@pikku/core 0.11.0 → 0.11.2

package/dist/middleware/auth-apikey.d.ts

@@ -20,5 +20,5 @@ export declare const authAPIKey: import("../types/core.types.js").CorePikkuMiddl
 }, import("../types/core.types.js").CoreSingletonServices<{
     logLevel?: import("../index.js").LogLevel;
     secrets?: {};
-    workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
+    workflow?: import("../index.js").WorkflowServiceConfig;
 }>, import("../types/core.types.js").CoreUserSession>;

package/dist/middleware/auth-apikey.js

@@ -16,8 +16,8 @@ import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js'
  * ])
  * ```
  */
-export const authAPIKey = pikkuMiddlewareFactory(({ source }) => pikkuMiddleware(async ({ userSession: userSessionService, jwt: jwtService }, { http }, next) => {
-    if (!http?.request || userSessionService.get()) {
+export const authAPIKey = pikkuMiddlewareFactory(({ source }) => pikkuMiddleware(async ({ jwt: jwtService }, { http, session: SessionService }, next) => {
+    if (!http?.request || !SessionService || SessionService.get()) {
         return next();
     }
     let apiKey = null;
@@ -30,7 +30,7 @@ export const authAPIKey = pikkuMiddlewareFactory(({ source }) => pikkuMiddleware
     if (apiKey && jwtService) {
         const userSession = await jwtService.decode(apiKey);
         if (userSession) {
-            userSessionService.setInitial(userSession);
+            SessionService.setInitial(userSession);
         }
     }
     return next();

package/dist/middleware/auth-bearer.d.ts

@@ -36,5 +36,5 @@ export declare const authBearer: import("../types/core.types.js").CorePikkuMiddl
 }, import("../types/core.types.js").CoreSingletonServices<{
     logLevel?: import("../index.js").LogLevel;
     secrets?: {};
-    workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
+    workflow?: import("../index.js").WorkflowServiceConfig;
 }>, CoreUserSession>;

package/dist/middleware/auth-bearer.js

@@ -29,9 +29,9 @@ import { pikkuMiddleware, pikkuMiddlewareFactory, } from '../types/core.types.js
  * ])
  * ```
  */
-export const authBearer = pikkuMiddlewareFactory(({ token } = {}) => pikkuMiddleware(async ({ userSession: userSessionService, jwt: jwtService }, { http }, next) => {
+export const authBearer = pikkuMiddlewareFactory(({ token } = {}) => pikkuMiddleware(async ({ jwt: jwtService }, { http, session }, next) => {
     // Skip if session already exists.
-    if (!http?.request || userSessionService.get()) {
+    if (!http?.request || !session || session.get()) {
         return next();
     }
     const authHeader = http.request.header('authorization') ||
@@ -51,7 +51,7 @@ export const authBearer = pikkuMiddlewareFactory(({ token } = {}) => pikkuMiddle
             userSession = await jwtService.decode(bearerToken);
         }
         if (userSession) {
-            userSessionService.setInitial(userSession);
+            session.setInitial(userSession);
         }
     }
     return next();

package/dist/middleware/auth-cookie.d.ts

@@ -35,5 +35,5 @@ export declare const authCookie: import("../types/core.types.js").CorePikkuMiddl
 }, import("../types/core.types.js").CoreSingletonServices<{
     logLevel?: import("../index.js").LogLevel;
     secrets?: {};
-    workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
+    workflow?: import("../index.js").WorkflowServiceConfig;
 }>, import("../types/core.types.js").CoreUserSession>;

package/dist/middleware/auth-cookie.js

@@ -28,8 +28,8 @@ import { getRelativeTimeOffsetFromNow, } from '../time-utils.js';
  * ])
  * ```
  */
-export const authCookie = pikkuMiddlewareFactory(({ name, options, expiresIn }) => pikkuMiddleware(async ({ userSession: userSessionService, jwt: jwtService, logger }, { http }, next) => {
-    if (!http?.request || userSessionService.get()) {
+export const authCookie = pikkuMiddlewareFactory(({ name, options, expiresIn }) => pikkuMiddleware(async ({ jwt: jwtService, logger }, { http, session: SessionService }, next) => {
+    if (!http?.request || !SessionService || SessionService.get()) {
         return next();
     }
     // Try to decode session from cookie
@@ -37,7 +37,7 @@ export const authCookie = pikkuMiddlewareFactory(({ name, options, expiresIn })
