@pikku/core 0.12.103 → 0.12.106

package/dist/classification/data-lock.d.ts

@@ -1,80 +0,0 @@
-import type { WrappedValue } from './data-classification.js';
-export type LockState = 'uninitialized' | 'locked' | 'unlocked';
-/**
- * One KEK's stored material: everything a passphrase has to reproduce, and
- * nothing a passphrase could be recovered from.
- */
-export type LockRecord = {
-    keyId: string;
-    keyVersion: number;
-    salt: string;
-    /**
-     * A DEK sealed under this KEK. Unwrapping it is the passphrase check — AES-GCM
-     * fails its authentication tag under the wrong key, so a bad passphrase is
-     * caught before it can produce a single garbled row.
-     */
-    verifier: WrappedValue;
-};
-/**
- * Where lock records live.
- *
- * Necessarily readable while locked — a store that needed its own key to find
- * out how to unlock itself could never be opened. It holds no plaintext key
- * material, so this costs nothing.
- */
-export interface LockVault {
-    read(): Promise<LockRecord[]>;
-    write(records: LockRecord[]): Promise<void>;
-}
-/**
- * The gate in front of every classified column.
- *
- * A key is never held at construction: the server boots locked and serves the
- * unlock screen, so the passphrase arrives over HTTP long after services are
- * built. `getKEK` is what a Kysely classification resolver calls per operation,
- * and it throws rather than returning a falsy key — silently writing plaintext
- * into a column the manifest calls `wrapped` would look like a working app
- * while the data sat exposed.
- */
-export declare class DataLock {
-    private readonly vault;
-    private keks;
-    private records;
-    private initialized;
-    private failures;
-    private lockedOutUntil;
-    private readonly now;
-    constructor(vault: LockVault, options?: {
-        now?: () => number;
-    });
-    get state(): LockState;
-    /**
-     * How long before another guess will be looked at, or 0.
-     *
-     * Exposed so an unlock screen can show the wait instead of discovering it by
-     * guessing again — a guess made during a lockout is itself a failure, and
-     * extends the window it was trying to wait out.
-     */
-    get retryAfterMs(): number;
-    /** Read what the store already has, so `state` can answer. */
-    init(): Promise<LockState>;
-    /**
-     * First run: mint a salt and verifier per key and leave the store open, since
-     * whoever chose the passphrase a moment ago does not need to retype it.
-     */
-    initialize(passphrase: string, keyIds?: string[]): Promise<void>;
-    unlock(passphrase: string): Promise<void>;
-    lock(): void;
-    getKEK(keyId: string): Promise<CryptoKey>;
-    /**
-     * The version to stamp into a value written under `keyId`.
-     *
-     * Separate from `getKEK` because only a write has to ask: a stored value
-     * carries the version it was sealed under, so a read already knows. Readable
-     * while locked, since a version number is not key material.
-     */
-    getKeyVersion(keyId: string): number;
-    private assertKnownKeyId;
-    private recordFailure;
-    private assertInitialized;
-}

