@pikku/core 0.9.11 → 0.10.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
+# @pikku/core
+
 ## 0.9.0
 
+## 0.10.0
+
+This release includes significant improvements across the framework including tree-shaking support, middleware/permission factories, enhanced CLI functionality, improved TypeScript type safety, and comprehensive test strategies.
+
+For complete details, see https://pikku.dev/changelogs/0_10_0.md
+
+## 0.9.12-next.0
+
+### Patch Changes
+
+- feat: running @pikku/cli using pikku
+
 ## 0.9.11
 
 ### Patch Changes

package/dist/errors/errors.d.ts

@@ -2,6 +2,8 @@
  * The server cannot or will not process the request due to client error (e.g., malformed request syntax).
  */
 import { PikkuError } from './error-handler.js';
+export declare class InvalidMiddlewareInteractionError extends PikkuError {
+}
 /**
  * The server cannot or will not process the request due to client error (e.g., malformed request syntax).
  * @group Error

package/dist/errors/errors.js

@@ -2,6 +2,12 @@
  * The server cannot or will not process the request due to client error (e.g., malformed request syntax).
  */
 import { addError, PikkuError } from './error-handler.js';
+export class InvalidMiddlewareInteractionError extends PikkuError {
+}
+addError(InvalidMiddlewareInteractionError, {
+    status: 500,
+    message: 'The middleware interaction is invalid for the current wiring type.',
+});
 /**
  * The server cannot or will not process the request due to client error (e.g., malformed request syntax).
  * @group Error

package/dist/function/function-runner.d.ts

@@ -1,13 +1,19 @@
-import { CoreServices, CoreUserSession, CorePikkuMiddleware, PikkuWiringTypes } from '../types/core.types.js';
-import { CorePermissionGroup, CorePikkuFunction, CorePikkuFunctionConfig, CorePikkuFunctionSessionless } from './functions.types.js';
-export declare const addFunction: (funcName: string, funcConfig: CorePikkuFunctionConfig<any, any> | CorePikkuFunctionSessionless<any, any> | CorePikkuFunction<any, any>) => void;
+import { CoreServices, CoreUserSession, CorePikkuMiddleware, PikkuWiringTypes, CoreSingletonServices, PikkuInteraction, MiddlewareMetadata, PermissionMetadata } from '../types/core.types.js';
+import { CorePermissionGroup, CorePikkuFunctionConfig, CorePikkuPermission } from './functions.types.js';
+import { UserSessionService } from '../services/user-session-service.js';
+export declare const addFunction: (funcName: string, funcConfig: CorePikkuFunctionConfig<any, any>) => void;
 export declare const runPikkuFuncDirectly: <In, Out>(funcName: string, allServices: CoreServices, data: In, session?: CoreUserSession) => Promise<Out>;
-export declare const runPikkuFunc: <In = any, Out = any>(wireType: PikkuWiringTypes, wireId: string, funcName: string, { getAllServices, data, session, permissions: wiringPermissions, middleware: wiringMiddleware, coerceDataFromSchema, tags, }: {
-    getAllServices: () => Promise<CoreServices> | CoreServices;
-    data: In;
-    session?: CoreUserSession;
-    permissions?: CorePermissionGroup;
-    middleware?: CorePikkuMiddleware[];
+export declare const runPikkuFunc: <In = any, Out = any>(wireType: PikkuWiringTypes, wireId: string, funcName: string, { getAllServices, singletonServices, data, userSession, auth: wiringAuth, inheritedMiddleware, wireMiddleware, inheritedPermissions, wirePermissions, coerceDataFromSchema, tags, interaction, }: {
+    singletonServices: CoreSingletonServices;
+    getAllServices: (session?: CoreUserSession) => Promise<CoreServices> | CoreServices;
+    userSession?: UserSessionService<CoreUserSession>;
+    data: () => Promise<In> | In;
+    auth?: boolean;
+    inheritedMiddleware?: MiddlewareMetadata[];
+    wireMiddleware?: CorePikkuMiddleware[];
+    inheritedPermissions?: PermissionMetadata[];
+    wirePermissions?: CorePermissionGroup | CorePikkuPermission[];
     coerceDataFromSchema?: boolean;
     tags?: string[];
+    interaction: PikkuInteraction;
 }) => Promise<Out>;

