@pikku/core 0.12.63 → 0.12.66

package/dist/permissions.js

@@ -1,18 +1,26 @@
 import { pikkuState } from './pikku-state.js';
 import { ForbiddenError } from './errors/errors.js';
-import { freezeDedupe, getTagGroups } from './utils.js';
 /**
- * This function validates permissions by iterating over permission groups and executing the corresponding permission functions. If all functions in at least one group return true, the permission is considered valid.
+ * Evaluates a single permission group. A group ORs its branches together and
+ * ANDs the entries within a branch: the group passes if at least one branch
+ * (an array of permission functions, all of which must return true — or a lone
+ * function) is satisfied.
+ *
+ * This is the only place OR lives in authorization. Everything cross-cutting —
+ * global permissions, scopes, and auth — ANDs together; a function's own
+ * `permissions` group is the sole place where "owner OR admin"-style
+ * alternatives are expressed.
+ *
+ * @param permissions - The permission group to evaluate.
  * @param services - The core services required for permission validation.
- * @param data - The data to be used in the permission validation functions.
+ * @param data - The request data passed to each permission function.
  * @param wire - The wire object containing request/response context and session.
- * @returns A promise that resolves to void.
+ * @returns A promise resolving to true if the group is satisfied.
  */
 const verifyPermissions = async (permissions, services, data, wire) => {
     if (!permissions) {
         return true;
     }
-    let valid = false;
     const permissionGroups = Object.values(permissions);
     if (permissionGroups.length === 0) {
         return true;
@@ -21,61 +29,33 @@ const verifyPermissions = async (permissions, services, data, wire) => {
         if (funcs instanceof Array) {
             const permissioned = await Promise.all(funcs.map((func) => func(services, data, wire)));
             if (permissioned.every((result) => result)) {
-                valid = true;
+                return true;
             }
         }
         else {
-            valid = await funcs(services, data, wire);
-        }
-        if (valid) {
-            return true;
+            if (await funcs(services, data, wire)) {
+                return true;
+            }
         }
     }
     return false;
 };
-/**
- * Retrieves a registered permission function by its name.
- *
- * This function looks up permissions that was registered with registerPermission.
- * It's used internally by the framework to resolve permission references in metadata.
- *
- * @param {string} name - The unique name (pikkuFuncId) of the permission function.
- * @returns {CorePikkuPermission | undefined} The permission function, or undefined if not found.
- *
- * @internal
- */
-const getPermissionByName = (name) => {
-    const permissionStore = pikkuState(null, 'misc', 'permissions');
-    const permission = permissionStore[name];
-    if (Array.isArray(permission) && permission.length === 1) {
-        return permission[0];
-    }
-    return undefined;
-};
-/**
- * Registers tag-scoped permissions. Applies to any wiring that carries the
- * matching tag.
- *
- * For tree-shaking, wrap in a factory:
- * `export const x = () => addTagPermission('tag', [...])`
- *
- * @example
- * export const adminPermissions = () => addTagPermission('admin', [adminPermission])
- */
-export const addTagPermission = (tag, permissions, packageName = null) => {
-    const tagGroups = pikkuState(packageName, 'permissions', 'tagGroup');
-    if (tagGroups[tag]) {
-        throw new Error(`Permissions for tag '${tag}' already exist. Use a different tag or remove the existing permissions first.`);
+const globalPermissionsCache = {};
+export const clearPermissionsCache = () => {
+    for (const key of Object.keys(globalPermissionsCache)) {
+        delete globalPermissionsCache[key];
     }
-    tagGroups[tag] = permissions;
-    return permissions;
 };
 /**
- * Registers wire-agnostic global permissions. Runs at the top of every
- * wiring's permission resolution — before wire-, tag-, and function-level
- * entries — across all wire types.
+ * Registers wire-agnostic global permissions. Global permissions are an AND
+ * gate: every registered requirement must pass on every function invocation,
