@pikku/core 0.12.26 → 0.12.28

package/CHANGELOG.md

@@ -1,3 +1,33 @@
+## 0.12.28
+
+### Patch Changes
+
+- 2cf67be: Add inline option to pikkuFunc/pikkuSessionlessFunc for workflow step dispatch
+
+  By default, workflow steps now run inline (no queue hop). Set inline: false on a function to force dispatch through the queue for that step.
+
+## 0.12.27
+
+### Patch Changes
+
+- 4b5c75b: feat(auth-js): wire OIDC config (issuer/tenantId) as variables, expand provider registry
+  - Move `issuer` and `tenantId` out of the secret blob for OIDC providers (auth0, okta, azure-ad, keycloak, cognito, microsoft-entra-id) — they are public config URLs, not secrets. Now registered via `wireVariable` and loaded at runtime via `services.variables.get()`.
+  - Expand provider registry from 13 to 31 providers: reddit, notion, instagram, zoom, figma, tiktok, threads, patreon, dropbox, bitbucket, hubspot, salesforce, atlassian, strava, keycloak, cognito, microsoft-entra-id added.
+  - `serialize-auth-gen` emits `wireVariable({...})` declarations and `services.variables.get()` calls in the generated factory for OIDC providers.
+  - Integration verifier exercises real `/auth/providers` endpoint with `LocalSecretService` + `LocalVariablesService`, including a spy test proving `services.variables.get('AUTH0_ISSUER')` is called at request time.
+
+- 4b5c75b: Add end-to-end data classification for SQLite and Postgres projects.
+
+  **Core (`@pikku/core`):** New `Private<T>` and `Secret<T>` intersection brands, `ClassificationManifest`, `ColumnClassification`, and `AnonymizeStrategy` types exported from `data-classification.ts`.
+
+  **CLI (`@pikku/cli`):**
+  - SQL comment annotations: `-- @public`, `-- @private[:strategy]`, `-- @secret[:strategy]` on `CREATE TABLE` columns and `ALTER TABLE ... ADD COLUMN` statements. Unannotated columns default to `private`.
+  - `pikku db migrate` now emits a `classification.gen.ts` manifest alongside `schema.d.ts`.
+  - New `pikku db audit` command — prints a per-column classification summary and warns on `private`/`secret` columns with no anonymize strategy.
+  - Postgres dialect support in `resolveDb`, `PostgresMigrationExecutor`, and `PostgresIntrospector`.
+
+  **Inspector (`@pikku/inspector`):** New PKU910 check — `findPiiPaths()` walks inferred function return types looking for `__pii__` brands (including inside `Array<T>`, `Record<K,V>`, and index signatures) and fails the build if a function exposes branded fields in its output.
+
 ## 0.12.26
 
 ### Patch Changes

package/dist/data-classification.d.ts

@@ -1,14 +1,18 @@
 export type Private<T> = T & {
-    readonly __pii__: 'private';
+    readonly __classification__: 'private';
+};
+export type Pii<T> = T & {
+    readonly __classification__: 'pii';
 };
 export type Secret<T> = T & {
-    readonly __pii__: 'secret';
+    readonly __classification__: 'secret';
 };
-export type Classification = 'public' | 'private' | 'secret';
+export type Classification = 'public' | 'private' | 'pii' | 'secret';
 export type AnonymizeStrategy = 'fake:email' | 'fake:name' | 'hash' | 'keep' | null;
 export interface ColumnClassification {
     classification: Classification;
     anonymize_strategy: AnonymizeStrategy;
+    description?: string;
 }
 export type ClassificationManifest = {
     version: 1;

package/dist/errors/error-handler.js

@@ -11,6 +11,7 @@ export class PikkuError extends Error {
     constructor(message = 'An error occurred') {
         super(message);
         Object.setPrototypeOf(this, new.target.prototype);
+        this.name = new.target.name;
     }
 }
 /**

