@pikku/core 0.9.10 → 0.9.12-next.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 ## 0.9.0
 
+## 0.9.12-next.0
+
+### Patch Changes
+
+- feat: running @pikku/cli using pikku
+
+## 0.9.11
+
+### Patch Changes
+
+- 6ee87c1: fix: local content server name slashes
+
 ## 0.9.10
 
 ### Patch Changes

package/dist/function/function-runner.d.ts

@@ -1,13 +1,18 @@
-import { CoreServices, CoreUserSession, CorePikkuMiddleware, PikkuWiringTypes } from '../types/core.types.js';
-import { CorePermissionGroup, CorePikkuFunction, CorePikkuFunctionConfig, CorePikkuFunctionSessionless } from './functions.types.js';
-export declare const addFunction: (funcName: string, funcConfig: CorePikkuFunctionConfig<any, any> | CorePikkuFunctionSessionless<any, any> | CorePikkuFunction<any, any>) => void;
+import { CoreServices, CoreUserSession, CorePikkuMiddleware, PikkuWiringTypes, CoreSingletonServices, PikkuInteraction, MiddlewareMetadata } from '../types/core.types.js';
+import { CorePermissionGroup, CorePikkuFunctionConfig } from './functions.types.js';
+import { UserSessionService } from '../services/user-session-service.js';
+export declare const addFunction: (funcName: string, funcConfig: CorePikkuFunctionConfig<any, any>) => void;
 export declare const runPikkuFuncDirectly: <In, Out>(funcName: string, allServices: CoreServices, data: In, session?: CoreUserSession) => Promise<Out>;
-export declare const runPikkuFunc: <In = any, Out = any>(wireType: PikkuWiringTypes, wireId: string, funcName: string, { getAllServices, data, session, permissions: wiringPermissions, middleware: wiringMiddleware, coerceDataFromSchema, tags, }: {
-    getAllServices: () => Promise<CoreServices> | CoreServices;
-    data: In;
-    session?: CoreUserSession;
+export declare const runPikkuFunc: <In = any, Out = any>(wireType: PikkuWiringTypes, wireId: string, funcName: string, { getAllServices, singletonServices, data, userSession, auth: wiringAuth, permissions: wiringPermissions, inheritedMiddleware, wireMiddleware, coerceDataFromSchema, tags, interaction, }: {
+    singletonServices: CoreSingletonServices;
+    getAllServices: (session?: CoreUserSession) => Promise<CoreServices> | CoreServices;
+    userSession?: UserSessionService<CoreUserSession>;
+    data: () => Promise<In> | In;
+    auth?: boolean;
     permissions?: CorePermissionGroup;
-    middleware?: CorePikkuMiddleware[];
+    inheritedMiddleware?: MiddlewareMetadata[];
+    wireMiddleware?: CorePikkuMiddleware[];
     coerceDataFromSchema?: boolean;
     tags?: string[];
+    interaction: PikkuInteraction;
 }) => Promise<Out>;