+ * regardless of transport. A requirement may be a single permission function
+ * or a permission group (in which case that group ORs internally, but the
+ * group as a whole must still pass).
  *
- * Resolution order: global → wire → tag → function.
+ * Global permissions never satisfy a function's own `permissions` — the two
+ * are independent gates that both have to pass, so a broad global can only
+ * ever narrow access.
  *
  * @example
  * addGlobalPermission([signedInUser])
@@ -88,188 +68,101 @@ export const addGlobalPermission = (permissions, packageName = null) => {
     else {
         state.push(permissions);
     }
+    clearPermissionsCache();
     return permissions;
 };
-const combinedPermissionsCache = {
-    http: {},
-    rpc: {},
-    channel: {},
-    queue: {},
-    scheduler: {},
-    trigger: {},
-    mcp: {},
-    agent: {},
-    cli: {},
-    workflow: {},
-    gateway: {},
+/**
+ * @deprecated Tag-level permissions were removed in #972 — permissions are now
+ * function-scoped only (declare them on the function via `pikkuFunc({ permissions })`).
+ * This throwing stub exists solely so the pinned bootstrap CLI (which still
+ * generates an `addTagPermission` wrapper) can resolve the import at build time;
+ * it is never called. Delete once `PIKKU_CLI_VERSION` in the CLI build is bumped
+ * past the release that removes tag permissions.
+ */
+export const addTagPermission = (_tag, _permissions, _packageName = null) => {
+    throw new Error('addTagPermission was removed in #972 — tag-level permissions no longer exist. Declare permissions on the function definition instead: pikkuFunc({ permissions }).');
 };
-export const clearPermissionsCache = () => {
-    for (const key of Object.keys(combinedPermissionsCache)) {
-        combinedPermissionsCache[key] = {};
+/**
+ * Resolves the registered global permission requirements for a package,
+ * caching the resolved array per package. The cache is keyed by package name
+ * (an empty string for the root package) so packages never collide, and it is
+ * cleared whenever globals are registered or on hot reload.
+ */
+const resolveGlobalPermissions = (packageName) => {
+    const key = packageName ?? '';
+    const cached = globalPermissionsCache[key];
+    if (cached) {
+        return cached;
     }
+    const globals = pikkuState(packageName, 'permissions', 'global');
+    const resolved = globals && globals.length > 0 ? [...globals] : [];
+    globalPermissionsCache[key] = resolved;
+    return resolved;
 };
+const asGroup = (entry) => typeof entry === 'function' ? { permission: entry } : entry;
 /**
- * Combines wiring-specific permissions with function-level permissions.
- *
- * This function resolves permission metadata into actual permission functions and combines them.
- * It filters out wire permissions without tags from inheritedPermissions to avoid duplication
- * (those are passed separately as wirePermissions).
+ * Runs authorization for a function invocation. Two independent gates, both of
+ * which must pass:
  *
- * @param {object} options - Configuration object for combining permissions.
- * @param {PermissionMetadata[] | undefined} options.wireInheritedPermissions - Metadata from wiring (HTTP + tags + wire with tags).
- * @param {CorePermissionGroup | CorePikkuPermission[] | undefined} options.wirePermissions - Inline wire permissions.
- * @param {PermissionMetadata[] | undefined} options.funcInheritedPermissions - Function permissions metadata (only tags).
- * @param {CorePermissionGroup | CorePikkuPermission[] | undefined} options.funcPermissions - Inline function permissions.
- * @returns {(CorePermissionGroup | CorePikkuPermission)[]} Combined array of resolved permissions.
+ * 1. Global permissions — AND. Every registered global requirement must pass.
+ * 2. Function permissions — OR. The function's own `permissions` group must be
+ *    satisfied (see {@link verifyPermissions}).
  *
- * @example
- * ```typescript
- * const combined = combinePermissions(wireType, wireId, {
- *   wireInheritedPermissions: meta.permissions,
- *   wirePermissions: inlinePermissions,
- *   funcInheritedPermissions: funcMeta.permissions,
- *   funcPermissions: funcConfig.permissions
- * })
- * ```
+ * A passing global requirement never contributes to the function gate, so a
