@pikku/core 0.12.71 → 0.12.72

package/CHANGELOG.md

@@ -1,3 +1,58 @@
+## 0.12.72
+
+### Patch Changes
+
+- 384e484: Apply schema defaults, which nothing was ever filling in
+
+  A `default` on an input property reaches the generated JSON Schema and keeps
+  that property out of `required`, so a call that omits it validates. Nothing
+  then filled it in: JSON Schema validators are pure by specification, and
+  neither `@cfworker/json-schema` nor Ajv (without `useDefaults`) annotates the
+  instance being checked. The function received `undefined` for a property its
+  own generated type declares as present.
+
+  That is the worst shape the mismatch can take. Validation permits the omission,
+  the type promises a value, and the body reads `undefined` — so it surfaces far
+  from its cause, as `const offset = (page - 1) * limit` evaluating to `NaN` and
+  `.limit(undefined)` reaching the database on a paginated call made with no
+  arguments.
+
+  Defaults are now filled in before validation, on every path. Deliberately not
+  gated on `coerceDataFromSchema`, the flag guarding the neighbouring coercion
+  step: that flag is about decoding transport-encoded values (a query string's
+  `"1,2"` into an array) and is absent on a direct RPC invocation. A default
+  belongs to the schema rather than to the transport a call arrived on, so
+  gating it there would fill defaults over HTTP and skip them on RPC.
+
+  Filling is by presence rather than truthiness, so a supplied `0` or `false`
+  survives, and a call made with no arguments at all still gets its defaults.
+  Values are cloned, because an object or array default would otherwise be a
+  single mutable instance shared by every request in the process — one request's
+  `push` showing up in the next.
+
+  Nothing needs to change in generated types or call sites: both were already
+  written as though defaults worked. This makes them true.
+
+- b5a73fb: fix: stop leaking internal error detail and bound the request body size
+
+  HTTP error responses no longer forward an error's `payload` or its raw `message` for
+  registered 5xx errors — those responses carry the registered error message instead, so an
+  internal error that happens to hold a `payload` cannot leak it to the client. Errors
+  registered with a 4xx status keep their message and payload, and `exposeErrors` still
+  surfaces the full detail outside production.
+
+  `PikkuFetchHTTPRequest` now caps how much of a request body it buffers, rejecting the
+  declared `content-length` up front and measuring the stream as it arrives so a lying or
+  absent header cannot exhaust memory. Exceeding the limit throws `PayloadTooLargeError`
+  (413). The ceiling defaults to 10MB and is configurable via the new `maxBodySize` option on
+  the constructor and on `RunHTTPWiringOptions`.
+
+- 6be5ab0: Security hardening: removed the gopass secret service and stopped MCP internal errors leaking stack traces.
+
+  **Breaking:** `GopassSecretService` and the `@pikku/core/services/gopass-secrets` subpath export are gone. The service shelled out to the `gopass` binary and its key validation accepted `../`, so a caller-supplied key could traverse out of the configured prefix namespace and read secrets outside it. Rather than harden a shell-out that few projects used, the service is removed. Anyone importing it should implement `SecretService` against their own secret backend. Pre-0.13 breaking changes still ship as a patch.
+
+  MCP internal errors (JSON-RPC `-32603`) previously always attached `data: { message, stack }`, handing any MCP client an internal stack trace. That payload is now gated on `exposeErrors`, which defaults to `!isProduction()` — the same convention `handleHTTPError` already uses. In production a client receives a bare `Internal error` with no `message` and no `stack`. `RunMCPEndpointParams` accepts an explicit `exposeErrors` to suppress the detail outside production as well; it cannot force the detail on in production, because the check is `exposeErrors && !isProduction()` — again matching `handleHTTPError`.
+
 ## 0.12.71
 
