@pikku/core 0.12.84 → 0.12.88

package/src/middleware/telemetry.ts

@@ -1,5 +1,7 @@
-import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js'
-
+import {
+  pikkuMiddleware,
+  pikkuMiddlewareFactory,
+} from './middleware-factories.js'
 /** Outermost telemetry: total duration, including every middleware. */
 export const telemetryOuter = pikkuMiddlewareFactory<{
   environmentId?: string

package/src/middleware-runner.test.ts

@@ -9,9 +9,8 @@ import { pikkuState, resetPikkuState } from './pikku-state.js'
 import type {
   CorePikkuMiddleware,
   MiddlewarePriority,
-} from './types/core.types.js'
-import { pikkuMiddleware } from './types/core.types.js'
-
+} from './middleware/middleware.types.js'
+import { pikkuMiddleware } from './middleware/middleware-factories.js'
 const withPriority = (
   name: string,
   priority: MiddlewarePriority,

package/src/middleware-runner.ts

@@ -1,10 +1,10 @@
+import type { PikkuWiringTypes } from './types/core.types.js'
 import type {
   CorePikkuMiddleware,
   CorePikkuMiddlewareGroup,
-  PikkuWiringTypes,
   MiddlewareMetadata,
   MiddlewarePriority,
-} from './types/core.types.js'
+} from './middleware/middleware.types.js'
 import { pikkuState } from './pikku-state.js'
 import { freezeDedupe, getTagGroups } from './utils.js'
 

package/src/no-root-barrel.test.ts

@@ -0,0 +1,114 @@
+import { test, describe } from 'node:test'
+import * as assert from 'assert'
+import ts from 'typescript'
+import { readFileSync, readdirSync, statSync } from 'node:fs'
+import { dirname, join, relative } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+/**
+ * The package root was one barrel of 206 names that no bundler could take
+ * apart, and the one specifier that revealed nothing about what a consumer
+ * actually used.
+ *
+ * It is gone. Every name lives on the subpath that owns it, and every import
+ * carries that subpath. What survives is a bootstrap shim, which the second
+ * test here holds to its exact contents.
+ */
+const repoRoot = join(dirname(fileURLToPath(import.meta.url)), '../../..')
+
+const skipDirectory = new Set([
+  'node_modules',
+  'dist',
+  '.git',
+  'build',
+  'coverage',
+])
+
+const walk = (dir: string, out: string[] = []): string[] => {
+  for (const entry of readdirSync(dir)) {
+    if (skipDirectory.has(entry)) continue
+    const path = join(dir, entry)
+    if (statSync(path).isDirectory()) walk(path, out)
+    else if (path.endsWith('.ts') || path.endsWith('.tsx')) out.push(path)
+  }
+  return out
+}
+
+/**
+ * Generated output belongs to whichever CLI wrote it — including the pinned
+ * published one that bootstraps `packages/cli` and still emits the old
+ * specifiers. What this branch's serializers emit is covered by the CLI's own
+ * tests, against the template rather than its output.
+ */
+const isGenerated = (path: string) =>
+  path.includes('.gen.') || path.endsWith('.d.ts') || path.includes('/.pikku/')
+
+describe('no root barrel', () => {
+  /**
+   * Parsed rather than grepped: several tests hold a user's file as a template
+   * literal, and `import { pikkuSessionlessFunc } from '@pikku/core'` inside
+   * one is fixture text for the inspector, not an import this repo makes.
+   */
+  test('nothing imports the package root', () => {
+    const offenders: string[] = []
+
+    for (const file of walk(repoRoot)) {
+      if (isGenerated(file)) continue
+      const source = ts.createSourceFile(
+        file,
+        readFileSync(file, 'utf8'),
+        ts.ScriptTarget.Latest,
+        true
+      )
+      for (const statement of source.statements) {
+        if (
+          !ts.isImportDeclaration(statement) &&
+          !ts.isExportDeclaration(statement)
+        ) {
+          continue
+        }
+        const specifier = statement.moduleSpecifier
+        if (!specifier || !ts.isStringLiteral(specifier)) continue
+        if (specifier.text !== '@pikku/core') continue
+        const { line } = source.getLineAndCharacterOfPosition(
+          statement.getStart(source)
+        )
+        offenders.push(`${relative(repoRoot, file)}:${line + 1}`)
+      }
+    }
+
+    assert.deepStrictEqual(
+      offenders,
+      [],
+      `The '@pikku/core' root is a bootstrap shim, not an entry point. Every ` +
+        `import carries the subpath that owns the name — '@pikku/core/types' ` +
+        `for the shared types, '@pikku/core/services' for the services.\n\n` +
+        offenders.join('\n')
+    )
+  })
+
+  /**
+   * The shim exists because `packages/cli` is generated by the published CLI
+   * pinned in its `build.sh`, which still writes these specifiers. Holding it
+   * to an exact list is what keeps it a shim: a name can only be added here by
+   * someone who has read why it should not be.
+   */
+  test('the bootstrap shim carries only what the pinned CLI emits', () => {
+    const surface = (file: string) =>
+      readFileSync(join(dirname(fileURLToPath(import.meta.url)), file), 'utf8')
+        .replace(/\/\*\*[\s\S]*?\*\//g, '')
+        .match(/\b[A-Za-z][A-Za-z0-9]*\b(?=[,\n\s]*(?:,|\}))/g)
+        ?.sort() ?? []
+
+    assert.deepStrictEqual(surface('bootstrap-compat/root.ts'), [
+      'CorePermissionGroup',
+      'CorePikkuMiddleware',
+      'ListInput',
+      'ListOutput',
+      'PickRequired',
+      'PikkuWire',
+      'SecretService',
+      'SecretlessServices',
+    ])
+  })
+})

