@pikku/core 0.12.106 → 0.12.111

package/src/services/index.ts

@@ -1,192 +0,0 @@
-export { LogLevel } from './logger.js'
-export { ScopedSecretService } from './scoped-secret-service.js'
-export { ScopedCredentialService } from './scoped-credential-service.js'
-export {
-  PikkuSessionService,
-  createMiddlewareSessionWireProps,
-} from './user-session-service.js'
-export { TypedSecretService } from './typed-secret-service.js'
-export { PikkuCredentialWireService } from './credential-wire-service.js'
-export { TypedVariablesService } from './typed-variables-service.js'
-export { LocalSecretService } from './local-secrets.js'
-export { LocalEmailService } from './local-email-service.js'
-export { LocalCredentialService } from './local-credential-service.js'
-export { LocalVariablesService } from './local-variables.js'
-export { ConsoleLogger, JsonConsoleLogger } from './logger-console.js'
-export { InMemoryWorkflowService } from './in-memory-workflow-service.js'
-export {
-  QueueWebhookService,
-  pikkuWebhookWorkerFunc,
-} from './queue-webhook-service.js'
-export {
-  REMOTE_JOBS_SECRET_HEADER,
-  REMOTE_JOBS_SECRET_VARIABLE,
-  REMOTE_QUEUE_JOB_PATH,
-  REMOTE_SCHEDULER_JOB_PATH,
-  pikkuRemoteQueueJobFunc,
-  pikkuRemoteScheduledJobFunc,
-  type RemoteQueueJobData,
-  type RemoteScheduledJobData,
-} from './remote-jobs.js'
-export { InMemoryQueueService } from './in-memory-queue-service.js'
-export { InMemoryTriggerService } from './in-memory-trigger-service.js'
-export { InMemoryAgentRunStateService } from './in-memory-agent-run-state-service.js'
-export { LocalGatewayService } from './local-gateway-service.js'
-export {
-  FileScenarioRunStore,
-  scenarioArtifactContentType,
-  scenarioRunSummary,
-  type FileScenarioRunStoreOptions,
-} from './file-scenario-run-store.js'
-export type {
-  ContentService,
-  SignContentKeyArgs,
-  SignURLArgs,
-  GetUploadURLArgs,
-  UploadURLResult,
-  BucketKeyArgs,
-  WriteFileArgs,
-  CopyFileArgs,
-} from './content-service.js'
-export type {
-  ScenarioPersona,
-  ResolvedPersona,
-  ScenarioPersonas,
-} from './personas-service.js'
-// knowledge: decisions/internals/the-persona-runtime-is-exported-from-the-persona-entry-point.md
-export type { JWTService } from './jwt-service.js'
-export type {
-  EmailAttachment,
-  EmailService,
-  SendEmailInput,
-  SendEmailResult,
-  SendHTMLEmailInput,
-  SendTemplateEmailInput,
-  SendTextEmailInput,
-} from './email-service.js'
-export {
-  renderEmail,
-  type EmailAssets,
-  type EmailTemplateAssets,
-  type EmailTemplateHashes,
-  type RenderEmailRequest,
-  type RenderedEmailResult,
-} from './email-template.js'
-export {
-  DEFAULT_WEBHOOK_RETRIES,
-  PIKKU_OUTGOING_WEBHOOK_QUEUE_NAME,
-  WebhookService,
-  type SendWebhookInput,
-  type SendWebhookResult,
-  type WebhookAttemptResult,
-  type WebhookDeliveryRecord,
-  type WebhookDeliveryWithAttempts,
-  type WebhookJobData,
-  type WebhookServiceConfig,
-} from './webhook-service.js'
-export {
-  ACTOR_ROOT_SECRET_MIN_LENGTH,
-  ACTOR_SECRET_INFO,
-  ACTOR_SECRET_NAME,
-  actorSecretSubject,
