@pikku/core 0.12.83 → 0.12.86

package/dist/function/index.d.ts

@@ -1,4 +1,10 @@
-export { addFunction, getAllFunctionNames } from './function-runner.js';
+export { addFunction, getAllFunctionNames, runPikkuFunc, } from './function-runner.js';
 export { pikkuAuth, pikkuPermission, pikkuPermissionFactory, pikkuApprovalDescription, } from './functions.types.js';
 export type { CorePikkuFunction, CorePikkuFunctionSessionless, CorePikkuFunctionConfig, CorePikkuSessionlessFunctionConfig, CorePikkuAuth, CorePikkuAuthConfig, CorePikkuPermission, } from './functions.types.js';
-export type { ListInput, ListOutput, Filter, } from './list.types.js';
+export type { ListInput, ListOutput, Filter } from './list.types.js';
+export { AbandonedError } from './abort-scope.js';
+export type { AbortScope } from './abort-scope.js';
+export { checkAuthPermissions } from '../permissions.js';
+export type { CorePermissionGroup, CorePikkuApprovalDescription, CorePikkuPermissionConfig, CorePikkuPermissionFactory, } from './functions.types.js';
+export type { FunctionMeta, FunctionRuntimeMeta, FunctionServicesMeta, FunctionWiresMeta, FunctionsMeta, FunctionsRuntimeMeta, PermissionMetadata, } from './function-meta.types.js';
+export { PikkuRequest } from './pikku-request.js';

package/dist/function/index.js

@@ -1,2 +1,5 @@
-export { addFunction, getAllFunctionNames } from './function-runner.js';
+export { addFunction, getAllFunctionNames, runPikkuFunc, } from './function-runner.js';
 export { pikkuAuth, pikkuPermission, pikkuPermissionFactory, pikkuApprovalDescription, } from './functions.types.js';
+export { AbandonedError } from './abort-scope.js';
+export { checkAuthPermissions } from '../permissions.js';
+export { PikkuRequest } from './pikku-request.js';

package/dist/function/pikku-request.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @group RequestResponse
+ */
+export declare abstract class PikkuRequest<In = any> {
+    #private;
+    constructor(data: In);
+    data(): Promise<In>;
+}

package/dist/function/pikku-request.js

@@ -0,0 +1,15 @@
+/**
+ * @group RequestResponse
+ */
+export class PikkuRequest {
+    #data;
+    constructor(data) {
+        this.#data = data;
+    }
+    async data() {
+        if (this.#data === undefined) {
+            throw new Error('Data not found');
+        }
+        return this.#data;
+    }
+}