package/src/permissions.ts

@@ -75,8 +75,7 @@ export const addGlobalPermission = (
   packageName: string | null = null
 ): CorePermissionGroup | CorePikkuPermission[] => {
   const state = pikkuState(packageName, 'permissions', 'global') as unknown as (
-    | CorePermissionGroup
-    | CorePikkuPermission
+    CorePermissionGroup | CorePikkuPermission
   )[]
   if (Array.isArray(permissions)) {
     state.push(...(permissions as CorePikkuPermission[]))
@@ -91,8 +90,7 @@ const bucket = (
   packageName: string | null
 ): (CorePermissionGroup | CorePikkuPermission)[] =>
   (pikkuState(packageName, 'permissions', 'global') as unknown as (
-    | CorePermissionGroup
-    | CorePikkuPermission
+    CorePermissionGroup | CorePikkuPermission
   )[]) ?? []
 
 /**

package/src/pikku-state.ts

@@ -1,4 +1,4 @@
-import type { PikkuPackageState } from './index.js'
+import type { PikkuPackageState } from './types/state.types.js'
 import type {
   CoreSingletonServices,
   CreateWireServices,
@@ -202,3 +202,5 @@ export const addPackageServiceFactories = (
 ): void => {
   pikkuState(packageName, 'package', 'factories', factories)
 }
+
+export type { PikkuPackageState } from './types/state.types.js'

