@pikku/core 0.9.11 → 0.10.0

package/dist/wirings/http/http-runner.js

@@ -1,8 +1,7 @@
 import { PikkuWiringTypes, } from '../../types/core.types.js';
-import { MissingSessionError, NotFoundError } from '../../errors/errors.js';
+import { NotFoundError } from '../../errors/errors.js';
 import { closeSessionServices, createWeakUID, isSerializable, } from '../../utils.js';
-import { PikkuUserSessionService, } from '../../services/user-session-service.js';
-import { combineMiddleware, runMiddleware } from '../../middleware-runner.js';
+import { PikkuUserSessionService } from '../../services/user-session-service.js';
 import { handleHTTPError } from '../../handle-error.js';
 import { pikkuState } from '../../pikku-state.js';
 import { PikkuFetchHTTPResponse } from './pikku-fetch-http-response.js';
@@ -11,33 +10,72 @@ import { addFunction, runPikkuFunc } from '../../function/function-runner.js';
 import { rpcService } from '../rpc/rpc-runner.js';
 import { httpRouter } from './routers/http-router.js';
 /**
- * Registers middleware either globally or for a specific route.
+ * Registers HTTP middleware for a specific route pattern.
  *
- * When a string route pattern is provided along with middleware, the middleware
- * is applied only to that route. Otherwise, if an array is provided, it is treated
- * as global middleware (applied to all routes).
+ * This function registers middleware at runtime that will be applied to
+ * HTTP routes matching the specified pattern.
+ *
+ * For tree-shaking benefits, wrap in a factory function:
+ * `export const x = () => addHTTPMiddleware('pattern', [...])`
  *
  * @template PikkuMiddleware The middleware type.
- * @param {PikkuMiddleware[] | string} routeOrMiddleware - Either a global middleware array or a route pattern string.
- * @param {PikkuMiddleware[]} [middleware] - The middleware array to apply when a route pattern is specified.
+ * @param {string} pattern - Route pattern (e.g., '*' for all routes, '/api/*' for specific routes).
+ * @param {CorePikkuMiddlewareGroup} middleware - Array of middleware for this route pattern.
+ *
+ * @returns {CorePikkuMiddlewareGroup} The middleware array (for chaining/wrapping).
+ *
+ * @example
+ * ```typescript
+ * // Recommended: tree-shakeable
+ * export const httpGlobal = () => addHTTPMiddleware('*', [
+ *   corsMiddleware,
+ *   loggingMiddleware
+ * ])
+ *
+ * // Also works: no tree-shaking
+ * export const apiMiddleware = addHTTPMiddleware('/api/*', [
+ *   authMiddleware
+ * ])
+ * ```
  */
-export const addHTTPMiddleware = (routeOrMiddleware, middleware) => {
-    const middlewareStore = pikkuState('http', 'middleware');
-    let route = '*';
-    if (typeof routeOrMiddleware === 'string') {
-        route = routeOrMiddleware;
-        middleware = middleware;
-    }
-    else {
-        middleware = routeOrMiddleware;
-    }
-    const currentMiddleware = middlewareStore.get(route);
-    if (currentMiddleware) {
-        middlewareStore.set(route, [...currentMiddleware, ...middleware]);
-    }
-    else {
-        middlewareStore.set(route, middleware);
-    }
+export const addHTTPMiddleware = (pattern, middleware) => {
+    const httpGroups = pikkuState('middleware', 'httpGroup');
+    httpGroups[pattern] = middleware;
+    return middleware;
+};
+/**
+ * Registers HTTP permissions for a specific route pattern.
+ *
+ * This function registers permissions at runtime that will be applied to
+ * HTTP routes matching the specified pattern.
+ *
+ * For tree-shaking benefits, wrap in a factory function:
+ * `export const x = () => addHTTPPermission('pattern', [...])`
+ *
+ * @template PikkuPermission The permission type.
+ * @param {string} pattern - Route pattern (e.g., '*' for all routes, '/api/*' for specific routes).
+ * @param {CorePermissionGroup | CorePikkuPermission[]} permissions - Permissions for this route pattern.
+ *
+ * @returns {CorePermissionGroup | CorePikkuPermission[]} The permissions (for chaining/wrapping).
+ *
+ * @example
+ * ```typescript
+ * // Recommended: tree-shakeable
+ * export const httpGlobalPermissions = () => addHTTPPermission('*', [
+ *   authenticatedPermission,
+ *   rateLimitPermission
+ * ])
+ *
+ * // Also works: no tree-shaking
+ * export const apiPermissions = addHTTPPermission('/api/*', [
+ *   adminPermission
+ * ])
+ * ```
+ */
+export const addHTTPPermission = (pattern, permissions) => {
+    const httpGroups = pikkuState('permissions', 'httpGroup');
+    httpGroups[pattern] = permissions;
+    return permissions;
 };
 /**
  * Adds a new route to the global HTTP route registry.
@@ -92,8 +130,6 @@ const getMatchingRoute = (requestType, requestPath) => {
             params: matchedPath.params,
             route,
             permissions: route.permissions,
-            httpMiddleware: matchedPath.middleware,
-            middleware: route.middleware,
             meta: meta,
         };
     }
@@ -122,16 +158,7 @@ export const createHTTPInteraction = (request, response) => {
     return http;
 };
 /**
- * Validates the input data and executes the route handler with associated middleware.
- *
- * NOTE: HTTP wiring handles middleware differently from other wirings (RPC, MCP, Queue, etc.)
- * because HTTP needs to:
