@pikku/core 0.9.12-next.0 → 0.10.1

package/dist/wirings/cli/cli.types.d.ts

@@ -1,4 +1,4 @@
-import { CorePikkuMiddleware, CoreSingletonServices, CoreUserSession, PikkuDocs, CoreServices, MiddlewareMetadata } from '../../types/core.types.js';
+import { CorePikkuMiddleware, CoreSingletonServices, CoreUserSession, PikkuDocs, CoreServices, MiddlewareMetadata, PermissionMetadata } from '../../types/core.types.js';
 import { CorePikkuFunctionConfig, CorePikkuPermission, CorePikkuFunction, CorePikkuFunctionSessionless } from '../../function/functions.types.js';
 import { PikkuChannel } from '../channel/channel.types.js';
 /**
@@ -60,6 +60,8 @@ export interface CLICommandMeta {
     tags?: string[];
     subcommands?: Record<string, CLICommandMeta>;
     middleware?: MiddlewareMetadata[];
+    permissions?: PermissionMetadata[];
+    isDefault?: boolean;
 }
 /**
  * CLI metadata collection (per program)
@@ -70,10 +72,26 @@ export type CLIProgramMeta = {
     options: Record<string, CLIOption>;
     defaultRenderName?: string;
 };
+/**
+ * Renderer metadata for CLI commands
+ */
+export interface RendererMeta {
+    name: string;
+    exportedName?: string;
+    services: {
+        optimized: boolean;
+        services: string[];
+    };
+    filePath: string;
+}
+export type RenderersMeta = Record<string, RendererMeta>;
 /**
  * All CLI programs metadata
  */
-export type CLIMeta = Record<string, CLIProgramMeta>;
+export interface CLIMeta {
+    programs: Record<string, CLIProgramMeta>;
+    renderers: RenderersMeta;
+}
 /**
  * CLI-specific renderer that outputs to console
  */
@@ -81,7 +99,7 @@ export type CorePikkuCLIRender<Data, Services extends CoreSingletonServices = Co
 /**
  * Extract input parameters from a Pikku function config type
  */
-export type ExtractFunctionInput<Func> = Func extends CorePikkuFunctionConfig<infer FuncType> ? FuncType extends CorePikkuFunction<infer Input, any, any, any, any> | CorePikkuFunctionSessionless<infer Input, any, any, any, any> ? Input : never : never;
+export type ExtractFunctionInput<Func> = Func extends CorePikkuFunctionConfig<infer FuncType, any, any> ? FuncType extends CorePikkuFunction<infer Input, any, any, any, any> | CorePikkuFunctionSessionless<infer Input, any, any, any, any> ? Input : never : never;
 /**
  * Strip < > [ ] characters from a string
  */
@@ -91,49 +109,57 @@ type StripBrackets<S extends string> = S extends `<${infer Inner}>` ? Inner : S
  */
 type SplitBySpace<S extends string> = S extends `${infer First} ${infer Rest}` ? [First, ...SplitBySpace<Rest>] : S extends '' ? [] : [S];
 /**
- * Extract parameter names from CLI parameter string
+ * Recursively build a tuple by stripping brackets from each element
+ */
+type BuildParamsTuple<Parts extends readonly string[]> = Parts extends readonly [
+    infer First extends string,
+    ...infer Rest extends string[]
+] ? [StripBrackets<First>, ...BuildParamsTuple<Rest>] : [];
+/**
+ * Extract parameter names from CLI parameter string into a tuple
  * Example: "<env> [region]" => ["env", "region"]
  */
-type ExtractParameterNames<S extends string> = {
-    [K in keyof SplitBySpace<S>]: SplitBySpace<S>[K] extends string ? StripBrackets<SplitBySpace<S>[K]> : never;
-};
+type ExtractParameterNames<S extends string> = BuildParamsTuple<SplitBySpace<S>>;
+/**
+ * Check if all elements of a tuple are valid keys of Input
+ */
+type AllParamsValid<Params extends readonly any[], Input> = Params extends readonly [infer First, ...infer Rest] ? First extends keyof Input ? AllParamsValid<Rest, Input> : false : true;
 /**
  * Validate that all parameter names are valid keys of the function input
  */
-export type ValidateParameters<Params extends string, Input> = ExtractParameterNames<Params> extends (infer P)[] ? P extends keyof Input ? Params : never : never;
+export type ValidateParameters<Params extends string, Input> = AllParamsValid<ExtractParameterNames<Params>, Input> extends true ? Params : never;
 /**
  * Extract output type from a Pikku function config type
  */
-export type ExtractFunctionOutput<Func> = Func extends CorePikkuFunctionConfig<infer FuncType> ? FuncType extends CorePikkuFunction<any, infer Output, any, any, any> | CorePikkuFunctionSessionless<any, infer Output, any, any, any> ? Output : never : never;
+export type ExtractFunctionOutput<Func> = Func extends CorePikkuFunctionConfig<infer FuncType, any, any> ? FuncType extends CorePikkuFunction<any, infer Output, any, any, any> | CorePikkuFunctionSessionless<any, infer Output, any, any, any> ? Output : never : never;
 /**
  * CLI command configuration that infers options from function input type.
