@pikku/core 0.12.84 → 0.12.86

package/src/public-surface.json

@@ -1,93 +1,6 @@
 {
-  ".": [
-    "AIProviderAuthError",
-    "AIProviderNotConfiguredError",
-    "AbandonedError",
-    "BadGatewayError",
-    "BadRequestError",
-    "ConflictError",
-    "ExpectationFailedError",
-    "ForbiddenError",
-    "GatewayTimeoutError",
-    "GoneError",
-    "HTTPVersionNotSupportedError",
-    "InternalServerError",
-    "InvalidMiddlewareWireError",
-    "InvalidOriginError",
-    "InvalidSessionError",
-    "LengthRequiredError",
-    "LocalEnvironmentOnlyError",
-    "LockedError",
-    "MaxComputeTimeReachedError",
-    "MethodNotAllowedError",
-    "MissingCredentialError",
-    "MissingSchemaError",
-    "MissingScopeError",
-    "MissingServiceError",
-    "MissingSessionError",
-    "NoopAuditService",
-    "NotAcceptableError",
-    "NotFoundError",
-    "NotImplementedError",
-    "PayloadTooLargeError",
-    "PaymentRequiredError",
-    "PikkuError",
-    "PikkuMissingMetaError",
-    "PikkuRequest",
-    "PreconditionFailedError",
-    "ProxyAuthenticationRequiredError",
-    "REDACTED",
-    "RangeNotSatisfiableError",
-    "ReadonlySessionError",
-    "RequestTimeoutError",
-    "SchedulerService",
-    "SecretAccessDeniedError",
-    "SecretCoercionError",
-    "SecretHostNotAllowedError",
-    "ServiceUnavailableError",
-    "TooManyRequestsError",
-    "URITooLongError",
-    "UnauthorizedError",
-    "UnprocessableContentError",
-    "UnsupportedMediaTypeError",
-    "addGlobalPermission",
-    "addTagMiddleware",
-    "assertSecretAllowedForHost",
-    "checkAuthPermissions",
-    "clearPikkuRuntimeState",
-    "createGraph",
-    "createInvocationAudit",
-    "createSecretValue",
-    "fetch",
-    "formatVersionedId",
-    "getAllFunctionNames",
-    "getRelativeTimeOffsetFromNow",
-    "hasScopes",
-    "hashToken",
-    "isExpectedError",
-    "isSecretValue",
-    "isSerializable",
-    "isVersionedId",
-    "parseDurationString",
-    "parseVersionedId",
-    "pikkuAgentMiddleware",
-    "pikkuApprovalDescription",
-    "pikkuAuth",
-    "pikkuCLIRender",
-    "pikkuChannelMiddleware",
-    "pikkuChannelMiddlewareFactory",
-    "pikkuMiddleware",
-    "pikkuMiddlewareFactory",
-    "pikkuPermission",
-    "pikkuPermissionFactory",
-    "pikkuServerLifecycle",
-    "runMiddleware",
-    "stopSingletonServices",
-    "verifyScopes",
-    "wireAddon",
-    "wireRemoteAddon",
-    "withoutSecrets"
-  ],
+  ".": [],
+  "./types": [],
   "./middleware": [
     "addGlobalMiddleware",
     "addGlobalPermission",
@@ -97,18 +10,27 @@
     "authBearer",
     "authCookie",
     "cors",
+    "pikkuAgentMiddleware",
+    "pikkuChannelMiddleware",
+    "pikkuChannelMiddlewareFactory",
+    "pikkuMiddleware",
+    "pikkuMiddlewareFactory",
     "pikkuRemoteAuthMiddleware",
     "runMiddleware",
     "telemetryInner",
     "telemetryOuter"
   ],
   "./function": [
+    "AbandonedError",
+    "PikkuRequest",
     "addFunction",
+    "checkAuthPermissions",
     "getAllFunctionNames",
     "pikkuApprovalDescription",
     "pikkuAuth",
     "pikkuPermission",
-    "pikkuPermissionFactory"
+    "pikkuPermissionFactory",
+    "runPikkuFunc"
   ],
   "./channel": [
     "ChannelDeploymentService",
@@ -139,6 +61,7 @@
     "addWorkflow",
     "assertWorkflowRunOwner",
     "buildRunTimeline",
+    "createGraph",
     "deriveInvocationId",
     "isRef",
     "pikkuWorkflowGraph",
@@ -150,7 +73,7 @@
   "./scenario": [
     "PikkuScenarioService",
     "SCENARIO_SURFACES",
-    "ScenarioBrowserActorRequired",
+    "ScenarioActorRequired",
     "ScenarioBrowserUnavailable",
     "ScenarioHookError",
     "ScenarioNoSurfaceBinding",
@@ -162,7 +85,6 @@
     "createScenarioRunner",