package/dist/index.d.ts

@@ -1,18 +1,18 @@
 /**
  * @module @pikku/core
  */
-export type { AuthInstance, CommonWireMeta, CoreConfig, CorePikkuMiddleware, CorePikkuMiddlewareConfig, CorePikkuMiddlewareFactory, CorePikkuMiddlewareGroup, CoreServices, CoreSecretlessSingletonServices, CoreSingletonServices, CoreUserSession, SecretlessServices, CreateConfig, ServerLifecycle, FunctionMeta, FunctionServicesMeta, FunctionWiresMeta, FunctionsMeta, FunctionsRuntimeMeta, JSONValue, MakeRequired, MiddlewareMetadata, MiddlewarePriority, PermissionMetadata, PickOptional, PickRequired, PikkuAIMiddlewareHooks, PikkuWire, PikkuRawWire, PikkuWiringTypes, PostgresConfig, RequireAtLeastOne, SecurityAuditIssue, SecurityAuditReport, SecurityAuditSummary, SecurityAuditUpdate, SecuritySeverity, SecurityUpdateLevel, SerializedError, } from './types/core.types.js';
-export { pikkuAIMiddleware, pikkuChannelMiddleware, pikkuChannelMiddlewareFactory, pikkuMiddleware, pikkuMiddlewareFactory, } from './types/core.types.js';
+export type { AuthInstance, CommonWireMeta, CoreConfig, CorePikkuMiddleware, CorePikkuMiddlewareConfig, CorePikkuMiddlewareFactory, CorePikkuMiddlewareGroup, CoreServices, CoreSecretlessSingletonServices, CoreSingletonServices, CoreUserSession, SecretlessServices, CreateConfig, ServerLifecycle, FunctionMeta, FunctionServicesMeta, FunctionWiresMeta, FunctionsMeta, FunctionsRuntimeMeta, JSONValue, MakeRequired, MiddlewareMetadata, MiddlewarePriority, PermissionMetadata, PickOptional, PickRequired, PikkuAgentMiddlewareHooks, PikkuWire, PikkuRawWire, PikkuWiringTypes, PostgresConfig, RequireAtLeastOne, SecurityAuditIssue, SecurityAuditReport, SecurityAuditSummary, SecurityAuditUpdate, SecuritySeverity, SecurityUpdateLevel, SerializedError, } from './types/core.types.js';
+export { pikkuAgentMiddleware, pikkuChannelMiddleware, pikkuChannelMiddlewareFactory, pikkuMiddleware, pikkuMiddlewareFactory, } from './types/core.types.js';
 export type { CorePikkuAuth, CorePikkuAuthConfig, CorePikkuFunction, CorePikkuFunctionConfig, CorePikkuPermission, CorePikkuPermissionConfig, CorePikkuPermissionFactory, CorePikkuApprovalDescription, CorePermissionGroup, } from './function/functions.types.js';
 export { pikkuAuth, pikkuPermission, pikkuPermissionFactory, pikkuApprovalDescription, } from './function/functions.types.js';
 export { getAllFunctionNames } from './function/index.js';
-export type { ListInput, ListOutput, Filter, } from './function/list.types.js';
+export type { ListInput, ListOutput, Filter } from './function/list.types.js';
 export { pikkuCLIRender } from './wirings/cli/cli-runner.js';
 export { PikkuRequest } from './pikku-request.js';
 export { getRelativeTimeOffsetFromNow, parseDurationString, } from './time-utils.js';
 export type { RelativeTimeInput } from './time-utils.js';
 export { formatVersionedId, isVersionedId, parseVersionedId, } from './version.js';
-export { AbandonedError, type AbortScope, } from './function/abort-scope.js';
+export { AbandonedError, type AbortScope } from './function/abort-scope.js';
 export { fetch } from './wirings/http/http-runner.js';
 export type { MCPToolResponse, MCPResourceResponse, MCPPromptResponse, } from './wirings/mcp/mcp.types.js';
 export { AIProviderAuthError, AIProviderNotConfiguredError, BadGatewayError, BadRequestError, ConflictError, ExpectationFailedError, ForbiddenError, GatewayTimeoutError, GoneError, HTTPVersionNotSupportedError, InternalServerError, InvalidMiddlewareWireError, InvalidOriginError, InvalidSessionError, LengthRequiredError, LocalEnvironmentOnlyError, LockedError, MaxComputeTimeReachedError, MethodNotAllowedError, MissingCredentialError, MissingSchemaError, MissingScopeError, MissingServiceError, MissingSessionError, NotAcceptableError, NotFoundError, NotImplementedError, PayloadTooLargeError, PaymentRequiredError, PikkuMissingMetaError, PreconditionFailedError, ProxyAuthenticationRequiredError, RangeNotSatisfiableError, ReadonlySessionError, RequestTimeoutError, ServiceUnavailableError, TooManyRequestsError, URITooLongError, UnauthorizedError, UnprocessableContentError, UnsupportedMediaTypeError, } from './errors/errors.js';
@@ -34,10 +34,10 @@ export type { SchemaService } from './services/schema-service.js';
 export type { SessionService } from './services/user-session-service.js';
 export { NoopAuditService, createInvocationAudit, } from './services/audit-service.js';
 export type { AuditConfig, AuditDurability, AuditEvent, AuditEventBatch, AuditFacets, AuditLog, AuditQuery, AuditQueryResult, AuditService, AuditUserIdentity, ResolvedAuditConfig, } from './services/audit-service.js';
-export type { AIAgentRunnerService, } from './services/ai-agent-runner-service.js';
+export type { AgentRunnerService } from './services/agent-runner-service.js';
 export type { AIEmbeddingService } from './services/ai-embedding-service.js';
-export type { AIRunStateService } from './services/ai-run-state-service.js';
-export type { AIStorageService } from './services/ai-storage-service.js';
+export type { AgentRunStateService } from './services/agent-run-state-service.js';
+export type { AgentStorageService } from './services/agent-storage-service.js';
 export type { EmailsMeta, EmailTemplateMeta, MetaService, } from './services/meta-service.js';
 export type { HTTPMethod } from './wirings/http/http.types.js';
 export type { GraphNodeConfig } from './wirings/workflow/graph/workflow-graph.types.js';
@@ -55,6 +55,6 @@ export { clearPikkuRuntimeState } from './test-utils.js';
 export { type ScheduledTaskInfo, type ScheduledTaskSummary, } from './services/scheduler-service.js';
 export { SchedulerService } from './services/scheduler-service.js';
 export type { Private, Pii, Secret, Classification, AnonymizeStrategy, ClassificationManifest, ColumnForm, WrappedValue, SealedValue, HashedValue, } from './data-classification.js';
-export { hashToken, } from './column-form.js';
+export { hashToken } from './column-form.js';
 export type { SecretValue, Safe } from './secret-value.js';
 export { createSecretValue, isSecretValue, SecretCoercionError, REDACTED, } from './secret-value.js';