package/src/public-surface.json

@@ -1,93 +1,6 @@
 {
-  ".": [
-    "AIProviderAuthError",
-    "AIProviderNotConfiguredError",
-    "AbandonedError",
-    "BadGatewayError",
-    "BadRequestError",
-    "ConflictError",
-    "ExpectationFailedError",
-    "ForbiddenError",
-    "GatewayTimeoutError",
-    "GoneError",
-    "HTTPVersionNotSupportedError",
-    "InternalServerError",
-    "InvalidMiddlewareWireError",
-    "InvalidOriginError",
-    "InvalidSessionError",
-    "LengthRequiredError",
-    "LocalEnvironmentOnlyError",
-    "LockedError",
-    "MaxComputeTimeReachedError",
-    "MethodNotAllowedError",
-    "MissingCredentialError",
-    "MissingSchemaError",
-    "MissingScopeError",
-    "MissingServiceError",
-    "MissingSessionError",
-    "NoopAuditService",
-    "NotAcceptableError",
-    "NotFoundError",
-    "NotImplementedError",
-    "PayloadTooLargeError",
-    "PaymentRequiredError",
-    "PikkuError",
-    "PikkuMissingMetaError",
-    "PikkuRequest",
-    "PreconditionFailedError",
-    "ProxyAuthenticationRequiredError",
-    "REDACTED",
-    "RangeNotSatisfiableError",
-    "ReadonlySessionError",
-    "RequestTimeoutError",
-    "SchedulerService",
-    "SecretAccessDeniedError",
-    "SecretCoercionError",
-    "SecretHostNotAllowedError",
-    "ServiceUnavailableError",
-    "TooManyRequestsError",
-    "URITooLongError",
-    "UnauthorizedError",
-    "UnprocessableContentError",
-    "UnsupportedMediaTypeError",
-    "addGlobalPermission",
-    "addTagMiddleware",
-    "assertSecretAllowedForHost",
-    "checkAuthPermissions",
-    "clearPikkuRuntimeState",
-    "createGraph",
-    "createInvocationAudit",
-    "createSecretValue",
-    "fetch",
-    "formatVersionedId",
-    "getAllFunctionNames",
-    "getRelativeTimeOffsetFromNow",
-    "hasScopes",
-    "hashToken",
-    "isExpectedError",
-    "isSecretValue",
-    "isSerializable",
-    "isVersionedId",
-    "parseDurationString",
-    "parseVersionedId",
-    "pikkuAgentMiddleware",
-    "pikkuApprovalDescription",
-    "pikkuAuth",
-    "pikkuCLIRender",
-    "pikkuChannelMiddleware",
-    "pikkuChannelMiddlewareFactory",
-    "pikkuMiddleware",
-    "pikkuMiddlewareFactory",
-    "pikkuPermission",
-    "pikkuPermissionFactory",
-    "pikkuServerLifecycle",
-    "runMiddleware",
-    "stopSingletonServices",
-    "verifyScopes",
-    "wireAddon",
-    "wireRemoteAddon",
-    "withoutSecrets"
-  ],
+  ".": [],
+  "./types": [],
   "./middleware": [
     "addGlobalMiddleware",
     "addGlobalPermission",
@@ -97,18 +10,27 @@
     "authBearer",
     "authCookie",
     "cors",
+    "pikkuAgentMiddleware",
+    "pikkuChannelMiddleware",
+    "pikkuChannelMiddlewareFactory",
+    "pikkuMiddleware",
+    "pikkuMiddlewareFactory",
     "pikkuRemoteAuthMiddleware",
     "runMiddleware",
     "telemetryInner",
     "telemetryOuter"
   ],
   "./function": [
+    "AbandonedError",
+    "PikkuRequest",
     "addFunction",
+    "checkAuthPermissions",
     "getAllFunctionNames",
     "pikkuApprovalDescription",
     "pikkuAuth",
     "pikkuPermission",
-    "pikkuPermissionFactory"
+    "pikkuPermissionFactory",
+    "runPikkuFunc"
   ],
   "./channel": [
     "ChannelDeploymentService",
@@ -139,6 +61,7 @@
     "addWorkflow",
     "assertWorkflowRunOwner",
     "buildRunTimeline",
+    "createGraph",
     "deriveInvocationId",
     "isRef",
     "pikkuWorkflowGraph",
@@ -150,7 +73,7 @@
   "./scenario": [
     "PikkuScenarioService",
     "SCENARIO_SURFACES",
-    "ScenarioBrowserActorRequired",
+    "ScenarioActorRequired",
     "ScenarioBrowserUnavailable",
     "ScenarioHookError",
     "ScenarioNoSurfaceBinding",
@@ -162,7 +85,6 @@
     "createScenarioRunner",
     "pollUntil",
