@pikku/core 0.12.80 → 0.12.83

package/knowledge/decisions/security/a-workflow-run-is-read-and-approved-by-its-owner.md

@@ -1,11 +1,11 @@
 ---
 type: decision
-title: A workflow run is read and approved by its owner
-description: A run started through a session records that user and only that user may read it or answer its approval gates; a run with no recorded owner has no ownership to enforce
+title: A workflow run is read by its owner, and answered by whoever its gate declares
+description: A run started through a session records that user and only that user may read it; who may answer an approval gate is the gate's own declaration, and a run with no recorded owner has no ownership to enforce
 tags: workflow
 ---
 
-# A workflow run is read and approved by its owner
+# A workflow run is read by its owner, and answered by whoever its gate declares
 
 `WorkflowRunWire.pikkuUserId` has always been recorded on every run started
 through a session — `RPCService.startWorkflow` copies it off the wire — and
@@ -14,9 +14,9 @@ routes (which stream `output` and `error`) and `approveStep`, which took no
 session at all and rejected only an already-resolved gate.
 
 `assertWorkflowRunOwner`
-(`packages/core/src/wirings/workflow/workflow-run-ownership.ts`) is the one check
-both paths share. `approveStep` takes the caller's session and asserts it, and
-the generated status routes assert it against the run they were already reading.
+(`packages/core/src/wirings/workflow/workflow-run-ownership.ts`) is the check the
+**read** paths share: the generated status routes assert it against the run they
+were already reading.
 
 **A run with no recorded owner is not gated.** Triggers, schedulers and routes
 wired without auth start runs with no `pikkuUserId`; there is nobody to compare a
@@ -24,11 +24,27 @@ caller against, and inventing one would reject the framework's own callers rathe
 than secure anything. Gate those at the entrypoint with `auth` or `permissions`.
 
 This is ownership, not an approver model. It answers "is this your run", not "are
-you entitled to approve this particular gate" — `WorkflowApprovalOptions` still
-carries no approver, role or permission, and a second approver on someone else's
-run is still a matter for the route's own `permissions`.
-
-**What this rules out:** treating a run id as a capability, and adding a new run
-read path that does not take a session. It does not rule out a richer approver
-model on `WorkflowApprovalOptions` later; that would narrow this gate, never
-replace it.
+you entitled to approve this particular gate".
+
+## Approving is a separate question, and the gate answers it
+
+`approveStep` originally shared `assertWorkflowRunOwner`, which made "only the
+initiator may answer" the one available rule. That is right for "confirm your own
+action" and exactly wrong for four-eyes sign-off, where the initiator is the one
+person who must not sign. Which applies is a property of the decision, so it is
+declared on the gate — `approvers` (`'any' | 'owner' | 'not-initiator'`) and
+`approverScope` on `WorkflowApprovalOptions`.
+
+It is enforced wherever the policy is known. Reaching the gate publishes the
+policy into the run state, so a decision submitted after that is judged by the
+approve entrypoint and refused with a 403. A decision can legitimately be
+recorded before the run has reached the gate, and that one has no policy to be
+judged against yet — it is judged on replay instead, alongside payload
+validation, and discarded if it fails.
+
+The default is therefore `any`: a gate is a pause for a decision, not an
+authorization boundary, and a route that needs one has `auth`/`permissions`.
+
+**What this rules out:** treating a run id as a capability, adding a new run read
+path that does not take a session, and re-deriving who may approve from who
+started the run.

package/knowledge/decisions/security/an-approval-answer-outlives-the-run-it-answered.md

