@pikku/lambda 0.12.5 → 0.12.7

package/CHANGELOG.md

@@ -1,3 +1,299 @@
+## 0.12.7
+
+### Patch Changes
+
+- fd9d834: Stop publishing internals that only their own package or file used. The declarations stay; only the entrypoint re-export is removed, so nothing that imported a name from where it is declared is affected.
+- Updated dependencies [063f43a]
+- Updated dependencies [ce66bf8]
+- Updated dependencies [d0307a8]
+- Updated dependencies [ce66bf8]
+- Updated dependencies [3ad2131]
+- Updated dependencies [b930dca]
+- Updated dependencies [b95e77d]
+- Updated dependencies [fd9d834]
+- Updated dependencies [8978fbd]
+  - @pikku/core@0.12.82
+
+## 0.12.6
+
+### Patch Changes
+
+- afef587: Close eleven security weaknesses found in a review of `@pikku/core`. Most are
+  breaking, and two invalidate data or credentials already in the wild — read the
+  migration notes before upgrading.
+
+  **Breaking: AI agent thread ownership now fails closed.** Reading, listing,
+  resuming or approving an existing thread or run requires a resolved session
+  principal (`userId`, or `orgId` for `sessionScope: 'org'`), regardless of the
+  agent's `auth` setting. Previously a request without a session had no ownership
+  model at all: the caller-supplied `resourceId` was accepted as the ownership
+  key, so any caller could read or resume another party's thread by naming its
+  `resourceId`. Worse, `threadOwnerConstraint` returned `undefined` for a
+  sessionless caller, and `undefined` means _no filter_ rather than _no rows_ —
+  so `getAgentThreads` returned every thread in the deployment. It now returns
+  `string[]`, empty for a sessionless caller, which every storage backend already
+  treats as matching nothing. Sessionless agents still run one-shot conversations,
+  each with a fresh unguessable owner; what they lose is cross-request continuity.
+  Wire a session to restore it.
+
+  **Breaking: stored secrets and credentials must be re-entered.** `deriveKey` ran
+  a single unsalted round of SHA-256 over the passphrase and used the digest
+  directly as the AES-GCM key — roughly one hash per brute-force guess, with one
+  rainbow table working against every deployment. It is now PBKDF2-HMAC-SHA256 at
+  600,000 iterations over a random salt. There is no compatibility path: every
+  value held by the kysely, mongodb and redis secret services and the kysely
+  credential service becomes undecryptable. They fail loud, naming the key and
+  `key_version`, so the app hard-fails on first secret read until each is re-set.
+
+  The KEK salt is scoped to the key version and stored alongside it, rather than
+  per secret, so a bulk read costs one derivation instead of N — `getSecrets` over
+  50 secrets went from ~2.3s to ~48ms, and rotation from ~4.6s to ~94ms. This adds
+  a salt table (kysely), hash field (redis) or collection (mongodb), created
+  automatically on first use.
+
+  **Breaking: `PIKKU_REMOTE_SECRET` must be at least 32 characters.** The
+  remote-RPC session envelope moved from PBKDF2 to HKDF, which expands
+  high-entropy key material rather than stretching a low-entropy passphrase. That
+  took a remote hop from ~269ms to ~0.4ms — PBKDF2 was running twice per request —
+  but HKDF supplies no brute-force resistance, so the secret must carry the
+  entropy itself. A shorter secret now throws `WeakKeyMaterialError` at both ends.
+  Generate one with `openssl rand -base64 32` and roll it out to every service in
+  the mesh together: existing bearer tokens are format-incompatible, so a partial
+  rollout produces 401s until every instance is updated. The Cloudflare, Lambda
+  and Azure deployment services each hand-rolled a copy of `buildRemoteHeaders`
+  and now call the shared one, which is what keeps the two sides in step.
+
+  **Breaking: previously signed content URLs stop verifying.** `LocalContent`
+  signed only `{signedAt, expiresAt, notBefore}`, so a signature proved when a URL
+  was issued but never what it was issued for — any valid token was a skeleton
+  key, and swapping the pathname from a public thumbnail to a private document
+  still verified. The signature now binds the request path. Separately, the
+  verifier returned "valid" when no JWT service was wired, which is how
+  `pikku serve` ran: a forged `?signedAt=0&expiresAt=99999999999999` was accepted.
+  It now rejects with 403, `LocalContent` requires a `JWTService`, and
+  `pikku serve`/`pikku dev` mint an ephemeral per-process signing key so local
+  development works without shipping a fail-open path. In-flight signed URLs must
+  be re-issued.
+
+  **Request body size limits now apply to every adapter.** The `maxBodySize` cap
+  existed only in `PikkuFetchHTTPRequest`. The real hole was uWebSockets, which
+  drove `res.onData` itself and concatenated every chunk with no bound and nothing
+  downstream able to intervene; it now drops chunks past the limit and replies 413
