@pikku/core 0.11.2 → 0.12.0

package/CHANGELOG.md

@@ -1,3 +1,36 @@
+## 0.12.0
+
+### New Features
+
+- AI agents with `pikkuAIAgent()` — define agents with tools, sub-agents, memory, structured output, and streaming via SSE
+- AI middleware hooks (`pikkuAIMiddleware`) for input, stream, and output transformation
+- Tool approval flow — suspend agent execution pending human approval
+- Channel middleware (`pikkuChannelMiddleware`) for intercepting and transforming channel events
+- Remote RPC — call functions across servers with `rpc.remote()` and `DeploymentService`
+- HTTP route groups with `wireHTTPRoutes` for shared basePath, tags, and auth
+- Workflow graph engine with `createGraph()` type-safe builder
+- Workflow HTTP helpers: `workflow()`, `workflowStart()`, `workflowStatus()`, `graphStart()`
+- Workflow DSL with rich step types (branch, parallel, fanout, switch, filter)
+- Trigger system with `wireTrigger()` and `wireTriggerSource()`
+- OAuth2 support with `wireOAuth2Credential` and `OAuth2Client`
+- Secret and variable declarations with `wireSecret()` and `wireVariable()`
+- `TypedSecretService` and `TypedVariablesService` for compile-time validated access
+- `defineCLICommands` and `defineChannelRoutes` for external composition
+- Built-in CORS middleware
+- `disabled: true` support on all wirings and functions
+- `createWireServices` and `createConfig` are now optional
+- `InMemoryWorkflowService` and `InMemoryTriggerService` for testing
+
+### Breaking Changes
+
+- `PikkuInteraction` → `PikkuWire`, `CreateSessionServices` → `CreateWireServices`
+- `wireForgeCredential` → `wireCredential`
+- `startWorkflowByWire` → `startWorkflowByHTTPWire`
+- Renamed all `forge` → `node` naming
+- Renamed `credential` → `secret` across core types
+- `WorkflowService.createRun` signature changed (new `inline`, `graphHash` params)
+- Auth enforced by default for `pikkuFunc`
+
 ## 0.11.0
 
 ## 0.11.2
@@ -6,8 +39,6 @@
 
 - db9c7bf: Add workflow graph system with type-safe builder
 
-## 0.11.2
-
 ### Features
 
 - f35e89da: Add workflow graph system with type-safe builder

package/dist/crypto-utils.d.ts

@@ -0,0 +1,2 @@
+export declare const encryptJSON: (secret: string, value: unknown) => Promise<string>;
+export declare const decryptJSON: <T>(secret: string, token: string) => Promise<T>;

package/dist/crypto-utils.js

@@ -0,0 +1,78 @@
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+const getSubtle = () => {
+    const crypto = globalThis.crypto;
+    if (!crypto?.subtle) {
+        throw new Error('WebCrypto not available');
+    }
+    return crypto.subtle;
+};
+const base64Encode = (bytes) => {
+    if (typeof Buffer !== 'undefined') {
+        return Buffer.from(bytes).toString('base64');
+    }
+    let binary = '';
+    for (let i = 0; i < bytes.length; i++) {
+        binary += String.fromCharCode(bytes[i]);
+    }
+    return btoa(binary);
+};
+const base64Decode = (input) => {
+    if (typeof Buffer !== 'undefined') {
+        return new Uint8Array(Buffer.from(input, 'base64'));
+    }
+    const binary = atob(input);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+};
+const toBase64Url = (bytes) => {
+    return base64Encode(bytes)
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=+$/g, '');
+};
+const fromBase64Url = (input) => {
+    let base64 = input.replace(/-/g, '+').replace(/_/g, '/');
+    while (base64.length % 4 !== 0)
+        base64 += '=';
+    return base64Decode(base64);
+};
+const deriveKey = async (secret) => {
+    const subtle = getSubtle();
+    const hash = await subtle.digest('SHA-256', encoder.encode(secret));
+    return subtle.importKey('raw', hash, { name: 'AES-GCM' }, false, [
+        'encrypt',
+        'decrypt',
+    ]);
+};
+export const encryptJSON = async (secret, value) => {
+    const crypto = globalThis.crypto;
+    if (!crypto?.getRandomValues) {
+        throw new Error('WebCrypto not available');
+    }
+    const subtle = getSubtle();
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const key = await deriveKey(secret);
+    const plaintext = encoder.encode(JSON.stringify(value));
+    const encrypted = await subtle.encrypt({ name: 'AES-GCM', iv }, key, plaintext);
+    const cipherBytes = new Uint8Array(encrypted);
+    const out = new Uint8Array(iv.length + cipherBytes.length);
+    out.set(iv, 0);
+    out.set(cipherBytes, iv.length);
+    return toBase64Url(out);
+};
+export const decryptJSON = async (secret, token) => {
+    const subtle = getSubtle();
+    const data = fromBase64Url(token);
+    if (data.length < 13) {
+        throw new Error('Invalid encrypted payload');
+    }
+    const iv = data.slice(0, 12);
+    const ciphertext = data.slice(12);
+    const key = await deriveKey(secret);
+    const decrypted = await subtle.decrypt({ name: 'AES-GCM', iv }, key, ciphertext);
+    return JSON.parse(decoder.decode(new Uint8Array(decrypted)));
+};

