter <name>." }, "filters": { "$ref": "#/definitions/InspectorFilters" } }, "required": ["addonTypesFile", "agentMapDeclarationFile", "agentTypesFile", "agentWiringMetaFile", "agentWiringMetaJsonFile", "agentWiringsFile", "bootstrapFile", "channelContractsMetaFile", "channelContractsMetaJsonFile", "channelsMapDeclarationFile", "channelsTypesFile", "channelsWiringFile", "channelsWiringMetaFile", "channelsWiringMetaJsonFile", "cliBootstrapFile", "cliContractsMetaFile", "cliContractsMetaJsonFile", "cliTypesFile", "cliWiringMetaFile", "cliWiringMetaJsonFile", "cliWiringsFile", "configDir", "consoleFunctionsFile", "credentialsFile", "credentialsMetaJsonFile", "eventsChannelFile", "filters", "functionTypesFile", "functionsFile", "functionsMetaFile", "functionsMetaJsonFile", "gatewaysWiringFile", "gatewaysWiringMetaFile", "gatewaysWiringMetaJsonFile", "httpContractsMetaFile", "httpContractsMetaJsonFile", "httpMapDeclarationFile", "httpTypesFile", "httpWiringMetaFile", "httpWiringMetaJsonFile", "httpWiringsFile", "mcpJsonFile", "mcpTypesFile", "mcpWiringsFile", "mcpWiringsMetaFile", "mcpWiringsMetaJsonFile", "middlewareFile", "middlewareGroupsMetaJsonFile", "nodeTypesFile", "outDir", "packageFile", "packageMappings", "permissionsFile", "permissionsGroupsMetaJsonFile", "publicAgentFile", "publicRpcFile", "queueMapDeclarationFile", "queueTypesFile", "queueWorkersWiringFile", "queueWorkersWiringMetaFile", "queueWorkersWiringMetaJsonFile", "rootDir", "rpcInternalMapDeclarationFile", "rpcInternalWiringMetaFile", "rpcInternalWiringMetaJsonFile", "rpcMapDeclarationFile", "schedulersTypesFile", "schedulersWiringFile", "schedulersWiringMetaFile", "schedulersWiringMetaJsonFile", "schemaDirectory", "secretTypesFile", "secretsFile", "secretsMetaJsonFile", "servicesFile", "srcDirectories", "triggerSourcesMetaFile", "triggerSourcesMetaJsonFile", "triggersTypesFile", "triggersWiringFile", "triggersWiringMetaFile", "triggersWiringMetaJsonFile", "tsconfig", "typesDeclarationFile", "userFlowActorsFile", "variableTypesFile", "variablesFile", "variablesMetaJsonFile", "workflowMapDeclarationFile", "workflowMetaDir", "workflowRoutesFile", "workflowTypesFile", "workflowsWiringFile", "workflowsWiringMetaFile", "workflowsWorkersFile"], "definitions": { "OpenAPISpecInfo": { "type": "object", "properties": { "info": { "type": "object", "properties": { "title": { "type": "string" }, "version": { "type": "string" }, "description": { "type": "string" }, "termsOfService": { "type": "string" }, "contact": { "type": "object", "properties": { "name": { "type": "string" }, "url": { "type": "string" }, "email": { "type": "string" } }, "additionalProperties": false }, "license": { "type": "object", "properties": { "name": { "type": "string" }, "url": { "type": "string" } }, "required": ["name"], "additionalProperties": false } }, "required": ["title", "version", "description"], "additionalProperties": false }, "servers": { "type": "array", "items": { "type": "object", "properties": { "url": { "type": "string" }, "description": { "type": "string" } }, "required": ["url"], "additionalProperties": false } }, "tags": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "description": { "type": "string" } }, "required": ["name"], "additionalProperties": false } }, "externalDocs": { "type": "object", "properties": { "description": { "type": "string" }, "url": { "type": "string" } }, "required": ["url"], "additionalProperties": false }, "securitySchemes": { "type": "object" }, "security": { "type": "array", "items": { "type": "object", "additionalProperties": { "type": "array", "items": {} } } } }, "required": ["info", "servers"], "additionalProperties": false }, "PikkuScaffoldFeature": { "type": ["string", "boolean"], "enum": ["auth", "no-auth", false] }, "InspectorFilters": { "type": "object", "properties": { "names": { "type": "array", "items": { "type": "string" } }, "tags": { "type": "array", "items": { "type": "string" } }, "wires": { "type": "array", "items": { "type": "string" } }, "directories": { "type": "array", "items": { "type": "string" } }, "httpRoutes": { "type": "array", "items": { "type": "string" } }, "httpMethods": { "type": "array", "items": { "type": "string" } }, "excludeNames": { "type": "array", "items": { "type": "string" } }, "excludeTags": { "type": "array", "items": { "type": "string" } }, "excludeWires": { "type": "array", "items": { "type": "string" } }, "excludeDirectories": { "type": "array", "items": { "type": "string" } }, "excludeHttpRoutes": { "type": "array", "items": { "type": "string" } }, "excludeHttpMethods": { "type": "array", "items": { "type": "string" } }, "target": { "type": "array", "items": { "type": "string", "enum": ["serverless", "server"] } }, "excludeTarget": { "type": "array", "items": { "type": "string", "enum": ["serverless", "server"] } }, "serverlessIncompatible": { "type": "array", "items": { "type": "string" } }, "defaultTarget": { "type": "string", "enum": ["serverless", "server"] } }, "additionalProperties": false } } }

