@pikku/cli 0.12.88 → 0.12.90

package/dist/.pikku/secrets/pikku-secrets.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.88
+ * This file was generated by @pikku/cli@0.12.90
  */
 import { TypedSecretService as CoreTypedSecretService } from '@pikku/core/services';
 import type { SecretService } from '@pikku/core/services';

package/dist/.pikku/secrets/pikku-secrets.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.88
+ * This file was generated by @pikku/cli@0.12.90
  */
 import { TypedSecretService as CoreTypedSecretService } from '@pikku/core/services';
 import secretsMeta from './pikku-secrets-meta.gen.json' with { type: 'json' };

package/dist/.pikku/trigger/pikku-trigger-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.88
+ * This file was generated by @pikku/cli@0.12.90
  */
 /**
  * Trigger-specific type definitions for tree-shaking optimization

package/dist/.pikku/trigger/pikku-trigger-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.88
+ * This file was generated by @pikku/cli@0.12.90
  */
 /**
  * Trigger-specific type definitions for tree-shaking optimization

package/dist/.pikku/variables/pikku-variable-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.88
+ * This file was generated by @pikku/cli@0.12.90
  */
 export { wireVariable } from '@pikku/core/variable';
 export type { CoreVariable, VariableDefinitionMeta, VariableDefinitionsMeta } from '@pikku/core/variable';

package/dist/.pikku/variables/pikku-variable-types.gen.js

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.88
+ * This file was generated by @pikku/cli@0.12.90
  */
 export { wireVariable } from '@pikku/core/variable';

package/dist/.pikku/variables/pikku-variables.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.88
+ * This file was generated by @pikku/cli@0.12.90
  */
 import { TypedVariablesService as CoreTypedVariablesService } from '@pikku/core/services';
 import type { VariablesService } from '@pikku/core/services';

package/dist/.pikku/variables/pikku-variables.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.88
+ * This file was generated by @pikku/cli@0.12.90
  */
 import { TypedVariablesService as CoreTypedVariablesService } from '@pikku/core/services';
 import variablesMeta from './pikku-variables-meta.gen.json' with { type: 'json' };

package/dist/.pikku/workflow/pikku-workflow-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.88
+ * This file was generated by @pikku/cli@0.12.90
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import { template } from '@pikku/core/workflow';

package/dist/.pikku/workflow/pikku-workflow-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.88
+ * This file was generated by @pikku/cli@0.12.90
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import { template } from '@pikku/core/workflow';

package/dist/.pikku/workflow/pikku-workflow-wirings-meta.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.88
+ * This file was generated by @pikku/cli@0.12.90
  */
 import { pikkuState } from '@pikku/core/internal';
 import allWorkflowMeta from './meta/allWorkflow.gen.json' with { type: 'json' };

package/dist/.pikku/workflow/pikku-workflow-wirings.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.88
+ * This file was generated by @pikku/cli@0.12.90
  */
 import { addWorkflow } from '@pikku/core/workflow';
 import './pikku-workflow-wirings-meta.gen.js';

package/dist/bin/pikku-bin.mjs

@@ -11,8 +11,8 @@ async function checkForUpdate() {
     })
     if (!res.ok) return
     const { version: latest } = await res.json()
-    if (latest !== '0.12.88') {
-      process.stderr.write(`\n  Update available  0.12.88 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
+    if (latest !== '0.12.90') {
+      process.stderr.write(`\n  Update available  0.12.90 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
     }
   } catch {}
 }

package/dist/bin/pikku.js

@@ -19,13 +19,28 @@ const __dirname = dirname(__filename);
  * Cannot be left to the package manager: the CLI has a node shebang, so `bunx
  * pikku dev` execs node and bun's own .env injection never reaches the process.
  * Existing variables win — a real env var must always beat a checked-out file.
+ *
+ * `process.loadEnvFile` is node-only, and the shebang is not a guarantee: under
+ * `bunx --bun pikku …` (which projects use so the CLI gets bun's `node:sqlite`)
+ * the process is bun and that method does not exist. Parse the file ourselves in
+ * that case rather than losing every secret in it.
  */
 function loadEnvFile() {
     const envPath = join(process.cwd(), '.env');
     if (!existsSync(envPath))
         return;
     try {
-        process.loadEnvFile(envPath);
+        if (typeof process.loadEnvFile === 'function') {
+            process.loadEnvFile(envPath);
+            return;
+        }
+        for (const line of readFileSync(envPath, 'utf-8').split('\n')) {
+            const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(line);
+            if (!match)
+                continue;
+            const value = match[2].trim().replace(/^(['"])(.*)\1$/s, '$2');
+            process.env[match[1]] ??= value;
+        }
     }
     catch (error) {
         process.stderr.write(`  Could not read .env: ${error.message}\n`);