- * 1. Check session early for performance (before expensive body parsing)
- * 2. Handle HTTP-specific concerns (headers, cookies, SSE setup)
- * 3. Process middleware that may set up authentication/session state
- *
- * Other wirings (RPC/MCP/Queue/Scheduler) simply pass middleware/permissions/auth
- * directly to runPikkuFunc without processing them.
+ * Validates the input data and executes the route handler
  *
  * This function performs these steps:
  *  1. Sets URL parameters on the request.
@@ -144,103 +171,91 @@ export const createHTTPInteraction = (request, response) => {
  *  8. Sends the appropriate response.
  *
  * @param {Object} services - A collection of shared services and utilities.
- * @param {Object} matchedRoute - Contains route details, URL parameters, middleware, and optional schema.
+ * @param {Object} matchedRoute - Contains route details, URL parameters, and optional schema.
  * @param {PikkuHTTP | undefined} http - The HTTP interaction object.
  * @param {Object} options - Options for route execution (e.g., whether to coerce query strings to arrays).
  * @returns {Promise<any>} An object containing the route handler result and session services (if any).
  * @throws Throws errors like MissingSessionError or ForbiddenError on validation failures.
  */
-const executeRouteWithMiddleware = async (services, matchedRoute, http, options) => {
-    const { matchedPath, params, route, httpMiddleware, middleware, meta } = matchedRoute;
-    const { singletonServices, userSession, createSessionServices, skipUserSession, requestId, } = services;
+const executeRoute = async (services, matchedRoute, http, options) => {
+    const userSession = new PikkuUserSessionService();
+    const { params, route, meta } = matchedRoute;
+    const { singletonServices, createSessionServices, skipUserSession, requestId, } = services;
     const requiresSession = route.auth !== false;
     let sessionServices;
     let result;
     // Attach URL parameters to the request object
     http?.request?.setParams(params);
     singletonServices.logger.info(`Matched route: ${route.route} | method: ${route.method.toUpperCase()} | auth: ${requiresSession.toString()}`);
-    // Main route execution logic wrapped for middleware handling
-    const runMain = async () => {
-        const session = userSession.get();
-        // Ensure session is available when required
-        if (skipUserSession && requiresSession) {
-            throw new Error("Can't skip trying to get user session if auth is required");
+    // Ensure session is available when required
+    if (skipUserSession && requiresSession) {
+        throw new Error("Can't skip trying to get user session if auth is required");
+    }
+    const data = () => http.request.data();
+    let channel;
+    if (matchedRoute.route.sse) {
+        const response = http?.response;
+        if (!response) {
+            throw new Error('SSE requires a valid HTTP response object');
         }
-        if (requiresSession && !session) {
-            singletonServices.logger.info({
-                action: 'Rejecting route (invalid session)',
-                path: matchedPath,
-            });
-            throw new MissingSessionError();
+        if (!response.setMode) {
+            throw new Error('Response object does not support SSE mode');
         }
-        const data = await http.request.data();
-        const getAllServices = async () => {
-            let channel;
-            if (matchedRoute.route.sse) {
-                const response = http?.response;
-                if (!response) {
-                    throw new Error('SSE requires a valid HTTP response object');
-                }
-                if (!response.setMode) {
-                    throw new Error('Response object does not support SSE mode');
-                }
-                response.setMode('stream');
-                response.header('Content-Type', 'text/event-stream');
-                response.header('Cache-Control', 'no-cache');
-                response.header('Connection', 'keep-alive');
-                response.header('Transfer-Encoding', 'chunked');
-                channel = {
-                    channelId: requestId,
-                    openingData: data,
-                    send: (data) => {
-                        response.arrayBuffer(isSerializable(data) ? JSON.stringify(data) : data);
-                    },
-                    close: () => {
-                        channel.state = 'closed';
-                        response.close?.();
-                    },
-                    state: 'open',
-                };
-            }
-            // Create session-specific services for handling the request
-            sessionServices = await createSessionServices({ ...singletonServices, userSession, channel }, { http }, session);
-            return rpcService.injectRPCService({
-                ...singletonServices,
-                ...sessionServices,
-                http,
-                userSession,
-                channel,
-            });
+        response.setMode('stream');
+        response.header('Content-Type', 'text/event-stream');
+        response.header('Cache-Control', 'no-cache');
+        response.header('Connection', 'keep-alive');
