@pikku/core 0.12.84 → 0.12.88

package/dist/middleware/middleware-factories.d.ts

@@ -0,0 +1,9 @@
+import type { CoreSingletonServices, CoreUserSession } from '../types/core.types.js';
+import type { CorePikkuChannelMiddleware, CorePikkuChannelMiddlewareFactory } from '../wirings/channel/channel.types.js';
+import type { PikkuAgentMiddlewareHooks } from '../wirings/agent/agent.types.js';
+import type { CorePikkuMiddleware, CorePikkuMiddlewareConfig, CorePikkuMiddlewareFactory } from './middleware.types.js';
+export declare const pikkuMiddleware: <SingletonServices extends CoreSingletonServices = CoreSingletonServices, UserSession extends CoreUserSession = CoreUserSession>(middleware: CorePikkuMiddleware<SingletonServices, UserSession> | CorePikkuMiddlewareConfig<SingletonServices, UserSession>) => CorePikkuMiddleware<SingletonServices, UserSession>;
+export declare const pikkuMiddlewareFactory: <In = any>(factory: CorePikkuMiddlewareFactory<In>) => CorePikkuMiddlewareFactory<In>;
+export declare const pikkuChannelMiddleware: <SingletonServices extends CoreSingletonServices = CoreSingletonServices, Event = unknown>(middleware: CorePikkuChannelMiddleware<SingletonServices, Event>) => CorePikkuChannelMiddleware<SingletonServices, Event>;
+export declare const pikkuChannelMiddlewareFactory: <In = any>(factory: CorePikkuChannelMiddlewareFactory<In>) => CorePikkuChannelMiddlewareFactory<In>;
+export declare const pikkuAgentMiddleware: <State extends Record<string, unknown> = Record<string, unknown>, SingletonServices extends CoreSingletonServices = CoreSingletonServices>(hooks: PikkuAgentMiddlewareHooks<State, SingletonServices>) => PikkuAgentMiddlewareHooks<State, SingletonServices>;

package/dist/middleware/middleware-factories.js

@@ -0,0 +1,19 @@
+export const pikkuMiddleware = (middleware) => {
+    if (typeof middleware === 'function')
+        return middleware;
+    const func = middleware.func;
+    if (middleware.priority) {
+        func.__priority = middleware.priority;
+    }
+    return func;
+};
+export const pikkuMiddlewareFactory = (factory) => {
+    return factory;
+};
+export const pikkuChannelMiddleware = (middleware) => {
+    return middleware;
+};
+export const pikkuChannelMiddlewareFactory = (factory) => {
+    return factory;
+};
+export const pikkuAgentMiddleware = (hooks) => hooks;

package/dist/middleware/middleware.types.d.ts

@@ -0,0 +1,27 @@
+import type { CoreSingletonServices, CoreUserSession, PikkuWire } from '../types/core.types.js';
+export type CorePikkuMiddleware<SingletonServices extends CoreSingletonServices = CoreSingletonServices, UserSession extends CoreUserSession = CoreUserSession> = (services: SingletonServices, wires: PikkuWire, next: () => Promise<void>) => Promise<void>;
+/**
+ * Execution order: `highest` runs first (outermost in the onion), `lowest`
+ * runs last, closest to the function.
+ */
+export type MiddlewarePriority = 'highest' | 'high' | 'medium' | 'low' | 'lowest';
+export type CorePikkuMiddlewareConfig<SingletonServices extends CoreSingletonServices = CoreSingletonServices, UserSession extends CoreUserSession = CoreUserSession> = {
+    func: CorePikkuMiddleware<SingletonServices, UserSession>;
+    name?: string;
+    description?: string;
+    /** Execution priority. Lower runs first (outermost). Defaults to 'medium'. */
+    priority?: MiddlewarePriority;
+};
+export type CorePikkuMiddlewareFactory<In = any, SingletonServices extends CoreSingletonServices = CoreSingletonServices, UserSession extends CoreUserSession = CoreUserSession> = (input: In) => CorePikkuMiddleware<SingletonServices, UserSession>;
+export type CorePikkuMiddlewareGroup<SingletonServices extends CoreSingletonServices = CoreSingletonServices, UserSession extends CoreUserSession = CoreUserSession> = Array<CorePikkuMiddleware<SingletonServices, UserSession> | CorePikkuMiddlewareFactory<any, SingletonServices, UserSession>>;
+export type MiddlewareMetadata = {
+    type: 'http';
+    route: string;
+} | {
+    type: 'tag';
+    tag: string;
+} | {
+    type: 'wire';
+    name: string;
+    inline?: boolean;
+};

