@pikku/cli 0.12.122 → 0.12.124

package/CHANGELOG.md

@@ -1,3 +1,146 @@
+## 0.12.124
+
+### Patch Changes
+
+- e0106bb: fabric validate: honour better-auth `modelName` overrides in the auth schema check.
+
+  The check looked for migrations creating `user`, `session`, `account` and
+  `verification` — better-auth's default table names. An app that already owns a
+  `user` table renames the models (`user: { modelName: 'authUser' }`), and the
+  adapter's CamelCasePlugin then writes them as `auth_user`, `auth_session` and
+  so on. None of the default names appear in such an app's migrations, so a fully
+  migrated project was reported as having no better-auth schema at all — an error
+  it had no way to clear.
+
+  Each model now also matches its configured `modelName` and that name's
+  snake_case form, read from the source files that configure better-auth.
+
+- e0106bb: fabric validate: stop two scanners reporting false positives.
+
+  The undeclared-import scan read raw file text, so prose in a comment or a
+  description string matched its `from "..."` pattern — `Converted from the
+Gherkin scenario of the same name` reported a missing package named `signed`.
+  Comments are now blanked before the scan, and a specifier containing whitespace
+  is never a package name.
+
+  The scenario copy scan matched every string literal in the file against the
+  message catalogue, so an RPC payload field whose value happens to equal a label
+  was reported as hardcoded UI copy — `unit: 'kg'` flagged against a `unit_kg`
+  form suffix, where rewriting it to a message lookup would bind a stored value to
+  UI copy. A literal in `key: '...'` position now only counts when the key names
+  something the browser renders; bare locator arguments are unchanged.
+
+- e0106bb: fabric validate: stop the scenario copy scan reporting asserted values as UI copy.
+
+  `expect(item.unit, 'kg', 'the item unit')` compares a value an RPC returned.
+  The scan matched the literal against the message catalogue and reported it as
+  hardcoded copy that should be read from `unit_kg` — a fix that would bind a
+  stored value to a form label, so the assertion would then pass against whatever
+  the label happened to say.
+
+  A literal passed directly to `expect(...)` is no longer scanned. A locator
+  nested inside one still is: in `expect(await page.getByText('Save').count(), 1)`
+  the literal belongs to `getByText`.
+
+- 6d9c09c: Resolve a variable's declared default instead of dropping it.
+
+  `defineVariable` takes a schema, and a schema can carry a default — `z.enum(['https://api.github.com']).default('https://api.github.com')` is the shape most addons declare their base URL with. Nothing read it. `variables.get('GITHUB_BASE_URL')` returned `undefined` on a host that had not set it, and the `as string` at the call site hid that until a request went to `undefined/repos/...`.
+
+  The default now resolves in `TypedVariablesService`, which is the layer that knows what was declared — `VariablesService` only knows what a host put in it. A stored value always wins; a schema with no default still resolves to `undefined`.
+
+  `VariableStatus` gains `hasDefault`, and `getMissing()` no longer lists a variable that defaults: it has a value, just not one anybody has to supply. `isConfigured` still means what it said — that a host set it.
+
+  For this to work the generated `TYPED_VARIABLES_META` now carries the schema as a value rather than only `z.infer`-ing its type, so the schema module is retained in the emit instead of being elided.
+
+- ef775dc: validate: flag static imports of packages the deploy bundler stubs
+
+  The deploy bundler replaces the AI SDK packages (`@pikku/ai-vercel`, `@ai-sdk/*`,
+  `ai`) with `export {}` in every unit that does not require `agentRunner`, so a
+  static named import of one in `services.ts` fails to bundle with an opaque
+  esbuild error repeated once per unit. `pikku fabric validate` now reports this as
+  `services-static-stubbed-import` and points at the lazy-import shape the starter
+  template uses. The service-to-module map moved to its own module so the check and
+  the bundler read the same list.
+
+- 239332b: Move first-party product analytics out of application code and into the framework.
+
+  `createAnalytics<Event>({ endpoint })` in `@pikku/react` is the buffered beacon client: it is typed against the app's own event union, flushes on an interval, on size and on `pagehide`/`visibilitychange` (via `sendBeacon`, so the abandon-point events survive unload), never surfaces a failure to the user and never retries. It also carries the delegated `data-analytics-click` listener, registered in the capture phase so a component calling `stopPropagation()` cannot silence instrumentation, and merging `data-analytics-meta` from ancestors with nearest-wins. Put the client on the Pikku instance and `usePikkuAnalytics<Event>()` reaches it from the provider, alongside `usePikkuFetch` and `usePikkuRPC`.
