@pikku/kysely 0.13.16 → 0.13.19

package/CHANGELOG.md

@@ -1,3 +1,161 @@
+## 0.13.19
+
+### Patch Changes
+
+- 2d21628: fix(kysely): claim a workflow step atomically in every SQL dialect
+
+  The workflow engine's "atomic claim" was a read-then-write guarded by
+  `withStepLock`, and `@pikku/kysely` inherited a silent pass-through for that
+  lock — so on every dialect but Postgres and MySQL a redelivered queue job could
+  claim a step another dispatch was already running, executing a side-effecting
+  step twice.
+
+  `@pikku/kysely` now claims the step with a status-guarded `UPDATE` and reads the
+  affected-row count, which is atomic in every SQL dialect without an
+  advisory-lock primitive. Relay redispatch is enabled for all Kysely dialects as
+  a result, not just Postgres and MySQL.
+
+- Updated dependencies [9687ad1]
+- Updated dependencies [2d21628]
+- Updated dependencies [985b87b]
+- Updated dependencies [3a83f85]
+  - @pikku/core@0.12.87
+
+## 0.13.18
+
+### Patch Changes
+
+- 746ed6a: fix: one coercion plugin, not three
+
+  The Kysely coercion plugin existed in three copies — the CLI's local database,
+  `@pikku/kysely-node-sqlite` and `@pikku/kysely-bun-sqlite` — and all three had
+  drifted apart. Only the CLI's resolved a column against the tables the query
+  actually named, so two tables that disagree on the kind of a same-named column
+  coerced correctly in local development and silently did not at runtime; only
+  bun's dropped a genuinely ambiguous column instead of letting the last table
+  processed win.
+
+  The single implementation now lives in `@pikku/kysely`, which all three already
+  depended on, and keeps both behaviours: table-qualified resolution first, an
+  ambiguity-safe bare-name fallback second.
+
+  `ColumnKind` — the value type of the generated `coercion.gen.ts` — is
+  `'date' | 'bool' | 'json'`. The CLI's fourth member, `uuid`, was never a
+  coercion kind: the codegen excludes it from the map by construction, because a
+  UUID is a string in both Postgres and SQLite. It is now `AnnotationKind` in the
+  CLI, the union a column may declare in `db/annotations.ts`, of which
+  `ColumnKind` is the coercible subset.
+
+  `@pikku/cli` also drops its unused dependency on the Node-only
+  `@pikku/kysely-node-sqlite`.
+
+- Updated dependencies [5a1a962]
+  - @pikku/core@0.12.86
+
+## 0.13.17
+
+### Patch Changes
+
+- 266e3bc: One door per name: `@pikku/core/ecosystem/*` and the package root are gone
+
+  `@pikku/core` published every module twice. `ecosystem/http` re-exported
+  `./http`, `ecosystem/services` re-exported `./services`, and a name was
+  reachable through either — so every addition had to be made in two places, and a
+  consumer's import said nothing about what it actually used. The package root was
+  the same problem at a larger scale: a single barrel of 206 names that no bundler
+  could take apart, and the one specifier that revealed nothing at all.
+
+  Both are deleted. Every name now lives on the subpath that owns it, and every
+  import carries that subpath — `@pikku/core/http`, `@pikku/core/services`,
+  `@pikku/core/errors`, `@pikku/core/types`.
+
+  Deleting the facades meant the raw subpaths had to become a superset of them,
+  which they were not: the facade tree had accumulated 25 names with no raw home
+  and about 26 more filed under a different area than the module they came from.
+  Those names moved to the area that owns them, and three areas were published as
+  new entry points rather than left on a root that is going away — `./types` (the
+  shared type surface, the largest single destination), `./state` and
+  `./classification`.
+
+  `./classification` is one door onto one subject: what a value is and how it must
+  be handled. Its three halves would each have been an entry point — the brands
+  and manifest types, the stored-form helpers (`hashToken`, `unsafeAsSealed` and
+  friends), and `SecretValue` — split by whether a name happens to be a type or a
+  value, which is the same defect as the facades. The duration and versioned-id
