@pikku/core 0.12.79 → 0.12.82

package/scripts/generate-api-report.mts

@@ -0,0 +1,343 @@
+/**
+ * Emits `api-report.md`: every entry point's exported symbols with their full
+ * type signatures.
+ *
+ * `public-surface.json` pins the *names* a consumer can reach, by reading
+ * `Object.keys` off each entry point. That catches an export appearing or
+ * disappearing and nothing else — adding a method to `MetaService`, or making
+ * a field on `ChannelMeta` required, sails straight past it, and so does every
+ * type-only export, which erases before there is an object to enumerate.
+ *
+ * Those are the changes that break a consumer's build, and the report's own
+ * summary shows how many more of them there are than there are names.
+ *
+ * So this walks the type checker instead and writes what each symbol actually
+ * *is*. The report is committed, and `api-report.test.ts` fails when the two
+ * disagree — so a member-level change is a reviewable diff rather than a
+ * surprise in someone else's CI.
+ *
+ * A member per line, and no member bodies. Both are load-bearing rather than
+ * cosmetic: the report exists to be diffed, and a class emitted as one long
+ * line of its own source is neither reviewable nor mergeable.
+ *
+ * Run: yarn api-report
+ */
+import { readFileSync, writeFileSync } from 'node:fs'
+import { resolve, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import ts from 'typescript'
+
+const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..')
+const pkg = JSON.parse(
+  readFileSync(resolve(packageRoot, 'package.json'), 'utf-8')
+)
+
+const entryPoints = Object.entries(pkg.exports as Record<string, string>).map(
+  ([subpath, dist]) => ({
+    subpath,
+    file: resolve(
+      packageRoot,
+      dist.replace('./dist/', './src/').replace(/\.js$/, '.ts')
+    ),
+  })
+)
+
+const program = ts.createProgram(
+  entryPoints.map((e) => e.file),
+  {
+    target: ts.ScriptTarget.ESNext,
+    module: ts.ModuleKind.Node16,
+    moduleResolution: ts.ModuleResolutionKind.Node16,
+    strict: true,
+    skipLibCheck: true,
+  }
+)
+const checker = program.getTypeChecker()
+
+/** Comments are noise in a report the diff is read for. */
+const stripComments = (text: string): string =>
+  text.replace(/\/\*[\s\S]*?\*\//g, '').replace(/\/\/[^\n]*/g, '')
+
+/**
+ * Punctuation that makes a line and its successor one thing.
+ *
+ * Read from both ends rather than one, because the closers are ambiguous from
+ * behind: `string[]`, `Promise<T>` and `= {}` all end in a closing bracket and
+ * none of them is a continuation. What the *next* line starts with is not.
+ */
+const CONTINUES = /(=>|[,;{([<|&=])$/
+const CLOSES = /^(=>|extends\b|[}\])>,;|&])/
+
+/**
+ * A member's own text on one line — long, but never long enough to matter.
+ *
+ * Inside an object type the author's newline *was* the separator, so collapsing
+ * without restoring it produces `{ a: string b: number }`, which is not the
+ * type it describes and does not parse in the ```ts fence it is printed into.
+ */
+const oneLine = (text: string): string => {
+  const lines = stripComments(text)
+    .split('\n')
+    .map((l) => l.trim())
+    .filter(Boolean)
+  let depth = 0
+  const joined = lines
+    .map((line, index) => {
+      const inObjectType = depth > 0
+      for (const character of line) {
+        if (character === '{') depth++
+        else if (character === '}') depth--
+      }
+      const next = lines[index + 1]
+      return inObjectType &&
+        next !== undefined &&
+        !CONTINUES.test(line) &&
+        !CLOSES.test(next)
+        ? `${line};`
+        : line
+    })
+    .join(' ')
+  return joined.replace(/\(\s+/g, '(').replace(/\s+\)/g, ')')
+}
+
+/**
+ * A class member as a consumer sees it: the signature, and nothing after it.
+ *
+ * The body is where every character of this report used to come from — a class
+ * arrived as its own source, so the report promised implementation details and
+ * a one-word change to a method rewrote the whole declaration. Truncating at
+ * the body leaves exactly the part a compatibility promise covers.
+ */
+const memberSignature = (member: ts.ClassElement | ts.TypeElement): string => {
+  const source = member.getSourceFile().text
+  const start = member.getStart()
+
+  const body = (member as { body?: ts.Node }).body
+  if (body) {
+    const head = oneLine(source.slice(start, body.getStart())).replace(
