@pikku/core 0.12.72 → 0.12.77

package/src/production-barrels-stay-lean.test.ts

@@ -0,0 +1,110 @@
+import { describe, test } from 'node:test'
+import assert from 'node:assert/strict'
+import { existsSync, readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { join, dirname, resolve, relative } from 'node:path'
+
+const srcRoot = dirname(fileURLToPath(import.meta.url))
+
+/**
+ * Statements that only move types. TypeScript erases them, so they cost a
+ * production bundle nothing and are deliberately not followed.
+ */
+const TYPE_ONLY = /^\s*(?:import|export)\s+type\b/
+
+/**
+ * The modules a production server must never load by importing a barrel.
+ *
+ * Each is scenario or virtual-user runtime: `http-personas` signs personas in
+ * and reaches the actor-flow conversation runner, which reaches the agent
+ * runner. None of it runs in production, and an unbundled Node or Lambda deploy
+ * does no tree-shaking — it loads whatever the graph names.
+ */
+const FORBIDDEN = [
+  'services/http-personas.ts',
+  'wirings/actor-flow/run-conversation.ts',
+  'wirings/workflow/pikku-scenario-service.ts',
+]
+
+const resolveSpecifier = (fromFile: string, specifier: string) => {
+  const base = resolve(dirname(fromFile), specifier.replace(/\.js$/, ''))
+  for (const candidate of [`${base}.ts`, join(base, 'index.ts')]) {
+    if (existsSync(candidate)) return candidate
+  }
+  return undefined
+}
+
+/**
+ * Every module loaded as a side effect of importing `entry`, following value
+ * imports only.
+ *
+ * A dynamic `await import(...)` is not followed: it does not run at module
+ * init, which is the whole reason `pikku-scenario-service` reaches
+ * `http-personas` that way.
+ */
+const runtimeGraph = (entry: string): Set<string> => {
+  const seen = new Set<string>()
+  const queue = [entry]
+
+  while (queue.length) {
+    const file = queue.pop()!
+    if (seen.has(file)) continue
+    seen.add(file)
+
+    for (const line of readFileSync(file, 'utf-8').split('\n')) {
+      if (TYPE_ONLY.test(line)) continue
+      const specifier = line.match(/\bfrom\s+'(\.[^']+)'/)?.[1]
+      if (!specifier) continue
+      const target = resolveSpecifier(file, specifier)
+      if (target) queue.push(target)
+    }
+  }
+
+  return seen
+}
+
+describe('production barrels stay lean', () => {
+  for (const barrel of ['services/index.ts', 'wirings/workflow/index.ts']) {
+    test(`@pikku/core ${barrel} does not load scenario runtime`, () => {
+      const reached = runtimeGraph(join(srcRoot, barrel))
+      const offenders = FORBIDDEN.filter((module) =>
+        reached.has(join(srcRoot, module))
+      )
+
+      assert.deepEqual(
+        offenders,
+        [],
+        `${barrel} pulls scenario runtime into every app that imports it:\n` +
+          `${offenders.join('\n')}\n` +
+          `Export the value from '@pikku/core/persona' instead — types may stay here.`
+      )
+    })
+  }
+
+  test('the persona entry point still exports the runtime that moved', async () => {
+    const persona = await import('./wirings/persona/index.js')
+
+    for (const name of [
+      'createHttpPersonas',
+      'HttpPersona',
+      'postScenarioJson',
+      'readScenarioHttpResponse',
+    ]) {
+      assert.ok(
+        name in persona,
+        `@pikku/core/persona no longer exports ${name}; it has to live somewhere`
+      )
+    }
+  })
+
+  test('the graph walker actually reaches things', () => {
+    // Guards the test above: a walker that silently resolved nothing would pass
+    // no matter what the barrels imported.
+    const reached = runtimeGraph(join(srcRoot, 'wirings/persona/index.ts'))
+    assert.ok(
+      reached.has(join(srcRoot, 'services/http-personas.ts')),
+      `walker failed to reach a known value import; reached ${reached.size} files:\n` +
+        [...reached].map((f) => relative(srcRoot, f)).join('\n')
+    )
+  })
+})

