@pikku/core 0.12.63 → 0.12.66

package/dist/wirings/gateway/gateway-runner.js

@@ -1,6 +1,6 @@
 import { pikkuState } from '../../pikku-state.js';
 import { NotFoundError, UnauthorizedError } from '../../errors/errors.js';
-import { addFunction } from '../../function/function-runner.js';
+import { addFunction, runPikkuFunc } from '../../function/function-runner.js';
 import { runMiddleware } from '../../middleware-runner.js';
 import { httpRouter } from '../http/routers/http-router.js';
 /**
@@ -9,6 +9,52 @@ import { httpRouter } from '../http/routers/http-router.js';
  * requests share one construction).
  */
 const resolvedAdapters = new WeakMap();
+/**
+ * The generated function id a gateway's handler is registered under.
+ */
+const gatewayHandlerFuncId = (name) => `gateway__${name}__handler`;
+/**
+ * Bridges a session established by gateway middleware onto the wire so the
+ * handler's gate can see it.
+ *
+ * Gateway middleware is the only place a webhook can acquire a session (e.g.
+ * mapping a verified platform sender to a user). Middleware that assigns
+ * `wire.session` needs nothing, but middleware using the idiomatic
+ * `wire.setSession()` writes to the enclosing wiring's session service, which
+ * the handler's own invocation does not read — without this the session would
+ * be silently invisible to `auth` and `scopes`.
+ */
+const bridgeMiddlewareSession = async (wire) => {
+    if (wire.session || !wire.getSession)
+        return;
+    const session = await wire.getSession();
+    if (session) {
+        wire.session = session;
+    }
+};
+/**
+ * Registers a gateway's handler as a real pikku function so that invoking it
+ * goes through the function runner's gate. Without this the handler is called
+ * directly and its own `auth`, `scopes` and `permissions` are never evaluated.
+ *
+ * The handler is registered as sessionless: a gateway's inbound traffic is
+ * platform-authenticated (adapter signature verification), not session-bearing,
+ * so requiring a session by default would break every webhook. A handler that
+ * does need one declares `auth: true`, exactly like `pikkuSessionlessFunc`.
+ * `scopes` and `permissions` are always enforced when declared.
+ */
+const registerGatewayHandler = (config) => {
+    const funcId = gatewayHandlerFuncId(config.name);
+    const funcMeta = pikkuState(null, 'function', 'meta');
+    funcMeta[funcId] = {
+        pikkuFuncId: funcId,
+        inputSchemaName: null,
+        outputSchemaName: null,
+        sessionless: true,
+    };
+    addFunction(funcId, config.func);
+    return funcId;
+};
 export const resolveGatewayAdapter = (config, services) => {
     let resolved = resolvedAdapters.get(config);
     if (!resolved) {
@@ -107,12 +153,13 @@ const wireWebhookGateway = (config) => {
  *  2. Parse body via adapter → GatewayInboundMessage (or null to ignore)
  *  3. Populate `wire.gateway`
  *  4. Run user middleware (which can read `wire.gateway` for auth)
- *  5. Call user func with parsed message
+ *  5. Invoke the handler through the function runner, which enforces its
+ *     `auth`/`scopes`/`permissions` before running it
  *  6. Auto-send response via adapter if func returns outbound content
  */
 const createWebhookPostHandler = (config) => {
-    const { name, func: userFunc, middleware: userMiddleware } = config;
-    const userFuncConfig = userFunc;
+    const { name, middleware: userMiddleware } = config;
+    const handlerFuncId = registerGatewayHandler(config);
     return async (services, data, wire) => {
         const adapter = await resolveGatewayAdapter(config, services);
         // Check for POST-based webhook verification (e.g. Slack url_verification)
@@ -136,23 +183,28 @@ const createWebhookPostHandler = (config) => {
             send: (msg) => adapter.send(parsed.senderId, msg),
         };
         wire.gateway = gateway;
-        // Build combined middleware chain: gateway-level + func-level
-        const allMiddleware = [
-            ...(userMiddleware || []),
-            ...(userFuncConfig.middleware || []),
-        ];
-        const exec = async () => {
-            const result = await userFuncConfig.func(services, parsed, wire);
-            // Auto-send response if the func returns outbound content
-            if (result && (result.text || result.richContent || result.attachments)) {
-                await adapter.send(parsed.senderId, result);
-            }
-            return { ok: true };
+        // Gateway middleware runs first and outside the gate, so it can establish
+        // the session the gate then checks. The handler is invoked through the
+        // function runner, which enforces its auth, scopes and permissions and
+        // applies the handler's own middleware.
+        const invoke = async () => {
+            await bridgeMiddlewareSession(wire);
