@pikku/core 0.12.83 → 0.12.86

package/dist/classification/data-classification.d.ts

@@ -0,0 +1,64 @@
+export type Private<T> = T & {
+    readonly __classification__?: 'private';
+};
+export type Pii<T> = T & {
+    readonly __classification__?: 'pii';
+};
+export type Secret<T> = T & {
+    readonly __classification__?: 'secret';
+};
+export type Classification = 'public' | 'private' | 'pii' | 'secret';
+export type AnonymizeStrategy = 'fake:email' | 'fake:name' | 'hash' | 'keep' | null;
+/**
+ * How a column's bytes are represented at rest, as distinct from how sensitive
+ * the value is (`Classification`). The two are independent: a token hash is
+ * `secret` + `hashed` and must never be encrypted, because the hash *is* the
+ * lookup key; a live bearer token is `secret` + `plain` today and should not be.
+ *
+ * `wrapped` and `sealed` are siblings rather than one being "encrypted": both
+ * are ciphertext, and what separates them is who can read it back. Wrapped is
+ * symmetric and the application holds the key. Sealed is asymmetric and the
+ * application holds only the public half, so it can write the value and never
+ * read it. Storing one where the other is expected is silent, permanent data
+ * loss, which is why they are not collapsed into a single `encrypted`.
+ */
+export type ColumnForm = 'plain' | 'hashed' | 'wrapped' | 'sealed';
+declare const wrappedBrand: unique symbol;
+declare const sealedBrand: unique symbol;
+declare const hashedBrand: unique symbol;
+/**
+ * Ciphertext under a symmetric key the application holds — the output of
+ * `envelopeEncrypt`, `wrapDEK` or `envelopeRewrap`.
+ *
+ * Unlike `Secret<T>` the brand is REQUIRED, so a plain `string` is not
+ * assignable and a column declared `form: 'wrapped'` cannot be written with
+ * anything but genuine ciphertext. It stays assignable *to* `string`, so it
+ * still works as a query operand and serializes normally — the constraint is on
+ * construction, not on use.
+ */
+export type WrappedValue = string & {
+    readonly [wrappedBrand]: true;
+};
+/** Ciphertext under a public key whose private half the application does not
+ *  hold. Deliberately not assignable to `WrappedValue`: writing one where the
+ *  other belongs produces a row nobody can ever open. */
+export type SealedValue = string & {
+    readonly [sealedBrand]: true;
+};
+/** A one-way digest of a secret input. The brand's job is narrow — stop a *raw*
+ *  credential being written into the column that should hold its hash. */
+export type HashedValue = string & {
+    readonly [hashedBrand]: true;
+};
+export interface ColumnClassification {
+    classification: Classification;
+    anonymize_strategy: AnonymizeStrategy;
+    /** At-rest representation. Absent means `plain`. */
+    form?: ColumnForm;
+    description?: string;
+}
+export type ClassificationManifest = {
+    version: 1;
+    tables: Record<string, Record<string, ColumnClassification>>;
+};
+export {};

package/dist/classification/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * What a value is, and how it must be handled: the classification brands a
+ * column carries, the stored forms those brands map to, and the wrapper that
+ * keeps a secret out of a log.
+ *
+ * These arrived as three entry points — one for the types, one for the
+ * runtime helpers, one for `SecretValue` — which is the same subject behind
+ * three doors, split by whether a name happens to be a type or a value.
+ */
+export type { Private, Pii, Secret, Classification, AnonymizeStrategy, ColumnForm, WrappedValue, SealedValue, HashedValue, ColumnClassification, ClassificationManifest, } from './data-classification.js';
+export { hashToken, unsafeAsWrapped, unsafeAsSealed, unsafeAsHashed, } from './column-form.js';
+export { REDACTED, SecretCoercionError, SecretValue, createSecretValue, isSecretValue, } from './secret-value.js';
+export type { Safe } from './secret-value.js';

package/dist/classification/index.js

@@ -0,0 +1,2 @@
+export { hashToken, unsafeAsWrapped, unsafeAsSealed, unsafeAsHashed, } from './column-form.js';
+export { REDACTED, SecretCoercionError, SecretValue, createSecretValue, isSecretValue, } from './secret-value.js';

