@pikku/core 0.12.84 → 0.12.86

package/dist/ecosystem/workflow.js

@@ -1,4 +1,6 @@
+export { InMemoryWorkflowService } from '../services/in-memory-workflow-service.js';
 export { template } from '../wirings/workflow/graph/template.js';
 export { isRef } from '../wirings/workflow/graph/workflow-graph.types.js';
+export { PikkuWorkflowService } from '../wirings/workflow/pikku-workflow-service.js';
 export { buildRunTimeline, reconstructFinalState, reconstructStateAt, } from '../wirings/workflow/run-timeline.js';
 export { assertWorkflowRunOwner } from '../wirings/workflow/workflow-run-ownership.js';

package/dist/errors/index.d.ts

@@ -1,2 +1,10 @@
 export * from './errors.js';
 export { PikkuError, addError } from './error-handler.js';
+/**
+ * Types the exports above mention but do not themselves export. Without
+ * them a consumer's declaration emit has no name for the type it infers,
+ * and fails with TS2883 rather than reaching for the original entry point.
+ */
+export type { ErrorDetails } from './error-handler.js';
+export { isExpectedError } from './error-handler.js';
+export type { SerializedError } from './serialized-error.js';

package/dist/errors/index.js

@@ -1,2 +1,3 @@
 export * from './errors.js';
 export { PikkuError, addError } from './error-handler.js';
+export { isExpectedError } from './error-handler.js';

package/dist/errors/serialized-error.d.ts

@@ -0,0 +1,7 @@
+export interface SerializedError {
+    message: string;
+    stack?: string;
+    code?: string;
+    expected?: boolean;
+    [key: string]: any;
+}

