@pikku/core 0.12.19 → 0.12.21

package/dist/services/content-service.d.ts

@@ -1,60 +1,89 @@
-export interface ContentService {
+/**
+ * Arguments for signing a content key into a time-limited URL.
+ */
+export interface SignContentKeyArgs<TBucket extends string = string> {
+    bucket: TBucket;
+    contentKey: string;
+    dateLessThan: Date;
+    dateGreaterThan?: Date;
+}
+/**
+ * Arguments for signing an arbitrary URL.
+ */
+export interface SignURLArgs {
+    url: string;
+    dateLessThan: Date;
+    dateGreaterThan?: Date;
+}
+/**
+ * Arguments for minting a presigned upload URL.
+ */
+export interface GetUploadURLArgs<TBucket extends string = string> {
+    bucket: TBucket;
+    fileKey: string;
+    contentType: string;
+    size?: number;
+}
+/**
+ * Result of minting a presigned upload URL.
+ */
+export interface UploadURLResult {
+    uploadUrl: string;
+    assetKey: string;
+    uploadHeaders?: Record<string, string>;
+    uploadMethod?: 'PUT' | 'POST';
+}
+/**
+ * Arguments for an operation that targets a single object by key.
+ */
+export interface BucketKeyArgs<TBucket extends string = string> {
+    bucket: TBucket;
+    key: string;
+}
+/**
+ * Arguments for writing a stream to storage.
+ */
+export interface WriteFileArgs<TBucket extends string = string> extends BucketKeyArgs<TBucket> {
+    stream: ReadableStream | NodeJS.ReadableStream;
+}
+/**
+ * Arguments for copying a local file into storage.
+ */
+export interface CopyFileArgs<TBucket extends string = string> extends BucketKeyArgs<TBucket> {
+    fromAbsolutePath: string;
+}
+export interface ContentService<TBucket extends string = string> {
     /**
      * Signs a content key to generate a secure, time-limited access URL.
-     * @param contentKey - The key representing the content object.
-     * @param dateLessThan - The expiration time for the signed URL.
-     * @param dateGreaterThan - (Optional) Start time before which access is denied.
      */
-    signContentKey(contentKey: string, dateLessThan: Date, dateGreaterThan?: Date): Promise<string>;
+    signContentKey(args: SignContentKeyArgs<TBucket>): Promise<string>;
     /**
      * Signs an arbitrary URL to generate a secure, time-limited access URL.
-     * @param url - The full URL that needs signing.
-     * @param dateLessThan - The expiration time for the signed URL.
-     * @param dateGreaterThan - (Optional) Start time before which access is denied.
      */
-    signURL(url: string, dateLessThan: Date, dateGreaterThan?: Date): Promise<string>;
+    signURL(args: SignURLArgs): Promise<string>;
     /**
      * Generates a signed URL for uploading a file directly to storage.
-     * @param fileKey - The desired key/location of the uploaded file.
-     * @param contentType - The MIME type of the file.
-     * @returns A signed upload URL and the finalized asset key.
+     * Bucket policy (size limits, MIME allowlist) is enforced by the implementation.
      */
-    getUploadURL(fileKey: string, contentType: string): Promise<{
-        uploadUrl: string;
-        assetKey: string;
-        uploadHeaders?: Record<string, string>;
-        uploadMethod?: 'PUT' | 'POST';
-    }>;
+    getUploadURL(args: GetUploadURLArgs<TBucket>): Promise<UploadURLResult>;
     /**
      * Deletes a file from the storage backend.
-     * @param fileName - The name or key of the file to delete.
-     * @returns A boolean indicating success.
      */
-    deleteFile(fileName: string): Promise<boolean>;
+    deleteFile(args: BucketKeyArgs<TBucket>): Promise<boolean>;
     /**
-     * Uploads a file stream to storage under a specified asset key.
-     * @param assetKey - The key where the file will be saved.
-     * @param stream - A readable stream of the file contents.
-     * @returns A boolean indicating success.
+     * Uploads a file stream to storage under the specified bucket + key.
      */
-    writeFile(assetKey: string, stream: ReadableStream | NodeJS.ReadableStream): Promise<boolean>;
+    writeFile(args: WriteFileArgs<TBucket>): Promise<boolean>;
     /**
-     * Copies a file from a local absolute path into storage under a new asset key.
-     * @param assetKey - The destination key.
-     * @param fromAbsolutePath - The local absolute file path.
-     * @returns A boolean indicating success.
+     * Copies a file from a local absolute path into storage.
      */
-    copyFile(assetKey: string, fromAbsolutePath: string): Promise<boolean>;
+    copyFile(args: CopyFileArgs<TBucket>): Promise<boolean>;
     /**
      * Reads a file from storage as a readable stream.
-     * @param assetKey - The key of the file to read.
-     * @returns A readable file stream.
      */
-    readFile(assetKey: string): Promise<ReadableStream | NodeJS.ReadableStream>;
+    readFile(args: BucketKeyArgs<TBucket>): Promise<ReadableStream | NodeJS.ReadableStream>;
     /**
      * Reads an entire file from storage into a Buffer.
-     * @param assetKey - The key of the file to read.
-     * @returns The file contents as a Buffer.
      */
-    readFileAsBuffer(assetKey: string): Promise<Buffer>;
+    readFileAsBuffer(args: BucketKeyArgs<TBucket>): Promise<Buffer>;
 }

