@pikku/core 0.12.82 → 0.12.83

package/CHANGELOG.md

@@ -1,3 +1,36 @@
+## 0.12.83
+
+### Patch Changes
+
+- 02c4fe5: fix(core,inspector): let a host grant an addon secrets it could not declare
+
+  Scoping an addon's `SecretService` to its `declaredSecrets` left generic addons
+  with nothing readable: `declaredSecrets` is derived from the addon package's own
+  source, but the secrets an addon like `@pikku/addon-graph` reads are named by the
+  consuming app's workflow nodes at runtime. Every authenticated `graph:httpRequest`
+  threw.
+
+  `wireAddon` now takes `secretGrants: string[]` and `credentialGrants: string[]`,
+  completing the grant family alongside `secretOverrides` (grant + rename) and
+  `globalSecrets` (grant everything, with a reason). Grants name the secret as the
+  addon reads it, since the scope check runs before the override map renames it —
+  which is also why an override's key grants and its value does not.
+
+  A grant naming a secret the project does not declare is an `INVALID_VALUE`
+  critical at codegen, resolved through the override map before lookup.
+
+- 438b776: Move the scenario and feature surface off `@pikku/core/workflow` and onto
+  `@pikku/core/scenario`. Scenarios extend workflows, so the production workflow
+  wiring no longer names a scenario module in its import graph. Feature and
+  scenario types are declared in their own `scenario.types.ts` rather than in
+  `workflow.types.ts`. Import `requireActor`, `requireScenarioEnv`, `pollUntil`,
+  `createCookieJar`, `addFeature`, `ScenarioHttpResponse` and the rest from
+  `@pikku/core/scenario`; `HttpPersonasConfig` now comes from
+  `@pikku/core/persona` rather than `@pikku/core/services`.
+- 438b776: Remove the `@pikku/core/internal` entry point. It aliased the same file as
+  `@pikku/core/ecosystem`, so the two published an identical set of names under
+  two specifiers. Import from `@pikku/core/ecosystem`.
+
 ## 0.12.82
 
 ### Patch Changes

package/dist/services/index.d.ts

@@ -3,7 +3,7 @@ export { ScopedSecretService } from './scoped-secret-service.js';
 export { ScopedCredentialService } from './scoped-credential-service.js';
 export { PikkuSessionService, createMiddlewareSessionWireProps, } from './user-session-service.js';
 export { TypedSecretService } from './typed-secret-service.js';
-export { PikkuCredentialWireService, } from './credential-wire-service.js';
+export { PikkuCredentialWireService } from './credential-wire-service.js';
 export { TypedVariablesService } from './typed-variables-service.js';
 export { LocalSecretService } from './local-secrets.js';
 export { LocalEmailService } from './local-email-service.js';
@@ -17,8 +17,7 @@ export { InMemoryTriggerService } from './in-memory-trigger-service.js';
 export { InMemoryAIRunStateService } from './in-memory-ai-run-state-service.js';
 export { LocalGatewayService } from './local-gateway-service.js';
 export type { ContentService, SignContentKeyArgs, SignURLArgs, GetUploadURLArgs, UploadURLResult, BucketKeyArgs, WriteFileArgs, CopyFileArgs, } from './content-service.js';
-export type { ScenarioPersona, ResolvedPersona, ScenarioPersonas, ScenarioHttpResponse, } from './personas-service.js';
-export type { HttpPersonasConfig } from './http-personas.js';
+export type { ScenarioPersona, ResolvedPersona, ScenarioPersonas, } from './personas-service.js';
 export type { JWTService } from './jwt-service.js';
 export type { EmailService, SendEmailInput, SendEmailResult, SendHTMLEmailInput, SendTemplateEmailInput, SendTextEmailInput, } from './email-service.js';
 export { DEFAULT_WEBHOOK_RETRIES, PIKKU_OUTGOING_WEBHOOK_QUEUE_NAME, WebhookService, type SendWebhookInput, type SendWebhookResult, type WebhookAttemptResult, type WebhookDeliveryRecord, type WebhookDeliveryWithAttempts, type WebhookJobData, type WebhookServiceConfig, } from './webhook-service.js';
@@ -35,16 +34,16 @@ export type { AIStorageService } from './ai-storage-service.js';
 export type { AIAgentRunnerParams, AIAgentRunnerResult, AIAgentStepResult, AIAgentRunnerService, } from './ai-agent-runner-service.js';
 export type { AIEmbeddingService } from './ai-embedding-service.js';
 export type { CreateRunInput, SaveScoreInput, AIRunStateService, } from './ai-run-state-service.js';
-export type { CredentialMeta, } from './typed-secret-service.js';
+export type { CredentialMeta } from './typed-secret-service.js';
 export type { CredentialService } from './credential-service.js';
 export { TypedCredentialService } from './typed-credential-service.js';
-export type { CredentialMetaInfo, } from './typed-credential-service.js';
+export type { CredentialMetaInfo } from './typed-credential-service.js';
 export type { VariableMeta } from './typed-variables-service.js';
 export type { MetaService } from './meta-service.js';
 export type { SessionStore } from './session-store.js';
 export type { ScopeService, Role } from './scope-service.js';
 export type { IsSystemRole } from './system-role-guard.js';
-export { NoopAuditService, createInvocationAudit, } from './audit-service.js';
+export { NoopAuditService, createInvocationAudit } from './audit-service.js';
 export type { AuditConfig, AuditDurability, AuditEvent, AuditEventBatch, AuditLog, AuditService, AuditUserIdentity, ResolvedAuditConfig, } from './audit-service.js';
 export { InMemorySessionStore } from './in-memory-session-store.js';
 export type { MCPMeta, RPCMetaRecord, ServiceMeta, ServicesMetaRecord, MiddlewareDefinitionMeta, MiddlewareInstanceMeta, GroupMeta, MiddlewareGroupsMeta, PermissionDefinitionMeta, PermissionsGroupsMeta, FunctionsMeta, FunctionMeta, MiddlewareMeta, PermissionMeta, AgentsMeta, AgentMeta, EmailsMeta, EmailTemplateMeta, } from './meta-service.js';