-  deriveActorSecret,
-  verifyActorSecret,
-} from './persona-actor-secret.js'
-export type { Logger } from './logger.js'
-export type { SecretService, SecretValues } from './secret-service.js'
-export type { VariablesService } from './variables-service.js'
-export type { SchemaService } from './schema-service.js'
-export type { SessionService } from './user-session-service.js'
-export type {
-  ScheduledTaskSummary,
-  ScheduledTaskInfo,
-} from './scheduler-service.js'
-export { SchedulerService } from './scheduler-service.js'
-export type { TriggerService } from './trigger-service.js'
-export type { GatewayService } from './gateway-service.js'
-export type {
-  DeploymentService,
-  DeploymentConfig,
-  DeploymentInfo,
-  DeploymentServiceConfig,
-} from './deployment-service.js'
-export type { AgentStorageService } from './agent-storage-service.js'
-export type {
-  AgentRunnerParams,
-  AgentRunnerResult,
-  AgentStepResult,
-  AgentRunnerService,
-} from './agent-runner-service.js'
-export type { AIEmbeddingService } from './ai-embedding-service.js'
-export type {
-  CreateRunInput,
-  SaveScoreInput,
-  AgentRunStateService,
-} from './agent-run-state-service.js'
-export type { CredentialMeta } from './typed-secret-service.js'
-export type { CredentialService } from './credential-service.js'
-export { TypedCredentialService } from './typed-credential-service.js'
-export type { CredentialMetaInfo } from './typed-credential-service.js'
-export type { VariableMeta } from './typed-variables-service.js'
-export type { MetaService } from './meta-service.js'
-export type { SessionStore } from './session-store.js'
-export type { ScopeService, Role } from './scope-service.js'
-export type { IsSystemRole } from './system-role-guard.js'
-export { NoopAuditService, createInvocationAudit } from './audit-service.js'
-export type {
-  AuditConfig,
-  AuditDurability,
-  AuditEvent,
-  AuditEventBatch,
-  AuditLog,
-  AuditService,
-  AuditUserIdentity,
-  ResolvedAuditConfig,
-} from './audit-service.js'
-export { InMemorySessionStore } from './in-memory-session-store.js'
-export type {
-  MCPMeta,
-  RPCMetaRecord,
-  ServiceMeta,
-  ServicesMetaRecord,
-  MiddlewareDefinitionMeta,
-  MiddlewareInstanceMeta,
-  GroupMeta,
-  MiddlewareGroupsMeta,
-  PermissionDefinitionMeta,
-  PermissionsGroupsMeta,
-  FunctionsMeta,
-  FunctionMeta,
-  MiddlewareMeta,
-  PermissionMeta,
-  AgentsMeta,
-  AgentMeta,
-  EmailsMeta,
-  EmailTemplateMeta,
-} from './meta-service.js'
-export type {
-  CoverageService,
-  ScriptCoverage,
-  FunctionCoverageEntry,
-  FunctionCoverageReport,
-  CoverageFunctionMeta,
-} from './v8-coverage-service.js'
-export {
-  StubTracker,
-  createStubProxy,
-  getStubTracker,
-  isTestRun,
-  stub,
-  spy,
-  type StubCall,
-} from './stub-tracker.js'
-export {
-  SecretHostNotAllowedError,
-  assertSecretAllowedForHost,
-} from './secret-host-binding.js'
-export type {
-  AuditFacets,
-  AuditQuery,
-  AuditQueryResult,
-} from './audit-service.js'
-export { SecretAccessDeniedError, withoutSecrets } from './secretless.js'

