@pikku/core 0.12.80 → 0.12.83

package/dist/wirings/channel/index.js

@@ -1,9 +1,8 @@
-export { wireChannel, openChannel } from './channel-runner.js';
-export { addChannelMiddleware, combineChannelMiddleware, wrapChannelWithMiddleware, } from './channel-middleware-runner.js';
+export { wireChannel } from './channel-runner.js';
+export { addChannelMiddleware, combineChannelMiddleware, } from './channel-middleware-runner.js';
 export { logChannels } from './log-channels.js';
 export { PikkuAbstractChannelHandler } from './pikku-abstract-channel-handler.js';
 export { ChannelStore } from './channel-store.js';
 export { EventHubStore } from './eventhub-store.js';
 export { defineChannelRoutes } from './define-channel-routes.js';
-export { CHANNEL_RPC_PENDING, CHANNEL_RPC_REQUEST, CHANNEL_RPC_RESPONSE, ChannelDeploymentService, ChannelRPCError, ChannelRPCRegistry, createChannelRPCResponder, createChannelRPCInputValidator, createChannelRPCResultValidator, isChannelRPCPending, isChannelRPCRequest, isChannelRPCResponse, resolveCapability, unsupportedChannelRemote, } from './channel-rpc.js';
-export { channelRemote, getChannelHostRPC, handleChannelRPCResponse, releaseChannelHostRPC, } from './channel-host-rpc.js';
+export { ChannelDeploymentService, ChannelRPCError, ChannelRPCRegistry, unsupportedChannelRemote, } from './channel-rpc.js';

package/dist/wirings/channel/local/local-channel-runner.js

@@ -135,7 +135,14 @@ export const runLocalChannel = async ({ channelId, request, response, route, ski
             channelHandler.registerOnMessage(async (data) => {
                 try {
                     const result = await onMessage(data);
-                    await channel.send(result);
+                    // Guarded exactly as the connect path above is. A handler with nothing
+                    // to say is normal — a gateway websocket's generated message handler
+                    // always returns undefined — and sending that raised `send requires a
+                    // non-empty message`, which surfaced as a channel that accepted a
+                    // connection and then silently delivered nothing.
+                    if (result !== undefined) {
+                        await channel.send(result);
+                    }
                 }
                 catch (e) {
                     singletonServices.logger.error(e);

package/dist/wirings/cli/channel/cli-raw-channel-runner.js

@@ -1,4 +1,5 @@
 import { pikkuState } from '../../../pikku-state.js';
+import { isProduction } from '../../../env.js';
 import { parseCLIArguments, generateCommandHelp } from '../command-parser.js';
 import { runCLICommand } from '../cli-runner.js';
 /**
@@ -61,6 +62,13 @@ export async function handleRawCLI({ programName, args, singletonServices, creat
         // A command can throw anything; `.message` off a string is undefined, and
         // the run would then exit 1 saying nothing at all.
         const message = e instanceof Error ? e.message : String(e);
-        return { error: message || 'Command failed', exitCode: 1, commandId };
+        // The raw message can carry internals (a stack, a DB error, a path). This
+        // runs over a channel that may be remote, so return a generic error in
+        // production and keep the detail server-side. Dev keeps the message inline.
+        singletonServices.logger.error?.(`CLI channel command failed: ${message}`, e);
+        const clientError = isProduction()
+            ? 'Command failed'
+            : message || 'Command failed';
+        return { error: clientError, exitCode: 1, commandId };
     }
 }

package/dist/wirings/cli/channel/index.d.ts

@@ -2,6 +2,5 @@ export { executeCLIViaChannel } from './cli-channel-runner.js';
 export { handleRawCLI } from './cli-raw-channel-runner.js';
 export type { RawCLIFrame, RawCLIResult } from './cli-raw-channel-runner.js';
 export { executeRawCLIViaChannel } from './cli-raw-client-runner.js';
-export type { ClientCLIRenderServices, CorePikkuCLIClientRender, } from './cli-raw-client-runner.js';
-export { APPROVAL_FLAGS, approverForMode, createTerminalApprover, takeApprovalFlags, } from './cli-approval.js';
+export type { CorePikkuCLIClientRender, } from './cli-raw-client-runner.js';
 export type { ApprovalMode } from './cli-approval.js';