+        response.header('Transfer-Encoding', 'chunked');
+        channel = {
+            channelId: requestId,
+            openingData: await data(),
+            send: (data) => {
+                response.arrayBuffer(isSerializable(data) ? JSON.stringify(data) : data);
+            },
+            close: () => {
+                channel.state = 'closed';
+                response.close?.();
+            },
+            state: 'open',
         };
-        result = await runPikkuFunc(PikkuWiringTypes.http, `${meta.method}:${meta.route}`, meta.pikkuFuncName, {
-            getAllServices,
-            session,
-            data,
-            permissions: route.permissions,
-            coerceDataFromSchema: options.coerceDataFromSchema,
-            tags: route.tags,
-        });
-        // Respond with either a binary or JSON response based on configuration
-        if (route.returnsJSON === false) {
-            http?.response?.arrayBuffer(result);
-        }
-        else {
-            http?.response?.json(result);
-        }
-        http?.response?.status(200);
-        // TODO: Evaluate if the response stream should be explicitly ended.
-        // http?.response?.end()
+    }
+    const interaction = { http, channel };
+    const getAllServices = async (session) => {
+        let channel;
+        // Create session-specific services for handling the request
+        sessionServices = await createSessionServices({ ...singletonServices, userSession, channel }, { http }, session);
+        return rpcService.injectRPCService({
+            ...singletonServices,
+            ...sessionServices,
+            http,
+            userSession,
+            channel,
+        }, interaction, route.auth);
     };
-    // Get function config for middleware and tags
-    const funcConfig = pikkuState('function', 'functions').get(meta.pikkuFuncName);
-    // Execute middleware, then run the main logic
-    await runMiddleware({ ...singletonServices, userSession }, { http }, combineMiddleware(PikkuWiringTypes.http, `${meta.method}:${meta.route}`, {
-        httpMiddleware,
-        wiringMiddleware: middleware,
-        wiringTags: route.tags,
-        funcMiddleware: funcConfig?.middleware,
-        funcTags: funcConfig?.tags,
-    }), runMain);
+    result = await runPikkuFunc(PikkuWiringTypes.http, `${meta.method}:${meta.route}`, meta.pikkuFuncName, {
+        singletonServices,
+        getAllServices,
+        auth: route.auth !== false,
+        userSession,
+        data,
+        inheritedMiddleware: meta.middleware,
+        wireMiddleware: route.middleware,
+        inheritedPermissions: meta.permissions,
+        wirePermissions: route.permissions,
+        coerceDataFromSchema: options.coerceDataFromSchema,
+        tags: route.tags,
+        interaction,
+    });
+    // Respond with either a binary or JSON response based on configuration
+    if (route.returnsJSON === false) {
+        http?.response?.arrayBuffer(result);
+    }
+    else {
+        http?.response?.json(result);
+    }
+    http?.response?.status(200);
+    // TODO: Evaluate if the response stream should be explicitly ended.
+    // http?.response?.end()
     return sessionServices ? { result, sessionServices } : { result };
 };
 /**
@@ -298,11 +313,10 @@ export const pikkuFetch = async (request, params) => {
  * @param {RunHTTPWiringOptions & RunHTTPWiringParams} options - Options such as singleton services, session handling, and error configuration.
  * @returns {Promise<Out | void>} The output from the route handler or void if an error occurred.
  */
-export const fetchData = async (request, response, { singletonServices, createSessionServices, skipUserSession = false, respondWith404 = true, logWarningsForStatusCodes = [], coerceDataFromSchema = true, bubbleErrors = false, generateRequestId, ignoreMiddleware = false, }) => {
+export const fetchData = async (request, response, { singletonServices, createSessionServices, skipUserSession = false, respondWith404 = true, logWarningsForStatusCodes = [], coerceDataFromSchema = true, bubbleErrors = false, generateRequestId, }) => {
     const requestId = request.getHeader?.('x-request-id') ||
         generateRequestId?.() ||
         createWeakUID();
-    const userSession = new PikkuUserSessionService();
     let sessionServices;
     let result;
     // Combine the request and response into one interaction object
@@ -323,19 +337,12 @@ export const fetchData = async (request, response, { singletonServices, createSe
         }
         // Execute the matched route along with its middleware and session management
         ;
-        ({ result, sessionServices } = await executeRouteWithMiddleware({
+        ({ result, sessionServices } = await executeRoute({
             singletonServices,
-            userSession,
             createSessionServices,
             skipUserSession,
             requestId,
-        }, ignoreMiddleware
-            ? {
-                ...matchedRoute,
-                middleware: undefined,
-                httpMiddleware: undefined,
-            }
-            : matchedRoute, http, { coerceDataFromSchema }));
+        }, matchedRoute, http, { coerceDataFromSchema }));
         return result;
     }
     catch (e) {