package/dist/errors/errors.d.ts

@@ -4,6 +4,8 @@
 import { PikkuError } from './error-handler.js';
 export declare class InvalidMiddlewareWireError extends PikkuError {
 }
+export declare class PikkuMissingMetaError extends PikkuError {
+}
 /**
  * The server cannot or will not process the request due to client error (e.g., malformed request syntax).
  * @group Error
@@ -190,3 +192,9 @@ export declare class HTTPVersionNotSupportedError extends PikkuError {
  */
 export declare class MaxComputeTimeReachedError extends PikkuError {
 }
+/**
+ * A required schema was not found during validation.
+ * @group Error
+ */
+export declare class MissingSchemaError extends PikkuError {
+}

package/dist/errors/errors.js

@@ -8,6 +8,12 @@ addError(InvalidMiddlewareWireError, {
     status: 500,
     message: 'The middleware wire is invalid for the current wiring type.',
 });
+export class PikkuMissingMetaError extends PikkuError {
+}
+addError(PikkuMissingMetaError, {
+    status: 500,
+    message: 'Required metadata is missing',
+});
 /**
  * The server cannot or will not process the request due to client error (e.g., malformed request syntax).
  * @group Error
@@ -321,3 +327,13 @@ addError(MaxComputeTimeReachedError, {
     status: 524,
     message: 'The server took too long to complete the request, reaching the maximum compute time allowed.',
 });
+/**
+ * A required schema was not found during validation.
+ * @group Error
+ */
+export class MissingSchemaError extends PikkuError {
+}
+addError(MissingSchemaError, {
+    status: 500,
+    message: 'A required schema was not found. Ensure schema generation has been run.',
+});

package/dist/errors/index.d.ts

@@ -1,2 +1 @@
-export * from './error-handler.js';
 export * from './errors.js';

package/dist/errors/index.js

@@ -1,2 +1 @@
-export * from './error-handler.js';
 export * from './errors.js';

