@pikku/core 0.12.106 → 0.12.111

package/src/production-barrels-stay-lean.test.ts

@@ -1,110 +0,0 @@
-import { describe, test } from 'node:test'
-import assert from 'node:assert/strict'
-import { existsSync, readFileSync } from 'node:fs'
-import { fileURLToPath } from 'node:url'
-import { join, dirname, resolve, relative } from 'node:path'
-
-const srcRoot = dirname(fileURLToPath(import.meta.url))
-
-/**
- * Statements that only move types. TypeScript erases them, so they cost a
- * production bundle nothing and are deliberately not followed.
- */
-const TYPE_ONLY = /^\s*(?:import|export)\s+type\b/
-
-/**
- * The modules a production server must never load by importing a barrel.
- *
- * Each is scenario or virtual-user runtime: `http-personas` signs personas in
- * and reaches the actor-flow conversation runner, which reaches the agent
- * runner. None of it runs in production, and an unbundled Node or Lambda deploy
- * does no tree-shaking — it loads whatever the graph names.
- */
-const FORBIDDEN = [
-  'services/http-personas.ts',
-  'wirings/actor-flow/run-conversation.ts',
-  'wirings/workflow/pikku-scenario-service.ts',
-]
-
-const resolveSpecifier = (fromFile: string, specifier: string) => {
-  const base = resolve(dirname(fromFile), specifier.replace(/\.js$/, ''))
-  for (const candidate of [`${base}.ts`, join(base, 'index.ts')]) {
-    if (existsSync(candidate)) return candidate
-  }
-  return undefined
-}
-
-/**
- * Every module loaded as a side effect of importing `entry`, following value
- * imports only.
- *
- * A dynamic `await import(...)` is not followed: it does not run at module
- * init, which is the whole reason `pikku-scenario-service` reaches
- * `http-personas` that way.
- */
-const runtimeGraph = (entry: string): Set<string> => {
-  const seen = new Set<string>()
-  const queue = [entry]
-
-  while (queue.length) {
-    const file = queue.pop()!
-    if (seen.has(file)) continue
-    seen.add(file)
-
-    for (const line of readFileSync(file, 'utf-8').split('\n')) {
-      if (TYPE_ONLY.test(line)) continue
-      const specifier = line.match(/\bfrom\s+'(\.[^']+)'/)?.[1]
-      if (!specifier) continue
-      const target = resolveSpecifier(file, specifier)
-      if (target) queue.push(target)
-    }
-  }
-
-  return seen
-}
-
-describe('production barrels stay lean', () => {
-  for (const barrel of ['services/index.ts', 'wirings/workflow/index.ts']) {
-    test(`@pikku/core ${barrel} does not load scenario runtime`, () => {
-      const reached = runtimeGraph(join(srcRoot, barrel))
-      const offenders = FORBIDDEN.filter((module) =>
-        reached.has(join(srcRoot, module))
-      )
-
-      assert.deepEqual(
-        offenders,
-        [],
-        `${barrel} pulls scenario runtime into every app that imports it:\n` +
-          `${offenders.join('\n')}\n` +
-          `Export the value from '@pikku/core/persona' instead — types may stay here.`
-      )
-    })
-  }
-
-  test('the persona entry point still exports the runtime that moved', async () => {
-    const persona = await import('./wirings/persona/index.js')
-
-    for (const name of [
-      'createHttpPersonas',
-      'HttpPersona',
-      'postScenarioJson',
-      'readScenarioHttpResponse',
-    ]) {
-      assert.ok(
-        name in persona,
-        `@pikku/core/persona no longer exports ${name}; it has to live somewhere`
-      )
-    }
-  })
-
-  test('the graph walker actually reaches things', () => {
-    // Guards the test above: a walker that silently resolved nothing would pass
-    // no matter what the barrels imported.
-    const reached = runtimeGraph(join(srcRoot, 'wirings/persona/index.ts'))
-    assert.ok(
-      reached.has(join(srcRoot, 'services/http-personas.ts')),
-      `walker failed to reach a known value import; reached ${reached.size} files:\n` +
-        [...reached].map((f) => relative(srcRoot, f)).join('\n')
-    )
-  })
-})