 ### Patch Changes

package/dist/function/function-runner.js

@@ -2,7 +2,7 @@ import { runMiddleware, combineMiddleware } from '../middleware-runner.js';
 import { combineChannelMiddleware, wrapChannelWithMiddleware, } from '../wirings/channel/channel-middleware-runner.js';
 import { runPermissions } from '../permissions.js';
 import { pikkuState } from '../pikku-state.js';
-import { coerceTopLevelDataFromSchema, validateSchema } from '../schema.js';
+import { applyDefaultsFromSchema, coerceTopLevelDataFromSchema, validateSchema, } from '../schema.js';
 import { parseVersionedId } from '../version.js';
 import { PikkuSessionService } from '../services/user-session-service.js';
 import { ForbiddenError, ReadonlySessionError } from '../errors/errors.js';
@@ -166,10 +166,15 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
         // evaluates the function's own OR-groups against request data.
         verifyScopes(funcConfig.scopes ?? funcMeta.scopes, session);
         // Evaluate the data from the lazy function
-        const actualData = await data();
+        let actualData = await data();
         // Validate and coerce data if schema is defined
         const inputSchemaName = funcMeta.inputSchemaName;
         if (inputSchemaName) {
+            // Fill in schema defaults before anything reads the data. Unconditional:
+            // a default belongs to the schema, not to the transport the call arrived
+            // on. Runs before coercion so a defaulted value and a supplied one are
+            // treated identically from here on.
+            actualData = applyDefaultsFromSchema(inputSchemaName, actualData, packageName);
             // Coerce (top level) data types before validation (e.g. string→array, string→date)
             if (coerceDataFromSchema) {
                 coerceTopLevelDataFromSchema(inputSchemaName, actualData, packageName);

package/dist/handle-error.d.ts

@@ -10,5 +10,7 @@ import type { PikkuHTTP } from './wirings/http/http.types.js';
  * @param {number[]} logWarningsForStatusCodes - HTTP status codes to log as warnings
  * @param {boolean} respondWith404 - Whether to respond with 404 for NotFoundError
  * @param {boolean} bubbleError - Whether to throw the error after handling
+ * @param {boolean} exposeErrors - Whether to include internal error details (message, stack and
+ * payload of 5xx errors) in the response body. Ignored in production.
  */
 export declare const handleHTTPError: (e: any, http: PikkuHTTP | undefined, traceId: string | undefined, logger: Logger, logWarningsForStatusCodes: number[], respondWith404: boolean, bubbleError: boolean, exposeErrors?: boolean) => void;

package/dist/handle-error.js

@@ -11,6 +11,8 @@ import { NotFoundError } from './errors/errors.js';
  * @param {number[]} logWarningsForStatusCodes - HTTP status codes to log as warnings
  * @param {boolean} respondWith404 - Whether to respond with 404 for NotFoundError
  * @param {boolean} bubbleError - Whether to throw the error after handling
+ * @param {boolean} exposeErrors - Whether to include internal error details (message, stack and
+ * payload of 5xx errors) in the response body. Ignored in production.
  */
 export const handleHTTPError = (e, http, traceId, logger, logWarningsForStatusCodes, respondWith404, bubbleError, exposeErrors = false) => {
     // Skip 404 handling if configured to do so
@@ -20,14 +22,18 @@ export const handleHTTPError = (e, http, traceId, logger, logWarningsForStatusCo
     // Get appropriate error response
     const errorResponse = getErrorResponse(e);
     if (errorResponse != null) {
+        const clientFacing = errorResponse.status < 500 || (exposeErrors && !isProduction());
         // Set status and response body
         http?.response?.status(errorResponse.status);
         http?.response?.json({
             name: e instanceof Error ? e.name : undefined,
-            message: e instanceof Error && e.message && e.message !== 'An error occurred'
+            message: clientFacing &&
+                e instanceof Error &&
+                e.message &&
+                e.message !== 'An error occurred'
                 ? e.message
                 : errorResponse.message,
-            payload: e.payload,
+            payload: clientFacing ? e.payload : undefined,
             errorId: traceId,
         });
         // Log certain status codes as warnings