+ * broad global like `signedIn` can't satisfy an admin-only function.
  */
-const combinePermissions = (wireType, uid, { wireInheritedPermissions, wirePermissions, funcInheritedPermissions, funcPermissions, packageName = null, } = {}) => {
-    if (combinedPermissionsCache[wireType][uid]) {
-        return combinedPermissionsCache[wireType][uid];
-    }
-    const resolved = [];
-    const globals = pikkuState(packageName, 'permissions', 'global');
-    if (globals && globals.length > 0) {
-        resolved.push(...globals);
-    }
-    if (wireInheritedPermissions) {
-        for (const meta of wireInheritedPermissions) {
-            if (meta.type === 'http') {
-                // Look up HTTP permission group from pikkuState
-                const group = pikkuState(packageName, 'permissions', 'httpGroup')[meta.route];
-                if (group) {
-                    if (Array.isArray(group)) {
-                        resolved.push(...group);
-                    }
-                    else {
-                        resolved.push(group);
-                    }
-                }
-            }
-            else if (meta.type === 'tag') {
-                const groups = getTagGroups(pikkuState(packageName, 'permissions', 'tagGroup'), meta.tag);
-                for (const group of groups) {
-                    if (Array.isArray(group)) {
-                        resolved.push(...group);
-                    }
-                    else {
-                        resolved.push(group);
-                    }
-                }
-            }
-            else if (meta.type === 'wire') {
-                // Individual wire permission (exported, not inline)
-                const permission = getPermissionByName(meta.name);
-                if (permission) {
-                    resolved.push(permission);
-                }
-            }
-        }
-    }
-    // 2. Add inline wire permissions
-    if (wirePermissions) {
-        if (Array.isArray(wirePermissions)) {
-            resolved.push(...wirePermissions);
-        }
-        else {
-            resolved.push(wirePermissions);
+export const runPermissions = async ({ funcPermissions, services, wire, data, packageName = null, label = 'function', }) => {
+    const globals = resolveGlobalPermissions(packageName);
+    for (const entry of globals) {
+        if (!(await verifyPermissions(asGroup(entry), services, data, wire))) {
+            services.logger.debug('Permission denied - global permission');
+            throw new ForbiddenError('Permission denied');
         }
     }
-    // 3. Resolve function inherited permissions (only tags, wire permissions already handled)
-    if (funcInheritedPermissions) {
-        for (const meta of funcInheritedPermissions) {
-            if (meta.type === 'tag') {
-                const groups = getTagGroups(pikkuState(packageName, 'permissions', 'tagGroup'), meta.tag);
-                for (const group of groups) {
-                    if (Array.isArray(group)) {
-                        resolved.push(...group);
-                    }
-                    else {
-                        resolved.push(group);
-                    }
-                }
-            }
-            // Note: wire permissions are already handled in wireInheritedPermissions
-        }
-    }
-    // 4. Add inline function permissions
     if (funcPermissions) {
-        if (Array.isArray(funcPermissions)) {
-            resolved.push(...funcPermissions);
-        }
-        else {
-            resolved.push(funcPermissions);
-        }
-    }
-    // Deduplicate and freeze
-    combinedPermissionsCache[wireType][uid] = freezeDedupe(resolved);
-    return combinedPermissionsCache[wireType][uid];
-};
-/**
- * Runs permission checks using combined permissions from all sources.
- * Combines permissions from wire and function levels, then validates them.
- */
-export const runPermissions = async (wireType, uid, { wireInheritedPermissions, wirePermissions, funcInheritedPermissions, funcPermissions, services, wire, data, packageName = null, }) => {
-    // Combine all permissions: wireInheritedPermissions → wirePermissions → funcInheritedPermissions → funcPermissions
-    const allPermissions = combinePermissions(wireType, uid, {
-        wireInheritedPermissions,
-        wirePermissions,
-        funcInheritedPermissions,