package/dist/function/function-runner.js

@@ -1,12 +1,9 @@
-import { ForbiddenError } from '../errors/errors.js';
 import { runMiddleware, combineMiddleware } from '../middleware-runner.js';
 import { runPermissions } from '../permissions.js';
 import { pikkuState } from '../pikku-state.js';
 import { coerceTopLevelDataFromSchema, validateSchema } from '../schema.js';
+import { ForbiddenError } from '../errors/errors.js';
 export const addFunction = (funcName, funcConfig) => {
-    if (funcConfig instanceof Function) {
-        funcConfig = { func: funcConfig };
-    }
     pikkuState('function', 'functions').set(funcName, funcConfig);
 };
 export const runPikkuFuncDirectly = async (funcName, allServices, data, session) => {
@@ -16,7 +13,7 @@ export const runPikkuFuncDirectly = async (funcName, allServices, data, session)
     }
     return (await funcConfig.func(allServices, data, session));
 };
-export const runPikkuFunc = async (wireType, wireId, funcName, { getAllServices, data, session, permissions: wiringPermissions, middleware: wiringMiddleware, coerceDataFromSchema, tags = [], }) => {
+export const runPikkuFunc = async (wireType, wireId, funcName, { getAllServices, singletonServices, data, userSession, auth: wiringAuth, permissions: wiringPermissions, inheritedMiddleware, wireMiddleware, coerceDataFromSchema, tags = [], interaction, }) => {
     const funcConfig = pikkuState('function', 'functions').get(funcName);
     if (!funcConfig) {
         throw new Error(`Function not found: ${funcName}`);
@@ -25,42 +22,57 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { getAllServices,
     if (!funcMeta) {
         throw new Error(`Function meta not found: ${funcName}`);
     }
-    if (funcConfig.auth && !session) {
-        throw new ForbiddenError(`Function ${funcName} requires authentication even though transport does not`);
-    }
-    const allServices = await getAllServices();
-    const inputSchemaName = funcMeta.inputSchemaName;
-    if (inputSchemaName) {
-        // Validate request data against the defined schema, if any
-        await validateSchema(allServices.logger, allServices.schema, inputSchemaName, data);
-        // Coerce (top level) query string parameters or date objects if specified by the schema
-        if (coerceDataFromSchema) {
-            coerceTopLevelDataFromSchema(inputSchemaName, data);
+    // Helper function to run permissions and execute the function
+    const executeFunction = async () => {
+        const session = userSession?.get();
+        if (wiringAuth === true || funcConfig.auth === true) {
+            // This means it was explicitly enabled in either wiring or function and has to be respected
+            if (!session) {
+                throw new ForbiddenError('Authentication required');
+            }
         }
-    }
-    // Run permission checks in the specified order
-    await runPermissions(wireType, wireId, {
-        wiringTags: tags,
-        wiringPermissions,
-        funcTags: funcConfig.tags,
-        funcPermissions: funcConfig.permissions,
-        allServices,
-        data,
-        session,
-    });
-    // Combine all middleware: wiring tags → wiring middleware → func middleware → func tags
+        if (wiringAuth === undefined && funcConfig.auth === undefined) {
+            // We always default to requiring auth unless explicitly disabled
+            if (!session) {
+                throw new ForbiddenError('Authentication required');
+            }
+        }
+        // Evaluate the data from the lazy function
+        const actualData = await data();
+        // Validate and coerce data if schema is defined
+        const inputSchemaName = funcMeta.inputSchemaName;
+        if (inputSchemaName) {
+            // Validate request data against the defined schema, if any
+            await validateSchema(singletonServices.logger, singletonServices.schema, inputSchemaName, actualData);
+            // Coerce (top level) query string parameters or date objects if specified by the schema
+            if (coerceDataFromSchema) {
+                coerceTopLevelDataFromSchema(inputSchemaName, actualData);
+            }
+        }
+        const allServices = await getAllServices(session);
+        await runPermissions(wireType, wireId, {
+            wiringTags: tags,
+            wiringPermissions,
+            funcTags: funcConfig.tags,
+            funcPermissions: funcConfig.permissions,
+            allServices,
+            data: actualData,
+            session,
+        });
+        return await funcConfig.func(allServices, actualData, session);
+    };
+    // Combine all middleware: inheritedMiddleware → wireMiddleware → funcMiddleware
     const allMiddleware = combineMiddleware(wireType, wireId, {
-        wiringTags: tags,
-        wiringMiddleware,
+        wireInheritedMiddleware: inheritedMiddleware,
+        wireMiddleware,
+        funcInheritedMiddleware: funcMeta.middleware,
         funcMiddleware: funcConfig.middleware,
-        funcTags: funcConfig.tags,
     });
     if (allMiddleware.length > 0) {
-        return (await runMiddleware(allServices, {
-            http: allServices.http,
-            mcp: allServices.mcp,
-            rpc: allServices.rpc,
-        }, allMiddleware, async () => await funcConfig.func(allServices, data, session)));
+        return (await runMiddleware({
+            ...singletonServices,
+            userSession,
+        }, interaction, allMiddleware, executeFunction));
     }
-    return (await funcConfig.func(allServices, data, session));
+    return (await executeFunction());
 };