+  helpers went to `./utils`, which already published, and `PikkuRequest` went to
+  `./function`: it is the transport-agnostic request base, not an HTTP one — HTTP
+  has `PikkuHTTPAbstractRequest`, and the only thing outside core that extends
+  `PikkuRequest` is Azure's timer request.
+
+  `./types` inherited the root barrel's habit before it inherited its contents, so
+  the names with an owner elsewhere were moved off it. The middleware types and the
+  five middleware factories — `pikkuMiddleware`, `pikkuMiddlewareFactory`,
+  `pikkuChannelMiddleware`, `pikkuChannelMiddlewareFactory` and
+  `pikkuAgentMiddleware`, runtime values on a types entry point — are now
+  `@pikku/core/middleware`; the function meta types are `@pikku/core/function`;
+  `SerializedError` is `@pikku/core/errors`; and the generic TypeScript helpers
+  (`MakeRequired`, `PickRequired`, `PickOptional`, `RequireAtLeastOne`,
+  `JSONPrimitive`, `JSONValue`) are `@pikku/core/utils`. What is left on `./types`
+  is the vocabulary the wirings share, which no single module owns.
+
+  `pikku` was itself a root barrel — `export * from '@pikku/core'` — and
+  now exports only the services it bundles.
+
+  One module survives at the old specifier, and only for the bootstrap:
+  `packages/cli` is generated by the _published_ CLI pinned in its `build.sh`, and
+  that CLI still writes a bare `@pikku/core` into the files it generates for the
+  CLI itself. `bootstrap-compat/root.ts` carries the eight types it names, a test
+  in core fails if that list grows, and it goes when the pin moves to a CLI
+  released from this branch. The adapter names the pinned CLI reaches for —
+  `pikkuState` and `CreateWireServices` — are rewritten to `@pikku/core/state` and
+  `@pikku/core/types` by the same `build.sh` patch pass, so no second shim is
+  needed for them.
+
+  A guard test keeps the root shut: it parses imports and rejects a bare
+  `@pikku/core` rather than grepping for it, because several tests hold a user's
+  file as a template literal, where `import … from '@pikku/core'` is fixture text
+  rather than an import this repo makes.
+
+  An agent scaffold a project generated under an older CLI is refreshed rather
+  than left to fail: `pikku all` already deleted one importing an entry point
+  `@pikku/core` no longer publishes, and the `#pikku` hub joins that list.
+  Without it a project that scaffolds the agent endpoint but
+  declares no agents keeps the old file forever — the generator that would rewrite
+  it only runs when agents exist, and the file being present is what stops it
+  being regenerated as missing.
+
+  `pikku new addon` also wrote a tsconfig `paths` map naming only the deleted hub.
+  An addon's `imports` map points into `dist`, so `paths` is what resolves
+  `#pikku/<leaf>` for the addon's own source build — it now names the two leaf
+  patterns, in both the addon and its test harness.
+
+- 786dae5: Bump every dependency whose latest release is a major across the monorepo, and
+  port the code the majors broke: `cookie` 2's `parseCookie`/`stringifySetCookie`
+  API in `@pikku/core` and the three runtime HTTP adapters, and assistant-ui 0.15's
+  store client in `@pikku/assistant-ui`.
+- 6eef0a0: Bump every dependency to its latest compatible minor/patch across the monorepo.
+- Updated dependencies [7722ceb]
+- Updated dependencies [375c1ff]
+- Updated dependencies [02a70cd]
+- Updated dependencies [aeef159]
+- Updated dependencies [a281de6]
+- Updated dependencies [266e3bc]
+- Updated dependencies [02a70cd]
+- Updated dependencies [786dae5]
+- Updated dependencies [6eef0a0]
+- Updated dependencies [3561d67]
+- Updated dependencies [a91c433]
+- Updated dependencies [02a70cd]
+- Updated dependencies [9537f74]
+- Updated dependencies [2b57ca8]
+- Updated dependencies [266e3bc]
+- Updated dependencies [9fce0f1]
+- Updated dependencies [83683a0]
+- Updated dependencies [456c88b]
+- Updated dependencies [456c88b]
+- Updated dependencies [c127273]
+  - @pikku/core@0.12.85
+
 ## 0.13.16
 