     "renderStepTemplate",
-    "requireActor",
     "requireScenarioEnv",
     "resolveFeatureScenarios",
     "resolveScenarioSurfaces"
@@ -211,6 +133,7 @@
     "defineHTTPRoutes",
     "fetch",
     "fetchData",
+    "httpRouter",
     "logRoutes",
     "toWebRequest",
     "wireHTTP",
@@ -235,11 +158,13 @@
   "./rpc": [
     "PikkuRPCService",
     "RPCNotFoundError",
-    "RemoteAddonAuthError",
     "RemoteAddonConfigError",
     "RemoteAddonRequestError",
+    "rpcService"
+  ],
+  "./addon": [
+    "RemoteAddonAuthError",
     "resolveRemoteAddonToken",
-    "rpcService",
     "wireAddon",
     "wireRemoteAddon"
   ],
@@ -331,7 +256,9 @@
   "./scope": [
     "defineScope",
     "flattenScopeDefinitions",
-    "validateAndBuildScopeDefinitionsMeta"
+    "hasScopes",
+    "validateAndBuildScopeDefinitionsMeta",
+    "verifyScopes"
   ],
   "./role": [
     "defineSystemRole",
@@ -403,11 +330,13 @@
     "UnprocessableContentError",
     "UnsupportedMediaTypeError",
     "WeakKeyMaterialError",
-    "addError"
+    "addError",
+    "isExpectedError"
   ],
   "./services": [
     "ConsoleLogger",
     "DEFAULT_WEBHOOK_RETRIES",
+    "FileScenarioRunStore",
     "InMemoryAgentRunStateService",
     "InMemoryQueueService",
     "InMemorySessionStore",
@@ -425,8 +354,10 @@
     "PikkuCredentialWireService",
     "PikkuSessionService",
     "QueueWebhookService",
+    "SchedulerService",
     "ScopedCredentialService",
     "ScopedSecretService",
+    "SecretAccessDeniedError",
     "SecretHostNotAllowedError",
     "StubTracker",
     "TypedCredentialService",
@@ -440,8 +371,11 @@
     "getStubTracker",
     "isTestRun",
     "pikkuWebhookWorkerFunc",
+    "scenarioArtifactContentType",
+    "scenarioRunSummary",
     "spy",
-    "stub"
+    "stub",
+    "withoutSecrets"
   ],
   "./services/local-meta": ["LocalMetaService"],
   "./services/v8-coverage": ["V8CoverageService"],
@@ -477,161 +411,42 @@
     "wrapDEK"
   ],
   "./hmac": ["hmacSha256Hex", "timingSafeStringEqual"],
-  "./ecosystem": [
-    "addFunction",
-    "addGlobalMiddleware",
-    "addMiddleware",
+  "./state": [
+    "addPackageServiceFactories",
     "getAllPackageStates",
     "getCreateWireServices",
     "getSingletonServices",
-    "httpRouter",
+    "initializePikkuState",
     "pikkuState",
     "resetPikkuState",
-    "runPikkuFunc",
     "setSingletonServices"
   ],
-  "./ecosystem/agent": [
-    "addAgent",
-    "agent",
-    "agentApprove",
-    "agentResume",
-    "agentStream",
-    "canAccessThread",
-    "isOwnedByPrincipal",
-    "resolveModelAlias",
-    "threadOwnerConstraint",
-    "voiceInput",
-    "voiceOutput"
-  ],
-  "./ecosystem/agent-scorer": [
-    "addAgentScorer",
-    "enableScoreSnapshots",
-    "getScoreSnapshot",
-    "gradeRun",
-    "pikkuAgentJudge",
-    "pikkuAgentScorer",
-    "wireAgentScorerQueueWorkers"
-  ],
-  "./ecosystem/channel": [
-    "EventHubStore",
-    "PikkuAbstractChannelHandler",
-    "addChannelMiddleware",
-    "logChannels"
-  ],
-  "./ecosystem/channel/local": ["PikkuLocalChannelHandler"],
-  "./ecosystem/cli": ["CLIError", "executeCLI", "generateCommandHelp"],
-  "./ecosystem/cli/channel": ["executeRawCLIViaChannel", "handleRawCLI"],
-  "./ecosystem/credential": ["validateAndBuildCredentialDefinitionsMeta"],
-  "./ecosystem/dev": ["reconcileAddonRegistry", "reloadGeneratedMeta"],
-  "./ecosystem/function": ["getAllFunctionNames", "pikkuAuth"],
-  "./ecosystem/gateway": [],
-  "./ecosystem/hmac": ["hmacSha256Hex", "timingSafeStringEqual"],
-  "./ecosystem/http": ["DEFAULT_MAX_BODY_SIZE", "logRoutes", "toWebRequest"],
-  "./ecosystem/mcp": [
-    "MCPEndpointRegistry",
-    "MCPError",
-    "getMCPPromptsMeta",
-    "getMCPResourcesMeta",
