@pikku/skills 0.12.22 → 0.12.26

package/CHANGELOG.md

@@ -1,5 +1,139 @@
 # @pikku/skills
 
+## 0.12.26
+
+### Patch Changes
+
+- 206dc04: pikku-auth's Better Auth reference gains two-factor, security hardening and post-signup hooks
+- 206dc04: pikku-react's client reference now says what `transformDate: true` costs you: a fully-zoned ISO instant arrives as a `Date` while a bare or zoneless date stays a string, so one field's runtime type follows the value — a string method on a revived one throws, and a raw one in JSX crashes the route.
+- 206dc04: Add `pikku-a11y`, `pikku-seo`, `pikku-permissions`, `pikku-list-query` and
+  `pikku-realtime`, which lived in Fabric's sandbox image and are not about Fabric.
+
+  None of them needs a sandbox, a console or the `fabric` CLI, so a local project
+  gets the same guidance the hosted build agent has been getting. `pikku-realtime`
+  carries the SSE and channel patterns inline rather than pointing at a scaffold
+  command that only exists inside Fabric.
+
+- 206dc04: pikku-build's multi-app reference now says how to decide it is two apps, not just how to clone one
+- 206dc04: The corpus now fails on a bare `fabric` command, which the OSS reader has no binary for
+- 206dc04: Three review fixes across the wiring skills: pikku-list-query now caps `limit` and reads `filter` as the recursive AND/OR tree it is (a `'status' in filter` check silently returns unfiltered rows for a group or an operator leaf); pikku-realtime warns that `/events/:topic` is unauthenticated so a topic must carry a projection rather than `returningAll()`, and invalidates the `[name, input]` query key instead of hand-patching a `ListOutput`; pikku-workflow replaces "each step is its own transaction" — pikku opens none — with where atomicity actually comes from, plus provider idempotency keys for retried external side effects.
+- 206dc04: Give `pikku-architect`, `pikku-build`, `pikku-knowledge` and
+  `pikku-software-archaeology` an `installGroups`. A skill with none is skipped
+  whenever any group is requested, so `pikku skills install --core` never
+  installed these four — including the archaeology skill other tooling documents
+  as installed by that command.
+
+  Also qualify pikku-i18n's "do not wrap `m`" rule: wrapping the namespace is a
+  real tradeoff (it forgoes per-message tree-shaking) rather than a mistake, and
+  is worth it when it buys something the gate cannot, such as debug masking.
+
+- 206dc04: Give `pikku-workflow` the "should this even BE a workflow?" section: the
+  external-boundary test, the checkout-with/without-payment split, "one durable
+  step is a queue worker, not a workflow", and "atomicity is a TRANSACTION, not a
+  workflow". It answers the question that comes before choosing a factory, and it
+  was only written down in Fabric's copy of the skill.
+
+## 0.12.25
+
+### Patch Changes
+
+- 498662a: Measure a finished milestone against its plan, with `pikku knowledge plan progress`.
+
+  The reconciliation itself already existed — `planShortfall` reads pikku's generated meta under `.pikku/` and answers "was this planned function written, this route wired, this `pikkuScenario` exported" by set membership. Nothing in the CLI could run it, so the only thing closing a milestone was the build agent's own account of what it had done.
+
+  `pikku knowledge plan progress <milestone>` prints what the milestone still owes, separating what BLOCKS (the first pass) from what a later pass picks up, and exits non-zero while anything blocks. Its problems include the two checks no meta covers: a browser scenario that opens a page and asserts it is still on it, and an `on delete cascade` the plan promised that no migration declares.
+
+  Two skills follow it. The new `pikku-architect` writes the plan against the milestone note through `pikku knowledge plan set`, as a seat separate from the build — a builder who writes its own plan can build a fraction, plan only that fraction, and certify itself complete. `pikku-build` now plans each milestone before building it (§5a) and closes it on `plan progress` rather than on memory (§6a), with `pikku knowledge plan defer` as the only way an unbuilt item leaves the first pass.
+
+  Two things `plan set` needed before an architect could actually satisfy it: it now refuses a `covers` entry naming a note that does not exist, or carrying a hash that is not that note's current one — and names the correct hash, which is also the only way to obtain one. Unchecked, a placeholder hash was accepted and the note it claimed read as edited-since from the moment the milestone shipped, dropping silently back into a backlog nobody had planned. The plan's build rendering no longer names a runtime-specific command for creating a frontend, since two builds read it and each creates one a different way.
+
