@pikku/core 0.11.2 → 0.12.0

package/dist/function/index.d.ts

@@ -1,2 +1,2 @@
-export * from './function-runner.js';
-export * from './functions.types.js';
+export { addFunction, getAllFunctionNames } from './function-runner.js';
+export type { CorePikkuFunction, CorePikkuFunctionSessionless, } from './functions.types.js';

package/dist/function/index.js

@@ -1,2 +1 @@
-export * from './function-runner.js';
-export * from './functions.types.js';
+export { addFunction, getAllFunctionNames } from './function-runner.js';

package/dist/handle-error.js

@@ -43,17 +43,8 @@ export const handleHTTPError = (e, http, trackerId, logger, logWarningsForStatus
             http?.response?.json({ errorId: trackerId });
         }
     }
-    // Handle 404 errors specifically
-    if (e instanceof NotFoundError) {
-        // TODO
-        // http?.response?.end()
-    }
-    // Either bubble up or end the response
     if (bubbleError) {
         throw e;
     }
-    else {
-        // TODO
-        // http?.response?.end()
-    }
+    http?.response?.close?.();
 };

package/dist/index.d.ts

@@ -1,32 +1,34 @@
 /**
  * @module @pikku/core
  */
-export * from './types/core.types.js';
-export * from './function/index.js';
-export * from './pikku-request.js';
-export * from './pikku-response.js';
-export * from './services/logger.js';
-export * from './services/schema-service.js';
-export * from './services/jwt-service.js';
-export * from './services/secret-service.js';
-export * from './services/user-session-service.js';
-export * from './services/scheduler-service.js';
-export * from './wirings/http/index.js';
-export * from './wirings/channel/index.js';
-export * from './wirings/scheduler/index.js';
-export * from './wirings/rpc/index.js';
-export * from './wirings/queue/index.js';
-export * from './wirings/workflow/index.js';
-export * from './wirings/workflow/graph/index.js';
-export * from './wirings/mcp/index.js';
-export * from './wirings/cli/index.js';
-export * from './wirings/forge-node/index.js';
-export * from './wirings/trigger/index.js';
-export * from './errors/index.js';
-export * from './middleware/index.js';
-export * from './utils.js';
-export * from './time-utils.js';
-export { pikkuState, initializePikkuState, resetPikkuState, addPackageServiceFactories, } from './pikku-state.js';
+export type { CommonWireMeta, CoreConfig, CorePikkuMiddleware, CorePikkuMiddlewareConfig, CorePikkuMiddlewareFactory, CorePikkuMiddlewareGroup, CoreServices, CoreSingletonServices, CoreUserSession, CreateConfig, CreateSingletonServices, CreateWireServices, FunctionMeta, FunctionRuntimeMeta, FunctionServicesMeta, FunctionWiresMeta, FunctionsMeta, FunctionsRuntimeMeta, JSONPrimitive, JSONValue, MakeRequired, MiddlewareMetadata, PermissionMetadata, PickOptional, PickRequired, PikkuAIMiddlewareHooks, PikkuWire, PikkuWiringTypes, RequireAtLeastOne, SerializedError, WireServices, } from './types/core.types.js';
+export { pikkuAIMiddleware, pikkuChannelMiddleware, pikkuChannelMiddlewareFactory, pikkuMiddleware, pikkuMiddlewareFactory, } from './types/core.types.js';
+export type { CorePikkuAuth, CorePikkuAuthConfig, CorePikkuFunction, CorePikkuFunctionConfig, CorePikkuPermission, CorePikkuPermissionConfig, CorePikkuPermissionFactory, CorePermissionGroup, ZodLike, } from './function/functions.types.js';
+export { pikkuAuth, pikkuPermission, pikkuPermissionFactory, } from './function/functions.types.js';
+export { addFunction, getAllFunctionNames } from './function/index.js';
+export { PikkuRequest } from './pikku-request.js';
+export { getRelativeTimeOffsetFromNow, parseDurationString, } from './time-utils.js';
+export type { RelativeTimeInput } from './time-utils.js';
+export { formatVersionedId, isVersionedId, parseVersionedId, } from './version.js';
+export { pikkuState, initializePikkuState, resetPikkuState, addPackageServiceFactories, getPikkuMetaDir, } from './pikku-state.js';
+export { runPikkuFunc } from './function/function-runner.js';
+export { runCLICommand, pikkuCLIRender } from './wirings/cli/cli-runner.js';
+export { fetch } from './wirings/http/http-runner.js';
+export { runMCPTool, runMCPResource, runMCPPrompt, } from './wirings/mcp/mcp-runner.js';
+export type { MCPToolResponse, MCPResourceResponse, MCPPromptResponse, } from './wirings/mcp/mcp.types.js';
+export { runQueueJob } from './wirings/queue/queue-runner.js';
+export { runScheduledTask } from './wirings/scheduler/scheduler-runner.js';
+export { NotFoundError } from './errors/errors.js';
+export type { EventHubService } from './wirings/channel/eventhub-service.js';
+export type { QueueService } from './wirings/queue/queue.types.js';
+export type { JWTService } from './services/jwt-service.js';
+export type { HTTPMethod } from './wirings/http/http.types.js';
+export type { GraphNodeConfig } from './wirings/workflow/graph/workflow-graph.types.js';
+export { createGraph } from './wirings/workflow/graph/graph-node.js';
+export { workflow as wireWorkflow } from './wirings/workflow/workflow-helpers.js';
 export type { PikkuPackageState } from './types/state.types.js';
 export { runMiddleware, addMiddleware } from './middleware-runner.js';
 export { addPermission } from './permissions.js';
+export { isSerializable, stopSingletonServices } from './utils.js';
+export { type ScheduledTaskInfo, type ScheduledTaskSummary, type SchedulerRuntimeHandlers, } from './services/scheduler-service.js';
+export { SchedulerService } from './services/scheduler-service.js';