@@ -0,0 +1,59 @@
+---
+type: decision
+title: An approval answer outlives the run it answered
+description: Run state holds a decision only while the gate is open, so the settled answer carries decidedBy/decidedAt into the step result and every attempt is written to the audit sink, which has no foreign key to the run
+tags: workflow, audit
+---
+
+# An approval answer outlives the run it answered
+
+An approval gate is asked for so it can be answered for afterwards. "Who
+released the funds" is the entire point of four-eyes sign-off, and until this
+change none of it was kept.
+
+Run state is where a decision *waits*, not where it is kept. The record under
+`workflowRuns.state.__approval_<hex>` is overwritten by the next write to that
+key, and cleared outright — `decidedBy: undefined` included — whenever a
+decision is refused on replay. A trail that erases exactly the events worth
+keeping is not a trail.
+
+So the answer is recorded twice, in two places with different lifetimes.
+
+## The settled decision keeps its provenance
+
+`ApprovalOutcome<T>` carries `decidedBy` and `decidedAt` alongside `data`, so
+the answer reaches `workflowStep.result` and, through it,
+`workflowStepHistory` — append-only, and already the per-step event log. Both
+are spread in only when present, so a gate answered without a session keeps the
+shape it had before there was anything to record.
+
+## The audit sink is what survives deletion
+
+`deleteRun` cascades: `workflowStep` is `onDelete('cascade')` from
+`workflowRuns`, and `workflowStepHistory` from `workflowStep`. Deleting a run
+therefore deletes the sign-off with it — and a *refused* attempt never reaches a
+step at all, so it was never in that trail to begin with.
+
+Every answer — accepted, refused at submission, or cleared on replay — is
+written to the `AuditService` as `workflow.approval.decided`, with
+`outcome: 'success' | 'denied'`, the decider under `userIdentity.pikkuUserId`,
+and the run, reason, scopes and refusal in `metadata`. The `audit` table holds
+no foreign key to any workflow table, which is precisely why it is the right
+home.
+
+`auditApprovalDecision`
+(`packages/core/src/wirings/workflow/workflow-approval-audit.ts`) is a module of
+its own rather than a method on `PikkuWorkflowService`: the trail is a separate
+concern from running the workflow, and the service is already at the 2000-line
+limit `source-files-stay-composable.test.ts` enforces.
+
+**A sink that fails is logged, never thrown.** The trail must not be the reason a
+decision is lost. A project with no `audit` service wired records nothing and is
+otherwise unaffected — the sink is opt-in, and `auditSchema` is deliberately not
+in `pikkuSchemas`.
+
+**What this rules out:** a dedicated `workflowApprovals` table. It would have to
+be implemented in all seven backends and would still be deleted with the run
+unless it deliberately broke the cascade — at which point it is the audit table
+with extra steps. If approvals later need to be *queried* as a first-class
+entity rather than read back from the trail, that is when to revisit.

package/knowledge/decisions/security/index.md

@@ -10,11 +10,12 @@ A rule about who may do what, and which way it fails when it is unsure.
 