package/dist/function/function-runner.d.ts

@@ -1,19 +1,25 @@
 import { CoreServices, CoreUserSession, CorePikkuMiddleware, PikkuWiringTypes, PikkuWire, MiddlewareMetadata, PermissionMetadata, CoreSingletonServices, CreateWireServices } from '../types/core.types.js';
+import type { CorePikkuChannelMiddleware } from '../wirings/channel/channel.types.js';
 import { CorePermissionGroup, CorePikkuFunctionConfig, CorePikkuPermission } from './functions.types.js';
 import { SessionService } from '../services/user-session-service.js';
 export declare const addFunction: (funcName: string, funcConfig: CorePikkuFunctionConfig<any, any>, packageName?: string | null) => void;
+export declare const getFunctionNames: (packageName?: string | null) => string[];
+export declare const getAllFunctionNames: () => string[];
 export declare const runPikkuFuncDirectly: <In, Out>(funcName: string, allServices: CoreServices, wire: PikkuWire, data: In, userSession?: SessionService<CoreUserSession>, packageName?: string | null) => Promise<Out>;
-export declare const runPikkuFunc: <In = any, Out = any>(wireType: PikkuWiringTypes, wireId: string, funcName: string, { singletonServices, createWireServices, data, auth: wiringAuth, inheritedMiddleware, wireMiddleware, inheritedPermissions, wirePermissions, coerceDataFromSchema, tags, wire, packageName, }: {
+export declare const runPikkuFunc: <In = any, Out = any>(wireType: PikkuWiringTypes, wireId: string, funcName: string, { singletonServices, createWireServices, data, auth: wiringAuth, inheritedMiddleware, wireMiddleware, inheritedChannelMiddleware, wireChannelMiddleware, inheritedPermissions, wirePermissions, coerceDataFromSchema, tags, wire, sessionService, packageName, }: {
     singletonServices: CoreSingletonServices;
     createWireServices?: CreateWireServices;
     data: () => Promise<In> | In;
     auth?: boolean;
     inheritedMiddleware?: MiddlewareMetadata[];
     wireMiddleware?: CorePikkuMiddleware[];
+    inheritedChannelMiddleware?: MiddlewareMetadata[];
+    wireChannelMiddleware?: CorePikkuChannelMiddleware[];
     inheritedPermissions?: PermissionMetadata[];
     wirePermissions?: CorePermissionGroup | CorePikkuPermission[];
     coerceDataFromSchema?: boolean;
     tags?: string[];
     wire: PikkuWire;
+    sessionService?: SessionService<CoreUserSession>;
     packageName?: string | null;
 }) => Promise<Out>;