+      /\s*$/,
+      ''
+    )
+    // An inferred return type is still a return type a consumer depends on, and
+    // truncating at the body is what threw the author's away.
+    if (ts.isMethodDeclaration(member) || ts.isGetAccessorDeclaration(member)) {
+      const signature = member.type
+        ? undefined
+        : checker.getSignatureFromDeclaration(member)
+      if (signature) {
+        const returns = checker.getReturnTypeOfSignature(signature)
+        return `${head}: ${checker.typeToString(returns, undefined, ts.TypeFormatFlags.NoTruncation)}`
+      }
+    }
+    return head
+  }
+
+  // A property's initializer is a body by another name. Its annotation stands in
+  // for it, and the checker supplies one when the author left it inferred.
+  if (ts.isPropertyDeclaration(member) && member.initializer) {
+    if (member.type) return oneLine(source.slice(start, member.type.end))
+    const type = checker.getTypeAtLocation(member)
+    return `${oneLine(source.slice(start, member.name.end))}: ${checker.typeToString(type, undefined, ts.TypeFormatFlags.NoTruncation)}`
+  }
+
+  return oneLine(member.getText())
+}
+
+/** Members a consumer can reach, so a private field is not a promise. */
+const isPublic = (member: ts.ClassElement | ts.TypeElement): boolean =>
+  !(ts.getModifiers(member as ts.HasModifiers) ?? []).some(
+    (modifier) => modifier.kind === ts.SyntaxKind.PrivateKeyword
+  ) && !(member.name && ts.isPrivateIdentifier(member.name))
+
+/**
+ * A declaration with members, one member per line.
+ *
+ * The line break is the point. Two branches that touch different methods of the
+ * same class are a textual conflict when the class is one line and an ordinary
+ * merge when it is not, which is a tax the whole repo was paying: every rebase
+ * over this file stopped to re-resolve a forty-thousand-character line by hand.
+ */
+const membered = (
+  declaration:
+    | ts.ClassDeclaration
+    | ts.InterfaceDeclaration
+    | ts.EnumDeclaration,
+  members: ts.NodeArray<ts.ClassElement | ts.TypeElement | ts.EnumMember>
+): string => {
+  if (members.length === 0) return oneLine(declaration.getText())
+  const source = declaration.getSourceFile().text
+  // `members.pos` is the offset just past the `{`, so the header comes with its
+  // own brace and needs no reassembling.
+  const header = oneLine(source.slice(declaration.getStart(), members.pos))
+  const lines = ts.isEnumDeclaration(declaration)
+    ? (members as readonly ts.EnumMember[]).map(
+        (member) => `${oneLine(member.getText())},`
+      )
+    : (members as readonly (ts.ClassElement | ts.TypeElement)[])
+        .filter(isPublic)
+        .map(memberSignature)
+  return [header, ...lines.map((line) => `  ${line}`), '}'].join('\n')
+}
+
+/** How a symbol is declared, in as many lines as its members need. */
+const signature = (exported: ts.Symbol): string => {
+  // A re-export is an alias; the declaration that matters is the target's, so
+  // an interface re-exported through a barrel still reports its members.
+  const symbol =
+    exported.flags & ts.SymbolFlags.Alias
+      ? checker.getAliasedSymbol(exported)
+      : exported
+  const declaration = symbol.declarations?.[0]
+  if (!declaration) return exported.getName()
+
+  if (
+    ts.isClassDeclaration(declaration) ||
+    ts.isInterfaceDeclaration(declaration) ||
+    ts.isEnumDeclaration(declaration)
+  ) {
+    return membered(declaration, declaration.members)
+  }
+
+  if (ts.isTypeAliasDeclaration(declaration)) {
+    // No members to walk, so the author's own line breaks are the ones that
+    // keep a long union reviewable.
+    return stripComments(declaration.getText())
+      .split('\n')
+      .map((l) => l.trimEnd())
+      .filter((l) => l.trim())
+      .join('\n')
+  }
+
+  const type = checker.getTypeOfSymbolAtLocation(symbol, declaration)
+  return `${exported.getName()}: ${checker.typeToString(type, undefined, ts.TypeFormatFlags.NoTruncation)}`
+}
+
+/**
+ * Entry points whose signatures move with the CLI's codegen. Everything else
+ * is what an application imports, and is what a compatibility promise covers.
+ *
+ * knowledge: decisions/internals/the-ecosystem-entry-point-carries-the-adapter-surface.md
+ */
+const ECOSYSTEM_SUBPATHS = new Set(['./ecosystem', './internal'])
+
+type Exported = { name: string; members: number; signature: string }
+
+/** The members the report lists, which is what the tally is counting. */