 ### Patch Changes

package/dist/src/coercion-plugin.d.ts

@@ -0,0 +1,41 @@
+import type { KyselyPlugin } from 'kysely';
+/**
+ * The kinds a column can be coerced *to* at runtime. This is the value type of
+ * the generated `CoercionMap`, so it is a public artifact contract — a kind may
+ * only appear here if `fromDb` below actually does something with it.
+ *
+ * `uuid` is deliberately absent: it is an annotation kind (it selects the `Uuid`
+ * TypeScript type in the generated schema) but not a coercion kind, and the
+ * codegen filters it out of `coercion.gen.ts` for exactly that reason — a UUID
+ * is a string in both Postgres and SQLite.
+ */
+export type ColumnKind = 'date' | 'bool' | 'json';
+/**
+ * Per-table column kind map. Keys are the table names queries are written
+ * against; inner keys are snake_case column names.
+ * Generated into `outDir/db/coercion.gen.ts` by `pikku db migrate` from the
+ * explicit `kind` entries in `db/annotations.ts`.
+ */
+export type CoercionMap = Record<string, Record<string, ColumnKind>>;
+export interface CreateCoercionPluginOptions {
+    map: CoercionMap;
+}
+/**
+ * Convert values stored in a dialect's on-disk representation back into the
+ * logical types app code expects (Date / boolean / parsed JSON).
+ *
+ * SQLite is what makes this necessary — it stores dates as TEXT, booleans as
+ * INTEGER and JSON as TEXT — but the plugin is dialect-neutral: on Postgres the
+ * driver already returns Date/boolean/object, and every branch of `fromDb`
+ * passes a non-string, non-number value straight through. That is why it lives
+ * in `@pikku/kysely` next to `SerializePlugin` rather than in a SQLite package:
+ * the CLI installs it on its local Postgres database too.
+ *
+ * Write-side coercion (Date → ISO string, boolean → 0/1, object → JSON) is
+ * handled in the SQLite database adapters (always-on), so this plugin is
+ * read-only.
+ *
+ * Place AFTER CamelCasePlugin in the plugin array (or it handles both
+ * orderings via the dual-keyed maps).
+ */
+export declare function createCoercionPlugin(options: CreateCoercionPluginOptions): KyselyPlugin;