package/dist/function/function-runner.d.ts

@@ -1,4 +1,4 @@
-import type { CoreServices, CoreUserSession, CorePikkuMiddleware, PikkuWiringTypes, PikkuWire, MiddlewareMetadata, PermissionMetadata, CoreSingletonServices, CreateWireServices } from '../types/core.types.js';
+import type { CoreUserSession, CorePikkuMiddleware, PikkuWiringTypes, PikkuWire, MiddlewareMetadata, PermissionMetadata, CoreSingletonServices, CreateWireServices } from '../types/core.types.js';
 import type { CorePikkuChannelMiddleware } from '../wirings/channel/channel.types.js';
 import type { CorePermissionGroup, CorePikkuFunctionConfig, CorePikkuPermission } from './functions.types.js';
 import type { SessionService } from '../services/user-session-service.js';
@@ -6,7 +6,6 @@ import { PikkuCredentialWireService } from '../services/credential-wire-service.
 export declare const addFunction: (funcName: string, funcConfig: CorePikkuFunctionConfig<any, any>, packageName?: string | null) => void;
 export declare const getFunctionNames: (packageName?: string | null) => string[];
 export declare const getAllFunctionNames: () => string[];
-export declare const runPikkuFuncDirectly: <In, Out>(funcName: string, allServices: CoreServices, wire: PikkuWire, data: In, userSession?: SessionService<CoreUserSession>, packageName?: string | null) => Promise<Out>;
 export declare const runPikkuFunc: <In = any, Out = any>(wireType: PikkuWiringTypes, wireId: string, funcName: string, { singletonServices, createWireServices, data, auth: wiringAuth, inheritedMiddleware, wireMiddleware, inheritedChannelMiddleware, wireChannelMiddleware, inheritedPermissions, wirePermissions, coerceDataFromSchema, tags, wire, sessionService, credentialWireService, packageName, }: {
     singletonServices: CoreSingletonServices;
     createWireServices?: CreateWireServices;

package/dist/function/function-runner.js

@@ -4,7 +4,7 @@ import { runPermissions } from '../permissions.js';
 import { pikkuState } from '../pikku-state.js';
 import { coerceTopLevelDataFromSchema, validateSchema } from '../schema.js';
 import { parseVersionedId } from '../version.js';
-import { PikkuSessionService, createFunctionSessionWireProps, } from '../services/user-session-service.js';
+import { PikkuSessionService } from '../services/user-session-service.js';
 import { ForbiddenError, ReadonlySessionError } from '../errors/errors.js';
 import { PikkuCredentialWireService, createWireServicesCredentialWireProps, } from '../services/credential-wire-service.js';
 import { defaultPikkuUserIdResolver } from '../services/pikku-user-id.js';
@@ -132,17 +132,6 @@ export const getAllFunctionNames = () => {
     }
     return functions;
 };
-export const runPikkuFuncDirectly = async (funcName, allServices, wire, data, userSession, packageName = null) => {
-    const funcConfig = pikkuState(packageName, 'function', 'functions').get(funcName);
-    if (!funcConfig) {
-        throw new Error(`Function not found: ${funcName}`);
-    }
-    const wireWithSession = {
-        ...wire,
-        ...(userSession && createFunctionSessionWireProps(userSession)),
-    };
-    return (await funcConfig.func(allServices, data, wireWithSession));
-};
 export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServices, createWireServices, data, auth: wiringAuth, inheritedMiddleware, wireMiddleware, inheritedChannelMiddleware, wireChannelMiddleware, inheritedPermissions, wirePermissions, coerceDataFromSchema, tags = [], wire, sessionService, credentialWireService, packageName = null, }) => {
     wire.wireType ??= wireType;
     wire.wireId ??= wireId;
@@ -230,7 +219,7 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
                 }
             }
         }
-        else if (funcMeta.sessionless === false) {
+        else {
             if (wiringAuth === false || funcConfig.auth === false) {
                 resolvedSingletonServices.logger.warn(`Function '${funcName}' requires a session but auth was explicitly disabled — use pikkuSessionlessFunc instead.`);
             }
@@ -238,15 +227,6 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
                 throw new ForbiddenError('Authentication required');
             }
         }
-        else {
-            // TODO: Remove after a couple of releases — backward compat for
-            // generated metadata that doesn't include the `sessionless` field yet.
-            if (wiringAuth === true || funcConfig.auth === true) {
-                if (!session) {
-                    throw new ForbiddenError('Authentication required');
-                }
-            }
-        }
         if (session?.readonly && !funcMeta.readonly) {
             throw new ReadonlySessionError();
         }

package/dist/function/functions.types.d.ts

@@ -149,6 +149,8 @@ export type CorePikkuFunctionConfig<PikkuFunction extends CorePikkuFunction<any,
     readonly?: boolean;
     deploy?: 'serverless' | 'server' | 'auto';
     approvalRequired?: boolean;
+    /** When false, workflow steps calling this function are dispatched via the queue instead of running inline. Defaults to true (inline). */
+    inline?: boolean;
     audit?: boolean | {
         durability?: 'best-effort' | 'transactional';
     };

