@pikku/core 0.12.79 → 0.12.82

package/src/permissions.test.ts

@@ -72,7 +72,9 @@ describe('runPermissions — function permissions (OR gate)', () => {
       run({ funcPermissions: { grp: [async () => true, async () => false] } }),
       { message: 'Permission denied' }
     )
-    await run({ funcPermissions: { grp: [async () => true, async () => true] } })
+    await run({
+      funcPermissions: { grp: [async () => true, async () => true] },
+    })
   })
 
   test('accepts a bare permission array as a single AND branch', async () => {

package/src/permissions.ts

@@ -3,7 +3,24 @@ import type {
   CoreUserSession,
   PikkuWire,
 } from './types/core.types.js'
+import type { PikkuRPC } from './wirings/rpc/rpc-types.js'
+
+/**
+ * The wire a permission function sees. `Out = never` denies it `channel.send`.
+ *
+ * knowledge: decisions/security/a-permission-gets-a-wire-it-cannot-reply-on.md
+ */
+export type PermissionWire = PikkuWire<
+  any,
+  never,
+  false,
+  any,
+  PikkuRPC,
+  never,
+  never
+>
 import type {
+  AuthBranded,
   CorePermissionGroup,
   CorePikkuPermission,
 } from './function/functions.types.js'
@@ -14,7 +31,7 @@ const verifyPermissions = async (
   permissions: CorePermissionGroup,
   services: CoreServices,
   data: any,
-  wire: PikkuWire<any, never, any, CoreUserSession, never, never, never>
+  wire: PermissionWire
 ): Promise<boolean> => {
   if (!permissions) {
     return true
@@ -34,7 +51,7 @@ const verifyPermissions = async (
         return true
       }
     } else {
-      if (await funcs(services, data, wire as any)) {
+      if (await funcs(services, data, wire)) {
         return true
       }
     }
@@ -42,7 +59,6 @@ const verifyPermissions = async (
   return false
 }
 
-
 const globalPermissionsCache: Record<
   string,
   readonly (CorePermissionGroup | CorePikkuPermission)[]
@@ -71,24 +87,6 @@ export const addGlobalPermission = (
   return permissions
 }
 
-/**
- * @deprecated Tag-level permissions were removed in #972 — permissions are now
- * function-scoped only (declare them on the function via `pikkuFunc({ permissions })`).
- * This throwing stub exists solely so the pinned bootstrap CLI (which still
- * generates an `addTagPermission` wrapper) can resolve the import at build time;
- * it is never called. Delete once `PIKKU_CLI_VERSION` in the CLI build is bumped
- * past the release that removes tag permissions.
- */
-export const addTagPermission = (
-  _tag: string,
-  _permissions: CorePermissionGroup | CorePikkuPermission[],
-  _packageName: string | null = null
-): never => {
-  throw new Error(
-    'addTagPermission was removed in #972 — tag-level permissions no longer exist. Declare permissions on the function definition instead: pikkuFunc({ permissions }).'
-  )
-}
-
 const bucket = (
   packageName: string | null
 ): (CorePermissionGroup | CorePikkuPermission)[] =>
@@ -141,7 +139,7 @@ export const runPermissions = async ({
 }: {
   funcPermissions?: CorePermissionGroup | CorePikkuPermission[]
   services: CoreServices
-  wire: PikkuWire<any, never, any, CoreUserSession, never, never, never>
+  wire: PermissionWire
   data: any
   packageName?: string | null
   /** What the non-global gate is called in debug logs, e.g. 'function', 'agent'. */
@@ -188,14 +186,14 @@ export const checkAuthPermissions = async (
 
   const collect = (perm: CorePermissionGroup | CorePikkuPermission) => {
     if (typeof perm === 'function') {
-      if ((perm as any).__pikkuAuth) {
+      if ((perm as AuthBranded).__pikkuAuth) {
         authPerms.push(perm)
       }
     } else if (perm && typeof perm === 'object') {
       for (const funcs of Object.values(perm)) {
         const arr = Array.isArray(funcs) ? funcs : [funcs]
         for (const fn of arr) {
-          if (typeof fn === 'function' && (fn as any).__pikkuAuth) {
+          if (typeof fn === 'function' && (fn as AuthBranded).__pikkuAuth) {
             authPerms.push(fn)
           }
         }

package/src/pikku-state.ts

@@ -10,17 +10,29 @@ import type {
   MCPPromptMeta,
 } from './wirings/mcp/mcp.types.js'
 import type { AIAgentMeta } from './wirings/ai-agent/ai-agent.types.js'
+import type { ScorerMeta } from './wirings/ai-scorer/ai-scorer.types.js'
 import type { GatewaysMeta } from './wirings/gateway/gateway.types.js'
 import type { ScheduledTasksMeta } from './wirings/scheduler/scheduler.types.js'
 import type { TriggerMeta } from './wirings/trigger/trigger.types.js'
 
 const PIKKU_STATE_KEY = Symbol.for('@pikku/core/state')
 
+/**
+ * State is parked on `globalThis` under a registered symbol so separate copies
+ * of @pikku/core in one process share it. Typed once here rather than at each
+ * access.
+ */
+const stateHost = globalThis as unknown as {
+  [key: symbol]: Map<string, PikkuPackageState> | undefined
+}
+
 export const getAllPackageStates = (): Map<string, PikkuPackageState> => {
-  if (!(globalThis as any)[PIKKU_STATE_KEY]) {
-    ;(globalThis as any)[PIKKU_STATE_KEY] = new Map<string, PikkuPackageState>()
+  let states = stateHost[PIKKU_STATE_KEY]
+  if (!states) {
+    states = new Map<string, PikkuPackageState>()
+    stateHost[PIKKU_STATE_KEY] = states
   }
-  return (globalThis as any)[PIKKU_STATE_KEY] as Map<string, PikkuPackageState>
+  return states
 }
 
 export const pikkuState = <
@@ -107,6 +119,9 @@ const createEmptyPackageState = (): PikkuPackageState => ({
   agent: {
     agents: new Map(),
     agentsMeta: {} as AIAgentMeta,
+    scorers: new Map(),
+    scorersMeta: {} as ScorerMeta,
+    modelAliases: {},
   },
   gateway: {
     gateways: new Map(),
@@ -119,13 +134,13 @@ const createEmptyPackageState = (): PikkuPackageState => ({
   middleware: {
     tagGroup: {},
     httpGroup: {},
-    global: [] as any,
+    global: [],
   },
   channelMiddleware: {
     tagGroup: {},
   },
   permissions: {
-    global: [] as any,
+    global: [],
   },
   misc: {
     errors: new Map(),
@@ -140,6 +155,7 @@ const createEmptyPackageState = (): PikkuPackageState => ({
     authFactory: null,
     credentialsMeta: null,
     requiredParentServices: null,
+    declaredSecrets: null,
   },
 })
 
@@ -153,7 +169,7 @@ export const resetPikkuState = () => {
   // Error definitions come from module-import side effects that never re-run.
   const existingErrors = getAllPackageStates().get('__main__')?.misc.errors
 
-  ;(globalThis as any)[PIKKU_STATE_KEY] = new Map<string, PikkuPackageState>()
+  stateHost[PIKKU_STATE_KEY] = new Map<string, PikkuPackageState>()
   initializePikkuState('__main__')
 
   if (existingErrors) {