package/src/public-surface.test.ts

@@ -1,133 +0,0 @@
-import { describe, test } from 'node:test'
-import assert from 'node:assert/strict'
-import { readdirSync, readFileSync } from 'node:fs'
-import { fileURLToPath, pathToFileURL } from 'node:url'
-import { dirname, join, resolve } from 'node:path'
-
-const srcRoot = dirname(fileURLToPath(import.meta.url))
-const packageRoot = join(srcRoot, '..')
-
-const packageJson = JSON.parse(
-  readFileSync(join(packageRoot, 'package.json'), 'utf-8')
-)
-const expected: Record<string, string[]> = JSON.parse(
-  readFileSync(join(srcRoot, 'public-surface.json'), 'utf-8')
-)
-
-const subpaths = packageJson.exports as Record<string, string>
-
-/**
- * `exports` entries, with a wildcard subpath replaced by the files it matches.
- *
- * A wildcard subpath would pin a pattern rather than a surface, and a module
- * dropped into the matched directory would appear in the published API without
- * a diff. Expanding it is what keeps every entry point's exports in
- * `public-surface.json` under the same guarantee. `exports` declares none
- * today, and this keeps that from being a silent assumption.
- */
-const entryPoints = (): [string, string][] =>
-  Object.entries(subpaths).flatMap(([subpath, dist]) => {
-    if (!subpath.includes('*')) return [[subpath, dist] as [string, string]]
-
-    const [prefix] = dist.split('*') as [string]
-    const directory = resolve(packageRoot, prefix.replace('./dist/', './src/'))
-    return readdirSync(directory, { recursive: true, encoding: 'utf-8' })
-      .filter((file) => file.endsWith('.ts') && !file.endsWith('.d.ts'))
-      .map((file) => file.slice(0, -'.ts'.length))
-      .sort()
-      .map(
-        (area) =>
-          [subpath.replace('*', area), dist.replace('*', area)] as [
-            string,
-            string,
-          ]
-      )
-  })
-
-/**
- * Every runtime export reachable through an entry point, keyed by subpath.
- *
- * Types are absent: they are erased before this can see them, so a type-only
- * addition is not pinned here.
- */
-const actualSurface = async () => {
-  const surface: Record<string, string[]> = {}
-  for (const [subpath, dist] of entryPoints()) {
-    const src = resolve(packageRoot, dist.replace('./dist/', './src/'))
-    const module = await import(pathToFileURL(src).href)
-    surface[subpath] = Object.keys(module).sort()
-  }
-  return surface
-}
-
-const REGENERATE =
-  'Regenerate with the snippet in public-surface.json.README, and make sure ' +
-  'every added name is one @pikku/core means to publish.'
-
-describe('the published surface is the surface we meant to publish', () => {
-  test('every export subpath resolves to a source file', () => {
-    const missing = entryPoints().filter(([, dist]) => {
-      try {
-        readFileSync(
-          resolve(packageRoot, dist.replace('./dist/', './src/')).replace(
-            /\.js$/,
-            '.ts'
-          )
-        )
-        return false
-      } catch {
-        return true
-      }
-    })
-
-    assert.deepEqual(
-      missing.map(([subpath]) => subpath),
-      [],
-      'package.json exports point at files that do not exist in src'
-    )
-  })
-
-  test('no entry point gained or lost a runtime export', async () => {
-    const actual = await actualSurface()
-
-    assert.deepEqual(
-      Object.keys(actual).sort(),
-      Object.keys(expected).sort(),
-      `the set of export subpaths changed. ${REGENERATE}`
-    )
-
-    for (const subpath of Object.keys(expected)) {
-      const added = actual[subpath]!.filter(
-        (name) => !expected[subpath]!.includes(name)
-      )
-      const removed = expected[subpath]!.filter(
-        (name) => !actual[subpath]!.includes(name)
-      )
-
-      assert.deepEqual(
-        { added, removed },
-        { added: [], removed: [] },
-        `'${subpath}' changed its public exports.\n` +
-          (added.length ? `  added:   ${added.join(', ')}\n` : '') +
-          (removed.length ? `  removed: ${removed.join(', ')}\n` : '') +
-          `${REGENERATE}`
-      )
-    }
-  })
-
-  test('the wildcard re-exports have not widened past their barrels', async () => {
-    // `errors/index.ts` and `dev/hot-reload.ts` re-export with `export *`, so a
-    // new export in the wrapped module is published without anyone editing an
-    // entry point. This pins the two that are reachable publicly.
-    const actual = await actualSurface()
-
-    assert.equal(
-      actual['./errors']!.every(
-        (name) => name.endsWith('Error') || name.startsWith('addError')
-      ),
-      true,
-      `'@pikku/core/errors' exports something that is not an error or an error ` +
-        `registrar: ${actual['./errors']!.filter((n) => !n.endsWith('Error') && !n.startsWith('addError')).join(', ')}`
-    )
-  })
-})