package/dist/src/coercion-plugin.js

@@ -0,0 +1,150 @@
+function fromDb(value, kind) {
+    if (value == null)
+        return value;
+    switch (kind) {
+        case 'date':
+            if (typeof value === 'string') {
+                const d = new Date(value);
+                return Number.isNaN(d.getTime()) ? value : d;
+            }
+            return value;
+        case 'bool':
+            if (typeof value === 'number')
+                return value !== 0;
+            if (typeof value === 'bigint')
+                return value !== 0n;
+            return value;
+        case 'json':
+            if (typeof value !== 'string')
+                return value;
+            try {
+                return JSON.parse(value);
+            }
+            catch {
+                return value;
+            }
+    }
+}
+function snakeToCamel(name) {
+    return name.replace(/_([a-z])/g, (_, c) => c.toUpperCase());
+}
+/**
+ * Flatten the per-table map into a table-qualified lookup plus a bare
+ * column-name fallback. Both are indexed by BOTH snake_case and camelCase so
+ * they work regardless of CamelCasePlugin ordering in the plugin array.
+ *
+ * When two tables disagree on the kind for the same column name, the bare name
+ * is ambiguous (a joined/aliased query could carry either) and is dropped from
+ * the flat map rather than letting whichever table was processed last win. The
+ * qualified map still resolves it whenever the query names its tables.
+ */
+function buildMaps(map) {
+    const qualified = {};
+    const flat = {};
+    const ambiguous = new Set();
+    const assignFlat = (key, kind) => {
+        const existing = flat[key];
+        if (existing !== undefined && existing !== kind) {
+            ambiguous.add(key);
+            return;
+        }
+        flat[key] = kind;
+    };
+    for (const [table, cols] of Object.entries(map)) {
+        for (const [col, kind] of Object.entries(cols)) {
+            const camel = snakeToCamel(col);
+            qualified[`${table}.${col}`] = kind;
+            qualified[`${table}.${camel}`] = kind;
+            assignFlat(col, kind);
+            assignFlat(camel, kind);
+        }
+    }
+    for (const key of ambiguous)
+        delete flat[key];
+    return { qualified, flat };
+}
+/**
+ * Collect every table named anywhere in the query's operation node, so a result
+ * column can be resolved against the tables the query actually touched instead
+ * of against every table in the schema.
+ */
+function collectQueryTables(node, out) {
+    if (!node || typeof node !== 'object')
+        return;
+    const op = node;
+    if (op.kind === 'TableNode') {
+        const tableName = op.table?.identifier?.name;
+        if (typeof tableName === 'string' && tableName.length > 0)
+            out.add(tableName);
+    }
+    for (const value of Object.values(node)) {
+        if (Array.isArray(value)) {
+            for (const item of value)
+                collectQueryTables(item, out);
+        }
+        else {
+            collectQueryTables(value, out);
+        }
+    }
+}
+/**
+ * Resolve a result column's kind against the query's tables, falling back to
+ * the bare column name. Tables that disagree with each other are as ambiguous
+ * as two schema tables are, so they fall back too.
+ */
+function lookupKind(maps, tables, col) {
+    let matchedKind;
+    for (const table of tables) {
+        const kind = maps.qualified[`${table}.${col}`];
+        if (!kind)
+            continue;
+        if (matchedKind && matchedKind !== kind)
+            return maps.flat[col];
+        matchedKind = kind;
+    }
+    return matchedKind ?? maps.flat[col];
+}
+/**
+ * Convert values stored in a dialect's on-disk representation back into the
+ * logical types app code expects (Date / boolean / parsed JSON).
+ *
+ * SQLite is what makes this necessary — it stores dates as TEXT, booleans as
+ * INTEGER and JSON as TEXT — but the plugin is dialect-neutral: on Postgres the
+ * driver already returns Date/boolean/object, and every branch of `fromDb`
+ * passes a non-string, non-number value straight through. That is why it lives
+ * in `@pikku/kysely` next to `SerializePlugin` rather than in a SQLite package:
+ * the CLI installs it on its local Postgres database too.
+ *
+ * Write-side coercion (Date → ISO string, boolean → 0/1, object → JSON) is
+ * handled in the SQLite database adapters (always-on), so this plugin is
+ * read-only.
+ *
+ * Place AFTER CamelCasePlugin in the plugin array (or it handles both
+ * orderings via the dual-keyed maps).
+ */
+export function createCoercionPlugin(options) {
+    const maps = buildMaps(options.map);
+    const queryTables = new WeakMap();
+    return {
+        transformQuery(args) {
+            const tables = new Set();
+            collectQueryTables(args.node, tables);
+            queryTables.set(args.queryId, [...tables]);
+            return args.node;
+        },
+        async transformResult(args) {
+            const tables = queryTables.get(args.queryId) ?? [];
+            const out = [];
+            for (const row of args.result.rows) {
+                const next = { ...row };
+                for (const [col, val] of Object.entries(row)) {
+                    const kind = lookupKind(maps, tables, col);
+                    if (kind)
+                        next[col] = fromDb(val, kind);
+                }
+                out.push(next);
+            }
+            return { ...args.result, rows: out };
+        },
+    };
+}

package/dist/src/create-audited-kysely.d.ts

@@ -1,4 +1,4 @@
-import type { AuditLog } from '@pikku/core';
+import type { AuditLog } from '@pikku/core/services';
 import type { Kysely } from 'kysely';
 export interface CreateAuditedKyselyOptions {
     audit: AuditLog;

package/dist/src/index.d.ts

@@ -16,8 +16,9 @@ export { createAuditedKysely, type CreateAuditedKyselyOptions, } from './create-
 export { KyselyAuditService } from './kysely-audit-service.js';
 export { KyselyVirtualUserRunStore } from './kysely-virtual-user-run-store.js';
 export { SerializePlugin, BaseSerializePlugin, type Serializer, type Deserializer, } from './serialize-plugin.js';
+export { createCoercionPlugin, type ColumnKind, type CoercionMap, type CreateCoercionPluginOptions, } from './coercion-plugin.js';
 export { auditSchema, pikkuSchemas, applyPikkuSchemas, compilePikkuSchemas, ensurePikkuSchema, type EnsureOutcome, resolveRequirements, type PikkuSchema, type RequiredTypes, type UnmetRequirement, type SchemaStatementFactory, } from './schema/index.js';
 export type { KyselyPikkuDB } from './kysely-tables.js';
-export type { WorkflowRunService } from '@pikku/core/ecosystem/workflow';
-export type { AgentRunService, AgentRunRow, } from '@pikku/core/ecosystem/agent';
-export type { VirtualUserRunStore, VirtualUserRunRecord, } from '@pikku/core/ecosystem/virtual-user';
+export type { WorkflowRunService } from '@pikku/core/workflow';
+export type { AgentRunService, AgentRunRow } from '@pikku/core/agent';
+export type { VirtualUserRunStore, VirtualUserRunRecord, } from '@pikku/core/virtual-user';