package/dist/handle-error.js

@@ -23,6 +23,7 @@ export const handleHTTPError = (e, http, traceId, logger, logWarningsForStatusCo
         // Set status and response body
         http?.response?.status(errorResponse.status);
         http?.response?.json({
+            name: e instanceof Error ? e.name : undefined,
             message: e instanceof Error && e.message && e.message !== 'An error occurred'
                 ? e.message
                 : errorResponse.message,

package/dist/index.d.ts

@@ -47,7 +47,8 @@ export type { PikkuPackageState } from './types/state.types.js';
 export { runMiddleware, addTagMiddleware, addTagMiddleware as addMiddleware, addGlobalMiddleware, } from './middleware-runner.js';
 export { addTagPermission, addTagPermission as addPermission, addGlobalPermission, checkAuthPermissions, } from './permissions.js';
 export { isSerializable, stopSingletonServices } from './utils.js';
-export { getSingletonServices, getCreateWireServices } from './pikku-state.js';
+export { getSingletonServices, getCreateWireServices, setSingletonServices, } from './pikku-state.js';
+export { clearPikkuRuntimeState } from './test-utils.js';
 export { type ScheduledTaskInfo, type ScheduledTaskSummary, } from './services/scheduler-service.js';
 export { SchedulerService } from './services/scheduler-service.js';
-export type { Private, Secret, Classification, AnonymizeStrategy, ColumnClassification, ClassificationManifest, } from './data-classification.js';
+export type { Private, Pii, Secret, Classification, AnonymizeStrategy, ColumnClassification, ClassificationManifest, } from './data-classification.js';

package/dist/index.js

@@ -17,5 +17,6 @@ export { wireAddon } from './wirings/rpc/wire-addon.js';
 export { runMiddleware, addTagMiddleware, addTagMiddleware as addMiddleware, addGlobalMiddleware, } from './middleware-runner.js';
 export { addTagPermission, addTagPermission as addPermission, addGlobalPermission, checkAuthPermissions, } from './permissions.js';
 export { isSerializable, stopSingletonServices } from './utils.js';
-export { getSingletonServices, getCreateWireServices } from './pikku-state.js';
+export { getSingletonServices, getCreateWireServices, setSingletonServices, } from './pikku-state.js';
+export { clearPikkuRuntimeState } from './test-utils.js';
 export { SchedulerService } from './services/scheduler-service.js';

package/dist/pikku-state.d.ts

@@ -24,6 +24,7 @@ export declare const pikkuState: <Type extends keyof PikkuPackageState, Content
 export declare const initializePikkuState: (packageName: string) => void;
 export declare const resetPikkuState: () => void;
 export declare const getSingletonServices: () => CoreSingletonServices;
+export declare const setSingletonServices: (services: CoreSingletonServices) => void;
 export declare const getCreateWireServices: () => CreateWireServices | undefined;
 /**
  * Register service factories for an addon package.

package/dist/pikku-state.js

@@ -157,6 +157,9 @@ export const getSingletonServices = () => {
         throw new Error('Singleton services not initialized');
     return services;
 };
+export const setSingletonServices = (services) => {
+    pikkuState(null, 'package', 'singletonServices', services);
+};
 export const getCreateWireServices = () => {
     return pikkuState(null, 'package', 'factories')?.createWireServices;
 };

package/dist/services/gopass-secrets.d.ts

@@ -11,4 +11,5 @@ export declare class GopassSecretService implements SecretService {
     hasSecret(key: string): Promise<boolean>;
     setSecret(key: string, value: unknown): Promise<void>;
     deleteSecret(key: string): Promise<void>;
+    getSecrets(keys: string[]): Promise<Record<string, unknown>>;
 }

package/dist/services/gopass-secrets.js

@@ -64,4 +64,13 @@ export class GopassSecretService {
             // Ignore errors if secret doesn't exist
         }
     }
+    async getSecrets(keys) {
+        const results = await Promise.allSettled(keys.map((k) => this.getSecret(k)));
+        const out = {};
+        keys.forEach((key, i) => {
+            if (results[i].status === 'fulfilled')
+                out[key] = results[i].value;
+        });
+        return out;
+    }
 }

