@pikku/core 0.12.72 → 0.12.74

package/dist/handle-error.js

@@ -1,29 +1,13 @@
 import { isProduction } from './env.js';
 import { getErrorResponse } from './errors/error-handler.js';
 import { NotFoundError } from './errors/errors.js';
-/**
- * Handle errors that occur during route processing
- *
- * @param {any} e - The error that occurred
- * @param {PikkuHTTP | undefined} http - HTTP wire object
- * @param {string} traceId - Unique ID for tracking this error
- * @param {Logger} logger - Logger service
- * @param {number[]} logWarningsForStatusCodes - HTTP status codes to log as warnings
- * @param {boolean} respondWith404 - Whether to respond with 404 for NotFoundError
- * @param {boolean} bubbleError - Whether to throw the error after handling
- * @param {boolean} exposeErrors - Whether to include internal error details (message, stack and
- * payload of 5xx errors) in the response body. Ignored in production.
- */
 export const handleHTTPError = (e, http, traceId, logger, logWarningsForStatusCodes, respondWith404, bubbleError, exposeErrors = false) => {
-    // Skip 404 handling if configured to do so
     if (e instanceof NotFoundError && !respondWith404) {
         return;
     }
-    // Get appropriate error response
     const errorResponse = getErrorResponse(e);
     if (errorResponse != null) {
         const clientFacing = errorResponse.status < 500 || (exposeErrors && !isProduction());
-        // Set status and response body
         http?.response?.status(errorResponse.status);
         http?.response?.json({
             name: e instanceof Error ? e.name : undefined,
@@ -36,7 +20,6 @@ export const handleHTTPError = (e, http, traceId, logger, logWarningsForStatusCo
             payload: clientFacing ? e.payload : undefined,
             errorId: traceId,
         });
-        // Log certain status codes as warnings
         if (logWarningsForStatusCodes.includes(errorResponse.status)) {
             if (traceId) {
                 logger.warn(`Warning id: ${traceId}`);
@@ -45,7 +28,6 @@ export const handleHTTPError = (e, http, traceId, logger, logWarningsForStatusCo
         }
     }
     else {
-        // Handle unexpected errors
         logger.error(e instanceof Error ? e.message : e);
         http?.response?.status(500);
         if (traceId) {

