@pikku/core 0.12.71 → 0.12.74

package/dist/middleware-runner.d.ts

@@ -1,67 +1,16 @@
 import type { CorePikkuMiddleware, CorePikkuMiddlewareGroup, PikkuWiringTypes, MiddlewareMetadata } from './types/core.types.js';
-/**
- * Runs a chain of middleware functions in sequence before executing the main function.
- *
- * @param services - An object containing services (e.g., singletonServices, userSession, etc.)
- * @param wire - The wire context, e.g., { http }.
- * @param middlewares - An array of middleware functions to run.
- * @param main - The main function to execute after all middleware have run.
- * @returns A promise resolving to the result of the main function.
- *
- * @example
- * runMiddleware(
- *   { ...services, userSession },
- *   { http },
- *   [middleware1, middleware2, middleware3],
- *   async () => { return await runMain(); }
- * );
- */
 export declare const runMiddleware: <Middleware extends CorePikkuMiddleware<any, any>>(services: Parameters<Middleware>[0], wire: Parameters<Middleware>[1], middlewares: readonly Middleware[], main?: () => Promise<unknown>) => Promise<unknown>;
 /**
- * Registers tag-scoped middleware. Applies to any wiring (HTTP, Channel,
- * Queue, Scheduler, MCP, CLI, Workflow, Agent) that carries the matching tag.
- *
- * For tree-shaking, wrap in a factory:
- * `export const x = () => addTagMiddleware('tag', [...])`
- *
- * @example
- * export const adminMiddleware = () => addTagMiddleware('admin', [authMiddleware])
+ * Registers tag-scoped middleware for any wiring carrying the tag. Wrap in a
+ * factory (`export const x = () => addTagMiddleware(...)`) for tree-shaking.
  */
 export declare const addTagMiddleware: <PikkuMiddleware extends CorePikkuMiddleware>(tag: string, middleware: CorePikkuMiddlewareGroup, packageName?: string | null) => CorePikkuMiddlewareGroup;
 /**
- * Registers wire-agnostic global middleware. Runs at the top of every
- * wiring's middleware chain — before wire-, tag-, and function-level
- * entries — across HTTP, Channel, Queue, Scheduler, MCP, CLI, Workflow, Agent.
- *
- * Resolution order: global → wire → tag → function.
- *
- * @example
- * addGlobalMiddleware([telemetryMiddleware])
+ * Registers wire-agnostic global middleware, which runs at the top of every
+ * wiring's chain — before wire-, tag- and function-level entries.
  */
 export declare const addGlobalMiddleware: <PikkuMiddleware extends CorePikkuMiddleware>(middleware: CorePikkuMiddlewareGroup, packageName?: string | null) => CorePikkuMiddlewareGroup;
 export declare const clearMiddlewareCache: () => void;
-/**
- * Combines wiring-specific middleware with function-level middleware.
- *
- * This function resolves middleware metadata into actual middleware functions and combines them.
- * It filters out wire middleware without tags from inheritedMiddleware to avoid duplication
- * (those are passed separately as wireMiddleware).
- *
- * @param {object} options - Configuration object for combining middleware.
- * @param {MiddlewareMetadata[] | undefined} options.inheritedMiddleware - Metadata from wiring (HTTP + tags + wire with tags).
- * @param {CorePikkuMiddleware[] | undefined} options.wireMiddleware - Inline wire middleware.
- * @param {MiddlewareMetadata[] | undefined} options.funcMiddleware - Function middleware metadata.
- * @returns {CorePikkuMiddleware[]} Combined array of resolved middleware.
- *
- * @example
- * ```typescript
- * const combined = combineMiddleware(wireType, wireId, {
- *   inheritedMiddleware: meta.middleware,
- *   wireMiddleware: [inlineMiddleware],
- *   funcMiddleware: funcMeta.middleware
- * })
- * ```
- */
 export declare const combineMiddleware: (wireType: PikkuWiringTypes, uid: string, { wireInheritedMiddleware, wireMiddleware, funcInheritedMiddleware, funcMiddleware, packageName, }?: {
     wireInheritedMiddleware?: MiddlewareMetadata[];
     wireMiddleware?: CorePikkuMiddleware[];

