@pikku/core 0.9.12-next.0 → 0.10.1

package/dist/middleware/auth-cookie.js

@@ -1,52 +1,60 @@
+import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js';
 import { getRelativeTimeOffsetFromNow, } from '../time-utils.js';
 /**
- * Cookie middleware that extracts a session from cookies.
+ * Cookie-based session middleware that uses JWT for encoding/decoding session data.
  *
- * @param options.name - List of cookie names to check.
- * @param options.getSessionForCookieValue - Function to retrieve a session using a cookie value.
+ * Reads session from a cookie on incoming requests and automatically updates the cookie
+ * when the session changes (e.g., after login).
+ *
+ * @param options.name - Cookie name
+ * @param options.expiresIn - Cookie expiration time (e.g., { value: 30, unit: 'day' })
+ * @param options.options - Cookie serialization options (httpOnly, secure, sameSite, etc.)
+ *
+ * @example
+ * ```typescript
+ * import { authCookie } from '@pikku/core/middleware'
+ *
+ * addHTTPMiddleware([
+ *   authCookie({
+ *     name: 'session',
+ *     expiresIn: { value: 30, unit: 'day' },
+ *     options: {
+ *       httpOnly: true,
+ *       secure: true,
+ *       sameSite: 'strict',
+ *       path: '/'
+ *     }
+ *   })
+ * ])
+ * ```
  */
-export const authCookie = ({ name, getSessionForCookieValue, jwt, options, expiresIn, }) => {
-    const middleware = async (services, { http }, next) => {
-        const { userSession: userSessionService, jwt: jwtService, logger, } = services;
-        if (!http?.request || userSessionService.get()) {
-            return next();
-        }
-        let userSession = null;
-        const cookieValue = http.request.cookie(name);
-        if (cookieValue) {
-            if (jwt) {
-                if (!jwtService) {
-                    throw new Error('JWT service is required for JWT decoding.');
-                }
-                userSession = await jwtService.decode(cookieValue);
-            }
-            else if (getSessionForCookieValue) {
-                userSession = await getSessionForCookieValue(services, cookieValue, name);
-            }
-        }
+export const authCookie = pikkuMiddlewareFactory(({ name, options, expiresIn }) => pikkuMiddleware(async ({ userSession: userSessionService, jwt: jwtService, logger }, { http }, next) => {
+    if (!http?.request || userSessionService.get()) {
+        return next();
+    }
+    // Try to decode session from cookie
+    const cookieValue = http.request.cookie(name);
+    if (cookieValue && jwtService) {
+        const userSession = await jwtService.decode(cookieValue);
         if (userSession) {
             userSessionService.setInitial(userSession);
         }
-        await next();
-        // Set the cookie in the response if the session has changed
-        if (!http?.response) {
-            return;
+    }
+    await next();
+    // Set the cookie in the response if the session has changed
+    if (!http?.response) {
+        return;
+    }
+    if (userSessionService.sessionChanged) {
+        const session = userSessionService.get();
+        if (jwtService) {
+            http.response.cookie(name, await jwtService.encode(expiresIn, session), {
+                ...options,
+                expires: getRelativeTimeOffsetFromNow(expiresIn),
+            });
         }
-        if (userSessionService.sessionChanged) {
-            const session = userSessionService.get();
-            if (jwt) {
-                if (!jwtService) {
-                    throw new Error('JWT service is required for JWT encoding.');
-                }
-                http.response.cookie(name, await jwtService.encode(expiresIn, session), {
-                    ...options,
-                    expires: getRelativeTimeOffsetFromNow(expiresIn),
-                });
-            }
-            else {
-                logger.warn('No JWT service available, unable to set cookie');
-            }
+        else {
+            logger.warn('No JWT service available, unable to set cookie');
         }
-    };
-    return middleware;
-};
+    }
+}));

package/dist/middleware/timeout.d.ts

@@ -1,2 +1,6 @@
-import { CorePikkuMiddleware } from '../types/core.types.js';
-export declare const timeout: (timeout: number) => CorePikkuMiddleware;
+export declare const timeout: () => import("../types/core.types.js").CorePikkuMiddlewareFactory<{
+    timeout: number;
+}, import("../types/core.types.js").CoreSingletonServices<{
+    logLevel?: import("../index.js").LogLevel;
+    secrets?: {};
+}>, import("../types/core.types.js").CoreUserSession>;