+            return await runPikkuFunc('gateway', name, handlerFuncId, {
+                singletonServices: services,
+                data: () => parsed,
+                auth: config.auth,
+                wire: wire,
+            });
         };
-        if (allMiddleware.length > 0) {
-            return await runMiddleware(services, wire, allMiddleware, exec);
+        const gatewayMiddleware = userMiddleware;
+        const result = gatewayMiddleware?.length
+            ? await runMiddleware(services, wire, gatewayMiddleware, invoke)
+            : await invoke();
+        // Auto-send response if the func returns outbound content
+        if (result && (result.text || result.richContent || result.attachments)) {
+            await adapter.send(parsed.senderId, result);
         }
-        return await exec();
+        return { ok: true };
     };
 };
 /**
@@ -215,8 +267,8 @@ const wireWebsocketGateway = (config) => {
         connect: { pikkuFuncId: connectFuncId },
         message: { pikkuFuncId: messageFuncId },
     };
-    const userFuncConfig = config.func;
     const userMiddleware = config.middleware;
+    const handlerFuncId = registerGatewayHandler(config);
     // Register onConnect
     addFunction(connectFuncId, {
         auth: false,
@@ -249,22 +301,21 @@ const wireWebsocketGateway = (config) => {
                 },
             };
             wire.gateway = gateway;
-            const allMiddleware = [
-                ...(userMiddleware || []),
-                ...(userFuncConfig.middleware || []),
-            ];
-            const exec = async () => {
-                const result = await userFuncConfig.func(services, parsed, wire);
-                if (result &&
-                    (result.text || result.richContent || result.attachments)) {
-                    wire.channel?.send(result);
-                }
+            const invoke = async () => {
+                await bridgeMiddlewareSession(wire);
+                return await runPikkuFunc('gateway', name, handlerFuncId, {
+                    singletonServices: services,
+                    data: () => parsed,
+                    auth: config.auth,
+                    wire: wire,
+                });
             };
-            if (allMiddleware.length > 0) {
-                await runMiddleware(services, wire, allMiddleware, exec);
-            }
-            else {
-                await exec();
+            const gatewayMiddleware = userMiddleware;
+            const result = gatewayMiddleware?.length
+                ? await runMiddleware(services, wire, gatewayMiddleware, invoke)
+                : await invoke();
+            if (result && (result.text || result.richContent || result.attachments)) {
+                wire.channel?.send(result);
             }
         },
     });
@@ -300,8 +351,8 @@ const wireListenerGateway = (config) => {
  * @param singletonServices - Singleton services to pass to handler/middleware
  */
 export const createListenerMessageHandler = (name, config, singletonServices) => {
-    const userFuncConfig = config.func;
     const userMiddleware = config.middleware;
+    const handlerFuncId = registerGatewayHandler(config);
     return async (rawData) => {
         const adapter = await resolveGatewayAdapter(config, singletonServices);
         const parsed = adapter.parse(rawData);
@@ -315,21 +366,20 @@ export const createListenerMessageHandler = (name, config, singletonServices) =>
             send: (msg) => adapter.send(parsed.senderId, msg),
         };
         wire.gateway = gateway;
-        const allMiddleware = [
-            ...(userMiddleware || []),
-            ...(userFuncConfig.middleware || []),
-        ];
-        const exec = async () => {
-            const result = await userFuncConfig.func(singletonServices, parsed, wire);
-            if (result && (result.text || result.richContent || result.attachments)) {
-                await adapter.send(parsed.senderId, result);
-            }
+        const invoke = async () => {
+            await bridgeMiddlewareSession(wire);
+            return await runPikkuFunc('gateway', name, handlerFuncId, {
+                singletonServices,
+                data: () => parsed,
+                auth: config.auth,
+                wire,
+            });
         };
-        if (allMiddleware.length > 0) {
-            await runMiddleware(singletonServices, wire, allMiddleware, exec);
-        }
-        else {
-            await exec();
+        const result = userMiddleware?.length
+            ? await runMiddleware(singletonServices, wire, userMiddleware, invoke)
+            : await invoke();
+        if (result && (result.text || result.richContent || result.attachments)) {
+            await adapter.send(parsed.senderId, result);
         }
     };
 };

