@pikku/core 0.12.22 → 0.12.24

package/dist/services/meta-service.d.ts

@@ -86,6 +86,34 @@ export interface PermissionsGroupsMeta {
     httpGroups: Record<string, GroupMeta>;
     tagGroups: Record<string, GroupMeta>;
 }
+export interface EmailTemplateLocaleMeta {
+    contentHash: string;
+    htmlHash: string;
+    subjectHash: string;
+    textHash: string;
+}
+export interface EmailTemplateMeta {
+    variables: string[];
+    hasHtml: boolean;
+    hasSubject: boolean;
+    hasText: boolean;
+    locales: Record<string, EmailTemplateLocaleMeta>;
+}
+export interface EmailsMeta {
+    src: string;
+    themeHash: string;
+    templates: Record<string, EmailTemplateMeta>;
+}
+export interface EmailTemplateAssets {
+    theme: Record<string, unknown>;
+    strings: Record<string, unknown>;
+    layout: string;
+    partials: Record<string, string>;
+    html: string;
+    subject: string;
+    text: string;
+    missing: string[];
+}
 /**
  * Abstraction over .pikku metadata file access.
  * All paths are relative to the .pikku root directory.
@@ -100,6 +128,8 @@ export interface MetaService {
     readFile(relativePath: string): Promise<string | null>;
     /** List files in a directory by relative path. Returns empty array if not found. */
     readDir(relativePath: string): Promise<string[]>;
+    /** Read a project source file relative to the project root (one level above .pikku). */
+    readProjectFile(relativePath: string): Promise<string | null>;
     getHttpMeta(): Promise<HTTPWiringsMeta>;
     getChannelsMeta(): Promise<ChannelsMeta>;
     getSchedulerMeta(): Promise<ScheduledTasksMeta>;
@@ -117,6 +147,8 @@ export interface MetaService {
     getSecretsMeta(): Promise<SecretDefinitionsMeta>;
     getCredentialsMeta(): Promise<CredentialDefinitionsMeta>;
     getVariablesMeta(): Promise<VariableDefinitionsMeta>;
+    getEmailMeta(): Promise<EmailsMeta>;
+    getEmailTemplateAssets(templateName: string, locale: string): Promise<EmailTemplateAssets>;
     getServicesMeta(): Promise<ServicesMetaRecord>;
     getSchema(schemaName: string): Promise<JSONSchema7 | null>;
     getSchemas(schemaNames: string[]): Promise<Record<string, JSONSchema7 | null>>;
@@ -143,6 +175,7 @@ export declare class LocalMetaService implements MetaService {
     private secretsMetaCache;
     private credentialsMetaCache;
     private variablesMetaCache;
+    private emailMetaCache;
     private middlewareGroupsMetaCache;
     private permissionsGroupsMetaCache;
     private agentsMetaCache;
@@ -150,6 +183,7 @@ export declare class LocalMetaService implements MetaService {
     constructor(basePath: string);
     readFile(relativePath: string): Promise<string | null>;
     readDir(relativePath: string): Promise<string[]>;
+    readProjectFile(relativePath: string): Promise<string | null>;
     clearCache(): void;
     private readMetaJson;
     getHttpMeta(): Promise<HTTPWiringsMeta>;
@@ -169,6 +203,8 @@ export declare class LocalMetaService implements MetaService {
     getSecretsMeta(): Promise<SecretDefinitionsMeta>;
     getCredentialsMeta(): Promise<CredentialDefinitionsMeta>;
     getVariablesMeta(): Promise<VariableDefinitionsMeta>;
+    getEmailMeta(): Promise<EmailsMeta>;
+    getEmailTemplateAssets(templateName: string, locale: string): Promise<EmailTemplateAssets>;
     getServicesMeta(): Promise<ServicesMetaRecord>;
     getSchema(schemaName: string): Promise<JSONSchema7 | null>;
     getSchemas(schemaNames: string[]): Promise<Record<string, JSONSchema7 | null>>;

