@pikku/cli 0.12.126 → 0.12.128

package/CHANGELOG.md

@@ -1,3 +1,160 @@
+## 0.12.128
+
+### Patch Changes
+
+- c0940a1: `pikku new addon` now installs and builds the addon it generates.
+
+  The generated package exports `./dist/...`, which is what an installed consumer
+  resolves and what the app's own `pikku-bootstrap.gen.ts` imports. Until `build`
+  had run, that path did not exist: the app failed at boot with PKU340 and an
+  ERR_MODULE_NOT_FOUND on a dist file nobody had written, and every
+  `ref('<addon>:…')` resolved to nothing. Nothing about the generated files showed
+  the problem, so a generated addon looked complete and was dead at runtime.
+
+  Pass `--no-build` to keep the previous write-only behaviour.
+
+- e92e30b: Print a CLI failure as its message, not as a JS stack trace.
+
+  Every error that reached the top of `executeCLI` was logged with `console.error('Error:', error)`, which node renders as the full stack — and prefixed it a second time, so a refusal read `Error: Error: Persona 'guest' missing guest…` above ten frames of pikku internals. A `PikkuFetchError` was worse: node inspects an error's own properties, so the whole `Response` came out with it, headers and body stream included, to say `502`.
+
+  An expected failure — a `PikkuError`, or anything carrying `expected: true` — now prints its message alone, and a fetch failure prints `502 Bad Gateway from <url>` without touching the response. Anything else keeps its stack, because a `TypeError` with its frames removed is undiagnosable. `--verbose`/`-v`, or `PIKKU_DEBUG=1` where the flag cannot be typed, adds the stack back to an expected failure.
+
+  The refusals behind the examples — a persona whose roles have drifted, a sign-in the stage rejected — are raised as `PikkuError` so they are classed as deliberate.
+
+- 3079f44: Give `pikku dev` a credential store.
+
+  Wiring a `credentialService` is the deployment's job — the values are per-user
+  secrets, and where they are encrypted and who holds the key is a decision only
+  the host can make. But that left `pikku dev` with none at all: `credentialService`
+  was `undefined`, so an addon imported with `--auth per-user` or `--auth delegated`
+  could not be exercised locally. The delegated sign-in a project is told to wire
+  threw on its first call, and projects were reaching for their own credential
+  tables to get past it.
+
+  `pikku dev` now builds a `LocalCredentialService` alongside the rest of its
+  in-memory services — the queue, the trigger service, the workflow service — and
+  hands it to `createSingletonServices` as an existing service. A project that
+  wants a real store overrides it there the same way it overrides any of the
+  others: `existingServices.credentialService ?? new OwnCredentialService()`.
+
+- 5bb006f: Add `pikku fabric secrets delete <name>`.
+
+  Removing one secret from a stage had no lever. The only thing close was
+  `secrets rotate`, which retires the stage's sealing key and so takes every
+  secret on the stage down with it — an enormous blast radius for wanting one
+  name gone.
+
+  `secrets delete` calls the `deleteStageSecret` RPC, which removes the single
+  named secret and leaves the sealing key and the stage's other secrets alone.
+  It confirms first unless `--force` is passed: fabric holds only the public half
+  of the stage keypair, so it cannot read a sealed value back and cannot restore
+  one — the plaintext has to be supplied again. Deployed units keep serving the
