@pikku/core 0.12.14 → 0.12.16

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 ## 0.12.4
 
+## 0.12.16
+
+### Patch Changes
+
+- fbcf5b9: Add middleware priority system, telemetry middleware, and statusCode getter. Middleware now supports named priority levels (highest, high, medium, low, lowest) that control execution order regardless of registration order. Includes telemetryOuter and telemetryInner middleware for observability instrumentation via structured console.log output. PikkuHTTPResponse now exposes a readonly `statusCode` getter across all response implementations.
+
+## 0.12.15
+
+### Patch Changes
+
+- 9e8605f: Add Workers for Platforms dispatch namespace support and AI agent fixes.
+
+  - deploy-cloudflare: Thread dispatchNamespace through deploy pipeline, reads CF_DISPATCH_NAMESPACE env var
+  - core: Fix auth-gated tools visible to unauthenticated sessions (null session now hides permission-gated items)
+  - core: Recursive null stripping in AI agent tool call resume path
+  - ai-vercel: Handle anyOf/oneOf/array types when making optional fields nullable for strict providers
+
+- 624097e: Add deploy pipeline with provider-agnostic architecture
+
+  - Add MetaService with explicit typed API, absorb WiringService reads
+  - Add deployment service, traceId propagation, scoped logger
+  - Rewrite analyzer: one function = one worker, gateways dispatch via RPC
+  - Add Cloudflare deploy provider with plan/apply commands
+  - Add per-unit filtered codegen for deploy pipeline
+  - Skip missing metadata in wiring registration for deploy units
+  - Fix schema coercion crash when schema has no properties
+  - Fix E2E codegen: double-pass resolves cross-package Zod type imports
+
+- 7ab3243: Add server-fallback deployment target for functions that can't run serverless.
+
+  Functions can declare `deploy: 'serverless' | 'server' | 'auto'`. With `serverlessIncompatible` config, the analyzer auto-routes functions using incompatible services to a container.
+
+  Server functions are merged into a single tree-shaken unit with a PikkuUWSServer entry, Dockerfile, and CF Container proxy Worker.
+
+  Also adds sub-path exports to @pikku/cloudflare for tree-shaking (greet bundle 1.6MB → 444KB) and deploy verifiers for cloudflare, serverless, and azure providers.
+
 ## 0.12.14
 
 ### Patch Changes

package/dist/errors/errors.d.ts

@@ -6,6 +6,10 @@ export declare class InvalidMiddlewareWireError extends PikkuError {
 }
 export declare class PikkuMissingMetaError extends PikkuError {
 }
+export declare class MissingServiceError extends PikkuError {
+}
+export declare class LocalEnvironmentOnlyError extends PikkuError {
+}
 /**
  * The server cannot or will not process the request due to client error (e.g., malformed request syntax).
  * @group Error

package/dist/errors/errors.js

@@ -14,6 +14,18 @@ addError(PikkuMissingMetaError, {
     status: 500,
     message: 'Required metadata is missing',
 });
+export class MissingServiceError extends PikkuError {
+}
+addError(MissingServiceError, {
+    status: 500,
+    message: 'A required service is not configured',
+});
+export class LocalEnvironmentOnlyError extends PikkuError {
+}
+addError(LocalEnvironmentOnlyError, {
+    status: 403,
+    message: 'This operation is only available in local development mode',
+});
 /**
  * The server cannot or will not process the request due to client error (e.g., malformed request syntax).
  * @group Error

package/dist/function/function-runner.js

@@ -196,8 +196,9 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
                 packageName,
             });
         }
-        const wireServices = await resolvedCreateWireServices?.(resolvedSingletonServices, resolvedWire);
+        let wireServices;
         try {
+            wireServices = (await resolvedCreateWireServices?.(resolvedSingletonServices, resolvedWire));
             const services = wireServices && Object.keys(wireServices).length > 0
                 ? { ...resolvedSingletonServices, ...wireServices }
                 : resolvedSingletonServices;