package/dist/services/index.js

@@ -3,7 +3,7 @@ export { ScopedSecretService } from './scoped-secret-service.js';
 export { ScopedCredentialService } from './scoped-credential-service.js';
 export { PikkuSessionService, createMiddlewareSessionWireProps, } from './user-session-service.js';
 export { TypedSecretService } from './typed-secret-service.js';
-export { PikkuCredentialWireService, } from './credential-wire-service.js';
+export { PikkuCredentialWireService } from './credential-wire-service.js';
 export { TypedVariablesService } from './typed-variables-service.js';
 export { LocalSecretService } from './local-secrets.js';
 export { LocalEmailService } from './local-email-service.js';
@@ -18,7 +18,7 @@ export { InMemoryAIRunStateService } from './in-memory-ai-run-state-service.js';
 export { LocalGatewayService } from './local-gateway-service.js';
 export { DEFAULT_WEBHOOK_RETRIES, PIKKU_OUTGOING_WEBHOOK_QUEUE_NAME, WebhookService, } from './webhook-service.js';
 export { TypedCredentialService } from './typed-credential-service.js';
-export { NoopAuditService, createInvocationAudit, } from './audit-service.js';
+export { NoopAuditService, createInvocationAudit } from './audit-service.js';
 export { InMemorySessionStore } from './in-memory-session-store.js';
 export { StubTracker, createStubProxy, getStubTracker, isTestRun, stub, spy, } from './stub-tracker.js';
 export { SecretHostNotAllowedError, assertSecretAllowedForHost, } from './secret-host-binding.js';

package/dist/services/meta-service.d.ts

@@ -5,7 +5,8 @@ import type { ScheduledTasksMeta } from '../wirings/scheduler/scheduler.types.js
 import type { QueueWorkersMeta } from '../wirings/queue/queue.types.js';
 import type { CLIMeta } from '../wirings/cli/cli.types.js';
 import type { MCPResourceMeta, MCPToolMeta, MCPPromptMeta } from '../wirings/mcp/mcp.types.js';
-import type { FeaturesMeta, WorkflowsMeta } from '../wirings/workflow/workflow.types.js';
+import type { WorkflowsMeta } from '../wirings/workflow/workflow.types.js';
+import type { FeaturesMeta } from '../wirings/workflow/scenario.types.js';
 import type { ResolvedPersona } from './personas-service.js';
 import type { SystemRoleDefinitionsMeta } from '../wirings/role/role.types.js';
 import type { TriggerMeta, TriggerSourceMeta } from '../wirings/trigger/trigger.types.js';

package/dist/types/core.types.d.ts

@@ -11,7 +11,8 @@ import type { PikkuMCP } from '../wirings/mcp/mcp.types.js';
 import type { PikkuScheduledTask } from '../wirings/scheduler/scheduler.types.js';
 import type { PikkuQueue, QueueService } from '../wirings/queue/queue.types.js';
 import type { PikkuCLI } from '../wirings/cli/cli.types.js';
-import type { PikkuWorkflowWire, PikkuScenarioWire, WorkflowService, WorkflowServiceConfig, WorkflowStepWire } from '../wirings/workflow/workflow.types.js';
+import type { PikkuWorkflowWire, WorkflowService, WorkflowServiceConfig, WorkflowStepWire } from '../wirings/workflow/workflow.types.js';
+import type { PikkuScenarioWire } from '../wirings/workflow/scenario.types.js';
 import type { PikkuBrowserWire, PikkuScenarioStepWire, ScenarioStepKind, ScenarioSurface } from '../wirings/workflow/scenario-step.types.js';
 import type { PikkuGraphWire } from '../wirings/workflow/graph/workflow-graph.types.js';
 import type { PikkuTrigger } from '../wirings/trigger/trigger.types.js';

