@pikku/core 0.12.83 → 0.12.86

package/knowledge/decisions/security/{ai-agent-resume-re-runs-the-authorization-gate.md → agent-resume-re-runs-the-authorization-gate.md}

@@ -2,14 +2,14 @@
 type: decision
 title: Resuming a suspended agent run re-runs the agent's authorization gate
 description: Ownership of the run is not enough — a grant revoked while the run was suspended must block the approval
-tags: ai-agent
+tags: agent
 ---
 
 # Resuming a suspended agent run re-runs the agent's authorization gate
 
-Both `resumeAIAgent` (`ai-agent-stream.ts`) and `resumeAIAgentSync`
-(`ai-agent-runner.ts`) call `assertAgentAuthorized` after asserting run
-ownership and before touching `aiRunState.resolveApproval`.
+Both `resumeAgent` (`agent-stream.ts`) and `resumeAgentSync`
+(`agent-runner.ts`) call `assertAgentAuthorized` after asserting run
+ownership and before touching `agentRunState.resolveApproval`.
 
 Ownership proves the run belongs to the caller, not that the caller may still
 act on it: a suspension can outlive the permission that created it, and the whole

package/knowledge/decisions/security/{ai-agent-sessionless-deployments-have-no-thread-ownership.md → agent-sessionless-deployments-have-no-thread-ownership.md}

@@ -2,14 +2,14 @@
 type: decision
 title: Agent thread ownership fails closed when there is no principal
 description: A sessionless caller gets an ephemeral owner and reaches no stored thread, rather than reaching all of them
-tags: ai-agent
+tags: agent
 ---
 
 # Agent thread ownership fails closed when there is no principal
 
 `canAccessThread` returns `false` and `threadOwnerConstraint` returns `[]` when
 the session carries neither `userId` nor `orgId`
-(`packages/core/src/wirings/ai-agent/ai-agent-prepare.ts`).
+(`packages/core/src/wirings/agent/agent-prepare.ts`).
 `resolveOwnerResourceId` never accepts the client-supplied `resourceId` as an
 ownership key; without a principal it mints an ephemeral `anon-<uuid>` owner
 memoized on the request's params object.
@@ -17,8 +17,8 @@ memoized on the request's params object.
 Agent wirings default to `auth: false`, so "no session" is the common case
 rather than an exotic one. Treating it as "no ownership model to enforce" made
 every ownership check vacuous: a caller named any `resourceId` and reached that
-thread, and because `undefined` on `AgentRunService.listThreads` means *no
-filter* rather than *no rows*, a sessionless `getAgentThreads` returned every
+thread, and because `undefined` on `AgentRunService.listThreads` means _no
+filter_ rather than _no rows_, a sessionless `getAgentThreads` returned every
 thread in the deployment. The ephemeral owner is what keeps one-shot
 conversations working while denying continuity — it is unguessable, so nothing
 stored can be reached, and it is stable within a request, so a sub-agent
@@ -32,7 +32,7 @@ field, never in its body.
 
 **What this rules out:** returning `undefined` from `threadOwnerConstraint` for
 any caller; deriving `owners` from request input instead of the session; reading
-`auth: false` as permission to skip ownership on a *stored* thread; and
+`auth: false` as permission to skip ownership on a _stored_ thread; and
 persisting the anonymous owner anywhere, which would turn an ephemeral identity
 into a forgeable one. Cross-request thread continuity without a session is not
 available by design — wire a session to get it back. See

package/knowledge/decisions/security/{ai-agent-thread-ownership-composes-the-session-principal.md → agent-thread-ownership-composes-the-session-principal.md}

@@ -2,12 +2,12 @@
 type: decision
 title: An agent thread key is always prefixed with the trusted principal
 description: Ownership keys are composed as principal:resourceId, so a client id can sub-divide its own boundary but never widen it
-tags: ai-agent
+tags: agent
 ---
 
 # An agent thread key is always prefixed with the trusted principal
 
-`resolveOwnerResourceId` in `packages/core/src/wirings/ai-agent/ai-agent-prepare.ts`
+`resolveOwnerResourceId` in `packages/core/src/wirings/agent/agent-prepare.ts`
 composes the ownership key for a thread or run as `principal:resourceId`. The
 principal is the trusted one — `session.userId` for the default `'user'`
 `SessionScope`, `session.orgId` for `'org'` — and the client-supplied

package/knowledge/decisions/security/{ai-agent-tool-filtering-reads-the-live-function-config.md → agent-tool-filtering-reads-the-live-function-config.md}

