@pikku/core 0.12.103 → 0.12.106

package/dist/index.js

@@ -1,25 +0,0 @@
-export { pikkuAgentMiddleware, pikkuChannelMiddleware, pikkuChannelMiddlewareFactory, pikkuMiddleware, pikkuMiddlewareFactory, } from './types/core.types.js';
-export { pikkuAuth, pikkuPermission, pikkuPermissionFactory, pikkuApprovalDescription, } from './function/functions.types.js';
-export { getAllFunctionNames } from './function/index.js';
-export { pikkuCLIRender } from './wirings/cli/cli-runner.js';
-export { PikkuRequest } from './pikku-request.js';
-export { getRelativeTimeOffsetFromNow, parseDurationString, } from './time-utils.js';
-export { formatVersionedId, isVersionedId, parseVersionedId, } from './version.js';
-export { AbandonedError } from './function/abort-scope.js';
-export { fetch } from './wirings/http/http-runner.js';
-export { AIProviderAuthError, AIProviderNotConfiguredError, BadGatewayError, BadRequestError, ConflictError, ExpectationFailedError, ForbiddenError, GatewayTimeoutError, GoneError, HTTPVersionNotSupportedError, InternalServerError, InvalidMiddlewareWireError, InvalidOriginError, InvalidSessionError, LengthRequiredError, LocalEnvironmentOnlyError, LockedError, MaxComputeTimeReachedError, MethodNotAllowedError, MissingCredentialError, MissingSchemaError, MissingScopeError, MissingServiceError, MissingSessionError, NotAcceptableError, NotFoundError, NotImplementedError, PayloadTooLargeError, PaymentRequiredError, PikkuMissingMetaError, PreconditionFailedError, ProxyAuthenticationRequiredError, RangeNotSatisfiableError, ReadonlySessionError, RequestTimeoutError, ServiceUnavailableError, TooManyRequestsError, URITooLongError, UnauthorizedError, UnprocessableContentError, UnsupportedMediaTypeError, } from './errors/errors.js';
-export { PikkuError, isExpectedError } from './errors/error-handler.js';
-export { SecretAccessDeniedError, withoutSecrets, } from './services/secretless.js';
-export { SecretHostNotAllowedError, assertSecretAllowedForHost, } from './services/secret-host-binding.js';
-export { NoopAuditService, createInvocationAudit, } from './services/audit-service.js';
-export { createGraph } from './wirings/workflow/graph/graph-node.js';
-export { wireAddon } from './wirings/rpc/wire-addon.js';
-export { wireRemoteAddon } from './wirings/rpc/wire-remote-addon.js';
-export { runMiddleware, addTagMiddleware } from './middleware-runner.js';
-export { addGlobalPermission, checkAuthPermissions } from './permissions.js';
-export { hasScopes, verifyScopes } from './scopes.js';
-export { isSerializable, stopSingletonServices, pikkuServerLifecycle, } from './utils.js';
-export { clearPikkuRuntimeState } from './test-utils.js';
-export { SchedulerService } from './services/scheduler-service.js';
-export { hashToken } from './column-form.js';
-export { createSecretValue, isSecretValue, SecretCoercionError, REDACTED, } from './secret-value.js';

package/dist/middleware/require-unlocked.d.ts

@@ -1,23 +0,0 @@
-import type { DataLock } from '../classification/data-lock.js';
-/**
- * Refuses a request while the encrypted store is locked.
- *
- * Applied by tag or route rather than globally, because the unlock endpoint and
- * the static frontend have to stay reachable — a store that gated its own
- * unlock screen could never be opened. Static mounts serve a file hit before
- * dispatch, so the app shell is already outside this gate; the unlock function
- * is the one wiring that must not carry it.
- *
- * The gate is deliberately in front of the function rather than inside the
- * query layer. Both refuse, but only this one refuses before the handler has
- * touched the database.
- */
-export declare const requireUnlocked: (lock: DataLock) => import("./middleware.types.js").CorePikkuMiddleware<import("../types/core.types.js").CoreSingletonServices<{
-    logLevel?: import("../services/logger.js").LogLevel;
-    secrets?: {
-        requireAllowedHosts?: boolean;
-    };
-    workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
-    webhook?: import("../services/webhook-service.js").WebhookServiceConfig;
-    postgres?: import("../types/core.types.js").PostgresConfig;
-}>, import("../types/core.types.js").CoreUserSession>;

