@pikku/cli 0.12.123 → 0.12.125

package/CHANGELOG.md

@@ -1,3 +1,161 @@
+## 0.12.125
+
+### Patch Changes
+
+- b951f04: Add `pikku fabric projects`, listing the projects in your organization with their ids. The fabric API already exposed `fabricCliProjects`; no command called it, so a project's id was reachable only through the web console — and a checkout whose `pikkufabric.config.json` still held the `__PROJECT_ID__` placeholder could run no other fabric command to recover it. `fabric init` was no help either: it only creates, so against a project that already exists it fails with a 409 carrying no id. Projects matching the local config are marked.
+- 80eb5c0: Generate a desktop shell from `pikku deploy apply --desktop`
+
+  `pikku deploy apply --provider standalone --runtime bun --desktop` now emits a
+  `src-tauri/` crate that ships the compiled binary as a sidecar and opens a
+  window on the server's own HTTP origin, so cookies, CORS and OAuth behave
+  exactly as they do in a browser. Regeneration is idempotent and leaves an
+  edited file alone rather than overwriting it.
+
+  `--desktop-url https://app.example.com` builds the other shape: a shell that
+  points at an already-deployed server. Nothing is bundled — no sidecar, no
+  binary, and so no bun runtime to compile one — and the window is declared in
+  `tauri.conf.json` rather than opened from Rust, because the origin is known up
+  front. The url can also live in `pikku.config.json` as `deploy.desktop.url`,
+  alongside `deploy.desktop.identifier`.
+
+  Supporting changes: `SERVER_READY_MARKER` moved to `@pikku/deploy` (the CLI
+  re-exports it from its old path), both HTTP runtimes expose the port they
+  actually bound so `--port 0` reports a real port, and the generated server
+  entry exits when its parent process goes away.
+
+- 80eb5c0: feat: serve a built frontend from the pikku server's own origin
+
+  A new `frontend` key in `pikku.config.json` names a directory of built
+  frontend output. `pikku serve` mounts it, and `pikku deploy` ships it inside
+  the distributable — into a directory beside the bundle for the node runtime,
+  and embedded in the binary for a `bun build --compile` standalone. `pikku dev`
+  deliberately ignores it and says so, because the frontend's own dev server owns
+  that job.
+
+  Pikku reads the frontend's output and never builds it, so an unbuilt directory
+  fails with a message that says which build to run rather than booting a server
+  that answers every page with a 404.
+
+- af2bde4: Persona provisioning actually provisions.
+
+  Two things stopped `provisionPersonas` from ever creating an account. It read
+  `$context` off the better-auth instance without awaiting it — every other call
+  site does — so the orphan sweep died on `undefined.findMany`, and a cast to
+  `any` kept the compiler quiet about it. And nothing set `PIKKU_ENV`, so the
+  environment rule failed closed and skipped every persona before it got that
+  far; `pikku dev` now names the local environment from `environments` in
+  pikku.config.json, preferring one called `local`.
+
+- 2252016: Decide whether a virtual-user run is against production from the configured
+  environment rather than `NODE_ENV`.
+
+  A deployment whose staging is a production mirror runs `NODE_ENV=production`
+  there too, so the old check refused every disposition on the one environment
+  they exist to be used on. `startVirtualUserRun` now takes the `environments`
+  generated beside the personas and the environment this process is (`PIKKU_ENV`
+  by default), which is the same signal `personaEnvironmentRefusal` already
+  checks at sign-in; the generated scaffold passes them. An environment that
