@pikku/core 0.12.79 → 0.12.82

package/CHANGELOG.md

@@ -1,3 +1,476 @@
+## 0.12.82
+
+### Patch Changes
+
+- 063f43a: api-report.md reports public signatures, one member per line
+
+  The report was built from `declaration.getText()`, so a class arrived as its own
+  source — private fields and method bodies included — flattened onto a single
+  line. `PikkuWorkflowService` was 40,603 characters of one line.
+
+  That made the file unmergeable. One line is one conflict hunk, so two branches
+  touching different methods of the same class conflicted on a line neither had
+  meaningfully changed, and the repo paid for it every rebase.
+
+  Now each member is its own line and stops at its signature, with private members
+  dropped and inferred return types filled in from the checker. The file is a
+  quarter smaller, and every declaration in it parses as TypeScript — 42 of its 50
+  code fences previously did not, because collapsing a multi-line object type threw
+  away the newline that was serving as the member separator.
+
+  Also adds the report to `.prettierignore`: prettier pads the summary tables to
+  their widest cell, so one changed count rewrote all fifty rows, and it reflowed a
+  file that `api-report.test.ts` compares byte-for-byte.
+
+- ce66bf8: A channel message handler that returns nothing no longer tries to send it.
+
+  `local-channel-runner` sent the message handler's result unconditionally, so a
+  handler with nothing to say produced `send requires a non-empty message` on every
+  inbound message. The connect path directly above it has always guarded this; the
+  message path did not.
+
+  Gateway websockets hit it every time — `wireGateway` generates a message handler
+  that returns `undefined` by design — which showed up as a chat gateway accepting
+  a connection and then erroring on each message rather than delivering it.
+
+  Found while testing a webchat gateway in a template. Note that fixing this is
+  necessary but not sufficient for that case: codegen does not emit the channel a
+  websocket gateway registers, so route resolution finds no handler and falls back
+  to the empty inline `onMessage` the gateway wires as a placeholder. That gap is
+  still open.
+
+- d0307a8: Stop the runner overwriting a status the route set
+
+  A function that calls `response.redirect()` has nothing left to return, so it
+  returns `undefined` — and the HTTP runner read that as "no content" and
+  overwrote the 3xx with a 204. The `Location` header survived, but a browser
+  does not follow `Location` on a 204, so the redirect silently became a dead
+  end: the user sits on the page that sent them, waiting for a hop that never
+  comes. This is the whole OAuth/app-install callback shape, where the redirect
+  back to the app is the last step of the flow.
+
+  The same clobber applied to a body: a route that set `201` and returned a
+  value was answered `200`.
+
+  The runner's 204 and 200 are now defaults rather than overrides — they apply
+  only when the route left the status alone.
+
+- ce66bf8: MCP calls now carry the caller's HTTP request, so an MCP tool can require a session.
+
+  Every auth middleware opens with `if (!http?.request) return`. The MCP runner
+  never put an `http` on the wire, so all of them bailed on their first line and
+  an MCP call reached the function with no session — no cookie, no bearer token,
+  no API key, whatever the app had registered. A tool fronting a session-requiring
+  `pikkuFunc` could therefore only ever answer `Authentication required`, and a
+  tool fronting a sessionless one was callable by anyone who could reach the mount.
+
+  Almost nothing was missing. Global middleware already ran for MCP wirings, and
+  the runner already built a `PikkuSessionService` and the middleware session wire
+  props. Only the request was being dropped — twice: `RunMCPEndpointParams` had
+  nowhere to put one, and `createFetchHandler` received the caller's `Request` and
+  discarded it.
+
+  `RunMCPEndpointParams` gains an optional `http`, which the runner places on the
+  wire, and the fetch handler wraps the incoming `Request` in a
+  `PikkuFetchHTTPRequest` and threads it through tools, resources and prompts. The
+  request is cloned before wrapping, because the MCP transport reads the body and
+  both would otherwise compete for one single-use stream; only headers and cookies
+  are wanted, since a tool's input arrives in the JSON-RPC params.
+
+  Transports with no request to offer — stdio, and the long-lived stdio/SSE server
+  paths — pass nothing and stay anonymous. That is a property of those transports
+  rather than a default chosen here, and it is now visible in the type.
+
+  The generated auth middleware moves from `addHTTPMiddleware('*')` to
+  `addGlobalMiddleware`. Carrying the request is necessary but not sufficient:
+  session middleware registered as HTTP middleware runs for HTTP wirings only, so
+  an MCP call still met no middleware and still had no session. Both entries —
+  the Better Auth session and the console bearer token — resolve a session from
+  whatever request the call arrived on, which is not an HTTP routing concern.