package/dist/services/meta-service.js

@@ -21,6 +21,7 @@ export class LocalMetaService {
     secretsMetaCache = null;
     credentialsMetaCache = null;
     variablesMetaCache = null;
+    emailMetaCache = null;
     middlewareGroupsMetaCache = null;
     permissionsGroupsMetaCache = null;
     agentsMetaCache = null;
@@ -44,6 +45,14 @@ export class LocalMetaService {
             return [];
         }
     }
+    async readProjectFile(relativePath) {
+        try {
+            return await readFile(join(this.basePath, '..', relativePath), 'utf-8');
+        }
+        catch {
+            return null;
+        }
+    }
     clearCache() {
         this.httpMetaCache = null;
         this.channelsMetaCache = null;
@@ -60,6 +69,7 @@ export class LocalMetaService {
         this.secretsMetaCache = null;
         this.credentialsMetaCache = null;
         this.variablesMetaCache = null;
+        this.emailMetaCache = null;
         this.middlewareGroupsMetaCache = null;
         this.permissionsGroupsMetaCache = null;
         this.agentsMetaCache = null;
@@ -257,6 +267,55 @@ export class LocalMetaService {
         this.variablesMetaCache = content ? JSON.parse(content) : {};
         return this.variablesMetaCache;
     }
+    async getEmailMeta() {
+        if (this.emailMetaCache)
+            return this.emailMetaCache;
+        const content = await this.readFile('email/pikku-emails-meta.gen.json');
+        this.emailMetaCache = content
+            ? JSON.parse(content)
+            : {
+                src: '',
+                themeHash: '',
+                templates: {},
+            };
+        return this.emailMetaCache;
+    }
+    async getEmailTemplateAssets(templateName, locale) {
+        const emailsMeta = await this.getEmailMeta();
+        if (!emailsMeta.src) {
+            throw new Error('No generated email metadata found. Run `pikku emails generate`.');
+        }
+        const baseDir = emailsMeta.src;
+        const [themeRaw, localeRaw, layoutRaw, footerRaw, templateHtml, templateSubject, templateText,] = await Promise.all([
+            this.readProjectFile(`${baseDir}/theme.json`),
+            this.readProjectFile(`${baseDir}/locales/${locale}.json`),
+            this.readProjectFile(`${baseDir}/partials/layout.html`),
+            this.readProjectFile(`${baseDir}/partials/footer.html`),
+            this.readProjectFile(`${baseDir}/templates/${templateName}.html`),
+            this.readProjectFile(`${baseDir}/templates/${templateName}.subject.txt`),
+            this.readProjectFile(`${baseDir}/templates/${templateName}.text.txt`),
+        ]);
+        return {
+            theme: themeRaw ? JSON.parse(themeRaw) : {},
+            strings: localeRaw
+                ? JSON.parse(localeRaw)
+                : {},
+            layout: layoutRaw ?? '',
+            partials: {
+                footer: footerRaw ?? '',
+            },
+            html: templateHtml ?? '',
+            subject: templateSubject ?? '',
+            text: templateText ?? '',
+            missing: [
+                ...(themeRaw ? [] : ['theme']),
+                ...(localeRaw ? [] : ['locale']),
+                ...(templateHtml ? [] : ['html']),
+                ...(templateSubject ? [] : ['subject']),
+                ...(templateText ? [] : ['text']),
+            ],
+        };
+    }
     async getServicesMeta() {
         if (this.servicesMetaCache)
             return this.servicesMetaCache;