package/dist/middleware/require-unlocked.js

@@ -1,21 +0,0 @@
-import { DataLockedError } from '../errors/errors.js';
-import { pikkuMiddleware } from './middleware-factories.js';
-/**
- * Refuses a request while the encrypted store is locked.
- *
- * Applied by tag or route rather than globally, because the unlock endpoint and
- * the static frontend have to stay reachable — a store that gated its own
- * unlock screen could never be opened. Static mounts serve a file hit before
- * dispatch, so the app shell is already outside this gate; the unlock function
- * is the one wiring that must not carry it.
- *
- * The gate is deliberately in front of the function rather than inside the
- * query layer. Both refuse, but only this one refuses before the handler has
- * touched the database.
- */
-export const requireUnlocked = (lock) => pikkuMiddleware(async (_services, _wires, next) => {
-    if (lock.state !== 'unlocked') {
-        throw new DataLockedError();
-    }
-    return next();
-});

package/dist/pikku-request.d.ts

@@ -1,8 +0,0 @@
-/**
- * @group RequestResponse
- */
-export declare abstract class PikkuRequest<In = any> {
-    #private;
-    constructor(data: In);
-    data(): Promise<In>;
-}

package/dist/pikku-request.js

@@ -1,15 +0,0 @@
-/**
- * @group RequestResponse
- */
-export class PikkuRequest {
-    #data;
-    constructor(data) {
-        this.#data = data;
-    }
-    async data() {
-        if (this.#data === undefined) {
-            throw new Error('Data not found');
-        }
-        return this.#data;
-    }
-}

package/dist/secret-value.d.ts

@@ -1,56 +0,0 @@
-import type { Secret } from './data-classification.js';
-declare const secretValueBrand: unique symbol;
-export declare const REDACTED = "[secret]";
-/** Runtime marker, resilient to duplicate copies of core. */
-declare const SECRET_VALUE: unique symbol;
-declare const NODE_INSPECT: unique symbol;
-export declare class SecretCoercionError extends Error {
-    constructor();
-}
-/**
- * A vault secret. Nominal, so it is not assignable to `string` and every
- * concretely-typed sink rejects it; `.reveal()` is the one way out, and every
- * call is a deliberate, greppable disclosure.
- *
- * The revealed value carries the erasable `Secret<T>` classification brand, so
- * the inspector can still follow it one hop past the call.
- *
- * Structured serialization redacts to `[secret]` — an audit or log write must
- * stay honest about the field without crashing the request. String coercion
- * throws, because a template literal or concatenation is always a leak.
- */
-export declare class SecretValue<T = string> {
-    #private;
-    readonly [secretValueBrand]: true;
-    readonly [SECRET_VALUE] = true;
-    constructor(value: T);
-    reveal(): Secret<T>;
-    toJSON(): string;
-    [NODE_INSPECT](): string;
-    toString(): never;
-    [Symbol.toPrimitive](): never;
-}
-export declare const createSecretValue: <T>(value: T) => SecretValue<T>;
-export declare const isSecretValue: (value: unknown) => value is SecretValue<unknown>;
-type IsAny<T> = 0 extends 1 & T ? true : false;
-type Passthrough = Function | Date | RegExp | Error | ArrayBuffer | ArrayBufferView;
-/**
- * Rejects a `SecretValue` anywhere in `T`, however deeply nested, by collapsing
- * it to `never`.
- *
- * For sinks whose parameters are `any`, `unknown` or a free generic — loggers,
- * queue payloads, channel messages — where nominality alone cannot help.
- * `any` is passed through untouched: it cannot be guarded, and collapsing it
- * would reject every legitimate call.
- *
- * `Promise`, `Map` and `Set` are recursed into rather than passed through. A
- * mapped type cannot reach what they hold — mapping their keys yields their
- * methods, not their contents — so treating them as opaque let a secret ride
- * through inside one. `Promise` is the case that bites: `getSecret()` returns
- * `Promise<SecretValue<T>>`, so a forgotten `await` would otherwise log a
- * secret.
- */
-export type Safe<T> = IsAny<T> extends true ? T : [Extract<T, SecretValue<any>>] extends [never] ? T extends Promise<infer V> ? Promise<Safe<V>> : T extends Map<infer K, infer V> ? Map<Safe<K>, Safe<V>> : T extends Set<infer V> ? Set<Safe<V>> : T extends Passthrough ? T : T extends object ? {
-    [K in keyof T]: Safe<T[K]>;
-} : T : never;
-export {};

