@pikku/core 0.12.138 → 0.12.139

package/dist/wirings/addon/wire-addon.d.ts

@@ -41,8 +41,21 @@ export type WireAddonConfig = {
     mcpEndpoint?: boolean | string;
     /** Filters this addon in and out of a build — see the `tags` option on `pikku all`. It has no effect at runtime. */
     tags?: string[];
+    /**
+     * Mounts the screens the addon ships (see `defineScreens`) in the host under
+     * `/addons/<name>`. Without it the addon's screens are ignored. The package
+     * must declare at least one, or `pikku all` rejects the wiring.
+     */
+    ui?: boolean;
     /** Required of every function in the addon, on top of the function's own. */
     scopes?: string[];
+    /**
+     * The other addons this one may call, as `{ '<package>': '<name>' }`: the
+     * package it was written against, and the name that package is wired under
+     * in this app. The addon calls `'<package>:<function>'`; anything it did not
+     * list is refused, whatever else the app has wired.
+     */
+    uses?: Record<string, string>;
     /** Points a secret the addon reads at a different key in this deployment, so two instances can hold different credentials. */
     secretOverrides?: Record<string, string>;
     /** Points a variable the addon reads at a different key in this deployment. */
@@ -65,6 +78,20 @@ export type WireAddonConfig = {
      * deploy manifest, and only the consuming app can grant it.
      */
     globalCredentials?: string;
+    /**
+     * The folder of the content store this instance owns. Everything it stores
+     * lands under it and it cannot see past it. Defaults to `name`.
+     */
+    contentBucket?: string;
+    /**
+     * Paths outside its own folder this instance may use, by path prefix:
+     * `read` allows reads and signed downloads, `write` adds uploads, writes and
+     * deletes. The longest matching prefix decides. The addon names a granted
+     * path by starting its bucket with `@`.
+     */
+    contentGrants?: Record<string, 'read' | 'write'>;
+    /** Hands over the whole `ContentService` unscoped. The value is the reason, recorded in the deploy manifest. */
+    globalContent?: string;
 };
 /**
  * Installs an addon into this project: its functions, wirings and scopes become

package/dist/wirings/addon/wire-addon.js

@@ -14,6 +14,7 @@ export const wireAddon = (config) => {
         tags: config.tags,
         ...(config.expose !== undefined ? { expose: config.expose } : {}),
         ...(config.scopes ? { scopes: config.scopes } : {}),
+        ...(config.uses ? { uses: config.uses } : {}),
         ...(config.secretOverrides
             ? { secretOverrides: config.secretOverrides }
             : {}),
@@ -31,6 +32,9 @@ export const wireAddon = (config) => {
         ...(config.globalCredentials
             ? { globalCredentials: config.globalCredentials }
             : {}),
+        ...(config.contentBucket ? { contentBucket: config.contentBucket } : {}),
+        ...(config.contentGrants ? { contentGrants: config.contentGrants } : {}),
+        ...(config.globalContent ? { globalContent: config.globalContent } : {}),
     });
 };
 /**

package/dist/wirings/agent/agent-prepare.js

@@ -389,6 +389,9 @@ export async function buildToolDefs(params, agentSessionMap, resourceId, agentNa
                                     credentialGrants: capturedAddonConfig?.credentialGrants,
                                     globalSecrets: capturedAddonConfig?.globalSecrets,
                                     globalCredentials: capturedAddonConfig?.globalCredentials,
+                                    contentBucket: capturedAddonConfig?.contentBucket,
+                                    contentGrants: capturedAddonConfig?.contentGrants,
+                                    globalContent: capturedAddonConfig?.globalContent,
                                 }
                                 : undefined;
                             services = await getOrCreatePackageSingletonServices(capturedPkg, singletonServices, addonInstance);

package/dist/wirings/rpc/rpc-runner.d.ts

@@ -14,6 +14,9 @@ export declare class RemoteAddonRequestError extends PikkuError {
     readonly httpStatus: number;
     constructor(namespace: string, fnName: string, status: number, detail: string);
 }
+export declare class AddonNotUsedError extends PikkuError {
+    constructor(caller: string, target: string);
+}
 export declare const resolveNamespace: (namespacedFunction: string) => ResolvedFunction | null;
 export declare class ContextAwareRPCService {
     private services;
@@ -26,6 +29,7 @@ export declare class ContextAwareRPCService {
     }, packageName?: string | null);
     rpcExposed(funcName: string, data: any): Promise<any>;
     rpc<In = any, Out = any>(funcName: string, data: In): Promise<Out>;
+    private mapUsedAddon;
     /**
      * Resolution half of an addon RPC call: never executes anything, so an
      * `RPCNotFoundError` thrown by the function itself can never be mistaken for