+const memberCount = (declaration: ts.Declaration): number => {
+  if (ts.isInterfaceDeclaration(declaration)) return declaration.members.length
+  if (ts.isEnumDeclaration(declaration)) return declaration.members.length
+  if (!ts.isClassDeclaration(declaration)) return 0
+  return declaration.members.filter(isPublic).length
+}
+
+const modules = new Map<string, Exported[]>()
+
+for (const { subpath, file } of entryPoints) {
+  const source = program.getSourceFile(file)
+  if (!source) continue
+  const moduleSymbol = checker.getSymbolAtLocation(source)
+  if (!moduleSymbol) continue
+
+  modules.set(
+    subpath,
+    checker
+      .getExportsOfModule(moduleSymbol)
+      .map((exported) => {
+        const symbol =
+          exported.flags & ts.SymbolFlags.Alias
+            ? checker.getAliasedSymbol(exported)
+            : exported
+        const declaration = symbol.declarations?.[0]
+        return {
+          name: exported.getName(),
+          members: declaration ? memberCount(declaration) : 0,
+          signature: signature(exported),
+        }
+      })
+      .sort((a, b) => a.name.localeCompare(b.name))
+  )
+}
+
+// A name reachable from more than one entry point is counted once, against the
+// weaker promise — reaching it through a stable subpath is what a consumer will
+// have done, whatever else also exports it.
+const tierOf = new Map<string, string>()
+const membersOf = new Map<string, number>()
+for (const [subpath, exports] of modules) {
+  const tier = ECOSYSTEM_SUBPATHS.has(subpath) ? 'ecosystem' : 'stable'
+  for (const { name, members } of exports) {
+    if (tier === 'stable' || !tierOf.has(name)) tierOf.set(name, tier)
+    membersOf.set(name, Math.max(membersOf.get(name) ?? 0, members))
+  }
+}
+
+const tally = (tier: string) => {
+  const names = [...tierOf].filter(([, t]) => t === tier).map(([n]) => n)
+  return {
+    entryPoints: [...modules.keys()].filter(
+      (s) => (ECOSYSTEM_SUBPATHS.has(s) ? 'ecosystem' : 'stable') === tier
+    ).length,
+    names: names.length,
+    members: names.reduce((total, n) => total + (membersOf.get(n) ?? 0), 0),
+  }
+}
+const stable = tally('stable')
+const ecosystem = tally('ecosystem')
+const observable =
+  stable.names + stable.members + ecosystem.names + ecosystem.members
+
+const reachableFrom = new Map<string, number>()
+for (const exports of modules.values())
+  for (const { name } of exports)
+    reachableFrom.set(name, (reachableFrom.get(name) ?? 0) + 1)
+
+const perEntryPoint = [...modules]
+  .map(([subpath, exports]) => {
+    const exclusive = exports.filter(
+      ({ name }) => reachableFrom.get(name) === 1
+    )
+    return {
+      subpath,
+      exports: exports.length,
+      exclusive: exclusive.length,
+      members: exclusive.reduce((total, e) => total + e.members, 0),
+    }
+  })
+  .sort((a, b) => b.exclusive + b.members - (a.exclusive + a.members))
+
+const sections: string[] = [
+  '# @pikku/core API report',
+  '',
+  'Generated by `yarn api-report`. Every exported symbol with its full',
+  'signature, so a member-level change is a reviewable diff. Do not edit.',
+  '',
+  '## What a compatibility promise covers',
+  '',
+  `**${observable} observable things**: ${stable.names + ecosystem.names} exported names, plus`,
+  `${stable.members + ecosystem.members} members on the classes and interfaces among them.`,
+  '',
+  '| tier | entry points | names | members |',
+  '| --- | ---: | ---: | ---: |',
+  `| stable | ${stable.entryPoints} | ${stable.names} | ${stable.members} |`,
+  `| ecosystem | ${ecosystem.entryPoints} | ${ecosystem.names} | ${ecosystem.members} |`,
+  '',
+  'An entry point whose exports are mostly *exclusive* is a self-contained',
+  'subsystem rather than shared machinery — which tends to mean a newer one.',
+  '',
+  '| entry point | exports | exclusive | members on those |',
+  '| --- | ---: | ---: | ---: |',
+  ...perEntryPoint.map(
+    (e) => `| \`${e.subpath}\` | ${e.exports} | ${e.exclusive} | ${e.members} |`
+  ),
+  '',
+]
+
+for (const [subpath, exports] of modules) {
+  sections.push(`## ${subpath}`, '')
+  sections.push('```ts')
+  for (const { signature } of exports) sections.push(signature)
+  sections.push('```', '')
+}
+
+writeFileSync(resolve(packageRoot, 'api-report.md'), sections.join('\n'))
+console.log(`api-report.md written for ${entryPoints.length} entry points`)

