@pikku/cli 0.12.93 → 0.12.99

package/dist/src/fabric/functions/validate.function.js

@@ -6,7 +6,7 @@ import { createRequire } from 'node:module';
 import { pikkuSessionlessFunc } from '../../../.pikku/pikku-types.gen.js';
 import { added, changed, removed, dim } from '../lib/output.js';
 import { typeCheckFrontends } from '../lib/frontend-typecheck.js';
-import { runKnowledgeValidate } from '@pikku/knowledge';
+import { readJsonSafe, readTextSafe, runSharedProjectChecks, } from '../../functions/validate/shared-checks.js';
 const FindingSchema = z.object({
     id: z.string(),
     severity: z.enum(['error', 'warn', 'info']),
@@ -47,26 +47,6 @@ async function findProjectRoot(startDir) {
         dir = parent;
     }
 }
-async function readJsonSafe(path) {
-    if (!existsSync(path))
-        return null;
-    try {
-        return JSON.parse(await readFile(path, 'utf8'));
-    }
-    catch {
-        return null;
-    }
-}
-async function readTextSafe(path) {
-    if (!existsSync(path))
-        return null;
-    try {
-        return await readFile(path, 'utf8');
-    }
-    catch {
-        return null;
-    }
-}
 // List .ts/.tsx source files under a directory (skips node_modules). Used to
 // scan an app for raw @mantine/core imports and i18n usage.
 async function listSourceFiles(dir) {
@@ -141,6 +121,23 @@ const SINGLETON_SENSITIVE_PKGS = [
     'react',
     'react-dom',
 ];
+// A file whose name says "this is the login surface". Used to decide whether an
+// app needs the actor quick-login control — an app with no login screen has
+// nothing to attach it to. Matched against the path relative to the app root, so
+// it covers src/pages/LoginPage.tsx as well as Next's app/login/page.tsx.
+const LOGIN_FILE_PATTERN = /(?:^|\/)[\w[\]-]*(?:login|sign-?in)[\w[\]-]*(?:\/|\.)/i;
+// Fingerprints of the dev-only "Sign in as …" quick login (the actor switcher):
+// one click signs in as a declared scenario persona, no password. Any one of
+// these means the app actually wires actor sign-in — the component's own
+// definition is excluded, since defining it without rendering it locks the
+// reviewer out just as thoroughly.
+// Canonical implementation: starter-template's DevActorSwitcher, rendered from
+// LoginPage and backed by signInAsActor() → POST /auth/sign-in/actor.
+const ACTOR_QUICK_LOGIN_PATTERNS = [
+    /<\s*DevActorSwitcher\b/,
+    /(?<!function\s)\bsignInAsActor\s*\(/,
+    /\/auth\/sign-in\/actor/,
+];
 // Minimum @pikku/* versions Fabric requires. The pikku packages are versioned
 // independently (e.g. @pikku/cli moves faster than @pikku/core), so this is a
 // per-package floor map, not a single number. Only listed packages are
@@ -202,6 +199,19 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
         findings.push({ id, severity: 'info', message, path, fixHint });
     };
     const lines = (...parts) => parts.join('\n');
+    // ── everything true of any pikku project ───────────────────────────────
+    // Fabric validate is workspace validate plus the deploy-shaped checks. The
+    // two used to be separate walks over the same project that duplicated sixteen
+    // findings verbatim, and each carried checks the other lacked for no reason
+    // anyone could name.
+    //
+    // knowledge: decisions/internals/one-project-shape-check-two-validators.md
+    const shared = await runSharedProjectChecks(root);
+    findings.push(...shared.findings);
+    const { pikkuConfig, dbEngine } = shared;
+    const pikkuConfigPath = join(root, 'pikku.config.json');
+    const rootPkgPath = join(root, 'package.json');
+    const rootPkg = await readJsonSafe(rootPkgPath);
     // ── pikkufabric.config.json ────────────────────────────────────────────
     // Not required to run validate — downgraded to info so any pikku project
     // can be checked for compatibility before it is linked to a fabric account.
@@ -216,69 +226,6 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
     else if (fabricConfig.projectId === '__PROJECT_ID__') {
         info('fabric-config-placeholder-project-id', 'pikkufabric.config.json has a placeholder projectId ("__PROJECT_ID__") — project is not linked', fabricConfigPath, lines('The file exists but still contains the placeholder project id.', 'Run `pikku fabric link` to replace it automatically, or edit the file and set:', '"projectId": "<real-project-id>"'));
     }
-    // ── root pikku.config.json ─────────────────────────────────────────────
-    const pikkuConfigPath = join(root, 'pikku.config.json');
-    const pikkuConfig = await readJsonSafe(pikkuConfigPath);
-    if (!pikkuConfig) {
-        e('pikku-config-missing', 'pikku.config.json not found at project root', pikkuConfigPath, lines('Create `pikku.config.json` at the repo root.', 'Minimum useful shape:', '{', '  "srcDirectories": ["packages/functions/src"],', '  "outDir": "packages/functions/.pikku",', '  "clientFiles": {', '    "rpcMapDeclarationFile": "packages/functions-sdk/src/pikku/rpc-map.gen.d.ts",', '    "reactQueryFile": "packages/functions-sdk/src/pikku/api.gen.ts"', '  }', '}'));
-    }