+  before routing. Fastify delegates to its native `bodyLimit` (set only when
+  `maxBodySize` is configured, so fastify's stricter 1 MB default is never
+  loosened), and `PikkuExpressServer` feeds the limit into its body parsers. Two
+  paths can only reject rather than prevent, and are documented as such:
+  `express-middleware` mounted on your own app receives an already-parsed body, so
+  that deployment must bound its own parser; Next server actions bottom out at
+  `experimental.serverActions.bodySizeLimit`.
+
+  **Breaking: the console addon's privileged functions are gated by default.**
+  `wireAddon` gains a `scopes` option that applies to every function in the
+  addon's namespace, and the console scaffold now generates
+  `wireAddon({ name: 'console', package: '@pikku/addon-console', scopes: ['admin'] })`.
+  Previously the console's entire privileged surface — around 54 functions
+  including `credentialGet`, which returns a resolved OAuth token for an arbitrary
+  `userId`, `updateFunctionBody`, and `installAddon`, which shells out to a
+  package install — was protected only by an optional host-registered
+  `addGlobalPermission`. `resolveGlobalPermissions` returns `[]` when none is
+  registered and permission checking then no-ops, so an app that never registered
+  one served those functions to anyone, and with the template's default
+  `scaffold.rpc: "no-auth"` that meant unauthenticated. All of them now return 403
+  `MissingScopeError` without an `admin`, `admin:*` or `*` scope. **Regenerating
+  is required** — an app holding an old `console.gen.ts` stays open.
+  `installAddon` and `installOpenapiAddon` additionally declare their own
+  `auth: true, scopes: ['admin']`, and `getAgentThreads` now scopes its listing to
+  the session's own threads unless the caller holds admin.
+
+  Addon scopes are enforced in `runPikkuFunc` rather than at the RPC boundary,
+  because a wiring can reference an addon function directly — the inspector
+  records the addon's `packageName` on HTTP, channel, schedule, queue, CLI,
+  trigger, gateway and MCP wirings — and those paths never call `resolveNamespace`.
+  Enforcing at the RPC seam would have covered only the `namespace:function` form
+  while reading as complete.
+
+  **Breaking: `wireAddon`'s `auth` and `tags` now apply on direct wirings too.**
+  Both were read only by `resolveAddonFunction`, so they had exactly the hole
+  scopes had: `wireAddon({ name: 'console', package: '@pikku/addon-console', auth:
+true, tags: ['admin'] })` gated `rpc('console:credentialGet')` and gated nothing
+  at all on an HTTP route wired straight to `credentialGet`. A consumer who
+  reached for the documented way to lock an addon down got a control that was
+  silently inert on every wiring except one. Both now resolve in `runPikkuFunc`.
+  `auth` merges as an OR — `auth: false` from an addon is ignored on a direct
+  wiring, because an addon may require a session the wiring did not but must never
+  waive one it did. Addon tags resolve to concrete middleware against the **root**
+  tag groups before the call rather than being folded into the function's
+  inherited middleware: `addTagMiddleware('admin', …)` is written by the consuming
+  app and registers under the root package, whereas `combineMiddleware` would look
+  the tag up under the addon's own `packageName`, where it does not exist.
+
+  One consequence worth naming: an addon that wires `auth: true` and also runs its
+  own sessionless internal work — a scheduled task or queue worker inside the
+  addon calling a sibling function — is now gated where it previously was not,
+  because a bare `rpc('fn')` from inside the addon reaches `runPikkuFunc` with the
+  addon's `packageName` like any other call. This reverses a decision that
+  deliberately scoped the gate to the namespaced boundary; that reasoning held
+  only while the boundary was real, and a direct wiring can enter an addon without
+  crossing it, so "already inside" is not something the runtime can infer. Such an
+  addon should carry authorization on the function via
+  `pikkuFunc({ permissions })`, which has always been enforced on every path. A
+  follow-up will add execution provenance so an intra-addon call can be
+  distinguished from an external one and skip the addon-level check; that needs a
+  marker no caller outside the process can set, which is its own design problem
+  and does not belong in a security fix.
+
+  **Codegen now warns when an exposed function has no gate (PKU574).** The
+  generated `POST /rpc/:rpcName` dispatcher forwards to `rpc.exposed`, which
+  refuses anything without `expose: true` — but nothing checked whether the
+  target was gated, because a dispatcher cannot know what it dispatches to. The
+  console shipped ~54 privileged functions through that gap and the toolchain was
+  silent. The inspector now reports every function that is exposed, sessionless,