package/dist/function/functions.types.js

@@ -73,5 +73,6 @@ export const pikkuAuth = (auth) => {
             return false;
         return fn(services, session);
     };
+    wrapper.__pikkuAuth = true;
     return wrapper;
 };

package/dist/function/index.d.ts

@@ -1,2 +1,3 @@
 export { addFunction, getAllFunctionNames } from './function-runner.js';
-export type { CorePikkuFunction, CorePikkuFunctionSessionless, } from './functions.types.js';
+export { pikkuAuth, pikkuPermission, pikkuPermissionFactory, pikkuApprovalDescription, } from './functions.types.js';
+export type { CorePikkuFunction, CorePikkuFunctionSessionless, CorePikkuFunctionConfig, CorePikkuAuth, CorePikkuAuthConfig, CorePikkuPermission, } from './functions.types.js';

package/dist/function/index.js

@@ -1 +1,2 @@
 export { addFunction, getAllFunctionNames } from './function-runner.js';
+export { pikkuAuth, pikkuPermission, pikkuPermissionFactory, pikkuApprovalDescription, } from './functions.types.js';

package/dist/handle-error.d.ts

@@ -5,10 +5,10 @@ import type { PikkuHTTP } from './wirings/http/http.types.js';
  *
  * @param {any} e - The error that occurred
  * @param {PikkuHTTP | undefined} http - HTTP wire object
- * @param {string} trackerId - Unique ID for tracking this error
+ * @param {string} traceId - Unique ID for tracking this error
  * @param {Logger} logger - Logger service
  * @param {number[]} logWarningsForStatusCodes - HTTP status codes to log as warnings
  * @param {boolean} respondWith404 - Whether to respond with 404 for NotFoundError
  * @param {boolean} bubbleError - Whether to throw the error after handling
  */
-export declare const handleHTTPError: (e: any, http: PikkuHTTP | undefined, trackerId: string | undefined, logger: Logger, logWarningsForStatusCodes: number[], respondWith404: boolean, bubbleError: boolean, exposeErrors?: boolean) => void;
+export declare const handleHTTPError: (e: any, http: PikkuHTTP | undefined, traceId: string | undefined, logger: Logger, logWarningsForStatusCodes: number[], respondWith404: boolean, bubbleError: boolean, exposeErrors?: boolean) => void;

package/dist/handle-error.js

@@ -6,13 +6,13 @@ import { NotFoundError } from './errors/errors.js';
  *
  * @param {any} e - The error that occurred
  * @param {PikkuHTTP | undefined} http - HTTP wire object
- * @param {string} trackerId - Unique ID for tracking this error
+ * @param {string} traceId - Unique ID for tracking this error
  * @param {Logger} logger - Logger service
  * @param {number[]} logWarningsForStatusCodes - HTTP status codes to log as warnings
  * @param {boolean} respondWith404 - Whether to respond with 404 for NotFoundError
  * @param {boolean} bubbleError - Whether to throw the error after handling
  */
-export const handleHTTPError = (e, http, trackerId, logger, logWarningsForStatusCodes, respondWith404, bubbleError, exposeErrors = false) => {
+export const handleHTTPError = (e, http, traceId, logger, logWarningsForStatusCodes, respondWith404, bubbleError, exposeErrors = false) => {
     // Skip 404 handling if configured to do so
     if (e instanceof NotFoundError && !respondWith404) {
         return;
@@ -25,12 +25,12 @@ export const handleHTTPError = (e, http, trackerId, logger, logWarningsForStatus
         http?.response?.json({
             message: errorResponse.message,
             payload: e.payload,
-            traceId: trackerId,
+            errorId: traceId,
         });
         // Log certain status codes as warnings
         if (logWarningsForStatusCodes.includes(errorResponse.status)) {
-            if (trackerId) {
-                logger.warn(`Warning id: ${trackerId}`);
+            if (traceId) {
+                logger.warn(`Warning id: ${traceId}`);
             }
             logger.warn(e instanceof Error ? e.message : e);
         }
@@ -39,9 +39,9 @@ export const handleHTTPError = (e, http, trackerId, logger, logWarningsForStatus
         // Handle unexpected errors
         logger.error(e instanceof Error ? e.message : e);
         http?.response?.status(500);
-        if (trackerId) {
-            logger.warn(`Error id: ${trackerId}`);
-            const errorBody = { errorId: trackerId };
+        if (traceId) {
+            logger.warn(`Error id: ${traceId}`);
+            const errorBody = { errorId: traceId };
             if (exposeErrors && !isProduction() && e instanceof Error) {
                 errorBody.message = e.message;
                 errorBody.stack = e.stack;