package/dist/middleware/middleware.types.js

@@ -0,0 +1 @@
+export {};

package/dist/middleware/remote-auth.d.ts

@@ -1,9 +1,9 @@
-export declare const pikkuRemoteAuthMiddleware: import("../types/core.types.js").CorePikkuMiddleware<import("../types/core.types.js").CoreSingletonServices<{
+export declare const pikkuRemoteAuthMiddleware: import("./middleware.types.js").CorePikkuMiddleware<import("../types/core.types.js").CoreSingletonServices<{
     logLevel?: import("../services/logger.js").LogLevel;
     secrets?: {
         requireAllowedHosts?: boolean;
     };
-    workflow?: import("../ecosystem/agent.js").WorkflowServiceConfig;
+    workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
     webhook?: import("../services/webhook-service.js").WebhookServiceConfig;
     postgres?: import("../types/core.types.js").PostgresConfig;
 }>, import("../types/core.types.js").CoreUserSession>;

package/dist/middleware/remote-auth.js

@@ -1,5 +1,5 @@
 import { UnauthorizedError } from '../errors/errors.js';
-import { pikkuMiddleware } from '../types/core.types.js';
+import { pikkuMiddleware } from './middleware-factories.js';
 import { assertStrongKeyMaterial, decryptWithKeyMaterial, REMOTE_SESSION_INFO, } from '../crypto-utils.js';
 const REMOTE_RPC_PREFIX = '/remote/rpc/';
 /**

package/dist/middleware/telemetry.d.ts

@@ -1,26 +1,10 @@
 /** Outermost telemetry: total duration, including every middleware. */
-export declare const telemetryOuter: import("../types/core.types.js").CorePikkuMiddlewareFactory<void | {
+export declare const telemetryOuter: import("./middleware.types.js").CorePikkuMiddlewareFactory<void | {
     environmentId?: string;
     orgId?: string;
-}, import("../types/core.types.js").CoreSingletonServices<{
-    logLevel?: import("../services/logger.js").LogLevel;
-    secrets?: {
-        requireAllowedHosts?: boolean;
-    };
-    workflow?: import("../ecosystem/agent.js").WorkflowServiceConfig;
-    webhook?: import("../services/webhook-service.js").WebhookServiceConfig;
-    postgres?: import("../types/core.types.js").PostgresConfig;
-}>, import("../types/core.types.js").CoreUserSession>;
+}>;
 /** Innermost telemetry: function-only duration, excluding outer middleware. */
-export declare const telemetryInner: import("../types/core.types.js").CorePikkuMiddlewareFactory<void | {
+export declare const telemetryInner: import("./middleware.types.js").CorePikkuMiddlewareFactory<void | {
     environmentId?: string;
     orgId?: string;
-}, import("../types/core.types.js").CoreSingletonServices<{
-    logLevel?: import("../services/logger.js").LogLevel;
-    secrets?: {
-        requireAllowedHosts?: boolean;
-    };
-    workflow?: import("../ecosystem/agent.js").WorkflowServiceConfig;
-    webhook?: import("../services/webhook-service.js").WebhookServiceConfig;
-    postgres?: import("../types/core.types.js").PostgresConfig;
-}>, import("../types/core.types.js").CoreUserSession>;
+}>;

package/dist/middleware/telemetry.js

@@ -1,4 +1,4 @@
-import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js';
+import { pikkuMiddleware, pikkuMiddlewareFactory, } from './middleware-factories.js';
 /** Outermost telemetry: total duration, including every middleware. */
 export const telemetryOuter = pikkuMiddlewareFactory(({ environmentId, orgId } = {}) => {
     return pikkuMiddleware({