package/dist/wirings/cli/channel/index.js

@@ -1,4 +1,3 @@
 export { executeCLIViaChannel } from './cli-channel-runner.js';
 export { handleRawCLI } from './cli-raw-channel-runner.js';
 export { executeRawCLIViaChannel } from './cli-raw-client-runner.js';
-export { APPROVAL_FLAGS, approverForMode, createTerminalApprover, takeApprovalFlags, } from './cli-approval.js';

package/dist/wirings/cli/cli-runner.js

@@ -87,7 +87,19 @@ function registerCLICommands(commands, path = [], inheritedOptions = {}, program
                 programs[program].commandMiddleware[commandId] = command.middleware;
             }
         }
-        addFunction(funcName, unwrapFunc(command), currentMeta?.packageName);
+        // Merge the command-level auth/permissions into the registered config so
+        // they are actually enforced by the function runner. They were accepted by
+        // the types but dropped here, making a command's declared access control a
+        // silent no-op. Command-level wins over the handler's own, then falls back
+        // to it.
+        const unwrapped = unwrapFunc(command);
+        const commandAuth = typeof command === 'object' ? command.auth : undefined;
+        const commandPermissions = typeof command === 'object' ? command.permissions : undefined;
+        addFunction(funcName, {
+            ...unwrapped,
+            auth: commandAuth ?? unwrapped.auth,
+            permissions: commandPermissions ?? unwrapped.permissions,
+        }, currentMeta?.packageName);
         if (typeof command === 'object' && command.render) {
             if (programs[program]) {
                 programs[program].renderers[commandId] = command.render;

package/dist/wirings/credential/index.d.ts

@@ -1,3 +1,3 @@
 export { defineCredential } from './define-credential.js';
 export { validateAndBuildCredentialDefinitionsMeta } from './validate-credential-definitions.js';
-export type { CoreCredential, CredentialDefinitionMeta, CredentialDefinitionsMeta, CredentialDefinitions, } from './credential.types.js';
+export type { CoreCredential, CredentialDefinitionsMeta, CredentialDefinitions, } from './credential.types.js';

package/dist/wirings/gateway/index.d.ts

@@ -1,2 +1,2 @@
 export { wireGateway, createListenerMessageHandler, resolveGatewayAdapter, } from './gateway-runner.js';
-export type { GatewayAdapter, GatewayAdapterFactory, GatewayAttachment, GatewayInboundMessage, GatewayOutboundMessage, GatewayMeta, GatewaysMeta, GatewayTransportType, CoreGateway, PikkuGateway, WebhookVerificationResult, } from './gateway.types.js';
+export type { GatewayAdapter, GatewayAdapterFactory, GatewayInboundMessage, GatewayOutboundMessage, GatewaysMeta, GatewayTransportType, CoreGateway, WebhookVerificationResult, } from './gateway.types.js';

package/dist/wirings/http/http-runner.js

@@ -173,6 +173,7 @@ const executeRoute = async (services, matchedRoute, http, options) => {
         getSession: () => userSession.get(),
         hasSessionChanged: () => userSession.sessionChanged,
     };
+    const statusBeforeRoute = http?.response?.statusCode;
     try {
         result = await runPikkuFunc('http', `${meta.method}:${meta.route}`, meta.pikkuFuncId, {
             singletonServices,
@@ -209,17 +210,22 @@ const executeRoute = async (services, matchedRoute, http, options) => {
         http?.response?.flushHeaders?.();
     }
     else {
+        const statusSetByRoute = http?.response?.statusCode !== statusBeforeRoute;
         if (result instanceof Response) {
             await applyWebResponse(http.response, result);
         }
         else if (result === undefined || result === null) {
-            http?.response?.status(204);
+            if (!statusSetByRoute) {
+                http?.response?.status(204);
+            }
         }
         else if (route.returnsJSON === false) {
             http?.response?.arrayBuffer(result);
         }
         else {
-            http?.response?.status(200);
+            if (!statusSetByRoute) {
+                http?.response?.status(200);
+            }
             http?.response?.json(result);
         }
     }