-    else {
-        if (!pikkuConfig.srcDirectories) {
-            e('pikku-config-no-src-dirs', 'pikku.config.json missing "srcDirectories"', pikkuConfigPath, 'Add "srcDirectories": ["packages/functions/src"] to pikku.config.json');
-        }
-        if (!pikkuConfig.outDir) {
-            e('pikku-config-no-out-dir', 'pikku.config.json missing "outDir"', pikkuConfigPath, 'Add "outDir": "packages/functions/.pikku" to pikku.config.json');
-        }
-        if (!pikkuConfig.clientFiles) {
-            info('pikku-config-no-client-files', 'pikku.config.json missing "clientFiles" — generated RPC client files and React Query hooks will not be written', pikkuConfigPath, lines('Add a `clientFiles` block to `pikku.config.json`.', 'Recommended values:', '"clientFiles": {', '  "rpcMapDeclarationFile": "packages/functions-sdk/src/pikku/rpc-map.gen.d.ts",', '  "reactQueryFile": "packages/functions-sdk/src/pikku/api.gen.ts"', '}', 'Those files should live in `packages/functions-sdk/src/pikku/` and are generated by Pikku.'));
-        }
-        // Each scaffold key gates generation of a public surface the Fabric console
-        // calls. Missing one means those endpoints are never generated, so the
-        // console 404s even though the functions/agents/workflows are wired. The
-        // generated file paths auto-derive from the flag (see pikku-cli-config), so
-        // setting the flag is sufficient. console/rpc/agent/workflow gate HTTP/RPC
-        // endpoints the console hits directly → error; events gates the realtime
-        // channel (feature-dependent, no template ships it yet) → warn.
-        const REQUIRED_SCAFFOLD = [
-            {
-                key: 'console',
-                severity: 'error',
-                surface: 'app introspection (console:getFunctionsMeta and friends) — the sandbox builder shows no functions',
-                value: '"auth"',
-            },
-            {
-                key: 'rpc',
-                severity: 'error',
-                surface: 'the generic /rpc/:name endpoint',
-                value: 'true',
-            },
-            {
-                key: 'agent',
-                severity: 'error',
-                surface: 'the agent endpoints (/rpc/agent/:agentName) — the agent playground 404s',
-                value: '"no-auth"',
-            },
-            {
-                key: 'workflow',
-                severity: 'error',
-                surface: 'the workflow endpoints (/workflow/:workflowName/start) — triggering a workflow 404s',
-                value: '"no-auth"',
-            },
-            {
-                key: 'events',
-                severity: 'warn',
-                surface: 'the realtime events channel',
-                value: 'true',
-            },
-        ];
-        for (const s of REQUIRED_SCAFFOLD) {
-            if (pikkuConfig.scaffold?.[s.key])
-                continue;
-            const report = s.severity === 'error' ? e : w;
-            report(`pikku-config-no-scaffold-${s.key}`, `pikku.config.json scaffold is missing "${s.key}" — ${s.surface} is never generated, so the Fabric console 404s for it`, pikkuConfigPath, lines(`Add "${s.key}" to the scaffold block in pikku.config.json:`, '"scaffold": {', '  "pikkuDir": "packages/functions/src/scaffold",', `  "${s.key}": ${s.value}`, '}', 'Then re-run codegen (`pikku all`) and restart the dev server.'));
-        }
-    }
-    const dbEngine = pikkuConfig?.db?.engine ?? 'sqlite';
     // ── .gitignore must ignore generated/runtime artifacts ─────────────────
     // These are regenerated on every dev boot / scaffold / codegen. Committing
     // them lets a stale copy shadow the freshly generated one — a committed
@@ -318,45 +265,6 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
             w(`missing-required-file-${relPath.replace(/[^a-z0-9]/gi, '-')}`, `${relPath} is missing — this file must be committed to the project`, join(root, relPath), lines(`Create ${relPath} and commit it.`, 'The starter-template ships a stub you can copy as a starting point.'));
         }
     }
-    // ── knowledge base ─────────────────────────────────────────────────────
-    // Delegated to the shared checker rather than asserting a list of filenames.
-    // The three flat files this used to require (design-language.md, security.md,
-    // technology.md) are not a knowledge base — they are three documents nothing
-    // can link into, and the profile now organises the same content into sections
-    // of notes. Fabric adds decisions/design/ on top of what is checked here.
-    const knowledge = await runKnowledgeValidate(root, join(root, typeof pikkuConfig?.outDir === 'string' ? pikkuConfig.outDir : '.pikku'));
-    for (const finding of knowledge.findings) {
-        findings.push({ ...finding, path: join(root, finding.path) });
-    }
-    const rootPkgPath = join(root, 'package.json');
-    const rootPkg = await readJsonSafe(rootPkgPath);
-    if (!rootPkg) {
-        e('root-package-missing', 'root package.json not found', rootPkgPath, 'Create a root package.json with workspaces: {"workspaces": ["packages/*", "apps/*"]}');
