@pikku/core 0.12.72 → 0.12.74

package/dist/wirings/queue/queue-identity.d.ts

@@ -0,0 +1,28 @@
+import type { Logger } from '../../services/logger.js';
+import type { SecretService } from '../../services/secret-service.js';
+export declare const QUEUE_IDENTITY_SECRET_NAME = "PIKKU_QUEUE_IDENTITY_SECRET";
+/** Namespaces the queue signing key away from every other use of the same material. */
+export declare const QUEUE_IDENTITY_INFO = "pikku:queue-identity";
+export declare const QUEUE_IDENTITY_CLAIM_VERSION = "pq1";
+/**
+ * What the signature is bound to. `jobId` is only enforced when the producer
+ * knew it at signing time — most adapters mint their own id after `add`.
+ */
+export interface QueueIdentityBinding {
+    queueName: string;
+    jobId?: string;
+    data: unknown;
+}
+export declare const getQueueIdentitySecret: (secrets?: SecretService) => Promise<string | undefined>;
+export declare const signQueueIdentity: (secret: string, pikkuUserId: string, binding: QueueIdentityBinding) => Promise<string>;
+/** The claimed user id, or undefined for anything that does not verify. */
+export declare const verifyQueueIdentity: (secret: string, token: string, binding: QueueIdentityBinding) => Promise<string | undefined>;
+/** Test seam: the latch is process-wide so the warning is emitted once. */
+export declare const resetQueueIdentityLogLatch: () => void;
+export declare const warnQueueIdentitySecretMissing: (logger: Logger) => void;
+export declare const resolveQueueJobIdentity: ({ claimedIdentity, binding, secrets, logger, }: {
+    claimedIdentity: string | undefined;
+    binding: QueueIdentityBinding;
+    secrets: SecretService | undefined;
+    logger: Logger;
+}) => Promise<string | undefined>;