     if (cookieValue && jwtService) {
         const userSession = await jwtService.decode(cookieValue);
         if (userSession) {
-            userSessionService.setInitial(userSession);
+            SessionService.setInitial(userSession);
         }
     }
     await next();
@@ -45,8 +45,8 @@ export const authCookie = pikkuMiddlewareFactory(({ name, options, expiresIn })
     if (!http?.response) {
         return;
     }
-    if (userSessionService.sessionChanged) {
-        const session = userSessionService.get();
+    if (SessionService.sessionChanged) {
+        const session = SessionService.get();
         if (jwtService) {
             http.response.cookie(name, await jwtService.encode(expiresIn, session), {
                 ...options,

package/dist/middleware/timeout.d.ts

@@ -3,5 +3,5 @@ export declare const timeout: () => import("../types/core.types.js").CorePikkuMi
 }, import("../types/core.types.js").CoreSingletonServices<{
     logLevel?: import("../index.js").LogLevel;
     secrets?: {};
-    workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
+    workflow?: import("../index.js").WorkflowServiceConfig;
 }>, import("../types/core.types.js").CoreUserSession>;

package/dist/middleware/timeout.js

@@ -1,8 +1,9 @@
 import { RequestTimeoutError } from '../errors/errors.js';
 import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js';
-export const timeout = () => pikkuMiddlewareFactory(({ timeout }) => pikkuMiddleware(async (_services, _interaction, next) => {
-    setTimeout(() => {
+export const timeout = () => pikkuMiddlewareFactory(({ timeout }) => pikkuMiddleware(async (_services, _wire, next) => {
+    const timeoutId = setTimeout(() => {
         throw new RequestTimeoutError();
     }, timeout);
     await next();
+    clearTimeout(timeoutId);
 }));

package/dist/middleware-runner.d.ts

@@ -1,10 +1,9 @@
-import { UserSessionService } from './services/user-session-service.js';
-import { CoreSingletonServices, PikkuInteraction, CorePikkuMiddleware, CorePikkuMiddlewareGroup, PikkuWiringTypes, MiddlewareMetadata } from './types/core.types.js';
+import { CoreSingletonServices, PikkuWire, CorePikkuMiddleware, CorePikkuMiddlewareGroup, PikkuWiringTypes, MiddlewareMetadata } from './types/core.types.js';
 /**
  * Runs a chain of middleware functions in sequence before executing the main function.
  *
  * @param services - An object containing services (e.g., singletonServices, userSession, etc.)
- * @param interaction - The interaction context, e.g., { http }.
+ * @param wire - The wire context, e.g., { http }.
  * @param middlewares - An array of middleware functions to run.
  * @param main - The main function to execute after all middleware have run.
  * @returns A promise resolving to the result of the main function.
@@ -17,9 +16,7 @@ import { CoreSingletonServices, PikkuInteraction, CorePikkuMiddleware, CorePikku
  *   async () => { return await runMain(); }
  * );
  */
-export declare const runMiddleware: <Middleware extends CorePikkuMiddleware>(services: CoreSingletonServices & {
-    userSession?: UserSessionService<any>;
-}, interaction: PikkuInteraction, middlewares: readonly Middleware[], main?: () => Promise<unknown>) => Promise<unknown>;
+export declare const runMiddleware: <Middleware extends CorePikkuMiddleware>(services: CoreSingletonServices, wire: PikkuWire, middlewares: readonly Middleware[], main?: () => Promise<unknown>) => Promise<unknown>;
 /**
  * Registers global middleware for a specific tag.
  *
@@ -53,19 +50,7 @@ export declare const runMiddleware: <Middleware extends CorePikkuMiddleware>(ser
  * ])
  * ```
  */
-export declare const addMiddleware: <PikkuMiddleware extends CorePikkuMiddleware>(tag: string, middleware: CorePikkuMiddlewareGroup) => CorePikkuMiddlewareGroup;
-/**
- * Retrieves a registered middleware function by its name.
- *
- * This function looks up middleware that was registered with registerMiddleware.
- * It's used internally by the framework to resolve middleware references in metadata.
- *
- * @param {string} name - The unique name (pikkuFuncName) of the middleware function.
- * @returns {CorePikkuMiddleware | undefined} The middleware function, or undefined if not found.