     "pollUntil",
     "renderStepTemplate",
-    "requireActor",
     "requireScenarioEnv",
     "resolveFeatureScenarios",
     "resolveScenarioSurfaces"
@@ -211,6 +133,7 @@
     "defineHTTPRoutes",
     "fetch",
     "fetchData",
+    "httpRouter",
     "logRoutes",
     "toWebRequest",
     "wireHTTP",
@@ -235,11 +158,13 @@
   "./rpc": [
     "PikkuRPCService",
     "RPCNotFoundError",
-    "RemoteAddonAuthError",
     "RemoteAddonConfigError",
     "RemoteAddonRequestError",
+    "rpcService"
+  ],
+  "./addon": [
+    "RemoteAddonAuthError",
     "resolveRemoteAddonToken",
-    "rpcService",
     "wireAddon",
     "wireRemoteAddon"
   ],
@@ -331,7 +256,9 @@
   "./scope": [
     "defineScope",
     "flattenScopeDefinitions",
-    "validateAndBuildScopeDefinitionsMeta"
+    "hasScopes",
+    "validateAndBuildScopeDefinitionsMeta",
+    "verifyScopes"
   ],
   "./role": [
     "defineSystemRole",
@@ -403,11 +330,13 @@
     "UnprocessableContentError",
     "UnsupportedMediaTypeError",
     "WeakKeyMaterialError",
-    "addError"
+    "addError",
+    "isExpectedError"
   ],
   "./services": [
     "ConsoleLogger",
     "DEFAULT_WEBHOOK_RETRIES",
+    "FileScenarioRunStore",
     "InMemoryAgentRunStateService",
     "InMemoryQueueService",
     "InMemorySessionStore",
@@ -425,8 +354,10 @@
     "PikkuCredentialWireService",
     "PikkuSessionService",
     "QueueWebhookService",
+    "SchedulerService",
     "ScopedCredentialService",
     "ScopedSecretService",
+    "SecretAccessDeniedError",
     "SecretHostNotAllowedError",
     "StubTracker",
     "TypedCredentialService",
@@ -440,8 +371,11 @@
     "getStubTracker",
     "isTestRun",
     "pikkuWebhookWorkerFunc",
+    "scenarioArtifactContentType",
+    "scenarioRunSummary",
     "spy",
-    "stub"
+    "stub",
+    "withoutSecrets"
   ],
   "./services/local-meta": ["LocalMetaService"],
   "./services/v8-coverage": ["V8CoverageService"],
@@ -477,161 +411,42 @@
     "wrapDEK"
   ],
   "./hmac": ["hmacSha256Hex", "timingSafeStringEqual"],
-  "./ecosystem": [
-    "addFunction",
-    "addGlobalMiddleware",
-    "addMiddleware",
+  "./state": [
+    "addPackageServiceFactories",
     "getAllPackageStates",
     "getCreateWireServices",
     "getSingletonServices",
-    "httpRouter",
+    "initializePikkuState",
     "pikkuState",
     "resetPikkuState",
-    "runPikkuFunc",
     "setSingletonServices"
   ],
-  "./ecosystem/agent": [
-    "addAgent",
-    "agent",
-    "agentApprove",
-    "agentResume",
-    "agentStream",
-    "canAccessThread",
-    "isOwnedByPrincipal",
-    "resolveModelAlias",
-    "threadOwnerConstraint",
-    "voiceInput",
-    "voiceOutput"
-  ],
-  "./ecosystem/agent-scorer": [
-    "addAgentScorer",
-    "enableScoreSnapshots",
-    "getScoreSnapshot",
-    "gradeRun",
-    "pikkuAgentJudge",
-    "pikkuAgentScorer",
-    "wireAgentScorerQueueWorkers"
-  ],
-  "./ecosystem/channel": [
-    "EventHubStore",
-    "PikkuAbstractChannelHandler",
-    "addChannelMiddleware",
-    "logChannels"
-  ],
-  "./ecosystem/channel/local": ["PikkuLocalChannelHandler"],
-  "./ecosystem/cli": ["CLIError", "executeCLI", "generateCommandHelp"],
-  "./ecosystem/cli/channel": ["executeRawCLIViaChannel", "handleRawCLI"],
-  "./ecosystem/credential": ["validateAndBuildCredentialDefinitionsMeta"],
-  "./ecosystem/dev": ["reconcileAddonRegistry", "reloadGeneratedMeta"],
-  "./ecosystem/function": ["getAllFunctionNames", "pikkuAuth"],
-  "./ecosystem/gateway": [],
-  "./ecosystem/hmac": ["hmacSha256Hex", "timingSafeStringEqual"],
-  "./ecosystem/http": ["DEFAULT_MAX_BODY_SIZE", "logRoutes", "toWebRequest"],
-  "./ecosystem/mcp": [
-    "MCPEndpointRegistry",
-    "MCPError",
-    "getMCPPromptsMeta",
-    "getMCPResourcesMeta",