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 /**
  * @module @pikku/core
  */
-export type { CommonWireMeta, CoreConfig, CorePikkuMiddleware, CorePikkuMiddlewareConfig, CorePikkuMiddlewareFactory, CorePikkuMiddlewareGroup, CoreServices, CoreSingletonServices, CoreUserSession, CreateConfig, FunctionMeta, FunctionRuntimeMeta, FunctionServicesMeta, FunctionWiresMeta, FunctionsMeta, FunctionsRuntimeMeta, JSONPrimitive, JSONValue, MakeRequired, MiddlewareMetadata, PermissionMetadata, PickOptional, PickRequired, PikkuAIMiddlewareHooks, PikkuWire, PikkuWiringTypes, RequireAtLeastOne, SerializedError, WireServices, } from './types/core.types.js';
+export type { CommonWireMeta, CoreConfig, CorePikkuMiddleware, CorePikkuMiddlewareConfig, CorePikkuMiddlewareFactory, CorePikkuMiddlewareGroup, CoreServices, CoreSingletonServices, CoreUserSession, CreateConfig, FunctionMeta, FunctionRuntimeMeta, FunctionServicesMeta, FunctionWiresMeta, FunctionsMeta, FunctionsRuntimeMeta, JSONPrimitive, JSONValue, MakeRequired, MiddlewareMetadata, MiddlewarePriority, PermissionMetadata, PickOptional, PickRequired, PikkuAIMiddlewareHooks, PikkuWire, PikkuWiringTypes, RequireAtLeastOne, SerializedError, WireServices, } from './types/core.types.js';
 export { pikkuAIMiddleware, pikkuChannelMiddleware, pikkuChannelMiddlewareFactory, pikkuMiddleware, pikkuMiddlewareFactory, } from './types/core.types.js';
 export type { CorePikkuAuth, CorePikkuAuthConfig, CorePikkuFunction, CorePikkuFunctionConfig, CorePikkuPermission, CorePikkuPermissionConfig, CorePikkuPermissionFactory, CorePikkuApprovalDescription, CorePermissionGroup, ZodLike, } from './function/functions.types.js';
 export { pikkuAuth, pikkuPermission, pikkuPermissionFactory, pikkuApprovalDescription, } from './function/functions.types.js';
@@ -36,12 +36,11 @@ export type { AIStorageService } from './services/ai-storage-service.js';
 export type { HTTPMethod } from './wirings/http/http.types.js';
 export type { GraphNodeConfig } from './wirings/workflow/graph/workflow-graph.types.js';
 export { createGraph } from './wirings/workflow/graph/graph-node.js';
-export { workflow as wireWorkflow } from './wirings/workflow/workflow-helpers.js';
 export { wireAddon } from './wirings/rpc/wire-addon.js';
 export type { WireAddonConfig } from './wirings/rpc/wire-addon.js';
 export type { PikkuPackageState } from './types/state.types.js';
 export { runMiddleware, addMiddleware } from './middleware-runner.js';
-export { addPermission } from './permissions.js';
+export { addPermission, checkAuthPermissions } from './permissions.js';
 export { isSerializable, stopSingletonServices } from './utils.js';
 export { getSingletonServices, getCreateWireServices } from './pikku-state.js';
 export { type ScheduledTaskInfo, type ScheduledTaskSummary, } from './services/scheduler-service.js';