package/dist/wirings/gateway/gateway.types.d.ts

@@ -1,5 +1,5 @@
 import type { CommonWireMeta, CorePikkuMiddleware, CorePikkuMiddlewareGroup, CoreSingletonServices } from '../../types/core.types.js';
-import type { CorePikkuFunctionConfig, CorePermissionGroup, CorePikkuPermission } from '../../function/functions.types.js';
+import type { CorePikkuFunctionConfig } from '../../function/functions.types.js';
 import type { PikkuHTTPRequest } from '../http/http.types.js';
 /**
  * Attachment in gateway messages (images, files, etc.)
@@ -102,7 +102,7 @@ export type GatewayTransportType = 'webhook' | 'websocket' | 'listener';
 /**
  * Core gateway configuration for wireGateway()
  */
-export type CoreGateway<PikkuFunctionConfig = CorePikkuFunctionConfig<any, any>, PikkuPermission extends CorePikkuPermission = CorePikkuPermission, PikkuMiddleware extends CorePikkuMiddleware = CorePikkuMiddleware> = Partial<Pick<CommonWireMeta, 'title' | 'summary' | 'description' | 'errors'>> & {
+export type CoreGateway<PikkuFunctionConfig = CorePikkuFunctionConfig<any, any>, PikkuMiddleware extends CorePikkuMiddleware = CorePikkuMiddleware> = Partial<Pick<CommonWireMeta, 'title' | 'summary' | 'description' | 'errors'>> & {
     /** Unique name for this gateway */
     name: string;
     /** Transport type */
@@ -117,11 +117,14 @@ export type CoreGateway<PikkuFunctionConfig = CorePikkuFunctionConfig<any, any>,
     func: PikkuFunctionConfig;
     /** Optional middleware chain (e.g., auth) */
     middleware?: CorePikkuMiddlewareGroup<any, any>;
-    /** Optional permissions */
-    permissions?: CorePermissionGroup | PikkuPermission[];
     /** Optional tags for categorization */
     tags?: string[];
-    /** Whether authentication is required (default: true) */
+    /**
+     * Whether the handler requires a session. Left unset, the handler's own
+     * `auth` governs, and a gateway handler is sessionless by default — inbound
+     * gateway traffic is platform-authenticated by the adapter, not
+     * session-bearing. Set `true` to require a session for every message.
+     */
     auth?: boolean;
 };
 /**

package/dist/wirings/http/http-routes.js

@@ -83,7 +83,6 @@ function processRouteMap(map, parentConfig) {
  * - tags: Merges (parent + child)
  * - middleware: Merges (parent runs first)
  * - auth: Inner overrides outer
- * - permissions: Inner overrides outer
  */
 function mergeGroupConfig(parent, child) {
     return {
@@ -91,7 +90,6 @@ function mergeGroupConfig(parent, child) {
         tags: [...(parent.tags || []), ...(child.tags || [])],
         middleware: [...(parent.middleware || []), ...(child.middleware || [])],
         auth: child.auth ?? parent.auth,
-        permissions: child.permissions ?? parent.permissions,
     };
 }
 /**
@@ -109,7 +107,6 @@ function registerRoute(route, groupConfig) {
             ...(groupConfig.middleware || []),
             ...(route.middleware || []),
         ],
-        permissions: route.permissions ?? groupConfig.permissions,
         contentType: route.contentType,
         timeout: route.timeout,
         headers: route.headers,