package/dist/.pikku/secrets/pikku-secret-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.67
+ * This file was generated by @pikku/cli@0.12.68
  */
 export { wireSecret } from '@pikku/core/secret';
 export type { CoreSecret, SecretDefinitionMeta, SecretDefinitionsMeta } from '@pikku/core/secret';

package/dist/.pikku/secrets/pikku-secret-types.gen.js

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.67
+ * This file was generated by @pikku/cli@0.12.68
  */
 export { wireSecret } from '@pikku/core/secret';

package/dist/.pikku/secrets/pikku-secrets.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.67
+ * This file was generated by @pikku/cli@0.12.68
  */
 import { TypedSecretService as CoreTypedSecretService } from '@pikku/core/services';
 import type { SecretService } from '@pikku/core/services';

package/dist/.pikku/secrets/pikku-secrets.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.67
+ * This file was generated by @pikku/cli@0.12.68
  */
 import { TypedSecretService as CoreTypedSecretService } from '@pikku/core/services';
 const CREDENTIALS_META = {};

package/dist/.pikku/trigger/pikku-trigger-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.67
+ * This file was generated by @pikku/cli@0.12.68
  */
 /**
  * Trigger-specific type definitions for tree-shaking optimization

package/dist/.pikku/trigger/pikku-trigger-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.67
+ * This file was generated by @pikku/cli@0.12.68
  */
 /**
  * Trigger-specific type definitions for tree-shaking optimization

package/dist/.pikku/variables/pikku-variable-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.67
+ * This file was generated by @pikku/cli@0.12.68
  */
 export { wireVariable } from '@pikku/core/variable';
 export type { CoreVariable, VariableDefinitionMeta, VariableDefinitionsMeta } from '@pikku/core/variable';

package/dist/.pikku/variables/pikku-variable-types.gen.js

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.67
+ * This file was generated by @pikku/cli@0.12.68
  */
 export { wireVariable } from '@pikku/core/variable';

package/dist/.pikku/variables/pikku-variables.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.67
+ * This file was generated by @pikku/cli@0.12.68
  */
 import { TypedVariablesService as CoreTypedVariablesService } from '@pikku/core/services';
 import type { VariablesService } from '@pikku/core/services';

package/dist/.pikku/variables/pikku-variables.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.67
+ * This file was generated by @pikku/cli@0.12.68
  */
 import { TypedVariablesService as CoreTypedVariablesService } from '@pikku/core/services';
 const VARIABLES_META = {};

package/dist/.pikku/workflow/meta/allWorkflow.gen.json

@@ -545,11 +545,16 @@
         "Summary": {
             "nodeId": "Summary",
             "rpcName": "pikkuSummary",
+            "next": "Type check",
             "stepHash": "a6c8f33339e2"
+        },
+        "Type check": {
+            "nodeId": "Type check",
+            "flow": "inline"
         }
     },
     "entryNodeIds": [
         "Bootstrap inspect"
     ],
-    "graphHash": "7b64c5235ba0"
+    "graphHash": "0c9134fe80d5"
 }

