@pikku/cli 0.12.96 → 0.12.99

package/dist/.pikku/workflow/meta/allWorkflow.gen.json

@@ -261,9 +261,15 @@
         "User admin functions": {
             "nodeId": "User admin functions",
             "rpcName": "pikkuUserAdminFunctions",
-            "next": "Events scaffold",
+            "next": "Virtual user functions",
             "stepHash": "831f37173651"
         },
+        "Virtual user functions": {
+            "nodeId": "Virtual user functions",
+            "rpcName": "pikkuVirtualUserFunctions",
+            "next": "Events scaffold",
+            "stepHash": "4f96c6158127"
+        },
         "Events scaffold": {
             "nodeId": "Events scaffold",
             "rpcName": "pikkuEventsScaffold",
@@ -345,25 +351,25 @@
         "Re-inspect after agents": {
             "nodeId": "Re-inspect after agents",
             "flow": "inline",
-            "next": "Secrets (post-auth)"
+            "next": "Secrets (post-scaffold)"
         },
-        "Secrets (post-auth)": {
-            "nodeId": "Secrets (post-auth)",
+        "Secrets (post-scaffold)": {
+            "nodeId": "Secrets (post-scaffold)",
             "rpcName": "pikkuSecrets",
-            "next": "Credentials (post-auth)",
-            "stepHash": "f263e11ae304"
+            "next": "Credentials (post-scaffold)",
+            "stepHash": "39dc613ab885"
         },
-        "Credentials (post-auth)": {
-            "nodeId": "Credentials (post-auth)",
+        "Credentials (post-scaffold)": {
+            "nodeId": "Credentials (post-scaffold)",
             "rpcName": "pikkuCredentials",
-            "next": "Variables (post-auth)",
-            "stepHash": "ab2438dcbd2b"
+            "next": "Variables (post-scaffold)",
+            "stepHash": "c9c202f0bf70"
         },
-        "Variables (post-auth)": {
-            "nodeId": "Variables (post-auth)",
+        "Variables (post-scaffold)": {
+            "nodeId": "Variables (post-scaffold)",
             "rpcName": "pikkuVariables",
             "next": "Schemas",
-            "stepHash": "df261a647c97"
+            "stepHash": "047ea7a92357"
         },
         "Schemas": {
             "nodeId": "Schemas",
@@ -628,5 +634,5 @@
     "entryNodeIds": [
         "Bootstrap inspect"
     ],
-    "graphHash": "a29b47e4387d"
+    "graphHash": "c8f162576369"
 }

package/dist/.pikku/workflow/pikku-personas.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.96
+ * This file was generated by @pikku/cli@0.12.99
  */
 /** Personas declared with definePersonas() */
 import { createHttpPersonas } from '@pikku/core/persona';

package/dist/.pikku/workflow/pikku-workflow-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.96
+ * This file was generated by @pikku/cli@0.12.99
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import { template } from '@pikku/core/workflow';
@@ -20,12 +20,12 @@ export interface TypedWorkflow extends PikkuWorkflowWire {
     do<T>(stepName: string, fn: () => T | Promise<T>, options?: WorkflowStepOptions): Promise<T>;
 }
 /**
- * The typed half of a scenario wire: `step` and its `given`/`when`/`then`
- * sugar, narrowed to the names declared by `pikkuScenarioStep` in this project.
- * The phase only changes the prose the reporter renders.
+ * The typed half of a scenario wire: `given`/`when`/`then`, narrowed to the
+ * names declared by `pikkuScenarioStep` in this project. `given` and `when`
+ * differ only in the prose the reporter renders; `then` additionally makes the
+ * step's bindings witnesses rather than alternatives.
  */
 export interface TypedScenarioSteps {
-    step<K extends keyof FlattenedScenarioStepMap>(stepName: string, stepFunc: K, data?: FlattenedScenarioStepMap[K]['input'], options?: ScenarioStepOptions): Promise<FlattenedScenarioStepMap[K]['output']>;
     given<K extends keyof FlattenedScenarioStepMap>(stepName: string, stepFunc: K, data?: FlattenedScenarioStepMap[K]['input'], options?: ScenarioStepOptions): Promise<FlattenedScenarioStepMap[K]['output']>;
     when<K extends keyof FlattenedScenarioStepMap>(stepName: string, stepFunc: K, data?: FlattenedScenarioStepMap[K]['input'], options?: ScenarioStepOptions): Promise<FlattenedScenarioStepMap[K]['output']>;
     then<K extends keyof FlattenedScenarioStepMap>(stepName: string, stepFunc: K, data?: FlattenedScenarioStepMap[K]['input'], options?: ScenarioStepOptions): Promise<FlattenedScenarioStepMap[K]['output']>;
@@ -180,7 +180,7 @@ export declare function pikkuFeature<const Scenarios extends readonly unknown[]>
  */
 export type PikkuFunctionScenarioStep<In = unknown, Out = never, Surface extends 'browser' | 'cli' | 'default' = 'default'> = PikkuFunctionSessionless<In, Out, Surface extends 'default' ? 'scenarioStep' : 'scenarioStep' | Surface>;
 export type PikkuScenarioStepConfigWithSchema<InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined> = {
-    /** Registered name — this is the string `scenario.step()` references. */
+    /** Registered name — this is the string `scenario.given()` references. */
     name: string;
     /**
      * What this step does, for the console and for whoever reads the source. It