 <!-- pikku:knowledge-index -->
 - [A dropped audit write is always logged](a-dropped-audit-write-is-always-logged.md) — The no-op audit service falls back to the singleton logger when the wire carries none, so an unconfigured audit call is never silent
+- [A function never receives the secret service](a-function-never-receives-the-secret-service.md) — Every function-, permission- and auth-facing services type is bounded by SecretlessServices, so reaching for `secrets` in a function body is a type error rather than a lint
 - [A graph run starts at an entry node the graph declared](a-graph-run-starts-at-an-entry-node-the-graph-declared.md) — startNode may only name a node in meta.entryNodeIds, and no generated route offers it, because otherwise a caller picks which half of the graph to skip
 - [A permission gets a wire it cannot reply on](a-permission-gets-a-wire-it-cannot-reply-on.md) — The permission wire is typed with Out = never so a permission cannot send on the channel; that narrowing is not a subtype, so the call site asserts
 - [A step runs the function the workflow dispatched it with](a-step-runs-the-function-the-workflow-dispatched-it-with.md) — StepState records the step's function name so the worker can reject a queue message naming a different one, because the step executes under the run owner's identity
 - [A virtual user is never offered a scenario, platform or addon step](a-virtual-user-is-never-offered-a-step-that-would-forge-its-own-oracle.md) — Being able to invoke "the webhook arrives" lets the user manufacture the outcome it exists to discover, which invalidates every finding downstream
-- [A workflow run is read and approved by its owner](a-workflow-run-is-read-and-approved-by-its-owner.md) — A run started through a session records that user and only that user may read it or answer its approval gates; a run with no recorded owner has no ownership to enforce
+- [A workflow run is read by its owner, and answered by whoever its gate declares](a-workflow-run-is-read-and-approved-by-its-owner.md) — A run started through a session records that user and only that user may read it; who may answer an approval gate is the gate's own declaration, and a run with no recorded owner has no ownership to enforce
 - [An actor's missing approval decision defaults to denied](actor-flow-missing-approval-decisions-default-to-denied.md) — Every pending tool call gets an explicit decision; an id the persona LLM omitted is denied, so a dropped field can never read as consent
 - [Actor sign-in is proven by Set-Cookie, not a non-empty jar](actor-sign-in-is-proven-by-set-cookie-not-a-non-empty-jar.md) — HttpScenarioActor tracks its own signedIn flag and requires the sign-in response itself to set a cookie, because a populated jar proves nothing
 - [Actor sign-in only works for actor-flagged users](actor-sign-in-only-works-for-actor-flagged-users.md) — The scenario actor secret mints sessions for user rows flagged actor and nothing else, so holding it never impersonates a real user
@@ -30,6 +31,7 @@ A rule about who may do what, and which way it fails when it is unsure.
 - [An agent thread key is always prefixed with the trusted principal](ai-agent-thread-ownership-composes-the-session-principal.md) — Ownership keys are composed as principal:resourceId, so a client id can sub-divide its own boundary but never widen it
 - [Agent tool permission filtering reads the live function config, not the metadata](ai-agent-tool-filtering-reads-the-live-function-config.md) — The pikkuAuth brand survives only on live permission objects, so a metadata-driven check would silently admit every gated tool
 - [An agent approval is claimed before the tool runs](an-agent-approval-is-claimed-before-the-tool-runs.md) — resolveApproval is a compare-and-swap returning whether this caller won, because the read that precedes it is not a claim and ten concurrent approvals would otherwise mean ten refunds
+- [An approval answer outlives the run it answered](an-approval-answer-outlives-the-run-it-answered.md) — Run state holds a decision only while the gate is open, so the settled answer carries decidedBy/decidedAt into the step result and every attempt is written to the audit sink, which has no foreign key to the run
 - [An empty owners constraint matches nothing](an-empty-owners-constraint-matches-nothing.md) — owners is an authorization boundary, so every storage backend must treat [] as no rows rather than no filter
 - [An exposed function with no gate is reported at codegen, not at boot](an-exposed-ungated-function-is-a-codegen-warning.md) — The check runs in the inspector where function meta and every wireAddon declaration are both in hand, because neither source alone can tell a gated function from an ungated one
 - [An upload is counted as it arrives, not buffered and then measured](an-upload-is-counted-as-it-arrives-not-buffered-then-measured.md) — Reading the whole body before checking its size hands an unauthenticated caller a way to spend the server's memory

package/knowledge/questions/index.md

@@ -12,5 +12,5 @@ gets recorded.
 