+  Wirings with no request are unaffected, since each middleware returns
+  immediately without one.
+
+  That move also retires a hazard the old shape carried: the two entries had to
+  share a single `addHTTPMiddleware('*')` call because the inspector keys
+  route-middleware groups by pattern, so a second `'*'` registration from another
+  file would silently displace the first. Global middleware is an append-only
+  list.
+
+  **Regenerate the auth scaffold after upgrading** — an app still carrying the
+  `addHTTPMiddleware('*')` form keeps anonymous MCP calls.
+
+  Two consequences worth planning for:
+  - **A tool fronting a session-requiring function starts working.** It previously
+    could not run at all.
+  - **A tool fronting a sessionless function is unchanged and still anonymous.**
+    Scopes and permissions now apply to MCP calls exactly as they do elsewhere, so
+    audit any tool that mutates state and give it the scope its HTTP sibling has.
+
+  `PikkuHTTP` is now exported from `@pikku/core/http`; it is part of this contract
+  and was previously only reachable as a type on other exported shapes.
+
+- 3ad2131: Name models by what they are for, and switch them all in one place
+
+  A `models` table in pikku.config.json maps an alias to a provider-qualified
+  model, so a declaration can say `model: 'cheap'` and the project repoints every
+  use of that tier at once instead of editing each agent. A model containing `/`
+  is still concrete and used exactly as written, which is how an agent that needs
+  one specific model pins it — aliases are opt-in.
+
+  The table is baked into codegen rather than read at runtime, so it applies to
+  deployed units and not just local runs, and `pikku dev`/`pikku serve` take
+  `--model cheap:openai/gpt-5-nano` to repoint a tier for one run without editing
+  the config.
+
+  Because the inspector already holds every agent's model literal, a bare name
+  with no matching alias now fails the build (PKU146) naming the aliases that do
+  exist, rather than reaching a provider as an unknown model.
+
+  Aliases resolve for every modality, not just agents: image, speech,
+  transcription, embedding and reranking all reach a provider through the same
+  point in the Vercel runner.
+
+- b930dca: Remove the `secretBroker` escape hatch and scope addon secrets and credentials
+
+  `secretBroker` let three named console functions receive the real `SecretService`,
+  against the rule that a function never sees one. It is gone: the inspector allowlist,
+  the `FunctionRuntimeMeta` flag, the runner branches, and the `WiredSecretBrokerServices`
+  type. Console secret administration moved into the console addon, where a
+  `SecretAdminService` holds the `SecretService` and the functions hold none.
+
+  Addons are now scoped rather than trusted. The CLI emits each package's declared secret
+  keys, and the host wraps the `SecretService` in a `ScopedSecretService` and the
+  `CredentialService` in a new `ScopedCredentialService` before the addon's service factory
+  runs — so an addon reads only what it declared, cannot write secrets, and cannot enumerate
+  the app's users. `wireAddon({ globalSecrets, globalCredentials })` waives this, taking the
+  reason as its value; only the consuming app can grant it, and the deploy manifest reports
+  every grant under `unscopedSecretAddons` / `unscopedCredentialAddons`.
+
+- b95e77d: fix(core): persist working memory on streamed agent runs
+
+  Working memory was never persisted when an agent streamed. The working memory
+  middleware strips the `<working_memory>` block from the outgoing deltas, and the
+  channel that accumulates the reply sits downstream of that strip — so the text
+  later handed to `modifyOutput`, the only place that calls `saveWorkingMemory`,
+  had already had the block removed. It now persists from the stream hook, at the
+  step's `usage` (or `done`) event, where the raw text is still reachable.
+
+  With that dependency gone, `modifyOutput` no longer runs at all on a streamed
+  run: nothing on that path could act on what it returned, since the text has
+  already reached the client and each step is flushed to storage as it goes. A
+  middleware that rewrites in `modifyOutput` without a `modifyOutputStream` — a
+  redaction hook, typically — was silently ineffective while streaming, and is now
+  warned about once per agent.
+
+- fd9d834: Stop publishing internals that only their own package or file used. The declarations stay; only the entrypoint re-export is removed, so nothing that imported a name from where it is declared is affected.
+- 8978fbd: feat(workflow): let an approval gate declare who may answer it
+
+  `workflow.approval()` gains `approvers` (`'any' | 'owner' | 'not-initiator'`)
+  and `approverScope`, so a gate can require four-eyes sign-off, restrict itself
+  to the run's initiator, or require the decider to hold a named scope.
