@pikku/addon-meta-conversions 0.1.2 → 0.1.3

package/.pikku/addon/pikku-addon-types.gen.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.55
+ * This file was generated by @pikku/cli@0.12.96
  */
 /**
  * Addon package types for pikkuAddonConfig and pikkuAddonServices

package/.pikku/addon/pikku-package.gen.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.55
+ * This file was generated by @pikku/cli@0.12.96
  */
 import { pikkuState } from '@pikku/core/internal'
 import { createSingletonServices as createSingletonServices } from '../../src/services.js'

package/.pikku/agent/pikku-agent-map.gen.d.ts

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.55
+ * This file was generated by @pikku/cli@0.12.96
  */
 export type AgentMap = {}

package/.pikku/agent/pikku-agent-types.gen.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.55
+ * This file was generated by @pikku/cli@0.12.96
  */
 import {
   CoreAIAgent,
@@ -15,16 +15,18 @@ import type { PikkuPermission, PikkuMiddleware, Services, PikkuFunctionConfig }
 import type { StandardSchemaV1 } from '@standard-schema/spec'
 import type { AIAgentMemoryConfig, AIAgentInput } from '@pikku/core/ai-agent'
 import type { AgentMap } from './pikku-agent-map.gen.d.js'
+import type { ScopeId } from '../scopes/pikku-scopes.gen.js'
 
 type AIAgentConfig<
   InputSchema extends StandardSchemaV1 | undefined = undefined,
   OutputSchema extends StandardSchemaV1 | undefined = undefined
-> = Omit<CoreAIAgent<PikkuPermission, PikkuMiddleware>, 'tools' | 'agents' | 'memory' | 'input' | 'output'> & {
+> = Omit<CoreAIAgent<PikkuPermission, PikkuMiddleware, ScopeId>, 'tools' | 'agents' | 'workflows' | 'memory' | 'input' | 'output'> & {
   input?: InputSchema
   output?: OutputSchema
   memory?: Omit<AIAgentMemoryConfig, 'workingMemory'> & { workingMemory?: StandardSchemaV1 }
   tools?: object[]
   agents?: AIAgentConfig<StandardSchemaV1 | undefined, StandardSchemaV1 | undefined>[]
+  workflows?: object[]
 }
 
 export const pikkuAIAgent = <

package/.pikku/channel/pikku-channel-types.gen.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.55
+ * This file was generated by @pikku/cli@0.12.96
  */
 /**
  * Channel-specific type definitions for tree-shaking optimization

package/.pikku/console/pikku-addon-meta.gen.json

@@ -29,5 +29,8 @@
     "categories": [
       "Events"
     ]
-  }
+  },
+  "requiredParentServices": [
+    "secrets"
+  ]
 }

package/.pikku/console/pikku-node-types.gen.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.55
+ * This file was generated by @pikku/cli@0.12.96
  */
 import type { FlattenedRPCMap } from '../rpc/pikku-rpc-wirings-map.internal.gen.js'
 

package/.pikku/function/pikku-function-types.gen.ts

@@ -1,21 +1,21 @@
 /**
- * This file was generated by @pikku/cli@0.12.55
+ * This file was generated by @pikku/cli@0.12.96
  */
 /**
  * Core function, middleware, and permission types for all wirings
  */
 
-import type { CorePikkuMiddleware, CorePermissionGroup, ListInput, ListOutput, PikkuWire, PickRequired } from '@pikku/core'
+import type { CorePikkuMiddleware, CorePermissionGroup, ListInput, ListOutput, PikkuWire, PickRequired, SecretlessServices, SecretService } from '@pikku/core'
 import type { CorePikkuFunctionConfig, CorePikkuAuth, CorePikkuAuthConfig, CorePikkuPermission } from '@pikku/core/function'
 import { pikkuAuth as pikkuAuthCore } from '@pikku/core/function'
 import {
   addTagMiddleware as addTagMiddlewareCore,
   addGlobalMiddleware as addGlobalMiddlewareCore,
-  addTagPermission as addTagPermissionCore,
   addGlobalPermission as addGlobalPermissionCore,
 } from '@pikku/core/middleware'
 import { pikkuState as __pikkuState, CreateWireServices } from '@pikku/core/internal'
 import type { NodeType } from '@pikku/core/node'
+import type { ScopeId } from '../scopes/pikku-scopes.gen.js'
 import type { StandardSchemaV1 } from '@standard-schema/spec'
 import { CorePikkuFunction, CorePikkuFunctionSessionless } from '@pikku/core/function'
 
