@pikku/core 0.12.13 → 0.12.15

package/CHANGELOG.md

@@ -1,5 +1,51 @@
 ## 0.12.4
 
+## 0.12.15
+
+### Patch Changes
+
+- 9e8605f: Add Workers for Platforms dispatch namespace support and AI agent fixes.
+
+  - deploy-cloudflare: Thread dispatchNamespace through deploy pipeline, reads CF_DISPATCH_NAMESPACE env var
+  - core: Fix auth-gated tools visible to unauthenticated sessions (null session now hides permission-gated items)
+  - core: Recursive null stripping in AI agent tool call resume path
+  - ai-vercel: Handle anyOf/oneOf/array types when making optional fields nullable for strict providers
+
+- 624097e: Add deploy pipeline with provider-agnostic architecture
+
+  - Add MetaService with explicit typed API, absorb WiringService reads
+  - Add deployment service, traceId propagation, scoped logger
+  - Rewrite analyzer: one function = one worker, gateways dispatch via RPC
+  - Add Cloudflare deploy provider with plan/apply commands
+  - Add per-unit filtered codegen for deploy pipeline
+  - Skip missing metadata in wiring registration for deploy units
+  - Fix schema coercion crash when schema has no properties
+  - Fix E2E codegen: double-pass resolves cross-package Zod type imports
+
+- 7ab3243: Add server-fallback deployment target for functions that can't run serverless.
+
+  Functions can declare `deploy: 'serverless' | 'server' | 'auto'`. With `serverlessIncompatible` config, the analyzer auto-routes functions using incompatible services to a container.
+
+  Server functions are merged into a single tree-shaken unit with a PikkuUWSServer entry, Dockerfile, and CF Container proxy Worker.
+
+  Also adds sub-path exports to @pikku/cloudflare for tree-shaking (greet bundle 1.6MB → 444KB) and deploy verifiers for cloudflare, serverless, and azure providers.
+
+## 0.12.14
+
+### Patch Changes
+
+- f85c234: Add unified credential system with per-user OAuth and AI agent pre-flight checks
+
+  - Unified CredentialService with lazy loading per user via pikkuUserId
+  - wire.getCredential() for typed single credential lookup
+  - MissingCredentialError with structured payload for client-side connect flows
+  - Console UI: Global/Users credential tabs, per-user OAuth connect/revoke
+  - AI agent pre-flight check: detects missing OAuth credentials from addon metadata, shows "Connect your accounts" prompt before chat
+  - CLI codegen: generates credentialsMeta per addon package for runtime lookup
+  - Vercel AI runner: catches MissingCredentialError as runtime fallback
+
+- 88d3100: Fix CLI command resolution for addon functions by passing packageName to addFunction during registration.
+
 ## 0.12.13
 
 ### Patch Changes

package/dist/errors/errors.d.ts

@@ -6,6 +6,10 @@ export declare class InvalidMiddlewareWireError extends PikkuError {
 }
 export declare class PikkuMissingMetaError extends PikkuError {
 }
+export declare class MissingServiceError extends PikkuError {
+}
+export declare class LocalEnvironmentOnlyError extends PikkuError {
+}
 /**
  * The server cannot or will not process the request due to client error (e.g., malformed request syntax).
  * @group Error
@@ -42,6 +46,20 @@ export declare class PaymentRequiredError extends PikkuError {
  */
 export declare class ForbiddenError extends PikkuError {
 }
+/**
+ * A required credential is missing. The payload contains metadata
+ * about the credential so the client can initiate a connect flow.
+ * @group Error
+ */
+export declare class MissingCredentialError extends PikkuError {
+    payload: {
+        error: 'missing_credential';
+        credentialName: string;
+        credentialType: 'oauth2' | 'apikey';
+        connectUrl?: string;
+    };
+    constructor(credentialName: string, credentialType: 'oauth2' | 'apikey', connectUrl?: string);
+}
 /**
  * The session is readonly and cannot access a non-readonly function.
  * @group Error