package/dist/secret-value.js

@@ -1,46 +0,0 @@
-export const REDACTED = '[secret]';
-/** Runtime marker, resilient to duplicate copies of core. */
-const SECRET_VALUE = Symbol.for('pikku.secretValue');
-const NODE_INSPECT = Symbol.for('nodejs.util.inspect.custom');
-export class SecretCoercionError extends Error {
-    constructor() {
-        super(`A secret was coerced to a string, which would write it out in the clear. Unwrap it deliberately with .reveal() at the point it reaches the wire.`);
-        this.name = 'SecretCoercionError';
-    }
-}
-/**
- * A vault secret. Nominal, so it is not assignable to `string` and every
- * concretely-typed sink rejects it; `.reveal()` is the one way out, and every
- * call is a deliberate, greppable disclosure.
- *
- * The revealed value carries the erasable `Secret<T>` classification brand, so
- * the inspector can still follow it one hop past the call.
- *
- * Structured serialization redacts to `[secret]` — an audit or log write must
- * stay honest about the field without crashing the request. String coercion
- * throws, because a template literal or concatenation is always a leak.
- */
-export class SecretValue {
-    [SECRET_VALUE] = true;
-    #value;
-    constructor(value) {
-        this.#value = value;
-    }
-    reveal() {
-        return this.#value;
-    }
-    toJSON() {
-        return REDACTED;
-    }
-    [NODE_INSPECT]() {
-        return REDACTED;
-    }
-    toString() {
-        throw new SecretCoercionError();
-    }
-    [Symbol.toPrimitive]() {
-        throw new SecretCoercionError();
-    }
-}
-export const createSecretValue = (value) => new SecretValue(value);
-export const isSecretValue = (value) => typeof value === 'object' && value !== null && SECRET_VALUE in value;

package/dist/wirings/data-lock/data-lock-wiring.d.ts

@@ -1,40 +0,0 @@
-import type { DataLock, LockState } from '../../classification/data-lock.js';
-export type DataLockStatus = {
-    state: LockState;
-    /**
-     * Milliseconds before another guess will be looked at, or 0.
-     *
-     * The unlock screen shows this as a countdown; without it the only way to
-     * learn the wait is over is to guess again, and a guess made during a
-     * lockout is itself a failure that extends it.
-     */
-    retryAfterMs: number;
-};
-export type DataLockWiringOptions = {
-    /** Where the lock routes are mounted. Defaults to `/_pikku/data`. */
-    prefix?: string;
-    /**
-     * Which keys first-run initialization mints. Derive it with
-     * `keyIdsFromManifest`.
-     *
-     * It is fixed here rather than sent by the caller because the unlock screen
-     * posts a passphrase and nothing else — and because a key the schema names
-     * but nobody minted does not fail at startup, it fails at the first write to
-     * that one column.
-     */
-    keyIds?: string[];
-};
-/**
- * Puts the passphrase gate on HTTP, so unlocking is a page in the app rather
- * than a prompt in whatever happens to have launched the server.
- *
- * That is what lets one story cover both shapes pikku ships in: a desktop
- * build whose window is pointed at the local server, and a headless
- * `pikku serve` somewhere else, unlock the same way and share the unlock
- * screen. A native prompt in the desktop shell would have left the headless
- * case with nothing.
- *
- * The routes are registered here rather than generated because they belong to
- * core: an app has no source file for them to be discovered in.
- */
-export declare const wireDataLock: (lock: DataLock, { prefix, keyIds }?: DataLockWiringOptions) => void;