 <!-- pikku:knowledge-index -->
 - [A channel's middleware list accepts bare factories that nothing ever resolves](channel-middleware-accepts-bare-factories-that-nothing-resolves.md) — CoreChannel.channelMiddleware admits CorePikkuChannelMiddlewareFactory, but no runner calls one, so a bare factory would stall the chain
-- [An unauthorized channel reply is sent outside the channel's declared Out type](unauthorized-channel-replies-escape-the-declared-out-type.md) — processMessageHandlers sends a bare string on auth failure that no generated client type admits, and the alternatives were never worked through
+- [An unauthorized channel reply is sent outside the channel's declared Out type](unauthorized-channel-replies-escape-the-declared-out-type.md) — processMessageHandlers sends a bare string on auth failure, which no generated client type admits — nobody has decided what the typed shape should be
 <!-- /pikku:knowledge-index -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/core",
-  "version": "0.12.80",
+  "version": "0.12.83",
   "description": "The Pikku runtime — functions, wirings, services, middleware and types",
   "author": "yasser.fadl@gmail.com",
   "license": "MIT",
@@ -22,6 +22,7 @@
     "./dist/errors/errors.js",
     "./dist/wirings/rpc/rpc-runner.js",
     "./dist/wirings/rpc/remote-addon-auth.js",
+    "./dist/wirings/workflow/workflow-approval-policy.js",
     "./dist/wirings/workflow/workflow-errors.js",
     "./dist/wirings/workflow/workflow-run-ownership.js",
     "./dist/wirings/workflow/pikku-scenario-service.js"
@@ -49,6 +50,7 @@
     "./node-host-resolver": "./dist/utils/node-host-resolver.js",
     "./mcp": "./dist/wirings/mcp/index.js",
     "./ai-agent": "./dist/wirings/ai-agent/index.js",
+    "./ai-scorer": "./dist/wirings/ai-scorer/index.js",
     "./gateway": "./dist/wirings/gateway/index.js",
     "./cli": "./dist/wirings/cli/index.js",
     "./cli/command-parser": "./dist/wirings/cli/command-parser.js",
@@ -72,7 +74,6 @@
     "./crypto-utils": "./dist/crypto-utils.js",
     "./hmac": "./dist/utils/hmac.js",
     "./ecosystem": "./dist/ecosystem.js",
-    "./internal": "./dist/ecosystem.js",
     "./schema": "./dist/schema.js",
     "./testing": "./dist/testing/index.js",
     "./dev": "./dist/dev/hot-reload.js"

package/scripts/generate-api-report.mts

@@ -16,6 +16,10 @@
  * disagree — so a member-level change is a reviewable diff rather than a
  * surprise in someone else's CI.
  *
+ * A member per line, and no member bodies. Both are load-bearing rather than
+ * cosmetic: the report exists to be diffed, and a class emitted as one long
+ * line of its own source is neither reviewable nor mergeable.
+ *
  * Run: yarn api-report
  */
 import { readFileSync, writeFileSync } from 'node:fs'
@@ -50,7 +54,132 @@ const program = ts.createProgram(
 )
 const checker = program.getTypeChecker()
 