package/dist/index.js

@@ -1,31 +1,20 @@
-/**
- * @module @pikku/core
- */
-export * from './types/core.types.js';
-export * from './function/index.js';
-export * from './pikku-request.js';
-export * from './pikku-response.js';
-export * from './services/logger.js';
-export * from './services/schema-service.js';
-export * from './services/jwt-service.js';
-export * from './services/secret-service.js';
-export * from './services/user-session-service.js';
-export * from './services/scheduler-service.js';
-export * from './wirings/http/index.js';
-export * from './wirings/channel/index.js';
-export * from './wirings/scheduler/index.js';
-export * from './wirings/rpc/index.js';
-export * from './wirings/queue/index.js';
-export * from './wirings/workflow/index.js';
-export * from './wirings/workflow/graph/index.js';
-export * from './wirings/mcp/index.js';
-export * from './wirings/cli/index.js';
-export * from './wirings/forge-node/index.js';
-export * from './wirings/trigger/index.js';
-export * from './errors/index.js';
-export * from './middleware/index.js';
-export * from './utils.js';
-export * from './time-utils.js';
-export { pikkuState, initializePikkuState, resetPikkuState, addPackageServiceFactories, } from './pikku-state.js';
+export { pikkuAIMiddleware, pikkuChannelMiddleware, pikkuChannelMiddlewareFactory, pikkuMiddleware, pikkuMiddlewareFactory, } from './types/core.types.js';
+export { pikkuAuth, pikkuPermission, pikkuPermissionFactory, } from './function/functions.types.js';
+export { addFunction, getAllFunctionNames } from './function/index.js';
+export { PikkuRequest } from './pikku-request.js';
+export { getRelativeTimeOffsetFromNow, parseDurationString, } from './time-utils.js';
+export { formatVersionedId, isVersionedId, parseVersionedId, } from './version.js';
+export { pikkuState, initializePikkuState, resetPikkuState, addPackageServiceFactories, getPikkuMetaDir, } from './pikku-state.js';
+export { runPikkuFunc } from './function/function-runner.js';
+export { runCLICommand, pikkuCLIRender } from './wirings/cli/cli-runner.js';
+export { fetch } from './wirings/http/http-runner.js';
+export { runMCPTool, runMCPResource, runMCPPrompt, } from './wirings/mcp/mcp-runner.js';
+export { runQueueJob } from './wirings/queue/queue-runner.js';
+export { runScheduledTask } from './wirings/scheduler/scheduler-runner.js';
+export { NotFoundError } from './errors/errors.js';
+export { createGraph } from './wirings/workflow/graph/graph-node.js';
+export { workflow as wireWorkflow } from './wirings/workflow/workflow-helpers.js';
 export { runMiddleware, addMiddleware } from './middleware-runner.js';
 export { addPermission } from './permissions.js';
+export { isSerializable, stopSingletonServices } from './utils.js';
+export { SchedulerService } from './services/scheduler-service.js';