package/dist/index.d.ts

@@ -16,15 +16,17 @@ export * from './wirings/scheduler/index.js';
 export * from './wirings/rpc/index.js';
 export * from './wirings/queue/index.js';
 export * from './wirings/mcp/index.js';
+export * from './wirings/cli/index.js';
 export * from './errors/index.js';
 export * from './middleware/index.js';
 export * from './utils.js';
 export * from './time-utils.js';
 export { pikkuState } from './pikku-state.js';
-export { addMiddleware, runMiddleware } from './middleware-runner.js';
+export { runMiddleware, registerMiddleware, getMiddlewareByName, addMiddleware, } from './middleware-runner.js';
 export { addPermission } from './permissions.js';
 export { wireHTTP, addHTTPMiddleware } from './wirings/http/http-runner.js';
 export { wireChannel } from './wirings/channel/channel-runner.js';
 export { wireScheduler } from './wirings/scheduler/scheduler-runner.js';
 export { wireQueueWorker } from './wirings/queue/queue-runner.js';
 export { wireMCPResource, wireMCPTool, wireMCPPrompt, runMCPResource, runMCPTool, runMCPPrompt, getMCPTools, getMCPResources, getMCPPrompts, getMCPResourcesMeta, getMCPToolsMeta, getMCPPromptsMeta, } from './wirings/mcp/mcp-runner.js';
+export { wireCLI, runCLICommand } from './wirings/cli/cli-runner.js';

package/dist/index.js

@@ -16,15 +16,17 @@ export * from './wirings/scheduler/index.js';
 export * from './wirings/rpc/index.js';
 export * from './wirings/queue/index.js';
 export * from './wirings/mcp/index.js';
+export * from './wirings/cli/index.js';
 export * from './errors/index.js';
 export * from './middleware/index.js';
 export * from './utils.js';
 export * from './time-utils.js';
 export { pikkuState } from './pikku-state.js';
-export { addMiddleware, runMiddleware } from './middleware-runner.js';
+export { runMiddleware, registerMiddleware, getMiddlewareByName, addMiddleware, } from './middleware-runner.js';
 export { addPermission } from './permissions.js';
 export { wireHTTP, addHTTPMiddleware } from './wirings/http/http-runner.js';
 export { wireChannel } from './wirings/channel/channel-runner.js';
 export { wireScheduler } from './wirings/scheduler/scheduler-runner.js';
 export { wireQueueWorker } from './wirings/queue/queue-runner.js';
 export { wireMCPResource, wireMCPTool, wireMCPPrompt, runMCPResource, runMCPTool, runMCPPrompt, getMCPTools, getMCPResources, getMCPPrompts, getMCPResourcesMeta, getMCPToolsMeta, getMCPPromptsMeta, } from './wirings/mcp/mcp-runner.js';
+export { wireCLI, runCLICommand } from './wirings/cli/cli-runner.js';