package/dist/types/state.types.d.ts

@@ -10,7 +10,8 @@ import type { PikkuAIScorer, ScorerMeta } from '../wirings/ai-scorer/ai-scorer.t
 import type { CoreGateway, GatewaysMeta } from '../wirings/gateway/gateway.types.js';
 import type { CoreQueueWorker, QueueWorkersMeta } from '../wirings/queue/queue.types.js';
 import type { CoreScheduledTask, ScheduledTasksMeta } from '../wirings/scheduler/scheduler.types.js';
-import type { CoreWorkflow, CoreFeature, WorkflowsRuntimeMeta } from '../wirings/workflow/workflow.types.js';
+import type { CoreWorkflow, WorkflowsRuntimeMeta } from '../wirings/workflow/workflow.types.js';
+import type { CoreFeature } from '../wirings/workflow/scenario.types.js';
 import type { CoreTrigger, CoreTriggerSource, TriggerMeta, TriggerSourceMeta } from '../wirings/trigger/trigger.types.js';
 import type { FunctionsMeta, CorePikkuMiddleware, CorePikkuMiddlewareGroup, CreateConfig, CreateSingletonServices, CreateWireServices, CoreConfig, CoreSingletonServices, CoreServices, CoreUserSession } from './core.types.js';
 import type { CorePikkuChannelMiddleware } from '../wirings/channel/channel.types.js';
@@ -41,6 +42,10 @@ export interface PikkuPackageState {
             variableOverrides?: Record<string, string>;
             /** Per-instance name-aliases: logical name the addon reads -> actual project credential name */
             credentialOverrides?: Record<string, string>;
+            /** Secrets the host lends this instance, named as the addon reads them */
+            secretGrants?: string[];
+            /** Credentials the host lends this instance, named as the addon reads them */
+            credentialGrants?: string[];
             /** Why this instance gets the whole `SecretService` rather than one scoped to its declared secrets */
             globalSecrets?: string;
             /** Why this instance gets the whole `CredentialService` rather than one scoped to its declared credentials */

package/dist/wirings/ai-agent/ai-agent-prepare.js

@@ -357,6 +357,8 @@ export async function buildToolDefs(params, agentSessionMap, resourceId, agentNa
                                     secretOverrides: capturedAddonConfig?.secretOverrides,
                                     variableOverrides: capturedAddonConfig?.variableOverrides,
                                     credentialOverrides: capturedAddonConfig?.credentialOverrides,
+                                    secretGrants: capturedAddonConfig?.secretGrants,
+                                    credentialGrants: capturedAddonConfig?.credentialGrants,
                                     globalSecrets: capturedAddonConfig?.globalSecrets,
                                     globalCredentials: capturedAddonConfig?.globalCredentials,
                                 }

package/dist/wirings/rpc/addon-runner.d.ts

@@ -4,6 +4,10 @@ export type AddonInstance = {
     secretOverrides?: Record<string, string>;
     variableOverrides?: Record<string, string>;
     credentialOverrides?: Record<string, string>;
+    /** Set by the consuming app: secrets it lends this instance, as the addon names them. */
+    secretGrants?: string[];
+    /** Set by the consuming app: credentials it lends this instance, as the addon names them. */
+    credentialGrants?: string[];
     /** Set by the consuming app to opt this instance out of secret scoping. */
     globalSecrets?: string;
     /** Set by the consuming app to opt this instance out of credential scoping. */

package/dist/wirings/rpc/addon-runner.js

@@ -1,6 +1,16 @@
 import { pikkuState } from '../../pikku-state.js';
 import { ScopedSecretService } from '../../services/scoped-secret-service.js';
 import { ScopedCredentialService } from '../../services/scoped-credential-service.js';
+/**
+ * What the addon declared, plus what the host lent it. Scoping runs outside the
+ * aliaser, so every name here is the one the addon reads — which is why an
+ * override's *key* grants, and its value does not.
+ */
+const allowedNames = (declared, grants, overrides) => new Set([
+    ...(declared ?? []),
+    ...(grants ?? []),
+    ...Object.keys(overrides ?? {}),
+]);
 const aliasSecretService = (secrets, overrides) => {
     const map = (key) => overrides[key] ?? key;
     return {
@@ -97,13 +107,13 @@ export const getOrCreatePackageSingletonServices = async (packageName, parentSer
     if (!addonInstance?.globalSecrets && existingServices.secrets) {
         existingServices = {
             ...existingServices,
-            secrets: new ScopedSecretService(existingServices.secrets, new Set(pikkuState(packageName, 'package', 'declaredSecrets') ?? [])),
+            secrets: new ScopedSecretService(existingServices.secrets, allowedNames(pikkuState(packageName, 'package', 'declaredSecrets'), addonInstance?.secretGrants, addonInstance?.secretOverrides)),
         };
     }
     if (!addonInstance?.globalCredentials && existingServices.credentialService) {
         existingServices = {
             ...existingServices,
-            credentialService: new ScopedCredentialService(existingServices.credentialService, new Set(Object.keys(pikkuState(packageName, 'package', 'credentialsMeta') ?? {}))),
+            credentialService: new ScopedCredentialService(existingServices.credentialService, allowedNames(Object.keys(pikkuState(packageName, 'package', 'credentialsMeta') ?? {}), addonInstance?.credentialGrants, addonInstance?.credentialOverrides)),
         };
     }
     if (!factories || !factories.createSingletonServices) {
@@ -132,6 +142,8 @@ export const addonInstanceForNamespace = (namespace, expectedPackage) => {
         secretOverrides: cfg.secretOverrides,
         variableOverrides: cfg.variableOverrides,
         credentialOverrides: cfg.credentialOverrides,
+        secretGrants: cfg.secretGrants,
+        credentialGrants: cfg.credentialGrants,
         globalSecrets: cfg.globalSecrets,
         globalCredentials: cfg.globalCredentials,
     };