package/dist/middleware/auth-apikey.d.ts

@@ -18,7 +18,7 @@
 export declare const authAPIKey: import("../types/core.types.js").CorePikkuMiddlewareFactory<{
     source: "header" | "query" | "all";
 }, import("../types/core.types.js").CoreSingletonServices<{
-    logLevel?: import("../index.js").LogLevel;
+    logLevel?: import("../services/logger.js").LogLevel;
     secrets?: {};
-    workflow?: import("../index.js").WorkflowServiceConfig;
+    workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
 }>, import("../types/core.types.js").CoreUserSession>;

package/dist/middleware/auth-apikey.js

@@ -16,8 +16,8 @@ import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js'
  * ])
  * ```
  */
-export const authAPIKey = pikkuMiddlewareFactory(({ source }) => pikkuMiddleware(async ({ jwt: jwtService }, { http, session: SessionService }, next) => {
-    if (!http?.request || !SessionService || SessionService.get()) {
+export const authAPIKey = pikkuMiddlewareFactory(({ source }) => pikkuMiddleware(async ({ jwt: jwtService }, { http, setSession, session }, next) => {
+    if (!http?.request || !setSession || session) {
         return next();
     }
     let apiKey = null;
@@ -30,7 +30,7 @@ export const authAPIKey = pikkuMiddlewareFactory(({ source }) => pikkuMiddleware
     if (apiKey && jwtService) {
         const userSession = await jwtService.decode(apiKey);
         if (userSession) {
-            SessionService.setInitial(userSession);
+            setSession?.(userSession);
         }
     }
     return next();

package/dist/middleware/auth-bearer.d.ts

@@ -34,7 +34,7 @@ export declare const authBearer: import("../types/core.types.js").CorePikkuMiddl
         userSession: CoreUserSession;
     };
 }, import("../types/core.types.js").CoreSingletonServices<{
-    logLevel?: import("../index.js").LogLevel;
+    logLevel?: import("../services/logger.js").LogLevel;
     secrets?: {};
-    workflow?: import("../index.js").WorkflowServiceConfig;
+    workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
 }>, CoreUserSession>;

package/dist/middleware/auth-bearer.js

@@ -29,9 +29,8 @@ import { pikkuMiddleware, pikkuMiddlewareFactory, } from '../types/core.types.js
  * ])
  * ```
  */
-export const authBearer = pikkuMiddlewareFactory(({ token } = {}) => pikkuMiddleware(async ({ jwt: jwtService }, { http, session }, next) => {
-    // Skip if session already exists.
-    if (!http?.request || !session || session.get()) {
+export const authBearer = pikkuMiddlewareFactory(({ token } = {}) => pikkuMiddleware(async ({ jwt: jwtService }, { http, setSession, session }, next) => {
+    if (!http?.request || !setSession || session) {
         return next();
     }
     const authHeader = http.request.header('authorization') ||
@@ -42,16 +41,14 @@ export const authBearer = pikkuMiddlewareFactory(({ token } = {}) => pikkuMiddle
             throw new InvalidSessionError();
         }
         let userSession = null;
-        // If static token provided, validate against it
         if (token && bearerToken === token.value) {
             userSession = token.userSession;
         }
-        // Otherwise, default to JWT decoding
         else if (jwtService && !token) {
             userSession = await jwtService.decode(bearerToken);
         }
         if (userSession) {
-            session.setInitial(userSession);
+            setSession?.(userSession);
         }
     }
     return next();