package/dist/errors/errors.js

@@ -14,6 +14,18 @@ addError(PikkuMissingMetaError, {
     status: 500,
     message: 'Required metadata is missing',
 });
+export class MissingServiceError extends PikkuError {
+}
+addError(MissingServiceError, {
+    status: 500,
+    message: 'A required service is not configured',
+});
+export class LocalEnvironmentOnlyError extends PikkuError {
+}
+addError(LocalEnvironmentOnlyError, {
+    status: 403,
+    message: 'This operation is only available in local development mode',
+});
 /**
  * The server cannot or will not process the request due to client error (e.g., malformed request syntax).
  * @group Error
@@ -72,6 +84,27 @@ addError(ForbiddenError, {
     status: 403,
     message: 'The client does not have permission to access the requested resource.',
 });
+/**
+ * A required credential is missing. The payload contains metadata
+ * about the credential so the client can initiate a connect flow.
+ * @group Error
+ */
+export class MissingCredentialError extends PikkuError {
+    payload;
+    constructor(credentialName, credentialType, connectUrl) {
+        super(`Missing credential: ${credentialName}`);
+        this.payload = {
+            error: 'missing_credential',
+            credentialName,
+            credentialType,
+            connectUrl,
+        };
+    }
+}
+addError(MissingCredentialError, {
+    status: 403,
+    message: 'A required credential is not configured.',
+});
 /**
  * The session is readonly and cannot access a non-readonly function.
  * @group Error

package/dist/function/function-runner.d.ts

@@ -2,7 +2,7 @@ import type { CoreServices, CoreUserSession, CorePikkuMiddleware, PikkuWiringTyp
 import type { CorePikkuChannelMiddleware } from '../wirings/channel/channel.types.js';
 import type { CorePermissionGroup, CorePikkuFunctionConfig, CorePikkuPermission } from './functions.types.js';
 import type { SessionService } from '../services/user-session-service.js';
-import type { PikkuCredentialWireService } from '../services/credential-wire-service.js';
+import { PikkuCredentialWireService } from '../services/credential-wire-service.js';
 export declare const addFunction: (funcName: string, funcConfig: CorePikkuFunctionConfig<any, any>, packageName?: string | null) => void;
 export declare const getFunctionNames: (packageName?: string | null) => string[];
 export declare const getAllFunctionNames: () => string[];

package/dist/function/function-runner.js

@@ -6,7 +6,7 @@ import { coerceTopLevelDataFromSchema, validateSchema } from '../schema.js';
 import { parseVersionedId } from '../version.js';
 import { createFunctionSessionWireProps } from '../services/user-session-service.js';
 import { ForbiddenError, ReadonlySessionError } from '../errors/errors.js';
-import { createWireServicesCredentialWireProps } from '../services/credential-wire-service.js';
+import { PikkuCredentialWireService, createWireServicesCredentialWireProps, } from '../services/credential-wire-service.js';
 import { rpcService } from '../wirings/rpc/rpc-runner.js';
 import { closeWireServices } from '../utils.js';
 /**
@@ -114,6 +114,13 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
     const resolvedWire = allChannelMiddleware.length > 0 && wire.channel
         ? wrapChannelWithMiddleware(wire, resolvedSingletonServices, allChannelMiddleware)
         : wire;
+    // Set up credential wire service early so middleware can use setCredential.
+    // Skip if already set up (e.g. addon functions reuse the parent wire).
+    if (!resolvedWire.getCredentials) {
+        const resolvedCredentialWireService = credentialWireService ??
+            new PikkuCredentialWireService(resolvedSingletonServices.credentialService, resolvedWire);
+        Object.assign(resolvedWire, createWireServicesCredentialWireProps(resolvedCredentialWireService));
+    }
     // Convert tags to PermissionMetadata and merge with inheritedPermissions
     let mergedInheritedPermissions;
     if (tags && tags.length > 0) {
@@ -189,11 +196,9 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
                 packageName,
             });
         }
-        if (credentialWireService) {
-            Object.assign(resolvedWire, createWireServicesCredentialWireProps(credentialWireService));
-        }
-        const wireServices = await resolvedCreateWireServices?.(resolvedSingletonServices, resolvedWire);
+        let wireServices;
         try {
+            wireServices = (await resolvedCreateWireServices?.(resolvedSingletonServices, resolvedWire));
             const services = wireServices && Object.keys(wireServices).length > 0
                 ? { ...resolvedSingletonServices, ...wireServices }
                 : resolvedSingletonServices;