package/dist/wirings/data-lock/data-lock-wiring.js

@@ -1,77 +0,0 @@
-import { pikkuState } from '../../pikku-state.js';
-import { wireHTTP } from '../http/http-runner.js';
-import { httpRouter } from '../http/routers/http-router.js';
-const helperFunctionMeta = (funcId) => ({
-    pikkuFuncId: funcId,
-    sessionless: true,
-    functionType: 'helper',
-    inputSchemaName: null,
-    outputSchemaName: null,
-});
-const DEFAULT_PREFIX = '/_pikku/data';
-/**
- * Puts the passphrase gate on HTTP, so unlocking is a page in the app rather
- * than a prompt in whatever happens to have launched the server.
- *
- * That is what lets one story cover both shapes pikku ships in: a desktop
- * build whose window is pointed at the local server, and a headless
- * `pikku serve` somewhere else, unlock the same way and share the unlock
- * screen. A native prompt in the desktop shell would have left the headless
- * case with nothing.
- *
- * The routes are registered here rather than generated because they belong to
- * core: an app has no source file for them to be discovered in.
- */
-export const wireDataLock = (lock, { prefix = DEFAULT_PREFIX, keyIds } = {}) => {
-    const status = () => ({
-        state: lock.state,
-        retryAfterMs: lock.retryAfterMs,
-    });
-    register(prefix, 'get', '/status', 'pikkuDataLockStatus', async () => status());
-    register(prefix, 'post', '/initialize', 'pikkuDataLockInitialize', async (_services, { passphrase }) => {
-        await lock.initialize(passphrase, keyIds);
-        return status();
-    });
-    register(prefix, 'post', '/unlock', 'pikkuDataLockUnlock', async (_services, { passphrase }) => {
-        await lock.unlock(passphrase);
-        return status();
-    });
-    register(prefix, 'post', '/lock', 'pikkuDataLockLock', async (_services, { passphrase }) => {
-        // Locking proves ownership first. An open POST here would be a
-        // one-request denial of service: the store shuts and stays shut until
-        // someone is around to type the passphrase back in.
-        await lock.unlock(passphrase);
-        lock.lock();
-        return status();
-    });
-    // A router that has already compiled its table would otherwise answer 404
-    // for everything registered after it woke up.
-    httpRouter.reset();
-};
-const register = (prefix, method, path, funcId, func) => {
-    const route = `${prefix}${path}`;
-    const routes = pikkuState(null, 'http', 'routes');
-    if (routes.get(method)?.has(route)) {
-        return;
-    }
-    const httpMeta = pikkuState(null, 'http', 'meta');
-    httpMeta[method][route] = {
-        pikkuFuncId: funcId,
-        route,
-        method,
-        // Never a session. The gate cannot sit in front of its own key: a session
-        // may itself live in a column this lock is holding shut.
-        auth: false,
-        requiresSession: false,
-    };
-    const functionsMeta = pikkuState(null, 'function', 'meta');
-    if (!functionsMeta[funcId]) {
-        functionsMeta[funcId] = helperFunctionMeta(funcId);
-    }
-    wireHTTP({
-        method,
-        route,
-        func: { func },
-        auth: false,
-    });
-};

package/dist/wirings/data-lock/index.d.ts

@@ -1,9 +0,0 @@
-/**
- * The HTTP face of {@link DataLock}: the routes an unlock screen talks to.
- *
- * Separate from `@pikku/core/classification` on purpose — that entry point is
- * types and crypto, and a runtime that never serves HTTP should not have to
- * load a router to use it.
- */
-export { wireDataLock } from './data-lock-wiring.js';
-export type { DataLockStatus, DataLockWiringOptions, } from './data-lock-wiring.js';

package/dist/wirings/data-lock/index.js

@@ -1,8 +0,0 @@
-/**
- * The HTTP face of {@link DataLock}: the routes an unlock screen talks to.
- *
- * Separate from `@pikku/core/classification` on purpose — that entry point is
- * types and crypto, and a runtime that never serves HTTP should not have to
- * load a router to use it.
- */
-export { wireDataLock } from './data-lock-wiring.js';