package/dist/middleware/auth-cookie.d.ts

@@ -33,7 +33,7 @@ export declare const authCookie: import("../types/core.types.js").CorePikkuMiddl
     options: SerializeOptions;
     expiresIn: RelativeTimeInput;
 }, import("../types/core.types.js").CoreSingletonServices<{
-    logLevel?: import("../index.js").LogLevel;
+    logLevel?: import("../services/logger.js").LogLevel;
     secrets?: {};
-    workflow?: import("../index.js").WorkflowServiceConfig;
+    workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
 }>, import("../types/core.types.js").CoreUserSession>;

package/dist/middleware/auth-cookie.js

@@ -28,27 +28,25 @@ import { getRelativeTimeOffsetFromNow, } from '../time-utils.js';
  * ])
  * ```
  */
-export const authCookie = pikkuMiddlewareFactory(({ name, options, expiresIn }) => pikkuMiddleware(async ({ jwt: jwtService, logger }, { http, session: SessionService }, next) => {
-    if (!http?.request || !SessionService || SessionService.get()) {
+export const authCookie = pikkuMiddlewareFactory(({ name, options, expiresIn }) => pikkuMiddleware(async ({ jwt: jwtService, logger }, { http, setSession, getSession, session, hasSessionChanged }, next) => {
+    if (!http?.request || !setSession || session) {
         return next();
     }
-    // Try to decode session from cookie
     const cookieValue = http.request.cookie(name);
     if (cookieValue && jwtService) {
         const userSession = await jwtService.decode(cookieValue);
         if (userSession) {
-            SessionService.setInitial(userSession);
+            setSession?.(userSession);
         }
     }
     await next();
-    // Set the cookie in the response if the session has changed
     if (!http?.response) {
         return;
     }
-    if (SessionService.sessionChanged) {
-        const session = SessionService.get();
+    if (hasSessionChanged?.()) {
+        const currentSession = await getSession?.();
         if (jwtService) {
-            http.response.cookie(name, await jwtService.encode(expiresIn, session), {
+            http.response.cookie(name, await jwtService.encode(expiresIn, currentSession), {
                 ...options,
                 expires: getRelativeTimeOffsetFromNow(expiresIn),
             });

package/dist/middleware/cors.d.ts

@@ -0,0 +1,46 @@
+/**
+ * CORS middleware that handles cross-origin requests including OPTIONS preflight.
+ *
+ * Sets appropriate CORS headers on all responses and short-circuits OPTIONS
+ * preflight requests with a 204 No Content response.
+ *
+ * @param options.origin - Allowed origin(s). Use `'*'` for any origin, a string for a single origin, or an array for multiple origins. Defaults to `'*'`.
+ * @param options.methods - Allowed HTTP methods. Defaults to common methods.
+ * @param options.headers - Allowed request headers. Defaults to common headers.
+ * @param options.credentials - Whether to allow credentials. Defaults to `false`.
+ * @param options.maxAge - Preflight cache duration in seconds. Defaults to `86400` (24 hours).
+ *
+ * @example
+ * ```typescript
+ * import { cors } from '@pikku/core/middleware'
+ *
+ * // Allow all origins
+ * addHTTPMiddleware('*', [cors()])
+ *
+ * // Specific origin with credentials
+ * addHTTPMiddleware('*', [
+ *   cors({
+ *     origin: 'https://app.example.com',
+ *     credentials: true,
+ *   })
+ * ])
+ *
+ * // Multiple origins
+ * addHTTPMiddleware('*', [
+ *   cors({
+ *     origin: ['https://app.example.com', 'https://admin.example.com'],
+ *   })
+ * ])
+ * ```
+ */
+export declare const cors: import("../types/core.types.js").CorePikkuMiddlewareFactory<{
+    origin?: string | string[];
+    methods?: string[];
+    headers?: string[];
+    credentials?: boolean;
+    maxAge?: number;
+}, import("../types/core.types.js").CoreSingletonServices<{
+    logLevel?: import("../services/logger.js").LogLevel;
+    secrets?: {};
+    workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
+}>, import("../types/core.types.js").CoreUserSession>;

package/dist/middleware/cors.js

@@ -0,0 +1,73 @@
+import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js';
+/**
+ * CORS middleware that handles cross-origin requests including OPTIONS preflight.
+ *
+ * Sets appropriate CORS headers on all responses and short-circuits OPTIONS