package/dist/src/cli.wiring.js

@@ -18,6 +18,10 @@ import { dev } from './functions/commands/dev.js';
 import { serve } from './functions/commands/serve.js';
 import { dbMigrate } from './functions/commands/db-migrate.js';
 import { dbGenerate } from './functions/commands/db-generate.js';
+import { dbCodegen } from './functions/commands/db-codegen.js';
+import { dbCheck } from './functions/commands/db-check.js';
+import { dbBaseline } from './functions/commands/db-baseline.js';
+import { dbExport } from './functions/commands/db-export.js';
 import { dbSeed } from './functions/commands/db-seed.js';
 import { dbReset } from './functions/commands/db-reset.js';
 import { dbAudit } from './functions/commands/db-audit.js';
@@ -321,6 +325,22 @@ wireCLI({
                     func: dbGenerate,
                     description: 'Generate SQL migrations from detected schema changes',
                 }),
+                check: pikkuCLICommand({
+                    func: dbCheck,
+                    description: 'Report how the configured database differs from the schema its migrations define',
+                }),
+                baseline: pikkuCLICommand({
+                    func: dbBaseline,
+                    description: 'Record pending migrations as applied, for a database that already has what they describe',
+                }),
+                codegen: pikkuCLICommand({
+                    func: dbCodegen,
+                    description: 'Regenerate db/schema.gen.ts and db/zod.gen.ts from the migration files, without connecting to a database',
+                }),
+                export: pikkuCLICommand({
+                    func: dbExport,
+                    description: "Publish this package's schema so projects consuming it as an addon can create its tables",
+                }),
                 seed: pikkuCLICommand({
                     func: dbSeed,
                     description: 'Apply db/seed.sql to the dev database',

package/dist/src/fabric/fabric-commands.d.ts

@@ -1,5 +1,7 @@
 export declare const fabricCommands: {
-    validate: import("@pikku/core/cli").CoreCLICommandConfig<import("../../.pikku/pikku-types.gen.js").PikkuFunctionConfig<Record<string, never>, {
+    validate: import("@pikku/core/cli").CoreCLICommandConfig<import("../../.pikku/pikku-types.gen.js").PikkuFunctionConfig<{
+        skipTypecheck?: boolean | undefined;
+    }, {
         ok: boolean;
         root: string;
         findings: {
@@ -9,7 +11,9 @@ export declare const fabricCommands: {
             path: string;
             fixHint: string;
         }[];
-    }, "rpc" | "session", import("../../.pikku/pikku-types.gen.js").PikkuFunctionSessionless<Record<string, never>, {
+    }, "rpc" | "session", import("../../.pikku/pikku-types.gen.js").PikkuFunctionSessionless<{
+        skipTypecheck?: boolean | undefined;
+    }, {
         ok: boolean;
         root: string;
         findings: {
@@ -19,7 +23,9 @@ export declare const fabricCommands: {
             path: string;
             fixHint: string;
         }[];
-    }, "rpc" | "session", import("../../.pikku/pikku-types.gen.js").WiredServices> | import("../../.pikku/pikku-types.gen.js").PikkuFunction<Record<string, never>, {
+    }, "rpc" | "session", import("../../.pikku/pikku-types.gen.js").WiredServices> | import("../../.pikku/pikku-types.gen.js").PikkuFunction<{
+        skipTypecheck?: boolean | undefined;
+    }, {
         ok: boolean;
         root: string;
         findings: {