package/dist/wirings/http/index.d.ts

@@ -1,8 +1,7 @@
 export { PikkuFetchHTTPRequest, DEFAULT_MAX_BODY_SIZE, } from './pikku-fetch-http-request.js';
-export type { PikkuFetchHTTPRequestOptions } from './pikku-fetch-http-request.js';
 export { PikkuFetchHTTPResponse } from './pikku-fetch-http-response.js';
 export { logRoutes } from './log-http-routes.js';
 export { fetch, fetchData, wireHTTP, addHTTPMiddleware } from './http-runner.js';
 export { wireHTTPRoutes, defineHTTPRoutes } from './http-routes.js';
 export { toWebRequest, applyWebResponse } from './web-request.js';
-export type { AssertHTTPWiringParams, CoreHTTPFunctionWiring, HTTPMethod, HTTPRouteBaseConfig, HTTPRouteContract, HTTPRouteMap, HTTPWiringsMeta, PikkuHTTPRequest, PikkuHTTPResponse, PikkuQuery, RunHTTPWiringOptions, } from './http.types.js';
+export type { AssertHTTPWiringParams, CoreHTTPFunctionWiring, HTTPMethod, HTTPRouteBaseConfig, HTTPRouteContract, HTTPRouteMap, HTTPWiringsMeta, PikkuHTTP, PikkuHTTPRequest, PikkuHTTPResponse, PikkuQuery, RunHTTPWiringOptions, } from './http.types.js';

package/dist/wirings/mcp/index.d.ts

@@ -1,4 +1,4 @@
 export { MCPEndpointRegistry } from './mcp-endpoint-registry.js';
 export { MCPError, wireMCPResource, wireMCPPrompt, runMCPResource, runMCPTool, runMCPPrompt, } from './mcp-runner.js';
 export { getMCPResourcesMeta, getMCPToolsMeta, getMCPPromptsMeta, } from './mcp-runner.js';
-export type { AssertMCPResourceURIParams, CoreMCPPrompt, CoreMCPResource, CoreMCPTool, MCPPromptResponse, MCPResourceMeta, MCPResourceResponse, MCPToolMeta, MCPToolResponse, MCPPromptMeta, PikkuMCP, } from './mcp.types.js';
+export type { AssertMCPResourceURIParams, CoreMCPPrompt, CoreMCPResource, MCPPromptResponse, MCPResourceMeta, MCPResourceResponse, MCPToolMeta, MCPToolResponse, MCPPromptMeta, PikkuMCP, } from './mcp.types.js';

package/dist/wirings/mcp/mcp-runner.d.ts

@@ -1,3 +1,4 @@
+import type { PikkuHTTP } from '../http/http.types.js';
 import type { CoreMCPResource, CoreMCPPrompt, JsonRpcRequest, JsonRpcResponse, JsonRpcErrorResponse, PikkuMCP } from './mcp.types.js';
 import type { CorePikkuFunctionConfig, CorePikkuFunctionSessionless } from '../../function/functions.types.js';
 export declare class MCPError extends Error {
@@ -6,6 +7,20 @@ export declare class MCPError extends Error {
 }
 export type RunMCPEndpointParams<Tools extends string = any> = {
     mcp?: PikkuMCP<Tools>;
+    /**
+     * The HTTP request the MCP call arrived on, when it arrived over HTTP.
+     *
+     * Auth middleware reads the session off `wire.http.request` — every
+     * implementation opens with `if (!http?.request) return` — so without this an
+     * MCP call reaches the function unauthenticated no matter what middleware the
+     * app has registered, and a tool fronting a session-requiring function can
+     * only ever answer 'Authentication required'.
+     *
+     * Left undefined for transports that have no request to offer, such as stdio.
+     * Those remain anonymous, which is a property of the transport rather than a
+     * default chosen here.
+     */
+    http?: PikkuHTTP;
     /** Defaults to enabled outside production. */
     exposeErrors?: boolean;
 };