package/dist/wirings/rpc/rpc-runner.js

@@ -1,3 +1,4 @@
+import { addonCallerOf, addonMayReach } from '../addon/addon-reach.js';
 import { forwardStepName, isCompensationStepName, } from '../../function/compensation-name.js';
 import { runPikkuFunc } from '../../function/function-runner.js';
 import { addonInstanceForNamespace } from '../addon/addon-runner.js';
@@ -43,6 +44,15 @@ addError(RemoteAddonRequestError, {
     status: 502,
     message: 'Remote addon request failed.',
 });
+export class AddonNotUsedError extends PikkuError {
+    constructor(caller, target) {
+        super(`Addon '${caller}' called '${target}' but does not list it in its wireAddon 'uses'.`);
+    }
+}
+addError(AddonNotUsedError, {
+    status: 403,
+    message: 'Addon called another addon it does not use.',
+});
 export const resolveNamespace = (namespacedFunction) => {
     const colonIndex = namespacedFunction.indexOf(':');
     if (colonIndex === -1) {
@@ -68,6 +78,7 @@ const resolvePikkuFunction = (rpcName, packageName = null) => {
         if (pkgMeta) {
             return { pikkuFuncId: pkgMeta.pikkuFuncId || rpcName, packageName };
         }
+        throw new RPCNotFoundError(rpcName);
     }
     const rpc = pikkuState(null, 'rpc', 'meta');
     let rpcMeta = rpc[rpcName];
@@ -119,6 +130,10 @@ export class ContextAwareRPCService {
         this.packageName = packageName;
     }
     async rpcExposed(funcName, data) {
+        const addonCaller = addonCallerOf(this.wire);
+        if (addonCaller && !addonMayReach(addonCaller, funcName)) {
+            throw new AddonNotUsedError(addonCaller, funcName);
+        }
         let functionMeta;
         let resolvedAddon = null;
         if (funcName.includes(':')) {
@@ -159,6 +174,7 @@ export class ContextAwareRPCService {
             ...this.wire,
         };
         if (funcName.includes(':')) {
+            funcName = this.mapUsedAddon(funcName);
             const addonCall = this.resolveAddonFunction(funcName);
             if (addonCall !== NOT_RESOLVED) {
                 return await this.executeAddonFunction(addonCall, data, updatedWire);
@@ -170,7 +186,7 @@ export class ContextAwareRPCService {
         }
         catch (e) {
             if (e instanceof RPCNotFoundError) {
-                if (this.services.deploymentService) {
+                if (!this.packageName && this.services.deploymentService) {
                     const session = await resolveWireSession(this.wire);
                     return this.services.deploymentService.invoke(funcName, data, session, this.wire.traceId);
                 }
@@ -189,6 +205,20 @@ export class ContextAwareRPCService {
             addonInstance,
         });
     }
+    mapUsedAddon(funcName) {
+        const caller = this.wire.addonNamespace;
+        if (!caller)
+            return funcName;
+        const colon = funcName.indexOf(':');
+        const prefix = funcName.slice(0, colon);
+        if (prefix === caller)
+            return funcName;
+        const uses = pikkuState(null, 'addons', 'packages').get(caller)?.uses;
+        const mapped = uses?.[prefix];
+        if (mapped)
+            return `${mapped}${funcName.slice(colon)}`;
+        throw new AddonNotUsedError(caller, funcName);
+    }
     /**
      * Resolution half of an addon RPC call: never executes anything, so an
      * `RPCNotFoundError` thrown by the function itself can never be mistaken for
@@ -243,6 +273,9 @@ export class ContextAwareRPCService {
                 credentialGrants: resolved.addonConfig?.credentialGrants,
                 globalSecrets: resolved.addonConfig?.globalSecrets,
                 globalCredentials: resolved.addonConfig?.globalCredentials,
+                contentBucket: resolved.addonConfig?.contentBucket,
+                contentGrants: resolved.addonConfig?.contentGrants,
+                globalContent: resolved.addonConfig?.globalContent,
             },
         };
     }
@@ -305,6 +338,7 @@ export class ContextAwareRPCService {
             ...wire,
         };
         if (rpcName.includes(':')) {
+            rpcName = this.mapUsedAddon(rpcName);
             const addonCall = this.resolveAddonFunction(rpcName);
             if (addonCall !== NOT_RESOLVED) {
                 return await this.executeAddonFunction(addonCall, data, mergedWire);
@@ -315,7 +349,9 @@ export class ContextAwareRPCService {
             resolved = resolvePikkuFunction(rpcName, this.packageName);
         }
         catch (e) {
-            if (e instanceof RPCNotFoundError && this.services.deploymentService) {
+            if (e instanceof RPCNotFoundError &&
+                !this.packageName &&
+                this.services.deploymentService) {
                 const session = await resolveWireSession(mergedWire);
                 return this.services.deploymentService.invoke(rpcName, data, session, mergedWire.traceId);
             }
@@ -337,6 +373,9 @@ export class ContextAwareRPCService {
         if (!this.services.workflowService) {
             throw new Error('WorkflowService service not available');
         }
+        if (workflowName.includes(':')) {
+            workflowName = this.mapUsedAddon(workflowName);
+        }
         const parentRunId = this.wire.workflowStep?.runId ?? this.wire.graph?.runId;
         const wire = options?.wire ?? {
             type: this.wire.wireType ?? 'unknown',