package/dist/src/fabric/fabric-commands.js

@@ -48,6 +48,12 @@ export const fabricCommands = defineCLICommands({
         func: FabricValidate,
         render: renderValidate,
         description: 'Check the project structure for fabric compatibility — prints all missing or misconfigured items with fix hints',
+        options: {
+            skipTypecheck: {
+                description: 'Skip the frontend type-check the build container runs (structural checks only)',
+                default: false,
+            },
+        },
     }),
     smoke: pikkuCLICommand({
         func: FabricSmoke,

package/dist/src/fabric/functions/validate.function.d.ts

@@ -1,5 +1,7 @@
 import { z } from 'zod';
-export declare const FabricValidateInput: z.ZodObject<{}, z.core.$strip>;
+export declare const FabricValidateInput: z.ZodObject<{
+    skipTypecheck: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
 export declare const FabricValidateOutput: z.ZodObject<{
     ok: z.ZodBoolean;
     root: z.ZodString;
@@ -15,8 +17,12 @@ export declare const FabricValidateOutput: z.ZodObject<{
         fixHint: z.ZodString;
     }, z.core.$strip>>;
 }, z.core.$strip>;
-export declare function runValidate(startDir?: string): Promise<z.infer<typeof FabricValidateOutput>>;
-export declare const FabricValidate: import("../../../.pikku/pikku-types.gen.js").PikkuFunctionConfig<Record<string, never>, {
+export declare function runValidate(startDir?: string, opts?: {
+    skipTypecheck?: boolean;
+}): Promise<z.infer<typeof FabricValidateOutput>>;
+export declare const FabricValidate: import("../../../.pikku/pikku-types.gen.js").PikkuFunctionConfig<{
+    skipTypecheck?: boolean | undefined;
+}, {
     ok: boolean;
     root: string;
     findings: {
@@ -26,7 +32,9 @@ export declare const FabricValidate: import("../../../.pikku/pikku-types.gen.js"
         path: string;
         fixHint: string;
     }[];
-}, "rpc" | "session", import("../../../.pikku/pikku-types.gen.js").PikkuFunctionSessionless<Record<string, never>, {
+}, "rpc" | "session", import("../../../.pikku/pikku-types.gen.js").PikkuFunctionSessionless<{
+    skipTypecheck?: boolean | undefined;
+}, {
     ok: boolean;
     root: string;
     findings: {
@@ -36,7 +44,9 @@ export declare const FabricValidate: import("../../../.pikku/pikku-types.gen.js"
         path: string;
         fixHint: string;
     }[];
-}, "rpc" | "session", import("../../../.pikku/pikku-types.gen.js").WiredServices> | import("../../../.pikku/pikku-types.gen.js").PikkuFunction<Record<string, never>, {
+}, "rpc" | "session", import("../../../.pikku/pikku-types.gen.js").WiredServices> | import("../../../.pikku/pikku-types.gen.js").PikkuFunction<{
+    skipTypecheck?: boolean | undefined;
+}, {
     ok: boolean;
     root: string;
     findings: {