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 /**
  * @module @pikku/core
  */
-export type { AuthInstance, CommonWireMeta, CoreConfig, CorePikkuMiddleware, CorePikkuMiddlewareConfig, CorePikkuMiddlewareFactory, CorePikkuMiddlewareGroup, CoreServices, CoreSingletonServices, CoreUserSession, CreateConfig, ServerLifecycle, FunctionMeta, FunctionRuntimeMeta, FunctionServicesMeta, FunctionWiresMeta, FunctionsMeta, FunctionsRuntimeMeta, JSONPrimitive, JSONValue, MakeRequired, MiddlewareMetadata, MiddlewarePriority, PermissionMetadata, PickOptional, PickRequired, PikkuAIMiddlewareHooks, PikkuWire, PikkuRawWire, PikkuWiringTypes, PostgresConfig, RequireAtLeastOne, SecurityAuditIssue, SecurityAuditReport, SecurityAuditSummary, SecurityAuditUpdate, SecuritySeverity, SecurityUpdateLevel, SerializedError, WireServices, } from './types/core.types.js';
+export type { AuthInstance, CommonWireMeta, CoreConfig, CorePikkuMiddleware, CorePikkuMiddlewareConfig, CorePikkuMiddlewareFactory, CorePikkuMiddlewareGroup, CoreServices, CoreSecretlessSingletonServices, CoreSingletonServices, CoreUserSession, SecretlessServices, CreateConfig, ServerLifecycle, FunctionMeta, FunctionRuntimeMeta, FunctionServicesMeta, FunctionWiresMeta, FunctionsMeta, FunctionsRuntimeMeta, JSONPrimitive, JSONValue, MakeRequired, MiddlewareMetadata, MiddlewarePriority, PermissionMetadata, PickOptional, PickRequired, PikkuAIMiddlewareHooks, PikkuWire, PikkuRawWire, PikkuWiringTypes, PostgresConfig, RequireAtLeastOne, SecurityAuditIssue, SecurityAuditReport, SecurityAuditSummary, SecurityAuditUpdate, SecuritySeverity, SecurityUpdateLevel, SerializedError, WireServices, } from './types/core.types.js';
 export { pikkuAIMiddleware, pikkuChannelMiddleware, pikkuChannelMiddlewareFactory, pikkuMiddleware, pikkuMiddlewareFactory, } from './types/core.types.js';
 export type { CorePikkuAuth, CorePikkuAuthConfig, CorePikkuFunction, CorePikkuFunctionConfig, CorePikkuFunctionHook, CorePikkuPermission, CorePikkuPermissionConfig, CorePikkuPermissionFactory, CorePikkuApprovalDescription, CorePermissionGroup, ZodLike, } from './function/functions.types.js';
 export { pikkuAuth, pikkuPermission, pikkuPermissionFactory, pikkuApprovalDescription, } from './function/functions.types.js';
@@ -12,19 +12,22 @@ export { getRelativeTimeOffsetFromNow, parseDurationString, } from './time-utils
 export type { RelativeTimeInput } from './time-utils.js';
 export { formatVersionedId, isVersionedId, parseVersionedId, } from './version.js';
 export { runPikkuFunc } from './function/function-runner.js';
+export { AbandonedError, beginChanges, getAbortScope, runInAbortScope, type AbortScope, } from './function/abort-scope.js';
 export { runCLICommand, pikkuCLIRender } from './wirings/cli/cli-runner.js';
 export { fetch } from './wirings/http/http-runner.js';
 export { runMCPTool, runMCPResource, runMCPPrompt, } from './wirings/mcp/mcp-runner.js';
 export type { MCPToolResponse, MCPResourceResponse, MCPPromptResponse, } from './wirings/mcp/mcp.types.js';
 export { runQueueJob } from './wirings/queue/queue-runner.js';
 export { runScheduledTask } from './wirings/scheduler/scheduler-runner.js';
-export { NotFoundError } from './errors/errors.js';
+export { AIProviderAuthError, AIProviderNotConfiguredError, BadGatewayError, BadRequestError, ConflictError, ExpectationFailedError, ForbiddenError, GatewayTimeoutError, GoneError, HTTPVersionNotSupportedError, InternalServerError, InvalidMiddlewareWireError, InvalidOriginError, InvalidSessionError, LengthRequiredError, LocalEnvironmentOnlyError, LockedError, MaxComputeTimeReachedError, MethodNotAllowedError, MissingCredentialError, MissingSchemaError, MissingScopeError, MissingServiceError, MissingSessionError, NotAcceptableError, NotFoundError, NotImplementedError, PayloadTooLargeError, PaymentRequiredError, PikkuMissingMetaError, PreconditionFailedError, ProxyAuthenticationRequiredError, RangeNotSatisfiableError, ReadonlySessionError, RequestTimeoutError, ServiceUnavailableError, TooManyRequestsError, URITooLongError, UnauthorizedError, UnprocessableContentError, UnsupportedMediaTypeError, } from './errors/errors.js';
 export { PikkuError, isExpectedError } from './errors/error-handler.js';
 export type { EventHubService } from './wirings/channel/eventhub-service.js';
 export type { QueueService } from './wirings/queue/queue.types.js';
 export type { JWTService } from './services/jwt-service.js';
 export type { EmailService, EmailTemplateReference, SendEmailInput, SendEmailResult, SendHTMLEmailInput, SendTemplateEmailInput, SendTextEmailInput, } from './services/email-service.js';
 export type { SecretService } from './services/secret-service.js';
+export { SecretAccessDeniedError, withoutSecrets, } from './services/secretless.js';
+export { SecretHostNotAllowedError, assertSecretAllowedForHost, } from './services/secret-host-binding.js';
 export type { VariablesService } from './services/variables-service.js';
 export type { ContentService, SignContentKeyArgs, SignURLArgs, GetUploadURLArgs, UploadURLResult, BucketKeyArgs, WriteFileArgs, CopyFileArgs, } from './services/content-service.js';
 export type { DeploymentService } from './services/deployment-service.js';