+
+  `requireOrigin()` in `@pikku/core/middleware` is a server-side origin lock for any unauthed route, and is re-exported from the generated `#pikku/middleware` leaf alongside `cors`. Unlike `cors()` — which only sets response headers a non-browser client ignores — it rejects with a 403 before the function body. Comparison is exact on the parsed origin, so `https://evil-myapp.com` cannot suffix-match `myapp.com`, and a missing `Origin` is rejected because a real browser always sets one on a cross-origin-capable POST. Allowed origins default to the request's own host and can be extended with a list or a resolver over services. `isAllowedOrigin` and `toOrigin` are exported for direct unit testing.
+
+  Together these let an app keep only its event registry and its wiring, instead of a few hundred lines of copied transport.
+
+- Updated dependencies [8154b1c]
+- Updated dependencies [af2b764]
+- Updated dependencies [6d9c09c]
+- Updated dependencies [239332b]
+  - @pikku/core@0.12.97
+  - @pikku/inspector@0.12.67
+
+## 0.12.123
+
+### Patch Changes
+
+- 9d2fbeb: Point a config-blocked deploy at the command that sets what is actually missing
+
+  A deploy blocked on `needs_config` printed one hint — "Set the values with
+  `pikku fabric secrets set <name>`" — whether what was missing was a secret or a
+  variable. Secrets and variables are set by two different commands, so anyone
+  blocked on a variable was sent to a command that refuses their value. The hint
+  now follows what is missing and names it, so the values can be found without
+  reading the deployment status by hand.
+
+- 2f94a0a: Stop `pikku all` failing on a diagnostic its own codegen went on to fix.
+
+  The run inspects several times, because generating the scaffold, the leaf indexes and the type files each changes the source graph the next inspection reads. Every full inspection re-runs every validator, so the newest pass is the complete one — but the logger accumulated diagnostics across all of them, and the build gate failed the run if any pass had ever recorded a critical.
+
+  A project whose system roles grant a scaffold-declared scope (`virtualUser:*`) therefore could not build from clean: the pass taken before the scaffold existed raised PKU124, the pass taken after was clean, and the run failed anyway. Same for PKU951 on a scaffold-declared secret.
+
+  Validation diagnostics are now scoped to the pass that recorded them, so a later pass supersedes an earlier one. Diagnostics reported outside a validation pass — by a generator or a command — are untouched, and a fault every pass reports still fails the run.
+
+- f1ccfe3: A step ladder reads as one paragraph, not a list of restatements
+
+  Every step prefixed its actor with `the `, named that actor again, and repeated
+  the phase keyword. A three-step run by one person said their name three times
+  and `Given` three times, only read as English when the persona key happened to
+  be a role noun, and never said who that person was — the fabric template's own
+  placeholder came out as `the nadia opens /app`.
+
+  ```
+  Given yasser (the founder) signs in
+  When  yasser opens the dashboard
+  And   sees the audit log
+  And   nadia reviews the invite
+  ```
+
+  The article is gone: the actor key is the subject verbatim, so a persona named
+  after a person reads as that person. A repeated phase reads as `And`, the way
+  Gherkin has always written it. A step that continues both the phase and the
+  actor drops the repeated subject, because English drops a repeated subject in a
+  compound predicate — it takes both, since eliding across a phase change gives
+  `When opens the dashboard`, and a pronoun rather than a name would give `they
+sees`, step templates being authored in the third person singular.
+
+  An actor is introduced once, by the persona's `jobTitle` — prose someone wrote
+  for a reader. `roles` is authorisation, so a persona whose only description is a
+  `reviewer` grant gets no introduction rather than one assembled out of grants.
+  A row carries `sentenceWithRole` alongside `sentence`, set only where an actor
+  is first named, so a renderer can offer the introduction as a toggle without
+  parsing a composed sentence back apart.
+
+  `{placeholder}` filling, the `#ordinal` lookup for repeated step names and an
+  actorless step reading as its description alone are all unchanged.
+
+- Updated dependencies [88629af]
+- Updated dependencies [88629af]
+- Updated dependencies [2f94a0a]
+- Updated dependencies [7eeff81]
+- Updated dependencies [f1ccfe3]
+  - @pikku/core@0.12.96
+  - @pikku/fetch@0.12.10
+  - @pikku/inspector@0.12.66
+  - @pikku/skills@0.12.19
+
 ## 0.12.122
 