package/dist/classification/secret-value.d.ts

@@ -0,0 +1,56 @@
+import type { Secret } from './data-classification.js';
+declare const secretValueBrand: unique symbol;
+export declare const REDACTED = "[secret]";
+/** Runtime marker, resilient to duplicate copies of core. */
+declare const SECRET_VALUE: unique symbol;
+declare const NODE_INSPECT: unique symbol;
+export declare class SecretCoercionError extends Error {
+    constructor();
+}
+/**
+ * A vault secret. Nominal, so it is not assignable to `string` and every
+ * concretely-typed sink rejects it; `.reveal()` is the one way out, and every
+ * call is a deliberate, greppable disclosure.
+ *
+ * The revealed value carries the erasable `Secret<T>` classification brand, so
+ * the inspector can still follow it one hop past the call.
+ *
+ * Structured serialization redacts to `[secret]` — an audit or log write must
+ * stay honest about the field without crashing the request. String coercion
+ * throws, because a template literal or concatenation is always a leak.
+ */
+export declare class SecretValue<T = string> {
+    #private;
+    readonly [secretValueBrand]: true;
+    readonly [SECRET_VALUE] = true;
+    constructor(value: T);
+    reveal(): Secret<T>;
+    toJSON(): string;
+    [NODE_INSPECT](): string;
+    toString(): never;
+    [Symbol.toPrimitive](): never;
+}
+export declare const createSecretValue: <T>(value: T) => SecretValue<T>;
+export declare const isSecretValue: (value: unknown) => value is SecretValue<unknown>;
+type IsAny<T> = 0 extends 1 & T ? true : false;
+type Passthrough = Function | Date | RegExp | Error | ArrayBuffer | ArrayBufferView;
+/**
+ * Rejects a `SecretValue` anywhere in `T`, however deeply nested, by collapsing
+ * it to `never`.
+ *
+ * For sinks whose parameters are `any`, `unknown` or a free generic — loggers,
+ * queue payloads, channel messages — where nominality alone cannot help.
+ * `any` is passed through untouched: it cannot be guarded, and collapsing it
+ * would reject every legitimate call.
+ *
+ * `Promise`, `Map` and `Set` are recursed into rather than passed through. A
+ * mapped type cannot reach what they hold — mapping their keys yields their
+ * methods, not their contents — so treating them as opaque let a secret ride
+ * through inside one. `Promise` is the case that bites: `getSecret()` returns
+ * `Promise<SecretValue<T>>`, so a forgotten `await` would otherwise log a
+ * secret.
+ */
+export type Safe<T> = IsAny<T> extends true ? T : [Extract<T, SecretValue<any>>] extends [never] ? T extends Promise<infer V> ? Promise<Safe<V>> : T extends Map<infer K, infer V> ? Map<Safe<K>, Safe<V>> : T extends Set<infer V> ? Set<Safe<V>> : T extends Passthrough ? T : T extends object ? {
+    [K in keyof T]: Safe<T[K]>;
+} : T : never;
+export {};

package/dist/classification/secret-value.js

@@ -0,0 +1,46 @@
+export const REDACTED = '[secret]';
+/** Runtime marker, resilient to duplicate copies of core. */
+const SECRET_VALUE = Symbol.for('pikku.secretValue');
+const NODE_INSPECT = Symbol.for('nodejs.util.inspect.custom');
+export class SecretCoercionError extends Error {
+    constructor() {
+        super(`A secret was coerced to a string, which would write it out in the clear. Unwrap it deliberately with .reveal() at the point it reaches the wire.`);
+        this.name = 'SecretCoercionError';
+    }
+}
+/**
+ * A vault secret. Nominal, so it is not assignable to `string` and every
+ * concretely-typed sink rejects it; `.reveal()` is the one way out, and every
+ * call is a deliberate, greppable disclosure.
+ *
+ * The revealed value carries the erasable `Secret<T>` classification brand, so
+ * the inspector can still follow it one hop past the call.
+ *
+ * Structured serialization redacts to `[secret]` — an audit or log write must
+ * stay honest about the field without crashing the request. String coercion
+ * throws, because a template literal or concatenation is always a leak.
+ */
+export class SecretValue {
+    [SECRET_VALUE] = true;
+    #value;
+    constructor(value) {
+        this.#value = value;
+    }
+    reveal() {
+        return this.#value;
+    }
+    toJSON() {
+        return REDACTED;
+    }
+    [NODE_INSPECT]() {
+        return REDACTED;
+    }
+    toString() {
+        throw new SecretCoercionError();
+    }
+    [Symbol.toPrimitive]() {
+        throw new SecretCoercionError();
+    }
+}
+export const createSecretValue = (value) => new SecretValue(value);
+export const isSecretValue = (value) => typeof value === 'object' && value !== null && SECRET_VALUE in value;

package/dist/crypto-utils.d.ts

@@ -1,4 +1,4 @@
-import type { WrappedValue } from './data-classification.js';
+import type { WrappedValue } from './classification/data-classification.js';
 export declare const encryptJSON: (secret: string, value: unknown) => Promise<string>;
 export declare const decryptJSON: <T>(secret: string, token: string) => Promise<T>;
 /**

