@pikku/cli 0.12.127 → 0.12.133

package/CHANGELOG.md

@@ -1,3 +1,325 @@
+## 0.12.133
+
+### Patch Changes
+
+- b2e038b: Rename `@pikku/sql-migrator` to `@pikku/migrator-sql`, so a future migrator for
+  another store sorts beside it rather than under a second prefix. The package has
+  never been published under either name, so nothing depends on the old one.
+- Updated dependencies [b2e038b]
+  - @pikku/migrator-sql@0.12.3
+
+## 0.12.132
+
+### Patch Changes
+
+- 498662a: Measure a finished milestone against its plan, with `pikku knowledge plan progress`.
+
+  The reconciliation itself already existed — `planShortfall` reads pikku's generated meta under `.pikku/` and answers "was this planned function written, this route wired, this `pikkuScenario` exported" by set membership. Nothing in the CLI could run it, so the only thing closing a milestone was the build agent's own account of what it had done.
+
+  `pikku knowledge plan progress <milestone>` prints what the milestone still owes, separating what BLOCKS (the first pass) from what a later pass picks up, and exits non-zero while anything blocks. Its problems include the two checks no meta covers: a browser scenario that opens a page and asserts it is still on it, and an `on delete cascade` the plan promised that no migration declares.
+
+  Two skills follow it. The new `pikku-architect` writes the plan against the milestone note through `pikku knowledge plan set`, as a seat separate from the build — a builder who writes its own plan can build a fraction, plan only that fraction, and certify itself complete. `pikku-build` now plans each milestone before building it (§5a) and closes it on `plan progress` rather than on memory (§6a), with `pikku knowledge plan defer` as the only way an unbuilt item leaves the first pass.
+
+  Two things `plan set` needed before an architect could actually satisfy it: it now refuses a `covers` entry naming a note that does not exist, or carrying a hash that is not that note's current one — and names the correct hash, which is also the only way to obtain one. Unchecked, a placeholder hash was accepted and the note it claimed read as edited-since from the moment the milestone shipped, dropping silently back into a backlog nobody had planned. The plan's build rendering no longer names a runtime-specific command for creating a frontend, since two builds read it and each creates one a different way.
+
+- f970f8f: Rename `@pikku/db-migrator` to `@pikku/migrator-sql`.
+
+  It applies `.sql` files and keeps their bookkeeping; it is not a database
+  service, and `db-` read as though it were one. Nothing was ever published under
+  the old name, so there is no alias to keep.
+
+- Updated dependencies [498662a]
+- Updated dependencies [e0bf0ce]
+- Updated dependencies [f970f8f]
+  - @pikku/knowledge@0.12.9
+  - @pikku/skills@0.12.25
+  - @pikku/migrator-sql@0.12.2
+
+## 0.12.131
+
+### Patch Changes
+
+- a057bec: Extract the SQL migration applier into `@pikku/migrator-sql`, so the CLI is no longer the only thing that can run one.
+
+  A shipped standalone bundle has to apply the same migrations to the same database as `pikku db migrate`, from a machine with no checkout. That only works if both agree on the bookkeeping table, the file hash and the file order — a second implementation that differs in any of the three reads every migration the other applied as drifted and refuses to go on.
+
+  Nothing about the CLI's behaviour changes; the algorithm, the `sql_migrations` table and the drift error moved intact.
+
+- a057bec: Give a standalone bundle a command line.
+
+  An operator holding a standalone artifact on a machine had one thing they could
+  do with it: start it. Applying the migrations it needs meant a checkout of the
+  project and a second copy of the CLI on a production box, and answering "which
+  build is this" meant asking whoever ran the deploy.
+
+  The bundle now takes a command. `serve` remains the default, so an existing
+  `node bundle.js` is unchanged. `version` prints the version the project declared
+  at build time. `db migrate` and `db status` apply and report the migrations that
+  now ship beside the bundle under `db/<engine>/` — the same path Fabric's build
+  container stages them to, so the two producers of an artifact cannot disagree
+  about where the SQL lives. `backup <path>` writes a consistent copy of a SQLite
+  database with `VACUUM INTO`; on postgres it refuses and names `pg_dump`, which
+  is the tool for it.