package/dist/function/function-runner.js

@@ -1,7 +1,10 @@
 import { runMiddleware, combineMiddleware } from '../middleware-runner.js';
+import { combineChannelMiddleware, wrapChannelWithMiddleware, } from '../wirings/channel/channel-middleware-runner.js';
 import { runPermissions } from '../permissions.js';
 import { pikkuState } from '../pikku-state.js';
 import { coerceTopLevelDataFromSchema, validateSchema } from '../schema.js';
+import { parseVersionedId } from '../version.js';
+import { createFunctionSessionWireProps, } from '../services/user-session-service.js';
 import { ForbiddenError } from '../errors/errors.js';
 import { rpcService } from '../wirings/rpc/rpc-runner.js';
 import { closeWireServices } from '../utils.js';
@@ -39,25 +42,57 @@ const getOrCreatePackageSingletonServices = async (packageName, parentServices)
 export const addFunction = (funcName, funcConfig, packageName = null) => {
     pikkuState(packageName, 'function', 'functions').set(funcName, funcConfig);
 };
+export const getFunctionNames = (packageName = null) => {
+    const functionsMeta = pikkuState(packageName, 'function', 'meta');
+    return Object.keys(functionsMeta);
+};
+export const getAllFunctionNames = () => {
+    const functions = [];
+    const mainFunctionsMeta = pikkuState(null, 'function', 'meta');
+    functions.push(...Object.keys(mainFunctionsMeta));
+    const externalPackages = pikkuState(null, 'rpc', 'externalPackages');
+    for (const [namespace, config] of externalPackages) {
+        const packageFunctionsMeta = pikkuState(config.package, 'function', 'meta');
+        for (const funcName of Object.keys(packageFunctionsMeta)) {
+            functions.push(`${namespace}:${funcName}`);
+        }
+    }
+    return functions;
+};
 export const runPikkuFuncDirectly = async (funcName, allServices, wire, data, userSession, packageName = null) => {
     const funcConfig = pikkuState(packageName, 'function', 'functions').get(funcName);
     if (!funcConfig) {
         throw new Error(`Function not found: ${funcName}`);
     }
-    // Inject session into wire
     const wireWithSession = {
         ...wire,
-        session: userSession,
+        ...(userSession && createFunctionSessionWireProps(userSession)),
     };
     return (await funcConfig.func(allServices, data, wireWithSession));
 };
-export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServices, createWireServices, data, auth: wiringAuth, inheritedMiddleware, wireMiddleware, inheritedPermissions, wirePermissions, coerceDataFromSchema, tags = [], wire, packageName = null, }) => {
-    const funcConfig = pikkuState(packageName, 'function', 'functions').get(funcName);
+export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServices, createWireServices, data, auth: wiringAuth, inheritedMiddleware, wireMiddleware, inheritedChannelMiddleware, wireChannelMiddleware, inheritedPermissions, wirePermissions, coerceDataFromSchema, tags = [], wire, sessionService, packageName = null, }) => {
+    wire = {
+        ...wire,
+        wireType: wire.wireType ?? wireType,
+        wireId: wire.wireId ?? wireId,
+    };
+    const funcMap = pikkuState(packageName, 'function', 'functions');
+    let funcConfig = funcMap.get(funcName);
+    const allMeta = pikkuState(packageName, 'function', 'meta');
+    let funcMeta = allMeta[funcName];
+    if (!funcConfig || !funcMeta) {
+        const { baseName, version } = parseVersionedId(funcName);
+        if (version !== null) {
+            funcConfig = funcConfig || funcMap.get(baseName);
+            funcMeta = funcMeta || allMeta[baseName];
+            if (funcConfig && funcMeta) {
+                singletonServices.logger.warn(`Version '${funcName}' not registered, resolved to '${baseName}'`);
+            }
+        }
+    }
     if (!funcConfig) {
         throw new Error(`Function not found: ${funcName}`);
     }
-    const allMeta = pikkuState(packageName, 'function', 'meta');
-    const funcMeta = allMeta[funcName];
     if (!funcMeta) {
         throw new Error(`Function meta not found: ${funcName}`);
     }
@@ -73,6 +108,14 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
             resolvedCreateWireServices = factories.createWireServices;
         }
     }
+    const allChannelMiddleware = combineChannelMiddleware(wireType, wireId, {
+        wireInheritedChannelMiddleware: inheritedChannelMiddleware,