package/dist/ecosystem/agent-scorer.d.ts

@@ -0,0 +1,12 @@
+export { gradeRun } from '../wirings/agent-scorer/agent-scorer-grade.js';
+export { addAgentScorer } from '../wirings/agent-scorer/agent-scorer-registry.js';
+export { enableScoreSnapshots, getScoreSnapshot, } from '../wirings/agent-scorer/agent-scorer-snapshots.js';
+export { wireAgentScorerQueueWorkers } from '../wirings/agent-scorer/agent-scorer-worker.js';
+export { pikkuAgentJudge, pikkuAgentScorer, } from '../wirings/agent-scorer/agent-scorer.js';
+export type { AgentRunScore, ScorerMeta, } from '../wirings/agent-scorer/agent-scorer.types.js';
+/**
+ * Types the exports above mention but do not themselves export. Without
+ * them a consumer's declaration emit has no name for the type it infers,
+ * and fails with TS2883 rather than reaching for the original entry point.
+ */
+export type { PikkuAgentScorer, ScoreJob, ScorerInput, ScorerOutput, } from '../wirings/agent-scorer/agent-scorer.types.js';

package/dist/ecosystem/agent-scorer.js

@@ -0,0 +1,5 @@
+export { gradeRun } from '../wirings/agent-scorer/agent-scorer-grade.js';
+export { addAgentScorer } from '../wirings/agent-scorer/agent-scorer-registry.js';
+export { enableScoreSnapshots, getScoreSnapshot, } from '../wirings/agent-scorer/agent-scorer-snapshots.js';
+export { wireAgentScorerQueueWorkers } from '../wirings/agent-scorer/agent-scorer-worker.js';
+export { pikkuAgentJudge, pikkuAgentScorer, } from '../wirings/agent-scorer/agent-scorer.js';

package/dist/ecosystem/agent.d.ts

@@ -0,0 +1,21 @@
+export type { AgentRunStateService, CreateRunInput, SaveScoreInput, } from '../services/agent-run-state-service.js';
+export type { AgentRunnerParams, AgentRunnerService, AgentStepResult, } from '../services/agent-runner-service.js';
+export type { AgentStorageService } from '../services/agent-storage-service.js';
+export { agent, agentApprove, agentResume, agentStream, } from '../wirings/agent/agent-helpers.js';
+export { resolveModelAlias } from '../wirings/agent/agent-model-config.js';
+export { canAccessThread, isOwnedByPrincipal, threadOwnerConstraint, } from '../wirings/agent/agent-prepare.js';
+export { addAgent } from '../wirings/agent/agent-registry.js';
+export type { AgentInput, AgentMemoryConfig, AgentMessage, AgentsMeta, AgentStep, AgentContentPart, AgentRunRow, AgentRunService, AgentRunState, AgentStreamChannel, AgentThread, CoreAgent, PendingApproval, PikkuAgentMiddlewareHooks, } from '../wirings/agent/agent.types.js';
+export { voiceInput } from '../wirings/agent/voice-input.js';
+export { voiceOutput } from '../wirings/agent/voice-output.js';
+/**
+ * Types the exports above mention but do not themselves export. Without
+ * them a consumer's declaration emit has no name for the type it infers,
+ * and fails with TS2883 rather than reaching for the original entry point.
+ */
+export type { LogLevel } from '../services/logger.js';
+export type { WebhookServiceConfig } from '../services/webhook-service.js';
+export type { CoreSingletonServices, PostgresConfig, } from '../types/core.types.js';
+export type { SpeakableScripts } from '../wirings/agent/voice-output.js';
+export type { WorkflowServiceConfig } from '../wirings/workflow/workflow.types.js';
+export type { VoiceOutputState } from '../wirings/agent/voice-output.js';

package/dist/ecosystem/agent.js

@@ -0,0 +1,6 @@
+export { agent, agentApprove, agentResume, agentStream, } from '../wirings/agent/agent-helpers.js';
+export { resolveModelAlias } from '../wirings/agent/agent-model-config.js';
+export { canAccessThread, isOwnedByPrincipal, threadOwnerConstraint, } from '../wirings/agent/agent-prepare.js';
+export { addAgent } from '../wirings/agent/agent-registry.js';
+export { voiceInput } from '../wirings/agent/voice-input.js';
+export { voiceOutput } from '../wirings/agent/voice-output.js';

package/dist/ecosystem/channel/local.d.ts

@@ -0,0 +1,3 @@
+export { PikkuLocalChannelHandler } from '../../wirings/channel/local/local-channel-handler.js';
+export { runLocalChannel } from '../../wirings/channel/local/local-channel-runner.js';
+export { LocalEventHubService } from '../../wirings/channel/local/local-eventhub-service.js';

