@pikku/skills 0.12.30 → 0.12.32

package/CHANGELOG.md

@@ -1,1368 +0,0 @@
-# @pikku/skills
-
-## 0.12.30
-
-### Patch Changes
-
-- 9c5aa96: dev/serve: always inject the local content service
-
-  `pikku dev` and `pikku serve` only built `LocalContent` when `pikku.config.json`
-  declared a `content` block, so a project without one type-checks, renders and
-  starts clean and then throws the first time anything uploads a file. Every field
-  already had a default, so the block was gating a service that needed no
-  configuration. It is now always constructed; the `content` block still overrides
-  the storage path, URL prefixes and size limit.
-
-  Also documents it in the `pikku-services` skill: these singletons arrive as
-  `existingServices` and are never named in `services.ts`, so their absence there
-  is not evidence they are off — which is what makes the `if (!content) throw`
-  guard the skill already forbids look justified.
-
-- 5e2a579: pikku-wiring: document how an MCP tool is actually reached
-
-  `references/mcp.md` ended with a standalone `PikkuMCPServer` bootstrap — a
-  `start.ts` that builds services, loads `mcp.gen.json` and calls `connectStdio()`.
-  Nothing in a `pikku dev` / `pikku serve` / deployed app does that: the runtime
-  mounts the MCP server itself at `/mcp` (`mcpPath` to move it) whenever
-  `mcp.gen.json` has at least one entry. An agent following the old section wrote a
-  server process nobody runs, and then could not tell the person who asked for the
-  tool where to point their assistant.
-
-  Replaces it with the reachable URL, the two things that read as breakage — the
-  mount is skipped while there is nothing to serve, and correct MCP wiring has no
-  `wires/mcp` directory and no `mcp` config block — and the instruction to hand over
-  the URL. Swaps the stdio-logger red flag for a `/mcp` 404 one.
-
-## 0.12.29
-
-### Patch Changes
-
-- 96b65ae: Document how an addon ships database tables: `pikku db export`, the artifact the
-  consumer resolves through the package name, and the silent failure when it is
-  neither exported nor packed.
-- c4ee98d: **pikku-build** gains `references/design.md`: the composition doctrine that no theme can supply. An app built to the letter of the skill still came out looking like nobody had decided anything — a form at the top of every list screen, sixty identical cards each carrying two filled buttons, an "urgent" group holding half the fridge, a scaffolded login page with a Google button the app had no credentials for, and the whole thing judged against a dev database full of `Ripe peaches d193e2aa` left behind by scenario runs. The new reference names the bar (six questions a screen has to answer), the composition rules that get it there, the screens agents forget — login, navigation, empty states — and the reset-and-restart that has to happen before any of it is judged. §8 now says out loud that half of it belongs at §6, because a design pass over eight finished milestones is a repaint.
-- f99547e: Two things an agent building a vision feature had to discover by reading source. **pikku-agent** now documents `attachments`: the `data`/`url` split, that a `url` is downloaded server-side (so a caller-supplied one is an SSRF surface the runner's host allowlist exists for), that the model id — not the provider prefix — decides whether an image is read at all, and that reading a picture into typed data is the tool-free case `output` was waiting for. **pikku-fabric** gains "Reaching a model": `pikku dev` builds the `agentRunner` from a matching `OPENAI_BASE_URL`/`OPENAI_API_KEY` or `LITELLM_PROXY_URL`/`LITELLM_API_KEY` pair and otherwise 503s every agent with `AIProviderNotConfiguredError`, and `pikku fabric llm key --env` is the one command that fills either pair in from the Fabric AI gateway.
-
-## 0.12.28
-
-### Patch Changes
-
-- 591593a: Document `pikku knowledge next` in the `pikku-knowledge` skill: what the six actions mean,
-  that `reason` is machine wording never to be repeated to a person, and that `ask-user`
-  carries a separate `question` whose empty `options` list means offer free text rather than
-  invent choices.
-- 591593a: Document the two frontmatter keys a driving loop writes, in `pikku-knowledge`.
-
-  `statusAt:` and `attempts:` are bookkeeping rather than content, and an agent
-  that rewrites a note has to know not to hand-edit them — clearing `attempts:`
-  hands back a budget that exists to stop a note nothing can satisfy being
-  rewritten forever.
-
-  Also corrects the status vocabulary: it is `designing` → `proposed` →
-  `dispatched` → `built`. The skill said `proposed` → `dispatched` → `built`,
-  "nothing else", while `validate` has always accepted `designing`.
-
-- f5a8ee4: Teach `pikku-kysely` to count round trips.
-
-  The skill documented the query builder API but said nothing about how many times
-  a function body crosses the wire, so generated functions routinely awaited four
-  or five queries in series — invisible locally, a stacked latency in a deployed
-  stage. Adds the four shapes that collapse: independent reads into `Promise.all`,
-  parent-then-children into the `jsonArrayFrom` helpers already documented below
-  it, read-then-write into one `returning()`/`onConflict` statement that also
-  closes the race, and a read that only feeds the next `where` into a subquery or
-  CTE. Plus the correction that a transaction adds round trips rather than
-  removing them.
-
-## 0.12.27
-
-### Patch Changes
-
-- 28f39f2: Add the `pikku-blueprint-to-fabric` and `pikku-admin-to-fabric` skills, which rebuild a legacy app (and its generated back-office admin) as a Fabric app from a `.knowledge/` Product Blueprint.
-
-  Both skills were written against an older corpus, so every cross-reference is repointed at the skill that owns the material today: `pikku-queue`/`pikku-cron`/`pikku-http` to `pikku-wiring`, `pikku-better-auth` to `pikku-auth`, `pikku-react-query` to `pikku-react`, `pikku-feature` to `pikku-build`. Four steps named skills that no longer exist at all and are rewritten rather than repointed — the post-clone cleanup, the AOP verification loop, versioning, and the Stage 9 parity check. The stale `wireVariable`/`wireSecret` names are corrected to `defineVariable`/`defineSecret`.
-
-  `scripts/inventory.mjs` now exits non-zero with the reason when the blueprint directory is missing, a required file is absent, a file is unparseable, or an expected array has the wrong shape. It previously swallowed all of those and printed a table of zeros, which reads as a small app rather than an unusable blueprint.
-
-## 0.12.26
-
-### Patch Changes
-
-- 206dc04: pikku-auth's Better Auth reference gains two-factor, security hardening and post-signup hooks
-- 206dc04: pikku-react's client reference now says what `transformDate: true` costs you: a fully-zoned ISO instant arrives as a `Date` while a bare or zoneless date stays a string, so one field's runtime type follows the value — a string method on a revived one throws, and a raw one in JSX crashes the route.
-- 206dc04: Add `pikku-a11y`, `pikku-seo`, `pikku-permissions`, `pikku-list-query` and
-  `pikku-realtime`, which lived in Fabric's sandbox image and are not about Fabric.
-
-  None of them needs a sandbox, a console or the `fabric` CLI, so a local project
-  gets the same guidance the hosted build agent has been getting. `pikku-realtime`
-  carries the SSE and channel patterns inline rather than pointing at a scaffold
-  command that only exists inside Fabric.
-
-- 206dc04: pikku-build's multi-app reference now says how to decide it is two apps, not just how to clone one
-- 206dc04: The corpus now fails on a bare `fabric` command, which the OSS reader has no binary for
-- 206dc04: Three review fixes across the wiring skills: pikku-list-query now caps `limit` and reads `filter` as the recursive AND/OR tree it is (a `'status' in filter` check silently returns unfiltered rows for a group or an operator leaf); pikku-realtime warns that `/events/:topic` is unauthenticated so a topic must carry a projection rather than `returningAll()`, and invalidates the `[name, input]` query key instead of hand-patching a `ListOutput`; pikku-workflow replaces "each step is its own transaction" — pikku opens none — with where atomicity actually comes from, plus provider idempotency keys for retried external side effects.
-- 206dc04: Give `pikku-architect`, `pikku-build`, `pikku-knowledge` and
-  `pikku-software-archaeology` an `installGroups`. A skill with none is skipped
-  whenever any group is requested, so `pikku skills install --core` never
-  installed these four — including the archaeology skill other tooling documents
-  as installed by that command.
-
-  Also qualify pikku-i18n's "do not wrap `m`" rule: wrapping the namespace is a
-  real tradeoff (it forgoes per-message tree-shaking) rather than a mistake, and
-  is worth it when it buys something the gate cannot, such as debug masking.
-
-- 206dc04: Give `pikku-workflow` the "should this even BE a workflow?" section: the
-  external-boundary test, the checkout-with/without-payment split, "one durable
-  step is a queue worker, not a workflow", and "atomicity is a TRANSACTION, not a
-  workflow". It answers the question that comes before choosing a factory, and it
-  was only written down in Fabric's copy of the skill.
-
-## 0.12.25
-
-### Patch Changes
-
-- 498662a: Measure a finished milestone against its plan, with `pikku knowledge plan progress`.
-
-  The reconciliation itself already existed — `planShortfall` reads pikku's generated meta under `.pikku/` and answers "was this planned function written, this route wired, this `pikkuScenario` exported" by set membership. Nothing in the CLI could run it, so the only thing closing a milestone was the build agent's own account of what it had done.
-
-  `pikku knowledge plan progress <milestone>` prints what the milestone still owes, separating what BLOCKS (the first pass) from what a later pass picks up, and exits non-zero while anything blocks. Its problems include the two checks no meta covers: a browser scenario that opens a page and asserts it is still on it, and an `on delete cascade` the plan promised that no migration declares.
-
-  Two skills follow it. The new `pikku-architect` writes the plan against the milestone note through `pikku knowledge plan set`, as a seat separate from the build — a builder who writes its own plan can build a fraction, plan only that fraction, and certify itself complete. `pikku-build` now plans each milestone before building it (§5a) and closes it on `plan progress` rather than on memory (§6a), with `pikku knowledge plan defer` as the only way an unbuilt item leaves the first pass.
-
-  Two things `plan set` needed before an architect could actually satisfy it: it now refuses a `covers` entry naming a note that does not exist, or carrying a hash that is not that note's current one — and names the correct hash, which is also the only way to obtain one. Unchecked, a placeholder hash was accepted and the note it claimed read as edited-since from the moment the milestone shipped, dropping silently back into a backlog nobody had planned. The plan's build rendering no longer names a runtime-specific command for creating a frontend, since two builds read it and each creates one a different way.
-
-- e0bf0ce: Add a `pikku-webhook` skill covering the outgoing webhook primitive — `WebhookService` / `QueueWebhookService`, the `pikku-outgoing-webhooks` queue worker, `scaffold.webhook`, `config.webhook` (signing secret, header, retries, SSRF allowlist), receiver-side verification, and `KyselyWebhookService`'s delivery/attempt history. The corpus previously mentioned it in one table row, so agents hand-rolled `fetch` + HMAC instead of using it.
