@pikku/core 0.12.72 → 0.12.74

package/src/function/functions.types.ts

@@ -1,15 +1,17 @@
 import type {
   CoreServices,
-  CoreSingletonServices,
+  CoreSecretlessSingletonServices,
   CoreUserSession,
   CorePikkuMiddleware,
   PikkuWire,
   PickRequired,
+  SecretlessServices,
 } from '../types/core.types.js'
 import type { PikkuRPC } from '../wirings/rpc/rpc-types.js'
 import type { StandardSchemaV1 } from '@standard-schema/spec'
 import type { PikkuError } from '../errors/error-handler.js'
 import type { CoreNodeConfig } from '../wirings/node/node.types.js'
+import type { ScenarioSurface } from '../wirings/workflow/scenario-step.types.js'
 
 /**
  * @deprecated Use StandardSchemaV1 from @standard-schema/spec instead.
@@ -17,18 +19,11 @@ import type { CoreNodeConfig } from '../wirings/node/node.types.js'
  */
 export type ZodLike<T = any> = StandardSchemaV1<T, T>
 
-/**
- * Represents a core API function that performs an operation using core services and a user session.
- *
- * @template In - The input type.
- * @template Out - The output type.
- * @template Services - The services type, defaults to `CoreServices`.
- * @template Wire - The wire type, defaults to `PikkuWire<In, Out>`.
- */
 export type CorePikkuFunction<
   In,
   Out,
-  Services extends CoreSingletonServices = CoreServices,
+  Services extends CoreSecretlessSingletonServices =
+    SecretlessServices<CoreServices>,
   Session extends CoreUserSession = CoreUserSession,
   Wire extends PikkuWire<In, Out, true, Session, PikkuRPC, null, string> =
     PikkuWire<In, Out, true, Session>,
@@ -38,18 +33,11 @@ export type CorePikkuFunction<
   wire: Wire
 ) => Wire['channel'] extends null ? Promise<Out> : Promise<Out> | Promise<void>
 
-/**
- * Represents a core API function that can be used without a session.
- *
- * @template In - The input type.
- * @template Out - The output type.
- * @template Services - The services type, defaults to `CoreServices`.
- * @template Wire - The wire type, defaults to `PikkuWire<In, Out>`.
- */
 export type CorePikkuFunctionSessionless<
   In,
   Out,
-  Services extends CoreSingletonServices = CoreServices,
+  Services extends CoreSecretlessSingletonServices =
+    SecretlessServices<CoreServices>,
   Session extends CoreUserSession = CoreUserSession,
   Wire extends PikkuWire<In, Out, false, Session, PikkuRPC, null, string> =
     PikkuWire<In, Out, false, Session>,
@@ -59,69 +47,30 @@ export type CorePikkuFunctionSessionless<
   wire: Wire
 ) => Wire['channel'] extends null ? Promise<Out> : Promise<Out> | Promise<void>
 
-/**
- * Represents a function that checks permissions for a given operation.
- *
- * @template In - The input type.
- * @template Services - The services type, defaults to `CoreServices`.
- * @template Session - The session type, defaults to `CoreUserSession`.
- */
 export type CorePikkuPermission<
   In = any,
-  Services extends CoreSingletonServices = CoreServices,
+  Services extends CoreSecretlessSingletonServices =
+    SecretlessServices<CoreServices>,
   Wire extends PikkuWire<In, never, false, any, PikkuRPC, never, never> =
     PikkuWire<In, never, false, any, PikkuRPC, never, never>,
 > = (services: Services, data: In, wire: Wire) => Promise<boolean>
 
-/**
- * Configuration object for creating a permission with metadata
- *
- * @template In - The input type.
- * @template Services - The services type, defaults to `CoreServices`.
- * @template Session - The session type, defaults to `CoreUserSession`.
- */
 export type CorePikkuPermissionConfig<
   In = any,
-  Services extends CoreSingletonServices = CoreServices,
+  Services extends CoreSecretlessSingletonServices =
+    SecretlessServices<CoreServices>,
   Wire extends PikkuWire<In, never, false, any, PikkuRPC, never, never> =
     PikkuWire<In, never, false, any, PikkuRPC, never, never>,
 > = {
-  /** The permission function */
   func: CorePikkuPermission<In, Services, Wire>
-  /** Optional human-readable name for the permission */
   name?: string
-  /** Optional description of what the permission checks */
   description?: string
 }
 