package/dist/ecosystem/channel/local.js

@@ -0,0 +1,3 @@
+export { PikkuLocalChannelHandler } from '../../wirings/channel/local/local-channel-handler.js';
+export { runLocalChannel } from '../../wirings/channel/local/local-channel-runner.js';
+export { LocalEventHubService } from '../../wirings/channel/local/local-eventhub-service.js';

package/dist/ecosystem/channel/serverless.d.ts

@@ -0,0 +1,9 @@
+export { runChannelConnect, runChannelDisconnect, runChannelMessage, } from '../../wirings/channel/serverless/serverless-channel-runner.js';
+export type { RunServerlessChannelParams } from '../../wirings/channel/serverless/serverless-channel-runner.js';
+/**
+ * Types the exports above mention but do not themselves export. Without
+ * them a consumer's declaration emit has no name for the type it infers,
+ * and fails with TS2883 rather than reaching for the original entry point.
+ */
+export type { ChannelStore } from '../../wirings/channel/channel-store.js';
+export type { PikkuChannelHandlerFactory } from '../../wirings/channel/channel.types.js';

package/dist/ecosystem/channel/serverless.js

@@ -0,0 +1 @@
+export { runChannelConnect, runChannelDisconnect, runChannelMessage, } from '../../wirings/channel/serverless/serverless-channel-runner.js';

package/dist/ecosystem/channel.d.ts

@@ -0,0 +1,15 @@
+export { addChannelMiddleware } from '../wirings/channel/channel-middleware-runner.js';
+export type { Capabilities } from '../wirings/channel/channel-rpc.types.js';
+export { ChannelStore } from '../wirings/channel/channel-store.js';
+export type { Channel } from '../wirings/channel/channel-store.js';
+export type { BinaryData, ChannelMessageMeta, ChannelMeta, ChannelsMeta, CoreChannel, CorePikkuChannelMiddleware, CorePikkuChannelMiddlewareFactory, PikkuChannelHandlerFactory, } from '../wirings/channel/channel.types.js';
+export type { EventHubService } from '../wirings/channel/eventhub-service.js';
+export { EventHubStore } from '../wirings/channel/eventhub-store.js';
+export { logChannels } from '../wirings/channel/log-channels.js';
+export { PikkuAbstractChannelHandler } from '../wirings/channel/pikku-abstract-channel-handler.js';
+/**
+ * Types the exports above mention but do not themselves export. Without
+ * them a consumer's declaration emit has no name for the type it infers,
+ * and fails with TS2883 rather than reaching for the original entry point.
+ */
+export type { Logger } from '../services/logger.js';

package/dist/ecosystem/channel.js

@@ -0,0 +1,5 @@
+export { addChannelMiddleware } from '../wirings/channel/channel-middleware-runner.js';
+export { ChannelStore } from '../wirings/channel/channel-store.js';
+export { EventHubStore } from '../wirings/channel/eventhub-store.js';
+export { logChannels } from '../wirings/channel/log-channels.js';
+export { PikkuAbstractChannelHandler } from '../wirings/channel/pikku-abstract-channel-handler.js';

package/dist/ecosystem/cli/channel.d.ts

@@ -0,0 +1,16 @@
+export { handleRawCLI } from '../../wirings/cli/channel/cli-raw-channel-runner.js';
+export type { RawCLIFrame } from '../../wirings/cli/channel/cli-raw-channel-runner.js';
+export { executeRawCLIViaChannel } from '../../wirings/cli/channel/cli-raw-client-runner.js';
+export type { CorePikkuCLIClientRender } from '../../wirings/cli/channel/cli-raw-client-runner.js';
+/**
+ * Types the exports above mention but do not themselves export. Without
+ * them a consumer's declaration emit has no name for the type it infers,
+ * and fails with TS2883 rather than reaching for the original entry point.
+ */
+export type { LogLevel } from '../../services/logger.js';
+export type { WebhookServiceConfig } from '../../services/webhook-service.js';
+export type { CoreSingletonServices, CoreUserSession, CreateWireServices, PostgresConfig, } from '../../types/core.types.js';
+export type { ApprovalRequester, Capabilities, } from '../../wirings/channel/channel-rpc.types.js';
+export type { PikkuChannel } from '../../wirings/channel/channel.types.js';
+export type { RawCLIResult } from '../../wirings/cli/channel/cli-raw-channel-runner.js';
+export type { WorkflowServiceConfig } from '../../wirings/workflow/workflow.types.js';