package/dist/.pikku/workflow/pikku-workflow-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.96
+ * This file was generated by @pikku/cli@0.12.99
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import { template } from '@pikku/core/workflow';

package/dist/.pikku/workflow/pikku-workflow-wirings-meta.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.96
+ * This file was generated by @pikku/cli@0.12.99
  */
 import { pikkuState } from '@pikku/core/internal';
 import allWorkflowMeta from './meta/allWorkflow.gen.json' with { type: 'json' };

package/dist/.pikku/workflow/pikku-workflow-wirings.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.96
+ * This file was generated by @pikku/cli@0.12.99
  */
 import { addWorkflow } from '@pikku/core/workflow';
 import './pikku-workflow-wirings-meta.gen.js';

package/dist/bin/pikku-bin.mjs

@@ -11,8 +11,8 @@ async function checkForUpdate() {
     })
     if (!res.ok) return
     const { version: latest } = await res.json()
-    if (latest !== '0.12.96') {
-      process.stderr.write(`\n  Update available  0.12.96 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
+    if (latest !== '0.12.99') {
+      process.stderr.write(`\n  Update available  0.12.99 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
     }
   } catch {}
 }

package/dist/src/cli.wiring.js

@@ -22,7 +22,6 @@ import { dbCodegen } from './functions/commands/db-codegen.js';
 import { dbCheck } from './functions/commands/db-check.js';
 import { dbBaseline } from './functions/commands/db-baseline.js';
 import { dbExport } from './functions/commands/db-export.js';
-import { dbSeed } from './functions/commands/db-seed.js';
 import { dbReset } from './functions/commands/db-reset.js';
 import { dbAudit } from './functions/commands/db-audit.js';
 import { scopesAudit } from './functions/commands/scopes-audit.js';
@@ -34,7 +33,7 @@ import { workspaceValidate, renderWorkspaceValidate, } from './functions/command
 import { knowledgeValidate, renderKnowledgeValidate, } from './functions/commands/knowledge-validate.js';
 import { knowledgeIndex, renderKnowledgeIndex, } from './functions/commands/knowledge-index.js';
 import { scenarioRun, scenarioList } from './functions/commands/scenario.js';
-import { personaList, personaRun, } from './functions/commands/persona.js';
+import { personaList, personaRun } from './functions/commands/persona.js';
 import { personaSync } from './functions/commands/persona-sync.js';
 import { pikkuVersionsInit } from './functions/commands/versions-init.js';
 import { pikkuEmailsInit } from './functions/commands/emails-init.js';
@@ -351,13 +350,15 @@ wireCLI({
                     func: dbExport,
                     description: "Publish this package's schema so projects consuming it as an addon can create its tables",
                 }),
-                seed: pikkuCLICommand({
-                    func: dbSeed,
-                    description: 'Apply db/seed.sql to the dev database',
-                }),
                 reset: pikkuCLICommand({
                     func: dbReset,
-                    description: 'Wipe and recreate the dev database (migrate + seed)',
+                    description: 'Wipe and recreate the dev database: migrate, then apply db/<engine>-dev-seed.sql. Dev only — it refuses to run in production',
+                    options: {
+                        noSeed: {
+                            description: 'Stop after migrating, leaving the database empty. For working on an empty-state or onboarding flow the test data would hide',
+                            default: false,
+                        },
+                    },
                 }),
                 audit: pikkuCLICommand({
                     func: dbAudit,