package/dist/schema.d.ts

@@ -21,5 +21,29 @@ export declare const getSchema: (name: string, packageName?: string | null) => R
  * @param logger - A logger for logging information.
  */
 export declare const compileAllSchemas: (logger: Logger, schemaService?: SchemaService) => void;
+/**
+ * Fill in absent top-level properties from their schema `default`.
+ *
+ * A `default` reaches the generated JSON Schema and keeps the property out of
+ * `required`, so omitting it validates — but nothing was ever filling it in.
+ * JSON Schema validators are pure by specification and none of the ones Pikku
+ * ships with (`@cfworker/json-schema`, and Ajv unless `useDefaults` is set)
+ * annotate the instance, so the function received `undefined` for a property
+ * its generated type declares as present. That is the worst shape a mismatch
+ * can take: validation permits the omission, the type says the value is there,
+ * and the body reads `undefined`.
+ *
+ * Applied unconditionally rather than alongside `coerceTopLevelDataFromSchema`,
+ * whose `coerceDataFromSchema` flag is about decoding transport-encoded values
+ * (a query string's `"1,2"` into an array). Defaults are a property of the
+ * schema, not of how the call arrived, so gating them on that flag would apply
+ * them over HTTP and skip them on a direct RPC invocation.
+ *
+ * Returns the data to use, which is a new object only when defaults had to be
+ * added to a nullish input — a call made with no arguments at all still gets
+ * them. Values are cloned so an object or array default (`[]`, `{}`) is never
+ * shared as one mutable instance across every request.
+ */
+export declare const applyDefaultsFromSchema: (schemaName: string, data: any, packageName?: string | null) => any;
 export declare const coerceTopLevelDataFromSchema: (schemaName: string, data: any, packageName?: string | null) => void;
 export declare const validateSchema: (logger: Logger, schemaService: SchemaService | undefined, schemaName: string | undefined | null, data: any, packageName?: string | null) => Promise<void>;

package/dist/schema.js

@@ -65,6 +65,52 @@ const validateAllSchemasLoaded = (logger, schemaService) => {
         logger.info('All schemas loaded');
     }
 };
+/**
+ * Fill in absent top-level properties from their schema `default`.
+ *
+ * A `default` reaches the generated JSON Schema and keeps the property out of
+ * `required`, so omitting it validates — but nothing was ever filling it in.
+ * JSON Schema validators are pure by specification and none of the ones Pikku
+ * ships with (`@cfworker/json-schema`, and Ajv unless `useDefaults` is set)
+ * annotate the instance, so the function received `undefined` for a property
+ * its generated type declares as present. That is the worst shape a mismatch
+ * can take: validation permits the omission, the type says the value is there,
+ * and the body reads `undefined`.
+ *
+ * Applied unconditionally rather than alongside `coerceTopLevelDataFromSchema`,
+ * whose `coerceDataFromSchema` flag is about decoding transport-encoded values
+ * (a query string's `"1,2"` into an array). Defaults are a property of the
+ * schema, not of how the call arrived, so gating them on that flag would apply
+ * them over HTTP and skip them on a direct RPC invocation.
+ *
+ * Returns the data to use, which is a new object only when defaults had to be
+ * added to a nullish input — a call made with no arguments at all still gets
+ * them. Values are cloned so an object or array default (`[]`, `{}`) is never
+ * shared as one mutable instance across every request.
+ */
+export const applyDefaultsFromSchema = (schemaName, data, packageName = null) => {
+    const schema = pikkuState(packageName, 'misc', 'schemas').get(schemaName);
+    if (!schema?.properties)
+        return data;
+    // A primitive body cannot carry named properties; leave it for the validator
+    // to reject rather than reshaping it into something that would pass.
+    if (data != null && typeof data !== 'object')
+        return data;
+    let result = data;
+    for (const key in schema.properties) {
+        const property = schema.properties[key];
+        if (typeof property === 'boolean' || !('default' in property)) {
+            continue;
+        }
+        // Allocated only once a default is actually found, so a schema without any
+        // leaves the caller's data (and its absence) exactly as it was.
+        result ??= {};
+        if (result[key] === undefined) {
+            result[key] = structuredClone(property.default);
+        }
+    }
+    return result;
+};
 export const coerceTopLevelDataFromSchema = (schemaName, data, packageName = null) => {
     const schema = pikkuState(packageName, 'misc', 'schemas').get(schemaName);
     if (!schema?.properties)

package/dist/wirings/http/http-runner.d.ts

@@ -116,4 +116,4 @@ export declare const pikkuFetch: <In, Out>(request: Request | PikkuHTTPRequest,
  * @param {RunHTTPWiringOptions} options - Options such as singleton services, session handling, and error configuration.
  * @returns {Promise<Out | void>} The output from the route handler or void if an error occurred.
  */
-export declare const fetchData: <In, Out>(request: Request | PikkuHTTPRequest, response: PikkuHTTPResponse, { skipUserSession, respondWith404, logWarningsForStatusCodes, coerceDataFromSchema, bubbleErrors, exposeErrors, generateRequestId, traceId: externalTraceId, }?: RunHTTPWiringOptions) => Promise<Out | void>;
+export declare const fetchData: <In, Out>(request: Request | PikkuHTTPRequest, response: PikkuHTTPResponse, { skipUserSession, respondWith404, logWarningsForStatusCodes, coerceDataFromSchema, bubbleErrors, exposeErrors, generateRequestId, traceId: externalTraceId, maxBodySize, }?: RunHTTPWiringOptions) => Promise<Out | void>;