package/dist/index.js

@@ -1,11 +1,11 @@
-export { pikkuAIMiddleware, pikkuChannelMiddleware, pikkuChannelMiddlewareFactory, pikkuMiddleware, pikkuMiddlewareFactory, } from './types/core.types.js';
+export { pikkuAgentMiddleware, pikkuChannelMiddleware, pikkuChannelMiddlewareFactory, pikkuMiddleware, pikkuMiddlewareFactory, } from './types/core.types.js';
 export { pikkuAuth, pikkuPermission, pikkuPermissionFactory, pikkuApprovalDescription, } from './function/functions.types.js';
 export { getAllFunctionNames } from './function/index.js';
 export { pikkuCLIRender } from './wirings/cli/cli-runner.js';
 export { PikkuRequest } from './pikku-request.js';
 export { getRelativeTimeOffsetFromNow, parseDurationString, } from './time-utils.js';
 export { formatVersionedId, isVersionedId, parseVersionedId, } from './version.js';
-export { AbandonedError, } from './function/abort-scope.js';
+export { AbandonedError } from './function/abort-scope.js';
 export { fetch } from './wirings/http/http-runner.js';
 export { AIProviderAuthError, AIProviderNotConfiguredError, BadGatewayError, BadRequestError, ConflictError, ExpectationFailedError, ForbiddenError, GatewayTimeoutError, GoneError, HTTPVersionNotSupportedError, InternalServerError, InvalidMiddlewareWireError, InvalidOriginError, InvalidSessionError, LengthRequiredError, LocalEnvironmentOnlyError, LockedError, MaxComputeTimeReachedError, MethodNotAllowedError, MissingCredentialError, MissingSchemaError, MissingScopeError, MissingServiceError, MissingSessionError, NotAcceptableError, NotFoundError, NotImplementedError, PayloadTooLargeError, PaymentRequiredError, PikkuMissingMetaError, PreconditionFailedError, ProxyAuthenticationRequiredError, RangeNotSatisfiableError, ReadonlySessionError, RequestTimeoutError, ServiceUnavailableError, TooManyRequestsError, URITooLongError, UnauthorizedError, UnprocessableContentError, UnsupportedMediaTypeError, } from './errors/errors.js';
 export { PikkuError, isExpectedError } from './errors/error-handler.js';
@@ -21,5 +21,5 @@ export { hasScopes, verifyScopes } from './scopes.js';
 export { isSerializable, stopSingletonServices, pikkuServerLifecycle, } from './utils.js';
 export { clearPikkuRuntimeState } from './test-utils.js';
 export { SchedulerService } from './services/scheduler-service.js';
-export { hashToken, } from './column-form.js';
+export { hashToken } from './column-form.js';
 export { createSecretValue, isSecretValue, SecretCoercionError, REDACTED, } from './secret-value.js';

package/dist/middleware/auth-apikey.d.ts

@@ -1,11 +1,3 @@
-export declare const authAPIKey: import("../types/core.types.js").CorePikkuMiddlewareFactory<{
+export declare const authAPIKey: import("./middleware.types.js").CorePikkuMiddlewareFactory<{
     source: "header" | "query" | "all";
-}, import("../types/core.types.js").CoreSingletonServices<{
-    logLevel?: import("../services/logger.js").LogLevel;
-    secrets?: {
-        requireAllowedHosts?: boolean;
-    };
-    workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
-    webhook?: import("../services/webhook-service.js").WebhookServiceConfig;
-    postgres?: import("../types/core.types.js").PostgresConfig;
-}>, import("../types/core.types.js").CoreUserSession>;
+}>;

package/dist/middleware/auth-apikey.js

@@ -1,4 +1,4 @@
-import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js';
+import { pikkuMiddleware, pikkuMiddlewareFactory, } from './middleware-factories.js';
 export const authAPIKey = pikkuMiddlewareFactory(({ source }) => pikkuMiddleware(async ({ jwt: jwtService }, { http, setSession, session }, next) => {
     if (!http?.request || !setSession || session) {
         return next();

package/dist/middleware/auth-bearer.d.ts

@@ -4,7 +4,7 @@ import type { CoreUserSession } from '../types/core.types.js';
  * time against a static `value` or a `secretId` resolved through the secrets
  * service per request.
  */
-export declare const authBearer: import("../types/core.types.js").CorePikkuMiddlewareFactory<{
+export declare const authBearer: import("./middleware.types.js").CorePikkuMiddlewareFactory<{
     token?: {
         value: string;
         userSession: CoreUserSession;
@@ -12,12 +12,4 @@ export declare const authBearer: import("../types/core.types.js").CorePikkuMiddl
         secretId: string;
         userSession: CoreUserSession;
     };
-}, import("../types/core.types.js").CoreSingletonServices<{
-    logLevel?: import("../services/logger.js").LogLevel;
-    secrets?: {
-        requireAllowedHosts?: boolean;
-    };
-    workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
-    webhook?: import("../services/webhook-service.js").WebhookServiceConfig;
-    postgres?: import("../types/core.types.js").PostgresConfig;
-}>, CoreUserSession>;
+}>;