package/src/remote.test.ts

@@ -1,173 +0,0 @@
-import { describe, test, beforeEach } from 'node:test'
-import assert from 'node:assert'
-import { buildRemoteHeaders } from './remote.js'
-import { pikkuRemoteAuthMiddleware } from './middleware/remote-auth.js'
-import { resetPikkuState } from './pikku-state.js'
-import { WeakKeyMaterialError } from './errors/errors.js'
-import { createSecretValue } from './classification/secret-value.js'
-
-beforeEach(() => {
-  resetPikkuState()
-})
-
-const STRONG_SECRET = 'a'.repeat(43)
-const WEAK_SECRET = 'dev-remote-secret'
-
-const createSecrets = (secret: string) => ({
-  getSecret: async (key: string) => {
-    if (key === 'PIKKU_REMOTE_SECRET') return createSecretValue(secret)
-    throw new Error(`Secret ${key} not found`)
-  },
-})
-
-/**
- * Signing is deliberately free here so the measurement isolates key derivation.
- */
-const createJWT = () => ({
-  encode: async (_expiresIn: unknown, payload: unknown) =>
-    Buffer.from(JSON.stringify(payload)).toString('base64url'),
-  decode: async (token: string) =>
-    JSON.parse(Buffer.from(token, 'base64url').toString('utf-8')),
-})
-
-const createRequest = (
-  headers: Record<string, string>,
-  path = '/remote/rpc/myFunc'
-) => ({
-  header: (name: string) => headers[name.toLowerCase()] || headers[name],
-  path: () => path,
-  method: () => 'POST',
-})
-
-const roundTrip = async (secret: string, session: unknown) => {
-  const jwt = createJWT()
-  const secrets = createSecrets(secret)
-
-  const headers = await buildRemoteHeaders(
-    jwt as any,
-    secrets as any,
-    'myFunc',
-    session
-  )
-
-  let received: unknown
-  await pikkuRemoteAuthMiddleware(
-    { secrets, jwt } as any,
-    {
-      http: {
-        request: createRequest({ authorization: headers.authorization! }),
-      },
-      setSession: async (s: unknown) => {
-        received = s
-      },
-    } as any,
-    async () => {}
-  )
-  return received
-}
-
-describe('remote RPC session round trip', () => {
-  test('round-trips the session through header build and middleware verify', async () => {
-    const session = { userId: 'user-1', role: 'admin' }
-    assert.deepStrictEqual(await roundTrip(STRONG_SECRET, session), session)
-  })
-
-  test('a header built with one secret is rejected by a peer holding another', async () => {
-    const jwt = createJWT()
-    const headers = await buildRemoteHeaders(
-      jwt as any,
-      createSecrets(STRONG_SECRET) as any,
-      'myFunc',
-      { userId: 'user-1' }
-    )
-
-    await assert.rejects(() =>
-      pikkuRemoteAuthMiddleware(
-        { secrets: createSecrets('b'.repeat(43)), jwt } as any,
-        {
-          http: {
-            request: createRequest({ authorization: headers.authorization! }),
-          },
-          setSession: async () => {},
-        } as any,
-        async () => {}
-      )
-    )
-  })
-
-  test('a full round trip stays under the per-hop latency budget', async () => {
-    const session = { userId: 'user-1', role: 'admin' }
-
-    // Warm up so the measurement excludes module/JIT startup.
-    await roundTrip(STRONG_SECRET, session)
-
-    const iterations = 5
-    const start = performance.now()
-    for (let i = 0; i < iterations; i++) {
-      await roundTrip(STRONG_SECRET, session)
-    }
-    const perRoundTrip = (performance.now() - start) / iterations
-
-    assert.ok(
-      perRoundTrip < 20,
-      `remote RPC round trip took ${perRoundTrip.toFixed(1)}ms, budget is 20ms`
-    )
-  })
-})
-
-describe('PIKKU_REMOTE_SECRET strength', () => {
-  test('buildRemoteHeaders rejects a secret shorter than 32 characters', async () => {
-    await assert.rejects(
-      () =>
-        buildRemoteHeaders(
-          createJWT() as any,
-          createSecrets(WEAK_SECRET) as any,
-          'myFunc',
-          { userId: 'user-1' }
-        ),
-      (err: unknown) => err instanceof WeakKeyMaterialError
-    )
-  })
-
-  test('buildRemoteHeaders rejects a weak secret even with no session to encrypt', async () => {
-    await assert.rejects(
-      () =>
-        buildRemoteHeaders(
-          createJWT() as any,
-          createSecrets(WEAK_SECRET) as any,
-          'myFunc'
-        ),
-      (err: unknown) => err instanceof WeakKeyMaterialError
-    )
-  })
-
-  test('the middleware rejects a weak secret rather than authenticating with it', async () => {
-    const jwt = createJWT()
-    const headers = await buildRemoteHeaders(
-      jwt as any,
-      createSecrets(STRONG_SECRET) as any,
-      'myFunc',
-      { userId: 'user-1' }
-    )
-
-    await assert.rejects(
-      () =>
-        pikkuRemoteAuthMiddleware(
-          { secrets: createSecrets(WEAK_SECRET), jwt } as any,
-          {
-            http: {
-              request: createRequest({ authorization: headers.authorization! }),
-            },
-            setSession: async () => {},
-          } as any,
-          async () => {}
-        ),
-      (err: unknown) => err instanceof WeakKeyMaterialError
-    )
-  })
-
-  test('a secret of exactly 32 characters is accepted', async () => {
-    const session = { userId: 'user-1' }
-    assert.deepStrictEqual(await roundTrip('x'.repeat(32), session), session)
-  })
-})