+  and carries no `auth`, `scopes` or `permissions` of its own and none from a
+  governing `wireAddon`. It is a `warn`, not a critical: `expose: true` on an
+  ungated sessionless function is correct for a genuinely public endpoint, so it
+  blocks a build only under `--fail-on-warn`.
+
+  Two pieces of metadata were missing for this to be answerable statically, and
+  both are now recorded. A `pikkuSessionlessFunc`'s own `auth: true` was read at
+  runtime but never written to function meta, so a self-gated function was
+  indistinguishable from an ungated one — `sessionless` carries the baseline, and
+  `auth` now carries the tightening. And `wireAddon`'s `scopes`, `auth` and `tags`
+  were not parsed at all: the inspector recorded the addon's `rpcEndpoint` and its
+  secret, variable and credential overrides, and dropped every one of its gates.
+  An addon whose gates are not statically knowable is treated as gated, because a
+  false positive on a correctly-secured addon costs more than the one case it
+  would catch.
+
+  **Breaking: an application's global permissions now apply inside addons.**
+  `resolveGlobalPermissions` read only the bucket matching the function's own
+  package, but the generated `addGlobalPermission` wrapper takes no package
+  argument and always registers under the root. An app-wide rule like "every
+  request needs a signed-in user" therefore stopped at the addon boundary, and the
+  bucket an addon's functions did read was one no host could write to — which is
+  why the console addon's recommended `addGlobalPermission([isAdmin],
+'@pikku/addon-console')` was never a gate anybody could actually install. A
+  function now resolves the root bucket and its own package's, root first.
+  Unioning is safe in a way nothing else here would be: globals AND, so adding the
+  root ones can only tighten. Package buckets stay one-way — a package's globals
+  never reach root functions, or an installed addon could gate the whole
+  application. Apps with both a root global and addon-provided functions will see
+  those functions gated where they previously were not.
+
+  **Codegen now records whether each HTTP route requires a session, and warns
+  about inert addon tags (PKU575).** Four separate things can demand a session —
+  the function's `sessionless`, its own `auth`, the route's (or its group's)
+  `auth`, and the addon it belongs to — and answering "which routes are open?"
+  meant joining all four by hand and knowing which wins. Each route's meta now
+  carries the resolved `requiresSession` alongside the route's own `auth`. Scopes
+  count as requiring one, since they are matched against the session's and fail
+  closed. Anything not statically knowable resolves to `true`, matching PKU574:
+  a route that looks stricter than it is costs less than one that looks open and
+  isn't. Separately, `wireAddon({ tags: ['admin'] })` reads like a gate and is
+  applied like one right up until no `addTagMiddleware('admin', …)` exists, at
+  which point it resolves to an empty list and gates nothing; that now warns.
+  Only addon tags are reported — a tag on a function is as likely to be
+  organizational, and warning about those would bury the case that matters.
+
+  **Object-shorthand permissions were missing from meta.** The inspector visited
+  `ts.PropertyAssignment` but not `ts.ShorthandPropertyAssignment`, so
+  `permissions: { canAdminOrg }` — enforced identically to the longhand form at
+  runtime, since `verifyPermissions` has a non-array branch — was recorded as _no
+  permissions at all_. That is the most dangerous direction for meta to be wrong
+  in: an audit reading it sees an open door where one is shut. It cost this review
+  a false IDOR report across ~35 billing and org functions before the source
+  contradicted the metadata.
+
+  **Functions that authorize in their own body can say so.** A webhook receiver
+  verifying a signature, or a handler redeeming a signed invite, is genuinely
+  closed while carrying no session, scope or permission — indistinguishable in
+  meta from one nobody remembered to gate, and so warned about forever by PKU574.
+  `selfAuthenticated: true` on the function config records the claim and silences
+  the warning for that function. It is declarative only: nothing at runtime reads
+  it and it grants nothing. Detection was rejected deliberately — inferring it
+  from the body means a function that _looks_ like it checks something silences
+  the warning while checking nothing, and a warning that is usually wrong stops
+  being read.
+
+  **Breaking: `scaffold.<feature>` is now `boolean | { auth?, path? }`, and `true`
+  means authenticated.** The old `'auth' | 'no-auth' | false` read like a
+  starter-file preference while being a live authorization decision, set three
+  directories from the functions it governed — the shape the console incident
+  took. A surface now becomes public only by writing `{ auth: false }`, so