package/dist/wirings/http/http-runner.d.ts

@@ -1,5 +1,5 @@
 import type { CoreHTTPFunctionWiring, RunHTTPWiringOptions, PikkuHTTP, PikkuHTTPRequest, PikkuHTTPResponse } from './http.types.js';
-import type { CorePikkuFunction, CorePikkuFunctionSessionless, CorePikkuPermission, CorePermissionGroup } from '../../function/functions.types.js';
+import type { CorePikkuFunction, CorePikkuFunctionSessionless, CorePikkuPermission } from '../../function/functions.types.js';
 import type { CorePikkuMiddleware, CorePikkuMiddlewareGroup } from '../../types/core.types.js';
 import { PikkuFetchHTTPResponse } from './pikku-fetch-http-response.js';
 /**
@@ -33,35 +33,15 @@ import { PikkuFetchHTTPResponse } from './pikku-fetch-http-response.js';
  */
 export declare const addHTTPMiddleware: <PikkuMiddleware extends CorePikkuMiddleware>(pattern: string, middleware: CorePikkuMiddlewareGroup, packageName?: string | null) => CorePikkuMiddlewareGroup;
 /**
- * Registers HTTP permissions for a specific route pattern.
- *
- * This function registers permissions at runtime that will be applied to
- * HTTP routes matching the specified pattern.
- *
- * For tree-shaking benefits, wrap in a factory function:
- * `export const x = () => addHTTPPermission('pattern', [...])`
- *
- * @template PikkuPermission The permission type.
- * @param {string} pattern - Route pattern (e.g., '*' for all routes, '/api/*' for specific routes).
- * @param {CorePermissionGroup | CorePikkuPermission[]} permissions - Permissions for this route pattern.
- *
- * @returns {CorePermissionGroup | CorePikkuPermission[]} The permissions (for chaining/wrapping).
- *
- * @example
- * ```typescript
- * // Recommended: tree-shakeable
- * export const httpGlobalPermissions = () => addHTTPPermission('*', [
- *   authenticatedPermission,
- *   rateLimitPermission
- * ])
- *
- * // Also works: no tree-shaking
- * export const apiPermissions = addHTTPPermission('/api/*', [
- *   adminPermission
- * ])
- * ```
+ * @deprecated HTTP-route-level permissions were removed in #972 — permissions
+ * are now function-scoped only (declare them on the function via
+ * `pikkuFunc({ permissions })`). This throwing stub exists solely so the pinned
+ * bootstrap CLI (which still generates an `addHTTPPermission` wrapper) can
+ * resolve the import at build time; it is never called. Delete once
+ * `PIKKU_CLI_VERSION` in the CLI build is bumped past the release that removes
+ * HTTP-route permissions.
  */
-export declare const addHTTPPermission: <PikkuPermission extends CorePikkuPermission>(pattern: string, permissions: CorePermissionGroup | CorePikkuPermission[], packageName?: string | null) => CorePermissionGroup | CorePikkuPermission[];
+export declare const addHTTPPermission: (_pattern: string, _permissions: Record<string, CorePikkuPermission | CorePikkuPermission[]> | CorePikkuPermission[]) => never;
 /**
  * Adds a new route to the global HTTP route registry.
  *

