@pikku/core 0.12.63 → 0.12.64

package/dist/function/function-runner.js

@@ -6,10 +6,12 @@ import { coerceTopLevelDataFromSchema, validateSchema } from '../schema.js';
 import { parseVersionedId } from '../version.js';
 import { PikkuSessionService } from '../services/user-session-service.js';
 import { ForbiddenError, ReadonlySessionError } from '../errors/errors.js';
+import { verifyScopes } from '../scopes.js';
 import { PikkuCredentialWireService, createWireServicesCredentialWireProps, } from '../services/credential-wire-service.js';
 import { defaultPikkuUserIdResolver } from '../services/pikku-user-id.js';
 import { createInvocationAudit, resolveAuditConfig, } from '../services/audit-service.js';
 import { rpcService } from '../wirings/rpc/rpc-runner.js';
+import { getOrCreatePackageSingletonServices } from '../wirings/rpc/addon-runner.js';
 import { closeWireServices } from '../utils.js';
 async function resolveSession(wire, singletonServices, sessionService) {
     const pikkuUserId = defaultPikkuUserIdResolver(wire);
@@ -35,88 +37,6 @@ async function resolveSession(wire, singletonServices, sessionService) {
         sessionService?.setInitial(wire.session);
     }
 }
-/**
- * Get or create singleton services for an addon package.
- * Services are cached in pikkuState to avoid recreation on each call.
- *
- * @param packageName - The addon package name
- * @param parentServices - The parent/caller's singleton services (used as base)
- * @returns The package's singleton services
- */
-/**
- * Find the consumer-defined namespace (from wireAddon) for a given addon package.
- * Returns null if the package isn't registered as an addon.
- */
-const findAddonNamespaceForPackage = (packageName) => {
-    const addons = pikkuState(null, 'addons', 'packages');
-    if (!addons)
-        return null;
-    for (const [namespace, cfg] of addons.entries()) {
-        if (cfg?.package === packageName)
-            return namespace;
-    }
-    return null;
-};
-/**
- * Wrap a workflow service so that bare workflow names passed from inside an
- * addon function are auto-prefixed with the addon's consumer-facing namespace.
- * Without this, `runToCompletion('myWorkflow')` from inside an addon misses
- * the workflow registered under the addon's package scope and throws
- * WorkflowNotFoundError — forcing addons to hardcode their consumer-defined
- * namespace, which couples the addon to its caller.
- *
- * Explicit `'ns:name'` and bare names that already exist in root meta are
- * unaffected; only bare names that would otherwise miss resolution get
- * prefixed.
- */
-const wrapWorkflowServiceForPackage = (service, packageName) => {
-    return new Proxy(service, {
-        get(target, prop, receiver) {
-            if (prop === 'startWorkflow' || prop === 'runToCompletion') {
-                const original = Reflect.get(target, prop, receiver);
-                return function (name, ...rest) {
-                    if (typeof name === 'string' && !name.includes(':')) {
-                        const namespace = findAddonNamespaceForPackage(packageName);
-                        if (namespace) {
-                            name = `${namespace}:${name}`;
-                        }
-                    }
-                    return original.call(this, name, ...rest);
-                };
-            }
-            return Reflect.get(target, prop, receiver);
-        },
-    });
-};
-const getOrCreatePackageSingletonServices = async (packageName, parentServices) => {
-    // Check if we already have cached singleton services for this package
-    const cachedServices = pikkuState(packageName, 'package', 'singletonServices');
-    if (cachedServices) {
-        return cachedServices;
-    }
-    // Get the package's service factories
-    const factories = pikkuState(packageName, 'package', 'factories');
-    if (!factories || !factories.createSingletonServices) {
-        // No factories registered, use parent services
-        return parentServices;
-    }
-    // Create config for the package (use parent config if no factory)
-    let config = parentServices.config;
-    if (factories.createConfig) {
-        config = await factories.createConfig(parentServices.variables);
-    }
-    // Create singleton services for the package, passing parent services as existing
-    const packageServices = await factories.createSingletonServices(config, parentServices);
-    // Wrap workflowService so that bare names used inside the addon's functions
-    // resolve to workflows registered under the addon's package scope.