+
+  Both are enforced when the workflow replays the gate — the same place, and for
+  the same reason, the decision payload is validated: the policy is a value on
+  the workflow, and a decision can be recorded before the run has ever reached
+  the gate. A decision that fails the policy is discarded and the gate stays
+  closed. Where the run has already published its policy, the check also runs at
+  submission time so the caller gets a 403 rather than silence.
+
+  An answer is now recorded where it can be answered for later. The settled
+  decision carries `decidedBy` and `decidedAt` in its `ApprovalOutcome`, so who
+  signed reaches `workflowStep.result` and `workflowStepHistory` rather than
+  living only in mutable run state. Every answer — accepted, refused at the door,
+  or cleared on replay — is also written to the audit sink as
+  `workflow.approval.decided`, which outlives the run: `deleteRun` cascades to
+  steps and history, and a refused attempt never reaches a step at all. Projects
+  with no audit service wired are unaffected.
+
+  **This loosens the default.** `approveStep` previously refused anyone but the
+  run's initiator, unconditionally. A gate that declares no `approvers` now
+  accepts a decision from anyone the approve entrypoint admits — restore the old
+  behaviour per-gate with `approvers: 'owner'`, or gate the approve route with
+  `auth`/`permissions`. Ownership still governs _reads_ of a run unchanged.
+
+## 0.12.81
+
+### Patch Changes
+
+- e110c55: Give a finished agent run one finalization seam, and make a failed tool call
+  distinguishable from a tool that returned text saying "Error:".
+  - Tool results carry `error` as its own field, from the runner through the
+    stream event and the run's step record into persisted messages.
+  - `modifyOutput` receives the run's tool calls and may return a rewritten list,
+    which is redistributed back onto the steps it came from.
+  - Streamed runs accumulate their tool calls across steps, and every completion
+    path — streamed, non-streamed, and resumed after a tool approval — now
+    finalizes through `finalizeAgentRun`. A tool that fails after being approved
+    leaves a record on the run instead of vanishing.
+
+- e110c55: Add `scenario.expectScore` — grade a finished agent run with a declared scorer and assert on it.
+
+  An agent's answer cannot be matched against a fixed string, so a scenario grades
+  it instead. `expectScore(step, runId, scorer, { atLeast, atMost, reference })`
+  runs one declared scorer against the run the scenario just triggered and fails
+  with the reason the judge gave. The default bound is `atLeast: 0.5`, so an
+  unqualified assertion still fails a run graded zero.
+
+  Grading goes over the new `pikkuScenarioGradeRun` instrumentation RPC, which the
+  dev server registers alongside the coverage and stub RPCs — so it exists only in
+  processes that should have it, and never in a deployed bundle. It grades from
+  the snapshot the runtime already took when the run finished, which is what makes
+  a scenario's grade the same measurement production's sampler makes rather than
+  an approximation of it: a run's prompt, answer and tool calls are spread across
+  a thread's messages, where the boundary of one run is not recoverable.
+
+  Two things differ deliberately from live scoring. The sample rate is ignored — a
+  scorer grading 1% of traffic still grades every scenario run — and the grade is
+  returned rather than recorded, so a test's score never lands among the
+  production figures. `reference` supplies the answer key a `requiresReference`
+  judge grades against, which is the only way such a judge is reachable at all.
+
+- e110c55: Add runtime scoring for AI agents: `pikkuAIScorer` for heuristic grades and
+  `pikkuAIJudge` for LLM-judged ones, graded off the request path on two queue
+  lanes so a slow judge cannot starve the cheap checks. Grades are sampled
+  deterministically per `(run, scorer)` and persisted to `ai_run_score`.
+- acc8077: Enforce a CLI command's declared `auth`/`permissions`, and mask CLI channel
+  errors in production.
+
+  A command's declared `auth`/`permissions` were accepted by the types but dropped
+  in `registerCLICommands`: when the command wrapped a function-config object,
+  `unwrapFunc` kept only the inner func's fields, so a command-level access-control
+  declaration was a silent no-op. They are now merged into the config passed to
+  `addFunction` — command-level winning, falling back to the handler's — so the
+  function runner enforces them.
+
+  The CLI raw channel runner returned the raw exception message to the remote
+  client. It can carry internals (a stack, a DB error, a path), so it is now logged
+  server-side and replaced with a generic `Command failed` in production; dev keeps
+  the message inline.
+
+  CWE-862 / CWE-209.
+
+- 905f737: Restrict a graph workflow's `startNode` to its declared entry nodes.