package/dist/classification/data-lock.js

@@ -1,146 +0,0 @@
-import { deriveKEK, generateDEK, generateKEKSalt, unwrapDEK, wrapDEK, } from '../crypto-utils.js';
-import { DataLockedError, InvalidPassphraseError, TooManyAttemptsError, } from '../errors/errors.js';
-import { DEFAULT_KEY_ID } from './key-ids.js';
-/** Wrong guesses tolerated before a lockout window opens. */
-const MAX_ATTEMPTS = 5;
-const LOCKOUT_MS = 30_000;
-const MAX_LOCKOUT_MS = 15 * 60_000;
-/**
- * The gate in front of every classified column.
- *
- * A key is never held at construction: the server boots locked and serves the
- * unlock screen, so the passphrase arrives over HTTP long after services are
- * built. `getKEK` is what a Kysely classification resolver calls per operation,
- * and it throws rather than returning a falsy key — silently writing plaintext
- * into a column the manifest calls `wrapped` would look like a working app
- * while the data sat exposed.
- */
-export class DataLock {
-    vault;
-    keks = new Map();
-    records = [];
-    initialized = false;
-    failures = 0;
-    lockedOutUntil = 0;
-    now;
-    constructor(vault, options = {}) {
-        this.vault = vault;
-        this.now = options.now ?? Date.now;
-    }
-    get state() {
-        if (!this.records.length) {
-            return 'uninitialized';
-        }
-        return this.keks.size ? 'unlocked' : 'locked';
-    }
-    /**
-     * How long before another guess will be looked at, or 0.
-     *
-     * Exposed so an unlock screen can show the wait instead of discovering it by
-     * guessing again — a guess made during a lockout is itself a failure, and
-     * extends the window it was trying to wait out.
-     */
-    get retryAfterMs() {
-        return Math.max(0, this.lockedOutUntil - this.now());
-    }
-    /** Read what the store already has, so `state` can answer. */
-    async init() {
-        this.records = await this.vault.read();
-        this.initialized = true;
-        return this.state;
-    }
-    /**
-     * First run: mint a salt and verifier per key and leave the store open, since
-     * whoever chose the passphrase a moment ago does not need to retype it.
-     */
-    async initialize(passphrase, keyIds = [DEFAULT_KEY_ID]) {
-        this.assertInitialized();
-        if (this.records.length) {
-            throw new Error('This store is already initialized. Re-initializing would seal it under a new key while every existing row stayed sealed under the old one.');
-        }
-        const records = [];
-        for (const keyId of keyIds) {
-            const salt = generateKEKSalt();
-            const kek = await deriveKEK(passphrase, salt);
-            records.push({
-                keyId,
-                keyVersion: 1,
-                salt,
-                verifier: await wrapDEK(kek, await generateDEK()),
-            });
-            this.keks.set(keyId, kek);
-        }
-        await this.vault.write(records);
-        this.records = records;
-    }
-    async unlock(passphrase) {
-        this.assertInitialized();
-        if (this.now() < this.lockedOutUntil) {
-            // A correct passphrase waits too. Exempting it would hand an attacker the
-            // oracle the throttle exists to deny: a guess that behaves differently is
-            // a guess that has been confirmed.
-            throw new TooManyAttemptsError();
-        }
-        const opened = new Map();
-        for (const record of this.records) {
-            const kek = await deriveKEK(passphrase, record.salt);
-            try {
-                await unwrapDEK(kek, record.verifier);
-            }
-            catch {
-                this.recordFailure();
-                // Which record failed says which key the passphrase was not for, so the
-                // whole attempt fails as one rather than naming it.
-                throw new InvalidPassphraseError();
-            }
-            opened.set(record.keyId, kek);
-        }
-        this.failures = 0;
-        this.lockedOutUntil = 0;
-        this.keks = opened;
-    }
-    lock() {
-        this.keks.clear();
-    }
-    async getKEK(keyId) {
-        // A keyId nobody initialized is a configuration error, and saying "locked"
-        // about it sends whoever reads that log hunting for a passphrase to a
-        // store that is already open. `DataLockedError` means only the lock state.
-        this.assertKnownKeyId(keyId);
-        const kek = this.keks.get(keyId);
-        if (!kek) {
-            throw new DataLockedError();
-        }
-        return kek;
-    }
-    /**
-     * The version to stamp into a value written under `keyId`.
-     *
-     * Separate from `getKEK` because only a write has to ask: a stored value
-     * carries the version it was sealed under, so a read already knows. Readable
-     * while locked, since a version number is not key material.
-     */
-    getKeyVersion(keyId) {
-        this.assertKnownKeyId(keyId);
-        return this.records.find((record) => record.keyId === keyId).keyVersion;
-    }
-    assertKnownKeyId(keyId) {
-        if (!this.records.some((record) => record.keyId === keyId)) {
-            throw new Error(`No lock record for key "${keyId}" — every keyId a column names has to be passed to initialize(). Derive the list from the classification manifest with keyIdsFromManifest() so the two cannot drift.`);
-        }
-    }
-    recordFailure() {
-        this.failures += 1;
-        if (this.failures < MAX_ATTEMPTS) {
-            return;
-        }
-        const escalation = this.failures - MAX_ATTEMPTS;
-        this.lockedOutUntil =
-            this.now() + Math.min(LOCKOUT_MS * 2 ** escalation, MAX_LOCKOUT_MS);
-    }
-    assertInitialized() {
-        if (!this.initialized) {
-            throw new Error('DataLock.init() must run before the store is used');
-        }
-    }
-}