package/dist/src/index.js

@@ -16,4 +16,5 @@ export { createAuditedKysely, } from './create-audited-kysely.js';
 export { KyselyAuditService } from './kysely-audit-service.js';
 export { KyselyVirtualUserRunStore } from './kysely-virtual-user-run-store.js';
 export { SerializePlugin, BaseSerializePlugin, } from './serialize-plugin.js';
+export { createCoercionPlugin, } from './coercion-plugin.js';
 export { auditSchema, pikkuSchemas, applyPikkuSchemas, compilePikkuSchemas, ensurePikkuSchema, resolveRequirements, } from './schema/index.js';

package/dist/src/kysely-agent-run-scores.d.ts

@@ -1,7 +1,7 @@
 import type { Kysely } from 'kysely';
 import type { KyselyPikkuDB } from './kysely-tables.js';
-import type { SaveScoreInput } from '@pikku/core/services';
 import type { AgentRunScore } from '@pikku/core/agent-scorer';
+import type { SaveScoreInput } from '@pikku/core/services';
 /**
  * Shared by the two Kysely services that implement `AgentRunStateService` — they
  * differ in how they store approvals, not in how they store grades.

package/dist/src/kysely-agent-run-service.d.ts

@@ -1,5 +1,4 @@
-import type { AgentThread, AgentMessage } from '@pikku/core/agent';
-import type { AgentRunRow, AgentRunService } from '@pikku/core/ecosystem/agent';
+import type { AgentThread, AgentMessage, AgentRunRow, AgentRunService } from '@pikku/core/agent';
 import type { Kysely } from 'kysely';
 import type { KyselyPikkuDB } from './kysely-tables.js';
 export declare class KyselyAgentRunService implements AgentRunService {

package/dist/src/kysely-agent-run-state-service.d.ts

@@ -1,9 +1,9 @@
 import type { Kysely } from 'kysely';
 import type { KyselyPikkuDB } from './kysely-tables.js';
-import type { AgentRunStateService, CreateRunInput, SaveScoreInput } from '@pikku/core/services';
 import type { AgentRunState } from '@pikku/core/agent';
-import type { PendingApproval } from '@pikku/core/ecosystem/agent';
 import type { AgentRunScore } from '@pikku/core/agent-scorer';
+import type { AgentRunStateService, CreateRunInput, SaveScoreInput } from '@pikku/core/services';
+import type { PendingApproval } from '@pikku/core/agent';
 export declare class KyselyAgentRunStateService implements AgentRunStateService {
     private db;
     private initialized;

package/dist/src/kysely-agent-storage-service.d.ts

@@ -1,6 +1,6 @@
-import type { AgentStorageService, AgentRunStateService, CreateRunInput, SaveScoreInput } from '@pikku/core/services';
-import type { AgentThread, AgentMessage, AgentRunState } from '@pikku/core/agent';
+import type { AgentMessage, AgentRunState, AgentThread } from '@pikku/core/agent';
 import type { AgentRunScore } from '@pikku/core/agent-scorer';
+import type { AgentRunStateService, AgentStorageService, CreateRunInput, SaveScoreInput } from '@pikku/core/services';
 import type { Kysely } from 'kysely';
 import type { KyselyPikkuDB } from './kysely-tables.js';
 export declare class KyselyAgentStorageService implements AgentStorageService, AgentRunStateService {

package/dist/src/kysely-audit-service.d.ts

@@ -1,6 +1,6 @@
-import type { AuditService } from '@pikku/core';
-import type { AuditEvent, AuditEventBatch } from '@pikku/core/ecosystem/services';
-import type { AuditFacets, AuditQuery, AuditQueryResult } from '@pikku/core/ecosystem/types';
+import type { AuditService } from '@pikku/core/services';
+import type { AuditEvent, AuditEventBatch } from '@pikku/core/services';
+import type { AuditFacets, AuditQuery, AuditQueryResult } from '@pikku/core/services';
 import type { Kysely } from 'kysely';
 /**
  * Durable {@link AuditService} that persists AuditEvents to an `audit` table