package/dist/middleware-runner.d.ts

@@ -1,4 +1,5 @@
-import type { CorePikkuMiddleware, CorePikkuMiddlewareGroup, PikkuWiringTypes, MiddlewareMetadata } from './types/core.types.js';
+import type { PikkuWiringTypes } from './types/core.types.js';
+import type { CorePikkuMiddleware, CorePikkuMiddlewareGroup, MiddlewareMetadata } from './middleware/middleware.types.js';
 export declare const runMiddleware: <Middleware extends CorePikkuMiddleware<any, any>>(services: Parameters<Middleware>[0], wire: Parameters<Middleware>[1], middlewares: readonly Middleware[], main?: () => Promise<unknown>) => Promise<unknown>;
 /**
  * Registers tag-scoped middleware for any wiring carrying the tag. Wrap in a

package/dist/pikku-state.d.ts

@@ -1,4 +1,4 @@
-import type { PikkuPackageState } from './index.js';
+import type { PikkuPackageState } from './types/state.types.js';
 import type { CoreSingletonServices, CreateWireServices } from './types/core.types.js';
 export declare const getAllPackageStates: () => Map<string, PikkuPackageState>;
 export declare const pikkuState: <Type extends keyof PikkuPackageState, Content extends keyof PikkuPackageState[Type]>(packageName: string | null, type: Type, content: Content, value?: PikkuPackageState[Type][Content]) => PikkuPackageState[Type][Content];
@@ -8,3 +8,4 @@ export declare const getSingletonServices: () => CoreSingletonServices;
 export declare const setSingletonServices: (services: CoreSingletonServices) => void;
 export declare const getCreateWireServices: () => CreateWireServices | undefined;
 export declare const addPackageServiceFactories: (packageName: string, factories: NonNullable<PikkuPackageState["package"]["factories"]>) => void;
+export type { PikkuPackageState } from './types/state.types.js';

package/dist/services/audit-service.d.ts

@@ -1,6 +1,6 @@
 import type { CoreUserSession, PikkuWire, PikkuWiringTypes } from '../types/core.types.js';
 import type { Logger } from './logger.js';
-import type { Safe } from '../secret-value.js';
+import type { Safe } from '../classification/secret-value.js';
 export type AuditDurability = 'best-effort' | 'transactional';
 export type AuditOutcome = 'success' | 'failed' | 'denied';
 export type AuditSource = 'auto' | 'explicit';

package/dist/services/credential-wire-service.js

@@ -1,4 +1,4 @@
-import { isSecretValue } from '../secret-value.js';
+import { isSecretValue } from '../classification/secret-value.js';
 import { defaultPikkuUserIdResolver } from './pikku-user-id.js';
 export class PikkuCredentialWireService {
     credentialService;

package/dist/services/email-service.d.ts

@@ -1,4 +1,4 @@
-import type { Safe } from '../secret-value.js';
+import type { Safe } from '../classification/secret-value.js';
 export interface EmailTemplateReference {
     name: string;
     locale?: string;