@@ -25,13 +25,37 @@ import type { Services } from '../../types/application-types.d.js'
 import type { Config } from '../../types/application-types.d.js'
 import type { TypedPikkuRPC, FlattenedRPCMap } from '../rpc/pikku-rpc-wirings-map.internal.gen.d.js'
 import type { RequiredSingletonServices, RequiredWireServices } from '../pikku-services.gen.js'
-import type { TypedWorkflow } from '../workflow/pikku-workflow-types.gen.js'
+import type { TypedWorkflow, TypedScenario, TypedPersonas } from '../workflow/pikku-workflow-types.gen.js'
 
 export type { SingletonServices as SingletonServices }
 export type { Services as Services }
 export type Session = UserSession
 
 
+/**
+ * The services a wired function actually receives. The inspector records which
+ * services each wired `func`, `permissions` and `middleware` destructures and
+ * emits them as `RequiredSingletonServices`; intersecting that here makes those
+ * services **non-optional** at every call site. A service is optional only when
+ * nothing destructures it — in which case it is never created either. This is
+ * why an `if (!service)` guard inside a function body is always dead code.
+ */
+export type WiredSingletonServices = RequiredSingletonServices & SingletonServices
+export type WiredServices = SecretlessServices<RequiredSingletonServices & Services>
+
+/** `WiredSingletonServices` without `secrets`, for auth gates. */
+export type WiredAuthServices = SecretlessServices<WiredSingletonServices>
+
+/**
+ * `WiredServices` with `secrets` restored, for the console's secret-admin
+ * functions. Reached by declaring `secretBroker: true` on a `pikkuFunc` config.
+ *
+ * Declaring it does not grant the service. The runner hands out the real
+ * `SecretService` only to the functions the inspector marks as secret brokers;
+ * every other function still receives the throwing accessor.
+ */
+export type WiredSecretBrokerServices = WiredServices & { secrets: SecretService }
+
 /**
  * Inline node configuration for function definitions.
  */
@@ -49,7 +73,7 @@ export type NodeConfig = {
  * @template In - The input type that the permission check will receive
  * @template RequiredServices - The services required for this permission check
  */
-export type PikkuPermission<In = unknown, RequiredServices extends Services = Services> = CorePikkuPermission<In, RequiredServices, PikkuWire<In, never, false, Session>>
+export type PikkuPermission<In = unknown, RequiredServices extends SecretlessServices<Services> = WiredServices> = CorePikkuPermission<In, RequiredServices, PikkuWire<In, never, false, Session>>
 
 /**
  * Type-safe middleware definition that can access your application's services and session.
@@ -57,12 +81,12 @@ export type PikkuPermission<In = unknown, RequiredServices extends Services = Se
  *
  * @template RequiredServices - The services required for this middleware
  */
-export type PikkuMiddleware<RequiredServices extends SingletonServices = SingletonServices> = CorePikkuMiddleware<RequiredServices>
+export type PikkuMiddleware<RequiredServices extends SingletonServices = WiredSingletonServices> = CorePikkuMiddleware<RequiredServices>
 