package/dist/wirings/http/http-runner.js

@@ -64,38 +64,16 @@ export const addHTTPMiddleware = (pattern, middleware, packageName = null) => {
     return middleware;
 };
 /**
- * Registers HTTP permissions for a specific route pattern.
- *
- * This function registers permissions at runtime that will be applied to
- * HTTP routes matching the specified pattern.
- *
- * For tree-shaking benefits, wrap in a factory function:
- * `export const x = () => addHTTPPermission('pattern', [...])`
- *
- * @template PikkuPermission The permission type.
- * @param {string} pattern - Route pattern (e.g., '*' for all routes, '/api/*' for specific routes).
- * @param {CorePermissionGroup | CorePikkuPermission[]} permissions - Permissions for this route pattern.
- *
- * @returns {CorePermissionGroup | CorePikkuPermission[]} The permissions (for chaining/wrapping).
- *
- * @example
- * ```typescript
- * // Recommended: tree-shakeable
- * export const httpGlobalPermissions = () => addHTTPPermission('*', [
- *   authenticatedPermission,
- *   rateLimitPermission
- * ])
- *
- * // Also works: no tree-shaking
- * export const apiPermissions = addHTTPPermission('/api/*', [
- *   adminPermission
- * ])
- * ```
+ * @deprecated HTTP-route-level permissions were removed in #972 — permissions
+ * are now function-scoped only (declare them on the function via
+ * `pikkuFunc({ permissions })`). This throwing stub exists solely so the pinned
+ * bootstrap CLI (which still generates an `addHTTPPermission` wrapper) can
+ * resolve the import at build time; it is never called. Delete once
+ * `PIKKU_CLI_VERSION` in the CLI build is bumped past the release that removes
+ * HTTP-route permissions.
  */
-export const addHTTPPermission = (pattern, permissions, packageName = null) => {
-    const httpGroups = pikkuState(packageName, 'permissions', 'httpGroup');
-    httpGroups[pattern] = permissions;
-    return permissions;
+export const addHTTPPermission = (_pattern, _permissions) => {
+    throw new Error('addHTTPPermission was removed in #972 — HTTP-route-level permissions no longer exist. Declare permissions on the function definition instead: pikkuFunc({ permissions }).');
 };
 /**
  * Adds a new route to the global HTTP route registry.
@@ -156,7 +134,6 @@ const getMatchingRoute = (requestType, requestPath) => {
             matchedPath,
             params: matchedPath.params,
             route,
-            permissions: route.permissions,
             meta: meta,
         };
     }
@@ -307,8 +284,6 @@ const executeRoute = async (services, matchedRoute, http, options) => {
             data,
             inheritedMiddleware: meta.middleware,
             wireMiddleware: route.middleware,
-            inheritedPermissions: meta.permissions,
-            wirePermissions: route.permissions,
             coerceDataFromSchema: options.coerceDataFromSchema,
             tags: route.tags,
             wire,

