@pikku/skills 0.12.19 → 0.12.21

package/CHANGELOG.md

@@ -1,5 +1,103 @@
 # @pikku/skills
 
+## 0.12.21
+
+### Patch Changes
+
+- 77ae071: `pikku fabric report` sends a finding — something about pikku that cost an agent time — to fabric. It needs a login but no linked project: a finding is about the framework rather than about anyone's project, and the reports worth having most come from checkouts that have nothing to name.
+
+  The finding can be given as JSON on stdin (`--stdin`) instead of as flags. Half the fields are prose, and prose carries apostrophes, quotes, backticks and newlines — every one a shell metacharacter before it is a character in a sentence — so an error message pasted into `--error` used to break the command at its first newline. The same schema validates either path.
+
+  Nothing is written to the repo, so nothing goes stale on an abandoned branch, and the terminal prints exactly what left the machine. Reporting never fails a build.
+
+  A finding that cannot be sent is held in `~/.fabric/findings` rather than dropped: logged out, unlinked, or fabric unreachable are the states a finding is most likely to be describing, and a scaffold that never got far enough to log in is exactly the thing worth hearing about. The queue drains on the next report that succeeds, keeps the project each finding was filed against, and is bounded at 100. `pikku fabric findings list`, `flush` and `clear` inspect and control it.
+
+  The resolved `@pikku/*` versions are read off the installed tree rather than out of `package.json`, since a range says nothing about what actually ran. A skewed tree and a package resolving through a workspace or link are both flagged, because either is a reason to read the finding differently.
+
+  The `pikku-feature` skill now tells an agent when to file one: work around it first, investigate only when there is no workaround, report at the depth already reached, and never patch pikku itself from inside a project that is using it.
+
+- 32d1280: Prefix the better-auth plugin factories with `pikku`: `pikkuActor`, `pikkuBan`,
+  `pikkuFabric`, `pikkuDelegatedAuth` and `pikkuCredentialOAuth`.
+
+  A `betterAuth({ plugins: [...] })` array mixes this package's plugins with
+  better-auth's own, and until now nothing at the call site told them apart —
+  `plugins: [actor(...), ban(), fabric(...), organization()]` reads as four
+  plugins from one place when only the last is better-auth's. The prefix says
+  which package a plugin came from where it is actually wired.
+
+  The old names are still exported as deprecated aliases bound to the same
+  functions, so no import has to change. Nothing about the plugins themselves
+  moved: the `id` each registers under — `pikku-ban`, `actor`, `fabric`,
+  `delegated-auth`, `credential-oauth` — is unchanged, so no deployed database or
+  session is affected.
+
+  The pieces that read a plugin's _export_ name rather than its id accept both:
+  `PLUGIN_REGISTRY` is keyed under the prefixed and the bare name, and the
+  `pikku validate` ban/actor checks and the `scaffold.userAdmin` ban check count
+  either spelling as wired. Their messages now point at the new names.
+
+## 0.12.20
+
+### Patch Changes
+
+- 7a15c9c: An actor credential is one persona's, not everyone's
+
+  `SCENARIO_ACTOR_SECRET` was a skeleton key. Anyone holding it could post any
+  `actor: true` address to `/auth/sign-in/actor` and get that persona's session —
+  including the `admin` persona, which provisioning grants real admin. The browser
+  switcher held it too, baked into the dev bundle as `VITE_SCENARIO_ACTOR_SECRET`,
+  so "the reviewer can sign in as each kind of user" and "the reviewer's bundle is
+  entitled to every persona" were the same fact.
+
+  It is now a root that credentials derive from, never one that is presented:
+
+  ```ts
+  deriveActorSecret(root, email) // HKDF-expanded HMAC-SHA256 over the address
+  ```
+
+  The endpoint re-derives the expected value for whichever address is signing in
+  and compares, so nothing is stored or looked up, a credential minted for one
+  persona is refused for every other, and rotating the root invalidates all of
+  them at once. The root itself is no longer a valid credential, and a root under
+  32 characters refuses the endpoint rather than deriving weak credentials from
+  it — the server log says why, the client is not told.
+
+  What that buys, in the places that used to need the whole key:
+
+  - **`pikku dev`** mints one credential per declared persona into
+    `VITE_DEV_ACTOR_SECRETS` and no longer writes `VITE_SCENARIO_ACTOR_SECRET` at
+    all. The root stays on the server.
+  - **`pikku persona secret <id>`** mints them for anything else, and a run given
+    `PIKKU_PERSONA_SECRETS=id=secret,…` can sign in as those personas and no
+    others — asking for one outside the list throws naming the persona instead of
+    falling back to the root.
+
+  `useDevActors()` and `<DevActorSwitcher />` take `secrets` (one per address)
+  where they took `secret`, and an actor with no credential is no longer offered
+  rather than rendering a row that 401s. `HttpPersonasConfig.secret` and the
+  Playwright provider's `secret` additionally accept a resolver, which is how a
+  partially-credentialled run is expressed.
+
+- ee9da9e: pikku-react now covers linking from a Mantine element: `component={Link}` widens the router generic to `AnyRouter` and stops checking `to` and `params`, so the skill teaches a wrapped typed `Link` reached through `renderRoot` instead.
+- 7d641f3: The three build skills now draw the line between the manual click-through (a smoke check, for layout) and verification: anything worth driving through the UI belongs in a scenario's browser step, not in a browser session steered by hand that nothing re-runs.
+- ee9da9e: The hardcoded-copy check stops flagging a feature's own name
+
+  Two rules disagreed. `runScenarioFileChecks` requires every `pikkuFeature` to
+  live in a `*.scenario.ts`, and moving one there is what put it in front of the
+  hardcoded-copy check — which then flagged the feature's own `name` because the
+  app catalogue happens to hold the same word:
+
+  ```
+  name: 'Downloads',   → ✗ "Downloads" → nav__downloads | downloads__title
+  ```
+
+  Complying with the first rule created violations of the second, and the advice
+  — read the string from the app catalogue — would tie the Console's language to
+  the product's. `name`, `description` and `template` declared directly on a
+  `pikkuFeature`, `pikkuScenario` or `pikkuScenarioStep` are Console meta and are
+  now skipped. A `name` nested deeper — `getByRole('button', { name: 'Speichern'
+})` — is a selector built out of UI copy and is still caught.
+
 ## 0.12.19
 
 ### Patch Changes