package/dist/index.js

@@ -12,10 +12,9 @@ export { runQueueJob } from './wirings/queue/queue-runner.js';
 export { runScheduledTask } from './wirings/scheduler/scheduler-runner.js';
 export { NotFoundError } from './errors/errors.js';
 export { createGraph } from './wirings/workflow/graph/graph-node.js';
-export { workflow as wireWorkflow } from './wirings/workflow/workflow-helpers.js';
 export { wireAddon } from './wirings/rpc/wire-addon.js';
 export { runMiddleware, addMiddleware } from './middleware-runner.js';
-export { addPermission } from './permissions.js';
+export { addPermission, checkAuthPermissions } from './permissions.js';
 export { isSerializable, stopSingletonServices } from './utils.js';
 export { getSingletonServices, getCreateWireServices } from './pikku-state.js';
 export { SchedulerService } from './services/scheduler-service.js';

package/dist/middleware/index.d.ts

@@ -3,3 +3,6 @@ export { authCookie } from './auth-cookie.js';
 export { authBearer } from './auth-bearer.js';
 export { pikkuRemoteAuthMiddleware } from './remote-auth.js';
 export { cors } from './cors.js';
+export { telemetryOuter, telemetryInner } from './telemetry.js';
+export { addMiddleware, runMiddleware } from '../middleware-runner.js';
+export { addPermission } from '../permissions.js';

package/dist/middleware/index.js

@@ -3,3 +3,6 @@ export { authCookie } from './auth-cookie.js';
 export { authBearer } from './auth-bearer.js';
 export { pikkuRemoteAuthMiddleware } from './remote-auth.js';
 export { cors } from './cors.js';
+export { telemetryOuter, telemetryInner } from './telemetry.js';
+export { addMiddleware, runMiddleware } from '../middleware-runner.js';
+export { addPermission } from '../permissions.js';

package/dist/middleware/remote-auth.js

@@ -10,6 +10,9 @@ export const pikkuRemoteAuthMiddleware = pikkuMiddleware(async ({ secrets, jwt }
         secret = await secrets.getSecret('PIKKU_REMOTE_SECRET');
     }
     catch {
+        if (http.request.path().startsWith('/remote/rpc/')) {
+            throw new UnauthorizedError();
+        }
         return next();
     }
     if (!jwt) {
@@ -34,8 +37,8 @@ export const pikkuRemoteAuthMiddleware = pikkuMiddleware(async ({ secrets, jwt }
     if (payload?.aud !== 'pikku-remote') {
         throw new UnauthorizedError();
     }
-    if (payload?.fn && http.request.path().startsWith('/rpc/')) {
-        const fn = decodeURIComponent(http.request.path().slice('/rpc/'.length));
+    if (payload?.fn && http.request.path().startsWith('/remote/rpc/')) {
+        const fn = decodeURIComponent(http.request.path().slice('/remote/rpc/'.length));
         if (fn && payload.fn !== fn) {
             throw new UnauthorizedError();
         }