-    if (packageServices.workflowService &&
-        typeof packageServices.workflowService === 'object') {
-        packageServices.workflowService = wrapWorkflowServiceForPackage(packageServices.workflowService, packageName);
-    }
-    // Cache the services
-    pikkuState(packageName, 'package', 'singletonServices', packageServices);
-    return packageServices;
-};
 export const addFunction = (funcName, funcConfig, packageName = null) => {
     pikkuState(packageName, 'function', 'functions').set(funcName, funcConfig);
 };
@@ -137,7 +57,7 @@ export const getAllFunctionNames = () => {
     }
     return functions;
 };
-export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServices, createWireServices, data, auth: wiringAuth, inheritedMiddleware, wireMiddleware, inheritedChannelMiddleware, wireChannelMiddleware, inheritedPermissions, wirePermissions, coerceDataFromSchema, tags = [], wire, sessionService, credentialWireService, packageName = null, }) => {
+export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServices, createWireServices, data, auth: wiringAuth, inheritedMiddleware, wireMiddleware, inheritedChannelMiddleware, wireChannelMiddleware, coerceDataFromSchema, wire, sessionService, credentialWireService, packageName = null, addonInstance, }) => {
     wire.wireType ??= wireType;
     wire.wireId ??= wireId;
     const funcMap = pikkuState(packageName, 'function', 'functions');
@@ -163,7 +83,7 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
     const resolvedFunctionId = funcMeta.pikkuFuncId ?? funcName;
     // For addon packages, get or create their singleton services
     const resolvedSingletonServices = packageName
-        ? await getOrCreatePackageSingletonServices(packageName, singletonServices)
+        ? await getOrCreatePackageSingletonServices(packageName, singletonServices, addonInstance)
         : singletonServices;
     // Get the package's createWireServices if available
     let resolvedCreateWireServices = createWireServices;
@@ -182,8 +102,18 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
         ? wrapChannelWithMiddleware(wire, resolvedSingletonServices, allChannelMiddleware)
         : wire;
     // Set up credential wire service early so middleware can use setCredential.
-    // Skip if already set up (e.g. addon functions reuse the parent wire).
-    if (!resolvedWire.getCredentials) {
+    // An addon instance with credentialOverrides always gets a fresh alias-aware
+    // service so its logical credential names resolve to instance-specific ones,
+    // even when a parent credential service is already present on the wire.
+    // Otherwise skip if already set up (e.g. addon functions reuse the parent wire).
+    if (addonInstance?.credentialOverrides) {
+        // Credentials belong to the consuming project, so resolve them via the
+        // project's credentialService (the addon's own singletons may not carry it).
+        const aliasedCredentialWireService = new PikkuCredentialWireService(singletonServices.credentialService ??
+            resolvedSingletonServices.credentialService, resolvedWire, addonInstance.credentialOverrides);
+        Object.assign(resolvedWire, createWireServicesCredentialWireProps(aliasedCredentialWireService));
+    }
+    else if (!resolvedWire.getCredentials) {
         const resolvedCredentialWireService = credentialWireService ??
             new PikkuCredentialWireService(resolvedSingletonServices.credentialService, resolvedWire);
         Object.assign(resolvedWire, createWireServicesCredentialWireProps(resolvedCredentialWireService));
@@ -192,19 +122,14 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
     const invocationWire = resolvedWire;
     const previousFunctionId = invocationWire.functionId;
     const previousAudit = invocationWire.audit;
+    const previousAddonNamespace = invocationWire.addonNamespace;
     const previousRpcDescriptor = Object.getOwnPropertyDescriptor(invocationWire, 'rpc');
     invocationWire.functionId = resolvedFunctionId;
     invocationWire.audit = resolvedAuditConfig;
-    // Convert tags to PermissionMetadata and merge with inheritedPermissions
-    let mergedInheritedPermissions;
-    if (tags && tags.length > 0) {
-        mergedInheritedPermissions = [
-            ...(inheritedPermissions || []),
-            ...tags.map((tag) => ({ type: 'tag', tag })),
-        ];
-    }
-    else {
-        mergedInheritedPermissions = inheritedPermissions || [];
+    // Track which addon instance is executing so intra-addon sibling calls
+    // resolve the same per-instance singleton services and overrides.