-    }
-    else {
-        if (!rootPkg.workspaces) {
-            w('root-package-no-workspaces', 'root package.json missing "workspaces"', rootPkgPath, 'Add "workspaces": ["packages/*", "apps/*"] to enable yarn workspaces');
-        }
-        const allDeps = {
-            ...rootPkg.dependencies,
-            ...rootPkg.devDependencies,
-        };
-        if (!allDeps['@pikku/core']) {
-            e('missing-core', '@pikku/core not in dependencies', rootPkgPath, 'Add "@pikku/core": "file:./vendor/pikku-core.tgz" to dependencies');
-        }
-        // Vendor tgz presence — only check file: deps that reference a vendor/ path
-        for (const [pkg, spec] of Object.entries(allDeps)) {
-            if (typeof spec !== 'string' || !spec.startsWith('file:'))
-                continue;
-            const relPath = spec.slice(5); // strip 'file:'
-            if (!relPath.includes('vendor'))
-                continue;
-            const absPath = join(root, relPath);
-            if (!existsSync(absPath)) {
-                w(`vendor-missing-${pkg.replace(/[@/]/g, '-')}`, `Vendor file missing for ${pkg}: ${relPath}`, absPath, `Run \`pikku pack\` in the pikku source repo and copy the output to ${relPath}`);
-            }
-        }
-    }
     // ── @pikku/* minimum versions ──────────────────────────────────────────
     // Scan every workspace manifest for @pikku/* deps below the required floor.
     // A stale @pikku/cli hangs `pikku dev`; a stale @pikku/core duplicates
@@ -589,16 +497,12 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
     const functionsSdkPkgName = (await readJsonSafe(join(root, 'packages', 'functions-sdk', 'package.json')))?.name;
     const themePkgName = (await readJsonSafe(join(root, 'packages', 'mantine-theme', 'package.json')))?.name;
     const componentsPkgName = (await readJsonSafe(join(root, 'packages', 'components', 'package.json')))?.name;
-    if (!existsSync(fnDir)) {
-        e('functions-pkg-missing', 'packages/functions/ directory not found', fnDir, 'Create packages/functions/ as a yarn workspace containing pikku.config.json, src/, and db/sqlite/');
-    }
-    else {
+    // packages/functions/ presence, its package.json, ESM, zod and layout are all
+    // asserted by runSharedProjectChecks — everything below is Fabric-specific.
+    if (existsSync(fnDir)) {
         const fnPkgPath = join(fnDir, 'package.json');
         const fnPkg = await readJsonSafe(fnPkgPath);
         if (fnPkg) {
-            if (fnPkg.type !== 'module') {
-                w('functions-pkg-no-esm', 'packages/functions/package.json is missing "type": "module"', fnPkgPath, 'Add "type": "module" to packages/functions/package.json — Cloudflare Workers require ES modules');
-            }
             // #pikku bare import — required by the injected fabric-telemetry.wiring.ts
             if (!fnPkg.imports?.['#pikku']) {
                 e('functions-pkg-missing-pikku-import', 'packages/functions/package.json is missing a bare "#pikku" entry in "imports" — the Fabric-injected telemetry middleware imports from "#pikku" and will fail to bundle without it', fnPkgPath, 'Add to "imports": { "#pikku": "./.pikku/pikku-types.gen.ts", "#pikku/*": "./.pikku/*" }');
@@ -660,13 +564,11 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
                 e('missing-ai-sdk-core', 'Project declares agent units but `ai` (the Vercel AI SDK) is not in packages/functions dependencies — it is a peer dependency of @pikku/ai-vercel and is not installed automatically', fnPkgPath, 'Run `yarn add ai` in packages/functions — must be in dependencies, not devDependencies');
             }
         }
-        // services.ts
+        // services.ts — its absence is reported by runSharedProjectChecks; what
+        // Fabric adds is which dialect it builds and whether it reads process.env.
         const servicesPath = join(fnDir, 'src', 'services.ts');
         const servicesText = await readTextSafe(servicesPath);
-        if (!servicesText) {
-            w('services-missing', 'packages/functions/src/services.ts not found', servicesPath, 'Create services.ts using pikkuServices() with LibsqlWebDialect from @pikku/kysely-sqlite — fabric injects DATABASE_URL at runtime');
-        }
-        else {
+        if (servicesText) {
             const usesKysely = /\bKysely\b/.test(servicesText);
             const usesLibsql = servicesText.includes('@pikku/kysely-sqlite') ||
                 servicesText.includes('LibsqlWebDialect');
@@ -684,7 +586,7 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
                 e('services-wrong-db-adapter', 'services.ts uses Kysely but not LibsqlWebDialect — Fabric injects a Turso/libSQL DATABASE_URL at runtime, not a PostgreSQL URL', servicesPath, 'Import LibsqlWebDialect from @pikku/kysely-sqlite and replace the dialect: new Kysely({ dialect: new LibsqlWebDialect({ url: databaseUrl }) })');
             }
             if (usesProcessEnv) {