+ * preflight requests with a 204 No Content response.
+ *
+ * @param options.origin - Allowed origin(s). Use `'*'` for any origin, a string for a single origin, or an array for multiple origins. Defaults to `'*'`.
+ * @param options.methods - Allowed HTTP methods. Defaults to common methods.
+ * @param options.headers - Allowed request headers. Defaults to common headers.
+ * @param options.credentials - Whether to allow credentials. Defaults to `false`.
+ * @param options.maxAge - Preflight cache duration in seconds. Defaults to `86400` (24 hours).
+ *
+ * @example
+ * ```typescript
+ * import { cors } from '@pikku/core/middleware'
+ *
+ * // Allow all origins
+ * addHTTPMiddleware('*', [cors()])
+ *
+ * // Specific origin with credentials
+ * addHTTPMiddleware('*', [
+ *   cors({
+ *     origin: 'https://app.example.com',
+ *     credentials: true,
+ *   })
+ * ])
+ *
+ * // Multiple origins
+ * addHTTPMiddleware('*', [
+ *   cors({
+ *     origin: ['https://app.example.com', 'https://admin.example.com'],
+ *   })
+ * ])
+ * ```
+ */
+export const cors = pikkuMiddlewareFactory(({ origin = '*', methods = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'], headers = ['Content-Type', 'Authorization', 'x-api-key'], credentials = false, maxAge = 86400, } = {}) => pikkuMiddleware({
+    name: 'CORS',
+    description: 'Handles cross-origin requests including OPTIONS preflight',
+    func: async (_services, wires, next) => {
+        const request = wires.http?.request;
+        const response = wires.http?.response;
+        if (!request || !response) {
+            return next();
+        }
+        const requestOrigin = request.header('origin');
+        let allowedOrigin;
+        if (Array.isArray(origin)) {
+            allowedOrigin =
+                requestOrigin && origin.includes(requestOrigin)
+                    ? requestOrigin
+                    : origin[0];
+        }
+        else {
+            allowedOrigin = origin;
+        }
+        response.header('Access-Control-Allow-Origin', allowedOrigin);
+        response.header('Access-Control-Allow-Methods', methods.join(', '));
+        response.header('Access-Control-Allow-Headers', headers.join(', '));
+        if (credentials) {
+            response.header('Access-Control-Allow-Credentials', 'true');
+        }
+        if (Array.isArray(origin)) {
+            response.header('Vary', 'Origin');
+        }
+        if (request.method() === 'options') {
+            response.header('Access-Control-Max-Age', String(maxAge));
+            response.status(204).json(undefined);
+            return;
+        }
+        return next();
+    },
+}));

package/dist/middleware/index.d.ts

@@ -1,3 +1,5 @@
-export * from './auth-apikey.js';
-export * from './auth-cookie.js';
-export * from './auth-bearer.js';
+export { authAPIKey } from './auth-apikey.js';
+export { authCookie } from './auth-cookie.js';
+export { authBearer } from './auth-bearer.js';
+export { pikkuRemoteAuthMiddleware } from './remote-auth.js';
+export { cors } from './cors.js';

package/dist/middleware/index.js

@@ -1,3 +1,5 @@
-export * from './auth-apikey.js';
-export * from './auth-cookie.js';
-export * from './auth-bearer.js';
+export { authAPIKey } from './auth-apikey.js';
+export { authCookie } from './auth-cookie.js';
+export { authBearer } from './auth-bearer.js';
+export { pikkuRemoteAuthMiddleware } from './remote-auth.js';
+export { cors } from './cors.js';

package/dist/middleware/remote-auth.d.ts

@@ -0,0 +1,5 @@
+export declare const pikkuRemoteAuthMiddleware: import("../types/core.types.js").CorePikkuMiddleware<import("../types/core.types.js").CoreSingletonServices<{
+    logLevel?: import("../services/logger.js").LogLevel;
+    secrets?: {};
+    workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
+}>, import("../types/core.types.js").CoreUserSession>;

package/dist/middleware/remote-auth.js

@@ -0,0 +1,55 @@
+import { UnauthorizedError } from '../errors/errors.js';
+import { pikkuMiddleware } from '../types/core.types.js';
+import { decryptJSON } from '../crypto-utils.js';
+export const pikkuRemoteAuthMiddleware = pikkuMiddleware(async ({ secrets, jwt }, { http, setSession }, next) => {
+    if (!http?.request || !secrets) {