package/dist/middleware/auth-bearer.js

@@ -1,5 +1,5 @@
 import { InvalidSessionError } from '../errors/errors.js';
-import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js';
+import { pikkuMiddleware, pikkuMiddlewareFactory, } from './middleware-factories.js';
 const constantTimeEqual = (a, b) => {
     if (a.length !== b.length)
         return false;

package/dist/middleware/auth-cookie.d.ts

@@ -1,15 +1,7 @@
 import type { SerializeOptions } from 'cookie';
 import type { RelativeTimeInput } from '../time-utils.js';
-export declare const authCookie: import("../types/core.types.js").CorePikkuMiddlewareFactory<{
+export declare const authCookie: import("./middleware.types.js").CorePikkuMiddlewareFactory<{
     name: string;
     options: SerializeOptions;
     expiresIn: RelativeTimeInput;
-}, import("../types/core.types.js").CoreSingletonServices<{
-    logLevel?: import("../services/logger.js").LogLevel;
-    secrets?: {
-        requireAllowedHosts?: boolean;
-    };
-    workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
-    webhook?: import("../services/webhook-service.js").WebhookServiceConfig;
-    postgres?: import("../types/core.types.js").PostgresConfig;
-}>, import("../types/core.types.js").CoreUserSession>;
+}>;

package/dist/middleware/auth-cookie.js

@@ -1,4 +1,4 @@
-import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js';
+import { pikkuMiddleware, pikkuMiddlewareFactory, } from './middleware-factories.js';
 import { getRelativeTimeOffsetFromNow } from '../time-utils.js';
 /**
  * Reads a JWT session from a cookie, and re-issues the cookie after the

package/dist/middleware/cors.d.ts

@@ -1,21 +1,15 @@
 /**
  * Sets CORS headers on every response and short-circuits OPTIONS preflight
  * with a 204. `origin: true` reflects the request origin; an array reflects a
- * matching origin and otherwise falls back to its first entry.
+ * matching origin and otherwise sends no `Access-Control-Allow-Origin` at all,
+ * so the browser reports "origin not allowed" rather than an origin mismatch
+ * against whichever entry happened to be first.
  */
-export declare const cors: import("../types/core.types.js").CorePikkuMiddlewareFactory<{
+export declare const cors: import("./middleware.types.js").CorePikkuMiddlewareFactory<{
     origin?: string | string[] | true;
     methods?: string[];
     headers?: string[];
     exposeHeaders?: string[];
     credentials?: boolean;
     maxAge?: number;
-}, import("../types/core.types.js").CoreSingletonServices<{
-    logLevel?: import("../services/logger.js").LogLevel;
-    secrets?: {
-        requireAllowedHosts?: boolean;
-    };
-    workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
-    webhook?: import("../services/webhook-service.js").WebhookServiceConfig;
-    postgres?: import("../types/core.types.js").PostgresConfig;
-}>, import("../types/core.types.js").CoreUserSession>;
+}>;

package/dist/middleware/cors.js

@@ -1,8 +1,10 @@
-import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js';
+import { pikkuMiddleware, pikkuMiddlewareFactory, } from './middleware-factories.js';
 /**
  * Sets CORS headers on every response and short-circuits OPTIONS preflight
  * with a 204. `origin: true` reflects the request origin; an array reflects a
- * matching origin and otherwise falls back to its first entry.
+ * matching origin and otherwise sends no `Access-Control-Allow-Origin` at all,
+ * so the browser reports "origin not allowed" rather than an origin mismatch
+ * against whichever entry happened to be first.
  */
 export const cors = pikkuMiddlewareFactory(({ origin = '*', methods = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'], headers = ['Content-Type', 'Authorization', 'x-api-key'], exposeHeaders = [], credentials = false, maxAge = 86400, } = {}) => {
     if (origin === '*' && credentials) {
@@ -11,7 +13,7 @@ export const cors = pikkuMiddlewareFactory(({ origin = '*', methods = ['GET', 'P
     return pikkuMiddleware({
         name: 'CORS',
         description: 'Handles cross-origin requests including OPTIONS preflight',
-        func: async (_services, wires, next) => {
+        func: async (services, wires, next) => {
             const request = wires.http?.request;
             const response = wires.http?.response;
             if (!request || !response) {
@@ -26,18 +28,23 @@ export const cors = pikkuMiddlewareFactory(({ origin = '*', methods = ['GET', 'P
                 allowedOrigin =
                     requestOrigin && origin.includes(requestOrigin)
                         ? requestOrigin
-                        : origin[0];
+                        : undefined;
+                if (requestOrigin && !allowedOrigin) {
+                    services.logger.debug(`CORS: origin '${requestOrigin}' is not in the allowed list, omitting Access-Control-Allow-Origin`);
+                }
             }
             else {
                 allowedOrigin = origin;
             }
-            response.header('Access-Control-Allow-Origin', allowedOrigin);
+            if (allowedOrigin) {
+                response.header('Access-Control-Allow-Origin', allowedOrigin);
+            }
             response.header('Access-Control-Allow-Methods', methods.join(', '));
             response.header('Access-Control-Allow-Headers', headers.join(', '));
             if (exposeHeaders.length > 0) {
                 response.header('Access-Control-Expose-Headers', exposeHeaders.join(', '));
             }
-            if (credentials) {
+            if (credentials && allowedOrigin) {
                 response.header('Access-Control-Allow-Credentials', 'true');
             }
             if (origin === true || Array.isArray(origin)) {