package/dist/.pikku/workflow/pikku-workflow-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.67
+ * This file was generated by @pikku/cli@0.12.68
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import { template } from '@pikku/core/workflow';

package/dist/.pikku/workflow/pikku-workflow-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.67
+ * This file was generated by @pikku/cli@0.12.68
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import { template } from '@pikku/core/workflow';

package/dist/.pikku/workflow/pikku-workflow-wirings-meta.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.67
+ * This file was generated by @pikku/cli@0.12.68
  */
 import { pikkuState } from '@pikku/core/internal';
 import allWorkflowMeta from './meta/allWorkflow.gen.json' with { type: 'json' };

package/dist/.pikku/workflow/pikku-workflow-wirings.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.67
+ * This file was generated by @pikku/cli@0.12.68
  */
 import { addWorkflow } from '@pikku/core/workflow';
 import './pikku-workflow-wirings-meta.gen.js';

package/dist/bin/pikku-bin.mjs

@@ -11,8 +11,8 @@ async function checkForUpdate() {
     })
     if (!res.ok) return
     const { version: latest } = await res.json()
-    if (latest !== '0.12.67') {
-      process.stderr.write(`\n  Update available  0.12.67 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
+    if (latest !== '0.12.68') {
+      process.stderr.write(`\n  Update available  0.12.68 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
     }
   } catch {}
 }

package/dist/src/cli.wiring.js

@@ -86,6 +86,14 @@ wireCLI({
             description: 'Fail the build on critical diagnostics. Always on; accepted for symmetry with --fail-on-error/--fail-on-warn.',
             default: true,
         },
+        tsc: {
+            description: "After codegen, run a real tsc --noEmit over the project's tsconfig and fail on type errors. Prints full diagnostics with code frames. Off by default.",
+            default: false,
+        },
+        tscSummary: {
+            description: 'Like --tsc but prints a compact one-line-per-error summary (no code frames, node_modules filtered, capped) — cheap for AI agents / CI. Fails on type errors.',
+            default: false,
+        },
         userSessionType: {
             description: 'Specify which UserSession type to use (when multiple exist)',
         },

package/dist/src/functions/workflows/all.workflow.js

@@ -1,6 +1,7 @@
 import { existsSync } from 'fs';
 import { pikkuWorkflowComplexFunc } from '#pikku/workflow/pikku-workflow-types.gen.js';
 import { assertSingleCoreVersion } from '../../utils/assert-single-core-version.js';
+import { PikkuTypecheckFailedError, renderTscFull, renderTscSummary, runProjectTypecheck, } from '../../utils/tsc-check.js';
 const scaffoldFiles = (config) => {
     const files = [];
     if (config.scaffold?.rpc && config.publicRpcFile)
@@ -272,5 +273,21 @@ export const allWorkflow = pikkuWorkflowComplexFunc({
         await workflow.do('Versions update', 'pikkuVersionsUpdate', null);
         await workflow.do('Bootstrap', 'pikkuBootstrap', { allImports });
         await workflow.do('Summary', 'pikkuSummary', null);
+        // Opt-in type-check gate (--tsc / --tsc-summary). Runs last, over the
+        // post-codegen project, so generated .pikku files are included — matching a
+        // real build. Printed inside the step; the throw lives in the workflow body
+        // (like assertSingleCoreVersion) so it reliably fails the run.
+        if (config.tsc || config.tscSummary) {
+            const errorCount = await workflow.do('Type check', async () => {
+                const { result, diagnostics, formatHost } = runProjectTypecheck(config.tsconfig, config.rootDir);
+                logger.info(config.tsc
+                    ? renderTscFull(diagnostics, config.rootDir, formatHost)
+                    : renderTscSummary(result));
+                return result.errorCount;
+            });
+            if (errorCount > 0) {
+                throw new PikkuTypecheckFailedError(`Type check failed: ${errorCount} error${errorCount === 1 ? '' : 's'}`);
+            }
+        }
     },
 });

