@pikku/core 0.12.31 → 0.12.33

package/CHANGELOG.md

@@ -1,3 +1,104 @@
+## 0.12.33
+
+### Patch Changes
+
+- 5c67b7e: Add a dedicated `@pikku/core/services/temporary-file-service` export for the Node filesystem-backed temporary file service without routing it through the `services` barrel.
+- 1b22977: fix(workflow): propagate pikkuUserId and session to child workflow wires
+
+  When a workflow calls `workflow.do()` on a sub-workflow, the child wire was created
+  without `pikkuUserId`. This meant that `pikkuFunc` steps inside the child workflow
+  could not resolve a session — `resolveSession` had nothing to look up, causing
+  `ForbiddenError` for authenticated steps.
+
+  Two fixes:
+  - `childWire` now copies `pikkuUserId` from the parent RPC service's wire, so remote
+    queue workers can re-hydrate the session from the session store.
+  - `orchestrateWorkflow` now propagates `session` from the parent RPC wire into the
+    child workflow's execution wire, so inline execution gets the session directly
+    without an extra session-store round-trip.
+
+## 0.12.32
+
+### Patch Changes
+
+- a027a8e: feat: emit auth provider + plugin metadata as `auth-meta.gen.json` for the console SSO page
+
+  The enabled social providers and Better Auth plugins are now extracted statically
+  and written to a generated `auth-meta.gen.json`, replacing the runtime
+  `setAuthRegistry`/`getAuthRegistry` approach — so the console can show them without
+  evaluating the Better Auth factory.
+  - **inspector**: the `pikkuBetterAuth` inspector now reads the `plugins` array from
+    the `betterAuth({ ... })` config and records each plugin id (the callee name of
+    each `plugins: [organization(), bearer()]` entry) on the auth definition.
+  - **cli**: `pikku auth` (and `pikku all`) emit `auth/pikku-auth-meta.gen.json` (path
+    configurable via `authMetaJsonFile`) containing `basePath`, `hasCredentials`, the
+    enabled `providers` (`id` + `displayName` + `secretId`), and the enabled `plugins`
+    (`id` + `displayName`). The previous `setAuthRegistry(...)` runtime wiring is
+    removed from the generated `auth.gen.ts`.
+  - **better-auth**: exports a `PLUGIN_REGISTRY` and `pluginDisplayName(id)` helper so
+    plugin ids resolve to human-readable names.
+  - **core**: removes the unreleased `setAuthRegistry`/`getAuthRegistry` runtime auth
+    registry (now superseded by `auth-meta.gen.json`).
+  - **addon-console**: `getAuthProviders` reads `auth-meta.gen.json` and returns the
+    configured providers, plugins, and `hasCredentials` flag.
+  - **console**: the Auth Providers (SSO) page fetches `console:getAuthProviders` and
+    marks each provider configured/unconfigured, lists email+password credentials as a
+    provider, and shows the enabled Better Auth plugins.
+
+- a027a8e: fix: address Better Auth review findings (secret/variable batch typing, auth init, guards)
+  - **core**: `SecretService.getSecrets` / `VariablesService.getVariables` (and the
+    Local/Typed/Scoped/AWS implementations) now return `Partial<T>`, honestly
+    reflecting that missing keys are omitted at runtime rather than typing partial
+    data as fully populated. `ScopedSecretService.getSecrets` now throws on a
+    disallowed key instead of silently filtering it out.
+  - **cli**: the generated `services.auth()` thunk clears its memoised promise on
+    rejection, so a transient Better Auth/Kysely startup failure no longer
+    permanently poisons auth for the process lifetime.
+  - **inspector**: the `pikkuBetterAuth` export guard now requires an exported
+    `const` (rejects `export let`/`export var`), matching its error message.
+  - **console**: the Microsoft auth provider's `callbackId` is `microsoft` (the
+    Better Auth provider id) rather than `microsoft-entra-id`.
+
+- a027a8e: fix(core): compose repeated global middleware registrations instead of overwriting
+
+  `addHTTPMiddleware(pattern, …)` and `addTagMiddleware(tag, …)` stored the
+  middleware group with `groups[key] = middleware`, so a second registration for
+  the same pattern/tag silently replaced the first. With Better Auth, generated
+  `auth.gen.ts` registers `addHTTPMiddleware('*', [betterAuthSession()])`, which
+  clobbered an app's own `addHTTPMiddleware('*', [...])` global middleware (cors,
+  session, credential loading) and dropped it from every route.
+
+  Both now append to the existing group (matching `addGlobalMiddleware`, which
+  already appends), so generated auth middleware composes with user-registered
+  global middleware. The route meta lists each pattern once, so the combined
+  group is still applied a single time per request.
+
+- a027a8e: feat(auth): migrate auth integration from Auth.js to Better Auth
+
+  The auth integration is now built on [Better Auth](https://better-auth.com)
+  and ships as a single package, `@pikku/better-auth` (replacing the former
+  `@pikku/auth-js`). There is exactly one auth package now.
+  - `pikkuBetterAuth(async ({ secrets, variables }) => betterAuth({ ... }))` is the new
+    single entry point. The CLI inspects the `betterAuth(...)` call and generates:
+    - `auth.gen.ts` — a catch-all `${basePath}{/*splat}` HTTP route per method and
+      a global `betterAuthSession({ auth })` middleware that bridges the Better
+      Auth session into the Pikku wire session.
+    - `auth-secrets.gen.ts` — `wireSecret(BETTER_AUTH_SECRET)` plus a
+      `<PROVIDER>_OAUTH` secret for each configured social provider, and
+      `wireVariable` for non-secret provider config (e.g. `MICROSOFT_TENANT_ID`,
+      `COGNITO_DOMAIN`/`REGION`/`USER_POOL_ID`).
+    - `auth.types.ts` — a typed `pikkuBetterAuth` re-export.
+  - `add-auth` (inspector) walks into the `betterAuth(...)` options to discover the
+    configured providers and required secrets/variables.
+  - The auth secret is now auto-wired by codegen from `BETTER_AUTH_SECRET` — it no
+    longer needs to be registered as a JWT signing key in `services.ts`.
+
+  CLI fix included: scaffold files generated outside `srcDirectories` (e.g. an
+  `auth.gen.ts` under a project's `pikku/` dir) are now added to the inspector's
+  wiring files, so their routes and secret metadata are picked up. The generated
+  wiring imports Pikku types via a resolved relative path instead of a hardcoded
+  `#pikku` specifier, so templates without a `#pikku` import map type-check.
+
 ## 0.12.31
 
