@pikku/skills 0.12.16 → 0.12.18

package/CHANGELOG.md

@@ -1,5 +1,56 @@
 # @pikku/skills
 
+## 0.12.18
+
+### Patch Changes
+
+- 7d8082a: Add `pikku fabric variables set` and `pikku fabric variables get`
+
+  `secrets` was the only stage-scoped store the CLI exposed, so a value declared
+  with `defineVariable` could be set locally through `.env` and not at all on a
+  deployed stage — `variables.get('NAME')` compiled, ran, and answered `undefined`
+  forever, with nothing saying why. The fabric API already had
+  `setStageConsoleVariable` and `getStageConsoleVariable`; only the CLI surface was
+  missing.
+
+  `set` stores the value the way `LocalVariablesService` reads one: `JSON.parse`,
+  falling back to the raw string. `--value true` is therefore the boolean on a
+  stage exactly as it is from `.env`, and `--value '"true"'` is the string. `get`
+  prints the stored value as JSON so the two are distinguishable, which is usually
+  why you are looking.
+
+  Variables are not sealed and are readable back — that is the difference from
+  `secrets`, and anything that would hurt to print belongs in `secrets set`.
+
+## 0.12.17
+
+### Patch Changes
+
+- a3deea4: Document machine authentication as middleware that sets a session. A caller with an identity (a sandbox, a deployed container, a machine host) is resolved once in `addHTTPMiddleware('*')`, which calls `setSession`; the function is then a plain `pikkuFunc` gated with `scopes` and reads `session`, rather than verifying the bearer token in its own body or in a `permissions` check that returns `true`.
+
+  The middleware skill also spells out why this cannot be `addTagMiddleware`: tag middleware runs inside `runPikkuFunc`, which the RPC dispatch calls without a `sessionService`, so a session set there never reaches a function invoked over `POST /rpc/:rpcName`.
+
+- 30e390b: Skills now name the three languages a project has, and refuse to let them
+  collapse into one.
+
+  An agent building a doctor's portal for a German practice read "the entire UI is
+  German" as an instruction about the codebase. It shipped
+  `project.inlang/settings.json` with `baseLocale: "de"` and no `en.json` — which
+  broke `--add-locale` permanently — alongside RPC functions `getUebersicht` and
+  `getPatientendetail`, components `Zeitstrahl` and `AufmerksamkeitStreifen`, and
+  database tables `vorgang` and `ereignis`. Nothing in the skills had ever told it
+  these were three separate decisions, so it made one.
+
+  `pikku-concepts` now carries the canonical statement — identifiers are always
+  English and no setting changes that; meta (`description`, `title`, `template`)
+  follows `locale` in `pikku.config.json`; the product's UI language lives in the
+  message catalogue with `defaultLocale`, never in `baseLocale`. `pikku-build-app`
+  §1a asks the question and writes the answer into the config; `pikku-scenario`
+  splits step identifiers from step prose and admits where the English-only
+  reporter frame still shows through; `pikku-i18n` states why `baseLocale` stays
+  `en` and what to set instead. `pikku-build-quick`, `pikku-build-platform`,
+  `pikku-feature` and `pikku-fabric` carry the short form.
+
 ## 0.12.16
 
 ### Patch Changes