 /**
  * Configuration object for creating a permission with metadata
  */
-export type PikkuPermissionConfig<In = unknown, RequiredServices extends Services = Services> = {
+export type PikkuPermissionConfig<In = unknown, RequiredServices extends SecretlessServices<Services> = WiredServices> = {
   /** The permission function */
   func: PikkuPermission<In, RequiredServices>
   /** Optional human-readable name for the permission */
@@ -107,12 +131,12 @@ export const pikkuPermission = <In>(
  *
  * @template RequiredServices - The services required for this auth check
  */
-export type PikkuAuth<RequiredServices extends SingletonServices = SingletonServices> = CorePikkuAuth<RequiredServices, Session>
+export type PikkuAuth<RequiredServices extends SecretlessServices<SingletonServices> = WiredAuthServices> = CorePikkuAuth<RequiredServices, Session>
 
 /**
  * Configuration object for creating an auth permission with metadata
  */
-export type PikkuAuthConfig<RequiredServices extends SingletonServices = SingletonServices> = CorePikkuAuthConfig<RequiredServices, Session>
+export type PikkuAuthConfig<RequiredServices extends SecretlessServices<SingletonServices> = WiredAuthServices> = CorePikkuAuthConfig<RequiredServices, Session>
 
 /**
  * Factory function for creating auth-only permissions with tree-shaking support.
@@ -134,7 +158,7 @@ export type PikkuAuthConfig<RequiredServices extends SingletonServices = Singlet
  * })
  * \`\`\`
  */
-export const pikkuAuth = <RequiredServices extends SingletonServices = SingletonServices>(
+export const pikkuAuth = <RequiredServices extends SecretlessServices<SingletonServices> = WiredAuthServices>(
   auth: PikkuAuth<RequiredServices> | PikkuAuthConfig<RequiredServices>
 ): PikkuPermission<any, any> => {
   return pikkuAuthCore(auth as any) as any
@@ -143,7 +167,7 @@ export const pikkuAuth = <RequiredServices extends SingletonServices = Singleton
 /**
  * Configuration object for creating middleware with metadata
  */
-export type PikkuMiddlewareConfig<RequiredServices extends SingletonServices = SingletonServices> = {
+export type PikkuMiddlewareConfig<RequiredServices extends SingletonServices = WiredSingletonServices> = {
   /** The middleware function */
   func: PikkuMiddleware<RequiredServices>
   /** Optional human-readable name for the middleware */
@@ -175,7 +199,7 @@ export type PikkuMiddlewareConfig<RequiredServices extends SingletonServices = S
  * })
  * ```
  */
-export const pikkuMiddleware = <RequiredServices extends SingletonServices = SingletonServices>(
+export const pikkuMiddleware = <RequiredServices extends SingletonServices = WiredSingletonServices>(
   middleware: PikkuMiddleware<RequiredServices> | PikkuMiddlewareConfig<RequiredServices>
 ): PikkuMiddleware<RequiredServices> => {
   return typeof middleware === 'function' ? middleware : middleware.func
@@ -236,7 +260,7 @@ export const pikkuPermissionFactory = <In = any>(
  * @template In - The input type (same as the function it describes)
  * @template RequiredServices - The services required for this description function
  */
-export type PikkuApprovalDescription<In = unknown, RequiredServices extends Services = Services> = (
+export type PikkuApprovalDescription<In = unknown, RequiredServices extends SecretlessServices<Services> = WiredServices> = (
   services: RequiredServices,
   data: In
 ) => Promise<string>
@@ -254,7 +278,7 @@ export type PikkuApprovalDescription<In = unknown, RequiredServices extends Serv
  * )
  * ```
  */
-export const pikkuApprovalDescription = <In = unknown, RequiredServices extends Services = Services>(
+export const pikkuApprovalDescription = <In = unknown, RequiredServices extends SecretlessServices<Services> = WiredServices>(
   fn: PikkuApprovalDescription<In, RequiredServices>
 ): PikkuApprovalDescription<In, RequiredServices> => {
   return fn
@@ -272,13 +296,13 @@ export type PikkuFunctionSessionless<
   In = unknown,
   Out = never,
   RequiredWires extends keyof PikkuWire = never,
-  RequiredServices extends Services = Services
+  RequiredServices extends SecretlessServices<Services> = WiredServices
 > = CorePikkuFunctionSessionless<
     In,
     Out,
     RequiredServices,
     Session,
-    PickRequired<PikkuWire<In, Out, false, Session, TypedPikkuRPC, null, any, TypedWorkflow>, RequiredWires>
+    PickRequired<PikkuWire<In, Out, false, Session, TypedPikkuRPC, null, any, TypedWorkflow, unknown, TypedScenario, TypedPersonas>, RequiredWires>
   >
 