package/dist/function/functions.types.js

@@ -73,5 +73,6 @@ export const pikkuAuth = (auth) => {
             return false;
         return fn(services, session);
     };
+    wrapper.__pikkuAuth = true;
     return wrapper;
 };

package/dist/function/index.d.ts

@@ -1,2 +1,3 @@
 export { addFunction, getAllFunctionNames } from './function-runner.js';
-export type { CorePikkuFunction, CorePikkuFunctionSessionless, } from './functions.types.js';
+export { pikkuAuth, pikkuPermission, pikkuPermissionFactory, pikkuApprovalDescription, } from './functions.types.js';
+export type { CorePikkuFunction, CorePikkuFunctionSessionless, CorePikkuFunctionConfig, CorePikkuAuth, CorePikkuAuthConfig, CorePikkuPermission, } from './functions.types.js';

package/dist/function/index.js

@@ -1 +1,2 @@
 export { addFunction, getAllFunctionNames } from './function-runner.js';
+export { pikkuAuth, pikkuPermission, pikkuPermissionFactory, pikkuApprovalDescription, } from './functions.types.js';

package/dist/handle-error.d.ts

@@ -5,10 +5,10 @@ import type { PikkuHTTP } from './wirings/http/http.types.js';
  *
  * @param {any} e - The error that occurred
  * @param {PikkuHTTP | undefined} http - HTTP wire object
- * @param {string} trackerId - Unique ID for tracking this error
+ * @param {string} traceId - Unique ID for tracking this error
  * @param {Logger} logger - Logger service
  * @param {number[]} logWarningsForStatusCodes - HTTP status codes to log as warnings
  * @param {boolean} respondWith404 - Whether to respond with 404 for NotFoundError
  * @param {boolean} bubbleError - Whether to throw the error after handling
  */
-export declare const handleHTTPError: (e: any, http: PikkuHTTP | undefined, trackerId: string | undefined, logger: Logger, logWarningsForStatusCodes: number[], respondWith404: boolean, bubbleError: boolean, exposeErrors?: boolean) => void;
+export declare const handleHTTPError: (e: any, http: PikkuHTTP | undefined, traceId: string | undefined, logger: Logger, logWarningsForStatusCodes: number[], respondWith404: boolean, bubbleError: boolean, exposeErrors?: boolean) => void;

package/dist/handle-error.js

@@ -6,13 +6,13 @@ import { NotFoundError } from './errors/errors.js';
  *
  * @param {any} e - The error that occurred
  * @param {PikkuHTTP | undefined} http - HTTP wire object
- * @param {string} trackerId - Unique ID for tracking this error
+ * @param {string} traceId - Unique ID for tracking this error
  * @param {Logger} logger - Logger service
  * @param {number[]} logWarningsForStatusCodes - HTTP status codes to log as warnings
  * @param {boolean} respondWith404 - Whether to respond with 404 for NotFoundError
  * @param {boolean} bubbleError - Whether to throw the error after handling
  */
-export const handleHTTPError = (e, http, trackerId, logger, logWarningsForStatusCodes, respondWith404, bubbleError, exposeErrors = false) => {
+export const handleHTTPError = (e, http, traceId, logger, logWarningsForStatusCodes, respondWith404, bubbleError, exposeErrors = false) => {
     // Skip 404 handling if configured to do so
     if (e instanceof NotFoundError && !respondWith404) {
         return;
@@ -25,12 +25,12 @@ export const handleHTTPError = (e, http, trackerId, logger, logWarningsForStatus
         http?.response?.json({
             message: errorResponse.message,
             payload: e.payload,
-            traceId: trackerId,
+            errorId: traceId,
         });
         // Log certain status codes as warnings
         if (logWarningsForStatusCodes.includes(errorResponse.status)) {
-            if (trackerId) {
-                logger.warn(`Warning id: ${trackerId}`);
+            if (traceId) {
+                logger.warn(`Warning id: ${traceId}`);
             }
             logger.warn(e instanceof Error ? e.message : e);
         }
@@ -39,9 +39,9 @@ export const handleHTTPError = (e, http, trackerId, logger, logWarningsForStatus
         // Handle unexpected errors
         logger.error(e instanceof Error ? e.message : e);
         http?.response?.status(500);
-        if (trackerId) {
-            logger.warn(`Error id: ${trackerId}`);
-            const errorBody = { errorId: trackerId };
+        if (traceId) {
+            logger.warn(`Error id: ${traceId}`);
+            const errorBody = { errorId: traceId };
             if (exposeErrors && !isProduction() && e instanceof Error) {
                 errorBody.message = e.message;
                 errorBody.stack = e.stack;