+  omitting a field can never open anything: the failure mode of a forgotten flag
+  is a locked door. `{ path }` additionally overrides where the file is
+  generated, which previously could only be set for all features at once via
+  `pikkuDir`.
+
+  The legacy strings are **refused, not coerced**. `resolveScaffoldFeature` throws
+  naming the key and its replacement (`"rpc": "no-auth"` → `"rpc": { "auth":
+false }`), and it does so at config load, not downstream. An earlier design used
+  a bare `string` for the output path, under which `"no-auth"` would have parsed
+  as a file named `no-auth` and every unmigrated config would have silently
+  produced nonsense; the object form makes any string invalid, so the failure is
+  loud.
+
+  The collapse is deliberately not uniform in effect. For `rpc` the flag was a
+  blanket "no anonymous RPC in this app" set on a dispatcher that cannot know what
+  it dispatches to; for `userAdmin` it was redundant, since the generated
+  functions are already `pikkuFunc` with `scopes: ['admin:users:list']`. But for
+  `agent`, `workflow`, `events` and `scenarios` it is the only gate — those
+  generate real endpoints the app never authors — so `true` keeps them
+  authenticated rather than opening them as a side effect of a config cleanup.
+  `webhook` and `remoteRpc` have no auth dimension at all (`serialize-remote-rpc.ts`
+  hardcodes `auth: false`), so an `{ auth }` on them is ignored. The three
+  configs in this repo are migrated preserving their current behaviour exactly.
+
+  **Queue job identities are signed.** A job carried the producer's `pikkuUserId`
+  as a plain string and the worker resolved a session from it with no
+  verification, so write access to the queue backend was act-as-any-user. The
+  identity is now `pq1.<claim>.<hmac>`, HMAC-SHA256 over the claim and the
+  canonicalized job payload, keyed by HKDF expansion of a new
+  `PIKKU_QUEUE_IDENTITY_SECRET`. Producers opt in by wrapping their queue service
+  with `SignedQueueService`. This fails safe rather than closed: with no secret
+  configured the identity is dropped and jobs still process, warning once per
+  process, so no existing deployment breaks on upgrade — it simply loses queue
+  identity until the secret is set. The payload rather than the job id is bound
+  because SQS, Cloudflare Queues, Azure and the in-memory service all mint ids
+  after `add` returns.
+
+  **Workflow inline state is read from the run record.** `isInline` consulted a
+  process-local `Map`, while `WorkflowRun.inline` is durable. Any instance that
+  did not start a run disagreed with the record, so one instance could dispatch a
+  queued job for a workflow another was already executing in-process. It is now
+  async and resolves through the durable identity, cached only when a context
+  already exists so a passive reader allocates nothing. The same `Map` also leaked:
+  `nextStepKey` fabricated replay state on every step, and `releaseContext`
+  refused to free anything carrying it, so runs whose steps executed outside a
+  `beginReplay` bracket — the step-worker queue path — stranded their context and
+  step state for the process lifetime. Contexts are now released by an explicit
+  execution counter. Step ordinals reset per execution rather than accumulating
+  across step-worker invocations in one process, which makes step naming
+  independent of how work was distributed.
+
+  **Secret reads fail loud in every store.** `MongoDBSecretService.getSecrets`
+  skipped rows that failed to decrypt, and the redis equivalent dropped every
+  rejection via `Promise.allSettled`, including the "No KEK available for
+  key_version N" configuration error. Both now throw, naming the key and its key
+  version, matching the kysely behaviour. This matters most alongside the KEK
+  change above: without it, an upgrade surfaces as a partial secrets map and an
+  opaque downstream failure instead of an error naming the secret to re-enter.
+
+  **A second middleware registration for a pattern no longer erases the first.**
+  `addHTTPMiddleware`, `addTagMiddleware` and `addChannelMiddleware` groups are
+  keyed by pattern or tag and held one source file each, so a second file's call
+  overwrote the first's. Codegen emits its imports from what is stored, so the
+  losing file was never imported and its middleware never registered — the
+  runtime composes repeated registrations for a pattern happily, and only codegen
+  dropped one. Adding an unrelated `addHTTPMiddleware('*', …)` to an app was
+  enough to silently unregister the generated better-auth session bridge, which
+  fails open and gives no sign until a request arrives without a session. A group
+  now carries every registration made for it, and all of them are imported.
+
+- Updated dependencies [6a307f0]
+- Updated dependencies [afef587]
+- Updated dependencies [8075f6a]
+  - @pikku/core@0.12.74
+
 ## 0.12.5
 