+
+  Both engines are supported: a postgres build migrates over the connection it
+  already opens. `PostgresMigrationClient` grew an optional `begin`, because a
+  pooled client is free to answer `BEGIN`, the migration and `COMMIT` on three
+  different connections — which leaves a failed migration half applied with
+  nothing to roll back.
+
+  There is deliberately no way to invoke an RPC. A running server already answers
+  them with auth, sessions and middleware applied; an in-process invoke would
+  answer them with none of that.
+
+- Updated dependencies [a057bec]
+- Updated dependencies [a057bec]
+  - @pikku/migrator-sql@0.12.1
+  - @pikku/deploy@0.12.5
+
+## 0.12.130
+
+### Patch Changes
+
+- 3d75643: Run the app's server lifecycle in generated entries, and make an out-of-band
+  account signable-in.
+
+  `pikkuServerLifecycle` was only ever called by `pikku dev` and `pikku serve`, so
+  an app that seeds its first admin account, probes a dependency, or warms a cache
+  in `beforeStart` did all of that in development and silently skipped it
+  everywhere it was actually deployed. The standalone entry and the shared node
+  server entry — the one behind every `target: 'server'` unit — now import the
+  app's lifecycle and call it: `beforeStart` after `init` and before the port
+  opens, so work that must finish before the first request has, `afterStart` once
+  the server is listening, and the stop hooks handed to the signal handler that
+  already owns shutdown rather than a second listener racing it. Each shutdown
+  step is isolated from the ones after it, so a hook that throws is logged without
+  taking the service teardown and the socket close down with it.
+
+  Separately, `createAuthUser` and `setAuthUserPassword` wrote credential accounts
+  with no `issuer`. From better-auth 1.7 a credential account is matched by its
+  issuer as well as its provider, so those accounts were invisible to sign-in,
+  `updatePassword` and `findCredentialAccount` — a user who plainly existed in the
+  table was reported as "user not found". The field is written only when the
+  resolved schema has it, so older better-auth keeps working, and
+  `setAuthUserPassword` repairs an account that predates the fix.
+
+- 3d75643: Give a standalone artifact the database connection every other provider's runtime hands it.
+
+  `createSingletonServices` receives `kysely` from whatever is hosting the app —
+  `pikku dev` builds one, a Cloudflare deploy binds one — so app code is written
+  expecting it, and the generated templates throw outright when it is absent. The
+  standalone provider is its own host and supplied nothing, so a bundle built from
+  a project with a database started, called the services factory, and died on the
+  first line of it. The artifact was only ever startable by projects that had no
+  database at all, which is not the case the provider exists to serve.
+
+  The generated entry now opens the database itself and passes `kysely` in.
+  `EntryGenerationContext` carries a `db` descriptor, and the engine is read from
+  the migrations directory the project actually wrote — `db/sqlite` or
+  `db/postgres`, the same two conventions the migrator emits to. Having both is
+  refused rather than resolved: choosing on directory order would choose which
+  database the deployed app talks to, and an app running happily against the
+  wrong but entirely valid schema is invisible until someone reads the data.
+
+  For SQLite the adapter emits the dialect its runtime can actually use —
+  `@pikku/kysely-node-sqlite` for the node bundle, `@pikku/kysely-bun-sqlite` for a
+  compiled bun binary, which has no `node:sqlite` to reach for. For Postgres it
+  emits `PikkuKysely` from `@pikku/kysely-postgres`, connected from `DATABASE_URL`,
+  the same variable every other pikku host reads, so an artifact dropped onto a
+  machine already running a pikku app needs no new one. An unset `DATABASE_URL`
+  fails by name rather than as a driver error about an undefined connection
+  string.
+
+  The connection pool is closed on shutdown, in `afterStop` — after the app's own
+  stop hook and the draining server have both finished with it, since a pool
+  closed any earlier takes the queries they are still entitled to make down with
+  it. SQLite needs no counterpart: the process exiting releases the file.
+
+  The project's generated coercion map is applied to either engine, so a deployed
+  app and `pikku dev` agree about which columns are dates and which are booleans.
