@pikku/core 0.11.2 → 0.12.1

package/CHANGELOG.md

@@ -1,3 +1,60 @@
+## 0.12.0
+
+## 0.12.1
+
+### Patch Changes
+
+- 62a8725: Rename 'external' to 'addon' throughout the codebase. All types, functions, config keys, and CLI options previously named `external` or `External` are now named `addon` or `Addon` (e.g. `ExternalPackageConfig` → `AddonConfig`, `externalPackages` → `addons`, `function-external` → `function-addon`).
+- a3bdb0d: Add AI middleware hooks for per-tool-call lifecycle and post-step observability:
+
+  - `beforeToolCall` / `afterToolCall`: per-tool-call hooks for logging, caching, input sanitization, and result transformation
+  - `afterStep`: post-step observation hook with full step context (text, toolCalls, toolResults, usage, finishReason)
+  - `onError`: error-specific hook for alerting and diagnostics (non-throwing, won't affect error flow)
+
+- e0349ff: Fix critical security vulnerability in channel message handler: `validateAuth` was being called with `channelHandler` (always truthy) instead of the actual user session, meaning auth checks always passed and unauthenticated clients could send messages to protected channels. Also fix an information disclosure issue where the full channel config object was being logged on unhandled messages.
+- 62a8725: Internalize singleton services management in the serverless channel runner, consistent with how other runners handle it. `createWireServices` and `singletonServices` no longer need to be passed explicitly to serverless channel runner calls.
+- e04531f: Security hardening: improve CORS handling, redirect validation, and error logging in the HTTP runner. Export additional internal utilities needed by native runtime adapters.
+- 62a8725: Fix security issue in `function-runner`: functions declared with `pikkuFunc` (which always require a session) now always throw `ForbiddenError` when called without a session, even if the wiring has `auth: false`. Previously a misconfigured wiring could bypass authentication entirely — the runner only logged a warning instead of blocking the call.
+- a83efb8: Handle OPTIONS preflight requests automatically in fetchData when no explicit OPTIONS route is matched. Runs global HTTP middleware (e.g. CORS) and returns 204. Remove redundant startWorkflowRun and streamAgentRun pass-through functions from addon-console.
+- 8eed717: Add `readonly` flag to function config and runtime enforcement. Functions can be marked `readonly: true` in their config. At runtime, if a session has `readonly: true`, only functions marked as readonly can be called — otherwise a `ReadonlySessionError` (403) is thrown.
+- 62a8725: `pikku versions check` now prints rich, human-readable output for all contract version errors instead of raw error codes. Each error type (PKU861–PKU865) shows the function name, separate input/output schema hashes with a `prev → current` arrow, and clear next-step instructions.
+
+  The version manifest now stores separate `inputHash` and `outputHash` per version entry (backward-compatible — old string-hash manifests still load and validate correctly). `VersionValidateError` gains optional detail fields (`functionKey`, `version`, `previousInputHash`, `currentInputHash`, `previousOutputHash`, `currentOutputHash`, `nextVersion`, `latestVersion`, `expectedNextVersion`) for use by tooling.
+
+- 62a8725: Replace config-based addon declarations with the new `wireAddon()` code-based API. Addons are now declared directly in wiring files using `wireAddon({ name, package, rpcEndpoint?, auth?, tags? })` instead of the `addons` field in `pikku.config.json`. The inspector reads these declarations from the TypeScript AST at build time.
+- 62a8725: Add `secretOverrides` and `variableOverrides` support to `wireAddon()`. These optional maps allow an app to remap an addon's secret/variable keys to its own names (e.g. `secretOverrides: { SENDGRID_API_KEY: 'MY_EMAIL_API_KEY' }`). The inspector validates that all override keys exist in the app's own secrets/variables definitions.
+
+### New Features
+
+- AI agents with `pikkuAIAgent()` — define agents with tools, sub-agents, memory, structured output, and streaming via SSE
+- AI middleware hooks (`pikkuAIMiddleware`) for input, stream, and output transformation
+- Tool approval flow — suspend agent execution pending human approval
+- Channel middleware (`pikkuChannelMiddleware`) for intercepting and transforming channel events
+- Remote RPC — call functions across servers with `rpc.remote()` and `DeploymentService`
+- HTTP route groups with `wireHTTPRoutes` for shared basePath, tags, and auth
+- Workflow graph engine with `createGraph()` type-safe builder
+- Workflow HTTP helpers: `workflow()`, `workflowStart()`, `workflowStatus()`, `graphStart()`
+- Workflow DSL with rich step types (branch, parallel, fanout, switch, filter)
+- Trigger system with `wireTrigger()` and `wireTriggerSource()`
+- OAuth2 support with `wireOAuth2Credential` and `OAuth2Client`
+- Secret and variable declarations with `wireSecret()` and `wireVariable()`
+- `TypedSecretService` and `TypedVariablesService` for compile-time validated access
+- `defineCLICommands` and `defineChannelRoutes` for external composition
+- Built-in CORS middleware
+- `disabled: true` support on all wirings and functions
+- `createWireServices` and `createConfig` are now optional
+- `InMemoryWorkflowService` and `InMemoryTriggerService` for testing
+
+### Breaking Changes
+
+- `PikkuInteraction` → `PikkuWire`, `CreateSessionServices` → `CreateWireServices`
+- `wireForgeCredential` → `wireCredential`
+- `startWorkflowByWire` → `startWorkflowByHTTPWire`
+- Renamed all `forge` → `node` naming
+- Renamed `credential` → `secret` across core types
+- `WorkflowService.createRun` signature changed (new `inline`, `graphHash` params)
+- Auth enforced by default for `pikkuFunc`
+
 ## 0.11.0
 