package/dist/wirings/http/http.types.d.ts

@@ -1,7 +1,7 @@
 import type { SerializeOptions } from 'cookie';
 import type { StandardSchemaV1 } from '@standard-schema/spec';
 import type { CorePikkuMiddleware, CommonWireMeta } from '../../types/core.types.js';
-import type { CorePikkuFunction, CorePikkuFunctionSessionless, CorePikkuPermission, CorePermissionGroup, CorePikkuFunctionConfig } from '../../function/functions.types.js';
+import type { CorePikkuFunction, CorePikkuFunctionSessionless, CorePikkuPermission, CorePikkuFunctionConfig } from '../../function/functions.types.js';
 type ExtractHTTPWiringParams<S extends string> = S extends `${string}:${infer Param}/${infer Rest}` ? Param | ExtractHTTPWiringParams<`/${Rest}`> : S extends `${string}:${infer Param}` ? Param : never;
 export type AssertHTTPWiringParams<In, HTTPWiring extends string> = ExtractHTTPWiringParams<HTTPWiring> extends keyof In ? unknown : [
     'Error: HTTPWiring parameters',
@@ -71,11 +71,10 @@ export type PikkuQuery<T = Record<string, string | undefined>> = Record<string,
  * @template PikkuFunctionSessionless - The sessionless API function type, defaults to `CorePikkuFunctionSessionless`.
  * @template PikkuPermission - The permission function type, defaults to `CorePikkuPermission`.
  */
-export type CoreHTTPFunctionWiring<In, Out, R extends string, PikkuFunction extends CorePikkuFunction<In, Out, any, any, any> = CorePikkuFunction<In, Out>, PikkuFunctionSessionless extends CorePikkuFunctionSessionless<In, Out, any, any, any> = CorePikkuFunctionSessionless<In, Out>, PikkuPermission extends CorePikkuPermission<In, any, any> = CorePikkuPermission<In, any, any>, PikkuMiddleware extends CorePikkuMiddleware<any, any> = CorePikkuMiddleware<any>> = (CoreHTTPFunction & {
+export type CoreHTTPFunctionWiring<In, Out, R extends string, PikkuFunction extends CorePikkuFunction<In, Out, any, any, any> = CorePikkuFunction<In, Out>, PikkuFunctionSessionless extends CorePikkuFunctionSessionless<In, Out, any, any, any> = CorePikkuFunctionSessionless<In, Out>, PikkuPermission extends CorePikkuPermission<In, any, any> = CorePikkuPermission<In, any, any>, PikkuMiddleware extends CorePikkuMiddleware<any, any> = CorePikkuMiddleware<any, any>> = (CoreHTTPFunction & {
     route: R;
     method: HTTPMethod;
     func: CorePikkuFunctionConfig<PikkuFunction, PikkuPermission, PikkuMiddleware>;
-    permissions?: CorePermissionGroup<PikkuPermission>;
     auth?: true;
     middleware?: PikkuMiddleware[];
     sse?: undefined;
@@ -83,7 +82,6 @@ export type CoreHTTPFunctionWiring<In, Out, R extends string, PikkuFunction exte
     route: R;
     method: HTTPMethod;
     func: CorePikkuFunctionConfig<PikkuFunctionSessionless, PikkuPermission, PikkuMiddleware>;
-    permissions?: undefined;
     auth?: false;
     middleware?: PikkuMiddleware[];
     sse?: undefined;
@@ -91,7 +89,6 @@ export type CoreHTTPFunctionWiring<In, Out, R extends string, PikkuFunction exte
     route: R;
     method: 'get';
     func: CorePikkuFunctionConfig<PikkuFunction, PikkuPermission, PikkuMiddleware>;
-    permissions?: CorePermissionGroup<PikkuPermission>;
     auth?: true;