package/dist/middleware-runner.js

@@ -14,25 +14,7 @@ const getMiddlewarePriority = (fn) => {
 const sortByPriority = (middlewares) => {
     return middlewares.sort((a, b) => getMiddlewarePriority(a) - getMiddlewarePriority(b));
 };
-/**
- * Runs a chain of middleware functions in sequence before executing the main function.
- *
- * @param services - An object containing services (e.g., singletonServices, userSession, etc.)
- * @param wire - The wire context, e.g., { http }.
- * @param middlewares - An array of middleware functions to run.
- * @param main - The main function to execute after all middleware have run.
- * @returns A promise resolving to the result of the main function.
- *
- * @example
- * runMiddleware(
- *   { ...services, userSession },
- *   { http },
- *   [middleware1, middleware2, middleware3],
- *   async () => { return await runMain(); }
- * );
- */
 export const runMiddleware = async (services, wire, middlewares, main) => {
-    // Sort by priority if not already sorted (cached middleware is pre-sorted)
     const sorted = isSortedByPriority(middlewares)
         ? middlewares
         : [...middlewares].sort((a, b) => getMiddlewarePriority(a) - getMiddlewarePriority(b));
@@ -58,14 +40,8 @@ const isSortedByPriority = (middlewares) => {
     return true;
 };
 /**
- * Registers tag-scoped middleware. Applies to any wiring (HTTP, Channel,
- * Queue, Scheduler, MCP, CLI, Workflow, Agent) that carries the matching tag.
- *
- * For tree-shaking, wrap in a factory:
- * `export const x = () => addTagMiddleware('tag', [...])`
- *
- * @example
- * export const adminMiddleware = () => addTagMiddleware('admin', [authMiddleware])
+ * Registers tag-scoped middleware for any wiring carrying the tag. Wrap in a
+ * factory (`export const x = () => addTagMiddleware(...)`) for tree-shaking.
  */
 export const addTagMiddleware = (tag, middleware, packageName = null) => {
     const tagGroups = pikkuState(packageName, 'middleware', 'tagGroup');
@@ -76,31 +52,14 @@ export const addTagMiddleware = (tag, middleware, packageName = null) => {
     return middleware;
 };
 /**
- * Registers wire-agnostic global middleware. Runs at the top of every
- * wiring's middleware chain — before wire-, tag-, and function-level
- * entries — across HTTP, Channel, Queue, Scheduler, MCP, CLI, Workflow, Agent.
- *
- * Resolution order: global → wire → tag → function.
- *
- * @example
- * addGlobalMiddleware([telemetryMiddleware])
+ * Registers wire-agnostic global middleware, which runs at the top of every
+ * wiring's chain — before wire-, tag- and function-level entries.
  */
 export const addGlobalMiddleware = (middleware, packageName = null) => {
     const state = pikkuState(packageName, 'middleware', 'global');
     state.push(...middleware);
     return middleware;
 };
-/**
- * Retrieves a registered middleware function by its name.
- *
- * This function looks up middleware that was registered with registerMiddleware.
- * It's used internally by the framework to resolve middleware references in metadata.
- *
- * @param {string} name - The unique name (pikkuFuncId) of the middleware function.
- * @returns {CorePikkuMiddleware | undefined} The middleware function, or undefined if not found.
- *
- * @internal
- */
 const getMiddlewareByName = (name) => {
     const middlewareStore = pikkuState(null, 'misc', 'middleware');
     const middleware = middlewareStore[name];
@@ -124,28 +83,6 @@ export const clearMiddlewareCache = () => {
         middlewareCache[key] = {};
     }
 };
-/**
- * Combines wiring-specific middleware with function-level middleware.
- *
- * This function resolves middleware metadata into actual middleware functions and combines them.
- * It filters out wire middleware without tags from inheritedMiddleware to avoid duplication
- * (those are passed separately as wireMiddleware).
- *
- * @param {object} options - Configuration object for combining middleware.
- * @param {MiddlewareMetadata[] | undefined} options.inheritedMiddleware - Metadata from wiring (HTTP + tags + wire with tags).
- * @param {CorePikkuMiddleware[] | undefined} options.wireMiddleware - Inline wire middleware.
- * @param {MiddlewareMetadata[] | undefined} options.funcMiddleware - Function middleware metadata.
- * @returns {CorePikkuMiddleware[]} Combined array of resolved middleware.
- *
- * @example
- * ```typescript
- * const combined = combineMiddleware(wireType, wireId, {
- *   inheritedMiddleware: meta.middleware,
- *   wireMiddleware: [inlineMiddleware],
- *   funcMiddleware: funcMeta.middleware
- * })
- * ```
- */
 export const combineMiddleware = (wireType, uid, { wireInheritedMiddleware, wireMiddleware, funcInheritedMiddleware, funcMiddleware, packageName = null, } = {}) => {
     if (middlewareCache[wireType][uid]) {
         return middlewareCache[wireType][uid];
@@ -158,7 +95,6 @@ export const combineMiddleware = (wireType, uid, { wireInheritedMiddleware, wire
     if (wireInheritedMiddleware) {
         for (const meta of wireInheritedMiddleware) {
             if (meta.type === 'http') {
-                // Look up HTTP middleware group from pikkuState
                 const group = pikkuState(packageName, 'middleware', 'httpGroup')[meta.route];
                 if (group) {
                     // At runtime, all factories should be resolved to middleware
@@ -172,7 +108,6 @@ export const combineMiddleware = (wireType, uid, { wireInheritedMiddleware, wire
                 }
             }
             else if (meta.type === 'wire') {
-                // Individual wire middleware (exported, not inline)
                 const middleware = getMiddlewareByName(meta.name);
                 if (middleware) {
                     resolved.push(middleware);
@@ -180,11 +115,10 @@ export const combineMiddleware = (wireType, uid, { wireInheritedMiddleware, wire
             }
         }
     }
-    // 2. Add inline wire middleware
     if (wireMiddleware) {
         resolved.push(...wireMiddleware);
     }
-    // 3. Resolve function inherited middleware (only tags, wire middleware already handled)
+    // Only tags here; wire middleware is resolved via wireInheritedMiddleware.
     if (funcInheritedMiddleware) {
         for (const meta of funcInheritedMiddleware) {
             if (meta.type === 'tag') {
@@ -193,14 +127,11 @@ export const combineMiddleware = (wireType, uid, { wireInheritedMiddleware, wire
                     resolved.push(...group);
                 }
             }
-            // Note: wire middleware is already handled in wireInheritedMiddleware
         }
     }
-    // 4. Add inline function middleware
     if (funcMiddleware) {
         resolved.push(...funcMiddleware);
     }
-    // Sort by priority, deduplicate, and freeze
     sortByPriority(resolved);
     middlewareCache[wireType][uid] = freezeDedupe(resolved);
     return middlewareCache[wireType][uid];