 ## 0.11.2
@@ -6,8 +63,6 @@
 
 - db9c7bf: Add workflow graph system with type-safe builder
 
-## 0.11.2
-
 ### Features
 
 - f35e89da: Add workflow graph system with type-safe builder

package/dist/crypto-utils.d.ts

@@ -0,0 +1,2 @@
+export declare const encryptJSON: (secret: string, value: unknown) => Promise<string>;
+export declare const decryptJSON: <T>(secret: string, token: string) => Promise<T>;

package/dist/crypto-utils.js

@@ -0,0 +1,78 @@
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+const getSubtle = () => {
+    const crypto = globalThis.crypto;
+    if (!crypto?.subtle) {
+        throw new Error('WebCrypto not available');
+    }
+    return crypto.subtle;
+};
+const base64Encode = (bytes) => {
+    if (typeof Buffer !== 'undefined') {
+        return Buffer.from(bytes).toString('base64');
+    }
+    let binary = '';
+    for (let i = 0; i < bytes.length; i++) {
+        binary += String.fromCharCode(bytes[i]);
+    }
+    return btoa(binary);
+};
+const base64Decode = (input) => {
+    if (typeof Buffer !== 'undefined') {
+        return new Uint8Array(Buffer.from(input, 'base64'));
+    }
+    const binary = atob(input);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+};
+const toBase64Url = (bytes) => {
+    return base64Encode(bytes)
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=+$/g, '');
+};
+const fromBase64Url = (input) => {
+    let base64 = input.replace(/-/g, '+').replace(/_/g, '/');
+    while (base64.length % 4 !== 0)
+        base64 += '=';
+    return base64Decode(base64);
+};
+const deriveKey = async (secret) => {
+    const subtle = getSubtle();
+    const hash = await subtle.digest('SHA-256', encoder.encode(secret));
+    return subtle.importKey('raw', hash, { name: 'AES-GCM' }, false, [
+        'encrypt',
+        'decrypt',
+    ]);
+};
+export const encryptJSON = async (secret, value) => {
+    const crypto = globalThis.crypto;
+    if (!crypto?.getRandomValues) {
+        throw new Error('WebCrypto not available');
+    }
+    const subtle = getSubtle();
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const key = await deriveKey(secret);
+    const plaintext = encoder.encode(JSON.stringify(value));
+    const encrypted = await subtle.encrypt({ name: 'AES-GCM', iv }, key, plaintext);
+    const cipherBytes = new Uint8Array(encrypted);
+    const out = new Uint8Array(iv.length + cipherBytes.length);
+    out.set(iv, 0);
+    out.set(cipherBytes, iv.length);
+    return toBase64Url(out);
+};
+export const decryptJSON = async (secret, token) => {
+    const subtle = getSubtle();
+    const data = fromBase64Url(token);
+    if (data.length < 13) {
+        throw new Error('Invalid encrypted payload');
+    }
+    const iv = data.slice(0, 12);
+    const ciphertext = data.slice(12);
+    const key = await deriveKey(secret);
+    const decrypted = await subtle.decrypt({ name: 'AES-GCM', iv }, key, ciphertext);
+    return JSON.parse(decoder.decode(new Uint8Array(decrypted)));
+};

