@pikku/core 0.12.138 → 0.12.141

package/dist/utils.js

@@ -1,4 +1,3 @@
-import { getSingletonServices, getAllPackageStates } from './pikku-state.js';
 import { BadRequestError } from './errors/errors.js';
 export const closeWireServices = async (logger, wireServices) => {
     await Promise.all(Object.values(wireServices).map(async (service) => {
@@ -77,42 +76,6 @@ export const freezeDedupe = (arr) => {
     }
     return Object.freeze(out);
 };
-const stopService = async (logger, name, service) => {
-    const stop = service?.stop;
-    if (stop) {
-        logger.info(`Stopping singleton service: ${name}`);
-        try {
-            await stop.call(service);
-        }
-        catch (e) {
-            logger.error(`Error stopping service ${name}:`, e);
-        }
-    }
-};
-/** Stops addon package services first, then the parent singleton services. */
-export const stopSingletonServices = async () => {
-    const singletonServices = getSingletonServices();
-    const logger = singletonServices.logger;
-    const stateMap = getAllPackageStates();
-    if (stateMap.size > 0) {
-        for (const [packageName, packageState] of stateMap) {
-            if (packageName === '__main__')
-                continue;
-            const packageServices = packageState.package?.singletonServices;
-            if (packageServices) {
-                logger.info(`Stopping singleton services for package: ${packageName}`);
-                for (const [name, service] of Object.entries(packageServices)) {
-                    await stopService(logger, `${packageName}/${name}`, service);
-                }
-                packageState.package.singletonServices = null;
-            }
-        }
-    }
-    for (const [name, service] of Object.entries(singletonServices)) {
-        await stopService(logger, name, service);
-    }
-};
-/** Wrap server lifecycle hooks so the inspector can discover them. */
-export const pikkuServerLifecycle = (lifecycle) => lifecycle;
+export { stopSingletonServices, pikkuServerLifecycle } from './lifecycle.js';
 export { getDurationInMilliseconds, getRelativeTimeOffset, getRelativeTimeOffsetFromNow, parseDurationString, } from './time-utils.js';
 export { formatVersionedId, isVersionedId, parseVersionedId, } from './version.js';

package/dist/wirings/addon/addon-reach.d.ts

@@ -0,0 +1,3 @@
+import type { PikkuRawWire } from '../../types/core.types.js';
+export declare const addonMayReach: (caller: string, funcName: string) => boolean;
+export declare const addonCallerOf: (wire: PikkuRawWire) => string | undefined;

package/dist/wirings/addon/addon-reach.js

@@ -0,0 +1,21 @@
+import { ForbiddenError } from '../../errors/errors.js';
+import { ADDON_HEADER } from '../../middleware/addon-scope-cap.js';
+import { pikkuState } from '../../pikku-state.js';
+export const addonMayReach = (caller, funcName) => {
+    const target = funcName.slice(0, Math.max(funcName.indexOf(':'), 0));
+    if (!target)
+        return false;
+    if (target === caller)
+        return true;
+    const uses = pikkuState(null, 'addons', 'packages').get(caller)?.uses;
+    return !!uses && Object.values(uses).includes(target);
+};
+export const addonCallerOf = (wire) => {
+    const name = wire.http?.request?.header(ADDON_HEADER);
+    if (!name)
+        return undefined;
+    if (!pikkuState(null, 'addons', 'packages').has(name)) {
+        throw new ForbiddenError(`Unknown addon '${name}'`);
+    }
+    return name;
+};

package/dist/wirings/addon/addon-runner.d.ts

@@ -13,6 +13,12 @@ export type AddonInstance = {
     globalSecrets?: string;
     /** Set by the consuming app to opt this instance out of credential scoping. */
     globalCredentials?: string;
+    /** Set by the consuming app: the folder of the content store this instance owns. */
+    contentBucket?: string;
+    /** Set by the consuming app: paths outside its folder this instance may read or write. */
+    contentGrants?: Record<string, 'read' | 'write'>;
+    /** Set by the consuming app to opt this instance out of content scoping. */
+    globalContent?: string;
 };
 export declare const getOrCreatePackageSingletonServices: (packageName: string, parentServices: CoreSingletonServices, addonInstance?: AddonInstance) => Promise<CoreSingletonServices>;
 export declare const addonInstanceForNamespace: (namespace: string | undefined, expectedPackage: string) => AddonInstance | undefined;