+  cannot be resolved is treated as production. `NODE_ENV` remains the answer for
+  a project that configures no environments at all.
+
+- 80eb5c0: Encrypt classified columns from the generated manifest.
+
+  `ClassificationPlugin` reads the per-column classification manifest and decrypts `wrapped` and `sealed` columns transparently on the way out. Writes are not transparent — Kysely's `transformQuery` is synchronous and WebCrypto is not — so plaintext heading for a classified column **throws** instead, and values are produced by `ClassificationCrypto.encryptColumn()`. A forgotten call site is a loud error rather than a silent plaintext row. The stored envelope is self-describing (`pikku1.<keyId>.<version>.<wrappedDek>.<ciphertext>`), so a row records which key opens it without a schema change to every table.
+
+  `keyId` now flows from the hand-authored `db/annotations.ts` through `pikku db migrate` into `classification.gen.ts`. It is emitted only for `wrapped` and `sealed` columns: naming a key on a plain column would claim a protection it does not have, and a hashed column has no key at all — the hash is the lookup key.
+
+- Updated dependencies [80eb5c0]
+- Updated dependencies [80eb5c0]
+- Updated dependencies [80eb5c0]
+- Updated dependencies [af2bde4]
+- Updated dependencies [2252016]
+- Updated dependencies [80eb5c0]
+  - @pikku/core@0.12.98
+  - @pikku/node-http-server@0.12.12
+  - @pikku/bun-server@0.12.10
+  - @pikku/deploy@0.12.2
+  - @pikku/better-auth@0.12.32
+  - @pikku/kysely@0.13.23
+
+## 0.12.124
+
+### Patch Changes
+
+- e0106bb: fabric validate: honour better-auth `modelName` overrides in the auth schema check.
+
+  The check looked for migrations creating `user`, `session`, `account` and
+  `verification` — better-auth's default table names. An app that already owns a
+  `user` table renames the models (`user: { modelName: 'authUser' }`), and the
+  adapter's CamelCasePlugin then writes them as `auth_user`, `auth_session` and
+  so on. None of the default names appear in such an app's migrations, so a fully
+  migrated project was reported as having no better-auth schema at all — an error
+  it had no way to clear.
+
+  Each model now also matches its configured `modelName` and that name's
+  snake_case form, read from the source files that configure better-auth.
+
+- e0106bb: fabric validate: stop two scanners reporting false positives.
+
+  The undeclared-import scan read raw file text, so prose in a comment or a
+  description string matched its `from "..."` pattern — `Converted from the
+Gherkin scenario of the same name` reported a missing package named `signed`.
+  Comments are now blanked before the scan, and a specifier containing whitespace
+  is never a package name.
+
+  The scenario copy scan matched every string literal in the file against the
+  message catalogue, so an RPC payload field whose value happens to equal a label
+  was reported as hardcoded UI copy — `unit: 'kg'` flagged against a `unit_kg`
+  form suffix, where rewriting it to a message lookup would bind a stored value to
+  UI copy. A literal in `key: '...'` position now only counts when the key names
+  something the browser renders; bare locator arguments are unchanged.
+
+- e0106bb: fabric validate: stop the scenario copy scan reporting asserted values as UI copy.
+
+  `expect(item.unit, 'kg', 'the item unit')` compares a value an RPC returned.
+  The scan matched the literal against the message catalogue and reported it as
+  hardcoded copy that should be read from `unit_kg` — a fix that would bind a
+  stored value to a form label, so the assertion would then pass against whatever
+  the label happened to say.
+
+  A literal passed directly to `expect(...)` is no longer scanned. A locator