-        funcPermissions,
-        packageName,
-    });
-    // Check all combined permissions - at least one must pass if any exist
-    if (allPermissions.length > 0) {
-        for (const permission of allPermissions) {
-            const result = await verifyPermissions(typeof permission === 'function' ? { permission } : permission, services, data, wire);
-            if (result) {
-                return;
+        const group = Array.isArray(funcPermissions)
+            ? { permissions: funcPermissions }
+            : funcPermissions;
+        if (group && Object.keys(group).length > 0) {
+            if (!(await verifyPermissions(group, services, data, wire))) {
+                services.logger.debug(`Permission denied - ${label} permission`);
+                throw new ForbiddenError('Permission denied');
             }
         }
-        services.logger.debug('Permission denied - combined permissions');
-        throw new ForbiddenError('Permission denied');
     }
 };
 /**
  * Checks whether a session passes the auth checks (pikkuAuth only) for a
  * given function/agent. Skips pikkuPermission checks since those require
- * request data which isn't available at filter time.
+ * request data which isn't available at filter time. Global auth requirements
+ * are included so a filtered list honours app-wide auth.
  *
- * @param funcPermissions - The PermissionMetadata[] from function or agent metadata
+ * `funcPermissions` is the live {@link CorePermissionGroup} from the function or
+ * agent config, not the metadata form: the `pikkuAuth` brand only survives on
+ * the actual predicate objects, and the by-name registry those metadata entries
+ * would resolve against is never populated. Passing metadata here would silently
+ * collect nothing and let every gated tool through.
+ *
+ * @param funcPermissions - The live permission group from the func/agent config
  * @param session - The user's session
  * @param services - Singleton services
  * @param packageName - Optional package namespace
- * @returns true if the session passes all auth checks (or no auth checks exist)
+ * @returns true if the session passes the auth checks (or no auth checks exist)
  */
 export const checkAuthPermissions = async (funcPermissions, session, services, packageName = null) => {
-    if (!funcPermissions?.length)
-        return true;
-    const allPermissions = combinePermissions('agent', `authcheck:${Math.random()}`, {
-        funcInheritedPermissions: funcPermissions,
-        packageName,
-    });
-    if (allPermissions.length === 0)
-        return true;
     const wire = { session };
-    // Extract only pikkuAuth permissions (marked with __pikkuAuth)
+    // Collect auth-only (pikkuAuth) predicates from globals and the function's
+    // referenced permissions. Data-dependent permissions are ignored — they
+    // can't be evaluated without request data at filter time.
     const authPerms = [];
-    for (const permission of allPermissions) {
-        if (typeof permission === 'function') {
-            if (permission.__pikkuAuth) {
-                authPerms.push(permission);
+    const collect = (perm) => {
+        if (typeof perm === 'function') {
+            if (perm.__pikkuAuth) {
+                authPerms.push(perm);
             }
         }
-        else if (permission && typeof permission === 'object') {
-            for (const funcs of Object.values(permission)) {
+        else if (perm && typeof perm === 'object') {
+            for (const funcs of Object.values(perm)) {
                 const arr = Array.isArray(funcs) ? funcs : [funcs];
                 for (const fn of arr) {
                     if (typeof fn === 'function' && fn.__pikkuAuth) {
@@ -278,11 +171,16 @@ export const checkAuthPermissions = async (funcPermissions, session, services, p
                 }
             }
         }
+    };
+    for (const entry of resolveGlobalPermissions(packageName)) {
+        collect(entry);
+    }
+    if (funcPermissions) {
+        collect(funcPermissions);
     }
     // No auth permissions = allowed (only data-dependent permissions exist)
     if (authPerms.length === 0)
         return true;
-    // All auth permissions must pass
     for (const perm of authPerms) {
         const result = await perm(services, null, wire);
         if (result)