package/dist/column-form.d.ts

@@ -1,32 +0,0 @@
-import type { HashedValue, SealedValue, WrappedValue } from './data-classification.js';
-/**
- * SHA-256 of a credential, lowercase hex — the sole producer of `HashedValue`.
- *
- * Deliberately unpeppered. These are high-entropy random bearer tokens, not
- * passwords: there is no candidate set to search, so a pepper would add a key
- * to manage and a rotation story to own while buying nothing. A column holding
- * a *low*-entropy secret is not a `hashed` column — it wants a password KDF and
- * a different type entirely.
- *
- * Async because it runs on WebCrypto rather than `node:crypto`, so the same
- * code path works in a Worker. Callers that hash a bearer token on every
- * request are already async.
- */
-export declare const hashToken: (raw: string) => Promise<HashedValue>;
-/**
- * Assert that a string already in storage is ciphertext of the given form.
- *
- * The brands exist so that new writes must come from a real encrypt/hash call,
- * but three paths legitimately hold such a value as a bare `string`: a
- * migration backfilling rows written before the column declared its form, a
- * test fixture, and a value arriving over the wire from a service that sealed
- * it elsewhere. Each of those is a promise the caller is making, not something
- * the type system can check — which is why these are named to be greppable and
- * why there is no non-`unsafe` spelling. If one of these appears in ordinary
- * request-handling code, that is the bug.
- */
-export declare const unsafeAsWrapped: (stored: string) => WrappedValue;
-/** See `unsafeAsWrapped`. */
-export declare const unsafeAsSealed: (stored: string) => SealedValue;
-/** See `unsafeAsWrapped`. */
-export declare const unsafeAsHashed: (stored: string) => HashedValue;

package/dist/column-form.js

@@ -1,42 +0,0 @@
-/**
- * SHA-256 of a credential, lowercase hex — the sole producer of `HashedValue`.
- *
- * Deliberately unpeppered. These are high-entropy random bearer tokens, not
- * passwords: there is no candidate set to search, so a pepper would add a key
- * to manage and a rotation story to own while buying nothing. A column holding
- * a *low*-entropy secret is not a `hashed` column — it wants a password KDF and
- * a different type entirely.
- *
- * Async because it runs on WebCrypto rather than `node:crypto`, so the same
- * code path works in a Worker. Callers that hash a bearer token on every
- * request are already async.
- */
-export const hashToken = async (raw) => {
-    const subtle = globalThis.crypto?.subtle;
-    if (!subtle) {
-        throw new Error('WebCrypto not available');
-    }
-    const digest = await subtle.digest('SHA-256', new TextEncoder().encode(raw));
-    let hex = '';
-    for (const byte of new Uint8Array(digest)) {
-        hex += byte.toString(16).padStart(2, '0');
-    }
-    return hex;
-};
-/**
- * Assert that a string already in storage is ciphertext of the given form.
- *
- * The brands exist so that new writes must come from a real encrypt/hash call,
- * but three paths legitimately hold such a value as a bare `string`: a
- * migration backfilling rows written before the column declared its form, a
- * test fixture, and a value arriving over the wire from a service that sealed
- * it elsewhere. Each of those is a promise the caller is making, not something
- * the type system can check — which is why these are named to be greppable and
- * why there is no non-`unsafe` spelling. If one of these appears in ordinary
- * request-handling code, that is the bug.
- */
-export const unsafeAsWrapped = (stored) => stored;
-/** See `unsafeAsWrapped`. */
-export const unsafeAsSealed = (stored) => stored;
-/** See `unsafeAsWrapped`. */
-export const unsafeAsHashed = (stored) => stored;

