@pikku/core 0.12.23 → 0.12.25

package/CHANGELOG.md

@@ -1,3 +1,33 @@
+## 0.12.25
+
+### Patch Changes
+
+- 665bdb0: Add end-to-end data classification for SQLite and Postgres projects.
+
+  **Core (`@pikku/core`):** New `Private<T>` and `Secret<T>` intersection brands, `ClassificationManifest`, `ColumnClassification`, and `AnonymizeStrategy` types exported from `data-classification.ts`.
+
+  **CLI (`@pikku/cli`):**
+  - SQL comment annotations: `-- @public`, `-- @private[:strategy]`, `-- @secret[:strategy]` on `CREATE TABLE` columns and `ALTER TABLE ... ADD COLUMN` statements. Unannotated columns default to `private`.
+  - `pikku db migrate` now emits a `classification.gen.ts` manifest alongside `schema.d.ts`.
+  - New `pikku db audit` command — prints a per-column classification summary and warns on `private`/`secret` columns with no anonymize strategy.
+  - Postgres dialect support in `resolveDb`, `PostgresMigrationExecutor`, and `PostgresIntrospector`.
+
+  **Inspector (`@pikku/inspector`):** New PKU910 check — `findPiiPaths()` walks inferred function return types looking for `__pii__` brands (including inside `Array<T>`, `Record<K,V>`, and index signatures) and fails the build if a function exposes branded fields in its output.
+
+## 0.12.24
+
+### Patch Changes
+
+- c02275f: Add per-request API key override to AI agent runner
+
+  `VercelAIAgentRunner` gains an optional `providerFactory` constructor param and a `withApiKey(apiKey)` method that forks a new runner scoped to a given key without touching the global singleton.
+
+  `RunAIAgentParams` gains an optional `getCredential` accessor so callers can thread per-request credentials (e.g. a user's `AI_API_KEY` from the credential wire service) into `prepareAgentRun`. If a credential is found and the runner supports `withApiKey`, the runner is forked before the agent executes.
+
+  `AIAgentRunnerService` interface gains the optional `withApiKey?` method.
+
+- 0bd0433: Add `db.engine` and `db.pgVersion` to the CLI config types, and make local env-backed secrets fall back to raw strings when JSON parsing fails.
+
 ## 0.12.23
 
 ### Patch Changes

package/dist/data-classification.d.ts

@@ -0,0 +1,16 @@
+export type Private<T> = T & {
+    readonly __pii__: 'private';
+};
+export type Secret<T> = T & {
+    readonly __pii__: 'secret';
+};
+export type Classification = 'public' | 'private' | 'secret';
+export type AnonymizeStrategy = 'fake:email' | 'fake:name' | 'hash' | 'keep' | null;
+export interface ColumnClassification {
+    classification: Classification;
+    anonymize_strategy: AnonymizeStrategy;
+}
+export type ClassificationManifest = {
+    version: 1;
+    tables: Record<string, Record<string, ColumnClassification>>;
+};

package/dist/data-classification.js

@@ -0,0 +1 @@
+export {};

package/dist/function/function-runner.js

@@ -8,6 +8,7 @@ import { PikkuSessionService, createFunctionSessionWireProps, } from '../service
 import { ForbiddenError, ReadonlySessionError } from '../errors/errors.js';
 import { PikkuCredentialWireService, createWireServicesCredentialWireProps, } from '../services/credential-wire-service.js';
 import { defaultPikkuUserIdResolver } from '../services/pikku-user-id.js';
+import { resolveAuditConfig } from '../services/audit-service.js';
 import { rpcService } from '../wirings/rpc/rpc-runner.js';
 import { closeWireServices } from '../utils.js';
 async function resolveSession(wire, singletonServices, sessionService) {
@@ -165,6 +166,7 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
     if (!funcMeta) {
         throw new Error(`Function meta not found: ${funcName}`);
     }
+    const resolvedFunctionId = funcMeta.pikkuFuncId ?? funcName;
     // For addon packages, get or create their singleton services
     const resolvedSingletonServices = packageName
         ? await getOrCreatePackageSingletonServices(packageName, singletonServices)
@@ -192,6 +194,13 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