@@ -2,12 +2,12 @@
 type: decision
 title: Agent tool permission filtering reads the live function config, not the metadata
 description: The pikkuAuth brand survives only on live permission objects, so a metadata-driven check would silently admit every gated tool
-tags: ai-agent
+tags: agent
 ---
 
 # Agent tool permission filtering reads the live function config, not the metadata
 
-`buildToolDefs` in `packages/core/src/wirings/ai-agent/ai-agent-prepare.ts`
+`buildToolDefs` in `packages/core/src/wirings/agent/agent-prepare.ts`
 decides which tools and sub-agents to expose to the model by calling
 `checkAuthPermissions` against the permission objects held in the live function
 (or agent) config in `pikkuState`, using the metadata only to learn that a

package/knowledge/decisions/security/an-agent-approval-is-claimed-before-the-tool-runs.md

@@ -2,7 +2,7 @@
 type: decision
 title: An agent approval is claimed before the tool runs
 description: resolveApproval is a compare-and-swap returning whether this caller won, because the read that precedes it is not a claim and ten concurrent approvals would otherwise mean ten refunds
-tags: ai-agent
+tags: agent
 ---
 
 # An agent approval is claimed before the tool runs
@@ -15,7 +15,7 @@ same tool call all observed `suspended`, all snapshotted the same list, and all
 reached `execute`. `resolveApproval` returned `void`, so a loser could not even
 tell.
 
-`resolveApproval` is now the claim, and returns whether *this* caller made it.
+`resolveApproval` is now the claim, and returns whether _this_ caller made it.
 The stores implement it as a compare-and-swap: Kysely updates the run row only
 while `status = 'suspended'` and `pendingApprovals` still equals the list it
 read; the tool-call stores move the row off `approvalStatus = 'pending'` and
@@ -23,7 +23,7 @@ count the rows they changed. Both resume paths run the tool only for the ids the
 claimed, and a caller that claimed nothing gets an error rather than a silent
 re-run.
 
-The claim is per tool call, not per run, so concurrent approvals of *different*
+The claim is per tool call, not per run, so concurrent approvals of _different_
 tool calls on one run all proceed — which is the case that made a run-level
 `claimSuspendedRun` the worse fit.
 

package/knowledge/decisions/security/an-approval-answer-outlives-the-run-it-answered.md

@@ -11,7 +11,7 @@ An approval gate is asked for so it can be answered for afterwards. "Who
 released the funds" is the entire point of four-eyes sign-off, and until this
 change none of it was kept.
 
-Run state is where a decision *waits*, not where it is kept. The record under
+Run state is where a decision _waits_, not where it is kept. The record under
 `workflowRuns.state.__approval_<hex>` is overwritten by the next write to that
 key, and cleared outright — `decidedBy: undefined` included — whenever a
 decision is refused on replay. A trail that erases exactly the events worth
@@ -31,7 +31,7 @@ shape it had before there was anything to record.
 
 `deleteRun` cascades: `workflowStep` is `onDelete('cascade')` from
 `workflowRuns`, and `workflowStepHistory` from `workflowStep`. Deleting a run
-therefore deletes the sign-off with it — and a *refused* attempt never reaches a
+therefore deletes the sign-off with it — and a _refused_ attempt never reaches a
 step at all, so it was never in that trail to begin with.
 
 Every answer — accepted, refused at submission, or cleared on replay — is
@@ -55,5 +55,5 @@ in `pikkuSchemas`.
 **What this rules out:** a dedicated `workflowApprovals` table. It would have to
 be implemented in all seven backends and would still be deleted with the run
 unless it deliberately broke the cascade — at which point it is the audit table
-with extra steps. If approvals later need to be *queried* as a first-class
+with extra steps. If approvals later need to be _queried_ as a first-class
 entity rather than read back from the trail, that is when to revisit.

package/knowledge/decisions/security/an-empty-owners-constraint-matches-nothing.md