package/dist/data-classification.d.ts

@@ -1,64 +0,0 @@
-export type Private<T> = T & {
-    readonly __classification__?: 'private';
-};
-export type Pii<T> = T & {
-    readonly __classification__?: 'pii';
-};
-export type Secret<T> = T & {
-    readonly __classification__?: 'secret';
-};
-export type Classification = 'public' | 'private' | 'pii' | 'secret';
-export type AnonymizeStrategy = 'fake:email' | 'fake:name' | 'hash' | 'keep' | null;
-/**
- * How a column's bytes are represented at rest, as distinct from how sensitive
- * the value is (`Classification`). The two are independent: a token hash is
- * `secret` + `hashed` and must never be encrypted, because the hash *is* the
- * lookup key; a live bearer token is `secret` + `plain` today and should not be.
- *
- * `wrapped` and `sealed` are siblings rather than one being "encrypted": both
- * are ciphertext, and what separates them is who can read it back. Wrapped is
- * symmetric and the application holds the key. Sealed is asymmetric and the
- * application holds only the public half, so it can write the value and never
- * read it. Storing one where the other is expected is silent, permanent data
- * loss, which is why they are not collapsed into a single `encrypted`.
- */
-export type ColumnForm = 'plain' | 'hashed' | 'wrapped' | 'sealed';
-declare const wrappedBrand: unique symbol;
-declare const sealedBrand: unique symbol;
-declare const hashedBrand: unique symbol;
-/**
- * Ciphertext under a symmetric key the application holds — the output of
- * `envelopeEncrypt`, `wrapDEK` or `envelopeRewrap`.
- *
- * Unlike `Secret<T>` the brand is REQUIRED, so a plain `string` is not
- * assignable and a column declared `form: 'wrapped'` cannot be written with
- * anything but genuine ciphertext. It stays assignable *to* `string`, so it
- * still works as a query operand and serializes normally — the constraint is on
- * construction, not on use.
- */
-export type WrappedValue = string & {
-    readonly [wrappedBrand]: true;
-};
-/** Ciphertext under a public key whose private half the application does not
- *  hold. Deliberately not assignable to `WrappedValue`: writing one where the
- *  other belongs produces a row nobody can ever open. */
-export type SealedValue = string & {
-    readonly [sealedBrand]: true;
-};
-/** A one-way digest of a secret input. The brand's job is narrow — stop a *raw*
- *  credential being written into the column that should hold its hash. */
-export type HashedValue = string & {
-    readonly [hashedBrand]: true;
-};
-export interface ColumnClassification {
-    classification: Classification;
-    anonymize_strategy: AnonymizeStrategy;
-    /** At-rest representation. Absent means `plain`. */
-    form?: ColumnForm;
-    description?: string;
-}
-export type ClassificationManifest = {
-    version: 1;
-    tables: Record<string, Record<string, ColumnClassification>>;
-};
-export {};

package/dist/data-classification.js

@@ -1 +0,0 @@
-export {};

package/dist/ecosystem/agent-scorer.d.ts

@@ -1,12 +0,0 @@
-export { gradeRun } from '../wirings/agent-scorer/agent-scorer-grade.js';
-export { addAgentScorer } from '../wirings/agent-scorer/agent-scorer-registry.js';
-export { enableScoreSnapshots, getScoreSnapshot, } from '../wirings/agent-scorer/agent-scorer-snapshots.js';
-export { wireAgentScorerQueueWorkers } from '../wirings/agent-scorer/agent-scorer-worker.js';
-export { pikkuAgentJudge, pikkuAgentScorer, } from '../wirings/agent-scorer/agent-scorer.js';
-export type { AgentRunScore, ScorerMeta, } from '../wirings/agent-scorer/agent-scorer.types.js';
-/**
- * Types the exports above mention but do not themselves export. Without
- * them a consumer's declaration emit has no name for the type it infers,
- * and fails with TS2883 rather than reaching for the original entry point.
- */
-export type { PikkuAgentScorer, ScoreJob, ScorerInput, ScorerOutput, } from '../wirings/agent-scorer/agent-scorer.types.js';

package/dist/ecosystem/agent-scorer.js

@@ -1,5 +0,0 @@
-export { gradeRun } from '../wirings/agent-scorer/agent-scorer-grade.js';
-export { addAgentScorer } from '../wirings/agent-scorer/agent-scorer-registry.js';
-export { enableScoreSnapshots, getScoreSnapshot, } from '../wirings/agent-scorer/agent-scorer-snapshots.js';
-export { wireAgentScorerQueueWorkers } from '../wirings/agent-scorer/agent-scorer-worker.js';
-export { pikkuAgentJudge, pikkuAgentScorer, } from '../wirings/agent-scorer/agent-scorer.js';