 /**
@@ -293,13 +317,13 @@ export type PikkuFunction<
   In = unknown,
   Out = never,
   RequiredWires extends keyof PikkuWire = 'session',
-  RequiredServices extends Services = Services
+  RequiredServices extends SecretlessServices<Services> = WiredServices
 > = CorePikkuFunction<
     In,
     Out,
     RequiredServices,
     Session,
-    PickRequired<PikkuWire<In, Out, true, Session, TypedPikkuRPC, null, any, TypedWorkflow>, RequiredWires>
+    PickRequired<PikkuWire<In, Out, true, Session, TypedPikkuRPC, null, any, TypedWorkflow, unknown, TypedScenario, TypedPersonas>, RequiredWires>
   >
 
 /**
@@ -319,10 +343,10 @@ export type PikkuFunctionConfig<
   In = unknown,
   Out = unknown,
   RequiredWires extends keyof PikkuWire = never,
-  PikkuFunc extends PikkuFunction<In, Out, RequiredWires> | PikkuFunctionSessionless<In, Out, RequiredWires> = PikkuFunction<In, Out, RequiredWires> | PikkuFunctionSessionless<In, Out, RequiredWires>,
+  PikkuFunc extends PikkuFunction<In, Out, RequiredWires, any> | PikkuFunctionSessionless<In, Out, RequiredWires, any> = PikkuFunction<In, Out, RequiredWires> | PikkuFunctionSessionless<In, Out, RequiredWires>,
   InputSchema extends StandardSchemaV1 | undefined = undefined,
   OutputSchema extends StandardSchemaV1 | undefined = undefined
-> = CorePikkuFunctionConfig<PikkuFunc, PikkuPermission<In>, PikkuMiddleware, InputSchema, OutputSchema>
+> = CorePikkuFunctionConfig<PikkuFunc, PikkuPermission<In>, PikkuMiddleware, InputSchema, OutputSchema, ScopeId>
 