package/dist/services/file-scenario-run-store.d.ts

@@ -0,0 +1,58 @@
+import type { ScenarioArtifact, ScenarioResult, ScenarioRunRecord, ScenarioRunStore, ScenarioRunSummary } from '../wirings/workflow/scenario-run.types.js';
+/** Counts and duration, derived rather than stored so they cannot disagree. */
+export declare const scenarioRunSummary: (record: ScenarioRunRecord) => ScenarioRunSummary;
+export declare const scenarioArtifactContentType: (path: string) => string;
+export interface FileScenarioRunStoreOptions {
+    /** The directory runs live under — one folder per run, named by its id. */
+    dir: string;
+    /**
+     * How many runs to keep. Older ones are deleted, with their artifacts, as a
+     * new run opens.
+     *
+     * Bounded on purpose: a run with video is megabytes, and an unbounded history
+     * beside a project is a directory nobody notices until it is enormous.
+     */
+    keep?: number;
+}
+/**
+ * Scenario run history as files on disk — the OSS store.
+ *
+ * One folder per run holding its record and everything it filed, which makes a
+ * run a thing you can open, copy, attach to an issue or delete with `rm -rf`.
+ * A hosted project swaps this for a table and an object store; the console
+ * reads the same shapes from either.
+ *
+ * Writes are serialised through one chain. Scenarios finish one at a time, but
+ * `recordScenario` is read-modify-write on a single file, and a store that
+ * corrupts its own history the first time two things overlap is worse than no
+ * history.
+ */
+export declare class FileScenarioRunStore implements ScenarioRunStore {
+    private readonly options;
+    private writes;
+    constructor(options: FileScenarioRunStoreOptions);
+    start(record: ScenarioRunRecord): Promise<void>;
+    recordScenario(runId: string, result: ScenarioResult): Promise<void>;
+    attachArtifacts(runId: string, artifacts: ScenarioArtifact[]): Promise<void>;
+    finish(runId: string, outcome: Pick<ScenarioRunRecord, 'status' | 'finishedAt' | 'skipped' | 'hookFailures'>): Promise<void>;
+    readArtifact(runId: string, path: string): Promise<{
+        body: Uint8Array<ArrayBuffer>;
+        contentType: string;
+    } | undefined>;
+    list(options?: {
+        limit?: number;
+    }): Promise<ScenarioRunSummary[]>;
+    get(runId: string): Promise<ScenarioRunRecord | undefined>;
+    remove(runId: string): Promise<void>;
+    /** Where this run's artifacts live, for a driver writing into it. */
+    runDir(runId: string): string;
+    private serialise;
+    private read;
+    private write;
+    private runIds;
+    /**
+     * Drop the oldest runs past the limit, never the one just opened — a `keep`
+     * of zero or one must still leave the run being started.
+     */
+    private prune;
+}