package/dist/pikku-state.js

@@ -111,8 +111,6 @@ const createEmptyPackageState = () => ({
         tagGroup: {},
     },
     permissions: {
-        tagGroup: {},
-        httpGroup: {},
         global: [],
     },
     misc: {

package/dist/scopes.d.ts

@@ -0,0 +1,17 @@
+import type { CoreUserSession } from './types/core.types.js';
+/**
+ * Verifies that a session holds every required scope, throwing on the first
+ * one it does not.
+ *
+ * Scopes are an AND gate: every entry in `required` must be satisfied. This is
+ * deliberately distinct from `permissions`, which OR together — a scope can
+ * only ever narrow access, so adding one to a function can never widen it.
+ *
+ * Fails closed: a session without a `scopes` field, or no session at all,
+ * satisfies nothing.
+ *
+ * @param required - Scopes the function declares. Empty means no gate.
+ * @param session - The session to check. May be undefined.
+ * @throws {MissingScopeError} Naming the first unsatisfied scope.
+ */
+export declare const verifyScopes: (required: readonly string[] | undefined, session: CoreUserSession | undefined) => void;

package/dist/scopes.js

@@ -0,0 +1,59 @@
+import { MissingScopeError } from './errors/errors.js';
+const SEPARATOR = ':';
+const WILDCARD = '*';
+/**
+ * Builds every grant that would satisfy `scope`: the scope itself, a wildcard
+ * directly beneath it, a wildcard at each ancestor level, and each plain
+ * ancestor id — holding a parent scope grants everything nested beneath it.
+ *
+ * For `admin:invoices:create` that is:
+ *   admin:invoices:create, admin:invoices:create:*, *, admin:*, admin:invoices:*,
+ *   admin, admin:invoices
+ */
+const satisfyingGrants = (scope) => {
+    const segments = scope.split(SEPARATOR);
+    const grants = [scope, `${scope}${SEPARATOR}${WILDCARD}`];
+    for (let i = 0; i < segments.length; i++) {
+        grants.push([...segments.slice(0, i), WILDCARD].join(SEPARATOR));
+    }
+    for (let i = 1; i < segments.length; i++) {
+        grants.push(segments.slice(0, i).join(SEPARATOR));
+    }
+    return grants;
+};
+/**
+ * Checks whether `held` satisfies a single required scope.
+ *
+ * A grant satisfies a requirement when it is the scope itself, a plain ancestor
+ * (`admin` covers `admin:invoices:create`), a wildcard at or above it (`admin:*`
+ * covers `admin` and `admin:invoices:create`), or the bare `*`. A narrower grant
+ * never satisfies a broader requirement — `admin:invoices` does not grant
+ * `admin`.
+ */
+const holds = (held, scope) => satisfyingGrants(scope).some((grant) => held.has(grant));
+/**
+ * Verifies that a session holds every required scope, throwing on the first
+ * one it does not.
+ *
+ * Scopes are an AND gate: every entry in `required` must be satisfied. This is
+ * deliberately distinct from `permissions`, which OR together — a scope can
+ * only ever narrow access, so adding one to a function can never widen it.
+ *
+ * Fails closed: a session without a `scopes` field, or no session at all,
+ * satisfies nothing.
+ *
+ * @param required - Scopes the function declares. Empty means no gate.
+ * @param session - The session to check. May be undefined.
+ * @throws {MissingScopeError} Naming the first unsatisfied scope.
+ */
+export const verifyScopes = (required, session) => {
+    if (!required || required.length === 0) {
+        return;
+    }
+    const held = new Set(session?.scopes ?? []);
+    for (const scope of required) {
+        if (!holds(held, scope)) {
+            throw new MissingScopeError(scope);
+        }
+    }
+};

package/dist/services/ai-embedding-service.d.ts

@@ -0,0 +1,31 @@
+/**
+ * A narrow, dedicated embedding service.
+ *
+ * Vector stores (Qdrant, Pinecone, Supabase/pgvector, …) depend on this to turn
+ * text into vectors, at BOTH index time (ingest) and query time (search). The
+ * embedding model is fixed at construction so those two moments cannot drift
+ * into different vector spaces — a mismatch would silently break similarity
+ * search. Provider addons (e.g. `@pikku/addon-openai`) implement it; the app
+ * wires a single instance into `singletonServices.aiEmbedding`.
+ *
+ * This is deliberately smaller than {@link AIAgentRunnerService} (whose optional
+ * `embed`/`embedMany` take a per-call model): a vector store should not have to
+ * pull in the whole agent-runner tool loop just to embed, and pinning the model
+ * to the service is what guarantees index/query consistency.
+ *
+ * Documents (ingested corpus) and queries (search text) are embedded through
+ * separate methods because some models are asymmetric — Cohere's `input_type`,
+ * E5's `query:`/`passage:` prefixes, BGE's query instruction — and must know
+ * which side they are embedding to produce comparable vectors. Symmetric
+ * providers (e.g. OpenAI) point both methods at the same call.
+ */
+export interface AIEmbeddingService {
+    /** The embedding model backing this service. Index and query share it. */
+    readonly model: string;
+    /** The vector dimensionality this model produces, when known. */
+    readonly dimensions?: number;
+    /** Embed corpus documents (index time), preserving input order. */
+    embedDocuments(values: string[]): Promise<number[][]>;
+    /** Embed a search query (query time) into a vector. */
+    embedQuery(value: string): Promise<number[]>;
+}

package/dist/services/ai-embedding-service.js

@@ -0,0 +1 @@
+export {};

package/dist/services/credential-wire-service.d.ts

@@ -3,10 +3,12 @@ import type { PikkuRawWire } from '../types/core.types.js';
 export declare class PikkuCredentialWireService {
     private credentialService?;
     private wire?;
+    private aliases?;
     private credentials;
     private loaded;
     private loadPromise;
-    constructor(credentialService?: CredentialService | undefined, wire?: PikkuRawWire | undefined);
+    constructor(credentialService?: CredentialService | undefined, wire?: PikkuRawWire | undefined, aliases?: Record<string, string> | undefined);
+    private resolveName;
     set(name: string, value: unknown): void;
     get<T = unknown>(name: string): T | null | Promise<T | null>;
     getAll(): Record<string, unknown> | Promise<Record<string, unknown>>;