package/dist/wirings/http/http.types.d.ts

@@ -1,7 +1,7 @@
 import type { SerializeOptions } from 'cookie';
 import type { PikkuError } from '../../errors/error-handler.js';
-import type { PikkuDocs, CoreServices, CoreSingletonServices, CoreUserSession, CreateSessionServices, CorePikkuMiddleware } from '../../types/core.types.js';
-import type { CorePikkuFunction, CorePikkuFunctionSessionless, CorePikkuPermission, CorePermissionGroup } from '../../function/functions.types.js';
+import type { PikkuDocs, CoreServices, CoreSingletonServices, CoreUserSession, CreateSessionServices, CorePikkuMiddleware, MiddlewareMetadata, PermissionMetadata } from '../../types/core.types.js';
+import type { CorePikkuFunction, CorePikkuFunctionSessionless, CorePikkuPermission, CorePermissionGroup, CorePikkuFunctionConfig } from '../../function/functions.types.js';
 type ExtractHTTPWiringParams<S extends string> = S extends `${string}:${infer Param}/${infer Rest}` ? Param | ExtractHTTPWiringParams<`/${Rest}`> : S extends `${string}:${infer Param}` ? Param : never;
 export type AssertHTTPWiringParams<In, HTTPWiring extends string> = ExtractHTTPWiringParams<HTTPWiring> extends keyof In ? unknown : [
     'Error: HTTPWiring parameters',
@@ -16,7 +16,6 @@ export type RunHTTPWiringOptions = Partial<{
     coerceDataFromSchema: boolean;
     bubbleErrors: boolean;
     generateRequestId: () => string;
-    ignoreMiddleware: boolean;
 }>;
 export type RunHTTPWiringParams = {
     singletonServices: CoreSingletonServices;
@@ -68,10 +67,10 @@ export type PikkuQuery<T = Record<string, string | undefined>> = Record<string,
  * @template PikkuFunctionSessionless - The sessionless API function type, defaults to `CorePikkuFunctionSessionless`.
  * @template PikkuPermission - The permission function type, defaults to `CorePikkuPermission`.
  */
-export type CoreHTTPFunctionWiring<In, Out, R extends string, PikkuFunction = CorePikkuFunction<In, Out>, PikkuFunctionSessionless = CorePikkuFunctionSessionless<In, Out>, PikkuPermission = CorePikkuPermission<In>, PikkuMiddleware = CorePikkuMiddleware> = (CoreHTTPFunction & {
+export type CoreHTTPFunctionWiring<In, Out, R extends string, PikkuFunction extends CorePikkuFunction<In, Out, any, any, any> = CorePikkuFunction<In, Out>, PikkuFunctionSessionless extends CorePikkuFunctionSessionless<In, Out, any, any, any> = CorePikkuFunctionSessionless<In, Out>, PikkuPermission extends CorePikkuPermission<In, any, any> = CorePikkuPermission<In, any, any>, PikkuMiddleware extends CorePikkuMiddleware<any, any> = CorePikkuMiddleware<any>> = (CoreHTTPFunction & {
     route: R;
     method: HTTPMethod;
-    func: PikkuFunction;
+    func: CorePikkuFunctionConfig<PikkuFunction, PikkuPermission, PikkuMiddleware>;
     permissions?: CorePermissionGroup<PikkuPermission>;
     auth?: true;
     tags?: string[];