@@ -2,13 +2,13 @@
 type: decision
 title: An empty owners constraint matches nothing
 description: owners is an authorization boundary, so every storage backend must treat [] as no rows rather than no filter
-tags: ai-agent, storage
+tags: agent, storage
 ---
 
 # An empty owners constraint matches nothing
 
 Every `AgentRunService.listThreads` implementation returns `[]` immediately when
-`owners` is present and empty — `kysely-ai-agent-run-service.ts`,
+`owners` is present and empty — `kysely-agent-run-service.ts`,
 `redis-agent-run-service.ts`, `mongodb-agent-run-service.ts`. The conformance
 suite in `packages/core/src/testing/service-tests.ts` pins it, so a new backend
 inherits the requirement instead of rediscovering it.
@@ -27,4 +27,4 @@ return; the two decisions only hold together.
 `if (owners)` path; treating `owners: []` as equivalent to `owners: undefined`
 at any layer; and adding a backend without the conformance suite.
 
-See [[ai-agent-sessionless-deployments-have-no-thread-ownership]].
+See [[agent-sessionless-deployments-have-no-thread-ownership]].

package/knowledge/decisions/security/console-addon-privileged-functions-gate-themselves.md

@@ -2,7 +2,7 @@
 type: decision
 title: The console addon's privileged functions gate themselves
 description: Thread listing is owner-scoped unless the caller holds admin, and addon installation requires an admin session, rather than trusting the host to register a global permission
-tags: addon, ai-agent, rpc
+tags: addon, agent, rpc
 ---
 
 # The console addon's privileged functions gate themselves
@@ -27,14 +27,18 @@ runner's, which for a `pikkuSessionlessFunc` fires only when the function itself
 sets `auth: true`.
 
 The addon's original authorization story was a single package-scoped
-`addGlobalPermission([isAdmin], '@pikku/addon-console')` that the *host*
+`addGlobalPermission([isAdmin], '@pikku/addon-console')` that the _host_
 registered, which `runPermissions` resolves in the callee's package namespace and
 applies to every function at once. Nothing generated that call — the scaffold
 emitted only a comment recommending it, and `resolveGlobalPermissions` returns an
 empty list when the host registered none, which `runPermissions` treats as
 allow. An app that followed the scaffold and stopped there had a fully open
-console surface. The scaffold now emits `wireAddon({ …, scopes: ['admin'] })`
-instead, which the function runner enforces on every function in the package.
+console surface. Every console function now declares its own
+`pikku:console:<area>:<action>` scope instead, which the function runner
+enforces per call. A blanket `wireAddon({ …, scopes: ['admin'] })` stood in for
+that briefly; it is gone, because a single grant covering secrets, source
+editing and the audit trail alike is not something an operator can reason
+about.
 
 The two functions whose failure mode is worst still do not depend on any
 package-wide gate:
@@ -51,16 +55,20 @@ storage backend already treats as no rows.
 attacker-chosen package name and write a wiring file into the project. They were
 `pikkuSessionlessFunc` with `auth: false`, which — behind a `no-auth` RPC route
 and with no host global permission — meant an unauthenticated POST reached
-`execFileSync`. They now declare `auth: true` and `scopes: ['admin']`, enforced
-by `verifyScopes` in the function runner before the body runs. Both gates are
-checked whether or not the host registered a global permission, and whether or
-not the addon itself was wired with scopes — an app that hand-wires
-`wireAddon({ name: 'console', package: '@pikku/addon-console' })` without them
+`execFileSync`. They now declare `auth: true` and
+`scopes: ['pikku:console:addons:install']`, enforced by `verifyScopes` in the
+function runner before the body runs. Both gates are
+checked whether or not the host registered a global permission — an app that
+hand-wires `wireAddon({ name: 'console', package: '@pikku/addon-console' })`
 still cannot reach `execFileSync` unauthenticated.
 
-`admin` is spelled as a literal here because it is a scope id in the addon's own
-`wireScope` tree, the same tree the `pikku:scopes:*` gates on the scope-admin
-functions come from.
+The scopes are spelled as literals here because they are scope ids in this
+addon's own `wireScope` tree. The `admin:scopes:*` gates on the scope-admin
+functions come from a different tree — those functions now live in
+`@pikku/addon-admin`, which declares its own. The generated secret and variable
+brokers live in the app's own scaffold rather than the addon, so the addon
+boundary never covered them; they carry `pikku:console:secrets:*` and
+`pikku:console:variables:*` themselves.
 