package/dist/middleware-runner.d.ts

@@ -1,5 +1,5 @@
 import { UserSessionService } from './services/user-session-service.js';
-import { CoreSingletonServices, PikkuInteraction, CorePikkuMiddleware, PikkuWiringTypes } from './types/core.types.js';
+import { CoreSingletonServices, PikkuInteraction, CorePikkuMiddleware, CorePikkuMiddlewareGroup, PikkuWiringTypes, MiddlewareMetadata } from './types/core.types.js';
 /**
  * Runs a chain of middleware functions in sequence before executing the main function.
  *
@@ -21,73 +21,94 @@ export declare const runMiddleware: <Middleware extends CorePikkuMiddleware>(ser
     userSession?: UserSessionService<any>;
 }, interaction: PikkuInteraction, middlewares: readonly Middleware[], main?: () => Promise<unknown>) => Promise<unknown>;
 /**
- * Adds global middleware for a specific tag.
+ * Registers global middleware for a specific tag.
  *
- * This function allows you to register middleware that will be applied to
- * any wiring (HTTP, Channel, Queue, Scheduler, MCP) that includes the matching tag.
+ * This function registers middleware at runtime that will be applied to
+ * any wiring (HTTP, Channel, Queue, Scheduler, MCP, CLI) that includes the matching tag.
+ *
+ * For tree-shaking benefits, wrap in a factory function:
+ * `export const x = () => addMiddleware('tag', [...])`
+ *
+ * Accepts an array that can contain:
+ * - Direct middleware functions (CorePikkuMiddleware)
+ * - Factory middleware functions (CorePikkuMiddlewareFactory)
  *
  * @template PikkuMiddleware The middleware type.
  * @param {string} tag - The tag that the middleware should apply to.
- * @param {PikkuMiddleware[]} middleware - The middleware array to apply for the specified tag.
+ * @param {CorePikkuMiddlewareGroup} middleware - Array of middleware for this tag.
  *
- * @throws {Error} If middleware for the tag already exists.
+ * @returns {CorePikkuMiddlewareGroup} The middleware array (for chaining/wrapping).
  *
  * @example
  * ```typescript
- * // Add admin middleware for admin endpoints
- * addMiddleware('admin', [adminMiddleware])
+ * // Recommended: tree-shakeable
+ * export const adminMiddleware = () => addMiddleware('admin', [
+ *   authMiddleware,
+ *   loggingMiddleware({ level: 'info' })
+ * ])
  *
- * // Add authentication middleware for auth endpoints
- * addMiddleware('auth', [authMiddleware])
- *
- * // Add logging middleware for all API endpoints
- * addMiddleware('api', [loggingMiddleware])
+ * // Also works: no tree-shaking
+ * export const apiMiddleware = addMiddleware('api', [
+ *   rateLimitMiddleware
+ * ])
  * ```
  */
-export declare const addMiddleware: <PikkuMiddleware extends CorePikkuMiddleware>(tag: string, middleware: PikkuMiddleware[]) => void;
+export declare const addMiddleware: <PikkuMiddleware extends CorePikkuMiddleware>(tag: string, middleware: CorePikkuMiddlewareGroup) => CorePikkuMiddlewareGroup;
 /**
- * Retrieves middleware for a given set of tags.
+ * Registers a single middleware function by name in the global middleware store.
  *
- * This function looks up all middleware registered for any of the provided tags
- * and returns them as a flattened array.
+ * This function is used by CLI-generated code to register middleware functions
+ * that can be referenced by name in metadata. It stores middleware in a special
+ * namespace to avoid conflicts with tag-based middleware.
  *
- * @param {string[]} tags - Array of tags to look up middleware for.
- * @returns {CorePikkuMiddleware[]} Array of middleware functions that apply to the given tags.
+ * @param {string} name - The unique name (pikkuFuncName) of the middleware function.
+ * @param {CorePikkuMiddleware} middleware - The middleware function to register.
  *
  * @example
  * ```typescript
- * // Get all middleware for tags 'api' and 'auth'