-
-## 0.12.24
-
-### Patch Changes
-
-- 202cb72: Refuse a scenario step whose prose opens with its own actor (PKU681). The
-  reporter already renders the actor as the sentence's subject, so a step
-  authored as `'sam' creates the client` and run as `{ actor: actors.sam }`
-  reads "Given sam 'sam' creates the client" — and the hardcoded name desyncs
-  the moment the call site changes actor. Only the subject position is refused:
-  naming someone else mid-sentence, or an actor keyed after a role noun used as
-  a noun ("creates the admin client"), is left alone.
-
-## 0.12.23
-
-### Patch Changes
-
-- f4e2e89: Add file attachments to `EmailService`.
-
-  `BaseSendEmailInput` gains an optional `attachments: EmailAttachment[]`, so it is
-  available on all three input variants — text, HTML and template. The new
-  `EmailAttachment` type is exported from `@pikku/core/services` alongside the
-  input types, and is shaped so that mapping it onto Resend, SendGrid, Nodemailer
-  or SES v2 is a straight field rename rather than a translation.
-
-  `content` is `Uint8Array | string`, where a string is always read as base64.
-  Both forms are accepted because both are what callers already hold: bytes come
-  out of a fetch or a file read, and base64 comes out of a database column or a
-  provider API. `Buffer` is deliberately absent from the type — it is a subclass
-  of `Uint8Array`, so Node callers can still pass one, while the type stays usable
-  in Cloudflare Workers, where `Buffer` does not exist.
-
-  `LocalEmailService` now logs attachment metadata — filename, content type,
-  content id, disposition and content length — instead of dropping the field
-  silently. The content itself is deliberately not logged.
-
-  The template-rendering wrapper documented in the emails skill rebuilt its
-  delegate payload field by field and therefore dropped `attachments`; it now
-  forwards them.
-
-- 9022169: Cover `pikku persona run`, and give the corpus a CLI command inventory.
-
-  `pikku doc` computes the `#pikku/*` API surface and lists no CLI commands, so
-  for anything invoked as `pikku <cmd>` the skills corpus is the only place it
-  exists. Two things were missing from it.
-
-  `pikku-scenario` covered declaring personas but not running one. Its new
-  `references/persona-run.md` covers the virtual-user run: the seven dispositions
-  and what each one is for, the three credentials and which wins, the budget and
-  `--seed` replay, why production takes only `accountable` and why that rule is
-  checked at build time and again at sign-in, the role check that happens before
-  the first step, and `sync` / `list` / `secret`.
-
-  `pikku-concepts` gains a one-line-per-command inventory of the CLI, grouped by
-  what you are doing and pointing at the skill that teaches each one. A dash means
-  no skill covers it beyond that line, which is a reason to read `--help` rather
-  than assume the command does what its name suggests.
-
-- acca415: Consolidate the skills corpus from 63 skills to 21.
-
-  The corpus had grown one skill per package and one per transport, so an agent's
-  first decision was a routing problem — which of ten wiring skills, which of five
-  auth skills — before it could reach anything that helped. Most of what those
-  skills carried was signatures and option keys, which `pikku doc` computes from
-  the compiler and cannot go stale.
-
-  Each family collapses to one chooser skill plus per-topic `references/*.md`. The
-  chooser answers the question the compiler cannot: which thing to pick, what
-  differs between the options, and what goes wrong silently. The families:
-
-  - `pikku-deploy` — eight runtime skills
-  - `pikku-service-backends` — six adapter skills, organised by the core interface
-    they implement rather than by vendor
-  - `pikku-wiring` — ten transport skills
-  - `pikku-auth` — five skills that all answered "who is this and may they",
-    fronted by the authentication-versus-authorization distinction
-  - `pikku-services` — services, config, audit and logging
-  - `pikku-agent` — the agent, its runner and the voice middlewares
-  - `pikku-react` and `pikku-i18n` — the client and localisation families
-  - `pikku-meta` — project metadata, contract versioning and the dependency audit
-  - `pikku-build` — the three build modes, feature work and post-clone cleanup
-  - `pikku-software-archaeology` and `pikku-fabric` — each gains its second phase
-
-  The doc-surface routing table (`LEAF_EDITORIAL`) points at the merged skills, and
-  the fabric install group is back to what it names: skills about Fabric.
-
-## 0.12.22
-
-### Patch Changes
-
-- 5ace170: Fix the `#pikku` import specifiers the skills teach.
-
-  Twenty-five examples across ten skills named a leaf that does not export the
-  symbol — `pikkuAuth`/`pikkuPermission`/`addGlobalPermission` from `#pikku/function`
-  (they are in `#pikku/auth`), `addHTTPMiddleware` from `#pikku/http` (`#pikku/middleware`),
-  `pikkuServices`/`pikkuWireServices` from `#pikku/function` (`#pikku/setup`),
-  `pikkuWorkflowFunc` from `#pikku/function` (`#pikku/workflow`), `pikkuScenario` and
-  friends from `#pikku/scenario` and from `#pikku/workflow/pikku-workflow-types.gen.js`
-  (`#pikku/scenarios`), and `defineSystemRole` from a bare `#pikku` (`#pikku/scopes`).
-
-  `pikku-addon` also claimed an addon authors against `#pikku/addon/function` and
-  `#pikku/addon/setup`. It does not: `pikku new addon` writes an `imports` map that
-  points `#pikku/*` at the addon's own `.pikku/addon/` tree, so an addon uses the
-  same subpaths an application does. The `addon` segment is the package's business,
-  never part of a specifier.
-
-  An agent following these wrote a file that took schema generation red —
-  `Package import specifier "#pikku" is not defined in package .../packages/functions/package.json`
-  — which is a failure the example, not the agent, was responsible for.
-
-## 0.12.21
-
-### Patch Changes
-
-- 77ae071: `pikku fabric report` sends a finding — something about pikku that cost an agent time — to fabric. It needs a login but no linked project: a finding is about the framework rather than about anyone's project, and the reports worth having most come from checkouts that have nothing to name.
-
-  The finding can be given as JSON on stdin (`--stdin`) instead of as flags. Half the fields are prose, and prose carries apostrophes, quotes, backticks and newlines — every one a shell metacharacter before it is a character in a sentence — so an error message pasted into `--error` used to break the command at its first newline. The same schema validates either path.
-
-  Nothing is written to the repo, so nothing goes stale on an abandoned branch, and the terminal prints exactly what left the machine. Reporting never fails a build.
-
-  A finding that cannot be sent is held in `~/.fabric/findings` rather than dropped: logged out, unlinked, or fabric unreachable are the states a finding is most likely to be describing, and a scaffold that never got far enough to log in is exactly the thing worth hearing about. The queue drains on the next report that succeeds, keeps the project each finding was filed against, and is bounded at 100. `pikku fabric findings list`, `flush` and `clear` inspect and control it.
-
-  The resolved `@pikku/*` versions are read off the installed tree rather than out of `package.json`, since a range says nothing about what actually ran. A skewed tree and a package resolving through a workspace or link are both flagged, because either is a reason to read the finding differently.
-
-  The `pikku-feature` skill now tells an agent when to file one: work around it first, investigate only when there is no workaround, report at the depth already reached, and never patch pikku itself from inside a project that is using it.
-
-- 32d1280: Prefix the better-auth plugin factories with `pikku`: `pikkuActor`, `pikkuBan`,
-  `pikkuFabric`, `pikkuDelegatedAuth` and `pikkuCredentialOAuth`.
-
-  A `betterAuth({ plugins: [...] })` array mixes this package's plugins with
-  better-auth's own, and until now nothing at the call site told them apart —
-  `plugins: [actor(...), ban(), fabric(...), organization()]` reads as four
-  plugins from one place when only the last is better-auth's. The prefix says
-  which package a plugin came from where it is actually wired.
-
-  The old names are still exported as deprecated aliases bound to the same
-  functions, so no import has to change. Nothing about the plugins themselves
-  moved: the `id` each registers under — `pikku-ban`, `actor`, `fabric`,
-  `delegated-auth`, `credential-oauth` — is unchanged, so no deployed database or
-  session is affected.
-
-  The pieces that read a plugin's _export_ name rather than its id accept both:
-  `PLUGIN_REGISTRY` is keyed under the prefixed and the bare name, and the
-  `pikku validate` ban/actor checks and the `scaffold.userAdmin` ban check count
-  either spelling as wired. Their messages now point at the new names.
-
-## 0.12.20
-
-### Patch Changes
-
-- 7a15c9c: An actor credential is one persona's, not everyone's
-
-  `SCENARIO_ACTOR_SECRET` was a skeleton key. Anyone holding it could post any
-  `actor: true` address to `/auth/sign-in/actor` and get that persona's session —
-  including the `admin` persona, which provisioning grants real admin. The browser
-  switcher held it too, baked into the dev bundle as `VITE_SCENARIO_ACTOR_SECRET`,
-  so "the reviewer can sign in as each kind of user" and "the reviewer's bundle is
-  entitled to every persona" were the same fact.
-
-  It is now a root that credentials derive from, never one that is presented:
-
-  ```ts
-  deriveActorSecret(root, email) // HKDF-expanded HMAC-SHA256 over the address
-  ```
-
-  The endpoint re-derives the expected value for whichever address is signing in
-  and compares, so nothing is stored or looked up, a credential minted for one
-  persona is refused for every other, and rotating the root invalidates all of
-  them at once. The root itself is no longer a valid credential, and a root under
-  32 characters refuses the endpoint rather than deriving weak credentials from
-  it — the server log says why, the client is not told.
-
-  What that buys, in the places that used to need the whole key:
-
-  - **`pikku dev`** mints one credential per declared persona into
-    `VITE_DEV_ACTOR_SECRETS` and no longer writes `VITE_SCENARIO_ACTOR_SECRET` at
-    all. The root stays on the server.
-  - **`pikku persona secret <id>`** mints them for anything else, and a run given
-    `PIKKU_PERSONA_SECRETS=id=secret,…` can sign in as those personas and no
-    others — asking for one outside the list throws naming the persona instead of
-    falling back to the root.
-
-  `useDevActors()` and `<DevActorSwitcher />` take `secrets` (one per address)
-  where they took `secret`, and an actor with no credential is no longer offered
-  rather than rendering a row that 401s. `HttpPersonasConfig.secret` and the
-  Playwright provider's `secret` additionally accept a resolver, which is how a
-  partially-credentialled run is expressed.
-
-- ee9da9e: pikku-react now covers linking from a Mantine element: `component={Link}` widens the router generic to `AnyRouter` and stops checking `to` and `params`, so the skill teaches a wrapped typed `Link` reached through `renderRoot` instead.
-- 7d641f3: The three build skills now draw the line between the manual click-through (a smoke check, for layout) and verification: anything worth driving through the UI belongs in a scenario's browser step, not in a browser session steered by hand that nothing re-runs.