             new PikkuCredentialWireService(resolvedSingletonServices.credentialService, resolvedWire);
         Object.assign(resolvedWire, createWireServicesCredentialWireProps(resolvedCredentialWireService));
     }
+    const resolvedAuditConfig = resolveAuditConfig(funcConfig.audit);
+    const invocationWire = resolvedWire;
+    const previousFunctionId = invocationWire.functionId;
+    const previousAudit = invocationWire.audit;
+    const previousRpcDescriptor = Object.getOwnPropertyDescriptor(invocationWire, 'rpc');
+    invocationWire.functionId = resolvedFunctionId;
+    invocationWire.audit = resolvedAuditConfig;
     // Convert tags to PermissionMetadata and merge with inheritedPermissions
     let mergedInheritedPermissions;
     if (tags && tags.length > 0) {
@@ -205,15 +214,15 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
     }
     // Helper function to run permissions and execute the function
     const executeFunction = async () => {
-        await resolveSession(resolvedWire, resolvedSingletonServices, sessionService);
+        await resolveSession(invocationWire, resolvedSingletonServices, sessionService);
         if (sessionService) {
-            resolvedWire.session = sessionService.freezeInitial();
-            resolvedWire.setSession = (s) => sessionService.set(s);
-            resolvedWire.clearSession = () => sessionService.clear();
-            resolvedWire.getSession = () => sessionService.get();
-            resolvedWire.hasSessionChanged = () => sessionService.sessionChanged;
+            invocationWire.session = sessionService.freezeInitial();
+            invocationWire.setSession = (s) => sessionService.set(s);
+            invocationWire.clearSession = () => sessionService.clear();
+            invocationWire.getSession = () => sessionService.get();
+            invocationWire.hasSessionChanged = () => sessionService.sessionChanged;
         }
-        const session = resolvedWire.session;
+        const session = invocationWire.session;
         if (funcMeta.sessionless) {
             if (wiringAuth === true || funcConfig.auth === true) {
                 if (!session) {
@@ -263,22 +272,22 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
                 funcInheritedPermissions: funcMeta.permissions,
                 funcPermissions: funcConfig.permissions,
                 services: resolvedSingletonServices,
-                wire: resolvedWire,
+                wire: invocationWire,
                 data: actualData,
                 packageName,
             });
         }
         let wireServices;
         try {
-            wireServices = (await resolvedCreateWireServices?.(resolvedSingletonServices, resolvedWire));
+            wireServices = (await resolvedCreateWireServices?.(resolvedSingletonServices, invocationWire));
             const services = wireServices && Object.keys(wireServices).length > 0
                 ? { ...resolvedSingletonServices, ...wireServices }
                 : resolvedSingletonServices;
             const callerPackageName = packageName;
-            Object.defineProperty(resolvedWire, 'rpc', {
+            Object.defineProperty(invocationWire, 'rpc', {
                 get() {
-                    const rpc = rpcService.getContextRPCService(services, resolvedWire, { sessionService }, 0, callerPackageName);
-                    Object.defineProperty(resolvedWire, 'rpc', {
+                    const rpc = rpcService.getContextRPCService(services, invocationWire, { sessionService }, 0, callerPackageName);
+                    Object.defineProperty(invocationWire, 'rpc', {
                         value: rpc,
                         writable: true,
                         configurable: true,
@@ -288,7 +297,7 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
                 configurable: true,
                 enumerable: true,
             });
-            return await funcConfig.func(services, actualData, resolvedWire);