-                info('services-process-env', 'services.ts reads process.env directly — prefer variables.get() for portable secret/variable access', servicesPath, 'Replace process.env.SOME_VAR with await variables.get("SOME_VAR") — declare the binding with wireVariable/wireSecret; process.env is fine for optional/non-secret config');
+                info('services-process-env', 'services.ts reads process.env directly — prefer variables.get() for portable secret/variable access', servicesPath, 'Replace process.env.SOME_VAR with await variables.get("SOME_VAR") — declare the binding with defineVariable/defineSecret; process.env is fine for optional/non-secret config');
             }
             if (dbEngine !== 'postgres' &&
                 usesLibsql &&
@@ -785,13 +687,6 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
                     if (m)
                         nums.push(parseInt(m[1], 10));
                 }
-                for (let idx = 1; idx < nums.length; idx++) {
-                    if (nums[idx] !== nums[idx - 1] + 1) {
-                        const missing = `${nums[idx - 1] + 1}..${nums[idx] - 1}`;
-                        e('migration-gap', `Migration numbering gap: IDs ${missing} are missing`, migrationsDir, 'Migrations must be consecutive. Add the missing .sql file or renumber if not yet applied.');
-                        break;
-                    }
-                }
                 if (dbEngine !== 'postgres') {
                     // Check for PostgreSQL-specific syntax — Fabric uses Turso (SQLite/libSQL)
                     for (const f of files) {
@@ -809,13 +704,13 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
                 // readdir failure — skip
             }
         }
-        const seedPath = join(root, 'db', dbEngine === 'postgres' ? 'postgres-seed.sql' : 'sqlite-seed.sql');
-        if (!existsSync(seedPath)) {
-            e('seed-sql-missing', dbEngine === 'postgres'
-                ? 'db/postgres-seed.sql not found'
-                : 'db/sqlite-seed.sql not found', seedPath, dbEngine === 'postgres'
-                ? lines('Create `db/postgres-seed.sql`.', 'Use idempotent INSERT statements suitable for local/dev/test setup.', 'Keep it safe to re-run.')
-                : lines('Create `db/sqlite-seed.sql`.', 'Use idempotent `INSERT OR IGNORE` statements for local/dev/test data.', 'Keep it safe to re-run.'));
+        const devSeedPath = join(root, 'db', dbEngine === 'postgres' ? 'postgres-dev-seed.sql' : 'sqlite-dev-seed.sql');
+        if (!existsSync(devSeedPath)) {
+            e('dev-seed-sql-missing', dbEngine === 'postgres'
+                ? 'db/postgres-dev-seed.sql not found'
+                : 'db/sqlite-dev-seed.sql not found', devSeedPath, dbEngine === 'postgres'
+                ? lines('Create `db/postgres-dev-seed.sql`.', 'Use idempotent INSERT statements suitable for local/dev/test setup.', 'Keep it safe to re-run.')
+                : lines('Create `db/sqlite-dev-seed.sql`.', 'Use idempotent `INSERT OR IGNORE` statements for local/dev/test data.', 'Keep it safe to re-run.'));
         }
         // audit table — info if not present (optional feature)
         if (existsSync(migrationsDir)) {
@@ -831,27 +726,6 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
                 // readdir failure — skip
             }
         }
-        // db.types.ts — should only re-export from .pikku
-        const dbTypesPath = join(fnDir, 'src', 'types', 'db.types.ts');
-        const dbTypesText = await readTextSafe(dbTypesPath);
-        if (dbTypesText) {
-            const isReexport = dbTypesText.includes('.pikku/db/schema') ||
-                dbTypesText.includes('.pikku\\db\\schema');
-            const hasInlineTypes = /(?:^|\n)\s*(?:export\s+)?(?:interface\s+\w|type\s+\w+\s*=)/.test(dbTypesText);
-            if (hasInlineTypes && !isReexport) {
-                w('db-types-hand-edited', 'src/types/db.types.ts contains inline type definitions — it should only re-export from .pikku', dbTypesPath, "Replace the file with a single line: export type { DB } from '../../.pikku/db/schema.gen.js' then run `yarn db:types` to regenerate");
-            }
-        }
-        // Structure: src/functions/, src/wirings/, src/config.ts
-        if (!existsSync(join(fnDir, 'src', 'functions'))) {
-            info('functions-dir-missing', 'packages/functions/src/functions/ not found', join(fnDir, 'src', 'functions'), 'Create src/functions/ to hold pikkuSessionlessFunc definitions (one function per file)');
-        }
-        if (!existsSync(join(fnDir, 'src', 'wirings'))) {
-            info('wirings-dir-missing', 'packages/functions/src/wirings/ not found', join(fnDir, 'src', 'wirings'), 'Create src/wirings/ for transport bindings: *.http.ts, *.queue.ts, *.schedule.ts, *.channel.ts, *.cli.ts');
-        }
-        if (!existsSync(join(fnDir, 'src', 'config.ts'))) {
-            info('config-missing', 'packages/functions/src/config.ts not found', join(fnDir, 'src', 'config.ts'), "Create src/config.ts: export const createConfig = pikkuConfig(async () => ({ sqliteDb: '.pikku-runtime/dev.db' }))");
-        }
     }