package/dist/ecosystem/agent.d.ts

@@ -1,21 +0,0 @@
-export type { AgentRunStateService, CreateRunInput, SaveScoreInput, } from '../services/agent-run-state-service.js';
-export type { AgentRunnerParams, AgentRunnerService, AgentStepResult, } from '../services/agent-runner-service.js';
-export type { AgentStorageService } from '../services/agent-storage-service.js';
-export { agent, agentApprove, agentResume, agentStream, } from '../wirings/agent/agent-helpers.js';
-export { resolveModelAlias } from '../wirings/agent/agent-model-config.js';
-export { canAccessThread, isOwnedByPrincipal, threadOwnerConstraint, } from '../wirings/agent/agent-prepare.js';
-export { addAgent } from '../wirings/agent/agent-registry.js';
-export type { AgentInput, AgentMemoryConfig, AgentMessage, AgentsMeta, AgentStep, AgentContentPart, AgentRunRow, AgentRunService, AgentRunState, AgentStreamChannel, AgentThread, CoreAgent, PendingApproval, PikkuAgentMiddlewareHooks, } from '../wirings/agent/agent.types.js';
-export { voiceInput } from '../wirings/agent/voice-input.js';
-export { voiceOutput } from '../wirings/agent/voice-output.js';
-/**
- * Types the exports above mention but do not themselves export. Without
- * them a consumer's declaration emit has no name for the type it infers,
- * and fails with TS2883 rather than reaching for the original entry point.
- */
-export type { LogLevel } from '../services/logger.js';
-export type { WebhookServiceConfig } from '../services/webhook-service.js';
-export type { CoreSingletonServices, PostgresConfig, } from '../types/core.types.js';
-export type { SpeakableScripts } from '../wirings/agent/voice-output.js';
-export type { WorkflowServiceConfig } from '../wirings/workflow/workflow.types.js';
-export type { VoiceOutputState } from '../wirings/agent/voice-output.js';

package/dist/ecosystem/agent.js

@@ -1,6 +0,0 @@
-export { agent, agentApprove, agentResume, agentStream, } from '../wirings/agent/agent-helpers.js';
-export { resolveModelAlias } from '../wirings/agent/agent-model-config.js';
-export { canAccessThread, isOwnedByPrincipal, threadOwnerConstraint, } from '../wirings/agent/agent-prepare.js';
-export { addAgent } from '../wirings/agent/agent-registry.js';
-export { voiceInput } from '../wirings/agent/voice-input.js';
-export { voiceOutput } from '../wirings/agent/voice-output.js';

package/dist/ecosystem/channel/local.d.ts

@@ -1,3 +0,0 @@
-export { PikkuLocalChannelHandler } from '../../wirings/channel/local/local-channel-handler.js';
-export { runLocalChannel } from '../../wirings/channel/local/local-channel-runner.js';
-export { LocalEventHubService } from '../../wirings/channel/local/local-eventhub-service.js';

package/dist/ecosystem/channel/local.js

@@ -1,3 +0,0 @@
-export { PikkuLocalChannelHandler } from '../../wirings/channel/local/local-channel-handler.js';
-export { runLocalChannel } from '../../wirings/channel/local/local-channel-runner.js';
-export { LocalEventHubService } from '../../wirings/channel/local/local-eventhub-service.js';

package/dist/ecosystem/channel/serverless.d.ts

@@ -1,9 +0,0 @@
-export { runChannelConnect, runChannelDisconnect, runChannelMessage, } from '../../wirings/channel/serverless/serverless-channel-runner.js';
-export type { RunServerlessChannelParams } from '../../wirings/channel/serverless/serverless-channel-runner.js';
-/**
- * Types the exports above mention but do not themselves export. Without
- * them a consumer's declaration emit has no name for the type it infers,
- * and fails with TS2883 rather than reaching for the original entry point.
- */
-export type { ChannelStore } from '../../wirings/channel/channel-store.js';
-export type { PikkuChannelHandlerFactory } from '../../wirings/channel/channel.types.js';

