@pikku/core 0.12.79 → 0.12.82

package/dist/wirings/http/index.js

@@ -1,6 +1,6 @@
 export { PikkuFetchHTTPRequest, DEFAULT_MAX_BODY_SIZE, } from './pikku-fetch-http-request.js';
 export { PikkuFetchHTTPResponse } from './pikku-fetch-http-response.js';
 export { logRoutes } from './log-http-routes.js';
-export { fetch, fetchData, wireHTTP, addHTTPMiddleware, addHTTPPermission, } from './http-runner.js';
+export { fetch, fetchData, wireHTTP, addHTTPMiddleware } from './http-runner.js';
 export { wireHTTPRoutes, defineHTTPRoutes } from './http-routes.js';
 export { toWebRequest, applyWebResponse } from './web-request.js';

package/dist/wirings/mcp/index.d.ts

@@ -1,4 +1,4 @@
 export { MCPEndpointRegistry } from './mcp-endpoint-registry.js';
 export { MCPError, wireMCPResource, wireMCPPrompt, runMCPResource, runMCPTool, runMCPPrompt, } from './mcp-runner.js';
 export { getMCPResourcesMeta, getMCPToolsMeta, getMCPPromptsMeta, } from './mcp-runner.js';
-export type { AssertMCPResourceURIParams, CoreMCPPrompt, CoreMCPResource, CoreMCPTool, MCPPromptResponse, MCPResourceMeta, MCPResourceResponse, MCPToolMeta, MCPToolResponse, MCPPromptMeta, PikkuMCP, } from './mcp.types.js';
+export type { AssertMCPResourceURIParams, CoreMCPPrompt, CoreMCPResource, MCPPromptResponse, MCPResourceMeta, MCPResourceResponse, MCPToolMeta, MCPToolResponse, MCPPromptMeta, PikkuMCP, } from './mcp.types.js';

package/dist/wirings/mcp/mcp-runner.d.ts

@@ -1,3 +1,4 @@
+import type { PikkuHTTP } from '../http/http.types.js';
 import type { CoreMCPResource, CoreMCPPrompt, JsonRpcRequest, JsonRpcResponse, JsonRpcErrorResponse, PikkuMCP } from './mcp.types.js';
 import type { CorePikkuFunctionConfig, CorePikkuFunctionSessionless } from '../../function/functions.types.js';
 export declare class MCPError extends Error {
@@ -6,21 +7,28 @@ export declare class MCPError extends Error {
 }
 export type RunMCPEndpointParams<Tools extends string = any> = {
     mcp?: PikkuMCP<Tools>;
+    /**
+     * The HTTP request the MCP call arrived on, when it arrived over HTTP.
+     *
+     * Auth middleware reads the session off `wire.http.request` — every
+     * implementation opens with `if (!http?.request) return` — so without this an
+     * MCP call reaches the function unauthenticated no matter what middleware the
+     * app has registered, and a tool fronting a session-requiring function can
+     * only ever answer 'Authentication required'.
+     *
+     * Left undefined for transports that have no request to offer, such as stdio.
+     * Those remain anonymous, which is a property of the transport rather than a
+     * default chosen here.
+     */
+    http?: PikkuHTTP;
     /** Defaults to enabled outside production. */
     exposeErrors?: boolean;
 };
-export type JsonRpcError = {
-    code: number;
-    message: string;
-    data?: any;
-};
 export declare const wireMCPResource: <PikkuFunctionConfig extends CorePikkuFunctionConfig<CorePikkuFunctionSessionless<any, any>> = CorePikkuFunctionConfig<CorePikkuFunctionSessionless<any, any>>>(mcpResource: CoreMCPResource<PikkuFunctionConfig>) => void;
 export declare const wireMCPPrompt: <PikkuFunctionConfig extends CorePikkuFunctionConfig<CorePikkuFunctionSessionless<any, any>> = CorePikkuFunctionConfig<CorePikkuFunctionSessionless<any, any>>>(mcpPrompt: CoreMCPPrompt<PikkuFunctionConfig>) => void;
 export declare function runMCPResource(request: JsonRpcRequest, params: RunMCPEndpointParams, uri: string): Promise<JsonRpcResponse>;
 export declare function runMCPTool(request: JsonRpcRequest, params: RunMCPEndpointParams, name: string): Promise<JsonRpcResponse>;
 export declare function runMCPPrompt(request: JsonRpcRequest, params: RunMCPEndpointParams, name: string): Promise<JsonRpcResponse>;
-export declare const getMCPResources: () => Map<string, CoreMCPResource>;
 export declare const getMCPResourcesMeta: () => import("./mcp.types.js").MCPResourceMeta;
 export declare const getMCPToolsMeta: () => import("./mcp.types.js").MCPToolMeta;
-export declare const getMCPPrompts: () => Map<string, CoreMCPPrompt>;
 export declare const getMCPPromptsMeta: () => import("./mcp.types.js").MCPPromptMeta;