-- ee9da9e: The hardcoded-copy check stops flagging a feature's own name
-
-  Two rules disagreed. `runScenarioFileChecks` requires every `pikkuFeature` to
-  live in a `*.scenario.ts`, and moving one there is what put it in front of the
-  hardcoded-copy check — which then flagged the feature's own `name` because the
-  app catalogue happens to hold the same word:
-
-  ```
-  name: 'Downloads',   → ✗ "Downloads" → nav__downloads | downloads__title
-  ```
-
-  Complying with the first rule created violations of the second, and the advice
-  — read the string from the app catalogue — would tie the Console's language to
-  the product's. `name`, `description` and `template` declared directly on a
-  `pikkuFeature`, `pikkuScenario` or `pikkuScenarioStep` are Console meta and are
-  now skipped. A `name` nested deeper — `getByRole('button', { name: 'Speichern'
-})` — is a selector built out of UI copy and is still caught.
-
-## 0.12.19
-
-### Patch Changes
-
-- f1ccfe3: A step ladder reads as one paragraph, not a list of restatements
-
-  Every step prefixed its actor with `the `, named that actor again, and repeated
-  the phase keyword. A three-step run by one person said their name three times
-  and `Given` three times, only read as English when the persona key happened to
-  be a role noun, and never said who that person was — the fabric template's own
-  placeholder came out as `the nadia opens /app`.
-
-  ```
-  Given yasser (the founder) signs in
-  When  yasser opens the dashboard
-  And   sees the audit log
-  And   nadia reviews the invite
-  ```
-
-  The article is gone: the actor key is the subject verbatim, so a persona named
-  after a person reads as that person. A repeated phase reads as `And`, the way
-  Gherkin has always written it. A step that continues both the phase and the
-  actor drops the repeated subject, because English drops a repeated subject in a
-  compound predicate — it takes both, since eliding across a phase change gives
-  `When opens the dashboard`, and a pronoun rather than a name would give `they
-sees`, step templates being authored in the third person singular.
-
-  An actor is introduced once, by the persona's `jobTitle` — prose someone wrote
-  for a reader. `roles` is authorisation, so a persona whose only description is a
-  `reviewer` grant gets no introduction rather than one assembled out of grants.
-  A row carries `sentenceWithRole` alongside `sentence`, set only where an actor
-  is first named, so a renderer can offer the introduction as a toggle without
-  parsing a composed sentence back apart.
-
-  `{placeholder}` filling, the `#ordinal` lookup for repeated step names and an
-  actorless step reading as its description alone are all unchanged.
-
-## 0.12.18
-
-### Patch Changes
-
-- 7d8082a: Add `pikku fabric variables set` and `pikku fabric variables get`
-
-  `secrets` was the only stage-scoped store the CLI exposed, so a value declared
-  with `defineVariable` could be set locally through `.env` and not at all on a
-  deployed stage — `variables.get('NAME')` compiled, ran, and answered `undefined`
-  forever, with nothing saying why. The fabric API already had
-  `setStageConsoleVariable` and `getStageConsoleVariable`; only the CLI surface was
-  missing.
-
-  `set` stores the value the way `LocalVariablesService` reads one: `JSON.parse`,
-  falling back to the raw string. `--value true` is therefore the boolean on a
-  stage exactly as it is from `.env`, and `--value '"true"'` is the string. `get`
-  prints the stored value as JSON so the two are distinguishable, which is usually
-  why you are looking.
-
-  Variables are not sealed and are readable back — that is the difference from
-  `secrets`, and anything that would hurt to print belongs in `secrets set`.
-
-## 0.12.17
-
-### Patch Changes
-
-- a3deea4: Document machine authentication as middleware that sets a session. A caller with an identity (a sandbox, a deployed container, a machine host) is resolved once in `addHTTPMiddleware('*')`, which calls `setSession`; the function is then a plain `pikkuFunc` gated with `scopes` and reads `session`, rather than verifying the bearer token in its own body or in a `permissions` check that returns `true`.
-
-  The middleware skill also spells out why this cannot be `addTagMiddleware`: tag middleware runs inside `runPikkuFunc`, which the RPC dispatch calls without a `sessionService`, so a session set there never reaches a function invoked over `POST /rpc/:rpcName`.
-
-- 30e390b: Skills now name the three languages a project has, and refuse to let them
-  collapse into one.
-
-  An agent building a doctor's portal for a German practice read "the entire UI is
-  German" as an instruction about the codebase. It shipped
-  `project.inlang/settings.json` with `baseLocale: "de"` and no `en.json` — which
-  broke `--add-locale` permanently — alongside RPC functions `getUebersicht` and
-  `getPatientendetail`, components `Zeitstrahl` and `AufmerksamkeitStreifen`, and
-  database tables `vorgang` and `ereignis`. Nothing in the skills had ever told it
-  these were three separate decisions, so it made one.
-
-  `pikku-concepts` now carries the canonical statement — identifiers are always
-  English and no setting changes that; meta (`description`, `title`, `template`)
-  follows `locale` in `pikku.config.json`; the product's UI language lives in the
-  message catalogue with `defaultLocale`, never in `baseLocale`. `pikku-build-app`
-  §1a asks the question and writes the answer into the config; `pikku-scenario`
-  splits step identifiers from step prose and admits where the English-only
-  reporter frame still shows through; `pikku-i18n` states why `baseLocale` stays
-  `en` and what to set instead. `pikku-build-quick`, `pikku-build-platform`,
-  `pikku-feature` and `pikku-fabric` carry the short form.
-
-## 0.12.16
-
-### Patch Changes
-
-- 0b1bf53: `pikku dev` turns actor quick login on and mints its secret; `pikku serve` never
-  does
-
-  Which command is running is the thing that knows whether "sign in as <persona>"
-  should work, so the two server commands now say so rather than leaving it to
-  whatever the environment happens to contain.
-
-  `pikku dev` sets `PIKKU_DEV_ACTOR_SIGN_IN` before it loads the project and, if no
-  actor secret is set, mints a cryptographically random one for the run under both
-  `SCENARIO_ACTOR_SECRET` and the `VITE_`-prefixed copy the dev frontend can
-  actually read — only prefixed variables reach `import.meta.env`, and the switcher
-  runs in the browser. Requiring every contributor to hand-manage a secret for a
-  server that is trusted with the database anyway bought nothing and cost setup
-  friction on every machine. An explicitly-set secret always wins: a project
-  pointing its scenario runs and its dev server at one value has to keep that
-  value. The minted one lives only in this process's environment, so it is gone
-  when the server stops and yesterday's cannot sign anything in today. Both cases
-  are logged, naming where the secret came from — the previous silence is what made
-  a missing control unanswerable from outside the container. Where the two names
-  disagree the command says so instead of picking one quietly, because that
-  disagreement presents as "the switcher signs in nowhere".
-
-  `pikku serve` is the production server command and does the opposite: it clears
-  the marker outright, so an inherited environment cannot switch passwordless
-  sign-in on behind the operator, and it warns when it had something to clear. What
-  it deliberately leaves alone is `PIKKU_ALLOW_ACTOR_SIGN_IN` — scenario suites have
-  to be able to run against a deployed stage, and that opt-in is the supported way
-  to say so.
-
-  `pikku validate`'s fix hint for a project with personas but no actor sign-in no
-  longer tells people to control the endpoint by withholding the secret, which is
-  no longer how it is controlled, and the `pikku-better-auth` skill documents the
-  gate, the two escape hatches, and the two distinct refusals.
-
-- 8519a73: Say plainly that the dev seed is local only. No deploy applies it, so the test for a row is not whether it looks realistic but whether the app would be broken without it in production — a venue, a catalogue, a tenant is configuration and belongs in a migration. Names the failure it causes: a stage whose pages return 200 while its first data read throws.
-
-## 0.12.15
-
-### Patch Changes
-
-- 56d6fde: Tag the skills Fabric sandboxes rely on with `installGroups: [fabric]`, so `pikku skills install --fabric` pulls them
-- 56d6fde: `pikku-info` becomes `pikku-meta`, and now owns the whole metadata surface rather
-  than the four `pikku info` tables.
-
-  Fifty-one skills already open with "Discover before editing. Run the relevant
-  `pikku meta ... --json`", and no skill documented that command — the one that did
-  exist covered a different, smaller command and was named after it. It also carried
-  no `installGroups`, so `pikku skills install --core` never installed it and agents
-  never saw it at all.
-
-  It now covers reading (`context`, `functions`, `schemas`, `workflows`, `wires`,
-  `permissions`, `middleware`, `clients`), changing (`pikku meta apply` — the batch
-  contract, which properties each kind accepts, and why one `pikku all` at the end
-  beats one per property), and keeps the `pikku info` tables as the human-readable
-  view. `installGroups: [core]` means it ships.
-
-## 0.12.14
-
-### Patch Changes
-
-- 4058c3a: A default skills install is now the seventeen that teach a `#pikku/*` door, not everything
-- 4058c3a: `pikku doc --ai` now names the skill that teaches each door, and pikku-concepts sends you there first
-- 4058c3a: Gate the door-to-skill table so it cannot name a skill a default install does not get
-- 9d48e8a: Fail `pikku fabric validate` when a scenario step hardcodes a string the message catalogue already owns.
-
-  A browser step that says `getByLabel('Full Name')` passes only while the app happens to render the base locale, and any copy edit turns it into a selector timeout that points at the wizard rather than at the rename that caused it. Validate now reads each `apps/<app>/messages/<baseLocale>.json` and errors on any string in a `*.steps.ts` / `*.scenario.ts` that is verbatim a catalogue value, naming the key to use.
-
-  It scans every literal rather than only the ones sitting in a `getBy*` call, because copy passed to a project helper — `pick('Where would you like to work?', …)` — reaches the DOM just the same. Comments are stripped first, since the prose around a step quotes the copy it is explaining. A project with no inlang app is not scanned, and a string the catalogue does not own (a test id, a fixture filename) is left alone.
-
-  The `pikku-scenario` skill gains the corresponding rule, including typing the lookup off the catalogue JSON rather than the generated Paraglide output, so a renamed key is a compile error instead of a run-time timeout.
-
-- 4058c3a: Add a `client` install group, so frontend-facing skills can be pulled without the whole `core` set: `pikku skills install --client`. `installGroups` has always been a list and the resolver installs a skill if _any_ requested group matches, so `[core, client]` keeps every existing `--core` install identical.
-
-  Tagged `[core, client]`: `pikku-react`, `pikku-react-query`, `pikku-workflows-client`, `pikku-paraglide`, `pikku-i18n`, `pikku-rtl`.
-
-- 4058c3a: Correct the `fabric` install group, which had drifted into a catch-all. It now holds only the two skills a Fabric sandbox agent actually needs: `pikku-fabric` and `pikku-ai-voice` (Fabric apps use voice I/O, and it was reaching nobody).
-
-  Moved to `core`, because they describe general Pikku work rather than anything Fabric-specific: `pikku-software-archaeology`, `pikku-product-second-opinion`, `pikku-schema-cfworker` (the Fabric template's Workers entry files are generated, so no agent ever writes `CFWorkerSchemaService`), `pikku-deploy-cloudflare` and `pikku-fabric-debug` (Fabric deploys and reads logs through CI, not through the app agent).