package/dist/wirings/queue/queue-identity.js

@@ -0,0 +1,102 @@
+import { decodeBase64UrlText, encodeBase64UrlText, signWithKeyMaterial, verifyWithKeyMaterial, } from '../../crypto-utils.js';
+export const QUEUE_IDENTITY_SECRET_NAME = 'PIKKU_QUEUE_IDENTITY_SECRET';
+/** Namespaces the queue signing key away from every other use of the same material. */
+export const QUEUE_IDENTITY_INFO = 'pikku:queue-identity';
+export const QUEUE_IDENTITY_CLAIM_VERSION = 'pq1';
+const stableStringify = (value) => {
+    if (value === null || typeof value !== 'object') {
+        return JSON.stringify(value) ?? 'null';
+    }
+    if (Array.isArray(value)) {
+        return `[${value.map(stableStringify).join(',')}]`;
+    }
+    const record = value;
+    const keys = Object.keys(record).sort();
+    return `{${keys
+        .map((key) => `${JSON.stringify(key)}:${stableStringify(record[key])}`)
+        .join(',')}}`;
+};
+/**
+ * Round-trips through JSON first so the producer hashes exactly what the
+ * transport will deliver, then sorts keys so property order cannot change the
+ * digest.
+ */
+const canonicalizePayload = (data) => stableStringify(JSON.parse(JSON.stringify(data ?? null)));
+const signingPayload = (encodedClaim, data) => `${QUEUE_IDENTITY_CLAIM_VERSION}.${encodedClaim}.${canonicalizePayload(data)}`;
+export const getQueueIdentitySecret = async (secrets) => {
+    try {
+        return (await secrets?.getSecret(QUEUE_IDENTITY_SECRET_NAME)) || undefined;
+    }
+    catch {
+        return undefined;
+    }
+};
+export const signQueueIdentity = async (secret, pikkuUserId, binding) => {
+    const claim = {
+        u: pikkuUserId,
+        q: binding.queueName,
+        ...(binding.jobId ? { j: binding.jobId } : {}),
+    };
+    const encodedClaim = encodeBase64UrlText(JSON.stringify(claim));
+    const signature = await signWithKeyMaterial(QUEUE_IDENTITY_SECRET_NAME, secret, QUEUE_IDENTITY_INFO, signingPayload(encodedClaim, binding.data));
+    return `${QUEUE_IDENTITY_CLAIM_VERSION}.${encodedClaim}.${signature}`;
+};
+/** The claimed user id, or undefined for anything that does not verify. */
+export const verifyQueueIdentity = async (secret, token, binding) => {
+    const parts = token.split('.');
+    if (parts.length !== 3)
+        return undefined;
+    const [version, encodedClaim, signature] = parts;
+    if (version !== QUEUE_IDENTITY_CLAIM_VERSION)
+        return undefined;
+    const verified = await verifyWithKeyMaterial(QUEUE_IDENTITY_SECRET_NAME, secret, QUEUE_IDENTITY_INFO, signingPayload(encodedClaim, binding.data), signature);
+    if (!verified)
+        return undefined;
+    let claim;
+    try {
+        claim = JSON.parse(decodeBase64UrlText(encodedClaim));
+    }
+    catch {
+        return undefined;
+    }
+    if (typeof claim?.u !== 'string' || claim.u.length === 0)
+        return undefined;
+    if (claim.q !== binding.queueName)
+        return undefined;
+    if (claim.j !== undefined && claim.j !== binding.jobId)
+        return undefined;
+    return claim.u;
+};
+let missingSecretLogged = false;
+/** Test seam: the latch is process-wide so the warning is emitted once. */
+export const resetQueueIdentityLogLatch = () => {
+    missingSecretLogged = false;
+};
+export const warnQueueIdentitySecretMissing = (logger) => {
+    if (missingSecretLogged)
+        return;
+    missingSecretLogged = true;
+    logger.warn(`No '${QUEUE_IDENTITY_SECRET_NAME}' secret is configured — queue job identities cannot be signed or verified, so pikkuUserId is dropped and queue workers run without one.`);
+};
+export const resolveQueueJobIdentity = async ({ claimedIdentity, binding, secrets, logger, }) => {
+    if (!claimedIdentity)
+        return undefined;
+    const secret = await getQueueIdentitySecret(secrets);
+    if (!secret) {
+        warnQueueIdentitySecretMissing(logger);
+        return undefined;
+    }
+    let pikkuUserId;
+    try {
+        pikkuUserId = await verifyQueueIdentity(secret, claimedIdentity, binding);
+    }
+    catch (error) {
+        logger.error(`Could not verify the identity claim on job ${binding.jobId} in queue ${binding.queueName} — the job runs without a pikkuUserId.`, error);
+        return undefined;
+    }
+    if (!pikkuUserId) {
+        logger.error(`Rejected an unsigned or invalid identity claim on job ${binding.jobId} in queue ${binding.queueName} — the job runs without a pikkuUserId.`);
+        return undefined;
+    }
+    return pikkuUserId;
+};

package/dist/wirings/queue/queue-runner.d.ts

@@ -1,36 +1,17 @@
 import type { CoreQueueWorker, QueueJob } from './queue.types.js';
 import type { CorePikkuFunctionConfig, CorePikkuFunctionSessionless } from '../../function/functions.types.js';
 import { PikkuError } from '../../errors/error-handler.js';
-/**
- * Error class for when a queue job is explicitly failed
- */
 export declare class QueueJobFailedError extends PikkuError {
     constructor(jobId: string, reason?: string);
 }
-/**
- * Error class for when a queue job is explicitly discarded
- */
 export declare class QueueJobDiscardedError extends PikkuError {
     constructor(jobId: string, reason?: string);
 }
-/**
- * Add a queue processor to the system
- */
 export declare const wireQueueWorker: <InputData = any, OutputData = any, PikkuFunctionConfig extends CorePikkuFunctionConfig<CorePikkuFunctionSessionless<InputData, OutputData>> = CorePikkuFunctionConfig<CorePikkuFunctionSessionless<InputData, OutputData>>>(queueWorker: CoreQueueWorker<PikkuFunctionConfig>) => void;
-/**
- * Get all registered queue processors
- */
 export declare function getQueueWorkers(): Map<string, CoreQueueWorker>;
-/**
- * Stop and remove a queue processor
- */
 export declare function removeQueueWorker(name: string): Promise<void>;
-/**
- * Process a single queue job - this function is called by queue consumers
- */
 export declare function runQueueJob({ job, updateProgress, traceId, }: {
     job: QueueJob;
     updateProgress?: (progress: number | string | object) => Promise<void>;
-    /** Pre-resolved trace ID (e.g. from queue message metadata) */
     traceId?: string;
 }): Promise<void>;