  * This is a helper type for creating type-safe CLI commands.
  */
-export interface CoreCLICommandConfig<Func, PikkuMiddleware extends CorePikkuMiddleware<any> = CorePikkuMiddleware<any>, PikkuCLIRender extends CorePikkuCLIRender<any, any, any> = CorePikkuCLIRender<any, any>> {
-    parameters?: ValidateParameters<string, ExtractFunctionInput<Func>>;
-    func?: Func;
+export type CoreCLICommandConfig<FuncConfig, PikkuMiddleware extends CorePikkuMiddleware<any> = CorePikkuMiddleware<any>, PikkuCLIRender extends CorePikkuCLIRender<any, any, any> = CorePikkuCLIRender<any, any>, Params extends string = string> = {
+    parameters?: ValidateParameters<Params, ExtractFunctionInput<FuncConfig>>;
+    func?: FuncConfig;
     description?: string;
     render?: PikkuCLIRender;
-    options?: Partial<Record<keyof ExtractFunctionInput<Func>, {
-        description?: string;
-        short?: string;
-        default?: ExtractFunctionInput<Func>[keyof ExtractFunctionInput<Func>];
-    }>> & Record<string, {
-        description?: string;
-        short?: string;
-        default?: any;
-    }>;
+    options?: {
+        [K in keyof ExtractFunctionInput<FuncConfig>]?: {
+            description?: string;
+            short?: string;
+            default?: ExtractFunctionInput<FuncConfig>[K];
+        };
+    };
     middleware?: PikkuMiddleware[];
-    subcommands?: Record<string, CoreCLICommandConfig<any, PikkuMiddleware, PikkuCLIRender>>;
+    subcommands?: Record<string, CoreCLICommandConfig<any, PikkuMiddleware, PikkuCLIRender, any>>;
     auth?: boolean;
     permissions?: any[];
-}
+    isDefault?: boolean;
+};
 /**
  * CLI command definition
  */
-export interface CoreCLICommand<In, Out, PikkuFunction extends CorePikkuFunctionConfig<CorePikkuFunction<In, Out, any, any, any> | CorePikkuFunctionSessionless<In, Out, any, any, any>>, PikkuPermission extends CorePikkuPermission<any, any, any>, PikkuMiddleware extends CorePikkuMiddleware, Options = any, Subcommands extends Record<string, CoreCLICommandConfig<any, any, any>> = Record<string, CoreCLICommandConfig<any, any, any>>> {
+export interface CoreCLICommand<In, Out, PikkuFunctionConfig extends CorePikkuFunctionConfig<CorePikkuFunction<In, Out, any, any, any> | CorePikkuFunctionSessionless<In, Out, any, any, any>>, PikkuPermission extends CorePikkuPermission<any, any, any>, PikkuMiddleware extends CorePikkuMiddleware, Options = any, Subcommands extends Record<string, CoreCLICommandConfig<any, any, any>> = Record<string, CoreCLICommandConfig<any, any, any>>> {
     parameters?: string;
-    func: PikkuFunction;
+    func: PikkuFunctionConfig;
     render?: CorePikkuCLIRender<Out>;
     description?: string;
     options?: CLIOptions<Options>;
@@ -142,15 +168,16 @@ export interface CoreCLICommand<In, Out, PikkuFunction extends CorePikkuFunction
     auth?: boolean;
     docs?: PikkuDocs;
     subcommands?: Subcommands;
+    isDefault?: boolean;
 }
 /**
  * Shorthand command definition (just a function)
  */
-export type CLICommandShorthand<In, Out, PikkuFunction extends CorePikkuFunctionConfig<CorePikkuFunction<In, Out, any, any, any> | CorePikkuFunctionSessionless<In, Out, any, any, any>>> = PikkuFunction;
+export type CLICommandShorthand<In, Out, PikkuFunctionConfig extends CorePikkuFunctionConfig<CorePikkuFunction<In, Out, any, any, any> | CorePikkuFunctionSessionless<In, Out, any, any, any>>> = PikkuFunctionConfig;
 /**
  * Command definition (either full or shorthand)
  */