package/src/services/istanbul-coverage-service.test.ts

@@ -1,66 +0,0 @@
-import { describe, test, afterEach } from 'node:test'
-import assert from 'node:assert/strict'
-import { IstanbulCoverageService } from './istanbul-coverage-service.js'
-
-const FILE = '/proj/src/things.function.ts'
-
-const seedCoverage = () => {
-  ;(globalThis as any).__coverage__ = {
-    [FILE]: {
-      path: FILE,
-      statementMap: {
-        '0': { start: { line: 2, column: 2 }, end: { line: 2, column: 20 } },
-        '1': { start: { line: 3, column: 4 }, end: { line: 3, column: 30 } },
-        '2': { start: { line: 5, column: 2 }, end: { line: 6, column: 18 } },
-      },
-      s: { '0': 3, '1': 0, '2': 3 },
-      branchMap: {},
-      b: {},
-      fnMap: {},
-      f: {},
-    },
-  }
-}
-
-afterEach(() => {
-  delete (globalThis as any).__coverage__
-})
-
-describe('IstanbulCoverageService', () => {
-  test('takeCoverage converts __coverage__ statement counts into line hits', async () => {
-    seedCoverage()
-    const service = new IstanbulCoverageService()
-    await service.start()
-    const snapshot = await service.takeCoverage()
-    assert.equal(snapshot.kind, 'line-hits')
-    if (snapshot.kind !== 'line-hits') return
-    const hits = snapshot.lineHits.get(FILE)
-    assert.ok(hits, 'file should have line hits')
-    assert.equal(hits.get(2), 3)
-    assert.equal(hits.get(3), 0)
-    assert.equal(hits.get(5), 3)
-    assert.equal(
-      hits.get(6),
-      undefined,
-      'counts attach to statement start lines only'
-    )
-  })
-
-  test('reset zeroes counters so per-scenario attribution is possible', async () => {
-    seedCoverage()
-    const service = new IstanbulCoverageService()
-    await service.reset()
-    const snapshot = await service.takeCoverage()
-    if (snapshot.kind !== 'line-hits') return assert.fail('expected line-hits')
-    const hits = snapshot.lineHits.get(FILE)
-    assert.equal(hits?.get(2), 0)
-    assert.equal(hits?.get(5), 0)
-  })
-
-  test('takeCoverage with no __coverage__ global returns an empty snapshot', async () => {
-    const service = new IstanbulCoverageService()
-    const snapshot = await service.takeCoverage()
-    if (snapshot.kind !== 'line-hits') return assert.fail('expected line-hits')
-    assert.equal(snapshot.lineHits.size, 0)
-  })
-})

package/src/services/istanbul-coverage-service.ts

@@ -1,59 +0,0 @@
-import type {
-  CoverageService,
-  CoverageSnapshot,
-  LineHits,
-} from './v8-coverage-service.js'
-
-interface IstanbulStatementLocation {
-  start: { line: number }
-  end: { line: number }
-}
-
-interface IstanbulFileCoverage {
-  path: string
-  statementMap: Record<string, IstanbulStatementLocation>
-  s: Record<string, number>
-  b: Record<string, number[]>
-  f: Record<string, number>
-}
-
-type IstanbulCoverageGlobal = Record<string, IstanbulFileCoverage>
-
-const getCoverageGlobal = (): IstanbulCoverageGlobal | undefined =>
-  (globalThis as { __coverage__?: IstanbulCoverageGlobal }).__coverage__
-
-/** The coverage backend for runtimes without V8 precise coverage, e.g. Bun. */
-export class IstanbulCoverageService implements CoverageService {
-  async start(): Promise<void> {}
-
-  async takeCoverage(): Promise<CoverageSnapshot> {
-    const coverage = getCoverageGlobal()
-    const lineHits: LineHits = new Map()
-    for (const file of Object.values(coverage ?? {})) {
-      let hits = lineHits.get(file.path)
-      if (!hits) {
-        hits = new Map()
-        lineHits.set(file.path, hits)
-      }
-      // knowledge: decisions/internals/istanbul-statement-counts-attach-to-the-start-line-only.md
-      for (const [id, location] of Object.entries(file.statementMap)) {
-        const count = file.s[id] ?? 0
-        const line = location.start.line
-        hits.set(line, Math.max(hits.get(line) ?? 0, count))
-      }
-    }
-    return { kind: 'line-hits', lineHits }
-  }
-
-  async reset(): Promise<void> {
-    for (const file of Object.values(getCoverageGlobal() ?? {})) {
-      for (const id of Object.keys(file.s)) file.s[id] = 0
-      for (const id of Object.keys(file.f)) file.f[id] = 0
-      for (const id of Object.keys(file.b)) {
-        file.b[id] = file.b[id]!.map(() => 0)
-      }
-    }
-  }
-
-  async stop(): Promise<void> {}
-}

package/src/services/jwt-service.ts

@@ -1,15 +0,0 @@
-import type { RelativeTimeInput } from '../time-utils.js'
-
-export interface JWTService {
-  encode: <T extends any>(
-    expiresIn: RelativeTimeInput,
-    payload: T
-  ) => Promise<string>
-
-  /** `invalidHashError` replaces the implementation's own error when the hash does not verify. */
-  decode: <T>(
-    hash: string,
-    invalidHashError?: Error,
-    debug?: boolean
-  ) => Promise<T>
-}