package/dist/errors/errors.d.ts

@@ -4,6 +4,8 @@
 import { PikkuError } from './error-handler.js';
 export declare class InvalidMiddlewareWireError extends PikkuError {
 }
+export declare class PikkuMissingMetaError extends PikkuError {
+}
 /**
  * The server cannot or will not process the request due to client error (e.g., malformed request syntax).
  * @group Error
@@ -40,6 +42,12 @@ export declare class PaymentRequiredError extends PikkuError {
  */
 export declare class ForbiddenError extends PikkuError {
 }
+/**
+ * The session is readonly and cannot access a non-readonly function.
+ * @group Error
+ */
+export declare class ReadonlySessionError extends PikkuError {
+}
 /**
  * The request was made from an origin that is not permitted to access this resource.
  * @group Error
@@ -190,3 +198,9 @@ export declare class HTTPVersionNotSupportedError extends PikkuError {
  */
 export declare class MaxComputeTimeReachedError extends PikkuError {
 }
+/**
+ * A required schema was not found during validation.
+ * @group Error
+ */
+export declare class MissingSchemaError extends PikkuError {
+}

package/dist/errors/errors.js

@@ -8,6 +8,12 @@ addError(InvalidMiddlewareWireError, {
     status: 500,
     message: 'The middleware wire is invalid for the current wiring type.',
 });
+export class PikkuMissingMetaError extends PikkuError {
+}
+addError(PikkuMissingMetaError, {
+    status: 500,
+    message: 'Required metadata is missing',
+});
 /**
  * The server cannot or will not process the request due to client error (e.g., malformed request syntax).
  * @group Error
@@ -66,6 +72,16 @@ addError(ForbiddenError, {
     status: 403,
     message: 'The client does not have permission to access the requested resource.',
 });
+/**
+ * The session is readonly and cannot access a non-readonly function.
+ * @group Error
+ */
+export class ReadonlySessionError extends PikkuError {
+}
+addError(ReadonlySessionError, {
+    status: 403,
+    message: 'The session is readonly and cannot access this function.',
+});
 /**
  * The request was made from an origin that is not permitted to access this resource.
  * @group Error
@@ -321,3 +337,13 @@ addError(MaxComputeTimeReachedError, {
     status: 524,
     message: 'The server took too long to complete the request, reaching the maximum compute time allowed.',
 });
+/**
+ * A required schema was not found during validation.
+ * @group Error
+ */
+export class MissingSchemaError extends PikkuError {
+}
+addError(MissingSchemaError, {
+    status: 500,
+    message: 'A required schema was not found. Ensure schema generation has been run.',
+});

package/dist/errors/index.d.ts

@@ -1,2 +1,2 @@
-export * from './error-handler.js';
 export * from './errors.js';
+export { PikkuError, addError, addErrors } from './error-handler.js';

package/dist/errors/index.js

@@ -1,2 +1,2 @@
-export * from './error-handler.js';
 export * from './errors.js';
+export { PikkuError, addError, addErrors } from './error-handler.js';