+    if (addonInstance) {
+        invocationWire.addonNamespace = addonInstance.namespace;
     }
     // Helper function to run permissions and execute the function
     const executeFunction = async () => {
@@ -235,6 +160,11 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
         if (session?.readonly && !funcMeta.readonly) {
             throw new ReadonlySessionError();
         }
+        // Scopes gate before the data is evaluated: they depend only on the
+        // session, so a denied request never pays to parse or validate its body.
+        // Scopes are an AND gate and stay separate from runPermissions, which
+        // evaluates the function's own OR-groups against request data.
+        verifyScopes(funcConfig.scopes ?? funcMeta.scopes, session);
         // Evaluate the data from the lazy function
         const actualData = await data();
         // Validate and coerce data if schema is defined
@@ -247,21 +177,13 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
             // Validate request data against the defined schema, if any
             await validateSchema(resolvedSingletonServices.logger, resolvedSingletonServices.schema, inputSchemaName, actualData, packageName);
         }
-        if (mergedInheritedPermissions.length > 0 ||
-            wirePermissions ||
-            funcMeta.permissions ||
-            funcConfig.permissions) {
-            await runPermissions(wireType, wireId, {
-                wireInheritedPermissions: mergedInheritedPermissions,
-                wirePermissions: wirePermissions,
-                funcInheritedPermissions: funcMeta.permissions,
-                funcPermissions: funcConfig.permissions,
-                services: resolvedSingletonServices,
-                wire: invocationWire,
-                data: actualData,
-                packageName,
-            });
-        }
+        await runPermissions({
+            funcPermissions: funcConfig.permissions,
+            services: resolvedSingletonServices,
+            wire: invocationWire,
+            data: actualData,
+            packageName,
+        });
         let wireServices;
         let invocationAuditLog;
         try {
@@ -333,6 +255,12 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
             else {
                 invocationWire.audit = previousAudit;
             }
+            if (previousAddonNamespace === undefined) {
+                delete invocationWire.addonNamespace;
+            }
+            else {
+                invocationWire.addonNamespace = previousAddonNamespace;
+            }
         }
     }
     try {

package/dist/function/functions.types.d.ts

@@ -1,4 +1,5 @@
 import type { CoreServices, CoreSingletonServices, CoreUserSession, CorePikkuMiddleware, PikkuWire, PickRequired } from '../types/core.types.js';
+import type { PikkuRPC } from '../wirings/rpc/rpc-types.js';
 import type { StandardSchemaV1 } from '@standard-schema/spec';
 import type { PikkuError } from '../errors/error-handler.js';
 import type { CoreNodeConfig } from '../wirings/node/node.types.js';
@@ -15,7 +16,7 @@ export type ZodLike<T = any> = StandardSchemaV1<T, T>;
  * @template Services - The services type, defaults to `CoreServices`.
  * @template Wire - The wire type, defaults to `PikkuWire<In, Out>`.
  */
-export type CorePikkuFunction<In, Out, Services extends CoreSingletonServices = CoreServices, Session extends CoreUserSession = CoreUserSession, Wire extends PikkuWire<In, Out, true, Session> = PikkuWire<In, Out, true, Session>> = (services: Services, data: In, wire: Wire) => Wire['channel'] extends null ? Promise<Out> : Promise<Out> | Promise<void>;
+export type CorePikkuFunction<In, Out, Services extends CoreSingletonServices = CoreServices, Session extends CoreUserSession = CoreUserSession, Wire extends PikkuWire<In, Out, true, Session, PikkuRPC, null, string> = PikkuWire<In, Out, true, Session>> = (services: Services, data: In, wire: Wire) => Wire['channel'] extends null ? Promise<Out> : Promise<Out> | Promise<void>;
 /**
  * Represents a core API function that can be used without a session.
  *
@@ -24,7 +25,7 @@ export type CorePikkuFunction<In, Out, Services extends CoreSingletonServices =
  * @template Services - The services type, defaults to `CoreServices`.