package/dist/wirings/queue/queue-runner.js

@@ -2,44 +2,31 @@ import { getErrorResponse, PikkuError } from '../../errors/error-handler.js';
 import { PikkuMissingMetaError } from '../../errors/errors.js';
 import { getSingletonServices, getCreateWireServices, pikkuState, } from '../../pikku-state.js';
 import { addFunction, runPikkuFunc } from '../../function/function-runner.js';
-/**
- * Error class for queue processor not found
- */
+import { resolveQueueJobIdentity } from './queue-identity.js';
 class QueueWorkerNotFoundError extends PikkuError {
     constructor(name) {
         super(`Queue processor not found: ${name}`);
     }
 }
-/**
- * Error class for when a queue job is explicitly failed
- */
 export class QueueJobFailedError extends PikkuError {
     constructor(jobId, reason) {
         super(`Queue job ${jobId} failed${reason ? `: ${reason}` : ''}`);
         this.name = 'QueueJobFailedError';
     }
 }
-/**
- * Error class for when a queue job is explicitly discarded
- */
 export class QueueJobDiscardedError extends PikkuError {
     constructor(jobId, reason) {
         super(`Queue job ${jobId} discarded${reason ? `: ${reason}` : ''}`);
         this.name = 'QueueJobDiscardedError';
     }
 }
-/**
- * Add a queue processor to the system
- */
 export const wireQueueWorker = (queueWorker) => {
-    // Get processor metadata
     const meta = pikkuState(null, 'queue', 'meta');
     const processorMeta = meta[queueWorker.name];
     if (!processorMeta) {
         console.warn(`[pikku] Skipping queue worker '${queueWorker.name}' — metadata not found. Consider moving this wiring to its own file.`);
         return;
     }
-    // Register the function with pikku
     addFunction(processorMeta.pikkuFuncId, {
         func: queueWorker.func.func,
         auth: queueWorker.func.auth,
@@ -47,19 +34,12 @@ export const wireQueueWorker = (queueWorker) => {
         middleware: queueWorker.func.middleware,
         tags: queueWorker.func.tags,
     });
-    // Store processor definition in state - runtime adapters will pick this up
     const registrations = pikkuState(null, 'queue', 'registrations');
     registrations.set(queueWorker.name, queueWorker);
 };
-/**
- * Get all registered queue processors
- */
 export function getQueueWorkers() {
     return pikkuState(null, 'queue', 'registrations');
 }
-/**
- * Stop and remove a queue processor
- */
 export async function removeQueueWorker(name) {
     const registrations = pikkuState(null, 'queue', 'registrations');
     const registration = registrations.get(name);
@@ -68,9 +48,6 @@ export async function removeQueueWorker(name) {
     }
     registrations.delete(name);
 }
-/**
- * Process a single queue job - this function is called by queue consumers
- */
 export async function runQueueJob({ job, updateProgress, traceId, }) {
     const singletonServices = getSingletonServices();
     const createWireServices = getCreateWireServices();
@@ -82,21 +59,25 @@ export async function runQueueJob({ job, updateProgress, traceId, }) {
     if (!processorMeta) {
         throw new PikkuMissingMetaError(`Missing generated metadata for queue worker '${job.queueName}'`);
     }
-    // Get the queue worker registration to access middleware
     const registrations = pikkuState(null, 'queue', 'registrations');
     const queueWorker = registrations.get(job.queueName);
     if (!queueWorker) {
         throw new Error(`Queue worker registration not found for: ${job.queueName}`);
     }
-    // Create the queue wire object
+    // knowledge: decisions/security/queue-job-identities-are-signed-at-enqueue.md
+    const pikkuUserId = await resolveQueueJobIdentity({
+        claimedIdentity: job.pikkuUserId,
+        binding: { queueName: job.queueName, jobId: job.id, data: job.data },
+        secrets: singletonServices.secrets,
+        logger,
+    });
     const queue = {
         queueName: job.queueName,
         jobId: job.id,
-        pikkuUserId: job.pikkuUserId,
+        pikkuUserId,
         updateProgress: updateProgress ||
             (async (progress) => {
                 logger.info(`Job ${job.id} progress: ${progress}`);
-                // Default implementation - just log the progress
             }),
         fail: async (reason) => {
             throw new QueueJobFailedError(job.id, reason);
@@ -111,7 +92,6 @@ export async function runQueueJob({ job, updateProgress, traceId, }) {
             traceId: resolvedTraceId,
             queue,
         };
-        // Execute the pikku function with the job data
         const result = await runPikkuFunc('queue', job.queueName, processorMeta.pikkuFuncId, {
             singletonServices,
             createWireServices,
@@ -131,7 +111,6 @@ export async function runQueueJob({ job, updateProgress, traceId, }) {
         if (errorResponse != null) {
             logger.error('Processed error response:', errorResponse);
         }
-        // Re-throw the error so the queue service can handle retries/DLQ
         throw error;
     }
 }