package/dist/ecosystem/cli/channel.js

@@ -0,0 +1,2 @@
+export { handleRawCLI } from '../../wirings/cli/channel/cli-raw-channel-runner.js';
+export { executeRawCLIViaChannel } from '../../wirings/cli/channel/cli-raw-client-runner.js';

package/dist/ecosystem/cli.d.ts

@@ -0,0 +1,9 @@
+export { CLIError, executeCLI, pikkuCLIRender, } from '../wirings/cli/cli-runner.js';
+export type { CLICommandMeta, CLIMeta, CLIProgramMeta, CoreCLI, CoreCLICommandConfig, CorePikkuCLIRender, } from '../wirings/cli/cli.types.js';
+export { generateCommandHelp } from '../wirings/cli/command-parser.js';
+/**
+ * Types the exports above mention but do not themselves export. Without
+ * them a consumer's declaration emit has no name for the type it infers,
+ * and fails with TS2883 rather than reaching for the original entry point.
+ */
+export type { CreateConfig, CreateSingletonServices, CreateWireServices, } from '../types/core.types.js';

package/dist/ecosystem/cli.js

@@ -0,0 +1,2 @@
+export { CLIError, executeCLI, pikkuCLIRender, } from '../wirings/cli/cli-runner.js';
+export { generateCommandHelp } from '../wirings/cli/command-parser.js';

package/dist/ecosystem/credential.d.ts

@@ -0,0 +1,10 @@
+export type { CredentialService } from '../services/credential-service.js';
+export type { CredentialDefinitions } from '../wirings/credential/credential.types.js';
+export { validateAndBuildCredentialDefinitionsMeta } from '../wirings/credential/validate-credential-definitions.js';
+/**
+ * Types the exports above mention but do not themselves export. Without
+ * them a consumer's declaration emit has no name for the type it infers,
+ * and fails with TS2883 rather than reaching for the original entry point.
+ */
+export type { SchemaRefLike } from '../types/core.types.js';
+export type { CredentialDefinitionsMeta } from '../wirings/credential/credential.types.js';

package/dist/ecosystem/credential.js

@@ -0,0 +1 @@
+export { validateAndBuildCredentialDefinitionsMeta } from '../wirings/credential/validate-credential-definitions.js';

package/dist/ecosystem/crypto-utils.d.ts

@@ -0,0 +1,8 @@
+export { deriveKEK, envelopeDecrypt, envelopeEncrypt, envelopeRewrap, generateKEKSalt, } from '../crypto-utils.js';
+export type { EnvelopeEncryptResult } from '../crypto-utils.js';
+/**
+ * Types the exports above mention but do not themselves export. Without
+ * them a consumer's declaration emit has no name for the type it infers,
+ * and fails with TS2883 rather than reaching for the original entry point.
+ */
+export type { WrappedValue } from '../data-classification.js';

package/dist/ecosystem/crypto-utils.js

@@ -0,0 +1 @@
+export { deriveKEK, envelopeDecrypt, envelopeEncrypt, envelopeRewrap, generateKEKSalt, } from '../crypto-utils.js';

package/dist/ecosystem/dev.d.ts

@@ -0,0 +1,9 @@
+export { pikkuDevReloader } from '../dev/hot-reload.js';
+export { reconcileAddonRegistry, reloadGeneratedMeta, } from '../dev/reload-meta.js';
+/**
+ * Types the exports above mention but do not themselves export. Without
+ * them a consumer's declaration emit has no name for the type it infers,
+ * and fails with TS2883 rather than reaching for the original entry point.
+ */
+export type { ReloadGeneratedMetaOptions } from '../dev/reload-meta.js';
+export type { Logger } from '../services/logger.js';

package/dist/ecosystem/dev.js

@@ -0,0 +1,2 @@
+export { pikkuDevReloader } from '../dev/hot-reload.js';
+export { reconcileAddonRegistry, reloadGeneratedMeta, } from '../dev/reload-meta.js';

package/dist/ecosystem/errors.d.ts

@@ -0,0 +1,8 @@
+export * from '../errors/errors.js';
+export { PikkuError, addError } from '../errors/error-handler.js';
+/**
+ * Types the exports above mention but do not themselves export. Without
+ * them a consumer's declaration emit has no name for the type it infers,
+ * and fails with TS2883 rather than reaching for the original entry point.
+ */
+export type { ErrorDetails } from '../errors/error-handler.js';

package/dist/ecosystem/errors.js

@@ -0,0 +1,2 @@
+export * from '../errors/errors.js';
+export { PikkuError, addError } from '../errors/error-handler.js';