package/dist/function/function-meta.types.d.ts

@@ -0,0 +1,139 @@
+import type { MiddlewareMetadata } from '../middleware/middleware.types.js';
+import type { AuditDurability } from '../services/audit-service.js';
+import type { ScenarioStepKind, ScenarioSurface } from '../wirings/workflow/scenario-step.types.js';
+import type { CommonWireMeta } from '../types/core.types.js';
+export interface FunctionServicesMeta {
+    optimized: boolean;
+    services: string[];
+}
+export interface FunctionWiresMeta {
+    optimized: boolean;
+    wires: string[];
+}
+/**
+ * A reference to a permission function, resolved by name. Function-scoped
+ * only: there are no wire- or tag-level permission references.
+ */
+export type PermissionMetadata = {
+    type: 'wire';
+    name: string;
+    inline?: boolean;
+};
+export type FunctionRuntimeMeta = {
+    pikkuFuncId: string;
+    inputSchemaName: string | null;
+    outputSchemaName: string | null;
+    /** Scopes the session must hold to run this function. All are required (AND). */
+    scopes?: string[];
+    expose?: boolean;
+    /**
+     * A sessionless function's own `auth: true`. `sessionless` carries the
+     * baseline — a `pikkuFunc` always requires a session — and this carries the
+     * tightening a `pikkuSessionlessFunc` applies to itself. Both are needed to
+     * know whether a function is gated without running it.
+     */
+    auth?: boolean;
+    /**
+     * The author's declaration that this function's permission check lives in its
+     * own body. Carries no runtime effect — it records a gate codegen cannot see,
+     * so an audit is not left to guess whether a sessionless function is open.
+     * Refused unless `allow.permissionsInBody` is set in `pikku.config.json`.
+     */
+    permissionsInBody?: boolean;
+    remote?: boolean;
+    /**
+     * A step RPC: invoked by name only from a scenario run and refused
+     * everywhere else, so it is never network-callable.
+     */
+    scenarioStep?: boolean;
+    /**
+     * The body of a `pikkuScenario(...)`. Only ever run by `pikku scenario run`,
+     * so it is held back from the app bootstrap and from every deployed unit.
+     */
+    scenario?: boolean;
+    mcp?: boolean;
+    readonly?: boolean;
+    deploy?: 'serverless' | 'server' | 'auto';
+    sessionless?: boolean;
+    /** When true, workflow steps calling this function are dispatched via the queue. No queue service configured is a hard error. */
+    workflowQueued?: boolean;
+    /** Retry count when this function is used as a workflow step. */
+    workflowRetries?: number;
+    /** Timeout when this function is used as a workflow step (e.g. '30s', '5m'). */
+    workflowTimeout?: string;
+    /**
+     * Scenario steps only: which surfaces this step declares a binding for.
+     *
+     * The reporter derives coverage from this — a `then` with no binding for the
+     * surface the run targeted was never actually witnessed there, which is a gap
+     * worth counting rather than excusing.
+     */
+    scenarioStepSurfaces?: ScenarioSurface[];
+    /**
+     * Scenario steps only: this step runs as a persona, so every call site must
+     * pass one and the runner injects it as `wire.actor`.
+     *
+     * Declared by `actor: true`, or implied by a `browser` binding — a window is
+     * opened as somebody. Absent on a step with nobody to be: an assertion over
+     * what an earlier step returned, or one posting credentials precisely because
+     * it must not reuse an actor's session.
+     */
+    scenarioStepRequiresActor?: boolean;
+    /**
+     * Scenario steps only: who acts. Absent means `persona` — the ordinary step,
+     * and the only kind that existed before the other two.
+     *
+     * A `platform` or `addon` step is the app or a third-party system acting, and
+     * it must never reach a virtual user's catalogue. That is not tidiness: a
+     * virtual user that can invoke "Stripe's webhook arrives" can forge its own
+     * payment success, and every finding downstream of that is worthless.
+     */
+    scenarioStepKind?: ScenarioStepKind;
+    /** Addon steps only: the addon whose system acts — `wireAddon`'s `name`. */
+    scenarioStepAddon?: string;
+    /** Scenario steps only: the prose a reporter renders, with `{placeholders}` filled from the step's recorded input. */
+    scenarioStepTemplate?: string;
+    /**
+     * The function's `audit` config, resolved — `audit: true` reads as
+     * `{ durability: 'best-effort' }`. Absent means the function records nothing:
+     * `auditLog.write()` from an unmarked function is dropped with a warning, so
+     * this is the only place a reader can see which functions have a trail at all
+     * without running them.
+     *
+     * Informational. The runner resolves audit from the live function config, not
+     * from here, so meta and runtime cannot disagree about whether audit is on.
+     */
+    audit?: {
+        durability: AuditDurability;
+    };
+    version?: number;
+    approvalRequired?: boolean;
+    approvalDescription?: string;
+    implementationHash?: string;
+    contractHash?: string;
+    inputHash?: string;
+    outputHash?: string;
+};
+export type FunctionMeta = FunctionRuntimeMeta & Partial<{
+    name: string;
+    /** `remote`: a contract with no local body, answered by a connected client. */
+    functionType: 'user' | 'inline' | 'helper' | 'remote';
+    funcWrapper: string;
+    services: FunctionServicesMeta;
+    wires: FunctionWiresMeta;
+    inputs: string[] | null;
+    outputs: string[] | null;
+    middleware: MiddlewareMetadata[];
+    permissions: PermissionMetadata[];
+    isDirectFunction: boolean;
+    sourceFile: string;
+    exportedName: string;
+    /** File containing the handler body when it differs from sourceFile (imported handlers) */
+    bodySourceFile?: string;
+    /** 1-indexed first line of the handler body (verbose meta; coverage mapping) */
+    bodyStart: number;
+    /** 1-indexed last line of the handler body (verbose meta; coverage mapping) */
+    bodyEnd: number;
+} & CommonWireMeta>;
+export type FunctionsRuntimeMeta = Record<string, FunctionRuntimeMeta>;
+export type FunctionsMeta = Record<string, FunctionMeta>;

package/dist/function/function-runner.d.ts

@@ -1,9 +1,10 @@
-import type { CoreUserSession, CorePikkuMiddleware, PikkuWiringTypes, PikkuRawWire, MiddlewareMetadata, CoreSingletonServices, CreateWireServices } from '../types/core.types.js';
+import type { CoreUserSession, PikkuWiringTypes, PikkuRawWire, CoreSingletonServices, CreateWireServices } from '../types/core.types.js';
+import type { CorePikkuMiddleware, MiddlewareMetadata } from '../middleware/middleware.types.js';
 import type { CorePikkuChannelMiddleware } from '../wirings/channel/channel.types.js';
 import type { CorePikkuFunctionConfig } from './functions.types.js';
 import type { SessionService } from '../services/user-session-service.js';
 import { PikkuCredentialWireService } from '../services/credential-wire-service.js';
-import type { AddonInstance } from '../wirings/rpc/addon-runner.js';
+import type { AddonInstance } from '../wirings/addon/addon-runner.js';
 export declare const addFunction: (funcName: string, funcConfig: CorePikkuFunctionConfig<any, any>, packageName?: string | null) => void;
 export declare const getFunctionNames: (packageName?: string | null) => string[];
 export declare const getAllFunctionNames: () => string[];