package/dist/services/in-memory-queue-service.js

@@ -11,7 +11,7 @@ export class InMemoryQueueService {
             status: () => 'active',
             pikkuUserId: options?.pikkuUserId,
         };
-        const delay = options?.delay ?? 0;
+        const delay = options?.delay ?? 100 + Math.floor(Math.random() * 201);
         setTimeout(async () => {
             try {
                 await runQueueJob({ job });

package/dist/services/in-memory-workflow-service.d.ts

@@ -17,6 +17,7 @@ import type { WorkflowPlannedStep, WorkflowRun, WorkflowRunService, WorkflowRunW
  * ```
  */
 export declare class InMemoryWorkflowService extends PikkuWorkflowService implements WorkflowRunService {
+    private sleepTimers;
     private runs;
     private steps;
     private stepData;
@@ -24,23 +25,24 @@ export declare class InMemoryWorkflowService extends PikkuWorkflowService implem
     private runState;
     private branchKeys;
     private workflowVersions;
-    createRun(workflowName: string, input: any, inline: boolean, graphHash: string, wire: WorkflowRunWire, options?: {
+    protected createRunImpl(workflowName: string, input: any, inline: boolean, graphHash: string, wire: WorkflowRunWire, options?: {
         deterministic?: boolean;
         plannedSteps?: WorkflowPlannedStep[];
     }): Promise<string>;
+    protected scheduleSleep(runId: string, stepId: string, duration: number): Promise<boolean>;
     getRun(id: string): Promise<WorkflowRun | null>;
     getRunHistory(runId: string): Promise<Array<StepState & {
         stepName: string;
     }>>;
-    updateRunStatus(id: string, status: WorkflowStatus, output?: any, error?: SerializedError): Promise<void>;
-    insertStepState(runId: string, stepName: string, rpcName: string | null, data: any, stepOptions?: WorkflowStepOptions): Promise<StepState>;
+    protected updateRunStatusImpl(id: string, status: WorkflowStatus, output?: any, error?: SerializedError): Promise<void>;
+    protected insertStepStateImpl(runId: string, stepName: string, rpcName: string | null, data: any, stepOptions?: WorkflowStepOptions): Promise<StepState>;
     getStepState(runId: string, stepName: string): Promise<StepState>;
-    setStepRunning(stepId: string): Promise<void>;
-    setStepScheduled(stepId: string): Promise<void>;
-    setStepResult(stepId: string, result: any): Promise<void>;
-    setStepError(stepId: string, error: Error): Promise<void>;
-    setStepChildRunId(stepId: string, childRunId: string): Promise<void>;
-    createRetryAttempt(failedStepId: string, status: 'pending' | 'running'): Promise<StepState>;
+    protected setStepRunningImpl(stepId: string): Promise<void>;
+    protected setStepScheduledImpl(stepId: string): Promise<void>;
+    protected setStepResultImpl(stepId: string, result: any): Promise<void>;
+    protected setStepErrorImpl(stepId: string, error: Error): Promise<void>;
+    protected setStepChildRunIdImpl(stepId: string, childRunId: string): Promise<void>;
+    protected createRetryAttemptImpl(failedStepId: string, status: 'pending' | 'running'): Promise<StepState>;
     listRuns(options?: {
         workflowName?: string;
         status?: string;
@@ -65,11 +67,11 @@ export declare class InMemoryWorkflowService extends PikkuWorkflowService implem
     getNodesWithoutSteps(runId: string, nodeIds: string[]): Promise<string[]>;
     getNodeResults(runId: string, nodeIds: string[]): Promise<Record<string, any>>;
     setBranchKey(runId: string, nodeId: string, branchKey: string): Promise<void>;
-    setBranchTaken(stepId: string, branchKey: string): Promise<void>;
-    updateRunState(runId: string, name: string, value: unknown): Promise<void>;
+    protected setBranchTakenImpl(stepId: string, branchKey: string): Promise<void>;
+    protected updateRunStateImpl(runId: string, name: string, value: unknown): Promise<void>;
     getRunState(runId: string): Promise<Record<string, unknown>>;
-    upsertWorkflowVersion(name: string, graphHash: string, graph: any, source: string, status?: WorkflowVersionStatus): Promise<void>;
-    updateWorkflowVersionStatus(name: string, graphHash: string, status: WorkflowVersionStatus): Promise<void>;
+    protected upsertWorkflowVersionImpl(name: string, graphHash: string, graph: any, source: string, status?: WorkflowVersionStatus): Promise<void>;
+    protected updateWorkflowVersionStatusImpl(name: string, graphHash: string, status: WorkflowVersionStatus): Promise<void>;
     getWorkflowVersion(name: string, graphHash: string): Promise<{
         graph: any;
         source: string;

package/dist/services/in-memory-workflow-service.js

@@ -16,6 +16,7 @@ import { PikkuWorkflowService } from '../wirings/workflow/pikku-workflow-service
  * ```
  */
 export class InMemoryWorkflowService extends PikkuWorkflowService {
+    sleepTimers = new Set();
     runs = new Map();
     steps = new Map(); // keyed by `${runId}:${stepName}`
     stepData = new Map(); // keyed by stepId
@@ -23,7 +24,7 @@ export class InMemoryWorkflowService extends PikkuWorkflowService {
     runState = new Map(); // keyed by runId
     branchKeys = new Map(); // keyed by stepId
     workflowVersions = new Map(); // keyed by `${name}:${graphHash}`
-    async createRun(workflowName, input, inline, graphHash, wire, options) {
