@pikku/core 0.12.14 → 0.12.15

package/src/middleware/remote-auth.test.ts

@@ -252,7 +252,7 @@ describe('pikkuRemoteAuthMiddleware', () => {
               http: {
                 request: createMockRequest(
                   { authorization: 'Bearer valid-token' },
-                  '/rpc/otherFunc'
+                  '/remote/rpc/otherFunc'
                 ),
               },
             } as any,
@@ -273,7 +273,7 @@ describe('pikkuRemoteAuthMiddleware', () => {
           http: {
             request: createMockRequest(
               { authorization: 'Bearer valid-token' },
-              '/rpc/myFunc'
+              '/remote/rpc/myFunc'
             ),
           },
         } as any,
@@ -295,7 +295,7 @@ describe('pikkuRemoteAuthMiddleware', () => {
           http: {
             request: createMockRequest(
               { authorization: 'Bearer valid-token' },
-              '/rpc/anyFunc'
+              '/remote/rpc/anyFunc'
             ),
           },
         } as any,
@@ -339,7 +339,7 @@ describe('pikkuRemoteAuthMiddleware', () => {
           http: {
             request: createMockRequest(
               { authorization: 'Bearer valid-token' },
-              '/rpc/my%20func'
+              '/remote/rpc/my%20func'
             ),
           },
         } as any,

package/src/middleware/remote-auth.ts

@@ -12,6 +12,9 @@ export const pikkuRemoteAuthMiddleware = pikkuMiddleware(
     try {
       secret = await secrets.getSecret('PIKKU_REMOTE_SECRET')
     } catch {
+      if (http.request.path().startsWith('/remote/rpc/')) {
+        throw new UnauthorizedError()
+      }
       return next()
     }
     if (!jwt) {
@@ -42,8 +45,10 @@ export const pikkuRemoteAuthMiddleware = pikkuMiddleware(
       throw new UnauthorizedError()
     }
 
-    if (payload?.fn && http.request.path().startsWith('/rpc/')) {
-      const fn = decodeURIComponent(http.request.path().slice('/rpc/'.length))
+    if (payload?.fn && http.request.path().startsWith('/remote/rpc/')) {
+      const fn = decodeURIComponent(
+        http.request.path().slice('/remote/rpc/'.length)
+      )
       if (fn && payload.fn !== fn) {
         throw new UnauthorizedError()
       }

package/src/permissions.ts

@@ -1,5 +1,6 @@
 import type {
   CoreServices,
+  CoreUserSession,
   PikkuWiringTypes,
   PermissionMetadata,
   PikkuWire,
@@ -325,3 +326,72 @@ export const runPermissions = async (
     throw new ForbiddenError('Permission denied')
   }
 }
+
+/**
+ * Checks whether a session passes the auth checks (pikkuAuth only) for a
+ * given function/agent. Skips pikkuPermission checks since those require
+ * request data which isn't available at filter time.
+ *
+ * @param funcPermissions - The PermissionMetadata[] from function or agent metadata
+ * @param session - The user's session
+ * @param services - Singleton services
+ * @param packageName - Optional package namespace
+ * @returns true if the session passes all auth checks (or no auth checks exist)
+ */
+export const checkAuthPermissions = async (
+  funcPermissions: PermissionMetadata[] | undefined,
+  session: CoreUserSession,
+  services: CoreServices,
+  packageName: string | null = null
+): Promise<boolean> => {
+  if (!funcPermissions?.length) return true
+
+  const allPermissions = combinePermissions(
+    'agent',
+    `authcheck:${Math.random()}`,
+    {
+      funcInheritedPermissions: funcPermissions,
+      packageName,
+    }
+  )
+
+  if (allPermissions.length === 0) return true
+
+  const wire = { session } as unknown as PikkuWire<
+    any,
+    never,
+    any,
+    never,
+    never,
+    never
+  >
+
+  // Extract only pikkuAuth permissions (marked with __pikkuAuth)
+  const authPerms: CorePikkuPermission[] = []
+  for (const permission of allPermissions) {
+    if (typeof permission === 'function') {
+      if ((permission as any).__pikkuAuth) {
+        authPerms.push(permission)
+      }
+    } else if (permission && typeof permission === 'object') {
+      for (const funcs of Object.values(permission)) {
+        const arr = Array.isArray(funcs) ? funcs : [funcs]
+        for (const fn of arr) {
+          if (typeof fn === 'function' && (fn as any).__pikkuAuth) {
+            authPerms.push(fn)
+          }
+        }
+      }
+    }
+  }
+
+  // No auth permissions = allowed (only data-dependent permissions exist)
+  if (authPerms.length === 0) return true
+
+  // All auth permissions must pass
+  for (const perm of authPerms) {
+    const result = await perm(services, null, wire)
+    if (result) return true
+  }
+  return false
+}