-    "getMCPToolsMeta"
-  ],
-  "./ecosystem/middleware": [
-    "addGlobalPermission",
-    "authAPIKey",
-    "authCookie",
-    "pikkuRemoteAuthMiddleware",
-    "runMiddleware",
-    "telemetryInner",
-    "telemetryOuter"
-  ],
-  "./ecosystem/node": [],
-  "./ecosystem/node-host-resolver": ["installNodeHostResolver"],
-  "./ecosystem/oauth2": [],
-  "./ecosystem/persona": [
-    "HttpPersona",
-    "createHttpPersonas",
-    "personaEmails",
-    "personaEnvironmentErrors",
-    "personaEnvironmentRefusal",
-    "roleMismatchMessage",
-    "validateAndBuildPersonasMeta",
-    "verifyPersonaRoles"
-  ],
-  "./ecosystem/queue": [
-    "QueueJobDiscardedError",
-    "QueueJobFailedError",
-    "registerQueueWorkers"
-  ],
-  "./ecosystem/remote": ["buildRemoteHeaders"],
-  "./ecosystem/role": [
-    "defineSystemRole",
-    "flattenSystemRoleDefinitions",
-    "validateAndBuildSystemRoleDefinitionsMeta"
-  ],
-  "./ecosystem/rpc": ["wireAddon", "wireRemoteAddon"],
-  "./ecosystem/safe-fetch": ["safeFetch"],
-  "./ecosystem/scenario": [
-    "PikkuScenarioService",
-    "SCENARIO_SURFACES",
-    "addFeature",
-    "composeStepProse",
-    "resolveFeatureScenarios"
-  ],
-  "./ecosystem/scheduler": ["getScheduledTasks"],
-  "./ecosystem/schema": ["addSchema"],
-  "./ecosystem/scope": [
-    "defineScope",
-    "flattenScopeDefinitions",
-    "validateAndBuildScopeDefinitionsMeta"
-  ],
-  "./ecosystem/secret": ["validateAndBuildSecretDefinitionsMeta"],
-  "./ecosystem/services": [
-    "InMemoryAgentRunStateService",
-    "PIKKU_OUTGOING_WEBHOOK_QUEUE_NAME",
-    "PikkuSessionService",
-    "TypedVariablesService",
-    "createMiddlewareSessionWireProps",
-    "getStubTracker",
-    "pikkuWebhookWorkerFunc",
-    "spy"
-  ],
-  "./ecosystem/services/istanbul-coverage": ["IstanbulCoverageService"],
-  "./ecosystem/services/local-content": ["signedContentPath"],
-  "./ecosystem/services/local-content-request-handler": [
-    "createLocalContentRequestHandler",
-    "verifySignedContentRequest"
+  "./classification": [
+    "REDACTED",
+    "SecretCoercionError",
+    "SecretValue",
+    "createSecretValue",
+    "hashToken",
+    "isSecretValue",
+    "unsafeAsHashed",
+    "unsafeAsSealed",
+    "unsafeAsWrapped"
   ],
-  "./ecosystem/services/v8-coverage": ["V8CoverageService"],
-  "./ecosystem/testing": ["defineServiceTests"],
-  "./ecosystem/trigger": [],
-  "./ecosystem/types": [
-    "PikkuRequest",
+  "./utils": [
+    "closeWireServices",
+    "createWeakUID",
     "formatVersionedId",
-    "isExpectedError",
+    "freezeDedupe",
+    "getDurationInMilliseconds",
+    "getRelativeTimeOffset",
+    "getRelativeTimeOffsetFromNow",
+    "getTagGroups",
     "isSerializable",
     "isVersionedId",
     "parseDurationString",
-    "parseVersionedId"
-  ],
-  "./ecosystem/variable": ["validateAndBuildVariableDefinitionsMeta"],
-  "./ecosystem/virtual-user": [
-    "DISPOSITIONS",
-    "PRODUCTION_DISPOSITION",
-    "catalogueClassification",
-    "dispositionProfile",
-    "intentsForPersona",
-    "isReadOnly",
-    "personaScopes",
-    "prepareVirtualUserRun",
-    "reachableCatalogue",
-    "unreachableCatalogue"
-  ],
-  "./ecosystem/workflow": [
-    "assertWorkflowRunOwner",
-    "buildRunTimeline",
-    "isRef",
-    "reconstructFinalState",
-    "reconstructStateAt",
-    "template"
+    "parseVersionedId",
+    "pikkuServerLifecycle",
+    "stopSingletonServices"
   ],
   "./schema": [
     "addSchema",
@@ -641,6 +456,6 @@
     "getSchema",
     "validateSchema"
   ],
-  "./testing": ["defineServiceTests"],
+  "./testing": ["clearPikkuRuntimeState", "defineServiceTests"],
   "./dev": ["pikkuDevReloader", "reconcileAddonRegistry", "reloadGeneratedMeta"]
 }