-/** One line per symbol: how it is declared, flattened and stripped of noise. */
+/** Comments are noise in a report the diff is read for. */
+const stripComments = (text: string): string =>
+  text.replace(/\/\*[\s\S]*?\*\//g, '').replace(/\/\/[^\n]*/g, '')
+
+/**
+ * Punctuation that makes a line and its successor one thing.
+ *
+ * Read from both ends rather than one, because the closers are ambiguous from
+ * behind: `string[]`, `Promise<T>` and `= {}` all end in a closing bracket and
+ * none of them is a continuation. What the *next* line starts with is not.
+ */
+const CONTINUES = /(=>|[,;{([<|&=])$/
+const CLOSES = /^(=>|extends\b|[}\])>,;|&])/
+
+/**
+ * A member's own text on one line — long, but never long enough to matter.
+ *
+ * Inside an object type the author's newline *was* the separator, so collapsing
+ * without restoring it produces `{ a: string b: number }`, which is not the
+ * type it describes and does not parse in the ```ts fence it is printed into.
+ */
+const oneLine = (text: string): string => {
+  const lines = stripComments(text)
+    .split('\n')
+    .map((l) => l.trim())
+    .filter(Boolean)
+  let depth = 0
+  const joined = lines
+    .map((line, index) => {
+      const inObjectType = depth > 0
+      for (const character of line) {
+        if (character === '{') depth++
+        else if (character === '}') depth--
+      }
+      const next = lines[index + 1]
+      return inObjectType &&
+        next !== undefined &&
+        !CONTINUES.test(line) &&
+        !CLOSES.test(next)
+        ? `${line};`
+        : line
+    })
+    .join(' ')
+  return joined.replace(/\(\s+/g, '(').replace(/\s+\)/g, ')')
+}
+
+/**
+ * A class member as a consumer sees it: the signature, and nothing after it.
+ *
+ * The body is where every character of this report used to come from — a class
+ * arrived as its own source, so the report promised implementation details and
+ * a one-word change to a method rewrote the whole declaration. Truncating at
+ * the body leaves exactly the part a compatibility promise covers.
+ */
+const memberSignature = (member: ts.ClassElement | ts.TypeElement): string => {
+  const source = member.getSourceFile().text
+  const start = member.getStart()
+
+  const body = (member as { body?: ts.Node }).body
+  if (body) {
+    const head = oneLine(source.slice(start, body.getStart())).replace(
+      /\s*$/,
+      ''
+    )
+    // An inferred return type is still a return type a consumer depends on, and
+    // truncating at the body is what threw the author's away.
+    if (ts.isMethodDeclaration(member) || ts.isGetAccessorDeclaration(member)) {
+      const signature = member.type
+        ? undefined
+        : checker.getSignatureFromDeclaration(member)
+      if (signature) {
+        const returns = checker.getReturnTypeOfSignature(signature)
+        return `${head}: ${checker.typeToString(returns, undefined, ts.TypeFormatFlags.NoTruncation)}`
+      }
+    }
+    return head
+  }
+
+  // A property's initializer is a body by another name. Its annotation stands in
+  // for it, and the checker supplies one when the author left it inferred.
+  if (ts.isPropertyDeclaration(member) && member.initializer) {
+    if (member.type) return oneLine(source.slice(start, member.type.end))
+    const type = checker.getTypeAtLocation(member)
+    return `${oneLine(source.slice(start, member.name.end))}: ${checker.typeToString(type, undefined, ts.TypeFormatFlags.NoTruncation)}`
+  }
+
+  return oneLine(member.getText())
+}
+
+/** Members a consumer can reach, so a private field is not a promise. */
+const isPublic = (member: ts.ClassElement | ts.TypeElement): boolean =>
+  !(ts.getModifiers(member as ts.HasModifiers) ?? []).some(
+    (modifier) => modifier.kind === ts.SyntaxKind.PrivateKeyword
+  ) && !(member.name && ts.isPrivateIdentifier(member.name))
+
+/**
+ * A declaration with members, one member per line.
+ *
+ * The line break is the point. Two branches that touch different methods of the
+ * same class are a textual conflict when the class is one line and an ordinary
+ * merge when it is not, which is a tax the whole repo was paying: every rebase
+ * over this file stopped to re-resolve a forty-thousand-character line by hand.
+ */
+const membered = (
+  declaration:
+    | ts.ClassDeclaration
+    | ts.InterfaceDeclaration
+    | ts.EnumDeclaration,
+  members: ts.NodeArray<ts.ClassElement | ts.TypeElement | ts.EnumMember>
+): string => {
+  if (members.length === 0) return oneLine(declaration.getText())
+  const source = declaration.getSourceFile().text
+  // `members.pos` is the offset just past the `{`, so the header comes with its
+  // own brace and needs no reassembling.
+  const header = oneLine(source.slice(declaration.getStart(), members.pos))
+  const lines = ts.isEnumDeclaration(declaration)
+    ? (members as readonly ts.EnumMember[]).map(
+        (member) => `${oneLine(member.getText())},`
+      )
+    : (members as readonly (ts.ClassElement | ts.TypeElement)[])
+        .filter(isPublic)
+        .map(memberSignature)
+  return [header, ...lines.map((line) => `  ${line}`), '}'].join('\n')
+}
+
+/** How a symbol is declared, in as many lines as its members need. */
 const signature = (exported: ts.Symbol): string => {
   // A re-export is an alias; the declaration that matters is the target's, so
   // an interface re-exported through a barrel still reports its members.
@@ -62,20 +191,21 @@ const signature = (exported: ts.Symbol): string => {
   if (!declaration) return exported.getName()
 