package/src/pikku-state.test.ts

@@ -7,7 +7,6 @@ import {
   getAllPackageStates,
   getSingletonServices,
   getCreateWireServices,
-  getPikkuMetaDir,
   addPackageServiceFactories,
 } from './pikku-state.js'
 
@@ -176,31 +175,6 @@ describe('getCreateWireServices', () => {
   })
 })
 
-describe('getPikkuMetaDir', () => {
-  test('should return null by default', () => {
-    const result = getPikkuMetaDir()
-    assert.strictEqual(result, null)
-  })
-
-  test('should return metaDir when set', () => {
-    pikkuState(null, 'package', 'metaDir', '/some/path' as any)
-    const result = getPikkuMetaDir()
-    assert.strictEqual(result, '/some/path')
-  })
-
-  test('should return metaDir for specific package', () => {
-    pikkuState('@test/pkg', 'package', 'metaDir', '/addon/path' as any)
-    const result = getPikkuMetaDir('@test/pkg')
-    assert.strictEqual(result, '/addon/path')
-  })
-
-  test('should treat null packageName as main', () => {
-    pikkuState(null, 'package', 'metaDir', '/main/path' as any)
-    const result = getPikkuMetaDir(null)
-    assert.strictEqual(result, '/main/path')
-  })
-})
-
 describe('addPackageServiceFactories', () => {
   test('should register factories for addon package', () => {
     const mockFactories = {

package/src/pikku-state.ts

@@ -156,8 +156,8 @@ const createEmptyPackageState = (): PikkuPackageState => ({
   package: {
     factories: null,
     singletonServices: null,
-    metaDir: null,
     credentialsMeta: null,
+    requiredParentServices: null,
   },
 })
 
@@ -188,10 +188,6 @@ if (!getAllPackageStates().has('__main__')) {
   resetPikkuState()
 }
 
-export const getPikkuMetaDir = (packageName?: string | null): string | null => {
-  return pikkuState(packageName ?? null, 'package', 'metaDir')
-}
-
 export const getSingletonServices = (): CoreSingletonServices => {
   const services = pikkuState(null, 'package', 'singletonServices')
   if (!services) throw new Error('Singleton services not initialized')

package/src/remote.ts

@@ -0,0 +1,46 @@
+import type { JWTService } from './services/jwt-service.js'
+import type { SecretService } from './services/secret-service.js'
+import { encryptJSON } from './crypto-utils.js'
+
+/**
+ * Build Authorization headers with JWT-signed session and traceId for
+ * pikkuRemoteAuthMiddleware on the receiving end.
+ *
+ * Used by all deployment services (Kysely, Redis, MongoDB, Lambda, CF, Azure)
+ * regardless of transport (HTTP, Lambda Invoke, service bindings).
+ */
+export async function buildRemoteHeaders(
+  jwt: JWTService | undefined,
+  secrets: SecretService | undefined,
+  funcName: string,
+  session?: unknown,
+  traceId?: string
+): Promise<Record<string, string>> {
+  const headers: Record<string, string> = {
+    'content-type': 'application/json',
+    ...(traceId && { 'x-request-id': traceId }),
+  }
+
+  let secret: string | undefined
+  try {
+    secret = await secrets?.getSecret('PIKKU_REMOTE_SECRET')
+  } catch {}
+
+  if (secret && jwt) {
+    const sessionEnc = session
+      ? await encryptJSON(secret, { session })
+      : undefined
+    const token = await jwt.encode(
+      { value: 5, unit: 'minute' },
+      {
+        aud: 'pikku-remote',
+        fn: funcName,
+        iat: Math.floor(Date.now() / 1000),
+        session: sessionEnc,
+      }
+    )
+    headers.authorization = `Bearer ${token}`
+  }
+
+  return headers
+}