-/**
- * Factory function for creating permissions with tree-shaking support
- * Supports both direct function and configuration object syntax
- *
- * @example
- * ```typescript
- * // Direct function syntax
- * export const adminPermission = pikkuPermission(
- *   async ({ logger }, _data, { getSession }) => {
- *     const currentSession = await getSession()
- *     return currentSession?.role === 'admin'
- *   }
- * )
- *
- * // Configuration object syntax with metadata
- * export const adminPermission = pikkuPermission({
- *   name: 'Admin Permission',
- *   description: 'Checks if user has admin role',
- *   func: async ({ logger }, _data, { getSession }) => {
- *     const currentSession = await getSession()
- *     return currentSession?.role === 'admin'
- *   }
- * })
- * ```
- */
 export const pikkuPermission = <
   In = any,
-  Services extends CoreSingletonServices = CoreServices,
+  Services extends CoreSecretlessSingletonServices =
+    SecretlessServices<CoreServices>,
   Wire extends PickRequired<
     PikkuWire<In, never, false, any, PikkuRPC, never, never>,
     'session'
@@ -137,41 +86,14 @@ export const pikkuPermission = <
   return typeof permission === 'function' ? permission : permission.func
 }
 
-/**
- * A factory function that takes input and returns a permission
- * Used when permissions need configuration/input parameters
- *
- * @template In - The input type for the factory.
- * @template Services - The services type, defaults to `CoreServices`.
- * @template Session - The session type, defaults to `CoreUserSession`.
- */
 export type CorePikkuPermissionFactory<
   In = any,
-  Services extends CoreSingletonServices = CoreServices,
+  Services extends CoreSecretlessSingletonServices =
+    SecretlessServices<CoreServices>,
   Wire extends PikkuWire<In, never, false, any, PikkuRPC, never, never> =
     PikkuWire<In, never, false, any, PikkuRPC, never, never>,
 > = (input: In) => CorePikkuPermission<any, Services, Wire>
 
-/**
- * Factory function for creating permission factories
- * Use this when your permission needs configuration/input parameters
- *
- * @example
- * ```typescript
- * export const requireRole = pikkuPermissionFactory<{ role: string }>(({
- *   role
- * }) => {
- *   return pikkuPermission(async ({ logger }, data, { getSession }) => {
- *      const currentSession = await getSession()
- *     if (!currentSession || currentSession.role !== role) {
- *       logger.warn(`Permission denied: required role '${role}'`)
- *       return false
- *     }
- *     return true
- *   })
- * })
- * ```
- */
 export const pikkuPermissionFactory = <In = any>(
   factory: CorePikkuPermissionFactory<In>
 ): CorePikkuPermissionFactory<In> => {
@@ -179,33 +101,19 @@ export const pikkuPermissionFactory = <In = any>(
 }
 
 /**
- * A function that generates a human-readable description of a pending approval action.
- * Used by AI agents to show meaningful approval prompts instead of raw tool arguments.
- *
- * @template In - The input type (same as the function it describes).
- * @template Services - The services type, defaults to `CoreSingletonServices`.
+ * Renders a human-readable approval prompt for an AI agent, in place of the
+ * raw tool arguments.
  */
 export type CorePikkuApprovalDescription<
   In = any,
-  Services extends CoreSingletonServices = CoreSingletonServices,
+  Services extends CoreSecretlessSingletonServices =
+    CoreSecretlessSingletonServices,
 > = (services: Services, data: In) => Promise<string>
 
-/**
- * Factory function for creating approval description functions with tree-shaking support.
- *
- * @example
- * ```typescript
- * export const deleteTodoApproval = pikkuApprovalDescription(
- *   async ({ todoStore }, { id }) => {
- *     const todo = await todoStore.get(id)
- *     return `Delete todo: "${todo.title}"`
- *   }
- * )
- * ```
- */
 export const pikkuApprovalDescription = <
   In = any,
-  Services extends CoreSingletonServices = CoreSingletonServices,
+  Services extends CoreSecretlessSingletonServices =
+    CoreSecretlessSingletonServices,
 >(
   fn: CorePikkuApprovalDescription<In, Services>
 ): CorePikkuApprovalDescription<In, Services> => {
@@ -213,12 +121,14 @@ export const pikkuApprovalDescription = <
 }
 
 export type CorePikkuAuth<
-  Services extends CoreSingletonServices = CoreServices,
+  Services extends CoreSecretlessSingletonServices =
+    SecretlessServices<CoreServices>,
   Session extends CoreUserSession = CoreUserSession,
 > = (services: Services, session: Session) => Promise<boolean> | boolean
 