package/dist/types/core.types.d.ts

@@ -25,8 +25,10 @@ import type { AgentRunService } from '../wirings/ai-agent/ai-agent.types.js';
 import type { PikkuAIMiddlewareHooks } from '../wirings/ai-agent/ai-agent.types.js';
 import type { WorkflowRunService } from '../wirings/workflow/workflow.types.js';
 import type { CredentialService } from '../services/credential-service.js';
+import type { EmailService } from '../services/email-service.js';
 import type { MetaService } from '../services/meta-service.js';
 import type { SessionStore } from '../services/session-store.js';
+import type { AuditDurability, AuditService } from '../services/audit-service.js';
 export type PikkuWiringTypes = 'http' | 'scheduler' | 'trigger' | 'channel' | 'rpc' | 'queue' | 'mcp' | 'cli' | 'workflow' | 'agent' | 'gateway';
 export interface FunctionServicesMeta {
     optimized: boolean;
@@ -143,6 +145,8 @@ export type CoreConfig<Config extends Record<string, unknown> = {}> = {
  * Represents a core user session, which can be extended for more specific session information.
  */
 export interface CoreUserSession {
+    userId?: string;
+    orgId?: string;
 }
 /**
  * Interface for core singleton services provided by Pikku.
@@ -184,8 +188,12 @@ export interface CoreSingletonServices<Config extends CoreConfig = CoreConfig> {
     workflowRunService?: WorkflowRunService;
     /** Credential service for dynamic/managed credentials (OAuth tokens, per-user API keys) */
     credentialService?: CredentialService;
+    /** Email service for outbound messages and template-backed delivery */
+    emailService?: EmailService;
     /** Meta service for reading .pikku metadata files (filesystem on Node, R2/KV on CF) */
     metaService?: MetaService;
+    /** Audit service for durable or staged audit event capture */
+    audit?: AuditService;
     /** Session store for persisting user sessions keyed by pikkuUserId */
     sessionStore?: SessionStore;
 }
@@ -197,6 +205,8 @@ export type PikkuWire<In = unknown, Out = unknown, HasInitialSession extends boo
     wireId: string;
     /** Trace ID for distributed tracing — propagated across remote RPC calls via x-trace-id header */
     traceId: string;
+    /** Function id for the current invocation */
+    functionId: string;
     http: PikkuHTTP<In>;
     mcp: PikkuMCP<MCPTools>;
     rpc: TypedRPC;
@@ -211,7 +221,7 @@ export type PikkuWire<In = unknown, Out = unknown, HasInitialSession extends boo
     gateway: PikkuGateway;
     session: HasInitialSession extends true ? UserSession : UserSession | undefined;
     /** Update and persist the current session */
-    setSession: (session: CoreUserSession) => Promise<void> | void;
+    setSession: (session: UserSession) => Promise<void> | void;
     /** Clear and persist the current session */
     clearSession: () => Promise<void> | void;
     /** Fetch the latest session (may read from backing store) */
@@ -226,6 +236,10 @@ export type PikkuWire<In = unknown, Out = unknown, HasInitialSession extends boo
     getCredential: <T = unknown>(name: string) => T | null | Promise<T | null>;
     /** Get all resolved credentials — lazy-loads from CredentialService on first call, sync thereafter */
     getCredentials: () => Record<string, unknown> | Promise<Record<string, unknown>>;
+    /** Resolved function audit metadata for this invocation, if enabled */
+    audit: {
+        durability: AuditDurability;
+    };
 }>;
 /**
  * A function that can wrap an wire and be called before or after

package/dist/wirings/ai-agent/ai-agent-prepare.d.ts

@@ -5,6 +5,8 @@ import { PikkuError } from '../../errors/error-handler.js';
 import type { SessionService } from '../../services/user-session-service.js';
 export type RunAIAgentParams = {
     sessionService?: SessionService<CoreUserSession>;
+    /** Credential accessor for the current request — used to read per-user overrides (e.g. AI_API_KEY). */
+    getCredential?: <T = unknown>(name: string) => T | null | Promise<T | null>;
 };
 export type StreamAIAgentOptions = {
     requiresToolApproval?: 'all' | 'explicit' | false;