package/dist/permissions.d.ts

@@ -1,20 +1,6 @@
 import type { CoreServices, CoreUserSession, PikkuWire } from './types/core.types.js';
 import type { CorePermissionGroup, CorePikkuPermission } from './function/functions.types.js';
 export declare const clearPermissionsCache: () => void;
-/**
- * Registers wire-agnostic global permissions. Global permissions are an AND
- * gate: every registered requirement must pass on every function invocation,
- * regardless of transport. A requirement may be a single permission function
- * or a permission group (in which case that group ORs internally, but the
- * group as a whole must still pass).
- *
- * Global permissions never satisfy a function's own `permissions` — the two
- * are independent gates that both have to pass, so a broad global can only
- * ever narrow access.
- *
- * @example
- * addGlobalPermission([signedInUser])
- */
 export declare const addGlobalPermission: (permissions: CorePermissionGroup | CorePikkuPermission[], packageName?: string | null) => CorePermissionGroup | CorePikkuPermission[];
 /**
  * @deprecated Tag-level permissions were removed in #972 — permissions are now
@@ -25,17 +11,6 @@ export declare const addGlobalPermission: (permissions: CorePermissionGroup | Co
  * past the release that removes tag permissions.
  */
 export declare const addTagPermission: (_tag: string, _permissions: CorePermissionGroup | CorePikkuPermission[], _packageName?: string | null) => never;
-/**
- * Runs authorization for a function invocation. Two independent gates, both of
- * which must pass:
- *
- * 1. Global permissions — AND. Every registered global requirement must pass.
- * 2. Function permissions — OR. The function's own `permissions` group must be
- *    satisfied (see {@link verifyPermissions}).
- *
- * A passing global requirement never contributes to the function gate, so a
- * broad global like `signedIn` can't satisfy an admin-only function.
- */
 export declare const runPermissions: ({ funcPermissions, services, wire, data, packageName, label, }: {
     funcPermissions?: CorePermissionGroup | CorePikkuPermission[];
     services: CoreServices;
@@ -45,22 +20,6 @@ export declare const runPermissions: ({ funcPermissions, services, wire, data, p
     /** What the non-global gate is called in debug logs, e.g. 'function', 'agent'. */
     label?: string;
 }) => Promise<void>;
-/**
- * Checks whether a session passes the auth checks (pikkuAuth only) for a
- * given function/agent. Skips pikkuPermission checks since those require
- * request data which isn't available at filter time. Global auth requirements
- * are included so a filtered list honours app-wide auth.
- *
- * `funcPermissions` is the live {@link CorePermissionGroup} from the function or
- * agent config, not the metadata form: the `pikkuAuth` brand only survives on
- * the actual predicate objects, and the by-name registry those metadata entries
- * would resolve against is never populated. Passing metadata here would silently
- * collect nothing and let every gated tool through.
- *
- * @param funcPermissions - The live permission group from the func/agent config
- * @param session - The user's session
- * @param services - Singleton services
- * @param packageName - Optional package namespace
- * @returns true if the session passes the auth checks (or no auth checks exist)
- */
-export declare const checkAuthPermissions: (funcPermissions: CorePermissionGroup | undefined, session: CoreUserSession, services: CoreServices, packageName?: string | null) => Promise<boolean>;
+export declare const checkAuthPermissions: (
+/** Must be the live permission group from the func/agent config, never metadata. */
+funcPermissions: CorePermissionGroup | undefined, session: CoreUserSession, services: CoreServices, packageName?: string | null) => Promise<boolean>;