+            return await funcConfig.func(services, actualData, invocationWire);
         }
         finally {
             if (wireServices && Object.keys(wireServices).length > 0) {
@@ -304,7 +313,45 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
         packageName,
     });
     if (allMiddleware.length > 0) {
-        return (await runMiddleware(resolvedSingletonServices, resolvedWire, allMiddleware, executeFunction));
+        try {
+            return (await runMiddleware(resolvedSingletonServices, invocationWire, allMiddleware, executeFunction));
+        }
+        finally {
+            if (previousRpcDescriptor) {
+                Object.defineProperty(invocationWire, 'rpc', previousRpcDescriptor);
+            }
+            if (previousFunctionId === undefined) {
+                delete invocationWire.functionId;
+            }
+            else {
+                invocationWire.functionId = previousFunctionId;
+            }
+            if (previousAudit === undefined) {
+                delete invocationWire.audit;
+            }
+            else {
+                invocationWire.audit = previousAudit;
+            }
+        }
+    }
+    try {
+        return (await executeFunction());
+    }
+    finally {
+        if (previousRpcDescriptor) {
+            Object.defineProperty(invocationWire, 'rpc', previousRpcDescriptor);
+        }
+        if (previousFunctionId === undefined) {
+            delete invocationWire.functionId;
+        }
+        else {
+            invocationWire.functionId = previousFunctionId;
+        }
+        if (previousAudit === undefined) {
+            delete invocationWire.audit;
+        }
+        else {
+            invocationWire.audit = previousAudit;
+        }
     }
-    return (await executeFunction());
 };

package/dist/function/functions.types.d.ts

@@ -15,7 +15,7 @@ export type ZodLike<T = any> = StandardSchemaV1<T, T>;
  * @template Services - The services type, defaults to `CoreServices`.
  * @template Wire - The wire type, defaults to `PikkuWire<In, Out>`.
  */
-export type CorePikkuFunction<In, Out, Services extends CoreSingletonServices = CoreServices, Session extends CoreUserSession = CoreUserSession, Wire extends PikkuWire<In, Out> = PikkuWire<In, Out, true, Session>> = (services: Services, data: In, wire: Wire) => Wire['channel'] extends null ? Promise<Out> : Promise<Out> | Promise<void>;
+export type CorePikkuFunction<In, Out, Services extends CoreSingletonServices = CoreServices, Session extends CoreUserSession = CoreUserSession, Wire extends PikkuWire<In, Out, true, Session> = PikkuWire<In, Out, true, Session>> = (services: Services, data: In, wire: Wire) => Wire['channel'] extends null ? Promise<Out> : Promise<Out> | Promise<void>;
 /**
  * Represents a core API function that can be used without a session.
  *
@@ -32,7 +32,7 @@ export type CorePikkuFunctionSessionless<In, Out, Services extends CoreSingleton
  * @template Services - The services type, defaults to `CoreServices`.
  * @template Session - The session type, defaults to `CoreUserSession`.
  */
-export type CorePikkuPermission<In = any, Services extends CoreSingletonServices = CoreServices, Wire extends PikkuWire<In, never, false, CoreUserSession, any, never, never> = PikkuWire<In, never, false, CoreUserSession, never, never, never>> = (services: Services, data: In, wire: Wire) => Promise<boolean>;
+export type CorePikkuPermission<In = any, Services extends CoreSingletonServices = CoreServices, Wire extends PikkuWire<In, never, false, any, any, never, never> = PikkuWire<In, never, false, any, never, never, never>> = (services: Services, data: In, wire: Wire) => Promise<boolean>;
 /**
  * Configuration object for creating a permission with metadata
  *
@@ -40,7 +40,7 @@ export type CorePikkuPermission<In = any, Services extends CoreSingletonServices
  * @template Services - The services type, defaults to `CoreServices`.
  * @template Session - The session type, defaults to `CoreUserSession`.