+  It is attached when the project generated one and skipped when it did not — the
+  map is built from `db/annotations.ts` rather than from the dialect, so an app
+  that annotates no columns is one with nothing to coerce rather than one that
+  should be handed no database at all.
+
+  A SQLite file is located by `PIKKU_DATA_DIR` rather than derived from the bundle's
+  own path: a deploy that swaps the release directory would otherwise take the
+  database with it. `PIKKU_DATABASE_FILE` overrides it outright, for when the path
+  has to match one something else already chose — notably `pikku db migrate`,
+  which has to open the same file or the app runs against an unmigrated schema.
+  Neither being set fails with the variable's name rather than as a SQLite error
+  about a path of `undefined`.
+
+- Updated dependencies [3d75643]
+- Updated dependencies [3d75643]
+  - @pikku/node-http-server@0.12.13
+  - @pikku/better-auth@0.12.36
+  - @pikku/bun-server@0.12.11
+  - @pikku/deploy@0.12.4
+
+## 0.12.129
+
+### Patch Changes
+
+- 796045f: Add `pikku knowledge plan` — read and write a milestone's technical plan.
+
+      pikku knowledge plan schema
+      pikku knowledge plan show <milestone> [--for-build]
+      pikku knowledge plan set <milestone> <file>
+      pikku knowledge plan defer <milestone> <item> --reason "..."
+
+  `set` is the point of it. It runs the schema, then `checkFirstPass`,
+  `checkPlanInternals` and `checkAgainstMilestone` against the milestone note's
+  own surface and personas, and writes nothing unless all of them pass — a plan
+  validated at gate time instead has already cost the build it was measured
+  against. A shape refusal carries the schema with it, so a writer told a field
+  is invalid does not have to go looking for what the valid options are.
+
+  `defer` moves ONE first-pass item to the next pass with its reason recorded,
+  which is the only sanctioned way for something planned to stop blocking the
+  milestone. The runners live in `@pikku/knowledge` as
+  `runKnowledgePlanSchema`/`Show`/`Set`/`Defer`, so anything else driving a build
+  gets the same order of checks without reimplementing it.
+
+- 8852a75: Register an agent invoked from a function body in the calling deployment unit.
+
+  `runAgent('houseAssistant', ...)` and `rpc.agent.run('houseAssistant', ...)` resolve against the in-process agent registry, but the deploy analyzer only ever put an agent's registration in its own `agent-*` unit. A function calling one landed in a separate unit whose bootstrap never registered it, so the deployed worker threw `AI agent not found: houseAssistant`.
+
+  The inspector now records a string-literal agent name passed to `runAgent` / `streamAgent` / `rpc.agent.run` / `rpc.agent.stream` in a function body under `agents.invokedAgentsByFile`, mirroring what it already does for `rpc.invoke` targets. The analyzer carries those names on the calling unit as `invokedAgents` and adds the `ai-model` / `ai-storage` service requirements, and per-unit codegen puts the agent — and its tools — into that unit's filter names so its wiring is generated there too. A dynamic (template-literal) agent name is warned about, as it is for `rpc.invoke`.
+
+- acca415: Consolidate the skills corpus from 63 skills to 21.
+
+  The corpus had grown one skill per package and one per transport, so an agent's
+  first decision was a routing problem — which of ten wiring skills, which of five
+  auth skills — before it could reach anything that helped. Most of what those
+  skills carried was signatures and option keys, which `pikku doc` computes from
+  the compiler and cannot go stale.
+
+  Each family collapses to one chooser skill plus per-topic `references/*.md`. The
+  chooser answers the question the compiler cannot: which thing to pick, what
+  differs between the options, and what goes wrong silently. The families:
+
+  - `pikku-deploy` — eight runtime skills
+  - `pikku-service-backends` — six adapter skills, organised by the core interface
+    they implement rather than by vendor
+  - `pikku-wiring` — ten transport skills
+  - `pikku-auth` — five skills that all answered "who is this and may they",
+    fronted by the authentication-versus-authorization distinction
+  - `pikku-services` — services, config, audit and logging
+  - `pikku-agent` — the agent, its runner and the voice middlewares
+  - `pikku-react` and `pikku-i18n` — the client and localisation families
+  - `pikku-meta` — project metadata, contract versioning and the dependency audit
+  - `pikku-build` — the three build modes, feature work and post-clone cleanup
+  - `pikku-software-archaeology` and `pikku-fabric` — each gains its second phase
+
+  The doc-surface routing table (`LEAF_EDITORIAL`) points at the merged skills, and
+  the fabric install group is back to what it names: skills about Fabric.