package/src/services/local-content-request-handler.test.ts

@@ -1,240 +0,0 @@
-import { describe, test, before, after } from 'node:test'
-import assert from 'node:assert/strict'
-import {
-  mkdtempSync,
-  mkdirSync,
-  writeFileSync,
-  readFileSync,
-  existsSync,
-  rmSync,
-} from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import type { JWTService, Logger } from './index.js'
-import { LocalContent } from './local-content.js'
-import { createLocalContentRequestHandler } from './local-content-request-handler.js'
-
-const noopLogger = {
-  info: () => {},
-  error: () => {},
-  warn: () => {},
-  debug: () => {},
-  trace: () => {},
-  setLevel: () => {},
-} as unknown as Logger
-
-const fakeJWT = {
-  encode: async (_expiry: string, payload: unknown) =>
-    Buffer.from(JSON.stringify(payload)).toString('base64url'),
-  decode: async (token: string) =>
-    JSON.parse(Buffer.from(token, 'base64url').toString()),
-} as unknown as JWTService
-
-describe('createLocalContentRequestHandler', () => {
-  let tmpDir: string
-  let handler: ReturnType<typeof createLocalContentRequestHandler>
-  let content: LocalContent
-
-  before(() => {
-    tmpDir = mkdtempSync(join(tmpdir(), 'pikku-content-handler-'))
-    mkdirSync(join(tmpDir, 'bucket'), { recursive: true })
-    writeFileSync(join(tmpDir, 'bucket', 'existing.bin'), 'already here')
-
-    const config = {
-      localFileUploadPath: tmpDir,
-      uploadUrlPrefix: '/upload',
-      assetUrlPrefix: '/assets',
-      sizeLimit: '1mb',
-    }
-    content = new LocalContent(config, noopLogger, fakeJWT)
-    handler = createLocalContentRequestHandler({
-      content: config,
-      logger: noopLogger,
-      getJWT: () => fakeJWT,
-    })
-  })
-
-  after(() => {
-    rmSync(tmpDir, { recursive: true, force: true })
-  })
-
-  test('returns null for a path outside both prefixes', async () => {
-    const result = await handler(
-      new Request('http://localhost/uploadsomething')
-    )
-    assert.equal(result, null)
-  })
-
-  test('returns null for a method neither prefix handles', async () => {
-    const result = await handler(
-      new Request('http://localhost/upload/bucket/x.bin', { method: 'GET' })
-    )
-    assert.equal(result, null)
-  })
-
-  // Encoded SEPARATORS, not encoded dots. `%2e%2e` never reaches the handler:
-  // the URL parser treats it as a double-dot segment and resolves it away, so
-  // the path arrives already outside the prefix. `%2f` survives parsing intact
-  // and only becomes a separator when the handler decodes it — which is the one
-  // way a `..` can still be sitting in the key by the time it is resolved, and
-  // therefore the case the guard actually has to catch.
-  test('refuses an upload whose key escapes the content directory', async () => {
-    writeFileSync(join(tmpDir, '..', 'pikku-handler-secret.txt'), 'secret')
-    try {
-      // Signed for the escaping path itself, so it clears the signature gate
-      // and the path-escape guard is what rejects it.
-      const signed = await content.signURL({
-        url: '/upload/bucket/..%2f..%2fpikku-handler-secret.txt',
-        dateLessThan: new Date(Date.now() + 60_000),
-      } as any)
-      const response = await handler(
-        new Request(`http://localhost${signed}`, {
-          method: 'PUT',
-          body: 'overwritten',
-        })
-      )
-      assert.equal(response?.status, 400)
-      assert.equal(
-        readFileSync(join(tmpDir, '..', 'pikku-handler-secret.txt'), 'utf8'),
-        'secret'
-      )
-    } finally {
-      rmSync(join(tmpDir, '..', 'pikku-handler-secret.txt'), { force: true })
-    }
-  })
-
-  test('refuses an asset read whose key escapes the content directory', async () => {
-    const response = await handler(
-      new Request('http://localhost/assets/bucket/..%2f..%2fanything.txt')
-    )
-    assert.equal(response?.status, 400)
-  })
-
-  test('refuses an unsigned PUT to the upload prefix', async () => {
-    const put = await handler(
-      new Request('http://localhost/upload/bucket/evil.bin', {
-        method: 'PUT',
-        body: 'attacker-controlled',
-      })
-    )