+  nested inside one still is: in `expect(await page.getByText('Save').count(), 1)`
+  the literal belongs to `getByText`.
+
+- 6d9c09c: Resolve a variable's declared default instead of dropping it.
+
+  `defineVariable` takes a schema, and a schema can carry a default — `z.enum(['https://api.github.com']).default('https://api.github.com')` is the shape most addons declare their base URL with. Nothing read it. `variables.get('GITHUB_BASE_URL')` returned `undefined` on a host that had not set it, and the `as string` at the call site hid that until a request went to `undefined/repos/...`.
+
+  The default now resolves in `TypedVariablesService`, which is the layer that knows what was declared — `VariablesService` only knows what a host put in it. A stored value always wins; a schema with no default still resolves to `undefined`.
+
+  `VariableStatus` gains `hasDefault`, and `getMissing()` no longer lists a variable that defaults: it has a value, just not one anybody has to supply. `isConfigured` still means what it said — that a host set it.
+
+  For this to work the generated `TYPED_VARIABLES_META` now carries the schema as a value rather than only `z.infer`-ing its type, so the schema module is retained in the emit instead of being elided.
+
+- ef775dc: validate: flag static imports of packages the deploy bundler stubs
+
+  The deploy bundler replaces the AI SDK packages (`@pikku/ai-vercel`, `@ai-sdk/*`,
+  `ai`) with `export {}` in every unit that does not require `agentRunner`, so a
+  static named import of one in `services.ts` fails to bundle with an opaque
+  esbuild error repeated once per unit. `pikku fabric validate` now reports this as
+  `services-static-stubbed-import` and points at the lazy-import shape the starter
+  template uses. The service-to-module map moved to its own module so the check and
+  the bundler read the same list.
+
+- 239332b: Move first-party product analytics out of application code and into the framework.
+
+  `createAnalytics<Event>({ endpoint })` in `@pikku/react` is the buffered beacon client: it is typed against the app's own event union, flushes on an interval, on size and on `pagehide`/`visibilitychange` (via `sendBeacon`, so the abandon-point events survive unload), never surfaces a failure to the user and never retries. It also carries the delegated `data-analytics-click` listener, registered in the capture phase so a component calling `stopPropagation()` cannot silence instrumentation, and merging `data-analytics-meta` from ancestors with nearest-wins. Put the client on the Pikku instance and `usePikkuAnalytics<Event>()` reaches it from the provider, alongside `usePikkuFetch` and `usePikkuRPC`.
+
+  `requireOrigin()` in `@pikku/core/middleware` is a server-side origin lock for any unauthed route, and is re-exported from the generated `#pikku/middleware` leaf alongside `cors`. Unlike `cors()` — which only sets response headers a non-browser client ignores — it rejects with a 403 before the function body. Comparison is exact on the parsed origin, so `https://evil-myapp.com` cannot suffix-match `myapp.com`, and a missing `Origin` is rejected because a real browser always sets one on a cross-origin-capable POST. Allowed origins default to the request's own host and can be extended with a list or a resolver over services. `isAllowedOrigin` and `toOrigin` are exported for direct unit testing.
+
+  Together these let an app keep only its event registry and its wiring, instead of a few hundred lines of copied transport.
+
+- Updated dependencies [8154b1c]
+- Updated dependencies [af2b764]
+- Updated dependencies [6d9c09c]
+- Updated dependencies [239332b]
+  - @pikku/core@0.12.97
+  - @pikku/inspector@0.12.67
+
 ## 0.12.123
 