package/dist/function/function-runner.js

@@ -1,12 +1,9 @@
-import { ForbiddenError } from '../errors/errors.js';
 import { runMiddleware, combineMiddleware } from '../middleware-runner.js';
 import { runPermissions } from '../permissions.js';
 import { pikkuState } from '../pikku-state.js';
 import { coerceTopLevelDataFromSchema, validateSchema } from '../schema.js';
+import { ForbiddenError } from '../errors/errors.js';
 export const addFunction = (funcName, funcConfig) => {
-    if (funcConfig instanceof Function) {
-        funcConfig = { func: funcConfig };
-    }
     pikkuState('function', 'functions').set(funcName, funcConfig);
 };
 export const runPikkuFuncDirectly = async (funcName, allServices, data, session) => {
@@ -16,7 +13,7 @@ export const runPikkuFuncDirectly = async (funcName, allServices, data, session)
     }
     return (await funcConfig.func(allServices, data, session));
 };
-export const runPikkuFunc = async (wireType, wireId, funcName, { getAllServices, data, session, permissions: wiringPermissions, middleware: wiringMiddleware, coerceDataFromSchema, tags = [], }) => {
+export const runPikkuFunc = async (wireType, wireId, funcName, { getAllServices, singletonServices, data, userSession, auth: wiringAuth, inheritedMiddleware, wireMiddleware, inheritedPermissions, wirePermissions, coerceDataFromSchema, tags = [], interaction, }) => {
     const funcConfig = pikkuState('function', 'functions').get(funcName);
     if (!funcConfig) {
         throw new Error(`Function not found: ${funcName}`);
@@ -25,42 +22,63 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { getAllServices,
     if (!funcMeta) {
         throw new Error(`Function meta not found: ${funcName}`);
     }
-    if (funcConfig.auth && !session) {
-        throw new ForbiddenError(`Function ${funcName} requires authentication even though transport does not`);
-    }
-    const allServices = await getAllServices();
-    const inputSchemaName = funcMeta.inputSchemaName;
-    if (inputSchemaName) {
-        // Validate request data against the defined schema, if any
-        await validateSchema(allServices.logger, allServices.schema, inputSchemaName, data);
-        // Coerce (top level) query string parameters or date objects if specified by the schema
-        if (coerceDataFromSchema) {
-            coerceTopLevelDataFromSchema(inputSchemaName, data);
+    // Convert tags to PermissionMetadata and merge with inheritedPermissions
+    const mergedInheritedPermissions = [
+        ...(inheritedPermissions || []),
+        ...(tags?.map((tag) => ({ type: 'tag', tag })) || []),
+    ];
+    // Helper function to run permissions and execute the function
+    const executeFunction = async () => {
+        const session = userSession?.get();
+        if (wiringAuth === true || funcConfig.auth === true) {
+            // This means it was explicitly enabled in either wiring or function and has to be respected
+            if (!session) {
+                throw new ForbiddenError('Authentication required');
+            }
         }
-    }
-    // Run permission checks in the specified order
-    await runPermissions(wireType, wireId, {
-        wiringTags: tags,
-        wiringPermissions,
-        funcTags: funcConfig.tags,
-        funcPermissions: funcConfig.permissions,
-        allServices,
-        data,
-        session,
-    });
-    // Combine all middleware: wiring tags → wiring middleware → func middleware → func tags
+        if (wiringAuth === undefined && funcConfig.auth === undefined) {
+            // We always default to requiring auth unless explicitly disabled
+            if (!session) {
+                throw new ForbiddenError('Authentication required');
+            }
+        }
+        // Evaluate the data from the lazy function
+        const actualData = await data();
+        // Validate and coerce data if schema is defined
+        const inputSchemaName = funcMeta.inputSchemaName;
+        if (inputSchemaName) {
+            // Validate request data against the defined schema, if any
+            await validateSchema(singletonServices.logger, singletonServices.schema, inputSchemaName, actualData);
+            // Coerce (top level) query string parameters or date objects if specified by the schema
+            if (coerceDataFromSchema) {
+                coerceTopLevelDataFromSchema(inputSchemaName, actualData);
+            }
+        }
+        const allServices = await getAllServices(session);
+        // Run permissions check with combined permissions: inheritedPermissions (including tags) → wirePermissions → funcPermissions
+        await runPermissions(wireType, wireId, {
+            wireInheritedPermissions: mergedInheritedPermissions,
+            wirePermissions: wirePermissions,
+            funcInheritedPermissions: funcMeta.permissions,
+            funcPermissions: funcConfig.permissions,
+            allServices,
+            data: actualData,
+            session,
+        });
+        return await funcConfig.func(allServices, actualData, session);
+    };
+    // Combine all middleware: inheritedMiddleware → wireMiddleware → funcMiddleware
     const allMiddleware = combineMiddleware(wireType, wireId, {
-        wiringTags: tags,
-        wiringMiddleware,
+        wireInheritedMiddleware: inheritedMiddleware,
+        wireMiddleware,
+        funcInheritedMiddleware: funcMeta.middleware,
         funcMiddleware: funcConfig.middleware,
-        funcTags: funcConfig.tags,
     });
     if (allMiddleware.length > 0) {
-        return (await runMiddleware(allServices, {
-            http: allServices.http,
-            mcp: allServices.mcp,
-            rpc: allServices.rpc,
-        }, allMiddleware, async () => await funcConfig.func(allServices, data, session)));
+        return (await runMiddleware({
+            ...singletonServices,
+            userSession,
+        }, interaction, allMiddleware, executeFunction));
     }
-    return (await funcConfig.func(allServices, data, session));
+    return (await executeFunction());
 };