package/dist/middleware/index.d.ts

@@ -6,3 +6,6 @@ export { cors } from './cors.js';
 export { telemetryOuter, telemetryInner } from './telemetry.js';
 export { addTagMiddleware, addTagMiddleware as addMiddleware, addGlobalMiddleware, runMiddleware, } from '../middleware-runner.js';
 export { addGlobalPermission } from '../permissions.js';
+export type { CorePikkuMiddleware, CorePikkuMiddlewareConfig, CorePikkuMiddlewareFactory, CorePikkuMiddlewareGroup, MiddlewareMetadata, MiddlewarePriority, } from './middleware.types.js';
+export { pikkuAgentMiddleware, pikkuChannelMiddleware, pikkuChannelMiddlewareFactory, pikkuMiddleware, pikkuMiddlewareFactory, } from './middleware-factories.js';
+export type { PikkuAgentMiddlewareHooks } from '../wirings/agent/agent.types.js';

package/dist/middleware/index.js

@@ -6,3 +6,4 @@ export { cors } from './cors.js';
 export { telemetryOuter, telemetryInner } from './telemetry.js';
 export { addTagMiddleware, addTagMiddleware as addMiddleware, addGlobalMiddleware, runMiddleware, } from '../middleware-runner.js';
 export { addGlobalPermission } from '../permissions.js';
+export { pikkuAgentMiddleware, pikkuChannelMiddleware, pikkuChannelMiddlewareFactory, pikkuMiddleware, pikkuMiddlewareFactory, } from './middleware-factories.js';

package/dist/middleware/middleware-factories.d.ts

@@ -0,0 +1,9 @@
+import type { CoreSingletonServices, CoreUserSession } from '../types/core.types.js';
+import type { CorePikkuChannelMiddleware, CorePikkuChannelMiddlewareFactory } from '../wirings/channel/channel.types.js';
+import type { PikkuAgentMiddlewareHooks } from '../wirings/agent/agent.types.js';
+import type { CorePikkuMiddleware, CorePikkuMiddlewareConfig, CorePikkuMiddlewareFactory } from './middleware.types.js';
+export declare const pikkuMiddleware: <SingletonServices extends CoreSingletonServices = CoreSingletonServices, UserSession extends CoreUserSession = CoreUserSession>(middleware: CorePikkuMiddleware<SingletonServices, UserSession> | CorePikkuMiddlewareConfig<SingletonServices, UserSession>) => CorePikkuMiddleware<SingletonServices, UserSession>;
+export declare const pikkuMiddlewareFactory: <In = any>(factory: CorePikkuMiddlewareFactory<In>) => CorePikkuMiddlewareFactory<In>;
+export declare const pikkuChannelMiddleware: <SingletonServices extends CoreSingletonServices = CoreSingletonServices, Event = unknown>(middleware: CorePikkuChannelMiddleware<SingletonServices, Event>) => CorePikkuChannelMiddleware<SingletonServices, Event>;
+export declare const pikkuChannelMiddlewareFactory: <In = any>(factory: CorePikkuChannelMiddlewareFactory<In>) => CorePikkuChannelMiddlewareFactory<In>;
+export declare const pikkuAgentMiddleware: <State extends Record<string, unknown> = Record<string, unknown>, SingletonServices extends CoreSingletonServices = CoreSingletonServices>(hooks: PikkuAgentMiddlewareHooks<State, SingletonServices>) => PikkuAgentMiddlewareHooks<State, SingletonServices>;

package/dist/middleware/middleware-factories.js

@@ -0,0 +1,19 @@
+export const pikkuMiddleware = (middleware) => {
+    if (typeof middleware === 'function')
+        return middleware;
+    const func = middleware.func;
+    if (middleware.priority) {
+        func.__priority = middleware.priority;
+    }
+    return func;
+};
+export const pikkuMiddlewareFactory = (factory) => {
+    return factory;
+};
+export const pikkuChannelMiddleware = (middleware) => {
+    return middleware;
+};
+export const pikkuChannelMiddlewareFactory = (factory) => {
+    return factory;
+};
+export const pikkuAgentMiddleware = (hooks) => hooks;