package/dist/wirings/rpc/rpc-types.d.ts

@@ -59,6 +59,12 @@ export interface ResolvedFunction {
         globalSecrets?: string;
         /** Set by the consuming app: hand this instance the unscoped `CredentialService` */
         globalCredentials?: string;
+        /** Set by the consuming app: the content folder this instance owns */
+        contentBucket?: string;
+        /** Set by the consuming app: paths outside its folder this instance may read or write */
+        contentGrants?: Record<string, 'read' | 'write'>;
+        /** Set by the consuming app: hand this instance the unscoped `ContentService` */
+        globalContent?: string;
         /** Set by `wireRemoteAddon`: dispatch this namespace's RPCs over HTTP */
         remote?: boolean;
         serverUrl?: string | ((services: any) => string | Promise<string>);

package/dist/wirings/scope/index.d.ts

@@ -1,4 +1,4 @@
 export { defineScope, declareScopes } from './define-scope.js';
 export { flattenScopeDefinitions, validateAndBuildScopeDefinitionsMeta, } from './validate-scope-definitions.js';
 export type { CoreScopes, CoreScopeNode, FlatScope, ScopeDefinitionMeta, ScopeDefinitionsMeta, ScopeDefinitions, ScopeNodeMeta, ScopeOrigin, } from './scope.types.js';
-export { hasScopes, verifyScopes } from '../../scopes.js';
+export { hasScopes, intersectScopes, verifyScopes } from '../../scopes.js';

package/dist/wirings/scope/index.js

@@ -1,3 +1,3 @@
 export { defineScope, declareScopes } from './define-scope.js';
 export { flattenScopeDefinitions, validateAndBuildScopeDefinitionsMeta, } from './validate-scope-definitions.js';
-export { hasScopes, verifyScopes } from '../../scopes.js';
+export { hasScopes, intersectScopes, verifyScopes } from '../../scopes.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/core",
-  "version": "0.12.138",
+  "version": "0.12.139",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/pikkujs/pikku.git",