package/dist/wirings/mcp/mcp-runner.js

@@ -48,6 +48,11 @@ export async function runMCPResource(request, params, uri) {
     let extractedParams = {};
     const metas = pikkuState(null, 'mcp', 'resourcesMeta');
     const endpoints = pikkuState(null, 'mcp', 'resources');
+    // The key the resource's meta (and its middleware) is stored under. For a
+    // templated resource this is the template, not the concrete request URI — so
+    // it must be carried forward, or the meta lookup downstream misses and the
+    // resource's declared middleware (including auth) is silently skipped.
+    let metaKey = uri;
     if (endpoints.has(uri)) {
         endpoint = endpoints.get(uri);
         pikkuFuncId = metas[uri]?.pikkuFuncId;
@@ -60,6 +65,7 @@ export async function runMCPResource(request, params, uri) {
             const match = uri.match(regex);
             if (match) {
                 endpoint = value;
+                metaKey = uriTemplate;
                 pikkuFuncId = metas[uriTemplate]?.pikkuFuncId;
                 for (let i = 0; i < paramNames.length; i++) {
                     extractedParams[paramNames[i]] = match[i + 1]; // match[0] is the full match
@@ -71,7 +77,7 @@ export async function runMCPResource(request, params, uri) {
     return await runMCPPikkuFunc({
         ...request,
         params: { ...request.params, ...extractedParams },
-    }, 'resource', uri, endpoint, pikkuFuncId, { ...params, mcp: { ...params.mcp, uri } });
+    }, 'resource', uri, endpoint, pikkuFuncId, { ...params, mcp: { ...params.mcp, uri } }, metaKey);
 }
 export async function runMCPTool(request, params, name) {
     const meta = pikkuState(null, 'mcp', 'toolsMeta')[name];
@@ -82,7 +88,11 @@ export async function runMCPPrompt(request, params, name) {
     const meta = pikkuState(null, 'mcp', 'promptsMeta')[name];
     return await runMCPPikkuFunc(request, 'prompt', name, endpoint, meta?.pikkuFuncId, params);
 }
-async function runMCPPikkuFunc(request, type, name, mcp, pikkuFuncId, { mcp: mcpWire, exposeErrors = !isProduction() }) {
+async function runMCPPikkuFunc(request, type, name, mcp, pikkuFuncId, { mcp: mcpWire, http, exposeErrors = !isProduction() }, 
+// The key the endpoint's meta is stored under. Differs from `name` only for a
+// templated resource, where `name` is the concrete URI and the meta lives
+// under the template. Defaults to `name` for tools and prompts.
+metaKey = name) {
     const singletonServices = getSingletonServices();
     const createWireServices = getCreateWireServices();
     try {
@@ -99,17 +109,20 @@ async function runMCPPikkuFunc(request, type, name, mcp, pikkuFuncId, { mcp: mcp
         const mcpSessionService = new PikkuSessionService(singletonServices.sessionStore);
         const wire = {
             mcp: mcpWire,
+            // Only when the transport supplied one. Setting `http: undefined`
+            // explicitly would be the same to a reader and different to a spread.
+            ...(http ? { http } : {}),
             ...createMiddlewareSessionWireProps(mcpSessionService),
         };
         let meta;
         if (type === 'resource') {
-            meta = pikkuState(null, 'mcp', 'resourcesMeta')[name];
+            meta = pikkuState(null, 'mcp', 'resourcesMeta')[metaKey];
         }
         else if (type === 'tool') {
-            meta = pikkuState(null, 'mcp', 'toolsMeta')[name];
+            meta = pikkuState(null, 'mcp', 'toolsMeta')[metaKey];
         }
         else if (type === 'prompt') {
-            meta = pikkuState(null, 'mcp', 'promptsMeta')[name];
+            meta = pikkuState(null, 'mcp', 'promptsMeta')[metaKey];
         }
         let resolvedFuncName = pikkuFuncId;
         let resolvedPackageName = meta?.packageName ?? null;