package/dist/wirings/addon/addon-runner.js

@@ -1,6 +1,7 @@
 import { pikkuState } from '../../pikku-state.js';
 import { ScopedSecretService } from '../../services/scoped-secret-service.js';
 import { ScopedCredentialService } from '../../services/scoped-credential-service.js';
+import { ScopedContentService } from '../../services/scoped-content-service.js';
 /**
  * What the addon declared, plus what the host lent it. Scoping runs outside the
  * aliaser, so every name here is the one the addon reads — which is why an
@@ -105,6 +106,7 @@ const scopeWebhookService = (service, namespace) => {
     return scoped;
 };
 export const getOrCreatePackageSingletonServices = async (packageName, parentServices, addonInstance) => {
+    addonInstance ??= addonInstanceForNamespace(findAddonNamespaceForPackage(packageName) ?? undefined, packageName);
     const cacheKey = addonInstance?.namespace ?? packageName;
     const cachedServices = pikkuState(cacheKey, 'package', 'singletonServices');
     if (cachedServices) {
@@ -137,6 +139,14 @@ export const getOrCreatePackageSingletonServices = async (packageName, parentSer
         };
     }
     const namespace = addonInstance?.namespace ?? findAddonNamespaceForPackage(packageName);
+    if (!addonInstance?.globalContent && existingServices.content) {
+        existingServices = {
+            ...existingServices,
+            content: new ScopedContentService(existingServices.content, addonInstance?.contentBucket ??
+                namespace ??
+                packageName.replace(/[^A-Za-z0-9._-]+/g, '-').replace(/^-+|-+$/g, ''), addonInstance?.contentGrants),
+        };
+    }
     if (namespace && existingServices.webhookService) {
         existingServices = {
             ...existingServices,
@@ -176,5 +186,8 @@ export const addonInstanceForNamespace = (namespace, expectedPackage) => {
         credentialGrants: cfg.credentialGrants,
         globalSecrets: cfg.globalSecrets,
         globalCredentials: cfg.globalCredentials,
+        contentBucket: cfg.contentBucket,
+        contentGrants: cfg.contentGrants,
+        globalContent: cfg.globalContent,
     };
 };

package/dist/wirings/addon/define-screens.d.ts

@@ -0,0 +1,32 @@
+type AddonScreenBase = {
+    /** Where the screen mounts under the addon, e.g. `/` or `/:id`. */
+    path: string;
+    title: string;
+    /** Lists the screen in the host's navigation. */
+    nav?: boolean;
+    /** Required of the viewer to see the screen. The addon's functions must enforce the same scopes: hiding a screen is not access control. */
+    scopes?: string[];
+};
+/** A screen rendered by the host from the addon's source. */
+export type AddonComponentScreen = AddonScreenBase & {
+    component: () => Promise<{
+        default: unknown;
+    }>;
+};
+/** A static program the host serves in a sandboxed iframe. */
+export type AddonAppScreen = AddonScreenBase & {
+    /** Directory of the built program, relative to the addon package. */
+    app: string;
+};
+export type AddonScreen = AddonComponentScreen | AddonAppScreen;
+export type ScreensManifest = {
+    title: string;
+    icon?: string;
+    screens: AddonScreen[];
+};
+/**
+ * Declares the screens an addon ships, which the host mounts when it is wired
+ * with `ui: true`. Read statically by `pikku all`, so `path`, `title`, `nav`, `scopes` and `app` must be literals.
+ */
+export declare const defineScreens: (manifest: ScreensManifest) => ScreensManifest;
+export {};