+        return next();
+    }
+    let secret;
+    try {
+        secret = await secrets.getSecret('PIKKU_REMOTE_SECRET');
+    }
+    catch {
+        return next();
+    }
+    if (!jwt) {
+        throw new Error('PIKKU_REMOTE_SECRET set but JWT service missing');
+    }
+    const authHeader = http.request.header('authorization') ||
+        http.request.header('Authorization');
+    if (!authHeader) {
+        throw new UnauthorizedError();
+    }
+    const [scheme, token] = authHeader.split(' ');
+    if (scheme !== 'Bearer' || !token) {
+        throw new UnauthorizedError();
+    }
+    let payload;
+    try {
+        payload = await jwt.decode(token);
+    }
+    catch {
+        throw new UnauthorizedError();
+    }
+    if (payload?.aud !== 'pikku-remote') {
+        throw new UnauthorizedError();
+    }
+    if (payload?.fn && http.request.path().startsWith('/rpc/')) {
+        const fn = decodeURIComponent(http.request.path().slice('/rpc/'.length));
+        if (fn && payload.fn !== fn) {
+            throw new UnauthorizedError();
+        }
+    }
+    if (payload?.session) {
+        try {
+            const decrypted = await decryptJSON(secret, payload.session);
+            if (decrypted?.session && setSession) {
+                await setSession(decrypted.session);
+            }
+        }
+        catch {
+            throw new UnauthorizedError();
+        }
+    }
+    return next();
+});

package/dist/middleware/timeout.d.ts

@@ -1,7 +1,7 @@
 export declare const timeout: () => import("../types/core.types.js").CorePikkuMiddlewareFactory<{
     timeout: number;
 }, import("../types/core.types.js").CoreSingletonServices<{
-    logLevel?: import("../index.js").LogLevel;
+    logLevel?: import("../services/logger.js").LogLevel;
     secrets?: {};
-    workflow?: import("../index.js").WorkflowServiceConfig;
+    workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
 }>, import("../types/core.types.js").CoreUserSession>;

package/dist/middleware-runner.js

@@ -1,5 +1,5 @@
 import { pikkuState } from './pikku-state.js';
-import { freezeDedupe } from './utils.js';
+import { freezeDedupe, getTagGroups } from './utils.js';
 /**
  * Runs a chain of middleware functions in sequence before executing the main function.
  *
@@ -75,7 +75,7 @@ export const addMiddleware = (tag, middleware, packageName = null) => {
  * This function looks up middleware that was registered with registerMiddleware.
  * It's used internally by the framework to resolve middleware references in metadata.
  *
- * @param {string} name - The unique name (pikkuFuncName) of the middleware function.
+ * @param {string} name - The unique name (pikkuFuncId) of the middleware function.
  * @returns {CorePikkuMiddleware | undefined} The middleware function, or undefined if not found.
  *
  * @internal
@@ -91,7 +91,9 @@ const middlewareCache = {
     channel: {},
     queue: {},
     scheduler: {},
+    trigger: {},
     mcp: {},
+    agent: {},
     cli: {},
     workflow: {},
 };
@@ -134,10 +136,8 @@ export const combineMiddleware = (wireType, uid, { wireInheritedMiddleware, wire
                 }
             }
             else if (meta.type === 'tag') {
-                // Look up tag middleware group from pikkuState
-                const group = pikkuState(packageName, 'middleware', 'tagGroup')[meta.tag];
-                if (group) {
-                    // At runtime, all factories should be resolved to middleware
+                const groups = getTagGroups(pikkuState(packageName, 'middleware', 'tagGroup'), meta.tag);
+                for (const group of groups) {
                     resolved.push(...group);
                 }
             }
@@ -158,10 +158,8 @@ export const combineMiddleware = (wireType, uid, { wireInheritedMiddleware, wire
     if (funcInheritedMiddleware) {
         for (const meta of funcInheritedMiddleware) {
             if (meta.type === 'tag') {
-                // Look up tag middleware group from pikkuState
-                const group = pikkuState(packageName, 'middleware', 'tagGroup')[meta.tag];
-                if (group) {
-                    // At runtime, all factories should be resolved to middleware
+                const groups = getTagGroups(pikkuState(packageName, 'middleware', 'tagGroup'), meta.tag);