-export type CLICommandDefinition<In, Out, PikkuFunction extends CorePikkuFunctionConfig<CorePikkuFunction<In, Out, any, any, any> | CorePikkuFunctionSessionless<In, Out, any, any, any>>, PikkuPermission extends CorePikkuPermission<any, any, any>, PikkuMiddleware extends CorePikkuMiddleware, Options = any, Subcommands extends Record<string, CoreCLICommandConfig<any, any, any>> = Record<string, CoreCLICommandConfig<any, any, any>>> = CoreCLICommand<In, Out, PikkuFunction, PikkuPermission, PikkuMiddleware, Options, Subcommands> | CLICommandShorthand<In, Out, PikkuFunction>;
+export type CLICommandDefinition<In, Out, PikkuFunctionConfig extends CorePikkuFunctionConfig<CorePikkuFunction<In, Out, any, any, any> | CorePikkuFunctionSessionless<In, Out, any, any, any>>, PikkuPermission extends CorePikkuPermission<any, any, any>, PikkuMiddleware extends CorePikkuMiddleware, Options = any, Subcommands extends Record<string, CoreCLICommandConfig<any, any, any>> = Record<string, CoreCLICommandConfig<any, any, any>>> = CoreCLICommand<In, Out, PikkuFunctionConfig, PikkuPermission, PikkuMiddleware, Options, Subcommands> | CLICommandShorthand<In, Out, PikkuFunctionConfig>;
 /**
  * CLI wiring configuration
  */

package/dist/wirings/cli/command-parser.js

@@ -9,7 +9,7 @@ export function parseCLIArguments(args, programName, allMeta) {
         options: {},
         errors: [],
     };
-    const meta = allMeta[programName];
+    const meta = allMeta.programs[programName];
     if (!meta) {
         result.errors.push(`Program not found: ${programName}`);
         return result;
@@ -38,10 +38,39 @@ export function parseCLIArguments(args, programName, allMeta) {
             break;
         }
     }
+    // If no command was parsed, check for a default command
+    // Only use default if user didn't provide any non-flag arguments
+    const hasNonFlagArgs = args.some((arg, idx) => idx >= currentIndex && !arg.startsWith('-'));
+    if (result.commandPath.length === 0 && meta.commands && !hasNonFlagArgs) {
+        for (const [name, cmd] of Object.entries(meta.commands)) {
+            if (cmd.isDefault) {
+                result.commandPath.push(name);
+                currentMeta = {
+                    program: currentMeta.program,
+                    commands: cmd.subcommands || {},
+                    options: {
+                        ...currentMeta.options,
+                        ...cmd.options,
+                    },
+                    defaultRenderName: cmd.renderName || currentMeta.defaultRenderName,
+                };
+                break;
+            }
+        }
+    }
     // Get the final command metadata
     const commandMeta = getCommandMeta(meta, result.commandPath);
     if (!commandMeta) {
-        result.errors.push(`Unknown command: ${result.commandPath.join(' ')}`);
+        // If we have no command path but there are non-flag args, the first arg is likely an unknown command
+        if (result.commandPath.length === 0 &&
+            hasNonFlagArgs &&
+            args.length > 0 &&
+            !args[0].startsWith('-')) {
+            result.errors.push(`Unknown command: ${args[0]}`);
+        }
+        else {
+            result.errors.push(`Unknown command: ${result.commandPath.join(' ')}`);
+        }
         return result;
     }
     // Collect all available options (global + inherited)
@@ -279,7 +308,7 @@ function applyOptionDefaults(optionDefs, options, result) {
  */
 export function generateCommandHelp(programName, allMeta, commandPath = []) {
     const lines = [];
-    const meta = allMeta[programName];
+    const meta = allMeta.programs[programName];
     if (!meta) {
         return `Program not found: ${programName}`;
     }
@@ -290,7 +319,8 @@ export function generateCommandHelp(programName, allMeta, commandPath = []) {
         lines.push('Commands:');
         for (const [name, cmd] of Object.entries(meta.commands)) {
             const desc = cmd.description || '';