package/dist/ecosystem/function.d.ts

@@ -0,0 +1,13 @@
+export { addFunction, getAllFunctionNames, } from '../function/function-runner.js';
+export { pikkuAuth } from '../function/functions.types.js';
+export type { CorePikkuAuth, CorePikkuAuthConfig, CorePikkuFunction, CorePikkuFunctionConfig, CorePikkuFunctionSessionless, CorePikkuPermission, CorePikkuSessionlessFunctionConfig, } from '../function/functions.types.js';
+export type { ListInput, ListOutput } from '../function/list.types.js';
+/**
+ * Types the exports above mention but do not themselves export. Without
+ * them a consumer's declaration emit has no name for the type it infers,
+ * and fails with TS2883 rather than reaching for the original entry point.
+ */
+export type { LogLevel } from '../services/logger.js';
+export type { WebhookServiceConfig } from '../services/webhook-service.js';
+export type { CoreSecretlessSingletonServices, CoreSingletonServices, CoreUserSession, PostgresConfig, SecretlessServices, } from '../types/core.types.js';
+export type { WorkflowServiceConfig } from '../wirings/workflow/workflow.types.js';

package/dist/ecosystem/function.js

@@ -0,0 +1,2 @@
+export { addFunction, getAllFunctionNames, } from '../function/function-runner.js';
+export { pikkuAuth } from '../function/functions.types.js';

package/dist/ecosystem/gateway.d.ts

@@ -0,0 +1 @@
+export type { GatewayTransportType, GatewaysMeta, } from '../wirings/gateway/gateway.types.js';

package/dist/ecosystem/hmac.d.ts

@@ -0,0 +1 @@
+export { hmacSha256Hex, timingSafeStringEqual } from '../utils/hmac.js';

package/dist/ecosystem/hmac.js

@@ -0,0 +1 @@
+export { hmacSha256Hex, timingSafeStringEqual } from '../utils/hmac.js';

package/dist/ecosystem/http.d.ts

@@ -0,0 +1,13 @@
+export { fetch, fetchData, wireHTTP } from '../wirings/http/http-runner.js';
+export type { AssertHTTPWiringParams, CoreHTTPFunctionWiring, HTTPMethod, HTTPRouteBaseConfig, HTTPWiringsMeta, PikkuHTTP, PikkuHTTPResponse, PikkuQuery, RunHTTPWiringOptions, } from '../wirings/http/http.types.js';
+export { logRoutes } from '../wirings/http/log-http-routes.js';
+export { DEFAULT_MAX_BODY_SIZE, PikkuFetchHTTPRequest, } from '../wirings/http/pikku-fetch-http-request.js';
+export { PikkuFetchHTTPResponse } from '../wirings/http/pikku-fetch-http-response.js';
+export { toWebRequest } from '../wirings/http/web-request.js';
+/**
+ * Types the exports above mention but do not themselves export. Without
+ * them a consumer's declaration emit has no name for the type it infers,
+ * and fails with TS2883 rather than reaching for the original entry point.
+ */
+export type { Logger } from '../services/logger.js';
+export type { PikkuHTTPRequest } from '../wirings/http/http.types.js';

package/dist/ecosystem/http.js

@@ -0,0 +1,5 @@
+export { fetch, fetchData, wireHTTP } from '../wirings/http/http-runner.js';
+export { logRoutes } from '../wirings/http/log-http-routes.js';
+export { DEFAULT_MAX_BODY_SIZE, PikkuFetchHTTPRequest, } from '../wirings/http/pikku-fetch-http-request.js';
+export { PikkuFetchHTTPResponse } from '../wirings/http/pikku-fetch-http-response.js';
+export { toWebRequest } from '../wirings/http/web-request.js';

package/dist/ecosystem/mcp.d.ts

@@ -0,0 +1,3 @@
+export { MCPEndpointRegistry } from '../wirings/mcp/mcp-endpoint-registry.js';
+export { MCPError, getMCPPromptsMeta, getMCPResourcesMeta, getMCPToolsMeta, runMCPPrompt, runMCPResource, runMCPTool, } from '../wirings/mcp/mcp-runner.js';
+export type { AssertMCPResourceURIParams, CoreMCPPrompt, CoreMCPResource, MCPPromptMeta, MCPResourceMeta, MCPToolMeta, MCPToolResponse, PikkuMCP, } from '../wirings/mcp/mcp.types.js';

package/dist/ecosystem/mcp.js

@@ -0,0 +1,2 @@
+export { MCPEndpointRegistry } from '../wirings/mcp/mcp-endpoint-registry.js';
+export { MCPError, getMCPPromptsMeta, getMCPResourcesMeta, getMCPToolsMeta, runMCPPrompt, runMCPResource, runMCPTool, } from '../wirings/mcp/mcp-runner.js';