package/dist/index.js

@@ -5,13 +5,16 @@ export { PikkuRequest } from './pikku-request.js';
 export { getRelativeTimeOffsetFromNow, parseDurationString, } from './time-utils.js';
 export { formatVersionedId, isVersionedId, parseVersionedId, } from './version.js';
 export { runPikkuFunc } from './function/function-runner.js';
+export { AbandonedError, beginChanges, getAbortScope, runInAbortScope, } from './function/abort-scope.js';
 export { runCLICommand, pikkuCLIRender } from './wirings/cli/cli-runner.js';
 export { fetch } from './wirings/http/http-runner.js';
 export { runMCPTool, runMCPResource, runMCPPrompt, } from './wirings/mcp/mcp-runner.js';
 export { runQueueJob } from './wirings/queue/queue-runner.js';
 export { runScheduledTask } from './wirings/scheduler/scheduler-runner.js';
-export { NotFoundError } from './errors/errors.js';
+export { AIProviderAuthError, AIProviderNotConfiguredError, BadGatewayError, BadRequestError, ConflictError, ExpectationFailedError, ForbiddenError, GatewayTimeoutError, GoneError, HTTPVersionNotSupportedError, InternalServerError, InvalidMiddlewareWireError, InvalidOriginError, InvalidSessionError, LengthRequiredError, LocalEnvironmentOnlyError, LockedError, MaxComputeTimeReachedError, MethodNotAllowedError, MissingCredentialError, MissingSchemaError, MissingScopeError, MissingServiceError, MissingSessionError, NotAcceptableError, NotFoundError, NotImplementedError, PayloadTooLargeError, PaymentRequiredError, PikkuMissingMetaError, PreconditionFailedError, ProxyAuthenticationRequiredError, RangeNotSatisfiableError, ReadonlySessionError, RequestTimeoutError, ServiceUnavailableError, TooManyRequestsError, URITooLongError, UnauthorizedError, UnprocessableContentError, UnsupportedMediaTypeError, } from './errors/errors.js';
 export { PikkuError, isExpectedError } from './errors/error-handler.js';
+export { SecretAccessDeniedError, withoutSecrets, } from './services/secretless.js';
+export { SecretHostNotAllowedError, assertSecretAllowedForHost, } from './services/secret-host-binding.js';
 export { NoopAuditService, createInvocationAudit, resolveAuditActorFromWire, resolveAuditConfig, } from './services/audit-service.js';
 export { createGraph } from './wirings/workflow/graph/graph-node.js';
 export { wireAddon } from './wirings/rpc/wire-addon.js';

package/dist/middleware/auth-apikey.d.ts

@@ -1,25 +1,10 @@
-/**
- * API key middleware that retrieves a session from the 'x-api-key' header using JWT decoding.
- *
- * Extracts API key from either the 'x-api-key' header or 'apiKey' query parameter
- * and decodes it using the JWT service.
- *
- * @param options.source - Where to look for the API key: 'header', 'query', or 'all'
- *
- * @example
- * ```typescript
- * import { authAPIKey } from '@pikku/core/middleware'
- *
- * addHTTPMiddleware([
- *   authAPIKey({ source: 'header' })
- * ])
- * ```
- */
 export declare const authAPIKey: import("../types/core.types.js").CorePikkuMiddlewareFactory<{
     source: "header" | "query" | "all";
 }, import("../types/core.types.js").CoreSingletonServices<{
     logLevel?: import("../services/logger.js").LogLevel;
-    secrets?: {};
+    secrets?: {
+        requireAllowedHosts?: boolean;
+    };
     workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
     webhook?: import("../services/webhook-service.js").WebhookServiceConfig;
     postgres?: import("../types/core.types.js").PostgresConfig;