package/dist/wirings/persona/index.d.ts

@@ -1,12 +1,11 @@
 export { definePersonas } from './define-personas.js';
 export { isRunnablePersona, roleMismatchMessage, runnablePersonas, validateAndBuildPersonasMeta, verifyPersonaRoles, } from './validate-personas.js';
 export type { RoleVerification } from './validate-personas.js';
-export { personaEnvironmentErrors, personaEnvironmentRefusal, resolvePersonaEnvironments, } from './persona-environments.js';
+export { personaEnvironmentErrors, personaEnvironmentRefusal, } from './persona-environments.js';
 export type { PersonaEnvironment, PersonaEnvironmentSubject, } from './persona-environments.js';
-export { personaEmail, personaEmailLabel, personaEmails, } from './persona-email.js';
-export { allowedLinks, applyMailboxAllowlist, isAllowedSender, } from './persona-mailbox.js';
+export { personaEmail, personaEmails, } from './persona-email.js';
 export type { MailboxAllowlist, PersonaMailbox, ReceivedEmail, } from './persona-mailbox.js';
-export type { CorePersona, CorePersonaAccount, CorePersonas, PersonaAccountMeta, PersonaDefinitions, PersonaMeta, PersonasMeta, } from './persona.types.js';
+export type { CorePersona, CorePersonas, PersonaAccountMeta, PersonaDefinitions, PersonaMeta, PersonasMeta, } from './persona.types.js';
 /**
  * Signing in as a persona and talking to a stage over HTTP.
  *

package/dist/wirings/persona/index.js

@@ -1,8 +1,7 @@
 export { definePersonas } from './define-personas.js';
 export { isRunnablePersona, roleMismatchMessage, runnablePersonas, validateAndBuildPersonasMeta, verifyPersonaRoles, } from './validate-personas.js';
-export { personaEnvironmentErrors, personaEnvironmentRefusal, resolvePersonaEnvironments, } from './persona-environments.js';
-export { personaEmail, personaEmailLabel, personaEmails, } from './persona-email.js';
-export { allowedLinks, applyMailboxAllowlist, isAllowedSender, } from './persona-mailbox.js';
+export { personaEnvironmentErrors, personaEnvironmentRefusal, } from './persona-environments.js';
+export { personaEmail, personaEmails, } from './persona-email.js';
 /**
  * Signing in as a persona and talking to a stage over HTTP.
  *

package/dist/wirings/queue/index.d.ts

@@ -1,9 +1,7 @@
 export type { ConfigValidationResult, CoreQueueWorker, GroupConcurrencyConfig, JobGroup, JobOptions, PikkuJobConfig, PikkuWorkerConfig, PikkuQueue, QueueJob, QueueJobStatus, QueueService, QueueWorkers, QueueWorkersMeta, } from './queue.types.js';
-export { wireQueueWorker, runQueueJob, getQueueWorkers, removeQueueWorker, QueueJobDiscardedError, QueueJobFailedError, } from './queue-runner.js';
-export { QUEUE_IDENTITY_CLAIM_VERSION, QUEUE_IDENTITY_INFO, QUEUE_IDENTITY_SECRET_NAME, getQueueIdentitySecret, resolveQueueJobIdentity, signQueueIdentity, verifyQueueIdentity, } from './queue-identity.js';
+export { wireQueueWorker, runQueueJob, QueueJobDiscardedError, QueueJobFailedError, } from './queue-runner.js';
 export type { QueueIdentityBinding } from './queue-identity.js';
 export { SignedQueueService } from './signed-queue-service.js';
-export { validateWorkerConfig } from './validate-worker-config.js';
 export type { QueueConfigMapping } from './validate-worker-config.js';
 export { registerQueueWorkers } from './register-queue-helper.js';
 export type { QueueRegistrationCallback } from './register-queue-helper.js';

package/dist/wirings/queue/index.js

@@ -1,5 +1,3 @@
-export { wireQueueWorker, runQueueJob, getQueueWorkers, removeQueueWorker, QueueJobDiscardedError, QueueJobFailedError, } from './queue-runner.js';
-export { QUEUE_IDENTITY_CLAIM_VERSION, QUEUE_IDENTITY_INFO, QUEUE_IDENTITY_SECRET_NAME, getQueueIdentitySecret, resolveQueueJobIdentity, signQueueIdentity, verifyQueueIdentity, } from './queue-identity.js';
+export { wireQueueWorker, runQueueJob, QueueJobDiscardedError, QueueJobFailedError, } from './queue-runner.js';
 export { SignedQueueService } from './signed-queue-service.js';
-export { validateWorkerConfig } from './validate-worker-config.js';
 export { registerQueueWorkers } from './register-queue-helper.js';