-            lines.push(`  ${name.padEnd(20)} ${desc}`);
+            const defaultMarker = cmd.isDefault ? ' (default)' : '';
+            lines.push(`  ${name.padEnd(20)} ${desc}${defaultMarker}`);
         }
         if (Object.keys(meta.options).length > 0) {
             lines.push('');

package/dist/wirings/cli/index.d.ts

@@ -1,5 +1,5 @@
 export * from './cli.types.js';
 export * from './cli-runner.js';
 export * from './command-parser.js';
-export { wireCLI, runCLICommand, pikkuCLIRender, executeCLI, } from './cli-runner.js';
+export { wireCLI, runCLICommand, pikkuCLIRender, executeCLI, CLIError, } from './cli-runner.js';
 export { parseCLIArguments, generateCommandHelp } from './command-parser.js';

package/dist/wirings/cli/index.js

@@ -1,5 +1,5 @@
 export * from './cli.types.js';
 export * from './cli-runner.js';
 export * from './command-parser.js';
-export { wireCLI, runCLICommand, pikkuCLIRender, executeCLI, } from './cli-runner.js';
+export { wireCLI, runCLICommand, pikkuCLIRender, executeCLI, CLIError, } from './cli-runner.js';
 export { parseCLIArguments, generateCommandHelp } from './command-parser.js';

package/dist/wirings/http/http-runner.d.ts

@@ -1,5 +1,5 @@
 import { CoreHTTPFunctionWiring, RunHTTPWiringOptions, RunHTTPWiringParams, PikkuHTTP, PikkuHTTPRequest, PikkuHTTPResponse } from './http.types.js';
-import { CorePikkuFunction, CorePikkuFunctionSessionless, CorePikkuPermission } from '../../function/functions.types.js';
+import { CorePikkuFunction, CorePikkuFunctionSessionless, CorePikkuPermission, CorePermissionGroup } from '../../function/functions.types.js';
 import { CorePikkuMiddleware, CorePikkuMiddlewareGroup } from '../../types/core.types.js';
 import { PikkuFetchHTTPResponse } from './pikku-fetch-http-response.js';
 /**
@@ -32,6 +32,36 @@ import { PikkuFetchHTTPResponse } from './pikku-fetch-http-response.js';
  * ```
  */
 export declare const addHTTPMiddleware: <PikkuMiddleware extends CorePikkuMiddleware>(pattern: string, middleware: CorePikkuMiddlewareGroup) => CorePikkuMiddlewareGroup;
+/**
+ * Registers HTTP permissions for a specific route pattern.
+ *
+ * This function registers permissions at runtime that will be applied to
+ * HTTP routes matching the specified pattern.
+ *
+ * For tree-shaking benefits, wrap in a factory function:
+ * `export const x = () => addHTTPPermission('pattern', [...])`
+ *
+ * @template PikkuPermission The permission type.
+ * @param {string} pattern - Route pattern (e.g., '*' for all routes, '/api/*' for specific routes).
+ * @param {CorePermissionGroup | CorePikkuPermission[]} permissions - Permissions for this route pattern.
+ *
+ * @returns {CorePermissionGroup | CorePikkuPermission[]} The permissions (for chaining/wrapping).
+ *
+ * @example
+ * ```typescript
+ * // Recommended: tree-shakeable
+ * export const httpGlobalPermissions = () => addHTTPPermission('*', [
+ *   authenticatedPermission,
+ *   rateLimitPermission
+ * ])
+ *
+ * // Also works: no tree-shaking
+ * export const apiPermissions = addHTTPPermission('/api/*', [
+ *   adminPermission
+ * ])
+ * ```
+ */
+export declare const addHTTPPermission: <PikkuPermission extends CorePikkuPermission>(pattern: string, permissions: CorePermissionGroup | CorePikkuPermission[]) => CorePermissionGroup | CorePikkuPermission[];
 /**
  * Adds a new route to the global HTTP route registry.
  *

package/dist/wirings/http/http-runner.js

@@ -43,6 +43,40 @@ export const addHTTPMiddleware = (pattern, middleware) => {
     httpGroups[pattern] = middleware;
     return middleware;
 };
+/**
+ * Registers HTTP permissions for a specific route pattern.
+ *
+ * This function registers permissions at runtime that will be applied to
+ * HTTP routes matching the specified pattern.