 export type CorePikkuAuthConfig<
-  Services extends CoreSingletonServices = CoreServices,
+  Services extends CoreSecretlessSingletonServices =
+    SecretlessServices<CoreServices>,
   Session extends CoreUserSession = CoreUserSession,
 > = {
   func: CorePikkuAuth<Services, Session>
@@ -227,7 +137,8 @@ export type CorePikkuAuthConfig<
 }
 
 export const pikkuAuth = <
-  Services extends CoreSingletonServices = CoreServices,
+  Services extends CoreSecretlessSingletonServices =
+    SecretlessServices<CoreServices>,
   Session extends CoreUserSession = CoreUserSession,
 >(
   auth:
@@ -249,9 +160,9 @@ export type CorePermissionGroup<PikkuPermission = CorePikkuPermission<any>> =
   | undefined
 
 /**
- * A lifecycle hook: the same call signature as the function it hangs off, but
- * its return value is discarded. A hook is setup/teardown, not a step — it has
- * no id, no meta and no schema, so it is never recorded and never replayed.
+ * A lifecycle hook: same call signature as the function it hangs off, return
+ * value discarded. Setup/teardown, not a step — no id, no meta, no schema, so
+ * it is never recorded and never replayed.
  */
 export type CorePikkuFunctionHook<Services = any, Data = any, Wire = any> = (
   services: Services,
@@ -273,15 +184,24 @@ export type CorePikkuFunctionConfig<
   OutputSchema extends StandardSchemaV1 | undefined = undefined,
   Scope extends string = string,
 > = {
-  /** Short human-readable name (e.g. "Create Todo") */
   title?: string
-  /** Longer-form description of what the function does */
   description?: string
   /** Explicit logical name override; lets multiple exports share a versioned base */
   override?: string
   version?: number
   tags?: string[]
   expose?: boolean
+  /**
+   * The function performs its own authorization in its body — verifying a
+   * signed token, checking a webhook signature, matching an invite code — so
+   * it is not open despite carrying no session, scope or permission.
+   *
+   * Purely declarative: nothing at runtime reads it, and it grants nothing. It
+   * exists so the claim is written down where an audit can find it, and so
+   * codegen stops warning about a gate it has no way to see. Asserting it
+   * falsely disables the one check that would have caught the mistake.
+   */
+  selfAuthenticated?: boolean
   remote?: boolean
   mcp?: boolean
   readonly?: boolean
@@ -293,8 +213,12 @@ export type CorePikkuFunctionConfig<
   workflowRetries?: number
   /** Timeout for this function when used as a workflow step (e.g. '30s', '5m'). */
   workflowTimeout?: string
-  /** Scenario steps only: this step drives a browser, so the runner must provision one before calling it. */
-  browser?: boolean
+  /**
+   * Scenario steps only: which surfaces this step declares a binding for. The
+   * runner uses it to pick a binding, decide whether to provision a browser,
+   * and report how much of the flow each surface actually covers.
+   */
+  surfaces?: ScenarioSurface[]
   audit?:
     | boolean
     | {
@@ -309,26 +233,22 @@ export type CorePikkuFunctionConfig<
    */
   before?: CorePikkuFunctionHook
   /**
-   * Scenarios only: always runs after the scenario body, in a `finally`.
-   * Throwing fails a run that would otherwise have passed; on an
-   * already-failed run it attaches as the `cause` and never replaces the
-   * original error.
+   * Scenarios only: always runs after the body, in a `finally`. Throwing fails
+   * an otherwise-passing run; on an already-failed run it attaches as `cause`
+   * and never replaces the original error.
    */
   after?: CorePikkuFunctionHook
   /**
-   * Scenarios only: why this scenario is held out of a default run. It is
-   * reported as skipped rather than quietly omitted, and naming it directly
-   * with `--flows` runs it anyway.
+   * Scenarios only: why this scenario is held out of a default run. Reported
+   * as skipped rather than quietly omitted; naming it in `--flows` runs it.
    */
   skip?: string
   auth?: boolean
   /**
-   * Scopes the session must hold to run this function. All of them are
-   * required (AND), and they are checked before `permissions` — unlike
-   * permissions, which OR together, a scope can only narrow access.
-   *
-   * Narrowed to the generated `ScopeId` union in a project's own
-   * `pikku-types.gen.ts`, so an undeclared scope is a compile error.
+   * Scopes the session must hold; all are required (AND) and checked before
+   * `permissions`, which OR together — a scope can only narrow access.
+   * Narrowed to the generated `ScopeId` union, so an undeclared scope is a
+   * compile error.
    */
   scopes?: Scope[]
   permissions?: CorePermissionGroup<PikkuPermission>