-
-  Deleted `pikku-tag-middleware`, a tombstone pointing at `pikku-middleware`. It carried no `installGroups`, so it never installed anywhere and only cost a name in the corpus.
-
-  Dropped `pikku-build-app`, `pikku-build-quick` and `pikku-build-platform` out of `core`. They are whole-app build procedures that duplicate whatever the host agent's own prompt already says, so auto-installing them into every project put three rival build modes in the picker. They still ship in the package and install with `--only`.
-
-- 4058c3a: Drop seven single-door skills out of the core install group
-
-  `--core` installed a reference skill for every transport whether or not a
-  project used one. The seven moved here (`pikku-services`, `pikku-queue`,
-  `pikku-cli`, `pikku-trigger`, `pikku-schedule`, `pikku-schema-ajv`,
-  `pikku-schema-cfworker`) join the deploy and adapter skills as `--only`
-  installs, so a project that wires a queue asks for the queue skill.
-
-  Measured against 24 fabric build runs, none of the seven was loaded once,
-  while their descriptions sat in the picker on every turn.
-
-## 0.12.13
-
-### Patch Changes
-
-- 58cb0f8: Scaffold an addon whose exports point at the leaf its codegen actually writes
-
-  `pikku all` roots an addon's generated tree at `.pikku/addon/`, but `pikku new
-addon` still wrote the pre-split targets: `./.pikku/*` resolved to
-  `./dist/.pikku/*` and the internal RPC map to `./dist/.pikku/rpc/...`, neither of
-  which exists in the published package. The subpaths a consumer writes are
-  unchanged — only the targets gain the `addon` segment.
-
-  The addon manifest reference in the `pikku-addon` skill described the same
-  package.json one migration further back, with `imports` and `exports` naming the
-  source tree and `files: ["dist", ".pikku"]` shipping `.ts` files Node cannot
-  load. It now documents the built layout, and why `imports` and tsconfig `paths`
-  deliberately point at different trees.
-
-  The plain scaffold — no `--secret`, `--oauth` or `--credential` — built its API
-  service with `new XService(variables)` against a class declaring no constructor,
-  so `pikku new addon <name>` produced a package that did not typecheck until the
-  author deleted the argument. Only the authenticating variants take one.
-
-## 0.12.12
-
-### Patch Changes
-
-- 8d6a6bc: fix(cli): a scaffold flag says a surface exists, not who may call it
-
-  `scaffold.<feature>` accepted an `auth` field, and the generated wrapper emitted
-  it onto the wired function. That put authentication in two places at once: the
-  target function already declares whether it needs a session, its wiring, its
-  scopes and its addon gate already refine it, and `runPikkuFunc` already enforces
-  all of that on every call. The scaffold flag only stacked a coarser gate in
-  front of the one that actually decides, and — being a config field — it could
-  disagree with the function it was gating.
-
-  `PikkuScaffoldFeature` is now `boolean | { path?: string }`. It answers two
-  things and no more: whether the surface is generated, and where the file is
-  written. A feature that was `{ "auth": false }` becomes plain `true`, and
-  `pikku enable` loses its `--noAuth` flag along with the dimension it set.
-
-  The six generators that took the flag no longer take one. The four that generate
-  a dispatcher — public RPC, public agent, workflow routes and the events channel
-  — now emit a fixed `auth: false`. That is the wrapper declining to gate, not the
-  scaffold declaring the surface public: `rpcCaller` forwards to whichever
-  function the caller named, and that function's own `auth`, permissions, scopes
-  and addon gate are what decide. Emitting nothing would not be neutral, since a
-  wiring without `auth` requires a session and would reject the call before the
-  gate that decides ever ran. The two that generate scoped admin functions — user
-  admin and virtual users — emit no `auth`, because they are `pikkuFunc` with
-  their own `scopes`: session-required by construction, and the deciding function
-  rather than a wrapper in front of one.
-
-  The legacy `'auth'` / `'no-auth'` string values are gone with it. A bare string
-  is still refused rather than read as a `path`: under `boolean | object` no
-  string is valid, so guessing one would turn a typo into a generated file nobody
-  asked for.
-
-- 31ad85f: fix(emails): escape substituted values in the generated email renderer
-
-  `renderEmailTemplate` spliced values into HTML unescaped and looped substitution
-  until it reached a fixed point, so a value containing `"` broke out of the
-  attribute it landed in, a value containing markup was injected verbatim, and a
-  value containing `{{...}}` was re-expanded as a template on the next pass. An
-  ordinary CSS font stack from `theme.json` was enough to corrupt the document.
-
-  Rendering is now layered by trust. Partials are inlined first; `theme.*` and
-  `t.*` are expanded next as template-author input; caller `data` is substituted in
-  a single pass that is never rescanned. Values are HTML-escaped in `.html` output
-  and left raw in `.subject.txt` / `.text.txt`. `{{content}}` and partials stay
-  raw, and `{{{value}}}` is a new opt-in raw form. The console's email preview uses
-  the same renderer, so previews match what is sent.
-
-## 0.12.11
-
-### Patch Changes
-
-- 7722ceb: Split the addon leaf so an application cannot shadow a linked addon's own
-
-  An addon authored its services through `#pikku/addon`, and so did an
-  application installing one. Node keeps those apart — `#pikku/*` is a
-  package-private subpath import, resolved against the addon's own
-  `package.json` — but tsconfig `paths` are global to a tsx process, and every
-  runtime template maps `#pikku/*` onto a sibling package. A linked addon's
-  `#pikku/addon` was resolved against the _application's_ leaf, which holds the
-  install half and none of the authoring exports, and every template failed to
-  boot with `does not provide an export named 'pikkuAddonServices'`.
-
-  The authoring half now sits at `#pikku/addon/setup`. An application generates a
-  flat `.pikku/<leaf>`, so there is nothing there for that specifier to match and
-  the resolver falls back to Node, which reads the addon's own imports. Addons
-  declaring themselves import `pikkuAddonConfig`, `pikkuAddonServices` and
-  `pikkuAddonWireServices` from `#pikku/addon/setup`; `wireAddon` and
-  `wireRemoteAddon` stay at `#pikku/addon`.
-
-  `wireAddon` and `wireRemoteAddon` also move off `@pikku/core/rpc` onto
-  `@pikku/core/addon`. Being reached over rpc is how an addon is called rather
-  than what it is, and it put the whole addon surface behind the rpc subpath for
-  consumers that only wanted to install one.
-
-- 6eef0a0: Bump every dependency to its latest compatible minor/patch across the monorepo.
-- 3b1164a: feat(react,mantine): ship the dev actor switcher instead of making every app copy it
-
-  The dev-only "Sign in as …" control — one click signs in as a declared scenario
-  persona, no password — was hand-copied into every app that needed it, because
-  `pikku fabric validate` requires any frontend with a login screen to have one.
-  The `devActors()` / `signInAsActor()` pair was byte-identical everywhere it
-  landed, including the `import.meta.env.DEV` gate that keeps the shared secret out
-  of production bundles. That is not a thing each app should be re-deriving from a
-  copy-paste.
-
-  Split along the dependency line:
-
-  - `@pikku/react` gains `useDevActors()`, `signInAsActor()` and `parseDevActors()`.
-    UI-free, so it stays inside the package's react-only dependency budget.
-  - `@pikku/mantine/dev` gains `<DevActorSwitcher />`, built on that hook. It is a
-    new entry point rather than part of `/core`, because `/core`'s contract is
-    "drop-in alias for `@mantine/core`" and exporting a component Mantine has no
-    counterpart for would break it.
-
-  The component takes `onSignedIn` rather than depending on a router, and the
-  actors/secret are passed in rather than read from env — how env is spelled is a
-  bundler fact (`import.meta.env.VITE_*` vs `process.env.NEXT_PUBLIC_*`), and a
-  package that guesses gets it wrong for half its consumers.
-
-  The skills document it in the four places an agent would look: `pikku-better-auth`
-  for the `actor` plugin's endpoint (which had only `/dev/quick-login` before, and
-  so sent agents to the wrong control), `pikku-scenario` for the actor list being
-  the same one a human signs in through, `pikku-react` for the hook, and
-  `pikku-fabric` for the validate rule that requires it.
-
-  `fabric validate` now also accepts a `useDevActors()` call site as evidence the
-  control is wired, so apps that want their own UI on the shared logic pass. The
-  hand-rolled shape still passes too — nothing existing breaks. Its fix text no
-  longer tells you to hand-write the helper, which would have become wrong advice
-  the day this shipped.
-
-- 266e3bc: `#pikku` is a namespace, not a module: one subpath per wiring
-
-  The bare `#pikku` specifier resolved to `.pikku/pikku-types.gen.ts`, a hub that
-  re-exported all twelve wiring leaves with `export *` — undoing the split the
-  leaves exist for, each of which still says so in its own generated header
-  ("HTTP-specific type definitions for tree-shaking optimization"). Reaching that
-  hub put 33 distinct `@pikku/core` subpaths into the module graph, and neither
-  consumer could drop them again: bundlers keep `export *` chains because the app
-  declares no `sideEffects`, and Node and tsx do not tree-shake at all, so an app
-  with no queues still executed `@pikku/core/queue` at boot.
-
-  The hub is gone. An app now imports the leaf the name belongs to —
-  `#pikku/function`, `#pikku/http`, `#pikku/workflow` — and a project's `imports`
-  map declares two patterns, because both resolvers pick the more specific one:
-
-  ```json
-  "#pikku/*.js": "./.pikku/*.ts",
-  "#pikku/*": "./.pikku/*/index.ts"
-  ```
-
-  A source tree names the `.ts` on both. Webpack, esbuild and Bun all rewrite a
-  `.js` specifier to the `.ts` beside it for a relative import but not for an
-  imports-map target, so a `.js` target there resolves to a file that does not
-  exist. The two places that keep `.js` are the ones where it is the real file: a
-  published addon, whose map points into `dist`, and a project that imports a
-  declaration-only generated file such as `pikku-rpc-wirings-map.gen.d.ts`, where
-  naming the `.js` lets the type resolver's own mapping reach the `.d.ts`.
-
-  `pikku` generates the leaf indexes and removes the hub, and `pikku validate`
-  reports a barrel import as an error. The split also turns the addon boundary
-  from advice into a rule: an addon never generates the wiring leaves, so
-  `#pikku/http` fails at the specifier rather than yielding "no exported member"
-  from a hub that quietly dropped the re-export.
-
-- 9fce0f1: Give a persona step its actor instead of making it unwrap one
-
-  `requireActor(scenarioStep)` was the first line of every step that acts as
-  somebody, and it existed because the actor lived on the `scenarioStep` wire as
-  an optional property. A property of a wire member is either optional for every
-  binding or required for all of them, so the only expressible answer was
-  "optional", and each step paid for it with a guard.