package/dist/src/utils/tsc-check.d.ts

@@ -0,0 +1,46 @@
+import ts from 'typescript';
+import { PikkuError } from '@pikku/core';
+export declare class PikkuTypecheckFailedError extends PikkuError {
+}
+export interface TscDiagnostic {
+    file: string;
+    line: number;
+    column: number;
+    code: number;
+    category: 'error' | 'warning' | 'suggestion' | 'message';
+    message: string;
+}
+export interface TscCheckResult {
+    errorCount: number;
+    warningCount: number;
+    fileCount: number;
+    diagnostics: TscDiagnostic[];
+}
+/**
+ * Turn raw tsc diagnostics into a filtered, structured result. Pure — it takes
+ * already-computed diagnostics so it can be unit-tested without a program.
+ * Anything under node_modules or outside the project root is dropped so the
+ * output stays focused on the user's own code (and not lib .d.ts noise).
+ */
+export declare const collectTscDiagnostics: (diagnostics: readonly ts.Diagnostic[], rootDir: string) => TscCheckResult;
+/**
+ * Compact, token-frugal render of a type-check result: a one-line header plus
+ * one line per diagnostic (no code frames), capped. Used by `--tsc-summary` so
+ * AI agents and CI logs get the signal without the flood.
+ */
+export declare const renderTscSummary: (result: TscCheckResult, maxLines?: number) => string;
+/**
+ * Full render: tsc's own formatter with code frames, filtered to project files.
+ */
+export declare const renderTscFull: (diagnostics: readonly ts.Diagnostic[], rootDir: string, formatHost: ts.FormatDiagnosticsHost) => string;
+/**
+ * Run a real `tsc --noEmit` over the project's own tsconfig — the correct
+ * source of truth (lib, paths, strict), unlike the inspector's stripped-down
+ * traversal program. Returns both a structured result and the raw diagnostics
+ * so the caller can pick the compact (`--tsc-summary`) or full (`--tsc`) render.
+ */
+export declare const runProjectTypecheck: (tsconfigPath: string, rootDir: string) => {
+    result: TscCheckResult;
+    diagnostics: ts.Diagnostic[];
+    formatHost: ts.FormatDiagnosticsHost;
+};