- * const middleware = getMiddlewareForTags(['api', 'auth'])
+ * // Called by CLI-generated pikku-middleware.gen.ts
+ * registerMiddleware('authMiddleware_src_middleware_ts_10_5', authMiddleware)
+ * registerMiddleware('loggingMiddleware_src_middleware_ts_20_10', loggingMiddleware)
  * ```
  */
-export declare const getMiddlewareForTags: (tags?: string[]) => CorePikkuMiddleware[];
+export declare const registerMiddleware: (name: string, middleware: CorePikkuMiddleware) => void;
+/**
+ * Retrieves a registered middleware function by its name.
+ *
+ * This function looks up middleware that was registered with registerMiddleware.
+ * It's used internally by the framework to resolve middleware references in metadata.
+ *
+ * @param {string} name - The unique name (pikkuFuncName) of the middleware function.
+ * @returns {CorePikkuMiddleware | undefined} The middleware function, or undefined if not found.
+ *
+ * @internal
+ */
+export declare const getMiddlewareByName: (name: string) => CorePikkuMiddleware | undefined;
 /**
- * Combines tag-based middleware with wiring-specific middleware and function-level middleware.
+ * Combines wiring-specific middleware with function-level middleware.
  *
- * This helper function gets middleware for tags and combines it with any
- * wiring-specific middleware and function-level middleware, avoiding the need for manual spreading.
+ * This function resolves middleware metadata into actual middleware functions and combines them.
+ * It filters out wire middleware without tags from inheritedMiddleware to avoid duplication
+ * (those are passed separately as wireMiddleware).
  *
  * @param {object} options - Configuration object for combining middleware.
- * @param {CorePikkuMiddleware[] | undefined} options.wiringMiddleware - Wiring-specific middleware.
- * @param {string[] | undefined} options.wiringTags - Array of wiring-level tags to look up middleware for.
- * @param {CorePikkuMiddleware[] | undefined} options.funcMiddleware - Function-level middleware.
- * @param {string[] | undefined} options.funcTags - Array of function-level tags to look up middleware for.
- * @returns {CorePikkuMiddleware[]} Combined array of tag-based and wiring-specific middleware.
+ * @param {MiddlewareMetadata[] | undefined} options.inheritedMiddleware - Metadata from wiring (HTTP + tags + wire with tags).
+ * @param {CorePikkuMiddleware[] | undefined} options.wireMiddleware - Inline wire middleware.
+ * @param {MiddlewareMetadata[] | undefined} options.funcMiddleware - Function middleware metadata.
+ * @returns {CorePikkuMiddleware[]} Combined array of resolved middleware.
  *
  * @example
  * ```typescript
- * const combined = combineMiddleware({
- *   wiringMiddleware: httpRoute.middleware,
- *   wiringTags: httpRoute.tags,
- *   funcMiddleware: funcConfig.middleware,
- *   funcTags: funcConfig.tags
+ * const combined = combineMiddleware(wireType, wireId, {
+ *   inheritedMiddleware: meta.middleware,
+ *   wireMiddleware: [inlineMiddleware],
+ *   funcMiddleware: funcMeta.middleware
  * })
  * ```
  */
-export declare const combineMiddleware: (wireType: PikkuWiringTypes, uid: string, { httpMiddleware, wiringMiddleware, wiringTags, funcMiddleware, funcTags, }?: {
-    httpMiddleware?: CorePikkuMiddleware[];
-    wiringMiddleware?: CorePikkuMiddleware[];
-    wiringTags?: string[];
+export declare const combineMiddleware: (wireType: PikkuWiringTypes, uid: string, { wireInheritedMiddleware, wireMiddleware, funcInheritedMiddleware, funcMiddleware, }?: {
+    wireInheritedMiddleware?: MiddlewareMetadata[];
+    wireMiddleware?: CorePikkuMiddleware[];
+    funcInheritedMiddleware?: MiddlewareMetadata[];
     funcMiddleware?: CorePikkuMiddleware[];
-    funcTags?: string[];
 }) => readonly CorePikkuMiddleware[];