package/dist/middleware/timeout.js

@@ -1,10 +1,8 @@
 import { RequestTimeoutError } from '../errors/errors.js';
-export const timeout = (timeout) => {
-    const middleware = async (_services, _interaction, next) => {
-        setTimeout(() => {
-            throw new RequestTimeoutError();
-        }, timeout);
-        await next();
-    };
-    return middleware;
-};
+import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js';
+export const timeout = () => pikkuMiddlewareFactory(({ timeout }) => pikkuMiddleware(async (_services, _interaction, next) => {
+    setTimeout(() => {
+        throw new RequestTimeoutError();
+    }, timeout);
+    await next();
+}));

package/dist/middleware-runner.d.ts

@@ -54,24 +54,6 @@ export declare const runMiddleware: <Middleware extends CorePikkuMiddleware>(ser
  * ```
  */
 export declare const addMiddleware: <PikkuMiddleware extends CorePikkuMiddleware>(tag: string, middleware: CorePikkuMiddlewareGroup) => CorePikkuMiddlewareGroup;
-/**
- * Registers a single middleware function by name in the global middleware store.
- *
- * This function is used by CLI-generated code to register middleware functions
- * that can be referenced by name in metadata. It stores middleware in a special
- * namespace to avoid conflicts with tag-based middleware.
- *
- * @param {string} name - The unique name (pikkuFuncName) of the middleware function.
- * @param {CorePikkuMiddleware} middleware - The middleware function to register.
- *
- * @example
- * ```typescript
- * // Called by CLI-generated pikku-middleware.gen.ts
- * registerMiddleware('authMiddleware_src_middleware_ts_10_5', authMiddleware)
- * registerMiddleware('loggingMiddleware_src_middleware_ts_20_10', loggingMiddleware)
- * ```
- */
-export declare const registerMiddleware: (name: string, middleware: CorePikkuMiddleware) => void;
 /**
  * Retrieves a registered middleware function by its name.
  *

package/dist/middleware-runner.js

@@ -70,27 +70,6 @@ export const addMiddleware = (tag, middleware) => {
     tagGroups[tag] = middleware;
     return middleware;
 };
-/**
- * Registers a single middleware function by name in the global middleware store.
- *
- * This function is used by CLI-generated code to register middleware functions
- * that can be referenced by name in metadata. It stores middleware in a special
- * namespace to avoid conflicts with tag-based middleware.
- *
- * @param {string} name - The unique name (pikkuFuncName) of the middleware function.
- * @param {CorePikkuMiddleware} middleware - The middleware function to register.
- *
- * @example
- * ```typescript
- * // Called by CLI-generated pikku-middleware.gen.ts
- * registerMiddleware('authMiddleware_src_middleware_ts_10_5', authMiddleware)
- * registerMiddleware('loggingMiddleware_src_middleware_ts_20_10', loggingMiddleware)
- * ```
- */
-export const registerMiddleware = (name, middleware) => {
-    const middlewareStore = pikkuState('misc', 'middleware');
-    middlewareStore[name] = [middleware];
-};
 /**
  * Retrieves a registered middleware function by its name.
  *

package/dist/permissions.d.ts

@@ -1,4 +1,4 @@
-import { CoreServices, CoreUserSession, PikkuWiringTypes } from './types/core.types.js';
+import { CoreServices, CoreUserSession, PikkuWiringTypes, PermissionMetadata } from './types/core.types.js';
 import { CorePermissionGroup, CorePikkuPermission } from './function/functions.types.js';
 /**
  * This function validates permissions by iterating over permission groups and executing the corresponding permission functions. If all functions in at least one group return true, the permission is considered valid.
@@ -8,30 +8,65 @@ import { CorePermissionGroup, CorePikkuPermission } from './function/functions.t
  * @returns A promise that resolves to void.
  */
 export declare const verifyPermissions: (permissions: CorePermissionGroup, services: CoreServices, data: any, session?: CoreUserSession) => Promise<boolean>;
+/**
+ * Registers a single permission function by name in the global permission store.
+ *
+ * This function is used by CLI-generated code to register permission functions
+ * that can be referenced by name in metadata. It stores permissions in a special
+ * namespace to avoid conflicts with tag-based permissions.
+ *
+ * @param {string} name - The unique name (pikkuFuncName) of the permission function.
+ * @param {CorePikkuPermission} permission - The permission function to register.
+ *
+ * @example
+ * ```typescript
+ * // Called by CLI-generated pikku-permissions.gen.ts
+ * registerPermission('adminPermission_src_permissions_ts_10_5', adminPermission)
+ * registerPermission('readPermission_src_permissions_ts_20_10', readPermission)
+ * ```
+ */