package/dist/middleware/middleware.types.d.ts

@@ -0,0 +1,27 @@
+import type { CoreSingletonServices, CoreUserSession, PikkuWire } from '../types/core.types.js';
+export type CorePikkuMiddleware<SingletonServices extends CoreSingletonServices = CoreSingletonServices, UserSession extends CoreUserSession = CoreUserSession> = (services: SingletonServices, wires: PikkuWire, next: () => Promise<void>) => Promise<void>;
+/**
+ * Execution order: `highest` runs first (outermost in the onion), `lowest`
+ * runs last, closest to the function.
+ */
+export type MiddlewarePriority = 'highest' | 'high' | 'medium' | 'low' | 'lowest';
+export type CorePikkuMiddlewareConfig<SingletonServices extends CoreSingletonServices = CoreSingletonServices, UserSession extends CoreUserSession = CoreUserSession> = {
+    func: CorePikkuMiddleware<SingletonServices, UserSession>;
+    name?: string;
+    description?: string;
+    /** Execution priority. Lower runs first (outermost). Defaults to 'medium'. */
+    priority?: MiddlewarePriority;
+};
+export type CorePikkuMiddlewareFactory<In = any, SingletonServices extends CoreSingletonServices = CoreSingletonServices, UserSession extends CoreUserSession = CoreUserSession> = (input: In) => CorePikkuMiddleware<SingletonServices, UserSession>;
+export type CorePikkuMiddlewareGroup<SingletonServices extends CoreSingletonServices = CoreSingletonServices, UserSession extends CoreUserSession = CoreUserSession> = Array<CorePikkuMiddleware<SingletonServices, UserSession> | CorePikkuMiddlewareFactory<any, SingletonServices, UserSession>>;
+export type MiddlewareMetadata = {
+    type: 'http';
+    route: string;
+} | {
+    type: 'tag';
+    tag: string;
+} | {
+    type: 'wire';
+    name: string;
+    inline?: boolean;
+};

package/dist/middleware/middleware.types.js

@@ -0,0 +1 @@
+export {};

package/dist/middleware/remote-auth.d.ts

@@ -1,4 +1,4 @@
-export declare const pikkuRemoteAuthMiddleware: import("../types/core.types.js").CorePikkuMiddleware<import("../types/core.types.js").CoreSingletonServices<{
+export declare const pikkuRemoteAuthMiddleware: import("./middleware.types.js").CorePikkuMiddleware<import("../types/core.types.js").CoreSingletonServices<{
     logLevel?: import("../services/logger.js").LogLevel;
     secrets?: {
         requireAllowedHosts?: boolean;

package/dist/middleware/remote-auth.js

@@ -1,5 +1,5 @@
 import { UnauthorizedError } from '../errors/errors.js';
-import { pikkuMiddleware } from '../types/core.types.js';
+import { pikkuMiddleware } from './middleware-factories.js';
 import { assertStrongKeyMaterial, decryptWithKeyMaterial, REMOTE_SESSION_INFO, } from '../crypto-utils.js';
 const REMOTE_RPC_PREFIX = '/remote/rpc/';
 /**

package/dist/middleware/telemetry.d.ts

@@ -1,26 +1,10 @@
 /** Outermost telemetry: total duration, including every middleware. */
-export declare const telemetryOuter: import("../types/core.types.js").CorePikkuMiddlewareFactory<void | {
+export declare const telemetryOuter: import("./middleware.types.js").CorePikkuMiddlewareFactory<void | {
     environmentId?: string;
     orgId?: string;
-}, import("../types/core.types.js").CoreSingletonServices<{
-    logLevel?: import("../services/logger.js").LogLevel;
-    secrets?: {
-        requireAllowedHosts?: boolean;
-    };
-    workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
-    webhook?: import("../services/webhook-service.js").WebhookServiceConfig;
-    postgres?: import("../types/core.types.js").PostgresConfig;
-}>, import("../types/core.types.js").CoreUserSession>;
+}>;
 /** Innermost telemetry: function-only duration, excluding outer middleware. */
-export declare const telemetryInner: import("../types/core.types.js").CorePikkuMiddlewareFactory<void | {
+export declare const telemetryInner: import("./middleware.types.js").CorePikkuMiddlewareFactory<void | {
     environmentId?: string;
     orgId?: string;
-}, import("../types/core.types.js").CoreSingletonServices<{
-    logLevel?: import("../services/logger.js").LogLevel;
-    secrets?: {
-        requireAllowedHosts?: boolean;
-    };
-    workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
-    webhook?: import("../services/webhook-service.js").WebhookServiceConfig;
-    postgres?: import("../types/core.types.js").PostgresConfig;
-}>, import("../types/core.types.js").CoreUserSession>;
+}>;