package/dist/wirings/addon/define-screens.js

@@ -0,0 +1,5 @@
+/**
+ * Declares the screens an addon ships, which the host mounts when it is wired
+ * with `ui: true`. Read statically by `pikku all`, so `path`, `title`, `nav`, `scopes` and `app` must be literals.
+ */
+export const defineScreens = (manifest) => manifest;

package/dist/wirings/addon/index.d.ts

@@ -1,5 +1,7 @@
 export { wireAddon } from './wire-addon.js';
 export type { WireAddonConfig } from './wire-addon.js';
+export { defineScreens } from './define-screens.js';
+export type { ScreensManifest, AddonScreen, AddonComponentScreen, AddonAppScreen, } from './define-screens.js';
 export { wireRemoteAddon } from './wire-remote-addon.js';
 export type { WireRemoteAddonConfig, RemoteAddonAuth, } from './wire-remote-addon.js';
 export { resolveRemoteAddonToken, RemoteAddonAuthError, } from './remote-addon-auth.js';

package/dist/wirings/addon/index.js

@@ -1,3 +1,4 @@
 export { wireAddon } from './wire-addon.js';
+export { defineScreens } from './define-screens.js';
 export { wireRemoteAddon } from './wire-remote-addon.js';
 export { resolveRemoteAddonToken, RemoteAddonAuthError, } from './remote-addon-auth.js';

package/dist/wirings/addon/wire-addon.d.ts

@@ -41,8 +41,21 @@ export type WireAddonConfig = {
     mcpEndpoint?: boolean | string;
     /** Filters this addon in and out of a build — see the `tags` option on `pikku all`. It has no effect at runtime. */
     tags?: string[];
+    /**
+     * Mounts the screens the addon ships (see `defineScreens`) in the host under
+     * `/addons/<name>`. Without it the addon's screens are ignored. The package
+     * must declare at least one, or `pikku all` rejects the wiring.
+     */
+    ui?: boolean;
     /** Required of every function in the addon, on top of the function's own. */
     scopes?: string[];
+    /**
+     * The other addons this one may call, as `{ '<package>': '<name>' }`: the
+     * package it was written against, and the name that package is wired under
+     * in this app. The addon calls `'<package>:<function>'`; anything it did not
+     * list is refused, whatever else the app has wired.
+     */
+    uses?: Record<string, string>;
     /** Points a secret the addon reads at a different key in this deployment, so two instances can hold different credentials. */
     secretOverrides?: Record<string, string>;
     /** Points a variable the addon reads at a different key in this deployment. */
@@ -65,6 +78,20 @@ export type WireAddonConfig = {
      * deploy manifest, and only the consuming app can grant it.
      */
     globalCredentials?: string;
+    /**
+     * The folder of the content store this instance owns. Everything it stores
+     * lands under it and it cannot see past it. Defaults to `name`.
+     */
+    contentBucket?: string;
+    /**
+     * Paths outside its own folder this instance may use, by path prefix:
+     * `read` allows reads and signed downloads, `write` adds uploads, writes and
+     * deletes. The longest matching prefix decides. The addon names a granted
+     * path by starting its bucket with `@`.
+     */
+    contentGrants?: Record<string, 'read' | 'write'>;
+    /** Hands over the whole `ContentService` unscoped. The value is the reason, recorded in the deploy manifest. */
+    globalContent?: string;
 };
 /**
  * Installs an addon into this project: its functions, wirings and scopes become

package/dist/wirings/addon/wire-addon.js

@@ -14,6 +14,7 @@ export const wireAddon = (config) => {
         tags: config.tags,
         ...(config.expose !== undefined ? { expose: config.expose } : {}),
         ...(config.scopes ? { scopes: config.scopes } : {}),
+        ...(config.uses ? { uses: config.uses } : {}),
         ...(config.secretOverrides
             ? { secretOverrides: config.secretOverrides }
             : {}),
@@ -31,6 +32,9 @@ export const wireAddon = (config) => {
         ...(config.globalCredentials
             ? { globalCredentials: config.globalCredentials }
             : {}),
+        ...(config.contentBucket ? { contentBucket: config.contentBucket } : {}),
+        ...(config.contentGrants ? { contentGrants: config.contentGrants } : {}),
+        ...(config.globalContent ? { globalContent: config.globalContent } : {}),
     });
 };
 /**