     // ── declared frontends ────────────────────────────────────────────────
     // pikkufabric.config.json is unvalidated JSON, so every field below is a
@@ -957,7 +831,7 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
                     const rel = file.slice(appPath.length + 1);
                     const norm = rel.replace(/\\/g, '/');
                     // Paraglide usage: the reactive useLocale() hook or an import from the
-                    // local `@/i18n` scaffold (messages `m`, mKey/mList) — either means
+                    // local `@/i18n` scaffold (the typed `m` namespace) — either means
                     // strings flow through compiled messages.
                     if (/\buseLocale\s*\(/.test(text) ||
                         /from\s+['"]@\/i18n(?:\/[\w-]+)?['"]/.test(text)) {
@@ -1009,6 +883,37 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
                         ? [`  …and ${rawMantineFiles.length - 10} more`]
                         : []), 'Keep "@mantine/core/styles.css", @mantine/hooks and @mantine/notifications imports as-is.'));
                 }
+                // ── one-click actor sign-in (the "Sign in as …" quick login) ────────
+                // Any frontend that ships a login screen must also ship the dev-only
+                // actor switcher, so the app can be reviewed as each scenario persona
+                // without knowing a password. Without it the reviewer is locked out of
+                // their own sandbox. Only fires when a login surface exists — an app
+                // with no auth has nothing to attach the control to.
+                // Next.js keeps its routes outside src/, so scan app/ and pages/ too.
+                const isNextApp = !!appAllDeps['next'];
+                const uiFiles = isNextApp
+                    ? [
+                        ...srcFiles,
+                        ...(await listSourceFiles(join(appPath, 'app'))),
+                        ...(await listSourceFiles(join(appPath, 'pages'))),
+                    ]
+                    : srcFiles;
+                const loginFiles = [];
+                let hasQuickLogin = false;
+                for (const file of uiFiles) {
+                    const text = await readTextSafe(file);
+                    if (!text)
+                        continue;
+                    const rel = file.slice(appPath.length + 1).replace(/\\/g, '/');
+                    if (LOGIN_FILE_PATTERN.test(rel))
+                        loginFiles.push(rel);
+                    if (ACTOR_QUICK_LOGIN_PATTERNS.some((p) => p.test(text))) {
+                        hasQuickLogin = true;
+                    }
+                }
+                if (loginFiles.length > 0 && !hasQuickLogin) {
+                    e(`app-missing-actor-quick-login-${name}`, `apps/${name} has a login screen (${loginFiles[0]}) but no one-click actor sign-in — nobody can view the app as a scenario persona without a password`, join(appPath, loginFiles[0]), lines('Add the dev-only "Sign in as …" switcher and render it from the login screen:', '1. lib/auth: devActors() reading the DEV_ACTORS env var, and', '   signInAsActor(email) → POST `${apiUrl()}/auth/sign-in/actor`', '   with { email, secret } and credentials: "include".', '2. components/DevActorSwitcher.tsx: a Menu of the declared actors,', '   each Menu.Item signing in as that persona. Render null when', '   devActors() is empty, so it disappears in production.', `3. Render <DevActorSwitcher /> from ${loginFiles[0]}.`, 'Reference: templates/starter-template/apps/app/src/components/DevActorSwitcher.tsx.'));
+                }
             }
         }
         // ── singleton-sensitive deps must resolve to ONE physical copy ─────────
@@ -1155,11 +1060,6 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
     if (!existsSync(join(root, 'packages', 'components'))) {
         info('components-missing', 'packages/components/ not found — Fabric design features require a components package', join(root, 'packages', 'components'), `Create packages/components/ with your shared UI components. See ${designDocUrl}`);
     }
-    // ── packages/functions-sdk/ ───────────────────────────────────────────
-    const sdkDir = join(root, 'packages', 'functions-sdk');
-    if (!existsSync(sdkDir)) {
-        info('functions-sdk-missing', 'packages/functions-sdk/ not found — generated RPC client and React Query hooks will not be available', sdkDir, lines('Create a workspace at `packages/functions-sdk/`.', 'Minimum structure:', '- packages/functions-sdk/package.json', '- packages/functions-sdk/src/pikku/', 'Point `pikku.config.json` clientFiles to:', '- packages/functions-sdk/src/pikku/rpc-map.gen.d.ts', '- packages/functions-sdk/src/pikku/api.gen.ts', 'This package is the home for generated client artifacts, not handwritten server code.'));
-    }
     // ── frontend type-check (what the build container actually runs) ───────
     // Every check above is a heuristic standing in for this compile. The build
     // container type-checks each deployable frontend and aborts the deploy on a