package/dist/src/fabric/functions/validate.function.js

@@ -6,7 +6,7 @@ import { createRequire } from 'node:module';
 import { pikkuSessionlessFunc } from '../../../.pikku/pikku-types.gen.js';
 import { added, changed, removed, dim } from '../lib/output.js';
 import { typeCheckFrontends } from '../lib/frontend-typecheck.js';
-import { runKnowledgeValidate } from '@pikku/knowledge';
+import { readJsonSafe, readTextSafe, runSharedProjectChecks, } from '../../functions/validate/shared-checks.js';
 const FindingSchema = z.object({
     id: z.string(),
     severity: z.enum(['error', 'warn', 'info']),
@@ -47,26 +47,6 @@ async function findProjectRoot(startDir) {
         dir = parent;
     }
 }
-async function readJsonSafe(path) {
-    if (!existsSync(path))
-        return null;
-    try {
-        return JSON.parse(await readFile(path, 'utf8'));
-    }
-    catch {
-        return null;
-    }
-}
-async function readTextSafe(path) {
-    if (!existsSync(path))
-        return null;
-    try {
-        return await readFile(path, 'utf8');
-    }
-    catch {
-        return null;
-    }
-}
 // List .ts/.tsx source files under a directory (skips node_modules). Used to
 // scan an app for raw @mantine/core imports and i18n usage.
 async function listSourceFiles(dir) {
@@ -141,6 +121,23 @@ const SINGLETON_SENSITIVE_PKGS = [
     'react',
     'react-dom',
 ];
+// A file whose name says "this is the login surface". Used to decide whether an
+// app needs the actor quick-login control — an app with no login screen has
+// nothing to attach it to. Matched against the path relative to the app root, so
+// it covers src/pages/LoginPage.tsx as well as Next's app/login/page.tsx.
+const LOGIN_FILE_PATTERN = /(?:^|\/)[\w[\]-]*(?:login|sign-?in)[\w[\]-]*(?:\/|\.)/i;
+// Fingerprints of the dev-only "Sign in as …" quick login (the actor switcher):
+// one click signs in as a declared scenario persona, no password. Any one of
+// these means the app actually wires actor sign-in — the component's own
+// definition is excluded, since defining it without rendering it locks the
+// reviewer out just as thoroughly.
+// Canonical implementation: starter-template's DevActorSwitcher, rendered from
+// LoginPage and backed by signInAsActor() → POST /auth/sign-in/actor.
+const ACTOR_QUICK_LOGIN_PATTERNS = [
+    /<\s*DevActorSwitcher\b/,
+    /(?<!function\s)\bsignInAsActor\s*\(/,
+    /\/auth\/sign-in\/actor/,
+];
 // Minimum @pikku/* versions Fabric requires. The pikku packages are versioned
 // independently (e.g. @pikku/cli moves faster than @pikku/core), so this is a
 // per-package floor map, not a single number. Only listed packages are
@@ -202,6 +199,19 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
         findings.push({ id, severity: 'info', message, path, fixHint });
     };
     const lines = (...parts) => parts.join('\n');
+    // ── everything true of any pikku project ───────────────────────────────
+    // Fabric validate is workspace validate plus the deploy-shaped checks. The
+    // two used to be separate walks over the same project that duplicated sixteen
+    // findings verbatim, and each carried checks the other lacked for no reason
+    // anyone could name.
+    //
+    // knowledge: decisions/internals/one-project-shape-check-two-validators.md
+    const shared = await runSharedProjectChecks(root);
+    findings.push(...shared.findings);
+    const { pikkuConfig, dbEngine } = shared;
+    const pikkuConfigPath = join(root, 'pikku.config.json');
+    const rootPkgPath = join(root, 'package.json');
+    const rootPkg = await readJsonSafe(rootPkgPath);
     // ── pikkufabric.config.json ────────────────────────────────────────────
     // Not required to run validate — downgraded to info so any pikku project
     // can be checked for compatibility before it is linked to a fabric account.
@@ -216,69 +226,6 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
     else if (fabricConfig.projectId === '__PROJECT_ID__') {
         info('fabric-config-placeholder-project-id', 'pikkufabric.config.json has a placeholder projectId ("__PROJECT_ID__") — project is not linked', fabricConfigPath, lines('The file exists but still contains the placeholder project id.', 'Run `pikku fabric link` to replace it automatically, or edit the file and set:', '"projectId": "<real-project-id>"'));
     }
-    // ── root pikku.config.json ─────────────────────────────────────────────
-    const pikkuConfigPath = join(root, 'pikku.config.json');
-    const pikkuConfig = await readJsonSafe(pikkuConfigPath);
-    if (!pikkuConfig) {
-        e('pikku-config-missing', 'pikku.config.json not found at project root', pikkuConfigPath, lines('Create `pikku.config.json` at the repo root.', 'Minimum useful shape:', '{', '  "srcDirectories": ["packages/functions/src"],', '  "outDir": "packages/functions/.pikku",', '  "clientFiles": {', '    "rpcMapDeclarationFile": "packages/functions-sdk/src/pikku/rpc-map.gen.d.ts",', '    "reactQueryFile": "packages/functions-sdk/src/pikku/api.gen.ts"', '  }', '}'));