+ *
+ * For tree-shaking benefits, wrap in a factory function:
+ * `export const x = () => addHTTPPermission('pattern', [...])`
+ *
+ * @template PikkuPermission The permission type.
+ * @param {string} pattern - Route pattern (e.g., '*' for all routes, '/api/*' for specific routes).
+ * @param {CorePermissionGroup | CorePikkuPermission[]} permissions - Permissions for this route pattern.
+ *
+ * @returns {CorePermissionGroup | CorePikkuPermission[]} The permissions (for chaining/wrapping).
+ *
+ * @example
+ * ```typescript
+ * // Recommended: tree-shakeable
+ * export const httpGlobalPermissions = () => addHTTPPermission('*', [
+ *   authenticatedPermission,
+ *   rateLimitPermission
+ * ])
+ *
+ * // Also works: no tree-shaking
+ * export const apiPermissions = addHTTPPermission('/api/*', [
+ *   adminPermission
+ * ])
+ * ```
+ */
+export const addHTTPPermission = (pattern, permissions) => {
+    const httpGroups = pikkuState('permissions', 'httpGroup');
+    httpGroups[pattern] = permissions;
+    return permissions;
+};
 /**
  * Adds a new route to the global HTTP route registry.
  *
@@ -204,9 +238,10 @@ const executeRoute = async (services, matchedRoute, http, options) => {
         auth: route.auth !== false,
         userSession,
         data,
-        permissions: route.permissions,
         inheritedMiddleware: meta.middleware,
         wireMiddleware: route.middleware,
+        inheritedPermissions: meta.permissions,
+        wirePermissions: route.permissions,
         coerceDataFromSchema: options.coerceDataFromSchema,
         tags: route.tags,
         interaction,

package/dist/wirings/http/http.types.d.ts

@@ -1,6 +1,6 @@
 import type { SerializeOptions } from 'cookie';
 import type { PikkuError } from '../../errors/error-handler.js';
-import type { PikkuDocs, CoreServices, CoreSingletonServices, CoreUserSession, CreateSessionServices, CorePikkuMiddleware, MiddlewareMetadata } from '../../types/core.types.js';
+import type { PikkuDocs, CoreServices, CoreSingletonServices, CoreUserSession, CreateSessionServices, CorePikkuMiddleware, MiddlewareMetadata, PermissionMetadata } from '../../types/core.types.js';
 import type { CorePikkuFunction, CorePikkuFunctionSessionless, CorePikkuPermission, CorePermissionGroup, CorePikkuFunctionConfig } from '../../function/functions.types.js';
 type ExtractHTTPWiringParams<S extends string> = S extends `${string}:${infer Param}/${infer Rest}` ? Param | ExtractHTTPWiringParams<`/${Rest}`> : S extends `${string}:${infer Param}` ? Param : never;
 export type AssertHTTPWiringParams<In, HTTPWiring extends string> = ExtractHTTPWiringParams<HTTPWiring> extends keyof In ? unknown : [
@@ -146,6 +146,7 @@ export type HTTPWiringMeta = {
     tags?: string[];
     sse?: true;
     middleware?: MiddlewareMetadata[];
+    permissions?: PermissionMetadata[];
 };
 export type HTTPWiringsMeta = Record<HTTPMethod, Record<string, HTTPWiringMeta>>;
 export type HTTPFunctionsMeta = Array<{

package/dist/wirings/http/index.d.ts

@@ -1,5 +1,5 @@
 export * from './pikku-fetch-http-request.js';
 export * from './pikku-fetch-http-response.js';
 export * from './log-http-routes.js';
-export { fetch, fetchData, wireHTTP, addHTTPMiddleware } from './http-runner.js';
+export { fetch, fetchData, wireHTTP, addHTTPMiddleware, addHTTPPermission, } from './http-runner.js';
 export type * from './http.types.js';

package/dist/wirings/http/index.js

@@ -1,4 +1,4 @@
 export * from './pikku-fetch-http-request.js';
 export * from './pikku-fetch-http-response.js';
 export * from './log-http-routes.js';
-export { fetch, fetchData, wireHTTP, addHTTPMiddleware } from './http-runner.js';
+export { fetch, fetchData, wireHTTP, addHTTPMiddleware, addHTTPPermission, } from './http-runner.js';