package/dist/wirings/rpc/rpc-runner.js

@@ -203,6 +203,8 @@ export class ContextAwareRPCService {
                 secretOverrides: resolved.addonConfig?.secretOverrides,
                 variableOverrides: resolved.addonConfig?.variableOverrides,
                 credentialOverrides: resolved.addonConfig?.credentialOverrides,
+                secretGrants: resolved.addonConfig?.secretGrants,
+                credentialGrants: resolved.addonConfig?.credentialGrants,
                 globalSecrets: resolved.addonConfig?.globalSecrets,
                 globalCredentials: resolved.addonConfig?.globalCredentials,
             },

package/dist/wirings/rpc/rpc-types.d.ts

@@ -48,6 +48,10 @@ export interface ResolvedFunction {
         secretOverrides?: Record<string, string>;
         variableOverrides?: Record<string, string>;
         credentialOverrides?: Record<string, string>;
+        /** Set by the consuming app: secrets it lends this instance, as the addon names them */
+        secretGrants?: string[];
+        /** Set by the consuming app: credentials it lends this instance, as the addon names them */
+        credentialGrants?: string[];
         /** Set by the consuming app: hand this instance the unscoped `SecretService` */
         globalSecrets?: string;
         /** Set by the consuming app: hand this instance the unscoped `CredentialService` */

package/dist/wirings/rpc/wire-addon.d.ts

@@ -11,6 +11,18 @@ export type WireAddonConfig = {
     secretOverrides?: Record<string, string>;
     variableOverrides?: Record<string, string>;
     credentialOverrides?: Record<string, string>;
+    /**
+     * Secrets this instance may read on top of the ones it declared, named as the
+     * addon reads them — the scope check runs before `secretOverrides` renames
+     * them, so an overridden secret is named here by its addon-side key. Listing
+     * one in `secretOverrides` grants it too.
+     *
+     * For an addon whose secret names come off its input rather than its own
+     * source, this is how the host lends names the addon could not declare.
+     */
+    secretGrants?: string[];
+    /** Credentials this instance may read on top of the ones it declared. */
+    credentialGrants?: string[];
     /**
      * Hands this instance the whole `SecretService` instead of one scoped to the
      * secrets it declared. The value is the reason, recorded in the deploy

package/dist/wirings/rpc/wire-addon.js

@@ -16,6 +16,10 @@ export const wireAddon = (config) => {
         ...(config.credentialOverrides
             ? { credentialOverrides: config.credentialOverrides }
             : {}),
+        ...(config.secretGrants ? { secretGrants: config.secretGrants } : {}),
+        ...(config.credentialGrants
+            ? { credentialGrants: config.credentialGrants }
+            : {}),
         ...(config.globalSecrets ? { globalSecrets: config.globalSecrets } : {}),
         ...(config.globalCredentials
             ? { globalCredentials: config.globalCredentials }

package/dist/wirings/workflow/feature.d.ts

@@ -1,4 +1,5 @@
-import type { CoreFeature, CoreWorkflow, FeaturePlanEntry } from './workflow.types.js';
+import type { CoreWorkflow } from './workflow.types.js';
+import type { CoreFeature, FeaturePlanEntry } from './scenario.types.js';
 export declare const addFeature: (featureId: string, feature: CoreFeature, packageName?: string | null) => void;
 export declare const resolveFeatureScenarios: (features: Map<string, CoreFeature>, registrations: Map<string, CoreWorkflow>) => {
     entries: FeaturePlanEntry[];