package/dist/wirings/agent/agent-prepare.js

@@ -389,6 +389,9 @@ export async function buildToolDefs(params, agentSessionMap, resourceId, agentNa
                                     credentialGrants: capturedAddonConfig?.credentialGrants,
                                     globalSecrets: capturedAddonConfig?.globalSecrets,
                                     globalCredentials: capturedAddonConfig?.globalCredentials,
+                                    contentBucket: capturedAddonConfig?.contentBucket,
+                                    contentGrants: capturedAddonConfig?.contentGrants,
+                                    globalContent: capturedAddonConfig?.globalContent,
                                 }
                                 : undefined;
                             services = await getOrCreatePackageSingletonServices(capturedPkg, singletonServices, addonInstance);

package/dist/wirings/cli/cli-runner.js

@@ -95,11 +95,26 @@ function registerCLICommands(commands, path = [], inheritedOptions = {}, program
         const unwrapped = unwrapFunc(command);
         const commandAuth = typeof command === 'object' ? command.auth : undefined;
         const commandPermissions = typeof command === 'object' ? command.permissions : undefined;
-        addFunction(funcName, {
-            ...unwrapped,
-            auth: commandAuth ?? unwrapped.auth,
-            permissions: commandPermissions ?? unwrapped.permissions,
-        }, currentMeta?.packageName);
+        if (currentMeta?.packageName && !funcName.includes(':')) {
+            if (commandAuth !== undefined || commandPermissions !== undefined) {
+                const registered = pikkuState(currentMeta.packageName, 'function', 'functions');
+                const existing = registered.get(funcName);
+                if (existing) {
+                    registered.set(funcName, {
+                        ...existing,
+                        auth: commandAuth ?? existing.auth,
+                        permissions: commandPermissions ?? existing.permissions,
+                    });
+                }
+            }
+        }
+        if (!currentMeta?.packageName || funcName.includes(':')) {
+            addFunction(funcName, {
+                ...unwrapped,
+                auth: commandAuth ?? unwrapped.auth,
+                permissions: commandPermissions ?? unwrapped.permissions,
+            }, currentMeta?.packageName);
+        }
         if (typeof command === 'object' && command.render) {
             if (programs[program]) {
                 programs[program].renderers[commandId] = command.render;
@@ -110,11 +125,11 @@ function registerCLICommands(commands, path = [], inheritedOptions = {}, program
         }
     }
 }
-function pluckCLIData(mergedData, funcName, availableOptions) {
-    const funcMeta = pikkuState(null, 'function', 'meta')[funcName];
+function pluckCLIData(mergedData, funcName, availableOptions, packageName) {
+    const funcMeta = pikkuState(packageName ?? null, 'function', 'meta')[funcName];
     const schemaName = funcMeta?.inputSchemaName;
     const schema = schemaName
-        ? pikkuState(funcMeta?.packageName ?? null, 'misc', 'schemas').get(schemaName)
+        ? pikkuState(packageName ?? funcMeta?.packageName ?? null, 'misc', 'schemas').get(schemaName)
         : null;
     if (schema && schema.properties) {
         const result = {};
@@ -172,7 +187,7 @@ export async function runCLICommand({ program, commandPath, data, singletonServi
     }
     const commandId = commandPath.join('.');
     const availableOptions = programData?.commandOptions?.[commandId] || {};
-    const pluckedData = () => pluckCLIData(data, funcName, availableOptions);
+    const pluckedData = () => pluckCLIData(data, funcName, availableOptions, currentCommand.packageName);
     const renderer = programData?.renderers[commandId] || programData?.defaultRenderer;
     let cliState;
     const channel = {