 /**
  * Configuration object for Pikku functions with Zod schema validation.
@@ -340,17 +364,23 @@ type SchemaInferred<S, Fallback = unknown> = S extends StandardSchemaV1
 export type PikkuFunctionConfigWithSchema<
   InputSchema extends StandardSchemaV1 | undefined = undefined,
   OutputSchema extends StandardSchemaV1 | undefined = undefined,
-  RequiredWires extends keyof PikkuWire = never
+  RequiredWires extends keyof PikkuWire = never,
+  RequiredServices extends SecretlessServices<Services> = WiredServices
 > = Omit<
   CorePikkuFunctionConfig<
-    | PikkuFunction<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires>
-    | PikkuFunctionSessionless<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires>
+    | PikkuFunction<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires, RequiredServices>
+    | PikkuFunctionSessionless<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires, RequiredServices>,
+    CorePikkuPermission<any>,
+    PikkuMiddleware,
+    undefined,
+    undefined,
+    ScopeId
   >,
   'func' | 'input' | 'output' | 'permissions' | 'approvalDescription'
 > & {
   func:
-    | PikkuFunction<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires>
-    | PikkuFunctionSessionless<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires>
+    | PikkuFunction<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires, RequiredServices>
+    | PikkuFunctionSessionless<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires, RequiredServices>
   input?: InputSchema
   output?: OutputSchema
   permissions?: InputSchema extends StandardSchemaV1
@@ -365,26 +395,14 @@ export type PikkuFunctionConfigWithSchema<
  * Creates a Pikku function that can be either session-aware or sessionless.
  * This is the main function wrapper for creating API endpoints.
  *
- * Supports two patterns:
- * 1. Generic types: `pikkuFunc<Input, Output>({ func: ... })`
- * 2. Zod schemas: `pikkuFunc({ input: z.object(...), output: z.object(...), func: ... })`
+ * Define the input and output with Zod schemas — the function's types are
+ * inferred from them, and the schemas double as runtime validation.
  *
- * @template In - Input type for the function (inferred from schema if provided)
- * @template Out - Output type for the function (inferred from schema if provided)
- * @param func - Function definition, either direct function or configuration object
+ * @param config - Function definition with `input`/`output` Zod schemas and `func`.
  * @returns The normalized configuration object
  *
  * @example
  * ```typescript
- * // Pattern 1: Using generic types
- * const createUser = pikkuFunc<{name: string, email: string}, {id: number}>({
- *   func: async ({db}, input) => {
- *     const user = await db.users.create(input)
- *     return { id: user.id }
- *   }
- * })
- *
- * // Pattern 2: Using Zod schemas (types inferred automatically)
  * const createUserInput = z.object({ name: z.string(), email: z.string() })
  * const createUserOutput = z.object({ id: z.number() })
  *
@@ -399,6 +417,12 @@ export type PikkuFunctionConfigWithSchema<
  * })
  * ```
  */
+export function pikkuFunc<
+  InputSchema extends StandardSchemaV1 | undefined = undefined,
+  OutputSchema extends StandardSchemaV1 | undefined = undefined
+>(
+  config: PikkuFunctionConfigWithSchema<InputSchema, OutputSchema, 'session' | 'rpc', WiredSecretBrokerServices> & { secretBroker: true }
+): PikkuFunctionConfig<InputSchema extends StandardSchemaV1 ? InferSchemaOutput<InputSchema> : unknown, OutputSchema extends StandardSchemaV1 ? InferSchemaOutput<OutputSchema> : unknown, 'session' | 'rpc'>
 export function pikkuFunc<
   InputSchema extends StandardSchemaV1 | undefined = undefined,
   OutputSchema extends StandardSchemaV1 | undefined = undefined
@@ -450,17 +474,19 @@ export const pikkuListFunc = <
 export type PikkuFunctionSessionlessConfigWithSchema<