  * @template Wire - The wire type, defaults to `PikkuWire<In, Out>`.
  */
-export type CorePikkuFunctionSessionless<In, Out, Services extends CoreSingletonServices = CoreServices, Session extends CoreUserSession = CoreUserSession, Wire extends PikkuWire<In, Out, false, Session, any, any, any> = PikkuWire<In, Out, false, Session, any, any, any>> = (services: Services, data: In, wire: Wire) => Wire['channel'] extends null ? Promise<Out> : Promise<Out> | Promise<void>;
+export type CorePikkuFunctionSessionless<In, Out, Services extends CoreSingletonServices = CoreServices, Session extends CoreUserSession = CoreUserSession, Wire extends PikkuWire<In, Out, false, Session, PikkuRPC, null, string> = PikkuWire<In, Out, false, Session>> = (services: Services, data: In, wire: Wire) => Wire['channel'] extends null ? Promise<Out> : Promise<Out> | Promise<void>;
 /**
  * Represents a function that checks permissions for a given operation.
  *
@@ -32,7 +33,7 @@ export type CorePikkuFunctionSessionless<In, Out, Services extends CoreSingleton
  * @template Services - The services type, defaults to `CoreServices`.
  * @template Session - The session type, defaults to `CoreUserSession`.
  */
-export type CorePikkuPermission<In = any, Services extends CoreSingletonServices = CoreServices, Wire extends PikkuWire<In, never, false, any, any, never, never> = PikkuWire<In, never, false, any, never, never, never>> = (services: Services, data: In, wire: Wire) => Promise<boolean>;
+export type CorePikkuPermission<In = any, Services extends CoreSingletonServices = CoreServices, Wire extends PikkuWire<In, never, false, any, PikkuRPC, never, never> = PikkuWire<In, never, false, any, PikkuRPC, never, never>> = (services: Services, data: In, wire: Wire) => Promise<boolean>;
 /**
  * Configuration object for creating a permission with metadata
  *
@@ -40,7 +41,7 @@ export type CorePikkuPermission<In = any, Services extends CoreSingletonServices
  * @template Services - The services type, defaults to `CoreServices`.
  * @template Session - The session type, defaults to `CoreUserSession`.
  */
-export type CorePikkuPermissionConfig<In = any, Services extends CoreSingletonServices = CoreServices, Wire extends PikkuWire<In, never, false, any> = PikkuWire<In, never, false, any>> = {
+export type CorePikkuPermissionConfig<In = any, Services extends CoreSingletonServices = CoreServices, Wire extends PikkuWire<In, never, false, any, PikkuRPC, never, never> = PikkuWire<In, never, false, any, PikkuRPC, never, never>> = {
     /** The permission function */
     func: CorePikkuPermission<In, Services, Wire>;
     /** Optional human-readable name for the permission */
@@ -73,7 +74,7 @@ export type CorePikkuPermissionConfig<In = any, Services extends CoreSingletonSe
  * })
  * ```
  */
-export declare const pikkuPermission: <In = any, Services extends CoreSingletonServices = CoreServices, Wire extends PickRequired<PikkuWire<In, never, false, any>, "session"> = PickRequired<PikkuWire<In, never, false, any>, "session">>(permission: CorePikkuPermission<In, Services, Wire> | CorePikkuPermissionConfig<In, Services, Wire>) => CorePikkuPermission<In, Services, Wire>;
+export declare const pikkuPermission: <In = any, Services extends CoreSingletonServices = CoreServices, Wire extends PickRequired<PikkuWire<In, never, false, any, PikkuRPC, never, never>, "session"> = PickRequired<PikkuWire<In, never, false, any, PikkuRPC, never, never>, "session">>(permission: CorePikkuPermission<In, Services, Wire> | CorePikkuPermissionConfig<In, Services, Wire>) => CorePikkuPermission<In, Services, Wire>;
 /**
  * A factory function that takes input and returns a permission
  * Used when permissions need configuration/input parameters
@@ -82,7 +83,7 @@ export declare const pikkuPermission: <In = any, Services extends CoreSingletonS
  * @template Services - The services type, defaults to `CoreServices`.