package/src/api-report.test.ts

@@ -0,0 +1,69 @@
+import { describe, test } from 'node:test'
+import assert from 'node:assert/strict'
+import { execFileSync } from 'node:child_process'
+import { readFileSync, writeFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { join, dirname } from 'node:path'
+
+const packageRoot = join(dirname(fileURLToPath(import.meta.url)), '..')
+const reportPath = join(packageRoot, 'api-report.md')
+
+/**
+ * `public-surface.json` pins the *names* a consumer can reach. That catches an
+ * export appearing or vanishing and nothing else — adding a method to
+ * `MetaService`, or making a field on `ChannelMeta` required, sails past it,
+ * as does every type-only export. Those are the changes that break a
+ * consumer's build, and the report's summary counts how many more of them
+ * there are than there are names.
+ *
+ * So `api-report.md` records what each symbol *is*, and this fails when the
+ * committed report and the code disagree.
+ *
+ * knowledge: decisions/internals/the-api-report-pins-members-not-just-names.md
+ */
+describe('the API report matches the code', () => {
+  test('regenerating produces no diff', () => {
+    const committed = readFileSync(reportPath, 'utf-8')
+
+    execFileSync(
+      'npx',
+      ['tsx', join(packageRoot, 'scripts', 'generate-api-report.mts')],
+      { cwd: packageRoot, stdio: 'pipe' }
+    )
+    const regenerated = readFileSync(reportPath, 'utf-8')
+
+    if (committed !== regenerated) {
+      // Restore, so a failing run does not leave the tree dirty.
+      const committedLines = committed.split('\n')
+      const regeneratedLines = regenerated.split('\n')
+      const firstDiff = regeneratedLines.findIndex(
+        (line, i) => line !== committedLines[i]
+      )
+      writeFileSync(reportPath, committed)
+
+      assert.fail(
+        'the public API changed but api-report.md was not regenerated.\n' +
+          `First difference at line ${firstDiff + 1}:\n` +
+          `  committed:   ${committedLines[firstDiff] ?? '(end of file)'}\n` +
+          `  regenerated: ${regeneratedLines[firstDiff] ?? '(end of file)'}\n` +
+          'Run `yarn api-report` and review the diff — a member added to an ' +
+          'exported interface or class is a change consumers compile against.'
+      )
+    }
+  })
+
+  test('the report actually contains member-level detail', () => {
+    // Guards the test above: a report of bare names would match itself forever
+    // while pinning nothing that public-surface.json does not already pin.
+    const report = readFileSync(reportPath, 'utf-8')
+
+    assert.ok(
+      /export interface MetaService \{[^}]*getHttpMeta/.test(report),
+      'expected MetaService to be reported with its members'
+    )
+    assert.ok(
+      !/^\w+: any$/m.test(report),
+      'symbols reported as `any` mean re-export aliases are not being followed'
+    )
+  })
+})

package/src/column-form.ts

@@ -23,10 +23,7 @@ export const hashToken = async (raw: string): Promise<HashedValue> => {
   if (!subtle) {
     throw new Error('WebCrypto not available')
   }
-  const digest = await subtle.digest(
-    'SHA-256',
-    new TextEncoder().encode(raw)
-  )
+  const digest = await subtle.digest('SHA-256', new TextEncoder().encode(raw))
   let hex = ''
   for (const byte of new Uint8Array(digest)) {
     hex += byte.toString(16).padStart(2, '0')

package/src/crypto-utils.test.ts

@@ -627,8 +627,21 @@ describe('envelope encryption', () => {
     )
   })
 