-    }
-    else {
-        if (!pikkuConfig.srcDirectories) {
-            e('pikku-config-no-src-dirs', 'pikku.config.json missing "srcDirectories"', pikkuConfigPath, 'Add "srcDirectories": ["packages/functions/src"] to pikku.config.json');
-        }
-        if (!pikkuConfig.outDir) {
-            e('pikku-config-no-out-dir', 'pikku.config.json missing "outDir"', pikkuConfigPath, 'Add "outDir": "packages/functions/.pikku" to pikku.config.json');
-        }
-        if (!pikkuConfig.clientFiles) {
-            info('pikku-config-no-client-files', 'pikku.config.json missing "clientFiles" — generated RPC client files and React Query hooks will not be written', pikkuConfigPath, lines('Add a `clientFiles` block to `pikku.config.json`.', 'Recommended values:', '"clientFiles": {', '  "rpcMapDeclarationFile": "packages/functions-sdk/src/pikku/rpc-map.gen.d.ts",', '  "reactQueryFile": "packages/functions-sdk/src/pikku/api.gen.ts"', '}', 'Those files should live in `packages/functions-sdk/src/pikku/` and are generated by Pikku.'));
-        }
-        // Each scaffold key gates generation of a public surface the Fabric console
-        // calls. Missing one means those endpoints are never generated, so the
-        // console 404s even though the functions/agents/workflows are wired. The
-        // generated file paths auto-derive from the flag (see pikku-cli-config), so
-        // setting the flag is sufficient. console/rpc/agent/workflow gate HTTP/RPC
-        // endpoints the console hits directly → error; events gates the realtime
-        // channel (feature-dependent, no template ships it yet) → warn.
-        const REQUIRED_SCAFFOLD = [
-            {
-                key: 'console',
-                severity: 'error',
-                surface: 'app introspection (console:getFunctionsMeta and friends) — the sandbox builder shows no functions',
-                value: 'true',
-            },
-            {
-                key: 'rpc',
-                severity: 'error',
-                surface: 'the generic /rpc/:name endpoint',
-                value: 'true',
-            },
-            {
-                key: 'agent',
-                severity: 'error',
-                surface: 'the agent endpoints (/rpc/agent/:agentName) — the agent playground 404s',
-                value: 'true',
-            },
-            {
-                key: 'workflow',
-                severity: 'error',
-                surface: 'the workflow endpoints (/workflow/:workflowName/start) — triggering a workflow 404s',
-                value: 'true',
-            },
-            {
-                key: 'events',
-                severity: 'warn',
-                surface: 'the realtime events channel',
-                value: 'true',
-            },
-        ];
-        for (const s of REQUIRED_SCAFFOLD) {
-            if (pikkuConfig.scaffold?.[s.key])
-                continue;
-            const report = s.severity === 'error' ? e : w;
-            report(`pikku-config-no-scaffold-${s.key}`, `pikku.config.json scaffold is missing "${s.key}" — ${s.surface} is never generated, so the Fabric console 404s for it`, pikkuConfigPath, lines(`Add "${s.key}" to the scaffold block in pikku.config.json:`, '"scaffold": {', '  "pikkuDir": "packages/functions/src/scaffold",', `  "${s.key}": ${s.value}`, '}', 'Then re-run codegen (`pikku all`) and restart the dev server.'));
-        }
-    }
-    const dbEngine = pikkuConfig?.db?.engine ?? 'sqlite';
     // ── .gitignore must ignore generated/runtime artifacts ─────────────────
     // These are regenerated on every dev boot / scaffold / codegen. Committing
     // them lets a stale copy shadow the freshly generated one — a committed
@@ -318,45 +265,6 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
             w(`missing-required-file-${relPath.replace(/[^a-z0-9]/gi, '-')}`, `${relPath} is missing — this file must be committed to the project`, join(root, relPath), lines(`Create ${relPath} and commit it.`, 'The starter-template ships a stub you can copy as a starting point.'));
         }
     }
-    // ── knowledge base ─────────────────────────────────────────────────────
-    // Delegated to the shared checker rather than asserting a list of filenames.
-    // The three flat files this used to require (design-language.md, security.md,
-    // technology.md) are not a knowledge base — they are three documents nothing
-    // can link into, and the profile now organises the same content into sections
-    // of notes. Fabric adds decisions/design/ on top of what is checked here.