   InputSchema extends StandardSchemaV1 | undefined = undefined,
   OutputSchema extends StandardSchemaV1 | undefined = undefined,
-  RequiredWires extends keyof PikkuWire = never
+  RequiredWires extends keyof PikkuWire = never,
+  RequiredServices extends SecretlessServices<Services> = WiredServices
 > = Omit<
   CorePikkuFunctionConfig<
-    PikkuFunctionSessionless<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires>
+    PikkuFunctionSessionless<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, RequiredWires, RequiredServices>
   >,
   'func' | 'input' | 'output' | 'permissions' | 'approvalDescription'
 > & {
   func: PikkuFunctionSessionless<
     SchemaInferred<InputSchema>,
     SchemaInferred<OutputSchema>,
-    RequiredWires
+    RequiredWires,
+    RequiredServices
   >
   input?: InputSchema
   output?: OutputSchema
@@ -476,25 +502,14 @@ export type PikkuFunctionSessionlessConfigWithSchema<
  * Creates a sessionless Pikku function that doesn't require user authentication.
  * Use this for public endpoints, webhooks, or background tasks.
  *
- * Supports two patterns:
- * 1. Generic types: `pikkuSessionlessFunc<Input, Output>({ func: ... })`
- * 2. Zod schemas: `pikkuSessionlessFunc({ input: z.object(...), func: ... })`
+ * Define the input and output with Zod schemas — the function's types are
+ * inferred from them, and the schemas double as runtime validation.
  *
- * @template In - Input type for the function (inferred from schema if provided)
- * @template Out - Output type for the function (inferred from schema if provided)
- * @param func - Function definition, either direct function or configuration object
+ * @param config - Function definition with `input`/`output` Zod schemas and `func`.
  * @returns The normalized configuration object
  *
  * @example
  * ```typescript
- * // Pattern 1: Using generic types
- * const healthCheck = pikkuSessionlessFunc<void, {status: string}>({
- *   func: async ({logger}) => {
- *     return { status: 'healthy' }
- *   }
- * })
- *
- * // Pattern 2: Using Zod schemas
  * const greetInput = z.object({ name: z.string() })
  * const greetOutput = z.object({ message: z.string() })
  *
@@ -509,14 +524,15 @@ export type PikkuFunctionSessionlessConfigWithSchema<
  */
 export function pikkuSessionlessFunc<
   InputSchema extends StandardSchemaV1 | undefined = undefined,
-  OutputSchema extends StandardSchemaV1 | undefined = undefined
+  OutputSchema extends StandardSchemaV1 | undefined = undefined,
+  RequiredServices extends SecretlessServices<Services> = WiredServices
 >(
-  config: PikkuFunctionSessionlessConfigWithSchema<InputSchema, OutputSchema, 'session' | 'rpc'>
+  config: PikkuFunctionSessionlessConfigWithSchema<InputSchema, OutputSchema, 'session' | 'rpc', RequiredServices>
 ): PikkuFunctionConfig<InputSchema extends StandardSchemaV1 ? InferSchemaOutput<InputSchema> : unknown, OutputSchema extends StandardSchemaV1 ? InferSchemaOutput<OutputSchema> : unknown, 'session' | 'rpc'>
-export function pikkuSessionlessFunc<In, Out = unknown>(
+export function pikkuSessionlessFunc<In, Out = unknown, RequiredServices extends SecretlessServices<Services> = WiredServices>(
   func:
-    | PikkuFunctionSessionless<In, Out, 'session' | 'rpc'>
-    | PikkuFunctionConfig<In, Out, 'session' | 'rpc'>
+    | PikkuFunctionSessionless<In, Out, 'session' | 'rpc', RequiredServices>
+    | PikkuFunctionConfig<In, Out, 'session' | 'rpc', PikkuFunctionSessionless<In, Out, 'session' | 'rpc', RequiredServices>>
 ): PikkuFunctionConfig<In, Out, 'session' | 'rpc'>
 export function pikkuSessionlessFunc(func: any) {
   return typeof func === 'function' ? { func } : func
@@ -581,6 +597,43 @@ export const ref = <Name extends keyof FlattenedRPCMap>(
   >
 }
 
+/**
+ * Declares a capability the connected client answers, reachable from any
+ * `wireChannel` function as `channel.remote(name, input)`.