package/src/remote.test.ts

@@ -0,0 +1,173 @@
+import { describe, test, beforeEach } from 'node:test'
+import assert from 'node:assert'
+import { buildRemoteHeaders } from './remote.js'
+import { pikkuRemoteAuthMiddleware } from './middleware/remote-auth.js'
+import { resetPikkuState } from './pikku-state.js'
+import { WeakKeyMaterialError } from './errors/errors.js'
+import { createSecretValue } from './secret-value.js'
+
+beforeEach(() => {
+  resetPikkuState()
+})
+
+const STRONG_SECRET = 'a'.repeat(43)
+const WEAK_SECRET = 'dev-remote-secret'
+
+const createSecrets = (secret: string) => ({
+  getSecret: async (key: string) => {
+    if (key === 'PIKKU_REMOTE_SECRET') return createSecretValue(secret)
+    throw new Error(`Secret ${key} not found`)
+  },
+})
+
+/**
+ * Signing is deliberately free here so the measurement isolates key derivation.
+ */
+const createJWT = () => ({
+  encode: async (_expiresIn: unknown, payload: unknown) =>
+    Buffer.from(JSON.stringify(payload)).toString('base64url'),
+  decode: async (token: string) =>
+    JSON.parse(Buffer.from(token, 'base64url').toString('utf-8')),
+})
+
+const createRequest = (
+  headers: Record<string, string>,
+  path = '/remote/rpc/myFunc'
+) => ({
+  header: (name: string) => headers[name.toLowerCase()] || headers[name],
+  path: () => path,
+  method: () => 'POST',
+})
+
+const roundTrip = async (secret: string, session: unknown) => {
+  const jwt = createJWT()
+  const secrets = createSecrets(secret)
+
+  const headers = await buildRemoteHeaders(
+    jwt as any,
+    secrets as any,
+    'myFunc',
+    session
+  )
+
+  let received: unknown
+  await pikkuRemoteAuthMiddleware(
+    { secrets, jwt } as any,
+    {
+      http: {
+        request: createRequest({ authorization: headers.authorization! }),
+      },
+      setSession: async (s: unknown) => {
+        received = s
+      },
+    } as any,
+    async () => {}
+  )
+  return received
+}
+
+describe('remote RPC session round trip', () => {
+  test('round-trips the session through header build and middleware verify', async () => {
+    const session = { userId: 'user-1', role: 'admin' }
+    assert.deepStrictEqual(await roundTrip(STRONG_SECRET, session), session)
+  })
+
+  test('a header built with one secret is rejected by a peer holding another', async () => {
+    const jwt = createJWT()
+    const headers = await buildRemoteHeaders(
+      jwt as any,
+      createSecrets(STRONG_SECRET) as any,
+      'myFunc',
+      { userId: 'user-1' }
+    )
+
+    await assert.rejects(() =>
+      pikkuRemoteAuthMiddleware(
+        { secrets: createSecrets('b'.repeat(43)), jwt } as any,
+        {
+          http: {
+            request: createRequest({ authorization: headers.authorization! }),
+          },
+          setSession: async () => {},
+        } as any,
+        async () => {}
+      )
+    )
+  })
+
+  test('a full round trip stays under the per-hop latency budget', async () => {
+    const session = { userId: 'user-1', role: 'admin' }
+
+    // Warm up so the measurement excludes module/JIT startup.
+    await roundTrip(STRONG_SECRET, session)
+
+    const iterations = 5
+    const start = performance.now()
+    for (let i = 0; i < iterations; i++) {
+      await roundTrip(STRONG_SECRET, session)
+    }
+    const perRoundTrip = (performance.now() - start) / iterations
+
+    assert.ok(
+      perRoundTrip < 20,
+      `remote RPC round trip took ${perRoundTrip.toFixed(1)}ms, budget is 20ms`
+    )
+  })
+})
+
+describe('PIKKU_REMOTE_SECRET strength', () => {
+  test('buildRemoteHeaders rejects a secret shorter than 32 characters', async () => {
+    await assert.rejects(
+      () =>
+        buildRemoteHeaders(
+          createJWT() as any,
+          createSecrets(WEAK_SECRET) as any,
+          'myFunc',
+          { userId: 'user-1' }
+        ),
+      (err: unknown) => err instanceof WeakKeyMaterialError
+    )
+  })
+
+  test('buildRemoteHeaders rejects a weak secret even with no session to encrypt', async () => {
+    await assert.rejects(
+      () =>
+        buildRemoteHeaders(
+          createJWT() as any,
+          createSecrets(WEAK_SECRET) as any,
+          'myFunc'
+        ),
+      (err: unknown) => err instanceof WeakKeyMaterialError
+    )
+  })
+
+  test('the middleware rejects a weak secret rather than authenticating with it', async () => {
+    const jwt = createJWT()
+    const headers = await buildRemoteHeaders(
+      jwt as any,
+      createSecrets(STRONG_SECRET) as any,
+      'myFunc',
+      { userId: 'user-1' }
+    )
+
+    await assert.rejects(
+      () =>
+        pikkuRemoteAuthMiddleware(
+          { secrets: createSecrets(WEAK_SECRET), jwt } as any,
+          {
+            http: {
+              request: createRequest({ authorization: headers.authorization! }),
+            },
+            setSession: async () => {},
+          } as any,
+          async () => {}
+        ),
+      (err: unknown) => err instanceof WeakKeyMaterialError
+    )
+  })
+
+  test('a secret of exactly 32 characters is accepted', async () => {
+    const session = { userId: 'user-1' }
+    assert.deepStrictEqual(await roundTrip('x'.repeat(32), session), session)
+  })
+})