package/dist/services/credential-wire-service.js

@@ -2,20 +2,26 @@ import { defaultPikkuUserIdResolver } from './pikku-user-id.js';
 export class PikkuCredentialWireService {
     credentialService;
     wire;
+    aliases;
     credentials = {};
     loaded = false;
     loadPromise;
-    constructor(credentialService, wire) {
+    constructor(credentialService, wire, aliases) {
         this.credentialService = credentialService;
         this.wire = wire;
+        this.aliases = aliases;
+    }
+    resolveName(name) {
+        return this.aliases?.[name] ?? name;
     }
     set(name, value) {
-        this.credentials[name] = value;
+        this.credentials[this.resolveName(name)] = value;
     }
     get(name) {
+        const key = this.resolveName(name);
         if (this.loaded)
-            return this.credentials[name] ?? null;
-        return this.lazyLoad().then(() => this.credentials[name] ?? null);
+            return this.credentials[key] ?? null;
+        return this.lazyLoad().then(() => this.credentials[key] ?? null);
     }
     getAll() {
         if (this.loaded)

package/dist/services/index.d.ts

@@ -13,6 +13,7 @@ export { LocalCredentialService } from './local-credential-service.js';
 export { LocalVariablesService } from './local-variables.js';
 export { ConsoleLogger, JsonConsoleLogger } from './logger-console.js';
 export { InMemoryWorkflowService } from './in-memory-workflow-service.js';
+export { QueueWebhookService, pikkuWebhookWorkerFunc, } from './queue-webhook-service.js';
 export { InMemoryQueueService } from './in-memory-queue-service.js';
 export { InMemoryTriggerService } from './in-memory-trigger-service.js';
 export { InMemoryAIRunStateService } from './in-memory-ai-run-state-service.js';
@@ -22,6 +23,7 @@ export type { ScenarioActor, ScenarioActorConfig, ScenarioActors, } from './scen
 export { HttpScenarioActor, createHttpScenarioActors, type HttpScenarioActorsConfig, } from './http-scenario-actors.js';
 export type { JWTService } from './jwt-service.js';
 export type { EmailService, EmailTemplateReference, SendEmailInput, SendEmailResult, SendHTMLEmailInput, SendTemplateEmailInput, SendTextEmailInput, } from './email-service.js';
+export { DEFAULT_WEBHOOK_RETRIES, DEFAULT_WEBHOOK_SIGNATURE_HEADER, PIKKU_OUTGOING_WEBHOOK_QUEUE_NAME, WebhookService, type SendWebhookInput, type SendWebhookResult, type WebhookAttemptRecord, type WebhookAttemptResult, type WebhookDeliveryRecord, type WebhookDeliveryWithAttempts, type WebhookJobData, type WebhookServiceConfig, } from './webhook-service.js';
 export type { Logger } from './logger.js';
 export type { SecretService } from './secret-service.js';
 export type { VariablesService } from './variables-service.js';
@@ -33,6 +35,7 @@ export type { GatewayService } from './gateway-service.js';
 export type { DeploymentService, DeploymentConfig, DeploymentInfo, DeploymentServiceConfig, } from './deployment-service.js';
 export type { AIStorageService } from './ai-storage-service.js';
 export type { AIAgentRunnerParams, AIAgentRunnerResult, AIAgentStepResult, AIEmbedManyParams, AIEmbedManyResult, AIEmbedParams, AIEmbedResult, AIGenerateImageParams, AIGenerateImagePrompt, AIGenerateImageResult, AIGenerateSpeechParams, AIGenerateSpeechResult, AIProviderOptions, AIRerankParams, AIRerankResult, AITranscriptionParams, AITranscriptionResult, AIAgentRunnerService, } from './ai-agent-runner-service.js';
+export type { AIEmbeddingService } from './ai-embedding-service.js';
 export type { CreateRunInput, AIRunStateService, } from './ai-run-state-service.js';
 export type { CredentialStatus, CredentialMeta, } from './typed-secret-service.js';
 export type { CredentialService } from './credential-service.js';
@@ -41,6 +44,7 @@ export type { CredentialStatusInfo, CredentialMetaInfo, } from './typed-credenti
 export type { VariableStatus, VariableMeta } from './typed-variables-service.js';
 export type { MetaService } from './meta-service.js';
 export type { SessionStore } from './session-store.js';
+export type { ScopeService, Role } from './scope-service.js';
 export { NoopAuditService, createInvocationAudit, resolveAuditActorFromWire, resolveAuditConfig, } from './audit-service.js';
 export type { AuditActor, AuditConfig, AuditDurability, AuditEvent, AuditEventBatch, AuditLog, AuditLogWriteInput, AuditOutcome, AuditService, AuditSource, ResolvedAuditConfig, } from './audit-service.js';
 export { InMemorySessionStore } from './in-memory-session-store.js';