package/src/schema.ts

@@ -100,6 +100,7 @@ export const coerceTopLevelDataFromSchema = (
   packageName: string | null = null
 ) => {
   const schema = pikkuState(packageName, 'misc', 'schemas').get(schemaName)
+  if (!schema?.properties) return
   for (const key in schema.properties) {
     const property = schema.properties[key]
     if (typeof property === 'boolean') {

package/src/services/deployment-service.ts

@@ -18,5 +18,21 @@ export interface DeploymentService {
   init(): Promise<void>
   start(config: DeploymentConfig): Promise<void>
   stop(): Promise<void>
-  findFunction(name: string): Promise<DeploymentInfo[]>
+  /**
+   * Dispatch a remote RPC call to a function.
+   * The deployment service owns the full transport:
+   * - Resolving the target (endpoint, service binding, etc.)
+   * - Session propagation (JWT signing, headers)
+   * - The actual network call
+   *
+   * @param funcName - The function to invoke
+   * @param data - Input data for the function
+   * @param session - User session to propagate (optional)
+   */
+  invoke(
+    funcName: string,
+    data: unknown,
+    session?: unknown,
+    traceId?: string
+  ): Promise<unknown>
 }

package/src/services/in-memory-queue-service.ts

@@ -0,0 +1,46 @@
+import type {
+  QueueService,
+  QueueJob,
+  JobOptions,
+} from '../wirings/queue/queue.types.js'
+import { runQueueJob } from '../wirings/queue/queue-runner.js'
+
+export class InMemoryQueueService implements QueueService {
+  readonly supportsResults = false
+  private jobCounter = 0
+
+  async add<T>(
+    queueName: string,
+    data: T,
+    options?: JobOptions
+  ): Promise<string> {
+    const jobId = `inmem-${++this.jobCounter}`
+
+    const job: QueueJob<T> = {
+      id: jobId,
+      queueName,
+      data,
+      status: () => 'active',
+      pikkuUserId: options?.pikkuUserId,
+    }
+
+    const delay = options?.delay ?? 0
+
+    setTimeout(async () => {
+      try {
+        await runQueueJob({ job })
+      } catch (e: any) {
+        console.error(
+          `[InMemoryQueue] Job ${jobId} on ${queueName} failed:`,
+          e.message
+        )
+      }
+    }, delay)
+
+    return jobId
+  }
+
+  async getJob(): Promise<null> {
+    return null
+  }
+}

package/src/services/index.ts

@@ -19,8 +19,9 @@ export { TypedVariablesService } from './typed-variables-service.js'
 export { LocalSecretService } from './local-secrets.js'
 export { LocalCredentialService } from './local-credential-service.js'
 export { LocalVariablesService } from './local-variables.js'
-export { ConsoleLogger } from './logger-console.js'
+export { ConsoleLogger, JsonConsoleLogger } from './logger-console.js'
 export { InMemoryWorkflowService } from './in-memory-workflow-service.js'
+export { InMemoryQueueService } from './in-memory-queue-service.js'
 export { InMemoryTriggerService } from './in-memory-trigger-service.js'
 export { InMemoryAIRunStateService } from './in-memory-ai-run-state-service.js'
 export { LocalGatewayService } from './local-gateway-service.js'
@@ -66,3 +67,22 @@ export type {
   CredentialMetaInfo,
 } from './typed-credential-service.js'
 export type { VariableStatus, VariableMeta } from './typed-variables-service.js'
+export type { MetaService } from './meta-service.js'
+export type {
+  MCPMeta,
+  RPCMetaRecord,
+  ServiceMeta,
+  ServicesMetaRecord,
+  MiddlewareDefinitionMeta,
+  MiddlewareInstanceMeta,
+  GroupMeta,
+  MiddlewareGroupsMeta,
+  PermissionDefinitionMeta,
+  PermissionsGroupsMeta,
+  FunctionsMeta,
+  FunctionMeta,
+  MiddlewareMeta,
+  PermissionMeta,
+  AgentsMeta,
+  AgentMeta,
+} from './meta-service.js'