-    const knowledge = await runKnowledgeValidate(root, join(root, typeof pikkuConfig?.outDir === 'string' ? pikkuConfig.outDir : '.pikku'));
-    for (const finding of knowledge.findings) {
-        findings.push({ ...finding, path: join(root, finding.path) });
-    }
-    const rootPkgPath = join(root, 'package.json');
-    const rootPkg = await readJsonSafe(rootPkgPath);
-    if (!rootPkg) {
-        e('root-package-missing', 'root package.json not found', rootPkgPath, 'Create a root package.json with workspaces: {"workspaces": ["packages/*", "apps/*"]}');
-    }
-    else {
-        if (!rootPkg.workspaces) {
-            w('root-package-no-workspaces', 'root package.json missing "workspaces"', rootPkgPath, 'Add "workspaces": ["packages/*", "apps/*"] to enable yarn workspaces');
-        }
-        const allDeps = {
-            ...rootPkg.dependencies,
-            ...rootPkg.devDependencies,
-        };
-        if (!allDeps['@pikku/core']) {
-            e('missing-core', '@pikku/core not in dependencies', rootPkgPath, 'Add "@pikku/core": "file:./vendor/pikku-core.tgz" to dependencies');
-        }
-        // Vendor tgz presence — only check file: deps that reference a vendor/ path
-        for (const [pkg, spec] of Object.entries(allDeps)) {
-            if (typeof spec !== 'string' || !spec.startsWith('file:'))
-                continue;
-            const relPath = spec.slice(5); // strip 'file:'
-            if (!relPath.includes('vendor'))
-                continue;
-            const absPath = join(root, relPath);
-            if (!existsSync(absPath)) {
-                w(`vendor-missing-${pkg.replace(/[@/]/g, '-')}`, `Vendor file missing for ${pkg}: ${relPath}`, absPath, `Run \`pikku pack\` in the pikku source repo and copy the output to ${relPath}`);
-            }
-        }
-    }
     // ── @pikku/* minimum versions ──────────────────────────────────────────
     // Scan every workspace manifest for @pikku/* deps below the required floor.
     // A stale @pikku/cli hangs `pikku dev`; a stale @pikku/core duplicates
@@ -589,16 +497,12 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
     const functionsSdkPkgName = (await readJsonSafe(join(root, 'packages', 'functions-sdk', 'package.json')))?.name;
     const themePkgName = (await readJsonSafe(join(root, 'packages', 'mantine-theme', 'package.json')))?.name;
     const componentsPkgName = (await readJsonSafe(join(root, 'packages', 'components', 'package.json')))?.name;
-    if (!existsSync(fnDir)) {
-        e('functions-pkg-missing', 'packages/functions/ directory not found', fnDir, 'Create packages/functions/ as a yarn workspace containing pikku.config.json, src/, and db/sqlite/');
-    }
-    else {
+    // packages/functions/ presence, its package.json, ESM, zod and layout are all
+    // asserted by runSharedProjectChecks — everything below is Fabric-specific.
+    if (existsSync(fnDir)) {
         const fnPkgPath = join(fnDir, 'package.json');
         const fnPkg = await readJsonSafe(fnPkgPath);
         if (fnPkg) {
-            if (fnPkg.type !== 'module') {
-                w('functions-pkg-no-esm', 'packages/functions/package.json is missing "type": "module"', fnPkgPath, 'Add "type": "module" to packages/functions/package.json — Cloudflare Workers require ES modules');
-            }
             // #pikku bare import — required by the injected fabric-telemetry.wiring.ts
             if (!fnPkg.imports?.['#pikku']) {
                 e('functions-pkg-missing-pikku-import', 'packages/functions/package.json is missing a bare "#pikku" entry in "imports" — the Fabric-injected telemetry middleware imports from "#pikku" and will fail to bundle without it', fnPkgPath, 'Add to "imports": { "#pikku": "./.pikku/pikku-types.gen.ts", "#pikku/*": "./.pikku/*" }');
@@ -660,13 +564,11 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
                 e('missing-ai-sdk-core', 'Project declares agent units but `ai` (the Vercel AI SDK) is not in packages/functions dependencies — it is a peer dependency of @pikku/ai-vercel and is not installed automatically', fnPkgPath, 'Run `yarn add ai` in packages/functions — must be in dependencies, not devDependencies');
             }
         }
-        // services.ts
+        // services.ts — its absence is reported by runSharedProjectChecks; what
+        // Fabric adds is which dialect it builds and whether it reads process.env.
         const servicesPath = join(fnDir, 'src', 'services.ts');
         const servicesText = await readTextSafe(servicesPath);
-        if (!servicesText) {
-            w('services-missing', 'packages/functions/src/services.ts not found', servicesPath, 'Create services.ts using pikkuServices() with LibsqlWebDialect from @pikku/kysely-sqlite — fabric injects DATABASE_URL at runtime');
-        }
-        else {
+        if (servicesText) {
             const usesKysely = /\bKysely\b/.test(servicesText);