  */
-export type CorePikkuPermissionConfig<In = any, Services extends CoreSingletonServices = CoreServices, Wire extends PikkuWire<In, never, false, CoreUserSession> = PikkuWire<In, never, false, CoreUserSession>> = {
+export type CorePikkuPermissionConfig<In = any, Services extends CoreSingletonServices = CoreServices, Wire extends PikkuWire<In, never, false, any> = PikkuWire<In, never, false, any>> = {
     /** The permission function */
     func: CorePikkuPermission<In, Services, Wire>;
     /** Optional human-readable name for the permission */
@@ -73,7 +73,7 @@ export type CorePikkuPermissionConfig<In = any, Services extends CoreSingletonSe
  * })
  * ```
  */
-export declare const pikkuPermission: <In = any, Services extends CoreSingletonServices = CoreServices, Wire extends PickRequired<PikkuWire<In, never, false, CoreUserSession>, "session"> = PickRequired<PikkuWire<In, never, false, CoreUserSession>, "session">>(permission: CorePikkuPermission<In, Services, Wire> | CorePikkuPermissionConfig<In, Services, Wire>) => CorePikkuPermission<In, Services, Wire>;
+export declare const pikkuPermission: <In = any, Services extends CoreSingletonServices = CoreServices, Wire extends PickRequired<PikkuWire<In, never, false, any>, "session"> = PickRequired<PikkuWire<In, never, false, any>, "session">>(permission: CorePikkuPermission<In, Services, Wire> | CorePikkuPermissionConfig<In, Services, Wire>) => CorePikkuPermission<In, Services, Wire>;
 /**
  * A factory function that takes input and returns a permission
  * Used when permissions need configuration/input parameters
@@ -82,7 +82,7 @@ export declare const pikkuPermission: <In = any, Services extends CoreSingletonS
  * @template Services - The services type, defaults to `CoreServices`.
  * @template Session - The session type, defaults to `CoreUserSession`.
  */
-export type CorePikkuPermissionFactory<In = any, Services extends CoreSingletonServices = CoreServices, Wire extends PikkuWire<In, never, false, CoreUserSession> = PikkuWire<In, never, false, CoreUserSession>> = (input: In) => CorePikkuPermission<any, Services, Wire>;
+export type CorePikkuPermissionFactory<In = any, Services extends CoreSingletonServices = CoreServices, Wire extends PikkuWire<In, never, false, any> = PikkuWire<In, never, false, any>> = (input: In) => CorePikkuPermission<any, Services, Wire>;
 /**
  * Factory function for creating permission factories
  * Use this when your permission needs configuration/input parameters
@@ -149,6 +149,9 @@ export type CorePikkuFunctionConfig<PikkuFunction extends CorePikkuFunction<any,
     readonly?: boolean;
     deploy?: 'serverless' | 'server' | 'auto';
     approvalRequired?: boolean;
+    audit?: boolean | {
+        durability?: 'best-effort' | 'transactional';
+    };
     approvalDescription?: any;
     func: PikkuFunction;
     auth?: boolean;

package/dist/index.d.ts

@@ -22,6 +22,7 @@ export { NotFoundError } from './errors/errors.js';
 export type { EventHubService } from './wirings/channel/eventhub-service.js';
 export type { QueueService } from './wirings/queue/queue.types.js';
 export type { JWTService } from './services/jwt-service.js';
+export type { EmailService, EmailTemplateReference, SendEmailInput, SendEmailResult, SendHTMLEmailInput, SendTemplateEmailInput, SendTextEmailInput, } from './services/email-service.js';
 export type { SecretService } from './services/secret-service.js';
 export type { VariablesService } from './services/variables-service.js';
 export type { ContentService, SignContentKeyArgs, SignURLArgs, GetUploadURLArgs, UploadURLResult, BucketKeyArgs, WriteFileArgs, CopyFileArgs, } from './services/content-service.js';
@@ -31,9 +32,12 @@ export type { GatewayService } from './services/gateway-service.js';
 export type { TriggerService } from './services/trigger-service.js';
 export type { SchemaService } from './services/schema-service.js';
 export type { SessionService } from './services/user-session-service.js';
+export { NoopAuditService, createInvocationAudit, resolveAuditActorFromWire, resolveAuditConfig, } from './services/audit-service.js';