package/dist/wirings/queue/queue.types.d.ts

@@ -1,90 +1,54 @@
 import type { CommonWireMeta } from '../../types/core.types.js';
 import type { CorePikkuFunctionConfig } from '../../function/functions.types.js';
 import type { QueueConfigMapping } from './validate-worker-config.js';
-/**
- * Configuration for queue workers - how jobs are processed
- */
-/**
- * Configuration for queue workers - how jobs are processed
- */
 export interface PikkuWorkerConfig {
-    /** Optional worker name for identification and monitoring */
     name?: string;
-    /** Number of messages to process in batch / in parallel */
+    /** Total worker concurrency. */
     batchSize?: number;
-    /** Number of messages to prefetch for efficiency */
     prefetch?: number;
-    /** Polling interval for pull-based queues in ms */
+    /** Milliseconds. */
     pollInterval?: number;
-    /** Message visibility timeout in seconds */
+    /** Seconds. */
     visibilityTimeout?: number;
-    /** Duration of job lock in milliseconds */
+    /** Milliseconds. */
     lockDuration?: number;
-    /** Number of seconds to wait when queue is empty before polling again */
+    /** Seconds. */
     drainDelay?: number;
-    /** Keep N completed jobs for inspection */
+    /** Number of completed jobs to retain, not an age. */
     removeOnComplete?: number;
-    /** Keep N failed jobs for inspection */
+    /** Number of failed jobs to retain, not an age. */
     removeOnFail?: number;
-    /** Maximum number of times a job can be recovered from stalled state */
     maxStalledCount?: number;
-    /** Condition to start processor at instance creation */
     autorun?: boolean;
-    /**
-     * Cap how many jobs of any one group ({@link JobOptions.group}) may run at
-     * once, so a single group can't occupy the whole worker. Lets one shared
-     * queue stay fair across producers instead of splitting it into one queue
-     * per producer — which multiplies polling cost on pull-based backends.
-     * Must not exceed {@link batchSize}.
-     */
+    /** Must not exceed {@link batchSize}. */
     groupConcurrency?: number | GroupConcurrencyConfig;
 }
-/**
- * Per-group concurrency limits, optionally varied by tier so slow groups can
- * be allowed more (or fewer) slots than the default.
- */
 export interface GroupConcurrencyConfig {
-    /** Limit applied to any group without a matching tier */
+    /** Limit applied to any group without a matching tier. */
     default: number;
-    /** Per-tier overrides, keyed by {@link JobGroup.tier} */
+    /** Keyed by {@link JobGroup.tier}. */
     tiers?: Record<string, number>;
 }
-/**
- * Fairness key for a job. Jobs sharing an `id` count against the same
- * {@link PikkuWorkerConfig.groupConcurrency} limit.
- */
 export interface JobGroup {
-    /** Group this job belongs to (e.g. a workflow name) */
     id: string;
-    /** Optional tier selecting a per-tier limit */
     tier?: string;
 }
-/**
- * Configuration for individual jobs - how jobs behave
- */
 export interface PikkuJobConfig {
-    /** Maximum retry attempts for failed jobs */
     retryAttempts?: number;
-    /** Initial retry delay in milliseconds */
+    /** Milliseconds. */
     retryDelay?: number;
-    /** Retry backoff strategy */
     retryBackoff?: 'linear' | 'exponential' | 'fixed';
-    /** Queue for failed messages after max retries */
     deadLetterQueue?: string;
-    /** How long to retain completed jobs in seconds */
+    /** Seconds. */
     messageRetention?: number;
-    /** Job priority (higher numbers = higher priority) */
+    /** Higher numbers run first. */
     priority?: number;
-    /** Enable FIFO ordering where supported */
     fifo?: boolean;
-    /** Job timeout in milliseconds */
+    /** Milliseconds. */
     timeout?: number;
-    /** Delay before job execution in milliseconds */