package/dist/services/local-secrets.d.ts

@@ -13,4 +13,5 @@ export declare class LocalSecretService implements SecretService {
     setSecret(key: string, value: unknown): Promise<void>;
     hasSecret(key: string): Promise<boolean>;
     deleteSecret(key: string): Promise<void>;
+    getSecrets(keys: string[]): Promise<Record<string, unknown>>;
 }

package/dist/services/local-secrets.js

@@ -41,4 +41,13 @@ export class LocalSecretService {
     async deleteSecret(key) {
         this.localSecrets.delete(key);
     }
+    async getSecrets(keys) {
+        const results = await Promise.allSettled(keys.map((k) => this.getSecret(k)));
+        const out = {};
+        keys.forEach((key, i) => {
+            if (results[i].status === 'fulfilled')
+                out[key] = results[i].value;
+        });
+        return out;
+    }
 }

package/dist/services/meta-service.js

@@ -285,15 +285,26 @@ export class LocalMetaService {
         if (!emailsMeta.src) {
             throw new Error('No generated email metadata found. Run `pikku emails generate`.');
         }
+        // emailsMeta.src is an absolute path resolved by the CLI at generation time.
+        // Read directly rather than through readProjectFile (which prepends the project
+        // root and produces a wrong compound path when baseDir is absolute).
         const baseDir = emailsMeta.src;
+        const readEmailFile = async (rel) => {
+            try {
+                return await readFile(join(baseDir, rel), 'utf-8');
+            }
+            catch {
+                return null;
+            }
+        };
         const [themeRaw, localeRaw, layoutRaw, footerRaw, templateHtml, templateSubject, templateText,] = await Promise.all([
-            this.readProjectFile(`${baseDir}/theme.json`),
-            this.readProjectFile(`${baseDir}/locales/${locale}.json`),
-            this.readProjectFile(`${baseDir}/partials/layout.html`),
-            this.readProjectFile(`${baseDir}/partials/footer.html`),
-            this.readProjectFile(`${baseDir}/templates/${templateName}.html`),
-            this.readProjectFile(`${baseDir}/templates/${templateName}.subject.txt`),
-            this.readProjectFile(`${baseDir}/templates/${templateName}.text.txt`),
+            readEmailFile('theme.json'),
+            readEmailFile(`locales/${locale}.json`),
+            readEmailFile('partials/layout.html'),
+            readEmailFile('partials/footer.html'),
+            readEmailFile(`templates/${templateName}.html`),
+            readEmailFile(`templates/${templateName}.subject.txt`),
+            readEmailFile(`templates/${templateName}.text.txt`),
         ]);
         return {
             theme: themeRaw ? JSON.parse(themeRaw) : {},

package/dist/services/scoped-secret-service.d.ts

@@ -12,4 +12,5 @@ export declare class ScopedSecretService implements SecretService {
     hasSecret(key: string): Promise<boolean>;
     setSecret(_key: string, _value: unknown): Promise<void>;
     deleteSecret(_key: string): Promise<void>;
+    getSecrets(keys: string[]): Promise<Record<string, unknown>>;
 }

package/dist/services/scoped-secret-service.js

@@ -28,4 +28,8 @@ export class ScopedSecretService {
     async deleteSecret(_key) {
         throw new Error('deleteSecret is not allowed in scoped secret service');
     }
+    async getSecrets(keys) {
+        const allowed = keys.filter((k) => this.allowedKeys.has(k));
+        return this.secrets.getSecrets(allowed);
+    }
 }

package/dist/services/secret-service.d.ts

@@ -28,4 +28,11 @@ export interface SecretService {
      * @returns A promise that resolves when the secret is deleted.
      */
     deleteSecret(key: string): Promise<void>;
+    /**
+     * Retrieves multiple secrets in a single batch operation.
+     * Returns a map of key → value for successfully fetched secrets; missing
+     * keys are omitted rather than throwing.
+     * @param keys - The keys of the secrets to retrieve.
+     */
+    getSecrets(keys: string[]): Promise<Record<string, unknown>>;
 }

package/dist/services/typed-secret-service.d.ts

@@ -24,6 +24,7 @@ export declare class TypedSecretService<TMap = Record<string, unknown>> implemen
     hasSecret(key: string): Promise<boolean>;
     setSecret<K extends string>(key: K, value: K extends keyof TMap ? TMap[K] : unknown): Promise<void>;
     deleteSecret(key: string): Promise<void>;
+    getSecrets(keys: string[]): Promise<Record<string, unknown>>;
     getAllStatus(): Promise<CredentialStatus[]>;
     getMissing(): Promise<CredentialStatus[]>;
 }