+  /**
+   * Timed against a derivation measured here rather than a fixed millisecond
+   * budget. A constant threshold is a load test in disguise: this runs
+   * alongside two thousand other tests, and 50ms left barely 4x headroom over
+   * a 10ms window, so the suite went red roughly one run in five. Timing the
+   * derivation the test already needs costs nothing and makes both sides scale
+   * together, so the margin survives whatever else the machine is doing.
+   *
+   * knowledge: decisions/internals/a-wall-clock-threshold-is-a-load-test-in-disguise.md
+   */
   test('N secrets cost one KEK derivation, not N', async () => {
+    const derivationStart = performance.now()
     const kek = await deriveKEK(passphrase, salt)
+    const oneDerivation = performance.now() - derivationStart
+
     const count = 50
     const stored = []
     for (let i = 0; i < count; i++) {
@@ -648,8 +661,8 @@ describe('envelope encryption', () => {
     const elapsed = performance.now() - start
 
     assert.ok(
-      elapsed < 50,
-      `unwrapping ${count} DEKs took ${elapsed.toFixed(1)}ms; a re-derivation per secret would cost seconds`
+      elapsed < oneDerivation,
+      `unwrapping ${count} DEKs took ${elapsed.toFixed(1)}ms, longer than the ${oneDerivation.toFixed(1)}ms a single KEK derivation costs — re-deriving per secret would cost about ${(oneDerivation * count).toFixed(0)}ms`
     )
   })
 })

package/src/dev/hot-reload.ts

@@ -26,7 +26,7 @@ const isFunctionConfig = (
     typeof value === 'object' &&
     value !== null &&
     'func' in value &&
-    typeof (value as any).func === 'function'
+    typeof (value as { func?: unknown }).func === 'function'
   )
 }
 
@@ -104,12 +104,7 @@ export async function pikkuDevReloader(
       return
     }
 
-    // Register every function-config export, replacing known functions and
-    // adding new ones. Write into the map captured at startup, NOT pikkuState's
-    // current one: a dev-server watcher may have temporarily swapped in a
-    // codegen-scoped map, whose writes are discarded when it restores.
-    // Schemas are NOT touched here: `input`/`output` hold raw zod schemas while
-    // the schema map carries codegen JSON schemas; mixing them crashed reloads.
+    // knowledge: decisions/internals/hot-reload-writes-into-the-function-map-captured-at-startup.md
     for (const [exportName, exportValue] of Object.entries(mod)) {
       if (!isFunctionConfig(exportValue)) continue
       const isNew = !functionsMap.has(exportName)

package/src/ecosystem.ts

@@ -0,0 +1,40 @@
+/**
+ * The surface a package in the Pikku ecosystem reaches for — a runtime adapter,
+ * a service, the code generator's output, the CLI — and application code does
+ * not.
+ *
+ * Split out from the package root so 1.0's compatibility promise covers what
+ * applications actually import. These signatures move when the runtime needs
+ * them to — `runPikkuFunc` was reshaped over the last year while every field on
+ * `PikkuWire` survived — and promising stability on both would mean promising
+ * the weaker of the two.
+ *
+ * Not `/internal`: generated bootstrap files import from here, so the specifier
+ * lands in the user's own `.pikku` directory, and telling someone they are
+ * touching internals when the code generator put it there is both wrong and
+ * self-defeating — it could never be broken anyway. Not `/runtime` either: that
+ * reads as runtime-versus-compile-time, i.e. the real API, and `packages/runtimes/*`
+ * already claims the word while the CLI is the largest consumer here.
+ *
+ * `/internal` stays as an alias because the pinned bootstrap CLI still emits it.
+ *
+ * knowledge: decisions/internals/the-ecosystem-entry-point-carries-the-adapter-surface.md
+ */
+export {
+  pikkuState,
+  resetPikkuState,
+  getAllPackageStates,
+  getSingletonServices,
+  getCreateWireServices,
+  setSingletonServices,
+} from './pikku-state.js'
+export { runPikkuFunc, addFunction } from './function/function-runner.js'
+export {
+  addGlobalMiddleware,
+  addTagMiddleware as addMiddleware,
+} from './middleware-runner.js'
+export { httpRouter } from './wirings/http/routers/http-router.js'
+export type {
+  CreateSingletonServices,
+  CreateWireServices,
+} from './types/core.types.js'

package/src/errors/error-handler.ts

@@ -15,7 +15,8 @@ export class PikkuError extends Error {
  * everything else.
  */
 export const isExpectedError = (error: unknown): boolean =>
-  error instanceof PikkuError || (error as any)?.expected === true
+  error instanceof PikkuError ||
+  (error as { expected?: unknown } | null)?.expected === true
 
 export interface ErrorDetails {
   status: number
@@ -48,7 +49,7 @@ export const getErrorResponse = (
 ): { status: number; message: string; mcpCode?: number } | undefined => {
   const errors = pikkuState(null, 'misc', 'errors')
 