package/dist/middleware-runner.js

@@ -33,66 +33,79 @@ export const runMiddleware = async (services, interaction, middlewares, main) =>
     return result;
 };
 /**
- * Adds global middleware for a specific tag.
+ * Registers global middleware for a specific tag.
  *
- * This function allows you to register middleware that will be applied to
- * any wiring (HTTP, Channel, Queue, Scheduler, MCP) that includes the matching tag.
+ * This function registers middleware at runtime that will be applied to
+ * any wiring (HTTP, Channel, Queue, Scheduler, MCP, CLI) that includes the matching tag.
+ *
+ * For tree-shaking benefits, wrap in a factory function:
+ * `export const x = () => addMiddleware('tag', [...])`
+ *
+ * Accepts an array that can contain:
+ * - Direct middleware functions (CorePikkuMiddleware)
+ * - Factory middleware functions (CorePikkuMiddlewareFactory)
  *
  * @template PikkuMiddleware The middleware type.
  * @param {string} tag - The tag that the middleware should apply to.
- * @param {PikkuMiddleware[]} middleware - The middleware array to apply for the specified tag.
+ * @param {CorePikkuMiddlewareGroup} middleware - Array of middleware for this tag.
  *
- * @throws {Error} If middleware for the tag already exists.
+ * @returns {CorePikkuMiddlewareGroup} The middleware array (for chaining/wrapping).
  *
  * @example
  * ```typescript
- * // Add admin middleware for admin endpoints
- * addMiddleware('admin', [adminMiddleware])
- *
- * // Add authentication middleware for auth endpoints
- * addMiddleware('auth', [authMiddleware])
+ * // Recommended: tree-shakeable
+ * export const adminMiddleware = () => addMiddleware('admin', [
+ *   authMiddleware,
+ *   loggingMiddleware({ level: 'info' })
+ * ])
  *
- * // Add logging middleware for all API endpoints
- * addMiddleware('api', [loggingMiddleware])
+ * // Also works: no tree-shaking
+ * export const apiMiddleware = addMiddleware('api', [
+ *   rateLimitMiddleware
+ * ])
  * ```
  */
 export const addMiddleware = (tag, middleware) => {
-    const middlewareStore = pikkuState('misc', 'middleware');
-    // Check if tag already exists
-    if (middlewareStore[tag]) {
-        throw new Error(`Middleware for tag '${tag}' already exists. Use a different tag or remove the existing middleware first.`);
-    }
-    middlewareStore[tag] = middleware;
+    const tagGroups = pikkuState('middleware', 'tagGroup');
+    tagGroups[tag] = middleware;
+    return middleware;
 };
 /**
- * Retrieves middleware for a given set of tags.
+ * Registers a single middleware function by name in the global middleware store.
  *
- * This function looks up all middleware registered for any of the provided tags
- * and returns them as a flattened array.
+ * This function is used by CLI-generated code to register middleware functions
+ * that can be referenced by name in metadata. It stores middleware in a special
+ * namespace to avoid conflicts with tag-based middleware.
  *
- * @param {string[]} tags - Array of tags to look up middleware for.
- * @returns {CorePikkuMiddleware[]} Array of middleware functions that apply to the given tags.
+ * @param {string} name - The unique name (pikkuFuncName) of the middleware function.
+ * @param {CorePikkuMiddleware} middleware - The middleware function to register.
  *
  * @example
  * ```typescript
- * // Get all middleware for tags 'api' and 'auth'
- * const middleware = getMiddlewareForTags(['api', 'auth'])
+ * // Called by CLI-generated pikku-middleware.gen.ts
+ * registerMiddleware('authMiddleware_src_middleware_ts_10_5', authMiddleware)
+ * registerMiddleware('loggingMiddleware_src_middleware_ts_20_10', loggingMiddleware)
  * ```
  */
-export const getMiddlewareForTags = (tags) => {
-    if (!tags || tags.length === 0) {
-        return [];
-    }
+export const registerMiddleware = (name, middleware) => {
     const middlewareStore = pikkuState('misc', 'middleware');
-    const applicableMiddleware = [];
-    // Collect middleware for all matching tags
-    for (const tag of tags) {
-        const tagMiddleware = middlewareStore[tag];
-        if (tagMiddleware) {
-            applicableMiddleware.push(...tagMiddleware);
-        }
-    }
-    return applicableMiddleware;
+    middlewareStore[name] = [middleware];
+};
+/**
+ * Retrieves a registered middleware function by its name.
+ *
+ * This function looks up middleware that was registered with registerMiddleware.
+ * It's used internally by the framework to resolve middleware references in metadata.
+ *
+ * @param {string} name - The unique name (pikkuFuncName) of the middleware function.
+ * @returns {CorePikkuMiddleware | undefined} The middleware function, or undefined if not found.
+ *
+ * @internal
+ */
+export const getMiddlewareByName = (name) => {
+    const middlewareStore = pikkuState('misc', 'middleware');
+    const middleware = middlewareStore[name];
+    return middleware?.[0];
 };
 const middlewareCache = {
     [PikkuWiringTypes.http]: {},
@@ -101,47 +114,86 @@ const middlewareCache = {
     [PikkuWiringTypes.queue]: {},
     [PikkuWiringTypes.scheduler]: {},
     [PikkuWiringTypes.mcp]: {},
+    [PikkuWiringTypes.cli]: {},
 };
 /**
- * Combines tag-based middleware with wiring-specific middleware and function-level middleware.