 ### Patch Changes

package/dist/function/function-runner.js

@@ -29,6 +29,11 @@ async function resolveSession(wire, singletonServices, sessionService) {
             sessionService?.setInitial(stored);
         }
     }
+    else {
+        // Session already present on wire (e.g. propagated from parent workflow).
+        // Seed the sessionService so freezeInitial() returns it instead of undefined.
+        sessionService?.setInitial(wire.session);
+    }
 }
 /**
  * Get or create singleton services for an addon package.

package/dist/middleware-runner.js

@@ -69,7 +69,10 @@ const isSortedByPriority = (middlewares) => {
  */
 export const addTagMiddleware = (tag, middleware, packageName = null) => {
     const tagGroups = pikkuState(packageName, 'middleware', 'tagGroup');
-    tagGroups[tag] = middleware;
+    const existing = tagGroups[tag];
+    tagGroups[tag] = existing
+        ? [...existing, ...middleware]
+        : middleware;
     return middleware;
 };
 /**

package/dist/pikku-state.js

@@ -125,6 +125,7 @@ const createEmptyPackageState = () => ({
     package: {
         factories: null,
         singletonServices: null,
+        authFactory: null,
         credentialsMeta: null,
         requiredParentServices: null,
     },

package/dist/services/gopass-secrets.d.ts

@@ -11,5 +11,5 @@ export declare class GopassSecretService implements SecretService {
     hasSecret(key: string): Promise<boolean>;
     setSecret(key: string, value: unknown): Promise<void>;
     deleteSecret(key: string): Promise<void>;
-    getSecrets(keys: string[]): Promise<Record<string, unknown>>;
+    getSecrets<T extends Record<string, unknown> = Record<string, unknown>>(keys: (keyof T & string)[]): Promise<Partial<T>>;
 }