package/dist/src/functions/commands/all.d.ts

@@ -1 +1 @@
-export declare const all: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const all: import("#pikku").PikkuFunctionSessionlessConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/bootstrap.d.ts

@@ -1 +1 @@
-export declare const bootstrap: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const bootstrap: import("#pikku").PikkuFunctionSessionlessConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/bootstrap.js

@@ -5,6 +5,9 @@ export const bootstrap = pikkuVoidFunc({
         await getInspectorState(false, true, true);
         // Before function types: they import ScopeId from the scopes codegen.
         await rpc.invoke('pikkuScopes', { bootstrap: true });
+        // Before function types too: personas import SystemRoleName.
+        await rpc.invoke('pikkuRoles', { bootstrap: true });
+        await rpc.invoke('pikkuPersonas', { bootstrap: true });
         await rpc.invoke('pikkuFunctionTypesSplit', { bootstrap: true });
         // Stub auth.types.ts (if better-auth is used) so the pikkuBetterAuth
         // re-export resolves before any user file is imported.

package/dist/src/functions/commands/db-audit.js

@@ -7,7 +7,7 @@ export const dbAudit = pikkuSessionlessFunc({
         const userConfig = await loadUserConfigForDb({ config, logger });
         if (!userConfig)
             return;
-        const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir);
+        const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir, config.db);
         if (!resolved) {
             logger.error('pikku db audit: no database configured — set sqliteDb or postgresUrl in your createConfig.');
             throw new Error('no database configured');

package/dist/src/functions/commands/db-baseline.js

@@ -19,7 +19,7 @@ export const dbBaseline = pikkuSessionlessFunc({
         const userConfig = await loadUserConfigForDb({ config, logger });
         if (!userConfig)
             return;
-        const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir);
+        const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir, config.db);
         if (!resolved) {
             logger.error('pikku db baseline: no database configured — set sqliteDb or postgresUrl in your createConfig.');
             throw new Error('no database configured');