+    async createRunImpl(workflowName, input, inline, graphHash, wire, options) {
         const runId = randomUUID();
         const now = new Date();
         const run = {
@@ -47,13 +48,26 @@ export class InMemoryWorkflowService extends PikkuWorkflowService {
         }
         return runId;
     }
+    async scheduleSleep(runId, stepId, duration) {
+        const timer = setTimeout(async () => {
+            this.sleepTimers.delete(timer);
+            try {
+                await this.executeWorkflowSleepCompleted(runId, stepId);
+            }
+            catch (error) {
+                this.logger?.error(`Failed to resume workflow sleep for runId ${runId}: ${error?.message ?? error}`);
+            }
+        }, duration);
+        this.sleepTimers.add(timer);
+        return true;
+    }
     async getRun(id) {
         return this.runs.get(id) || null;
     }
     async getRunHistory(runId) {
         return this.stepHistory.get(runId) || [];
     }
-    async updateRunStatus(id, status, output, error) {
+    async updateRunStatusImpl(id, status, output, error) {
         const run = this.runs.get(id);
         if (run) {
             run.status = status;
@@ -64,7 +78,7 @@ export class InMemoryWorkflowService extends PikkuWorkflowService {
                 run.error = error;
         }
     }
-    async insertStepState(runId, stepName, rpcName, data, stepOptions) {
+    async insertStepStateImpl(runId, stepName, rpcName, data, stepOptions) {
         const stepId = randomUUID();
         const now = new Date();
         const step = {
@@ -94,7 +108,7 @@ export class InMemoryWorkflowService extends PikkuWorkflowService {
         }
         return step;
     }
-    async setStepRunning(stepId) {
+    async setStepRunningImpl(stepId) {
         for (const step of this.steps.values()) {
             if (step.stepId === stepId) {
                 step.status = 'running';
@@ -104,7 +118,7 @@ export class InMemoryWorkflowService extends PikkuWorkflowService {
             }
         }
     }
-    async setStepScheduled(stepId) {
+    async setStepScheduledImpl(stepId) {
         for (const step of this.steps.values()) {
             if (step.stepId === stepId) {
                 step.status = 'scheduled';
@@ -114,7 +128,7 @@ export class InMemoryWorkflowService extends PikkuWorkflowService {
             }
         }
     }
-    async setStepResult(stepId, result) {
+    async setStepResultImpl(stepId, result) {
         for (const step of this.steps.values()) {
             if (step.stepId === stepId) {
                 step.status = 'succeeded';
@@ -125,7 +139,7 @@ export class InMemoryWorkflowService extends PikkuWorkflowService {
             }
         }
     }
-    async setStepError(stepId, error) {
+    async setStepErrorImpl(stepId, error) {
         for (const step of this.steps.values()) {
             if (step.stepId === stepId) {
                 step.status = 'failed';
@@ -140,7 +154,7 @@ export class InMemoryWorkflowService extends PikkuWorkflowService {
             }
         }
     }
-    async setStepChildRunId(stepId, childRunId) {
+    async setStepChildRunIdImpl(stepId, childRunId) {
         for (const step of this.steps.values()) {
             if (step.stepId === stepId) {
                 step.childRunId = childRunId;
@@ -149,7 +163,7 @@ export class InMemoryWorkflowService extends PikkuWorkflowService {
             }
         }
     }
-    async createRetryAttempt(failedStepId, status) {
+    async createRetryAttemptImpl(failedStepId, status) {
         // Find the failed step
         let failedStep;
         let runId;
@@ -252,6 +266,10 @@ export class InMemoryWorkflowService extends PikkuWorkflowService {
         return fn();
     }
     async close() {
+        for (const timer of this.sleepTimers) {
+            clearTimeout(timer);
+        }
+        this.sleepTimers.clear();
         // Clear all in-memory state
         this.runs.clear();
         this.steps.clear();
@@ -317,10 +335,10 @@ export class InMemoryWorkflowService extends PikkuWorkflowService {
             this.branchKeys.set(step.stepId, branchKey);
         }
     }
-    async setBranchTaken(stepId, branchKey) {
+    async setBranchTakenImpl(stepId, branchKey) {
         this.branchKeys.set(stepId, branchKey);
     }
-    async updateRunState(runId, name, value) {
+    async updateRunStateImpl(runId, name, value) {
         const state = this.runState.get(runId) || {};
         state[name] = value;
         this.runState.set(runId, state);
@@ -328,14 +346,14 @@ export class InMemoryWorkflowService extends PikkuWorkflowService {
     async getRunState(runId) {
         return this.runState.get(runId) || {};
     }
-    async upsertWorkflowVersion(name, graphHash, graph, source, status) {
+    async upsertWorkflowVersionImpl(name, graphHash, graph, source, status) {
         this.workflowVersions.set(`${name}:${graphHash}`, {
             graph,
             source,
             status: status ?? 'active',
         });
     }
-    async updateWorkflowVersionStatus(name, graphHash, status) {
+    async updateWorkflowVersionStatusImpl(name, graphHash, status) {
         const key = `${name}:${graphHash}`;
         const version = this.workflowVersions.get(key);
         if (version) {