package/dist/wirings/rpc/addon-runner.d.ts

@@ -1,17 +0,0 @@
-import type { CoreSingletonServices } from '../../types/core.types.js';
-export type AddonInstance = {
-    namespace: string;
-    secretOverrides?: Record<string, string>;
-    variableOverrides?: Record<string, string>;
-    credentialOverrides?: Record<string, string>;
-    /** Set by the consuming app: secrets it lends this instance, as the addon names them. */
-    secretGrants?: string[];
-    /** Set by the consuming app: credentials it lends this instance, as the addon names them. */
-    credentialGrants?: string[];
-    /** Set by the consuming app to opt this instance out of secret scoping. */
-    globalSecrets?: string;
-    /** Set by the consuming app to opt this instance out of credential scoping. */
-    globalCredentials?: string;
-};
-export declare const getOrCreatePackageSingletonServices: (packageName: string, parentServices: CoreSingletonServices, addonInstance?: AddonInstance) => Promise<CoreSingletonServices>;
-export declare const addonInstanceForNamespace: (namespace: string | undefined, expectedPackage: string) => AddonInstance | undefined;

package/dist/wirings/rpc/addon-runner.js

@@ -1,150 +0,0 @@
-import { pikkuState } from '../../pikku-state.js';
-import { ScopedSecretService } from '../../services/scoped-secret-service.js';
-import { ScopedCredentialService } from '../../services/scoped-credential-service.js';
-/**
- * What the addon declared, plus what the host lent it. Scoping runs outside the
- * aliaser, so every name here is the one the addon reads — which is why an
- * override's *key* grants, and its value does not.
- */
-const allowedNames = (declared, grants, overrides) => new Set([
-    ...(declared ?? []),
-    ...(grants ?? []),
-    ...Object.keys(overrides ?? {}),
-]);
-const aliasSecretService = (secrets, overrides) => {
-    const map = (key) => overrides[key] ?? key;
-    return {
-        getSecret: (key) => secrets.getSecret(map(key)),
-        hasSecret: (key) => secrets.hasSecret(map(key)),
-        setSecret: (key, value) => secrets.setSecret(map(key), value),
-        deleteSecret: (key) => secrets.deleteSecret(map(key)),
-        getSecrets: async (keys) => {
-            const result = await secrets.getSecrets(keys.map(map));
-            const out = {};
-            for (const logical of keys) {
-                const real = map(logical);
-                if (real in result)
-                    out[logical] = result[real];
-            }
-            return out;
-        },
-    };
-};
-const aliasVariablesService = (variables, overrides) => {
-    const map = (name) => overrides[name] ?? name;
-    return {
-        get: (name) => variables.get(map(name)),
-        getVariables: (names) => {
-            const result = variables.getVariables(names.map(map));
-            const remap = (r) => {
-                const out = {};
-                for (const logical of names) {
-                    const real = map(logical);
-                    if (real in r)
-                        out[logical] = r[real];
-                }
-                return out;
-            };
-            return result instanceof Promise
-                ? result.then(remap)
-                : remap(result);
-        },
-        getAll: () => variables.getAll(),
-        set: (name, value) => variables.set(map(name), value),
-        has: (name) => variables.has(map(name)),
-        delete: (name) => variables.delete(map(name)),
-    };
-};
-const findAddonNamespaceForPackage = (packageName) => {
-    const addons = pikkuState(null, 'addons', 'packages');
-    if (!addons)
-        return null;
-    for (const [namespace, cfg] of addons.entries()) {
-        if (cfg?.package === packageName)
-            return namespace;
-    }
-    return null;
-};
-const wrapWorkflowServiceForPackage = (service, packageName, namespace) => {