+        wireChannelMiddleware,
+        packageName,
+    });
+    const resolvedWire = allChannelMiddleware.length > 0 && wire.channel
+        ? wrapChannelWithMiddleware(wire, resolvedSingletonServices, allChannelMiddleware)
+        : wire;
     // Convert tags to PermissionMetadata and merge with inheritedPermissions
     const mergedInheritedPermissions = [
         ...(inheritedPermissions || []),
@@ -80,22 +123,36 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
     ];
     // Helper function to run permissions and execute the function
     const executeFunction = async () => {
-        const initialSession = wire.session?.freezeInitial();
-        const wireWithInitialSession = {
-            ...wire,
-            initialSession,
+        const functionWireProps = sessionService
+            ? createFunctionSessionWireProps(sessionService)
+            : undefined;
+        const wireWithSession = {
+            ...resolvedWire,
+            ...functionWireProps,
         };
-        if (wiringAuth === true || funcConfig.auth === true) {
-            // This means it was explicitly enabled in either wiring or function and has to be respected
-            if (!initialSession) {
+        const session = wireWithSession.session;
+        if (funcMeta.sessionless) {
+            if (wiringAuth === true || funcConfig.auth === true) {
+                if (!session) {
+                    throw new ForbiddenError('Authentication required');
+                }
+            }
+        }
+        else if (funcMeta.sessionless === false) {
+            if (wiringAuth === false || funcConfig.auth === false) {
+                resolvedSingletonServices.logger.warn(`Function '${funcName}' requires a session but auth was explicitly disabled — use pikkuSessionlessFunc instead.`);
+            }
+            else if (!session) {
                 throw new ForbiddenError('Authentication required');
             }
         }
-        if (wiringAuth === undefined && funcConfig.auth === undefined) {
-            // We always default to requiring auth unless explicitly disabled
-            if (!initialSession) {
-                // TODO: Critical, we need to figure out how to make this work with different wirings
-                // throw new ForbiddenError('Authentication required')
+        else {
+            // TODO: Remove after a couple of releases — backward compat for
+            // generated metadata that doesn't include the `sessionless` field yet.
+            if (wiringAuth === true || funcConfig.auth === true) {
+                if (!session) {
+                    throw new ForbiddenError('Authentication required');
+                }
             }
         }
         // Evaluate the data from the lazy function
@@ -116,16 +173,18 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
             funcInheritedPermissions: funcMeta.permissions,
             funcPermissions: funcConfig.permissions,
             services: resolvedSingletonServices,
-            wire: { ...wireWithInitialSession, rpc: undefined },
+            wire: { ...wireWithSession, rpc: undefined },
             data: actualData,
             packageName,
         });
-        const wireServices = await resolvedCreateWireServices?.(resolvedSingletonServices, wireWithInitialSession);
+        const wireServices = await resolvedCreateWireServices?.(resolvedSingletonServices, wireWithSession);
         try {
             const services = { ...resolvedSingletonServices, ...wireServices };
-            const rpc = rpcService.getContextRPCService(services, wireWithInitialSession);
+            const rpc = rpcService.getContextRPCService(services, wireWithSession, {
+                sessionService,
+            });
             return await funcConfig.func(services, actualData, {
-                ...wireWithInitialSession,
+                ...wireWithSession,
                 rpc,
             });
         }
@@ -143,7 +202,7 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
         packageName,
     });
     if (allMiddleware.length > 0) {
-        return (await runMiddleware(resolvedSingletonServices, wire, allMiddleware, executeFunction));
+        return (await runMiddleware(resolvedSingletonServices, resolvedWire, allMiddleware, executeFunction));
     }
     return (await executeFunction());
 };