package/dist/services/index.d.ts

@@ -16,7 +16,7 @@ export { InMemoryQueueService } from './in-memory-queue-service.js';
 export { InMemoryTriggerService } from './in-memory-trigger-service.js';
 export { InMemoryAIRunStateService } from './in-memory-ai-run-state-service.js';
 export { LocalGatewayService } from './local-gateway-service.js';
-export type { ContentService } from './content-service.js';
+export type { ContentService, SignContentKeyArgs, SignURLArgs, GetUploadURLArgs, UploadURLResult, BucketKeyArgs, WriteFileArgs, CopyFileArgs, } from './content-service.js';
 export type { JWTService } from './jwt-service.js';
 export type { Logger } from './logger.js';
 export type { SecretService } from './secret-service.js';

package/dist/services/local-content.d.ts

@@ -1,4 +1,4 @@
-import type { ContentService, JWTService, Logger } from '@pikku/core/services';
+import type { BucketKeyArgs, ContentService, CopyFileArgs, GetUploadURLArgs, JWTService, Logger, SignContentKeyArgs, SignURLArgs, UploadURLResult, WriteFileArgs } from '@pikku/core/services';
 export interface LocalContentConfig {
     localFileUploadPath: string;
     uploadUrlPrefix: string;
@@ -12,18 +12,16 @@ export declare class LocalContent implements ContentService {
     private jwt?;
     constructor(config: LocalContentConfig, logger: Logger, jwt?: JWTService | undefined);
     private safePath;
+    private joinKey;
     init(): Promise<void>;
     private signParams;
-    signURL(url: string, dateLessThan: Date, dateGreaterThan?: Date): Promise<string>;
-    signContentKey(assetKey: string, dateLessThan: Date, dateGreaterThan?: Date): Promise<string>;
-    getUploadURL(assetKey: string): Promise<{
-        uploadUrl: string;
-        assetKey: string;
-    }>;
-    writeFile(assetKey: string, stream: ReadableStream | NodeJS.ReadableStream): Promise<boolean>;
-    copyFile(assetKey: string, fromAbsolutePath: string): Promise<boolean>;
-    readFile(assetKey: string): Promise<ReadableStream | NodeJS.ReadableStream>;
-    readFileAsBuffer(assetKey: string): Promise<Buffer>;
-    deleteFile(assetKey: string): Promise<boolean>;
+    signURL(args: SignURLArgs): Promise<string>;
+    signContentKey(args: SignContentKeyArgs): Promise<string>;
+    getUploadURL(args: GetUploadURLArgs): Promise<UploadURLResult>;
+    writeFile(args: WriteFileArgs): Promise<boolean>;
+    copyFile(args: CopyFileArgs): Promise<boolean>;
+    readFile(args: BucketKeyArgs): Promise<ReadableStream | NodeJS.ReadableStream>;
+    readFileAsBuffer(args: BucketKeyArgs): Promise<Buffer>;
+    deleteFile(args: BucketKeyArgs): Promise<boolean>;
     private createDirectoryForFile;
 }