package/dist/wirings/http/http-runner.js

@@ -164,6 +164,10 @@ const executeRoute = async (services, matchedRoute, http, options) => {
                 await originalClose();
             };
         }
+        response.onClose?.(() => {
+            channel.state = 'closed';
+            singletonServices.eventHub?.onChannelClosed(channelId);
+        });
     }
     const wire = {
         traceId: requestId,

package/dist/wirings/http/http.types.d.ts

@@ -185,6 +185,7 @@ export interface PikkuHTTPResponse<Out = unknown> {
     send?(data: string | ArrayBuffer | ArrayBufferView): this;
     redirect(location: string, status?: number): this;
     close?: () => void;
+    onClose?: (callback: () => void) => void;
     setMode?: (mode: 'stream') => void;
     flushHeaders?: () => void;
 }

package/dist/wirings/http/pikku-fetch-http-response.d.ts

@@ -14,6 +14,7 @@ export declare class PikkuFetchHTTPResponse implements PikkuHTTPResponse {
     send(data: any): this;
     redirect(location: string, status?: number): this;
     close(): this;
+    onClose(callback: () => void): void;
     toResponse(args?: Record<string, any>): Response;
     private createStream;
 }

package/dist/wirings/http/pikku-fetch-http-response.js

@@ -8,6 +8,7 @@ export class PikkuFetchHTTPResponse {
     #send = null;
     #close = null;
     #cancelStream = null;
+    #onClose = [];
     setMode(mode) {
         this.#responseMode = 'stream';
         if (mode === 'stream') {
@@ -95,6 +96,15 @@ export class PikkuFetchHTTPResponse {
         }
         return this;
     }
+    onClose(callback) {
+        this.#onClose.push(callback);
+    }
+    #closed() {
+        const callbacks = this.#onClose;
+        this.#onClose = [];
+        for (const callback of callbacks)
+            callback();
+    }
     toResponse(args) {
         const cookieHeader = Array.from(this.#cookies.entries()).map(([name, { value, flags }]) => stringifySetCookie({ name, value, ...flags }, flags));
         cookieHeader.forEach((cookie) => this.#headers.append('Set-Cookie', cookie));
@@ -119,9 +129,11 @@ export class PikkuFetchHTTPResponse {
                         return;
                     closed = true;
                     controller.close();
+                    this.#closed();
                 };
                 this.#cancelStream = () => {
                     closed = true;
+                    this.#closed();
                 };
                 this.#send = send;
                 this.#close = close;

package/dist/wirings/http/web-request.js

@@ -1,3 +1,4 @@
+import { PikkuFetchHTTPResponse } from './pikku-fetch-http-response.js';
 export function toWebRequest(req, baseUrl) {
     const proto = req.header('x-forwarded-proto') ?? 'http';
     const host = req.header('x-forwarded-host') ?? req.header('host') ?? 'localhost';
@@ -120,6 +121,12 @@ export async function applyWebResponse(res, webResponse) {
     if (setCookieValues.length > 0) {
         res.header('Set-Cookie', setCookieValues);
     }
+    if (webResponse.body &&
+        res instanceof PikkuFetchHTTPResponse &&
+        webResponse.headers.get('content-type')?.startsWith('text/event-stream')) {
+        res.send(webResponse.body);
+        return;
+    }
     const body = await readBody(webResponse);
     if (body !== null) {
         if (res.send) {

package/dist/wirings/rpc/rpc-runner.d.ts

@@ -14,6 +14,9 @@ export declare class RemoteAddonRequestError extends PikkuError {
     readonly httpStatus: number;
     constructor(namespace: string, fnName: string, status: number, detail: string);
 }
+export declare class AddonNotUsedError extends PikkuError {
+    constructor(caller: string, target: string);
+}
 export declare const resolveNamespace: (namespacedFunction: string) => ResolvedFunction | null;
 export declare class ContextAwareRPCService {
     private services;
@@ -26,6 +29,7 @@ export declare class ContextAwareRPCService {
     }, packageName?: string | null);
     rpcExposed(funcName: string, data: any): Promise<any>;
     rpc<In = any, Out = any>(funcName: string, data: In): Promise<Out>;
+    private mapUsedAddon;
     /**
      * Resolution half of an addon RPC call: never executes anything, so an
      * `RPCNotFoundError` thrown by the function itself can never be mistaken for