package/dist/middleware/telemetry.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Outer telemetry middleware that captures total request duration and outcome.
+ * Runs at `highest` priority (outermost in the middleware chain).
+ *
+ * Emits a structured JSON log entry with `__pikku_telemetry: 'end'` containing:
+ * - Total duration (including all middleware)
+ * - Outcome (ok/error)
+ * - Wire metadata (wireType, wireId, traceId)
+ * - HTTP details (method, path, status) if applicable
+ *
+ * @example
+ * ```typescript
+ * import { telemetryOuter } from '@pikku/core/middleware'
+ * addMiddleware('myTag', [telemetryOuter()])
+ * ```
+ */
+export declare const telemetryOuter: import("../types/core.types.js").CorePikkuMiddlewareFactory<void | {
+    environmentId?: string;
+    orgId?: string;
+}, import("../types/core.types.js").CoreSingletonServices<{
+    logLevel?: import("../services/logger.js").LogLevel;
+    secrets?: {};
+    workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
+}>, import("../types/core.types.js").CoreUserSession>;
+/**
+ * Inner telemetry middleware that captures function execution duration and user context.
+ * Runs at `lowest` priority (innermost, closest to the function).
+ *
+ * Emits a structured JSON log entry with `__pikku_telemetry: 'end'` containing:
+ * - Function-only duration (excluding outer middleware like auth)
+ * - User identity (pikkuUserId) if authenticated
+ * - Wire metadata (wireType, wireId, traceId)
+ *
+ * @example
+ * ```typescript
+ * import { telemetryInner } from '@pikku/core/middleware'
+ * addMiddleware('myTag', [telemetryInner()])
+ * ```
+ */
+export declare const telemetryInner: import("../types/core.types.js").CorePikkuMiddlewareFactory<void | {
+    environmentId?: string;
+    orgId?: string;
+}, import("../types/core.types.js").CoreSingletonServices<{
+    logLevel?: import("../services/logger.js").LogLevel;
+    secrets?: {};
+    workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
+}>, import("../types/core.types.js").CoreUserSession>;

package/dist/middleware/telemetry.js

@@ -0,0 +1,106 @@
+import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js';
+/**
+ * Outer telemetry middleware that captures total request duration and outcome.
+ * Runs at `highest` priority (outermost in the middleware chain).
+ *
+ * Emits a structured JSON log entry with `__pikku_telemetry: 'end'` containing:
+ * - Total duration (including all middleware)
+ * - Outcome (ok/error)
+ * - Wire metadata (wireType, wireId, traceId)
+ * - HTTP details (method, path, status) if applicable
+ *
+ * @example
+ * ```typescript
+ * import { telemetryOuter } from '@pikku/core/middleware'
+ * addMiddleware('myTag', [telemetryOuter()])
+ * ```
+ */
+export const telemetryOuter = pikkuMiddlewareFactory(({ environmentId, orgId } = {}) => {
+    return pikkuMiddleware({
+        name: 'telemetry-outer',
+        priority: 'highest',
+        func: async (services, wire, next) => {
+            const start = performance.now();
+            let outcome = 'ok';
+            let errorMessage;
+            try {
+                await next();
+            }
+            catch (e) {
+                outcome = 'error';
+                errorMessage = e instanceof Error ? e.message : String(e);
+                throw e;
+            }
+            finally {
+                services.logger.info({
+                    __pikku_telemetry: 'end',
+                    __pikku_layer: 'outer',
+                    traceId: wire.traceId,
+                    wireType: wire.wireType,
+                    wireId: wire.wireId,
+                    totalDuration: Math.round(performance.now() - start),
+                    outcome,
+                    ...(errorMessage ? { errorMessage } : {}),
+                    ...(wire.http
+                        ? {
+                            httpStatus: wire.http.response?.statusCode,
+                            httpMethod: wire.http.request?.method(),
+                            httpPath: wire.http.request?.path(),
+                        }
+                        : {}),
+                    ...(environmentId ? { environmentId } : {}),
+                    ...(orgId ? { orgId } : {}),
+                });
+            }
+        },
+    });
+});
+/**
+ * Inner telemetry middleware that captures function execution duration and user context.
+ * Runs at `lowest` priority (innermost, closest to the function).
+ *
+ * Emits a structured JSON log entry with `__pikku_telemetry: 'end'` containing:
+ * - Function-only duration (excluding outer middleware like auth)
+ * - User identity (pikkuUserId) if authenticated
+ * - Wire metadata (wireType, wireId, traceId)
+ *
+ * @example
+ * ```typescript
+ * import { telemetryInner } from '@pikku/core/middleware'
+ * addMiddleware('myTag', [telemetryInner()])
+ * ```
+ */
+export const telemetryInner = pikkuMiddlewareFactory(({ environmentId, orgId } = {}) => {
+    return pikkuMiddleware({
+        name: 'telemetry-inner',
+        priority: 'lowest',
+        func: async (services, wire, next) => {
+            const start = performance.now();
+            let outcome = 'ok';
+            let errorMessage;
+            try {
+                await next();
+            }
+            catch (e) {
+                outcome = 'error';
+                errorMessage = e instanceof Error ? e.message : String(e);
+                throw e;
+            }
+            finally {
+                services.logger.info({
+                    __pikku_telemetry: 'end',
+                    __pikku_layer: 'inner',
+                    traceId: wire.traceId,
+                    wireType: wire.wireType,
+                    wireId: wire.wireId,
+                    functionDuration: Math.round(performance.now() - start),
+                    outcome,
+                    pikkuUserId: wire.pikkuUserId,
+                    ...(errorMessage ? { errorMessage } : {}),
+                    ...(environmentId ? { environmentId } : {}),
+                    ...(orgId ? { orgId } : {}),
+                });
+            }
+        },
+    });
+});