+
+- Updated dependencies [9015400]
+- Updated dependencies [f4e2e89]
+- Updated dependencies [796045f]
+- Updated dependencies [796045f]
+- Updated dependencies [9022169]
+- Updated dependencies [8852a75]
+- Updated dependencies [acca415]
+  - @pikku/inspector@0.12.71
+  - @pikku/core@0.12.102
+  - @pikku/skills@0.12.23
+  - @pikku/knowledge@0.12.8
+  - @pikku/deploy@0.12.3
+
+## 0.12.128
+
+### Patch Changes
+
+- c0940a1: `pikku new addon` now installs and builds the addon it generates.
+
+  The generated package exports `./dist/...`, which is what an installed consumer
+  resolves and what the app's own `pikku-bootstrap.gen.ts` imports. Until `build`
+  had run, that path did not exist: the app failed at boot with PKU340 and an
+  ERR_MODULE_NOT_FOUND on a dist file nobody had written, and every
+  `ref('<addon>:…')` resolved to nothing. Nothing about the generated files showed
+  the problem, so a generated addon looked complete and was dead at runtime.
+
+  Pass `--no-build` to keep the previous write-only behaviour.
+
+- e92e30b: Print a CLI failure as its message, not as a JS stack trace.
+
+  Every error that reached the top of `executeCLI` was logged with `console.error('Error:', error)`, which node renders as the full stack — and prefixed it a second time, so a refusal read `Error: Error: Persona 'guest' missing guest…` above ten frames of pikku internals. A `PikkuFetchError` was worse: node inspects an error's own properties, so the whole `Response` came out with it, headers and body stream included, to say `502`.
+
+  An expected failure — a `PikkuError`, or anything carrying `expected: true` — now prints its message alone, and a fetch failure prints `502 Bad Gateway from <url>` without touching the response. Anything else keeps its stack, because a `TypeError` with its frames removed is undiagnosable. `--verbose`/`-v`, or `PIKKU_DEBUG=1` where the flag cannot be typed, adds the stack back to an expected failure.
+
+  The refusals behind the examples — a persona whose roles have drifted, a sign-in the stage rejected — are raised as `PikkuError` so they are classed as deliberate.
+
+- 3079f44: Give `pikku dev` a credential store.
+
+  Wiring a `credentialService` is the deployment's job — the values are per-user
+  secrets, and where they are encrypted and who holds the key is a decision only
+  the host can make. But that left `pikku dev` with none at all: `credentialService`
+  was `undefined`, so an addon imported with `--auth per-user` or `--auth delegated`
+  could not be exercised locally. The delegated sign-in a project is told to wire
+  threw on its first call, and projects were reaching for their own credential
+  tables to get past it.
+
+  `pikku dev` now builds a `LocalCredentialService` alongside the rest of its
+  in-memory services — the queue, the trigger service, the workflow service — and
+  hands it to `createSingletonServices` as an existing service. A project that
+  wants a real store overrides it there the same way it overrides any of the
+  others: `existingServices.credentialService ?? new OwnCredentialService()`.
+
+- 5bb006f: Add `pikku fabric secrets delete <name>`.
+
+  Removing one secret from a stage had no lever. The only thing close was
+  `secrets rotate`, which retires the stage's sealing key and so takes every
+  secret on the stage down with it — an enormous blast radius for wanting one
+  name gone.
+
+  `secrets delete` calls the `deleteStageSecret` RPC, which removes the single
+  named secret and leaves the sealing key and the stage's other secrets alone.