 ### Patch Changes

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2021 - present Yasser Fadl and Pikku contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,28 @@
 # @pikku/lambda
 
-This package is part of @pikku/mono and is responsible for providing a wrapper between lambda calls and pikku
+AWS Lambda runtime for Pikku — HTTP (API Gateway v1 and v2), WebSocket, SQS
+queue and scheduled handlers, plus `SQSQueueService`.
+
+## Install
+
+```bash
+npm install @pikku/lambda
+```
+
+## Usage
+
+```typescript
+import { runFetchV2 } from '@pikku/lambda'
+import type { APIGatewayProxyEventV2 } from 'aws-lambda'
+
+import './.pikku/pikku-bootstrap.gen.js'
+
+export const handler = async (event: APIGatewayProxyEventV2) =>
+  runFetchV2(event)
+```
+
+Use `@pikku/deploy-serverless` to generate the matching `serverless.yml`.
+
+## Docs
+
+https://pikku.dev/docs

package/dist/http/index.d.ts

@@ -1,4 +1,2 @@
 export * from './run-fetch.js';
 export * from './run-fetch-v2.js';
-export { lambdaV2EventToRequest } from './request-converter-v2.js';
-export { responseToLambdaV2Result } from './response-converter-v2.js';

package/dist/http/index.js

@@ -1,5 +1,3 @@
 export * from './run-fetch.js';
 export * from './run-fetch-v2.js';
-export { lambdaV2EventToRequest } from './request-converter-v2.js';
-export { responseToLambdaV2Result } from './response-converter-v2.js';
 //# sourceMappingURL=index.js.map

package/dist/http/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAA;AAC9B,cAAc,mBAAmB,CAAA;AACjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAA;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAA;AAC9B,cAAc,mBAAmB,CAAA"}

package/dist/lambda-deployment-service.js

@@ -1,5 +1,5 @@
 import { LambdaClient, InvokeCommand } from '@aws-sdk/client-lambda';
-import { encryptJSON } from '@pikku/core/crypto-utils';
+import { buildRemoteHeaders } from '@pikku/core/remote';
 export class LambdaDeploymentService {
     jwt;
     secrets;
@@ -20,27 +20,7 @@ export class LambdaDeploymentService {
             throw new Error(`No Lambda binding for function '${funcName}'. ` +
                 `Available bindings: ${[...this.bindings.keys()].join(', ')}`);
         }
-        const headers = {
-            'content-type': 'application/json',
-            ...(traceId && { 'x-request-id': traceId }),
-        };
-        let secret;
-        try {
-            secret = await this.secrets.getSecret('PIKKU_REMOTE_SECRET');
-        }
-        catch { }
-        if (secret && this.jwt) {
-            const sessionEnc = session
-                ? await encryptJSON(secret, { session })
-                : undefined;
-            const token = await this.jwt.encode({ value: 5, unit: 'minute' }, {
-                aud: 'pikku-remote',
-                fn: funcName,
-                iat: Math.floor(Date.now() / 1000),
-                session: sessionEnc,
-            });
-            headers.authorization = `Bearer ${token}`;
-        }
+        const headers = await buildRemoteHeaders(this.jwt, this.secrets, funcName, session, traceId);
         const rpcPath = `/remote/rpc/${encodeURIComponent(funcName)}`;
         const apiGatewayEvent = {
             httpMethod: 'POST',