package/dist/services/file-scenario-run-store.js

@@ -0,0 +1,214 @@
+import { mkdir, readFile, readdir, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+/** The record, beside the images and footage the same run produced. */
+const RECORD_FILE = 'run.json';
+/**
+ * A run id is a path segment, and `get('../../etc')` is a file read.
+ *
+ * Ids are generated here, so anything failing this arrived from outside and is
+ * refused rather than sanitised — a request for a run that cannot exist is a
+ * request for a run that does not exist.
+ */
+const SAFE_RUN_ID = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
+/** Counts and duration, derived rather than stored so they cannot disagree. */
+export const scenarioRunSummary = (record) => ({
+    runId: record.runId,
+    environment: record.environment,
+    surface: record.surface,
+    status: record.status,
+    startedAt: record.startedAt,
+    finishedAt: record.finishedAt,
+    durationMs: record.finishedAt
+        ? new Date(record.finishedAt).getTime() -
+            new Date(record.startedAt).getTime()
+        : undefined,
+    passed: record.results.filter((r) => r.status === 'passed').length,
+    failed: record.results.filter((r) => r.status === 'failed').length,
+    skipped: record.skipped.length,
+    artifacts: record.results.reduce((total, result) => total + (result.artifacts?.length ?? 0), 0),
+});
+/**
+ * What a scenario artifact is served as.
+ *
+ * A short, closed list rather than a MIME database: a run produces images and
+ * recordings and nothing else, and anything unrecognised is served as bytes the
+ * browser is told not to interpret.
+ */
+const CONTENT_TYPES = {
+    png: 'image/png',
+    jpg: 'image/jpeg',
+    jpeg: 'image/jpeg',
+    webp: 'image/webp',
+    mp4: 'video/mp4',
+    webm: 'video/webm',
+};
+export const scenarioArtifactContentType = (path) => CONTENT_TYPES[path.split('.').pop()?.toLowerCase() ?? ''] ??
+    'application/octet-stream';
+/**
+ * An artifact path is a content key from the record, but it arrives from a
+ * client and is joined onto a directory. Anything that could climb out of the
+ * run, or name something other than a file inside it, is refused.
+ */
+const SAFE_ARTIFACT_PATH = /^[A-Za-z0-9][A-Za-z0-9._-]*(\/[A-Za-z0-9][A-Za-z0-9._-]*)*$/;
+const DEFAULT_KEEP = 20;
+/**
+ * Scenario run history as files on disk — the OSS store.
+ *
+ * One folder per run holding its record and everything it filed, which makes a
+ * run a thing you can open, copy, attach to an issue or delete with `rm -rf`.
+ * A hosted project swaps this for a table and an object store; the console
+ * reads the same shapes from either.
+ *
+ * Writes are serialised through one chain. Scenarios finish one at a time, but
+ * `recordScenario` is read-modify-write on a single file, and a store that
+ * corrupts its own history the first time two things overlap is worse than no
+ * history.
+ */
+export class FileScenarioRunStore {
+    options;
+    writes = Promise.resolve();
+    constructor(options) {
+        this.options = options;
+    }
+    async start(record) {
+        await this.serialise(async () => {
+            await this.write(record);
+            await this.prune(record.runId);
+        });
+    }
+    async recordScenario(runId, result) {
+        await this.serialise(async () => {
+            const record = await this.read(runId);
+            if (!record) {
+                return;
+            }
+            record.results.push(result);
+            await this.write(record);
+        });
+    }
+    async attachArtifacts(runId, artifacts) {
+        if (artifacts.length === 0) {
+            return;
+        }
+        await this.serialise(async () => {
+            const record = await this.read(runId);
+            if (!record) {
+                return;
+            }
+            for (const artifact of artifacts) {
+                const result = record.results.find((candidate) => candidate.name === artifact.scenario);
+                // An artifact whose scenario is not in the results belongs to a
+                // scenario that never produced one — it is dropped rather than filed
+                // under a run-level bucket nothing renders.
+                if (result) {
+                    result.artifacts = [...(result.artifacts ?? []), artifact];
+                }
+            }
+            await this.write(record);
+        });
+    }
+    async finish(runId, outcome) {
+        await this.serialise(async () => {
+            const record = await this.read(runId);
+            if (!record) {
+                return;
+            }
+            await this.write({ ...record, ...outcome });
+        });
+    }
+    async readArtifact(runId, path) {
+        if (!SAFE_RUN_ID.test(runId) || !SAFE_ARTIFACT_PATH.test(path)) {
+            return undefined;
+        }
+        try {
+            const file = await readFile(join(this.options.dir, runId, ...path.split('/')));
+            return {
+                body: new Uint8Array(file),
+                contentType: scenarioArtifactContentType(path),
+            };
+        }
+        catch {
+            return undefined;
+        }
+    }
+    async list(options = {}) {
+        const summaries = [];
+        for (const runId of await this.runIds()) {
+            const record = await this.read(runId);
+            if (record) {
+                summaries.push(scenarioRunSummary(record));
+            }
+        }
+        summaries.sort((a, b) => b.startedAt.localeCompare(a.startedAt));
+        return options.limit ? summaries.slice(0, options.limit) : summaries;
+    }
+    async get(runId) {
+        return this.read(runId);
+    }
+    async remove(runId) {
+        if (!SAFE_RUN_ID.test(runId)) {
+            return;
+        }
+        await rm(join(this.options.dir, runId), { recursive: true, force: true });
+    }
+    /** Where this run's artifacts live, for a driver writing into it. */
+    runDir(runId) {
+        return join(this.options.dir, runId);
+    }
+    serialise(work) {
+        const next = this.writes.then(work, work);
+        // Swallowed on the CHAIN only, so one failed write does not reject every
+        // later one; the caller still sees its own rejection through `next`.
+        this.writes = next.catch(() => { });
+        return next;
+    }
+    async read(runId) {
+        if (!SAFE_RUN_ID.test(runId)) {
+            return undefined;
+        }
+        try {
+            const raw = await readFile(join(this.options.dir, runId, RECORD_FILE), 'utf-8');
+            return JSON.parse(raw);
+        }
+        catch {
+            // A folder with artifacts but no readable record is a run that was killed
+            // mid-write. It is not listable, and it is not an error either.
+            return undefined;
+        }
+    }
+    async write(record) {
+        const dir = join(this.options.dir, record.runId);
+        await mkdir(dir, { recursive: true });
+        await writeFile(join(dir, RECORD_FILE), JSON.stringify(record, null, 2) + '\n');
+    }
+    async runIds() {
+        try {
+            const entries = await readdir(this.options.dir, { withFileTypes: true });
+            return entries
+                .filter((entry) => entry.isDirectory() && SAFE_RUN_ID.test(entry.name))
+                .map((entry) => entry.name);
+        }
+        catch {
+            return [];
+        }
+    }
+    /**
+     * Drop the oldest runs past the limit, never the one just opened — a `keep`
+     * of zero or one must still leave the run being started.
+     */
+    async prune(keeping) {
+        const keep = this.options.keep ?? DEFAULT_KEEP;
+        const dated = [];
+        for (const runId of await this.runIds()) {
+            if (runId === keeping) {
+                continue;
+            }
+            const record = await this.read(runId);
+            dated.push({ runId, startedAt: record?.startedAt ?? '' });
+        }
+        dated.sort((a, b) => b.startedAt.localeCompare(a.startedAt));
+        for (const { runId } of dated.slice(Math.max(keep - 1, 0))) {
+            await rm(join(this.options.dir, runId), { recursive: true, force: true });
+        }
+    }
+}