package/dist/src/fabric/functions/validate.function.js

@@ -5,6 +5,7 @@ import { dirname, join } from 'node:path';
 import { createRequire } from 'node:module';
 import { pikkuSessionlessFunc } from '../../../.pikku/pikku-types.gen.js';
 import { added, changed, removed, dim } from '../lib/output.js';
+import { typeCheckFrontends } from '../lib/frontend-typecheck.js';
 const FindingSchema = z.object({
     id: z.string(),
     severity: z.enum(['error', 'warn', 'info']),
@@ -12,7 +13,12 @@ const FindingSchema = z.object({
     path: z.string(),
     fixHint: z.string(),
 });
-export const FabricValidateInput = z.object({});
+export const FabricValidateInput = z.object({
+    skipTypecheck: z
+        .boolean()
+        .optional()
+        .describe('Skip the frontend type-check stage (structural checks only, much faster)'),
+});
 export const FabricValidateOutput = z.object({
     ok: z.boolean(),
     root: z.string(),
@@ -182,7 +188,7 @@ const POSTGRES_SQL_PATTERNS = [
     { re: /\bTSVECTOR\b/i, label: 'TSVECTOR' },
     { re: /\bARRAY\s*\[/i, label: 'ARRAY[…]' },
 ];
-export async function runValidate(startDir = process.cwd()) {
+export async function runValidate(startDir = process.cwd(), opts = {}) {
     const root = await findProjectRoot(startDir);
     const findings = [];
     const e = (id, message, path, fixHint) => {
@@ -838,19 +844,47 @@ export async function runValidate(startDir = process.cwd()) {
             info('config-missing', 'packages/functions/src/config.ts not found', join(fnDir, 'src', 'config.ts'), "Create src/config.ts: export const createConfig = pikkuConfig(async () => ({ sqliteDb: '.pikku-runtime/dev.db' }))");
         }
     }
+    // ── declared frontends ────────────────────────────────────────────────
+    // pikkufabric.config.json is unvalidated JSON, so every field below is a
+    // claim, not a guarantee: a null entry or a non-string cwd used to throw on
+    // property access and take down the whole validation run — the one thing that
+    // was supposed to report the broken config. Shape-check the entries once here
+    // and let the apps/ and type-check passes consume the narrowed list.
+    const declaredFrontends = [];
+    /** every syntactically valid cwd, including ones whose directory is missing */
+    const declaredCwdList = [];
+    const rawFrontends = fabricConfig?.frontends;
+    if (rawFrontends !== undefined &&
+        (!rawFrontends || typeof rawFrontends !== 'object')) {
+        e('frontends-invalid', 'pikkufabric.config.json "frontends" is not an object — no frontend will be built or type-checked', fabricConfigPath, `Set "frontends" to an object keyed by slug: { "app": { "cwd": "apps/app", "kind": "ssr" } }`);
+    }
+    else if (rawFrontends) {
+        for (const [slug, entry] of Object.entries(rawFrontends)) {
+            if (!entry || typeof entry !== 'object' || Array.isArray(entry)) {
+                e(`frontend-entry-invalid-${slug}`, `pikkufabric.config.json frontend "${slug}" is not an object`, fabricConfigPath, `Give "${slug}" an object value: { "cwd": "apps/${slug}", "kind": "ssr" }`);
+                continue;
+            }
+            const { cwd, deploy } = entry;
+            if (typeof cwd !== 'string' || cwd.trim() === '') {
+                e(`frontend-cwd-invalid-${slug}`, `pikkufabric.config.json frontend "${slug}" has no string "cwd" — the build container has nothing to build`, fabricConfigPath, `Set "cwd" to the app directory, e.g. { "${slug}": { "cwd": "apps/${slug}" } }`);
+                continue;
+            }
+            const rel = cwd.replace(/^\.\//, '');
+            declaredCwdList.push(rel);
+            const dir = join(root, rel);
+            if (!existsSync(dir)) {
+                // Reported here rather than inside the apps/ block below: a project
+                // without an apps/ directory used to validate cleanly while declaring a
+                // deployable frontend that does not exist.
+                e(`frontend-cwd-missing-${slug}`, `fabric.config.json frontend "${slug}" declares cwd "${rel}" but that directory does not exist`, dir, `Create the directory or update the cwd in fabric.config.json`);
+                continue;
+            }
+            declaredFrontends.push({ slug, cwd: rel, dir, deploy: deploy !== false });
+        }
+    }
