@pikku/core 0.12.139 → 0.12.141

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## 0.12.141
+
+### Patch Changes
+
+- b04e444: Fix CLI commands that come from an addon package. Auth and permissions set on such a command are now merged into the addon's own function instead of replacing it, and the command's input is shaped by the addon's own schema (for example a comma list becomes an array). The inspector now also resolves `...refCLI('addon:contract')`, spreads and `defineCLICommands` identifiers inside a command's `subcommands`.
+- d3d8a98: Graceful shutdown ignores repeat signals. A second SIGTERM or SIGINT arriving while `beforeStop` and the service teardown are still running no longer falls through to the default handler and kills the process mid-cleanup. `@pikku/core/lifecycle` is a new entry point holding `onShutdownSignals`, `stopSingletonServices` and `pikkuServerLifecycle` (the latter two stay re-exported from `utils`), which the server runtimes now share.
+- 658da50: `SecretService` gains an optional `setEncryptedSecret(key, sealed)` for stores that hold a sealing key, so a browser can seal a secret and the caller's process never sees the plaintext.
+
+## 0.12.140
+
+### Patch Changes
+
+- f396538: Event-stream responses pass through `applyWebResponse` without being read, so an SSE route can proxy another stream. HTTP responses gain `onClose`, which `executeRoute` uses to tell an SSE route's event hub when the client leaves. `pikku all` wires the console's `/meta/stream` route to `console:streamMetaChanges`.
+
 ## 0.12.139
 
 ### Patch Changes

package/dist/lifecycle.d.ts

@@ -0,0 +1,6 @@
+import type { CoreSingletonServices, ServerLifecycle } from './types/core.types.js';
+/** Stops addon package services first, then the parent singleton services. */
+export declare const stopSingletonServices: () => Promise<void>;
+/** Wrap server lifecycle hooks so the inspector can discover them. */
+export declare const pikkuServerLifecycle: <SS extends CoreSingletonServices = CoreSingletonServices>(lifecycle: ServerLifecycle<SS>) => ServerLifecycle<SS>;
+export declare const onShutdownSignals: (run: (signal: NodeJS.Signals) => void | Promise<void>, signals?: NodeJS.Signals[]) => (() => void);

package/dist/lifecycle.js

@@ -0,0 +1,58 @@
+import { getSingletonServices, getAllPackageStates } from './pikku-state.js';
+const stopService = async (logger, name, service) => {
+    const stop = service?.stop;
+    if (stop) {
+        logger.info(`Stopping singleton service: ${name}`);
+        try {
+            await stop.call(service);
+        }
+        catch (e) {
+            logger.error(`Error stopping service ${name}:`, e);
+        }
+    }
+};
+/** Stops addon package services first, then the parent singleton services. */
+export const stopSingletonServices = async () => {
+    const singletonServices = getSingletonServices();
+    const logger = singletonServices.logger;
+    const stateMap = getAllPackageStates();
+    if (stateMap.size > 0) {
+        for (const [packageName, packageState] of stateMap) {
+            if (packageName === '__main__')
+                continue;
+            const packageServices = packageState.package?.singletonServices;
+            if (packageServices) {
+                logger.info(`Stopping singleton services for package: ${packageName}`);
+                for (const [name, service] of Object.entries(packageServices)) {
+                    await stopService(logger, `${packageName}/${name}`, service);
+                }
+                packageState.package.singletonServices = null;
+            }
+        }
+    }
+    for (const [name, service] of Object.entries(singletonServices)) {
+        await stopService(logger, name, service);
+    }
+};
+/** Wrap server lifecycle hooks so the inspector can discover them. */
+export const pikkuServerLifecycle = (lifecycle) => lifecycle;
+export const onShutdownSignals = (run, signals = ['SIGINT', 'SIGTERM']) => {
+    const proc = typeof process !== 'undefined' ? process : undefined;
+    if (!proc?.on)
+        return () => { };
+    let stopping = false;
+    const handlers = signals.map((signal) => {
+        const handler = () => {
+            if (stopping)
+                return;
+            stopping = true;
+            void run(signal);
+        };
+        proc.on(signal, handler);
+        return [signal, handler];
+    });
+    return () => {
+        for (const [signal, handler] of handlers)
+            proc.off(signal, handler);
+    };
+};

package/dist/services/scoped-secret-service.d.ts

@@ -8,6 +8,7 @@ export declare class ScopedSecretService implements SecretService {
     getSecret<T = string>(key: string): Promise<SecretValue<T>>;
     hasSecret(key: string): Promise<boolean>;
     setSecret(_key: string, _value: unknown): Promise<void>;
+    setEncryptedSecret(_key: string, _sealed: string): Promise<void>;
     deleteSecret(_key: string): Promise<void>;
     getSecrets<T extends Record<string, unknown> = Record<string, unknown>>(keys: (keyof T & string)[]): Promise<Partial<SecretValues<T>>>;
 }