package/src/remote.ts

@@ -1,56 +0,0 @@
-import type { JWTService } from './services/jwt-service.js'
-import type { SecretService } from './services/secret-service.js'
-import {
-  assertStrongKeyMaterial,
-  encryptWithKeyMaterial,
-  REMOTE_SESSION_INFO,
-} from './crypto-utils.js'
-
-/**
- * Authorization headers carrying a JWT-signed session and traceId for
- * `pikkuRemoteAuthMiddleware` on the receiving end. Used by every deployment
- * service regardless of transport (HTTP, Lambda Invoke, service bindings).
- */
-export async function buildRemoteHeaders(
-  jwt: JWTService | undefined,
-  secrets: SecretService | undefined,
-  funcName: string,
-  session?: unknown,
-  traceId?: string
-): Promise<Record<string, string>> {
-  const headers: Record<string, string> = {
-    'content-type': 'application/json',
-    ...(traceId && { 'x-request-id': traceId }),
-  }
-
-  let secret: string | undefined
-  try {
-    secret = (await secrets?.getSecret('PIKKU_REMOTE_SECRET'))?.reveal()
-  } catch {}
-
-  if (secret && jwt) {
-    assertStrongKeyMaterial('PIKKU_REMOTE_SECRET', secret)
-    const sessionEnc = session
-      ? await encryptWithKeyMaterial(
-          'PIKKU_REMOTE_SECRET',
-          secret,
-          REMOTE_SESSION_INFO,
-          {
-            session,
-          }
-        )
-      : undefined
-    const token = await jwt.encode(
-      { value: 5, unit: 'minute' },
-      {
-        aud: 'pikku-remote',
-        fn: funcName,
-        iat: Math.floor(Date.now() / 1000),
-        session: sessionEnc,
-      }
-    )
-    headers.authorization = `Bearer ${token}`
-  }
-
-  return headers
-}