- *
- * @internal
- */
-export declare const getMiddlewareByName: (name: string) => CorePikkuMiddleware | undefined;
+export declare const addMiddleware: <PikkuMiddleware extends CorePikkuMiddleware>(tag: string, middleware: CorePikkuMiddlewareGroup, packageName?: string | null) => CorePikkuMiddlewareGroup;
 /**
  * Combines wiring-specific middleware with function-level middleware.
  *
@@ -88,9 +73,10 @@ export declare const getMiddlewareByName: (name: string) => CorePikkuMiddleware
  * })
  * ```
  */
-export declare const combineMiddleware: (wireType: PikkuWiringTypes, uid: string, { wireInheritedMiddleware, wireMiddleware, funcInheritedMiddleware, funcMiddleware, }?: {
+export declare const combineMiddleware: (wireType: PikkuWiringTypes, uid: string, { wireInheritedMiddleware, wireMiddleware, funcInheritedMiddleware, funcMiddleware, packageName, }?: {
     wireInheritedMiddleware?: MiddlewareMetadata[];
     wireMiddleware?: CorePikkuMiddleware[];
     funcInheritedMiddleware?: MiddlewareMetadata[];
     funcMiddleware?: CorePikkuMiddleware[];
+    packageName?: string | null;
 }) => readonly CorePikkuMiddleware[];

package/dist/middleware-runner.js

@@ -1,11 +1,10 @@
-import { PikkuWiringTypes, } from './types/core.types.js';
 import { pikkuState } from './pikku-state.js';
 import { freezeDedupe } from './utils.js';
 /**
  * Runs a chain of middleware functions in sequence before executing the main function.
  *
  * @param services - An object containing services (e.g., singletonServices, userSession, etc.)
- * @param interaction - The interaction context, e.g., { http }.
+ * @param wire - The wire context, e.g., { http }.
  * @param middlewares - An array of middleware functions to run.
  * @param main - The main function to execute after all middleware have run.
  * @returns A promise resolving to the result of the main function.
@@ -18,12 +17,12 @@ import { freezeDedupe } from './utils.js';
  *   async () => { return await runMain(); }
  * );
  */
-export const runMiddleware = async (services, interaction, middlewares, main) => {
+export const runMiddleware = async (services, wire, middlewares, main) => {
     // Deduplicate middleware using Set to avoid running the same middleware multiple times
     let result;
     const dispatch = async (index) => {
         if (middlewares && index < middlewares.length) {
-            return await middlewares[index](services, interaction, () => dispatch(index + 1));
+            return await middlewares[index](services, wire, () => dispatch(index + 1));
         }
         else if (main) {
             result = await main();
@@ -65,8 +64,8 @@ export const runMiddleware = async (services, interaction, middlewares, main) =>
  * ])
  * ```
  */
-export const addMiddleware = (tag, middleware) => {
-    const tagGroups = pikkuState('middleware', 'tagGroup');
+export const addMiddleware = (tag, middleware, packageName = null) => {
+    const tagGroups = pikkuState(packageName, 'middleware', 'tagGroup');
     tagGroups[tag] = middleware;
     return middleware;
 };
@@ -81,20 +80,20 @@ export const addMiddleware = (tag, middleware) => {
  *
  * @internal
  */
-export const getMiddlewareByName = (name) => {
-    const middlewareStore = pikkuState('misc', 'middleware');
+const getMiddlewareByName = (name) => {
+    const middlewareStore = pikkuState(null, 'misc', 'middleware');
     const middleware = middlewareStore[name];
     return middleware?.[0];
 };
 const middlewareCache = {
-    [PikkuWiringTypes.http]: {},
-    [PikkuWiringTypes.rpc]: {},
-    [PikkuWiringTypes.channel]: {},
-    [PikkuWiringTypes.queue]: {},
-    [PikkuWiringTypes.scheduler]: {},
-    [PikkuWiringTypes.mcp]: {},
-    [PikkuWiringTypes.cli]: {},
-    [PikkuWiringTypes.workflow]: {},
+    http: {},
+    rpc: {},
+    channel: {},
+    queue: {},
+    scheduler: {},
+    mcp: {},
+    cli: {},
+    workflow: {},
 };
 /**
  * Combines wiring-specific middleware with function-level middleware.