 **What this rules out:** treating the host's `addGlobalPermission` as the only
 gate in front of an operation that installs code or reads another principal's
@@ -72,5 +80,5 @@ is-this-localhost test.
 
 See [[addon-scopes-are-resolved-where-the-function-runs]],
 [[an-empty-owners-constraint-matches-nothing]],
-[[ai-agent-sessionless-deployments-have-no-thread-ownership]] and
+[[agent-sessionless-deployments-have-no-thread-ownership]] and
 [[global-permissions-and-function-permissions-are-independent-gates]].

package/knowledge/decisions/security/core-safe-fetch-blocks-ssrf-by-host-literal-not-dns.md

@@ -10,7 +10,7 @@ tags: core
 `packages/core/src/utils/safe-fetch.ts` guards every outbound fetch that core
 makes on a caller-supplied URL. `@pikku/core` runs in edge runtimes (Cloudflare
 Workers) that have no Node `dns` module, so the guard cannot resolve a hostname
-and inspect the resulting address. It instead rejects address *literals* that are
+and inspect the resulting address. It instead rejects address _literals_ that are
 obviously internal — loopback, `10/8`, `172.16/12`, `192.168/16`, `0.0.0.0/8`,
 link-local `169.254/16` (the cloud metadata endpoint), IPv6 `::`, `::1`,
 `fe80::/10` and `fc00::/7` — plus the alias forms that reach the same targets:

package/knowledge/decisions/security/gateway-middleware-sessions-must-be-bridged-onto-the-wire.md

@@ -13,8 +13,8 @@ every `runPikkuFunc` call in the gateway runner, copying `await wire.getSession(
 onto `wire.session` when the latter is unset. Gateway middleware is the only
 place a webhook can acquire a session at all — typically by mapping a verified
 platform sender id to a user. Middleware that assigns `wire.session` directly
-needs no help, but the idiomatic `wire.setSession()` writes into the *enclosing
-wiring's* session service, and the handler's own invocation does not read that
+needs no help, but the idiomatic `wire.setSession()` writes into the _enclosing
+wiring's_ session service, and the handler's own invocation does not read that
 service.
 
 Without the bridge, the failure mode is silent and it fails open in the way that

package/knowledge/decisions/security/global-permissions-and-function-permissions-are-independent-gates.md

@@ -23,7 +23,7 @@ satisfy an admin-only function's requirements, because the two gates are
 evaluated independently against separate inputs. An empty or absent group passes,
 so declaring no permissions means "globals only", not "deny".
 
-Globals are bucketed per package, and a function reads *both* the root bucket and
+Globals are bucketed per package, and a function reads _both_ the root bucket and
 its own package's — root first. The generated `addGlobalPermission` wrapper takes
 no package argument, so an application's rules only ever land in the root bucket;
 resolving the package bucket alone meant a host rule like "every request needs a

package/knowledge/decisions/security/http-request-bodies-are-bounded-before-they-are-buffered.md

@@ -26,11 +26,11 @@ they divide into two kinds, and the difference is what can actually be
 prevented rather than merely reported:
 
 - **Prevention.** uWebSockets drives `res.onData` itself, so it counts bytes and
-  *drops* chunks past the limit rather than concatenating, replying 413 before
+  _drops_ chunks past the limit rather than concatenating, replying 413 before
   routing — the only point at which the buffering can be stopped, which is why
   it deviates from the fetch adapter's 404-an-unmatched-route order. Fastify
   delegates to native `bodyLimit`, set only when `maxBodySize` is configured so
-  the default never *loosens* fastify's stricter 1 MB. `PikkuExpressServer`
+  the default never _loosens_ fastify's stricter 1 MB. `PikkuExpressServer`
   feeds the limit into `express.json`/`text`/`urlencoded`.
 - **Rejection only.** `express-middleware` is handed an already-parsed body, so
   its guard makes the rejection uniform but cannot reclaim the memory; a

package/knowledge/decisions/security/index.md

@@ -9,13 +9,14 @@ description: Who may do what in core — gates, defaults, and the failures they
 A rule about who may do what, and which way it fails when it is unsure.
 