package/dist/function/function-runner.js

@@ -13,8 +13,8 @@ import { PikkuCredentialWireService, createWireServicesCredentialWireProps, } fr
 import { defaultPikkuUserIdResolver } from '../services/pikku-user-id.js';
 import { createInvocationAudit, resolveAuditConfig, } from '../services/audit-service.js';
 import { rpcService } from '../wirings/rpc/rpc-runner.js';
-import { getOrCreatePackageSingletonServices } from '../wirings/rpc/addon-runner.js';
-import { resolveAddonAuth, resolveAddonScopes, resolveAddonTagMiddleware, } from '../wirings/rpc/wire-addon.js';
+import { getOrCreatePackageSingletonServices } from '../wirings/addon/addon-runner.js';
+import { resolveAddonAuth, resolveAddonFunctionTarget, resolveAddonScopes, resolveAddonTagMiddleware, } from '../wirings/addon/wire-addon.js';
 import { closeWireServices } from '../utils.js';
 async function resolveSession(wire, singletonServices, sessionService) {
     const pikkuUserId = defaultPikkuUserIdResolver(wire);
@@ -77,6 +77,26 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
             }
         }
     }
+    /**
+     * The package the *function* belongs to, which is the wire's own until a
+     * `ref()` resolves the target into an addon. The wiring stays the consuming
+     * app's — that is what keeps the app's middleware running rather than the
+     * addon's — but everything the function is declared with lives in the addon's
+     * package state, so its schemas, services and permissions are read from here.
+     */
+    let funcPackageName = packageName;
+    if (!funcMeta) {
+        const addonTarget = resolveAddonFunctionTarget(funcName, packageName);
+        if (addonTarget) {
+            funcConfig =
+                funcConfig ||
+                    pikkuState(addonTarget.packageName, 'function', 'functions').get(addonTarget.localName);
+            funcMeta = pikkuState(addonTarget.packageName, 'function', 'meta')[addonTarget.localName];
+            if (funcMeta) {
+                funcPackageName = addonTarget.packageName;
+            }
+        }
+    }
     if (!funcConfig) {
         throw new Error(`Function not found: ${funcName}`);
     }
@@ -84,12 +104,12 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
         throw new Error(`Function meta not found: ${funcName}`);
     }
     const resolvedFunctionId = funcMeta.pikkuFuncId ?? funcName;
-    const resolvedSingletonServices = packageName
-        ? await getOrCreatePackageSingletonServices(packageName, singletonServices, addonInstance)
+    const resolvedSingletonServices = funcPackageName
+        ? await getOrCreatePackageSingletonServices(funcPackageName, singletonServices, addonInstance)
         : singletonServices;
     let resolvedCreateWireServices = createWireServices;
-    if (packageName) {
-        const factories = pikkuState(packageName, 'package', 'factories');
+    if (funcPackageName) {
+        const factories = pikkuState(funcPackageName, 'package', 'factories');
         if (factories?.createWireServices) {
             resolvedCreateWireServices = factories.createWireServices;
         }
@@ -192,11 +212,11 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
         let actualData = await data();
         const inputSchemaName = funcMeta.inputSchemaName;
         if (inputSchemaName) {
-            actualData = applyDefaultsFromSchema(inputSchemaName, actualData, packageName);
+            actualData = applyDefaultsFromSchema(inputSchemaName, actualData, funcPackageName);
             if (coerceDataFromSchema) {
-                coerceTopLevelDataFromSchema(inputSchemaName, actualData, packageName);
+                coerceTopLevelDataFromSchema(inputSchemaName, actualData, funcPackageName);
             }
-            await validateSchema(resolvedSingletonServices.logger, resolvedSingletonServices.schema, inputSchemaName, actualData, packageName);
+            await validateSchema(resolvedSingletonServices.logger, resolvedSingletonServices.schema, inputSchemaName, actualData, funcPackageName);
         }
         await runPermissions({
             funcPermissions: funcConfig.permissions,
@@ -204,7 +224,7 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
             // knowledge: decisions/security/a-permission-gets-a-wire-it-cannot-reply-on.md
             wire: invocationWire,
             data: actualData,
-            packageName,
+            packageName: funcPackageName,
         });
         let wireServices;
         let invocationAuditLog;
@@ -220,7 +240,7 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
                 invocationAuditLog = createInvocationAudit(resolvedSingletonServices.audit, invocationWire, resolvedSingletonServices.logger);
                 services = { ...services, auditLog: invocationAuditLog };
             }
-            const callerPackageName = packageName;
+            const callerPackageName = funcPackageName;
             Object.defineProperty(invocationWire, 'rpc', {
                 get() {
                     const rpc = rpcService.getContextRPCService(services, invocationWire, { sessionService }, 0, callerPackageName);