package/dist/wirings/mcp/mcp-runner.js

@@ -48,6 +48,11 @@ export async function runMCPResource(request, params, uri) {
     let extractedParams = {};
     const metas = pikkuState(null, 'mcp', 'resourcesMeta');
     const endpoints = pikkuState(null, 'mcp', 'resources');
+    // The key the resource's meta (and its middleware) is stored under. For a
+    // templated resource this is the template, not the concrete request URI — so
+    // it must be carried forward, or the meta lookup downstream misses and the
+    // resource's declared middleware (including auth) is silently skipped.
+    let metaKey = uri;
     if (endpoints.has(uri)) {
         endpoint = endpoints.get(uri);
         pikkuFuncId = metas[uri]?.pikkuFuncId;
@@ -60,6 +65,7 @@ export async function runMCPResource(request, params, uri) {
             const match = uri.match(regex);
             if (match) {
                 endpoint = value;
+                metaKey = uriTemplate;
                 pikkuFuncId = metas[uriTemplate]?.pikkuFuncId;
                 for (let i = 0; i < paramNames.length; i++) {
                     extractedParams[paramNames[i]] = match[i + 1]; // match[0] is the full match
@@ -71,7 +77,7 @@ export async function runMCPResource(request, params, uri) {
     return await runMCPPikkuFunc({
         ...request,
         params: { ...request.params, ...extractedParams },
-    }, 'resource', uri, endpoint, pikkuFuncId, { ...params, mcp: { ...params.mcp, uri } });
+    }, 'resource', uri, endpoint, pikkuFuncId, { ...params, mcp: { ...params.mcp, uri } }, metaKey);
 }
 export async function runMCPTool(request, params, name) {
     const meta = pikkuState(null, 'mcp', 'toolsMeta')[name];
@@ -82,7 +88,11 @@ export async function runMCPPrompt(request, params, name) {
     const meta = pikkuState(null, 'mcp', 'promptsMeta')[name];
     return await runMCPPikkuFunc(request, 'prompt', name, endpoint, meta?.pikkuFuncId, params);
 }
-async function runMCPPikkuFunc(request, type, name, mcp, pikkuFuncId, { mcp: mcpWire, exposeErrors = !isProduction() }) {
+async function runMCPPikkuFunc(request, type, name, mcp, pikkuFuncId, { mcp: mcpWire, http, exposeErrors = !isProduction() }, 
+// The key the endpoint's meta is stored under. Differs from `name` only for a
+// templated resource, where `name` is the concrete URI and the meta lives
+// under the template. Defaults to `name` for tools and prompts.
+metaKey = name) {
     const singletonServices = getSingletonServices();
     const createWireServices = getCreateWireServices();
     try {
@@ -99,17 +109,20 @@ async function runMCPPikkuFunc(request, type, name, mcp, pikkuFuncId, { mcp: mcp
         const mcpSessionService = new PikkuSessionService(singletonServices.sessionStore);
         const wire = {
             mcp: mcpWire,
+            // Only when the transport supplied one. Setting `http: undefined`
+            // explicitly would be the same to a reader and different to a spread.
+            ...(http ? { http } : {}),
             ...createMiddlewareSessionWireProps(mcpSessionService),
         };
         let meta;
         if (type === 'resource') {
-            meta = pikkuState(null, 'mcp', 'resourcesMeta')[name];
+            meta = pikkuState(null, 'mcp', 'resourcesMeta')[metaKey];
         }
         else if (type === 'tool') {
-            meta = pikkuState(null, 'mcp', 'toolsMeta')[name];
+            meta = pikkuState(null, 'mcp', 'toolsMeta')[metaKey];
         }
         else if (type === 'prompt') {
-            meta = pikkuState(null, 'mcp', 'promptsMeta')[name];
+            meta = pikkuState(null, 'mcp', 'promptsMeta')[metaKey];
         }
         let resolvedFuncName = pikkuFuncId;
         let resolvedPackageName = meta?.packageName ?? null;
@@ -165,18 +178,12 @@ async function runMCPPikkuFunc(request, type, name, mcp, pikkuFuncId, { mcp: mcp
         }
     }
 }
-export const getMCPResources = () => {
-    return pikkuState(null, 'mcp', 'resources');
-};
 export const getMCPResourcesMeta = () => {
     return pikkuState(null, 'mcp', 'resourcesMeta');
 };
 export const getMCPToolsMeta = () => {
     return pikkuState(null, 'mcp', 'toolsMeta');
 };
-export const getMCPPrompts = () => {
-    return pikkuState(null, 'mcp', 'prompts');
-};
 export const getMCPPromptsMeta = () => {
     return pikkuState(null, 'mcp', 'promptsMeta');
 };