-
-  The actor is now its own wire member, `wire.actor`, injected by the runner. Wire
-  members can be required per binding, so a step declares whether it runs as
-  somebody and the type follows:
-
-  ```typescript
-  export const buysAnApple = pikkuScenarioStep<
-    { qty: number },
-    { orderId: string }
-  >({
-    name: 'buysAnApple',
-    actor: true,
-    default: async (_services, { qty }, { actor }) =>
-      actor.invoke('placeOrder', { qty }),
-  })
-  ```
-
-  A `browser` binding implies it — a window is opened as somebody, so every
-  binding of a step that has one gets the actor too. A step that declares neither
-  has no `actor` on its wire at all, rather than an optional one: a pure assertion
-  over what an earlier step returned has nobody to be, and `attemptsSignIn`
-  deliberately posts credentials instead of reusing an actor's established
-  session. That distinction is why the requirement is declared per step rather
-  than inferred from the step being a persona step — "persona step ⇒ has an actor"
-  is false, and a guard built on it rejects the 61 steps in the e2e suite that
-  correctly run without one.
-
-  Dispatching a step that declared an actor without `{ actor: actors.x }` now
-  fails before the body runs, with `ScenarioActorRequired` naming the step.
-  `ScenarioBrowserActorRequired` is replaced by it, and `requireActor` is gone
-  from `@pikku/core/scenario` and the generated `#pikku/scenario` barrel.
-
-- 9fce0f1: Say what a scenario step is actually given, and stop the skill teaching an RPC call that throws
-
-  The `pikku-scenario` skill's two `default` witnesses destructured `rpc` from
-  services and called `rpc.invoke`. That is exactly what the scenario runner
-  refuses: steps run in the CLI process, and `guardRpc` answers every member with
-  _"Scenario tried to run 'getOrder' as an internal step. Every workflow.do in a
-  scenario must carry { actor: actors.x }"_. Both examples now go through
-  `actor.invoke` off the step's wire, which is the path the surrounding prose
-  already described.
-
-  Adds a **What a step is given** section, because nothing said it. The services
-  object is built by hand in `scenario.ts` and holds `logger`, `workflowService`,
-  `workflowRunService` and — only when the project declares agents — `agentRunner`.
-  There is no `kysely`, no `variables`, no `secrets` and none of the project's own
-  services, so a step that destructures one gets `undefined` and fails on first
-  use, which reads like a broken container and is not. The section names the three
-  ways in (`invoke`, `invokeRaw`, a plain `fetch` at `env.apiUrl`), the two
-  consequences that shape how steps get written, and the condition on
-  `agentRunner` — `createDevAgentRunner` needs a base URL _and_ a key together, so
-  a project with only `OPENAI_API_KEY` set gets `undefined` and every conversing
-  scenario fails before the persona says anything.
-
-  Adds **Declaring personas in TypeScript**, covering the one-call rule and the
-  trap underneath it: `definePersonas` is read from source and never evaluated, so
-  every value must be statically knowable — but only `name` is validated. A
-  computed `personality` is dropped in silence and the persona runs with a blank
-  temperament. `stringProperty` accepts `ts.isStringLiteralLike`, so a
-  no-substitution template literal is read and is the way to write a long
-  personality across several lines; a `+` concatenation is not. Also records that
-  `actorInstructions` builds the conversing persona's prompt from `name`,
-  `jobTitle`, `personality` and the scenario's `task` only — `disposition`,
-  `goals` and `roles` are stored and shown but never reach it.
-
-  Finally, the three `import ... from '#pikku/workflow/pikku-workflow-types.gen.js'`
-  lines now point at `#pikku/scenarios/pikku-scenario-types.gen.js`, which is where
-  the scenario surface moved when the barrel was split.
-
-  Also corrects three import specifiers the skill still taught from before the
-  `#pikku` leaves landed: `#pikku/scenarios/pikku-scenario-types.gen.js` and
-  `@pikku/core/workflow` both become `#pikku/scenario`, which is the one door the
-  leaf exists to be and the specifier every step file in the e2e suite already
-  uses.
-
-- 727671b: `wireAddon` and `wireRemoteAddon` move from `#pikku/function` to `#pikku/addon`.
-
-  Installing an addon and authoring one are the same concept from opposite ends,
-  so they are one import: an application's `#pikku/addon` carries the two install
-  functions, an addon package's carries `pikkuAddonConfig`, `pikkuAddonServices`,
-  `pikkuAddonWireServices` and `AddonBaseServices`.
-
-  Two generation fixes came with it:
-
-  - `CredentialsMap` is generated as a type alias rather than an interface. An
-    interface has no implicit index signature, so it was never assignable to the
-    `Record<string, unknown>` that `GetCredential` is constrained by, and every
-    generated project reported two errors on its own function types.
-  - An unresolved `SingletonServices` type is now `PKU724` instead of a services
-    map with no entries in it. Written out, the empty map made every service
-    optional and the real failure resurfaced as unrelated "possibly undefined"
-    errors in files nobody had touched.
-
-## 0.12.10
-
-### Patch Changes
-
-- 7406bfe: Rename the agent runtime from `AI*` to `Agent*` (#596)
-
-  `AI` described the model provider, not the thing being named. Every symbol that
-  belongs to the agent runtime now says `Agent`; the symbols that genuinely wrap a
-  model provider — `AIEmbeddingService`, `AIProviderOptions`, `AIEmbedParams`,
-  `AITranscriptionParams`, `AIGenerateImageParams` and their siblings, and the
-  `@pikku/ai-vercel` / `@pikku/ai-deepinfra` / `@pikku/ai-voice` packages — keep
-  their names.
-
-  **Wiring**
-  - `pikkuAIAgent` → `pikkuAgent`, `pikkuAIScorer` → `pikkuAgentScorer`,
-    `pikkuAIJudge` → `pikkuAgentJudge`
-  - `CoreAIAgent` → `CoreAgent`, `AIAgentInput` → `AgentInput`, `AIAgentStep` →
-    `AgentStep`, `AIMessage` → `AgentMessage`, and the rest of the agent types
-  - `AIAgentRunnerService` → `AgentRunnerService`, `AIStorageService` →
-    `AgentStorageService`, `AIRunStateService` → `AgentRunStateService`
-
-  **Entry points**
-
-  `@pikku/core/agent` → `@pikku/core/agent`, `@pikku/core/agent-scorer` →
-  `@pikku/core/agent-scorer`.
-
-  **Queues**
-
-  The scorer queues are now `agent-score-fast` and `agent-score-slow`. Drain the
-  old `ai-score-fast` / `ai-score-slow` queues before deploying — jobs still
-  sitting on them when the new workers start will never be picked up.
-
-  **Scaffolds**
-
-  The agent scaffold pikku wrote for your project — `<scaffold>/agent/agent.gen.ts`
-  and its schemas file — imports `@pikku/core/ai-agent`, which no longer exists. A
-  scaffold is normally written once and then left alone, so `pikku all` would find
-  it present and leave the broken import in place. It now deletes an agent scaffold
-  importing either removed entry point and regenerates it in the same run. Anything
-  you added to that file goes with it, so move local edits out first.
-
-  **Database**
-
-  The agent tables are renamed: `ai_threads`, `ai_message`, `ai_tool_call`,
-  `ai_working_memory`, `ai_run` and `ai_run_score` become `agent_threads`,
-  `agent_message`, `agent_tool_call`, `agent_working_memory`, `agent_run` and
-  `agent_run_score`, along with their indexes and the `ai_working_memory_pk`
-  constraint. The same rename applies to the MongoDB collections.
-
-  `ensurePikkuSchema` creates tables it cannot find, so an existing database will
-  get empty `agent_*` tables and leave the old data stranded in `ai_*`. Rename
-  them before the first boot on the new version:
-
-  ```sql
-  ALTER TABLE ai_threads        RENAME TO agent_threads;
-  ALTER TABLE ai_message        RENAME TO agent_message;
-  ALTER TABLE ai_tool_call      RENAME TO agent_tool_call;
-  ALTER TABLE ai_working_memory RENAME TO agent_working_memory;
-  ALTER TABLE ai_run            RENAME TO agent_run;
-  ALTER TABLE ai_run_score      RENAME TO agent_run_score;
-  ```
-
-- e7e5319: Add `pikku semver`, which derives a release's semver from a diff against a deployed surface and writes `.pikku/changes.gen.json`
-
-  A function or client-facing wiring that disappeared is major, an addition is minor, and a surface that did not move is patch. Where the generated JSON Schemas are available the verdict goes below the id level: a removed field or a newly required input field is breaking, an added optional one is not — direction-aware, so an output field going optional counts even though the same change on an input does not. `versions.pikku.json` is consumed, so a `@v2` bump does not read as a removal while v1 is still published.
-
-  The baseline is `--against <path|url>`: another `.pikku` directory, a snapshot file, or a snapshot published by `pikku semver --emit`. `--fail-on <level>` turns the verdict into a CI gate.
-
-- 411f89a: Add `pikku update`: report which `@pikku/*` dependencies can move forward, and which peers those versions need.
-
-  Reporting only by default. `--update` writes the new ranges into every covered package.json — the project root plus every workspace it declares — and then runs an install with the package manager the project names (`--no-install` to skip). `--update-peers` additionally writes the ranges unsatisfied peers require; it is separate because a peer bump can cross a major of a third-party package.
-
-  Peers are read off the version the run lands on rather than the one installed, so an update that needs a companion bump says so before it is applied. Ranges that cannot be substituted into (`workspace:*`, `file:`, unions, x-ranges) are reported and left alone, and a package the registry could not answer for is reported as unresolved rather than current.
-
-## 0.12.9
-
-### Patch Changes
-
-- b5fa1e5: Enumerate addon secret and credential grants in the deployment manifest.
-
-  `wireAddon`'s `secretGrants` / `credentialGrants` widen an addon's scope the same
-  way `globalSecrets` does, only narrower — but the manifest reported the exemption
-  and not the grant, so a deployment could not see the secrets an app had lent an
-  addon. `grantedSecretAddons` and `grantedCredentialAddons` now list them by name,
-  including override keys, since scoping is checked before an override renames.
-
-  The `pikku-addon` skill documents the whole grant family and the scoping rule
-  behind it, rather than the override fields alone.
-
-## 0.12.8
-
-### Patch Changes
-
-- 0ab1a88: feat(knowledge): draw a note's scenario and its decision, and say the vocabulary exists
-
-  The console already drew ```mermaid fences as diagrams and `> [!NOTE]` blocks as
-  callouts, and nothing told the librarian either existed — the skill that governs
-  what goes in a note never mentioned them, so notes were written as prose and
-  tables into a renderer that would happily have drawn the graph. The gap was the
-  guidance, not the format.