package/dist/services/in-memory-workflow-service.d.ts

@@ -1,5 +1,5 @@
 import { PikkuWorkflowService } from '../wirings/workflow/pikku-workflow-service.js';
-import type { SerializedError } from '../types/core.types.js';
+import type { SerializedError } from '../errors/serialized-error.js';
 import type { WorkflowPlannedStep, WorkflowQueueOptions, WorkflowRun, WorkflowRunService, WorkflowRunWire, StepState, StepStatus, WorkflowStatus, WorkflowVersionStatus, WorkflowStepOptions } from '../wirings/workflow/workflow.types.js';
 export declare class InMemoryWorkflowService extends PikkuWorkflowService implements WorkflowRunService {
     constructor(options?: WorkflowQueueOptions);

package/dist/services/index.d.ts

@@ -16,6 +16,7 @@ export { InMemoryQueueService } from './in-memory-queue-service.js';
 export { InMemoryTriggerService } from './in-memory-trigger-service.js';
 export { InMemoryAgentRunStateService } from './in-memory-agent-run-state-service.js';
 export { LocalGatewayService } from './local-gateway-service.js';
+export { FileScenarioRunStore, scenarioArtifactContentType, scenarioRunSummary, type FileScenarioRunStoreOptions, } from './file-scenario-run-store.js';
 export type { ContentService, SignContentKeyArgs, SignURLArgs, GetUploadURLArgs, UploadURLResult, BucketKeyArgs, WriteFileArgs, CopyFileArgs, } from './content-service.js';
 export type { ScenarioPersona, ResolvedPersona, ScenarioPersonas, } from './personas-service.js';
 export type { JWTService } from './jwt-service.js';
@@ -26,7 +27,8 @@ export type { SecretService, SecretValues } from './secret-service.js';
 export type { VariablesService } from './variables-service.js';
 export type { SchemaService } from './schema-service.js';
 export type { SessionService } from './user-session-service.js';
-export type { ScheduledTaskSummary, ScheduledTaskInfo, SchedulerService, } from './scheduler-service.js';
+export type { ScheduledTaskSummary, ScheduledTaskInfo, } from './scheduler-service.js';
+export { SchedulerService } from './scheduler-service.js';
 export type { TriggerService } from './trigger-service.js';
 export type { GatewayService } from './gateway-service.js';
 export type { DeploymentService, DeploymentConfig, DeploymentInfo, DeploymentServiceConfig, } from './deployment-service.js';
@@ -50,3 +52,5 @@ export type { MCPMeta, RPCMetaRecord, ServiceMeta, ServicesMetaRecord, Middlewar
 export type { CoverageService, ScriptCoverage, FunctionCoverageEntry, FunctionCoverageReport, CoverageFunctionMeta, } from './v8-coverage-service.js';
 export { StubTracker, createStubProxy, getStubTracker, isTestRun, stub, spy, type StubCall, } from './stub-tracker.js';
 export { SecretHostNotAllowedError, assertSecretAllowedForHost, } from './secret-host-binding.js';
+export type { AuditFacets, AuditQuery, AuditQueryResult, } from './audit-service.js';
+export { SecretAccessDeniedError, withoutSecrets } from './secretless.js';