 ### Patch Changes

package/console-app/assets/{abnfDiagram-N423BO3Z-BR5_-R36.js → abnfDiagram-N423BO3Z-B2suyn6i.js}

@@ -1 +1 @@
-import{m as e,t}from"./mermaid-parser.core-3dL4TN1f.js";import{n}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import{t as r}from"./src-BJFofs4v.js";import"./chunk-I66GZJ75-Hl61byF7.js";import{n as i,r as a,t as o}from"./chunk-6Q2QTUOP-L6D94YxI.js";import{t as s}from"./chunk-JWPE2WC7-DVXcaiue.js";import"./mermaid.core-DaXl8RjK.js";var c=e().RailroadAbnf.parser.LangiumParser,l=n(e=>{let t=e.alternatives.map(u);return t.length===1?t[0]:{type:`choice`,alternatives:t}},`transformAlternation`),u=n(e=>{let t=e.elements.map(f);return t.length===1?t[0]:{type:`sequence`,elements:t}},`transformConcatenation`),d=n(e=>{if(e.includes(`*`)){let[t,n]=e.split(`*`);return{min:t?parseInt(t,10):0,max:n?parseInt(n,10):1/0}}let t=parseInt(e,10);return{min:t,max:t}},`parseRepeat`),f=n(e=>{let t=p(e.primary);if(!e.repeat)return t;let{min:n,max:r}=d(e.repeat);return n===0&&r===1?{type:`optional`,element:t}:{type:`repetition`,element:t,min:n,max:r}},`transformElement`),p=n(e=>{switch(e.$type){case`AbnfStringLiteral`:return{type:`terminal`,value:e.value};case`AbnfNumVal`:return{type:`terminal`,value:e.value};case`AbnfRuleName`:return{type:`nonterminal`,name:e.name};case`AbnfGroup`:return l(e.element);case`AbnfOptionalGroup`:return{type:`optional`,element:l(e.element)};default:throw Error(`Unsupported ABNF primary node: ${e.$type}`)}},`transformPrimary`),m=n(e=>({name:e.name,definition:l(e.definition)}),`transformRule`),h=n(e=>{s(e,o),e.title&&o.setTitle(e.title),e.rules.map(e=>o.addRule(m(e)))},`populateDb`),g={parser:{parse:n(e=>{o.clear(),r.debug(`[ABNF Parser] Starting Langium parse`);let n=c.parse(e);if(n.lexerErrors.length>0||n.parserErrors.length>0)throw new t(n);let i=n.value;r.debug(`[ABNF Parser] Parsed rules:`,i.rules.length),h(i),r.debug(`[ABNF Parser] Parse complete`)},`parse`),parser:{yy:o}},db:o,renderer:a,styles:i};export{g as diagram};
+import{m as e,t}from"./mermaid-parser.core-b4yKyO56.js";import{n}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import{t as r}from"./src-DUC7tLWb.js";import"./chunk-I66GZJ75-Cb2nDoa3.js";import{n as i,r as a,t as o}from"./chunk-6Q2QTUOP-D0IK0SMT.js";import{t as s}from"./chunk-JWPE2WC7-DVXcaiue.js";import"./mermaid.core-Cwfec1gr.js";var c=e().RailroadAbnf.parser.LangiumParser,l=n(e=>{let t=e.alternatives.map(u);return t.length===1?t[0]:{type:`choice`,alternatives:t}},`transformAlternation`),u=n(e=>{let t=e.elements.map(f);return t.length===1?t[0]:{type:`sequence`,elements:t}},`transformConcatenation`),d=n(e=>{if(e.includes(`*`)){let[t,n]=e.split(`*`);return{min:t?parseInt(t,10):0,max:n?parseInt(n,10):1/0}}let t=parseInt(e,10);return{min:t,max:t}},`parseRepeat`),f=n(e=>{let t=p(e.primary);if(!e.repeat)return t;let{min:n,max:r}=d(e.repeat);return n===0&&r===1?{type:`optional`,element:t}:{type:`repetition`,element:t,min:n,max:r}},`transformElement`),p=n(e=>{switch(e.$type){case`AbnfStringLiteral`:return{type:`terminal`,value:e.value};case`AbnfNumVal`:return{type:`terminal`,value:e.value};case`AbnfRuleName`:return{type:`nonterminal`,name:e.name};case`AbnfGroup`:return l(e.element);case`AbnfOptionalGroup`:return{type:`optional`,element:l(e.element)};default:throw Error(`Unsupported ABNF primary node: ${e.$type}`)}},`transformPrimary`),m=n(e=>({name:e.name,definition:l(e.definition)}),`transformRule`),h=n(e=>{s(e,o),e.title&&o.setTitle(e.title),e.rules.map(e=>o.addRule(m(e)))},`populateDb`),g={parser:{parse:n(e=>{o.clear(),r.debug(`[ABNF Parser] Starting Langium parse`);let n=c.parse(e);if(n.lexerErrors.length>0||n.parserErrors.length>0)throw new t(n);let i=n.value;r.debug(`[ABNF Parser] Parsed rules:`,i.rules.length),h(i),r.debug(`[ABNF Parser] Parse complete`)},`parse`),parser:{yy:o}},db:o,renderer:a,styles:i};export{g as diagram};

package/console-app/assets/architecture-TIHT7OUA-DmG0bXDT.js

@@ -0,0 +1 @@
+import"./chunk-KEIR6QF5-BICK3FdT.js";import{M as e}from"./mermaid-parser.core-b4yKyO56.js";export{e as createArchitectureServices};