package/dist/wirings/rpc/addon-runner.d.ts

@@ -4,6 +4,14 @@ export type AddonInstance = {
     secretOverrides?: Record<string, string>;
     variableOverrides?: Record<string, string>;
     credentialOverrides?: Record<string, string>;
+    /** Set by the consuming app: secrets it lends this instance, as the addon names them. */
+    secretGrants?: string[];
+    /** Set by the consuming app: credentials it lends this instance, as the addon names them. */
+    credentialGrants?: string[];
+    /** Set by the consuming app to opt this instance out of secret scoping. */
+    globalSecrets?: string;
+    /** Set by the consuming app to opt this instance out of credential scoping. */
+    globalCredentials?: string;
 };
 export declare const getOrCreatePackageSingletonServices: (packageName: string, parentServices: CoreSingletonServices, addonInstance?: AddonInstance) => Promise<CoreSingletonServices>;
 export declare const addonInstanceForNamespace: (namespace: string | undefined, expectedPackage: string) => AddonInstance | undefined;

package/dist/wirings/rpc/addon-runner.js

@@ -1,4 +1,16 @@
 import { pikkuState } from '../../pikku-state.js';
+import { ScopedSecretService } from '../../services/scoped-secret-service.js';
+import { ScopedCredentialService } from '../../services/scoped-credential-service.js';
+/**
+ * What the addon declared, plus what the host lent it. Scoping runs outside the
+ * aliaser, so every name here is the one the addon reads — which is why an
+ * override's *key* grants, and its value does not.
+ */
+const allowedNames = (declared, grants, overrides) => new Set([
+    ...(declared ?? []),
+    ...(grants ?? []),
+    ...Object.keys(overrides ?? {}),
+]);
 const aliasSecretService = (secrets, overrides) => {
     const map = (key) => overrides[key] ?? key;
     return {
@@ -79,9 +91,6 @@ export const getOrCreatePackageSingletonServices = async (packageName, parentSer
         return cachedServices;
     }
     const factories = pikkuState(packageName, 'package', 'factories');
-    if (!factories || !factories.createSingletonServices) {
-        return parentServices;
-    }
     let existingServices = parentServices;
     if (addonInstance?.secretOverrides && parentServices.secrets) {
         existingServices = {
@@ -95,6 +104,21 @@ export const getOrCreatePackageSingletonServices = async (packageName, parentSer
             variables: aliasVariablesService(parentServices.variables, addonInstance.variableOverrides),
         };
     }
+    if (!addonInstance?.globalSecrets && existingServices.secrets) {
+        existingServices = {
+            ...existingServices,
+            secrets: new ScopedSecretService(existingServices.secrets, allowedNames(pikkuState(packageName, 'package', 'declaredSecrets'), addonInstance?.secretGrants, addonInstance?.secretOverrides)),
+        };
+    }
+    if (!addonInstance?.globalCredentials && existingServices.credentialService) {
+        existingServices = {
+            ...existingServices,
+            credentialService: new ScopedCredentialService(existingServices.credentialService, allowedNames(Object.keys(pikkuState(packageName, 'package', 'credentialsMeta') ?? {}), addonInstance?.credentialGrants, addonInstance?.credentialOverrides)),
+        };
+    }
+    if (!factories || !factories.createSingletonServices) {
+        return existingServices;
+    }
     let config = existingServices.config;
     if (factories.createConfig) {
         config = await factories.createConfig(existingServices.variables);
@@ -118,5 +142,9 @@ export const addonInstanceForNamespace = (namespace, expectedPackage) => {
         secretOverrides: cfg.secretOverrides,
         variableOverrides: cfg.variableOverrides,
         credentialOverrides: cfg.credentialOverrides,
+        secretGrants: cfg.secretGrants,
+        credentialGrants: cfg.credentialGrants,
+        globalSecrets: cfg.globalSecrets,
+        globalCredentials: cfg.globalCredentials,
     };
 };