+
+  The scaffolded public route `POST /workflow/:name/graph/:nodeId` passes `:nodeId`
+  straight through as `startNode`, and `validateGraphReferences` only checked that
+  the node exists. A caller could name any dependency-free node — one whose input
+  reads only `trigger` — and fire its RPC directly with chosen data, skipping every
+  upstream eligibility, validation or approval node. These node RPCs are internal,
+  so the public `/rpc` endpoint refuses them; this route was the only outside path
+  to them.
+
+  `startWorkflow` — the boundary the public route and triggers enter through — now
+  rejects a `startNode` that is not in the graph's `entryNodeIds`. Internal
+  resume/replay drives `runWorkflowGraph` directly and keeps full node targeting,
+  so the check sits at the trust boundary rather than in the low-level runner.
+
+  CWE-20 / CWE-863.
+
+- 3cc6428: Run a templated MCP resource's middleware for concrete request URIs.
+
+  `runMCPResource` resolves a templated resource's `pikkuFuncId` via the template
+  key, but `runMCPPikkuFunc` then re-looked-up the resource meta by the concrete
+  request URI (`resource://users/123`), which no meta is stored under — so meta was
+  `undefined` and the resource's merged middleware, including any tag-derived auth
+  gate, was silently dropped. A templated MCP resource was reachable with its gate
+  skipped.
+
+  The meta key — the template for a templated match, the URI otherwise — is now
+  carried through to the meta lookup, so the declared middleware runs.
+
+  CWE-863 / CWE-306.
+
+- c524adf: fix(cli,core): make scenario captures reachable, filed per scenario, and findable
+
+  `--screenshots` and `--video` were read by `scenario run` but never declared as
+  options, so both flags were rejected as unknown and silently ignored — capture
+  could not be switched on from the command line at all.
+
+  A provider's `beginScenario` was never called, so every capture in a run was
+  filed under one shared label instead of the scenario that produced it. It is now
+  part of `ScenarioBrowserProvider` and called after the per-scenario reset, once
+  the previous scenario's context is closed and its video finalised.
+
+  The run also never said where it wrote anything. It now reports `Captures → …`
+  after the browser closes, which is the point at which a video exists.
+
+- e110c55: fix(core): persist working memory on streamed agent runs
+
+  Working memory was never persisted when an agent streamed. The working memory
+  middleware strips the `<working_memory>` block from the outgoing deltas, and the
+  channel that accumulates the reply sits downstream of that strip — so the text
+  later handed to `modifyOutput`, the only place that calls `saveWorkingMemory`,
+  had already had the block removed. It now persists from the stream hook, at the
+  step's `usage` (or `done`) event, where the raw text is still reachable.
+
+  With that dependency gone, `modifyOutput` no longer runs at all on a streamed
+  run: nothing on that path could act on what it returned, since the text has
+  already reached the client and each step is flushed to storage as it goes. A
+  middleware that rewrites in `modifyOutput` without a `modifyOutputStream` — a
+  redaction hook, typically — was silently ineffective while streaming, and is now
+  warned about once per agent.
+
+## 0.12.80
+
+### Patch Changes
+
+- 41c1a95: Move the adapter surface to `@pikku/core/ecosystem` so the root can promise stability
+
+  The types and helpers a runtime adapter, a service package, the code generator and the CLI implement against sat on the package root, mixed in with the API application code uses. That made the root impossible to commit to: `runPikkuFunc` was reshaped repeatedly over the last year while every field on `PikkuWire` survived untouched, and promising stability on both would mean promising the weaker of the two.
+
+  They now live on `@pikku/core/ecosystem`. The root is what 0.13's compatibility promise covers.
+
+  Not `/internal`: generated bootstrap files import from here, so the specifier lands in the user's own `.pikku` directory — telling someone they are touching internals when the code generator put it there is both wrong and self-defeating. Not `/runtime` either: that reads as runtime-versus-compile-time, `packages/runtimes/*` already claims the word, and the CLI is the largest consumer.
+
+  `./internal` remains as an alias to the same module, because the pinned bootstrap CLI still emits it.
+
+  Breaking for adapter authors; appropriate pre-0.13.
+
+- ce96383: A child workflow now inherits the `pikkuUserId` its parent was running as
+
+  `PikkuWorkflowService` filled parts of the wire it builds for a workflow body and for a child run from the RPC service it had been handed — `rpcService.wire?.session`, `rpcService.wire?.rpc`, `rpcService.wire?.pikkuUserId`. `PikkuRPC` has no `wire`, and neither does the object the RPC service actually returns, so every one of those reads was `undefined`; the `rpcService: any` parameter type is what kept it quiet. The visible consequence was that a child workflow started from a step ran as nobody.