package/dist/services/local-secrets.d.ts

@@ -13,5 +13,5 @@ export declare class LocalSecretService implements SecretService {
     setSecret(key: string, value: unknown): Promise<void>;
     hasSecret(key: string): Promise<boolean>;
     deleteSecret(key: string): Promise<void>;
-    getSecrets(keys: string[]): Promise<Record<string, unknown>>;
+    getSecrets<T extends Record<string, unknown> = Record<string, unknown>>(keys: (keyof T & string)[]): Promise<Partial<T>>;
 }

package/dist/services/local-variables.d.ts

@@ -3,6 +3,7 @@ export declare class LocalVariablesService implements VariablesService {
     private variables;
     constructor(variables?: Record<string, string | undefined>);
     getAll(): Record<string, string | undefined>;
+    getVariables<T extends Record<string, unknown> = Record<string, unknown>>(names: (keyof T & string)[]): Partial<T>;
     get<T = string>(name: string): T | undefined;
     set(name: string, value: unknown): void;
     has(name: string): boolean;

package/dist/services/local-variables.js

@@ -6,6 +6,15 @@ export class LocalVariablesService {
     getAll() {
         return this.variables || {};
     }
+    getVariables(names) {
+        const out = {};
+        for (const name of names) {
+            const value = this.get(name);
+            if (value !== undefined)
+                out[name] = value;
+        }
+        return out;
+    }
     get(name) {
         const raw = this.variables[name];
         if (raw === undefined)

package/dist/services/scoped-secret-service.d.ts

@@ -12,5 +12,5 @@ export declare class ScopedSecretService implements SecretService {
     hasSecret(key: string): Promise<boolean>;
     setSecret(_key: string, _value: unknown): Promise<void>;
     deleteSecret(_key: string): Promise<void>;
-    getSecrets(keys: string[]): Promise<Record<string, unknown>>;
+    getSecrets<T extends Record<string, unknown> = Record<string, unknown>>(keys: (keyof T & string)[]): Promise<Partial<T>>;
 }

package/dist/services/scoped-secret-service.js

@@ -29,7 +29,7 @@ export class ScopedSecretService {
         throw new Error('deleteSecret is not allowed in scoped secret service');
     }
     async getSecrets(keys) {
-        const allowed = keys.filter((k) => this.allowedKeys.has(k));
-        return this.secrets.getSecrets(allowed);
+        keys.forEach((k) => this.assertAllowed(k));
+        return this.secrets.getSecrets(keys);
     }
 }

package/dist/services/secret-service.d.ts

@@ -31,8 +31,12 @@ export interface SecretService {
     /**
      * Retrieves multiple secrets in a single batch operation.
      * Returns a map of key → value for successfully fetched secrets; missing
-     * keys are omitted rather than throwing.
+     * keys are omitted rather than throwing, so the result is typed as
+     * `Partial<T>` and callers must handle keys that may be absent at runtime.
+     *
+     * Pass a shape as `T` to get a typed result without casting, e.g.
+     * `await secrets.getSecrets<{ FOO: string; BAR: { id: string } }>(['FOO', 'BAR'])`.
      * @param keys - The keys of the secrets to retrieve.
      */
-    getSecrets(keys: string[]): Promise<Record<string, unknown>>;
+    getSecrets<T extends Record<string, unknown> = Record<string, unknown>>(keys: (keyof T & string)[]): Promise<Partial<T>>;
 }

package/dist/services/temporary-file-service.d.ts

@@ -0,0 +1,20 @@
+import type { Logger } from './logger.js';
+export declare class TemporaryFileInstance {
+    private logger;
+    private tempDir;
+    private files;
+    constructor(logger: Logger, tempDir: string);
+    getFile(key: string): ReadableStream | NodeJS.ReadableStream;
+    writeFile(key: string, stream: ReadableStream | NodeJS.ReadableStream): Promise<void>;
+    deleteFile(key: string): Promise<void>;
+    hasFile(key: string): Promise<boolean>;
+    getTempFileAbsolutePath(key: string): Promise<string>;
+    private createDir;
+    cleanup(): Promise<void>;
+}
+export declare class TemporaryFileService {
+    private logger;
+    private tempDir;
+    constructor(logger: Logger, tempDir: string);
+    createInstance(): TemporaryFileInstance;
+}