package/dist/middleware/auth-apikey.js

@@ -1,21 +1,4 @@
 import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js';
-/**
- * API key middleware that retrieves a session from the 'x-api-key' header using JWT decoding.
- *
- * Extracts API key from either the 'x-api-key' header or 'apiKey' query parameter
- * and decodes it using the JWT service.
- *
- * @param options.source - Where to look for the API key: 'header', 'query', or 'all'
- *
- * @example
- * ```typescript
- * import { authAPIKey } from '@pikku/core/middleware'
- *
- * addHTTPMiddleware([
- *   authAPIKey({ source: 'header' })
- * ])
- * ```
- */
 export const authAPIKey = pikkuMiddlewareFactory(({ source }) => pikkuMiddleware(async ({ jwt: jwtService }, { http, setSession, session }, next) => {
     if (!http?.request || !setSession || session) {
         return next();

package/dist/middleware/auth-bearer.d.ts

@@ -1,45 +1,8 @@
 import type { CoreUserSession } from '../types/core.types.js';
 /**
- * Bearer token middleware that extracts and validates tokens from the Authorization header.
- *
- * Supports three modes:
- * - JWT decoding (default): Decodes bearer tokens using the JWT service
- * - Static token: Provide a `token` object with a value and userSession for simple token validation
- * - Secret-resolved token: Provide a `token` object with a secretId — the expected
- *   value is resolved through the secrets service per request, so it works with any
- *   secret backend and the middleware is a no-op while the secret is unset
- *
- * @param options.token - Optional token configuration: { value, userSession } or { secretId, userSession }
- *
- * @example
- * ```typescript
- * import { authBearer } from '@pikku/core/middleware'
- *
- * // JWT mode (default)
- * addHTTPMiddleware('*', [
- *   authBearer()
- * ])
- *
- * // Static token mode
- * addHTTPMiddleware('*', [
- *   authBearer({
- *     token: {
- *       value: process.env.API_TOKEN,
- *       userSession: { userId: 'system', role: 'admin' }
- *     }
- *   })
- * ])
- *
- * // Secret-resolved token mode
- * addHTTPMiddleware('*', [
- *   authBearer({
- *     token: {
- *       secretId: 'PIKKU_CONSOLE_TOKEN',
- *       userSession: { userId: 'pikku-console-token' }
- *     }
- *   })
- * ])
- * ```
+ * Validates a bearer token: JWT-decoded by default, or compared in constant
+ * time against a static `value` or a `secretId` resolved through the secrets
+ * service per request.
  */
 export declare const authBearer: import("../types/core.types.js").CorePikkuMiddlewareFactory<{
     token?: {
@@ -51,7 +14,9 @@ export declare const authBearer: import("../types/core.types.js").CorePikkuMiddl
     };
 }, import("../types/core.types.js").CoreSingletonServices<{
     logLevel?: import("../services/logger.js").LogLevel;
-    secrets?: {};
+    secrets?: {
+        requireAllowedHosts?: boolean;
+    };
     workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
     webhook?: import("../services/webhook-service.js").WebhookServiceConfig;
     postgres?: import("../types/core.types.js").PostgresConfig;

