@pikku/skills 0.12.11 → 0.12.13

package/CHANGELOG.md

@@ -1,5 +1,79 @@
 # @pikku/skills
 
+## 0.12.13
+
+### Patch Changes
+
+- 58cb0f8: Scaffold an addon whose exports point at the leaf its codegen actually writes
+
+  `pikku all` roots an addon's generated tree at `.pikku/addon/`, but `pikku new
+addon` still wrote the pre-split targets: `./.pikku/*` resolved to
+  `./dist/.pikku/*` and the internal RPC map to `./dist/.pikku/rpc/...`, neither of
+  which exists in the published package. The subpaths a consumer writes are
+  unchanged — only the targets gain the `addon` segment.
+
+  The addon manifest reference in the `pikku-addon` skill described the same
+  package.json one migration further back, with `imports` and `exports` naming the
+  source tree and `files: ["dist", ".pikku"]` shipping `.ts` files Node cannot
+  load. It now documents the built layout, and why `imports` and tsconfig `paths`
+  deliberately point at different trees.
+
+  The plain scaffold — no `--secret`, `--oauth` or `--credential` — built its API
+  service with `new XService(variables)` against a class declaring no constructor,
+  so `pikku new addon <name>` produced a package that did not typecheck until the
+  author deleted the argument. Only the authenticating variants take one.
+
+## 0.12.12
+
+### Patch Changes
+
+- 8d6a6bc: fix(cli): a scaffold flag says a surface exists, not who may call it
+
+  `scaffold.<feature>` accepted an `auth` field, and the generated wrapper emitted
+  it onto the wired function. That put authentication in two places at once: the
+  target function already declares whether it needs a session, its wiring, its
+  scopes and its addon gate already refine it, and `runPikkuFunc` already enforces
+  all of that on every call. The scaffold flag only stacked a coarser gate in
+  front of the one that actually decides, and — being a config field — it could
+  disagree with the function it was gating.
+
+  `PikkuScaffoldFeature` is now `boolean | { path?: string }`. It answers two
+  things and no more: whether the surface is generated, and where the file is
+  written. A feature that was `{ "auth": false }` becomes plain `true`, and
+  `pikku enable` loses its `--noAuth` flag along with the dimension it set.
+
+  The six generators that took the flag no longer take one. The four that generate
+  a dispatcher — public RPC, public agent, workflow routes and the events channel
+  — now emit a fixed `auth: false`. That is the wrapper declining to gate, not the
+  scaffold declaring the surface public: `rpcCaller` forwards to whichever
+  function the caller named, and that function's own `auth`, permissions, scopes
+  and addon gate are what decide. Emitting nothing would not be neutral, since a
+  wiring without `auth` requires a session and would reject the call before the
+  gate that decides ever ran. The two that generate scoped admin functions — user
+  admin and virtual users — emit no `auth`, because they are `pikkuFunc` with
+  their own `scopes`: session-required by construction, and the deciding function
+  rather than a wrapper in front of one.
+
+  The legacy `'auth'` / `'no-auth'` string values are gone with it. A bare string
+  is still refused rather than read as a `path`: under `boolean | object` no
+  string is valid, so guessing one would turn a typo into a generated file nobody
+  asked for.
+
+- 31ad85f: fix(emails): escape substituted values in the generated email renderer
+
+  `renderEmailTemplate` spliced values into HTML unescaped and looped substitution
+  until it reached a fixed point, so a value containing `"` broke out of the
+  attribute it landed in, a value containing markup was injected verbatim, and a
+  value containing `{{...}}` was re-expanded as a template on the next pass. An
+  ordinary CSS font stack from `theme.json` was enough to corrupt the document.
+
+  Rendering is now layered by trust. Partials are inlined first; `theme.*` and
+  `t.*` are expanded next as template-author input; caller `data` is substituted in
+  a single pass that is never rescanned. Values are HTML-escaped in `.html` output
+  and left raw in `.subject.txt` / `.text.txt`. `{{content}}` and partials stay
+  raw, and `{{{value}}}` is a new opt-in raw form. The console's email preview uses
+  the same renderer, so previews match what is sent.
+
 ## 0.12.11
 
 ### Patch Changes