package/dist/function/functions.types.d.ts

@@ -5,6 +5,7 @@ import type { CoreServices, CoreSingletonServices, CoreUserSession, PikkuDocs, C
  *
  * @template In - The input type.
  * @template Out - The output type.
+ * @template ChannelData - The channel data type.
  * @template Services - The services type, defaults to `CoreServices`.
  * @template Session - The session type, defaults to `CoreUserSession`.
  */
@@ -18,6 +19,7 @@ export type CorePikkuFunction<In, Out, ChannelData extends unknown | null = null
  *
  * @template In - The input type.
  * @template Out - The output type.
+ * @template ChannelData - The channel data type.
  * @template Services - The services type, defaults to `CoreServices`.
  * @template Session - The session type, defaults to `CoreUserSession`.
  */
@@ -34,10 +36,74 @@ export type CorePikkuFunctionSessionless<In, Out, ChannelData extends unknown |
  * @template Session - The session type, defaults to `CoreUserSession`.
  */
 export type CorePikkuPermission<In = any, Services extends CoreSingletonServices = CoreServices, Session extends CoreUserSession = CoreUserSession> = (services: Services, data: In, session?: Session) => Promise<boolean>;
+/**
+ * Configuration object for creating a permission with metadata
+ *
+ * @template In - The input type.
+ * @template Services - The services type, defaults to `CoreServices`.
+ * @template Session - The session type, defaults to `CoreUserSession`.
+ */
+export type CorePikkuPermissionConfig<In = any, Services extends CoreSingletonServices = CoreServices, Session extends CoreUserSession = CoreUserSession> = {
+    /** The permission function */
+    func: CorePikkuPermission<In, Services, Session>;
+    /** Optional human-readable name for the permission */
+    name?: string;
+    /** Optional description of what the permission checks */
+    description?: string;
+};
 /**
  * Factory function for creating permissions with tree-shaking support
+ * Supports both direct function and configuration object syntax
+ *
+ * @example
+ * ```typescript
+ * // Direct function syntax
+ * export const adminPermission = pikkuPermission(
+ *   async ({ logger }, data, session) => {
+ *     return session?.role === 'admin'
+ *   }
+ * )
+ *
+ * // Configuration object syntax with metadata
+ * export const adminPermission = pikkuPermission({
+ *   name: 'Admin Permission',
+ *   description: 'Checks if user has admin role',
+ *   func: async ({ logger }, data, session) => {
+ *     return session?.role === 'admin'
+ *   }
+ * })
+ * ```
+ */
+export declare const pikkuPermission: <In = any, Services extends CoreSingletonServices = CoreServices, Session extends CoreUserSession = CoreUserSession>(permission: CorePikkuPermission<In, Services, Session> | CorePikkuPermissionConfig<In, Services, Session>) => CorePikkuPermission<In, Services, Session>;
+/**
+ * A factory function that takes input and returns a permission
+ * Used when permissions need configuration/input parameters
+ *
+ * @template In - The input type for the factory.
+ * @template Services - The services type, defaults to `CoreServices`.
+ * @template Session - The session type, defaults to `CoreUserSession`.