package/dist/services/typed-secret-service.js

@@ -17,6 +17,9 @@ export class TypedSecretService {
     async deleteSecret(key) {
         return this.secrets.deleteSecret(key);
     }
+    async getSecrets(keys) {
+        return this.secrets.getSecrets(keys);
+    }
     async getAllStatus() {
         const results = [];
         for (const [secretId, meta] of Object.entries(this.credentialsMeta)) {

package/dist/test-utils.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Clears all runtime caches between test scenarios without touching registered
+ * routes, functions, or middleware groups (which are set at module load time
+ * and must persist for the whole test run).
+ *
+ * Call this alongside your DB snapshot restore in your Before hook:
+ *
+ * ```typescript
+ * Before(async function() {
+ *   await restoreSnapshot()
+ *   clearPikkuRuntimeState()
+ *   setSingletonServices(bundle.services)
+ * })
+ * ```
+ *
+ * Only works when NODE_ENV === 'test'. Logs an error and returns otherwise.
+ */
+export declare const clearPikkuRuntimeState: () => void;

package/dist/test-utils.js

@@ -0,0 +1,33 @@
+import { getAllPackageStates } from './pikku-state.js';
+import { clearMiddlewareCache } from './middleware-runner.js';
+import { clearPermissionsCache } from './permissions.js';
+import { clearChannelMiddlewareCache } from './wirings/channel/channel-middleware-runner.js';
+/**
+ * Clears all runtime caches between test scenarios without touching registered
+ * routes, functions, or middleware groups (which are set at module load time
+ * and must persist for the whole test run).
+ *
+ * Call this alongside your DB snapshot restore in your Before hook:
+ *
+ * ```typescript
+ * Before(async function() {
+ *   await restoreSnapshot()
+ *   clearPikkuRuntimeState()
+ *   setSingletonServices(bundle.services)
+ * })
+ * ```
+ *
+ * Only works when NODE_ENV === 'test'. Logs an error and returns otherwise.
+ */
+export const clearPikkuRuntimeState = () => {
+    if (process.env.NODE_ENV !== 'test') {
+        console.error('[pikku] clearPikkuRuntimeState() must only be called in test environments. Ignoring.');
+        return;
+    }
+    clearMiddlewareCache();
+    clearPermissionsCache();
+    clearChannelMiddlewareCache();
+    for (const packageState of getAllPackageStates().values()) {
+        packageState.package.singletonServices = null;
+    }
+};

package/dist/types/core.types.d.ts

@@ -82,6 +82,8 @@ export type FunctionRuntimeMeta = {
     readonly?: boolean;
     deploy?: 'serverless' | 'server' | 'auto';
     sessionless?: boolean;
+    /** When false, workflow steps calling this function are dispatched via the queue. Defaults to true (inline). */
+    inline?: boolean;
     version?: number;
     approvalRequired?: boolean;
     approvalDescription?: string;

package/dist/wirings/channel/channel-common.js

@@ -1,5 +1,5 @@
 import { combineMiddleware, runMiddleware } from '../../middleware-runner.js';
-import { runPikkuFuncDirectly } from '../../function/function-runner.js';
+import { runPikkuFunc } from '../../function/function-runner.js';
 import { combineChannelMiddleware, wrapChannelWithMiddleware, } from './channel-middleware-runner.js';
 /**
  * Runs a channel lifecycle function (onConnect or onDisconnect) with proper middleware handling.
@@ -37,7 +37,14 @@ export const runChannelLifecycleWithMiddleware = async ({ channelConfig, meta, l
         wire = wrapChannelWithMiddleware(wire, services, allChannelMiddleware);
     }
     const runLifecycle = async () => {
-        return await runPikkuFuncDirectly(meta.pikkuFuncId, services, wire, data);
+        return await runPikkuFunc('channel', channelConfig.name, meta.pikkuFuncId, {
+            singletonServices: services,
+            data: () => data,
+            wire,
+            tags: meta.tags ?? [],
+            inheritedPermissions: meta.permissions,
+            packageName: meta.packageName ?? null,
+        });
     };
     if (allMiddleware.length > 0) {
         return await runMiddleware(services, wire, allMiddleware, runLifecycle);