package/dist/middleware/auth-bearer.js

@@ -10,46 +10,9 @@ const constantTimeEqual = (a, b) => {
     return result === 0;
 };
 /**
- * Bearer token middleware that extracts and validates tokens from the Authorization header.
- *
- * Supports three modes:
- * - JWT decoding (default): Decodes bearer tokens using the JWT service
- * - Static token: Provide a `token` object with a value and userSession for simple token validation
- * - Secret-resolved token: Provide a `token` object with a secretId — the expected
- *   value is resolved through the secrets service per request, so it works with any
- *   secret backend and the middleware is a no-op while the secret is unset
- *
- * @param options.token - Optional token configuration: { value, userSession } or { secretId, userSession }
- *
- * @example
- * ```typescript
- * import { authBearer } from '@pikku/core/middleware'
- *
- * // JWT mode (default)
- * addHTTPMiddleware('*', [
- *   authBearer()
- * ])
- *
- * // Static token mode
- * addHTTPMiddleware('*', [
- *   authBearer({
- *     token: {
- *       value: process.env.API_TOKEN,
- *       userSession: { userId: 'system', role: 'admin' }
- *     }
- *   })
- * ])
- *
- * // Secret-resolved token mode
- * addHTTPMiddleware('*', [
- *   authBearer({
- *     token: {
- *       secretId: 'PIKKU_CONSOLE_TOKEN',
- *       userSession: { userId: 'pikku-console-token' }
- *     }
- *   })
- * ])
- * ```
+ * Validates a bearer token: JWT-decoded by default, or compared in constant
+ * time against a static `value` or a `secretId` resolved through the secrets
+ * service per request.
  */
 export const authBearer = pikkuMiddlewareFactory(({ token } = {}) => pikkuMiddleware(async ({ jwt: jwtService, secrets }, { http, setSession, session }, next) => {
     if (!http?.request || !setSession || session) {

package/dist/middleware/auth-cookie.d.ts

@@ -1,32 +1,8 @@
 import type { SerializeOptions } from 'cookie';
 import type { RelativeTimeInput } from '../time-utils.js';
 /**
- * Cookie-based session middleware that uses JWT for encoding/decoding session data.
- *
- * Reads session from a cookie on incoming requests and automatically updates the cookie
- * when the session changes (e.g., after login).
- *
- * @param options.name - Cookie name
- * @param options.expiresIn - Cookie expiration time (e.g., { value: 30, unit: 'day' })
- * @param options.options - Cookie serialization options (httpOnly, secure, sameSite, etc.)
- *
- * @example
- * ```typescript
- * import { authCookie } from '@pikku/core/middleware'
- *
- * addHTTPMiddleware([
- *   authCookie({
- *     name: 'session',
- *     expiresIn: { value: 30, unit: 'day' },
- *     options: {
- *       httpOnly: true,
- *       secure: true,
- *       sameSite: 'strict',
- *       path: '/'
- *     }
- *   })
- * ])
- * ```
+ * Reads a JWT session from a cookie, and re-issues the cookie after the
+ * request whenever the session changed (e.g. after login).
  */
 export declare const authCookie: import("../types/core.types.js").CorePikkuMiddlewareFactory<{
     name: string;
@@ -34,7 +10,9 @@ export declare const authCookie: import("../types/core.types.js").CorePikkuMiddl
     expiresIn: RelativeTimeInput;
 }, import("../types/core.types.js").CoreSingletonServices<{
     logLevel?: import("../services/logger.js").LogLevel;
-    secrets?: {};
+    secrets?: {
+        requireAllowedHosts?: boolean;
+    };
     workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
     webhook?: import("../services/webhook-service.js").WebhookServiceConfig;
     postgres?: import("../types/core.types.js").PostgresConfig;

package/dist/middleware/auth-cookie.js

@@ -1,32 +1,8 @@
 import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js';
 import { getRelativeTimeOffsetFromNow } from '../time-utils.js';
 /**
- * Cookie-based session middleware that uses JWT for encoding/decoding session data.
- *
- * Reads session from a cookie on incoming requests and automatically updates the cookie
- * when the session changes (e.g., after login).
- *
- * @param options.name - Cookie name
- * @param options.expiresIn - Cookie expiration time (e.g., { value: 30, unit: 'day' })
- * @param options.options - Cookie serialization options (httpOnly, secure, sameSite, etc.)
- *
- * @example
- * ```typescript
- * import { authCookie } from '@pikku/core/middleware'
- *
- * addHTTPMiddleware([
- *   authCookie({
- *     name: 'session',
- *     expiresIn: { value: 30, unit: 'day' },
- *     options: {
- *       httpOnly: true,
- *       secure: true,
- *       sameSite: 'strict',
- *       path: '/'
- *     }
- *   })
- * ])
- * ```
+ * Reads a JWT session from a cookie, and re-issues the cookie after the
+ * request whenever the session changed (e.g. after login).
  */
 export const authCookie = pikkuMiddlewareFactory(({ name, options, expiresIn }) => {
     const mergedOptions = {