  * @template Session - The session type, defaults to `CoreUserSession`.
  */
-export type CorePikkuPermissionFactory<In = any, Services extends CoreSingletonServices = CoreServices, Wire extends PikkuWire<In, never, false, any> = PikkuWire<In, never, false, any>> = (input: In) => CorePikkuPermission<any, Services, Wire>;
+export type CorePikkuPermissionFactory<In = any, Services extends CoreSingletonServices = CoreServices, Wire extends PikkuWire<In, never, false, any, PikkuRPC, never, never> = PikkuWire<In, never, false, any, PikkuRPC, never, never>> = (input: In) => CorePikkuPermission<any, Services, Wire>;
 /**
  * Factory function for creating permission factories
  * Use this when your permission needs configuration/input parameters
@@ -134,7 +135,7 @@ export type CorePikkuAuthConfig<Services extends CoreSingletonServices = CoreSer
 };
 export declare const pikkuAuth: <Services extends CoreSingletonServices = CoreServices, Session extends CoreUserSession = CoreUserSession>(auth: CorePikkuAuth<Services, Session> | CorePikkuAuthConfig<Services, Session>) => CorePikkuPermission<any, Services, any>;
 export type CorePermissionGroup<PikkuPermission = CorePikkuPermission<any>> = Record<string, PikkuPermission | PikkuPermission[]> | undefined;
-export type CorePikkuFunctionConfig<PikkuFunction extends CorePikkuFunction<any, any, any, any, any> | CorePikkuFunctionSessionless<any, any, any, any, any>, PikkuPermission extends CorePikkuPermission<any, any, any> = CorePikkuPermission<any>, PikkuMiddleware extends CorePikkuMiddleware<any, any> = CorePikkuMiddleware<any, any>, InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined> = {
+export type CorePikkuFunctionConfig<PikkuFunction extends CorePikkuFunction<any, any, any, any, any> | CorePikkuFunctionSessionless<any, any, any, any, any>, PikkuPermission extends CorePikkuPermission<any, any, any> = CorePikkuPermission<any>, PikkuMiddleware extends CorePikkuMiddleware<any, any> = CorePikkuMiddleware<any, any>, InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined, Scope extends string = string> = {
     /** Short human-readable name (e.g. "Create Todo") */
     title?: string;
     /** Longer-form description of what the function does */
@@ -161,6 +162,15 @@ export type CorePikkuFunctionConfig<PikkuFunction extends CorePikkuFunction<any,
     approvalDescription?: any;
     func: PikkuFunction;
     auth?: boolean;
+    /**
+     * Scopes the session must hold to run this function. All of them are
+     * required (AND), and they are checked before `permissions` — unlike
+     * permissions, which OR together, a scope can only narrow access.
+     *
+     * Narrowed to the generated `ScopeId` union in a project's own
+     * `pikku-types.gen.ts`, so an undeclared scope is a compile error.
+     */
+    scopes?: Scope[];
     permissions?: CorePermissionGroup<PikkuPermission>;
     middleware?: PikkuMiddleware[];
     input?: InputSchema;

package/dist/index.d.ts

@@ -36,6 +36,7 @@ export type { SessionService } from './services/user-session-service.js';
 export { NoopAuditService, createInvocationAudit, resolveAuditActorFromWire, resolveAuditConfig, } from './services/audit-service.js';
 export type { AuditActor, AuditConfig, AuditDurability, AuditEvent, AuditEventBatch, AuditLog, AuditLogWriteInput, AuditOutcome, AuditService, AuditSource, ResolvedAuditConfig, } from './services/audit-service.js';
 export type { AIAgentRunnerService, AIEmbedManyParams, AIEmbedManyResult, AIEmbedParams, AIEmbedResult, AIGenerateImageParams, AIGenerateImagePrompt, AIGenerateImageResult, AIGenerateSpeechParams, AIGenerateSpeechResult, AIProviderOptions, AIRerankParams, AIRerankResult, AITranscriptionParams, AITranscriptionResult, } from './services/ai-agent-runner-service.js';
+export type { AIEmbeddingService } from './services/ai-embedding-service.js';
 export type { AIRunStateService } from './services/ai-run-state-service.js';