package/src/function/list.types.test.ts

@@ -1,15 +1,11 @@
 /**
- * Type-level tests for list-function primitives.
- *
- * No runtime assertions — the point is that valid shapes compile and
- * invalid shapes fail with `@ts-expect-error`. The file is excluded
- * from `yarn build` via tsconfig's `**∕*.test.ts` pattern.
+ * Type-level tests: no runtime assertions — valid shapes must compile and
+ * invalid shapes must fail with `@ts-expect-error`. Excluded from `yarn build`
+ * via tsconfig's test-file pattern.
  */
 
 import type { ListInput, ListOutput, Filter } from './list.types.js'
 
-// -- ListInput ---------------------------------------------------------------
-
 type SessionFilter = {
   status?: string[]
   therapistId?: string
@@ -32,22 +28,18 @@ void _basic
 const _empty: ListInput = {}
 void _empty
 
-// sort.column must be from the declared union
 // @ts-expect-error — 'created_at' is not in SessionSort
 const _badSort: ListInput<SessionFilter, SessionSort> = {
   sort: [{ column: 'created_at', direction: 'asc' }],
 }
 void _badSort
 
-// sort.direction must be 'asc' or 'desc'
 // @ts-expect-error — 'descending' is not a valid direction
 const _badDirection: ListInput<SessionFilter, SessionSort> = {
   sort: [{ column: 'user', direction: 'descending' }],
 }
 void _badDirection
 
-// -- ListOutput --------------------------------------------------------------
-
 interface Session {
   id: string
   user: string
@@ -61,39 +53,29 @@ const _output: ListOutput<Session> = {
 }
 void _output
 
-// nextCursor is required (must be string or null, not undefined-only)
 // @ts-expect-error — missing nextCursor
 const _badOutput: ListOutput<Session> = {
   rows: [],
 }
 void _badOutput
 
-// -- Filter: leaves ----------------------------------------------------------
-
-// Simple equality
 const _leafEq: Filter<SessionFilter> = { therapistId: 'kim' }
 void _leafEq
 
-// Array = IN shorthand
 const _leafIn: Filter<SessionFilter> = { status: ['pending', 'processed'] }
 void _leafIn
 
-// Operator object
 const _leafOp: Filter<SessionFilter> = {
   uploadedAt: { gt: '2026-04-10', lte: '2026-04-17' },
 }
 void _leafOp
 
-// Null = IS NULL
 const _leafNull: Filter<SessionFilter> = { therapistId: null }
 void _leafNull
 
-// NOT on a value
 const _leafNot: Filter<SessionFilter> = { therapistId: { not: 'kim' } }
 void _leafNot
 
-// -- Filter: AND (array) -----------------------------------------------------
-
 const _and: Filter<SessionFilter> = [
   { status: ['pending'] },
   { therapistId: 'kim' },
@@ -101,16 +83,12 @@ const _and: Filter<SessionFilter> = [
 ]
 void _and
 
-// -- Filter: OR (object with arbitrary label keys) --------------------------
-
 const _or: Filter<SessionFilter> = {
   viaKim: { therapistId: 'kim' },
   viaPark: { therapistId: 'park' },
 }
 void _or
 
-// -- Filter: nested AND/OR ---------------------------------------------------
-
 const _nested: Filter<SessionFilter> = [
   { status: ['pending'] },
   {

package/src/function/list.types.ts

@@ -1,37 +1,10 @@
 /**
- * List-function primitives.
- *
- * A "list function" is any Pikku function that returns a paginated
- * collection. Adopting this shape unlocks a shared vocabulary across
- * MCP tools, AI agents, typed RPC clients, and widget libraries — they
- * all reason about cursor, filter, sort, and search uniformly.
- *
- * Under the hood, a list function is still a normal `pikkuFunc`. These
- * types are purely structural constraints; no runtime behaviour change.
- *
- * @example
- * ```ts
- * import { pikkuFunc } from '#pikku'
- * import type { ListInput, ListOutput } from '@pikku/core'
- *
- * export const listSessions = pikkuFunc<
- *   ListInput<{ status?: SessionStatus[] }, 'user' | 'status' | 'uploaded_at'>,
- *   ListOutput<Session>
- * >({
- *   func: async ({ kysely }, input) => {
- *     // input.sort / input.filter / input.cursor / input.search are typed
- *     return { rows, nextCursor, totalCount }
- *   },
- * })
- * ```
+ * A list function is an ordinary `pikkuFunc` whose input and output adopt
+ * these shapes. They are purely structural — no runtime behaviour attaches to
+ * them — and exist so MCP tools, agents, RPC clients and widget libraries all
+ * reason about cursor, filter, sort and search the same way.
  */
 
