@pikku/core 0.12.106 → 0.12.111

package/src/types/state.types.ts

@@ -1,226 +0,0 @@
-import type {
-  PikkuErrorConstructor,
-  ErrorDetails,
-} from '../errors/error-handler.js'
-import type {
-  CorePikkuFunctionConfig,
-  CorePermissionGroup,
-  CorePikkuPermission,
-} from '../function/functions.types.js'
-import type { CorePikkuTriggerFunctionConfig } from '../wirings/trigger/trigger.types.js'
-import type {
-  CoreChannel,
-  ChannelsMeta,
-} from '../wirings/channel/channel.types.js'
-import type { CLIMeta, CLIProgramState } from '../wirings/cli/cli.types.js'
-import type {
-  HTTPMethod,
-  CoreHTTPFunctionWiring,
-  HTTPWiringsMeta,
-} from '../wirings/http/http.types.js'
-import type {
-  CoreMCPResource,
-  MCPResourceMeta,
-  MCPToolMeta,
-  CoreMCPPrompt,
-  MCPPromptMeta,
-} from '../wirings/mcp/mcp.types.js'
-import type { CoreAgent, AgentsMeta } from '../wirings/agent/agent.types.js'
-import type {
-  PikkuAgentScorer,
-  ScorerMeta,
-} from '../wirings/agent-scorer/agent-scorer.types.js'
-import type {
-  CoreGateway,
-  GatewaysMeta,
-} from '../wirings/gateway/gateway.types.js'
-import type {
-  CoreQueueWorker,
-  QueueWorkersMeta,
-} from '../wirings/queue/queue.types.js'
-import type {
-  CoreScheduledTask,
-  ScheduledTasksMeta,
-} from '../wirings/scheduler/scheduler.types.js'
-import type {
-  CoreWorkflow,
-  WorkflowsRuntimeMeta,
-} from '../wirings/workflow/workflow.types.js'
-import type { CoreFeature } from '../wirings/workflow/scenario.types.js'
-import type {
-  CoreTrigger,
-  CoreTriggerSource,
-  TriggerMeta,
-  TriggerSourceMeta,
-} from '../wirings/trigger/trigger.types.js'
-import type {
-  CreateConfig,
-  CreateSingletonServices,
-  CreateWireServices,
-  CoreConfig,
-  CoreSingletonServices,
-  CoreServices,
-  CoreUserSession,
-} from './core.types.js'
-import type { FunctionsMeta } from '../function/function-meta.types.js'
-import type {
-  CorePikkuMiddleware,
-  CorePikkuMiddlewareGroup,
-} from '../middleware/middleware.types.js'
-import type { CorePikkuChannelMiddleware } from '../wirings/channel/channel.types.js'
-
-export interface PikkuPackageState {
-  function: {
-    meta: FunctionsMeta
-    functions: Map<string, CorePikkuFunctionConfig<any, any>>
-  }
-  rpc: {
-    meta: Record<string, string>
-    files: Map<
-      string,
-      {
-        exportedName: string
-        path: string
-      }
-    >
-  }
-  /** Maps namespace aliases to package config (e.g., 'console' -> { package: '@pikku/console', ... }) */
-  addons: {
-    packages: Map<
-      string,
-      {
-        package: string
-        rpcEndpoint?: string
-        auth?: boolean
-        tags?: string[]
-        /** Required of every function in this package, on top of the function's own */
-        scopes?: string[]
-        /** Per-instance name-aliases: logical name the addon reads -> actual project secret name */
-        secretOverrides?: Record<string, string>
-        /** Per-instance name-aliases: logical name the addon reads -> actual project variable name */
-        variableOverrides?: Record<string, string>
-        /** Per-instance name-aliases: logical name the addon reads -> actual project credential name */
-        credentialOverrides?: Record<string, string>
-        /** Secrets the host lends this instance, named as the addon reads them */
-        secretGrants?: string[]
-        /** Credentials the host lends this instance, named as the addon reads them */
-        credentialGrants?: string[]
-        /** Why this instance gets the whole `SecretService` rather than one scoped to its declared secrets */
-        globalSecrets?: string
-        /** Why this instance gets the whole `CredentialService` rather than one scoped to its declared credentials */
-        globalCredentials?: string
-        /** Set by `wireRemoteAddon`: this namespace is consumed remotely over HTTP, not bundled */
-        remote?: boolean
-        /** Remote host base URL (wireRemoteAddon) — string or resolver over singleton services */