package/dist/middleware-runner.js

@@ -1,5 +1,19 @@
 import { pikkuState } from './pikku-state.js';
 import { freezeDedupe, getTagGroups } from './utils.js';
+const PRIORITY_ORDER = {
+    highest: 0,
+    high: 1,
+    medium: 2,
+    low: 3,
+    lowest: 4,
+};
+const getMiddlewarePriority = (fn) => {
+    const priority = fn.__priority;
+    return PRIORITY_ORDER[priority ?? 'medium'];
+};
+const sortByPriority = (middlewares) => {
+    return middlewares.sort((a, b) => getMiddlewarePriority(a) - getMiddlewarePriority(b));
+};
 /**
  * Runs a chain of middleware functions in sequence before executing the main function.
  *
@@ -18,11 +32,14 @@ import { freezeDedupe, getTagGroups } from './utils.js';
  * );
  */
 export const runMiddleware = async (services, wire, middlewares, main) => {
-    // Deduplicate middleware using Set to avoid running the same middleware multiple times
+    // Sort by priority if not already sorted (cached middleware is pre-sorted)
+    const sorted = isSortedByPriority(middlewares)
+        ? middlewares
+        : [...middlewares].sort((a, b) => getMiddlewarePriority(a) - getMiddlewarePriority(b));
     let result;
     const dispatch = async (index) => {
-        if (middlewares && index < middlewares.length) {
-            return await middlewares[index](services, wire, () => dispatch(index + 1));
+        if (sorted && index < sorted.length) {
+            return await sorted[index](services, wire, () => dispatch(index + 1));
         }
         else if (main) {
             result = await main();
@@ -31,6 +48,15 @@ export const runMiddleware = async (services, wire, middlewares, main) => {
     await dispatch(0);
     return result;
 };
+const isSortedByPriority = (middlewares) => {
+    for (let i = 1; i < middlewares.length; i++) {
+        if (getMiddlewarePriority(middlewares[i]) <
+            getMiddlewarePriority(middlewares[i - 1])) {
+            return false;
+        }
+    }
+    return true;
+};
 /**
  * Registers global middleware for a specific tag.
  *
@@ -176,7 +202,8 @@ export const combineMiddleware = (wireType, uid, { wireInheritedMiddleware, wire
     if (funcMiddleware) {
         resolved.push(...funcMiddleware);
     }
-    // Deduplicate and freeze
+    // Sort by priority, deduplicate, and freeze
+    sortByPriority(resolved);
     middlewareCache[wireType][uid] = freezeDedupe(resolved);
     return middlewareCache[wireType][uid];
 };