+
+  Those reads now come from the run record, which is durable and survives the process boundary a queued step crosses. `session` and `rpc` are not copied at all: `runPikkuFunc` attaches `rpc` lazily per invocation and resolves the session from the session store, so both were overwritten moments later regardless. The wires these paths build are typed `PikkuRawWire`, which is what they have always been.
+
+  `PikkuRPC` also now declares `rpcWithWire`, which the RPC service has always returned and the workflow service has always called.
+
+- 7e60867: Delete exports nothing references
+
+  A sweep of the `@pikku/core` surface for exports with no consumer anywhere in the repo — no package, template, verifier or e2e project imports them: `ExtractFunctionOutput`, `CLICommandDefinition`, `RequestHeaders`, `HTTPFunctionsMeta`, `HTTPWiringMiddleware`, `JsonRpcError`, `TriggerSourceInfo`, `getMCPResources`, `getMCPPrompts`, `onGraphNodeComplete` and `InputRef`.
+
+  Every one was a compatibility promise with nothing on the other end of it. Removing them narrows what 0.13 has to keep stable.
+
+  `isRef` looked like the twelfth, and isn't. It is the type guard that reads what `createRef` writes — the `__isRef` brand marking a graph node input as "substitute another node's output here". Nothing imported it because neither it nor `RefValue` was reachable from any entry point, so the one consumer that needed it, the inspector's graph serializer, had reimplemented the same four conditions privately as `isRefValue` along with its own structural copy of `RefValue`. Deleting `isRef` would have made that duplicate permanent, with the brand's shape asserted in two places free to drift apart.
+
+  So `isRef` and `RefValue` are exported from `@pikku/core/workflow` instead, and the inspector imports them rather than keeping its own copy.
+
+- f8f1244: Fix `onConnect`/`onDisconnect` wrapper handlers, and correct `wireChannel`'s generic arguments
+
+  `CoreChannel` accepts three shapes for a handler: a function config, a simple wrapper (`{ func, middleware }`), and a wrapper around a function config (`{ func: { func }, middleware }`). `wireChannel` unwrapped the third shape for `onMessage` and `onMessageWiring`, but registered `onConnect` and `onDisconnect` as-is — so the registered config's `func` was an object, and the function runner threw when it tried to call it. All three shapes now register a callable config on every handler.
+
+  `wireChannel`'s type arguments were also misaligned with `CoreChannel`'s parameter list: `PikkuPermission` was being passed into the `ChannelConnect` slot and `PikkuMiddleware` into `ChannelDisconnect`, which made `wireChannel({ onConnect: { func } })` fail to typecheck with "not assignable to `CorePikkuPermission`". End users did not see this — the CLI's generated `wireChannel` wrapper casts before calling core — but anyone importing `wireChannel` from `@pikku/core/channel` directly did. The signature is now `wireChannel<In, Channel>(channel: CoreChannel<In, Channel>)`; the three surplus type parameters were never used for anything correct and are gone.
+
+- dcf20cb: Pin the public API, and declare which modules have import-time side effects
+
+  Nothing caught a change to what `@pikku/core` publishes. An export could appear, vanish, or have a member's signature change, and the only signal was a downstream break after release.
+
+  `public-surface.json` now pins every runtime export reachable through a `package.json` `exports` subpath, and `api-report.md` pins the API at **member** level — a method added to an interface is the change that breaks a consumer's build, and an export list cannot see it. Both regenerate from the code and are asserted against it, so widening the API is a visible diff rather than a side effect of an `export *`.
+
+  The report is written to state what the API _is_ rather than merely list identifiers, so the diff is readable by a reviewer.
+
+  `sideEffects` is declared as an allowlist rather than `false`: core genuinely has some. The error registry is built by `addError` calls that run on import, so claiming `sideEffects: false` would let a bundler drop it and leave `getErrorResponse` unable to find any error. A test detects the modules that actually have side effects and fails if the allowlist disagrees.
+
+- 6512384: feat: give scenarios a `scenario.context` their `before`/`after` hooks can read
+
+  A hook only ever received the run's _input_, so teardown could not reach an id
+  the scenario body minted — which is exactly what a failing run needs to clean
+  up. `wire.scenario.context` is a per-run scratch object shared by `before`, the
+  body and `after`. It is typed as a `Partial` of the scenario's output, because a
+  run that failed early has none of it.