     middleware?: PikkuMiddleware[];
     sse?: boolean;
@@ -99,7 +96,6 @@ export type CoreHTTPFunctionWiring<In, Out, R extends string, PikkuFunction exte
     route: R;
     method: 'get';
     func: CorePikkuFunctionConfig<PikkuFunctionSessionless, PikkuPermission, PikkuMiddleware>;
-    permissions?: undefined;
     auth?: false;
     middleware?: PikkuMiddleware[];
     sse?: boolean;
@@ -107,7 +103,6 @@ export type CoreHTTPFunctionWiring<In, Out, R extends string, PikkuFunction exte
     route: R;
     method: 'post';
     func: CorePikkuFunctionConfig<PikkuFunction, PikkuPermission, PikkuMiddleware>;
-    permissions?: CorePermissionGroup<PikkuPermission>;
     auth?: true;
     middleware?: PikkuMiddleware[];
     query?: Array<keyof In>;
@@ -116,7 +111,6 @@ export type CoreHTTPFunctionWiring<In, Out, R extends string, PikkuFunction exte
     route: R;
     method: 'post';
     func: CorePikkuFunctionConfig<PikkuFunctionSessionless, PikkuPermission, PikkuMiddleware>;
-    permissions?: undefined;
     auth?: false;
     middleware?: PikkuMiddleware[];
     query?: Array<keyof In>;
@@ -183,24 +177,22 @@ export interface PikkuHTTPResponse<Out = unknown> {
 /**
  * Single route configuration - supports all wireHTTP options
  */
-export type HTTPRouteConfig<PikkuFunction extends CorePikkuFunction<any, any, any, any, any> | CorePikkuFunctionSessionless<any, any, any, any, any> = CorePikkuFunction<any, any, any, any, any> | CorePikkuFunctionSessionless<any, any, any, any, any>, PikkuPermission extends CorePikkuPermission<any, any, any> = CorePikkuPermission<any>, PikkuMiddleware extends CorePikkuMiddleware<any, any> = CorePikkuMiddleware<any, any>> = HTTPRouteBaseConfig & {
+export type HTTPRouteConfig<PikkuFunction extends CorePikkuFunction<any, any, any, any, any> | CorePikkuFunctionSessionless<any, any, any, any, any> = CorePikkuFunction<any, any, any, any, any> | CorePikkuFunctionSessionless<any, any, any, any, any>, PikkuPermission extends CorePikkuPermission<any, any, any> = CorePikkuPermission<any, any, any>, PikkuMiddleware extends CorePikkuMiddleware<any, any> = CorePikkuMiddleware<any, any>> = HTTPRouteBaseConfig & {
     method: HTTPMethod;
     route: string;
     func: CorePikkuFunctionConfig<PikkuFunction, PikkuPermission, PikkuMiddleware>;
     auth?: boolean;
-    permissions?: CorePermissionGroup<PikkuPermission>;
     middleware?: PikkuMiddleware[];
     sse?: boolean;
 };
 /**
  * Group-level configuration applied to all routes
  */
-export type HTTPRoutesGroupConfig<PikkuPermission extends CorePikkuPermission<any, any, any> = CorePikkuPermission<any>, PikkuMiddleware extends CorePikkuMiddleware<any, any> = CorePikkuMiddleware<any, any>> = {
+export type HTTPRoutesGroupConfig<PikkuPermission extends CorePikkuPermission<any, any, any> = CorePikkuPermission<any, any, any>, PikkuMiddleware extends CorePikkuMiddleware<any, any> = CorePikkuMiddleware<any, any>> = {
     basePath?: string;
     tags?: string[];
     auth?: boolean;
     middleware?: PikkuMiddleware[];
-    permissions?: CorePermissionGroup<PikkuPermission>;
 };
 /**
  * Nested route map - allows hierarchical organization