package/dist/permissions.d.ts

@@ -1,4 +1,4 @@
-import type { CoreServices, PikkuWiringTypes, PermissionMetadata, PikkuWire } from './types/core.types.js';
+import type { CoreServices, CoreUserSession, PikkuWiringTypes, PermissionMetadata, PikkuWire } from './types/core.types.js';
 import type { CorePermissionGroup, CorePikkuPermission } from './function/functions.types.js';
 /**
  * Adds global permissions for a specific tag.
@@ -44,3 +44,15 @@ export declare const runPermissions: (wireType: PikkuWiringTypes, uid: string, {
     data: any;
     packageName?: string | null;
 }) => Promise<void>;
+/**
+ * Checks whether a session passes the auth checks (pikkuAuth only) for a
+ * given function/agent. Skips pikkuPermission checks since those require
+ * request data which isn't available at filter time.
+ *
+ * @param funcPermissions - The PermissionMetadata[] from function or agent metadata
+ * @param session - The user's session
+ * @param services - Singleton services
+ * @param packageName - Optional package namespace
+ * @returns true if the session passes all auth checks (or no auth checks exist)
+ */
+export declare const checkAuthPermissions: (funcPermissions: PermissionMetadata[] | undefined, session: CoreUserSession, services: CoreServices, packageName?: string | null) => Promise<boolean>;

package/dist/permissions.js

@@ -234,3 +234,54 @@ export const runPermissions = async (wireType, uid, { wireInheritedPermissions,
         throw new ForbiddenError('Permission denied');
     }
 };
+/**
+ * Checks whether a session passes the auth checks (pikkuAuth only) for a
+ * given function/agent. Skips pikkuPermission checks since those require
+ * request data which isn't available at filter time.
+ *
+ * @param funcPermissions - The PermissionMetadata[] from function or agent metadata
+ * @param session - The user's session
+ * @param services - Singleton services
+ * @param packageName - Optional package namespace
+ * @returns true if the session passes all auth checks (or no auth checks exist)
+ */
+export const checkAuthPermissions = async (funcPermissions, session, services, packageName = null) => {
+    if (!funcPermissions?.length)
+        return true;
+    const allPermissions = combinePermissions('agent', `authcheck:${Math.random()}`, {
+        funcInheritedPermissions: funcPermissions,
+        packageName,
+    });
+    if (allPermissions.length === 0)
+        return true;
+    const wire = { session };
+    // Extract only pikkuAuth permissions (marked with __pikkuAuth)
+    const authPerms = [];
+    for (const permission of allPermissions) {
+        if (typeof permission === 'function') {
+            if (permission.__pikkuAuth) {
+                authPerms.push(permission);
+            }
+        }
+        else if (permission && typeof permission === 'object') {
+            for (const funcs of Object.values(permission)) {
+                const arr = Array.isArray(funcs) ? funcs : [funcs];
+                for (const fn of arr) {
+                    if (typeof fn === 'function' && fn.__pikkuAuth) {
+                        authPerms.push(fn);
+                    }
+                }
+            }
+        }
+    }
+    // No auth permissions = allowed (only data-dependent permissions exist)
+    if (authPerms.length === 0)
+        return true;
+    // All auth permissions must pass
+    for (const perm of authPerms) {
+        const result = await perm(services, null, wire);
+        if (result)
+            return true;
+    }
+    return false;
+};

package/dist/pikku-state.d.ts

@@ -23,7 +23,6 @@ export declare const pikkuState: <Type extends keyof PikkuPackageState, Content
  */
 export declare const initializePikkuState: (packageName: string) => void;
 export declare const resetPikkuState: () => void;
-export declare const getPikkuMetaDir: (packageName?: string | null) => string | null;
 export declare const getSingletonServices: () => CoreSingletonServices;
 export declare const getCreateWireServices: () => CreateWireServices | undefined;
 /**

package/dist/pikku-state.js

@@ -126,8 +126,8 @@ const createEmptyPackageState = () => ({
     package: {
         factories: null,
         singletonServices: null,
-        metaDir: null,
         credentialsMeta: null,
+        requiredParentServices: null,
     },
 });
 /**
@@ -152,9 +152,6 @@ export const resetPikkuState = () => {
 if (!getAllPackageStates().has('__main__')) {
     resetPikkuState();
 }
-export const getPikkuMetaDir = (packageName) => {
-    return pikkuState(packageName ?? null, 'package', 'metaDir');
-};
 export const getSingletonServices = () => {
     const services = pikkuState(null, 'package', 'singletonServices');
     if (!services)