package/dist/services/local-content.js

@@ -11,14 +11,18 @@ export class LocalContent {
         this.logger = logger;
         this.jwt = jwt;
     }
-    safePath(assetKey) {
+    safePath(bucket, key) {
         const base = resolve(this.config.localFileUploadPath);
-        const target = resolve(base, normalize(assetKey));
+        const scoped = resolve(base, normalize(bucket));
+        const target = resolve(scoped, normalize(key));
         if (!target.startsWith(base + '/') && target !== base) {
             throw new Error('Invalid asset key');
         }
         return target;
     }
+    joinKey(bucket, key) {
+        return `${bucket}/${key}`;
+    }
     async init() { }
     async signParams(dateLessThan, dateGreaterThan) {
         const signedAt = Date.now();
@@ -32,86 +36,98 @@ export class LocalContent {
         }
         if (this.jwt) {
             const expiresInSeconds = Math.max(1, Math.floor((expiresAt - signedAt) / 1000));
-            const signature = await this.jwt.encode({ value: expiresInSeconds, unit: 'second' }, { signedAt, expiresAt });
+            const payload = {
+                signedAt,
+                expiresAt,
+            };
+            if (dateGreaterThan) {
+                payload.notBefore = dateGreaterThan.getTime();
+            }
+            const signature = await this.jwt.encode({ value: expiresInSeconds, unit: 'second' }, payload);
             params.set('signature', signature);
         }
         return params.toString();
     }
-    async signURL(url, dateLessThan, dateGreaterThan) {
-        const params = await this.signParams(dateLessThan, dateGreaterThan);
-        return `${url}?${params}`;
+    async signURL(args) {
+        const params = await this.signParams(args.dateLessThan, args.dateGreaterThan);
+        return `${args.url}?${params}`;
     }
-    async signContentKey(assetKey, dateLessThan, dateGreaterThan) {
+    async signContentKey(args) {
+        const fullKey = this.joinKey(args.bucket, args.contentKey);
         const base = this.config.server
-            ? `${this.config.server}${this.config.assetUrlPrefix}/${assetKey}`
-            : `${this.config.assetUrlPrefix}/${assetKey}`;
-        return this.signURL(base, dateLessThan, dateGreaterThan);
+            ? `${this.config.server}${this.config.assetUrlPrefix}/${fullKey}`
+            : `${this.config.assetUrlPrefix}/${fullKey}`;
+        return this.signURL({
+            url: base,
+            dateLessThan: args.dateLessThan,
+            dateGreaterThan: args.dateGreaterThan,
+        });
     }
-    async getUploadURL(assetKey) {
-        this.logger.debug(`Going to upload with key: ${assetKey}`);
+    async getUploadURL(args) {
+        const fullKey = this.joinKey(args.bucket, args.fileKey);
+        this.logger.debug(`Going to upload with key: ${fullKey}`);
         return {
-            uploadUrl: `${this.config.uploadUrlPrefix}/${assetKey}`,
-            assetKey,
+            uploadUrl: `${this.config.uploadUrlPrefix}/${fullKey}`,
+            assetKey: fullKey,
         };
     }
-    async writeFile(assetKey, stream) {
-        this.logger.debug(`Writing file: ${assetKey}`);
-        const path = this.safePath(assetKey);
+    async writeFile(args) {
+        this.logger.debug(`Writing file: ${args.bucket}/${args.key}`);
+        const path = this.safePath(args.bucket, args.key);
         try {
             await this.createDirectoryForFile(path);
             const fileStream = createWriteStream(path);
-            // Use pipeline to properly manage stream piping and errors
