@pikku/skills 0.12.21 → 0.12.25

package/CHANGELOG.md

@@ -1,5 +1,130 @@
 # @pikku/skills
 
+## 0.12.25
+
+### Patch Changes
+
+- 498662a: Measure a finished milestone against its plan, with `pikku knowledge plan progress`.
+
+  The reconciliation itself already existed — `planShortfall` reads pikku's generated meta under `.pikku/` and answers "was this planned function written, this route wired, this `pikkuScenario` exported" by set membership. Nothing in the CLI could run it, so the only thing closing a milestone was the build agent's own account of what it had done.
+
+  `pikku knowledge plan progress <milestone>` prints what the milestone still owes, separating what BLOCKS (the first pass) from what a later pass picks up, and exits non-zero while anything blocks. Its problems include the two checks no meta covers: a browser scenario that opens a page and asserts it is still on it, and an `on delete cascade` the plan promised that no migration declares.
+
+  Two skills follow it. The new `pikku-architect` writes the plan against the milestone note through `pikku knowledge plan set`, as a seat separate from the build — a builder who writes its own plan can build a fraction, plan only that fraction, and certify itself complete. `pikku-build` now plans each milestone before building it (§5a) and closes it on `plan progress` rather than on memory (§6a), with `pikku knowledge plan defer` as the only way an unbuilt item leaves the first pass.
+
+  Two things `plan set` needed before an architect could actually satisfy it: it now refuses a `covers` entry naming a note that does not exist, or carrying a hash that is not that note's current one — and names the correct hash, which is also the only way to obtain one. Unchecked, a placeholder hash was accepted and the note it claimed read as edited-since from the moment the milestone shipped, dropping silently back into a backlog nobody had planned. The plan's build rendering no longer names a runtime-specific command for creating a frontend, since two builds read it and each creates one a different way.
+
+- e0bf0ce: Add a `pikku-webhook` skill covering the outgoing webhook primitive — `WebhookService` / `QueueWebhookService`, the `pikku-outgoing-webhooks` queue worker, `scaffold.webhook`, `config.webhook` (signing secret, header, retries, SSRF allowlist), receiver-side verification, and `KyselyWebhookService`'s delivery/attempt history. The corpus previously mentioned it in one table row, so agents hand-rolled `fetch` + HMAC instead of using it.
+
+## 0.12.24
+
+### Patch Changes
+
+- 202cb72: Refuse a scenario step whose prose opens with its own actor (PKU681). The
+  reporter already renders the actor as the sentence's subject, so a step
+  authored as `'sam' creates the client` and run as `{ actor: actors.sam }`
+  reads "Given sam 'sam' creates the client" — and the hardcoded name desyncs
+  the moment the call site changes actor. Only the subject position is refused:
+  naming someone else mid-sentence, or an actor keyed after a role noun used as
+  a noun ("creates the admin client"), is left alone.
+
+## 0.12.23
+
+### Patch Changes
+
+- f4e2e89: Add file attachments to `EmailService`.
+
+  `BaseSendEmailInput` gains an optional `attachments: EmailAttachment[]`, so it is
+  available on all three input variants — text, HTML and template. The new
+  `EmailAttachment` type is exported from `@pikku/core/services` alongside the
+  input types, and is shaped so that mapping it onto Resend, SendGrid, Nodemailer
+  or SES v2 is a straight field rename rather than a translation.
+
+  `content` is `Uint8Array | string`, where a string is always read as base64.
+  Both forms are accepted because both are what callers already hold: bytes come
+  out of a fetch or a file read, and base64 comes out of a database column or a
+  provider API. `Buffer` is deliberately absent from the type — it is a subclass
+  of `Uint8Array`, so Node callers can still pass one, while the type stays usable
+  in Cloudflare Workers, where `Buffer` does not exist.
+
+  `LocalEmailService` now logs attachment metadata — filename, content type,
+  content id, disposition and content length — instead of dropping the field
+  silently. The content itself is deliberately not logged.