   if (
-    ts.isInterfaceDeclaration(declaration) ||
     ts.isClassDeclaration(declaration) ||
-    ts.isTypeAliasDeclaration(declaration) ||
+    ts.isInterfaceDeclaration(declaration) ||
     ts.isEnumDeclaration(declaration)
   ) {
-    // The declaration itself, so member changes show up in the diff.
-    return declaration
-      .getText()
-      .replace(/\/\*\*[\s\S]*?\*\//g, '')
-      .replace(/\/\/[^\n]*/g, '')
+    return membered(declaration, declaration.members)
+  }
+
+  if (ts.isTypeAliasDeclaration(declaration)) {
+    // No members to walk, so the author's own line breaks are the ones that
+    // keep a long union reviewable.
+    return stripComments(declaration.getText())
       .split('\n')
-      .map((l) => l.trim())
-      .filter(Boolean)
-      .join(' ')
+      .map((l) => l.trimEnd())
+      .filter((l) => l.trim())
+      .join('\n')
   }
 
   const type = checker.getTypeOfSymbolAtLocation(symbol, declaration)
@@ -92,17 +222,12 @@ const ECOSYSTEM_SUBPATHS = new Set(['./ecosystem', './internal'])
 
 type Exported = { name: string; members: number; signature: string }
 
-/** Members a consumer can reach, so a private field is not a promise. */
+/** The members the report lists, which is what the tally is counting. */
 const memberCount = (declaration: ts.Declaration): number => {
   if (ts.isInterfaceDeclaration(declaration)) return declaration.members.length
   if (ts.isEnumDeclaration(declaration)) return declaration.members.length
   if (!ts.isClassDeclaration(declaration)) return 0
-  return declaration.members.filter(
-    (member) =>
-      !(ts.getModifiers(member) ?? []).some(
-        (modifier) => modifier.kind === ts.SyntaxKind.PrivateKeyword
-      ) && !(member.name && ts.isPrivateIdentifier(member.name))
-  ).length
+  return declaration.members.filter(isPublic).length
 }
 
 const modules = new Map<string, Exported[]>()

package/src/api-report.test.ts

@@ -1,7 +1,7 @@
 import { describe, test } from 'node:test'
 import assert from 'node:assert/strict'
 import { execFileSync } from 'node:child_process'
-import { readFileSync } from 'node:fs'
+import { readFileSync, writeFileSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'
 import { join, dirname } from 'node:path'
 
@@ -39,7 +39,7 @@ describe('the API report matches the code', () => {
       const firstDiff = regeneratedLines.findIndex(
         (line, i) => line !== committedLines[i]
       )
-      require('node:fs').writeFileSync(reportPath, committed)
+      writeFileSync(reportPath, committed)
 
       assert.fail(
         'the public API changed but api-report.md was not regenerated.\n' +

package/src/errors/index.ts

@@ -1,2 +1,2 @@
 export * from './errors.js'
-export { PikkuError, addError, addErrors } from './error-handler.js'
+export { PikkuError, addError } from './error-handler.js'

package/src/function/function-runner.test.ts

@@ -14,6 +14,7 @@ import type { CorePermissionGroup } from './functions.types.js'
 import { PikkuSessionService } from '../services/user-session-service.js'
 import { MissingScopeError, ReadonlySessionError } from '../errors/errors.js'
 import { createInvocationAudit } from '../services/audit-service.js'
+import { SecretAccessDeniedError } from '../services/secretless.js'
 