package/dist/wirings/http/http-runner.js

@@ -386,13 +386,15 @@ export const pikkuFetch = async (request, params = {}) => {
  */
 export const fetchData = async (request, response, { skipUserSession = false, respondWith404 = true, logWarningsForStatusCodes = [], coerceDataFromSchema = true, bubbleErrors = false, 
 // Surface the error message + stack on unexpected 500s unless in production.
-exposeErrors = !isProduction(), generateRequestId, traceId: externalTraceId, } = {}) => {
+exposeErrors = !isProduction(), generateRequestId, traceId: externalTraceId, maxBodySize, } = {}) => {
     const singletonServices = getSingletonServices();
     const createWireServices = getCreateWireServices();
     let wireServices;
     let result;
     // Combine the request and response into one wire object
-    const pikkuRequest = request instanceof Request ? new PikkuFetchHTTPRequest(request) : request;
+    const pikkuRequest = request instanceof Request
+        ? new PikkuFetchHTTPRequest(request, { maxBodySize })
+        : request;
     // Resolve traceId: external (e.g. CF-Ray) > x-request-id header > generated
     let requestId = externalTraceId ?? null;
     if (!requestId) {

package/dist/wirings/http/http.types.d.ts

@@ -19,6 +19,8 @@ export type RunHTTPWiringOptions = Partial<{
     generateRequestId: () => string;
     /** Pre-resolved trace ID (e.g. CF-Ray). Falls back to x-request-id header or generated ID. */
     traceId: string;
+    /** Maximum request body size in bytes, applied when pikku wraps a fetch `Request`. */
+    maxBodySize: number;
 }>;
 /**
  * Represents the HTTP methods supported for API HTTP wirings.

package/dist/wirings/http/index.d.ts

@@ -1,4 +1,5 @@
-export { PikkuFetchHTTPRequest } from './pikku-fetch-http-request.js';
+export { PikkuFetchHTTPRequest, DEFAULT_MAX_BODY_SIZE, } from './pikku-fetch-http-request.js';
+export type { PikkuFetchHTTPRequestOptions } from './pikku-fetch-http-request.js';
 export { PikkuFetchHTTPResponse } from './pikku-fetch-http-response.js';
 export { logRoutes } from './log-http-routes.js';
 export { fetch, fetchData, wireHTTP, addHTTPMiddleware, addHTTPPermission, } from './http-runner.js';

package/dist/wirings/http/index.js

@@ -1,4 +1,4 @@
-export { PikkuFetchHTTPRequest } from './pikku-fetch-http-request.js';
+export { PikkuFetchHTTPRequest, DEFAULT_MAX_BODY_SIZE, } from './pikku-fetch-http-request.js';
 export { PikkuFetchHTTPResponse } from './pikku-fetch-http-response.js';
 export { logRoutes } from './log-http-routes.js';
 export { fetch, fetchData, wireHTTP, addHTTPMiddleware, addHTTPPermission, } from './http-runner.js';

package/dist/wirings/http/pikku-fetch-http-request.d.ts

@@ -1,4 +1,14 @@
 import type { HTTPMethod, PikkuHTTPRequest, PikkuQuery } from './http.types.js';
+/**
+ * The largest request body read into memory when no limit is configured. Ample
+ * for JSON APIs and typical uploads while keeping a single request's memory
+ * footprint bounded.
+ */
+export declare const DEFAULT_MAX_BODY_SIZE: number;
+export type PikkuFetchHTTPRequestOptions = Partial<{
+    /** Maximum request body size in bytes. Defaults to {@link DEFAULT_MAX_BODY_SIZE}. */
+    maxBodySize: number;
+}>;
 /**
  * Abstract class representing a pikku request.
  * @template In - The type of the request body.
@@ -7,7 +17,7 @@ import type { HTTPMethod, PikkuHTTPRequest, PikkuQuery } from './http.types.js';
 export declare class PikkuFetchHTTPRequest<In = unknown> implements PikkuHTTPRequest<In> {
     #private;
     private request;
-    constructor(request: Request);
+    constructor(request: Request, { maxBodySize }?: PikkuFetchHTTPRequestOptions);
     method(): HTTPMethod;
     path(): string;
     /**