@@ -118,7 +117,7 @@ const middlewareCache = {
  * })
  * ```
  */
-export const combineMiddleware = (wireType, uid, { wireInheritedMiddleware, wireMiddleware, funcInheritedMiddleware, funcMiddleware, } = {}) => {
+export const combineMiddleware = (wireType, uid, { wireInheritedMiddleware, wireMiddleware, funcInheritedMiddleware, funcMiddleware, packageName = null, } = {}) => {
     if (middlewareCache[wireType][uid]) {
         return middlewareCache[wireType][uid];
     }
@@ -128,7 +127,7 @@ export const combineMiddleware = (wireType, uid, { wireInheritedMiddleware, wire
         for (const meta of wireInheritedMiddleware) {
             if (meta.type === 'http') {
                 // Look up HTTP middleware group from pikkuState
-                const group = pikkuState('middleware', 'httpGroup')[meta.route];
+                const group = pikkuState(packageName, 'middleware', 'httpGroup')[meta.route];
                 if (group) {
                     // At runtime, all factories should be resolved to middleware
                     resolved.push(...group);
@@ -136,7 +135,7 @@ export const combineMiddleware = (wireType, uid, { wireInheritedMiddleware, wire
             }
             else if (meta.type === 'tag') {
                 // Look up tag middleware group from pikkuState
-                const group = pikkuState('middleware', 'tagGroup')[meta.tag];
+                const group = pikkuState(packageName, 'middleware', 'tagGroup')[meta.tag];
                 if (group) {
                     // At runtime, all factories should be resolved to middleware
                     resolved.push(...group);
@@ -160,7 +159,7 @@ export const combineMiddleware = (wireType, uid, { wireInheritedMiddleware, wire
         for (const meta of funcInheritedMiddleware) {
             if (meta.type === 'tag') {
                 // Look up tag middleware group from pikkuState
-                const group = pikkuState('middleware', 'tagGroup')[meta.tag];
+                const group = pikkuState(packageName, 'middleware', 'tagGroup')[meta.tag];
                 if (group) {
                     // At runtime, all factories should be resolved to middleware
                     resolved.push(...group);

package/dist/permissions.d.ts

@@ -1,43 +1,5 @@
-import { CoreServices, CoreUserSession, PikkuWiringTypes, PermissionMetadata } from './types/core.types.js';
+import { CoreServices, PikkuWiringTypes, PermissionMetadata, PikkuWire } from './types/core.types.js';
 import { CorePermissionGroup, CorePikkuPermission } from './function/functions.types.js';
-/**
- * This function validates permissions by iterating over permission groups and executing the corresponding permission functions. If all functions in at least one group return true, the permission is considered valid.
- * @param services - The core services required for permission validation.
- * @param data - The data to be used in the permission validation functions.
- * @param session - An optional user session for permission validation.
- * @returns A promise that resolves to void.
- */
-export declare const verifyPermissions: (permissions: CorePermissionGroup, services: CoreServices, data: any, session?: CoreUserSession) => Promise<boolean>;
-/**
- * Registers a single permission function by name in the global permission store.
- *
- * This function is used by CLI-generated code to register permission functions
- * that can be referenced by name in metadata. It stores permissions in a special
- * namespace to avoid conflicts with tag-based permissions.
- *
- * @param {string} name - The unique name (pikkuFuncName) of the permission function.
- * @param {CorePikkuPermission} permission - The permission function to register.
- *
- * @example
- * ```typescript
- * // Called by CLI-generated pikku-permissions.gen.ts
- * registerPermission('adminPermission_src_permissions_ts_10_5', adminPermission)
- * registerPermission('readPermission_src_permissions_ts_20_10', readPermission)
- * ```
- */
-export declare const registerPermission: (name: string, permission: CorePikkuPermission<any>) => void;
-/**
- * Retrieves a registered permission function by its name.
- *
- * This function looks up permissions that was registered with registerPermission.
- * It's used internally by the framework to resolve permission references in metadata.
- *
- * @param {string} name - The unique name (pikkuFuncName) of the permission function.
- * @returns {CorePikkuPermission | undefined} The permission function, or undefined if not found.
- *
- * @internal
- */
-export declare const getPermissionByName: (name: string) => CorePikkuPermission | undefined;
 /**
  * Adds global permissions for a specific tag.