+ */
+export type CorePikkuPermissionFactory<In = any, Services extends CoreSingletonServices = CoreServices, Session extends CoreUserSession = CoreUserSession> = (input: In) => CorePikkuPermission<any, Services, Session>;
+/**
+ * Factory function for creating permission factories
+ * Use this when your permission needs configuration/input parameters
+ *
+ * @example
+ * ```typescript
+ * export const requireRole = pikkuPermissionFactory<{ role: string }>(({
+ *   role
+ * }) => {
+ *   return pikkuPermission(async ({ logger }, data, session) => {
+ *     if (!session || session.role !== role) {
+ *       logger.warn(`Permission denied: required role '${role}'`)
+ *       return false
+ *     }
+ *     return true
+ *   })
+ * })
+ * ```
  */
-export declare const pikkuPermission: <In = any, Services extends CoreSingletonServices = CoreServices, Session extends CoreUserSession = CoreUserSession>(permission: CorePikkuPermission<In, Services, Session>) => CorePikkuPermission<In, Services, Session>;
+export declare const pikkuPermissionFactory: <In = any>(factory: CorePikkuPermissionFactory<In>) => CorePikkuPermissionFactory<In>;
 export type CorePermissionGroup<PikkuPermission = CorePikkuPermission<any>> = Record<string, PikkuPermission | PikkuPermission[]> | undefined;
 export type CorePikkuFunctionConfig<PikkuFunction extends CorePikkuFunction<any, any, any, any, any> | CorePikkuFunctionSessionless<any, any, any, any, any>, PikkuPermission extends CorePikkuPermission<any, any, any> = CorePikkuPermission<any>, PikkuMiddleware extends CorePikkuMiddleware<any> = CorePikkuMiddleware<any>> = {
     name?: string;

package/dist/function/functions.types.js

@@ -1,6 +1,48 @@
 /**
  * Factory function for creating permissions with tree-shaking support
+ * Supports both direct function and configuration object syntax
+ *
+ * @example
+ * ```typescript
+ * // Direct function syntax
+ * export const adminPermission = pikkuPermission(
+ *   async ({ logger }, data, session) => {
+ *     return session?.role === 'admin'
+ *   }
+ * )
+ *
+ * // Configuration object syntax with metadata
+ * export const adminPermission = pikkuPermission({
+ *   name: 'Admin Permission',
+ *   description: 'Checks if user has admin role',
+ *   func: async ({ logger }, data, session) => {
+ *     return session?.role === 'admin'
+ *   }
+ * })
+ * ```
  */
 export const pikkuPermission = (permission) => {
-    return permission;
+    return typeof permission === 'function' ? permission : permission.func;
+};
+/**
+ * Factory function for creating permission factories
+ * Use this when your permission needs configuration/input parameters
+ *
+ * @example
+ * ```typescript
+ * export const requireRole = pikkuPermissionFactory<{ role: string }>(({
+ *   role
+ * }) => {
+ *   return pikkuPermission(async ({ logger }, data, session) => {
+ *     if (!session || session.role !== role) {
+ *       logger.warn(`Permission denied: required role '${role}'`)
+ *       return false
+ *     }
+ *     return true
+ *   })
+ * })
+ * ```
+ */
+export const pikkuPermissionFactory = (factory) => {
+    return factory;
 };