-        serverUrl?: string | ((services: any) => string | Promise<string>)
-        /** Consumer-side auth binding for the hosted addon (wireRemoteAddon) */
-        remoteAuth?:
-          | { credentialId: string }
-          | { secretId: string }
-          | { resolve: (services: any, wire: any) => string | Promise<string> }
-        /** Map consumer-facing fn name → remote fn name (wireRemoteAddon) */
-        remoteName?: (fn: string) => string
-      }
-    >
-  }
-  http: {
-    middleware: Map<string, CorePikkuMiddleware<any, any>[]>
-    permissions: Map<string, CorePermissionGroup | CorePikkuPermission[]>
-    routes: Map<HTTPMethod, Map<string, CoreHTTPFunctionWiring<any, any, any>>>
-    meta: HTTPWiringsMeta
-  }
-  channel: {
-    channels: Map<string, CoreChannel<any, any, any, any, any>>
-    meta: ChannelsMeta
-  }
-  scheduler: {
-    tasks: Map<string, CoreScheduledTask>
-    meta: ScheduledTasksMeta
-  }
-  queue: {
-    registrations: Map<string, CoreQueueWorker>
-    meta: QueueWorkersMeta
-  }
-  workflows: {
-    registrations: Map<string, CoreWorkflow>
-    /** Scenario groups declared with `pikkuFeature`, keyed by export name. */
-    features: Map<string, CoreFeature>
-    meta: WorkflowsRuntimeMeta
-  }
-  trigger: {
-    functions: Map<string, CorePikkuTriggerFunctionConfig<any, any>>
-    triggers: Map<string, CoreTrigger>
-    triggerSources: Map<string, CoreTriggerSource>
-    meta: TriggerMeta
-    sourceMeta: TriggerSourceMeta
-  }
-  mcp: {
-    resources: Map<string, CoreMCPResource>
-    resourcesMeta: MCPResourceMeta
-    toolsMeta: MCPToolMeta
-    prompts: Map<string, CoreMCPPrompt>
-    promptsMeta: MCPPromptMeta
-  }
-  agent: {
-    agents: Map<string, CoreAgent>
-    agentsMeta: AgentsMeta
-    scorers: Map<string, PikkuAgentScorer>
-    scorersMeta: ScorerMeta
-    /** Alias -> `provider/model`, from the `models` table in pikku.config.json. */
-    modelAliases: Record<string, string>
-  }
-  gateway: {
-    gateways: Map<string, CoreGateway>
-    meta: GatewaysMeta
-  }
-  cli: {
-    meta: CLIMeta | Record<string, any> // Backward compatible with old published CLI format
-    programs: Record<string, CLIProgramState>
-  }
-  middleware: {
-    tagGroup: Record<string, CorePikkuMiddlewareGroup>
-    httpGroup: Record<string, CorePikkuMiddlewareGroup>
-    global: CorePikkuMiddlewareGroup
-  }
-  channelMiddleware: {
-    tagGroup: Record<string, CorePikkuChannelMiddleware[]>
-  }
-  permissions: {
-    global: (CorePermissionGroup | CorePikkuPermission)[]
-  }
-  misc: {
-    errors: Map<PikkuErrorConstructor, ErrorDetails>
-    schemas: Map<string, any>
-    middleware: Record<string, CorePikkuMiddleware[]>
-    channelMiddleware: Record<string, CorePikkuChannelMiddleware[]>
-    permissions: Record<string, CorePermissionGroup | CorePikkuPermission[]>
-  }
-  package: {
-    factories: {
-      createConfig?: CreateConfig<CoreConfig>
-      createSingletonServices?: CreateSingletonServices<
-        CoreConfig,
-        CoreSingletonServices
-      >
-      createWireServices?: CreateWireServices<
-        CoreSingletonServices,
-        CoreServices,
-        CoreUserSession
-      >
-    } | null
-    singletonServices: CoreSingletonServices | null
-    /** The pikkuBetterAuth factory, self-registered when auth.ts is evaluated.
-     *  pikkuServices reads it to build and inject the `auth` singleton. */
-    authFactory:
-      ((services: CoreSingletonServices) => unknown | Promise<unknown>) | null
-    credentialsMeta: Record<
-      string,
-      { name: string; displayName: string; type: string; oauth2?: boolean }
-    > | null
-    requiredParentServices: string[] | null
-    /** The secret keys this package is allowed to read, emitted by the CLI from
-     *  what the package declares and is seen to read. `null` when the package
-     *  was never analysed, which scopes it to nothing. */
-    declaredSecrets: string[] | null
-  }
-}