package/src/public-surface.json

@@ -2,9 +2,11 @@
   ".": [],
   "./types": [],
   "./middleware": [
+    "ADDON_HEADER",
     "addGlobalMiddleware",
     "addGlobalPermission",
     "addTagMiddleware",
+    "addonScopeCap",
     "authAPIKey",
     "authBearer",
     "authCookie",
@@ -109,7 +111,9 @@
     "reconstructStateAt"
   ],
   "./workflow/types": [],
-  "./actor-flow": ["runConversation"],
+  "./actor-flow": [
+    "runConversation"
+  ],
   "./virtual-user": [
     "DEFAULT_MAX_INTERVAL_MS",
     "DEFAULT_MIN_INTERVAL_MS",
@@ -172,7 +176,9 @@
     "wireHTTP",
     "wireHTTPRoutes"
   ],
-  "./remote": ["buildRemoteHeaders"],
+  "./remote": [
+    "buildRemoteHeaders"
+  ],
   "./queue": [
     "QueueJobDiscardedError",
     "QueueJobFailedError",
@@ -215,6 +221,7 @@
   ],
   "./addon": [
     "RemoteAddonAuthError",
+    "defineScreens",
     "resolveRemoteAddonToken",
     "wireAddon",
     "wireRemoteAddon"
@@ -225,7 +232,10 @@
     "safeFetch",
     "setDefaultHostResolver"
   ],
-  "./node-host-resolver": ["installNodeHostResolver", "nodeHostResolver"],
+  "./node-host-resolver": [
+    "installNodeHostResolver",
+    "nodeHostResolver"
+  ],
   "./mcp": [
     "MCPEndpointRegistry",
     "MCPError",
@@ -312,7 +322,10 @@
     "wantsStackTrace",
     "wireCLI"
   ],
-  "./cli/command-parser": ["generateCommandHelp", "parseCLIArguments"],
+  "./cli/command-parser": [
+    "generateCommandHelp",
+    "parseCLIArguments"
+  ],
   "./cli/channel": [
     "executeCLIViaChannel",
     "executeRawCLIViaChannel",
@@ -330,6 +343,7 @@
     "defineScope",
     "flattenScopeDefinitions",
     "hasScopes",
+    "intersectScopes",
     "validateAndBuildScopeDefinitionsMeta",
     "verifyScopes"
   ],
@@ -373,8 +387,13 @@
     "deriveOAuth2AppSecrets",
     "validateAndBuildSecretDefinitionsMeta"
   ],
-  "./variable": ["defineVariable", "validateAndBuildVariableDefinitionsMeta"],
-  "./webhook": ["defineOutgoingWebhook"],
+  "./variable": [
+    "defineVariable",
+    "validateAndBuildVariableDefinitionsMeta"
+  ],
+  "./webhook": [
+    "defineOutgoingWebhook"
+  ],
   "./oauth2": [],
   "./errors": [
     "AIProviderAuthError",
@@ -442,18 +461,17 @@
     "InMemoryWorkflowService",
     "IncomingWebhookService",
     "JsonConsoleLogger",
+    "LeaseLostError",
+    "LeaseTakenError",
     "LocalCredentialService",
     "LocalEmailService",
     "LocalGatewayService",
     "LocalSecretService",
     "LocalVariablesService",
-    "LeaseLostError",
-    "LeaseTakenError",
     "LogLevel",
     "NoopAuditService",
     "PIKKU_OUTGOING_WEBHOOK_QUEUE_NAME",
     "PikkuCredentialWireService",
-    "holdLease",
     "PikkuSessionService",
     "QueueWebhookService",
     "REMOTE_JOBS_SECRET_HEADER",
@@ -461,6 +479,7 @@
     "REMOTE_QUEUE_JOB_PATH",
     "REMOTE_SCHEDULER_JOB_PATH",
     "SchedulerService",
+    "ScopedContentService",
     "ScopedCredentialService",
     "ScopedSecretService",
     "SecretAccessDeniedError",
@@ -477,6 +496,7 @@
     "createStubProxy",
     "deriveActorSecret",
     "getStubTracker",
+    "holdLease",
     "isTestRun",
     "pikkuRemoteQueueJobFunc",
     "pikkuRemoteScheduledJobFunc",
@@ -500,10 +520,27 @@
     "subjectIdOf",
     "validateAndBuildFeatureFlagDefinitionsMeta"
   ],
-  "./services/local-meta": ["LocalMetaService"],
-  "./services/v8-coverage": ["V8CoverageService"],
-  "./services/istanbul-coverage": ["IstanbulCoverageService"],
-  "./services/local-content": ["LocalContent", "signedContentPath"],
+  "./services/local-meta": [
+    "LocalMetaService"
+  ],
+  "./services/v8-coverage": [
+    "V8CoverageService"
+  ],
+  "./services/istanbul-coverage": [
+    "IstanbulCoverageService"
+  ],
+  "./services/local-content": [
+    "CONTENT_VISIBILITIES",
+    "LocalContent",
+    "PUBLIC_URL_SEGMENT",
+    "UploadTooLargeError",
+    "parseContentSizeLimit",
+    "parseContentUrlPath",
+    "resolveContentRequestTarget",
+    "resolveVisibilityPath",
+    "signedContentPath",
+    "streamUploadToFile"
+  ],
   "./services/local-content-request-handler": [
     "createLocalContentRequestHandler",
     "verifySignedContentRequest"
@@ -592,6 +629,13 @@
     "getSchema",
     "validateSchema"
   ],
-  "./testing": ["clearPikkuRuntimeState", "defineServiceTests"],
-  "./dev": ["pikkuDevReloader", "reconcileAddonRegistry", "reloadGeneratedMeta"]
+  "./testing": [
+    "clearPikkuRuntimeState",
+    "defineServiceTests"
+  ],
+  "./dev": [
+    "pikkuDevReloader",
+    "reconcileAddonRegistry",
+    "reloadGeneratedMeta"
+  ]
 }