package/dist/wirings/workflow/index.d.ts

@@ -8,21 +8,10 @@ export { deriveInvocationId, uuidv5 } from './workflow-invocation-id.js';
 export { isRef } from './graph/workflow-graph.types.js';
 export type { RefValue } from './graph/workflow-graph.types.js';
 export { buildRunTimeline, reconstructStateAt, reconstructFinalState, } from './run-timeline.js';
-export type { RunTimeline, ReconstructedRunState, } from './run-timeline.js';
+export type { RunTimeline, ReconstructedRunState } from './run-timeline.js';
 export { addWorkflow } from './dsl/workflow-runner.js';
-export { addFeature, resolveFeatureScenarios } from './feature.js';
 export { template, type TemplateString } from './graph/template.js';
 export { pikkuWorkflowGraph, type PikkuWorkflowGraphConfig, type PikkuWorkflowGraphResult, } from './graph/wire-workflow-graph.js';
 export type { WorkflowStepInput as WorkflowStepQueueInput, PikkuWorkflowOrchestratorInput, PikkuWorkflowSleeperInput, } from './workflow-queue-workers.js';
-export type { WorkflowService, WorkflowQueueOptions, WorkflowServiceConfig, WorkflowPlannedStep, WorkflowRunWire, WorkflowStatus, WorkflowVersionStatus, StepStatus, WorkflowRun, WorkflowRunStatus, StepState, WorkflowRunService, WorkflowRunMirror, CoreWorkflow, CoreFeature, FeatureMeta, FeaturesMeta, FeaturePlanEntry, PikkuWorkflow, ContextVariable, WorkflowContext, WorkflowsMeta, WorkflowsRuntimeMeta, } from './workflow.types.js';
-export type { WorkflowStepOptions, WorkflowWireDoRPC, WorkflowApprovalOptions, ApprovalOutcome, InputSource, OutputBinding, RpcStepMeta, Condition, BranchStepMeta, ParallelGroupStepMeta, FanoutStepMeta, ReturnStepMeta, InlineStepMeta, SleepStepMeta, CancelStepMeta, SuspendStepMeta, ApprovalStepMeta, SetStepMeta, SwitchCaseMeta, SwitchStepMeta, FilterStepMeta, ArrayPredicateStepMeta, ScenarioStepInvocation, ScenarioStepMeta, WorkflowStepMeta, WorkflowStepWire, PikkuWorkflowWire, PikkuScenarioWire, } from './workflow.types.js';
-export type { ScenarioStepPhase, ScenarioStepKind, ScenarioStepOptions, PikkuScenarioStepWire, ScenarioEnvironment, ScenarioSurface, ScenarioSurfaceResolution, } from './scenario-step.types.js';
-export { SCENARIO_SURFACES } from './scenario-step.types.js';
-export { resolveScenarioSurfaces } from './scenario-surface.js';
-export { requireActor, requireScenarioEnv } from './scenario-step-guards.js';
-export { pollUntil, type PollOptions } from './scenario-poll.js';
-export { createCookieJar } from './scenario-cookie-jar.js';
-export type { ScenarioCookieJar } from './scenario-cookie-jar.js';
-export type { ScenarioHttpResponse, ScenarioJsonRequest, } from '../../services/personas-service.js';
-export type { PikkuBrowserWire, TestIdSelector, ScenarioBrowserProvider, ScenarioBrowserFailure, } from './scenario-step.types.js';
-export { composeStepProse, renderStepTemplate } from './scenario-prose.js';
+export type { WorkflowService, WorkflowQueueOptions, WorkflowServiceConfig, WorkflowPlannedStep, WorkflowRunWire, WorkflowStatus, WorkflowVersionStatus, StepStatus, WorkflowRun, WorkflowRunStatus, StepState, WorkflowRunService, WorkflowRunMirror, CoreWorkflow, PikkuWorkflow, ContextVariable, WorkflowContext, WorkflowsMeta, WorkflowsRuntimeMeta, } from './workflow.types.js';
+export type { WorkflowStepOptions, WorkflowWireDoRPC, WorkflowApprovalOptions, ApprovalOutcome, InputSource, OutputBinding, RpcStepMeta, Condition, BranchStepMeta, ParallelGroupStepMeta, FanoutStepMeta, ReturnStepMeta, InlineStepMeta, SleepStepMeta, CancelStepMeta, SuspendStepMeta, ApprovalStepMeta, SetStepMeta, SwitchCaseMeta, SwitchStepMeta, FilterStepMeta, ArrayPredicateStepMeta, WorkflowStepMeta, WorkflowStepWire, PikkuWorkflowWire, } from './workflow.types.js';

package/dist/wirings/workflow/index.js

@@ -7,13 +7,5 @@ export { deriveInvocationId, uuidv5 } from './workflow-invocation-id.js';
 export { isRef } from './graph/workflow-graph.types.js';
 export { buildRunTimeline, reconstructStateAt, reconstructFinalState, } from './run-timeline.js';
 export { addWorkflow } from './dsl/workflow-runner.js';
-export { addFeature, resolveFeatureScenarios } from './feature.js';
 export { template } from './graph/template.js';
 export { pikkuWorkflowGraph, } from './graph/wire-workflow-graph.js';
-export { SCENARIO_SURFACES } from './scenario-step.types.js';
-// Which of a step's bindings run: one for an action, every witness for a `then`
-export { resolveScenarioSurfaces } from './scenario-surface.js';
-export { requireActor, requireScenarioEnv } from './scenario-step-guards.js';
-export { pollUntil } from './scenario-poll.js';
-export { createCookieJar } from './scenario-cookie-jar.js';
-export { composeStepProse, renderStepTemplate } from './scenario-prose.js';