+ *
+ * There is no `func`: this side owns the contract, the client owns the body.
+ * The `description` is what a person is shown when asked to approve the call,
+ * so write it for them rather than for the caller.
+ *
+ * @example
+ * ```typescript
+ * export const localCheckoutOutput = z.object({ sha: z.string(), branch: z.string() })
+ *
+ * export const localCheckout = pikkuRemoteChannelFunc({
+ *   description: 'Read the current commit and branch of your working tree',
+ *   output: localCheckoutOutput,
+ * })
+ * ```
+ */
+export function pikkuRemoteChannelFunc<
+  InputSchema extends StandardSchemaV1 | undefined = undefined,
+  OutputSchema extends StandardSchemaV1 | undefined = undefined
+>(
+  config: Omit<
+    PikkuFunctionSessionlessConfigWithSchema<InputSchema, OutputSchema, 'session' | 'rpc'>,
+    'func'
+  >
+): PikkuFunctionConfig<SchemaInferred<InputSchema>, SchemaInferred<OutputSchema>, 'session' | 'rpc'> {
+  return {
+    ...config,
+    func: async (_services: any, _data: any, _wire: any) => {
+      throw new Error(
+        `${config.title ?? 'This'} is a remote channel capability and has no local implementation — reach it with channel.remote() on the channel whose client exposes it.`
+      )
+    },
+  } as any
+}
+
 /**
  * Creates a Pikku config factory.
  * Use this to define your application's configuration factory.
@@ -697,16 +750,6 @@ export const addGlobalMiddleware = (middleware: PikkuMiddleware[]) => {
   addGlobalMiddlewareCore(middleware as any, '@pikku/addon-meta-conversions')
 }
 
-/**
- * Tag-scoped permissions. Applies to any wiring that carries the matching tag.
- *
- * @example
- * addTagPermission('admin', [adminPermission])
- */
-export const addTagPermission = <In = unknown>(tag: string, permissions: CorePermissionGroup<PikkuPermission<In>> | PikkuPermission<In>[]) => {
-  addTagPermissionCore(tag, permissions as any, '@pikku/addon-meta-conversions')
-}
-
 /**
  * Wire-agnostic global permissions. Runs at the top of every wiring's
  * permission resolution — before wire-, tag-, and function-level entries.
@@ -720,8 +763,8 @@ export const addGlobalPermission = <In = unknown>(permissions: CorePermissionGro
   addGlobalPermissionCore(permissions as any, '@pikku/addon-meta-conversions')
 }
 
-export { wireAddon } from '@pikku/core/rpc'
-export type { WireAddonConfig } from '@pikku/core/rpc'
+export { wireAddon, wireRemoteAddon } from '@pikku/core/rpc'
+export type { WireAddonConfig, WireRemoteAddonConfig, RemoteAddonAuth } from '@pikku/core/rpc'
 
 
 /**

package/.pikku/function/pikku-functions-meta-verbose.gen.json

@@ -24,6 +24,8 @@
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/addons/addons/packages/analytics/meta-conversions/src/functions/events/send.function.ts",
     "exportedName": "eventSend",
+    "bodyStart": 49,
+    "bodyEnd": 49,
     "contractHash": "5864ea42d4379da5",
     "inputHash": "0030f99c",
     "outputHash": "39d1f240"

package/.pikku/function/pikku-functions-meta.gen.json

@@ -16,6 +16,12 @@
     "implementationHash": "289d4066fc71925f",
     "contractHash": "5864ea42d4379da5",
     "inputHash": "0030f99c",
-    "outputHash": "39d1f240"
+    "outputHash": "39d1f240",
+    "services": {
+      "optimized": true,
+      "services": [
+        "metaConversions"
+      ]
+    }
   }
 }

package/.pikku/function/pikku-functions-meta.gen.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.55
+ * This file was generated by @pikku/cli@0.12.96
  */
 import { pikkuState } from '@pikku/core/internal'
 import type { FunctionsMeta } from '@pikku/core'

package/.pikku/function/pikku-functions.gen.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.55
+ * This file was generated by @pikku/cli@0.12.96
  */
 /* Import and register functions used by RPCs */
 import { addFunction } from '@pikku/core/function'

package/.pikku/http/pikku-http-types.gen.ts