package/dist/index.d.ts

@@ -16,15 +16,11 @@ export * from './wirings/scheduler/index.js';
 export * from './wirings/rpc/index.js';
 export * from './wirings/queue/index.js';
 export * from './wirings/mcp/index.js';
+export * from './wirings/cli/index.js';
 export * from './errors/index.js';
 export * from './middleware/index.js';
 export * from './utils.js';
 export * from './time-utils.js';
 export { pikkuState } from './pikku-state.js';
-export { addMiddleware, runMiddleware } from './middleware-runner.js';
+export { runMiddleware, addMiddleware, getMiddlewareByName, } from './middleware-runner.js';
 export { addPermission } from './permissions.js';
-export { wireHTTP, addHTTPMiddleware } from './wirings/http/http-runner.js';
-export { wireChannel } from './wirings/channel/channel-runner.js';
-export { wireScheduler } from './wirings/scheduler/scheduler-runner.js';
-export { wireQueueWorker } from './wirings/queue/queue-runner.js';
-export { wireMCPResource, wireMCPTool, wireMCPPrompt, runMCPResource, runMCPTool, runMCPPrompt, getMCPTools, getMCPResources, getMCPPrompts, getMCPResourcesMeta, getMCPToolsMeta, getMCPPromptsMeta, } from './wirings/mcp/mcp-runner.js';

package/dist/index.js

@@ -16,15 +16,11 @@ export * from './wirings/scheduler/index.js';
 export * from './wirings/rpc/index.js';
 export * from './wirings/queue/index.js';
 export * from './wirings/mcp/index.js';
+export * from './wirings/cli/index.js';
 export * from './errors/index.js';
 export * from './middleware/index.js';
 export * from './utils.js';
 export * from './time-utils.js';
 export { pikkuState } from './pikku-state.js';
-export { addMiddleware, runMiddleware } from './middleware-runner.js';
+export { runMiddleware, addMiddleware, getMiddlewareByName, } from './middleware-runner.js';
 export { addPermission } from './permissions.js';
-export { wireHTTP, addHTTPMiddleware } from './wirings/http/http-runner.js';
-export { wireChannel } from './wirings/channel/channel-runner.js';
-export { wireScheduler } from './wirings/scheduler/scheduler-runner.js';
-export { wireQueueWorker } from './wirings/queue/queue-runner.js';
-export { wireMCPResource, wireMCPTool, wireMCPPrompt, runMCPResource, runMCPTool, runMCPPrompt, getMCPTools, getMCPResources, getMCPPrompts, getMCPResourcesMeta, getMCPToolsMeta, getMCPPromptsMeta, } from './wirings/mcp/mcp-runner.js';

package/dist/middleware/auth-apikey.d.ts

@@ -1,15 +1,23 @@
-import { CoreConfig, CoreSingletonServices, CoreUserSession, CorePikkuMiddleware } from '../types/core.types.js';
 /**
- * API key middleware that retrieves a session from the 'x-api-key' header using a provided callback.
+ * API key middleware that retrieves a session from the 'x-api-key' header using JWT decoding.
  *
- * @param options.getSessionForAPIKey - A function that returns a session when provided an API key.
+ * Extracts API key from either the 'x-api-key' header or 'apiKey' query parameter
+ * and decodes it using the JWT service.
+ *
+ * @param options.source - Where to look for the API key: 'header', 'query', or 'all'
+ *
+ * @example
+ * ```typescript
+ * import { authAPIKey } from '@pikku/core/middleware'
+ *
+ * addHTTPMiddleware([
+ *   authAPIKey({ source: 'header' })
+ * ])
+ * ```
  */
-export declare const authAPIKey: <SingletonServices extends CoreSingletonServices<CoreConfig>, UserSession extends CoreUserSession>({ source, getSessionForAPIKey, jwt, }: {
+export declare const authAPIKey: import("../types/core.types.js").CorePikkuMiddlewareFactory<{
     source: "header" | "query" | "all";
-} & ({
-    getSessionForAPIKey?: undefined;
-    jwt?: true;
-} | {
-    getSessionForAPIKey: (services: SingletonServices, apiKey: string) => Promise<any>;
-    jwt?: false;
-})) => CorePikkuMiddleware;
+}, import("../types/core.types.js").CoreSingletonServices<{
+    logLevel?: import("../index.js").LogLevel;
+    secrets?: {};
+}>, import("../types/core.types.js").CoreUserSession>;