+    /** Milliseconds. */
     delay?: number;
 }
-/**
- * Configuration validation result with warnings and fallbacks
- */
 export interface ConfigValidationResult {
     applied: Partial<PikkuWorkerConfig>;
     ignored: Partial<PikkuWorkerConfig>;
@@ -93,9 +57,6 @@ export interface ConfigValidationResult {
         [key: string]: any;
     };
 }
-/**
- * Queue job representation
- */
 export type QueueJobStatus = 'waiting' | 'active' | 'completed' | 'failed' | 'delayed';
 export type QueueJobMetadata = {
     progress?: number | string | object | undefined | boolean;
@@ -115,12 +76,8 @@ export interface QueueJob<T = any, R = any> {
     result?: R;
     waitForCompletion?: (ttl?: number) => Promise<R>;
     metadata?: () => Promise<QueueJobMetadata> | QueueJobMetadata;
-    /** Pikku user ID propagated from the job producer */
     pikkuUserId?: string;
 }
-/**
- * Job options for queue operations
- */
 export interface JobOptions {
     priority?: number;
     delay?: number;
@@ -132,45 +89,25 @@ export interface JobOptions {
     removeOnComplete?: number;
     removeOnFail?: number;
     jobId?: string;
-    /** Pikku user ID to propagate to the queue worker for credential resolution */
     pikkuUserId?: string;
-    /** Fairness key — counts against the worker's {@link PikkuWorkerConfig.groupConcurrency} */
+    /** Counts against the worker's {@link PikkuWorkerConfig.groupConcurrency}. */
     group?: JobGroup;
 }
-/**
- * Queue provider interface for job publishing operations
- */
 export interface QueueService {
-    /** Whether this queue provider supports job results */
     readonly supportsResults: boolean;
-    /** Add a job to the queue with type safety */
     add<T>(queueName: string, data: T, options?: JobOptions): Promise<string>;
-    /** Get job status and result */
     getJob<T, R>(queueName: string, jobId: string): Promise<QueueJob<T, R> | null>;
 }
-/**
- * Queue service interface that queue adapters implement
- */
 export interface QueueWorkers {
-    /** Service name identifier */
     name: string;
-    /** Whether this queue service supports job results */
     supportsResults: boolean;
-    /** Configuration mapping for validation */
     configMappings: QueueConfigMapping;
-    /** Scan state and register all compatible processors */
     registerQueues(): Promise<Record<string, ConfigValidationResult[]>>;
 }
-/**
- * Queue processor metadata
- */
 export type QueueWorkersMeta = Record<string, CommonWireMeta & {
     name: string;
     config?: PikkuWorkerConfig;
 }>;
-/**
- * Core queue processor definition
- */
 export type CoreQueueWorker<PikkuFunctionConfig extends CorePikkuFunctionConfig<any, any, any> = CorePikkuFunctionConfig<any, any, any>> = {
     name: string;
     func: PikkuFunctionConfig;
@@ -179,21 +116,13 @@ export type CoreQueueWorker<PikkuFunctionConfig extends CorePikkuFunctionConfig<
     tags?: string[];
     middleware?: PikkuFunctionConfig['middleware'];
 };
-/**
- * Represents a queue wire object for middleware
- * Provides information and actions for the current queue job execution
- */
 export interface PikkuQueue {
-    /** The name of the queue being processed */
     queueName: string;
-    /** The current job ID */
     jobId: string;
-    /** Pikku user ID propagated from the job producer for credential resolution */
     pikkuUserId?: string;
-    /** Update job progress (0-100 or custom value) */
     updateProgress: (progress: number | string | object) => Promise<void>;
-    /** Fail the current job with optional reason */
+    /** Never returns — throws QueueJobFailedError. */
     fail: (reason?: string) => Promise<void>;
-    /** Discard/delete the job without retrying */
+    /** Never returns — throws QueueJobDiscardedError. */
     discard: (reason?: string) => Promise<void>;
 }