package/dist/ecosystem/channel/serverless.js

@@ -1 +0,0 @@
-export { runChannelConnect, runChannelDisconnect, runChannelMessage, } from '../../wirings/channel/serverless/serverless-channel-runner.js';

package/dist/ecosystem/channel.d.ts

@@ -1,15 +0,0 @@
-export { addChannelMiddleware } from '../wirings/channel/channel-middleware-runner.js';
-export type { Capabilities } from '../wirings/channel/channel-rpc.types.js';
-export { ChannelStore } from '../wirings/channel/channel-store.js';
-export type { Channel } from '../wirings/channel/channel-store.js';
-export type { BinaryData, ChannelMessageMeta, ChannelMeta, ChannelsMeta, CoreChannel, CorePikkuChannelMiddleware, CorePikkuChannelMiddlewareFactory, PikkuChannelHandlerFactory, } from '../wirings/channel/channel.types.js';
-export type { EventHubService } from '../wirings/channel/eventhub-service.js';
-export { EventHubStore } from '../wirings/channel/eventhub-store.js';
-export { logChannels } from '../wirings/channel/log-channels.js';
-export { PikkuAbstractChannelHandler } from '../wirings/channel/pikku-abstract-channel-handler.js';
-/**
- * Types the exports above mention but do not themselves export. Without
- * them a consumer's declaration emit has no name for the type it infers,
- * and fails with TS2883 rather than reaching for the original entry point.
- */
-export type { Logger } from '../services/logger.js';

package/dist/ecosystem/channel.js

@@ -1,5 +0,0 @@
-export { addChannelMiddleware } from '../wirings/channel/channel-middleware-runner.js';
-export { ChannelStore } from '../wirings/channel/channel-store.js';
-export { EventHubStore } from '../wirings/channel/eventhub-store.js';
-export { logChannels } from '../wirings/channel/log-channels.js';
-export { PikkuAbstractChannelHandler } from '../wirings/channel/pikku-abstract-channel-handler.js';

package/dist/ecosystem/cli/channel.d.ts

@@ -1,16 +0,0 @@
-export { handleRawCLI } from '../../wirings/cli/channel/cli-raw-channel-runner.js';
-export type { RawCLIFrame } from '../../wirings/cli/channel/cli-raw-channel-runner.js';
-export { executeRawCLIViaChannel } from '../../wirings/cli/channel/cli-raw-client-runner.js';
-export type { CorePikkuCLIClientRender } from '../../wirings/cli/channel/cli-raw-client-runner.js';
-/**
- * Types the exports above mention but do not themselves export. Without
- * them a consumer's declaration emit has no name for the type it infers,
- * and fails with TS2883 rather than reaching for the original entry point.
- */
-export type { LogLevel } from '../../services/logger.js';
-export type { WebhookServiceConfig } from '../../services/webhook-service.js';
-export type { CoreSingletonServices, CoreUserSession, CreateWireServices, PostgresConfig, } from '../../types/core.types.js';
-export type { ApprovalRequester, Capabilities, } from '../../wirings/channel/channel-rpc.types.js';
-export type { PikkuChannel } from '../../wirings/channel/channel.types.js';
-export type { RawCLIResult } from '../../wirings/cli/channel/cli-raw-channel-runner.js';
-export type { WorkflowServiceConfig } from '../../wirings/workflow/workflow.types.js';

package/dist/ecosystem/cli/channel.js

@@ -1,2 +0,0 @@
-export { handleRawCLI } from '../../wirings/cli/channel/cli-raw-channel-runner.js';
-export { executeRawCLIViaChannel } from '../../wirings/cli/channel/cli-raw-client-runner.js';

package/dist/ecosystem/cli.d.ts

@@ -1,9 +0,0 @@
-export { CLIError, executeCLI, pikkuCLIRender, } from '../wirings/cli/cli-runner.js';
-export type { CLICommandMeta, CLIMeta, CLIProgramMeta, CoreCLI, CoreCLICommandConfig, CorePikkuCLIRender, } from '../wirings/cli/cli.types.js';
-export { generateCommandHelp } from '../wirings/cli/command-parser.js';
-/**
- * Types the exports above mention but do not themselves export. Without
- * them a consumer's declaration emit has no name for the type it infers,
- * and fails with TS2883 rather than reaching for the original entry point.
- */
-export type { CreateConfig, CreateSingletonServices, CreateWireServices, } from '../types/core.types.js';