  *
@@ -66,63 +28,18 @@ export declare const getPermissionByName: (name: string) => CorePikkuPermission
  * ])
  * ```
  */
-export declare const addPermission: (tag: string, permissions: CorePermissionGroup | CorePikkuPermission[]) => CorePermissionGroup | CorePikkuPermission[];
-/**
- * Retrieves permissions for a given set of tags.
- *
- * This function looks up all permissions registered for any of the provided tags
- * and returns them as a flattened array.
- *
- * @param {string[]} tags - Array of tags to look up permissions for.
- * @returns {any[]} Array of permission functions that apply to the given tags.
- *
- * @example
- * ```typescript
- * // Get all permissions for tags 'api' and 'auth'
- * const permissions = getPermissionsForTags(['api', 'auth'])
- * ```
- */
-export declare const getPermissionsForTags: (tags?: string[]) => readonly (CorePermissionGroup | CorePikkuPermission)[];
-/**
- * Combines wiring-specific permissions with function-level permissions.
- *
- * This function resolves permission metadata into actual permission functions and combines them.
- * It filters out wire permissions without tags from inheritedPermissions to avoid duplication
- * (those are passed separately as wirePermissions).
- *
- * @param {object} options - Configuration object for combining permissions.
- * @param {PermissionMetadata[] | undefined} options.wireInheritedPermissions - Metadata from wiring (HTTP + tags + wire with tags).
- * @param {CorePermissionGroup | CorePikkuPermission[] | undefined} options.wirePermissions - Inline wire permissions.
- * @param {PermissionMetadata[] | undefined} options.funcInheritedPermissions - Function permissions metadata (only tags).
- * @param {CorePermissionGroup | CorePikkuPermission[] | undefined} options.funcPermissions - Inline function permissions.
- * @returns {(CorePermissionGroup | CorePikkuPermission)[]} Combined array of resolved permissions.
- *
- * @example
- * ```typescript
- * const combined = combinePermissions(wireType, wireId, {
- *   wireInheritedPermissions: meta.permissions,
- *   wirePermissions: inlinePermissions,
- *   funcInheritedPermissions: funcMeta.permissions,
- *   funcPermissions: funcConfig.permissions
- * })
- * ```
- */
-export declare const combinePermissions: (wireType: PikkuWiringTypes, uid: string, { wireInheritedPermissions, wirePermissions, funcInheritedPermissions, funcPermissions, }?: {
-    wireInheritedPermissions?: PermissionMetadata[];
-    wirePermissions?: CorePermissionGroup | CorePikkuPermission[];
-    funcInheritedPermissions?: PermissionMetadata[];
-    funcPermissions?: CorePermissionGroup | CorePikkuPermission[];
-}) => readonly (CorePermissionGroup | CorePikkuPermission)[];
+export declare const addPermission: (tag: string, permissions: CorePermissionGroup | CorePikkuPermission[], packageName?: string | null) => CorePermissionGroup | CorePikkuPermission[];
 /**
  * Runs permission checks using combined permissions from all sources.
  * Combines permissions from wire and function levels, then validates them.
  */
-export declare const runPermissions: (wireType: PikkuWiringTypes, uid: string, { wireInheritedPermissions, wirePermissions, funcInheritedPermissions, funcPermissions, allServices, data, session, }: {
+export declare const runPermissions: (wireType: PikkuWiringTypes, uid: string, { wireInheritedPermissions, wirePermissions, funcInheritedPermissions, funcPermissions, services, wire, data, packageName, }: {
     wireInheritedPermissions?: PermissionMetadata[];
     wirePermissions?: CorePermissionGroup | CorePikkuPermission[];
     funcInheritedPermissions?: PermissionMetadata[];
     funcPermissions?: CorePermissionGroup | CorePikkuPermission[];
-    allServices: CoreServices;
+    services: CoreServices;
+    wire: PikkuWire<any, never, any, never, never, never>;
     data: any;
-    session?: CoreUserSession;
+    packageName?: string | null;
 }) => Promise<void>;

package/dist/permissions.js

@@ -1,4 +1,3 @@
-import { PikkuWiringTypes, } from './types/core.types.js';
 import { pikkuState } from './pikku-state.js';
 import { ForbiddenError } from './errors/errors.js';
 import { freezeDedupe } from './utils.js';
@@ -6,10 +5,10 @@ import { freezeDedupe } from './utils.js';
  * This function validates permissions by iterating over permission groups and executing the corresponding permission functions. If all functions in at least one group return true, the permission is considered valid.