package/dist/wirings/queue/register-queue-helper.d.ts

@@ -1,17 +1,5 @@
 import type { ConfigValidationResult, CoreQueueWorker } from './queue.types.js';
 import type { QueueConfigMapping } from './validate-worker-config.js';
 import type { Logger } from '../../services/logger.js';
-/**
- * Queue processor registration callback
- */
 export type QueueRegistrationCallback<T = any> = (queueName: string, processor: CoreQueueWorker) => Promise<T>;
-/**
- * Helper function to register queue processors with validation
- * This centralizes the common logic for looping over processors and validating configs
- *
- * @param configMappings - Configuration mapping for the queue implementation
- * @param registerCallback - Callback to register each individual queue processor
- * @param logger - Optional logger for info/error messages
- * @returns Record of validation results by queue name
- */
 export declare function registerQueueWorkers<T = any>(configMappings: QueueConfigMapping, logger: Logger, registerCallback: QueueRegistrationCallback<T>): Promise<Record<string, ConfigValidationResult[]>>;

package/dist/wirings/queue/register-queue-helper.js

@@ -1,22 +1,11 @@
 import { getQueueWorkers } from './queue-runner.js';
 import { validateWorkerConfig } from './validate-worker-config.js';
-/**
- * Helper function to register queue processors with validation
- * This centralizes the common logic for looping over processors and validating configs
- *
- * @param configMappings - Configuration mapping for the queue implementation
- * @param registerCallback - Callback to register each individual queue processor
- * @param logger - Optional logger for info/error messages
- * @returns Record of validation results by queue name
- */
 export async function registerQueueWorkers(configMappings, logger, registerCallback) {
     const configValidation = {};
     const queueWorkers = getQueueWorkers();
     for (const [queueName, processor] of queueWorkers) {
         logger?.info(`Registering queue processor: ${queueName}`);
-        // Validate the processor configuration
         const validationResult = validateWorkerConfig(configMappings, processor.config);
-        // Store validation results
         configValidation[queueName] = configValidation[queueName] || [];
         configValidation[queueName].push(validationResult);
         if (validationResult.warnings.length > 0) {