+ * Combines wiring-specific middleware with function-level middleware.
  *
- * This helper function gets middleware for tags and combines it with any
- * wiring-specific middleware and function-level middleware, avoiding the need for manual spreading.
+ * This function resolves middleware metadata into actual middleware functions and combines them.
+ * It filters out wire middleware without tags from inheritedMiddleware to avoid duplication
+ * (those are passed separately as wireMiddleware).
  *
  * @param {object} options - Configuration object for combining middleware.
- * @param {CorePikkuMiddleware[] | undefined} options.wiringMiddleware - Wiring-specific middleware.
- * @param {string[] | undefined} options.wiringTags - Array of wiring-level tags to look up middleware for.
- * @param {CorePikkuMiddleware[] | undefined} options.funcMiddleware - Function-level middleware.
- * @param {string[] | undefined} options.funcTags - Array of function-level tags to look up middleware for.
- * @returns {CorePikkuMiddleware[]} Combined array of tag-based and wiring-specific middleware.
+ * @param {MiddlewareMetadata[] | undefined} options.inheritedMiddleware - Metadata from wiring (HTTP + tags + wire with tags).
+ * @param {CorePikkuMiddleware[] | undefined} options.wireMiddleware - Inline wire middleware.
+ * @param {MiddlewareMetadata[] | undefined} options.funcMiddleware - Function middleware metadata.
+ * @returns {CorePikkuMiddleware[]} Combined array of resolved middleware.
  *
  * @example
  * ```typescript
- * const combined = combineMiddleware({
- *   wiringMiddleware: httpRoute.middleware,
- *   wiringTags: httpRoute.tags,
- *   funcMiddleware: funcConfig.middleware,
- *   funcTags: funcConfig.tags
+ * const combined = combineMiddleware(wireType, wireId, {
+ *   inheritedMiddleware: meta.middleware,
+ *   wireMiddleware: [inlineMiddleware],
+ *   funcMiddleware: funcMeta.middleware
  * })
  * ```
  */
-export const combineMiddleware = (wireType, uid, { httpMiddleware, wiringMiddleware, wiringTags, funcMiddleware, funcTags, } = {}) => {
+export const combineMiddleware = (wireType, uid, { wireInheritedMiddleware, wireMiddleware, funcInheritedMiddleware, funcMiddleware, } = {}) => {
     if (middlewareCache[wireType][uid]) {
         return middlewareCache[wireType][uid];
     }
-    // Run middleware in specific order:
-    // 1) wiringTags middleware
-    // 2) wiringMiddleware
-    // 3) funcMiddleware
-    // 4) funcTags middleware
-    const wiringTaggedMiddleware = getMiddlewareForTags(wiringTags);
-    const funcTaggedMiddleware = getMiddlewareForTags(funcTags);
-    middlewareCache[wireType][uid] = freezeDedupe([
-        ...(httpMiddleware || []),
-        ...wiringTaggedMiddleware,
-        ...(wiringMiddleware || []),
-        ...(funcMiddleware || []),
-        ...funcTaggedMiddleware,
-    ]);
+    const resolved = [];
+    // 1. Resolve wire inherited middleware (HTTP + tag groups + individual wire middleware)
+    if (wireInheritedMiddleware) {
+        for (const meta of wireInheritedMiddleware) {
+            if (meta.type === 'http') {
+                // Look up HTTP middleware group from pikkuState
+                const group = pikkuState('middleware', 'httpGroup')[meta.route];
+                if (group) {
+                    // At runtime, all factories should be resolved to middleware
+                    resolved.push(...group);
+                }
+            }
+            else if (meta.type === 'tag') {
+                // Look up tag middleware group from pikkuState
+                const group = pikkuState('middleware', 'tagGroup')[meta.tag];
+                if (group) {
+                    // At runtime, all factories should be resolved to middleware
+                    resolved.push(...group);
+                }
+            }
+            else if (meta.type === 'wire') {
+                // Individual wire middleware (exported, not inline)
+                const middleware = getMiddlewareByName(meta.name);
+                if (middleware) {
+                    resolved.push(middleware);
+                }
+            }
+        }
+    }
+    // 2. Add inline wire middleware
+    if (wireMiddleware) {
+        resolved.push(...wireMiddleware);
+    }
+    // 3. Resolve function inherited middleware (only tags, wire middleware already handled)
+    if (funcInheritedMiddleware) {
+        for (const meta of funcInheritedMiddleware) {
+            if (meta.type === 'tag') {
+                // Look up tag middleware group from pikkuState
+                const group = pikkuState('middleware', 'tagGroup')[meta.tag];
+                if (group) {
+                    // At runtime, all factories should be resolved to middleware
+                    resolved.push(...group);
+                }
+            }
+            // Note: wire middleware is already handled in wireInheritedMiddleware
+        }
+    }
+    // 4. Add inline function middleware
+    if (funcMiddleware) {
+        resolved.push(...funcMiddleware);
+    }
+    // Deduplicate and freeze
+    middlewareCache[wireType][uid] = freezeDedupe(resolved);
     return middlewareCache[wireType][uid];
 };