-
-  Two blocks join them. A slice's ```gherkin scenario is drawn rather than
-  highlighted: the keywords line up in a column so the shape of the scenario is
-  readable before a word of it is, and each quoted persona becomes a chip — which
-  also makes a first-person scenario, the form the format rejects, visibly a block
-  with no personas in it.
-
-  A new ```decision fence states what a decision note owes: `chosen`, `rules-out`,
-  `because`. The middle one is the half that gets dropped, so `pikku knowledge
-validate` now warns when a fence says what was chosen and never says what it
-  closes off. The fence is optional and a decision argued in prose is still a
-  decision — validate checks the fences that exist rather than asking every note
-  to be reformatted.
-
-  `Markdown` is exported from `@pikku/console` so the fabric console can render the
-  same notes through the same vocabulary instead of a second `<ReactMarkdown>`.
-
-- 8978fbd: feat(workflow): let an approval gate declare who may answer it
-
-  `workflow.approval()` gains `approvers` (`'any' | 'owner' | 'not-initiator'`)
-  and `approverScope`, so a gate can require four-eyes sign-off, restrict itself
-  to the run's initiator, or require the decider to hold a named scope.
-
-  Both are enforced when the workflow replays the gate — the same place, and for
-  the same reason, the decision payload is validated: the policy is a value on
-  the workflow, and a decision can be recorded before the run has ever reached
-  the gate. A decision that fails the policy is discarded and the gate stays
-  closed. Where the run has already published its policy, the check also runs at
-  submission time so the caller gets a 403 rather than silence.
-
-  An answer is now recorded where it can be answered for later. The settled
-  decision carries `decidedBy` and `decidedAt` in its `ApprovalOutcome`, so who
-  signed reaches `workflowStep.result` and `workflowStepHistory` rather than
-  living only in mutable run state. Every answer — accepted, refused at the door,
-  or cleared on replay — is also written to the audit sink as
-  `workflow.approval.decided`, which outlives the run: `deleteRun` cascades to
-  steps and history, and a refused attempt never reaches a step at all. Projects
-  with no audit service wired are unaffected.
-
-  **This loosens the default.** `approveStep` previously refused anyone but the
-  run's initiator, unconditionally. A gate that declares no `approvers` now
-  accepts a decision from anyone the approve entrypoint admits — restore the old
-  behaviour per-gate with `approvers: 'owner'`, or gate the approve route with
-  `auth`/`permissions`. Ownership still governs _reads_ of a run unchanged.
-
-## 0.12.7
-
-### Patch Changes
-
-- e110c55: Add `scenario.expectScore` — grade a finished agent run with a declared scorer and assert on it.
-
-  An agent's answer cannot be matched against a fixed string, so a scenario grades
-  it instead. `expectScore(step, runId, scorer, { atLeast, atMost, reference })`
-  runs one declared scorer against the run the scenario just triggered and fails
-  with the reason the judge gave. The default bound is `atLeast: 0.5`, so an
-  unqualified assertion still fails a run graded zero.
-
-  Grading goes over the new `pikkuScenarioGradeRun` instrumentation RPC, which the
-  dev server registers alongside the coverage and stub RPCs — so it exists only in
-  processes that should have it, and never in a deployed bundle. It grades from
-  the snapshot the runtime already took when the run finished, which is what makes
-  a scenario's grade the same measurement production's sampler makes rather than
-  an approximation of it: a run's prompt, answer and tool calls are spread across
-  a thread's messages, where the boundary of one run is not recoverable.
-
-  Two things differ deliberately from live scoring. The sample rate is ignored — a
-  scorer grading 1% of traffic still grades every scenario run — and the grade is
-  returned rather than recorded, so a test's score never lands among the
-  production figures. `reference` supplies the answer key a `requiresReference`
-  judge grades against, which is the only way such a judge is reachable at all.
-
-- 2f15aad: `pikku workspace validate` is now `pikku validate`, and it checks addon packaging
-
-  The command no longer needs to be told what kind of project it is looking at.
-  Each check declares the condition under which it means anything and runs
-  wherever that condition holds, so a repo that is an app, a pile of publishable
-  addons, or both gets exactly the checks that apply — and a run that found
-  nothing to check says so instead of printing a tick.
-
-  The new checks are for addons, and both state the same property at a different
-  level: every relative import in a shipped generated file, and every `exports` or
-  `imports` target, must resolve to a file the package actually publishes.
-
-  That property was false in every published `@pikku/addon-*`. They shipped
-  `dist/.pikku` without the `types/application-types.d.ts` those files import —
-  14 typecheck errors inside `node_modules` for any app depending on one — and
-  they published a second, dead copy of `.pikku` at the root whose imports reached
-  for a `src/` and `types/` the tarball did not contain, behind the very subpath
-  consumers import their bootstrap through.
-
-  Addons now point every entry point at the built copy under `dist`; the addon's
-  own build resolves `#pikku` through tsconfig `paths`, so nothing has to reach
-  into the source tree. `pikku new-addon` scaffolds that shape, and the addon
-  skill teaches it.
-
-## 0.12.6
-
-### Patch Changes
-
-- 2ff07e0: Remove `pikku db seed`. Seeding is now a step of `pikku db reset`, which grew `--no-seed`.
-
-  `seed` read like something you might point at any environment. It never was. It exists
-  for one job: put enough test data into a **dev** database that the app isn't empty on
-  first run. Production and staging are provisioned, not seeded — accounts and their role
-  grants come from `pikku persona sync` or a migration, and always have.
-
-  A standalone seed command is also what made seed files unpleasant to write. Because it
-  could be run against a database in any state, every seed had to defend itself with
-  `INSERT OR IGNORE`, `ON CONFLICT DO NOTHING`, `IF NOT EXISTS`. Folding it into reset
-  removes that: `pikku db reset` wipes, migrates, then seeds, so the seed only ever meets
-  an empty database and **plain `INSERT`s are correct**. The guarantee is structural now
-  rather than a documented convention.
-
-  ```bash
-  pikku db reset             # wipe + migrate + test data
-  pikku db reset --no-seed   # wipe + migrate, empty — for empty-state and onboarding work
-  ```
-
-  Seeding also inherits reset's guards for free: it refuses `NODE_ENV=production`, and
-  refuses a database resolved outside the runtime directory.
-
-  The seed file keeps a name that says what it is:
-  - `db/postgres-seed.sql` → `db/postgres-dev-seed.sql`
-  - `db/sqlite-seed.sql` → `db/sqlite-dev-seed.sql`
-
-  **Migrating:** rename the file, and drop the idempotency guards from it if you like.
-  `pikku db seed` no longer exists — use `pikku db reset`. A project that keeps the old
-  filename gets no error: reset reports the database is empty, which is the one failure
-  mode worth knowing about up front. The Fabric validator's `seed-sql-missing` finding is
-  now `dev-seed-sql-missing` and looks for the new name.
-
-- 1e74b01: Remove `pikku db seed`. Seeding is now a step of `pikku db reset`, which grew `--no-seed`.
-
-  `seed` read like something you might point at any environment. It never was. It exists
-  for one job: put enough test data into a **dev** database that the app isn't empty on
-  first run. Production and staging are provisioned, not seeded — accounts and their role
-  grants come from `pikku persona sync` or a migration, and always have.
-
-  A standalone seed command is also what made seed files unpleasant to write. Because it
-  could be run against a database in any state, every seed had to defend itself with
-  `INSERT OR IGNORE`, `ON CONFLICT DO NOTHING`, `IF NOT EXISTS`. Folding it into reset
-  removes that: `pikku db reset` wipes, migrates, then seeds, so the seed only ever meets
-  an empty database and **plain `INSERT`s are correct**. The guarantee is structural now
-  rather than a documented convention.
-
-  ```bash
-  pikku db reset             # wipe + migrate + test data
-  pikku db reset --no-seed   # wipe + migrate, empty — for empty-state and onboarding work
-  ```
-
-  Seeding also inherits reset's guards for free: it refuses `NODE_ENV=production`, and
-  refuses a database resolved outside the runtime directory.
-
-  The seed file keeps a name that says what it is:
-  - `db/postgres-seed.sql` → `db/postgres-dev-seed.sql`
-  - `db/sqlite-seed.sql` → `db/sqlite-dev-seed.sql`
-
-  **Migrating:** rename the file, and drop the idempotency guards from it if you like.
-  `pikku db seed` no longer exists — use `pikku db reset`. A project that keeps the old
-  filename gets no error: reset reports the database is empty, which is the one failure
-  mode worth knowing about up front. The Fabric validator's `seed-sql-missing` finding is
-  now `dev-seed-sql-missing` and looks for the new name.
-
-- 95f6144: Audit the twelve core skills against the shipped APIs and correct the drift.
-  - pikku-ai-agent: `instructions` does not exist — the prompt is `role`/`personality`/`goal` (required); tools are `ref()` handles; import from `#pikku/agent/pikku-agent-types.gen.js`; invoke via `rpc.agent.*` rather than `runAIAgent(name, input, { singletonServices })`
-  - pikku-scenario: step bodies live under `default`/`browser`/`cli` bindings, not a `func`; `scaffold.scenarios` is a boolean, not the rejected `"auth"` string
-  - pikku-addon: there is no `addon()` helper — `ref()` covers local and addon functions
-  - pikku-realtime: SSE is `PikkuRealtime.subscribeToTopic`; `publish`'s channelId argument excludes rather than targets
-  - pikku-cli: factories come from `#pikku`; documents options parsing, permissions/middleware/auth and the generated websocket backend
-  - pikku-services, pikku-config, pikku-middleware, pikku-rpc, pikku-workflow, pikku-queue, pikku-cron, pikku-websocket: corrected option names, wire objects, scopes/secrets coverage and cross-skill routing
-
-- facd61f: Audit the remaining skills against the shipped APIs and correct the drift.