package/dist/src/utils/tsc-check.js

@@ -0,0 +1,141 @@
+import ts from 'typescript';
+import { dirname, isAbsolute, relative } from 'node:path';
+import { PikkuError } from '@pikku/core';
+// A type-check failure is expected (the --tsc gate did its job) — throw a
+// PikkuError so the runner logs the message alone, not a stack trace.
+export class PikkuTypecheckFailedError extends PikkuError {
+}
+const CATEGORY = {
+    [ts.DiagnosticCategory.Error]: 'error',
+    [ts.DiagnosticCategory.Warning]: 'warning',
+    [ts.DiagnosticCategory.Suggestion]: 'suggestion',
+    [ts.DiagnosticCategory.Message]: 'message',
+};
+const MAX_MESSAGE_LENGTH = 200;
+const DEFAULT_MAX_LINES = 50;
+const NO_FILE = '(project)';
+const isProjectFile = (fileName, rootDir) => {
+    if (fileName.includes('/node_modules/'))
+        return false;
+    const rel = relative(rootDir, fileName);
+    return !rel.startsWith('..') && !isAbsolute(rel);
+};
+/**
+ * Turn raw tsc diagnostics into a filtered, structured result. Pure — it takes
+ * already-computed diagnostics so it can be unit-tested without a program.
+ * Anything under node_modules or outside the project root is dropped so the
+ * output stays focused on the user's own code (and not lib .d.ts noise).
+ */
+export const collectTscDiagnostics = (diagnostics, rootDir) => {
+    const files = new Set();
+    const collected = [];
+    let errorCount = 0;
+    let warningCount = 0;
+    for (const d of diagnostics) {
+        let file = NO_FILE;
+        let line = 0;
+        let column = 0;
+        if (d.file) {
+            if (!isProjectFile(d.file.fileName, rootDir))
+                continue;
+            file = relative(rootDir, d.file.fileName);
+            const lc = d.file.getLineAndCharacterOfPosition(d.start ?? 0);
+            line = lc.line + 1;
+            column = lc.character + 1;
+        }
+        const category = CATEGORY[d.category];
+        if (category === 'error')
+            errorCount++;
+        else if (category === 'warning')
+            warningCount++;
+        let message = ts.flattenDiagnosticMessageText(d.messageText, ' ');
+        if (message.length > MAX_MESSAGE_LENGTH) {
+            message = `${message.slice(0, MAX_MESSAGE_LENGTH - 1)}…`;
+        }
+        files.add(file);
+        collected.push({ file, line, column, code: d.code, category, message });
+    }
+    collected.sort((a, b) => a.file === b.file ? a.line - b.line : a.file < b.file ? -1 : 1);
+    return {
+        errorCount,
+        warningCount,
+        fileCount: files.size,
+        diagnostics: collected,
+    };
+};
+/**
+ * Compact, token-frugal render of a type-check result: a one-line header plus
+ * one line per diagnostic (no code frames), capped. Used by `--tsc-summary` so
+ * AI agents and CI logs get the signal without the flood.
+ */
+export const renderTscSummary = (result, maxLines = DEFAULT_MAX_LINES) => {
+    if (result.errorCount === 0 && result.warningCount === 0) {
+        return 'Type check passed — no errors.';
+    }
+    const counts = [];
+    if (result.errorCount > 0) {
+        counts.push(`${result.errorCount} error${result.errorCount === 1 ? '' : 's'}`);
+    }
+    if (result.warningCount > 0) {
+        counts.push(`${result.warningCount} warning${result.warningCount === 1 ? '' : 's'}`);
+    }
+    const fileLabel = `${result.fileCount} file${result.fileCount === 1 ? '' : 's'}`;
+    const lines = [`Type check: ${counts.join(', ')} in ${fileLabel}`];
+    const shown = result.diagnostics.slice(0, maxLines);
+    for (const d of shown) {
+        const at = d.line > 0 ? `${d.file}:${d.line}:${d.column}` : d.file;
+        lines.push(`  ${at}  TS${d.code}  ${d.message}`);
+    }
+    const remaining = result.diagnostics.length - shown.length;
+    if (remaining > 0) {
+        lines.push(`  … and ${remaining} more (run \`pikku all --tsc\` for full output)`);
+    }
+    return lines.join('\n');
+};
+/**
+ * Full render: tsc's own formatter with code frames, filtered to project files.
+ */
+export const renderTscFull = (diagnostics, rootDir, formatHost) => {
+    const filtered = diagnostics.filter((d) => !d.file || isProjectFile(d.file.fileName, rootDir));
+    if (filtered.length === 0)
+        return 'Type check passed — no errors.';
+    return ts.formatDiagnosticsWithColorAndContext(filtered, formatHost);
+};
+/**
+ * Run a real `tsc --noEmit` over the project's own tsconfig — the correct
+ * source of truth (lib, paths, strict), unlike the inspector's stripped-down
+ * traversal program. Returns both a structured result and the raw diagnostics
+ * so the caller can pick the compact (`--tsc-summary`) or full (`--tsc`) render.
+ */
+export const runProjectTypecheck = (tsconfigPath, rootDir) => {
+    const formatHost = {
+        getCanonicalFileName: (f) => f,
+        getCurrentDirectory: () => rootDir,
+        getNewLine: () => ts.sys.newLine,
+    };
+    const configFile = ts.readConfigFile(tsconfigPath, ts.sys.readFile);
+    if (configFile.error) {
+        const diagnostics = [configFile.error];
+        return {
+            result: collectTscDiagnostics(diagnostics, rootDir),
+            diagnostics,
+            formatHost,
+        };
+    }
+    const parsed = ts.parseJsonConfigFileContent(configFile.config, ts.sys, dirname(tsconfigPath));
+    const program = ts.createProgram({
+        rootNames: parsed.fileNames,
+        options: {
+            ...parsed.options,
+            noEmit: true,
+            incremental: false,
+            tsBuildInfoFile: undefined,
+        },
+    });
+    const diagnostics = [...parsed.errors, ...ts.getPreEmitDiagnostics(program)];
+    return {
+        result: collectTscDiagnostics(diagnostics, rootDir),
+        diagnostics,
+        formatHost,
+    };
+};