package/dist/wirings/rpc/rpc-runner.js

@@ -1,3 +1,4 @@
+import { addonCallerOf, addonMayReach } from '../addon/addon-reach.js';
 import { forwardStepName, isCompensationStepName, } from '../../function/compensation-name.js';
 import { runPikkuFunc } from '../../function/function-runner.js';
 import { addonInstanceForNamespace } from '../addon/addon-runner.js';
@@ -43,6 +44,15 @@ addError(RemoteAddonRequestError, {
     status: 502,
     message: 'Remote addon request failed.',
 });
+export class AddonNotUsedError extends PikkuError {
+    constructor(caller, target) {
+        super(`Addon '${caller}' called '${target}' but does not list it in its wireAddon 'uses'.`);
+    }
+}
+addError(AddonNotUsedError, {
+    status: 403,
+    message: 'Addon called another addon it does not use.',
+});
 export const resolveNamespace = (namespacedFunction) => {
     const colonIndex = namespacedFunction.indexOf(':');
     if (colonIndex === -1) {
@@ -68,6 +78,7 @@ const resolvePikkuFunction = (rpcName, packageName = null) => {
         if (pkgMeta) {
             return { pikkuFuncId: pkgMeta.pikkuFuncId || rpcName, packageName };
         }
+        throw new RPCNotFoundError(rpcName);
     }
     const rpc = pikkuState(null, 'rpc', 'meta');
     let rpcMeta = rpc[rpcName];
@@ -119,6 +130,10 @@ export class ContextAwareRPCService {
         this.packageName = packageName;
     }
     async rpcExposed(funcName, data) {
+        const addonCaller = addonCallerOf(this.wire);
+        if (addonCaller && !addonMayReach(addonCaller, funcName)) {
+            throw new AddonNotUsedError(addonCaller, funcName);
+        }
         let functionMeta;
         let resolvedAddon = null;
         if (funcName.includes(':')) {
@@ -159,6 +174,7 @@ export class ContextAwareRPCService {
             ...this.wire,
         };
         if (funcName.includes(':')) {
+            funcName = this.mapUsedAddon(funcName);
             const addonCall = this.resolveAddonFunction(funcName);
             if (addonCall !== NOT_RESOLVED) {
                 return await this.executeAddonFunction(addonCall, data, updatedWire);
@@ -170,7 +186,7 @@ export class ContextAwareRPCService {
         }
         catch (e) {
             if (e instanceof RPCNotFoundError) {
-                if (this.services.deploymentService) {
+                if (!this.packageName && this.services.deploymentService) {
                     const session = await resolveWireSession(this.wire);
                     return this.services.deploymentService.invoke(funcName, data, session, this.wire.traceId);
                 }
@@ -189,6 +205,20 @@ export class ContextAwareRPCService {
             addonInstance,
         });
     }
+    mapUsedAddon(funcName) {
+        const caller = this.wire.addonNamespace;
+        if (!caller)
+            return funcName;
+        const colon = funcName.indexOf(':');
+        const prefix = funcName.slice(0, colon);
+        if (prefix === caller)
+            return funcName;
+        const uses = pikkuState(null, 'addons', 'packages').get(caller)?.uses;
+        const mapped = uses?.[prefix];
+        if (mapped)
+            return `${mapped}${funcName.slice(colon)}`;
+        throw new AddonNotUsedError(caller, funcName);
+    }
     /**
      * Resolution half of an addon RPC call: never executes anything, so an
      * `RPCNotFoundError` thrown by the function itself can never be mistaken for
@@ -243,6 +273,9 @@ export class ContextAwareRPCService {
                 credentialGrants: resolved.addonConfig?.credentialGrants,
                 globalSecrets: resolved.addonConfig?.globalSecrets,
                 globalCredentials: resolved.addonConfig?.globalCredentials,
+                contentBucket: resolved.addonConfig?.contentBucket,
+                contentGrants: resolved.addonConfig?.contentGrants,
+                globalContent: resolved.addonConfig?.globalContent,
             },
         };
     }
@@ -305,6 +338,7 @@ export class ContextAwareRPCService {
             ...wire,
         };
         if (rpcName.includes(':')) {
+            rpcName = this.mapUsedAddon(rpcName);
             const addonCall = this.resolveAddonFunction(rpcName);
             if (addonCall !== NOT_RESOLVED) {
                 return await this.executeAddonFunction(addonCall, data, mergedWire);
@@ -315,7 +349,9 @@ export class ContextAwareRPCService {
             resolved = resolvePikkuFunction(rpcName, this.packageName);
         }
         catch (e) {
-            if (e instanceof RPCNotFoundError && this.services.deploymentService) {
+            if (e instanceof RPCNotFoundError &&
+                !this.packageName &&
+                this.services.deploymentService) {
                 const session = await resolveWireSession(mergedWire);
                 return this.services.deploymentService.invoke(rpcName, data, session, mergedWire.traceId);
             }
@@ -337,6 +373,9 @@ export class ContextAwareRPCService {
         if (!this.services.workflowService) {
             throw new Error('WorkflowService service not available');
         }
+        if (workflowName.includes(':')) {
+            workflowName = this.mapUsedAddon(workflowName);
+        }
         const parentRunId = this.wire.workflowStep?.runId ?? this.wire.graph?.runId;
         const wire = options?.wire ?? {
             type: this.wire.wireType ?? 'unknown',