package/dist/ecosystem/cli.js

@@ -1,2 +0,0 @@
-export { CLIError, executeCLI, pikkuCLIRender, } from '../wirings/cli/cli-runner.js';
-export { generateCommandHelp } from '../wirings/cli/command-parser.js';

package/dist/ecosystem/credential.d.ts

@@ -1,10 +0,0 @@
-export type { CredentialService } from '../services/credential-service.js';
-export type { CredentialDefinitions } from '../wirings/credential/credential.types.js';
-export { validateAndBuildCredentialDefinitionsMeta } from '../wirings/credential/validate-credential-definitions.js';
-/**
- * Types the exports above mention but do not themselves export. Without
- * them a consumer's declaration emit has no name for the type it infers,
- * and fails with TS2883 rather than reaching for the original entry point.
- */
-export type { SchemaRefLike } from '../types/core.types.js';
-export type { CredentialDefinitionsMeta } from '../wirings/credential/credential.types.js';

package/dist/ecosystem/credential.js

@@ -1 +0,0 @@
-export { validateAndBuildCredentialDefinitionsMeta } from '../wirings/credential/validate-credential-definitions.js';

package/dist/ecosystem/crypto-utils.d.ts

@@ -1,8 +0,0 @@
-export { deriveKEK, envelopeDecrypt, envelopeEncrypt, envelopeRewrap, generateKEKSalt, } from '../crypto-utils.js';
-export type { EnvelopeEncryptResult } from '../crypto-utils.js';
-/**
- * Types the exports above mention but do not themselves export. Without
- * them a consumer's declaration emit has no name for the type it infers,
- * and fails with TS2883 rather than reaching for the original entry point.
- */
-export type { WrappedValue } from '../data-classification.js';

package/dist/ecosystem/crypto-utils.js

@@ -1 +0,0 @@
-export { deriveKEK, envelopeDecrypt, envelopeEncrypt, envelopeRewrap, generateKEKSalt, } from '../crypto-utils.js';

package/dist/ecosystem/dev.d.ts

@@ -1,9 +0,0 @@
-export { pikkuDevReloader } from '../dev/hot-reload.js';
-export { reconcileAddonRegistry, reloadGeneratedMeta, } from '../dev/reload-meta.js';
-/**
- * Types the exports above mention but do not themselves export. Without
- * them a consumer's declaration emit has no name for the type it infers,
- * and fails with TS2883 rather than reaching for the original entry point.
- */
-export type { ReloadGeneratedMetaOptions } from '../dev/reload-meta.js';
-export type { Logger } from '../services/logger.js';

package/dist/ecosystem/dev.js

@@ -1,2 +0,0 @@
-export { pikkuDevReloader } from '../dev/hot-reload.js';
-export { reconcileAddonRegistry, reloadGeneratedMeta, } from '../dev/reload-meta.js';

package/dist/ecosystem/errors.d.ts

@@ -1,8 +0,0 @@
-export * from '../errors/errors.js';
-export { PikkuError, addError } from '../errors/error-handler.js';
-/**
- * Types the exports above mention but do not themselves export. Without
- * them a consumer's declaration emit has no name for the type it infers,
- * and fails with TS2883 rather than reaching for the original entry point.
- */
-export type { ErrorDetails } from '../errors/error-handler.js';

package/dist/ecosystem/errors.js

@@ -1,2 +0,0 @@
-export * from '../errors/errors.js';
-export { PikkuError, addError } from '../errors/error-handler.js';

package/dist/ecosystem/function.d.ts

@@ -1,13 +0,0 @@
-export { addFunction, getAllFunctionNames, } from '../function/function-runner.js';
-export { pikkuAuth } from '../function/functions.types.js';
-export type { CorePikkuAuth, CorePikkuAuthConfig, CorePikkuFunction, CorePikkuFunctionConfig, CorePikkuFunctionSessionless, CorePikkuPermission, CorePikkuSessionlessFunctionConfig, } from '../function/functions.types.js';
-export type { ListInput, ListOutput } from '../function/list.types.js';
-/**
- * Types the exports above mention but do not themselves export. Without
- * them a consumer's declaration emit has no name for the type it infers,
- * and fails with TS2883 rather than reaching for the original entry point.
- */
-export type { LogLevel } from '../services/logger.js';
-export type { WebhookServiceConfig } from '../services/webhook-service.js';
-export type { CoreSecretlessSingletonServices, CoreSingletonServices, CoreUserSession, PostgresConfig, SecretlessServices, } from '../types/core.types.js';
-export type { WorkflowServiceConfig } from '../wirings/workflow/workflow.types.js';