     // ── apps/ vs fabric.config.json frontends ─────────────────────────────
     const appsDir = join(root, 'apps');
     if (existsSync(appsDir)) {
-        // Check declared frontends have a real directory on disk
-        if (fabricConfig) {
-            const frontends = (fabricConfig.frontends ?? {});
-            for (const [slug, fe] of Object.entries(frontends)) {
-                const cwd = fe.cwd?.replace(/^\.\//, '');
-                if (cwd && !existsSync(join(root, cwd))) {
-                    e(`frontend-cwd-missing-${slug}`, `fabric.config.json frontend "${slug}" declares cwd "${cwd}" but that directory does not exist`, join(root, cwd), `Create the directory or update the cwd in fabric.config.json`);
-                }
-            }
-        }
         // Check each app/ subdir is declared and has correct local deps
         let appEntries = [];
         try {
@@ -861,9 +895,7 @@ export async function runValidate(startDir = process.cwd()) {
         catch {
             /* ignore */
         }
-        const declaredCwds = fabricConfig
-            ? new Set(Object.values((fabricConfig.frontends ?? {})).map((f) => f.cwd?.replace(/^\.\//, '') ?? ''))
-            : null;
+        const declaredCwds = fabricConfig ? new Set(declaredCwdList) : null;
         for (const name of appEntries) {
             const appPath = join(appsDir, name);
             const cwd = `apps/${name}`;
@@ -1119,6 +1151,27 @@ export async function runValidate(startDir = process.cwd()) {
     if (!existsSync(sdkDir)) {
         info('functions-sdk-missing', 'packages/functions-sdk/ not found — generated RPC client and React Query hooks will not be available', sdkDir, lines('Create a workspace at `packages/functions-sdk/`.', 'Minimum structure:', '- packages/functions-sdk/package.json', '- packages/functions-sdk/src/pikku/', 'Point `pikku.config.json` clientFiles to:', '- packages/functions-sdk/src/pikku/rpc-map.gen.d.ts', '- packages/functions-sdk/src/pikku/api.gen.ts', 'This package is the home for generated client artifacts, not handwritten server code.'));
     }
+    // ── frontend type-check (what the build container actually runs) ───────
+    // Every check above is a heuristic standing in for this compile. The build
+    // container type-checks each deployable frontend and aborts the deploy on a
+    // non-zero exit, so running the same compile here is the difference between
+    // a 20-second local failure and a burned deploy out of the daily 10.
+    if (!opts.skipTypecheck) {
+        const frontends = declaredFrontends
+            .filter((fe) => fe.deploy)
+            .map((fe) => ({ name: fe.slug, dir: fe.dir }));
+        for (const result of await typeCheckFrontends(root, frontends)) {
+            if (result.skipped) {
+                w(`frontend-typecheck-skipped-${result.name}`, `could not type-check frontend "${result.name}" — ${result.skipped}`, result.dir, lines('The build container type-checks every deployable frontend and aborts the deploy if it fails.', 'Give the app a tsconfig.json and a "tsc" script so the same check runs locally.'));
+                continue;
+            }
+            if (result.errors.length === 0)
+                continue;
+            const shown = result.errors.slice(0, 20);
+            const extra = result.errors.length - shown.length;
+            e(`frontend-typecheck-${result.name}`, `frontend "${result.name}" does not type-check — the build container aborts the deploy on this`, result.dir, lines(...shown, ...(extra > 0 ? [`… and ${extra} more`] : []), '', `Reproduce with: cd ${result.dir.slice(root.length + 1)} && ${result.command}`));
+        }
+    }
     const ok = !findings.some((f) => f.severity === 'error');
     return { ok, root, findings };
 }
@@ -1126,7 +1179,7 @@ export const FabricValidate = pikkuSessionlessFunc({
     description: 'Check the current project structure for fabric compatibility. Prints all missing or misconfigured items with fix hints so an AI agent or developer can resolve them.',
     input: FabricValidateInput,
     output: FabricValidateOutput,
-    func: async (_services) => runValidate(),
+    func: async (_services, { skipTypecheck }) => runValidate(process.cwd(), { skipTypecheck }),
 });
 export const renderValidate = (_s, { ok, root, findings }) => {
     if (findings.length === 0) {