package/dist/src/kysely-channel-store.d.ts

@@ -1,5 +1,5 @@
-import type { Channel } from '@pikku/core/channel';
 import { ChannelStore } from '@pikku/core/channel';
+import type { Channel } from '@pikku/core/channel';
 import type { Kysely } from 'kysely';
 import type { KyselyPikkuDB } from './kysely-tables.js';
 export declare class KyselyChannelStore extends ChannelStore {

package/dist/src/kysely-credential-service.js

@@ -1,4 +1,4 @@
-import { deriveKEK, generateKEKSalt, envelopeEncrypt, envelopeDecrypt, envelopeRewrap, } from '@pikku/core/crypto-utils';
+import { deriveKEK, envelopeDecrypt, envelopeEncrypt, envelopeRewrap, generateKEKSalt, } from '@pikku/core/crypto-utils';
 import { ensurePikkuSchema } from './schema/index.js';
 import { credentialSchema } from './schema/credential.schema.js';
 export class KyselyCredentialService {

package/dist/src/kysely-deployment-service.d.ts

@@ -1,5 +1,6 @@
-import type { DeploymentService, DeploymentServiceConfig, DeploymentConfig } from '@pikku/core/ecosystem/services';
-import type { JWTService, SecretService } from '@pikku/core/services';
+import type { DeploymentService, DeploymentServiceConfig, DeploymentConfig } from '@pikku/core/services';
+import type { JWTService } from '@pikku/core/services';
+import type { SecretService } from '@pikku/core/services';
 import type { Kysely } from 'kysely';
 import type { KyselyPikkuDB } from './kysely-tables.js';
 export declare class KyselyDeploymentService implements DeploymentService {

package/dist/src/kysely-deployment-service.js

@@ -1,5 +1,5 @@
-import { buildRemoteHeaders } from '@pikku/core/ecosystem/remote';
-import { getAllFunctionNames } from '@pikku/core/ecosystem/function';
+import { buildRemoteHeaders } from '@pikku/core/remote';
+import { getAllFunctionNames } from '@pikku/core/function';
 import { ensurePikkuSchema } from './schema/index.js';
 import { deploymentSchema } from './schema/deployment.schema.js';
 export class KyselyDeploymentService {

package/dist/src/kysely-eventhub-store.d.ts

@@ -1,4 +1,4 @@
-import { EventHubStore } from '@pikku/core/ecosystem/channel';
+import { EventHubStore } from '@pikku/core/channel';
 import type { Kysely } from 'kysely';
 import type { KyselyPikkuDB } from './kysely-tables.js';
 export declare class KyselyEventHubStore extends EventHubStore {

package/dist/src/kysely-eventhub-store.js

@@ -1,4 +1,4 @@
-import { EventHubStore } from '@pikku/core/ecosystem/channel';
+import { EventHubStore } from '@pikku/core/channel';
 export class KyselyEventHubStore extends EventHubStore {
     db;
     initialized = false;

package/dist/src/kysely-scope-service.d.ts

@@ -1,7 +1,7 @@
 import type { ScopeService } from '@pikku/core/services';
-import type { Role } from '@pikku/core/ecosystem/services';
-import type { FlatScope } from '@pikku/core/ecosystem/scope';
-import type { SystemRole } from '@pikku/core/ecosystem/role';
+import type { Role } from '@pikku/core/services';
+import type { FlatScope } from '@pikku/core/scope';
+import type { SystemRole } from '@pikku/core/role';
 import type { Kysely } from 'kysely';
 import type { KyselyPikkuDB } from './kysely-tables.js';
 /**

package/dist/src/kysely-secret-service.d.ts

@@ -1,5 +1,5 @@
-import { type SecretValue } from '@pikku/core';
 import type { SecretService, SecretValues } from '@pikku/core/services';
+import type { SecretValue } from '@pikku/core/classification';
 import type { Kysely } from 'kysely';
 import type { KyselyPikkuDB } from './kysely-tables.js';
 export interface KyselySecretServiceConfig {

package/dist/src/kysely-secret-service.js

@@ -1,5 +1,5 @@
-import { createSecretValue, isSecretValue } from '@pikku/core';
-import { deriveKEK, generateKEKSalt, envelopeEncrypt, envelopeDecrypt, envelopeRewrap, } from '@pikku/core/crypto-utils';
+import { deriveKEK, envelopeDecrypt, envelopeEncrypt, envelopeRewrap, generateKEKSalt, } from '@pikku/core/crypto-utils';
+import { createSecretValue, isSecretValue } from '@pikku/core/classification';
 import { ensurePikkuSchema } from './schema/index.js';
 import { secretSchema } from './schema/secret.schema.js';
 export class KyselySecretService {