+
+  ```ts
+  pikkuScenario<void, { projectId: string }>({
+    func: async (_services, _data, { scenario }) => {
+      const { projectId } = await scenario.when('creates a project', 'createsProject', …)
+      scenario.context.projectId = projectId
+      …
+    },
+    after: pikkuScenarioHook<void, { projectId: string }>(
+      async (_services, _data, { scenario, actors }) => {
+        if (scenario.context.projectId) {
+          await actors.admin.invoke('deleteProject', { projectId: scenario.context.projectId })
+        }
+      }
+    ),
+  })
+  ```
+
+  Deliberately not a world: it is scoped to a single run, and scenario _steps_
+  cannot reach it — state still flows between steps as return values.
+
+  Feature-level `before`/`after` get the same member, scoped to their feature, so
+  group setup can hand group teardown what it created. It is a separate object
+  from the scenarios' contexts: one bag shared across a group is the invisible
+  coupling a Cucumber world had.
+
+- e3b4c14: Remove the `addTagPermission`, `addHTTPPermission` and `ZodLike` compatibility stubs
+
+  Tag- and HTTP-route-level permissions were removed in #972; `addTagPermission` and `addHTTPPermission` survived only as throwing stubs so the pinned bootstrap CLI could resolve their imports at build time. `@pikku/cli@0.12.96` — the currently pinned bootstrap version — emits neither name, so the stubs and the `packages/cli/build.sh` rewrite rules that fed them are gone.
+
+  Declare permissions on the function instead: `pikkuFunc({ permissions })`, or app-wide with `addGlobalPermission`.
+
+  `ZodLike` was an alias for `StandardSchemaV1<T, T>` kept for generated code that no longer references it. Import `StandardSchemaV1` from `@standard-schema/spec` directly.
+
+- efd0ed1: **An explicitly-`undefined` property no longer kills a step.** JSON Schema
+  cannot describe such a property, so the validator rejected the whole instance
+  rather than the field — `{ a: undefined }` threw
+  `Instances of "undefined" type are not supported`. Whether a payload could
+  contain one depended on how the call travelled: `JSON.stringify` drops those
+  keys over HTTP, while an in-process dispatch hands the object over intact, so
+  `workflow.do('step', 'rpc', { retries: data.maybeRetries })` failed only when
+  the step ran inline. `validateSchema` now strips them first, and an
+  explicitly-undefined _required_ field reports as the missing property it is.
+- cba98fb: Security hardening sweep
+  - **Content uploads require a signature**, matching reads. `handleUpload` previously validated the path and the size limit and then wrote the file, so an unauthenticated `PUT` to the upload prefix landed on disk. The express server, which verified nothing at all, now verifies both uploads and reads.
+  - **The remote-RPC prefix is matched case-insensitively.** The router matches routes case-insensitively, so `/Remote/RPC/fn` reached the same handler while a case-sensitive `startsWith('/remote/rpc/')` let it past the mesh trust gate and the token's `fn` binding.
+  - **Dev quick-login refuses proxied requests.** The gate checked the hostname only, so a request forwarded with `Host: localhost` was auto-provisioned a root-admin session. Proxy markers (`forwarded`, `x-forwarded-*`) now refuse regardless of what they claim, and dev login is inert in production.
+  - **Logout clears the session cookie** instead of re-signing an absent session into a fresh, unexpired one.
+  - **Short-flag cluster parsing is bounded**, closing a CLI-over-channel denial of service.
+  - `allowedHosts` is carried into secret definition meta.
+
+- ce96383: Split `pikku-workflow-service.ts` into composable modules and report missing workflow metadata as such
+
+  `PikkuWorkflowService`'s module carried its error catalog, run-engine interfaces, queue routing and queue wiring alongside the class. Those now live in `workflow-errors.ts`, `workflow-run-engine.types.ts`, `workflow-constants.ts`, `workflow-meta-resolver.ts`, `workflow-queue-routing.ts` and `workflow-queue-wiring.ts`, with the approval and recovery paths in `workflow-approval.ts` and `workflow-recovery.ts`. The `@pikku/core/workflow` entry point exports the same names as before.
+
+  Typing the workflow meta resolver surfaced a crash: a run whose workflow had no generated metadata threw `TypeError: Cannot read properties of undefined` from deep inside the runner, or `WorkflowNotFoundError` — neither of which points at the actual cause. It now throws `PikkuMissingMetaError`, matching how the queue and trigger runners already report the same condition.
+
+- f8f1244: Tighten several public types that `as any` was masking
+  - `AIStreamEvent`'s `approval-request` variant now declares `runId: string` rather than `runId?: string`. Every emitter already set it, and `AIAgentResult['pendingApprovals']` has always required it — the optional let `undefined` reach a field consumers rely on to resume a suspended run.
+  - `PikkuWire` gains an optional `logger`. The no-op audit service already read `wire.logger` before falling back to the singleton, but nothing declared it, so a host had no typed way to attach an invocation-scoped logger.