package/dist/middleware/cors.d.ts

@@ -1,47 +1,20 @@
 /**
- * CORS middleware that handles cross-origin requests including OPTIONS preflight.
- *
- * Sets appropriate CORS headers on all responses and short-circuits OPTIONS
- * preflight requests with a 204 No Content response.
- *
- * @param options.origin - Allowed origin(s). Use `'*'` for any origin, `true` to reflect the request origin, a string for a single origin, or an array for multiple origins. Defaults to `'*'`.
- * @param options.methods - Allowed HTTP methods. Defaults to common methods.
- * @param options.headers - Allowed request headers. Defaults to common headers.
- * @param options.credentials - Whether to allow credentials. Defaults to `false`.
- * @param options.maxAge - Preflight cache duration in seconds. Defaults to `86400` (24 hours).
- *
- * @example
- * ```typescript
- * import { cors } from '@pikku/core/middleware'
- *
- * // Allow all origins
- * addHTTPMiddleware('*', [cors()])
- *
- * // Specific origin with credentials
- * addHTTPMiddleware('*', [
- *   cors({
- *     origin: 'https://app.example.com',
- *     credentials: true,
- *   })
- * ])
- *
- * // Multiple origins
- * addHTTPMiddleware('*', [
- *   cors({
- *     origin: ['https://app.example.com', 'https://admin.example.com'],
- *   })
- * ])
- * ```
+ * Sets CORS headers on every response and short-circuits OPTIONS preflight
+ * with a 204. `origin: true` reflects the request origin; an array reflects a
+ * matching origin and otherwise falls back to its first entry.
  */
 export declare const cors: import("../types/core.types.js").CorePikkuMiddlewareFactory<{
     origin?: string | string[] | true;
     methods?: string[];
     headers?: string[];
+    exposeHeaders?: string[];
     credentials?: boolean;
     maxAge?: number;
 }, import("../types/core.types.js").CoreSingletonServices<{
     logLevel?: import("../services/logger.js").LogLevel;
-    secrets?: {};
+    secrets?: {
+        requireAllowedHosts?: boolean;
+    };
     workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
     webhook?: import("../services/webhook-service.js").WebhookServiceConfig;
     postgres?: import("../types/core.types.js").PostgresConfig;