package/dist/wirings/ai-agent/ai-agent-prepare.js

@@ -3,7 +3,7 @@ import { checkAuthPermissions } from '../../permissions.js';
 import { AIProviderNotConfiguredError } from '../../errors/errors.js';
 import { pikkuState, getSingletonServices } from '../../pikku-state.js';
 import { createMiddlewareSessionWireProps } from '../../services/user-session-service.js';
-import { randomUUID } from 'crypto';
+import { randomUUID } from './ai-agent-utils.js';
 import { streamAIAgent } from './ai-agent-stream.js';
 import { runAIAgent } from './ai-agent-runner.js';
 import { resolveNamespace, ContextAwareRPCService, } from '../../wirings/rpc/rpc-runner.js';
@@ -434,10 +434,16 @@ export async function buildToolDefs(params, agentSessionMap, resourceId, agentNa
 export async function prepareAgentRun(agentName, input, params, agentSessionMap, streamContext) {
     const singletonServices = getSingletonServices();
     const { agent, packageName, resolvedName } = resolveAgent(agentName);
-    const agentRunner = singletonServices.aiAgentRunner;
+    let agentRunner = singletonServices.aiAgentRunner;
     if (!agentRunner) {
         throw new AIProviderNotConfiguredError();
     }
+    if (params.getCredential && agentRunner.withApiKey) {
+        const aiCredential = await params.getCredential('AI_API_KEY');
+        if (aiCredential?.apiKey?.trim()) {
+            agentRunner = agentRunner.withApiKey(aiCredential.apiKey);
+        }
+    }
     const { storage } = resolveMemoryServices(agent, singletonServices);
     const memoryConfig = agent.memory;
     const threadId = input.threadId;

package/dist/wirings/ai-agent/ai-agent-runner.js

@@ -4,6 +4,7 @@ import { checkForApprovals, appendStepMessages } from './ai-agent-stream.js';
 import { pikkuState, getSingletonServices } from '../../pikku-state.js';
 import { resolveModelConfig } from './ai-agent-model-config.js';
 import { AIProviderNotConfiguredError } from '../../errors/errors.js';
+import { randomUUID } from './ai-agent-utils.js';
 function stripNulls(obj) {
     if (obj === null)
         return undefined;
@@ -19,7 +20,6 @@ function stripNulls(obj) {
     }
     return result;
 }
-import { randomUUID } from 'crypto';
 function extractStructuredAssistantOutput(object) {
     if (!object || typeof object !== 'object') {
         return { text: null, uiSpec: null };
@@ -33,6 +33,7 @@ function extractStructuredAssistantOutput(object) {
 export async function runAIAgent(agentName, input, params, agentSessionMap) {
     const sessionMap = agentSessionMap ?? new Map();
     const { agent, agentRunner, storage, memoryConfig, threadId, userMessage, runnerParams, maxSteps, missingRpcs, workingMemorySchemaName, } = await prepareAgentRun(agentName, input, params, sessionMap);
+    runnerParams.agentId = agentName;
     const singletonServices = getSingletonServices();
     const { aiRunState } = singletonServices;
     if (!aiRunState) {
@@ -417,6 +418,7 @@ async function continueAfterToolResultSync(run, agent, packageName, resolvedName
         outputSchema: meta?.outputSchema
             ? pikkuState(packageName, 'misc', 'schemas').get(meta.outputSchema)
             : undefined,
+        agentId: run.agentName,
     };
     try {
         const accumulatedSteps = [];