package/dist/wirings/persona/index.d.ts

@@ -1,12 +1,11 @@
 export { definePersonas } from './define-personas.js';
 export { isRunnablePersona, roleMismatchMessage, runnablePersonas, validateAndBuildPersonasMeta, verifyPersonaRoles, } from './validate-personas.js';
 export type { RoleVerification } from './validate-personas.js';
-export { personaEnvironmentErrors, personaEnvironmentRefusal, resolvePersonaEnvironments, } from './persona-environments.js';
+export { personaEnvironmentErrors, personaEnvironmentRefusal, } from './persona-environments.js';
 export type { PersonaEnvironment, PersonaEnvironmentSubject, } from './persona-environments.js';
-export { personaEmail, personaEmailLabel, personaEmails, } from './persona-email.js';
-export { allowedLinks, applyMailboxAllowlist, isAllowedSender, } from './persona-mailbox.js';
+export { personaEmail, personaEmails, } from './persona-email.js';
 export type { MailboxAllowlist, PersonaMailbox, ReceivedEmail, } from './persona-mailbox.js';
-export type { CorePersona, CorePersonaAccount, CorePersonas, PersonaAccountMeta, PersonaDefinitions, PersonaMeta, PersonasMeta, } from './persona.types.js';
+export type { CorePersona, CorePersonas, PersonaAccountMeta, PersonaDefinitions, PersonaMeta, PersonasMeta, } from './persona.types.js';
 /**
  * Signing in as a persona and talking to a stage over HTTP.
  *

package/dist/wirings/persona/index.js

@@ -1,8 +1,7 @@
 export { definePersonas } from './define-personas.js';
 export { isRunnablePersona, roleMismatchMessage, runnablePersonas, validateAndBuildPersonasMeta, verifyPersonaRoles, } from './validate-personas.js';
-export { personaEnvironmentErrors, personaEnvironmentRefusal, resolvePersonaEnvironments, } from './persona-environments.js';
-export { personaEmail, personaEmailLabel, personaEmails, } from './persona-email.js';
-export { allowedLinks, applyMailboxAllowlist, isAllowedSender, } from './persona-mailbox.js';
+export { personaEnvironmentErrors, personaEnvironmentRefusal, } from './persona-environments.js';
+export { personaEmail, personaEmails, } from './persona-email.js';
 /**
  * Signing in as a persona and talking to a stage over HTTP.
  *

package/dist/wirings/queue/index.d.ts

@@ -1,9 +1,7 @@
 export type { ConfigValidationResult, CoreQueueWorker, GroupConcurrencyConfig, JobGroup, JobOptions, PikkuJobConfig, PikkuWorkerConfig, PikkuQueue, QueueJob, QueueJobStatus, QueueService, QueueWorkers, QueueWorkersMeta, } from './queue.types.js';
-export { wireQueueWorker, runQueueJob, getQueueWorkers, removeQueueWorker, QueueJobDiscardedError, QueueJobFailedError, } from './queue-runner.js';
-export { QUEUE_IDENTITY_CLAIM_VERSION, QUEUE_IDENTITY_INFO, QUEUE_IDENTITY_SECRET_NAME, getQueueIdentitySecret, resolveQueueJobIdentity, signQueueIdentity, verifyQueueIdentity, } from './queue-identity.js';
+export { wireQueueWorker, runQueueJob, QueueJobDiscardedError, QueueJobFailedError, } from './queue-runner.js';
 export type { QueueIdentityBinding } from './queue-identity.js';
 export { SignedQueueService } from './signed-queue-service.js';
-export { validateWorkerConfig } from './validate-worker-config.js';
 export type { QueueConfigMapping } from './validate-worker-config.js';
 export { registerQueueWorkers } from './register-queue-helper.js';
 export type { QueueRegistrationCallback } from './register-queue-helper.js';