-/**
- * Shape every list function accepts as input.
- *
- * @template F - User-defined filter shape. Each key is a filterable field.
- * @template S - String union of sortable column names.
- */
 export interface ListInput<
   F extends Record<string, unknown> = Record<string, never>,
   S extends string = never,
@@ -42,15 +15,11 @@ export interface ListInput<
   limit?: number
   /** Ordered sort criteria — first entry is primary. */
   sort?: Array<{ column: S; direction: 'asc' | 'desc' }>
-  /** Structured filter tree. See {@link Filter}. */
   filter?: Filter<F>
   /** Unstructured text search across server-configured fields. */
   search?: string
 }
 
-/**
- * Shape every list function returns.
- */
 export interface ListOutput<Row> {
   rows: Row[]
   /** Null when no more pages. */
@@ -60,12 +29,9 @@ export interface ListOutput<Row> {
 }
 
 /**
- * Leaf predicate value on a single field.
- *
- * Operator keywords (`equals`, `not`, `in`, `notIn`, `gt`, `gte`, `lt`,
- * `lte`, `contains`, `startsWith`, `endsWith`, `mode`) mirror Prisma's
- * vocabulary for dev familiarity. These keys are reserved and cannot be
- * used as user field names in a Filter's `F` type.
+ * Leaf predicate on a single field. The operator keywords mirror Prisma's
+ * vocabulary; they are reserved and cannot be used as user field names in a
+ * Filter's `F` type.
  */
 export type LeafValue<T> =
   | T
@@ -87,33 +53,17 @@ export type LeafValue<T> =
     }
 
 /**
- * A single-key object keyed by a field name from F, value is a leaf
- * predicate. Single-key so the runtime discriminator is unambiguous:
- * multi-key objects are OR groups.
+ * A single-key object keyed by a field of F. Single-key so the runtime
+ * discriminator is unambiguous — multi-key objects are OR groups.
  */
 export type LeafFilter<F extends Record<string, unknown>> = {
   [K in keyof F]: { [Key in K]: LeafValue<F[K]> }
 }[keyof F]
 
 /**
- * Recursive filter tree.
- *
- * - `Array<Filter<F>>` — AND of children.
- * - `{ [label: string]: Filter<F> }` — OR of children. Keys are arbitrary
- *   labels (unique strings), ignored at evaluation time.
- * - `LeafFilter<F>` — single-key predicate on a declared field.
- *
- * @example "status = pending AND (therapist = kim OR therapist = park) AND uploaded_at > 2026-04-10"
- * ```ts
- * const filter: Filter<{ status: string; therapistId: string; uploadedAt: string }> = [
- *   { status: 'pending' },
- *   {
- *     kim:  { therapistId: 'kim' },
- *     park: { therapistId: 'park' },
- *   },
- *   { uploadedAt: { gt: '2026-04-10' } },
- * ]
- * ```
+ * Recursive filter tree: an array is an AND of its children; an object is an
+ * OR of its children, keyed by arbitrary unique labels that are ignored at
+ * evaluation time; a single-key object is a leaf predicate.
  */
 export type Filter<F extends Record<string, unknown>> =
   | LeafFilter<F>

package/src/handle-error.ts

@@ -4,19 +4,6 @@ import { NotFoundError } from './errors/errors.js'
 import type { Logger } from './services/logger.js'
 import type { PikkuHTTP } from './wirings/http/http.types.js'
 
-/**
- * Handle errors that occur during route processing
- *
- * @param {any} e - The error that occurred
- * @param {PikkuHTTP | undefined} http - HTTP wire object
- * @param {string} traceId - Unique ID for tracking this error
- * @param {Logger} logger - Logger service
- * @param {number[]} logWarningsForStatusCodes - HTTP status codes to log as warnings
- * @param {boolean} respondWith404 - Whether to respond with 404 for NotFoundError
- * @param {boolean} bubbleError - Whether to throw the error after handling
- * @param {boolean} exposeErrors - Whether to include internal error details (message, stack and
- * payload of 5xx errors) in the response body. Ignored in production.
- */
 export const handleHTTPError = (
   e: any,
   http: PikkuHTTP | undefined,
@@ -27,18 +14,15 @@ export const handleHTTPError = (
   bubbleError: boolean,
   exposeErrors: boolean = false
 ) => {
-  // Skip 404 handling if configured to do so
   if (e instanceof NotFoundError && !respondWith404) {
     return
   }
 