package/dist/wirings/queue/signed-queue-service.d.ts

@@ -0,0 +1,16 @@
+import type { Logger } from '../../services/logger.js';
+import type { SecretService } from '../../services/secret-service.js';
+import type { JobOptions, QueueJob, QueueService } from './queue.types.js';
+/**
+ * Wraps any {@link QueueService} so `JobOptions.pikkuUserId` leaves the process
+ * as a signed claim that `runQueueJob` can verify.
+ */
+export declare class SignedQueueService implements QueueService {
+    private readonly queueService;
+    private readonly secrets;
+    private readonly logger;
+    constructor(queueService: QueueService, secrets: SecretService, logger: Logger);
+    get supportsResults(): boolean;
+    add<T>(queueName: string, data: T, options?: JobOptions): Promise<string>;
+    getJob<T, R>(queueName: string, jobId: string): Promise<QueueJob<T, R> | null>;
+}

package/dist/wirings/queue/signed-queue-service.js

@@ -0,0 +1,42 @@
+import { getQueueIdentitySecret, signQueueIdentity, warnQueueIdentitySecretMissing, } from './queue-identity.js';
+/**
+ * Wraps any {@link QueueService} so `JobOptions.pikkuUserId` leaves the process
+ * as a signed claim that `runQueueJob` can verify.
+ */
+export class SignedQueueService {
+    queueService;
+    secrets;
+    logger;
+    constructor(queueService, secrets, logger) {
+        this.queueService = queueService;
+        this.secrets = secrets;
+        this.logger = logger;
+    }
+    get supportsResults() {
+        return this.queueService.supportsResults;
+    }
+    async add(queueName, data, options) {
+        const pikkuUserId = options?.pikkuUserId;
+        if (!pikkuUserId) {
+            return this.queueService.add(queueName, data, options);
+        }
+        const secret = await getQueueIdentitySecret(this.secrets);
+        if (!secret) {
+            warnQueueIdentitySecretMissing(this.logger);
+            const { pikkuUserId: _unsigned, ...rest } = options;
+            return this.queueService.add(queueName, data, rest);
+        }
+        const signed = await signQueueIdentity(secret, pikkuUserId, {
+            queueName,
+            jobId: undefined,
+            data,
+        });
+        return this.queueService.add(queueName, data, {
+            ...options,
+            pikkuUserId: signed,
+        });
+    }
+    async getJob(queueName, jobId) {
+        return this.queueService.getJob(queueName, jobId);
+    }
+}

package/dist/wirings/queue/validate-worker-config.d.ts

@@ -1,41 +1,20 @@
 import type { PikkuWorkerConfig, ConfigValidationResult } from './queue.types.js';
-/**
- * Configuration mapping structure for queue implementations
- */
 export interface QueueConfigMapping {
-    /** Configurations that are directly supported */
     supported: Partial<Record<keyof PikkuWorkerConfig, {
-        /** The property name in the underlying queue system */
         queueProperty?: string;
-        /** Optional transform function for the value */
         transform?: (value: any) => any;
-        /** Description of what this configuration does */
         description: string;
     }>>;
-    /** Configurations that are not supported */
+    /** Rejected: the value is dropped and a warning raised. */
     unsupported: Partial<Record<keyof PikkuWorkerConfig, {
-        /** Why this configuration is not supported */
         reason: string;
-        /** Detailed explanation of what the queue system does instead */
         explanation: string;
     }>>;
-    /** Configurations that have partial support or workarounds */
+    /** Applied anyway, but with a warning describing the substituted behaviour. */
     fallbacks: Partial<Record<keyof PikkuWorkerConfig, {
-        /** Why this configuration uses a fallback */
         reason: string;
-        /** Detailed explanation of the fallback behavior */
         explanation: string;
-        /** The fallback value or description */
         fallbackValue: string;
     }>>;
 }
-/**
- * Validates worker configuration using a mapping table
- * This provides a flexible, maintainable way to validate configurations
- * across different queue implementations
- *
- * @param config - The worker configuration to validate
- * @param configMapping - The mapping table defining supported/unsupported configurations
- * @returns Validation result with applied, ignored, warnings, and fallbacks
- */
 export declare function validateWorkerConfig(configMapping: QueueConfigMapping, config?: PikkuWorkerConfig): ConfigValidationResult;