package/dist/wirings/ai-agent/ai-agent-stream.js

@@ -1,7 +1,7 @@
 import { pikkuState, getSingletonServices } from '../../pikku-state.js';
 import { AIProviderNotConfiguredError } from '../../errors/errors.js';
+import { randomUUID } from './ai-agent-utils.js';
 import { combineChannelMiddleware, wrapChannelWithMiddleware, } from '../channel/channel-middleware-runner.js';
-import { randomUUID } from 'crypto';
 import { resolveMemoryServices, loadContextMessages, trimMessages, getWorkingMemoryMiddleware, } from './ai-agent-memory.js';
 import { prepareAgentRun, resolveAgent, buildInstructions, buildToolDefs, createScopedChannel, ToolApprovalRequired, ToolCredentialRequired, } from './ai-agent-prepare.js';
 import { resolveModelConfig } from './ai-agent-model-config.js';
@@ -354,6 +354,7 @@ export async function streamAIAgent(agentName, input, channel, params, agentSess
     const streamContext = { channel, options };
     // delegateState is attached after prepareAgentRun resolves the agent config
     const { agent, packageName, resolvedName, agentRunner, storage, memoryConfig, threadId, userMessage, runnerParams, maxSteps, missingRpcs, workingMemorySchemaName, } = await prepareAgentRun(agentName, normalizedInput, params, sessionMap, streamContext);
+    runnerParams.agentId = agentName;
     const singletonServices = getSingletonServices();
     const { aiRunState } = singletonServices;
     if (!aiRunState) {

package/dist/wirings/ai-agent/ai-agent-utils.d.ts

@@ -0,0 +1 @@
+export declare const randomUUID: () => string;

package/dist/wirings/ai-agent/ai-agent-utils.js

@@ -0,0 +1 @@
+export const randomUUID = () => globalThis.crypto.randomUUID();

package/dist/wirings/rpc/rpc-runner.js

@@ -250,6 +250,7 @@ export class ContextAwareRPCService {
             run: async (agentName, input) => {
                 const result = await runAIAgent(agentName, input, {
                     sessionService: this.options.sessionService,
+                    getCredential: this.wire.getCredential?.bind(this.wire),
                 });
                 return {
                     runId: result.runId,
@@ -265,13 +266,19 @@ export class ContextAwareRPCService {
                 const channel = this.wire.channel;
                 if (!channel)
                     throw new Error('No channel available for streaming');
-                await streamAIAgent(agentName, input, channel, { sessionService: this.options.sessionService }, undefined, options);
+                await streamAIAgent(agentName, input, channel, {
+                    sessionService: this.options.sessionService,
+                    getCredential: this.wire.getCredential?.bind(this.wire),
+                }, undefined, options);
             },
             resume: async (runId, input, options) => {
                 const channel = this.wire.channel;
                 if (!channel)
                     throw new Error('No channel available for streaming');
-                await resumeAIAgent({ runId, ...input }, channel, { sessionService: this.options.sessionService }, options);
+                await resumeAIAgent({ runId, ...input }, channel, {
+                    sessionService: this.options.sessionService,
+                    getCredential: this.wire.getCredential?.bind(this.wire),
+                }, options);
             },
             approve: async (runId, approvals, expectedAgentName) => {
                 const result = await resumeAIAgentSync(runId, approvals, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/core",
-  "version": "0.12.22",
+  "version": "0.12.24",
   "author": "yasser.fadl@gmail.com",
   "license": "MIT",
   "module": "dist/index.js",

package/src/function/function-runner.test.ts

@@ -785,6 +785,55 @@ describe('runPikkuFunc - Integration Tests', () => {
     assert.deepEqual(receivedSession, { userId: 'user-1', loaded: true })
   })
 