package/dist/wirings/queue/index.js

@@ -1,5 +1,3 @@
-export { wireQueueWorker, runQueueJob, getQueueWorkers, removeQueueWorker, QueueJobDiscardedError, QueueJobFailedError, } from './queue-runner.js';
-export { QUEUE_IDENTITY_CLAIM_VERSION, QUEUE_IDENTITY_INFO, QUEUE_IDENTITY_SECRET_NAME, getQueueIdentitySecret, resolveQueueJobIdentity, signQueueIdentity, verifyQueueIdentity, } from './queue-identity.js';
+export { wireQueueWorker, runQueueJob, QueueJobDiscardedError, QueueJobFailedError, } from './queue-runner.js';
 export { SignedQueueService } from './signed-queue-service.js';
-export { validateWorkerConfig } from './validate-worker-config.js';
 export { registerQueueWorkers } from './register-queue-helper.js';

package/dist/wirings/rpc/addon-runner.d.ts

@@ -4,6 +4,10 @@ export type AddonInstance = {
     secretOverrides?: Record<string, string>;
     variableOverrides?: Record<string, string>;
     credentialOverrides?: Record<string, string>;
+    /** Set by the consuming app to opt this instance out of secret scoping. */
+    globalSecrets?: string;
+    /** Set by the consuming app to opt this instance out of credential scoping. */
+    globalCredentials?: string;
 };
 export declare const getOrCreatePackageSingletonServices: (packageName: string, parentServices: CoreSingletonServices, addonInstance?: AddonInstance) => Promise<CoreSingletonServices>;
 export declare const addonInstanceForNamespace: (namespace: string | undefined, expectedPackage: string) => AddonInstance | undefined;

package/dist/wirings/rpc/addon-runner.js

@@ -1,4 +1,6 @@
 import { pikkuState } from '../../pikku-state.js';
+import { ScopedSecretService } from '../../services/scoped-secret-service.js';
+import { ScopedCredentialService } from '../../services/scoped-credential-service.js';
 const aliasSecretService = (secrets, overrides) => {
     const map = (key) => overrides[key] ?? key;
     return {
@@ -79,9 +81,6 @@ export const getOrCreatePackageSingletonServices = async (packageName, parentSer
         return cachedServices;
     }
     const factories = pikkuState(packageName, 'package', 'factories');
-    if (!factories || !factories.createSingletonServices) {
-        return parentServices;
-    }
     let existingServices = parentServices;
     if (addonInstance?.secretOverrides && parentServices.secrets) {
         existingServices = {
@@ -95,6 +94,21 @@ export const getOrCreatePackageSingletonServices = async (packageName, parentSer
             variables: aliasVariablesService(parentServices.variables, addonInstance.variableOverrides),
         };
     }
+    if (!addonInstance?.globalSecrets && existingServices.secrets) {
+        existingServices = {
+            ...existingServices,
+            secrets: new ScopedSecretService(existingServices.secrets, new Set(pikkuState(packageName, 'package', 'declaredSecrets') ?? [])),
+        };
+    }
+    if (!addonInstance?.globalCredentials && existingServices.credentialService) {
+        existingServices = {
+            ...existingServices,
+            credentialService: new ScopedCredentialService(existingServices.credentialService, new Set(Object.keys(pikkuState(packageName, 'package', 'credentialsMeta') ?? {}))),
+        };
+    }
+    if (!factories || !factories.createSingletonServices) {
+        return existingServices;
+    }
     let config = existingServices.config;
     if (factories.createConfig) {
         config = await factories.createConfig(existingServices.variables);
@@ -118,5 +132,7 @@ export const addonInstanceForNamespace = (namespace, expectedPackage) => {
         secretOverrides: cfg.secretOverrides,
         variableOverrides: cfg.variableOverrides,
         credentialOverrides: cfg.credentialOverrides,
+        globalSecrets: cfg.globalSecrets,
+        globalCredentials: cfg.globalCredentials,
     };
 };