package/dist/wirings/workflow/pikku-scenario-service.d.ts

@@ -5,6 +5,16 @@ import type { PikkuRawWire } from '../../types/core.types.js';
 import type { ScenarioPersonas } from '../../services/personas-service.js';
 import type { ScenarioBrowserProvider, ScenarioEnvironment, ScenarioSurface } from './scenario-step.types.js';
 import type { PikkuWorkflowWire, WorkflowQueueOptions } from './workflow.types.js';
+export { addFeature, resolveFeatureScenarios } from './feature.js';
+export type * from './scenario.types.js';
+export { SCENARIO_SURFACES } from './scenario-step.types.js';
+export { resolveScenarioSurfaces } from './scenario-surface.js';
+export { pollUntil, type PollOptions } from './scenario-poll.js';
+export { createCookieJar } from './scenario-cookie-jar.js';
+export type { ScenarioCookieJar } from './scenario-cookie-jar.js';
+export { composeStepProse, renderStepTemplate } from './scenario-prose.js';
+export { requireActor, requireScenarioEnv } from './scenario-step-guards.js';
+export type { ScenarioHttpResponse, ScenarioJsonRequest, } from '../../services/personas-service.js';
 /**
  * A workflow service with the scenario capability attached — the two lines
  * `pikku scenario run` needs, in one call so no caller has to remember that the

package/dist/wirings/workflow/pikku-scenario-service.js

@@ -7,6 +7,15 @@ import { InMemoryWorkflowService } from '../../services/in-memory-workflow-servi
 import { runScheduledTask } from '../scheduler/scheduler-runner.js';
 import { WorkflowStepNameNotString } from './workflow-errors.js';
 import { resolveScenarioSurfaces, witnessesAgree } from './scenario-surface.js';
+export { addFeature, resolveFeatureScenarios } from './feature.js';
+export { SCENARIO_SURFACES } from './scenario-step.types.js';
+// Which of a step's bindings run: one for an action, every witness for a `then`
+export { resolveScenarioSurfaces } from './scenario-surface.js';
+export { pollUntil } from './scenario-poll.js';
+export { createCookieJar } from './scenario-cookie-jar.js';
+export { composeStepProse, renderStepTemplate } from './scenario-prose.js';
+export { requireActor, requireScenarioEnv } from './scenario-step-guards.js';
+// The readers themselves live on `@pikku/core/persona`
 /**
  * A workflow service with the scenario capability attached — the two lines
  * `pikku scenario run` needs, in one call so no caller has to remember that the

package/dist/wirings/workflow/scenario.types.d.ts

@@ -0,0 +1,37 @@
+import type { CorePikkuFunctionConfig, CorePikkuFunctionHook } from '../../function/functions.types.js';
+export type { ScenarioStepInvocation, ScenarioStepMeta, PikkuScenarioWire, } from './dsl/workflow-dsl.types.js';
+export type { ScenarioStepPhase, ScenarioStepKind, ScenarioStepOptions, PikkuScenarioStepWire, ScenarioEnvironment, ScenarioSurface, ScenarioSurfaceResolution, PikkuBrowserWire, TestIdSelector, ScenarioBrowserProvider, ScenarioBrowserFailure, } from './scenario-step.types.js';
+export type CoreFeatureScenario = CorePikkuFunctionConfig<any, any, any> | {
+    scenario: CorePikkuFunctionConfig<any, any, any>;
+    data: unknown;
+};
+export type CoreFeature = {
+    name: string;
+    description?: string;
+    tags?: string[];
+    scenarios: readonly CoreFeatureScenario[];
+    before?: CorePikkuFunctionHook;
+    after?: CorePikkuFunctionHook;
+};
+export type FeatureMetaEntry = {
+    scenario: string;
+    data?: unknown;
+};
+export type FeatureMeta = {
+    id: string;
+    name: string;
+    description?: string;
+    tags: string[];
+    entries: FeatureMetaEntry[];
+    unresolvedEntries: number;
+    hasBefore: boolean;
+    hasAfter: boolean;
+};
+export type FeaturesMeta = Record<string, FeatureMeta>;
+export type FeaturePlanEntry = {
+    featureId: string;
+    featureName: string;
+    scenarioName: string;
+    data?: unknown;
+    tags: string[];
+};

package/dist/wirings/workflow/scenario.types.js

@@ -0,0 +1 @@
+export {};