 export type { AIStorageService } from './services/ai-storage-service.js';
 export type { EmailsMeta, EmailTemplateMeta, EmailTemplateLocaleMeta, EmailTemplateAssets, MetaService, } from './services/meta-service.js';
@@ -44,9 +45,12 @@ export type { GraphNodeConfig } from './wirings/workflow/graph/workflow-graph.ty
 export { createGraph } from './wirings/workflow/graph/graph-node.js';
 export { wireAddon } from './wirings/rpc/wire-addon.js';
 export type { WireAddonConfig } from './wirings/rpc/wire-addon.js';
+export { wireRemoteAddon } from './wirings/rpc/wire-remote-addon.js';
+export type { WireRemoteAddonConfig, RemoteAddonAuth, } from './wirings/rpc/wire-remote-addon.js';
 export type { PikkuPackageState } from './types/state.types.js';
 export { runMiddleware, addTagMiddleware, addTagMiddleware as addMiddleware, addGlobalMiddleware, } from './middleware-runner.js';
-export { addTagPermission, addTagPermission as addPermission, addGlobalPermission, checkAuthPermissions, } from './permissions.js';
+export { addGlobalPermission, checkAuthPermissions } from './permissions.js';
+export { verifyScopes } from './scopes.js';
 export { isSerializable, stopSingletonServices, pikkuServerLifecycle, } from './utils.js';
 export { getSingletonServices, getCreateWireServices, setSingletonServices, } from './pikku-state.js';
 export { clearPikkuRuntimeState } from './test-utils.js';

package/dist/index.js

@@ -15,8 +15,10 @@ export { PikkuError, isExpectedError } from './errors/error-handler.js';
 export { NoopAuditService, createInvocationAudit, resolveAuditActorFromWire, resolveAuditConfig, } from './services/audit-service.js';
 export { createGraph } from './wirings/workflow/graph/graph-node.js';
 export { wireAddon } from './wirings/rpc/wire-addon.js';
+export { wireRemoteAddon } from './wirings/rpc/wire-remote-addon.js';
 export { runMiddleware, addTagMiddleware, addTagMiddleware as addMiddleware, addGlobalMiddleware, } from './middleware-runner.js';
-export { addTagPermission, addTagPermission as addPermission, addGlobalPermission, checkAuthPermissions, } from './permissions.js';
+export { addGlobalPermission, checkAuthPermissions } from './permissions.js';
+export { verifyScopes } from './scopes.js';
 export { isSerializable, stopSingletonServices, pikkuServerLifecycle, } from './utils.js';
 export { getSingletonServices, getCreateWireServices, setSingletonServices, } from './pikku-state.js';
 export { clearPikkuRuntimeState } from './test-utils.js';

package/dist/middleware/auth-apikey.d.ts

@@ -21,5 +21,6 @@ export declare const authAPIKey: import("../types/core.types.js").CorePikkuMiddl
     logLevel?: import("../services/logger.js").LogLevel;
     secrets?: {};
     workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
+    webhook?: import("../services/webhook-service.js").WebhookServiceConfig;
     postgres?: import("../types/core.types.js").PostgresConfig;
 }>, import("../types/core.types.js").CoreUserSession>;

package/dist/middleware/auth-bearer.d.ts

@@ -53,5 +53,6 @@ export declare const authBearer: import("../types/core.types.js").CorePikkuMiddl
     logLevel?: import("../services/logger.js").LogLevel;
     secrets?: {};
     workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
+    webhook?: import("../services/webhook-service.js").WebhookServiceConfig;
     postgres?: import("../types/core.types.js").PostgresConfig;
 }>, CoreUserSession>;

package/dist/middleware/auth-cookie.d.ts

@@ -36,5 +36,6 @@ export declare const authCookie: import("../types/core.types.js").CorePikkuMiddl
     logLevel?: import("../services/logger.js").LogLevel;
     secrets?: {};
     workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
+    webhook?: import("../services/webhook-service.js").WebhookServiceConfig;
     postgres?: import("../types/core.types.js").PostgresConfig;
 }>, import("../types/core.types.js").CoreUserSession>;

package/dist/middleware/cors.d.ts