-  - pikku-mcp: there is no `wireMCPTool` — a tool _is_ the function (`mcp: true` or `pikkuMCPToolFunc`), while `uri`/`title`/`name` belong on `wireMCPResource`/`wireMCPPrompt` rather than on the `pikkuMCP*Func` factories; resources return `{ uri, text }` only; `PikkuMCPServer` takes `(config, logger)`
-  - pikku-http: `channel` is on the wire, not services; `sse` is `get`-only and `query` is `post`-only; `docs` was never a `wireHTTP` option; factories come from `#pikku`
-  - pikku-security: documents `authBearer`'s static-token mode, `authCookie`'s merged defaults and re-issue rule, and that every strategy is a no-op without an HTTP request or with a session already set
-  - pikku-better-auth: the `admin:users:*` scope tree gained create/ban/remove/sessions/password, and `syncProjectedAdminRole` projects them onto `user.role` for better-auth's own `admin()` endpoints; documents dev quick login
-  - pikku-react / pikku-react-query / pikku-workflows-client: `createPikku` options are flat `CorePikkuFetchOptions` with `authHeaders` and the `setAuthorizationJWT`/`setAPIKey`/`setHeader` setters (no request interceptor); `useWorkflowStatus` never stops polling on its own
-  - pikku-trigger: a source function runs once at startup with singleton services only; documents `InMemoryTriggerService` startup and the skipped-metadata warning
-  - pikku-schedule: the singleton is `schedulerService` and `start()` is what registers the cron jobs; documents `scheduleRPC` and the one-off task API
-  - pikku-ws: there is no `PikkuWSServer` — `pikkuWebsocketHandler({ server, wss, logger })` over a `noServer: true` `WebSocketServer` is the real API
-  - pikku-info: there are only four subcommands, and `--silent` works despite the spurious "Unknown option" warning
-  - pikku-versioning: `override` is not required — a matching `V<n>` export suffix is stripped automatically — and the live function must be bumped explicitly; `versions init` writes an empty manifest, so `versions update` has to follow it
-  - pikku-audit: documents `audit: { durability }`, the `Safe<>` guard on `auditLog.write`, `createInvocationAudit`'s logger argument, and `createAuditedKysely`'s options
-  - pikku-kysely: six packages, not four — `@pikku/kysely-node-sqlite` / `-bun-sqlite` build the instance functions query, while `createSQLiteKysely` is typed to `KyselyPikkuDB` and wires `SerializePlugin`; the secret service config is `{ key, keyVersion, previousKey, audit }`, not `{ kekSecret, salt }`, and `getSecret` returns a `SecretValue`
-  - pikku-emails: template variables are always optional and never required-able; unresolved placeholders render blank rather than failing; documents `pikku emails init`
-  - pikku-rtl: rewritten off i18next — there is no `t()` or `i18n.changeLanguage` anywhere in the repo; Arabic is a `messages/ar.json` listed in `project.inlang/settings.json`
-  - pikku-i18n: enum labels use the singular `enum__<group>__<member>` namespace `@pikku/paraglide` generates from, not hand-written `enums__` maps; notes the console's wrapped `m` as a leftover rather than a pattern, and that the `mKey`/`mList` runtime resolvers have been removed for good
-  - pikku-deps: the summary has `totalIssues`/`totalUpdates` and no `info` bucket, issue `url`/`cvssScore`/`recommendedVersion` are nullable rather than optional, lockfile detection covers pnpm and npm too, and a non-zero `bun audit` exit only counts as data when it produced output
-  - pikku-feature: stage changed files by path — `git add -A` sweeps up regenerated artifacts and, on a shared checkout, another agent's work
-  - pikku-jose: `decode` verifies the signature and expiry (it is not an unchecked read), keys resolve by the token's `kid` rather than being tried in turn, and the algorithm is fixed HS256
-  - pikku-machine-auth: documents restricting a key below its owner via `scopes` on the mapped session, the deliberate verify-vs-scope failure split, and that `betterAuthStatelessSession` has no api-key path
-  - pikku-redis / pikku-mongodb: the secret-service config is `{ key, keyVersion, previousKey, … }`, not the fabricated `{ kekSecret, salt }`; both packages also ship a `SessionStore`
-  - pikku-pino: log methods take trailing meta varargs and are `Safe<>`-guarded against secrets; `debug` takes a string only
-  - pikku-aws / pikku-backblaze: every `ContentService` method takes an args object with a logical `bucket` stored as a path prefix, not positional arguments; `S3ContentConfig` is `{ bucketName, region, endpoint }` and `B2ContentConfig` has no `cdnUrl`; documents `signURL` failing open, the fixed 3600s presign, SQS's 900s delay ceiling and throwing `getJob`, and that `AWSSecrets.getSecret` returns a `SecretValue` and reports every failure as the same fatal error
-  - pikku-gateway-slack: `SlackGatewayAdapter` takes `{ signingSecret, tokenResolver }` — there is no `botToken`, one adapter serves every workspace; `verifySlackSignature` is `(secret, signature, timestamp, body)` and returns a boolean; `parseSlashCommand` returns camelCase fields with the raw payload on `raw`; the generic `send()` is a no-op, so replies must go through `createBoundSend`/`SlackGatewayHelper`
-  - pikku-ai-vercel: model strings are `provider/model`, not `provider:model`; documents the `'*'` catch-all, `withApiKey`, the transcribe/speech/image/embed methods, and that the service key must be `aiAgentRunner`
-  - pikku-ai-voice: rewritten — `@pikku/ai-voice` is a deprecated empty package with no `STTService`/`TTSService`; `voiceInput`/`voiceOutput` come from `@pikku/core/ai-agent` and attach via `aiMiddleware`, with per-script voices, `NoSpeechDetectedError`, and speak-only-when-spoken-to
-  - both above: there is no `wireAIAgent` — agents are declared with `pikkuAIAgent` from the generated agent types
-  - pikku-schema-ajv / pikku-schema-cfworker: the two validators are not drop-in equivalents — AJV caches by name forever and fills defaults in place, cfworker recompiles on a changed schema and applies no defaults; a missing schema throws a bare string rather than an `Error`
-  - pikku-n8n-import: the output directory is `--out/-o`, not a positional argument, and `pikku import n8n` already accepts a directory and flattens array/`{workflows:[]}` exports — an un-importable workflow is skipped while the rest of a batch still imports
-  - pikku-template-clone: `create-pikku` keeps only the chosen package manager's lockfile and may have written an empty `yarn.lock`, so commit it after the first install rather than as scaffolded
-  - pikku-fabric: the wirings file comment claimed a `wireMCPTool` that has never existed, and the conversion checklist named `fabric.config.json` with a `production.branch` — the real file is `pikkufabric.config.json` with `production.domain`; notes that several CLI messages print the shorter name anyway
-  - pikku-fabric-debug: `metrics` also requires `--branch`, and `--follow`'s own help text advertises SSE for what is a 2-second client poll
-  - pikku-deploy-express: documents `getHttpServer`/`enableReaper`, that the health check is registered in the constructor (before any middleware, so it cannot be wrapped in auth), what `init()` installs and in what order, and that Express buffers the body so the parser limit is the only place `maxBodySize` can stop an oversized request
-  - pikku-deploy-fastify: `enableCors` throws `Method not implemented.`; the health check lives in `init()`, not the constructor; the plugin registers a catch-all `fastify.all('/*')` and only sets `bodyLimit` when `maxBodySize` is supplied, so Fastify's stricter 1MB default otherwise stands
-  - pikku-deploy-uws: `PikkuUWSServer` has no `enableCors`, static assets or `content`; `init()` registers the health check plus catch-all HTTP and websocket handlers, `httpOptions` never reaches the websocket one and `loadSchemas` is never passed; `stop()` throws a bare string and waits a fixed 2s; documents the byte-counting `maxBodySize` 413 and why `@pikku/ws` needs `noServer: true`
-  - pikku-deploy-lambda: `runFetch` is payload v1 and `runFetchV2` v2 — only v2 echoes an origin or returns a 500; scheduled handlers should use `runLambdaScheduled`, which runs every task in the bundle and swallows per-task failures; the SQS worker's `batchItemFailures` needs `ReportBatchItemFailures` to mean anything; websocket handlers return a real `APIGatewayProxyResult` that must not be replaced with a hardcoded 200; documents the handler factories, `SQS_QUEUE_URL_*` resolution and the binary-unsupported/stale-connection eventhub behaviour
-  - pikku-deploy-cloudflare: the hand-rolled `setup-services.ts` never called `setSingletonServices`, so every request would have thrown a CF 1101 — use the exported `setupServices(env, factories)` and the handler factories; documents `runFetch`'s 426 upgrade path, `cf-ray` traceId and `exposeErrors: false` default, that `runScheduled` stops after the first cron match, and the `WEBSOCKET_HIBERNATION_SERVER` binding plus the 1008/403 connect-denial path
-  - pikku-deploy-nextjs: `pikkuAPIRequest` strips a leading `/api` (toggle with `removeAPIPrefix`) and passes no wiring options; the helper set includes `patch` and has no `staticPatch`/`staticDel`; the static variants differ by `skipUserSession`, not just where they run, and both bubble errors; documents `PikkuNextJSWorkerRPC` and `toNextJsAuthHandler`
-  - pikku-deploy-azure: the exports are `AzInvocationLogger` and `PikkuAZTimerRequest` — `PikkuAzFunctionsLogger` never existed; real deployments go through `createAzureHandler(factories, handlerTypes)` returning `{ http, queue, timer }`; `createAzureWebSocketHandler` is a 501 stub; documents the text-flattened HTTP response, `AZURE_QUEUE_NAME_*` resolution, the 7-day visibility cap, the timer running every task without per-task error handling, and `setLevel` being a no-op
-  - pikku-product-second-opinion: stop asserting a fixed TanStack Start release stage — `@tanstack/react-start`'s major tracks the Router line, so the version says nothing about maturity; check the vendor at write-up time
-
-- 2f72189: Point the `versions check` hints at a command that exists.
-
-  Three different failures told you to run `npx pikku versions-update`. There is
-  no such command — `update` is a subcommand of `versions` — so anyone following
-  the hint hit "unknown command" at the moment they were trying to repair a
-  contract manifest. It now prints `npx pikku versions update`.
-
-  The pikku-versioning skill carried a paragraph warning agents the hint was
-  wrong; with the hint fixed, that warning is gone.
-
-- 7b0da5e: Point `versions check` at a command that exists.
-
-  Three of its diagnostics told you to run `npx pikku versions-update`. There is
-  no such command — `update` is a subcommand of `versions`, so following the hint
-  gets an unknown-command error at the exact moment you have a failing check to
-  clear. They now print `npx pikku versions update`.
-
-  The pikku-versioning skill carried a paragraph warning agents off the bad hint.
-  With the hint corrected the warning is the only thing left naming a command that
-  does not exist, so it goes too.
-
-## 0.12.5
-
-### Patch Changes
-
-- fd72e58: Drop `scenario.step` — a scenario step is now always a `given`, `when` or
-  `then`.
-
-  `step` rendered no keyword, which made it the phase to reach for whenever a
-  step did not obviously fit one of the three. That is exactly the step a reader
-  cannot check: a scenario is read by people deciding whether it describes the
-  behaviour they wanted, and a row that says what it does without saying whether
-  it is setup, action or claim tells them nothing to agree or disagree with. It
-  was also the escape hatch from the assertion lint — a scenario with no `then`
-  could be made to stop complaining by demoting its steps rather than by
-  asserting anything.
-
-  Replace `scenario.step(...)` with whichever of `given`, `when` or `then` the
-  step actually is. `then` is not a rename: it makes the step's bindings
-  witnesses rather than alternatives, so every declared surface runs and they
-  must agree.
-
-- 75e81b1: Document `pikkuServerLifecycle` in the skills corpus. `pikku-concepts` now presents both bootstrap paths (letting `pikku dev`/`pikku serve` own the server vs. embedding in your own runtime) instead of only the hand-rolled entrypoint, `pikku-services` gains a `pikkuServerLifecycle` reference covering hook ordering, discovery rules and the `afterStop`-runs-after-services-stop caveat, and `pikku-config` documents the `lint` severity map including `customServerBootstrap`.