package/src/services/logger-console.ts

@@ -2,97 +2,177 @@ import type { Logger } from './logger.js'
 import { LogLevel } from './logger.js'
 
 /**
- * A logger implementation that logs messages to the console.
+ * Text-mode console logger.
+ * Output: `INFO: message` or `[traceId] INFO: message`
  */
 export class ConsoleLogger implements Logger {
-  /**
-   * The current logging level.
-   */
   private level: LogLevel = LogLevel.info
+  private prefix: string
+
+  constructor(traceId?: string) {
+    this.prefix = traceId ? `[${traceId}]` : ''
+  }
 
-  /**
-   * Sets the logging level.
-   * @param level - The logging level to set.
-   */
   setLevel(level: LogLevel): void {
     this.level = level
   }
 
-  /**
-   * Logs a trace message.
-   * @param message - The message to log.
-   * @param meta - Additional metadata to log.
-   */
-  trace?(message: string, ...meta: any[]): void {
+  scope(traceId: string): Logger {
+    const scoped = new ConsoleLogger(traceId)
+    scoped.level = this.level
+    return scoped
+  }
+
+  private log_(
+    fn: (...args: unknown[]) => void,
+    label: string,
+    ...args: unknown[]
+  ): void {
+    if (this.prefix) {
+      fn(this.prefix, label, ...args)
+    } else {
+      fn(label, ...args)
+    }
+  }
+
+  trace(message: string, ...meta: any[]): void {
     if (this.level <= LogLevel.trace) {
-      console.trace('TRACE:', message, ...meta)
+      this.log_(console.trace, 'TRACE:', message, ...meta)
     }
   }
 
-  /**
-   * Logs a debug message.
-   * @param message - The message to log.
-   * @param meta - Additional metadata to log.
-   */
   debug(message: string, ...meta: any[]): void {
     if (this.level <= LogLevel.debug) {
-      console.debug('DEBUG:', message, ...meta)
+      this.log_(console.debug, 'DEBUG:', message, ...meta)
     }
   }
 
-  /**
-   * Logs an informational message.
-   * @param messageOrObj - The message or object to log.
-   * @param meta - Additional metadata to log.
-   */
   info(messageOrObj: string | Record<string, any>, ...meta: any[]): void {
     if (this.level <= LogLevel.info) {
-      console.info('INFO:', messageOrObj, ...meta)
+      this.log_(console.info, 'INFO:', messageOrObj, ...meta)
     }
   }
 
-  /**
-   * Logs a warning message.
-   * @param messageOrObj - The message or object to log.
-   * @param meta - Additional metadata to log.
-   */
   warn(messageOrObj: string | Record<string, any>, ...meta: any[]): void {
     if (this.level <= LogLevel.warn) {
-      console.warn('WARN:', messageOrObj, ...meta)
+      this.log_(console.warn, 'WARN:', messageOrObj, ...meta)
     }
   }
 