package/dist/wirings/workflow/workflow.types.d.ts

@@ -1,9 +1,8 @@
 import type { SerializedError, CommonWireMeta } from '../../types/core.types.js';
-import type { CorePikkuFunctionConfig, CorePikkuFunctionHook } from '../../function/functions.types.js';
+import type { CorePikkuFunctionConfig } from '../../function/functions.types.js';
 import type { GroupConcurrencyConfig } from '../queue/queue.types.js';
 export type { WorkflowService } from '../../services/workflow-service.js';
-export type { WorkflowStepOptions, WorkflowWireDoRPC, WorkflowApprovalOptions, ApprovalOutcome, InputSource, OutputBinding, RpcStepMeta, Condition, BranchStepMeta, ParallelGroupStepMeta, FanoutStepMeta, ReturnStepMeta, InlineStepMeta, SleepStepMeta, CancelStepMeta, SuspendStepMeta, ApprovalStepMeta, SetStepMeta, SwitchCaseMeta, SwitchStepMeta, FilterStepMeta, ArrayPredicateStepMeta, ScenarioStepInvocation, ScenarioStepMeta, WorkflowStepMeta, WorkflowStepWire, PikkuWorkflowWire, PikkuScenarioWire, } from './dsl/workflow-dsl.types.js';
-export type { ScenarioStepPhase, ScenarioStepOptions, PikkuScenarioStepWire, PikkuBrowserWire, ScenarioBrowserProvider, } from './scenario-step.types.js';
+export type { WorkflowStepOptions, WorkflowWireDoRPC, WorkflowApprovalOptions, ApprovalOutcome, InputSource, OutputBinding, RpcStepMeta, Condition, BranchStepMeta, ParallelGroupStepMeta, FanoutStepMeta, ReturnStepMeta, InlineStepMeta, SleepStepMeta, CancelStepMeta, SuspendStepMeta, ApprovalStepMeta, SetStepMeta, SwitchCaseMeta, SwitchStepMeta, FilterStepMeta, ArrayPredicateStepMeta, WorkflowStepMeta, WorkflowStepWire, PikkuWorkflowWire, } from './dsl/workflow-dsl.types.js';
 import type { WorkflowStepMeta } from './dsl/workflow-dsl.types.js';
 export interface WorkflowRunWire {
     type: string;
@@ -141,40 +140,6 @@ export type CoreWorkflow<PikkuFunctionConfig extends CorePikkuFunctionConfig<any
     middleware?: PikkuFunctionConfig['middleware'];
     tags?: string[];
 };
-export type CoreFeatureScenario = CorePikkuFunctionConfig<any, any, any> | {
-    scenario: CorePikkuFunctionConfig<any, any, any>;
-    data: unknown;
-};
-export type CoreFeature = {
-    name: string;
-    description?: string;
-    tags?: string[];
-    scenarios: readonly CoreFeatureScenario[];
-    before?: CorePikkuFunctionHook;
-    after?: CorePikkuFunctionHook;
-};
-export type FeatureMetaEntry = {
-    scenario: string;
-    data?: unknown;
-};
-export type FeatureMeta = {
-    id: string;
-    name: string;
-    description?: string;
-    tags: string[];
-    entries: FeatureMetaEntry[];
-    unresolvedEntries: number;
-    hasBefore: boolean;
-    hasAfter: boolean;
-};
-export type FeaturesMeta = Record<string, FeatureMeta>;
-export type FeaturePlanEntry = {
-    featureId: string;
-    featureName: string;
-    scenarioName: string;
-    data?: unknown;
-    tags: string[];
-};
 export interface PikkuWorkflow {
     start: <I>(input: I) => Promise<{
         runId: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/core",
-  "version": "0.12.82",
+  "version": "0.12.83",
   "description": "The Pikku runtime — functions, wirings, services, middleware and types",
   "author": "yasser.fadl@gmail.com",
   "license": "MIT",
@@ -74,7 +74,6 @@
     "./crypto-utils": "./dist/crypto-utils.js",
     "./hmac": "./dist/utils/hmac.js",
     "./ecosystem": "./dist/ecosystem.js",
-    "./internal": "./dist/ecosystem.js",
     "./schema": "./dist/schema.js",
     "./testing": "./dist/testing/index.js",
     "./dev": "./dist/dev/hot-reload.js"