-
-## 0.12.4
-
-### Patch Changes
-
-- 8075f6a: Confine `SecretService` to the places an app is wired.
-
-  `secrets` is now omitted from the services every function, AI agent, workflow,
-  permission and wire receives, and the function runner replaces it with a
-  throwing accessor so a cast cannot reach past the type. It stays available in
-  `pikkuServices`, `pikkuWireServices`, addon service factories and middleware —
-  read a secret there, give it to a service, and have the function ask that
-  service.
-
-  Alongside it:
-  - `wireSecret` gains `allowedHosts`, refusing a secret attached to a host it was
-    not declared for. Permissive by default; strict via
-    `config.secrets.requireAllowedHosts`.
-  - `pikku-graph`'s `httpRequest` resolves and attaches its credential inside a new
-    `httpRequester` service instead of holding the plaintext in the function.
-  - New inspector diagnostics: `PKU950` (a `SecretService` exposed under another
-    service name), `PKU951` (a secret read that no `wireSecret` declares) and
-    `PKU952` (a secret read with a non-literal key).
-
-## 0.12.3
-
-### Patch Changes
-
-- a7b26c5: rename the inspected declarations to `define*`: `wireScope` → `defineScope`, `wireSecret` → `defineSecret`, `wireVariable` → `defineVariable`, `wireCredential` → `defineCredential`
-
-  `wire*` meant two unrelated things. A transport wiring attaches a function to
-  something that can invoke it — `wireHTTP`, `wireChannel`, `wireScheduler`,
-  `wireQueueWorker` and the rest — and the thing it wires runs. These four wire
-  nothing: they are no-ops that exist only so the call typechecks, they are
-  tree-shaken out of the build, and their whole job is to be found by the
-  inspector's AST pass and turned into a type union. One word for both left the
-  declaration reading like a registration with a runtime.
-
-  So the vocabulary splits: **`wire*` is a transport, `define*` is an inspected
-  declaration.**
-
-  ```ts
-  import { defineScope } from '@pikku/core/scope'
-  import { defineSecret } from '@pikku/core/secret'
-  import { defineVariable } from '@pikku/core/variable'
-  import { defineCredential } from '@pikku/core/credential'
-
-  defineScope({ admin: { scopes: { invoices: { scopes: { create: {} } } } } })
-  ```
-
-  **Breaking:** no alias is kept. Rename the four call sites; the module subpaths
-  (`@pikku/core/scope`, `/secret`, `/variable`) are unchanged.
-
-  The inspector matches these by identifier text, so a stale `wire*` call is not a
-  type error — it is silently not extracted, and the generated union comes back
-  empty. That fails as "this scope isn't declared" on code that was fine a moment
-  ago, nowhere near the declaration. Grep for the old names rather than trusting a
-  clean build.
-
-  An addon published with `.pikku` output generated before this release re-exports
-  `wireSecret` from `@pikku/core/secret` and will not typecheck against this core
-  until it is rebuilt and republished.
-
-- 457cb25: Add `definePersonas()`: the people a project's scenarios and virtual users run
-  as, declared in code.
-
-  There used to be three names for two-and-a-bit things — an _actor_ in
-  `scenarios.actors`, a _persona_ in `scenarios.personas`, and a _virtual user_
-  declared separately against an actor. In practice almost every actor was its own
-  kind, so the second set carried no information and the third was a third place
-  for a name to drift. There is now one declaration:
-
-  ```ts
-  definePersonas({
-    shopper: {
-      name: 'Sam Shopper',
-      jobTitle: 'Shopper',
-      personality: 'Buys in a hurry and leaves tabs open',
-      roles: ['customer'],
-      disposition: 'careless',
-      goals: ['Buy something without reading anything'],
-      account: {},
-    },
-  })
-  ```
-
-  A persona is a person: what they are like, what they want, the roles they hold,
-  and **one** account they sign in with — `account: {}` plus `linkedAccounts` for
-  the rare case of more, modelled on how better-auth does linking. A persona with a
-  `disposition` is a virtual user; `runnable: false` marks someone who only ever
-  exists to be acted upon — banned, shared with, reset — and is never handed a
-  session.
-
-  **A persona names roles, never scopes.** Scopes come from `defineSystemRole()`
-  expansion, so the build fails if a persona names a role nobody declared, and
-  fails again if a role confers a scope no `defineScope` declares. Running one only
-  ever has to check that its roles are still valid.
-
-  **Addresses are computed, never declared.** `personaEmail(id, domain, runId)`
-  derives `<id>[+runId]@<domain>` from `scenarios.emailDomain`, so a seed, a
-  scenario run and a virtual-user run cannot disagree about who they are signing in
-  as. `scenarios.actors` and `scenarios.personas` are gone from
-  `pikku.config.json` — only `emailDomain` remains.
-
-  `actor` survives in exactly one place: the name of a **slot in a scenario step**,
-  which is the role a persona is cast in for that step. `pikkuVirtualUser()`,
-  `kind`, `grants` and the `actor` field are removed; the `actors` service is now
-  `personas`, and the CLI's `virtual-user` commands are now `pikku persona list` /
-  `pikku persona run`. `budget` and `allowApprovalRequired` moved to run flags —
-  how much you will spend today is not a fact about a person.
-
-  `@pikku/cucumber` drops its `Actor` class and `ActorDispatchContext`: a
-  hand-rolled cookie jar that a persona's own typed session replaces outright.
-
-- 86a50b9: scenario: replace `browser: true` + `func` with per-surface bindings on `pikkuScenarioStep`
-
-  A step now declares one implementation per surface it can be driven through:
-
-  ```ts
-  export const buysTheItem = pikkuScenarioStep<{ sku: string }, { orderId: string }>({
-    name: 'buysTheItem',
-    description: 'buys the item',
-    browser: async (services, data, { browser }) => { ... },
-    default: async (services, data, { rpc }) => { ... },
-  })
-  ```
-
-  `pikku scenario run --run browser|cli|default` picks which surface the run drives,
-  and the two phases resolve bindings differently:
-  - **Actions** (`given` / `when` / `step`) run exactly one binding — the run
-    surface if it has one, otherwise `default`. A step with neither now fails with
-    `ScenarioNoSurfaceBinding` instead of silently running server-side.
-  - **Assertions** (`then`) are witnesses, not alternatives: every declared binding
-    runs and they must agree. Two surfaces reporting different things fails the run
-    with `ScenarioWitnessDisagreement` rather than reporting a pass. An assertion
-    with no witness the run can execute at all fails with `ScenarioNoWitness` —
-    without it the step returns `undefined` and renders as a tick, reporting a pass
-    for something nobody checked.
-
-  A scenario written as a step ladder that never calls `then` is now a **PKU680**
-  critical. It proves only that nothing threw, so an assertion-free ladder of
-  browser-bound actions would score perfect coverage while checking nothing.
-
-  The report gains a surface-coverage line — `n/m steps ran on browser`, counted
-  over every step, so an action that fell back to the server lowers the ratio
-  rather than needing a footnote. That also makes surfaces comparable over one
-  denominator: a scenario is `4/4` on a default run and `3/4` on a browser one.
-  Assertions that fell back are named separately and gate `--strict`, since a
-  sentence claiming the actor saw something nobody looked at is a different problem
-  from an action taking a shortcut.
-
-  **Breaking:** `browser: true` and the third `B extends boolean` type argument are
-  gone. Rename `func` to `default` (or to `browser` where the step drove a browser)
-  and drop the type argument.
-
-## 0.12.2
-
-### Patch Changes
-
-- b89d3b3: Bring the knowledge base into OSS: a package, a CLI gate, a console browser and a skill
-
-  `knowledge/` is where a project records the things `pikku meta` cannot tell you —
-  what a slice is for, which rule was chosen and what it rules out, what is still an
-  open question. Tables, routes, schemas and permissions are generated, so a note
-  that repeats them is a copy that will drift, and the profile refuses the sections
-  where that happens.
-  - **`@pikku/knowledge`** (new) reads the notes, builds the link graph in both
-    directions, and validates the app-project profile: every note typed, every
-    section indexed, every slice carrying a third-person gherkin scenario and at
-    most three entities, and every `resource:` URI resolving against the generated
-    meta. The resource check fails closed on drift and open on ignorance — a prefix
-    whose meta is absent is skipped rather than called dangling.
-  - **`pikku knowledge validate`** and **`pikku knowledge index`** replace the dead
-    three-flat-files check. Both exit non-zero on an inconsistent base, so a
-    pipeline can stop on one; `index` refreshes each `index.md` listing while
-    leaving the prose around it alone, and now gives a section that holds only
-    sub-sections an index of its own instead of leaving it unreachable.
-  - **The console** gains a read-only Knowledge page: notes grouped by section,
-    a rendered document with its tags, resources, links in both directions and the
-    findings against it, and intra-bundle markdown links that open the linked note
-    instead of leaving the page. Read-only by design — a note is edited in the repo,
-    in the same commit as the code it describes.
-  - **The `pikku-knowledge` skill** documents the format for agents, and Fabric
-    builds on it rather than restating it.
-  - **`@pikku/inspector`**: a zod schema imported from a built workspace package
-    resolved to that package's `.d.ts`, which has no runtime exports at all, so
-    every schema in it was reported missing. The emitted JS beside it is imported
-    instead.
-
-- e14c530: Drop OpenCode-specific discovery guidance from the bundled skills
-
-  Step 1 of the execution checklist in 43 skills opened with "Prefer OpenCode
-  tools such as `pikku-meta` when available; otherwise run the relevant
-  `pikku meta ... --json` command". The skills ship to every agent that reads
-  them, most of which have no such tools, so the preferred branch was dead
-  advice that an agent had to reason past before reaching the instruction that
-  actually applies.
-
-  The step now just says to run `pikku meta ... --json`. The README still notes
-  that the frontmatter shape is the one Claude Code, opencode and pi.dev all
-  parse — that is a compatibility fact about the format, not a routing hint.
-
-## 0.12.1
-
-### Patch Changes
-
-- 637e668: Move the bundled agent skills out of `@pikku/cli` into a new MIT-licensed `@pikku/skills` package.
-
-  The skills are the open core — the instruction set any harness reads to build, wire and deploy a Pikku project — but they shipped inside `@pikku/cli`, whose `files` array carried `skills/` under BUSL-1.1 with no carve-out. Their terms now stand on their own package and no longer depend on the CLI that installs them.
-
-  This also fixes `pikku skills install` on the native binaries. `bun build --compile` only bundles the JS import graph, so 81 markdown files reached through `readdir` never made it in: every Homebrew install failed with `Could not locate bundled skills directory`, while npm installs worked. `@pikku/skills` ships both the `skills/` directory and an embedded path → contents manifest, and reads prefer the directory when one exists — so skill edits stay live in development, and the binary falls back to the manifest it now carries.
-
-  No skill content changed, and `pikku skills install` takes the same flags.