package/dist/index.d.ts

@@ -36,12 +36,11 @@ export type { AIStorageService } from './services/ai-storage-service.js';
 export type { HTTPMethod } from './wirings/http/http.types.js';
 export type { GraphNodeConfig } from './wirings/workflow/graph/workflow-graph.types.js';
 export { createGraph } from './wirings/workflow/graph/graph-node.js';
-export { workflow as wireWorkflow } from './wirings/workflow/workflow-helpers.js';
 export { wireAddon } from './wirings/rpc/wire-addon.js';
 export type { WireAddonConfig } from './wirings/rpc/wire-addon.js';
 export type { PikkuPackageState } from './types/state.types.js';
 export { runMiddleware, addMiddleware } from './middleware-runner.js';
-export { addPermission } from './permissions.js';
+export { addPermission, checkAuthPermissions } from './permissions.js';
 export { isSerializable, stopSingletonServices } from './utils.js';
 export { getSingletonServices, getCreateWireServices } from './pikku-state.js';
 export { type ScheduledTaskInfo, type ScheduledTaskSummary, } from './services/scheduler-service.js';

package/dist/index.js

@@ -12,10 +12,9 @@ export { runQueueJob } from './wirings/queue/queue-runner.js';
 export { runScheduledTask } from './wirings/scheduler/scheduler-runner.js';
 export { NotFoundError } from './errors/errors.js';
 export { createGraph } from './wirings/workflow/graph/graph-node.js';
-export { workflow as wireWorkflow } from './wirings/workflow/workflow-helpers.js';
 export { wireAddon } from './wirings/rpc/wire-addon.js';
 export { runMiddleware, addMiddleware } from './middleware-runner.js';
-export { addPermission } from './permissions.js';
+export { addPermission, checkAuthPermissions } from './permissions.js';
 export { isSerializable, stopSingletonServices } from './utils.js';
 export { getSingletonServices, getCreateWireServices } from './pikku-state.js';
 export { SchedulerService } from './services/scheduler-service.js';

package/dist/middleware/index.d.ts

@@ -3,3 +3,5 @@ export { authCookie } from './auth-cookie.js';
 export { authBearer } from './auth-bearer.js';
 export { pikkuRemoteAuthMiddleware } from './remote-auth.js';
 export { cors } from './cors.js';
+export { addMiddleware, runMiddleware } from '../middleware-runner.js';
+export { addPermission } from '../permissions.js';

package/dist/middleware/index.js

@@ -3,3 +3,5 @@ export { authCookie } from './auth-cookie.js';
 export { authBearer } from './auth-bearer.js';
 export { pikkuRemoteAuthMiddleware } from './remote-auth.js';
 export { cors } from './cors.js';
+export { addMiddleware, runMiddleware } from '../middleware-runner.js';
+export { addPermission } from '../permissions.js';

package/dist/middleware/remote-auth.js

@@ -10,6 +10,9 @@ export const pikkuRemoteAuthMiddleware = pikkuMiddleware(async ({ secrets, jwt }
         secret = await secrets.getSecret('PIKKU_REMOTE_SECRET');
     }
     catch {
+        if (http.request.path().startsWith('/remote/rpc/')) {
+            throw new UnauthorizedError();
+        }
         return next();
     }
     if (!jwt) {
@@ -34,8 +37,8 @@ export const pikkuRemoteAuthMiddleware = pikkuMiddleware(async ({ secrets, jwt }
     if (payload?.aud !== 'pikku-remote') {
         throw new UnauthorizedError();
     }
-    if (payload?.fn && http.request.path().startsWith('/rpc/')) {
-        const fn = decodeURIComponent(http.request.path().slice('/rpc/'.length));
+    if (payload?.fn && http.request.path().startsWith('/remote/rpc/')) {
+        const fn = decodeURIComponent(http.request.path().slice('/remote/rpc/'.length));
         if (fn && payload.fn !== fn) {
             throw new UnauthorizedError();
         }