package/dist/function/functions.types.d.ts

@@ -1,5 +1,11 @@
 import type { CoreServices, CoreSingletonServices, CoreUserSession, CorePikkuMiddleware, PikkuWire, PickRequired } from '../types/core.types.js';
-import { Session } from 'inspector';
+import type { StandardSchemaV1 } from '@standard-schema/spec';
+import type { CoreNodeConfig } from '../wirings/node/node.types.js';
+/**
+ * @deprecated Use StandardSchemaV1 from @standard-schema/spec instead.
+ * This alias exists only for backward compatibility with generated code.
+ */
+export type ZodLike<T = any> = StandardSchemaV1<T, T>;
 /**
  * Represents a core API function that performs an operation using core services and a user session.
  *
@@ -8,7 +14,7 @@ import { Session } from 'inspector';
  * @template Services - The services type, defaults to `CoreServices`.
  * @template Wire - The wire type, defaults to `PikkuWire<In, Out>`.
  */
-export type CorePikkuFunction<In, Out, Services extends CoreSingletonServices = CoreServices, Wire extends PikkuWire<In, Out> = PikkuWire<In, Out, true, Session>> = (services: Services, data: In, wire: Wire) => Wire['channel'] extends null ? Promise<Out> : Promise<Out> | Promise<void>;
+export type CorePikkuFunction<In, Out, Services extends CoreSingletonServices = CoreServices, Session extends CoreUserSession = CoreUserSession, Wire extends PikkuWire<In, Out> = PikkuWire<In, Out, true, Session>> = (services: Services, data: In, wire: Wire) => Wire['channel'] extends null ? Promise<Out> : Promise<Out> | Promise<void>;
 /**
  * Represents a core API function that can be used without a session.
  *
@@ -17,7 +23,7 @@ export type CorePikkuFunction<In, Out, Services extends CoreSingletonServices =
  * @template Services - The services type, defaults to `CoreServices`.
  * @template Wire - The wire type, defaults to `PikkuWire<In, Out>`.
  */
-export type CorePikkuFunctionSessionless<In, Out, Services extends CoreSingletonServices = CoreServices, Wire extends PikkuWire<In, Out, false, CoreUserSession, any, any, any> = PikkuWire<In, Out, false, CoreUserSession, any, any, any>> = (services: Services, data: In, wire: Wire) => Wire['channel'] extends null ? Promise<Out> : Promise<Out> | Promise<void>;
+export type CorePikkuFunctionSessionless<In, Out, Services extends CoreSingletonServices = CoreServices, Session extends CoreUserSession = CoreUserSession, Wire extends PikkuWire<In, Out, false, Session, any, any, any> = PikkuWire<In, Out, false, Session, any, any, any>> = (services: Services, data: In, wire: Wire) => Wire['channel'] extends null ? Promise<Out> : Promise<Out> | Promise<void>;
 /**
  * Represents a function that checks permissions for a given operation.
  *
@@ -36,8 +42,8 @@ export type CorePikkuPermission<In = any, Services extends CoreSingletonServices
 export type CorePikkuPermissionConfig<In = any, Services extends CoreSingletonServices = CoreServices, Wire extends PikkuWire<In, never, false, CoreUserSession> = PikkuWire<In, never, false, CoreUserSession>> = {
     /** The permission function */
     func: CorePikkuPermission<In, Services, Wire>;
-    /** Optional human-readable title for the permission */
-    title?: string;
+    /** Optional human-readable name for the permission */
+    name?: string;
     /** Optional description of what the permission checks */
     description?: string;
 };
@@ -49,18 +55,18 @@ export type CorePikkuPermissionConfig<In = any, Services extends CoreSingletonSe
  * ```typescript
  * // Direct function syntax
  * export const adminPermission = pikkuPermission(
- *   async ({ logger }, _data, { session }) => {
- *     const currentSession = await session.get()
+ *   async ({ logger }, _data, { getSession }) => {
+ *     const currentSession = await getSession()
  *     return currentSession?.role === 'admin'
  *   }
  * )
  *
  * // Configuration object syntax with metadata
  * export const adminPermission = pikkuPermission({
- *   title: 'Admin Permission',
+ *   name: 'Admin Permission',
  *   description: 'Checks if user has admin role',
- *   func: async ({ logger }, _data, { session }) => {
- *     const currentSession = await session.get()
+ *   func: async ({ logger }, _data, { getSession }) => {
+ *     const currentSession = await getSession()
  *     return currentSession?.role === 'admin'
  *   }
  * })
@@ -85,8 +91,8 @@ export type CorePikkuPermissionFactory<In = any, Services extends CoreSingletonS
  * export const requireRole = pikkuPermissionFactory<{ role: string }>(({
  *   role
  * }) => {
- *   return pikkuPermission(async ({ logger }, data, { session }) => {
- *      const currentSession = await session.get()
+ *   return pikkuPermission(async ({ logger }, data, { getSession }) => {
+ *      const currentSession = await getSession()
  *     if (!currentSession || currentSession.role !== role) {
  *       logger.warn(`Permission denied: required role '${role}'`)
  *       return false
@@ -97,93 +103,31 @@ export type CorePikkuPermissionFactory<In = any, Services extends CoreSingletonS
  * ```
  */
 export declare const pikkuPermissionFactory: <In = any>(factory: CorePikkuPermissionFactory<In>) => CorePikkuPermissionFactory<In>;
-export type CorePermissionGroup<PikkuPermission = CorePikkuPermission<any>> = Record<string, PikkuPermission | PikkuPermission[]> | undefined;
-/**
- * Zod schema type - matches z.ZodType shape for type inference
- * This avoids requiring zod as a dependency while allowing schema inference
- */