package/dist/wirings/mcp/mcp-runner.js

@@ -134,8 +134,6 @@ async function runMCPPikkuFunc(request, type, name, mcp, pikkuFuncId, { mcp: mcp
             data: () => request.params,
             inheritedMiddleware: meta?.middleware,
             wireMiddleware: mcp?.middleware,
-            inheritedPermissions: meta?.permissions,
-            wirePermissions: mcp?.permissions,
             tags: mcp?.tags,
             wire,
             sessionService: mcpSessionService,

package/dist/wirings/mcp/mcp.types.d.ts

@@ -1,5 +1,5 @@
-import type { CorePermissionGroup, CorePikkuFunctionConfig, CorePikkuFunctionSessionless, CorePikkuPermission } from '../../function/functions.types.js';
-import type { CorePikkuMiddleware, MiddlewareMetadata, PermissionMetadata } from '../../types/core.types.js';
+import type { CorePikkuFunctionConfig, CorePikkuFunctionSessionless, CorePikkuPermission } from '../../function/functions.types.js';
+import type { CorePikkuMiddleware, MiddlewareMetadata } from '../../types/core.types.js';
 /**
  * Extract URI parameters from MCP resource URI template.
  * E.g., "user/{userId}/post/{postId}" => "userId" | "postId"
@@ -25,27 +25,25 @@ export type PikkuMCP<Tools extends string = any> = {
 /**
  * Represents metadata for MCP resources, including name, description, and documentation.
  */
-export type MCPResourceMeta = Record<string, Omit<CoreMCPResource, 'func' | 'middleware' | 'permissions'> & {
+export type MCPResourceMeta = Record<string, Omit<CoreMCPResource, 'func' | 'middleware'> & {
     pikkuFuncId: string;
     inputSchema: string | null;
     outputSchema: string | null;
     middleware?: MiddlewareMetadata[];
-    permissions?: PermissionMetadata[];
 }>;
 /**
  * Represents metadata for MCP tools, including name, description, and documentation.
  */
-export type MCPToolMeta = Record<string, Omit<CoreMCPTool, 'func' | 'middleware' | 'permissions'> & {
+export type MCPToolMeta = Record<string, Omit<CoreMCPTool, 'func' | 'middleware'> & {
     pikkuFuncId: string;
     inputSchema: string | null;
     outputSchema: string | null;
     middleware?: MiddlewareMetadata[];
-    permissions?: PermissionMetadata[];
 }>;
 /**
  * Represents metadata for MCP prompts, including name, description, and arguments.
  */
-export type MCPPromptMeta = Record<string, Omit<CoreMCPPrompt, 'func' | 'middleware' | 'permissions'> & {
+export type MCPPromptMeta = Record<string, Omit<CoreMCPPrompt, 'func' | 'middleware'> & {
     pikkuFuncId: string;
     inputSchema: string | null;
     outputSchema: string | null;
@@ -55,7 +53,6 @@ export type MCPPromptMeta = Record<string, Omit<CoreMCPPrompt, 'func' | 'middlew
         required: boolean;
     }>;
     middleware?: MiddlewareMetadata[];
-    permissions?: PermissionMetadata[];
 }>;
 /**
  * Represents an MCP resource with specific properties.
@@ -72,7 +69,6 @@ export type CoreMCPResource<PikkuFunctionConfig = CorePikkuFunctionConfig<CorePi
     func: PikkuFunctionConfig;
     tags?: string[];
     middleware?: PikkuMiddleware[];
-    permissions?: CorePermissionGroup<PikkuPermission>;
 };
 /**
  * Represents an MCP tool with specific properties.
@@ -87,7 +83,6 @@ export type CoreMCPTool<PikkuFunctionConfig = CorePikkuFunctionConfig<CorePikkuF
     tags?: string[];
     streaming?: boolean;
     middleware?: PikkuMiddleware[];
-    permissions?: CorePermissionGroup<PikkuPermission>;
 };
 /**
  * Represents an MCP prompt with specific properties.
@@ -100,7 +95,6 @@ export type CoreMCPPrompt<PikkuFunctionConfig = CorePikkuFunctionConfig<CorePikk
     func: PikkuFunctionConfig;
     tags?: string[];
     middleware?: PikkuMiddleware[];
-    permissions?: CorePermissionGroup<PikkuPermission>;
 };
 export type JsonRpcRequest = {
     jsonrpc: string;

package/dist/wirings/oauth2/index.d.ts

@@ -1,4 +1 @@
-export { OAuth2Client } from './oauth2-client.js';
-export { createOAuth2Handler } from './oauth2-routes.js';
-export type { CreateOAuth2HandlerOptions } from './oauth2-routes.js';
 export type { OAuth2AppCredential, OAuth2Token } from './oauth2.types.js';

package/dist/wirings/oauth2/index.js

@@ -1,2 +1 @@
-export { OAuth2Client } from './oauth2-client.js';
-export { createOAuth2Handler } from './oauth2-routes.js';
+export {};

package/dist/wirings/rpc/addon-runner.d.ts

@@ -0,0 +1,28 @@
+import type { CoreSingletonServices } from '../../types/core.types.js';
+/**
+ * A single wired addon instance: a namespace (wireAddon `name`) plus the
+ * per-instance name-aliases that remap the logical names the addon reads to
+ * the actual project secret/variable/credential names.
+ */
+export type AddonInstance = {
+    namespace: string;
+    secretOverrides?: Record<string, string>;
+    variableOverrides?: Record<string, string>;
+    credentialOverrides?: Record<string, string>;
+};
+/**
+ * Get or create singleton services for an addon instance.
+ * Services are cached in pikkuState to avoid recreation on each call.
+ *
+ * @param packageName - The addon package name
+ * @param parentServices - The parent/caller's singleton services (used as base)
+ * @param addonInstance - The wired instance whose overrides shape the services
+ * @returns The instance's singleton services
+ */
+export declare const getOrCreatePackageSingletonServices: (packageName: string, parentServices: CoreSingletonServices, addonInstance?: AddonInstance) => Promise<CoreSingletonServices>;
+/**
+ * Build the addon instance descriptor (namespace + per-instance overrides) for
+ * a bare intra-addon call, using the namespace currently executing on the wire.
+ * Returns undefined unless that namespace maps to the resolved package.
+ */
+export declare const addonInstanceForNamespace: (namespace: string | undefined, expectedPackage: string) => AddonInstance | undefined;