package/src/public-surface.json.README

@@ -5,9 +5,9 @@ disagree, so widening the API is a visible diff rather than a side effect of an
 
 Types are not pinned: they are erased before the test can enumerate them.
 
-A wildcard subpath is expanded to the files it matches, so `./ecosystem/*` is
-pinned as one entry per area rather than as a pattern — otherwise a new
-sub-barrel joins the published API without a diff.
+A wildcard subpath is expanded to the files it matches, so it is pinned as one
+entry per area rather than as a pattern — otherwise a new sub-barrel joins the
+published API without a diff.
 
 Regenerate after an intentional change, from `packages/core`:
 

package/src/public-surface.test.ts

@@ -19,11 +19,11 @@ const subpaths = packageJson.exports as Record<string, string>
 /**
  * `exports` entries, with a wildcard subpath replaced by the files it matches.
  *
- * `./ecosystem/*` publishes one sub-barrel per area, so pinning it as written
- * would pin a pattern rather than a surface — and a new barrel would appear in
- * the published API without a diff. Expanding it is what keeps each area's
- * exports in `public-surface.json` under the same guarantee as every other
- * entry point's.
+ * A wildcard subpath would pin a pattern rather than a surface, and a module
+ * dropped into the matched directory would appear in the published API without
+ * a diff. Expanding it is what keeps every entry point's exports in
+ * `public-surface.json` under the same guarantee. `exports` declares none
+ * today, and this keeps that from being a silent assumption.
  */
 const entryPoints = (): [string, string][] =>
   Object.entries(subpaths).flatMap(([subpath, dist]) => {

package/src/remote.test.ts

@@ -4,7 +4,7 @@ import { buildRemoteHeaders } from './remote.js'
 import { pikkuRemoteAuthMiddleware } from './middleware/remote-auth.js'
 import { resetPikkuState } from './pikku-state.js'
 import { WeakKeyMaterialError } from './errors/errors.js'
-import { createSecretValue } from './secret-value.js'
+import { createSecretValue } from './classification/secret-value.js'
 
 beforeEach(() => {
   resetPikkuState()

package/src/removed-legacy-exports.test.ts

@@ -14,11 +14,15 @@ const thisFile = fileURLToPath(import.meta.url)
  * They survived as throwing stubs only so the pinned bootstrap CLI could
  * resolve the import; `@pikku/cli@0.12.96` emits none of them, so the stubs
  * went too.
+ *
+ * `ZodLike` sat on the package root, which is now `bootstrap-compat/root.ts` —
+ * what `.` resolves to for the pinned CLI's sake, and the only place a name
+ * could return to the root from.
  */
 const REMOVED = [
   { name: 'addTagPermission', entry: './middleware/index.js' },
   { name: 'addHTTPPermission', entry: './wirings/http/index.js' },
-  { name: 'ZodLike', entry: './index.js' },
+  { name: 'ZodLike', entry: './bootstrap-compat/root.js' },
 ]
 
 const collectSourceFiles = (directory: string): string[] =>

package/src/services/audit-service.ts

@@ -4,7 +4,7 @@ import type {
   PikkuWiringTypes,
 } from '../types/core.types.js'
 import type { Logger } from './logger.js'
-import type { Safe } from '../secret-value.js'
+import type { Safe } from '../classification/secret-value.js'
 
 export type AuditDurability = 'best-effort' | 'transactional'
 export type AuditOutcome = 'success' | 'failed' | 'denied'

package/src/services/credential-wire-service.ts

@@ -1,4 +1,4 @@
-import { isSecretValue } from '../secret-value.js'
+import { isSecretValue } from '../classification/secret-value.js'
 import type { CredentialService } from './credential-service.js'
 import { defaultPikkuUserIdResolver } from './pikku-user-id.js'
 import type { PikkuRawWire } from '../types/core.types.js'