package/dist/permissions.js

@@ -1,22 +1,5 @@
 import { pikkuState } from './pikku-state.js';
 import { ForbiddenError } from './errors/errors.js';
-/**
- * Evaluates a single permission group. A group ORs its branches together and
- * ANDs the entries within a branch: the group passes if at least one branch
- * (an array of permission functions, all of which must return true — or a lone
- * function) is satisfied.
- *
- * This is the only place OR lives in authorization. Everything cross-cutting —
- * global permissions, scopes, and auth — ANDs together; a function's own
- * `permissions` group is the sole place where "owner OR admin"-style
- * alternatives are expressed.
- *
- * @param permissions - The permission group to evaluate.
- * @param services - The core services required for permission validation.
- * @param data - The request data passed to each permission function.
- * @param wire - The wire object containing request/response context and session.
- * @returns A promise resolving to true if the group is satisfied.
- */
 const verifyPermissions = async (permissions, services, data, wire) => {
     if (!permissions) {
         return true;
@@ -46,20 +29,6 @@ export const clearPermissionsCache = () => {
         delete globalPermissionsCache[key];
     }
 };
-/**
- * Registers wire-agnostic global permissions. Global permissions are an AND
- * gate: every registered requirement must pass on every function invocation,
- * regardless of transport. A requirement may be a single permission function
- * or a permission group (in which case that group ORs internally, but the
- * group as a whole must still pass).
- *
- * Global permissions never satisfy a function's own `permissions` — the two
- * are independent gates that both have to pass, so a broad global can only
- * ever narrow access.
- *
- * @example
- * addGlobalPermission([signedInUser])
- */
 export const addGlobalPermission = (permissions, packageName = null) => {
     const state = pikkuState(packageName, 'permissions', 'global');
     if (Array.isArray(permissions)) {
@@ -82,11 +51,20 @@ export const addGlobalPermission = (permissions, packageName = null) => {
 export const addTagPermission = (_tag, _permissions, _packageName = null) => {
     throw new Error('addTagPermission was removed in #972 — tag-level permissions no longer exist. Declare permissions on the function definition instead: pikkuFunc({ permissions }).');
 };
+const bucket = (packageName) => pikkuState(packageName, 'permissions', 'global') ?? [];
 /**
- * Resolves the registered global permission requirements for a package,
- * caching the resolved array per package. The cache is keyed by package name
- * (an empty string for the root package) so packages never collide, and it is
- * cleared whenever globals are registered or on hot reload.
+ * Global permissions in effect for a function, root ones first.
+ *
+ * A function that belongs to a package reads *both* buckets, not just its own.
+ * The generated `addGlobalPermission` wrapper always registers under the root
+ * (`null`) package — it takes no package argument — so resolving the package
+ * bucket alone meant an application's "every request needs a signed-in user"
+ * rule silently stopped at the addon boundary, and the bucket the addon's
+ * functions did read was one no host could write to. Both directions of that
+ * are wrong, and the safe union is to apply everything: globals are an AND
+ * gate, so adding the root ones can only ever tighten.
+ *
+ * knowledge: decisions/security/global-permissions-and-function-permissions-are-independent-gates.md
  */
 const resolveGlobalPermissions = (packageName) => {
     const key = packageName ?? '';
@@ -94,23 +72,13 @@ const resolveGlobalPermissions = (packageName) => {
     if (cached) {
         return cached;
     }
-    const globals = pikkuState(packageName, 'permissions', 'global');
-    const resolved = globals && globals.length > 0 ? [...globals] : [];
+    const resolved = packageName