package/dist/wirings/channel/local/local-channel-handler.d.ts

@@ -1,3 +1,4 @@
+import type { Logger } from '../../../services/logger.js';
 import type { BinaryData } from '../channel.types.js';
 import { PikkuAbstractChannelHandler } from '../pikku-abstract-channel-handler.js';
 export declare class PikkuLocalChannelHandler<OpeningData = unknown, Out = unknown> extends PikkuAbstractChannelHandler<OpeningData, Out> {
@@ -7,14 +8,16 @@ export declare class PikkuLocalChannelHandler<OpeningData = unknown, Out = unkno
     private closeCallbacks;
     private sendCallback?;
     private sendBinaryCallback?;
-    registerOnOpen(callback: () => void): void;
-    open(): void;
+    private logger?;
+    constructor(channelId: string, channelName: string, openingData: OpeningData, logger?: Logger);
+    registerOnOpen(callback: () => Promise<void> | void): void;
+    open(): Promise<void>;
     registerOnMessage(callback: (data: any) => Promise<unknown>): void;
     message(data: unknown): Promise<unknown>;
     registerOnBinaryMessage(callback: (data: BinaryData) => Promise<BinaryData | void> | BinaryData | void): void;
     binaryMessage(data: BinaryData): Promise<BinaryData | void>;
-    registerOnClose(callback: () => void): void;
-    close(): void;
+    registerOnClose(callback: () => Promise<void> | void): void;
+    close(): Promise<void>;
     registerOnSend(send: (message: Out) => void): void;
     send(message: Out, isBinary?: boolean): void;
     registerOnSendBinary(send: (data: BinaryData) => void): void;

package/dist/wirings/channel/local/local-channel-handler.js

@@ -6,13 +6,18 @@ export class PikkuLocalChannelHandler extends PikkuAbstractChannelHandler {
     closeCallbacks = [];
     sendCallback;
     sendBinaryCallback;
+    logger;
+    constructor(channelId, channelName, openingData, logger) {
+        super(channelId, channelName, openingData);
+        this.logger = logger;
+    }
     registerOnOpen(callback) {
         this.openCallBack = callback;
     }
-    open() {
+    async open() {
         this.getChannel().state = 'open';
         if (this.openCallBack) {
-            this.openCallBack();
+            await this.openCallBack();
         }
     }
     registerOnMessage(callback) {
@@ -30,13 +35,16 @@ export class PikkuLocalChannelHandler extends PikkuAbstractChannelHandler {
     registerOnClose(callback) {
         this.closeCallbacks.push(callback);
     }
-    close() {
+    async close() {
         if (this.getChannel().state === 'closed') {
             return;
         }
         super.close();
-        for (const cb of this.closeCallbacks) {
-            cb();
+        const results = await Promise.allSettled(this.closeCallbacks.map((cb) => cb()));
+        for (const result of results) {
+            if (result.status === 'rejected') {
+                this.logger?.error('Error in channel close callback:', result.reason);
+            }
         }
     }
     registerOnSend(send) {

package/dist/wirings/channel/local/local-channel-runner.js

@@ -59,7 +59,7 @@ export const runLocalChannel = async ({ channelId, request, response, route, ski
     }
     const main = async () => {
         try {
-            channelHandler = new PikkuLocalChannelHandler(channelId, channelConfig.name, openingData);
+            channelHandler = new PikkuLocalChannelHandler(channelId, channelConfig.name, openingData, singletonServices.logger);
             const channel = channelHandler.getChannel();
             const wire = {
                 channel,

package/dist/wirings/workflow/pikku-workflow-service.js

@@ -484,7 +484,16 @@ export class PikkuWorkflowService {
      *   through to the inline execution path.
      */
     async dispatchStep(runId, stepName, rpcName, data, stepOptions) {
-        if (this.isInline(runId) || !getSingletonServices()?.queueService) {
+        if (!getSingletonServices()?.queueService) {
+            return false;
+        }
+        // Functions default to inline execution. Only dispatch via queue when the
+        // function explicitly sets inline: false.
+        const functionsMeta = pikkuState(null, 'function', 'meta');
+        const rpcFuncId = pikkuState(null, 'rpc', 'meta')[rpcName];
+        const rpcMeta = typeof rpcFuncId === 'string' ? functionsMeta[rpcFuncId] : undefined;
+        const forceQueue = rpcMeta?.inline === false;
+        if (!forceQueue && this.isInline(runId)) {
             return false;
         }
         const retries = stepOptions?.retries ?? 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/core",
-  "version": "0.12.26",
+  "version": "0.12.28",
   "author": "yasser.fadl@gmail.com",
   "license": "MIT",
   "module": "dist/index.js",