package/src/types/typed-credentials.test.ts

@@ -1,72 +0,0 @@
-import { describe, test } from 'node:test'
-import assert from 'node:assert/strict'
-import type { CoreUserSession, GetCredential, PikkuWire } from './core.types.js'
-import type { PikkuRPC } from '../wirings/rpc/rpc-types.js'
-import type { PikkuWorkflowWire } from '../wirings/workflow/workflow.types.js'
-import type { PikkuScenarioWire } from '../wirings/workflow/scenario.types.js'
-import type { ScenarioPersonas } from '../services/personas-service.js'
-
-interface CredentialsMap {
-  slack: { token: string }
-  stripe: { apiKey: string; accountId: string }
-}
-
-type TypedWire = PikkuWire<
-  unknown,
-  unknown,
-  false,
-  CoreUserSession,
-  PikkuRPC,
-  null,
-  never,
-  PikkuWorkflowWire,
-  unknown,
-  PikkuScenarioWire<any>,
-  ScenarioPersonas,
-  CredentialsMap
->
-
-const VALUES: Record<string, unknown> = {
-  slack: { token: 'xoxb-1' },
-  stripe: { apiKey: 'sk-1', accountId: 'acct-1' },
-  'not-in-the-map': { anything: true },
-}
-
-// Mirrors `createWireServicesCredentialWireProps`, so this also pins that a
-// generic single-signature implementation still satisfies the overload pair.
-const getCredential: NonNullable<TypedWire['getCredential']> = <T = unknown>(
-  name: string
-) => (VALUES[name] ?? null) as T | null
-
-describe('wire.getCredential is typed by the generated CredentialsMap', () => {
-  test('resolves a mapped name without an explicit type argument', async () => {
-    const slack: { token: string } | null | Promise<{ token: string } | null> =
-      getCredential('slack')
-    assert.deepEqual(await slack, { token: 'xoxb-1' })
-
-    const stripe = await getCredential('stripe')
-    assert.equal(stripe?.accountId, 'acct-1')
-  })
-
-  test('rejects the wrong type for a mapped name', () => {
-    // @ts-expect-error 'slack' resolves to { token: string }, not a string
-    const wrong: string | null | Promise<string | null> = getCredential('slack')
-    assert.ok(wrong)
-  })
-
-  test('keeps an unmapped name callable with an explicit type argument', async () => {
-    const other = await getCredential<{ anything: boolean }>('not-in-the-map')
-    assert.equal(other?.anything, true)
-  })
-
-  test('falls back to unknown when no map is bound', async () => {
-    const untyped: GetCredential = <T = unknown>(name: string) =>
-      (VALUES[name] ?? null) as T | null
-    // @ts-expect-error no map is bound, so the value is unknown
-    const wrong: { token: string } | null = await untyped('slack')
-    assert.deepEqual(wrong, { token: 'xoxb-1' })
-    assert.deepEqual(await untyped<{ token: string }>('slack'), {
-      token: 'xoxb-1',
-    })
-  })
-})