package/dist/permissions.d.ts

@@ -1,4 +1,4 @@
-import type { CoreServices, PikkuWiringTypes, PermissionMetadata, PikkuWire } from './types/core.types.js';
+import type { CoreServices, CoreUserSession, PikkuWiringTypes, PermissionMetadata, PikkuWire } from './types/core.types.js';
 import type { CorePermissionGroup, CorePikkuPermission } from './function/functions.types.js';
 /**
  * Adds global permissions for a specific tag.
@@ -44,3 +44,15 @@ export declare const runPermissions: (wireType: PikkuWiringTypes, uid: string, {
     data: any;
     packageName?: string | null;
 }) => Promise<void>;
+/**
+ * Checks whether a session passes the auth checks (pikkuAuth only) for a
+ * given function/agent. Skips pikkuPermission checks since those require
+ * request data which isn't available at filter time.
+ *
+ * @param funcPermissions - The PermissionMetadata[] from function or agent metadata
+ * @param session - The user's session
+ * @param services - Singleton services
+ * @param packageName - Optional package namespace
+ * @returns true if the session passes all auth checks (or no auth checks exist)
+ */
+export declare const checkAuthPermissions: (funcPermissions: PermissionMetadata[] | undefined, session: CoreUserSession, services: CoreServices, packageName?: string | null) => Promise<boolean>;

package/dist/permissions.js

@@ -234,3 +234,54 @@ export const runPermissions = async (wireType, uid, { wireInheritedPermissions,
         throw new ForbiddenError('Permission denied');
     }
 };
+/**
+ * Checks whether a session passes the auth checks (pikkuAuth only) for a
+ * given function/agent. Skips pikkuPermission checks since those require
+ * request data which isn't available at filter time.
+ *
+ * @param funcPermissions - The PermissionMetadata[] from function or agent metadata
+ * @param session - The user's session
+ * @param services - Singleton services
+ * @param packageName - Optional package namespace
+ * @returns true if the session passes all auth checks (or no auth checks exist)
+ */
+export const checkAuthPermissions = async (funcPermissions, session, services, packageName = null) => {
+    if (!funcPermissions?.length)
+        return true;
+    const allPermissions = combinePermissions('agent', `authcheck:${Math.random()}`, {
+        funcInheritedPermissions: funcPermissions,
+        packageName,
+    });
+    if (allPermissions.length === 0)
+        return true;
+    const wire = { session };
+    // Extract only pikkuAuth permissions (marked with __pikkuAuth)
+    const authPerms = [];
+    for (const permission of allPermissions) {
+        if (typeof permission === 'function') {
+            if (permission.__pikkuAuth) {
+                authPerms.push(permission);
+            }
+        }
+        else if (permission && typeof permission === 'object') {
+            for (const funcs of Object.values(permission)) {
+                const arr = Array.isArray(funcs) ? funcs : [funcs];
+                for (const fn of arr) {
+                    if (typeof fn === 'function' && fn.__pikkuAuth) {
+                        authPerms.push(fn);
+                    }
+                }
+            }
+        }
+    }
+    // No auth permissions = allowed (only data-dependent permissions exist)
+    if (authPerms.length === 0)
+        return true;
+    // All auth permissions must pass
+    for (const perm of authPerms) {
+        const result = await perm(services, null, wire);
+        if (result)
+            return true;
+    }
+    return false;
+};

package/dist/pikku-state.d.ts

@@ -23,7 +23,6 @@ export declare const pikkuState: <Type extends keyof PikkuPackageState, Content
  */
 export declare const initializePikkuState: (packageName: string) => void;
 export declare const resetPikkuState: () => void;
-export declare const getPikkuMetaDir: (packageName?: string | null) => string | null;
 export declare const getSingletonServices: () => CoreSingletonServices;
 export declare const getCreateWireServices: () => CreateWireServices | undefined;
 /**

package/dist/pikku-state.js

@@ -126,7 +126,8 @@ const createEmptyPackageState = () => ({
     package: {
         factories: null,
         singletonServices: null,
-        metaDir: null,
+        credentialsMeta: null,
+        requiredParentServices: null,
     },
 });
 /**
@@ -151,9 +152,6 @@ export const resetPikkuState = () => {
 if (!getAllPackageStates().has('__main__')) {
     resetPikkuState();
 }
-export const getPikkuMetaDir = (packageName) => {
-    return pikkuState(packageName ?? null, 'package', 'metaDir');
-};
 export const getSingletonServices = () => {
     const services = pikkuState(null, 'package', 'singletonServices');
     if (!services)