@@ -80,7 +79,7 @@ export type CoreHTTPFunctionWiring<In, Out, R extends string, PikkuFunction = Co
 }) | (CoreHTTPFunction & {
     route: R;
     method: HTTPMethod;
-    func: PikkuFunctionSessionless;
+    func: CorePikkuFunctionConfig<PikkuFunctionSessionless, PikkuPermission, PikkuMiddleware>;
     permissions?: undefined;
     auth?: false;
     tags?: string[];
@@ -89,7 +88,7 @@ export type CoreHTTPFunctionWiring<In, Out, R extends string, PikkuFunction = Co
 }) | (CoreHTTPFunction & {
     route: R;
     method: 'get';
-    func: PikkuFunction;
+    func: CorePikkuFunctionConfig<PikkuFunction, PikkuPermission, PikkuMiddleware>;
     permissions?: CorePermissionGroup<PikkuPermission>;
     auth?: true;
     sse?: boolean;
@@ -98,7 +97,7 @@ export type CoreHTTPFunctionWiring<In, Out, R extends string, PikkuFunction = Co
 }) | (CoreHTTPFunction & {
     route: R;
     method: 'get';
-    func: PikkuFunctionSessionless;
+    func: CorePikkuFunctionConfig<PikkuFunctionSessionless, PikkuPermission, PikkuMiddleware>;
     permissions?: undefined;
     auth?: false;
     sse?: boolean;
@@ -107,7 +106,7 @@ export type CoreHTTPFunctionWiring<In, Out, R extends string, PikkuFunction = Co
 }) | (CoreHTTPFunction & {
     route: R;
     method: 'post';
-    func: PikkuFunction;
+    func: CorePikkuFunctionConfig<PikkuFunction, PikkuPermission, PikkuMiddleware>;
     permissions?: CorePermissionGroup<PikkuPermission>;
     auth?: true;
     query?: Array<keyof In>;
@@ -117,7 +116,7 @@ export type CoreHTTPFunctionWiring<In, Out, R extends string, PikkuFunction = Co
 }) | (CoreHTTPFunction & {
     route: R;
     method: 'post';
-    func: PikkuFunctionSessionless;
+    func: CorePikkuFunctionConfig<PikkuFunctionSessionless, PikkuPermission, PikkuMiddleware>;
     permissions?: undefined;
     auth?: false;
     query?: Array<keyof In>;
@@ -146,6 +145,8 @@ export type HTTPWiringMeta = {
     docs?: PikkuDocs;
     tags?: string[];
     sse?: true;
+    middleware?: MiddlewareMetadata[];
+    permissions?: PermissionMetadata[];
 };
 export type HTTPWiringsMeta = Record<HTTPMethod, Record<string, HTTPWiringMeta>>;
 export type HTTPFunctionsMeta = Array<{

package/dist/wirings/http/index.d.ts

@@ -1,5 +1,5 @@
 export * from './pikku-fetch-http-request.js';
 export * from './pikku-fetch-http-response.js';
 export * from './log-http-routes.js';
-export { fetch, fetchData, wireHTTP } from './http-runner.js';
+export { fetch, fetchData, wireHTTP, addHTTPMiddleware, addHTTPPermission, } from './http-runner.js';
 export type * from './http.types.js';

package/dist/wirings/http/index.js

@@ -1,4 +1,4 @@
 export * from './pikku-fetch-http-request.js';
 export * from './pikku-fetch-http-response.js';
 export * from './log-http-routes.js';
-export { fetch, fetchData, wireHTTP } from './http-runner.js';
+export { fetch, fetchData, wireHTTP, addHTTPMiddleware, addHTTPPermission, } from './http-runner.js';