package/dist/function/functions.types.d.ts

@@ -1,10 +1,12 @@
-import type { CoreServices, CoreSecretlessSingletonServices, CoreUserSession, CorePikkuMiddleware, PikkuWire, PickRequired, SecretlessServices } from '../types/core.types.js';
+import type { CoreServices, CoreSecretlessSingletonServices, CoreUserSession, PikkuWire, SecretlessServices } from '../types/core.types.js';
+import type { CorePikkuMiddleware } from '../middleware/middleware.types.js';
+import type { PickRequired } from '../utils.js';
 import type { PikkuRPC } from '../wirings/rpc/rpc-types.js';
 import type { StandardSchemaV1 } from '@standard-schema/spec';
 import type { PikkuError } from '../errors/error-handler.js';
 import type { CoreNodeConfig } from '../wirings/node/node.types.js';
 import type { ScenarioSurface } from '../wirings/workflow/scenario-step.types.js';
-import type { Safe } from '../secret-value.js';
+import type { Safe } from '../classification/secret-value.js';
 export type CorePikkuFunction<In, Out, Services extends CoreSecretlessSingletonServices = SecretlessServices<CoreServices>, Session extends CoreUserSession = CoreUserSession, Wire extends PikkuWire<In, Out, true, Session, PikkuRPC, null, string> = PikkuWire<In, Out, true, Session>> = (services: Services, data: In, wire: Wire) => Wire['channel'] extends null ? Promise<Safe<Out>> : Promise<Safe<Out>> | Promise<void>;
 export type CorePikkuFunctionSessionless<In, Out, Services extends CoreSecretlessSingletonServices = SecretlessServices<CoreServices>, Session extends CoreUserSession = CoreUserSession, Wire extends PikkuWire<In, Out, false, Session, PikkuRPC, null, string> = PikkuWire<In, Out, false, Session>> = (services: Services, data: In, wire: Wire) => Wire['channel'] extends null ? Promise<Safe<Out>> : Promise<Safe<Out>> | Promise<void>;
 export type CorePikkuPermission<In = any, Services extends CoreSecretlessSingletonServices = SecretlessServices<CoreServices>, Wire extends PikkuWire<In, never, false, any, PikkuRPC, never, never> = PikkuWire<In, never, false, any, PikkuRPC, never, never>> = (services: Services, data: In, wire: Wire) => Promise<boolean>;
@@ -83,6 +85,12 @@ export type CorePikkuFunctionConfig<PikkuFunction extends CorePikkuFunction<any,
      * and report how much of the flow each surface actually covers.
      */
     surfaces?: ScenarioSurface[];
+    /**
+     * Scenario steps only: this step is driven by a persona, so the runner injects
+     * `wire.actor` and refuses to dispatch it without one. Set by the definer from
+     * a `browser` binding or an explicit `actor: true`, never written by hand.
+     */
+    requiresActor?: boolean;
     audit?: boolean | {
         durability?: 'best-effort' | 'transactional';
     };