 <!-- pikku:knowledge-index -->
+
 - [A dropped audit write is always logged](a-dropped-audit-write-is-always-logged.md) — The no-op audit service falls back to the singleton logger when the wire carries none, so an unconfigured audit call is never silent
 - [A function never receives the secret service](a-function-never-receives-the-secret-service.md) — Every function-, permission- and auth-facing services type is bounded by SecretlessServices, so reaching for `secrets` in a function body is a type error rather than a lint
 - [A graph run starts at an entry node the graph declared](a-graph-run-starts-at-an-entry-node-the-graph-declared.md) — startNode may only name a node in meta.entryNodeIds, and no generated route offers it, because otherwise a caller picks which half of the graph to skip
 - [A permission gets a wire it cannot reply on](a-permission-gets-a-wire-it-cannot-reply-on.md) — The permission wire is typed with Out = never so a permission cannot send on the channel; that narrowing is not a subtype, so the call site asserts
 - [A step runs the function the workflow dispatched it with](a-step-runs-the-function-the-workflow-dispatched-it-with.md) — StepState records the step's function name so the worker can reject a queue message naming a different one, because the step executes under the run owner's identity
 - [A virtual user is never offered a scenario, platform or addon step](a-virtual-user-is-never-offered-a-step-that-would-forge-its-own-oracle.md) — Being able to invoke "the webhook arrives" lets the user manufacture the outcome it exists to discover, which invalidates every finding downstream
-- [A workflow run is read by its owner, and answered by whoever its gate declares](a-workflow-run-is-read-and-approved-by-its-owner.md) — A run started through a session records that user and only that user may read it; who may answer an approval gate is the gate's own declaration, and a run with no recorded owner has no ownership to enforce
+- [A workflow run is read and approved by its owner](a-workflow-run-is-read-and-approved-by-its-owner.md) — A run started through a session records that user and only that user may read it or answer its approval gates; a run with no recorded owner has no ownership to enforce
 - [An actor's missing approval decision defaults to denied](actor-flow-missing-approval-decisions-default-to-denied.md) — Every pending tool call gets an explicit decision; an id the persona LLM omitted is denied, so a dropped field can never read as consent
 - [Actor sign-in is proven by Set-Cookie, not a non-empty jar](actor-sign-in-is-proven-by-set-cookie-not-a-non-empty-jar.md) — HttpScenarioActor tracks its own signedIn flag and requires the sign-in response itself to set a cookie, because a populated jar proves nothing
 - [Actor sign-in only works for actor-flagged users](actor-sign-in-only-works-for-actor-flagged-users.md) — The scenario actor secret mints sessions for user rows flagged actor and nothing else, so holding it never impersonates a real user
@@ -31,7 +32,6 @@ A rule about who may do what, and which way it fails when it is unsure.
 - [An agent thread key is always prefixed with the trusted principal](ai-agent-thread-ownership-composes-the-session-principal.md) — Ownership keys are composed as principal:resourceId, so a client id can sub-divide its own boundary but never widen it
 - [Agent tool permission filtering reads the live function config, not the metadata](ai-agent-tool-filtering-reads-the-live-function-config.md) — The pikkuAuth brand survives only on live permission objects, so a metadata-driven check would silently admit every gated tool
 - [An agent approval is claimed before the tool runs](an-agent-approval-is-claimed-before-the-tool-runs.md) — resolveApproval is a compare-and-swap returning whether this caller won, because the read that precedes it is not a claim and ten concurrent approvals would otherwise mean ten refunds
-- [An approval answer outlives the run it answered](an-approval-answer-outlives-the-run-it-answered.md) — Run state holds a decision only while the gate is open, so the settled answer carries decidedBy/decidedAt into the step result and every attempt is written to the audit sink, which has no foreign key to the run
 - [An empty owners constraint matches nothing](an-empty-owners-constraint-matches-nothing.md) — owners is an authorization boundary, so every storage backend must treat [] as no rows rather than no filter
 - [An exposed function with no gate is reported at codegen, not at boot](an-exposed-ungated-function-is-a-codegen-warning.md) — The check runs in the inspector where function meta and every wireAddon declaration are both in hand, because neither source alone can tell a gated function from an ungated one
 - [An upload is counted as it arrives, not buffered and then measured](an-upload-is-counted-as-it-arrives-not-buffered-then-measured.md) — Reading the whole body before checking its size hands an unauthenticated caller a way to spend the server's memory
@@ -61,4 +61,5 @@ A rule about who may do what, and which way it fails when it is unsure.
 - [A queued workflow step rehydrates its session from the persisted run wire](workflow-queued-steps-rehydrate-their-session-from-the-run-wire.md) — The queue job payload is just `{ runId }`, so without threading `pikkuUserId` an authed step sees no session and throws
 - [Scenario sessions are isolated per actor and reset between scenarios](workflow-scenario-sessions-are-isolated-per-actor-and-per-scenario.md) — One jar per actor keeps two personas from sharing a session; a browser reset keeps one scenario from leaving the next signed in as somebody else
 - [A scenario step is never registered as a callable RPC and never dispatched on the queue](workflow-scenario-steps-are-never-network-invocable.md) — A step drives a browser and holds an actor's session, so exposing it as an RPC would put that reach on the network
+
 <!-- /pikku:knowledge-index -->