package/dist/middleware/auth-apikey.js

@@ -1,37 +1,37 @@
+import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js';
 /**
- * API key middleware that retrieves a session from the 'x-api-key' header using a provided callback.
+ * API key middleware that retrieves a session from the 'x-api-key' header using JWT decoding.
  *
- * @param options.getSessionForAPIKey - A function that returns a session when provided an API key.
+ * Extracts API key from either the 'x-api-key' header or 'apiKey' query parameter
+ * and decodes it using the JWT service.
+ *
+ * @param options.source - Where to look for the API key: 'header', 'query', or 'all'
+ *
+ * @example
+ * ```typescript
+ * import { authAPIKey } from '@pikku/core/middleware'
+ *
+ * addHTTPMiddleware([
+ *   authAPIKey({ source: 'header' })
+ * ])
+ * ```
  */
-export const authAPIKey = ({ source, getSessionForAPIKey, jwt, }) => {
-    const middleware = async (services, { http }, next) => {
-        const { userSession: userSessionService, jwt: jwtService } = services;
-        if (!http?.request || userSessionService.get()) {
-            return next();
-        }
-        let apiKey = null;
-        if (source === 'header' || source === 'all') {
-            apiKey = http.request.header('x-api-key');
-        }
-        if (!apiKey && (source === 'query' || source === 'all')) {
-            apiKey = http.request.query().apiKey;
-        }
-        if (apiKey) {
-            let userSession = null;
-            if (jwt) {
-                if (!jwtService) {
-                    throw new Error('JWT service is required for JWT decoding.');
-                }
-                userSession = await jwtService.decode(apiKey);
-            }
-            else {
-                userSession = await getSessionForAPIKey(services, apiKey);
-            }
-            if (userSession) {
-                userSessionService.setInitial(userSession);
-            }
-        }
+export const authAPIKey = pikkuMiddlewareFactory(({ source }) => pikkuMiddleware(async ({ userSession: userSessionService, jwt: jwtService }, { http }, next) => {
+    if (!http?.request || userSessionService.get()) {
         return next();
-    };
-    return middleware;
-};
+    }
+    let apiKey = null;
+    if (source === 'header' || source === 'all') {
+        apiKey = http.request.header('x-api-key');
+    }
+    if (!apiKey && (source === 'query' || source === 'all')) {
+        apiKey = http.request.query().apiKey;
+    }
+    if (apiKey && jwtService) {
+        const userSession = await jwtService.decode(apiKey);
+        if (userSession) {
+            userSessionService.setInitial(userSession);
+        }
+    }
+    return next();
+}));

package/dist/middleware/auth-bearer.d.ts

@@ -1,12 +1,39 @@
-import { CoreConfig, CoreSingletonServices, CoreUserSession, CorePikkuMiddleware } from '../types/core.types.js';
+import { CoreUserSession } from '../types/core.types.js';
 /**
- * Extracts the Bearer token from the Authorization header
+ * Bearer token middleware that extracts and validates tokens from the Authorization header.
+ *
+ * Supports two modes:
+ * - JWT decoding (default): Decodes bearer tokens using the JWT service
+ * - Static token: Provide a `token` object with a value and userSession for simple token validation
+ *
+ * @param options.token - Optional static token configuration { value: string, userSession: CoreUserSession }
+ *
+ * @example
+ * ```typescript
+ * import { authBearer } from '@pikku/core/middleware'
+ *
+ * // JWT mode (default)
+ * addHTTPMiddleware('*', [
+ *   authBearer()
+ * ])
+ *
+ * // Static token mode
+ * addHTTPMiddleware('*', [
+ *   authBearer({
+ *     token: {
+ *       value: process.env.API_TOKEN,
+ *       userSession: { userId: 'system', role: 'admin' }
+ *     }
+ *   })
+ * ])
+ * ```
  */
-export declare const authBearer: <SingletonServices extends CoreSingletonServices<CoreConfig>, UserSession extends CoreUserSession>({ token, jwt, getSession, }?: {
+export declare const authBearer: import("../types/core.types.js").CorePikkuMiddlewareFactory<{
     token?: {
         value: string;
-        userSession: UserSession;
+        userSession: CoreUserSession;
     };
-    jwt?: boolean;
-    getSession?: (services: SingletonServices, token: string) => Promise<UserSession> | UserSession;
-}) => CorePikkuMiddleware;
+}, import("../types/core.types.js").CoreSingletonServices<{
+    logLevel?: import("../index.js").LogLevel;
+    secrets?: {};
+}>, CoreUserSession>;