package/dist/lambda-deployment-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"lambda-deployment-service.js","sourceRoot":"","sources":["../src/lambda-deployment-service.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAIpE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAEtD,MAAM,OAAO,uBAAuB;IAKxB;IACA;IALF,MAAM,CAAc;IACpB,QAAQ,CAAqB;IAErC,YACU,GAA2B,EAC3B,OAAsB,EAC9B,gBAAwC;QAFhC,QAAG,GAAH,GAAG,CAAwB;QAC3B,YAAO,GAAP,OAAO,CAAe;QAG9B,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,CAAC,CAAA;QAClC,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAA;IAC3D,CAAC;IAED,KAAK,CAAC,IAAI,KAAmB,CAAC;IAC9B,KAAK,CAAC,KAAK,CAAC,OAAyB,IAAkB,CAAC;IACxD,KAAK,CAAC,IAAI,KAAmB,CAAC;IAE9B,KAAK,CAAC,MAAM,CACV,QAAgB,EAChB,IAAa,EACb,OAAiB,EACjB,OAAgB;QAEhB,MAAM,kBAAkB,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACtD,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,mCAAmC,QAAQ,KAAK;gBAC9C,uBAAuB,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChE,CAAA;QACH,CAAC;QAED,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,GAAG,CAAC,OAAO,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;SAC5C,CAAA;QAGD,IAAI,MAA0B,CAAA;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAA;QAC9D,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QAEV,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,UAAU,GAAG,OAAO;gBACxB,CAAC,CAAC,MAAM,WAAW,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC;gBACxC,CAAC,CAAC,SAAS,CAAA;YACb,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CACjC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAC5B;gBACE,GAAG,EAAE,cAAc;gBACnB,EAAE,EAAE,QAAQ;gBACZ,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;gBAClC,OAAO,EAAE,UAAU;aACpB,CACF,CAAA;YACD,OAAO,CAAC,aAAa,GAAG,UAAU,KAAK,EAAE,CAAA;QAC3C,CAAC;QAGD,MAAM,OAAO,GAAG,eAAe,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAA;QAC7D,MAAM,eAAe,GAAG;YACtB,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,OAAO;YACb,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;YAC9B,eAAe,EAAE,KAAK;YACtB,qBAAqB,EAAE,IAAI;YAC3B,cAAc,EAAE,IAAI;YACpB,cAAc,EAAE,IAAI;YACpB,cAAc,EAAE;gBACd,UAAU,EAAE,MAAM;gBAClB,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,MAAM;gBACb,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE;gBAC9B,QAAQ,EAAE,EAAE;aACb;YACD,QAAQ,EAAE,OAAO;SAClB,CAAA;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACrC,IAAI,aAAa,CAAC;YAChB,YAAY,EAAE,kBAAkB;YAChC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;SACzC,CAAC,CACH,CAAA;QAED,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;YAC3B,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO;gBACnC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAC5C,CAAC,CAAC,eAAe,CAAA;YACnB,MAAM,IAAI,KAAK,CACb,uBAAuB,QAAQ,2BAA2B,YAAY,EAAE,CACzE,CAAA;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,uBAAuB,CAAC,CAAA;QACzE,CAAC;QAGD,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;QAE3E,IAAI,YAAY,CAAC,UAAU,IAAI,YAAY,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CACb,uBAAuB,QAAQ,aAAa,YAAY,CAAC,UAAU,IAAI,YAAY,CAAC,IAAI,EAAE,CAC3F,CAAA;QACH,CAAC;QAGD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAA;QAC9B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"lambda-deployment-service.js","sourceRoot":"","sources":["../src/lambda-deployment-service.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAIpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAEvD,MAAM,OAAO,uBAAuB;IAKxB;IACA;IALF,MAAM,CAAc;IACpB,QAAQ,CAAqB;IAErC,YACU,GAA2B,EAC3B,OAAsB,EAC9B,gBAAwC;QAFhC,QAAG,GAAH,GAAG,CAAwB;QAC3B,YAAO,GAAP,OAAO,CAAe;QAG9B,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,CAAC,CAAA;QAClC,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAA;IAC3D,CAAC;IAED,KAAK,CAAC,IAAI,KAAmB,CAAC;IAC9B,KAAK,CAAC,KAAK,CAAC,OAAyB,IAAkB,CAAC;IACxD,KAAK,CAAC,IAAI,KAAmB,CAAC;IAE9B,KAAK,CAAC,MAAM,CACV,QAAgB,EAChB,IAAa,EACb,OAAiB,EACjB,OAAgB;QAEhB,MAAM,kBAAkB,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACtD,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,mCAAmC,QAAQ,KAAK;gBAC9C,uBAAuB,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChE,CAAA;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,kBAAkB,CACtC,IAAI,CAAC,GAAG,EACR,IAAI,CAAC,OAAO,EACZ,QAAQ,EACR,OAAO,EACP,OAAO,CACR,CAAA;QAGD,MAAM,OAAO,GAAG,eAAe,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAA;QAC7D,MAAM,eAAe,GAAG;YACtB,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,OAAO;YACb,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;YAC9B,eAAe,EAAE,KAAK;YACtB,qBAAqB,EAAE,IAAI;YAC3B,cAAc,EAAE,IAAI;YACpB,cAAc,EAAE,IAAI;YACpB,cAAc,EAAE;gBACd,UAAU,EAAE,MAAM;gBAClB,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,MAAM;gBACb,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE;gBAC9B,QAAQ,EAAE,EAAE;aACb;YACD,QAAQ,EAAE,OAAO;SAClB,CAAA;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACrC,IAAI,aAAa,CAAC;YAChB,YAAY,EAAE,kBAAkB;YAChC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;SACzC,CAAC,CACH,CAAA;QAED,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;YAC3B,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO;gBACnC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAC5C,CAAC,CAAC,eAAe,CAAA;YACnB,MAAM,IAAI,KAAK,CACb,uBAAuB,QAAQ,2BAA2B,YAAY,EAAE,CACzE,CAAA;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,uBAAuB,CAAC,CAAA;QACzE,CAAC;QAGD,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;QAE3E,IAAI,YAAY,CAAC,UAAU,IAAI,YAAY,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CACb,uBAAuB,QAAQ,aAAa,YAAY,CAAC,UAAU,IAAI,YAAY,CAAC,IAAI,EAAE,CAC3F,CAAA;QACH,CAAC;QAGD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAA;QAC9B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF"}