package/src/remote.ts

@@ -1,13 +1,15 @@
 import type { JWTService } from './services/jwt-service.js'
 import type { SecretService } from './services/secret-service.js'
-import { encryptJSON } from './crypto-utils.js'
+import {
+  assertStrongKeyMaterial,
+  encryptWithKeyMaterial,
+  REMOTE_SESSION_INFO,
+} from './crypto-utils.js'
 
 /**
- * Build Authorization headers with JWT-signed session and traceId for
- * pikkuRemoteAuthMiddleware on the receiving end.
- *
- * Used by all deployment services (Kysely, Redis, MongoDB, Lambda, CF, Azure)
- * regardless of transport (HTTP, Lambda Invoke, service bindings).
+ * Authorization headers carrying a JWT-signed session and traceId for
+ * `pikkuRemoteAuthMiddleware` on the receiving end. Used by every deployment
+ * service regardless of transport (HTTP, Lambda Invoke, service bindings).
  */
 export async function buildRemoteHeaders(
   jwt: JWTService | undefined,
@@ -23,12 +25,20 @@ export async function buildRemoteHeaders(
 
   let secret: string | undefined
   try {
-    secret = await secrets?.getSecret('PIKKU_REMOTE_SECRET')
+    secret = (await secrets?.getSecret('PIKKU_REMOTE_SECRET'))?.reveal()
   } catch {}
 
   if (secret && jwt) {
+    assertStrongKeyMaterial('PIKKU_REMOTE_SECRET', secret)
     const sessionEnc = session
-      ? await encryptJSON(secret, { session })
+      ? await encryptWithKeyMaterial(
+          'PIKKU_REMOTE_SECRET',
+          secret,
+          REMOTE_SESSION_INFO,
+          {
+            session,
+          }
+        )
       : undefined
     const token = await jwt.encode(
       { value: 5, unit: 'minute' },

package/src/schema.ts

@@ -9,13 +9,6 @@ import { pikkuState, getAllPackageStates } from './pikku-state.js'
 const schemaKey = (name: string, packageName: string | null): string =>
   packageName ? `${packageName}:${name}` : name
 
-/**
- * Adds a schema to the schemas map for a specific package.
- * @param name - The name of the schema.
- * @param value - The schema value.
- * @param packageName - The package name (null for main package, '@scope/package' for addon packages).
- * @ignore
- */
 export const addSchema = (
   name: string,
   value: any,
@@ -25,13 +18,6 @@ export const addSchema = (
   pikkuState(packageName, 'misc', 'schemas').set(name, schema)
 }
 
-/**
- * Retrieves a schema from the schemas map for a specific package.
- * @param name - The name of the schema.
- * @param packageName - The package name (null for main package, '@scope/package' for addon packages).
- * @returns The schema value or undefined if not found.
- * @ignore
- */
 export const getSchema = (
   name: string,
   packageName: string | null = null
@@ -39,10 +25,6 @@ export const getSchema = (
   return pikkuState(packageName, 'misc', 'schemas').get(name)
 }
 
-/**
- * Loads a schema and compiles it into a validator.
- * @param logger - A logger for logging information.
- */
 export const compileAllSchemas = (
   logger: Logger,
   schemaService?: SchemaService
@@ -95,27 +77,11 @@ const validateAllSchemasLoaded = (
 }
 