package/dist/wirings/rpc/rpc-runner.js

@@ -203,6 +203,10 @@ export class ContextAwareRPCService {
                 secretOverrides: resolved.addonConfig?.secretOverrides,
                 variableOverrides: resolved.addonConfig?.variableOverrides,
                 credentialOverrides: resolved.addonConfig?.credentialOverrides,
+                secretGrants: resolved.addonConfig?.secretGrants,
+                credentialGrants: resolved.addonConfig?.credentialGrants,
+                globalSecrets: resolved.addonConfig?.globalSecrets,
+                globalCredentials: resolved.addonConfig?.globalCredentials,
             },
         };
     }

package/dist/wirings/rpc/rpc-types.d.ts

@@ -48,6 +48,14 @@ export interface ResolvedFunction {
         secretOverrides?: Record<string, string>;
         variableOverrides?: Record<string, string>;
         credentialOverrides?: Record<string, string>;
+        /** Set by the consuming app: secrets it lends this instance, as the addon names them */
+        secretGrants?: string[];
+        /** Set by the consuming app: credentials it lends this instance, as the addon names them */
+        credentialGrants?: string[];
+        /** Set by the consuming app: hand this instance the unscoped `SecretService` */
+        globalSecrets?: string;
+        /** Set by the consuming app: hand this instance the unscoped `CredentialService` */
+        globalCredentials?: string;
         /** Set by `wireRemoteAddon`: dispatch this namespace's RPCs over HTTP */
         remote?: boolean;
         serverUrl?: string | ((services: any) => string | Promise<string>);

package/dist/wirings/rpc/wire-addon.d.ts

@@ -11,6 +11,31 @@ export type WireAddonConfig = {
     secretOverrides?: Record<string, string>;
     variableOverrides?: Record<string, string>;
     credentialOverrides?: Record<string, string>;
+    /**
+     * Secrets this instance may read on top of the ones it declared, named as the
+     * addon reads them — the scope check runs before `secretOverrides` renames
+     * them, so an overridden secret is named here by its addon-side key. Listing
+     * one in `secretOverrides` grants it too.
+     *
+     * For an addon whose secret names come off its input rather than its own
+     * source, this is how the host lends names the addon could not declare.
+     */
+    secretGrants?: string[];
+    /** Credentials this instance may read on top of the ones it declared. */
+    credentialGrants?: string[];
+    /**
+     * Hands this instance the whole `SecretService` instead of one scoped to the
+     * secrets it declared. The value is the reason, recorded in the deploy
+     * manifest — an addon that names secrets at runtime cannot be scoped, and
+     * only the consuming app, never the addon, can grant it.
+     */
+    globalSecrets?: string;
+    /**
+     * Hands this instance the whole `CredentialService` instead of one narrowed
+     * to the credentials it declared. The value is the reason, recorded in the
+     * deploy manifest, and only the consuming app can grant it.
+     */
+    globalCredentials?: string;
 };
 export declare const wireAddon: (config: WireAddonConfig) => void;
 /**

package/dist/wirings/rpc/wire-addon.js

@@ -16,6 +16,14 @@ export const wireAddon = (config) => {
         ...(config.credentialOverrides
             ? { credentialOverrides: config.credentialOverrides }
             : {}),
+        ...(config.secretGrants ? { secretGrants: config.secretGrants } : {}),
+        ...(config.credentialGrants
+            ? { credentialGrants: config.credentialGrants }
+            : {}),
+        ...(config.globalSecrets ? { globalSecrets: config.globalSecrets } : {}),
+        ...(config.globalCredentials
+            ? { globalCredentials: config.globalCredentials }
+            : {}),
     });
 };
 /**

package/dist/wirings/scheduler/index.d.ts

@@ -1,3 +1,3 @@
 export { runScheduledTask, wireScheduler, getScheduledTasks, } from './scheduler-runner.js';
 export { logSchedulers } from './log-schedulers.js';
-export type { CoreScheduledTask, ScheduledTasksMeta, PikkuScheduledTask, } from './scheduler.types.js';
+export type { CoreScheduledTask, ScheduledTasksMeta, } from './scheduler.types.js';