@@ -43,5 +43,6 @@ export declare const cors: import("../types/core.types.js").CorePikkuMiddlewareF
     logLevel?: import("../services/logger.js").LogLevel;
     secrets?: {};
     workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
+    webhook?: import("../services/webhook-service.js").WebhookServiceConfig;
     postgres?: import("../types/core.types.js").PostgresConfig;
 }>, import("../types/core.types.js").CoreUserSession>;

package/dist/middleware/index.d.ts

@@ -5,4 +5,4 @@ export { pikkuRemoteAuthMiddleware } from './remote-auth.js';
 export { cors } from './cors.js';
 export { telemetryOuter, telemetryInner } from './telemetry.js';
 export { addTagMiddleware, addTagMiddleware as addMiddleware, addGlobalMiddleware, runMiddleware, } from '../middleware-runner.js';
-export { addTagPermission, addTagPermission as addPermission, addGlobalPermission, } from '../permissions.js';
+export { addGlobalPermission, addTagPermission } from '../permissions.js';

package/dist/middleware/index.js

@@ -5,4 +5,4 @@ export { pikkuRemoteAuthMiddleware } from './remote-auth.js';
 export { cors } from './cors.js';
 export { telemetryOuter, telemetryInner } from './telemetry.js';
 export { addTagMiddleware, addTagMiddleware as addMiddleware, addGlobalMiddleware, runMiddleware, } from '../middleware-runner.js';
-export { addTagPermission, addTagPermission as addPermission, addGlobalPermission, } from '../permissions.js';
+export { addGlobalPermission, addTagPermission } from '../permissions.js';

package/dist/middleware/remote-auth.d.ts

@@ -2,5 +2,6 @@ export declare const pikkuRemoteAuthMiddleware: import("../types/core.types.js")
     logLevel?: import("../services/logger.js").LogLevel;
     secrets?: {};
     workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
+    webhook?: import("../services/webhook-service.js").WebhookServiceConfig;
     postgres?: import("../types/core.types.js").PostgresConfig;
 }>, import("../types/core.types.js").CoreUserSession>;

package/dist/middleware/telemetry.d.ts

@@ -21,6 +21,7 @@ export declare const telemetryOuter: import("../types/core.types.js").CorePikkuM
     logLevel?: import("../services/logger.js").LogLevel;
     secrets?: {};
     workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
+    webhook?: import("../services/webhook-service.js").WebhookServiceConfig;
     postgres?: import("../types/core.types.js").PostgresConfig;
 }>, import("../types/core.types.js").CoreUserSession>;
 /**
@@ -45,5 +46,6 @@ export declare const telemetryInner: import("../types/core.types.js").CorePikkuM
     logLevel?: import("../services/logger.js").LogLevel;
     secrets?: {};
     workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
+    webhook?: import("../services/webhook-service.js").WebhookServiceConfig;
     postgres?: import("../types/core.types.js").PostgresConfig;
 }>, import("../types/core.types.js").CoreUserSession>;

package/dist/middleware/timeout.d.ts

@@ -4,5 +4,6 @@ export declare const timeout: () => import("../types/core.types.js").CorePikkuMi
     logLevel?: import("../services/logger.js").LogLevel;
     secrets?: {};
     workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
+    webhook?: import("../services/webhook-service.js").WebhookServiceConfig;
     postgres?: import("../types/core.types.js").PostgresConfig;
 }>, import("../types/core.types.js").CoreUserSession>;

package/dist/permissions.d.ts

@@ -1,36 +1,42 @@
-import type { CoreServices, CoreUserSession, PikkuWiringTypes, PermissionMetadata, PikkuWire } from './types/core.types.js';
+import type { CoreServices, CoreUserSession, PermissionMetadata, PikkuWire } from './types/core.types.js';
 import type { CorePermissionGroup, CorePikkuPermission } from './function/functions.types.js';
+export declare const clearPermissionsCache: () => void;
 /**
- * Registers tag-scoped permissions. Applies to any wiring that carries the
- * matching tag.