package/dist/services/temporary-file-service.js

@@ -0,0 +1,63 @@
+import { createReadStream, createWriteStream } from 'fs';
+import { mkdir, rm, stat } from 'fs/promises';
+import { resolve } from 'path';
+import { pipeline } from 'stream/promises';
+export class TemporaryFileInstance {
+    logger;
+    tempDir;
+    files = [];
+    constructor(logger, tempDir) {
+        this.logger = logger;
+        this.tempDir = tempDir;
+        this.tempDir = resolve(tempDir);
+        logger.debug(`Using temp dir ${this.tempDir}`);
+    }
+    getFile(key) {
+        return createReadStream(`${this.tempDir}/${key}`);
+    }
+    async writeFile(key, stream) {
+        await this.createDir(key);
+        const filePath = `${this.tempDir}/${key}`;
+        const fileStream = createWriteStream(filePath);
+        await pipeline(stream, fileStream);
+        this.files.push(filePath);
+        this.logger.debug(`Wrote file: ${filePath}`);
+    }
+    async deleteFile(key) {
+        await rm(`${this.tempDir}/${key}`);
+        this.logger.debug(`Deleted file ${this.tempDir}/${key}`);
+    }
+    async hasFile(key) {
+        try {
+            return !!(await stat(`${this.tempDir}/${key}`));
+        }
+        catch {
+            return false;
+        }
+    }
+    async getTempFileAbsolutePath(key) {
+        await this.createDir(key);
+        return `${this.tempDir}/${key}`;
+    }
+    async createDir(key) {
+        const dir = `${this.tempDir}/${key}`.split('/').slice(0, -1).join('/');
+        if (!(await this.hasFile(dir))) {
+            await mkdir(dir, { recursive: true });
+        }
+    }
+    async cleanup() {
+        await Promise.all(this.files.map((file) => rm(file)));
+    }
+}
+export class TemporaryFileService {
+    logger;
+    tempDir;
+    constructor(logger, tempDir) {
+        this.logger = logger;
+        this.tempDir = tempDir;
+        this.tempDir = resolve(tempDir);
+    }
+    createInstance() {
+        return new TemporaryFileInstance(this.logger, this.tempDir);
+    }
+}

package/dist/services/typed-secret-service.d.ts

@@ -24,7 +24,7 @@ export declare class TypedSecretService<TMap = Record<string, unknown>> implemen
     hasSecret(key: string): Promise<boolean>;
     setSecret<K extends string>(key: K, value: K extends keyof TMap ? TMap[K] : unknown): Promise<void>;
     deleteSecret(key: string): Promise<void>;
-    getSecrets(keys: string[]): Promise<Record<string, unknown>>;
+    getSecrets<T extends Record<string, unknown> = Record<string, unknown>>(keys: (keyof T & string)[]): Promise<Partial<T>>;
     getAllStatus(): Promise<CredentialStatus[]>;
     getMissing(): Promise<CredentialStatus[]>;
 }

package/dist/services/typed-variables-service.d.ts

@@ -15,6 +15,7 @@ export declare class TypedVariablesService<TMap = Record<string, unknown>> imple
     constructor(variables: VariablesService, variablesMeta: Record<string, VariableMeta>);
     get<K extends keyof TMap & string>(name: K): Promise<TMap[K] | undefined> | TMap[K] | undefined;
     get<T = string>(name: string): Promise<T | undefined> | T | undefined;
+    getVariables<T extends Record<string, unknown> = Record<string, unknown>>(names: (keyof T & string)[]): Promise<Partial<T>> | Partial<T>;
     getAll(): Promise<Record<string, string | undefined>> | Record<string, string | undefined>;
     set(name: string, value: unknown): Promise<void> | void;
     has(name: string): Promise<boolean> | boolean;

package/dist/services/typed-variables-service.js

@@ -8,6 +8,9 @@ export class TypedVariablesService {
     get(name) {
         return this.variables.get(name);
     }
+    getVariables(names) {
+        return this.variables.getVariables(names);
+    }
     getAll() {
         return this.variables.getAll();
     }

