@pikku/skills 0.12.15 → 0.12.17

package/CHANGELOG.md

@@ -1,5 +1,74 @@
 # @pikku/skills
 
+## 0.12.17
+
+### Patch Changes
+
+- a3deea4: Document machine authentication as middleware that sets a session. A caller with an identity (a sandbox, a deployed container, a machine host) is resolved once in `addHTTPMiddleware('*')`, which calls `setSession`; the function is then a plain `pikkuFunc` gated with `scopes` and reads `session`, rather than verifying the bearer token in its own body or in a `permissions` check that returns `true`.
+
+  The middleware skill also spells out why this cannot be `addTagMiddleware`: tag middleware runs inside `runPikkuFunc`, which the RPC dispatch calls without a `sessionService`, so a session set there never reaches a function invoked over `POST /rpc/:rpcName`.
+
+- 30e390b: Skills now name the three languages a project has, and refuse to let them
+  collapse into one.
+
+  An agent building a doctor's portal for a German practice read "the entire UI is
+  German" as an instruction about the codebase. It shipped
+  `project.inlang/settings.json` with `baseLocale: "de"` and no `en.json` — which
+  broke `--add-locale` permanently — alongside RPC functions `getUebersicht` and
+  `getPatientendetail`, components `Zeitstrahl` and `AufmerksamkeitStreifen`, and
+  database tables `vorgang` and `ereignis`. Nothing in the skills had ever told it
+  these were three separate decisions, so it made one.
+
+  `pikku-concepts` now carries the canonical statement — identifiers are always
+  English and no setting changes that; meta (`description`, `title`, `template`)
+  follows `locale` in `pikku.config.json`; the product's UI language lives in the
+  message catalogue with `defaultLocale`, never in `baseLocale`. `pikku-build-app`
+  §1a asks the question and writes the answer into the config; `pikku-scenario`
+  splits step identifiers from step prose and admits where the English-only
+  reporter frame still shows through; `pikku-i18n` states why `baseLocale` stays
+  `en` and what to set instead. `pikku-build-quick`, `pikku-build-platform`,
+  `pikku-feature` and `pikku-fabric` carry the short form.
+
+## 0.12.16
+
+### Patch Changes
+
+- 0b1bf53: `pikku dev` turns actor quick login on and mints its secret; `pikku serve` never
+  does
+
+  Which command is running is the thing that knows whether "sign in as <persona>"
+  should work, so the two server commands now say so rather than leaving it to
+  whatever the environment happens to contain.
+
+  `pikku dev` sets `PIKKU_DEV_ACTOR_SIGN_IN` before it loads the project and, if no
+  actor secret is set, mints a cryptographically random one for the run under both
+  `SCENARIO_ACTOR_SECRET` and the `VITE_`-prefixed copy the dev frontend can
+  actually read — only prefixed variables reach `import.meta.env`, and the switcher
+  runs in the browser. Requiring every contributor to hand-manage a secret for a
+  server that is trusted with the database anyway bought nothing and cost setup
+  friction on every machine. An explicitly-set secret always wins: a project
+  pointing its scenario runs and its dev server at one value has to keep that
+  value. The minted one lives only in this process's environment, so it is gone
+  when the server stops and yesterday's cannot sign anything in today. Both cases
+  are logged, naming where the secret came from — the previous silence is what made
+  a missing control unanswerable from outside the container. Where the two names
+  disagree the command says so instead of picking one quietly, because that
+  disagreement presents as "the switcher signs in nowhere".
+
+  `pikku serve` is the production server command and does the opposite: it clears
+  the marker outright, so an inherited environment cannot switch passwordless
+  sign-in on behind the operator, and it warns when it had something to clear. What
+  it deliberately leaves alone is `PIKKU_ALLOW_ACTOR_SIGN_IN` — scenario suites have
+  to be able to run against a deployed stage, and that opt-in is the supported way
+  to say so.
+
+  `pikku validate`'s fix hint for a project with personas but no actor sign-in no
+  longer tells people to control the endpoint by withholding the secret, which is
+  no longer how it is controlled, and the `pikku-better-auth` skill documents the
+  gate, the two escape hatches, and the two distinct refusals.
+
+- 8519a73: Say plainly that the dev seed is local only. No deploy applies it, so the test for a row is not whether it looks realistic but whether the app would be broken without it in production — a venue, a catalogue, a tenant is configuration and belongs in a migration. Names the failure it causes: a stage whose pages return 200 while its first data read throws.
+
 ## 0.12.15
 
 ### Patch Changes