-    return new Proxy(service, {
-        get(target, prop, receiver) {
-            if (prop === 'startWorkflow' || prop === 'runToCompletion') {
-                const original = Reflect.get(target, prop, receiver);
-                return function (name, ...rest) {
-                    if (typeof name === 'string' && !name.includes(':')) {
-                        const ns = namespace ?? findAddonNamespaceForPackage(packageName);
-                        if (ns) {
-                            name = `${ns}:${name}`;
-                        }
-                    }
-                    return original.call(this, name, ...rest);
-                };
-            }
-            return Reflect.get(target, prop, receiver);
-        },
-    });
-};
-export const getOrCreatePackageSingletonServices = async (packageName, parentServices, addonInstance) => {
-    const cacheKey = addonInstance?.namespace ?? packageName;
-    const cachedServices = pikkuState(cacheKey, 'package', 'singletonServices');
-    if (cachedServices) {
-        return cachedServices;
-    }
-    const factories = pikkuState(packageName, 'package', 'factories');
-    let existingServices = parentServices;
-    if (addonInstance?.secretOverrides && parentServices.secrets) {
-        existingServices = {
-            ...existingServices,
-            secrets: aliasSecretService(parentServices.secrets, addonInstance.secretOverrides),
-        };
-    }
-    if (addonInstance?.variableOverrides && parentServices.variables) {
-        existingServices = {
-            ...existingServices,
-            variables: aliasVariablesService(parentServices.variables, addonInstance.variableOverrides),
-        };
-    }
-    if (!addonInstance?.globalSecrets && existingServices.secrets) {
-        existingServices = {
-            ...existingServices,
-            secrets: new ScopedSecretService(existingServices.secrets, allowedNames(pikkuState(packageName, 'package', 'declaredSecrets'), addonInstance?.secretGrants, addonInstance?.secretOverrides)),
-        };
-    }
-    if (!addonInstance?.globalCredentials && existingServices.credentialService) {
-        existingServices = {
-            ...existingServices,
-            credentialService: new ScopedCredentialService(existingServices.credentialService, allowedNames(Object.keys(pikkuState(packageName, 'package', 'credentialsMeta') ?? {}), addonInstance?.credentialGrants, addonInstance?.credentialOverrides)),
-        };
-    }
-    if (!factories || !factories.createSingletonServices) {
-        return existingServices;
-    }
-    let config = existingServices.config;
-    if (factories.createConfig) {
-        config = await factories.createConfig(existingServices.variables);
-    }
-    const packageServices = await factories.createSingletonServices(config, existingServices);
-    if (packageServices.workflowService &&
-        typeof packageServices.workflowService === 'object') {
-        packageServices.workflowService = wrapWorkflowServiceForPackage(packageServices.workflowService, packageName, addonInstance?.namespace ?? null);
-    }
-    pikkuState(cacheKey, 'package', 'singletonServices', packageServices);
-    return packageServices;
-};
-export const addonInstanceForNamespace = (namespace, expectedPackage) => {
-    if (!namespace)
-        return undefined;
-    const cfg = pikkuState(null, 'addons', 'packages').get(namespace);
-    if (!cfg || cfg.package !== expectedPackage)
-        return undefined;
-    return {
-        namespace,
-        secretOverrides: cfg.secretOverrides,
-        variableOverrides: cfg.variableOverrides,
-        credentialOverrides: cfg.credentialOverrides,
-        secretGrants: cfg.secretGrants,
-        credentialGrants: cfg.credentialGrants,
-        globalSecrets: cfg.globalSecrets,
-        globalCredentials: cfg.globalCredentials,
-    };
-};