package/dist/wirings/rpc/rpc-runner.d.ts

@@ -14,8 +14,6 @@ export declare class RemoteAddonRequestError extends PikkuError {
     readonly httpStatus: number;
     constructor(namespace: string, fnName: string, status: number, detail: string);
 }
-import type { AIAgentInput } from '../ai-agent/ai-agent.types.js';
-import type { StreamAIAgentOptions } from '../ai-agent/ai-agent-prepare.js';
 export declare const resolveNamespace: (namespacedFunction: string) => ResolvedFunction | null;
 export declare class ContextAwareRPCService {
     private services;
@@ -51,55 +49,14 @@ export declare class ContextAwareRPCService {
     }): Promise<{
         runId: string;
     }>;
-    get agent(): {
-        run: (agentName: string, input: AIAgentInput) => Promise<{
-            status?: "suspended" | undefined;
-            pendingApprovals?: {
-                toolCallId: string;
-                toolName: string;
-                args: unknown;
-                reason?: string;
-                runId: string;
-            }[] | undefined;
-            runId: string;
-            result: {};
-            usage: {
-                inputTokens: number;
-                outputTokens: number;
-            };
-        }>;
-        stream: (agentName: string, input: {
-            message: string;
-            threadId: string;
-            resourceId: string;
-            model?: string;
-            temperature?: number;
-        }, options?: StreamAIAgentOptions) => Promise<void>;
-        resume: (runId: string, input: {
-            toolCallId: string;
-            approved: boolean;
-        }, options?: StreamAIAgentOptions) => Promise<void>;
-        interrupt: (runId: string, reason?: "speech" | "user" | "timeout") => Promise<import("../ai-agent/ai-agent-interrupt.js").AgentInterruptResult>;
-        approve: (runId: string, approvals: {
-            toolCallId: string;
-            approved: boolean;
-        }[], expectedAgentName?: string) => Promise<{
-            status?: "suspended" | undefined;
-            pendingApprovals?: {
-                toolCallId: string;
-                toolName: string;
-                args: unknown;
-                reason?: string;
-                runId: string;
-            }[] | undefined;
-            runId: string;
-            result: {};
-            usage: {
-                inputTokens: number;
-                outputTokens: number;
-            };
-        }>;
-    };
+    /**
+     * The agent facade, built on access.
+     *
+     * The implementation lives in `ai-agent/agent-rpc.ts` so the agent surface is
+     * one file rather than a wing of this one; a getter rather than a field so a
+     * request that never touches an agent never builds it.
+     */
+    get agent(): PikkuRPC['agent'];
     remote<In = any, Out = any>(funcName: string, data: In): Promise<Out>;
 }
 export declare class PikkuRPCService<Services extends CoreServices, TypedRPC = PikkuRPC> {