+        ? [...bucket(null), ...bucket(packageName)]
+        : [...bucket(null)];
     globalPermissionsCache[key] = resolved;
     return resolved;
 };
 const asGroup = (entry) => typeof entry === 'function' ? { permission: entry } : entry;
-/**
- * Runs authorization for a function invocation. Two independent gates, both of
- * which must pass:
- *
- * 1. Global permissions — AND. Every registered global requirement must pass.
- * 2. Function permissions — OR. The function's own `permissions` group must be
- *    satisfied (see {@link verifyPermissions}).
- *
- * A passing global requirement never contributes to the function gate, so a
- * broad global like `signedIn` can't satisfy an admin-only function.
- */
 export const runPermissions = async ({ funcPermissions, services, wire, data, packageName = null, label = 'function', }) => {
     const globals = resolveGlobalPermissions(packageName);
     for (const entry of globals) {
@@ -131,29 +99,10 @@ export const runPermissions = async ({ funcPermissions, services, wire, data, pa
         }
     }
 };
-/**
- * Checks whether a session passes the auth checks (pikkuAuth only) for a
- * given function/agent. Skips pikkuPermission checks since those require
- * request data which isn't available at filter time. Global auth requirements
- * are included so a filtered list honours app-wide auth.
- *
- * `funcPermissions` is the live {@link CorePermissionGroup} from the function or
- * agent config, not the metadata form: the `pikkuAuth` brand only survives on
- * the actual predicate objects, and the by-name registry those metadata entries
- * would resolve against is never populated. Passing metadata here would silently
- * collect nothing and let every gated tool through.
- *
- * @param funcPermissions - The live permission group from the func/agent config
- * @param session - The user's session
- * @param services - Singleton services
- * @param packageName - Optional package namespace
- * @returns true if the session passes the auth checks (or no auth checks exist)
- */
-export const checkAuthPermissions = async (funcPermissions, session, services, packageName = null) => {
+export const checkAuthPermissions = async (
+/** Must be the live permission group from the func/agent config, never metadata. */
+funcPermissions, session, services, packageName = null) => {
     const wire = { session };
-    // Collect auth-only (pikkuAuth) predicates from globals and the function's
-    // referenced permissions. Data-dependent permissions are ignored — they
-    // can't be evaluated without request data at filter time.
     const authPerms = [];
     const collect = (perm) => {
         if (typeof perm === 'function') {
@@ -178,7 +127,6 @@ export const checkAuthPermissions = async (funcPermissions, session, services, p
     if (funcPermissions) {
         collect(funcPermissions);
     }
-    // No auth permissions = allowed (only data-dependent permissions exist)
     if (authPerms.length === 0)
         return true;
     for (const perm of authPerms) {

package/dist/pikku-request.d.ts

@@ -1,14 +1,8 @@
 /**
- * Simplest class to represent a pikku request.
- * @template In - The type of the request body.
  * @group RequestResponse
  */
 export declare abstract class PikkuRequest<In = any> {
     #private;
     constructor(data: In);
-    /**
-     * Retrieves the data
-     * @returns A promise that resolves to an object containing the combined data.
-     */
     data(): Promise<In>;
 }

package/dist/pikku-request.js

@@ -1,6 +1,4 @@
 /**
- * Simplest class to represent a pikku request.
- * @template In - The type of the request body.
  * @group RequestResponse
  */
 export class PikkuRequest {
@@ -8,10 +6,6 @@ export class PikkuRequest {
     constructor(data) {
         this.#data = data;
     }
-    /**
-     * Retrieves the data
-     * @returns A promise that resolves to an object containing the combined data.
-     */
     async data() {
         if (this.#data === undefined) {
             throw new Error('Data not found');