             const usesLibsql = servicesText.includes('@pikku/kysely-sqlite') ||
                 servicesText.includes('LibsqlWebDialect');
@@ -785,13 +687,6 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
                     if (m)
                         nums.push(parseInt(m[1], 10));
                 }
-                for (let idx = 1; idx < nums.length; idx++) {
-                    if (nums[idx] !== nums[idx - 1] + 1) {
-                        const missing = `${nums[idx - 1] + 1}..${nums[idx] - 1}`;
-                        e('migration-gap', `Migration numbering gap: IDs ${missing} are missing`, migrationsDir, 'Migrations must be consecutive. Add the missing .sql file or renumber if not yet applied.');
-                        break;
-                    }
-                }
                 if (dbEngine !== 'postgres') {
                     // Check for PostgreSQL-specific syntax — Fabric uses Turso (SQLite/libSQL)
                     for (const f of files) {
@@ -809,13 +704,13 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
                 // readdir failure — skip
             }
         }
-        const seedPath = join(root, 'db', dbEngine === 'postgres' ? 'postgres-seed.sql' : 'sqlite-seed.sql');
-        if (!existsSync(seedPath)) {
-            e('seed-sql-missing', dbEngine === 'postgres'
-                ? 'db/postgres-seed.sql not found'
-                : 'db/sqlite-seed.sql not found', seedPath, dbEngine === 'postgres'
-                ? lines('Create `db/postgres-seed.sql`.', 'Use idempotent INSERT statements suitable for local/dev/test setup.', 'Keep it safe to re-run.')
-                : lines('Create `db/sqlite-seed.sql`.', 'Use idempotent `INSERT OR IGNORE` statements for local/dev/test data.', 'Keep it safe to re-run.'));
+        const devSeedPath = join(root, 'db', dbEngine === 'postgres' ? 'postgres-dev-seed.sql' : 'sqlite-dev-seed.sql');
+        if (!existsSync(devSeedPath)) {
+            e('dev-seed-sql-missing', dbEngine === 'postgres'
+                ? 'db/postgres-dev-seed.sql not found'
+                : 'db/sqlite-dev-seed.sql not found', devSeedPath, dbEngine === 'postgres'
+                ? lines('Create `db/postgres-dev-seed.sql`.', 'Use idempotent INSERT statements suitable for local/dev/test setup.', 'Keep it safe to re-run.')
+                : lines('Create `db/sqlite-dev-seed.sql`.', 'Use idempotent `INSERT OR IGNORE` statements for local/dev/test data.', 'Keep it safe to re-run.'));
         }
         // audit table — info if not present (optional feature)
         if (existsSync(migrationsDir)) {
@@ -831,27 +726,6 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
                 // readdir failure — skip
             }
         }
-        // db.types.ts — should only re-export from .pikku
-        const dbTypesPath = join(fnDir, 'src', 'types', 'db.types.ts');
-        const dbTypesText = await readTextSafe(dbTypesPath);
-        if (dbTypesText) {
-            const isReexport = dbTypesText.includes('.pikku/db/schema') ||
-                dbTypesText.includes('.pikku\\db\\schema');
-            const hasInlineTypes = /(?:^|\n)\s*(?:export\s+)?(?:interface\s+\w|type\s+\w+\s*=)/.test(dbTypesText);
-            if (hasInlineTypes && !isReexport) {
-                w('db-types-hand-edited', 'src/types/db.types.ts contains inline type definitions — it should only re-export from .pikku', dbTypesPath, "Replace the file with a single line: export type { DB } from '../../.pikku/db/schema.gen.js' then run `yarn db:types` to regenerate");
-            }
-        }
-        // Structure: src/functions/, src/wirings/, src/config.ts
-        if (!existsSync(join(fnDir, 'src', 'functions'))) {
-            info('functions-dir-missing', 'packages/functions/src/functions/ not found', join(fnDir, 'src', 'functions'), 'Create src/functions/ to hold pikkuSessionlessFunc definitions (one function per file)');
-        }
-        if (!existsSync(join(fnDir, 'src', 'wirings'))) {
-            info('wirings-dir-missing', 'packages/functions/src/wirings/ not found', join(fnDir, 'src', 'wirings'), 'Create src/wirings/ for transport bindings: *.http.ts, *.queue.ts, *.schedule.ts, *.channel.ts, *.cli.ts');
-        }
-        if (!existsSync(join(fnDir, 'src', 'config.ts'))) {
-            info('config-missing', 'packages/functions/src/config.ts not found', join(fnDir, 'src', 'config.ts'), "Create src/config.ts: export const createConfig = pikkuConfig(async () => ({ sqliteDb: '.pikku-runtime/dev.db' }))");
-        }
     }
     // ── declared frontends ────────────────────────────────────────────────
     // pikkufabric.config.json is unvalidated JSON, so every field below is a
@@ -957,7 +831,7 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
                     const rel = file.slice(appPath.length + 1);