package/dist/function/function-runner.d.ts

@@ -1,19 +1,25 @@
-import { CoreServices, CoreUserSession, CorePikkuMiddleware, PikkuWiringTypes, PikkuWire, MiddlewareMetadata, PermissionMetadata, CoreSingletonServices, CreateWireServices } from '../types/core.types.js';
-import { CorePermissionGroup, CorePikkuFunctionConfig, CorePikkuPermission } from './functions.types.js';
-import { SessionService } from '../services/user-session-service.js';
+import type { CoreServices, CoreUserSession, CorePikkuMiddleware, PikkuWiringTypes, PikkuWire, MiddlewareMetadata, PermissionMetadata, CoreSingletonServices, CreateWireServices } from '../types/core.types.js';
+import type { CorePikkuChannelMiddleware } from '../wirings/channel/channel.types.js';
+import type { CorePermissionGroup, CorePikkuFunctionConfig, CorePikkuPermission } from './functions.types.js';
+import type { SessionService } from '../services/user-session-service.js';
 export declare const addFunction: (funcName: string, funcConfig: CorePikkuFunctionConfig<any, any>, packageName?: string | null) => void;
+export declare const getFunctionNames: (packageName?: string | null) => string[];
+export declare const getAllFunctionNames: () => string[];
 export declare const runPikkuFuncDirectly: <In, Out>(funcName: string, allServices: CoreServices, wire: PikkuWire, data: In, userSession?: SessionService<CoreUserSession>, packageName?: string | null) => Promise<Out>;
-export declare const runPikkuFunc: <In = any, Out = any>(wireType: PikkuWiringTypes, wireId: string, funcName: string, { singletonServices, createWireServices, data, auth: wiringAuth, inheritedMiddleware, wireMiddleware, inheritedPermissions, wirePermissions, coerceDataFromSchema, tags, wire, packageName, }: {
+export declare const runPikkuFunc: <In = any, Out = any>(wireType: PikkuWiringTypes, wireId: string, funcName: string, { singletonServices, createWireServices, data, auth: wiringAuth, inheritedMiddleware, wireMiddleware, inheritedChannelMiddleware, wireChannelMiddleware, inheritedPermissions, wirePermissions, coerceDataFromSchema, tags, wire, sessionService, packageName, }: {
     singletonServices: CoreSingletonServices;
     createWireServices?: CreateWireServices;
     data: () => Promise<In> | In;
     auth?: boolean;
     inheritedMiddleware?: MiddlewareMetadata[];
     wireMiddleware?: CorePikkuMiddleware[];
+    inheritedChannelMiddleware?: MiddlewareMetadata[];
+    wireChannelMiddleware?: CorePikkuChannelMiddleware[];
     inheritedPermissions?: PermissionMetadata[];
     wirePermissions?: CorePermissionGroup | CorePikkuPermission[];
     coerceDataFromSchema?: boolean;
     tags?: string[];
     wire: PikkuWire;
+    sessionService?: SessionService<CoreUserSession>;
     packageName?: string | null;
 }) => Promise<Out>;