+  test('should expose middleware-set session to createWireServices credential lookups', async () => {
+    let credentialLookups = 0
+    let receivedCredential: any
+    const sessionService = new PikkuSessionService<any>()
+
+    addTestFunction('credentialWire', {
+      middleware: [
+        async (_services: any, wire: any, next: any) => {
+          wire.setSession({ userId: 'user-1' })
+          await next()
+        },
+      ],
+      func: async (_services: any, _data: any, wire: any) => {
+        return wire.getSession()
+      },
+    })
+
+    await runPikkuFunc('rpc', Math.random().toString(), 'credentialWire', {
+      singletonServices: {
+        ...mockSingletonServices,
+        credentialService: {
+          getAll: async (userId: string) => {
+            credentialLookups++
+            assert.equal(userId, 'user-1')
+            return {
+              'user-oauth': { accessToken: 'token-1' },
+            }
+          },
+        },
+      } as any,
+      createWireServices: async (_services: any, wire: any) => {
+        receivedCredential = await wire.getCredential('user-oauth')
+        return {}
+      },
+      data: () => ({}),
+      auth: false,
+      wire: {
+        session: undefined,
+        setSession: (session: any) => sessionService.setInitial(session),
+        getSession: () => sessionService.get(),
+        hasSessionChanged: () => sessionService.sessionChanged,
+      } as any,
+      sessionService,
+    })
+
+    assert.equal(credentialLookups, 1)
+    assert.deepEqual(receivedCredential, { accessToken: 'token-1' })
+  })
+
   test('should pass addon-scoped singleton services and wrap bare workflow names', async () => {
     pikkuState(null, 'addons', 'packages').set('stripe', {
       package: '@addon/stripe',
@@ -969,6 +1018,212 @@ describe('runPikkuFunc - Integration Tests', () => {
     assert.equal(result, true)
     assert.ok(receivedWire.rpc)
   })
+
+  test('should expose resolved audit metadata on the wire for audited functions', async () => {
+    let receivedAudit: any
+
+    addTestFunction('auditedWire', {
+      audit: { durability: 'transactional' },
+      func: async (_services: any, _data: any, wire: any) => {
+        receivedAudit = wire.audit
+        return 'ok'
+      },
+    })
+
+    const result = await runPikkuFunc('rpc', 'wire-audit-on', 'auditedWire', {
+      singletonServices: mockSingletonServices,
+      data: () => ({}),
+      auth: false,
+      wire: {},
+    })
+
+    assert.equal(result, 'ok')
+    assert.deepEqual(receivedAudit, { durability: 'transactional' })
+  })
+
+  test('should leave wire audit metadata undefined when audit is disabled', async () => {
+    let receivedWire: any
+
+    addTestFunction('plainWire', {
+      func: async (_services: any, _data: any, wire: any) => {
+        receivedWire = wire
+        return 'ok'
+      },
+    })
+
+    const result = await runPikkuFunc('rpc', 'wire-audit-off', 'plainWire', {
+      singletonServices: mockSingletonServices,
+      data: () => ({}),
+      auth: false,
+      wire: {},
+    })
+
+    assert.equal(result, 'ok')
+    assert.equal(receivedWire.audit, undefined)
+  })
+
+  test('should restore parent audit metadata after nested non-audited calls', async () => {
+    let auditBeforeChild: any
+    let auditAfterChild: any
+
+    addTestFunction('childPlain', {
+      func: async () => 'child-ok',
+    })
+
+    addTestFunction('parentAudited', {
+      audit: true,
+      func: async (_services: any, _data: any, wire: any) => {
+        auditBeforeChild = wire.audit
+        await runPikkuFunc('rpc', 'nested-child-wire', 'childPlain', {
+          singletonServices: mockSingletonServices,
+          data: () => ({}),
+          auth: false,
+          wire,
+        })
+        auditAfterChild = wire.audit
+        return 'parent-ok'
+      },
+    })
+
+    const result = await runPikkuFunc(
+      'rpc',
+      'nested-parent-wire',
+      'parentAudited',
+      {
+        singletonServices: mockSingletonServices,
+        data: () => ({}),
+        auth: false,
+        wire: {},
+      }
+    )
+
+    assert.equal(result, 'parent-ok')