package/dist/wirings/rpc/remote-addon-auth.d.ts

@@ -1,16 +0,0 @@
-import type { CoreServices, PikkuRawWire } from '../../types/core.types.js';
-import { PikkuError } from '../../errors/error-handler.js';
-import { type SecretValue } from '../../classification/secret-value.js';
-export type RemoteAddonAuthBinding = {
-    credentialId: string;
-} | {
-    secretId: string;
-} | {
-    resolve: (services: CoreServices, wire: PikkuRawWire) => string | SecretValue<string> | Promise<string | SecretValue<string>>;
-};
-export declare class RemoteAddonAuthError extends PikkuError {
-    readonly namespace: string;
-    constructor(namespace: string, detail: string);
-}
-/** Returns `null` only when no auth is bound; an empty resolved token throws. */
-export declare function resolveRemoteAddonToken(auth: RemoteAddonAuthBinding | undefined, services: CoreServices, wire: PikkuRawWire, namespace: string): Promise<string | null>;

package/dist/wirings/rpc/remote-addon-auth.js

@@ -1,39 +0,0 @@
-import { PikkuError, addError } from '../../errors/error-handler.js';
-import { isSecretValue, } from '../../classification/secret-value.js';
-export class RemoteAddonAuthError extends PikkuError {
-    namespace;
-    constructor(namespace, detail) {
-        super(`Remote addon '${namespace}' auth could not be resolved: ${detail}`);
-        this.namespace = namespace;
-    }
-}
-addError(RemoteAddonAuthError, {
-    status: 401,
-    message: 'Remote addon authentication could not be resolved.',
-});
-/** Returns `null` only when no auth is bound; an empty resolved token throws. */
-export async function resolveRemoteAddonToken(auth, services, wire, namespace) {
-    if (!auth) {
-        return null;
-    }
-    let token;
-    if ('credentialId' in auth) {
-        if (typeof wire.getCredential !== 'function') {
-            throw new RemoteAddonAuthError(namespace, `credentialId '${auth.credentialId}' requires a wire with credential access`);
-        }
-        token = await wire.getCredential(auth.credentialId);
-    }
-    else if ('secretId' in auth) {
-        token = await services.secrets.getSecret(auth.secretId);
-    }
-    else if (typeof auth.resolve === 'function') {
-        token = await auth.resolve(services, wire);
-    }
-    // The wire is where a secret is meant to end up, so unwrap it here rather
-    // than at each branch — `resolve` and `getCredential` may hand one back too.
-    const resolved = isSecretValue(token) ? token.reveal() : token;
-    if (resolved === null || resolved === undefined || resolved === '') {
-        throw new RemoteAddonAuthError(namespace, 'resolved token was empty');
-    }
-    return String(resolved);
-}

package/dist/wirings/rpc/wire-addon.d.ts

@@ -1,62 +0,0 @@
-import type { CorePikkuMiddleware } from '../../middleware/middleware.types.js';
-export type WireAddonConfig = {
-    name: string;
-    package: string;
-    rpcEndpoint?: string;
-    auth?: boolean;
-    mcp?: boolean;
-    tags?: string[];
-    /** Required of every function in the addon, on top of the function's own. */
-    scopes?: string[];
-    secretOverrides?: Record<string, string>;
-    variableOverrides?: Record<string, string>;
-    credentialOverrides?: Record<string, string>;
-    /**
-     * Secrets this instance may read on top of the ones it declared, named as the
-     * addon reads them — the scope check runs before `secretOverrides` renames
-     * them, so an overridden secret is named here by its addon-side key. Listing
-     * one in `secretOverrides` grants it too.
-     *
-     * For an addon whose secret names come off its input rather than its own
-     * source, this is how the host lends names the addon could not declare.
-     */
-    secretGrants?: string[];
-    /** Credentials this instance may read on top of the ones it declared. */
-    credentialGrants?: string[];
-    /**
-     * Hands this instance the whole `SecretService` instead of one scoped to the
-     * secrets it declared. The value is the reason, recorded in the deploy
-     * manifest — an addon that names secrets at runtime cannot be scoped, and
-     * only the consuming app, never the addon, can grant it.
-     */
-    globalSecrets?: string;
-    /**
-     * Hands this instance the whole `CredentialService` instead of one narrowed
-     * to the credentials it declared. The value is the reason, recorded in the
-     * deploy manifest, and only the consuming app can grant it.
-     */
-    globalCredentials?: string;
-};
-export declare const wireAddon: (config: WireAddonConfig) => void;
-/**
- * knowledge: decisions/security/addon-scopes-are-resolved-where-the-function-runs.md
- */
-export declare const resolveAddonScopes: (packageName: string | null, namespace?: string) => string[];
-/**
- * knowledge: decisions/security/addon-auth-and-tags-only-tighten.md
- */
-export declare const resolveAddonTags: (packageName: string | null, namespace?: string) => string[];
-/**
- * True when any governing instance requires a session. `auth: false` is not
- * honoured here — on a direct wiring it would weaken the wiring's own gate.
- *
- * knowledge: decisions/security/addon-auth-and-tags-only-tighten.md
- */
-export declare const resolveAddonAuth: (packageName: string | null, namespace?: string) => boolean;
-/**
- * Addon tags name middleware the *consuming app* registered, so they resolve
- * against the root tag groups rather than the addon package's own.
- *
- * knowledge: decisions/security/addon-auth-and-tags-only-tighten.md
- */
-export declare const resolveAddonTagMiddleware: (packageName: string | null, namespace?: string) => CorePikkuMiddleware[];