package/dist/remote.d.ts

@@ -0,0 +1,10 @@
+import type { JWTService } from './services/jwt-service.js';
+import type { SecretService } from './services/secret-service.js';
+/**
+ * Build Authorization headers with JWT-signed session and traceId for
+ * pikkuRemoteAuthMiddleware on the receiving end.
+ *
+ * Used by all deployment services (Kysely, Redis, MongoDB, Lambda, CF, Azure)
+ * regardless of transport (HTTP, Lambda Invoke, service bindings).
+ */
+export declare function buildRemoteHeaders(jwt: JWTService | undefined, secrets: SecretService | undefined, funcName: string, session?: unknown, traceId?: string): Promise<Record<string, string>>;

package/dist/remote.js

@@ -0,0 +1,32 @@
+import { encryptJSON } from './crypto-utils.js';
+/**
+ * Build Authorization headers with JWT-signed session and traceId for
+ * pikkuRemoteAuthMiddleware on the receiving end.
+ *
+ * Used by all deployment services (Kysely, Redis, MongoDB, Lambda, CF, Azure)
+ * regardless of transport (HTTP, Lambda Invoke, service bindings).
+ */
+export async function buildRemoteHeaders(jwt, secrets, funcName, session, traceId) {
+    const headers = {
+        'content-type': 'application/json',
+        ...(traceId && { 'x-request-id': traceId }),
+    };
+    let secret;
+    try {
+        secret = await secrets?.getSecret('PIKKU_REMOTE_SECRET');
+    }
+    catch { }
+    if (secret && jwt) {
+        const sessionEnc = session
+            ? await encryptJSON(secret, { session })
+            : undefined;
+        const token = await jwt.encode({ value: 5, unit: 'minute' }, {
+            aud: 'pikku-remote',
+            fn: funcName,
+            iat: Math.floor(Date.now() / 1000),
+            session: sessionEnc,
+        });
+        headers.authorization = `Bearer ${token}`;
+    }
+    return headers;
+}

package/dist/schema.js

@@ -67,6 +67,8 @@ const validateAllSchemasLoaded = (logger, schemaService) => {
 };
 export const coerceTopLevelDataFromSchema = (schemaName, data, packageName = null) => {
     const schema = pikkuState(packageName, 'misc', 'schemas').get(schemaName);
+    if (!schema?.properties)
+        return;
     for (const key in schema.properties) {
         const property = schema.properties[key];
         if (typeof property === 'boolean') {

package/dist/services/deployment-service.d.ts

@@ -15,5 +15,16 @@ export interface DeploymentService {
     init(): Promise<void>;
     start(config: DeploymentConfig): Promise<void>;
     stop(): Promise<void>;
-    findFunction(name: string): Promise<DeploymentInfo[]>;
+    /**
+     * Dispatch a remote RPC call to a function.
+     * The deployment service owns the full transport:
+     * - Resolving the target (endpoint, service binding, etc.)
+     * - Session propagation (JWT signing, headers)
+     * - The actual network call
+     *
+     * @param funcName - The function to invoke
+     * @param data - Input data for the function
+     * @param session - User session to propagate (optional)
+     */
+    invoke(funcName: string, data: unknown, session?: unknown, traceId?: string): Promise<unknown>;
 }

package/dist/services/in-memory-queue-service.d.ts

@@ -0,0 +1,7 @@
+import type { QueueService, JobOptions } from '../wirings/queue/queue.types.js';
+export declare class InMemoryQueueService implements QueueService {
+    readonly supportsResults = false;
+    private jobCounter;
+    add<T>(queueName: string, data: T, options?: JobOptions): Promise<string>;
+    getJob(): Promise<null>;
+}