package/src/removed-legacy-exports.test.ts

@@ -1,66 +0,0 @@
-import { describe, test } from 'node:test'
-import assert from 'node:assert/strict'
-import { readFileSync, readdirSync } from 'node:fs'
-import { fileURLToPath } from 'node:url'
-import { join, dirname, relative } from 'node:path'
-
-const srcRoot = dirname(fileURLToPath(import.meta.url))
-const thisFile = fileURLToPath(import.meta.url)
-
-/**
- * Names removed from the public surface, each with the entry point that must
- * no longer carry it.
- *
- * They survived as throwing stubs only so the pinned bootstrap CLI could
- * resolve the import; `@pikku/cli@0.12.96` emits none of them, so the stubs
- * went too.
- *
- * `ZodLike` sat on the package root, which is now `bootstrap-compat/root.ts` —
- * what `.` resolves to for the pinned CLI's sake, and the only place a name
- * could return to the root from.
- */
-const REMOVED = [
-  { name: 'addTagPermission', entry: './middleware/index.js' },
-  { name: 'addHTTPPermission', entry: './wirings/http/index.js' },
-  { name: 'ZodLike', entry: './bootstrap-compat/root.js' },
-]
-
-const collectSourceFiles = (directory: string): string[] =>
-  readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
-    const entryPath = join(directory, entry.name)
-    if (entry.isDirectory()) {
-      return entry.name === 'dist' ? [] : collectSourceFiles(entryPath)
-    }
-    return /\.ts$/.test(entry.name) ? [entryPath] : []
-  })
-
-describe('removed legacy exports stay removed', () => {
-  for (const { name, entry } of REMOVED) {
-    test(`${entry} no longer exports ${name}`, async () => {
-      const module = await import(entry)
-      assert.equal(
-        name in module,
-        false,
-        `${entry} exports ${name} again; it was removed in #972`
-      )
-    })
-  }
-
-  test('no source file mentions the removed permission wrappers', () => {
-    const offenders = collectSourceFiles(srcRoot)
-      .filter(
-        (file) =>
-          file !== thisFile &&
-          /\baddTagPermission\b|\baddHTTPPermission\b|\bZodLike\b/.test(
-            readFileSync(file, 'utf-8')
-          )
-      )
-      .map((file) => relative(srcRoot, file))
-
-    assert.deepEqual(
-      offenders,
-      [],
-      `removed names still referenced in:\n${offenders.join('\n')}`
-    )
-  })
-})

package/src/run-tests-script.test.ts

@@ -1,67 +0,0 @@
-import { describe, test } from 'node:test'
-import assert from 'node:assert/strict'
-import fs from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-import { spawnSync } from 'node:child_process'
-import { fileURLToPath } from 'node:url'
-
-const thisDir = path.dirname(fileURLToPath(import.meta.url))
-const packageRoot = path.resolve(thisDir, '..')
-const runTestsScriptPath = path.join(packageRoot, 'run-tests.sh')
-
-describe('run-tests.sh discovery behavior', () => {
-  test('returns success by default when no tests are found', () => {
-    const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pikku-core-tests-'))
-    const srcDir = path.join(tempDir, 'src')
-    fs.mkdirSync(srcDir, { recursive: true })
-    fs.copyFileSync(runTestsScriptPath, path.join(tempDir, 'run-tests.sh'))
-
-    const result = spawnSync('bash', ['run-tests.sh'], {
-      cwd: tempDir,
-      encoding: 'utf8',
-      env: { ...process.env, CI: 'false' },
-    })
-
-    assert.equal(result.status, 0)
-    assert.match(result.stdout, /No test files found matching pattern/)
-
-    fs.rmSync(tempDir, { recursive: true, force: true })
-  })
-
-  test('returns success in CI when no tests are found', () => {
-    const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pikku-core-tests-'))
-    const srcDir = path.join(tempDir, 'src')
-    fs.mkdirSync(srcDir, { recursive: true })
-    fs.copyFileSync(runTestsScriptPath, path.join(tempDir, 'run-tests.sh'))
-
-    const result = spawnSync('bash', ['run-tests.sh'], {
-      cwd: tempDir,
-      encoding: 'utf8',
-      env: { ...process.env, CI: 'true' },
-    })
-
-    assert.equal(result.status, 0)
-    assert.match(result.stdout, /No test files found matching pattern/)
-
-    fs.rmSync(tempDir, { recursive: true, force: true })
-  })
-
-  test('returns failure in strict mode when no tests are found', () => {
-    const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pikku-core-tests-'))
-    const srcDir = path.join(tempDir, 'src')
-    fs.mkdirSync(srcDir, { recursive: true })
-    fs.copyFileSync(runTestsScriptPath, path.join(tempDir, 'run-tests.sh'))
-
-    const result = spawnSync('bash', ['run-tests.sh'], {
-      cwd: tempDir,
-      encoding: 'utf8',
-      env: { ...process.env, STRICT_TEST_DISCOVERY: '1' },
-    })
-
-    assert.equal(result.status, 1)
-    assert.match(result.stdout, /No test files found matching pattern/)
-
-    fs.rmSync(tempDir, { recursive: true, force: true })
-  })
-})