package/src/utils/hash.test.ts

@@ -1,68 +0,0 @@
-import { describe, it } from 'node:test'
-import assert from 'node:assert/strict'
-
-import { canonicalJSON, hashString } from './hash.js'
-
-describe('canonicalJSON', () => {
-  it('sorts object keys alphabetically', () => {
-    const result = canonicalJSON({ b: 1, a: 2, c: 3 })
-    assert.equal(result, '{"a":2,"b":1,"c":3}')
-  })
-
-  it('sorts nested object keys', () => {
-    const result = canonicalJSON({ z: { b: 1, a: 2 }, a: 1 })
-    assert.equal(result, '{"a":1,"z":{"a":2,"b":1}}')
-  })
-
-  it('preserves array order', () => {
-    const result = canonicalJSON([3, 1, 2])
-    assert.equal(result, '[3,1,2]')
-  })
-
-  it('sorts objects inside arrays', () => {
-    const result = canonicalJSON([{ b: 1, a: 2 }])
-    assert.equal(result, '[{"a":2,"b":1}]')
-  })
-
-  it('handles null and undefined', () => {
-    assert.equal(canonicalJSON(null), 'null')
-    assert.equal(canonicalJSON(undefined), undefined)
-  })
-
-  it('handles primitives', () => {
-    assert.equal(canonicalJSON('hello'), '"hello"')
-    assert.equal(canonicalJSON(42), '42')
-    assert.equal(canonicalJSON(true), 'true')
-  })
-
-  it('produces deterministic output for same input regardless of key order', () => {
-    const a = canonicalJSON({ x: 1, y: 2, z: 3 })
-    const b = canonicalJSON({ z: 3, x: 1, y: 2 })
-    assert.equal(a, b)
-  })
-})
-
-describe('hashString', () => {
-  it('returns a hex string of default length 16', () => {
-    const result = hashString('test')
-    assert.equal(result.length, 16)
-    assert.match(result, /^[0-9a-f]+$/)
-  })
-
-  it('returns consistent hash for same input', () => {
-    const a = hashString('hello world')
-    const b = hashString('hello world')
-    assert.equal(a, b)
-  })
-
-  it('returns different hashes for different inputs', () => {
-    const a = hashString('hello')
-    const b = hashString('world')
-    assert.notEqual(a, b)
-  })
-
-  it('respects custom length parameter', () => {
-    const result = hashString('test', 8)
-    assert.equal(result.length, 8)
-  })
-})

package/src/utils/hash.ts

@@ -1,26 +0,0 @@
-import { createHash } from 'node:crypto'
-
-export function canonicalJSON(obj: unknown): string {
-  return JSON.stringify(sortDeep(obj))
-}
-
-function sortDeep(value: unknown): unknown {
-  if (value === null || value === undefined) {
-    return value
-  }
-  if (Array.isArray(value)) {
-    return value.map(sortDeep)
-  }
-  if (typeof value === 'object') {
-    const sorted: Record<string, unknown> = {}
-    for (const key of Object.keys(value as Record<string, unknown>).sort()) {
-      sorted[key] = sortDeep((value as Record<string, unknown>)[key])
-    }
-    return sorted
-  }
-  return value
-}
-
-export function hashString(input: string, length: number = 16): string {
-  return createHash('sha256').update(input).digest('hex').slice(0, length)
-}

package/src/utils/hmac.ts

@@ -1,21 +0,0 @@
-import { createHmac, timingSafeEqual } from 'node:crypto'
-
-/**
- * HMAC-SHA256 of a payload, hex-encoded. Senders wrap this in their own scheme
- * prefix (`sha256=`, `v0=`, …).
- */
-export function hmacSha256Hex(secret: string, payload: string): string {
-  return createHmac('sha256', secret).update(payload).digest('hex')
-}
-
-/**
- * Constant-time signature comparison. Returns false on a length mismatch,
- * where `timingSafeEqual` itself throws.
- */
-export function timingSafeStringEqual(a: string, b: string): boolean {
-  try {
-    return timingSafeEqual(Buffer.from(a), Buffer.from(b))
-  } catch {
-    return false
-  }
-}

package/src/utils/node-host-resolver.ts

@@ -1,20 +0,0 @@
-import { lookup } from 'node:dns/promises'
-
-import { setDefaultHostResolver, type HostResolver } from './safe-fetch.js'
-
-/**
- * Resolves a hostname through the platform resolver, returning every address it
- * points at so `safeFetch` can reject a public name aimed at an internal one.
- *
- * This module is Node-only and is never imported by core itself — Workers has no
- * DNS API, and a static `node:dns` import in the shared path would break that
- * build.
- */
-export const nodeHostResolver: HostResolver = async (hostname) => {
-  const results = await lookup(hostname, { all: true, verbatim: true })
-  return results.map(({ address }) => address)
-}
-
-/** Installs {@link nodeHostResolver} as the default for every `safeFetch`. */
-export const installNodeHostResolver = () =>
-  setDefaultHostResolver(nodeHostResolver)