@pikku/skills 0.12.15 → 0.12.16
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,45 @@
|
|
|
1
1
|
# @pikku/skills
|
|
2
2
|
|
|
3
|
+
## 0.12.16
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- 0b1bf53: `pikku dev` turns actor quick login on and mints its secret; `pikku serve` never
|
|
8
|
+
does
|
|
9
|
+
|
|
10
|
+
Which command is running is the thing that knows whether "sign in as <persona>"
|
|
11
|
+
should work, so the two server commands now say so rather than leaving it to
|
|
12
|
+
whatever the environment happens to contain.
|
|
13
|
+
|
|
14
|
+
`pikku dev` sets `PIKKU_DEV_ACTOR_SIGN_IN` before it loads the project and, if no
|
|
15
|
+
actor secret is set, mints a cryptographically random one for the run under both
|
|
16
|
+
`SCENARIO_ACTOR_SECRET` and the `VITE_`-prefixed copy the dev frontend can
|
|
17
|
+
actually read — only prefixed variables reach `import.meta.env`, and the switcher
|
|
18
|
+
runs in the browser. Requiring every contributor to hand-manage a secret for a
|
|
19
|
+
server that is trusted with the database anyway bought nothing and cost setup
|
|
20
|
+
friction on every machine. An explicitly-set secret always wins: a project
|
|
21
|
+
pointing its scenario runs and its dev server at one value has to keep that
|
|
22
|
+
value. The minted one lives only in this process's environment, so it is gone
|
|
23
|
+
when the server stops and yesterday's cannot sign anything in today. Both cases
|
|
24
|
+
are logged, naming where the secret came from — the previous silence is what made
|
|
25
|
+
a missing control unanswerable from outside the container. Where the two names
|
|
26
|
+
disagree the command says so instead of picking one quietly, because that
|
|
27
|
+
disagreement presents as "the switcher signs in nowhere".
|
|
28
|
+
|
|
29
|
+
`pikku serve` is the production server command and does the opposite: it clears
|
|
30
|
+
the marker outright, so an inherited environment cannot switch passwordless
|
|
31
|
+
sign-in on behind the operator, and it warns when it had something to clear. What
|
|
32
|
+
it deliberately leaves alone is `PIKKU_ALLOW_ACTOR_SIGN_IN` — scenario suites have
|
|
33
|
+
to be able to run against a deployed stage, and that opt-in is the supported way
|
|
34
|
+
to say so.
|
|
35
|
+
|
|
36
|
+
`pikku validate`'s fix hint for a project with personas but no actor sign-in no
|
|
37
|
+
longer tells people to control the endpoint by withholding the secret, which is
|
|
38
|
+
no longer how it is controlled, and the `pikku-better-auth` skill documents the
|
|
39
|
+
gate, the two escape hatches, and the two distinct refusals.
|
|
40
|
+
|
|
41
|
+
- 8519a73: Say plainly that the dev seed is local only. No deploy applies it, so the test for a row is not whether it looks realistic but whether the app would be broken without it in production — a venue, a catalogue, a tenant is configuration and belongs in a migration. Names the failure it causes: a stage whose pages return 200 while its first data read throws.
|
|
42
|
+
|
|
3
43
|
## 0.12.15
|
|
4
44
|
|
|
5
45
|
### Patch Changes
|