package/dist/function/function-runner.js

@@ -1,15 +1,18 @@
 import { runMiddleware, combineMiddleware } from '../middleware-runner.js';
+import { combineChannelMiddleware, wrapChannelWithMiddleware, } from '../wirings/channel/channel-middleware-runner.js';
 import { runPermissions } from '../permissions.js';
 import { pikkuState } from '../pikku-state.js';
 import { coerceTopLevelDataFromSchema, validateSchema } from '../schema.js';
-import { ForbiddenError } from '../errors/errors.js';
+import { parseVersionedId } from '../version.js';
+import { createFunctionSessionWireProps } from '../services/user-session-service.js';
+import { ForbiddenError, ReadonlySessionError } from '../errors/errors.js';
 import { rpcService } from '../wirings/rpc/rpc-runner.js';
 import { closeWireServices } from '../utils.js';
 /**
- * Get or create singleton services for an external package.
+ * Get or create singleton services for an addon package.
  * Services are cached in pikkuState to avoid recreation on each call.
  *
- * @param packageName - The external package name
+ * @param packageName - The addon package name
  * @param parentServices - The parent/caller's singleton services (used as base)
  * @returns The package's singleton services
  */
@@ -39,29 +42,58 @@ const getOrCreatePackageSingletonServices = async (packageName, parentServices)
 export const addFunction = (funcName, funcConfig, packageName = null) => {
     pikkuState(packageName, 'function', 'functions').set(funcName, funcConfig);
 };
+export const getFunctionNames = (packageName = null) => {
+    const functionsMeta = pikkuState(packageName, 'function', 'meta');
+    return Object.keys(functionsMeta);
+};
+export const getAllFunctionNames = () => {
+    const functions = [];
+    const mainFunctionsMeta = pikkuState(null, 'function', 'meta');
+    functions.push(...Object.keys(mainFunctionsMeta));
+    const addons = pikkuState(null, 'rpc', 'addons');
+    for (const [namespace, config] of addons) {
+        const packageFunctionsMeta = pikkuState(config.package, 'function', 'meta');
+        for (const funcName of Object.keys(packageFunctionsMeta)) {
+            functions.push(`${namespace}:${funcName}`);
+        }
+    }
+    return functions;
+};
 export const runPikkuFuncDirectly = async (funcName, allServices, wire, data, userSession, packageName = null) => {
     const funcConfig = pikkuState(packageName, 'function', 'functions').get(funcName);
     if (!funcConfig) {
         throw new Error(`Function not found: ${funcName}`);
     }
-    // Inject session into wire
     const wireWithSession = {
         ...wire,
-        session: userSession,
+        ...(userSession && createFunctionSessionWireProps(userSession)),
     };
     return (await funcConfig.func(allServices, data, wireWithSession));
 };
-export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServices, createWireServices, data, auth: wiringAuth, inheritedMiddleware, wireMiddleware, inheritedPermissions, wirePermissions, coerceDataFromSchema, tags = [], wire, packageName = null, }) => {
-    const funcConfig = pikkuState(packageName, 'function', 'functions').get(funcName);
+export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServices, createWireServices, data, auth: wiringAuth, inheritedMiddleware, wireMiddleware, inheritedChannelMiddleware, wireChannelMiddleware, inheritedPermissions, wirePermissions, coerceDataFromSchema, tags = [], wire, sessionService, packageName = null, }) => {
+    wire.wireType ??= wireType;
+    wire.wireId ??= wireId;
+    const funcMap = pikkuState(packageName, 'function', 'functions');
+    let funcConfig = funcMap.get(funcName);
+    const allMeta = pikkuState(packageName, 'function', 'meta');
+    let funcMeta = allMeta[funcName];
+    if (!funcConfig || !funcMeta) {
+        const { baseName, version } = parseVersionedId(funcName);
+        if (version !== null) {
+            funcConfig = funcConfig || funcMap.get(baseName);
+            funcMeta = funcMeta || allMeta[baseName];
+            if (funcConfig && funcMeta) {
+                singletonServices.logger.warn(`Version '${funcName}' not registered, resolved to '${baseName}'`);
+            }
+        }
+    }
     if (!funcConfig) {
         throw new Error(`Function not found: ${funcName}`);
     }
-    const allMeta = pikkuState(packageName, 'function', 'meta');
-    const funcMeta = allMeta[funcName];
     if (!funcMeta) {
         throw new Error(`Function meta not found: ${funcName}`);
     }
-    // For external packages, get or create their singleton services
+    // For addon packages, get or create their singleton services
     const resolvedSingletonServices = packageName
         ? await getOrCreatePackageSingletonServices(packageName, singletonServices)
         : singletonServices;
@@ -73,31 +105,62 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
             resolvedCreateWireServices = factories.createWireServices;
         }
     }
+    const allChannelMiddleware = combineChannelMiddleware(wireType, wireId, {
+        wireInheritedChannelMiddleware: inheritedChannelMiddleware,
+        wireChannelMiddleware,
+        packageName,
+    });
+    const resolvedWire = allChannelMiddleware.length > 0 && wire.channel
+        ? wrapChannelWithMiddleware(wire, resolvedSingletonServices, allChannelMiddleware)
+        : wire;
     // Convert tags to PermissionMetadata and merge with inheritedPermissions
-    const mergedInheritedPermissions = [
-        ...(inheritedPermissions || []),
-        ...(tags?.map((tag) => ({ type: 'tag', tag })) || []),
-    ];
+    let mergedInheritedPermissions;
+    if (tags && tags.length > 0) {
+        mergedInheritedPermissions = [
+            ...(inheritedPermissions || []),
+            ...tags.map((tag) => ({ type: 'tag', tag })),
+        ];
+    }
+    else {
+        mergedInheritedPermissions = inheritedPermissions || [];
+    }
     // Helper function to run permissions and execute the function