package/dist/remote.d.ts

@@ -0,0 +1,10 @@
+import type { JWTService } from './services/jwt-service.js';
+import type { SecretService } from './services/secret-service.js';
+/**
+ * Build Authorization headers with JWT-signed session and traceId for
+ * pikkuRemoteAuthMiddleware on the receiving end.
+ *
+ * Used by all deployment services (Kysely, Redis, MongoDB, Lambda, CF, Azure)
+ * regardless of transport (HTTP, Lambda Invoke, service bindings).
+ */
+export declare function buildRemoteHeaders(jwt: JWTService | undefined, secrets: SecretService | undefined, funcName: string, session?: unknown, traceId?: string): Promise<Record<string, string>>;

package/dist/remote.js

@@ -0,0 +1,32 @@
+import { encryptJSON } from './crypto-utils.js';
+/**
+ * Build Authorization headers with JWT-signed session and traceId for
+ * pikkuRemoteAuthMiddleware on the receiving end.
+ *
+ * Used by all deployment services (Kysely, Redis, MongoDB, Lambda, CF, Azure)
+ * regardless of transport (HTTP, Lambda Invoke, service bindings).
+ */
+export async function buildRemoteHeaders(jwt, secrets, funcName, session, traceId) {
+    const headers = {
+        'content-type': 'application/json',
+        ...(traceId && { 'x-request-id': traceId }),
+    };
+    let secret;
+    try {
+        secret = await secrets?.getSecret('PIKKU_REMOTE_SECRET');
+    }
+    catch { }
+    if (secret && jwt) {
+        const sessionEnc = session
+            ? await encryptJSON(secret, { session })
+            : undefined;
+        const token = await jwt.encode({ value: 5, unit: 'minute' }, {
+            aud: 'pikku-remote',
+            fn: funcName,
+            iat: Math.floor(Date.now() / 1000),
+            session: sessionEnc,
+        });
+        headers.authorization = `Bearer ${token}`;
+    }
+    return headers;
+}

package/dist/schema.js

@@ -67,6 +67,8 @@ const validateAllSchemasLoaded = (logger, schemaService) => {
 };
 export const coerceTopLevelDataFromSchema = (schemaName, data, packageName = null) => {
     const schema = pikkuState(packageName, 'misc', 'schemas').get(schemaName);
+    if (!schema?.properties)
+        return;
     for (const key in schema.properties) {
         const property = schema.properties[key];
         if (typeof property === 'boolean') {

package/dist/services/credential-service.d.ts

@@ -37,4 +37,15 @@ export interface CredentialService {
      * @returns A record of credential name to value.
      */
     getAll(userId: string): Promise<Record<string, unknown>>;
+    /**
+     * Lists all user IDs that have a specific credential configured.
+     * @param name - The credential name.
+     * @returns Array of user IDs.
+     */
+    getUsersWithCredential(name: string): Promise<string[]>;
+    /**
+     * Lists all unique user IDs that have any credential configured.
+     * @returns Array of user IDs.
+     */
+    getAllUsers(): Promise<string[]>;
 }

package/dist/services/credential-wire-service.d.ts

@@ -1,13 +1,24 @@
+import type { CredentialService } from './credential-service.js';
+import type { PikkuWire } from '../types/core.types.js';
 export declare class PikkuCredentialWireService {
+    private credentialService?;
+    private wire?;
     private credentials;
+    private loaded;
+    private loadPromise;
+    constructor(credentialService?: CredentialService | undefined, wire?: PikkuWire | undefined);
     set(name: string, value: unknown): void;
-    getAll(): Record<string, unknown>;
-    getScoped(allowedNames: string[]): Record<string, unknown>;
+    get<T = unknown>(name: string): T | null | Promise<T | null>;
+    getAll(): Record<string, unknown> | Promise<Record<string, unknown>>;
+    getScoped(allowedNames: string[]): Record<string, unknown> | Promise<Record<string, unknown>>;
+    private lazyLoad;
+    private doLoad;
 }
 export declare function createMiddlewareCredentialWireProps(credentialWire: PikkuCredentialWireService): {
     setCredential: (name: string, value: unknown) => void;
 };
 export declare function createWireServicesCredentialWireProps(credentialWire: PikkuCredentialWireService, allowedNames?: string[]): {
     setCredential: (name: string, value: unknown) => void;
-    getCredentials: () => Record<string, unknown>;
+    getCredential: <T = unknown>(name: string) => T | Promise<T | null> | null;
+    getCredentials: () => Record<string, unknown> | Promise<Record<string, unknown>>;
 };