 /**
- * Fill in absent top-level properties from their schema `default`.
- *
- * A `default` reaches the generated JSON Schema and keeps the property out of
- * `required`, so omitting it validates — but nothing was ever filling it in.
- * JSON Schema validators are pure by specification and none of the ones Pikku
- * ships with (`@cfworker/json-schema`, and Ajv unless `useDefaults` is set)
- * annotate the instance, so the function received `undefined` for a property
- * its generated type declares as present. That is the worst shape a mismatch
- * can take: validation permits the omission, the type says the value is there,
- * and the body reads `undefined`.
- *
- * Applied unconditionally rather than alongside `coerceTopLevelDataFromSchema`,
- * whose `coerceDataFromSchema` flag is about decoding transport-encoded values
- * (a query string's `"1,2"` into an array). Defaults are a property of the
- * schema, not of how the call arrived, so gating them on that flag would apply
- * them over HTTP and skip them on a direct RPC invocation.
- *
- * Returns the data to use, which is a new object only when defaults had to be
- * added to a nullish input — a call made with no arguments at all still gets
- * them. Values are cloned so an object or array default (`[]`, `{}`) is never
- * shared as one mutable instance across every request.
+ * Fills in absent top-level properties from their schema `default`. Applied
+ * unconditionally: a default belongs to the schema, not to the transport the
+ * call arrived on, and runs before coercion so a defaulted and a supplied
+ * value are treated identically from here on. Values are cloned so an object
+ * or array default is never shared as one mutable instance across requests.
  */
 export const applyDefaultsFromSchema = (
   schemaName: string,

package/src/scopes.ts

@@ -5,13 +5,9 @@ const SEPARATOR = ':'
 const WILDCARD = '*'
 
 /**
- * Builds every grant that would satisfy `scope`: the scope itself, a wildcard
+ * Every grant that would satisfy `scope`: the scope itself, a wildcard
  * directly beneath it, a wildcard at each ancestor level, and each plain
- * ancestor id — holding a parent scope grants everything nested beneath it.
- *
- * For `admin:invoices:create` that is:
- *   admin:invoices:create, admin:invoices:create:*, *, admin:*, admin:invoices:*,
- *   admin, admin:invoices
+ * ancestor id.
  */
 const satisfyingGrants = (scope: string): string[] => {
   const segments = scope.split(SEPARATOR)
@@ -25,28 +21,10 @@ const satisfyingGrants = (scope: string): string[] => {
   return grants
 }
 
-/**
- * Checks whether `held` satisfies a single required scope.
- *
- * A grant satisfies a requirement when it is the scope itself, a plain ancestor
- * (`admin` covers `admin:invoices:create`), a wildcard at or above it (`admin:*`
- * covers `admin` and `admin:invoices:create`), or the bare `*`. A narrower grant
- * never satisfies a broader requirement — `admin:invoices` does not grant
- * `admin`.
- */
 const holds = (held: ReadonlySet<string>, scope: string): boolean =>
   satisfyingGrants(scope).some((grant) => held.has(grant))
 
-/**
- * The first required scope a set of held grants does not satisfy, or `null`
- * when every one is satisfied.
- *
- * Scopes are an AND gate: every entry in `required` must be satisfied. This is
- * deliberately distinct from `permissions`, which OR together — a scope can
- * only ever narrow access, so adding one to a function can never widen it.
- *
- * Fails closed: an absent `held` satisfies nothing.
- */
+/** The first required scope `held` does not satisfy, or `null`. Fails closed. */
 const firstUnsatisfied = (
   required: readonly string[] | undefined,
   held: Iterable<string> | undefined
@@ -65,17 +43,8 @@ const firstUnsatisfied = (
 }
 
 /**
- * Whether a set of held grants satisfies every required scope.
- *
  * The non-throwing counterpart to {@link verifyScopes}, for deciding rather
- * than enforcing — an authorization gate that falls back to another check when
- * it is not satisfied, rather than rejecting the request outright.
- *
- * Fails closed: an absent or empty `held` satisfies nothing. An empty
- * `required` is satisfied by anything.
- *
- * @param required - Scopes to check for. Empty means no gate.
- * @param held - The grants held, e.g. `session.scopes`. May be undefined.
+ * than enforcing. Fails closed; an empty `required` is satisfied by anything.
  */
 export const hasScopes = (
   required: readonly string[] | undefined,
@@ -83,19 +52,9 @@ export const hasScopes = (
 ): boolean => firstUnsatisfied(required, held) === null
 