package/dist/pikku-state.d.ts

@@ -1,36 +1,10 @@
 import type { PikkuPackageState } from './index.js';
 import type { CoreSingletonServices, CreateWireServices } from './types/core.types.js';
 export declare const getAllPackageStates: () => Map<string, PikkuPackageState>;
-/**
- * Get or set package-scoped pikku state
- *
- * @param packageName - Package name (null for main package, '@scope/package' for addon packages)
- * @param type - State category (function, rpc, http, etc.)
- * @param content - Content key within the category
- * @param value - Optional value to set
- * @returns The current value of the state
- *
- * @example
- * // Main package
- * pikkuState(null, 'function', 'functions').get(funcName)
- *
- * // Addon package
- * pikkuState('@acme/stripe-functions', 'rpc', 'meta')
- */
 export declare const pikkuState: <Type extends keyof PikkuPackageState, Content extends keyof PikkuPackageState[Type]>(packageName: string | null, type: Type, content: Content, value?: PikkuPackageState[Type][Content]) => PikkuPackageState[Type][Content];
-/**
- * Initialize state for a new package
- */
 export declare const initializePikkuState: (packageName: string) => void;
 export declare const resetPikkuState: () => void;
 export declare const getSingletonServices: () => CoreSingletonServices;
 export declare const setSingletonServices: (services: CoreSingletonServices) => void;
 export declare const getCreateWireServices: () => CreateWireServices | undefined;
-/**
- * Register service factories for an addon package.
- * These factories are used to create services when the package's functions are invoked.
- *
- * @param packageName - The package name (e.g., '@pikku/templates-function-addon')
- * @param factories - The service factory functions
- */
 export declare const addPackageServiceFactories: (packageName: string, factories: NonNullable<PikkuPackageState["package"]["factories"]>) => void;

package/dist/pikku-state.js

@@ -1,4 +1,4 @@
-const PIKKU_STATE_KEY = Symbol('@pikku/core/state');
+const PIKKU_STATE_KEY = Symbol.for('@pikku/core/state');
 export const getAllPackageStates = () => {
     if (!globalThis[PIKKU_STATE_KEY]) {
         ;
@@ -6,25 +6,8 @@ export const getAllPackageStates = () => {
     }
     return globalThis[PIKKU_STATE_KEY];
 };
-/**
- * Get or set package-scoped pikku state
- *
- * @param packageName - Package name (null for main package, '@scope/package' for addon packages)
- * @param type - State category (function, rpc, http, etc.)
- * @param content - Content key within the category
- * @param value - Optional value to set
- * @returns The current value of the state
- *
- * @example
- * // Main package
- * pikkuState(null, 'function', 'functions').get(funcName)
- *
- * // Addon package
- * pikkuState('@acme/stripe-functions', 'rpc', 'meta')
- */
 export const pikkuState = (packageName, type, content, value) => {
     const resolvedPackageName = packageName ?? '__main__';
-    // Initialize package state if it doesn't exist
     if (!getAllPackageStates().has(resolvedPackageName)) {
         initializePikkuState(resolvedPackageName);
     }
@@ -129,20 +112,16 @@ const createEmptyPackageState = () => ({
         requiredParentServices: null,
     },
 });
-/**
- * Initialize state for a new package
- */
 export const initializePikkuState = (packageName) => {
     if (!getAllPackageStates().has(packageName)) {
         getAllPackageStates().set(packageName, createEmptyPackageState());
     }
 };
 export const resetPikkuState = () => {
-    // Preserve the errors map before resetting
+    // Error definitions come from module-import side effects that never re-run.
     const existingErrors = getAllPackageStates().get('__main__')?.misc.errors;
     globalThis[PIKKU_STATE_KEY] = new Map();
     initializePikkuState('__main__');
-    // Restore the errors map if it existed
     if (existingErrors) {
         const mainState = getAllPackageStates().get('__main__');
         mainState.misc.errors = existingErrors;
@@ -163,13 +142,6 @@ export const setSingletonServices = (services) => {
 export const getCreateWireServices = () => {
     return pikkuState(null, 'package', 'factories')?.createWireServices;
 };
-/**
- * Register service factories for an addon package.
- * These factories are used to create services when the package's functions are invoked.
- *
- * @param packageName - The package name (e.g., '@pikku/templates-function-addon')
- * @param factories - The service factory functions
- */
 export const addPackageServiceFactories = (packageName, factories) => {
     pikkuState(packageName, 'package', 'factories', factories);
 };