package/dist/ecosystem/middleware.d.ts

@@ -0,0 +1,18 @@
+export { addGlobalMiddleware, runMiddleware } from '../middleware-runner.js';
+export { authAPIKey } from '../middleware/auth-apikey.js';
+export { authCookie } from '../middleware/auth-cookie.js';
+export { pikkuRemoteAuthMiddleware } from '../middleware/remote-auth.js';
+export { telemetryInner, telemetryOuter } from '../middleware/telemetry.js';
+export { addGlobalPermission } from '../permissions.js';
+export { pikkuMiddleware } from '../types/core.types.js';
+/**
+ * Types the exports above mention but do not themselves export. Without
+ * them a consumer's declaration emit has no name for the type it infers,
+ * and fails with TS2883 rather than reaching for the original entry point.
+ */
+export type { CorePermissionGroup, CorePikkuPermission, } from '../function/functions.types.js';
+export type { LogLevel } from '../services/logger.js';
+export type { WebhookServiceConfig } from '../services/webhook-service.js';
+export type { RelativeTimeInput } from '../time-utils.js';
+export type { CorePikkuMiddleware, CorePikkuMiddlewareFactory, CoreSingletonServices, CoreUserSession, PostgresConfig, } from '../types/core.types.js';
+export type { WorkflowServiceConfig } from '../wirings/workflow/workflow.types.js';

package/dist/ecosystem/middleware.js

@@ -0,0 +1,7 @@
+export { addGlobalMiddleware, runMiddleware } from '../middleware-runner.js';
+export { authAPIKey } from '../middleware/auth-apikey.js';
+export { authCookie } from '../middleware/auth-cookie.js';
+export { pikkuRemoteAuthMiddleware } from '../middleware/remote-auth.js';
+export { telemetryInner, telemetryOuter } from '../middleware/telemetry.js';
+export { addGlobalPermission } from '../permissions.js';
+export { pikkuMiddleware } from '../types/core.types.js';

package/dist/ecosystem/node-host-resolver.d.ts

@@ -0,0 +1 @@
+export { installNodeHostResolver } from '../utils/node-host-resolver.js';

package/dist/ecosystem/node-host-resolver.js

@@ -0,0 +1 @@
+export { installNodeHostResolver } from '../utils/node-host-resolver.js';

package/dist/ecosystem/node.d.ts

@@ -0,0 +1 @@
+export type { CoreNodeConfig, NodeType, NodesMeta, } from '../wirings/node/node.types.js';

package/dist/ecosystem/oauth2.d.ts

@@ -0,0 +1 @@
+export type { OAuth2AppCredential, OAuth2Token, } from '../wirings/oauth2/oauth2.types.js';

package/dist/ecosystem/oauth2.js

@@ -0,0 +1 @@
+export {};

package/dist/ecosystem/persona.d.ts

@@ -0,0 +1,17 @@
+export { HttpPersona, createHttpPersonas } from '../services/http-personas.js';
+export type { HttpPersonasConfig } from '../services/http-personas.js';
+export { postScenarioJson, readScenarioHttpResponse, } from '../services/personas-service.js';
+export type { ScenarioHttpResponse } from '../services/personas-service.js';
+export { personaEmails } from '../wirings/persona/persona-email.js';
+export { personaEnvironmentErrors, personaEnvironmentRefusal, } from '../wirings/persona/persona-environments.js';
+export type { CorePersona, PersonaAccountMeta, PersonaDefinitions, PersonaMeta, } from '../wirings/persona/persona.types.js';
+export { isRunnablePersona, roleMismatchMessage, validateAndBuildPersonasMeta, verifyPersonaRoles, } from '../wirings/persona/validate-personas.js';
+/**
+ * Types the exports above mention but do not themselves export. Without
+ * them a consumer's declaration emit has no name for the type it infers,
+ * and fails with TS2883 rather than reaching for the original entry point.
+ */
+export type { ScenarioPersonas } from '../services/personas-service.js';
+export type { PersonaEnvironment, PersonaEnvironmentSubject, } from '../wirings/persona/persona-environments.js';
+export type { PersonasMeta } from '../wirings/persona/persona.types.js';
+export type { RoleVerification } from '../wirings/persona/validate-personas.js';

package/dist/ecosystem/persona.js

@@ -0,0 +1,5 @@
+export { HttpPersona, createHttpPersonas } from '../services/http-personas.js';
+export { postScenarioJson, readScenarioHttpResponse, } from '../services/personas-service.js';
+export { personaEmails } from '../wirings/persona/persona-email.js';
+export { personaEnvironmentErrors, personaEnvironmentRefusal, } from '../wirings/persona/persona-environments.js';
+export { isRunnablePersona, roleMismatchMessage, validateAndBuildPersonasMeta, verifyPersonaRoles, } from '../wirings/persona/validate-personas.js';