+export type { AuditActor, AuditConfig, AuditDurability, AuditEvent, AuditEventBatch, AuditLog, AuditLogWriteInput, AuditOutcome, AuditService, AuditSource, ResolvedAuditConfig, } from './services/audit-service.js';
 export type { AIAgentRunnerService } from './services/ai-agent-runner-service.js';
 export type { AIRunStateService } from './services/ai-run-state-service.js';
 export type { AIStorageService } from './services/ai-storage-service.js';
+export type { EmailsMeta, EmailTemplateMeta, EmailTemplateLocaleMeta, EmailTemplateAssets, MetaService, } from './services/meta-service.js';
 export type { HTTPMethod } from './wirings/http/http.types.js';
 export type { GraphNodeConfig } from './wirings/workflow/graph/workflow-graph.types.js';
 export { createGraph } from './wirings/workflow/graph/graph-node.js';
@@ -46,3 +50,4 @@ export { isSerializable, stopSingletonServices } from './utils.js';
 export { getSingletonServices, getCreateWireServices } from './pikku-state.js';
 export { type ScheduledTaskInfo, type ScheduledTaskSummary, } from './services/scheduler-service.js';
 export { SchedulerService } from './services/scheduler-service.js';
+export type { Private, Secret, Classification, AnonymizeStrategy, ColumnClassification, ClassificationManifest, } from './data-classification.js';

package/dist/index.js

@@ -11,6 +11,7 @@ export { runMCPTool, runMCPResource, runMCPPrompt, } from './wirings/mcp/mcp-run
 export { runQueueJob } from './wirings/queue/queue-runner.js';
 export { runScheduledTask } from './wirings/scheduler/scheduler-runner.js';
 export { NotFoundError } from './errors/errors.js';
+export { NoopAuditService, createInvocationAudit, resolveAuditActorFromWire, resolveAuditConfig, } from './services/audit-service.js';
 export { createGraph } from './wirings/workflow/graph/graph-node.js';
 export { wireAddon } from './wirings/rpc/wire-addon.js';
 export { runMiddleware, addTagMiddleware, addTagMiddleware as addMiddleware, addGlobalMiddleware, } from './middleware-runner.js';

package/dist/middleware-runner.d.ts

@@ -1,4 +1,4 @@
-import type { CoreSingletonServices, PikkuWire, CorePikkuMiddleware, CorePikkuMiddlewareGroup, PikkuWiringTypes, MiddlewareMetadata } from './types/core.types.js';
+import type { CorePikkuMiddleware, CorePikkuMiddlewareGroup, PikkuWiringTypes, MiddlewareMetadata } from './types/core.types.js';
 /**
  * Runs a chain of middleware functions in sequence before executing the main function.
  *
@@ -16,7 +16,7 @@ import type { CoreSingletonServices, PikkuWire, CorePikkuMiddleware, CorePikkuMi
  *   async () => { return await runMain(); }
  * );
  */
-export declare const runMiddleware: <Middleware extends CorePikkuMiddleware>(services: CoreSingletonServices, wire: PikkuWire, middlewares: readonly Middleware[], main?: () => Promise<unknown>) => Promise<unknown>;
+export declare const runMiddleware: <Middleware extends CorePikkuMiddleware<any, any>>(services: Parameters<Middleware>[0], wire: Parameters<Middleware>[1], middlewares: readonly Middleware[], main?: () => Promise<unknown>) => Promise<unknown>;
 /**
  * Registers tag-scoped middleware. Applies to any wiring (HTTP, Channel,
  * Queue, Scheduler, MCP, CLI, Workflow, Agent) that carries the matching tag.

package/dist/permissions.d.ts

@@ -33,7 +33,7 @@ export declare const runPermissions: (wireType: PikkuWiringTypes, uid: string, {
     funcInheritedPermissions?: PermissionMetadata[];
     funcPermissions?: CorePermissionGroup | CorePikkuPermission[];
     services: CoreServices;
-    wire: PikkuWire<any, never, any, never, never, never>;
+    wire: PikkuWire<any, never, any, CoreUserSession, never, never, never>;
     data: any;
     packageName?: string | null;
 }) => Promise<void>;

package/dist/services/ai-agent-runner-service.d.ts

@@ -44,4 +44,7 @@ export type AIAgentStepResult = {
 export interface AIAgentRunnerService {
     stream(params: AIAgentRunnerParams, channel: AIStreamChannel): Promise<AIAgentStepResult>;
     run(params: AIAgentRunnerParams): Promise<AIAgentStepResult>;
+    /** Return a new runner that uses the given API key for every LLM call.