package/dist/wirings/mcp/mcp-endpoint-registry.d.ts

@@ -1,4 +1,4 @@
-import { MCPResourceMeta, MCPToolMeta, MCPPromptMeta } from '@pikku/core';
+import { MCPResourceMeta, MCPToolMeta, MCPPromptMeta } from '@pikku/core/mcp';
 export interface MCPToolEndpoint {
     name: string;
     title: string;

package/dist/wirings/mcp/mcp-runner.js

@@ -140,6 +140,8 @@ async function runMCPPikkuFunc(request, type, name, mcp, pikkuFuncName, { single
             data: () => request.params,
             inheritedMiddleware: meta?.middleware,
             wireMiddleware: mcp.middleware,
+            inheritedPermissions: meta?.permissions,
+            wirePermissions: mcp.permissions,
             tags: mcp.tags,
             interaction,
         });

package/dist/wirings/mcp/mcp.types.d.ts

@@ -1,5 +1,20 @@
-import { CorePikkuFunctionConfig, CorePikkuFunctionSessionless } from '../../function/functions.types.js';
-import { CorePikkuMiddleware, MiddlewareMetadata } from '../../types/core.types.js';
+import { CorePermissionGroup, CorePikkuFunctionConfig, CorePikkuFunctionSessionless, CorePikkuPermission } from '../../function/functions.types.js';
+import { CorePikkuMiddleware, MiddlewareMetadata, PermissionMetadata } from '../../types/core.types.js';
+/**
+ * Extract URI parameters from MCP resource URI template.
+ * E.g., "user/{userId}/post/{postId}" => "userId" | "postId"
+ */
+type ExtractMCPURIParams<S extends string> = S extends `${string}{${infer Param}}/${infer Rest}` ? Param | ExtractMCPURIParams<Rest> : S extends `${string}{${infer Param}}` ? Param : never;
+/**
+ * Type-level assertion that MCP resource URI parameters are present in the input type.
+ * This ensures compile-time safety for URI parameter validation.
+ */
+export type AssertMCPResourceURIParams<In, URI extends string> = ExtractMCPURIParams<URI> extends keyof In ? unknown : [
+    'Error: MCP Resource URI parameters',
+    ExtractMCPURIParams<URI>,
+    'not in input type',
+    keyof In
+];
 export type PikkuMCP<Tools extends string = any> = {
     uri?: string;
     sendResourceUpdated: (uri: string) => void;
@@ -10,25 +25,27 @@ export type PikkuMCP<Tools extends string = any> = {
 /**
  * Represents metadata for MCP resources, including name, description, and documentation.
  */
-export type MCPResourceMeta = Record<string, Omit<CoreMCPResource, 'func' | 'middleware'> & {
+export type MCPResourceMeta = Record<string, Omit<CoreMCPResource, 'func' | 'middleware' | 'permissions'> & {
     pikkuFuncName: string;
     inputSchema: string | null;
     outputSchema: string | null;
     middleware?: MiddlewareMetadata[];
+    permissions?: PermissionMetadata[];
 }>;
 /**
  * Represents metadata for MCP tools, including name, description, and documentation.
  */
-export type MCPToolMeta = Record<string, Omit<CoreMCPTool, 'func' | 'middleware'> & {
+export type MCPToolMeta = Record<string, Omit<CoreMCPTool, 'func' | 'middleware' | 'permissions'> & {
     pikkuFuncName: string;
     inputSchema: string | null;
     outputSchema: string | null;
     middleware?: MiddlewareMetadata[];
+    permissions?: PermissionMetadata[];
 }>;
 /**
  * Represents metadata for MCP prompts, including name, description, and arguments.
  */
-export type MCPPromptMeta = Record<string, Omit<CoreMCPPrompt, 'func' | 'middleware'> & {
+export type MCPPromptMeta = Record<string, Omit<CoreMCPPrompt, 'func' | 'middleware' | 'permissions'> & {
     pikkuFuncName: string;
     inputSchema: string | null;
     outputSchema: string | null;
@@ -38,43 +55,46 @@ export type MCPPromptMeta = Record<string, Omit<CoreMCPPrompt, 'func' | 'middlew
         required: boolean;
     }>;
     middleware?: MiddlewareMetadata[];
+    permissions?: PermissionMetadata[];
 }>;
 /**
  * Represents an MCP resource with specific properties.