package/dist/services/index.js

@@ -13,11 +13,13 @@ export { LocalCredentialService } from './local-credential-service.js';
 export { LocalVariablesService } from './local-variables.js';
 export { ConsoleLogger, JsonConsoleLogger } from './logger-console.js';
 export { InMemoryWorkflowService } from './in-memory-workflow-service.js';
+export { QueueWebhookService, pikkuWebhookWorkerFunc, } from './queue-webhook-service.js';
 export { InMemoryQueueService } from './in-memory-queue-service.js';
 export { InMemoryTriggerService } from './in-memory-trigger-service.js';
 export { InMemoryAIRunStateService } from './in-memory-ai-run-state-service.js';
 export { LocalGatewayService } from './local-gateway-service.js';
 export { HttpScenarioActor, createHttpScenarioActors, } from './http-scenario-actors.js';
+export { DEFAULT_WEBHOOK_RETRIES, DEFAULT_WEBHOOK_SIGNATURE_HEADER, PIKKU_OUTGOING_WEBHOOK_QUEUE_NAME, WebhookService, } from './webhook-service.js';
 export { TypedCredentialService } from './typed-credential-service.js';
 export { NoopAuditService, createInvocationAudit, resolveAuditActorFromWire, resolveAuditConfig, } from './audit-service.js';
 export { InMemorySessionStore } from './in-memory-session-store.js';

package/dist/services/meta-service.d.ts

@@ -85,8 +85,6 @@ export interface PermissionDefinitionMeta {
 }
 export interface PermissionsGroupsMeta {
     definitions: Record<string, PermissionDefinitionMeta>;
-    httpGroups: Record<string, GroupMeta>;
-    tagGroups: Record<string, GroupMeta>;
 }
 export interface EmailTemplateLocaleMeta {
     contentHash: string;
@@ -132,6 +130,17 @@ export interface MetaService {
     readDir(relativePath: string): Promise<string[]>;
     /** Read a project source file relative to the project root (one level above .pikku). */
     readProjectFile(relativePath: string): Promise<string | null>;
+    /**
+     * Read a file from an *installed addon package's* own `.pikku` directory
+     * (resolved from node_modules), NOT the app's `.pikku`. `relativePath` is
+     * relative to that package's `.pikku` root (use `../` to reach the package
+     * root itself, e.g. `../README.md`). Returns null if the package or file is
+     * absent. Only local/Node implementations resolve packages; remote impls omit
+     * this and callers guard with `?.`.
+     */
+    readPackageFile?(packageName: string, relativePath: string): Promise<string | null>;
+    /** List a directory inside an installed addon package's `.pikku`. */
+    readPackageDir?(packageName: string, relativePath: string): Promise<string[]>;
     getHttpMeta(): Promise<HTTPWiringsMeta>;
     getChannelsMeta(): Promise<ChannelsMeta>;
     getSchedulerMeta(): Promise<ScheduledTasksMeta>;
@@ -189,6 +198,10 @@ export declare class LocalMetaService implements MetaService {
     readFile(relativePath: string): Promise<string | null>;
     readDir(relativePath: string): Promise<string[]>;
     readProjectFile(relativePath: string): Promise<string | null>;
+    private packageRootCache;
+    private resolvePackageRoot;
+    readPackageFile(packageName: string, relativePath: string): Promise<string | null>;
+    readPackageDir(packageName: string, relativePath: string): Promise<string[]>;
     clearCache(): void;
     private readMetaJson;
     getHttpMeta(): Promise<HTTPWiringsMeta>;