+  old value until the stage is republished, so the run that does so is reported
+  when the delete triggers one.
+
+- e15f5a9: Add `pikku dist`, and use it as the generated addon's build step.
+
+  `tsc` compiles the `.ts` under the pikku out dir, but it never carries the
+  `*.gen.json` meta written beside them, and it never re-emits a hand-authored
+  `.d.ts`. Both are needed at runtime — `MetaService` opens the meta off disk by
+  path — so a package that ships only tsc's output answers every meta lookup with
+  nothing.
+
+  Every generated addon papered over this with `tsc && cp -r .pikku types dist/`,
+  which copied two whole directories: it dragged 52 raw `.ts` sources into the
+  published output alongside the compiled ones, and needed a POSIX shell. Since
+  the script comes from the CLI, every project carried the same line.
+
+  `pikku dist` copies exactly what tsc could not emit, to where tsc would have put
+  it, reading the layout from `pikku.config.json` and the destination from the
+  tsconfig's `outDir` (or `--dist-dir`). The generated build script is now
+  `tsc && pikku dist`.
+
+- 4d0a548: Provision the declared personas from the fabric plugin instead of the server lifecycle.
+
+  `provisionPersonas` was documented as a call an app makes from `pikkuServerLifecycle`'s `afterStart`. That hook is invoked by `pikku serve` and `pikku dev` and by nothing else — no deploy runtime calls it — so on any stage deployed to Workers or a serverless target the provisioning never ran, and every persona signed in holding no roles.
+
+  `pikkuFabric` now takes `personas`. The operator endpoint resolves the address the caller wants to act as; a miss provisions the declaration and looks again. On a stage that already holds the persona that is one query, and the pass only runs when there is genuinely something absent to create.
+
+  Sign-in no longer creates accounts of its own. `OperatorSignInOptions.createMissing` and `PIKKU_PERSONA_CREATE_MISSING` are gone, and an address no declaration claims stays a 404 however many times it is asked for. `provisionPersonas` is no longer exported — the plugin is the only caller.
+
+  `pikku persona sync <environment>` is unchanged: it still reports who an environment will provision and why anyone was skipped, and still writes nothing.
+
+- Updated dependencies [e92e30b]
+- Updated dependencies [14059e0]
+- Updated dependencies [781797c]
+- Updated dependencies [ccab6ed]
+- Updated dependencies [4d0a548]
+- Updated dependencies [5ace170]
+  - @pikku/core@0.12.101
+  - @pikku/better-auth@0.12.35
+  - @pikku/skills@0.12.22
+
+## 0.12.127
+
+### Patch Changes
+
+- 77ae071: `pikku fabric report` sends a finding — something about pikku that cost an agent time — to fabric. It needs a login but no linked project: a finding is about the framework rather than about anyone's project, and the reports worth having most come from checkouts that have nothing to name.
+
+  The finding can be given as JSON on stdin (`--stdin`) instead of as flags. Half the fields are prose, and prose carries apostrophes, quotes, backticks and newlines — every one a shell metacharacter before it is a character in a sentence — so an error message pasted into `--error` used to break the command at its first newline. The same schema validates either path.
+
+  Nothing is written to the repo, so nothing goes stale on an abandoned branch, and the terminal prints exactly what left the machine. Reporting never fails a build.
+