package/dist/wirings/http/pikku-fetch-http-request.js

@@ -1,6 +1,12 @@
 import { parse as parseQuery } from 'picoquery';
 import { parse as parseCookie } from 'cookie';
-import { UnprocessableContentError } from '../../errors/errors.js';
+import { PayloadTooLargeError, UnprocessableContentError, } from '../../errors/errors.js';
+/**
+ * The largest request body read into memory when no limit is configured. Ample
+ * for JSON APIs and typical uploads while keeping a single request's memory
+ * footprint bounded.
+ */
+export const DEFAULT_MAX_BODY_SIZE = 10 * 1024 * 1024;
 /**
  * Abstract class representing a pikku request.
  * @template In - The type of the request body.
@@ -14,9 +20,11 @@ export class PikkuFetchHTTPRequest {
     #rawBodyText;
     #rawBodyBuffer;
     #rawBufferPromise;
-    constructor(request) {
+    #maxBodySize;
+    constructor(request, { maxBodySize = DEFAULT_MAX_BODY_SIZE } = {}) {
         this.request = request;
         this.#url = new URL(request.url);
+        this.#maxBodySize = maxBodySize;
     }
     method() {
         return this.request.method.toLowerCase();
@@ -68,12 +76,65 @@ export class PikkuFetchHTTPRequest {
                 `toWebRequest just for headers) should be removed.`);
             return this.#rawBufferPromise;
         }
-        this.#rawBufferPromise = this.request.arrayBuffer().then((buf) => {
+        this.#rawBufferPromise = this.#readBoundedBuffer().then((buf) => {
             this.#rawBodyBuffer = buf;
             return buf;
         });
         return this.#rawBufferPromise;
     }
+    /**
+     * Reads the body while refusing to buffer more than `maxBodySize` bytes. The
+     * declared `content-length` is rejected up front so an oversized body is never
+     * transferred, and the stream is measured as it arrives because that header is
+     * both optional and attacker-controlled.
+     */
+    async #readBoundedBuffer() {
+        const contentLength = this.request.headers.get('content-length');
+        if (contentLength !== null) {
+            const declaredSize = Number(contentLength);
+            if (Number.isFinite(declaredSize) && declaredSize > this.#maxBodySize) {
+                throw this.#payloadTooLarge();
+            }
+        }
+        const stream = this.request.body;
+        if (stream === null) {
+            const buffer = await this.request.arrayBuffer();
+            if (buffer.byteLength > this.#maxBodySize) {
+                throw this.#payloadTooLarge();
+            }
+            return buffer;
+        }
+        const reader = stream.getReader();
+        const chunks = [];
+        let size = 0;
+        try {
+            while (true) {
+                const { done, value } = await reader.read();
+                if (done) {
+                    break;
+                }
+                size += value.byteLength;
+                if (size > this.#maxBodySize) {
+                    await reader.cancel();
+                    throw this.#payloadTooLarge();
+                }
+                chunks.push(value);
+            }
+        }
+        finally {
+            reader.releaseLock();
+        }
+        const body = new Uint8Array(size);
+        let offset = 0;
+        for (const chunk of chunks) {
+            body.set(chunk, offset);
+            offset += chunk.byteLength;
+        }
+        return body.buffer;
+    }
+    #payloadTooLarge() {
+        return new PayloadTooLargeError(`Request body exceeds the maximum size of ${this.#maxBodySize} bytes`);
+    }
     async #readRawText() {
         if (this.#rawBodyText !== undefined) {
             return this.#rawBodyText;
@@ -191,6 +252,9 @@ export class PikkuFetchHTTPRequest {
             }
         }
         catch (e) {
+            if (e instanceof PayloadTooLargeError) {
+                throw e;
+            }
             throw new UnprocessableContentError(`Error parsing body: ${e}`);
         }
         return body;

package/dist/wirings/mcp/mcp-runner.d.ts

@@ -6,6 +6,11 @@ export declare class MCPError extends Error {
 }
 export type RunMCPEndpointParams<Tools extends string = any> = {
     mcp?: PikkuMCP<Tools>;
+    /**
+     * Surface the error message + stack on unexpected internal errors.
+     * Defaults to enabled outside of production.
+     */
+    exposeErrors?: boolean;
 };
 export type JsonRpcError = {
     code: number;