package/dist/permissions.js

@@ -107,6 +107,7 @@ const permissionCache = {
     [PikkuWiringTypes.queue]: {},
     [PikkuWiringTypes.scheduler]: {},
     [PikkuWiringTypes.mcp]: {},
+    [PikkuWiringTypes.cli]: {},
 };
 /**
  * Runs permission checks in the specified order:

package/dist/pikku-state.d.ts

@@ -1,11 +1,12 @@
 import { ChannelsMeta, CoreChannel } from './wirings/channel/channel.types.js';
 import { CoreHTTPFunctionWiring, HTTPMethod, HTTPWiringsMeta } from './wirings/http/http.types.js';
-import { FunctionsMeta, CorePikkuMiddleware } from './types/core.types.js';
+import { FunctionsMeta, CorePikkuMiddleware, CorePikkuMiddlewareGroup, FunctionServicesMeta } from './types/core.types.js';
 import { CoreScheduledTask, ScheduledTasksMeta } from './wirings/scheduler/scheduler.types.js';
 import { ErrorDetails, PikkuError } from './errors/error-handler.js';
 import { CorePermissionGroup, CorePikkuFunctionConfig, CorePikkuPermission } from './function/functions.types.js';
 import { queueWorkersMeta, CoreQueueWorker } from './wirings/queue/queue.types.js';
 import { CoreMCPResource, CoreMCPTool, CoreMCPPrompt, MCPResourceMeta, MCPToolMeta, MCPPromptMeta } from './wirings/mcp/mcp.types.js';
+import { CLIProgramMeta, CLIProgramState } from './wirings/cli/cli.types.js';
 interface PikkuState {
     function: {
         meta: FunctionsMeta;
@@ -44,6 +45,30 @@ interface PikkuState {
         prompts: Map<string, CoreMCPPrompt>;
         promptsMeta: MCPPromptMeta;
     };
+    cli: {
+        meta: Record<string, CLIProgramMeta>;
+        programs: Record<string, CLIProgramState>;
+    };
+    middleware: {
+        tagGroup: Record<string, CorePikkuMiddlewareGroup>;
+        httpGroup: Record<string, CorePikkuMiddlewareGroup>;
+        tagGroupMeta: Record<string, {
+            exportName: string | null;
+            sourceFile: string;
+            position: number;
+            services: FunctionServicesMeta;
+            middlewareCount: number;
+            isFactory: boolean;
+        }>;
+        httpGroupMeta: Record<string, {
+            exportName: string | null;
+            sourceFile: string;
+            position: number;
+            services: FunctionServicesMeta;
+            middlewareCount: number;
+            isFactory: boolean;
+        }>;
+    };
     misc: {
         errors: Map<PikkuError, ErrorDetails>;
         schemas: Map<string, any>;