+                for (const group of groups) {
                     resolved.push(...group);
                 }
             }

package/dist/permissions.js

@@ -1,6 +1,6 @@
 import { pikkuState } from './pikku-state.js';
 import { ForbiddenError } from './errors/errors.js';
-import { freezeDedupe } from './utils.js';
+import { freezeDedupe, getTagGroups } from './utils.js';
 /**
  * This function validates permissions by iterating over permission groups and executing the corresponding permission functions. If all functions in at least one group return true, the permission is considered valid.
  * @param services - The core services required for permission validation.
@@ -39,7 +39,7 @@ const verifyPermissions = async (permissions, services, data, wire) => {
  * This function looks up permissions that was registered with registerPermission.
  * It's used internally by the framework to resolve permission references in metadata.
  *
- * @param {string} name - The unique name (pikkuFuncName) of the permission function.
+ * @param {string} name - The unique name (pikkuFuncId) of the permission function.
  * @returns {CorePikkuPermission | undefined} The permission function, or undefined if not found.
  *
  * @internal
@@ -94,7 +94,9 @@ const combinedPermissionsCache = {
     channel: {},
     queue: {},
     scheduler: {},
+    trigger: {},
     mcp: {},
+    agent: {},
     cli: {},
     workflow: {},
 };
@@ -143,9 +145,8 @@ const combinePermissions = (wireType, uid, { wireInheritedPermissions, wirePermi
                 }
             }
             else if (meta.type === 'tag') {
-                // Look up tag permission group from pikkuState
-                const group = pikkuState(packageName, 'permissions', 'tagGroup')[meta.tag];
-                if (group) {
+                const groups = getTagGroups(pikkuState(packageName, 'permissions', 'tagGroup'), meta.tag);
+                for (const group of groups) {
                     if (Array.isArray(group)) {
                         resolved.push(...group);
                     }
@@ -176,9 +177,8 @@ const combinePermissions = (wireType, uid, { wireInheritedPermissions, wirePermi
     if (funcInheritedPermissions) {
         for (const meta of funcInheritedPermissions) {
             if (meta.type === 'tag') {
-                // Look up tag permission group from pikkuState
-                const group = pikkuState(packageName, 'permissions', 'tagGroup')[meta.tag];
-                if (group) {
+                const groups = getTagGroups(pikkuState(packageName, 'permissions', 'tagGroup'), meta.tag);
+                for (const group of groups) {
                     if (Array.isArray(group)) {
                         resolved.push(...group);
                     }
@@ -218,17 +218,13 @@ export const runPermissions = async (wireType, uid, { wireInheritedPermissions,
     });
     // Check all combined permissions - at least one must pass if any exist
     if (allPermissions.length > 0) {
-        let permissioned = false;
         for (const permission of allPermissions) {
             const result = await verifyPermissions(typeof permission === 'function' ? { permission } : permission, services, data, wire);
             if (result) {
-                permissioned = true;
-                // Continue executing all permissions (don't break early)
+                return;
             }
         }
-        if (!permissioned) {
-            services.logger.debug('Permission denied - combined permissions');
-            throw new ForbiddenError('Permission denied');
-        }
+        services.logger.debug('Permission denied - combined permissions');
+        throw new ForbiddenError('Permission denied');
     }
 };

package/dist/pikku-state.d.ts

@@ -24,6 +24,7 @@ export declare const pikkuState: <Type extends keyof PikkuPackageState, Content
  */
 export declare const initializePikkuState: (packageName: string) => void;
 export declare const resetPikkuState: () => void;
+export declare const getPikkuMetaDir: (packageName?: string | null) => string | null;
 /**
  * Register service factories for an external package.
  * These factories are used to create services when the package's functions are invoked.