package/src/data-classification.ts

@@ -1,12 +1,19 @@
-export type Private<T> = T & { readonly __pii__: 'private' }
-export type Secret<T> = T & { readonly __pii__: 'secret' }
+export type Private<T> = T & { readonly __classification__: 'private' }
+export type Pii<T> = T & { readonly __classification__: 'pii' }
+export type Secret<T> = T & { readonly __classification__: 'secret' }
 
-export type Classification = 'public' | 'private' | 'secret'
-export type AnonymizeStrategy = 'fake:email' | 'fake:name' | 'hash' | 'keep' | null
+export type Classification = 'public' | 'private' | 'pii' | 'secret'
+export type AnonymizeStrategy =
+  | 'fake:email'
+  | 'fake:name'
+  | 'hash'
+  | 'keep'
+  | null
 
 export interface ColumnClassification {
   classification: Classification
   anonymize_strategy: AnonymizeStrategy
+  description?: string
 }
 
 export type ClassificationManifest = {

package/src/dev/hot-reload.test.ts

@@ -308,6 +308,7 @@ describe('pikkuDevReloader', { concurrency: false }, () => {
       pikkuFuncId: 'hotTask',
       inputSchemaName: null,
       outputSchemaName: null,
+      sessionless: true,
     }
 
     addFunction('hotTask', {
@@ -375,6 +376,7 @@ describe('pikkuDevReloader', { concurrency: false }, () => {
       pikkuFuncId: 'queue_hot-queue',
       inputSchemaName: null,
       outputSchemaName: null,
+      sessionless: true,
     }
 
     addFunction('queue_hot-queue', {

package/src/errors/error-handler.ts

@@ -12,6 +12,7 @@ export class PikkuError extends Error {
   constructor(message: string = 'An error occurred') {
     super(message)
     Object.setPrototypeOf(this, new.target.prototype)
+    this.name = new.target.name
   }
 }
 

package/src/function/function-runner.test.ts

@@ -5,7 +5,6 @@ import {
   getAllFunctionNames,
   getFunctionNames,
   runPikkuFunc,
-  runPikkuFuncDirectly,
 } from './function-runner.js'
 import { addTagMiddleware, addTagPermission } from '../index.js'
 import { resetPikkuState, pikkuState } from '../pikku-state.js'
@@ -33,6 +32,7 @@ const addTestFunction = (funcName: string, funcConfig: any) => {
     pikkuFuncId: funcName,
     inputSchemaName: null,
     outputSchemaName: null,
+    sessionless: true,
     middleware,
     permissions,
   }
@@ -676,7 +676,7 @@ describe('runPikkuFunc - Integration Tests', () => {
     )
   })
 
-  test('should use backward-compatible auth checks when sessionless metadata is absent', async () => {
+  test('should require auth when sessionless metadata is absent (undefined defaults to session-required)', async () => {
     addTestFunction('legacyAuth', {
       func: async () => 'ok',
       auth: true,
@@ -1227,32 +1227,6 @@ describe('runPikkuFunc - Integration Tests', () => {
 })
 
 describe('function-runner helpers', () => {
-  test('runPikkuFuncDirectly should pass through the provided wire and session helpers', async () => {
-    let receivedWire: any
-    const sessionService = new PikkuSessionService({
-      get: async () => undefined,
-    } as any)
-
-    addTestFunction('directFunc', {
-      func: async (_services: any, _data: any, wire: any) => {
-        receivedWire = wire
-        return 'ok'
-      },
-    })
-
-    const result = await runPikkuFuncDirectly(
-      'directFunc',
-      mockServices,
-      { traceId: 'trace-1' },
-      { hello: 'world' },
-      sessionService
-    )
-
-    assert.equal(result, 'ok')
-    assert.equal(receivedWire.traceId, 'trace-1')
-    assert.equal(typeof receivedWire.getSession, 'function')
-  })
-
   test('getFunctionNames and getAllFunctionNames should include addon namespaces', () => {
     addTestFunction('rootFunc', { func: async () => 'ok' })
     pikkuState(null, 'addons', 'packages').set('stripe', {