package/dist/function/index.d.ts

@@ -1,4 +1,10 @@
-export { addFunction, getAllFunctionNames } from './function-runner.js';
+export { addFunction, getAllFunctionNames, runPikkuFunc, } from './function-runner.js';
 export { pikkuAuth, pikkuPermission, pikkuPermissionFactory, pikkuApprovalDescription, } from './functions.types.js';
 export type { CorePikkuFunction, CorePikkuFunctionSessionless, CorePikkuFunctionConfig, CorePikkuSessionlessFunctionConfig, CorePikkuAuth, CorePikkuAuthConfig, CorePikkuPermission, } from './functions.types.js';
-export type { ListInput, ListOutput, Filter, } from './list.types.js';
+export type { ListInput, ListOutput, Filter } from './list.types.js';
+export { AbandonedError } from './abort-scope.js';
+export type { AbortScope } from './abort-scope.js';
+export { checkAuthPermissions } from '../permissions.js';
+export type { CorePermissionGroup, CorePikkuApprovalDescription, CorePikkuPermissionConfig, CorePikkuPermissionFactory, } from './functions.types.js';
+export type { FunctionMeta, FunctionRuntimeMeta, FunctionServicesMeta, FunctionWiresMeta, FunctionsMeta, FunctionsRuntimeMeta, PermissionMetadata, } from './function-meta.types.js';
+export { PikkuRequest } from './pikku-request.js';

package/dist/function/index.js

@@ -1,2 +1,5 @@
-export { addFunction, getAllFunctionNames } from './function-runner.js';
+export { addFunction, getAllFunctionNames, runPikkuFunc, } from './function-runner.js';
 export { pikkuAuth, pikkuPermission, pikkuPermissionFactory, pikkuApprovalDescription, } from './functions.types.js';
+export { AbandonedError } from './abort-scope.js';
+export { checkAuthPermissions } from '../permissions.js';
+export { PikkuRequest } from './pikku-request.js';

package/dist/function/pikku-request.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @group RequestResponse
+ */
+export declare abstract class PikkuRequest<In = any> {
+    #private;
+    constructor(data: In);
+    data(): Promise<In>;
+}

package/dist/function/pikku-request.js

@@ -0,0 +1,15 @@
+/**
+ * @group RequestResponse
+ */
+export class PikkuRequest {
+    #data;
+    constructor(data) {
+        this.#data = data;
+    }
+    async data() {
+        if (this.#data === undefined) {
+            throw new Error('Data not found');
+        }
+        return this.#data;
+    }
+}

package/dist/middleware/auth-apikey.d.ts

@@ -1,11 +1,3 @@
-export declare const authAPIKey: import("../types/core.types.js").CorePikkuMiddlewareFactory<{
+export declare const authAPIKey: import("./middleware.types.js").CorePikkuMiddlewareFactory<{
     source: "header" | "query" | "all";
-}, import("../types/core.types.js").CoreSingletonServices<{
-    logLevel?: import("../services/logger.js").LogLevel;
-    secrets?: {
-        requireAllowedHosts?: boolean;
-    };
-    workflow?: import("../ecosystem/agent.js").WorkflowServiceConfig;
-    webhook?: import("../services/webhook-service.js").WebhookServiceConfig;
-    postgres?: import("../types/core.types.js").PostgresConfig;
-}>, import("../types/core.types.js").CoreUserSession>;
+}>;

package/dist/middleware/auth-apikey.js

@@ -1,4 +1,4 @@
-import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js';
+import { pikkuMiddleware, pikkuMiddlewareFactory, } from './middleware-factories.js';
 export const authAPIKey = pikkuMiddlewareFactory(({ source }) => pikkuMiddleware(async ({ jwt: jwtService }, { http, setSession, session }, next) => {
     if (!http?.request || !setSession || session) {
         return next();

package/dist/middleware/auth-bearer.d.ts

@@ -4,7 +4,7 @@ import type { CoreUserSession } from '../types/core.types.js';
  * time against a static `value` or a `secretId` resolved through the secrets
  * service per request.
  */
-export declare const authBearer: import("../types/core.types.js").CorePikkuMiddlewareFactory<{
+export declare const authBearer: import("./middleware.types.js").CorePikkuMiddlewareFactory<{
     token?: {
         value: string;
         userSession: CoreUserSession;
@@ -12,12 +12,4 @@ export declare const authBearer: import("../types/core.types.js").CorePikkuMiddl
         secretId: string;
         userSession: CoreUserSession;
     };
-}, import("../types/core.types.js").CoreSingletonServices<{
-    logLevel?: import("../services/logger.js").LogLevel;
-    secrets?: {
-        requireAllowedHosts?: boolean;
-    };
-    workflow?: import("../ecosystem/agent.js").WorkflowServiceConfig;
-    webhook?: import("../services/webhook-service.js").WebhookServiceConfig;
-    postgres?: import("../types/core.types.js").PostgresConfig;
-}>, CoreUserSession>;
+}>;