+  - `pikkuAuth`'s marker is now the exported `AuthBranded` type instead of an untyped property, so the brand that agent tool filtering depends on is visible to the type system at both the site that sets it and the sites that read it.
+
+  Internally this takes core's non-test modules from 108 `as any` casts to none. Each is replaced by an assertion to the type actually wanted, or by a change to the surrounding types that makes the assertion unnecessary. A test holds the count at zero.
+
+- f8f1244: Declare `CoreUserSession.readonly` and `ChannelMeta.gateway`, which the runtime already used
+
+  The function runner throws `ReadonlySessionError` when a session is marked `readonly` and the function is not, but `CoreUserSession` never declared the field — so there was no typed way to build a readonly session, and even core's own test had to cast. Likewise `wireGateway` writes `gateway: true` onto a websocket channel's meta, which `ChannelMeta` did not admit. Both are now declared.
+
+  The gateway websocket path also wrote channel meta without `input`, `disconnect` or `messageWirings`, all of which `ChannelMeta` requires and `channel-handler` indexes without a guard. It now writes a complete record.
+
+- 6e93a35: Give each wire an explicit set of crossovers
+
+  `wire.rpc.agent` was implemented inline in `rpc-runner.ts`, which put the agent turn logic — run, stream, resume, interrupt, approve — inside the RPC primitive. It moves to `ai-agent/agent-rpc.ts`, next to the runner and stream code it delegates to; `rpc-runner` imports it and the getter stays, so a request that never touches an agent never builds the facade.
+
+  The wires (`http`, `channel`, `queue`, `scheduler`, `cli`, `rpc`, `ai-agent`, `workflow`) previously imported each other ad hoc, so an accidental edge was indistinguishable from a designed one. Each wire now declares the crossovers it is allowed, and a test walks the import graph to hold it — failing both on an undeclared edge and on a declared crossover that no longer exists, so the declaration cannot rot into a rubber stamp.
+
+  `unsupportedChannelRemote` moves from `channel-rpc-service.ts` to `channel-rpc.types.ts`, alongside the error it throws.
+
+  The shared storage conformance suite splits from one 1216-line module into one module per service, so a backend author can read the contract for the service they implement. `defineServiceTests` is unchanged for callers.
+
+- 6dada45: fix(workflow,ai-agent): make a run's owner, entry node and step function authoritative
+
+  A graph run may only start at a node the graph declared in `meta.entryNodeIds`, and
+  the generated `POST /workflow/:workflowName/graph/:nodeId` route that let an HTTP
+  caller pick the entry node is gone. `startNode` stays for `PikkuTriggerService`,
+  which names a declared entry node anyway.
+
+  `StepState` now records the `rpcName` the workflow dispatched a step with, and the
+  step claim rejects a queue message naming a different function with
+  `WorkflowStepFunctionMismatchError` before mutating any status — a step runs under
+  the run owner's identity and without the `expose` gate, so the message must not
+  choose what runs.
+
+  `approveStep` takes the caller's session, and the generated status routes and
+  streams assert the same `assertWorkflowRunOwner` check: a run started through a
+  session may only be read and approved by that session's user. A run with no
+  recorded owner (trigger, scheduler, unauthenticated route) has nobody to compare
+  against and is still gated by the entrypoint's own `auth`/`permissions`.
+
+  `AIRunStateService.resolveApproval` is now a compare-and-swap returning whether
+  _this_ caller made the claim, and both agent resume paths run a tool only for the
+  approvals they claimed — concurrent approvals of one tool call no longer all
+  execute it.
+
 ## 0.12.79
 
 ### Patch Changes

package/dist/dev/hot-reload.js

@@ -61,12 +61,7 @@ export async function pikkuDevReloader(options) {
             logger.error(`Failed to import: ${relative(process.cwd(), importPath)} (keeping old code)`);
             return;
         }
-        // Register every function-config export, replacing known functions and
-        // adding new ones. Write into the map captured at startup, NOT pikkuState's
-        // current one: a dev-server watcher may have temporarily swapped in a
-        // codegen-scoped map, whose writes are discarded when it restores.
-        // Schemas are NOT touched here: `input`/`output` hold raw zod schemas while
-        // the schema map carries codegen JSON schemas; mixing them crashed reloads.
+        // knowledge: decisions/internals/hot-reload-writes-into-the-function-map-captured-at-startup.md
         for (const [exportName, exportValue] of Object.entries(mod)) {
             if (!isFunctionConfig(exportValue))
                 continue;

package/dist/ecosystem.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The surface a package in the Pikku ecosystem reaches for — a runtime adapter,
+ * a service, the code generator's output, the CLI — and application code does
+ * not.