 beforeEach(() => {
   resetPikkuState()
@@ -1563,3 +1564,54 @@ describe('runPikkuFunc - scopes', () => {
     })
   })
 })
+
+describe('runPikkuFunc - secrets', () => {
+  const singletonServicesWithSecrets = {
+    ...mockSingletonServices,
+    secrets: { getSecret: async () => 'super-secret' },
+  } as any
+
+  const addSecretReadingFunction = (
+    funcName: string,
+    seen: { error?: unknown }
+  ) => {
+    addTestFunction(funcName, {
+      func: async (services: any) => {
+        try {
+          return services.secrets
+        } catch (error) {
+          seen.error = error
+          return 'denied'
+        }
+      },
+    })
+  }
+
+  const run = (funcName: string) =>
+    runPikkuFunc('rpc', Math.random().toString(), funcName, {
+      singletonServices: singletonServicesWithSecrets,
+      getAllServices: () => singletonServicesWithSecrets,
+      data: () => ({}),
+      auth: false,
+      wire: {},
+    })
+
+  test('a function never receives the secrets service', async () => {
+    const seen: { error?: unknown } = {}
+    addSecretReadingFunction('readsSecrets', seen)
+
+    assert.equal(await run('readsSecrets'), 'denied')
+    assert.ok(seen.error instanceof SecretAccessDeniedError)
+  })
+
+  test('no metadata flag can restore the secrets service', async () => {
+    const seen: { error?: unknown } = {}
+    addSecretReadingFunction('claimsAnExemption', seen)
+    Object.assign(pikkuState(null, 'function', 'meta')['claimsAnExemption']!, {
+      secretBroker: true,
+    })
+
+    assert.equal(await run('claimsAnExemption'), 'denied')
+    assert.ok(seen.error instanceof SecretAccessDeniedError)
+  })
+})

package/src/function/function-runner.ts

@@ -177,8 +177,6 @@ export const runPikkuFunc = async <In = any, Out = any>(
 
   const resolvedFunctionId = funcMeta.pikkuFuncId ?? funcName
 
-  const keepsSecrets = funcMeta.secretBroker === true
-
   const resolvedSingletonServices = packageName
     ? await getOrCreatePackageSingletonServices(
         packageName,
@@ -363,12 +361,10 @@ export const runPikkuFunc = async <In = any, Out = any>(
 
     await runPermissions({
       funcPermissions: funcConfig.permissions,
-      services: keepsSecrets
-        ? resolvedSingletonServices
-        : (withoutSecrets(
-            resolvedSingletonServices,
-            'a permission'
-          ) as CoreSingletonServices),
+      services: withoutSecrets(
+        resolvedSingletonServices,
+        'a permission'
+      ) as CoreSingletonServices,
       // knowledge: decisions/security/a-permission-gets-a-wire-it-cannot-reply-on.md
       wire: invocationWire as PermissionWire,
       data: actualData,
@@ -420,7 +416,7 @@ export const runPikkuFunc = async <In = any, Out = any>(
         enumerable: true,
       })
       return await funcConfig.func(
-        keepsSecrets ? services : withoutSecrets(services, 'a pikku function'),
+        withoutSecrets(services, 'a pikku function'),
         actualData,
         invocationWire
       )

package/src/function/index.ts

@@ -18,6 +18,4 @@ export type {
   ListInput,
   ListOutput,
   Filter,
-  LeafFilter,
-  LeafValue,
 } from './list.types.js'