-export type ZodLike<T = any> = {
-    _input: T;
-    _output: T;
+export type CorePikkuAuth<Services extends CoreSingletonServices = CoreServices, Session extends CoreUserSession = CoreUserSession> = (services: Services, session: Session) => Promise<boolean> | boolean;
+export type CorePikkuAuthConfig<Services extends CoreSingletonServices = CoreServices, Session extends CoreUserSession = CoreUserSession> = {
+    func: CorePikkuAuth<Services, Session>;
+    name?: string;
+    description?: string;
 };
-export type CorePikkuFunctionConfig<PikkuFunction extends CorePikkuFunction<any, any, any, any> | CorePikkuFunctionSessionless<any, any, any, any>, PikkuPermission extends CorePikkuPermission<any, any, any> = CorePikkuPermission<any>, PikkuMiddleware extends CorePikkuMiddleware<any, any> = CorePikkuMiddleware<any, any>, InputSchema extends ZodLike | undefined = undefined, OutputSchema extends ZodLike | undefined = undefined> = {
+export declare const pikkuAuth: <Services extends CoreSingletonServices = CoreServices, Session extends CoreUserSession = CoreUserSession>(auth: CorePikkuAuth<Services, Session> | CorePikkuAuthConfig<Services, Session>) => CorePikkuPermission<any, Services, any>;
+export type CorePermissionGroup<PikkuPermission = CorePikkuPermission<any>> = Record<string, PikkuPermission | PikkuPermission[]> | undefined;
+export type CorePikkuFunctionConfig<PikkuFunction extends CorePikkuFunction<any, any, any, any, any> | CorePikkuFunctionSessionless<any, any, any, any, any>, PikkuPermission extends CorePikkuPermission<any, any, any> = CorePikkuPermission<any>, PikkuMiddleware extends CorePikkuMiddleware<any, any> = CorePikkuMiddleware<any, any>, InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined> = {
     /** Optional human-readable title for the function */
     title?: string;
     /** Optional description of what the function does */
     description?: string;
     override?: string;
+    version?: number;
     tags?: string[];
     expose?: boolean;
-    internal?: boolean;
+    remote?: boolean;
+    mcp?: boolean;
+    requiresApproval?: boolean;
     func: PikkuFunction;
     auth?: boolean;
     permissions?: CorePermissionGroup<PikkuPermission>;
     middleware?: PikkuMiddleware[];
     input?: InputSchema;
     output?: OutputSchema;
+    node?: CoreNodeConfig;
 };
-/**
- * A trigger function that sets up a subscription and returns a teardown function.
- * The trigger is fired via wire.trigger.trigger(data).
- *
- * @template TConfig - Configuration type (hardcoded when wired)
- * @template TOutput - Output type produced when trigger fires
- * @template Services - Services available to the trigger
- */
-export type CorePikkuTriggerFunction<TConfig = unknown, TOutput = unknown, Services extends CoreSingletonServices = CoreSingletonServices> = (services: Services, config: TConfig, wire: {
-    trigger: {
-        trigger: (data: TOutput) => void;
-    };
-}) => Promise<() => void | Promise<void>>;
-/**
- * Configuration object for creating a trigger function with metadata
- */
-export type CorePikkuTriggerFunctionConfig<TConfig = unknown, TOutput = unknown, Services extends CoreSingletonServices = CoreSingletonServices, ConfigSchema extends ZodLike | undefined = undefined, OutputSchema extends ZodLike | undefined = undefined> = {
-    /** Optional human-readable title for the trigger */
-    title?: string;
-    /** Optional description of what the trigger does */
-    description?: string;
-    /** Optional tags for categorization */
-    tags?: string[];
-    /** The trigger function */
-    func: CorePikkuTriggerFunction<TConfig, TOutput, Services>;
-    /** Optional Zod schema for config validation */
-    config?: ConfigSchema;
-    /** Optional Zod schema for output validation */
-    output?: OutputSchema;
-};
-/**
- * Factory function for creating trigger functions
- * Supports both direct function and configuration object syntax
- *
- * @example
- * ```typescript
- * // Direct function syntax
- * export const redisSubscribeTrigger = pikkuTriggerFunc<
- *   { channel: string },
- *   { message: string }
- * >(async ({ redis }, { channel }, { trigger }) => {
- *   const subscriber = redis.duplicate()
- *   await subscriber.subscribe(channel, (msg) => {
- *     trigger.trigger({ message: msg })
- *   })
- *   return () => subscriber.unsubscribe()
- * })
- *
- * // Configuration object syntax with metadata
- * export const redisSubscribeTrigger = pikkuTriggerFunc({
- *   title: 'Redis Subscribe Trigger',
- *   description: 'Listens to Redis pub/sub channel',
- *   config: z.object({ channel: z.string() }),
- *   output: z.object({ message: z.string() }),
- *   func: async ({ redis }, { channel }, { trigger }) => {
- *     const subscriber = redis.duplicate()
- *     await subscriber.subscribe(channel, (msg) => {
- *       trigger.trigger({ message: msg })
- *     })
- *     return () => subscriber.unsubscribe()
- *   }
- * })
- * ```
- */
-export declare const pikkuTriggerFunc: <TConfig = unknown, TOutput = unknown, Services extends CoreSingletonServices = CoreSingletonServices, ConfigSchema extends ZodLike | undefined = undefined, OutputSchema extends ZodLike | undefined = undefined>(triggerOrConfig: CorePikkuTriggerFunction<TConfig, TOutput, Services> | CorePikkuTriggerFunctionConfig<TConfig, TOutput, Services, ConfigSchema, OutputSchema>) => CorePikkuTriggerFunctionConfig<TConfig, TOutput, Services, ConfigSchema, OutputSchema>;