package/dist/middleware/cors.js

@@ -1,40 +1,10 @@
 import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js';
 /**
- * CORS middleware that handles cross-origin requests including OPTIONS preflight.
- *
- * Sets appropriate CORS headers on all responses and short-circuits OPTIONS
- * preflight requests with a 204 No Content response.
- *
- * @param options.origin - Allowed origin(s). Use `'*'` for any origin, `true` to reflect the request origin, a string for a single origin, or an array for multiple origins. Defaults to `'*'`.
- * @param options.methods - Allowed HTTP methods. Defaults to common methods.
- * @param options.headers - Allowed request headers. Defaults to common headers.
- * @param options.credentials - Whether to allow credentials. Defaults to `false`.
- * @param options.maxAge - Preflight cache duration in seconds. Defaults to `86400` (24 hours).
- *
- * @example
- * ```typescript
- * import { cors } from '@pikku/core/middleware'
- *
- * // Allow all origins
- * addHTTPMiddleware('*', [cors()])
- *
- * // Specific origin with credentials
- * addHTTPMiddleware('*', [
- *   cors({
- *     origin: 'https://app.example.com',
- *     credentials: true,
- *   })
- * ])
- *
- * // Multiple origins
- * addHTTPMiddleware('*', [
- *   cors({
- *     origin: ['https://app.example.com', 'https://admin.example.com'],
- *   })
- * ])
- * ```
+ * Sets CORS headers on every response and short-circuits OPTIONS preflight
+ * with a 204. `origin: true` reflects the request origin; an array reflects a
+ * matching origin and otherwise falls back to its first entry.
  */
-export const cors = pikkuMiddlewareFactory(({ origin = '*', methods = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'], headers = ['Content-Type', 'Authorization', 'x-api-key'], credentials = false, maxAge = 86400, } = {}) => {
+export const cors = pikkuMiddlewareFactory(({ origin = '*', methods = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'], headers = ['Content-Type', 'Authorization', 'x-api-key'], exposeHeaders = [], credentials = false, maxAge = 86400, } = {}) => {
     if (origin === '*' && credentials) {
         throw new Error('CORS misconfiguration: wildcard origin (*) cannot be used with credentials: true');
     }
@@ -64,6 +34,9 @@ export const cors = pikkuMiddlewareFactory(({ origin = '*', methods = ['GET', 'P
             response.header('Access-Control-Allow-Origin', allowedOrigin);
             response.header('Access-Control-Allow-Methods', methods.join(', '));
             response.header('Access-Control-Allow-Headers', headers.join(', '));
+            if (exposeHeaders.length > 0) {
+                response.header('Access-Control-Expose-Headers', exposeHeaders.join(', '));
+            }
             if (credentials) {
                 response.header('Access-Control-Allow-Credentials', 'true');
             }

package/dist/middleware/remote-auth.d.ts

@@ -1,6 +1,8 @@
 export declare const pikkuRemoteAuthMiddleware: import("../types/core.types.js").CorePikkuMiddleware<import("../types/core.types.js").CoreSingletonServices<{
     logLevel?: import("../services/logger.js").LogLevel;
-    secrets?: {};
+    secrets?: {
+        requireAllowedHosts?: boolean;
+    };
     workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
     webhook?: import("../services/webhook-service.js").WebhookServiceConfig;
     postgres?: import("../types/core.types.js").PostgresConfig;

package/dist/middleware/remote-auth.js

@@ -1,6 +1,6 @@
 import { UnauthorizedError } from '../errors/errors.js';
 import { pikkuMiddleware } from '../types/core.types.js';
-import { decryptJSON } from '../crypto-utils.js';
+import { assertStrongKeyMaterial, decryptWithKeyMaterial, REMOTE_SESSION_INFO, } from '../crypto-utils.js';
 export const pikkuRemoteAuthMiddleware = pikkuMiddleware(async ({ secrets, jwt }, { http, setSession }, next) => {
     if (!http?.request || !secrets) {
         return next();
@@ -15,6 +15,7 @@ export const pikkuRemoteAuthMiddleware = pikkuMiddleware(async ({ secrets, jwt }
         }
         return next();
     }
+    assertStrongKeyMaterial('PIKKU_REMOTE_SECRET', secret);
     if (!jwt) {
         throw new Error('PIKKU_REMOTE_SECRET set but JWT service missing');
     }
@@ -45,7 +46,7 @@ export const pikkuRemoteAuthMiddleware = pikkuMiddleware(async ({ secrets, jwt }
     }
     if (payload?.session) {
         try {
-            const decrypted = await decryptJSON(secret, payload.session);
+            const decrypted = await decryptWithKeyMaterial('PIKKU_REMOTE_SECRET', secret, REMOTE_SESSION_INFO, payload.session);
             if (decrypted?.session && setSession) {
                 await setSession(decrypted.session);
             }