package/dist/src/kysely-session-store.d.ts

@@ -1,5 +1,5 @@
-import type { CoreUserSession } from '@pikku/core';
 import type { SessionStore } from '@pikku/core/services';
+import type { CoreUserSession } from '@pikku/core/types';
 import type { Kysely } from 'kysely';
 import type { KyselyPikkuDB } from './kysely-tables.js';
 export declare class KyselySessionStore implements SessionStore {

package/dist/src/kysely-tables.d.ts

@@ -1,5 +1,5 @@
 import type { Generated } from 'kysely';
-import type { WorkflowStatus, StepStatus, WorkflowVersionStatus } from '@pikku/core/ecosystem/workflow';
+import type { WorkflowStatus, StepStatus, WorkflowVersionStatus } from '@pikku/core/workflow';
 export interface ChannelsTable {
     channelId: string;
     channelName: string;

package/dist/src/kysely-virtual-user-run-store.d.ts

@@ -1,5 +1,5 @@
 import type { Kysely } from 'kysely';
-import type { VirtualUserRunOutcome, VirtualUserRunRecord, VirtualUserRunStart, VirtualUserRunStore } from '@pikku/core/ecosystem/virtual-user';
+import type { VirtualUserRunOutcome, VirtualUserRunRecord, VirtualUserRunStart, VirtualUserRunStore } from '@pikku/core/virtual-user';
 import type { KyselyPikkuDB } from './kysely-tables.js';
 /**
  * Records virtual-user runs in a `virtualUserRun` table.

package/dist/src/kysely-webhook-service.d.ts

@@ -1,6 +1,6 @@
 import { QueueWebhookService } from '@pikku/core/services';
-import { type SendWebhookInput, type SendWebhookResult, type WebhookAttemptResult, type WebhookDeliveryRecord, type WebhookDeliveryWithAttempts } from '@pikku/core/ecosystem/services';
 import type { QueueService } from '@pikku/core/queue';
+import { type SendWebhookInput, type SendWebhookResult, type WebhookAttemptResult, type WebhookDeliveryRecord, type WebhookDeliveryWithAttempts } from '@pikku/core/services';
 import type { Kysely } from 'kysely';
 import type { KyselyPikkuDB } from './kysely-tables.js';
 /**

package/dist/src/kysely-webhook-service.js

@@ -1,5 +1,5 @@
 import { QueueWebhookService } from '@pikku/core/services';
-import { PIKKU_OUTGOING_WEBHOOK_QUEUE_NAME, } from '@pikku/core/ecosystem/services';
+import { PIKKU_OUTGOING_WEBHOOK_QUEUE_NAME, } from '@pikku/core/services';
 import { ensurePikkuSchema } from './schema/index.js';
 import { webhookSchema } from './schema/webhook.schema.js';
 /**

package/dist/src/kysely-workflow-mirror.d.ts

@@ -1,5 +1,5 @@
-import type { SerializedError } from '@pikku/core/ecosystem/types';
-import type { StepState, WorkflowRunMirror, WorkflowRunWire, WorkflowStatus, WorkflowPlannedStep, WorkflowVersionStatus } from '@pikku/core/ecosystem/workflow';
+import type { SerializedError } from '@pikku/core/errors';
+import type { StepState, WorkflowRunMirror, WorkflowRunWire, WorkflowStatus, WorkflowPlannedStep, WorkflowVersionStatus } from '@pikku/core/workflow';
 import type { Kysely } from 'kysely';
 import type { KyselyPikkuDB } from './kysely-tables.js';
 /**

package/dist/src/kysely-workflow-run-service.d.ts

@@ -1,4 +1,4 @@
-import type { WorkflowRun, StepState, WorkflowRunService } from '@pikku/core/ecosystem/workflow';
+import type { WorkflowRun, StepState, WorkflowRunService } from '@pikku/core/workflow';
 import type { Kysely } from 'kysely';
 import type { KyselyPikkuDB } from './kysely-tables.js';
 export declare class KyselyWorkflowRunService implements WorkflowRunService {