package/dist/websocket/utils.js

@@ -1,5 +1,5 @@
 import { ApiGatewayManagementApiClient, PostToConnectionCommand, } from '@aws-sdk/client-apigatewaymanagementapi';
-import { getSingletonServices } from '@pikku/core';
+import { getSingletonServices } from '@pikku/core/ecosystem';
 import { createLambdaChannelHandlerFactory } from './lambda-channel-handler.js';
 export const sendMessage = async (logger, callbackAPI, ConnectionId, Data) => {
     try {

package/dist/websocket/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/websocket/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,6BAA6B,EAC7B,uBAAuB,GACxB,MAAM,yCAAyC,CAAA;AAEhD,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAElD,OAAO,EAAE,iCAAiC,EAAE,MAAM,6BAA6B,CAAA;AAG/E,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC9B,MAAc,EACd,WAA0C,EAC1C,YAAoB,EACpB,IAAY,EACM,EAAE;IACpB,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QAC3E,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAGhB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;QACvB,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,MAAc,EACd,YAA0B,EAC1B,WAA0C,EAC1C,aAAqB,EACrB,UAAoB,EACpB,IAAa,EACb,QAAkB,EACH,EAAE;IACjB,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;IACvE,CAAC;IACD,MAAM,eAAe,GAAa,EAAE,CAAA;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,OAAO,CAAC,GAAG,CACf,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;QACjC,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;YACvE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IACD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,YAAY,CAAC,cAAc,CAAC,eAAe,CAAC,CAAA;IACpD,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAC9C,MAAc,EACd,KAAsB,EACtB,EAAE;IACF,IAAI,QAAgB,CAAA;IACpB,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAA;QACjE,QAAQ,GAAG,uBAAuB,CAAA;IACpC,CAAC;SAAM,IAAI,KAAK,CAAC,cAAc,CAAC,UAAU,EAAE,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,IAAI,CACT,6EAA6E,CAC9E,CAAA;QACD,QAAQ,GAAG,WAAW,KAAK,CAAC,cAAc,CAAC,UAAU,IAAI,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,CAAA;IACvF,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAA;QACzD,QAAQ,GAAG,WAAW,KAAK,CAAC,cAAc,CAAC,UAAU,EAAE,CAAA;IACzD,CAAC;IACD,OAAO,IAAI,6BAA6B,CAAC;QACvC,UAAU,EAAE,YAAY;QACxB,QAAQ;KACT,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,YAA0B,EAC1B,KAAsB,EACtB,EAAE;IACF,MAAM,EAAE,MAAM,EAAE,GAAG,oBAAoB,EAAE,CAAA;IACzC,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,CAAC,YAAY,CAAA;IACnD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC5D,CAAC;IACD,MAAM,WAAW,GAAG,gCAAgC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IACnE,MAAM,qBAAqB,GAAG,iCAAiC,CAC7D,MAAM,EACN,YAAY,EACZ,WAAW,CACZ,CAAA;IACD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,qBAAqB,EAAE,YAAY,EAAE,CAAA;AACxE,CAAC,CAAA"}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/websocket/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,6BAA6B,EAC7B,uBAAuB,GACxB,MAAM,yCAAyC,CAAA;AAEhD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAE5D,OAAO,EAAE,iCAAiC,EAAE,MAAM,6BAA6B,CAAA;AAG/E,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC9B,MAAc,EACd,WAA0C,EAC1C,YAAoB,EACpB,IAAY,EACM,EAAE;IACpB,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QAC3E,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAGhB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;QACvB,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,MAAc,EACd,YAA0B,EAC1B,WAA0C,EAC1C,aAAqB,EACrB,UAAoB,EACpB,IAAa,EACb,QAAkB,EACH,EAAE;IACjB,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;IACvE,CAAC;IACD,MAAM,eAAe,GAAa,EAAE,CAAA;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,OAAO,CAAC,GAAG,CACf,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;QACjC,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;YACvE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IACD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,YAAY,CAAC,cAAc,CAAC,eAAe,CAAC,CAAA;IACpD,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAC9C,MAAc,EACd,KAAsB,EACtB,EAAE;IACF,IAAI,QAAgB,CAAA;IACpB,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAA;QACjE,QAAQ,GAAG,uBAAuB,CAAA;IACpC,CAAC;SAAM,IAAI,KAAK,CAAC,cAAc,CAAC,UAAU,EAAE,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,IAAI,CACT,6EAA6E,CAC9E,CAAA;QACD,QAAQ,GAAG,WAAW,KAAK,CAAC,cAAc,CAAC,UAAU,IAAI,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,CAAA;IACvF,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAA;QACzD,QAAQ,GAAG,WAAW,KAAK,CAAC,cAAc,CAAC,UAAU,EAAE,CAAA;IACzD,CAAC;IACD,OAAO,IAAI,6BAA6B,CAAC;QACvC,UAAU,EAAE,YAAY;QACxB,QAAQ;KACT,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,YAA0B,EAC1B,KAAsB,EACtB,EAAE;IACF,MAAM,EAAE,MAAM,EAAE,GAAG,oBAAoB,EAAE,CAAA;IACzC,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,CAAC,YAAY,CAAA;IACnD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC5D,CAAC;IACD,MAAM,WAAW,GAAG,gCAAgC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IACnE,MAAM,qBAAqB,GAAG,iCAAiC,CAC7D,MAAM,EACN,YAAY,EACZ,WAAW,CACZ,CAAA;IACD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,qBAAqB,EAAE,YAAY,EAAE,CAAA;AACxE,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@pikku/lambda",
-  "version": "0.12.5",
+  "version": "0.12.7",
+  "description": "AWS Lambda runtime for Pikku — HTTP, WebSocket, SQS queue and scheduled handlers",
   "license": "MIT",
   "author": "yasser.fadl@gmail.com",
   "module": "dist/index.js",
@@ -27,7 +28,7 @@
     "@aws-sdk/client-apigatewaymanagementapi": "^3.713.0",
     "@aws-sdk/client-lambda": "^3.713.0",
     "@aws-sdk/client-sqs": "^3.713.0",
-    "@pikku/core": "^0.12.58",
+    "@pikku/core": "^0.12.82",
     "@types/aws-lambda": "^8.10.161"
   },
   "devDependencies": {