package/dist/src/fabric/lib/config.d.ts

@@ -50,7 +50,17 @@ export declare function findProjectConfig(startDir?: string): Promise<{
  * placeholder to the API as if it were a real id.
  */
 export declare function isLinkedProjectId(projectId?: string | null): boolean;
-export declare function writeProjectConfig(cwd: string, config: ProjectConfig): Promise<string>;
+/**
+ * Merge into the existing config rather than replacing it. `link` and `init`
+ * only know the projectId, so a plain write silently deleted every other key —
+ * including `frontends`, which is what tells the build container an app exists.
+ * The symptom is a deploy that succeeds having built no frontend at all, long
+ * after the link that caused it. Unknown keys are preserved too; nothing here
+ * has any business dropping config it does not understand.
+ */
+export declare function writeProjectConfig(cwd: string, config: Partial<ProjectConfig> & {
+    projectId: string;
+}): Promise<string>;
 export declare function readAuthFile(): Promise<AuthFile>;
 export declare function writeAuthFile(file: AuthFile): Promise<void>;
 export interface ResolvedApiContext {

package/dist/src/fabric/lib/config.js

@@ -31,10 +31,48 @@ export function isLinkedProjectId(projectId) {
         return false;
     return !/^__.*__$/.test(projectId);
 }
+/**
+ * Merge into the existing config rather than replacing it. `link` and `init`
+ * only know the projectId, so a plain write silently deleted every other key —
+ * including `frontends`, which is what tells the build container an app exists.
+ * The symptom is a deploy that succeeds having built no frontend at all, long
+ * after the link that caused it. Unknown keys are preserved too; nothing here
+ * has any business dropping config it does not understand.
+ */
 export async function writeProjectConfig(cwd, config) {
     const path = join(cwd, projectConfigName);
+    let existing = {};
+    if (existsSync(path)) {
+        // A read that fails for any reason other than the file's contents —
+        // permissions, a transient I/O error — tells us nothing about what the file
+        // holds. Rewriting it then is the exact clobber this function exists to
+        // prevent, so refuse the write instead.
+        let raw;
+        try {
+            raw = await readFile(path, 'utf8');
+        }
+        catch (error) {
+            throw new Error(`Cannot read ${projectConfigName} at ${path} (${error.message}) — refusing to overwrite it`);
+        }
+        try {
+            const parsed = JSON.parse(raw);
+            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                existing = parsed;
+            }
+            else {
+                // Valid JSON that is not an object holds nothing we can merge, but it is
+                // still the user's file — say so rather than dropping it silently.
+                console.warn(`[fabric] ${projectConfigName} is not a JSON object — rewriting it`);
+            }
+        }
+        catch (error) {
+            // An unparseable config is not a reason to lose the link; warn and start
+            // fresh rather than throwing away the command the user just ran.
+            console.warn(`[fabric] ${projectConfigName} is not valid JSON (${error.message}) — rewriting it`);
+        }
+    }
     await mkdir(dirname(path), { recursive: true });
-    await writeFile(path, JSON.stringify(config, null, 2) + '\n', 'utf8');
+    await writeFile(path, JSON.stringify({ ...existing, ...config }, null, 2) + '\n', 'utf8');
     return path;
 }
 export async function readAuthFile() {

package/dist/src/fabric/lib/frontend-typecheck.d.ts

@@ -0,0 +1,46 @@
+export interface FrontendTypeCheckResult {
+    /** fabric.config.json frontend key, e.g. "app" */
+    name: string;
+    /** absolute directory that was type-checked */
+    dir: string;
+    /**
+     * The invocation that actually ran, e.g. `yarn run tsc` or `npx tsc --noEmit`.
+     * A finding tells the user to reproduce it, so it has to be the command this
+     * check chose — not a guess at their package manager.
+     */
+    command: string;
+    /** raw `file(line,col): error TSxxxx: message` lines, in tsc's order */
+    errors: string[];
+    /** set when the frontend could not be checked at all (no tsconfig, tsc missing) */
+    skipped?: string;
+}
+/**
+ * Run each deployable frontend's type-check exactly as the Fabric build
+ * container does, so a type error fails `fabric validate` on the developer's
+ * machine instead of eight minutes into a deploy.
+ *
+ * The container runs the frontend's own `tsc` script (falling back to
+ * `tsc --noEmit`) and aborts the deploy on a non-zero exit; the deploy budget
+ * is 10/day, so spending one on a TS2353 is expensive. Everything else in
+ * validate is a structural heuristic *approximating* this compile — this is the
+ * compile.
+ */
+export declare function typeCheckFrontends(root: string, frontendDirs: Array<{
+    name: string;
+    dir: string;
+}>): Promise<FrontendTypeCheckResult[]>;
+/**
+ * The frontend's own `tsc` script when it has one — that is what the build
+ * container runs — otherwise `tsc --noEmit` through the project's package
+ * manager, so the compiler resolved is the workspace-local one.
+ */
+export declare function resolveTypeCheckCommand(root: string, dir: string): Promise<{
+    command: string;
+    args: string[];
+}>;
+/**
+ * Keep only tsc's diagnostic lines. The runner wraps the command with its own
+ * chatter ("$ tsc --noEmit", "error Command failed with exit code 2"), which is
+ * noise in a finding.
+ */
+export declare function parseTscErrors(output: string): string[];