@@ -1,11 +1,11 @@
 /**
- * This file was generated by @pikku/cli@0.12.55
+ * This file was generated by @pikku/cli@0.12.96
  */
 /**
  * HTTP-specific type definitions for tree-shaking optimization
  */
 
-import { AssertHTTPWiringParams, wireHTTP as wireHTTPCore, addHTTPMiddleware as addHTTPMiddlewareCore, addHTTPPermission as addHTTPPermissionCore, wireHTTPRoutes as wireHTTPRoutesCore, defineHTTPRoutes as defineHTTPRoutesCore } from '@pikku/core/http'
+import { AssertHTTPWiringParams, wireHTTP as wireHTTPCore, addHTTPMiddleware as addHTTPMiddlewareCore, wireHTTPRoutes as wireHTTPRoutesCore, defineHTTPRoutes as defineHTTPRoutesCore } from '@pikku/core/http'
 import type { PikkuFunction, PikkuFunctionSessionless, PikkuPermission, PikkuMiddleware, PikkuFunctionConfig } from '../function/pikku-function-types.gen.js'
 import type { CoreHTTPFunctionWiring, HTTPMethod, HTTPRouteBaseConfig } from '@pikku/core/http'
 
@@ -59,32 +59,6 @@ export const addHTTPMiddleware = (
   addHTTPMiddlewareCore(routeOrMiddleware as any, middleware as any)
 }
 
-/**
- * Registers HTTP permissions either globally or for a specific route pattern.
- *
- * When a string route pattern is provided along with permissions, the permissions
- * are applied only to that route. Permissions can be passed as an array or as a
- * permission group object.
- *
- * @param pattern - Route pattern string (e.g., '*' for all routes, '/api/*' for specific routes)
- * @param permissions - The permissions to apply for the specified route pattern
- *
- * @example
- * ```typescript
- * // Add global HTTP permissions
- * addHTTPPermission('*', { global: globalPermission })
- *
- * // Add route-specific permissions
- * addHTTPPermission('/api/admin/*', { admin: adminPermission })
- * ```
- */
-export const addHTTPPermission = <In = unknown>(
-  pattern: string,
-  permissions: Record<string, PikkuPermission<In>> | PikkuPermission<In>[]
-) => {
-  addHTTPPermissionCore(pattern, permissions as any)
-}
-
 /**
  * Route configuration for wireHTTPRoutes with proper typing
  */
@@ -93,7 +67,6 @@ type HTTPRouteConfig = HTTPRouteBaseConfig & {
   route: string
   func: PikkuFunctionConfig<any, any, any, any, any, any>
   auth?: boolean
-  permissions?: Record<string, PikkuPermission | PikkuPermission[]>
   middleware?: PikkuMiddleware[]
   sse?: boolean
 }
@@ -113,14 +86,13 @@ type TypedHTTPRouteContract<T extends TypedHTTPRouteMap = TypedHTTPRouteMap> = T
 }
 
 /**
- * Group config with typed middleware/permissions
+ * Group config with typed middleware
  */
 type TypedHTTPRoutesGroupConfig = {
   basePath?: string
   tags?: string[]
   auth?: boolean
   middleware?: PikkuMiddleware[]
-  permissions?: Record<string, PikkuPermission | PikkuPermission[]>
 }
 
 /**

package/.pikku/mcp/pikku-mcp-types.gen.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.55
+ * This file was generated by @pikku/cli@0.12.96
  */
 /**
  * MCP-specific type definitions for tree-shaking optimization

package/.pikku/pikku-bootstrap-scenarios.gen.ts

@@ -0,0 +1,9 @@
+/**
+ * This file was generated by @pikku/cli@0.12.96
+ */
+import './pikku-bootstrap.gen.js'
+import './scenarios/schemas/register.gen.js'
+import './scenarios/pikku-scenario-functions-meta.gen.js'
+import './scenarios/pikku-scenario-functions.gen.js'
+import './scenarios/pikku-scenario-wirings-meta.gen.js'
+import './scenarios/pikku-scenario-wirings.gen.js'

package/.pikku/pikku-bootstrap.gen.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.55
+ * This file was generated by @pikku/cli@0.12.96
  */
 import './rpc/pikku-rpc-wirings-meta.internal.gen.js'
 import './function/pikku-functions-meta.gen.js'

package/.pikku/pikku-meta-service.gen.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.55
+ * This file was generated by @pikku/cli@0.12.96
  */
 import { LocalMetaService } from '@pikku/core/services/local-meta'