package/dist/middleware/auth-bearer.js

@@ -1,5 +1,5 @@
 import { InvalidSessionError } from '../errors/errors.js';
-import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js';
+import { pikkuMiddleware, pikkuMiddlewareFactory, } from './middleware-factories.js';
 const constantTimeEqual = (a, b) => {
     if (a.length !== b.length)
         return false;

package/dist/middleware/auth-cookie.d.ts

@@ -1,15 +1,7 @@
 import type { SerializeOptions } from 'cookie';
 import type { RelativeTimeInput } from '../time-utils.js';
-export declare const authCookie: import("../types/core.types.js").CorePikkuMiddlewareFactory<{
+export declare const authCookie: import("./middleware.types.js").CorePikkuMiddlewareFactory<{
     name: string;
     options: SerializeOptions;
     expiresIn: RelativeTimeInput;
-}, import("../types/core.types.js").CoreSingletonServices<{
-    logLevel?: import("../services/logger.js").LogLevel;
-    secrets?: {
-        requireAllowedHosts?: boolean;
-    };
-    workflow?: import("../ecosystem/agent.js").WorkflowServiceConfig;
-    webhook?: import("../services/webhook-service.js").WebhookServiceConfig;
-    postgres?: import("../types/core.types.js").PostgresConfig;
-}>, import("../types/core.types.js").CoreUserSession>;
+}>;

package/dist/middleware/auth-cookie.js

@@ -1,4 +1,4 @@
-import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js';
+import { pikkuMiddleware, pikkuMiddlewareFactory, } from './middleware-factories.js';
 import { getRelativeTimeOffsetFromNow } from '../time-utils.js';
 /**
  * Reads a JWT session from a cookie, and re-issues the cookie after the

package/dist/middleware/cors.d.ts

@@ -1,21 +1,15 @@
 /**
  * Sets CORS headers on every response and short-circuits OPTIONS preflight
  * with a 204. `origin: true` reflects the request origin; an array reflects a
- * matching origin and otherwise falls back to its first entry.
+ * matching origin and otherwise sends no `Access-Control-Allow-Origin` at all,
+ * so the browser reports "origin not allowed" rather than an origin mismatch
+ * against whichever entry happened to be first.
  */
-export declare const cors: import("../types/core.types.js").CorePikkuMiddlewareFactory<{
+export declare const cors: import("./middleware.types.js").CorePikkuMiddlewareFactory<{
     origin?: string | string[] | true;
     methods?: string[];
     headers?: string[];
     exposeHeaders?: string[];
     credentials?: boolean;
     maxAge?: number;
-}, import("../types/core.types.js").CoreSingletonServices<{
-    logLevel?: import("../services/logger.js").LogLevel;
-    secrets?: {
-        requireAllowedHosts?: boolean;
-    };
-    workflow?: import("../ecosystem/agent.js").WorkflowServiceConfig;
-    webhook?: import("../services/webhook-service.js").WebhookServiceConfig;
-    postgres?: import("../types/core.types.js").PostgresConfig;
-}>, import("../types/core.types.js").CoreUserSession>;
+}>;

package/dist/middleware/cors.js

@@ -1,8 +1,10 @@
-import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js';
+import { pikkuMiddleware, pikkuMiddlewareFactory, } from './middleware-factories.js';
 /**
  * Sets CORS headers on every response and short-circuits OPTIONS preflight
  * with a 204. `origin: true` reflects the request origin; an array reflects a
- * matching origin and otherwise falls back to its first entry.
+ * matching origin and otherwise sends no `Access-Control-Allow-Origin` at all,
+ * so the browser reports "origin not allowed" rather than an origin mismatch
+ * against whichever entry happened to be first.
  */
 export const cors = pikkuMiddlewareFactory(({ origin = '*', methods = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'], headers = ['Content-Type', 'Authorization', 'x-api-key'], exposeHeaders = [], credentials = false, maxAge = 86400, } = {}) => {
     if (origin === '*' && credentials) {
@@ -11,7 +13,7 @@ export const cors = pikkuMiddlewareFactory(({ origin = '*', methods = ['GET', 'P
     return pikkuMiddleware({
         name: 'CORS',
         description: 'Handles cross-origin requests including OPTIONS preflight',
-        func: async (_services, wires, next) => {
+        func: async (services, wires, next) => {
             const request = wires.http?.request;
             const response = wires.http?.response;
             if (!request || !response) {
@@ -26,18 +28,23 @@ export const cors = pikkuMiddlewareFactory(({ origin = '*', methods = ['GET', 'P
                 allowedOrigin =
                     requestOrigin && origin.includes(requestOrigin)
                         ? requestOrigin
-                        : origin[0];
+                        : undefined;
+                if (requestOrigin && !allowedOrigin) {
+                    services.logger.debug(`CORS: origin '${requestOrigin}' is not in the allowed list, omitting Access-Control-Allow-Origin`);
+                }
             }
             else {
                 allowedOrigin = origin;
             }
-            response.header('Access-Control-Allow-Origin', allowedOrigin);
+            if (allowedOrigin) {
+                response.header('Access-Control-Allow-Origin', allowedOrigin);
+            }
             response.header('Access-Control-Allow-Methods', methods.join(', '));
             response.header('Access-Control-Allow-Headers', headers.join(', '));
             if (exposeHeaders.length > 0) {
                 response.header('Access-Control-Expose-Headers', exposeHeaders.join(', '));
             }
-            if (credentials) {
+            if (credentials && allowedOrigin) {
                 response.header('Access-Control-Allow-Credentials', 'true');
             }
             if (origin === true || Array.isArray(origin)) {