package/dist/services/variables-service.d.ts

@@ -1,5 +1,14 @@
 export interface VariablesService {
     get<T = string>(name: string): Promise<T | undefined> | T | undefined;
+    /**
+     * Retrieves multiple variables in a single batch operation, mirroring
+     * `SecretService.getSecrets`. Missing variables are omitted rather than
+     * throwing, so the result is typed as `Partial<T>` and callers must handle
+     * keys that may be absent at runtime. Pass a shape as `T` to get a typed
+     * result without casting, e.g.
+     * `await variables.getVariables<{ FOO: string; BAR: string }>(['FOO', 'BAR'])`.
+     */
+    getVariables<T extends Record<string, unknown> = Record<string, unknown>>(names: (keyof T & string)[]): Promise<Partial<T>> | Partial<T>;
     getAll: () => Promise<Record<string, string | undefined>> | Record<string, string | undefined>;
     set: (name: string, value: unknown) => Promise<void> | void;
     has: (name: string) => Promise<boolean> | boolean;

package/dist/types/state.types.d.ts

@@ -114,6 +114,9 @@ export interface PikkuPackageState {
         } | null;
         /** Cached singleton services for this package */
         singletonServices: CoreSingletonServices | null;
+        /** The pikkuBetterAuth factory, self-registered when auth.ts is evaluated.
+         *  pikkuServices reads it to build and inject the `auth` singleton. */
+        authFactory: ((services: CoreSingletonServices) => unknown | Promise<unknown>) | null;
         /** Credential metadata for this addon package */
         credentialsMeta: Record<string, {
             name: string;

package/dist/wirings/http/http-runner.js

@@ -56,7 +56,10 @@ function extractHeadersFromRequest(request, headerKeys) {
  */
 export const addHTTPMiddleware = (pattern, middleware, packageName = null) => {
     const httpGroups = pikkuState(packageName, 'middleware', 'httpGroup');
-    httpGroups[pattern] = middleware;
+    const existing = httpGroups[pattern];
+    httpGroups[pattern] = existing
+        ? [...existing, ...middleware]
+        : middleware;
     return middleware;
 };
 /**

package/dist/wirings/http/pikku-fetch-http-request.js

@@ -13,7 +13,7 @@ export class PikkuFetchHTTPRequest {
     #url;
     #rawBodyText;
     #rawBodyBuffer;
-    #bodyRead = false;
+    #rawBufferPromise;
     constructor(request) {
         this.request = request;
         this.#url = new URL(request.url);
@@ -37,35 +37,49 @@ export class PikkuFetchHTTPRequest {
      * @returns A promise that resolves to the raw request body.
      */
     async arrayBuffer() {
+        return this.#readRawBuffer();
+    }
+    /**
+     * Reads the underlying single-use request body exactly once and memoises both
+     * the in-flight promise and the result. `json()`, `arrayBuffer()`, `body()`
+     * and `toWebRequest()` all funnel through here, so a request whose body is
+     * consumed in more than one place can no longer race on the underlying stream
+     * and fail with "Body has already been used".
+     *
+     * If a second consumer asks for the body while the first read is still in
+     * flight, that is the concurrent double-read that used to crash — now safe,
+     * but warned about so the redundant consumer is found and removed at the
+     * source rather than silently leaning on this cache.
+     */
+    async #readRawBuffer() {
         if (this.#rawBodyBuffer !== undefined) {
             return this.#rawBodyBuffer;
         }
-        if (this.#bodyRead) {
-            if (this.#rawBodyText !== undefined) {
-                const buf = new TextEncoder().encode(this.#rawBodyText)
-                    .buffer;
-                this.#rawBodyBuffer = buf;
-                return buf;
-            }
-            return new ArrayBuffer(0);
+        if (this.#rawBodyText !== undefined) {
+            const buf = new TextEncoder().encode(this.#rawBodyText)
+                .buffer;
+            this.#rawBodyBuffer = buf;
+            return buf;
+        }
+        if (this.#rawBufferPromise !== undefined) {
+            console.warn(`[pikku] request body for ${this.method().toUpperCase()} ${this.path()} ` +
+                `was requested again before the first read resolved — the read is now ` +
+                `shared, but a duplicate body consumer (e.g. middleware calling ` +
+                `toWebRequest just for headers) should be removed.`);
+            return this.#rawBufferPromise;
         }
-        const buf = await this.request.arrayBuffer();
-        this.#rawBodyBuffer = buf;
-        this.#bodyRead = true;
-        return buf;
+        this.#rawBufferPromise = this.request.arrayBuffer().then((buf) => {
+            this.#rawBodyBuffer = buf;
+            return buf;
+        });
+        return this.#rawBufferPromise;
     }
     async #readRawText() {
         if (this.#rawBodyText !== undefined) {
             return this.#rawBodyText;
         }
-        if (this.#rawBodyBuffer !== undefined) {
-            const text = new TextDecoder().decode(this.#rawBodyBuffer);
-            this.#rawBodyText = text;
-            return text;
-        }
-        const text = await this.request.text();
+        const text = new TextDecoder().decode(await this.#readRawBuffer());
         this.#rawBodyText = text;
-        this.#bodyRead = true;
         return text;
     }
     headers() {