package/dist/middleware/telemetry.js

@@ -1,4 +1,4 @@
-import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js';
+import { pikkuMiddleware, pikkuMiddlewareFactory, } from './middleware-factories.js';
 /** Outermost telemetry: total duration, including every middleware. */
 export const telemetryOuter = pikkuMiddlewareFactory(({ environmentId, orgId } = {}) => {
     return pikkuMiddleware({

package/dist/middleware-runner.d.ts

@@ -1,4 +1,5 @@
-import type { CorePikkuMiddleware, CorePikkuMiddlewareGroup, PikkuWiringTypes, MiddlewareMetadata } from './types/core.types.js';
+import type { PikkuWiringTypes } from './types/core.types.js';
+import type { CorePikkuMiddleware, CorePikkuMiddlewareGroup, MiddlewareMetadata } from './middleware/middleware.types.js';
 export declare const runMiddleware: <Middleware extends CorePikkuMiddleware<any, any>>(services: Parameters<Middleware>[0], wire: Parameters<Middleware>[1], middlewares: readonly Middleware[], main?: () => Promise<unknown>) => Promise<unknown>;
 /**
  * Registers tag-scoped middleware for any wiring carrying the tag. Wrap in a

package/dist/pikku-state.d.ts

@@ -1,4 +1,4 @@
-import type { PikkuPackageState } from './index.js';
+import type { PikkuPackageState } from './types/state.types.js';
 import type { CoreSingletonServices, CreateWireServices } from './types/core.types.js';
 export declare const getAllPackageStates: () => Map<string, PikkuPackageState>;
 export declare const pikkuState: <Type extends keyof PikkuPackageState, Content extends keyof PikkuPackageState[Type]>(packageName: string | null, type: Type, content: Content, value?: PikkuPackageState[Type][Content]) => PikkuPackageState[Type][Content];
@@ -8,3 +8,4 @@ export declare const getSingletonServices: () => CoreSingletonServices;
 export declare const setSingletonServices: (services: CoreSingletonServices) => void;
 export declare const getCreateWireServices: () => CreateWireServices | undefined;
 export declare const addPackageServiceFactories: (packageName: string, factories: NonNullable<PikkuPackageState["package"]["factories"]>) => void;
+export type { PikkuPackageState } from './types/state.types.js';

package/dist/services/{ai-run-state-service.d.ts → agent-run-state-service.d.ts}

@@ -1,8 +1,8 @@
-import type { AgentRunState, PendingApproval } from '../wirings/ai-agent/ai-agent.types.js';
-import type { AIRunScore } from '../wirings/ai-scorer/ai-scorer.types.js';
+import type { AgentRunState, PendingApproval } from '../wirings/agent/agent.types.js';
+import type { AgentRunScore } from '../wirings/agent-scorer/agent-scorer.types.js';
 export type CreateRunInput = Omit<AgentRunState, 'runId'>;
-export type SaveScoreInput = Omit<AIRunScore, 'createdAt'>;
-export interface AIRunStateService {
+export type SaveScoreInput = Omit<AgentRunScore, 'createdAt'>;
+export interface AgentRunStateService {
     createRun(run: CreateRunInput): Promise<string>;
     updateRun(runId: string, updates: Partial<AgentRunState>): Promise<void>;
     getRun(runId: string): Promise<AgentRunState | null>;
@@ -25,5 +25,5 @@ export interface AIRunStateService {
      * grade that was acted on.
      */
     saveScore(score: SaveScoreInput): Promise<void>;
-    getScores(runId: string): Promise<AIRunScore[]>;
+    getScores(runId: string): Promise<AgentRunScore[]>;
 }

package/dist/services/agent-run-state-service.js

@@ -0,0 +1 @@
+export {};