package/dist/function/functions.types.js

@@ -6,18 +6,18 @@
  * ```typescript
  * // Direct function syntax
  * export const adminPermission = pikkuPermission(
- *   async ({ logger }, _data, { session }) => {
- *     const currentSession = await session.get()
+ *   async ({ logger }, _data, { getSession }) => {
+ *     const currentSession = await getSession()
  *     return currentSession?.role === 'admin'
  *   }
  * )
  *
  * // Configuration object syntax with metadata
  * export const adminPermission = pikkuPermission({
- *   title: 'Admin Permission',
+ *   name: 'Admin Permission',
  *   description: 'Checks if user has admin role',
- *   func: async ({ logger }, _data, { session }) => {
- *     const currentSession = await session.get()
+ *   func: async ({ logger }, _data, { getSession }) => {
+ *     const currentSession = await getSession()
  *     return currentSession?.role === 'admin'
  *   }
  * })
@@ -35,8 +35,8 @@ export const pikkuPermission = (permission) => {
  * export const requireRole = pikkuPermissionFactory<{ role: string }>(({
  *   role
  * }) => {
- *   return pikkuPermission(async ({ logger }, data, { session }) => {
- *      const currentSession = await session.get()
+ *   return pikkuPermission(async ({ logger }, data, { getSession }) => {
+ *      const currentSession = await getSession()
  *     if (!currentSession || currentSession.role !== role) {
  *       logger.warn(`Permission denied: required role '${role}'`)
  *       return false
@@ -49,43 +49,13 @@ export const pikkuPermission = (permission) => {
 export const pikkuPermissionFactory = (factory) => {
     return factory;
 };
-/**
- * Factory function for creating trigger functions
- * Supports both direct function and configuration object syntax
- *
- * @example
- * ```typescript
- * // Direct function syntax
- * export const redisSubscribeTrigger = pikkuTriggerFunc<
- *   { channel: string },
- *   { message: string }
- * >(async ({ redis }, { channel }, { trigger }) => {
- *   const subscriber = redis.duplicate()
- *   await subscriber.subscribe(channel, (msg) => {
- *     trigger.trigger({ message: msg })
- *   })
- *   return () => subscriber.unsubscribe()
- * })
- *
- * // Configuration object syntax with metadata
- * export const redisSubscribeTrigger = pikkuTriggerFunc({
- *   title: 'Redis Subscribe Trigger',
- *   description: 'Listens to Redis pub/sub channel',
- *   config: z.object({ channel: z.string() }),
- *   output: z.object({ message: z.string() }),
- *   func: async ({ redis }, { channel }, { trigger }) => {
- *     const subscriber = redis.duplicate()
- *     await subscriber.subscribe(channel, (msg) => {
- *       trigger.trigger({ message: msg })
- *     })
- *     return () => subscriber.unsubscribe()
- *   }
- * })
- * ```
- */
-export const pikkuTriggerFunc = (triggerOrConfig) => {
-    if (typeof triggerOrConfig === 'function') {
-        return { func: triggerOrConfig };
-    }
-    return triggerOrConfig;
+export const pikkuAuth = (auth) => {
+    const fn = typeof auth === 'function' ? auth : auth.func;
+    const wrapper = async (services, _data, wire) => {
+        const session = wire.session;
+        if (!session)
+            return false;
+        return fn(services, session);
+    };
+    return wrapper;
 };