package/dist/ecosystem/function.js

@@ -1,2 +0,0 @@
-export { addFunction, getAllFunctionNames, } from '../function/function-runner.js';
-export { pikkuAuth } from '../function/functions.types.js';

package/dist/ecosystem/gateway.d.ts

@@ -1 +0,0 @@
-export type { GatewayTransportType, GatewaysMeta, } from '../wirings/gateway/gateway.types.js';

package/dist/ecosystem/gateway.js

@@ -1 +0,0 @@
-export {};

package/dist/ecosystem/hmac.d.ts

@@ -1 +0,0 @@
-export { hmacSha256Hex, timingSafeStringEqual } from '../utils/hmac.js';

package/dist/ecosystem/hmac.js

@@ -1 +0,0 @@
-export { hmacSha256Hex, timingSafeStringEqual } from '../utils/hmac.js';

package/dist/ecosystem/http.d.ts

@@ -1,13 +0,0 @@
-export { fetch, fetchData, wireHTTP } from '../wirings/http/http-runner.js';
-export type { AssertHTTPWiringParams, CoreHTTPFunctionWiring, HTTPMethod, HTTPRouteBaseConfig, HTTPWiringsMeta, PikkuHTTP, PikkuHTTPResponse, PikkuQuery, RunHTTPWiringOptions, } from '../wirings/http/http.types.js';
-export { logRoutes } from '../wirings/http/log-http-routes.js';
-export { DEFAULT_MAX_BODY_SIZE, PikkuFetchHTTPRequest, } from '../wirings/http/pikku-fetch-http-request.js';
-export { PikkuFetchHTTPResponse } from '../wirings/http/pikku-fetch-http-response.js';
-export { toWebRequest } from '../wirings/http/web-request.js';
-/**
- * Types the exports above mention but do not themselves export. Without
- * them a consumer's declaration emit has no name for the type it infers,
- * and fails with TS2883 rather than reaching for the original entry point.
- */
-export type { Logger } from '../services/logger.js';
-export type { PikkuHTTPRequest } from '../wirings/http/http.types.js';

package/dist/ecosystem/http.js

@@ -1,5 +0,0 @@
-export { fetch, fetchData, wireHTTP } from '../wirings/http/http-runner.js';
-export { logRoutes } from '../wirings/http/log-http-routes.js';
-export { DEFAULT_MAX_BODY_SIZE, PikkuFetchHTTPRequest, } from '../wirings/http/pikku-fetch-http-request.js';
-export { PikkuFetchHTTPResponse } from '../wirings/http/pikku-fetch-http-response.js';
-export { toWebRequest } from '../wirings/http/web-request.js';

package/dist/ecosystem/mcp.d.ts

@@ -1,3 +0,0 @@
-export { MCPEndpointRegistry } from '../wirings/mcp/mcp-endpoint-registry.js';
-export { MCPError, getMCPPromptsMeta, getMCPResourcesMeta, getMCPToolsMeta, runMCPPrompt, runMCPResource, runMCPTool, } from '../wirings/mcp/mcp-runner.js';
-export type { AssertMCPResourceURIParams, CoreMCPPrompt, CoreMCPResource, MCPPromptMeta, MCPResourceMeta, MCPToolMeta, MCPToolResponse, PikkuMCP, } from '../wirings/mcp/mcp.types.js';

package/dist/ecosystem/mcp.js

@@ -1,2 +0,0 @@
-export { MCPEndpointRegistry } from '../wirings/mcp/mcp-endpoint-registry.js';
-export { MCPError, getMCPPromptsMeta, getMCPResourcesMeta, getMCPToolsMeta, runMCPPrompt, runMCPResource, runMCPTool, } from '../wirings/mcp/mcp-runner.js';