package/knowledge/decisions/security/mcp-internal-error-details-are-double-gated-on-production.md

@@ -9,7 +9,7 @@ tags: mcp
 
 `RunMCPEndpointParams.exposeErrors` in
 `packages/core/src/wirings/mcp/mcp-runner.ts` defaults to `!isProduction()`, and
-`runMCPPikkuFunc` checks `exposeErrors && !isProduction()` *again* when building
+`runMCPPikkuFunc` checks `exposeErrors && !isProduction()` _again_ when building
 the `-32603` internal-error response that carries `{ message, stack }`. The
 second check looks redundant against the default — it is not. The default only
 applies when the caller omits the option; a caller that passes

package/knowledge/decisions/security/queue-jobs-carry-the-producers-pikku-user-id.md

@@ -19,10 +19,10 @@ set by whoever enqueues the job. The adapter surfaces it as
 The claim is now HMAC-signed at enqueue and verified in `runQueueJob` — see
 [[queue-job-identities-are-signed-at-enqueue]], which supersedes the "any
 producer may name any user" reading below. Everything here still holds for the
-*authorization* question: signing proves the producer held the deployment
+_authorization_ question: signing proves the producer held the deployment
 secret, not that it was entitled to name that user.
 
-There is no re-authentication at the worker boundary — the queue payload *is* the
+There is no re-authentication at the worker boundary — the queue payload _is_ the
 credential. Workers run with `auth: false`, so nothing downstream re-checks that
 the producer was entitled to name that user. This is deliberate: the whole point
 is to let a background job resolve the same per-user credentials the original
@@ -35,5 +35,5 @@ client-supplied field flow into `JobOptions.pikkuUserId` without an authorizatio
 check first. It also rules out treating the queue as an authorization boundary —
 do not add a "the worker validated the producer's rights" assumption anywhere
 downstream, and do not drop the id from the wire on the theory that workers are
-unauthenticated anyway. Dropping an id that fails *signature* verification is a
+unauthenticated anyway. Dropping an id that fails _signature_ verification is a
 different matter and is what the worker now does.

package/knowledge/decisions/security/remote-addon-tokens-are-client-credentials-not-mesh-trust.md

@@ -23,7 +23,7 @@ logged or traced. Binding a `credentialId` without a wire that supports
 credentials throws rather than falling back to a shared secret.
 
 Resolution fails closed. `null` is returned only when no auth is bound at all,
-which is the addon declaring its remote surface public. Once auth *is* bound, a
+which is the addon declaring its remote surface public. Once auth _is_ bound, a
 resolved value of `null`, `undefined` or `''` raises `RemoteAddonAuthError` (401)
 instead of dispatching an unauthenticated request that the host might accept as
 anonymous.

package/knowledge/decisions/security/scaffold-features-are-authenticated-unless-opted-out.md

@@ -16,7 +16,7 @@ dispatcher that cannot know what it dispatches to — wrong the moment one
 legitimately public sessionless function exists. For `userAdmin` it was
 redundant: the generated functions are `pikkuFunc` with `scopes:
 ['admin:users:list']`, gated twice over already. But for `agent`, `workflow`,
-`events` and `scenarios` it was the *only* gate, because those generate real
+`events` and `scenarios` it was the _only_ gate, because those generate real
 endpoints the app never authors and has nowhere else to declare a gate for.
 A uniform collapse to boolean would have silently opened four surfaces.
 