+  It confirms first unless `--force` is passed: fabric holds only the public half
+  of the stage keypair, so it cannot read a sealed value back and cannot restore
+  one — the plaintext has to be supplied again. Deployed units keep serving the
+  old value until the stage is republished, so the run that does so is reported
+  when the delete triggers one.
+
+- e15f5a9: Add `pikku dist`, and use it as the generated addon's build step.
+
+  `tsc` compiles the `.ts` under the pikku out dir, but it never carries the
+  `*.gen.json` meta written beside them, and it never re-emits a hand-authored
+  `.d.ts`. Both are needed at runtime — `MetaService` opens the meta off disk by
+  path — so a package that ships only tsc's output answers every meta lookup with
+  nothing.
+
+  Every generated addon papered over this with `tsc && cp -r .pikku types dist/`,
+  which copied two whole directories: it dragged 52 raw `.ts` sources into the
+  published output alongside the compiled ones, and needed a POSIX shell. Since
+  the script comes from the CLI, every project carried the same line.
+
+  `pikku dist` copies exactly what tsc could not emit, to where tsc would have put
+  it, reading the layout from `pikku.config.json` and the destination from the
+  tsconfig's `outDir` (or `--dist-dir`). The generated build script is now
+  `tsc && pikku dist`.
+
+- 4d0a548: Provision the declared personas from the fabric plugin instead of the server lifecycle.
+
+  `provisionPersonas` was documented as a call an app makes from `pikkuServerLifecycle`'s `afterStart`. That hook is invoked by `pikku serve` and `pikku dev` and by nothing else — no deploy runtime calls it — so on any stage deployed to Workers or a serverless target the provisioning never ran, and every persona signed in holding no roles.
+
+  `pikkuFabric` now takes `personas`. The operator endpoint resolves the address the caller wants to act as; a miss provisions the declaration and looks again. On a stage that already holds the persona that is one query, and the pass only runs when there is genuinely something absent to create.
+
+  Sign-in no longer creates accounts of its own. `OperatorSignInOptions.createMissing` and `PIKKU_PERSONA_CREATE_MISSING` are gone, and an address no declaration claims stays a 404 however many times it is asked for. `provisionPersonas` is no longer exported — the plugin is the only caller.
+
+  `pikku persona sync <environment>` is unchanged: it still reports who an environment will provision and why anyone was skipped, and still writes nothing.
+
+- Updated dependencies [e92e30b]
+- Updated dependencies [14059e0]
+- Updated dependencies [781797c]
+- Updated dependencies [ccab6ed]
+- Updated dependencies [4d0a548]
+- Updated dependencies [5ace170]
+  - @pikku/core@0.12.101
+  - @pikku/better-auth@0.12.35
+  - @pikku/skills@0.12.22
+
 ## 0.12.127
 
 ### Patch Changes

package/console-app/assets/{abnfDiagram-N423BO3Z-BY2LM8wi.js → abnfDiagram-N423BO3Z-BQPUva28.js}

@@ -1 +1 @@