     const executeFunction = async () => {
-        const initialSession = wire.session?.freezeInitial();
-        const wireWithInitialSession = {
-            ...wire,
-            initialSession,
-        };
-        if (wiringAuth === true || funcConfig.auth === true) {
-            // This means it was explicitly enabled in either wiring or function and has to be respected
-            if (!initialSession) {
+        if (sessionService) {
+            resolvedWire.session = sessionService.freezeInitial();
+            resolvedWire.setSession = (s) => sessionService.set(s);
+            resolvedWire.clearSession = () => sessionService.clear();
+            resolvedWire.getSession = () => sessionService.get();
+            resolvedWire.hasSessionChanged = () => sessionService.sessionChanged;
+        }
+        const session = resolvedWire.session;
+        if (funcMeta.sessionless) {
+            if (wiringAuth === true || funcConfig.auth === true) {
+                if (!session) {
+                    throw new ForbiddenError('Authentication required');
+                }
+            }
+        }
+        else if (funcMeta.sessionless === false) {
+            if (wiringAuth === false || funcConfig.auth === false) {
+                resolvedSingletonServices.logger.warn(`Function '${funcName}' requires a session but auth was explicitly disabled — use pikkuSessionlessFunc instead.`);
+            }
+            if (!session) {
                 throw new ForbiddenError('Authentication required');
             }
         }
-        if (wiringAuth === undefined && funcConfig.auth === undefined) {
-            // We always default to requiring auth unless explicitly disabled
-            if (!initialSession) {
-                // TODO: Critical, we need to figure out how to make this work with different wirings
-                // throw new ForbiddenError('Authentication required')
+        else {
+            // TODO: Remove after a couple of releases — backward compat for
+            // generated metadata that doesn't include the `sessionless` field yet.
+            if (wiringAuth === true || funcConfig.auth === true) {
+                if (!session) {
+                    throw new ForbiddenError('Authentication required');
+                }
             }
         }
+        if (session?.readonly && !funcMeta.readonly) {
+            throw new ReadonlySessionError();
+        }
         // Evaluate the data from the lazy function
         const actualData = await data();
         // Validate and coerce data if schema is defined
@@ -110,27 +173,45 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
                 coerceTopLevelDataFromSchema(inputSchemaName, actualData, packageName);
             }
         }
-        await runPermissions(wireType, wireId, {
-            wireInheritedPermissions: mergedInheritedPermissions,
-            wirePermissions: wirePermissions,
-            funcInheritedPermissions: funcMeta.permissions,
-            funcPermissions: funcConfig.permissions,
-            services: resolvedSingletonServices,
-            wire: { ...wireWithInitialSession, rpc: undefined },
-            data: actualData,
-            packageName,
-        });
-        const wireServices = await resolvedCreateWireServices?.(resolvedSingletonServices, wireWithInitialSession);
+        if (mergedInheritedPermissions.length > 0 ||
+            wirePermissions ||
+            funcMeta.permissions ||
+            funcConfig.permissions) {
+            await runPermissions(wireType, wireId, {
+                wireInheritedPermissions: mergedInheritedPermissions,
+                wirePermissions: wirePermissions,
+                funcInheritedPermissions: funcMeta.permissions,
+                funcPermissions: funcConfig.permissions,
+                services: resolvedSingletonServices,
+                wire: resolvedWire,
+                data: actualData,
+                packageName,
+            });
+        }
+        const wireServices = await resolvedCreateWireServices?.(resolvedSingletonServices, resolvedWire);
         try {
-            const services = { ...resolvedSingletonServices, ...wireServices };
-            const rpc = rpcService.getContextRPCService(services, wireWithInitialSession);
-            return await funcConfig.func(services, actualData, {
-                ...wireWithInitialSession,
-                rpc,
+            const services = wireServices && Object.keys(wireServices).length > 0
+                ? { ...resolvedSingletonServices, ...wireServices }
+                : resolvedSingletonServices;
+            Object.defineProperty(resolvedWire, 'rpc', {
+                get() {
+                    const rpc = rpcService.getContextRPCService(services, resolvedWire, {
+                        sessionService,
+                    });
+                    Object.defineProperty(resolvedWire, 'rpc', {
+                        value: rpc,
+                        writable: true,
+                        configurable: true,
+                    });
+                    return rpc;
+                },
+                configurable: true,
+                enumerable: true,
             });
+            return await funcConfig.func(services, actualData, resolvedWire);
         }
         finally {
-            if (wireServices) {
+            if (wireServices && Object.keys(wireServices).length > 0) {
                 await closeWireServices(resolvedSingletonServices.logger, wireServices);
             }
         }
@@ -143,7 +224,7 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
         packageName,
     });
     if (allMiddleware.length > 0) {
-        return (await runMiddleware(resolvedSingletonServices, wire, allMiddleware, executeFunction));
+        return (await runMiddleware(resolvedSingletonServices, resolvedWire, allMiddleware, executeFunction));
     }
     return (await executeFunction());
 };