@@ -33,7 +33,7 @@ it.
 
 The object form is also what makes the legacy strings safe to remove. An
 earlier design used `string` for the output path, under which `"no-auth"` would
-have parsed as *a file named `no-auth`* — every unmigrated config silently
+have parsed as _a file named `no-auth`_ — every unmigrated config silently
 producing nonsense instead of failing. With `boolean | object`, a string is
 never valid, so `resolveScaffoldFeature` refuses `'auth'` and `'no-auth'` by
 name and prints the replacement. Coercing them was rejected outright: the value

package/knowledge/decisions/security/self-authentication-is-declared-not-detected.md

@@ -17,7 +17,7 @@ them on every build.
 The fix is a declaration — `selfAuthenticated: true` on the function config —
 not analysis of the body. Detection would have to recognise an open-ended set of
 authorization idioms, and it fails in the expensive direction: a body that
-*looks* like it checks something silences the warning for a function that
+_looks_ like it checks something silences the warning for a function that
 checks nothing. A declaration cannot be wrong by accident. Someone typed it,
 it is greppable, and it survives into meta where an audit reads it as what it
 is — a claim by a named author, not an inference.

package/knowledge/decisions/security/signed-content-urls-bind-the-request-path.md

@@ -13,8 +13,8 @@ requested. `LocalContent` requires a `JWTService` and throws without one; a
 verifier with no key available rejects with 403 rather than allowing the
 request, logging once per process so an attacker-triggerable path cannot flood.
 
-A signature over `{signedAt, expiresAt, notBefore}` alone proves only *when* a
-URL was issued, never *what* it was issued for. Any valid token was a skeleton
+A signature over `{signedAt, expiresAt, notBefore}` alone proves only _when_ a
+URL was issued, never _what_ it was issued for. Any valid token was a skeleton
 key: swap the pathname from a public thumbnail to a private document and the
 signature still verifies. Timestamps bound the window; only the path binds the
 asset.

package/knowledge/index.md

@@ -6,7 +6,7 @@ description: Why @pikku/core is built the way it is — the reasoning that used
 
 # Knowledge
 
-Pikku's source says *what* it does. These notes say *why*, for the handful of
+Pikku's source says _what_ it does. These notes say _why_, for the handful of
 choices where the code alone reads as arbitrary or, worse, reads as a mistake.
 
 The rule that produced this directory: **reasoning never lives in code.** A
@@ -19,6 +19,8 @@ meta files, the export surface. A note that repeats them is a copy that will
 drift.
 
 <!-- pikku:knowledge-index -->
+
 - [decisions](decisions/index.md) — a rule that was chosen, and what it rules out
 - [questions](questions/index.md) — something asked and not yet answered
+
 <!-- /pikku:knowledge-index -->

package/knowledge/questions/channel-middleware-accepts-bare-factories-that-nothing-resolves.md

@@ -14,7 +14,7 @@ tags: core, channel
 `channel-common.ts` and `channel-handler.ts` — assert across the gap.
 
 A factory is `(input: In) => CorePikkuChannelMiddleware`: the author is meant to
-*call* it at wiring time and put the result in the array.
+_call_ it at wiring time and put the result in the array.
 `combineChannelMiddleware` contains no factory-resolution branch, and neither
 does `combineMiddleware` for ordinary middleware — that is consistent and
 deliberate. So a bare, uncalled factory in `channelMiddleware` would be pushed

package/knowledge/questions/index.md

@@ -11,6 +11,8 @@ currently makes a choice that nobody has defended — the choice stays, the doub
 gets recorded.
 