-    "getMCPToolsMeta"
-  ],
-  "./ecosystem/middleware": [
-    "addGlobalPermission",
-    "authAPIKey",
-    "authCookie",
-    "pikkuRemoteAuthMiddleware",
-    "runMiddleware",
-    "telemetryInner",
-    "telemetryOuter"
-  ],
-  "./ecosystem/node": [],
-  "./ecosystem/node-host-resolver": ["installNodeHostResolver"],
-  "./ecosystem/oauth2": [],
-  "./ecosystem/persona": [
-    "HttpPersona",
-    "createHttpPersonas",
-    "personaEmails",
-    "personaEnvironmentErrors",
-    "personaEnvironmentRefusal",
-    "roleMismatchMessage",
-    "validateAndBuildPersonasMeta",
-    "verifyPersonaRoles"
-  ],
-  "./ecosystem/queue": [
-    "QueueJobDiscardedError",
-    "QueueJobFailedError",
-    "registerQueueWorkers"
-  ],
-  "./ecosystem/remote": ["buildRemoteHeaders"],
-  "./ecosystem/role": [
-    "defineSystemRole",
-    "flattenSystemRoleDefinitions",
-    "validateAndBuildSystemRoleDefinitionsMeta"
-  ],
-  "./ecosystem/rpc": ["wireAddon", "wireRemoteAddon"],
-  "./ecosystem/safe-fetch": ["safeFetch"],
-  "./ecosystem/scenario": [
-    "PikkuScenarioService",
-    "SCENARIO_SURFACES",
-    "addFeature",
-    "composeStepProse",
-    "resolveFeatureScenarios"
-  ],
-  "./ecosystem/scheduler": ["getScheduledTasks"],
-  "./ecosystem/schema": ["addSchema"],
-  "./ecosystem/scope": [
-    "defineScope",
-    "flattenScopeDefinitions",
-    "validateAndBuildScopeDefinitionsMeta"
-  ],
-  "./ecosystem/secret": ["validateAndBuildSecretDefinitionsMeta"],
-  "./ecosystem/services": [
-    "InMemoryAgentRunStateService",
-    "PIKKU_OUTGOING_WEBHOOK_QUEUE_NAME",
-    "PikkuSessionService",
-    "TypedVariablesService",
-    "createMiddlewareSessionWireProps",
-    "getStubTracker",
-    "pikkuWebhookWorkerFunc",
-    "spy"
-  ],
-  "./ecosystem/services/istanbul-coverage": ["IstanbulCoverageService"],
-  "./ecosystem/services/local-content": ["signedContentPath"],
-  "./ecosystem/services/local-content-request-handler": [
-    "createLocalContentRequestHandler",
-    "verifySignedContentRequest"
+  "./classification": [
+    "REDACTED",
+    "SecretCoercionError",
+    "SecretValue",
+    "createSecretValue",
+    "hashToken",
+    "isSecretValue",
+    "unsafeAsHashed",
+    "unsafeAsSealed",
+    "unsafeAsWrapped"
   ],
-  "./ecosystem/services/v8-coverage": ["V8CoverageService"],
-  "./ecosystem/testing": ["defineServiceTests"],
-  "./ecosystem/trigger": [],
-  "./ecosystem/types": [
-    "PikkuRequest",
+  "./utils": [
+    "closeWireServices",
+    "createWeakUID",
     "formatVersionedId",
-    "isExpectedError",
+    "freezeDedupe",
+    "getDurationInMilliseconds",
+    "getRelativeTimeOffset",
+    "getRelativeTimeOffsetFromNow",
+    "getTagGroups",
     "isSerializable",
     "isVersionedId",
     "parseDurationString",
-    "parseVersionedId"
-  ],
-  "./ecosystem/variable": ["validateAndBuildVariableDefinitionsMeta"],
-  "./ecosystem/virtual-user": [
-    "DISPOSITIONS",
-    "PRODUCTION_DISPOSITION",
-    "catalogueClassification",
-    "dispositionProfile",
-    "intentsForPersona",
-    "isReadOnly",
-    "personaScopes",
-    "prepareVirtualUserRun",
-    "reachableCatalogue",
-    "unreachableCatalogue"
-  ],
-  "./ecosystem/workflow": [
-    "assertWorkflowRunOwner",
-    "buildRunTimeline",
-    "isRef",
-    "reconstructFinalState",
-    "reconstructStateAt",
-    "template"
+    "parseVersionedId",
+    "pikkuServerLifecycle",
+    "stopSingletonServices"
   ],
   "./schema": [
     "addSchema",
@@ -641,6 +456,6 @@
     "getSchema",
     "validateSchema"
   ],
-  "./testing": ["defineServiceTests"],
+  "./testing": ["clearPikkuRuntimeState", "defineServiceTests"],
   "./dev": ["pikkuDevReloader", "reconcileAddonRegistry", "reloadGeneratedMeta"]
 }