+ *
+ * Split out from the package root so 1.0's compatibility promise covers what
+ * applications actually import. These signatures move when the runtime needs
+ * them to — `runPikkuFunc` was reshaped over the last year while every field on
+ * `PikkuWire` survived — and promising stability on both would mean promising
+ * the weaker of the two.
+ *
+ * Not `/internal`: generated bootstrap files import from here, so the specifier
+ * lands in the user's own `.pikku` directory, and telling someone they are
+ * touching internals when the code generator put it there is both wrong and
+ * self-defeating — it could never be broken anyway. Not `/runtime` either: that
+ * reads as runtime-versus-compile-time, i.e. the real API, and `packages/runtimes/*`
+ * already claims the word while the CLI is the largest consumer here.
+ *
+ * `/internal` stays as an alias because the pinned bootstrap CLI still emits it.
+ *
+ * knowledge: decisions/internals/the-ecosystem-entry-point-carries-the-adapter-surface.md
+ */
+export { pikkuState, resetPikkuState, getAllPackageStates, getSingletonServices, getCreateWireServices, setSingletonServices, } from './pikku-state.js';
+export { runPikkuFunc, addFunction } from './function/function-runner.js';
+export { addGlobalMiddleware, addTagMiddleware as addMiddleware, } from './middleware-runner.js';
+export { httpRouter } from './wirings/http/routers/http-router.js';
+export type { CreateSingletonServices, CreateWireServices, } from './types/core.types.js';

package/dist/ecosystem.js

@@ -0,0 +1,26 @@
+/**
+ * The surface a package in the Pikku ecosystem reaches for — a runtime adapter,
+ * a service, the code generator's output, the CLI — and application code does
+ * not.
+ *
+ * Split out from the package root so 1.0's compatibility promise covers what
+ * applications actually import. These signatures move when the runtime needs
+ * them to — `runPikkuFunc` was reshaped over the last year while every field on
+ * `PikkuWire` survived — and promising stability on both would mean promising
+ * the weaker of the two.
+ *
+ * Not `/internal`: generated bootstrap files import from here, so the specifier
+ * lands in the user's own `.pikku` directory, and telling someone they are
+ * touching internals when the code generator put it there is both wrong and
+ * self-defeating — it could never be broken anyway. Not `/runtime` either: that
+ * reads as runtime-versus-compile-time, i.e. the real API, and `packages/runtimes/*`
+ * already claims the word while the CLI is the largest consumer here.
+ *
+ * `/internal` stays as an alias because the pinned bootstrap CLI still emits it.
+ *
+ * knowledge: decisions/internals/the-ecosystem-entry-point-carries-the-adapter-surface.md
+ */
+export { pikkuState, resetPikkuState, getAllPackageStates, getSingletonServices, getCreateWireServices, setSingletonServices, } from './pikku-state.js';
+export { runPikkuFunc, addFunction } from './function/function-runner.js';
+export { addGlobalMiddleware, addTagMiddleware as addMiddleware, } from './middleware-runner.js';
+export { httpRouter } from './wirings/http/routers/http-router.js';

package/dist/errors/error-handler.js

@@ -12,7 +12,8 @@ export class PikkuError extends Error {
  * plain `Error`. Callers log the message alone for these, the full stack for
  * everything else.
  */
-export const isExpectedError = (error) => error instanceof PikkuError || error?.expected === true;
+export const isExpectedError = (error) => error instanceof PikkuError ||
+    error?.expected === true;
 export const addError = (error, { status, message, mcpCode }) => {
     pikkuState(null, 'misc', 'errors').set(error, mcpCode === undefined ? { status, message } : { status, message, mcpCode });
 };
@@ -31,7 +32,8 @@ export const getErrorResponse = (error) => {
         }
         ctor = Object.getPrototypeOf(ctor);
     }
-    const name = error?.constructor?.name;
+    const name = error
+        ?.constructor?.name;
     return name
         ? Array.from(errors.entries()).find(([e]) => e.name === name)?.[1]
         : undefined;

package/dist/errors/index.d.ts

@@ -1,2 +1,2 @@
 export * from './errors.js';
-export { PikkuError, addError, addErrors } from './error-handler.js';
+export { PikkuError, addError } from './error-handler.js';

package/dist/errors/index.js

@@ -1,2 +1,2 @@
 export * from './errors.js';
-export { PikkuError, addError, addErrors } from './error-handler.js';
+export { PikkuError, addError } from './error-handler.js';