package/dist/wirings/rpc/rpc-runner.js

@@ -4,6 +4,12 @@ import { pikkuState } from '../../pikku-state.js';
 import { PikkuError, addError } from '../../errors/error-handler.js';
 import { parseVersionedId } from '../../version.js';
 import { resolveRemoteAddonToken } from './remote-addon-auth.js';
+import { createAgentRPC } from '../ai-agent/agent-rpc.js';
+/**
+ * The session for a wire: read through `getSession` when a runner attached one,
+ * otherwise whatever was placed on the wire directly.
+ */
+const resolveWireSession = async (wire) => typeof wire.getSession === 'function' ? await wire.getSession() : wire.session;
 export class RPCNotFoundError extends PikkuError {
     rpcName;
     constructor(rpcName) {
@@ -36,9 +42,6 @@ addError(RemoteAddonRequestError, {
     status: 502,
     message: 'Remote addon request failed.',
 });
-import { runAIAgent, resumeAIAgentSync } from '../ai-agent/ai-agent-runner.js';
-import { streamAIAgent, resumeAIAgent, interruptAIAgent, } from '../ai-agent/ai-agent-stream.js';
-import { wrapChannelWithAGUI } from '../ai-agent/ai-agent-agui.js';
 export const resolveNamespace = (namespacedFunction) => {
     const colonIndex = namespacedFunction.indexOf(':');
     if (colonIndex === -1) {
@@ -142,9 +145,7 @@ export class ContextAwareRPCService {
         catch (e) {
             if (e instanceof RPCNotFoundError) {
                 if (this.services.deploymentService) {
-                    const session = this.wire.getSession && typeof this.wire.getSession === 'function'
-                        ? await this.wire.getSession()
-                        : this.wire.session;
+                    const session = await resolveWireSession(this.wire);
                     return this.services.deploymentService.invoke(funcName, data, session, this.wire.traceId);
                 }
             }
@@ -202,6 +203,8 @@ export class ContextAwareRPCService {
                 secretOverrides: resolved.addonConfig?.secretOverrides,
                 variableOverrides: resolved.addonConfig?.variableOverrides,
                 credentialOverrides: resolved.addonConfig?.credentialOverrides,
+                globalSecrets: resolved.addonConfig?.globalSecrets,
+                globalCredentials: resolved.addonConfig?.globalCredentials,
             },
         };
     }
@@ -276,9 +279,7 @@ export class ContextAwareRPCService {
         }
         catch (e) {
             if (e instanceof RPCNotFoundError && this.services.deploymentService) {
-                const session = this.wire.getSession && typeof this.wire.getSession === 'function'
-                    ? await this.wire.getSession()
-                    : this.wire.session;
+                const session = await resolveWireSession(this.wire);
                 return this.services.deploymentService.invoke(rpcName, data, session, this.wire.traceId);
             }
             throw e;
@@ -308,78 +309,22 @@ export class ContextAwareRPCService {
         };
         return this.services.workflowService.startWorkflow(workflowName, input, wire, this, options);
     }
+    /**
+     * The agent facade, built on access.
+     *
+     * The implementation lives in `ai-agent/agent-rpc.ts` so the agent surface is
+     * one file rather than a wing of this one; a getter rather than a field so a
+     * request that never touches an agent never builds it.
+     */
     get agent() {
-        return {
-            run: async (agentName, input) => {
-                const result = await runAIAgent(agentName, input, {
-                    sessionService: this.options.sessionService,
-                    getCredential: this.wire.getCredential?.bind(this.wire),
-                });
-                return {
-                    runId: result.runId,
-                    result: result.object ?? result.text,
-                    usage: result.usage,
-                    ...(result.status === 'suspended' && {
-                        status: 'suspended',
-                        pendingApprovals: result.pendingApprovals,
-                    }),
-                };
-            },
-            stream: async (agentName, input, options) => {
-                const channel = this.wire.channel;
-                if (!channel)
-                    throw new Error('No channel available for streaming');
-                let currentRunId;
-                await streamAIAgent(agentName, input, wrapChannelWithAGUI(channel, {
-                    threadId: input.threadId,
-                    getRunId: () => currentRunId,
-                }), {
-                    sessionService: this.options.sessionService,
-                    getCredential: this.wire.getCredential?.bind(this.wire),
-                }, undefined, {
-                    ...options,
-                    onRunCreated: (runId) => {
-                        currentRunId = runId;
-                        options?.onRunCreated?.(runId);
-                    },
-                });
-            },
-            resume: async (runId, input, options) => {
-                const channel = this.wire.channel;
-                if (!channel)
-                    throw new Error('No channel available for streaming');
-                await resumeAIAgent({ runId, ...input }, wrapChannelWithAGUI(channel, { runId }), {
-                    sessionService: this.options.sessionService,
-                    getCredential: this.wire.getCredential?.bind(this.wire),
-                }, options);
-            },
-            interrupt: async (runId, reason) => {
-                return interruptAIAgent({ runId, ...(reason ? { reason } : {}) }, { sessionService: this.options.sessionService });
-            },
-            approve: async (runId, approvals, expectedAgentName) => {
-                const result = await resumeAIAgentSync(runId, approvals, {
-                    sessionService: this.options.sessionService,
-                }, expectedAgentName);
-                return {
-                    runId: result.runId,
-                    result: result.object ?? result.text,
-                    usage: result.usage,
-                    ...(result.status === 'suspended' && {
-                        status: 'suspended',
-                        pendingApprovals: result.pendingApprovals,
-                    }),
-                };
-            },
-        };
+        return createAgentRPC(this.wire, this.options);
     }
     async remote(funcName, data) {
         if (!this.services.deploymentService) {
             throw new Error(`No DeploymentService configured for remote RPC: ${funcName}. ` +
                 `Set up a DeploymentService to enable remote function calls.`);
         }
-        const session = this.wire.getSession && typeof this.wire.getSession === 'function'
-            ? await this.wire.getSession()
-            : this.wire.session;
+        const session = await resolveWireSession(this.wire);
         return this.services.deploymentService.invoke(funcName, data, session, this.wire.traceId);
     }
 }
@@ -390,18 +335,42 @@ export class PikkuRPCService {
             ? requiresAuthOrOptions
             : { requiresAuth: requiresAuthOrOptions };
         const serviceRPC = new ContextAwareRPCService(services, wire, options, packageName);
-        return {
-            depth,
-            global: false,
-            invoke: serviceRPC.rpc.bind(serviceRPC),
-            remote: serviceRPC.remote.bind(serviceRPC),
-            exposed: serviceRPC.rpcExposed.bind(serviceRPC),
-            startWorkflow: serviceRPC.startWorkflow.bind(serviceRPC),
-            get agent() {
-                return serviceRPC.agent;
-            },
-            rpcWithWire: serviceRPC.rpcWithWire.bind(serviceRPC),
-        };
+        // `TypedRPC` is named by the caller from its generated RPC map. Nothing
+        // concrete can satisfy a type the caller has not chosen yet.
+        return new ContextRPCView(serviceRPC, depth);
+    }
+}
+/**
+ * The per-invocation `wire.rpc`.
+ *
+ * A class rather than an object literal because `agent` has to stay lazy — most
+ * requests never touch it — and an accessor declared on an object literal is
+ * defined per instance, which drops the literal off V8's fast construction
+ * path. Measured at ~1.15µs per request as a literal against ~0.47µs here, on
+ * the hot path every request takes.
+ *
+ * knowledge: decisions/internals/the-per-invocation-rpc-view-is-a-class.md
+ */
+class ContextRPCView {
+    serviceRPC;
+    depth;
+    global = false;
+    invoke;
+    remote;
+    exposed;
+    startWorkflow;
+    rpcWithWire;
+    constructor(serviceRPC, depth) {
+        this.serviceRPC = serviceRPC;
+        this.depth = depth;
+        this.invoke = serviceRPC.rpc.bind(serviceRPC);
+        this.remote = serviceRPC.remote.bind(serviceRPC);
+        this.exposed = serviceRPC.rpcExposed.bind(serviceRPC);
+        this.startWorkflow = serviceRPC.startWorkflow.bind(serviceRPC);
+        this.rpcWithWire = serviceRPC.rpcWithWire.bind(serviceRPC);
+    }
+    get agent() {
+        return this.serviceRPC.agent;
     }
 }
 export const rpcService = new PikkuRPCService();