                     const norm = rel.replace(/\\/g, '/');
                     // Paraglide usage: the reactive useLocale() hook or an import from the
-                    // local `@/i18n` scaffold (messages `m`, mKey/mList) — either means
+                    // local `@/i18n` scaffold (the typed `m` namespace) — either means
                     // strings flow through compiled messages.
                     if (/\buseLocale\s*\(/.test(text) ||
                         /from\s+['"]@\/i18n(?:\/[\w-]+)?['"]/.test(text)) {
@@ -1009,6 +883,37 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
                         ? [`  …and ${rawMantineFiles.length - 10} more`]
                         : []), 'Keep "@mantine/core/styles.css", @mantine/hooks and @mantine/notifications imports as-is.'));
                 }
+                // ── one-click actor sign-in (the "Sign in as …" quick login) ────────
+                // Any frontend that ships a login screen must also ship the dev-only
+                // actor switcher, so the app can be reviewed as each scenario persona
+                // without knowing a password. Without it the reviewer is locked out of
+                // their own sandbox. Only fires when a login surface exists — an app
+                // with no auth has nothing to attach the control to.
+                // Next.js keeps its routes outside src/, so scan app/ and pages/ too.
+                const isNextApp = !!appAllDeps['next'];
+                const uiFiles = isNextApp
+                    ? [
+                        ...srcFiles,
+                        ...(await listSourceFiles(join(appPath, 'app'))),
+                        ...(await listSourceFiles(join(appPath, 'pages'))),
+                    ]
+                    : srcFiles;
+                const loginFiles = [];
+                let hasQuickLogin = false;
+                for (const file of uiFiles) {
+                    const text = await readTextSafe(file);
+                    if (!text)
+                        continue;
+                    const rel = file.slice(appPath.length + 1).replace(/\\/g, '/');
+                    if (LOGIN_FILE_PATTERN.test(rel))
+                        loginFiles.push(rel);
+                    if (ACTOR_QUICK_LOGIN_PATTERNS.some((p) => p.test(text))) {
+                        hasQuickLogin = true;
+                    }
+                }
+                if (loginFiles.length > 0 && !hasQuickLogin) {
+                    e(`app-missing-actor-quick-login-${name}`, `apps/${name} has a login screen (${loginFiles[0]}) but no one-click actor sign-in — nobody can view the app as a scenario persona without a password`, join(appPath, loginFiles[0]), lines('Add the dev-only "Sign in as …" switcher and render it from the login screen:', '1. lib/auth: devActors() reading the DEV_ACTORS env var, and', '   signInAsActor(email) → POST `${apiUrl()}/auth/sign-in/actor`', '   with { email, secret } and credentials: "include".', '2. components/DevActorSwitcher.tsx: a Menu of the declared actors,', '   each Menu.Item signing in as that persona. Render null when', '   devActors() is empty, so it disappears in production.', `3. Render <DevActorSwitcher /> from ${loginFiles[0]}.`, 'Reference: templates/starter-template/apps/app/src/components/DevActorSwitcher.tsx.'));
+                }
             }
         }
         // ── singleton-sensitive deps must resolve to ONE physical copy ─────────
@@ -1155,11 +1060,6 @@ export async function runValidate(startDir = process.cwd(), opts = {}) {
     if (!existsSync(join(root, 'packages', 'components'))) {
         info('components-missing', 'packages/components/ not found — Fabric design features require a components package', join(root, 'packages', 'components'), `Create packages/components/ with your shared UI components. See ${designDocUrl}`);
     }
-    // ── packages/functions-sdk/ ───────────────────────────────────────────
-    const sdkDir = join(root, 'packages', 'functions-sdk');
-    if (!existsSync(sdkDir)) {
-        info('functions-sdk-missing', 'packages/functions-sdk/ not found — generated RPC client and React Query hooks will not be available', sdkDir, lines('Create a workspace at `packages/functions-sdk/`.', 'Minimum structure:', '- packages/functions-sdk/package.json', '- packages/functions-sdk/src/pikku/', 'Point `pikku.config.json` clientFiles to:', '- packages/functions-sdk/src/pikku/rpc-map.gen.d.ts', '- packages/functions-sdk/src/pikku/api.gen.ts', 'This package is the home for generated client artifacts, not handwritten server code.'));
-    }
     // ── frontend type-check (what the build container actually runs) ───────
     // Every check above is a heuristic standing in for this compile. The build
     // container type-checks each deployable frontend and aborts the deploy on a