+  A finding that cannot be sent is held in `~/.fabric/findings` rather than dropped: logged out, unlinked, or fabric unreachable are the states a finding is most likely to be describing, and a scaffold that never got far enough to log in is exactly the thing worth hearing about. The queue drains on the next report that succeeds, keeps the project each finding was filed against, and is bounded at 100. `pikku fabric findings list`, `flush` and `clear` inspect and control it.
+
+  The resolved `@pikku/*` versions are read off the installed tree rather than out of `package.json`, since a range says nothing about what actually ran. A skewed tree and a package resolving through a workspace or link are both flagged, because either is a reason to read the finding differently.
+
+  The `pikku-feature` skill now tells an agent when to file one: work around it first, investigate only when there is no workaround, report at the depth already reached, and never patch pikku itself from inside a project that is using it.
+
+- 32d1280: Prefix the better-auth plugin factories with `pikku`: `pikkuActor`, `pikkuBan`,
+  `pikkuFabric`, `pikkuDelegatedAuth` and `pikkuCredentialOAuth`.
+
+  A `betterAuth({ plugins: [...] })` array mixes this package's plugins with
+  better-auth's own, and until now nothing at the call site told them apart —
+  `plugins: [actor(...), ban(), fabric(...), organization()]` reads as four
+  plugins from one place when only the last is better-auth's. The prefix says
+  which package a plugin came from where it is actually wired.
+
+  The old names are still exported as deprecated aliases bound to the same
+  functions, so no import has to change. Nothing about the plugins themselves
+  moved: the `id` each registers under — `pikku-ban`, `actor`, `fabric`,
+  `delegated-auth`, `credential-oauth` — is unchanged, so no deployed database or
+  session is affected.
+
+  The pieces that read a plugin's _export_ name rather than its id accept both:
+  `PLUGIN_REGISTRY` is keyed under the prefixed and the bare name, and the
+  `pikku validate` ban/actor checks and the `scaffold.userAdmin` ban check count
+  either spelling as wired. Their messages now point at the new names.
+
+- a0ed1e8: Derive a persona's session and operator paths from the mount its sign-in path names.
+
+  Both `sessionRoles()` and the Fabric operator handshake asked for a fixed
+  `/auth/…` no matter where auth was mounted. An app serving better-auth under
+  `/api/auth` while keeping its RPCs at the root cannot put the mount in
+  `apiUrl`, so it moves `signInPath` — and the other two stayed behind.
+
+  For the session read that meant a 404, which returns `null`, which means "this
+  stage does not report roles": every `pikku persona run` on such an app warned
+  "running unverified" and lost the one thing that tells a permissions finding
+  from seed drift. For the operator handshake it was worse — `HttpPersona`
+  reused the _actor_ path verbatim, so an operator token was posted to the actor
+  endpoint and came back as a validation error about a missing email and secret,
+  which reads like a broken persona rather than a wrong URL. The browser provider
+  had the same fixed default.
+
+  All three now follow `signInPath`, and `environments[].sessionPath` in
+  pikku.config.json overrides the session read for a stage that reports it
+  elsewhere.
+
+- Updated dependencies [77ae071]
+- Updated dependencies [32d1280]
+- Updated dependencies [a0ed1e8]
+  - @pikku/skills@0.12.21
+  - @pikku/better-auth@0.12.34
+  - @pikku/inspector@0.12.69
+  - @pikku/core@0.12.100
+  - @pikku/playwright@0.12.81
+
 ## 0.12.126
 