-  let ctor: unknown = (error as any)?.constructor
+  let ctor: unknown = (error as { constructor?: unknown } | null)?.constructor
   while (typeof ctor === 'function' && ctor !== Object) {
     const details = errors.get(ctor as PikkuErrorConstructor)
     if (details) {
@@ -57,7 +58,8 @@ export const getErrorResponse = (
     ctor = Object.getPrototypeOf(ctor)
   }
 
-  const name = (error as any)?.constructor?.name
+  const name = (error as { constructor?: { name?: string } } | null)
+    ?.constructor?.name
   return name
     ? Array.from(errors.entries()).find(([e]) => e.name === name)?.[1]
     : undefined

package/src/errors/error.test.ts

@@ -199,7 +199,10 @@ describe('getErrorResponse resolution order', () => {
   test('a subclass of a registered error inherits its registered status', () => {
     class TenantNotFoundError extends NotFoundError {}
     const expected = getErrorResponse(new NotFoundError())
-    assert.deepStrictEqual(getErrorResponse(new TenantNotFoundError()), expected)
+    assert.deepStrictEqual(
+      getErrorResponse(new TenantNotFoundError()),
+      expected
+    )
   })
 
   test('an unregistered, non-colliding error class resolves to undefined', () => {

package/src/errors/index.ts

@@ -1,2 +1,2 @@
 export * from './errors.js'
-export { PikkuError, addError, addErrors } from './error-handler.js'
+export { PikkuError, addError } from './error-handler.js'

package/src/function/function-runner.test.ts

@@ -14,6 +14,7 @@ import type { CorePermissionGroup } from './functions.types.js'
 import { PikkuSessionService } from '../services/user-session-service.js'
 import { MissingScopeError, ReadonlySessionError } from '../errors/errors.js'
 import { createInvocationAudit } from '../services/audit-service.js'
+import { SecretAccessDeniedError } from '../services/secretless.js'
 
 beforeEach(() => {
   resetPikkuState()
@@ -637,7 +638,7 @@ describe('runPikkuFunc - Integration Tests', () => {
           singletonServices: mockSingletonServices,
           data: () => ({}),
           auth: false,
-          wire: { session: { readonly: true } as any },
+          wire: { session: { readonly: true } },
         }),
       ReadonlySessionError
     )
@@ -1563,3 +1564,54 @@ describe('runPikkuFunc - scopes', () => {
     })
   })
 })
+
+describe('runPikkuFunc - secrets', () => {
+  const singletonServicesWithSecrets = {
+    ...mockSingletonServices,
+    secrets: { getSecret: async () => 'super-secret' },
+  } as any
+
+  const addSecretReadingFunction = (
+    funcName: string,
+    seen: { error?: unknown }
+  ) => {
+    addTestFunction(funcName, {
+      func: async (services: any) => {
+        try {
+          return services.secrets
+        } catch (error) {
+          seen.error = error
+          return 'denied'
+        }
+      },
+    })
+  }
+
+  const run = (funcName: string) =>
+    runPikkuFunc('rpc', Math.random().toString(), funcName, {
+      singletonServices: singletonServicesWithSecrets,
+      getAllServices: () => singletonServicesWithSecrets,
+      data: () => ({}),
+      auth: false,
+      wire: {},
+    })
+
+  test('a function never receives the secrets service', async () => {
+    const seen: { error?: unknown } = {}
+    addSecretReadingFunction('readsSecrets', seen)
+
+    assert.equal(await run('readsSecrets'), 'denied')
+    assert.ok(seen.error instanceof SecretAccessDeniedError)
+  })
+
+  test('no metadata flag can restore the secrets service', async () => {
+    const seen: { error?: unknown } = {}
+    addSecretReadingFunction('claimsAnExemption', seen)
+    Object.assign(pikkuState(null, 'function', 'meta')['claimsAnExemption']!, {
+      secretBroker: true,
+    })
+
+    assert.equal(await run('claimsAnExemption'), 'denied')
+    assert.ok(seen.error instanceof SecretAccessDeniedError)
+  })
+})