package/dist/wirings/rpc/rpc-types.d.ts

@@ -1,3 +1,4 @@
+import type { PikkuRawWire } from '../../types/core.types.js';
 import type { AgentInterruptResult } from '../ai-agent/ai-agent-interrupt.js';
 export type PikkuRPC<Invoke extends (...args: any[]) => any = (...args: any[]) => any, Remote extends (...args: any[]) => any = (...args: any[]) => any, startWorkflow extends (...args: any[]) => any = (...args: any[]) => any, AgentRun extends (...args: any[]) => any = (...args: any[]) => any, AgentStream extends (...args: any[]) => any = (...args: any[]) => any> = {
     depth: number;
@@ -5,6 +6,8 @@ export type PikkuRPC<Invoke extends (...args: any[]) => any = (...args: any[]) =
     invoke: Invoke;
     remote: Remote;
     exposed: (name: string, data: any) => Promise<any>;
+    /** Invoke an RPC with explicit wire fields merged over the caller's. */
+    rpcWithWire: <In = any, Out = any>(rpcName: string, data: In, wire: PikkuRawWire) => Promise<Out>;
     startWorkflow: startWorkflow;
     agent: {
         run: AgentRun;
@@ -45,6 +48,10 @@ export interface ResolvedFunction {
         secretOverrides?: Record<string, string>;
         variableOverrides?: Record<string, string>;
         credentialOverrides?: Record<string, string>;
+        /** Set by the consuming app: hand this instance the unscoped `SecretService` */
+        globalSecrets?: string;
+        /** Set by the consuming app: hand this instance the unscoped `CredentialService` */
+        globalCredentials?: string;
         /** Set by `wireRemoteAddon`: dispatch this namespace's RPCs over HTTP */
         remote?: boolean;
         serverUrl?: string | ((services: any) => string | Promise<string>);