package/dist/services/scoped-secret-service.js

@@ -21,6 +21,9 @@ export class ScopedSecretService {
     async setSecret(_key, _value) {
         throw new Error('setSecret is not allowed in scoped secret service');
     }
+    async setEncryptedSecret(_key, _sealed) {
+        throw new Error('setEncryptedSecret is not allowed in scoped secret service');
+    }
     async deleteSecret(_key) {
         throw new Error('deleteSecret is not allowed in scoped secret service');
     }

package/dist/services/secret-service.d.ts

@@ -13,6 +13,12 @@ export interface SecretService {
     /** Answers for any key, including a disallowed one — it must not throw. */
     hasSecret(key: string): Promise<boolean>;
     setSecret(key: string, value: unknown): Promise<void>;
+    /**
+     * Stores a value sealed to this service's public key, so the plaintext never
+     * reaches the caller's process. `sealed` is the serialized envelope, opaque
+     * here. Optional: only stores that hold a sealing key implement it.
+     */
+    setEncryptedSecret?(key: string, sealed: string): Promise<void>;
     deleteSecret(key: string): Promise<void>;
     /**
      * Missing keys are omitted rather than throwing, hence `Partial<T>`: callers

package/dist/services/typed-secret-service.d.ts

@@ -41,6 +41,7 @@ export declare class TypedSecretService<TMap = Record<string, unknown>> implemen
     getSecret<T = string>(key: string): Promise<SecretValue<T>>;
     hasSecret(key: string): Promise<boolean>;
     setSecret<K extends string>(key: K, value: K extends keyof TMap ? TMap[K] : unknown): Promise<void>;
+    setEncryptedSecret(key: string, sealed: string): Promise<void>;
     deleteSecret(key: string): Promise<void>;
     getSecrets<T extends Record<string, unknown> = Record<string, unknown>>(keys: (keyof T & string)[]): Promise<Partial<SecretValues<T>>>;
     getAllStatus(): Promise<CredentialStatus[]>;

package/dist/services/typed-secret-service.js

@@ -33,6 +33,13 @@ export class TypedSecretService {
         await this.secrets.setSecret(key, value);
         this.cache.delete(key);
     }
+    async setEncryptedSecret(key, sealed) {
+        if (!this.secrets.setEncryptedSecret) {
+            throw new Error('This secret service does not accept sealed secrets');
+        }
+        await this.secrets.setEncryptedSecret(key, sealed);
+        this.cache.delete(key);
+    }
     async deleteSecret(key) {
         await this.secrets.deleteSecret(key);
         this.cache.delete(key);

package/dist/testing/service-tests/secret-service-tests.js

@@ -48,6 +48,15 @@ export const defineSecretServiceTests = (name, secretService) => {
             await service.deleteSecret('to-delete');
             assert.strictEqual(await service.hasSecret('to-delete'), false);
         });
+        test('setEncryptedSecret stores a sealed value without opening it', async (t) => {
+            const service = await factory({ key: kek });
+            if (!service.setEncryptedSecret) {
+                t.skip('store does not accept sealed secrets');
+                return;
+            }
+            await service.setEncryptedSecret('sealed-key', 'opaque-envelope');
+            assert.strictEqual(await service.hasSecret('sealed-key'), true);
+        });
         test('rotateKEK re-wraps all secrets', async () => {
             const newKEK = 'new-key-encryption-key-rotated!';
             const oldService = await factory({ key: kek });

package/dist/utils.d.ts

@@ -1,5 +1,5 @@
 import type { Logger } from './services/logger.js';
-import type { CoreSingletonServices, ServerLifecycle, WireServices } from './types/core.types.js';
+import type { WireServices } from './types/core.types.js';
 export declare const closeWireServices: (logger: Logger, wireServices: WireServices) => Promise<void>;
 export declare const createWeakUID: () => string;
 export declare const isSerializable: (data: any) => boolean;
@@ -12,10 +12,7 @@ export declare const getTagGroups: <T>(tagGroups: Record<string, T>, tag: string
  */
 export declare const parseJson: <T = any>(input: string | Uint8Array) => T;
 export declare const freezeDedupe: <T>(arr?: readonly T[] | T[] | undefined) => readonly T[];
-/** Stops addon package services first, then the parent singleton services. */
-export declare const stopSingletonServices: () => Promise<void>;
-/** Wrap server lifecycle hooks so the inspector can discover them. */
-export declare const pikkuServerLifecycle: <SS extends CoreSingletonServices = CoreSingletonServices>(lifecycle: ServerLifecycle<SS>) => ServerLifecycle<SS>;
+export { stopSingletonServices, pikkuServerLifecycle } from './lifecycle.js';
 export type MakeRequired<T, K extends keyof T> = Omit<T, K> & Required<Pick<T, K>>;
 export type JSONPrimitive = string | number | boolean | null | undefined;
 export type JSONValue = JSONPrimitive | JSONValue[] | {