  */
-export type CoreMCPResource<PikkuFunction = CorePikkuFunctionConfig<CorePikkuFunctionSessionless<any, any>>, PikkuMiddleware = CorePikkuMiddleware<any>> = {
+export type CoreMCPResource<PikkuFunctionConfig = CorePikkuFunctionConfig<CorePikkuFunctionSessionless<any, any>>, PikkuPermission = CorePikkuPermission<any, any>, PikkuMiddleware = CorePikkuMiddleware<any>> = {
     uri: string;
     title: string;
-    description?: string;
+    description: string;
     mimeType?: string;
     size?: number;
     streaming?: boolean;
-    func: PikkuFunction;
+    func: PikkuFunctionConfig;
     tags?: string[];
     middleware?: PikkuMiddleware[];
+    permissions?: CorePermissionGroup<PikkuPermission>;
 };
 /**
  * Represents an MCP tool with specific properties.
  */
-export type CoreMCPTool<PikkuFunction = CorePikkuFunctionConfig<CorePikkuFunctionSessionless<any, any>>, PikkuMiddleware = CorePikkuMiddleware<any>> = {
+export type CoreMCPTool<PikkuFunctionConfig = CorePikkuFunctionConfig<CorePikkuFunctionSessionless<any, any>>, PikkuPermission = CorePikkuPermission<any, any>, PikkuMiddleware = CorePikkuMiddleware<any>> = {
     name: string;
     title?: string;
     description: string;
-    annotations?: Record<string, any>;
-    func: PikkuFunction;
+    func: PikkuFunctionConfig;
     tags?: string[];
     streaming?: boolean;
     middleware?: PikkuMiddleware[];
+    permissions?: CorePermissionGroup<PikkuPermission>;
 };
 /**
  * Represents an MCP prompt with specific properties.
  */
-export type CoreMCPPrompt<PikkuFunction = CorePikkuFunctionConfig<CorePikkuFunctionSessionless<any, MCPPromptResponse>>, PikkuMiddleware = CorePikkuMiddleware<any>> = {
+export type CoreMCPPrompt<PikkuFunctionConfig = CorePikkuFunctionConfig<CorePikkuFunctionSessionless<any, MCPPromptResponse>>, PikkuPermission = CorePikkuPermission<any, any>, PikkuMiddleware = CorePikkuMiddleware<any>> = {
     name: string;
-    description?: string;
-    func: PikkuFunction;
+    description: string;
+    func: PikkuFunctionConfig;
     tags?: string[];
     middleware?: PikkuMiddleware[];
+    permissions?: CorePermissionGroup<PikkuPermission>;
 };
 export type JsonRpcRequest = {
     jsonrpc: string;
@@ -122,3 +142,4 @@ export type MCPToolMessage = {
     data: string;
 };
 export type MCPToolResponse = MCPToolMessage[];
+export {};

package/dist/wirings/queue/queue-runner.js

@@ -114,6 +114,7 @@ export async function runQueueJob({ singletonServices, createSessionServices, jo
         const result = await runPikkuFunc(PikkuWiringTypes.queue, job.queueName, processorMeta.pikkuFuncName, {
             singletonServices,
             getAllServices,
+            auth: false,
             data: () => job.data,
             inheritedMiddleware: processorMeta.middleware,
             wireMiddleware: queueWorker.middleware,

package/dist/wirings/scheduler/scheduler-runner.js

@@ -74,6 +74,7 @@ export async function runScheduledTask({ name, session, singletonServices, creat
             singletonServices,
             getAllServices,
             userSession,
+            auth: false,
             data: () => undefined,
             inheritedMiddleware: meta.middleware,
             wireMiddleware: task.middleware,

package/dist/wirings/scheduler/scheduler.types.d.ts

@@ -15,10 +15,10 @@ export type ScheduledTasksMeta<UserSession extends CoreUserSession = any> = Reco
 /**
  * Represents a core scheduled task.