package/dist/services/index.js

@@ -16,9 +16,12 @@ export { InMemoryQueueService } from './in-memory-queue-service.js';
 export { InMemoryTriggerService } from './in-memory-trigger-service.js';
 export { InMemoryAgentRunStateService } from './in-memory-agent-run-state-service.js';
 export { LocalGatewayService } from './local-gateway-service.js';
+export { FileScenarioRunStore, scenarioArtifactContentType, scenarioRunSummary, } from './file-scenario-run-store.js';
 export { DEFAULT_WEBHOOK_RETRIES, PIKKU_OUTGOING_WEBHOOK_QUEUE_NAME, WebhookService, } from './webhook-service.js';
+export { SchedulerService } from './scheduler-service.js';
 export { TypedCredentialService } from './typed-credential-service.js';
 export { NoopAuditService, createInvocationAudit } from './audit-service.js';
 export { InMemorySessionStore } from './in-memory-session-store.js';
 export { StubTracker, createStubProxy, getStubTracker, isTestRun, stub, spy, } from './stub-tracker.js';
 export { SecretHostNotAllowedError, assertSecretAllowedForHost, } from './secret-host-binding.js';
+export { SecretAccessDeniedError, withoutSecrets } from './secretless.js';

package/dist/services/local-secrets.d.ts

@@ -1,4 +1,4 @@
-import { type SecretValue } from '../secret-value.js';
+import { type SecretValue } from '../classification/secret-value.js';
 import type { SecretService, SecretValues } from './secret-service.js';
 import type { VariablesService } from './variables-service.js';
 export declare class LocalSecretService implements SecretService {

package/dist/services/local-secrets.js

@@ -1,4 +1,4 @@
-import { createSecretValue, isSecretValue, } from '../secret-value.js';
+import { createSecretValue, isSecretValue, } from '../classification/secret-value.js';
 import { LocalVariablesService } from './local-variables.js';
 export class LocalSecretService {
     variables;

package/dist/services/logger.d.ts

@@ -1,11 +1,11 @@
-import type { Safe } from '../secret-value.js';
+import type { Safe } from '../classification/secret-value.js';
 export declare enum LogLevel {
-    'trace' = 0,
-    'debug' = 1,
-    'info' = 2,
-    'warn' = 3,
-    'error' = 4,
-    'critical' = 5
+    trace = 0,
+    debug = 1,
+    info = 2,
+    warn = 3,
+    error = 4,
+    critical = 5
 }
 /**
  * A log line is the easiest place to leak a vault secret, so every parameter is

package/dist/services/meta-service.d.ts

@@ -13,7 +13,8 @@ import type { TriggerMeta, TriggerSourceMeta } from '../wirings/trigger/trigger.
 import type { SecretDefinitionsMeta } from '../wirings/secret/secret.types.js';
 import type { CredentialDefinitionsMeta } from '../wirings/credential/credential.types.js';
 import type { VariableDefinitionsMeta } from '../wirings/variable/variable.types.js';
-import type { FunctionMeta, FunctionsMeta, MiddlewareMetadata, PermissionMetadata } from '../types/core.types.js';
+import type { FunctionMeta, FunctionsMeta, PermissionMetadata } from '../function/function-meta.types.js';
+import type { MiddlewareMetadata } from '../middleware/middleware.types.js';
 import type { AgentsMeta } from '../wirings/agent/agent.types.js';
 import type { GatewaysMeta } from '../wirings/gateway/gateway.types.js';
 export type { FunctionMeta, FunctionsMeta, MiddlewareMetadata as MiddlewareMeta, PermissionMetadata as PermissionMeta, };

package/dist/services/scoped-secret-service.d.ts

@@ -1,4 +1,4 @@
-import type { SecretValue } from '../secret-value.js';
+import type { SecretValue } from '../classification/secret-value.js';
 import type { SecretService, SecretValues } from './secret-service.js';
 export declare class ScopedSecretService implements SecretService {
     private secrets;