+- e0bf0ce: Add a `pikku-webhook` skill covering the outgoing webhook primitive — `WebhookService` / `QueueWebhookService`, the `pikku-outgoing-webhooks` queue worker, `scaffold.webhook`, `config.webhook` (signing secret, header, retries, SSRF allowlist), receiver-side verification, and `KyselyWebhookService`'s delivery/attempt history. The corpus previously mentioned it in one table row, so agents hand-rolled `fetch` + HMAC instead of using it.
+
+## 0.12.24
+
+### Patch Changes
+
+- 202cb72: Refuse a scenario step whose prose opens with its own actor (PKU681). The
+  reporter already renders the actor as the sentence's subject, so a step
+  authored as `'sam' creates the client` and run as `{ actor: actors.sam }`
+  reads "Given sam 'sam' creates the client" — and the hardcoded name desyncs
+  the moment the call site changes actor. Only the subject position is refused:
+  naming someone else mid-sentence, or an actor keyed after a role noun used as
+  a noun ("creates the admin client"), is left alone.
+
+## 0.12.23
+
+### Patch Changes
+
+- f4e2e89: Add file attachments to `EmailService`.
+
+  `BaseSendEmailInput` gains an optional `attachments: EmailAttachment[]`, so it is
+  available on all three input variants — text, HTML and template. The new
+  `EmailAttachment` type is exported from `@pikku/core/services` alongside the
+  input types, and is shaped so that mapping it onto Resend, SendGrid, Nodemailer
+  or SES v2 is a straight field rename rather than a translation.
+
+  `content` is `Uint8Array | string`, where a string is always read as base64.
+  Both forms are accepted because both are what callers already hold: bytes come
+  out of a fetch or a file read, and base64 comes out of a database column or a
+  provider API. `Buffer` is deliberately absent from the type — it is a subclass
+  of `Uint8Array`, so Node callers can still pass one, while the type stays usable
+  in Cloudflare Workers, where `Buffer` does not exist.
+
+  `LocalEmailService` now logs attachment metadata — filename, content type,
+  content id, disposition and content length — instead of dropping the field
+  silently. The content itself is deliberately not logged.
+
+  The template-rendering wrapper documented in the emails skill rebuilt its
+  delegate payload field by field and therefore dropped `attachments`; it now
+  forwards them.
+
+- 9022169: Cover `pikku persona run`, and give the corpus a CLI command inventory.
+
+  `pikku doc` computes the `#pikku/*` API surface and lists no CLI commands, so
+  for anything invoked as `pikku <cmd>` the skills corpus is the only place it
+  exists. Two things were missing from it.
+
+  `pikku-scenario` covered declaring personas but not running one. Its new
+  `references/persona-run.md` covers the virtual-user run: the seven dispositions
+  and what each one is for, the three credentials and which wins, the budget and
+  `--seed` replay, why production takes only `accountable` and why that rule is
+  checked at build time and again at sign-in, the role check that happens before
+  the first step, and `sync` / `list` / `secret`.
+
+  `pikku-concepts` gains a one-line-per-command inventory of the CLI, grouped by
+  what you are doing and pointing at the skill that teaches each one. A dash means
+  no skill covers it beyond that line, which is a reason to read `--help` rather
+  than assume the command does what its name suggests.
+
+- acca415: Consolidate the skills corpus from 63 skills to 21.
+
+  The corpus had grown one skill per package and one per transport, so an agent's
+  first decision was a routing problem — which of ten wiring skills, which of five
+  auth skills — before it could reach anything that helped. Most of what those
+  skills carried was signatures and option keys, which `pikku doc` computes from
+  the compiler and cannot go stale.
+
+  Each family collapses to one chooser skill plus per-topic `references/*.md`. The
+  chooser answers the question the compiler cannot: which thing to pick, what
+  differs between the options, and what goes wrong silently. The families:
+
+  - `pikku-deploy` — eight runtime skills
+  - `pikku-service-backends` — six adapter skills, organised by the core interface
+    they implement rather than by vendor
+  - `pikku-wiring` — ten transport skills
+  - `pikku-auth` — five skills that all answered "who is this and may they",
+    fronted by the authentication-versus-authorization distinction
+  - `pikku-services` — services, config, audit and logging
+  - `pikku-agent` — the agent, its runner and the voice middlewares
+  - `pikku-react` and `pikku-i18n` — the client and localisation families
+  - `pikku-meta` — project metadata, contract versioning and the dependency audit
+  - `pikku-build` — the three build modes, feature work and post-clone cleanup
+  - `pikku-software-archaeology` and `pikku-fabric` — each gains its second phase
+
+  The doc-surface routing table (`LEAF_EDITORIAL`) points at the merged skills, and
+  the fabric install group is back to what it names: skills about Fabric.
+
 ## 0.12.22
 
 ### Patch Changes