package/dist/wirings/rpc/rpc-types.d.ts

@@ -59,6 +59,12 @@ export interface ResolvedFunction {
         globalSecrets?: string;
         /** Set by the consuming app: hand this instance the unscoped `CredentialService` */
         globalCredentials?: string;
+        /** Set by the consuming app: the content folder this instance owns */
+        contentBucket?: string;
+        /** Set by the consuming app: paths outside its folder this instance may read or write */
+        contentGrants?: Record<string, 'read' | 'write'>;
+        /** Set by the consuming app: hand this instance the unscoped `ContentService` */
+        globalContent?: string;
         /** Set by `wireRemoteAddon`: dispatch this namespace's RPCs over HTTP */
         remote?: boolean;
         serverUrl?: string | ((services: any) => string | Promise<string>);

package/dist/wirings/scope/index.d.ts

@@ -1,4 +1,4 @@
 export { defineScope, declareScopes } from './define-scope.js';
 export { flattenScopeDefinitions, validateAndBuildScopeDefinitionsMeta, } from './validate-scope-definitions.js';
 export type { CoreScopes, CoreScopeNode, FlatScope, ScopeDefinitionMeta, ScopeDefinitionsMeta, ScopeDefinitions, ScopeNodeMeta, ScopeOrigin, } from './scope.types.js';
-export { hasScopes, verifyScopes } from '../../scopes.js';
+export { hasScopes, intersectScopes, verifyScopes } from '../../scopes.js';

package/dist/wirings/scope/index.js

@@ -1,3 +1,3 @@
 export { defineScope, declareScopes } from './define-scope.js';
 export { flattenScopeDefinitions, validateAndBuildScopeDefinitionsMeta, } from './validate-scope-definitions.js';
-export { hasScopes, verifyScopes } from '../../scopes.js';
+export { hasScopes, intersectScopes, verifyScopes } from '../../scopes.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/core",
-  "version": "0.12.138",
+  "version": "0.12.141",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/pikkujs/pikku.git",
@@ -87,6 +87,7 @@
     "./state": "./dist/pikku-state.js",
     "./classification": "./dist/classification/index.js",
     "./utils": "./dist/utils.js",
+    "./lifecycle": "./dist/lifecycle.js",
     "./schema": "./dist/schema.js",
     "./testing": "./dist/testing/index.js",
     "./dev": "./dist/dev/hot-reload.js"