+
+  The template-rendering wrapper documented in the emails skill rebuilt its
+  delegate payload field by field and therefore dropped `attachments`; it now
+  forwards them.
+
+- 9022169: Cover `pikku persona run`, and give the corpus a CLI command inventory.
+
+  `pikku doc` computes the `#pikku/*` API surface and lists no CLI commands, so
+  for anything invoked as `pikku <cmd>` the skills corpus is the only place it
+  exists. Two things were missing from it.
+
+  `pikku-scenario` covered declaring personas but not running one. Its new
+  `references/persona-run.md` covers the virtual-user run: the seven dispositions
+  and what each one is for, the three credentials and which wins, the budget and
+  `--seed` replay, why production takes only `accountable` and why that rule is
+  checked at build time and again at sign-in, the role check that happens before
+  the first step, and `sync` / `list` / `secret`.
+
+  `pikku-concepts` gains a one-line-per-command inventory of the CLI, grouped by
+  what you are doing and pointing at the skill that teaches each one. A dash means
+  no skill covers it beyond that line, which is a reason to read `--help` rather
+  than assume the command does what its name suggests.
+
+- acca415: Consolidate the skills corpus from 63 skills to 21.
+
+  The corpus had grown one skill per package and one per transport, so an agent's
+  first decision was a routing problem — which of ten wiring skills, which of five
+  auth skills — before it could reach anything that helped. Most of what those
+  skills carried was signatures and option keys, which `pikku doc` computes from
+  the compiler and cannot go stale.
+
+  Each family collapses to one chooser skill plus per-topic `references/*.md`. The
+  chooser answers the question the compiler cannot: which thing to pick, what
+  differs between the options, and what goes wrong silently. The families:
+
+  - `pikku-deploy` — eight runtime skills
+  - `pikku-service-backends` — six adapter skills, organised by the core interface
+    they implement rather than by vendor
+  - `pikku-wiring` — ten transport skills
+  - `pikku-auth` — five skills that all answered "who is this and may they",
+    fronted by the authentication-versus-authorization distinction
+  - `pikku-services` — services, config, audit and logging
+  - `pikku-agent` — the agent, its runner and the voice middlewares
+  - `pikku-react` and `pikku-i18n` — the client and localisation families
+  - `pikku-meta` — project metadata, contract versioning and the dependency audit
+  - `pikku-build` — the three build modes, feature work and post-clone cleanup
+  - `pikku-software-archaeology` and `pikku-fabric` — each gains its second phase
+
+  The doc-surface routing table (`LEAF_EDITORIAL`) points at the merged skills, and
+  the fabric install group is back to what it names: skills about Fabric.
+
+## 0.12.22
+
+### Patch Changes
+
+- 5ace170: Fix the `#pikku` import specifiers the skills teach.
+
+  Twenty-five examples across ten skills named a leaf that does not export the
+  symbol — `pikkuAuth`/`pikkuPermission`/`addGlobalPermission` from `#pikku/function`
+  (they are in `#pikku/auth`), `addHTTPMiddleware` from `#pikku/http` (`#pikku/middleware`),
+  `pikkuServices`/`pikkuWireServices` from `#pikku/function` (`#pikku/setup`),
+  `pikkuWorkflowFunc` from `#pikku/function` (`#pikku/workflow`), `pikkuScenario` and
+  friends from `#pikku/scenario` and from `#pikku/workflow/pikku-workflow-types.gen.js`
+  (`#pikku/scenarios`), and `defineSystemRole` from a bare `#pikku` (`#pikku/scopes`).
+
+  `pikku-addon` also claimed an addon authors against `#pikku/addon/function` and
+  `#pikku/addon/setup`. It does not: `pikku new addon` writes an `imports` map that
+  points `#pikku/*` at the addon's own `.pikku/addon/` tree, so an addon uses the
+  same subpaths an application does. The `addon` segment is the package's business,
+  never part of a specifier.
+
+  An agent following these wrote a file that took schema generation red —
+  `Package import specifier "#pikku" is not defined in package .../packages/functions/package.json`
+  — which is a failure the example, not the agent, was responsible for.
+
 ## 0.12.21
 
 ### Patch Changes