package/dist/wirings/trigger/index.d.ts

@@ -1,3 +1,3 @@
 export { wireTrigger, wireTriggerSource } from './trigger-runner.js';
 export { PikkuTriggerService } from './pikku-trigger-service.js';
-export type { TriggerMeta, TriggerSourceMeta, CorePikkuTriggerFunction, CorePikkuTriggerFunctionConfig, CoreTrigger, PikkuTrigger, } from './trigger.types.js';
+export type { TriggerMeta, TriggerSourceMeta, CorePikkuTriggerFunction, CorePikkuTriggerFunctionConfig, CoreTrigger, } from './trigger.types.js';

package/dist/wirings/virtual-user/index.d.ts

@@ -16,15 +16,14 @@
  * {@link VirtualUserTarget}, which in production is an `HttpPersona`
  * signed in as a real user against staging or production.
  */
-export type { ApiCatalogueEntry, IntentRecord, IntentSource, IntentStatus, StepRecord, VirtualUserAction, VirtualUserBudget, VirtualUserDisposition, VirtualUserFinding, VirtualUserFindingKind, VirtualUserRunResult, VirtualUserTally, VirtualUserTarget, } from './virtual-user.types.js';
+export type { ApiCatalogueEntry, IntentSource, VirtualUserDisposition, VirtualUserFinding, VirtualUserRunResult, VirtualUserTarget, } from './virtual-user.types.js';
 export { PRODUCTION_DISPOSITION } from './virtual-user.types.js';
-export { runVirtualUser, rememberIds, type RunVirtualUserParams, type VirtualUserCallContext, } from './run-virtual-user.js';
+export { runVirtualUser, type RunVirtualUserParams, } from './run-virtual-user.js';
 export { personaScopes, prepareVirtualUserRun, type VirtualUserPreparation, } from './prepare-virtual-user-run.js';
 export type { VirtualUserRunOutcome, VirtualUserRunRecord, VirtualUserRunStart, VirtualUserRunStore, } from './virtual-user-run-store.js';
 export { DISPOSITIONS, dispositionProfile, type DispositionProfile, type VirtualUserTuning, } from './virtual-user-dispositions.js';
-export { catalogueClassification, catalogueIndex, catalogueLookup, describeEntry, isReadOnly, reachableCatalogue, renderCatalogue, unreachableCatalogue, } from './virtual-user-catalogue.js';
-export { reachableAgents, type AgentReachability, type ReachableAgent, } from './virtual-user-agents.js';
-export { IntentStack, intentsForPersona, type IntentMove, type ScheduledTick, } from './virtual-user-intents.js';
-export { createRng, type VirtualUserRng } from './virtual-user-rng.js';
+export { catalogueClassification, catalogueLookup, isReadOnly, reachableCatalogue, unreachableCatalogue, } from './virtual-user-catalogue.js';
+export { type AgentReachability, type ReachableAgent, } from './virtual-user-agents.js';
+export { IntentStack, intentsForPersona, } from './virtual-user-intents.js';
 export { deriveCatalogue, deriveIntents, type SchemaMap, } from './virtual-user-derive.js';
 export { personaVirtualUserTarget, type PersonaTargetOptions, } from './virtual-user-target.js';

package/dist/wirings/virtual-user/index.js

@@ -1,10 +1,8 @@
 export { PRODUCTION_DISPOSITION } from './virtual-user.types.js';
-export { runVirtualUser, rememberIds, } from './run-virtual-user.js';
+export { runVirtualUser, } from './run-virtual-user.js';
 export { personaScopes, prepareVirtualUserRun, } from './prepare-virtual-user-run.js';
 export { DISPOSITIONS, dispositionProfile, } from './virtual-user-dispositions.js';
-export { catalogueClassification, catalogueIndex, catalogueLookup, describeEntry, isReadOnly, reachableCatalogue, renderCatalogue, unreachableCatalogue, } from './virtual-user-catalogue.js';
-export { reachableAgents, } from './virtual-user-agents.js';
+export { catalogueClassification, catalogueLookup, isReadOnly, reachableCatalogue, unreachableCatalogue, } from './virtual-user-catalogue.js';
 export { IntentStack, intentsForPersona, } from './virtual-user-intents.js';
-export { createRng } from './virtual-user-rng.js';
 export { deriveCatalogue, deriveIntents, } from './virtual-user-derive.js';
 export { personaVirtualUserTarget, } from './virtual-user-target.js';