package/dist/wirings/http/pikku-fetch-http-response.js

@@ -88,7 +88,9 @@ export class PikkuFetchHTTPResponse {
     }
     toResponse(args) {
         const cookieHeader = Array.from(this.#cookies.entries()).map(([name, { value, flags }]) => serializeCookie(name, value, flags));
-        this.#headers.set('Set-Cookie', cookieHeader.join(', '));
+        // Multiple Set-Cookie headers must be appended separately, not joined with commas
+        // per HTTP specification (RFC 6265)
+        cookieHeader.forEach((cookie) => this.#headers.append('Set-Cookie', cookie));
         return new Response(this.#body, {
             ...args,
             status: this.#statusCode,

package/dist/wirings/http/routers/http-router.d.ts

@@ -1,10 +1,8 @@
-import { CorePikkuMiddleware } from '../../../types/core.types.js';
 import { HTTPMethod } from '../http.types.js';
 import { PathToRegexRouter } from './path-to-regex.js';
 export type MatchResult = {
     route: string;
     params: Record<string, any>;
-    middleware?: CorePikkuMiddleware[];
 } | null;
 export interface Router {
     match(method: HTTPMethod, path: string): MatchResult;

package/dist/wirings/http/routers/path-to-regex.d.ts

@@ -3,8 +3,8 @@ import { HTTPMethod } from '../http.types.js';
 export declare class PathToRegexRouter implements Router {
     private compiledRoutes;
     private staticRoutes;
-    private precompiledMiddleware;
     private isInitialized;
+    reset(): void;
     initialize(): void;
     match(method: HTTPMethod, path: string): MatchResult;
 }

package/dist/wirings/http/routers/path-to-regex.js

@@ -3,16 +3,15 @@ import { pikkuState } from '../../../pikku-state.js';
 export class PathToRegexRouter {
     compiledRoutes = new Map();
     staticRoutes = new Map();
-    precompiledMiddleware = new Map();
     isInitialized = false;
+    reset() {
+        this.compiledRoutes = new Map();
+        this.staticRoutes = new Map();
+        this.isInitialized = false;
+    }
     initialize() {
         const routes = pikkuState('http', 'routes');
         const channelRoutes = pikkuState('channel', 'channels');
-        const middlewareMap = pikkuState('http', 'middleware');
-        // Precompile middleware lookups
-        for (const [middlewareRoute, middlewareArray] of middlewareMap.entries()) {
-            this.precompiledMiddleware.set(middlewareRoute, middlewareArray);
-        }
         // Helper function to compile routes for a given method
         const compileRoutesForMethod = (method, routeEntries) => {
             const methodCompiledRoutes = this.compiledRoutes.get(method) || new Map();
@@ -24,35 +23,10 @@ export class PathToRegexRouter {
                     : `/${routePath}`;
                 // Check if route is static (no parameters or wildcards)
                 const isStaticRoute = !/\*|:/.test(normalizedRoutePath);
-                // Precompute middleware for this route
-                const routeMiddleware = [];
-                // Add global middleware (*)
-                const globalMiddleware = this.precompiledMiddleware.get('*');
-                if (globalMiddleware) {
-                    routeMiddleware.push(...globalMiddleware);
-                }
-                // Add route-specific middleware
-                for (const [middlewareRoute, middlewareArray,] of this.precompiledMiddleware.entries()) {
-                    if (middlewareRoute !== '*') {
-                        // Use regex test for pattern matching
-                        try {
-                            if (new RegExp(middlewareRoute).test(normalizedRoutePath)) {
-                                routeMiddleware.push(...middlewareArray);
-                            }
-                        }
-                        catch {
-                            // If regex is invalid, do exact match
-                            if (middlewareRoute === normalizedRoutePath) {
-                                routeMiddleware.push(...middlewareArray);
-                            }
-                        }
-                    }
-                }
                 if (isStaticRoute) {
                     // Store static routes for O(1) lookup
                     methodStaticRoutes.set(normalizedRoutePath, {
                         route: routePath, // Keep the original route path for lookup in pikkuState
-                        middleware: routeMiddleware,
                     });
                 }
                 else {
@@ -63,7 +37,6 @@ export class PathToRegexRouter {
                     methodCompiledRoutes.set(normalizedRoutePath, {
                         matcher,
                         route: routePath, // Keep the original route path for lookup in pikkuState
-                        middleware: routeMiddleware,
                     });
                 }
             }
@@ -93,7 +66,6 @@ export class PathToRegexRouter {
                 return {
                     route: staticRoute.route,
                     params: {},
-                    middleware: staticRoute.middleware,
                 };
             }
         }
@@ -109,7 +81,6 @@ export class PathToRegexRouter {
                 return {
                     route: compiledRoute.route,
                     params: result.params,
-                    middleware: compiledRoute.middleware,
                 };
             }
         }