+     *  Optional — runners that don't support per-key scoping leave this undefined. */
+    withApiKey?(apiKey: string): AIAgentRunnerService;
 }

package/dist/services/audit-service.d.ts

@@ -0,0 +1,50 @@
+import type { CoreUserSession, PikkuWire, PikkuWiringTypes } from '../types/core.types.js';
+export type AuditDurability = 'best-effort' | 'transactional';
+export type AuditOutcome = 'success' | 'failed' | 'denied';
+export type AuditSource = 'auto' | 'explicit';
+export type AuditConfig = boolean | {
+    durability?: AuditDurability;
+};
+export type ResolvedAuditConfig = {
+    durability: AuditDurability;
+};
+export type AuditActor = {
+    userId?: string;
+    orgId?: string;
+    pikkuUserId?: string;
+};
+export type AuditEvent = {
+    eventId?: string;
+    type: string;
+    source: AuditSource;
+    outcome?: AuditOutcome;
+    occurredAt: string;
+    functionId?: string;
+    wireType?: PikkuWiringTypes;
+    wireId?: string;
+    traceId?: string;
+    transactionId?: string | null;
+    queryId?: string | null;
+    actor?: AuditActor;
+    input?: unknown;
+    metadata?: Record<string, unknown>;
+};
+export type AuditEventBatch = AuditEvent[];
+export interface AuditService {
+    audit(event: AuditEvent): Promise<void>;
+    write?(batch: AuditEventBatch): Promise<void>;
+}
+export declare class NoopAuditService implements AuditService {
+    audit(_event: AuditEvent): Promise<void>;
+    write(_batch: AuditEventBatch): Promise<void>;
+}
+export type AuditLogWriteInput = Omit<AuditEvent, 'occurredAt'>;
+export interface AuditLog {
+    readonly config: ResolvedAuditConfig | undefined;
+    write(event: AuditLogWriteInput): Promise<void>;
+    flush(): Promise<void>;
+    close(): Promise<void>;
+}
+export declare const resolveAuditConfig: (config?: AuditConfig) => ResolvedAuditConfig | undefined;
+export declare const createInvocationAudit: (service: AuditService, wire: PikkuWire<any, any, any, CoreUserSession>) => AuditLog;
+export declare const resolveAuditActorFromWire: (wire: PikkuWire<any, any, any, CoreUserSession>) => AuditActor | undefined;

package/dist/services/audit-service.js

@@ -0,0 +1,106 @@
+export class NoopAuditService {
+    async audit(_event) { }
+    async write(_batch) { }
+}
+class DisabledInvocationAudit {
+    wire;
+    config = undefined;
+    warned = false;
+    constructor(wire) {
+        this.wire = wire;
+    }
+    async write(_event) {
+        if (!this.warned) {
+            this.warned = true;
+            this.wire.logger?.warn?.('audit.write() called for an invocation without wire.audit enabled');
+        }
+    }
+    async flush() { }
+    async close() { }
+}
+class InvocationAuditLog {
+    config;
+    service;
+    wire;
+    buffer = [];
+    constructor(config, service, wire) {
+        this.config = config;
+        this.service = service;
+        this.wire = wire;
+    }
+    async write(event) {
+        const resolved = this.resolveEvent(event);
+        if (this.config.durability === 'transactional') {
+            await this.service.audit(resolved);
+            return;
+        }
+        this.buffer.push(resolved);
+    }
+    async flush() {
+        if (this.config.durability === 'transactional' ||
+            this.buffer.length === 0) {
+            return;
+        }
+        const batch = this.buffer.splice(0, this.buffer.length);
+        const queryEvents = batch.filter((event) => event.queryId != null);
+        if (queryEvents.length === 1) {
+            queryEvents[0].queryId = null;
+        }
+        try {
+            if (this.service.write) {
+                await this.service.write(batch);
+                return;
+            }
+            for (const event of batch) {
+                await this.service.audit(event);
+            }
+        }
+        catch (error) {