package/src/public-surface.json.README

@@ -5,9 +5,9 @@ disagree, so widening the API is a visible diff rather than a side effect of an
 
 Types are not pinned: they are erased before the test can enumerate them.
 
-A wildcard subpath is expanded to the files it matches, so `./ecosystem/*` is
-pinned as one entry per area rather than as a pattern — otherwise a new
-sub-barrel joins the published API without a diff.
+A wildcard subpath is expanded to the files it matches, so it is pinned as one
+entry per area rather than as a pattern — otherwise a new sub-barrel joins the
+published API without a diff.
 
 Regenerate after an intentional change, from `packages/core`:
 

package/src/public-surface.test.ts

@@ -19,11 +19,11 @@ const subpaths = packageJson.exports as Record<string, string>
 /**
  * `exports` entries, with a wildcard subpath replaced by the files it matches.
  *
- * `./ecosystem/*` publishes one sub-barrel per area, so pinning it as written
- * would pin a pattern rather than a surface — and a new barrel would appear in
- * the published API without a diff. Expanding it is what keeps each area's
- * exports in `public-surface.json` under the same guarantee as every other
- * entry point's.
+ * A wildcard subpath would pin a pattern rather than a surface, and a module
+ * dropped into the matched directory would appear in the published API without
+ * a diff. Expanding it is what keeps every entry point's exports in
+ * `public-surface.json` under the same guarantee. `exports` declares none
+ * today, and this keeps that from being a silent assumption.
  */
 const entryPoints = (): [string, string][] =>
   Object.entries(subpaths).flatMap(([subpath, dist]) => {

package/src/remote.test.ts

@@ -4,7 +4,7 @@ import { buildRemoteHeaders } from './remote.js'
 import { pikkuRemoteAuthMiddleware } from './middleware/remote-auth.js'
 import { resetPikkuState } from './pikku-state.js'
 import { WeakKeyMaterialError } from './errors/errors.js'
-import { createSecretValue } from './secret-value.js'
+import { createSecretValue } from './classification/secret-value.js'
 
 beforeEach(() => {
   resetPikkuState()

package/src/removed-legacy-exports.test.ts

@@ -14,11 +14,15 @@ const thisFile = fileURLToPath(import.meta.url)
  * They survived as throwing stubs only so the pinned bootstrap CLI could
  * resolve the import; `@pikku/cli@0.12.96` emits none of them, so the stubs
  * went too.
+ *
+ * `ZodLike` sat on the package root, which is now `bootstrap-compat/root.ts` —
+ * what `.` resolves to for the pinned CLI's sake, and the only place a name
+ * could return to the root from.
  */
 const REMOVED = [
   { name: 'addTagPermission', entry: './middleware/index.js' },
   { name: 'addHTTPPermission', entry: './wirings/http/index.js' },
-  { name: 'ZodLike', entry: './index.js' },
+  { name: 'ZodLike', entry: './bootstrap-compat/root.js' },
 ]
 
 const collectSourceFiles = (directory: string): string[] =>

package/src/services/audit-service.ts

@@ -4,7 +4,7 @@ import type {
   PikkuWiringTypes,
 } from '../types/core.types.js'
 import type { Logger } from './logger.js'
-import type { Safe } from '../secret-value.js'
+import type { Safe } from '../classification/secret-value.js'
 
 export type AuditDurability = 'best-effort' | 'transactional'
 export type AuditOutcome = 'success' | 'failed' | 'denied'

package/src/services/credential-wire-service.ts

@@ -1,4 +1,4 @@
-import { isSecretValue } from '../secret-value.js'
+import { isSecretValue } from '../classification/secret-value.js'
 import type { CredentialService } from './credential-service.js'
 import { defaultPikkuUserIdResolver } from './pikku-user-id.js'
 import type { PikkuRawWire } from '../types/core.types.js'

package/src/services/email-service.ts

@@ -1,4 +1,4 @@
-import type { Safe } from '../secret-value.js'
+import type { Safe } from '../classification/secret-value.js'
 
 export interface EmailTemplateReference {
   name: string
@@ -35,9 +35,7 @@ export interface SendTemplateEmailInput extends BaseSendEmailInput {
 }
 
 export type SendEmailInput =
-  | SendTextEmailInput
-  | SendHTMLEmailInput
-  | SendTemplateEmailInput
+  SendTextEmailInput | SendHTMLEmailInput | SendTemplateEmailInput
 
 export interface SendEmailResult {
   messageId?: string