 ### Patch Changes

package/console-app/assets/{abnfDiagram-N423BO3Z-B2suyn6i.js → abnfDiagram-N423BO3Z-BY2LM8wi.js}

@@ -1 +1 @@
-import{m as e,t}from"./mermaid-parser.core-b4yKyO56.js";import{n}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import{t as r}from"./src-DUC7tLWb.js";import"./chunk-I66GZJ75-Cb2nDoa3.js";import{n as i,r as a,t as o}from"./chunk-6Q2QTUOP-D0IK0SMT.js";import{t as s}from"./chunk-JWPE2WC7-DVXcaiue.js";import"./mermaid.core-Cwfec1gr.js";var c=e().RailroadAbnf.parser.LangiumParser,l=n(e=>{let t=e.alternatives.map(u);return t.length===1?t[0]:{type:`choice`,alternatives:t}},`transformAlternation`),u=n(e=>{let t=e.elements.map(f);return t.length===1?t[0]:{type:`sequence`,elements:t}},`transformConcatenation`),d=n(e=>{if(e.includes(`*`)){let[t,n]=e.split(`*`);return{min:t?parseInt(t,10):0,max:n?parseInt(n,10):1/0}}let t=parseInt(e,10);return{min:t,max:t}},`parseRepeat`),f=n(e=>{let t=p(e.primary);if(!e.repeat)return t;let{min:n,max:r}=d(e.repeat);return n===0&&r===1?{type:`optional`,element:t}:{type:`repetition`,element:t,min:n,max:r}},`transformElement`),p=n(e=>{switch(e.$type){case`AbnfStringLiteral`:return{type:`terminal`,value:e.value};case`AbnfNumVal`:return{type:`terminal`,value:e.value};case`AbnfRuleName`:return{type:`nonterminal`,name:e.name};case`AbnfGroup`:return l(e.element);case`AbnfOptionalGroup`:return{type:`optional`,element:l(e.element)};default:throw Error(`Unsupported ABNF primary node: ${e.$type}`)}},`transformPrimary`),m=n(e=>({name:e.name,definition:l(e.definition)}),`transformRule`),h=n(e=>{s(e,o),e.title&&o.setTitle(e.title),e.rules.map(e=>o.addRule(m(e)))},`populateDb`),g={parser:{parse:n(e=>{o.clear(),r.debug(`[ABNF Parser] Starting Langium parse`);let n=c.parse(e);if(n.lexerErrors.length>0||n.parserErrors.length>0)throw new t(n);let i=n.value;r.debug(`[ABNF Parser] Parsed rules:`,i.rules.length),h(i),r.debug(`[ABNF Parser] Parse complete`)},`parse`),parser:{yy:o}},db:o,renderer:a,styles:i};export{g as diagram};
+import{m as e,t}from"./mermaid-parser.core-Cx6yvn3j.js";import{n}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import{t as r}from"./src-LceHEY_Q.js";import"./chunk-I66GZJ75-DH54FcuO.js";import{n as i,r as a,t as o}from"./chunk-6Q2QTUOP-DloGRHJZ.js";import{t as s}from"./chunk-JWPE2WC7-DVXcaiue.js";import"./mermaid.core-BebGyklS.js";var c=e().RailroadAbnf.parser.LangiumParser,l=n(e=>{let t=e.alternatives.map(u);return t.length===1?t[0]:{type:`choice`,alternatives:t}},`transformAlternation`),u=n(e=>{let t=e.elements.map(f);return t.length===1?t[0]:{type:`sequence`,elements:t}},`transformConcatenation`),d=n(e=>{if(e.includes(`*`)){let[t,n]=e.split(`*`);return{min:t?parseInt(t,10):0,max:n?parseInt(n,10):1/0}}let t=parseInt(e,10);return{min:t,max:t}},`parseRepeat`),f=n(e=>{let t=p(e.primary);if(!e.repeat)return t;let{min:n,max:r}=d(e.repeat);return n===0&&r===1?{type:`optional`,element:t}:{type:`repetition`,element:t,min:n,max:r}},`transformElement`),p=n(e=>{switch(e.$type){case`AbnfStringLiteral`:return{type:`terminal`,value:e.value};case`AbnfNumVal`:return{type:`terminal`,value:e.value};case`AbnfRuleName`:return{type:`nonterminal`,name:e.name};case`AbnfGroup`:return l(e.element);case`AbnfOptionalGroup`:return{type:`optional`,element:l(e.element)};default:throw Error(`Unsupported ABNF primary node: ${e.$type}`)}},`transformPrimary`),m=n(e=>({name:e.name,definition:l(e.definition)}),`transformRule`),h=n(e=>{s(e,o),e.title&&o.setTitle(e.title),e.rules.map(e=>o.addRule(m(e)))},`populateDb`),g={parser:{parse:n(e=>{o.clear(),r.debug(`[ABNF Parser] Starting Langium parse`);let n=c.parse(e);if(n.lexerErrors.length>0||n.parserErrors.length>0)throw new t(n);let i=n.value;r.debug(`[ABNF Parser] Parsed rules:`,i.rules.length),h(i),r.debug(`[ABNF Parser] Parse complete`)},`parse`),parser:{yy:o}},db:o,renderer:a,styles:i};export{g as diagram};

package/console-app/assets/architecture-TIHT7OUA-CWwmvxZF.js

@@ -0,0 +1 @@
+import"./chunk-KEIR6QF5-BICK3FdT.js";import{M as e}from"./mermaid-parser.core-Cx6yvn3j.js";export{e as createArchitectureServices};