package/dist/utils.js

@@ -1,4 +1,3 @@
-import { getSingletonServices, getAllPackageStates } from './pikku-state.js';
 import { BadRequestError } from './errors/errors.js';
 export const closeWireServices = async (logger, wireServices) => {
     await Promise.all(Object.values(wireServices).map(async (service) => {
@@ -77,42 +76,6 @@ export const freezeDedupe = (arr) => {
     }
     return Object.freeze(out);
 };
-const stopService = async (logger, name, service) => {
-    const stop = service?.stop;
-    if (stop) {
-        logger.info(`Stopping singleton service: ${name}`);
-        try {
-            await stop.call(service);
-        }
-        catch (e) {
-            logger.error(`Error stopping service ${name}:`, e);
-        }
-    }
-};
-/** Stops addon package services first, then the parent singleton services. */
-export const stopSingletonServices = async () => {
-    const singletonServices = getSingletonServices();
-    const logger = singletonServices.logger;
-    const stateMap = getAllPackageStates();
-    if (stateMap.size > 0) {
-        for (const [packageName, packageState] of stateMap) {
-            if (packageName === '__main__')
-                continue;
-            const packageServices = packageState.package?.singletonServices;
-            if (packageServices) {
-                logger.info(`Stopping singleton services for package: ${packageName}`);
-                for (const [name, service] of Object.entries(packageServices)) {
-                    await stopService(logger, `${packageName}/${name}`, service);
-                }
-                packageState.package.singletonServices = null;
-            }
-        }
-    }
-    for (const [name, service] of Object.entries(singletonServices)) {
-        await stopService(logger, name, service);
-    }
-};
-/** Wrap server lifecycle hooks so the inspector can discover them. */
-export const pikkuServerLifecycle = (lifecycle) => lifecycle;
+export { stopSingletonServices, pikkuServerLifecycle } from './lifecycle.js';
 export { getDurationInMilliseconds, getRelativeTimeOffset, getRelativeTimeOffsetFromNow, parseDurationString, } from './time-utils.js';
 export { formatVersionedId, isVersionedId, parseVersionedId, } from './version.js';

package/dist/wirings/cli/cli-runner.js

@@ -95,11 +95,26 @@ function registerCLICommands(commands, path = [], inheritedOptions = {}, program
         const unwrapped = unwrapFunc(command);
         const commandAuth = typeof command === 'object' ? command.auth : undefined;
         const commandPermissions = typeof command === 'object' ? command.permissions : undefined;
-        addFunction(funcName, {
-            ...unwrapped,
-            auth: commandAuth ?? unwrapped.auth,
-            permissions: commandPermissions ?? unwrapped.permissions,
-        }, currentMeta?.packageName);
+        if (currentMeta?.packageName && !funcName.includes(':')) {
+            if (commandAuth !== undefined || commandPermissions !== undefined) {
+                const registered = pikkuState(currentMeta.packageName, 'function', 'functions');
+                const existing = registered.get(funcName);
+                if (existing) {
+                    registered.set(funcName, {
+                        ...existing,
+                        auth: commandAuth ?? existing.auth,
+                        permissions: commandPermissions ?? existing.permissions,
+                    });
+                }
+            }
+        }
+        if (!currentMeta?.packageName || funcName.includes(':')) {
+            addFunction(funcName, {
+                ...unwrapped,
+                auth: commandAuth ?? unwrapped.auth,
+                permissions: commandPermissions ?? unwrapped.permissions,
+            }, currentMeta?.packageName);
+        }
         if (typeof command === 'object' && command.render) {
             if (programs[program]) {
                 programs[program].renderers[commandId] = command.render;
@@ -110,11 +125,11 @@ function registerCLICommands(commands, path = [], inheritedOptions = {}, program
         }
     }
 }
-function pluckCLIData(mergedData, funcName, availableOptions) {
-    const funcMeta = pikkuState(null, 'function', 'meta')[funcName];
+function pluckCLIData(mergedData, funcName, availableOptions, packageName) {
+    const funcMeta = pikkuState(packageName ?? null, 'function', 'meta')[funcName];
     const schemaName = funcMeta?.inputSchemaName;
     const schema = schemaName
-        ? pikkuState(funcMeta?.packageName ?? null, 'misc', 'schemas').get(schemaName)
+        ? pikkuState(packageName ?? funcMeta?.packageName ?? null, 'misc', 'schemas').get(schemaName)
         : null;
     if (schema && schema.properties) {
         const result = {};
@@ -172,7 +187,7 @@ export async function runCLICommand({ program, commandPath, data, singletonServi
     }
     const commandId = commandPath.join('.');
     const availableOptions = programData?.commandOptions?.[commandId] || {};
-    const pluckedData = () => pluckCLIData(data, funcName, availableOptions);
+    const pluckedData = () => pluckCLIData(data, funcName, availableOptions, currentCommand.packageName);
     const renderer = programData?.renderers[commandId] || programData?.defaultRenderer;
     let cliState;
     const channel = {