-            await pipeline(stream, fileStream);
+            await pipeline(args.stream, fileStream);
             return true;
         }
         catch (e) {
             console.error(e);
-            this.logger.error(`Error writing content ${assetKey}`, e);
+            this.logger.error(`Error writing content ${args.bucket}/${args.key}`, e);
             return false;
         }
     }
-    async copyFile(assetKey, fromAbsolutePath) {
-        this.logger.debug(`Writing file: ${assetKey}`);
+    async copyFile(args) {
+        this.logger.debug(`Writing file: ${args.bucket}/${args.key}`);
         try {
-            const path = this.safePath(assetKey);
+            const path = this.safePath(args.bucket, args.key);
             await this.createDirectoryForFile(path);
-            await promises.copyFile(fromAbsolutePath, path);
+            await promises.copyFile(args.fromAbsolutePath, path);
+            return true;
         }
         catch (e) {
             console.error(e);
-            this.logger.error(`Error inserting content ${assetKey}`, e);
+            this.logger.error(`Error inserting content ${args.bucket}/${args.key}`, e);
         }
         return false;
     }
-    async readFile(assetKey) {
-        this.logger.debug(`Getting key: ${assetKey}`);
-        const filePath = this.safePath(assetKey);
+    async readFile(args) {
+        this.logger.debug(`Getting key: ${args.bucket}/${args.key}`);
+        const filePath = this.safePath(args.bucket, args.key);
         try {
             const stream = createReadStream(filePath);
-            // Handle early stream errors (like file not found, permission denied, etc.)
             stream.on('error', (err) => {
-                this.logger.error(`Error getting content ${assetKey}`, err);
+                this.logger.error(`Error getting content ${args.bucket}/${args.key}`, err);
             });
             return stream;
         }
         catch (e) {
-            this.logger.error(`Error setting up stream for ${assetKey}`, e);
+            this.logger.error(`Error setting up stream for ${args.bucket}/${args.key}`, e);
             throw e;
         }
     }
-    async readFileAsBuffer(assetKey) {
-        const filePath = this.safePath(assetKey);
-        this.logger.debug(`Reading file as buffer: ${assetKey}`);
+    async readFileAsBuffer(args) {
+        const filePath = this.safePath(args.bucket, args.key);
+        this.logger.debug(`Reading file as buffer: ${args.bucket}/${args.key}`);
         return readFile(filePath);
     }
-    async deleteFile(assetKey) {
-        this.logger.debug(`deleting key: ${assetKey}`);
+    async deleteFile(args) {
+        this.logger.debug(`deleting key: ${args.bucket}/${args.key}`);
         try {
-            await promises.unlink(this.safePath(assetKey));
+            await promises.unlink(this.safePath(args.bucket, args.key));
             return true;
         }
         catch (e) {
-            this.logger.error(`Error deleting content ${assetKey}`, e);
+            this.logger.error(`Error deleting content ${args.bucket}/${args.key}`, e);
         }
         return false;
     }

package/dist/services/user-session-service.d.ts

@@ -13,7 +13,7 @@ export declare class PikkuSessionService<UserSession extends CoreUserSession> im
     private sessionStore?;
     sessionChanged: boolean;
     initial: UserSession | undefined;
-    private session;
+    protected session: UserSession | undefined;
     private pikkuUserId?;
     constructor(sessionStore?: SessionStore<UserSession> | undefined);
     setPikkuUserId(id: string): void;