package/dist/middleware/auth-bearer.js

@@ -1,41 +1,58 @@
 import { InvalidSessionError } from '../errors/errors.js';
+import { pikkuMiddleware, pikkuMiddlewareFactory, } from '../types/core.types.js';
 /**
- * Extracts the Bearer token from the Authorization header
+ * Bearer token middleware that extracts and validates tokens from the Authorization header.
+ *
+ * Supports two modes:
+ * - JWT decoding (default): Decodes bearer tokens using the JWT service
+ * - Static token: Provide a `token` object with a value and userSession for simple token validation
+ *
+ * @param options.token - Optional static token configuration { value: string, userSession: CoreUserSession }
+ *
+ * @example
+ * ```typescript
+ * import { authBearer } from '@pikku/core/middleware'
+ *
+ * // JWT mode (default)
+ * addHTTPMiddleware('*', [
+ *   authBearer()
+ * ])
+ *
+ * // Static token mode
+ * addHTTPMiddleware('*', [
+ *   authBearer({
+ *     token: {
+ *       value: process.env.API_TOKEN,
+ *       userSession: { userId: 'system', role: 'admin' }
+ *     }
+ *   })
+ * ])
+ * ```
  */
-export const authBearer = ({ token, jwt, getSession, } = {}) => {
-    const middleware = async (services, { http }, next) => {
-        const { userSession: userSessionService, jwt: jwtService } = services;
-        // Skip if session already exists.
-        if (!http?.request || userSessionService.get()) {
-            return next();
+export const authBearer = pikkuMiddlewareFactory(({ token } = {}) => pikkuMiddleware(async ({ userSession: userSessionService, jwt: jwtService }, { http }, next) => {
+    // Skip if session already exists.
+    if (!http?.request || userSessionService.get()) {
+        return next();
+    }
+    const authHeader = http.request.header('authorization') ||
+        http.request.header('Authorization');
+    if (authHeader) {
+        const [scheme, bearerToken] = authHeader.split(' ');
+        if (scheme !== 'Bearer' || !bearerToken) {
+            throw new InvalidSessionError();
         }
-        const authHeader = http.request.header('authorization') ||
-            http.request.header('Authorization');
-        if (authHeader) {
-            const [scheme, bearerToken] = authHeader.split(' ');
-            if (scheme !== 'Bearer' || !token || !bearerToken) {
-                throw new InvalidSessionError();
-            }
-            let userSession = null;
-            if (jwt) {
-                if (!jwtService) {
-                    throw new Error('JWT service is required for JWT decoding.');
-                }
-                userSession = await jwtService.decode(bearerToken);
-            }
-            else if (token) {
-                if (bearerToken === token.value) {
-                    userSession = token.userSession;
-                }
-            }
-            else if (getSession) {
-                userSession = await getSession(services, token);
-            }
-            if (userSession) {
-                userSessionService.setInitial(userSession);
-            }
+        let userSession = null;
+        // If static token provided, validate against it
+        if (token && bearerToken === token.value) {
+            userSession = token.userSession;
         }
-        return next();
-    };
-    return middleware;
-};
+        // Otherwise, default to JWT decoding
+        else if (jwtService && !token) {
+            userSession = await jwtService.decode(bearerToken);
+        }
+        if (userSession) {
+            userSessionService.setInitial(userSession);
+        }
+    }
+    return next();
+}));