package/src/http/index.ts

@@ -1,4 +1,2 @@
 export * from './run-fetch.js'
 export * from './run-fetch-v2.js'
-export { lambdaV2EventToRequest } from './request-converter-v2.js'
-export { responseToLambdaV2Result } from './response-converter-v2.js'

package/src/lambda-deployment-service.ts

@@ -13,7 +13,7 @@ import { LambdaClient, InvokeCommand } from '@aws-sdk/client-lambda'
 import type { DeploymentService, DeploymentConfig } from '@pikku/core/services'
 import type { JWTService } from '@pikku/core/services'
 import type { SecretService } from '@pikku/core/services'
-import { encryptJSON } from '@pikku/core/crypto-utils'
+import { buildRemoteHeaders } from '@pikku/core/remote'
 
 export class LambdaDeploymentService implements DeploymentService {
   private client: LambdaClient
@@ -46,32 +46,13 @@ export class LambdaDeploymentService implements DeploymentService {
       )
     }
 
-    const headers: Record<string, string> = {
-      'content-type': 'application/json',
-      ...(traceId && { 'x-request-id': traceId }),
-    }
-
-    // Sign session as JWT for pikkuRemoteAuthMiddleware
-    let secret: string | undefined
-    try {
-      secret = await this.secrets.getSecret('PIKKU_REMOTE_SECRET')
-    } catch {}
-
-    if (secret && this.jwt) {
-      const sessionEnc = session
-        ? await encryptJSON(secret, { session })
-        : undefined
-      const token = await this.jwt.encode(
-        { value: 5, unit: 'minute' },
-        {
-          aud: 'pikku-remote',
-          fn: funcName,
-          iat: Math.floor(Date.now() / 1000),
-          session: sessionEnc,
-        }
-      )
-      headers.authorization = `Bearer ${token}`
-    }
+    const headers = await buildRemoteHeaders(
+      this.jwt,
+      this.secrets,
+      funcName,
+      session,
+      traceId
+    )
 
     // Build an API Gateway v2 event for the target Lambda
     const rpcPath = `/remote/rpc/${encodeURIComponent(funcName)}`

package/src/websocket/utils.ts

@@ -3,7 +3,7 @@ import {
   PostToConnectionCommand,
 } from '@aws-sdk/client-apigatewaymanagementapi'
 import type { Logger } from '@pikku/core/services'
-import { getSingletonServices } from '@pikku/core'
+import { getSingletonServices } from '@pikku/core/ecosystem'
 import type { APIGatewayEvent } from 'aws-lambda'
 import { createLambdaChannelHandlerFactory } from './lambda-channel-handler.js'
 import type { ChannelStore } from '@pikku/core/channel'