package/dist/wirings/mcp/mcp-runner.js

@@ -1,4 +1,5 @@
 import { getErrorResponse } from '../../errors/error-handler.js';
+import { isProduction } from '../../env.js';
 import { closeWireServices } from '../../utils.js';
 import { pikkuState, getSingletonServices, getCreateWireServices, } from '../../pikku-state.js';
 import { addFunction, runPikkuFunc } from '../../function/function-runner.js';
@@ -88,7 +89,7 @@ export async function runMCPPrompt(request, params, name) {
 /**
  * JSON-RPC 2.0 compatible MCP endpoint runner
  */
-async function runMCPPikkuFunc(request, type, name, mcp, pikkuFuncId, { mcp: mcpWire }) {
+async function runMCPPikkuFunc(request, type, name, mcp, pikkuFuncId, { mcp: mcpWire, exposeErrors = !isProduction() }) {
     const singletonServices = getSingletonServices();
     const createWireServices = getCreateWireServices();
     let wireServices;
@@ -165,7 +166,9 @@ async function runMCPPikkuFunc(request, type, name, mcp, pikkuFuncId, { mcp: mcp
                 id: request.id,
                 code: -32603,
                 message: 'Internal error',
-                data: { message: e.message, stack: e.stack },
+                data: exposeErrors && !isProduction() && e instanceof Error
+                    ? { message: e.message, stack: e.stack }
+                    : undefined,
             });
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/core",
-  "version": "0.12.71",
+  "version": "0.12.72",
   "description": "The Pikku runtime — functions, wirings, services, middleware and types",
   "author": "yasser.fadl@gmail.com",
   "license": "MIT",
@@ -55,7 +55,6 @@
     "./services/istanbul-coverage": "./dist/services/istanbul-coverage-service.js",
     "./services/local-content": "./dist/services/local-content.js",
     "./services/temporary-file-service": "./dist/services/temporary-file-service.js",
-    "./services/gopass-secrets": "./dist/services/gopass-secrets.js",
     "./crypto-utils": "./dist/crypto-utils.js",
     "./hmac": "./dist/utils/hmac.js",
     "./internal": "./dist/internal.js",

package/src/function/function-runner.test.ts

@@ -7,6 +7,7 @@ import {
   runPikkuFunc,
 } from './function-runner.js'
 import { addGlobalPermission, addTagMiddleware } from '../index.js'
+import { addSchema } from '../schema.js'
 import { resetPikkuState, pikkuState } from '../pikku-state.js'
 import type { CoreServices, CorePikkuMiddleware } from '../types/core.types.js'
 import type { CorePermissionGroup } from './functions.types.js'
@@ -1494,4 +1495,78 @@ describe('runPikkuFunc - scopes', () => {
       MissingScopeError
     )
   })
+
+  describe('schema defaults', () => {
+    const addPagedFunction = (funcName: string, seen: { data?: any }) => {
+      addSchema('PagedInput', {
+        properties: {
+          page: { type: 'number', default: 1 },
+          limit: { type: 'number', default: 50 },
+        },
+      })
+      addTestFunction(funcName, {
+        func: async (_services: any, data: any) => {
+          seen.data = data
+          return 'ok'
+        },
+      })
+      pikkuState(null, 'function', 'meta')[funcName]!.inputSchemaName =
+        'PagedInput'
+    }
+
+    // The whole point of the fix: `{}` validates because a defaulted property
+    // is not `required`, so without this the body reads `undefined` for a value
+    // its generated type declares as a number.
+    test('a function called with {} receives its schema defaults', async () => {
+      const seen: { data?: any } = {}
+      addPagedFunction('paged', seen)
+
+      await runPikkuFunc('rpc', Math.random().toString(), 'paged', {
+        singletonServices: mockSingletonServices,
+        getAllServices: () => mockServices,
+        data: () => ({}),
+        auth: false,
+        wire: {},
+      })
+
+      assert.equal(seen.data.page, 1)
+      assert.equal(seen.data.limit, 50)
+    })
+
+    // `coerceDataFromSchema` is not passed here, exactly as a direct RPC
+    // invocation leaves it. Defaults belong to the schema rather than to the
+    // transport, so they must not ride on that flag — and a call made with no
+    // arguments at all still has to get them.
+    test('defaults apply with coercion off and no data', async () => {
+      const seen: { data?: any } = {}
+      addPagedFunction('pagedNoCoerce', seen)
+
+      await runPikkuFunc('rpc', Math.random().toString(), 'pagedNoCoerce', {
+        singletonServices: mockSingletonServices,
+        getAllServices: () => mockServices,
+        data: () => undefined,
+        auth: false,
+        wire: {},
+      })
+
+      assert.equal(seen.data.page, 1)
+      assert.equal(seen.data.limit, 50)
+    })
+
+    test('a supplied value survives', async () => {
+      const seen: { data?: any } = {}
+      addPagedFunction('pagedSupplied', seen)
+
+      await runPikkuFunc('rpc', Math.random().toString(), 'pagedSupplied', {
+        singletonServices: mockSingletonServices,
+        getAllServices: () => mockServices,
+        data: () => ({ page: 3 }),
+        auth: false,
+        wire: {},
+      })
+
+      assert.equal(seen.data.page, 3)
+      assert.equal(seen.data.limit, 50)
+    })
+  })
 })