package/dist/middleware/index.d.ts

@@ -6,3 +6,6 @@ export { cors } from './cors.js';
 export { telemetryOuter, telemetryInner } from './telemetry.js';
 export { addTagMiddleware, addTagMiddleware as addMiddleware, addGlobalMiddleware, runMiddleware, } from '../middleware-runner.js';
 export { addGlobalPermission } from '../permissions.js';
+export type { CorePikkuMiddleware, CorePikkuMiddlewareConfig, CorePikkuMiddlewareFactory, CorePikkuMiddlewareGroup, MiddlewareMetadata, MiddlewarePriority, } from './middleware.types.js';
+export { pikkuAgentMiddleware, pikkuChannelMiddleware, pikkuChannelMiddlewareFactory, pikkuMiddleware, pikkuMiddlewareFactory, } from './middleware-factories.js';
+export type { PikkuAgentMiddlewareHooks } from '../wirings/agent/agent.types.js';

package/dist/middleware/index.js

@@ -6,3 +6,4 @@ export { cors } from './cors.js';
 export { telemetryOuter, telemetryInner } from './telemetry.js';
 export { addTagMiddleware, addTagMiddleware as addMiddleware, addGlobalMiddleware, runMiddleware, } from '../middleware-runner.js';
 export { addGlobalPermission } from '../permissions.js';
+export { pikkuAgentMiddleware, pikkuChannelMiddleware, pikkuChannelMiddlewareFactory, pikkuMiddleware, pikkuMiddlewareFactory, } from './middleware-factories.js';

package/dist/middleware/middleware-factories.d.ts

@@ -0,0 +1,9 @@
+import type { CoreSingletonServices, CoreUserSession } from '../types/core.types.js';
+import type { CorePikkuChannelMiddleware, CorePikkuChannelMiddlewareFactory } from '../wirings/channel/channel.types.js';
+import type { PikkuAgentMiddlewareHooks } from '../wirings/agent/agent.types.js';
+import type { CorePikkuMiddleware, CorePikkuMiddlewareConfig, CorePikkuMiddlewareFactory } from './middleware.types.js';
+export declare const pikkuMiddleware: <SingletonServices extends CoreSingletonServices = CoreSingletonServices, UserSession extends CoreUserSession = CoreUserSession>(middleware: CorePikkuMiddleware<SingletonServices, UserSession> | CorePikkuMiddlewareConfig<SingletonServices, UserSession>) => CorePikkuMiddleware<SingletonServices, UserSession>;
+export declare const pikkuMiddlewareFactory: <In = any>(factory: CorePikkuMiddlewareFactory<In>) => CorePikkuMiddlewareFactory<In>;
+export declare const pikkuChannelMiddleware: <SingletonServices extends CoreSingletonServices = CoreSingletonServices, Event = unknown>(middleware: CorePikkuChannelMiddleware<SingletonServices, Event>) => CorePikkuChannelMiddleware<SingletonServices, Event>;
+export declare const pikkuChannelMiddlewareFactory: <In = any>(factory: CorePikkuChannelMiddlewareFactory<In>) => CorePikkuChannelMiddlewareFactory<In>;
+export declare const pikkuAgentMiddleware: <State extends Record<string, unknown> = Record<string, unknown>, SingletonServices extends CoreSingletonServices = CoreSingletonServices>(hooks: PikkuAgentMiddlewareHooks<State, SingletonServices>) => PikkuAgentMiddlewareHooks<State, SingletonServices>;