  * @param services - The core services required for permission validation.
  * @param data - The data to be used in the permission validation functions.
- * @param session - An optional user session for permission validation.
+ * @param wire - The wire object containing request/response context and session.
  * @returns A promise that resolves to void.
  */
-export const verifyPermissions = async (permissions, services, data, session) => {
+const verifyPermissions = async (permissions, services, data, wire) => {
     if (!permissions) {
         return true;
     }
@@ -20,13 +19,13 @@ export const verifyPermissions = async (permissions, services, data, session) =>
     }
     for (const funcs of permissionGroups) {
         if (funcs instanceof Array) {
-            const permissioned = await Promise.all(funcs.map((func) => func(services, data, session)));
+            const permissioned = await Promise.all(funcs.map((func) => func(services, data, wire)));
             if (permissioned.every((result) => result)) {
                 valid = true;
             }
         }
         else {
-            valid = await funcs(services, data, session);
+            valid = await funcs(services, data, wire);
         }
         if (valid) {
             return true;
@@ -34,27 +33,6 @@ export const verifyPermissions = async (permissions, services, data, session) =>
     }
     return false;
 };
-/**
- * Registers a single permission function by name in the global permission store.
- *
- * This function is used by CLI-generated code to register permission functions
- * that can be referenced by name in metadata. It stores permissions in a special
- * namespace to avoid conflicts with tag-based permissions.
- *
- * @param {string} name - The unique name (pikkuFuncName) of the permission function.
- * @param {CorePikkuPermission} permission - The permission function to register.
- *
- * @example
- * ```typescript
- * // Called by CLI-generated pikku-permissions.gen.ts
- * registerPermission('adminPermission_src_permissions_ts_10_5', adminPermission)
- * registerPermission('readPermission_src_permissions_ts_20_10', readPermission)
- * ```
- */
-export const registerPermission = (name, permission) => {
-    const permissionStore = pikkuState('misc', 'permissions');
-    permissionStore[name] = [permission];
-};
 /**
  * Retrieves a registered permission function by its name.
  *
@@ -66,8 +44,8 @@ export const registerPermission = (name, permission) => {
  *
  * @internal
  */
-export const getPermissionByName = (name) => {
-    const permissionStore = pikkuState('misc', 'permissions');
+const getPermissionByName = (name) => {
+    const permissionStore = pikkuState(null, 'misc', 'permissions');
     const permission = permissionStore[name];
     if (Array.isArray(permission) && permission.length === 1) {
         return permission[0];
@@ -102,59 +80,23 @@ export const getPermissionByName = (name) => {
  * ])
  * ```
  */
-export const addPermission = (tag, permissions) => {
-    const tagGroups = pikkuState('permissions', 'tagGroup');
+export const addPermission = (tag, permissions, packageName = null) => {
+    const tagGroups = pikkuState(packageName, 'permissions', 'tagGroup');
     if (tagGroups[tag]) {
         throw new Error(`Permissions for tag '${tag}' already exist. Use a different tag or remove the existing permissions first.`);
     }
     tagGroups[tag] = permissions;
     return permissions;
 };
-const EMPTY = [];
-/**
- * Retrieves permissions for a given set of tags.
- *
- * This function looks up all permissions registered for any of the provided tags
- * and returns them as a flattened array.
- *
- * @param {string[]} tags - Array of tags to look up permissions for.
- * @returns {any[]} Array of permission functions that apply to the given tags.
- *
- * @example
- * ```typescript
- * // Get all permissions for tags 'api' and 'auth'
- * const permissions = getPermissionsForTags(['api', 'auth'])
- * ```
- */
-export const getPermissionsForTags = (tags) => {
-    if (!tags || tags.length === 0) {
-        return EMPTY;
-    }
-    const permissionsStore = pikkuState('permissions', 'tagGroup');
-    const applicablePermissions = [];
-    // Collect permissions for all matching tags
-    for (const tag of new Set(tags)) {
-        const tagPermissions = permissionsStore[tag];
-        if (tagPermissions) {
-            if (Array.isArray(tagPermissions)) {
-                applicablePermissions.push(...tagPermissions);
-            }
-            else {
-                applicablePermissions.push(tagPermissions);
-            }
-        }
-    }
-    return applicablePermissions;
-};
 const combinedPermissionsCache = {
-    [PikkuWiringTypes.http]: {},
-    [PikkuWiringTypes.rpc]: {},
-    [PikkuWiringTypes.channel]: {},
-    [PikkuWiringTypes.queue]: {},
-    [PikkuWiringTypes.scheduler]: {},
-    [PikkuWiringTypes.mcp]: {},
-    [PikkuWiringTypes.cli]: {},
-    [PikkuWiringTypes.workflow]: {},
+    http: {},
+    rpc: {},
+    channel: {},
+    queue: {},
+    scheduler: {},
+    mcp: {},
+    cli: {},
+    workflow: {},
 };
 /**
  * Combines wiring-specific permissions with function-level permissions.