+            ;
+            this.wire.logger?.warn?.('best-effort audit flush failed', error);
+        }
+    }
+    async close() {
+        await this.flush();
+    }
+    resolveEvent(event) {
+        return {
+            functionId: this.wire.functionId,
+            wireType: this.wire.wireType,
+            wireId: this.wire.wireId,
+            traceId: this.wire.traceId,
+            actor: event.actor ?? resolveAuditActorFromWire(this.wire),
+            ...event,
+            occurredAt: new Date().toISOString(),
+        };
+    }
+}
+export const resolveAuditConfig = (config) => {
+    if (config === true) {
+        return { durability: 'best-effort' };
+    }
+    if (!config) {
+        return undefined;
+    }
+    return {
+        durability: config.durability ?? 'best-effort',
+    };
+};
+export const createInvocationAudit = (service, wire) => {
+    if (!wire.audit) {
+        return new DisabledInvocationAudit(wire);
+    }
+    return new InvocationAuditLog(wire.audit, service, wire);
+};
+export const resolveAuditActorFromWire = (wire) => {
+    const session = wire.session;
+    const actor = {
+        userId: session?.userId,
+        orgId: session?.orgId,
+        pikkuUserId: wire.pikkuUserId,
+    };
+    if (!actor.userId && !actor.orgId && !actor.pikkuUserId) {
+        return undefined;
+    }
+    return actor;
+};

package/dist/services/content-service.d.ts

@@ -23,6 +23,7 @@ export interface GetUploadURLArgs<TBucket extends string = string> {
     fileKey: string;
     contentType: string;
     size?: number;
+    visibility?: 'private' | 'public';
 }
 /**
  * Result of minting a presigned upload URL.

package/dist/services/email-service.d.ts

@@ -0,0 +1,36 @@
+export interface EmailTemplateReference {
+    name: string;
+    locale?: string;
+    data?: Record<string, unknown>;
+}
+export interface BaseSendEmailInput {
+    to: string | string[];
+    from?: string;
+    cc?: string | string[];
+    bcc?: string | string[];
+    replyTo?: string | string[];
+    headers?: Record<string, string>;
+    subject?: string;
+}
+export interface SendTextEmailInput extends BaseSendEmailInput {
+    text: string;
+    html?: never;
+    template?: never;
+}
+export interface SendHTMLEmailInput extends BaseSendEmailInput {
+    html: string;
+    text?: string;
+    template?: never;
+}
+export interface SendTemplateEmailInput extends BaseSendEmailInput {
+    template: EmailTemplateReference;
+    html?: never;
+    text?: never;
+}
+export type SendEmailInput = SendTextEmailInput | SendHTMLEmailInput | SendTemplateEmailInput;
+export interface SendEmailResult {
+    messageId?: string;
+}
+export interface EmailService {
+    send(input: SendEmailInput): Promise<SendEmailResult>;
+}

package/dist/services/email-service.js

@@ -0,0 +1 @@
+export {};

package/dist/services/gopass-secrets.d.ts

@@ -5,43 +5,10 @@ import type { SecretService } from './secret-service.js';
  */
 export declare class GopassSecretService implements SecretService {
     private prefix;
-    /**
-     * Creates an instance of GopassSecretService.
-     * @param prefix - Optional prefix for all secret keys (e.g., 'pikku/' will look up 'pikku/mykey' for key 'mykey')
-     */
     constructor(prefix?: string);
     private getFullKey;
-    /**
-     * Retrieves a secret by key and parses it as JSON.
-     * @param key - The key of the secret to retrieve.
-     * @returns A promise that resolves to the parsed secret value.
-     * @throws {Error} If the secret is not found or gopass fails.
-     */
-    getSecretJSON<R>(key: string): Promise<R>;
-    /**
-     * Retrieves a secret by key as a string.
-     * @param key - The key of the secret to retrieve.
-     * @returns A promise that resolves to the secret value.
-     * @throws {Error} If the secret is not found or gopass fails.