 <!-- pikku:knowledge-index -->
+
 - [A channel's middleware list accepts bare factories that nothing ever resolves](channel-middleware-accepts-bare-factories-that-nothing-resolves.md) — CoreChannel.channelMiddleware admits CorePikkuChannelMiddlewareFactory, but no runner calls one, so a bare factory would stall the chain
 - [An unauthorized channel reply is sent outside the channel's declared Out type](unauthorized-channel-replies-escape-the-declared-out-type.md) — processMessageHandlers sends a bare string on auth failure, which no generated client type admits — nobody has decided what the typed shape should be
+
 <!-- /pikku:knowledge-index -->

package/package.json

@@ -1,11 +1,9 @@
 {
   "name": "@pikku/core",
-  "version": "0.12.83",
+  "version": "0.12.86",
   "description": "The Pikku runtime — functions, wirings, services, middleware and types",
   "author": "yasser.fadl@gmail.com",
   "license": "MIT",
-  "module": "dist/index.js",
-  "main": "dist/index.js",
   "type": "module",
   "scripts": {
     "tsc": "tsc && tsc -p tsconfig.type-tests.json",
@@ -21,14 +19,15 @@
   "sideEffects": [
     "./dist/errors/errors.js",
     "./dist/wirings/rpc/rpc-runner.js",
-    "./dist/wirings/rpc/remote-addon-auth.js",
+    "./dist/wirings/addon/remote-addon-auth.js",
     "./dist/wirings/workflow/workflow-approval-policy.js",
     "./dist/wirings/workflow/workflow-errors.js",
     "./dist/wirings/workflow/workflow-run-ownership.js",
     "./dist/wirings/workflow/pikku-scenario-service.js"
   ],
   "exports": {
-    ".": "./dist/index.js",
+    ".": "./dist/bootstrap-compat/root.js",
+    "./types": "./dist/types/index.js",
     "./middleware": "./dist/middleware/index.js",
     "./function": "./dist/function/index.js",
     "./channel": "./dist/wirings/channel/index.js",
@@ -46,11 +45,12 @@
     "./scheduler": "./dist/wirings/scheduler/index.js",
     "./trigger": "./dist/wirings/trigger/index.js",
     "./rpc": "./dist/wirings/rpc/index.js",
+    "./addon": "./dist/wirings/addon/index.js",
     "./safe-fetch": "./dist/utils/safe-fetch.js",
     "./node-host-resolver": "./dist/utils/node-host-resolver.js",
     "./mcp": "./dist/wirings/mcp/index.js",
-    "./ai-agent": "./dist/wirings/ai-agent/index.js",
-    "./ai-scorer": "./dist/wirings/ai-scorer/index.js",
+    "./agent": "./dist/wirings/agent/index.js",
+    "./agent-scorer": "./dist/wirings/agent-scorer/index.js",
     "./gateway": "./dist/wirings/gateway/index.js",
     "./cli": "./dist/wirings/cli/index.js",
     "./cli/command-parser": "./dist/wirings/cli/command-parser.js",
@@ -73,7 +73,9 @@
     "./services/temporary-file-service": "./dist/services/temporary-file-service.js",
     "./crypto-utils": "./dist/crypto-utils.js",
     "./hmac": "./dist/utils/hmac.js",
-    "./ecosystem": "./dist/ecosystem.js",
+    "./state": "./dist/pikku-state.js",
+    "./classification": "./dist/classification/index.js",
+    "./utils": "./dist/utils.js",
     "./schema": "./dist/schema.js",
     "./testing": "./dist/testing/index.js",
     "./dev": "./dist/dev/hot-reload.js"
@@ -81,19 +83,19 @@
   "dependencies": {
     "@standard-schema/spec": "^1.1.0",
     "@types/json-schema": "^7.0.15",
-    "cookie": "^1.1.1",
+    "cookie": "^2.0.1",
     "json-schema": "^0.4.0",
-    "path-to-regexp": "^8.3.0",
+    "path-to-regexp": "^8.4.2",
     "picoquery": "^2.5.0"
   },
   "devDependencies": {
     "@ag-ui/core": "0.0.57",
-    "@types/node": "^24.11.0",
-    "esbuild": "~0.27.0",
-    "tsx": "^4.21.0",
+    "@types/node": "^24.13.3",
+    "esbuild": "~0.28.2",
+    "tsx": "^4.23.12",
     "typescript": "^6.0.3"
   },
   "engines": {
     "node": ">=24"
   }
-}
+}

package/scripts/generate-api-report.d.mts

@@ -1 +1 @@
-export {};
+export {}