package/dist/services/credential-wire-service.js

@@ -1,19 +1,61 @@
+import { defaultPikkuUserIdResolver } from './pikku-user-id.js';
 export class PikkuCredentialWireService {
+    credentialService;
+    wire;
     credentials = {};
+    loaded = false;
+    loadPromise;
+    constructor(credentialService, wire) {
+        this.credentialService = credentialService;
+        this.wire = wire;
+    }
     set(name, value) {
         this.credentials[name] = value;
     }
+    get(name) {
+        if (this.loaded)
+            return this.credentials[name] ?? null;
+        return this.lazyLoad().then(() => this.credentials[name] ?? null);
+    }
     getAll() {
-        return this.credentials;
+        if (this.loaded)
+            return this.credentials;
+        return this.lazyLoad().then(() => this.credentials);
     }
     getScoped(allowedNames) {
-        const scoped = {};
-        for (const name of allowedNames) {
-            if (name in this.credentials) {
-                scoped[name] = this.credentials[name];
+        const buildScoped = () => {
+            const scoped = {};
+            for (const name of allowedNames) {
+                if (name in this.credentials) {
+                    scoped[name] = this.credentials[name];
+                }
+            }
+            return scoped;
+        };
+        if (this.loaded)
+            return buildScoped();
+        return this.lazyLoad().then(buildScoped);
+    }
+    lazyLoad() {
+        if (this.loadPromise)
+            return this.loadPromise;
+        this.loadPromise = this.doLoad();
+        return this.loadPromise;
+    }
+    async doLoad() {
+        this.loaded = true;
+        if (!this.credentialService || !this.wire)
+            return;
+        const userId = defaultPikkuUserIdResolver(this.wire);
+        if (!userId)
+            return;
+        this.wire.pikkuUserId = userId;
+        const allCreds = await this.credentialService.getAll(userId);
+        for (const [name, value] of Object.entries(allCreds)) {
+            if (!(name in this.credentials)) {
+                this.credentials[name] = value;
             }
         }
-        return scoped;
     }
 }
 export function createMiddlewareCredentialWireProps(credentialWire) {
@@ -24,6 +66,7 @@ export function createMiddlewareCredentialWireProps(credentialWire) {
 export function createWireServicesCredentialWireProps(credentialWire, allowedNames) {
     return {
         setCredential: (name, value) => credentialWire.set(name, value),
+        getCredential: (name) => credentialWire.get(name),
         getCredentials: () => allowedNames
             ? credentialWire.getScoped(allowedNames)
             : credentialWire.getAll(),

package/dist/services/deployment-service.d.ts

@@ -15,5 +15,16 @@ export interface DeploymentService {
     init(): Promise<void>;
     start(config: DeploymentConfig): Promise<void>;
     stop(): Promise<void>;
-    findFunction(name: string): Promise<DeploymentInfo[]>;
+    /**
+     * Dispatch a remote RPC call to a function.
+     * The deployment service owns the full transport:
+     * - Resolving the target (endpoint, service binding, etc.)
+     * - Session propagation (JWT signing, headers)
+     * - The actual network call
+     *
+     * @param funcName - The function to invoke
+     * @param data - Input data for the function
+     * @param session - User session to propagate (optional)
+     */
+    invoke(funcName: string, data: unknown, session?: unknown, traceId?: string): Promise<unknown>;
 }

package/dist/services/in-memory-queue-service.d.ts

@@ -0,0 +1,7 @@
+import type { QueueService, JobOptions } from '../wirings/queue/queue.types.js';
+export declare class InMemoryQueueService implements QueueService {
+    readonly supportsResults = false;
+    private jobCounter;
+    add<T>(queueName: string, data: T, options?: JobOptions): Promise<string>;
+    getJob(): Promise<null>;
+}