 /**
- * Verifies that a session holds every required scope, throwing on the first
- * one it does not.
- *
- * Scopes are an AND gate: every entry in `required` must be satisfied. This is
- * deliberately distinct from `permissions`, which OR together — a scope can
- * only ever narrow access, so adding one to a function can never widen it.
- *
- * Fails closed: a session without a `scopes` field, or no session at all,
- * satisfies nothing.
- *
- * @param required - Scopes the function declares. Empty means no gate.
- * @param session - The session to check. May be undefined.
- * @throws {MissingScopeError} Naming the first unsatisfied scope.
+ * Throws {@link MissingScopeError} naming the first scope the session does not
+ * hold. Fails closed: no session, or a session without `scopes`, satisfies
+ * nothing.
  */
 export const verifyScopes = (
   required: readonly string[] | undefined,

package/src/secret-value.test.ts

@@ -0,0 +1,204 @@
+import { describe, test } from 'node:test'
+import assert from 'node:assert/strict'
+import {
+  createSecretValue,
+  isSecretValue,
+  REDACTED,
+  SecretCoercionError,
+  type Safe,
+  type SecretValue,
+} from './secret-value.js'
+import type { Logger } from './services/logger.js'
+import type { AuditLog } from './services/audit-service.js'
+
+const VALUE = 'sk-live-DEADBEEF'
+
+describe('SecretValue', () => {
+  test('reveals the value', () => {
+    assert.equal(createSecretValue(VALUE).reveal(), VALUE)
+  })
+
+  test('unwraps object secrets whole', () => {
+    const creds = createSecretValue({ apiKey: 'k', apiSecret: 's' })
+    assert.deepEqual(creds.reveal(), { apiKey: 'k', apiSecret: 's' })
+  })
+
+  test('is recognisable at runtime', () => {
+    assert.equal(isSecretValue(createSecretValue(VALUE)), true)
+    assert.equal(
+      isSecretValue(() => VALUE),
+      false
+    )
+    assert.equal(isSecretValue(VALUE), false)
+    assert.equal(isSecretValue(undefined), false)
+  })
+})
+
+describe('structured serialization redacts', () => {
+  test('JSON.stringify renders [secret] rather than dropping the key', () => {
+    const event = {
+      type: 'fn.call',
+      input: { user: 'ada', token: createSecretValue(VALUE) },
+    }
+    assert.equal(
+      JSON.stringify(event),
+      '{"type":"fn.call","input":{"user":"ada","token":"[secret]"}}'
+    )
+  })
+
+  test('a bare secret serializes to [secret]', () => {
+    assert.equal(JSON.stringify(createSecretValue(VALUE)), `"${REDACTED}"`)
+  })
+
+  test('node inspect renders [secret]', () => {
+    const inspect = Symbol.for('nodejs.util.inspect.custom')
+    const secret = createSecretValue(VALUE) as unknown as Record<
+      symbol,
+      () => string
+    >
+    assert.equal(secret[inspect]!(), REDACTED)
+  })
+
+  test('structuredClone carries no secret material across the boundary', () => {
+    // The value lives in a private field, so a clone is an empty object rather
+    // than a copy — it crosses a worker or postMessage boundary carrying nothing.
+    const clone = structuredClone({ token: createSecretValue(VALUE) })
+    assert.equal(JSON.stringify(clone), '{"token":{}}')
+    assert.equal(Object.keys(clone.token).length, 0)
+  })
+})
+
+describe('string coercion throws', () => {
+  const secret = createSecretValue(VALUE)
+
+  test('template literal', () => {
+    assert.throws(() => `Bearer ${secret}`, SecretCoercionError)
+  })
+
+  test('concatenation', () => {
+    assert.throws(() => ('Bearer ' + secret) as string, SecretCoercionError)
+  })
+
+  test('String()', () => {
+    assert.throws(() => String(secret), SecretCoercionError)
+  })
+
+  test('explicit toString()', () => {
+    assert.throws(
+      () => (secret as unknown as { toString(): string }).toString(),
+      SecretCoercionError
+    )
+  })
+
+  test('the thrown error never contains the secret', () => {
+    try {
+      String(secret)
+      assert.fail('expected a throw')