- *
- * For tree-shaking, wrap in a factory:
- * `export const x = () => addTagPermission('tag', [...])`
- *
- * @example
- * export const adminPermissions = () => addTagPermission('admin', [adminPermission])
- */
-export declare const addTagPermission: (tag: string, permissions: CorePermissionGroup | CorePikkuPermission[], packageName?: string | null) => CorePermissionGroup | CorePikkuPermission[];
-/**
- * Registers wire-agnostic global permissions. Runs at the top of every
- * wiring's permission resolution — before wire-, tag-, and function-level
- * entries — across all wire types.
+ * Registers wire-agnostic global permissions. Global permissions are an AND
+ * gate: every registered requirement must pass on every function invocation,
+ * regardless of transport. A requirement may be a single permission function
+ * or a permission group (in which case that group ORs internally, but the
+ * group as a whole must still pass).
  *
- * Resolution order: global → wire → tag → function.
+ * Global permissions never satisfy a function's own `permissions` — the two
+ * are independent gates that both have to pass, so a broad global can only
+ * ever narrow access.
  *
  * @example
  * addGlobalPermission([signedInUser])
  */
 export declare const addGlobalPermission: (permissions: CorePermissionGroup | CorePikkuPermission[], packageName?: string | null) => CorePermissionGroup | CorePikkuPermission[];
-export declare const clearPermissionsCache: () => void;
 /**
- * Runs permission checks using combined permissions from all sources.
- * Combines permissions from wire and function levels, then validates them.
+ * @deprecated Tag-level permissions were removed in #972 — permissions are now
+ * function-scoped only (declare them on the function via `pikkuFunc({ permissions })`).
+ * This throwing stub exists solely so the pinned bootstrap CLI (which still
+ * generates an `addTagPermission` wrapper) can resolve the import at build time;
+ * it is never called. Delete once `PIKKU_CLI_VERSION` in the CLI build is bumped
+ * past the release that removes tag permissions.
+ */
+export declare const addTagPermission: (_tag: string, _permissions: CorePermissionGroup | CorePikkuPermission[], _packageName?: string | null) => never;
+/**
+ * Runs authorization for a function invocation. Two independent gates, both of
+ * which must pass:
+ *
+ * 1. Global permissions — AND. Every registered global requirement must pass.
+ * 2. Function permissions — OR. The function's own `permissions` group must be
+ *    satisfied (see {@link verifyPermissions}).
+ *
+ * A passing global requirement never contributes to the function gate, so a
+ * broad global like `signedIn` can't satisfy an admin-only function.
  */
-export declare const runPermissions: (wireType: PikkuWiringTypes, uid: string, { wireInheritedPermissions, wirePermissions, funcInheritedPermissions, funcPermissions, services, wire, data, packageName, }: {
-    wireInheritedPermissions?: PermissionMetadata[];
-    wirePermissions?: CorePermissionGroup | CorePikkuPermission[];
-    funcInheritedPermissions?: PermissionMetadata[];
+export declare const runPermissions: ({ funcPermissions, services, wire, data, packageName, }: {
     funcPermissions?: CorePermissionGroup | CorePikkuPermission[];
     services: CoreServices;
     wire: PikkuWire<any, never, any, CoreUserSession, never, never, never>;
@@ -40,12 +46,13 @@ export declare const runPermissions: (wireType: PikkuWiringTypes, uid: string, {
 /**
  * Checks whether a session passes the auth checks (pikkuAuth only) for a
  * given function/agent. Skips pikkuPermission checks since those require
- * request data which isn't available at filter time.
+ * request data which isn't available at filter time. Global auth requirements
+ * are included so a filtered list honours app-wide auth.
  *
  * @param funcPermissions - The PermissionMetadata[] from function or agent metadata
  * @param session - The user's session
  * @param services - Singleton services
  * @param packageName - Optional package namespace
- * @returns true if the session passes all auth checks (or no auth checks exist)
+ * @returns true if the session passes the auth checks (or no auth checks exist)
  */
 export declare const checkAuthPermissions: (funcPermissions: PermissionMetadata[] | undefined, session: CoreUserSession, services: CoreServices, packageName?: string | null) => Promise<boolean>;