 ### Patch Changes

package/console-app/assets/{abnfDiagram-N423BO3Z-Dfq94a7u.js → abnfDiagram-N423BO3Z-BP7zxMq6.js}

@@ -1 +1 @@
-import{m as e,t}from"./mermaid-parser.core-R240ylPw.js";import{n}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import{t as r}from"./src-DwHVY--Z.js";import"./chunk-I66GZJ75-CWdPrY4a.js";import{n as i,r as a,t as o}from"./chunk-6Q2QTUOP-DpsTVhit.js";import{t as s}from"./chunk-JWPE2WC7-DVXcaiue.js";import"./mermaid.core-BZ3jSM6D.js";var c=e().RailroadAbnf.parser.LangiumParser,l=n(e=>{let t=e.alternatives.map(u);return t.length===1?t[0]:{type:`choice`,alternatives:t}},`transformAlternation`),u=n(e=>{let t=e.elements.map(f);return t.length===1?t[0]:{type:`sequence`,elements:t}},`transformConcatenation`),d=n(e=>{if(e.includes(`*`)){let[t,n]=e.split(`*`);return{min:t?parseInt(t,10):0,max:n?parseInt(n,10):1/0}}let t=parseInt(e,10);return{min:t,max:t}},`parseRepeat`),f=n(e=>{let t=p(e.primary);if(!e.repeat)return t;let{min:n,max:r}=d(e.repeat);return n===0&&r===1?{type:`optional`,element:t}:{type:`repetition`,element:t,min:n,max:r}},`transformElement`),p=n(e=>{switch(e.$type){case`AbnfStringLiteral`:return{type:`terminal`,value:e.value};case`AbnfNumVal`:return{type:`terminal`,value:e.value};case`AbnfRuleName`:return{type:`nonterminal`,name:e.name};case`AbnfGroup`:return l(e.element);case`AbnfOptionalGroup`:return{type:`optional`,element:l(e.element)};default:throw Error(`Unsupported ABNF primary node: ${e.$type}`)}},`transformPrimary`),m=n(e=>({name:e.name,definition:l(e.definition)}),`transformRule`),h=n(e=>{s(e,o),e.title&&o.setTitle(e.title),e.rules.map(e=>o.addRule(m(e)))},`populateDb`),g={parser:{parse:n(e=>{o.clear(),r.debug(`[ABNF Parser] Starting Langium parse`);let n=c.parse(e);if(n.lexerErrors.length>0||n.parserErrors.length>0)throw new t(n);let i=n.value;r.debug(`[ABNF Parser] Parsed rules:`,i.rules.length),h(i),r.debug(`[ABNF Parser] Parse complete`)},`parse`),parser:{yy:o}},db:o,renderer:a,styles:i};export{g as diagram};
+import{m as e,t}from"./mermaid-parser.core-CMBFGJ0U.js";import{n}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import{t as r}from"./src-Dg-KiSsV.js";import"./chunk-I66GZJ75-DDQhhfA0.js";import{n as i,r as a,t as o}from"./chunk-6Q2QTUOP-Bswg4T3s.js";import{t as s}from"./chunk-JWPE2WC7-DVXcaiue.js";import"./mermaid.core-DYoDrSEJ.js";var c=e().RailroadAbnf.parser.LangiumParser,l=n(e=>{let t=e.alternatives.map(u);return t.length===1?t[0]:{type:`choice`,alternatives:t}},`transformAlternation`),u=n(e=>{let t=e.elements.map(f);return t.length===1?t[0]:{type:`sequence`,elements:t}},`transformConcatenation`),d=n(e=>{if(e.includes(`*`)){let[t,n]=e.split(`*`);return{min:t?parseInt(t,10):0,max:n?parseInt(n,10):1/0}}let t=parseInt(e,10);return{min:t,max:t}},`parseRepeat`),f=n(e=>{let t=p(e.primary);if(!e.repeat)return t;let{min:n,max:r}=d(e.repeat);return n===0&&r===1?{type:`optional`,element:t}:{type:`repetition`,element:t,min:n,max:r}},`transformElement`),p=n(e=>{switch(e.$type){case`AbnfStringLiteral`:return{type:`terminal`,value:e.value};case`AbnfNumVal`:return{type:`terminal`,value:e.value};case`AbnfRuleName`:return{type:`nonterminal`,name:e.name};case`AbnfGroup`:return l(e.element);case`AbnfOptionalGroup`:return{type:`optional`,element:l(e.element)};default:throw Error(`Unsupported ABNF primary node: ${e.$type}`)}},`transformPrimary`),m=n(e=>({name:e.name,definition:l(e.definition)}),`transformRule`),h=n(e=>{s(e,o),e.title&&o.setTitle(e.title),e.rules.map(e=>o.addRule(m(e)))},`populateDb`),g={parser:{parse:n(e=>{o.clear(),r.debug(`[ABNF Parser] Starting Langium parse`);let n=c.parse(e);if(n.lexerErrors.length>0||n.parserErrors.length>0)throw new t(n);let i=n.value;r.debug(`[ABNF Parser] Parsed rules:`,i.rules.length),h(i),r.debug(`[ABNF Parser] Parse complete`)},`parse`),parser:{yy:o}},db:o,renderer:a,styles:i};export{g as diagram};

package/console-app/assets/architecture-TIHT7OUA-D4Hj6824.js

@@ -0,0 +1 @@
+import"./chunk-KEIR6QF5-BICK3FdT.js";import{M as e}from"./mermaid-parser.core-CMBFGJ0U.js";export{e as createArchitectureServices};