  */
-export type CoreScheduledTask<PikkuFunction = CorePikkuFunctionConfig<CorePikkuFunctionSessionless<void, void>>, PikkuMiddleware = CorePikkuMiddleware<any>> = {
+export type CoreScheduledTask<PikkuFunctionConfig = CorePikkuFunctionConfig<CorePikkuFunctionSessionless<void, void>>, PikkuMiddleware = CorePikkuMiddleware<any>> = {
     name: string;
     schedule: string;
-    func: PikkuFunction;
+    func: PikkuFunctionConfig;
     docs?: PikkuDocs;
     tags?: string[];
     middleware?: PikkuMiddleware[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/core",
-  "version": "0.9.12-next.0",
+  "version": "0.10.1",
   "author": "yasser.fadl@gmail.com",
   "license": "MIT",
   "module": "dist/index.js",
@@ -27,6 +27,7 @@
     "./scheduler": "./dist/wirings/scheduler/index.js",
     "./rpc": "./dist/wirings/rpc/index.js",
     "./mcp": "./dist/wirings/mcp/index.js",
+    "./cli": "./dist/wirings/cli/index.js",
     "./cli/channel": "./dist/wirings/cli/channel/index.js",
     "./errors": "./dist/errors/index.js",
     "./services": "./dist/services/index.js",
@@ -36,14 +37,14 @@
   },
   "dependencies": {
     "@types/cookie": "^1.0.0",
-    "@types/uuid": "^10.0.0",
+    "@types/uuid": "^11.0.0",
     "cookie": "^1.0.2",
-    "path-to-regexp": "^8.2.0",
+    "path-to-regexp": "^8.3.0",
     "picoquery": "^2.5.0"
   },
   "devDependencies": {
-    "@types/node": "^24.2.1",
-    "tsx": "^4.20.4",
+    "@types/node": "^24.9.1",
+    "tsx": "^4.20.6",
     "typescript": "^5.9"
   },
   "engines": {

package/src/errors/errors.ts

@@ -3,6 +3,12 @@
  */
 import { addError, PikkuError } from './error-handler.js'
 
+export class InvalidMiddlewareInteractionError extends PikkuError {}
+addError(InvalidMiddlewareInteractionError, {
+  status: 500,
+  message: 'The middleware interaction is invalid for the current wiring type.',
+})
+
 /**
  * The server cannot or will not process the request due to client error (e.g., malformed request syntax).
  * @group Error

package/src/factory-functions.test.ts

@@ -1,6 +1,11 @@
 import { test } from 'node:test'
 import assert from 'node:assert'
-import { pikkuPermission, pikkuMiddleware } from './index.js'
+import {
+  pikkuPermission,
+  pikkuMiddleware,
+  pikkuPermissionFactory,
+  pikkuMiddlewareFactory,
+} from './index.js'
 
 test('pikkuPermission factory function', async () => {
   const permission = pikkuPermission(async ({ logger }, data, session) => {
@@ -35,3 +40,57 @@ test('pikkuMiddleware returns the same function', async () => {
 
   assert.strictEqual(wrappedFn, originalFn)
 })
+
+test('pikkuPermissionFactory creates a factory function', async () => {
+  const factory = pikkuPermissionFactory<{ role: string }>(({ role }) => {
+    return pikkuPermission(async ({ logger }, data, session) => {
+      return session?.role === role
+    })
+  })
+
+  assert.strictEqual(typeof factory, 'function')
+  assert.strictEqual(factory.length, 1) // input parameter
+
+  // Call the factory to get a permission
+  const permission = factory({ role: 'admin' })
+  assert.strictEqual(typeof permission, 'function')
+  assert.strictEqual(permission.length, 3) // services, data, session
+})
+
+test('pikkuMiddlewareFactory creates a factory function', async () => {
+  const factory = pikkuMiddlewareFactory<{ message: string }>(({ message }) => {
+    return pikkuMiddleware(async ({ logger }, interactions, next) => {
+      logger.info(message)
+      await next()
+    })
+  })
+
+  assert.strictEqual(typeof factory, 'function')
+  assert.strictEqual(factory.length, 1) // input parameter
+
+  // Call the factory to get middleware
+  const middleware = factory({ message: 'test' })
+  assert.strictEqual(typeof middleware, 'function')
+  assert.strictEqual(middleware.length, 3) // services, interactions, next
+})
+
+test('pikkuPermissionFactory returns the same factory', async () => {
+  const originalFactory = ({ role }) =>
+    pikkuPermission(async ({ logger }, data, session) => {
+      return session?.role === role
+    })
+  const wrappedFactory = pikkuPermissionFactory(originalFactory)
+
+  assert.strictEqual(wrappedFactory, originalFactory)
+})
+
+test('pikkuMiddlewareFactory returns the same factory', async () => {
+  const originalFactory = ({ message }) =>
+    pikkuMiddleware(async ({ logger }, interactions, next) => {
+      logger.info(message)
+      await next()
+    })
+  const wrappedFactory = pikkuMiddlewareFactory(originalFactory)
+
+  assert.strictEqual(wrappedFactory, originalFactory)
+})