package/dist/src/functions/commands/all.d.ts

@@ -1 +1 @@
-export declare const all: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const all: import("#pikku").PikkuFunctionSessionlessConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/bootstrap.d.ts

@@ -1 +1 @@
-export declare const bootstrap: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const bootstrap: import("#pikku").PikkuFunctionSessionlessConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/db-audit.js

@@ -7,7 +7,7 @@ export const dbAudit = pikkuSessionlessFunc({
         const userConfig = await loadUserConfigForDb({ config, logger });
         if (!userConfig)
             return;
-        const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir);
+        const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir, config.db);
         if (!resolved) {
             logger.error('pikku db audit: no database configured — set sqliteDb or postgresUrl in your createConfig.');
             throw new Error('no database configured');

package/dist/src/functions/commands/db-baseline.js

@@ -19,7 +19,7 @@ export const dbBaseline = pikkuSessionlessFunc({
         const userConfig = await loadUserConfigForDb({ config, logger });
         if (!userConfig)
             return;
-        const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir);
+        const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir, config.db);
         if (!resolved) {
             logger.error('pikku db baseline: no database configured — set sqliteDb or postgresUrl in your createConfig.');
             throw new Error('no database configured');

package/dist/src/functions/commands/db-check.js

@@ -18,17 +18,18 @@ export const dbCheck = pikkuSessionlessFunc({
         const userConfig = await loadUserConfigForDb({ config, logger });
         if (!userConfig)
             return;
-        const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir);
+        const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir, config.db);
         if (!resolved) {
             logger.error('pikku db check: no database configured — set sqliteDb or postgresUrl in your createConfig.');
             throw new Error('no database configured');
         }
         const drift = await computeSchemaDrift(resolved, config.rootDir, config.srcDirectories, logger);
-        // Table names elide the `public` schema, which reads as ambiguous in a
-        // report whose whole point can be a second copy of `app.orders` sitting in
-        // `public`. Put the schema back for display only.
+        // Table names elide the schema they landed in, which reads as ambiguous in
+        // a report whose whole point can be a second copy of `app.orders` sitting
+        // in `public`. Put the schema back for display only — the configured one
+        // when there is one, since that is where these tables belong.
         const qualify = (table) => resolved.dialect === 'postgres' && !table.includes('.')
-            ? `public.${table}`
+            ? `${resolved.schema ?? 'public'}.${table}`
             : table;
         if (drift.runtimeTables.length) {
             logger.info(`db check: ${drift.runtimeTables.length} table(s) the pikku runtime created at boot, which no migration records:`);

package/dist/src/functions/commands/db-codegen.js

@@ -17,7 +17,7 @@ export const dbCodegen = pikkuSessionlessFunc({
         const userConfig = await loadUserConfigForDb({ config, logger });
         if (!userConfig)
             return;
-        const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir);
+        const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir, config.db);
         if (!resolved) {
             logger.error('pikku db codegen: no database configured — set sqliteDb or postgresUrl in your createConfig.');
             throw new Error('no database configured');

package/dist/src/functions/commands/db-generate.js

@@ -7,7 +7,7 @@ export const dbGenerate = pikkuSessionlessFunc({
         const userConfig = await loadUserConfigForDb({ config, logger });
         if (!userConfig)
             return;
-        const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir);
+        const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir, config.db);
         if (!resolved) {
             logger.error('pikku db generate: no database configured — set sqliteDb or postgresUrl in your createConfig.');
             throw new Error('no database configured');

package/dist/src/functions/commands/db-migrate.js

@@ -7,7 +7,7 @@ export const dbMigrate = pikkuSessionlessFunc({
         const userConfig = await loadUserConfigForDb({ config, logger });
         if (!userConfig)
             return;
-        const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir);
+        const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir, config.db);
         if (!resolved) {
             logger.error('pikku db migrate: no database configured — set sqliteDb or postgresUrl in your createConfig.');
             throw new Error('no database configured');