package/dist/wirings/http/http-runner.js

@@ -164,6 +164,10 @@ const executeRoute = async (services, matchedRoute, http, options) => {
                 await originalClose();
             };
         }
+        response.onClose?.(() => {
+            channel.state = 'closed';
+            singletonServices.eventHub?.onChannelClosed(channelId);
+        });
     }
     const wire = {
         traceId: requestId,

package/dist/wirings/http/http.types.d.ts

@@ -185,6 +185,7 @@ export interface PikkuHTTPResponse<Out = unknown> {
     send?(data: string | ArrayBuffer | ArrayBufferView): this;
     redirect(location: string, status?: number): this;
     close?: () => void;
+    onClose?: (callback: () => void) => void;
     setMode?: (mode: 'stream') => void;
     flushHeaders?: () => void;
 }

package/dist/wirings/http/pikku-fetch-http-response.d.ts

@@ -14,6 +14,7 @@ export declare class PikkuFetchHTTPResponse implements PikkuHTTPResponse {
     send(data: any): this;
     redirect(location: string, status?: number): this;
     close(): this;
+    onClose(callback: () => void): void;
     toResponse(args?: Record<string, any>): Response;
     private createStream;
 }

package/dist/wirings/http/pikku-fetch-http-response.js

@@ -8,6 +8,7 @@ export class PikkuFetchHTTPResponse {
     #send = null;
     #close = null;
     #cancelStream = null;
+    #onClose = [];
     setMode(mode) {
         this.#responseMode = 'stream';
         if (mode === 'stream') {
@@ -95,6 +96,15 @@ export class PikkuFetchHTTPResponse {
         }
         return this;
     }
+    onClose(callback) {
+        this.#onClose.push(callback);
+    }
+    #closed() {
+        const callbacks = this.#onClose;
+        this.#onClose = [];
+        for (const callback of callbacks)
+            callback();
+    }
     toResponse(args) {
         const cookieHeader = Array.from(this.#cookies.entries()).map(([name, { value, flags }]) => stringifySetCookie({ name, value, ...flags }, flags));
         cookieHeader.forEach((cookie) => this.#headers.append('Set-Cookie', cookie));
@@ -119,9 +129,11 @@ export class PikkuFetchHTTPResponse {
                         return;
                     closed = true;
                     controller.close();
+                    this.#closed();
                 };
                 this.#cancelStream = () => {
                     closed = true;
+                    this.#closed();
                 };
                 this.#send = send;
                 this.#close = close;

package/dist/wirings/http/web-request.js

@@ -1,3 +1,4 @@
+import { PikkuFetchHTTPResponse } from './pikku-fetch-http-response.js';
 export function toWebRequest(req, baseUrl) {
     const proto = req.header('x-forwarded-proto') ?? 'http';
     const host = req.header('x-forwarded-host') ?? req.header('host') ?? 'localhost';
@@ -120,6 +121,12 @@ export async function applyWebResponse(res, webResponse) {
     if (setCookieValues.length > 0) {
         res.header('Set-Cookie', setCookieValues);
     }
+    if (webResponse.body &&
+        res instanceof PikkuFetchHTTPResponse &&
+        webResponse.headers.get('content-type')?.startsWith('text/event-stream')) {
+        res.send(webResponse.body);
+        return;
+    }
     const body = await readBody(webResponse);
     if (body !== null) {
         if (res.send) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/core",
-  "version": "0.12.139",
+  "version": "0.12.141",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/pikkujs/pikku.git",
@@ -87,6 +87,7 @@
     "./state": "./dist/pikku-state.js",
     "./classification": "./dist/classification/index.js",
     "./utils": "./dist/utils.js",
+    "./lifecycle": "./dist/lifecycle.js",
     "./schema": "./dist/schema.js",
     "./testing": "./dist/testing/index.js",
     "./dev": "./dist/dev/hot-reload.js"

package/src/public-surface.json

@@ -621,6 +621,11 @@
     "pikkuServerLifecycle",
     "stopSingletonServices"
   ],
+  "./lifecycle": [
+    "onShutdownSignals",
+    "pikkuServerLifecycle",
+    "stopSingletonServices"
+  ],
   "./schema": [
     "addSchema",
     "applyDefaultsFromSchema",