package/dist/wirings/http/web-request.js

@@ -21,8 +21,13 @@ export function toWebRequest(req, baseUrl) {
     return new Request(url, {
         method,
         headers,
+        // `pull` (lazy) rather than `start` (eager): the body is only read from the
+        // underlying request when this stream is actually consumed. A consumer that
+        // builds a web Request just to read its headers (e.g. a session middleware
+        // calling getSession({ headers })) never touches the body, so it does zero
+        // body I/O and cannot race the route handler's read of the same request.
         body: new ReadableStream({
-            async start(controller) {
+            async pull(controller) {
                 try {
                     const buffer = await req.arrayBuffer();
                     if (buffer.byteLength > 0) {

package/dist/wirings/workflow/pikku-workflow-service.js

@@ -683,6 +683,7 @@ export class PikkuWorkflowService {
             const wire = {
                 workflow: workflowWire,
                 pikkuUserId: run.wire?.pikkuUserId,
+                session: rpcService.wire?.session,
                 rpc: rpcService.wire?.rpc,
             };
             try {
@@ -812,6 +813,7 @@ export class PikkuWorkflowService {
                             id: rpcName,
                             parentRunId: runId,
                             parentStepId: stepState.stepId,
+                            pikkuUserId: rpcService.wire?.pikkuUserId,
                         };
                         const shouldInline = !getSingletonServices()?.queueService;
                         const { runId: childRunId } = await this.startWorkflow(rpcName, data, childWire, rpcService, { inline: shouldInline });
@@ -952,6 +954,7 @@ export class PikkuWorkflowService {
                             type: 'workflow',
                             id: rpcName,
                             parentRunId: runId,
+                            pikkuUserId: rpcService.wire?.pikkuUserId,
                         };
                         const { runId: childRunId } = await this.startWorkflow(rpcName, data, childWire, rpcService, { inline: true });
                         await this.setStepChildRunId(currentStepState.stepId, childRunId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/core",
-  "version": "0.12.31",
+  "version": "0.12.33",
   "author": "yasser.fadl@gmail.com",
   "license": "MIT",
   "module": "dist/index.js",
@@ -44,6 +44,7 @@
     "./services": "./dist/services/index.js",
     "./services/local-meta": "./dist/services/meta-service.js",
     "./services/local-content": "./dist/services/local-content.js",
+    "./services/temporary-file-service": "./dist/services/temporary-file-service.js",
     "./services/gopass-secrets": "./dist/services/gopass-secrets.js",
     "./crypto-utils": "./dist/crypto-utils.js",
     "./internal": "./dist/internal.js",

package/src/function/function-runner.ts

@@ -58,6 +58,10 @@ async function resolveSession(
       wire.session = stored
       sessionService?.setInitial(stored)
     }
+  } else {
+    // Session already present on wire (e.g. propagated from parent workflow).
+    // Seed the sessionService so freezeInitial() returns it instead of undefined.
+    sessionService?.setInitial(wire.session as CoreUserSession)
   }
 }
 

package/src/middleware-runner.test.ts

@@ -5,7 +5,7 @@ import {
   addTagMiddleware,
   runMiddleware,
 } from './middleware-runner.js'
-import { resetPikkuState } from './pikku-state.js'
+import { pikkuState, resetPikkuState } from './pikku-state.js'
 import type {
   CorePikkuMiddleware,
   MiddlewarePriority,
@@ -32,6 +32,21 @@ beforeEach(() => {
   resetPikkuState()
 })
 