package/dist/remote.d.ts

@@ -1,10 +1,8 @@
 import type { JWTService } from './services/jwt-service.js';
 import type { SecretService } from './services/secret-service.js';
 /**
- * Build Authorization headers with JWT-signed session and traceId for
- * pikkuRemoteAuthMiddleware on the receiving end.
- *
- * Used by all deployment services (Kysely, Redis, MongoDB, Lambda, CF, Azure)
- * regardless of transport (HTTP, Lambda Invoke, service bindings).
+ * Authorization headers carrying a JWT-signed session and traceId for
+ * `pikkuRemoteAuthMiddleware` on the receiving end. Used by every deployment
+ * service regardless of transport (HTTP, Lambda Invoke, service bindings).
  */
 export declare function buildRemoteHeaders(jwt: JWTService | undefined, secrets: SecretService | undefined, funcName: string, session?: unknown, traceId?: string): Promise<Record<string, string>>;

package/dist/remote.js

@@ -1,10 +1,8 @@
-import { encryptJSON } from './crypto-utils.js';
+import { assertStrongKeyMaterial, encryptWithKeyMaterial, REMOTE_SESSION_INFO, } from './crypto-utils.js';
 /**
- * Build Authorization headers with JWT-signed session and traceId for
- * pikkuRemoteAuthMiddleware on the receiving end.
- *
- * Used by all deployment services (Kysely, Redis, MongoDB, Lambda, CF, Azure)
- * regardless of transport (HTTP, Lambda Invoke, service bindings).
+ * Authorization headers carrying a JWT-signed session and traceId for
+ * `pikkuRemoteAuthMiddleware` on the receiving end. Used by every deployment
+ * service regardless of transport (HTTP, Lambda Invoke, service bindings).
  */
 export async function buildRemoteHeaders(jwt, secrets, funcName, session, traceId) {
     const headers = {
@@ -17,8 +15,11 @@ export async function buildRemoteHeaders(jwt, secrets, funcName, session, traceI
     }
     catch { }
     if (secret && jwt) {
+        assertStrongKeyMaterial('PIKKU_REMOTE_SECRET', secret);
         const sessionEnc = session
-            ? await encryptJSON(secret, { session })
+            ? await encryptWithKeyMaterial('PIKKU_REMOTE_SECRET', secret, REMOTE_SESSION_INFO, {
+                session,
+            })
             : undefined;
         const token = await jwt.encode({ value: 5, unit: 'minute' }, {
             aud: 'pikku-remote',

package/dist/schema.d.ts

@@ -1,25 +1,15 @@
 import type { Logger } from './services/logger.js';
 import type { SchemaService } from './services/schema-service.js';
-/**
- * Adds a schema to the schemas map for a specific package.
- * @param name - The name of the schema.
- * @param value - The schema value.
- * @param packageName - The package name (null for main package, '@scope/package' for addon packages).
- * @ignore
- */
 export declare const addSchema: (name: string, value: any, packageName?: string | null) => void;
-/**
- * Retrieves a schema from the schemas map for a specific package.
- * @param name - The name of the schema.
- * @param packageName - The package name (null for main package, '@scope/package' for addon packages).
- * @returns The schema value or undefined if not found.
- * @ignore
- */
 export declare const getSchema: (name: string, packageName?: string | null) => Record<string, unknown> | undefined;
+export declare const compileAllSchemas: (logger: Logger, schemaService?: SchemaService) => void;
 /**
- * Loads a schema and compiles it into a validator.
- * @param logger - A logger for logging information.
+ * Fills in absent top-level properties from their schema `default`. Applied
+ * unconditionally: a default belongs to the schema, not to the transport the
+ * call arrived on, and runs before coercion so a defaulted and a supplied
+ * value are treated identically from here on. Values are cloned so an object
+ * or array default is never shared as one mutable instance across requests.
  */
-export declare const compileAllSchemas: (logger: Logger, schemaService?: SchemaService) => void;
+export declare const applyDefaultsFromSchema: (schemaName: string, data: any, packageName?: string | null) => any;
 export declare const coerceTopLevelDataFromSchema: (schemaName: string, data: any, packageName?: string | null) => void;
 export declare const validateSchema: (logger: Logger, schemaService: SchemaService | undefined, schemaName: string | undefined | null, data: any, packageName?: string | null) => Promise<void>;