package/dist/src/functions/commands/db-check.js

@@ -18,17 +18,18 @@ export const dbCheck = pikkuSessionlessFunc({
         const userConfig = await loadUserConfigForDb({ config, logger });
         if (!userConfig)
             return;
-        const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir);
+        const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir, config.db);
         if (!resolved) {
             logger.error('pikku db check: no database configured — set sqliteDb or postgresUrl in your createConfig.');
             throw new Error('no database configured');
         }
         const drift = await computeSchemaDrift(resolved, config.rootDir, config.srcDirectories, logger);
-        // Table names elide the `public` schema, which reads as ambiguous in a
-        // report whose whole point can be a second copy of `app.orders` sitting in
-        // `public`. Put the schema back for display only.
+        // Table names elide the schema they landed in, which reads as ambiguous in
+        // a report whose whole point can be a second copy of `app.orders` sitting
+        // in `public`. Put the schema back for display only — the configured one
+        // when there is one, since that is where these tables belong.
         const qualify = (table) => resolved.dialect === 'postgres' && !table.includes('.')
-            ? `public.${table}`
+            ? `${resolved.schema ?? 'public'}.${table}`
             : table;
         if (drift.runtimeTables.length) {
             logger.info(`db check: ${drift.runtimeTables.length} table(s) the pikku runtime created at boot, which no migration records:`);

package/dist/src/functions/commands/db-codegen.js

@@ -17,7 +17,7 @@ export const dbCodegen = pikkuSessionlessFunc({
         const userConfig = await loadUserConfigForDb({ config, logger });
         if (!userConfig)
             return;
-        const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir);
+        const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir, config.db);
         if (!resolved) {
             logger.error('pikku db codegen: no database configured — set sqliteDb or postgresUrl in your createConfig.');
             throw new Error('no database configured');

package/dist/src/functions/commands/db-generate.js

@@ -7,7 +7,7 @@ export const dbGenerate = pikkuSessionlessFunc({
         const userConfig = await loadUserConfigForDb({ config, logger });
         if (!userConfig)
             return;
-        const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir);
+        const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir, config.db);
         if (!resolved) {
             logger.error('pikku db generate: no database configured — set sqliteDb or postgresUrl in your createConfig.');
             throw new Error('no database configured');

package/dist/src/functions/commands/db-migrate.js

@@ -7,7 +7,7 @@ export const dbMigrate = pikkuSessionlessFunc({
         const userConfig = await loadUserConfigForDb({ config, logger });
         if (!userConfig)
             return;
-        const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir);
+        const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir, config.db);
         if (!resolved) {
             logger.error('pikku db migrate: no database configured — set sqliteDb or postgresUrl in your createConfig.');
             throw new Error('no database configured');

package/dist/src/functions/commands/db-reset.d.ts

@@ -1 +1,15 @@
-export declare const dbReset: import("#pikku").PikkuFunctionConfig<{}, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{}, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<{}, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+/**
+ * Wipe the dev database, replay every migration, then apply the dev seed.
+ *
+ * Seeding lives here rather than in a command of its own so it only ever meets
+ * a freshly migrated, empty database. That is what lets a seed file be plain
+ * `INSERT`s: there is no path that applies it twice, so it never has to defend
+ * itself with `INSERT OR IGNORE` or `ON CONFLICT DO NOTHING`.
+ */
+export declare const dbReset: import("#pikku").PikkuFunctionConfig<{
+    noSeed?: boolean;
+}, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{
+    noSeed?: boolean;
+}, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<{
+    noSeed?: boolean;
+}, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/db-reset.js