package/dist/wirings/rpc/wire-addon.d.ts

@@ -11,6 +11,19 @@ export type WireAddonConfig = {
     secretOverrides?: Record<string, string>;
     variableOverrides?: Record<string, string>;
     credentialOverrides?: Record<string, string>;
+    /**
+     * Hands this instance the whole `SecretService` instead of one scoped to the
+     * secrets it declared. The value is the reason, recorded in the deploy
+     * manifest — an addon that names secrets at runtime cannot be scoped, and
+     * only the consuming app, never the addon, can grant it.
+     */
+    globalSecrets?: string;
+    /**
+     * Hands this instance the whole `CredentialService` instead of one narrowed
+     * to the credentials it declared. The value is the reason, recorded in the
+     * deploy manifest, and only the consuming app can grant it.
+     */
+    globalCredentials?: string;
 };
 export declare const wireAddon: (config: WireAddonConfig) => void;
 /**

package/dist/wirings/rpc/wire-addon.js

@@ -16,6 +16,10 @@ export const wireAddon = (config) => {
         ...(config.credentialOverrides
             ? { credentialOverrides: config.credentialOverrides }
             : {}),
+        ...(config.globalSecrets ? { globalSecrets: config.globalSecrets } : {}),
+        ...(config.globalCredentials
+            ? { globalCredentials: config.globalCredentials }
+            : {}),
     });
 };
 /**

package/dist/wirings/scheduler/index.d.ts

@@ -1,3 +1,3 @@
 export { runScheduledTask, wireScheduler, getScheduledTasks, } from './scheduler-runner.js';
 export { logSchedulers } from './log-schedulers.js';
-export type { CoreScheduledTask, ScheduledTasksMeta, PikkuScheduledTask, } from './scheduler.types.js';
+export type { CoreScheduledTask, ScheduledTasksMeta, } from './scheduler.types.js';

package/dist/wirings/secret/validate-secret-definitions.js

@@ -34,8 +34,8 @@ export function validateAndBuildSecretDefinitionsMeta(definitions, schemaLookup)
                     schema: def.schema,
                     oauth2: def.oauth2,
                     rotationPeriod: def.rotationPeriod,
-                    docsUrl: def.docsUrl,
                     allowedHosts: def.allowedHosts,
+                    docsUrl: def.docsUrl,
                     sourceFile: def.sourceFile,
                 };
             }
@@ -51,8 +51,8 @@ export function validateAndBuildSecretDefinitionsMeta(definitions, schemaLookup)
                 schema: def.schema,
                 oauth2: def.oauth2,
                 rotationPeriod: def.rotationPeriod,
-                docsUrl: def.docsUrl,
                 allowedHosts: def.allowedHosts,
+                docsUrl: def.docsUrl,
                 sourceFile: def.sourceFile,
             };
         }

package/dist/wirings/trigger/index.d.ts

@@ -1,3 +1,3 @@
 export { wireTrigger, wireTriggerSource } from './trigger-runner.js';
 export { PikkuTriggerService } from './pikku-trigger-service.js';
-export type { TriggerMeta, TriggerSourceMeta, CorePikkuTriggerFunction, CorePikkuTriggerFunctionConfig, CoreTrigger, PikkuTrigger, } from './trigger.types.js';
+export type { TriggerMeta, TriggerSourceMeta, CorePikkuTriggerFunction, CorePikkuTriggerFunctionConfig, CoreTrigger, } from './trigger.types.js';

package/dist/wirings/trigger/pikku-trigger-service.d.ts

@@ -5,10 +5,6 @@ export type TriggerTarget = {
     targetName: string;
     startNode?: string;
 };
-export type TriggerSourceInfo = {
-    name: string;
-    input: unknown;
-};
 export declare abstract class PikkuTriggerService implements TriggerService {
     protected activeTriggers: Map<string, TriggerInstance>;
     abstract start(): Promise<void>;

package/dist/wirings/trigger/trigger-runner.js

@@ -24,6 +24,7 @@ export const wireTriggerSource = (source) => {
     if (triggerSources.has(source.name)) {
         throw new Error(`Trigger source already exists: ${source.name}`);
     }
+    // knowledge: decisions/internals/wiring-registries-erase-the-generics-their-wire-functions-capture.md
     triggerSources.set(source.name, source);
     addFunction(triggerSourceMeta.pikkuFuncId, source.func, triggerSourceMeta.packageName);
 };