package/dist/testing/service-tests.js

@@ -49,6 +49,30 @@ export function defineServiceTests(config) {
             test('removeChannels with empty array is no-op', async () => {
                 await store.removeChannels([]);
             });
+            test('session round-trip — set / get / clear', async () => {
+                await store.addChannel({
+                    channelId: 'ch-state',
+                    channelName: 'test-channel',
+                });
+                // initially undefined
+                const empty = await store.getState('ch-state');
+                assert.equal(empty, undefined);
+                // set + get
+                const payload = { userId: 'u-7', meta: { foo: 1 } };
+                await store.setState('ch-state', payload);
+                const got = await store.getState('ch-state');
+                assert.deepEqual(got, payload);
+                // overwrite
+                const next = { userId: 'u-8' };
+                await store.setState('ch-state', next);
+                const got2 = await store.getState('ch-state');
+                assert.deepEqual(got2, next);
+                // clear
+                await store.clearState('ch-state');
+                const after = await store.getState('ch-state');
+                assert.equal(after, undefined);
+                await store.removeChannels(['ch-state']);
+            });
         });
     }
     if (services.eventHubStore) {

package/dist/types/core.types.d.ts

@@ -5,6 +5,7 @@ import type { SchemaService } from '../services/schema-service.js';
 import type { JWTService } from '../services/jwt-service.js';
 import type { PikkuHTTP } from '../wirings/http/http.types.js';
 import type { PikkuChannel, CorePikkuChannelMiddleware, CorePikkuChannelMiddlewareFactory } from '../wirings/channel/channel.types.js';
+import type { EventHubService } from '../wirings/channel/eventhub-service.js';
 import type { PikkuRPC } from '../wirings/rpc/rpc-types.js';
 import type { PikkuMCP } from '../wirings/mcp/mcp.types.js';
 import type { PikkuScheduledTask } from '../wirings/scheduler/scheduler.types.js';
@@ -82,6 +83,7 @@ export type FunctionRuntimeMeta = {
     version?: number;
     approvalRequired?: boolean;
     approvalDescription?: string;
+    implementationHash?: string;
     contractHash?: string;
     inputHash?: string;
     outputHash?: string;
@@ -162,6 +164,8 @@ export interface CoreSingletonServices<Config extends CoreConfig = CoreConfig> {
     workflowService?: WorkflowService;
     /** The queue service */
     queueService?: QueueService;
+    /** Event hub for realtime pub/sub across channels */
+    eventHub?: EventHubService<Record<string, any>>;
     /** The scheduler service */
     schedulerService?: SchedulerService;
     /** The deployment service for service discovery */

package/dist/types/state.types.d.ts

@@ -88,6 +88,7 @@ export interface PikkuPackageState {
     middleware: {
         tagGroup: Record<string, CorePikkuMiddlewareGroup>;
         httpGroup: Record<string, CorePikkuMiddlewareGroup>;
+        global: CorePikkuMiddlewareGroup;
     };
     channelMiddleware: {
         tagGroup: Record<string, CorePikkuChannelMiddleware[]>;
@@ -95,6 +96,7 @@ export interface PikkuPackageState {
     permissions: {
         tagGroup: Record<string, CorePermissionGroup | CorePikkuPermission[]>;
         httpGroup: Record<string, CorePermissionGroup | CorePikkuPermission[]>;
+        global: (CorePermissionGroup | CorePikkuPermission)[];
     };
     misc: {
         errors: Map<PikkuError, ErrorDetails>;
@@ -103,24 +105,6 @@ export interface PikkuPackageState {
         channelMiddleware: Record<string, CorePikkuChannelMiddleware[]>;
         permissions: Record<string, CorePermissionGroup | CorePikkuPermission[]>;
     };
-    models: {
-        config: {
-            models?: Record<string, string | {
-                model: string;
-                temperature?: number;
-                maxSteps?: number;
-            }>;
-            agentDefaults?: {
-                temperature?: number;
-                maxSteps?: number;
-            };
-            agentOverrides?: Record<string, {
-                model?: string;
-                temperature?: number;
-                maxSteps?: number;
-            }>;
-        } | null;
-    };
     package: {
         /** Service factory functions for addon packages */
         factories: {