+    assert.deepEqual(auditBeforeChild, { durability: 'best-effort' })
+    assert.deepEqual(auditAfterChild, { durability: 'best-effort' })
+  })
+
+  test('should preserve parent audit metadata across rpc sub-calls to non-audited functions', async () => {
+    let parentAuditBeforeChild: any
+    let parentAuditAfterChild: any
+    let parentFunctionIdBeforeChild: any
+    let parentFunctionIdAfterChild: any
+    let childAudit: any
+    let childFunctionId: any
+
+    addTestFunction('rpcChildPlain', {
+      func: async (_services: any, _data: any, wire: any) => {
+        childAudit = wire.audit
+        childFunctionId = wire.functionId
+        return 'child-ok'
+      },
+    })
+
+    addTestFunction('rpcParentAudited', {
+      audit: true,
+      func: async (_services: any, _data: any, wire: any) => {
+        parentAuditBeforeChild = wire.audit
+        parentFunctionIdBeforeChild = wire.functionId
+        const childResult = await wire.rpc.invoke('rpcChildPlain', {})
+        parentAuditAfterChild = wire.audit
+        parentFunctionIdAfterChild = wire.functionId
+        return childResult
+      },
+    })
+
+    const result = await runPikkuFunc(
+      'rpc',
+      'rpc-parent-wire',
+      'rpcParentAudited',
+      {
+        singletonServices: mockSingletonServices,
+        data: () => ({}),
+        auth: false,
+        wire: {},
+      }
+    )
+
+    assert.equal(result, 'child-ok')
+    assert.deepEqual(parentAuditBeforeChild, { durability: 'best-effort' })
+    assert.deepEqual(parentAuditAfterChild, { durability: 'best-effort' })
+    assert.equal(parentFunctionIdBeforeChild, 'rpcParentAudited')
+    assert.equal(parentFunctionIdAfterChild, 'rpcParentAudited')
+    assert.equal(childAudit, undefined)
+    assert.equal(childFunctionId, 'rpcChildPlain')
+  })
+
+  test('should bind audited rpc sub-calls to the child invocation context', async () => {
+    let parentAuditBeforeChild: any
+    let parentAuditAfterChild: any
+    let parentFunctionIdAfterChild: any
+    let childAudit: any
+    let childFunctionId: any
+
+    addTestFunction('rpcChildAudited', {
+      audit: { durability: 'transactional' },
+      func: async (_services: any, _data: any, wire: any) => {
+        childAudit = wire.audit
+        childFunctionId = wire.functionId
+        return 'child-audited-ok'
+      },
+    })
+
+    addTestFunction('rpcParentAuditedChild', {
+      audit: true,
+      func: async (_services: any, _data: any, wire: any) => {
+        parentAuditBeforeChild = wire.audit
+        const childResult = await wire.rpc.invoke('rpcChildAudited', {})
+        parentAuditAfterChild = wire.audit
+        parentFunctionIdAfterChild = wire.functionId
+        return childResult
+      },
+    })
+
+    const result = await runPikkuFunc(
+      'rpc',
+      'rpc-parent-child-audit-wire',
+      'rpcParentAuditedChild',
+      {
+        singletonServices: mockSingletonServices,
+        data: () => ({}),
+        auth: false,
+        wire: {},
+      }
+    )
+
+    assert.equal(result, 'child-audited-ok')
+    assert.deepEqual(parentAuditBeforeChild, { durability: 'best-effort' })
+    assert.deepEqual(parentAuditAfterChild, { durability: 'best-effort' })
+    assert.equal(parentFunctionIdAfterChild, 'rpcParentAuditedChild')
+    assert.deepEqual(childAudit, { durability: 'transactional' })
+    assert.equal(childFunctionId, 'rpcChildAudited')
+  })
+
+  test('should expose the resolved base function id after version fallback', async () => {
+    let receivedFunctionId: any
+
+    addTestFunction('versionedBase', {
+      audit: true,
+      func: async (_services: any, _data: any, wire: any) => {
+        receivedFunctionId = wire.functionId
+        return 'ok'
+      },
+    })
+
+    const result = await runPikkuFunc(
+      'rpc',
+      'wire-version-fallback',
+      'versionedBase@v2',
+      {
+        singletonServices: mockSingletonServices,
+        data: () => ({}),
+        auth: false,
+        wire: {},
+      }
+    )
+
+    assert.equal(result, 'ok')
+    assert.equal(receivedFunctionId, 'versionedBase')
+  })
 })
 
 describe('function-runner helpers', () => {