package/dist/services/secret-service.d.ts

@@ -1,4 +1,4 @@
-import type { SecretValue } from '../secret-value.js';
+import type { SecretValue } from '../classification/secret-value.js';
 /** A record of secrets, each still wrapped. */
 export type SecretValues<T> = {
     [K in keyof T]: SecretValue<T[K]>;

package/dist/services/typed-secret-service.d.ts

@@ -1,5 +1,13 @@
-import type { SecretValue } from '../secret-value.js';
+import type { SecretValue } from '../classification/secret-value.js';
 import type { SecretService, SecretValues } from './secret-service.js';
+/**
+ * The wrapper, or `undefined` when the generated map declares the key as an
+ * optional property. The `undefined` has to be lifted OUT of `SecretValue` —
+ * a missing optional secret resolves to `undefined` itself, not to a wrapper
+ * around it, so `SecretValue<T | undefined>` would type a value that never
+ * exists and hide the `undefined` behind a `.reveal()` the caller never reaches.
+ */
+export type SecretResult<T> = undefined extends T ? SecretValue<Exclude<T, undefined>> | undefined : SecretValue<T>;
 export interface CredentialStatus {
     secretId: string;
     name: string;
@@ -12,6 +20,12 @@ export interface CredentialStatus {
 export type CredentialMeta = {
     name: string;
     displayName: string;
+    /**
+     * Declared `optional: true`, so absence is a supported state rather than a
+     * misconfiguration. The generated map types the key as an optional property,
+     * which is what puts `undefined` in `getSecret`'s return type.
+     */
+    optional?: boolean;
     oauth2?: {
         tokenSecretId: string;
     };
@@ -21,7 +35,7 @@ export declare class TypedSecretService<TMap = Record<string, unknown>> implemen
     private credentialsMeta;
     private cache;
     constructor(secrets: SecretService, credentialsMeta: Record<string, CredentialMeta>);
-    getSecret<K extends keyof TMap & string>(key: K): Promise<SecretValue<TMap[K]>>;
+    getSecret<K extends keyof TMap & string>(key: K): Promise<SecretResult<TMap[K]>>;
     getSecret<T = string>(key: string): Promise<SecretValue<T>>;
     hasSecret(key: string): Promise<boolean>;
     setSecret<K extends string>(key: K, value: K extends keyof TMap ? TMap[K] : unknown): Promise<void>;

package/dist/services/typed-secret-service.js

@@ -11,6 +11,11 @@ export class TypedSecretService {
         if (this.cache.has(key)) {
             return this.cache.get(key);
         }
+        if (this.credentialsMeta[key]?.optional &&
+            !(await this.secrets.hasSecret(key))) {
+            this.cache.set(key, undefined);
+            return undefined;
+        }
         const value = await this.secrets.getSecret(key);
         this.cache.set(key, value);
         return value;

package/dist/services/webhook-service.d.ts

@@ -1,4 +1,4 @@
-import type { Safe } from '../secret-value.js';
+import type { Safe } from '../classification/secret-value.js';
 export interface SendWebhookInput {
     url: string;
     /** Sent as the `X-Pikku-Event` header. */

package/dist/services/workflow-service.d.ts

@@ -1,4 +1,5 @@
-import type { CoreUserSession, SerializedError } from '../types/core.types.js';
+import type { CoreUserSession } from '../types/core.types.js';
+import type { SerializedError } from '../errors/serialized-error.js';
 import type { WorkflowRun, WorkflowPlannedStep, WorkflowRunWire, WorkflowRunStatus, StepState, WorkflowStatus, WorkflowVersionStatus } from '../wirings/workflow/workflow.types.js';
 import type { RunTimeline, ReconstructedRunState } from '../wirings/workflow/run-timeline.js';
 export interface WorkflowService {

package/dist/testing/index.d.ts

@@ -1,2 +1,3 @@
 export { defineServiceTests } from './service-tests.js';
 export type { ServiceTestConfig } from './service-tests.js';
+export { clearPikkuRuntimeState } from '../test-utils.js';

package/dist/testing/index.js

@@ -1 +1,2 @@
 export { defineServiceTests } from './service-tests.js';
+export { clearPikkuRuntimeState } from '../test-utils.js';