@@ -1,9 +1,17 @@
 import { pikkuSessionlessFunc } from '#pikku';
-import { resolveDb, reset, migrateAndCodegen, seed } from '../db/local-db.js';
+import { resolveDb, reset, migrateAndCodegen, devSeed } from '../db/local-db.js';
 import { loadUserConfigForDb } from './db-shared.js';
+/**
+ * Wipe the dev database, replay every migration, then apply the dev seed.
+ *
+ * Seeding lives here rather than in a command of its own so it only ever meets
+ * a freshly migrated, empty database. That is what lets a seed file be plain
+ * `INSERT`s: there is no path that applies it twice, so it never has to defend
+ * itself with `INSERT OR IGNORE` or `ON CONFLICT DO NOTHING`.
+ */
 export const dbReset = pikkuSessionlessFunc({
     remote: true,
-    func: async ({ logger, config }) => {
+    func: async ({ logger, config }, { noSeed }) => {
         if (process.env.NODE_ENV === 'production') {
             logger.error('pikku db reset refused: NODE_ENV=production. This command only runs in dev.');
             throw new Error('pikku db reset refused: NODE_ENV=production');
@@ -11,7 +19,7 @@ export const dbReset = pikkuSessionlessFunc({
         const userConfig = await loadUserConfigForDb({ config, logger });
         if (!userConfig)
             return;
-        const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir);
+        const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir, config.db);
         if (!resolved) {
             logger.error('pikku db reset: no database configured — set sqliteDb or postgresUrl in your createConfig.');
             throw new Error('no database configured');
@@ -35,9 +43,13 @@ export const dbReset = pikkuSessionlessFunc({
         logger.info(zod.written
             ? `db reset: regenerated ${zod.outFile} (${zod.tables.length} tables)`
             : `db reset: ${zod.outFile} unchanged`);
-        const seedResult = await seed(resolved);
-        if (seedResult.applied) {
-            logger.info(`db reset: seeded ${resolved.seedFile} (${seedResult.bytes} bytes)`);
+        if (noSeed) {
+            logger.info('db reset: --no-seed, leaving the database empty');
+            return;
         }
+        const devSeedResult = await devSeed(resolved);
+        logger.info(devSeedResult.applied
+            ? `db reset: seeded ${resolved.devSeedFile} (${devSeedResult.bytes} bytes)`
+            : `db reset: no ${resolved.devSeedFile} found, database is empty`);
     },
 });

package/dist/src/functions/commands/db-shared.d.ts

@@ -1,6 +1,20 @@
 export interface UserConfigShape {
     sqliteDb?: string;
     postgresUrl?: string;
+    /**
+     * Postgres extensions the CLI's embedded PGlite databases must load — the
+     * local dev database, and the shadow one every `db` command migrates to type
+     * and diff a schema.
+     *
+     * A bare name is one of PGlite's bundled contrib extensions (`hstore`,
+     * `citext`, `uuid_ossp`, …) and needs nothing installed. Anything else is a
+     * package the project depends on, such as `@electric-sql/pglite-pgvector`.
+     *
+     * Needed even when `postgresUrl` points at a server that already has the
+     * extension: the shadow database is PGlite regardless, so a `CREATE EXTENSION`
+     * in a migration fails there unless it is declared here.
+     */
+    pgliteExtensions?: string[];
     [key: string]: unknown;
 }
 interface LoadOptions {

package/dist/src/functions/commands/deploy-info.d.ts

@@ -1 +1 @@
-export declare const deployInfo: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const deployInfo: import("#pikku").PikkuFunctionSessionlessConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/dev-ai-runner.d.ts

@@ -7,10 +7,22 @@ import type { AIAgentRunnerService } from '@pikku/core/services';
  * has no equivalent, so agents 503 with AIProviderNotConfiguredError unless we
  * construct one here. When an OpenAI-compatible base URL + key are present
  * (fabric injects LITELLM_PROXY_URL/LITELLM_API_KEY; the standard OPENAI_*
- * vars are also honored) we point a single openai-compatible provider at it and
- * register it under every common provider prefix. Returns undefined when no AI
- * env is configured (agents stay disabled, with the clear downstream error) or
- * when the AI SDK packages aren't installed in the project.
+ * vars are also honored) we point one provider at it and register it under
+ * `'*'`, so every provider prefix resolves to it. The CLI ships the SDK rather
+ * than asking the project for it — behind a proxy one openai-compatible
+ * provider answers for `openai/…`, `anthropic/…` and `google/…` alike, so there
+ * was never a per-vendor package worth making somebody install. The project's
+ * own copies still win when it has them. Returns undefined when no AI env is
+ * configured (agents stay disabled, with the clear downstream error) or when
+ * the SDK packages cannot be loaded from either place.
+ *
+ * Audio does not work here: `@ai-sdk/openai-compatible` exposes only
+ * language/embedding/image models, so a voice agent under `pikku dev` throws
+ * `Provider does not support transcription models`. Fixing that means the full
+ * `@ai-sdk/openai` provider, which assumes OpenAI's own request specifics — a
+ * bad default for a path whose entire purpose is fronting arbitrary gateways.
+ * If it becomes worth it, delegate just `transcription`/`speech` to the full
+ * provider and leave everything else on this one.
  */
 export declare function createDevAIAgentRunner({ logger, projectRoot, variables, }: {
     logger: Logger;