package/dist/middleware/telemetry.d.ts

@@ -1,50 +1,25 @@
-/**
- * Outer telemetry middleware that captures total request duration and outcome.
- * Runs at `highest` priority (outermost in the middleware chain).
- *
- * Emits a structured JSON log entry with `__pikku_telemetry: 'end'` containing:
- * - Total duration (including all middleware)
- * - Outcome (ok/error)
- * - Wire metadata (wireType, wireId, traceId)
- * - HTTP details (method, path, status) if applicable
- *
- * @example
- * ```typescript
- * import { telemetryOuter } from '@pikku/core/middleware'
- * addTagMiddleware('myTag', [telemetryOuter()])
- * ```
- */
+/** Outermost telemetry: total duration, including every middleware. */
 export declare const telemetryOuter: import("../types/core.types.js").CorePikkuMiddlewareFactory<void | {
     environmentId?: string;
     orgId?: string;
 }, import("../types/core.types.js").CoreSingletonServices<{
     logLevel?: import("../services/logger.js").LogLevel;
-    secrets?: {};
+    secrets?: {
+        requireAllowedHosts?: boolean;
+    };
     workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
     webhook?: import("../services/webhook-service.js").WebhookServiceConfig;
     postgres?: import("../types/core.types.js").PostgresConfig;
 }>, import("../types/core.types.js").CoreUserSession>;
-/**
- * Inner telemetry middleware that captures function execution duration and user context.
- * Runs at `lowest` priority (innermost, closest to the function).
- *
- * Emits a structured JSON log entry with `__pikku_telemetry: 'end'` containing:
- * - Function-only duration (excluding outer middleware like auth)
- * - User identity (pikkuUserId) if authenticated
- * - Wire metadata (wireType, wireId, traceId)
- *
- * @example
- * ```typescript
- * import { telemetryInner } from '@pikku/core/middleware'
- * addTagMiddleware('myTag', [telemetryInner()])
- * ```
- */
+/** Innermost telemetry: function-only duration, excluding outer middleware. */
 export declare const telemetryInner: import("../types/core.types.js").CorePikkuMiddlewareFactory<void | {
     environmentId?: string;
     orgId?: string;
 }, import("../types/core.types.js").CoreSingletonServices<{
     logLevel?: import("../services/logger.js").LogLevel;
-    secrets?: {};
+    secrets?: {
+        requireAllowedHosts?: boolean;
+    };
     workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
     webhook?: import("../services/webhook-service.js").WebhookServiceConfig;
     postgres?: import("../types/core.types.js").PostgresConfig;

package/dist/middleware/telemetry.js

@@ -1,20 +1,5 @@
 import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js';
-/**
- * Outer telemetry middleware that captures total request duration and outcome.
- * Runs at `highest` priority (outermost in the middleware chain).
- *
- * Emits a structured JSON log entry with `__pikku_telemetry: 'end'` containing:
- * - Total duration (including all middleware)
- * - Outcome (ok/error)
- * - Wire metadata (wireType, wireId, traceId)
- * - HTTP details (method, path, status) if applicable
- *
- * @example
- * ```typescript
- * import { telemetryOuter } from '@pikku/core/middleware'
- * addTagMiddleware('myTag', [telemetryOuter()])
- * ```
- */
+/** Outermost telemetry: total duration, including every middleware. */
 export const telemetryOuter = pikkuMiddlewareFactory(({ environmentId, orgId } = {}) => {
     return pikkuMiddleware({
         name: 'telemetry-outer',
@@ -55,21 +40,7 @@ export const telemetryOuter = pikkuMiddlewareFactory(({ environmentId, orgId } =
         },
     });
 });
-/**
- * Inner telemetry middleware that captures function execution duration and user context.
- * Runs at `lowest` priority (innermost, closest to the function).
- *
- * Emits a structured JSON log entry with `__pikku_telemetry: 'end'` containing:
- * - Function-only duration (excluding outer middleware like auth)
- * - User identity (pikkuUserId) if authenticated
- * - Wire metadata (wireType, wireId, traceId)
- *
- * @example
- * ```typescript
- * import { telemetryInner } from '@pikku/core/middleware'
- * addTagMiddleware('myTag', [telemetryInner()])
- * ```
- */
+/** Innermost telemetry: function-only duration, excluding outer middleware. */
 export const telemetryInner = pikkuMiddlewareFactory(({ environmentId, orgId } = {}) => {
     return pikkuMiddleware({
         name: 'telemetry-inner',