package/dist/ecosystem/queue.d.ts

@@ -0,0 +1,13 @@
+export { InMemoryQueueService } from '../services/in-memory-queue-service.js';
+export { QueueWebhookService } from '../services/queue-webhook-service.js';
+export { QueueJobDiscardedError, QueueJobFailedError, runQueueJob, } from '../wirings/queue/queue-runner.js';
+export type { ConfigValidationResult, CoreQueueWorker, JobOptions, PikkuJobConfig, PikkuWorkerConfig, QueueJob, QueueJobStatus, QueueService, QueueWorkers, QueueWorkersMeta, } from '../wirings/queue/queue.types.js';
+export { registerQueueWorkers } from '../wirings/queue/register-queue-helper.js';
+export type { QueueConfigMapping } from '../wirings/queue/validate-worker-config.js';
+/**
+ * Types the exports above mention but do not themselves export. Without
+ * them a consumer's declaration emit has no name for the type it infers,
+ * and fails with TS2883 rather than reaching for the original entry point.
+ */
+export type { Logger } from '../services/logger.js';
+export type { QueueRegistrationCallback } from '../wirings/queue/register-queue-helper.js';

package/dist/ecosystem/queue.js

@@ -0,0 +1,4 @@
+export { InMemoryQueueService } from '../services/in-memory-queue-service.js';
+export { QueueWebhookService } from '../services/queue-webhook-service.js';
+export { QueueJobDiscardedError, QueueJobFailedError, runQueueJob, } from '../wirings/queue/queue-runner.js';
+export { registerQueueWorkers } from '../wirings/queue/register-queue-helper.js';

package/dist/ecosystem/remote.d.ts

@@ -0,0 +1,8 @@
+export { buildRemoteHeaders } from '../remote.js';
+/**
+ * Types the exports above mention but do not themselves export. Without
+ * them a consumer's declaration emit has no name for the type it infers,
+ * and fails with TS2883 rather than reaching for the original entry point.
+ */
+export type { JWTService } from '../services/jwt-service.js';
+export type { SecretService } from '../services/secret-service.js';

package/dist/ecosystem/remote.js

@@ -0,0 +1 @@
+export { buildRemoteHeaders } from '../remote.js';

package/dist/ecosystem/role.d.ts

@@ -0,0 +1,4 @@
+export type { Role } from '../services/scope-service.js';
+export { defineSystemRole } from '../wirings/role/define-system-role.js';
+export type { CoreSystemRole, CoreSystemRoles, SystemRole, SystemRoleDefinitionMeta, SystemRoleDefinitions, SystemRoleDefinitionsMeta, } from '../wirings/role/role.types.js';
+export { flattenSystemRoleDefinitions, validateAndBuildSystemRoleDefinitionsMeta, } from '../wirings/role/validate-role-definitions.js';

package/dist/ecosystem/role.js

@@ -0,0 +1,2 @@
+export { defineSystemRole } from '../wirings/role/define-system-role.js';
+export { flattenSystemRoleDefinitions, validateAndBuildSystemRoleDefinitionsMeta, } from '../wirings/role/validate-role-definitions.js';

package/dist/ecosystem/rpc.d.ts

@@ -0,0 +1,6 @@
+export { rpcService } from '../wirings/rpc/rpc-runner.js';
+export type { PikkuRPC } from '../wirings/rpc/rpc-types.js';
+export { wireAddon } from '../wirings/rpc/wire-addon.js';
+export type { WireAddonConfig } from '../wirings/rpc/wire-addon.js';
+export { wireRemoteAddon } from '../wirings/rpc/wire-remote-addon.js';
+export type { RemoteAddonAuth, WireRemoteAddonConfig, } from '../wirings/rpc/wire-remote-addon.js';

package/dist/ecosystem/rpc.js

@@ -0,0 +1,3 @@
+export { rpcService } from '../wirings/rpc/rpc-runner.js';
+export { wireAddon } from '../wirings/rpc/wire-addon.js';
+export { wireRemoteAddon } from '../wirings/rpc/wire-remote-addon.js';

package/dist/ecosystem/safe-fetch.d.ts

@@ -0,0 +1,7 @@
+export { safeFetch } from '../utils/safe-fetch.js';
+/**
+ * Types the exports above mention but do not themselves export. Without
+ * them a consumer's declaration emit has no name for the type it infers,
+ * and fails with TS2883 rather than reaching for the original entry point.
+ */
+export type { SafeFetchOptions } from '../utils/safe-fetch.js';

package/dist/ecosystem/safe-fetch.js

@@ -0,0 +1 @@
+export { safeFetch } from '../utils/safe-fetch.js';