@@ -180,7 +122,7 @@ const combinedPermissionsCache = {
  * })
  * ```
  */
-export const combinePermissions = (wireType, uid, { wireInheritedPermissions, wirePermissions, funcInheritedPermissions, funcPermissions, } = {}) => {
+const combinePermissions = (wireType, uid, { wireInheritedPermissions, wirePermissions, funcInheritedPermissions, funcPermissions, packageName = null, } = {}) => {
     if (combinedPermissionsCache[wireType][uid]) {
         return combinedPermissionsCache[wireType][uid];
     }
@@ -190,7 +132,7 @@ export const combinePermissions = (wireType, uid, { wireInheritedPermissions, wi
         for (const meta of wireInheritedPermissions) {
             if (meta.type === 'http') {
                 // Look up HTTP permission group from pikkuState
-                const group = pikkuState('permissions', 'httpGroup')[meta.route];
+                const group = pikkuState(packageName, 'permissions', 'httpGroup')[meta.route];
                 if (group) {
                     if (Array.isArray(group)) {
                         resolved.push(...group);
@@ -202,7 +144,7 @@ export const combinePermissions = (wireType, uid, { wireInheritedPermissions, wi
             }
             else if (meta.type === 'tag') {
                 // Look up tag permission group from pikkuState
-                const group = pikkuState('permissions', 'tagGroup')[meta.tag];
+                const group = pikkuState(packageName, 'permissions', 'tagGroup')[meta.tag];
                 if (group) {
                     if (Array.isArray(group)) {
                         resolved.push(...group);
@@ -235,7 +177,7 @@ export const combinePermissions = (wireType, uid, { wireInheritedPermissions, wi
         for (const meta of funcInheritedPermissions) {
             if (meta.type === 'tag') {
                 // Look up tag permission group from pikkuState
-                const group = pikkuState('permissions', 'tagGroup')[meta.tag];
+                const group = pikkuState(packageName, 'permissions', 'tagGroup')[meta.tag];
                 if (group) {
                     if (Array.isArray(group)) {
                         resolved.push(...group);
@@ -265,26 +207,27 @@ export const combinePermissions = (wireType, uid, { wireInheritedPermissions, wi
  * Runs permission checks using combined permissions from all sources.
  * Combines permissions from wire and function levels, then validates them.
  */
-export const runPermissions = async (wireType, uid, { wireInheritedPermissions, wirePermissions, funcInheritedPermissions, funcPermissions, allServices, data, session, }) => {
+export const runPermissions = async (wireType, uid, { wireInheritedPermissions, wirePermissions, funcInheritedPermissions, funcPermissions, services, wire, data, packageName = null, }) => {
     // Combine all permissions: wireInheritedPermissions → wirePermissions → funcInheritedPermissions → funcPermissions
     const allPermissions = combinePermissions(wireType, uid, {
         wireInheritedPermissions,
         wirePermissions,
         funcInheritedPermissions,
         funcPermissions,
+        packageName,
     });
     // Check all combined permissions - at least one must pass if any exist
     if (allPermissions.length > 0) {
         let permissioned = false;
         for (const permission of allPermissions) {
-            const result = await verifyPermissions(typeof permission === 'function' ? { permission } : permission, allServices, data, session);
+            const result = await verifyPermissions(typeof permission === 'function' ? { permission } : permission, services, data, wire);
             if (result) {
                 permissioned = true;
                 // Continue executing all permissions (don't break early)
             }
         }
         if (!permissioned) {
-            allServices.logger.debug('Permission denied - combined permissions');
+            services.logger.debug('Permission denied - combined permissions');
             throw new ForbiddenError('Permission denied');
         }
     }