package/dist/services/{ai-agent-runner-service.d.ts → agent-runner-service.d.ts}

@@ -1,11 +1,11 @@
-import type { AIMessage, AIAgentStep, AIAgentToolDef, AIStreamChannel } from '../wirings/ai-agent/ai-agent.types.js';
+import type { AgentMessage, AgentStep, AgentToolDef, AgentStreamChannel } from '../wirings/agent/agent.types.js';
 export type AIProviderOptions = Record<string, Record<string, unknown>>;
-export type AIAgentRunnerParams = {
+export type AgentRunnerParams = {
     model: string;
     temperature?: number;
     instructions: string;
-    messages: AIMessage[];
-    tools: AIAgentToolDef[];
+    messages: AgentMessage[];
+    tools: AgentToolDef[];
     maxSteps: number;
     toolChoice: 'auto' | 'required' | 'none';
     outputSchema?: Record<string, unknown>;
@@ -14,7 +14,7 @@ export type AIAgentRunnerParams = {
     agentId?: string;
     /**
      * Cancels the model call itself, not just delivery of its output. Set by
-     * `streamAIAgent` from the run's interrupt handle so a voice barge-in stops
+     * `streamAgent` from the run's interrupt handle so a voice barge-in stops
      * generation upstream rather than leaving tokens being billed into a stream
      * nobody reads. A runner that ignores it degrades to "the caller stops
      * listening", which is the behaviour before this field existed.
@@ -33,16 +33,16 @@ export type AIAgentRunnerParams = {
      */
     providerOptions?: AIProviderOptions;
 };
-export type AIAgentRunnerResult = {
+export type AgentRunnerResult = {
     text: string;
     object?: unknown;
-    steps: AIAgentStep[];
+    steps: AgentStep[];
     usage: {
         inputTokens: number;
         outputTokens: number;
     };
 };
-export type AIAgentStepResult = {
+export type AgentStepResult = {
     text: string;
     object?: unknown;
     toolCalls: {
@@ -205,9 +205,9 @@ export type AIRerankResult<VALUE extends string | Record<string, unknown>> = {
     providerMetadata?: Record<string, unknown>;
     response?: unknown;
 };
-export interface AIAgentRunnerService {
-    stream(params: AIAgentRunnerParams, channel: AIStreamChannel): Promise<AIAgentStepResult>;
-    run(params: AIAgentRunnerParams): Promise<AIAgentStepResult>;
+export interface AgentRunnerService {
+    stream(params: AgentRunnerParams, channel: AgentStreamChannel): Promise<AgentStepResult>;
+    run(params: AgentRunnerParams): Promise<AgentStepResult>;
     transcribe?(params: AITranscriptionParams): Promise<AITranscriptionResult>;
     generateSpeech?(params: AIGenerateSpeechParams): Promise<AIGenerateSpeechResult>;
     generateImage?(params: AIGenerateImageParams): Promise<AIGenerateImageResult>;
@@ -216,5 +216,5 @@ export interface AIAgentRunnerService {
     rerank?<VALUE extends string | Record<string, unknown>>(params: AIRerankParams<VALUE>): Promise<AIRerankResult<VALUE>>;
     /** Return a new runner that uses the given API key for every LLM call.
      *  Optional — runners that don't support per-key scoping leave this undefined. */
-    withApiKey?(apiKey: string): AIAgentRunnerService;
+    withApiKey?(apiKey: string): AgentRunnerService;
 }

package/dist/services/agent-runner-service.js

@@ -0,0 +1 @@
+export {};

package/dist/services/{ai-storage-service.d.ts → agent-storage-service.d.ts}

@@ -1,18 +1,18 @@
-import type { AIThread, AIMessage } from '../wirings/ai-agent/ai-agent.types.js';
-export interface AIStorageService {
+import type { AgentThread, AgentMessage } from '../wirings/agent/agent.types.js';
+export interface AgentStorageService {
     createThread(resourceId: string, options?: {
         threadId?: string;
         title?: string;
         metadata?: Record<string, unknown>;
-    }): Promise<AIThread>;
-    getThread(threadId: string): Promise<AIThread>;
-    getThreads(resourceId: string): Promise<AIThread[]>;
+    }): Promise<AgentThread>;
+    getThread(threadId: string): Promise<AgentThread>;
+    getThreads(resourceId: string): Promise<AgentThread[]>;
     deleteThread(threadId: string): Promise<void>;
     getMessages(threadId: string, options?: {
         lastN?: number;
         cursor?: string;
-    }): Promise<AIMessage[]>;
-    saveMessages(threadId: string, messages: AIMessage[]): Promise<void>;
+    }): Promise<AgentMessage[]>;
+    saveMessages(threadId: string, messages: AgentMessage[]): Promise<void>;
     getWorkingMemory(id: string, scope: 'resource' | 'thread'): Promise<Record<string, unknown> | null>;
     saveWorkingMemory(id: string, scope: 'resource' | 'thread', data: Record<string, unknown>): Promise<void>;
 }

package/dist/services/agent-storage-service.js

@@ -0,0 +1 @@
+export {};

package/dist/services/audit-service.d.ts

@@ -1,6 +1,6 @@
 import type { CoreUserSession, PikkuWire, PikkuWiringTypes } from '../types/core.types.js';
 import type { Logger } from './logger.js';
-import type { Safe } from '../secret-value.js';
+import type { Safe } from '../classification/secret-value.js';
 export type AuditDurability = 'best-effort' | 'transactional';
 export type AuditOutcome = 'success' | 'failed' | 'denied';
 export type AuditSource = 'auto' | 'explicit';

package/dist/services/credential-wire-service.js

@@ -1,4 +1,4 @@
-import { isSecretValue } from '../secret-value.js';
+import { isSecretValue } from '../classification/secret-value.js';
 import { defaultPikkuUserIdResolver } from './pikku-user-id.js';
 export class PikkuCredentialWireService {
     credentialService;

package/dist/services/email-service.d.ts

@@ -1,4 +1,4 @@
-import type { Safe } from '../secret-value.js';
+import type { Safe } from '../classification/secret-value.js';
 export interface EmailTemplateReference {
     name: string;
     locale?: string;