package/dist/wirings/mcp/mcp-endpoint-registry.d.ts

@@ -1,4 +1,4 @@
-import { MCPResourceMeta, MCPToolMeta, MCPPromptMeta } from '@pikku/core';
+import { MCPResourceMeta, MCPToolMeta, MCPPromptMeta } from '@pikku/core/mcp';
 export interface MCPToolEndpoint {
     name: string;
     title: string;

package/dist/wirings/mcp/mcp-runner.d.ts

@@ -1,12 +1,11 @@
 import { type CoreServices, type CoreSingletonServices, type CoreUserSession, type CreateSessionServices } from '../../types/core.types.js';
 import type { CoreMCPResource, CoreMCPTool, CoreMCPPrompt, JsonRpcRequest, JsonRpcResponse, JsonRpcErrorResponse, PikkuMCP } from './mcp.types.js';
-import type { CorePikkuFunctionSessionless } from '../../function/functions.types.js';
+import type { CorePikkuFunctionConfig, CorePikkuFunctionSessionless } from '../../function/functions.types.js';
 export declare class MCPError extends Error {
     readonly error: JsonRpcErrorResponse;
     constructor(error: JsonRpcErrorResponse);
 }
 export type RunMCPEndpointParams<Tools extends string = any> = {
-    session?: CoreUserSession;
     singletonServices: CoreSingletonServices;
     mcp?: PikkuMCP<Tools>;
     createSessionServices?: CreateSessionServices<CoreSingletonServices, CoreServices<CoreSingletonServices>, CoreUserSession>;
@@ -16,9 +15,9 @@ export type JsonRpcError = {
     message: string;
     data?: any;
 };
-export declare const wireMCPResource: <PikkuFunction extends CorePikkuFunctionSessionless<any, any>>(mcpResource: CoreMCPResource<PikkuFunction>) => void;
-export declare const wireMCPTool: <PikkuFunction extends CorePikkuFunctionSessionless<any, any>>(mcpTool: CoreMCPTool<PikkuFunction>) => void;
-export declare const wireMCPPrompt: <PikkuFunction extends CorePikkuFunctionSessionless<any, any>>(mcpPrompt: CoreMCPPrompt<PikkuFunction>) => void;
+export declare const wireMCPResource: <PikkuFunctionConfig extends CorePikkuFunctionConfig<CorePikkuFunctionSessionless<any, any>> = CorePikkuFunctionConfig<CorePikkuFunctionSessionless<any, any>>>(mcpResource: CoreMCPResource<PikkuFunctionConfig>) => void;
+export declare const wireMCPTool: <PikkuFunctionConfig extends CorePikkuFunctionConfig<CorePikkuFunctionSessionless<any, any>> = CorePikkuFunctionConfig<CorePikkuFunctionSessionless<any, any>>>(mcpTool: CoreMCPTool<PikkuFunctionConfig>) => void;
+export declare const wireMCPPrompt: <PikkuFunctionConfig extends CorePikkuFunctionConfig<CorePikkuFunctionSessionless<any, any>> = CorePikkuFunctionConfig<CorePikkuFunctionSessionless<any, any>>>(mcpPrompt: CoreMCPPrompt<PikkuFunctionConfig>) => void;
 export declare function runMCPResource(request: JsonRpcRequest, params: RunMCPEndpointParams, uri: string): Promise<JsonRpcResponse>;
 export declare function runMCPTool(request: JsonRpcRequest, params: RunMCPEndpointParams, name: string): Promise<JsonRpcResponse>;
 export declare function runMCPPrompt(request: JsonRpcRequest, params: RunMCPEndpointParams, name: string): Promise<JsonRpcResponse>;