-import{m as e,t}from"./mermaid-parser.core-Cx6yvn3j.js";import{n}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import{t as r}from"./src-LceHEY_Q.js";import"./chunk-I66GZJ75-DH54FcuO.js";import{n as i,r as a,t as o}from"./chunk-6Q2QTUOP-DloGRHJZ.js";import{t as s}from"./chunk-JWPE2WC7-DVXcaiue.js";import"./mermaid.core-BebGyklS.js";var c=e().RailroadAbnf.parser.LangiumParser,l=n(e=>{let t=e.alternatives.map(u);return t.length===1?t[0]:{type:`choice`,alternatives:t}},`transformAlternation`),u=n(e=>{let t=e.elements.map(f);return t.length===1?t[0]:{type:`sequence`,elements:t}},`transformConcatenation`),d=n(e=>{if(e.includes(`*`)){let[t,n]=e.split(`*`);return{min:t?parseInt(t,10):0,max:n?parseInt(n,10):1/0}}let t=parseInt(e,10);return{min:t,max:t}},`parseRepeat`),f=n(e=>{let t=p(e.primary);if(!e.repeat)return t;let{min:n,max:r}=d(e.repeat);return n===0&&r===1?{type:`optional`,element:t}:{type:`repetition`,element:t,min:n,max:r}},`transformElement`),p=n(e=>{switch(e.$type){case`AbnfStringLiteral`:return{type:`terminal`,value:e.value};case`AbnfNumVal`:return{type:`terminal`,value:e.value};case`AbnfRuleName`:return{type:`nonterminal`,name:e.name};case`AbnfGroup`:return l(e.element);case`AbnfOptionalGroup`:return{type:`optional`,element:l(e.element)};default:throw Error(`Unsupported ABNF primary node: ${e.$type}`)}},`transformPrimary`),m=n(e=>({name:e.name,definition:l(e.definition)}),`transformRule`),h=n(e=>{s(e,o),e.title&&o.setTitle(e.title),e.rules.map(e=>o.addRule(m(e)))},`populateDb`),g={parser:{parse:n(e=>{o.clear(),r.debug(`[ABNF Parser] Starting Langium parse`);let n=c.parse(e);if(n.lexerErrors.length>0||n.parserErrors.length>0)throw new t(n);let i=n.value;r.debug(`[ABNF Parser] Parsed rules:`,i.rules.length),h(i),r.debug(`[ABNF Parser] Parse complete`)},`parse`),parser:{yy:o}},db:o,renderer:a,styles:i};export{g as diagram};
+import{m as e,t}from"./mermaid-parser.core-DxPo1qbR.js";import{n}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import{t as r}from"./src-DF-84qwJ.js";import"./chunk-I66GZJ75-CbpQtX8e.js";import{n as i,r as a,t as o}from"./chunk-6Q2QTUOP-xrgFRP4Y.js";import{t as s}from"./chunk-JWPE2WC7-DVXcaiue.js";import"./mermaid.core-DpvXaF3y.js";var c=e().RailroadAbnf.parser.LangiumParser,l=n(e=>{let t=e.alternatives.map(u);return t.length===1?t[0]:{type:`choice`,alternatives:t}},`transformAlternation`),u=n(e=>{let t=e.elements.map(f);return t.length===1?t[0]:{type:`sequence`,elements:t}},`transformConcatenation`),d=n(e=>{if(e.includes(`*`)){let[t,n]=e.split(`*`);return{min:t?parseInt(t,10):0,max:n?parseInt(n,10):1/0}}let t=parseInt(e,10);return{min:t,max:t}},`parseRepeat`),f=n(e=>{let t=p(e.primary);if(!e.repeat)return t;let{min:n,max:r}=d(e.repeat);return n===0&&r===1?{type:`optional`,element:t}:{type:`repetition`,element:t,min:n,max:r}},`transformElement`),p=n(e=>{switch(e.$type){case`AbnfStringLiteral`:return{type:`terminal`,value:e.value};case`AbnfNumVal`:return{type:`terminal`,value:e.value};case`AbnfRuleName`:return{type:`nonterminal`,name:e.name};case`AbnfGroup`:return l(e.element);case`AbnfOptionalGroup`:return{type:`optional`,element:l(e.element)};default:throw Error(`Unsupported ABNF primary node: ${e.$type}`)}},`transformPrimary`),m=n(e=>({name:e.name,definition:l(e.definition)}),`transformRule`),h=n(e=>{s(e,o),e.title&&o.setTitle(e.title),e.rules.map(e=>o.addRule(m(e)))},`populateDb`),g={parser:{parse:n(e=>{o.clear(),r.debug(`[ABNF Parser] Starting Langium parse`);let n=c.parse(e);if(n.lexerErrors.length>0||n.parserErrors.length>0)throw new t(n);let i=n.value;r.debug(`[ABNF Parser] Parsed rules:`,i.rules.length),h(i),r.debug(`[ABNF Parser] Parse complete`)},`parse`),parser:{yy:o}},db:o,renderer:a,styles:i};export{g as diagram};

package/console-app/assets/architecture-TIHT7OUA-G_ldr-C2.js

@@ -0,0 +1 @@
+import"./chunk-KEIR6QF5-BICK3FdT.js";import{M as e}from"./mermaid-parser.core-DxPo1qbR.js";export{e as createArchitectureServices};