package/dist/middleware/middleware-factories.js

@@ -0,0 +1,19 @@
+export const pikkuMiddleware = (middleware) => {
+    if (typeof middleware === 'function')
+        return middleware;
+    const func = middleware.func;
+    if (middleware.priority) {
+        func.__priority = middleware.priority;
+    }
+    return func;
+};
+export const pikkuMiddlewareFactory = (factory) => {
+    return factory;
+};
+export const pikkuChannelMiddleware = (middleware) => {
+    return middleware;
+};
+export const pikkuChannelMiddlewareFactory = (factory) => {
+    return factory;
+};
+export const pikkuAgentMiddleware = (hooks) => hooks;

package/dist/middleware/middleware.types.d.ts

@@ -0,0 +1,27 @@
+import type { CoreSingletonServices, CoreUserSession, PikkuWire } from '../types/core.types.js';
+export type CorePikkuMiddleware<SingletonServices extends CoreSingletonServices = CoreSingletonServices, UserSession extends CoreUserSession = CoreUserSession> = (services: SingletonServices, wires: PikkuWire, next: () => Promise<void>) => Promise<void>;
+/**
+ * Execution order: `highest` runs first (outermost in the onion), `lowest`
+ * runs last, closest to the function.
+ */
+export type MiddlewarePriority = 'highest' | 'high' | 'medium' | 'low' | 'lowest';
+export type CorePikkuMiddlewareConfig<SingletonServices extends CoreSingletonServices = CoreSingletonServices, UserSession extends CoreUserSession = CoreUserSession> = {
+    func: CorePikkuMiddleware<SingletonServices, UserSession>;
+    name?: string;
+    description?: string;
+    /** Execution priority. Lower runs first (outermost). Defaults to 'medium'. */
+    priority?: MiddlewarePriority;
+};
+export type CorePikkuMiddlewareFactory<In = any, SingletonServices extends CoreSingletonServices = CoreSingletonServices, UserSession extends CoreUserSession = CoreUserSession> = (input: In) => CorePikkuMiddleware<SingletonServices, UserSession>;
+export type CorePikkuMiddlewareGroup<SingletonServices extends CoreSingletonServices = CoreSingletonServices, UserSession extends CoreUserSession = CoreUserSession> = Array<CorePikkuMiddleware<SingletonServices, UserSession> | CorePikkuMiddlewareFactory<any, SingletonServices, UserSession>>;
+export type MiddlewareMetadata = {
+    type: 'http';
+    route: string;
+} | {
+    type: 'tag';
+    tag: string;
+} | {
+    type: 'wire';
+    name: string;
+    inline?: boolean;
+};

package/dist/middleware/middleware.types.js

@@ -0,0 +1 @@
+export {};

package/dist/middleware/remote-auth.d.ts

@@ -1,9 +1,9 @@
-export declare const pikkuRemoteAuthMiddleware: import("../types/core.types.js").CorePikkuMiddleware<import("../types/core.types.js").CoreSingletonServices<{
+export declare const pikkuRemoteAuthMiddleware: import("./middleware.types.js").CorePikkuMiddleware<import("../types/core.types.js").CoreSingletonServices<{
     logLevel?: import("../services/logger.js").LogLevel;
     secrets?: {
         requireAllowedHosts?: boolean;
     };
-    workflow?: import("../ecosystem/agent.js").WorkflowServiceConfig;
+    workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
     webhook?: import("../services/webhook-service.js").WebhookServiceConfig;
     postgres?: import("../types/core.types.js").PostgresConfig;
 }>, import("../types/core.types.js").CoreUserSession>;

package/dist/middleware/remote-auth.js

@@ -1,5 +1,5 @@
 import { UnauthorizedError } from '../errors/errors.js';
-import { pikkuMiddleware } from '../types/core.types.js';
+import { pikkuMiddleware } from './middleware-factories.js';
 import { assertStrongKeyMaterial, decryptWithKeyMaterial, REMOTE_SESSION_INFO, } from '../crypto-utils.js';
 const REMOTE_RPC_PREFIX = '/remote/rpc/';
 /**