+    } catch (error) {
+      assert.equal((error as Error).message.includes(VALUE), false)
+    }
+  })
+})
+
+// ── Type-level assertions ────────────────────────────────────────────────────
+// The point of the exercise: these fail `yarn tsc`, not `yarn test`. Held in a
+// function that is never called so the runtime never evaluates them.
+//
+// `tsconfig.json` excludes `**/*.test.ts`, so this file is only reached through
+// `tsconfig.type-tests.json`, which lists it under `files` — `exclude` filters
+// `include` but not `files`. Both run from this package's `tsc` script. Without
+// that second pass the assertions below type-check nothing at all.
+
+const _typeAssertions = (
+  secret: SecretValue<string>,
+  creds: SecretValue<{ token: string }>,
+  anything: any,
+  sink: <T>(value: Safe<T>) => void,
+  secretPromise: Promise<SecretValue<string>>,
+  secretMap: Map<string, SecretValue<string>>,
+  secretSet: Set<SecretValue<string>>
+) => {
+  // Nominal: not assignable to what it wraps.
+  // @ts-expect-error a secret is not a string
+  const _notAString: string = secret
+  void _notAString
+
+  // Unwrapping composes with plain types, so call sites need no cast.
+  const _unwrapped: string = secret.reveal()
+  const _unwrappedField: string = creds.reveal().token
+  void _unwrapped
+  void _unwrappedField
+
+  // @ts-expect-error a secret cannot reach a guarded sink
+  sink(secret)
+  // @ts-expect-error nor nested inside an object
+  sink({ config: { token: secret } })
+  // @ts-expect-error nor inside an array
+  sink([secret])
+  // @ts-expect-error nor as one branch of a union
+  sink(true ? secret : 'plain')
+
+  // Unwrapped values pass — disclosure is deliberate and visible.
+  sink(secret.reveal())
+  sink({ config: { token: secret.reveal() } })
+
+  // Ordinary values must not trip the guard.
+  sink('plain')
+  sink(42)
+  sink(null)
+  sink(undefined)
+  sink({ nested: { deep: [1, 2, 3] } })
+  sink(() => 'an ordinary function')
+  sink(new Date())
+  sink(new Error('boom'))
+  sink(Buffer.from('bytes'))
+  sink(new Map([['k', 'v']]))
+  sink([{ a: 1 }, { a: 2 }])
+
+  // A container is not a hiding place: a mapped type cannot reach what a
+  // `Promise`, `Map` or `Set` holds, so `Safe` recurses into them explicitly.
+  // @ts-expect-error nor awaiting later — `getSecret()` returns exactly this
+  sink(secretPromise)
+  // @ts-expect-error nor as a map value
+  sink(secretMap)
+  // @ts-expect-error nor as a set member
+  sink(secretSet)
+
+  // The same containers holding ordinary values must still pass.
+  sink(Promise.resolve('plain'))
+  sink(new Map([['k', 'v']]))
+  sink(new Set(['plain']))
+
+  // `any` cannot be guarded and must stay usable rather than collapsing to never.
+  sink(anything)
+}
+void _typeAssertions
+
+// The assertions above prove `Safe<>` works against a stand-in sink. These prove
+// the real interfaces are actually wired to it — the two can drift apart, and a
+// sink that forgot the guard is exactly the leak this design exists to stop.
+
+const _sinkAssertions = (
+  secret: SecretValue<string>,
+  logger: Logger,
+  auditLog: AuditLog
+) => {
+  // @ts-expect-error a secret cannot be logged
+  logger.info(secret)
+  // @ts-expect-error nor nested in a log message
+  logger.info({ token: secret })
+  // @ts-expect-error nor in the log metadata
+  logger.info('using', { token: secret })
+
+  // @ts-expect-error nor written into an audit input
+  auditLog.write({ type: 'used', source: 'explicit', input: { token: secret } })
+  const metadata = { token: secret }
+  // @ts-expect-error nor into audit metadata
+  auditLog.write({ type: 'used', source: 'explicit', metadata })
+
+  // Ordinary logging and auditing must still compile.
+  logger.info({ msg: 'fine' })
+  logger.info('fine', { count: 1 })
+  auditLog.write({ type: 'used', source: 'explicit', input: { userId: 'u1' } })
+}
+void _sinkAssertions