package/src/index.ts

@@ -17,12 +17,10 @@ export type {
   CreateConfig,
   ServerLifecycle,
   FunctionMeta,
-  FunctionRuntimeMeta,
   FunctionServicesMeta,
   FunctionWiresMeta,
   FunctionsMeta,
   FunctionsRuntimeMeta,
-  JSONPrimitive,
   JSONValue,
   MakeRequired,
   MiddlewareMetadata,
@@ -43,7 +41,6 @@ export type {
   SecuritySeverity,
   SecurityUpdateLevel,
   SerializedError,
-  WireServices,
 } from './types/core.types.js'
 export {
   pikkuAIMiddleware,
@@ -57,7 +54,6 @@ export type {
   CorePikkuAuthConfig,
   CorePikkuFunction,
   CorePikkuFunctionConfig,
-  CorePikkuFunctionHook,
   CorePikkuPermission,
   CorePikkuPermissionConfig,
   CorePikkuPermissionFactory,
@@ -75,8 +71,6 @@ export type {
   ListInput,
   ListOutput,
   Filter,
-  LeafFilter,
-  LeafValue,
 } from './function/list.types.js'
 export { pikkuCLIRender } from './wirings/cli/cli-runner.js'
 export { PikkuRequest } from './pikku-request.js'
@@ -92,9 +86,6 @@ export {
 } from './version.js'
 export {
   AbandonedError,
-  beginChanges,
-  getAbortScope,
-  runInAbortScope,
   type AbortScope,
 } from './function/abort-scope.js'
 export { fetch } from './wirings/http/http-runner.js'
@@ -152,7 +143,6 @@ export type { QueueService } from './wirings/queue/queue.types.js'
 export type { JWTService } from './services/jwt-service.js'
 export type {
   EmailService,
-  EmailTemplateReference,
   SendEmailInput,
   SendEmailResult,
   SendHTMLEmailInput,
@@ -188,8 +178,6 @@ export type { SessionService } from './services/user-session-service.js'
 export {
   NoopAuditService,
   createInvocationAudit,
-  resolveAuditConfig,
-  resolveAuditUserIdentityFromWire,
 } from './services/audit-service.js'
 export type {
   AuditConfig,
@@ -198,31 +186,14 @@ export type {
   AuditEventBatch,
   AuditFacets,
   AuditLog,
-  AuditLogWriteInput,
-  AuditOutcome,
   AuditQuery,
   AuditQueryResult,
   AuditService,
-  AuditSource,
   AuditUserIdentity,
   ResolvedAuditConfig,
 } from './services/audit-service.js'
 export type {
   AIAgentRunnerService,
-  AIEmbedManyParams,
-  AIEmbedManyResult,
-  AIEmbedParams,
-  AIEmbedResult,
-  AIGenerateImageParams,
-  AIGenerateImagePrompt,
-  AIGenerateImageResult,
-  AIGenerateSpeechParams,
-  AIGenerateSpeechResult,
-  AIProviderOptions,
-  AIRerankParams,
-  AIRerankResult,
-  AITranscriptionParams,
-  AITranscriptionResult,
 } from './services/ai-agent-runner-service.js'
 export type { AIEmbeddingService } from './services/ai-embedding-service.js'
 export type { AIRunStateService } from './services/ai-run-state-service.js'
@@ -230,8 +201,6 @@ export type { AIStorageService } from './services/ai-storage-service.js'
 export type {
   EmailsMeta,
   EmailTemplateMeta,
-  EmailTemplateLocaleMeta,
-  EmailTemplateAssets,
   MetaService,
 } from './services/meta-service.js'
 export type { HTTPMethod } from './wirings/http/http.types.js'
@@ -266,7 +235,6 @@ export type {
   Secret,
   Classification,
   AnonymizeStrategy,
-  ColumnClassification,
   ClassificationManifest,
   ColumnForm,
   WrappedValue,
@@ -276,9 +244,6 @@ export type {
 
 export {
   hashToken,
-  unsafeAsWrapped,
-  unsafeAsSealed,
-  unsafeAsHashed,
 } from './column-form.js'
 
 export type { SecretValue, Safe } from './secret-value.js'

package/src/pikku-state.ts

@@ -10,6 +10,7 @@ import type {
   MCPPromptMeta,
 } from './wirings/mcp/mcp.types.js'
 import type { AIAgentMeta } from './wirings/ai-agent/ai-agent.types.js'
+import type { ScorerMeta } from './wirings/ai-scorer/ai-scorer.types.js'
 import type { GatewaysMeta } from './wirings/gateway/gateway.types.js'
 import type { ScheduledTasksMeta } from './wirings/scheduler/scheduler.types.js'
 import type { TriggerMeta } from './wirings/trigger/trigger.types.js'
@@ -118,6 +119,9 @@ const createEmptyPackageState = (): PikkuPackageState => ({
   agent: {
     agents: new Map(),
     agentsMeta: {} as AIAgentMeta,
+    scorers: new Map(),
+    scorersMeta: {} as ScorerMeta,
+    modelAliases: {},
   },
   gateway: {
     gateways: new Map(),
@@ -151,6 +155,7 @@ const createEmptyPackageState = (): PikkuPackageState => ({
     authFactory: null,
     credentialsMeta: null,
     requiredParentServices: null,
+    declaredSecrets: null,
   },
 })