-  // Get appropriate error response
   const errorResponse = getErrorResponse(e)
   if (errorResponse != null) {
     const clientFacing =
       errorResponse.status < 500 || (exposeErrors && !isProduction())
 
-    // Set status and response body
     http?.response?.status(errorResponse.status)
     http?.response?.json({
       name: e instanceof Error ? e.name : undefined,
@@ -53,7 +37,6 @@ export const handleHTTPError = (
       errorId: traceId,
     })
 
-    // Log certain status codes as warnings
     if (logWarningsForStatusCodes.includes(errorResponse.status)) {
       if (traceId) {
         logger.warn(`Warning id: ${traceId}`)
@@ -61,7 +44,6 @@ export const handleHTTPError = (
       logger.warn(e instanceof Error ? e.message : e)
     }
   } else {
-    // Handle unexpected errors
     logger.error(e instanceof Error ? e.message : e)
     http?.response?.status(500)
 

package/src/index.ts

@@ -10,8 +10,10 @@ export type {
   CorePikkuMiddlewareFactory,
   CorePikkuMiddlewareGroup,
   CoreServices,
+  CoreSecretlessSingletonServices,
   CoreSingletonServices,
   CoreUserSession,
+  SecretlessServices,
   CreateConfig,
   ServerLifecycle,
   FunctionMeta,
@@ -89,6 +91,13 @@ export {
   parseVersionedId,
 } from './version.js'
 export { runPikkuFunc } from './function/function-runner.js'
+export {
+  AbandonedError,
+  beginChanges,
+  getAbortScope,
+  runInAbortScope,
+  type AbortScope,
+} from './function/abort-scope.js'
 export { runCLICommand, pikkuCLIRender } from './wirings/cli/cli-runner.js'
 export { fetch } from './wirings/http/http-runner.js'
 export {
@@ -103,7 +112,49 @@ export type {
 } from './wirings/mcp/mcp.types.js'
 export { runQueueJob } from './wirings/queue/queue-runner.js'
 export { runScheduledTask } from './wirings/scheduler/scheduler-runner.js'
-export { NotFoundError } from './errors/errors.js'
+export {
+  AIProviderAuthError,
+  AIProviderNotConfiguredError,
+  BadGatewayError,
+  BadRequestError,
+  ConflictError,
+  ExpectationFailedError,
+  ForbiddenError,
+  GatewayTimeoutError,
+  GoneError,
+  HTTPVersionNotSupportedError,
+  InternalServerError,
+  InvalidMiddlewareWireError,
+  InvalidOriginError,
+  InvalidSessionError,
+  LengthRequiredError,
+  LocalEnvironmentOnlyError,
+  LockedError,
+  MaxComputeTimeReachedError,
+  MethodNotAllowedError,
+  MissingCredentialError,
+  MissingSchemaError,
+  MissingScopeError,
+  MissingServiceError,
+  MissingSessionError,
+  NotAcceptableError,
+  NotFoundError,
+  NotImplementedError,
+  PayloadTooLargeError,
+  PaymentRequiredError,
+  PikkuMissingMetaError,
+  PreconditionFailedError,
+  ProxyAuthenticationRequiredError,
+  RangeNotSatisfiableError,
+  ReadonlySessionError,
+  RequestTimeoutError,
+  ServiceUnavailableError,
+  TooManyRequestsError,
+  URITooLongError,
+  UnauthorizedError,
+  UnprocessableContentError,
+  UnsupportedMediaTypeError,
+} from './errors/errors.js'
 export { PikkuError, isExpectedError } from './errors/error-handler.js'
 export type { EventHubService } from './wirings/channel/eventhub-service.js'
 export type { QueueService } from './wirings/queue/queue.types.js'
@@ -118,6 +169,14 @@ export type {
   SendTextEmailInput,
 } from './services/email-service.js'
 export type { SecretService } from './services/secret-service.js'
+export {
+  SecretAccessDeniedError,
+  withoutSecrets,
+} from './services/secretless.js'
+export {
+  SecretHostNotAllowedError,
+  assertSecretAllowedForHost,
+} from './services/secret-host-binding.js'
 export type { VariablesService } from './services/variables-service.js'
 export type {
   ContentService,