+describe('addTagMiddleware', () => {
+  test('composes repeated registrations for the same tag', () => {
+    const first: CorePikkuMiddleware = async (_s, _w, next) => next()
+    const second: CorePikkuMiddleware = async (_s, _w, next) => next()
+
+    addTagMiddleware('shared', [first])
+    addTagMiddleware('shared', [second])
+
+    assert.deepEqual(pikkuState(null, 'middleware', 'tagGroup')['shared'], [
+      first,
+      second,
+    ])
+  })
+})
+
 describe('combineMiddleware', () => {
   test('should return empty array when no parameters provided', () => {
     const result = combineMiddleware('http', Math.random().toString())

package/src/middleware-runner.ts

@@ -106,7 +106,10 @@ export const addTagMiddleware = <PikkuMiddleware extends CorePikkuMiddleware>(
   packageName: string | null = null
 ): CorePikkuMiddlewareGroup => {
   const tagGroups = pikkuState(packageName, 'middleware', 'tagGroup')
-  tagGroups[tag] = middleware
+  const existing = tagGroups[tag] as CorePikkuMiddleware[] | undefined
+  tagGroups[tag] = existing
+    ? [...existing, ...(middleware as CorePikkuMiddleware[])]
+    : middleware
   return middleware
 }
 

package/src/pikku-state.ts

@@ -155,6 +155,7 @@ const createEmptyPackageState = (): PikkuPackageState => ({
   package: {
     factories: null,
     singletonServices: null,
+    authFactory: null,
     credentialsMeta: null,
     requiredParentServices: null,
   },

package/src/services/gopass-secrets.ts

@@ -64,13 +64,15 @@ export class GopassSecretService implements SecretService {
     }
   }
 
-  public async getSecrets(keys: string[]): Promise<Record<string, unknown>> {
+  public async getSecrets<
+    T extends Record<string, unknown> = Record<string, unknown>,
+  >(keys: (keyof T & string)[]): Promise<Partial<T>> {
     const results = await Promise.allSettled(keys.map((k) => this.getSecret(k)))
     const out: Record<string, unknown> = {}
     keys.forEach((key, i) => {
       if (results[i].status === 'fulfilled')
         out[key] = (results[i] as PromiseFulfilledResult<unknown>).value
     })
-    return out
+    return out as Partial<T>
   }
 }

package/src/services/local-secrets.ts

@@ -53,13 +53,15 @@ export class LocalSecretService implements SecretService {
     this.localSecrets.delete(key)
   }
 
-  public async getSecrets(keys: string[]): Promise<Record<string, unknown>> {
+  public async getSecrets<
+    T extends Record<string, unknown> = Record<string, unknown>,
+  >(keys: (keyof T & string)[]): Promise<Partial<T>> {
     const results = await Promise.allSettled(keys.map((k) => this.getSecret(k)))
     const out: Record<string, unknown> = {}
     keys.forEach((key, i) => {
       if (results[i].status === 'fulfilled')
         out[key] = (results[i] as PromiseFulfilledResult<unknown>).value
     })
-    return out
+    return out as Partial<T>
   }
 }

package/src/services/local-variables.ts

@@ -9,6 +9,17 @@ export class LocalVariablesService implements VariablesService {
     return this.variables || {}
   }
 
+  public getVariables<
+    T extends Record<string, unknown> = Record<string, unknown>,
+  >(names: (keyof T & string)[]): Partial<T> {
+    const out: Record<string, unknown> = {}
+    for (const name of names) {
+      const value = this.get(name)
+      if (value !== undefined) out[name] = value
+    }
+    return out as Partial<T>
+  }
+
   public get<T = string>(name: string): T | undefined {
     const raw = this.variables[name]
     if (raw === undefined) return undefined