package/src/public-surface.json

@@ -127,7 +127,6 @@
   "./workflow": [
     "DEFAULT_STEP_RETRIES",
     "PikkuWorkflowService",
-    "SCENARIO_SURFACES",
     "WorkflowApprovalForbiddenError",
     "WorkflowApprovalResolvedError",
     "WorkflowCancelledException",
@@ -137,35 +136,36 @@
     "WorkflowRunNotFoundError",
     "WorkflowStepFunctionMismatchError",
     "WorkflowSuspendedException",
-    "addFeature",
     "addWorkflow",
     "assertWorkflowRunOwner",
     "buildRunTimeline",
-    "composeStepProse",
-    "createCookieJar",
     "deriveInvocationId",
     "isRef",
     "pikkuWorkflowGraph",
-    "pollUntil",
     "reconstructFinalState",
     "reconstructStateAt",
-    "renderStepTemplate",
-    "requireActor",
-    "requireScenarioEnv",
-    "resolveFeatureScenarios",
-    "resolveScenarioSurfaces",
     "template",
     "uuidv5"
   ],
   "./scenario": [
     "PikkuScenarioService",
+    "SCENARIO_SURFACES",
     "ScenarioBrowserActorRequired",
     "ScenarioBrowserUnavailable",
     "ScenarioHookError",
     "ScenarioNoSurfaceBinding",
     "ScenarioNoWitness",
     "ScenarioWitnessDisagreement",
-    "createScenarioRunner"
+    "addFeature",
+    "composeStepProse",
+    "createCookieJar",
+    "createScenarioRunner",
+    "pollUntil",
+    "renderStepTemplate",
+    "requireActor",
+    "requireScenarioEnv",
+    "resolveFeatureScenarios",
+    "resolveScenarioSurfaces"
   ],
   "./workflow/timeline": [
     "buildRunTimeline",
@@ -522,19 +522,6 @@
     "runPikkuFunc",
     "setSingletonServices"
   ],
-  "./internal": [
-    "addFunction",
-    "addGlobalMiddleware",
-    "addMiddleware",
-    "getAllPackageStates",
-    "getCreateWireServices",
-    "getSingletonServices",
-    "httpRouter",
-    "pikkuState",
-    "resetPikkuState",
-    "runPikkuFunc",
-    "setSingletonServices"
-  ],
   "./schema": [
     "addSchema",
     "applyDefaultsFromSchema",

package/src/services/index.ts

@@ -6,9 +6,7 @@ export {
   createMiddlewareSessionWireProps,
 } from './user-session-service.js'
 export { TypedSecretService } from './typed-secret-service.js'
-export {
-  PikkuCredentialWireService,
-} from './credential-wire-service.js'
+export { PikkuCredentialWireService } from './credential-wire-service.js'
 export { TypedVariablesService } from './typed-variables-service.js'
 export { LocalSecretService } from './local-secrets.js'
 export { LocalEmailService } from './local-email-service.js'
@@ -38,10 +36,8 @@ export type {
   ScenarioPersona,
   ResolvedPersona,
   ScenarioPersonas,
-  ScenarioHttpResponse,
 } from './personas-service.js'
 // knowledge: decisions/internals/the-persona-runtime-is-exported-from-the-persona-entry-point.md
-export type { HttpPersonasConfig } from './http-personas.js'
 export type { JWTService } from './jwt-service.js'
 export type {
   EmailService,
@@ -94,23 +90,16 @@ export type {
   SaveScoreInput,
   AIRunStateService,
 } from './ai-run-state-service.js'
-export type {
-  CredentialMeta,
-} from './typed-secret-service.js'
+export type { CredentialMeta } from './typed-secret-service.js'
 export type { CredentialService } from './credential-service.js'
 export { TypedCredentialService } from './typed-credential-service.js'
-export type {
-  CredentialMetaInfo,
-} from './typed-credential-service.js'
+export type { CredentialMetaInfo } from './typed-credential-service.js'
 export type { VariableMeta } from './typed-variables-service.js'
 export type { MetaService } from './meta-service.js'
 export type { SessionStore } from './session-store.js'
 export type { ScopeService, Role } from './scope-service.js'
 export type { IsSystemRole } from './system-role-guard.js'
-export {
-  NoopAuditService,
-  createInvocationAudit,
-} from './audit-service.js'
+export { NoopAuditService, createInvocationAudit } from './audit-service.js'
 export type {
   AuditConfig,
   AuditDurability,

package/src/services/meta-service.ts

@@ -13,10 +13,8 @@ import type {
   MCPToolMeta,
   MCPPromptMeta,
 } from '../wirings/mcp/mcp.types.js'
-import type {
-  FeaturesMeta,
-  WorkflowsMeta,
-} from '../wirings/workflow/workflow.types.js'
+import type { WorkflowsMeta } from '../wirings/workflow/workflow.types.js'
+import type { FeaturesMeta } from '../wirings/workflow/scenario.types.js'
 import type { ResolvedPersona } from './personas-service.js'
 import type { SystemRoleDefinitionsMeta } from '../wirings/role/role.types.js'
 import type {

package/src/types/core.types.ts

@@ -17,11 +17,11 @@ import type { PikkuQueue, QueueService } from '../wirings/queue/queue.types.js'
 import type { PikkuCLI } from '../wirings/cli/cli.types.js'
 import type {
   PikkuWorkflowWire,
-  PikkuScenarioWire,
   WorkflowService,
   WorkflowServiceConfig,
   WorkflowStepWire,
 } from '../wirings/workflow/workflow.types.js'
+import type { PikkuScenarioWire } from '../wirings/workflow/scenario.types.js'
 import type {
   PikkuBrowserWire,
   PikkuScenarioStepWire,