package/src/function/function-runner.ts

@@ -5,7 +5,11 @@ import {
 } from '../wirings/channel/channel-middleware-runner.js'
 import { runPermissions } from '../permissions.js'
 import { pikkuState } from '../pikku-state.js'
-import { coerceTopLevelDataFromSchema, validateSchema } from '../schema.js'
+import {
+  applyDefaultsFromSchema,
+  coerceTopLevelDataFromSchema,
+  validateSchema,
+} from '../schema.js'
 import type {
   CoreUserSession,
   CorePikkuMiddleware,
@@ -293,11 +297,20 @@ export const runPikkuFunc = async <In = any, Out = any>(
     verifyScopes(funcConfig.scopes ?? funcMeta.scopes, session)
 
     // Evaluate the data from the lazy function
-    const actualData = await data()
+    let actualData = await data()
 
     // Validate and coerce data if schema is defined
     const inputSchemaName = funcMeta.inputSchemaName
     if (inputSchemaName) {
+      // Fill in schema defaults before anything reads the data. Unconditional:
+      // a default belongs to the schema, not to the transport the call arrived
+      // on. Runs before coercion so a defaulted value and a supplied one are
+      // treated identically from here on.
+      actualData = applyDefaultsFromSchema(
+        inputSchemaName,
+        actualData,
+        packageName
+      )
       // Coerce (top level) data types before validation (e.g. string→array, string→date)
       if (coerceDataFromSchema) {
         coerceTopLevelDataFromSchema(inputSchemaName, actualData, packageName)

package/src/gopass-secrets-removed.test.ts

@@ -0,0 +1,51 @@
+import { describe, test } from 'node:test'
+import assert from 'node:assert/strict'
+import { existsSync, readFileSync, readdirSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { join, dirname } from 'node:path'
+
+const srcRoot = dirname(fileURLToPath(import.meta.url))
+const packageRoot = join(srcRoot, '..')
+
+const collectSourceFiles = (directory: string): string[] =>
+  readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
+    const entryPath = join(directory, entry.name)
+    if (entry.isDirectory()) {
+      return entry.name === 'dist' ? [] : collectSourceFiles(entryPath)
+    }
+    return /\.(ts|js|mts|cts)$/.test(entry.name) ? [entryPath] : []
+  })
+
+describe('gopass secret service removal', () => {
+  test('the gopass-secrets module no longer exists', () => {
+    assert.equal(
+      existsSync(join(srcRoot, 'services/gopass-secrets.ts')),
+      false,
+      'services/gopass-secrets.ts was reintroduced'
+    )
+  })
+
+  test('package.json no longer exports ./services/gopass-secrets', () => {
+    const packageJson = JSON.parse(
+      readFileSync(join(packageRoot, 'package.json'), 'utf-8')
+    )
+    assert.equal(
+      packageJson.exports['./services/gopass-secrets'],
+      undefined,
+      './services/gopass-secrets export was reintroduced'
+    )
+  })
+
+  test('no source file references gopass', () => {
+    const offenders = collectSourceFiles(srcRoot).filter(
+      (file) =>
+        file !== fileURLToPath(import.meta.url) &&
+        /gopass/i.test(readFileSync(file, 'utf-8'))
+    )
+    assert.deepEqual(
+      offenders,
+      [],
+      `gopass references found in:\n${offenders.join('\n')}`
+    )
+  })
+})