-  /**
-   * Logs an error message.
-   * @param messageOrObj - The message, object, or error to log.
-   * @param meta - Additional metadata to log.
-   */
   error(
     messageOrObj: string | Record<string, any> | Error,
     ...meta: any[]
   ): void {
     if (this.level <= LogLevel.error) {
-      console.error(
+      this.log_(
+        console.error,
         'ERROR:',
         messageOrObj instanceof Error ? messageOrObj.message : messageOrObj,
         ...meta
       )
       if (messageOrObj instanceof Error) {
-        console.error('STACK:', messageOrObj.stack)
+        this.log_(console.error, 'STACK:', messageOrObj.stack)
+      }
+    }
+  }
+
+  log(level: string, message: string, ...meta: any[]): void {
+    const logLevel = LogLevel[level as keyof typeof LogLevel]
+    if (this.level <= logLevel) {
+      this.log_(console.log, `${level.toUpperCase()}:`, message, ...meta)
+    }
+  }
+}
+
+/**
+ * JSON-mode console logger.
+ * Output: `{"level":"info","message":"...","traceId":"..."}`
+ * CF Workers Logs auto-indexes JSON keys for filtering.
+ */
+export class JsonConsoleLogger implements Logger {
+  private level: LogLevel = LogLevel.info
+  private traceId: string | undefined
+
+  constructor(traceId?: string) {
+    this.traceId = traceId
+  }
+
+  setLevel(level: LogLevel): void {
+    this.level = level
+  }
+
+  scope(traceId: string): Logger {
+    const scoped = new JsonConsoleLogger(traceId)
+    scoped.level = this.level
+    return scoped
+  }
+
+  trace(message: string, ...meta: any[]): void {
+    if (this.level <= LogLevel.trace) {
+      this.emit(console.debug, 'trace', message, meta)
+    }
+  }
+
+  debug(message: string, ...meta: any[]): void {
+    if (this.level <= LogLevel.debug) {
+      this.emit(console.debug, 'debug', message, meta)
+    }
+  }
+
+  info(messageOrObj: string | Record<string, any>, ...meta: any[]): void {
+    if (this.level <= LogLevel.info) {
+      this.emit(console.info, 'info', messageOrObj, meta)
+    }
+  }
+
+  warn(messageOrObj: string | Record<string, any>, ...meta: any[]): void {
+    if (this.level <= LogLevel.warn) {
+      this.emit(console.warn, 'warn', messageOrObj, meta)
+    }
+  }
+
+  error(
+    messageOrObj: string | Record<string, any> | Error,
+    ...meta: any[]
+  ): void {
+    if (this.level <= LogLevel.error) {
+      if (messageOrObj instanceof Error) {
+        this.emit(console.error, 'error', messageOrObj.message, meta)
+        console.error(
+          JSON.stringify({
+            level: 'error',
+            message: 'stack',
+            stack: messageOrObj.stack,
+            ...(this.traceId ? { traceId: this.traceId } : {}),
+          })
+        )
+      } else {
+        this.emit(console.error, 'error', messageOrObj, meta)
       }
     }
   }
 
-  /**
-   * Logs a message at a specified level.
-   * @param level - The logging level.
-   * @param message - The message to log.
-   * @param meta - Additional metadata to log.
-   */
   log(level: string, message: string, ...meta: any[]): void {
     const logLevel = LogLevel[level as keyof typeof LogLevel]
     if (this.level <= logLevel) {
-      console.log(`${level.toUpperCase()}:`, message, ...meta)
+      this.emit(console.log, level, message, meta)
+    }
+  }
+
+  private emit(
+    fn: (...args: any[]) => void,
+    level: string,
+    messageOrObj: string | Record<string, any>,
+    meta: any[]
+  ): void {
+    const entry: Record<string, unknown> = { level }
+    if (this.traceId) entry.traceId = this.traceId
+    if (typeof messageOrObj === 'string') {
+      entry.message = messageOrObj
+    } else {
+      Object.assign(entry, messageOrObj)
     }
+    if (meta.length > 0) entry.meta = meta
+    fn(JSON.stringify(entry))
   }
 }

package/src/services/logger.ts

@@ -54,4 +54,10 @@ export interface Logger {
    * @param level - The logging level to set.
    */
   setLevel(level: LogLevel): void
+
+  /**
+   * Creates a scoped logger with a traceId included in every log entry.
+   * Used per-request to correlate logs across function calls.
+   */
+  scope?(traceId: string): Logger
 }