-     */
-    getSecret(key: string): Promise<string>;
-    /**
-     * Checks if a secret exists without throwing.
-     * @param key - The key of the secret to check.
-     * @returns A promise that resolves to true if the secret exists.
-     */
+    getSecret<T = string>(key: string): Promise<T>;
     hasSecret(key: string): Promise<boolean>;
-    /**
-     * Stores a JSON value as a secret in gopass.
-     * @param key - The key to store the secret under.
-     * @param value - The JSON value to store.
-     * @returns A promise that resolves when the secret is stored.
-     */
-    setSecretJSON(key: string, value: unknown): Promise<void>;
-    /**
-     * Deletes a secret from gopass.
-     * @param key - The key of the secret to delete.
-     * @returns A promise that resolves when the secret is deleted.
-     */
+    setSecret(key: string, value: unknown): Promise<void>;
     deleteSecret(key: string): Promise<void>;
 }

package/dist/services/gopass-secrets.js

@@ -5,10 +5,6 @@ import { execFileSync } from 'child_process';
  */
 export class GopassSecretService {
     prefix;
-    /**
-     * Creates an instance of GopassSecretService.
-     * @param prefix - Optional prefix for all secret keys (e.g., 'pikku/' will look up 'pikku/mykey' for key 'mykey')
-     */
     constructor(prefix = '') {
         this.prefix = prefix;
     }
@@ -18,38 +14,23 @@ export class GopassSecretService {
         }
         return this.prefix ? `${this.prefix}${key}` : key;
     }
-    /**
-     * Retrieves a secret by key and parses it as JSON.
-     * @param key - The key of the secret to retrieve.
-     * @returns A promise that resolves to the parsed secret value.
-     * @throws {Error} If the secret is not found or gopass fails.
-     */
-    async getSecretJSON(key) {
-        const value = await this.getSecret(key);
-        return JSON.parse(value);
-    }
-    /**
-     * Retrieves a secret by key as a string.
-     * @param key - The key of the secret to retrieve.
-     * @returns A promise that resolves to the secret value.
-     * @throws {Error} If the secret is not found or gopass fails.
-     */
     async getSecret(key) {
         const fullKey = this.getFullKey(key);
         try {
-            return execFileSync('gopass', ['show', '-o', fullKey], {
+            const raw = execFileSync('gopass', ['show', '-o', fullKey], {
                 encoding: 'utf8',
             }).trim();
+            try {
+                return JSON.parse(raw);
+            }
+            catch {
+                return raw;
+            }
         }
         catch (error) {
             throw new Error(`Secret Not Found: ${key}`, { cause: error });
         }
     }
-    /**
-     * Checks if a secret exists without throwing.
-     * @param key - The key of the secret to check.
-     * @returns A promise that resolves to true if the secret exists.
-     */
     async hasSecret(key) {
         const fullKey = this.getFullKey(key);
         try {
@@ -60,19 +41,13 @@ export class GopassSecretService {
             return false;
         }
     }
-    /**
-     * Stores a JSON value as a secret in gopass.
-     * @param key - The key to store the secret under.
-     * @param value - The JSON value to store.
-     * @returns A promise that resolves when the secret is stored.
-     */
-    async setSecretJSON(key, value) {
+    async setSecret(key, value) {
         const fullKey = this.getFullKey(key);
-        const jsonValue = JSON.stringify(value);
+        const encoded = typeof value === 'string' ? value : JSON.stringify(value);
         try {
             execFileSync('gopass', ['insert', '-f', fullKey], {
                 encoding: 'utf8',
-                input: jsonValue,
+                input: encoded,
                 stdio: ['pipe', 'pipe', 'pipe'],
             });
         }
@@ -80,11 +55,6 @@ export class GopassSecretService {
             throw new Error(`Failed to set secret: ${key}`, { cause: error });
         }
     }
-    /**
-     * Deletes a secret from gopass.
-     * @param key - The key of the secret to delete.
-     * @returns A promise that resolves when the secret is deleted.
-     */
     async deleteSecret(key) {
         const fullKey = this.getFullKey(key);
         try {