-    assert.equal(put?.status, 403, 'an upload URL must be signed like a read')
-  })
-
-  test('refuses a PUT whose signature was minted for a different key', async () => {
-    const { uploadUrl } = await content.getUploadURL({
-      bucket: 'bucket',
-      fileKey: 'legit/one.bin',
-      contentType: 'application/octet-stream',
-    } as any)
-    const query = uploadUrl.slice(uploadUrl.indexOf('?'))
-    // Same signature, a different target path.
-    const put = await handler(
-      new Request(`http://localhost/upload/bucket/other.bin${query}`, {
-        method: 'PUT',
-        body: 'payload',
-      })
-    )
-    assert.equal(put?.status, 403)
-  })
-
-  test('round-trips an upload and a signed read', async () => {
-    const { uploadUrl } = await content.getUploadURL({
-      bucket: 'bucket',
-      fileKey: 'round/trip.bin',
-      contentType: 'application/octet-stream',
-    } as any)
-    const put = await handler(
-      new Request(`http://localhost${uploadUrl}`, {
-        method: 'PUT',
-        body: 'payload',
-      })
-    )
-    assert.equal(put?.status, 200)
-
-    const signed = await content.signContentKey({
-      bucket: 'bucket',
-      contentKey: 'round/trip.bin',
-      dateLessThan: new Date(Date.now() + 60_000),
-    } as any)
-    const get = await handler(new Request(`http://localhost${signed}`))
-    assert.equal(get?.status, 200)
-    assert.equal(await get!.text(), 'payload')
-  })
-
-  test('HEAD returns the length without the body', async () => {
-    const signed = await content.signContentKey({
-      bucket: 'bucket',
-      contentKey: 'existing.bin',
-      dateLessThan: new Date(Date.now() + 60_000),
-    } as any)
-    const response = await handler(
-      new Request(`http://localhost${signed}`, { method: 'HEAD' })
-    )
-    assert.equal(response?.status, 200)
-    assert.equal(
-      response?.headers.get('content-length'),
-      String('already here'.length)
-    )
-    assert.equal(await response!.text(), '')
-  })
-
-  test('refuses a read with no signature at all', async () => {
-    const response = await handler(
-      new Request('http://localhost/assets/bucket/existing.bin')
-    )
-    assert.equal(response?.status, 403)
-  })
-
-  test('refuses a signature that verifies but names another path', async () => {
-    const signed = await content.signContentKey({
-      bucket: 'bucket',
-      contentKey: 'existing.bin',
-      dateLessThan: new Date(Date.now() + 60_000),
-    } as any)
-    writeFileSync(join(tmpDir, 'bucket', 'sibling.bin'), 'sibling')
-    const query = signed.slice(signed.indexOf('?'))
-    const response = await handler(
-      new Request(`http://localhost/assets/bucket/sibling.bin${query}`)
-    )
-    assert.equal(response?.status, 403)
-  })
-
-  test('refuses signed reads when no JWT service is available', async () => {
-    const unverifiable = createLocalContentRequestHandler({
-      content: {
-        localFileUploadPath: tmpDir,
-        uploadUrlPrefix: '/upload',
-        assetUrlPrefix: '/assets',
-      },
-      logger: noopLogger,
-      getJWT: () => undefined,
-    })
-    const signed = await content.signContentKey({
-      bucket: 'bucket',
-      contentKey: 'existing.bin',
-      dateLessThan: new Date(Date.now() + 60_000),
-    } as any)
-    const response = await unverifiable(
-      new Request(`http://localhost${signed}`)
-    )
-    assert.equal(response?.status, 403)
-  })
-
-  test('rejects a body over the size limit without writing it', async () => {
-    const { uploadUrl } = await content.getUploadURL({
-      bucket: 'bucket',
-      fileKey: 'big.bin',
-      contentType: 'application/octet-stream',
-    } as any)
-    const response = await handler(
-      new Request(`http://localhost${uploadUrl}`, {
-        method: 'PUT',
-        body: Buffer.alloc(1024 * 1024 + 1),
-      })
-    )
-    assert.equal(response?.status, 413)
-    // Abandoning the stream must leave nothing behind — a partial file here
-    // would be a truncated asset that later reads would serve as if whole.
-    assert.equal(existsSync(join(tmpDir, 'bucket', 'big.bin')), false)
-  })
-})