+export declare const registerPermission: (name: string, permission: CorePikkuPermission<any>) => void;
+/**
+ * Retrieves a registered permission function by its name.
+ *
+ * This function looks up permissions that was registered with registerPermission.
+ * It's used internally by the framework to resolve permission references in metadata.
+ *
+ * @param {string} name - The unique name (pikkuFuncName) of the permission function.
+ * @returns {CorePikkuPermission | undefined} The permission function, or undefined if not found.
+ *
+ * @internal
+ */
+export declare const getPermissionByName: (name: string) => CorePikkuPermission | undefined;
 /**
  * Adds global permissions for a specific tag.
  *
  * This function allows you to register permissions that will be applied to
  * any wiring (HTTP, Channel, Queue, Scheduler, MCP) that includes the matching tag.
  *
+ * For tree-shaking benefits, wrap in a factory function:
+ * `export const x = () => addPermission('tag', [...])`
+ *
  * @param {string} tag - The tag that the permissions should apply to.
  * @param {any[]} permissions - The permissions array to apply for the specified tag.
  *
- * @throws {Error} If permissions for the tag already exist.
+ * @returns {CorePermissionGroup | CorePikkuPermission[]} The permissions (for chaining/wrapping).
  *
  * @example
  * ```typescript
- * // Add admin permissions for admin endpoints
- * addPermission('admin', [adminPermission])
- *
- * // Add authentication permissions for auth endpoints
- * addPermission('auth', [authPermission])
+ * // Recommended: tree-shakeable
+ * export const adminPermissions = () => addPermission('admin', [
+ *   adminPermission,
+ *   rolePermission({ role: 'admin' })
+ * ])
  *
- * // Add read permissions for all API endpoints
- * addPermission('api', [readPermission])
+ * // Also works: no tree-shaking
+ * export const apiPermissions = addPermission('api', [
+ *   readPermission
+ * ])
  * ```
  */
-export declare const addPermission: (tag: string, permissions: CorePermissionGroup | CorePikkuPermission[]) => void;
+export declare const addPermission: (tag: string, permissions: CorePermissionGroup | CorePikkuPermission[]) => CorePermissionGroup | CorePikkuPermission[];
 /**
  * Retrieves permissions for a given set of tags.
  *
@@ -49,17 +84,44 @@ export declare const addPermission: (tag: string, permissions: CorePermissionGro
  */
 export declare const getPermissionsForTags: (tags?: string[]) => readonly (CorePermissionGroup | CorePikkuPermission)[];
 /**
- * Runs permission checks in the specified order:
- * 1) wiring tag permissions - at least one must pass if any exist
- * 2) wiring permissions - must pass if defined
- * 3) function tag permissions - at least one must pass if any exist
- * 4) function permissions - must pass if defined
+ * Combines wiring-specific permissions with function-level permissions.
+ *
+ * This function resolves permission metadata into actual permission functions and combines them.
+ * It filters out wire permissions without tags from inheritedPermissions to avoid duplication
+ * (those are passed separately as wirePermissions).
+ *
+ * @param {object} options - Configuration object for combining permissions.
+ * @param {PermissionMetadata[] | undefined} options.wireInheritedPermissions - Metadata from wiring (HTTP + tags + wire with tags).
+ * @param {CorePermissionGroup | CorePikkuPermission[] | undefined} options.wirePermissions - Inline wire permissions.
+ * @param {PermissionMetadata[] | undefined} options.funcInheritedPermissions - Function permissions metadata (only tags).
+ * @param {CorePermissionGroup | CorePikkuPermission[] | undefined} options.funcPermissions - Inline function permissions.
+ * @returns {(CorePermissionGroup | CorePikkuPermission)[]} Combined array of resolved permissions.
+ *
+ * @example
+ * ```typescript
+ * const combined = combinePermissions(wireType, wireId, {
+ *   wireInheritedPermissions: meta.permissions,
+ *   wirePermissions: inlinePermissions,
+ *   funcInheritedPermissions: funcMeta.permissions,
+ *   funcPermissions: funcConfig.permissions
+ * })
+ * ```
+ */
+export declare const combinePermissions: (wireType: PikkuWiringTypes, uid: string, { wireInheritedPermissions, wirePermissions, funcInheritedPermissions, funcPermissions, }?: {
+    wireInheritedPermissions?: PermissionMetadata[];
+    wirePermissions?: CorePermissionGroup | CorePikkuPermission[];
+    funcInheritedPermissions?: PermissionMetadata[];
+    funcPermissions?: CorePermissionGroup | CorePikkuPermission[];
+}) => readonly (CorePermissionGroup | CorePikkuPermission)[];
+/**
+ * Runs permission checks using combined permissions from all sources.
+ * Combines permissions from wire and function levels, then validates them.
  */
-export declare const runPermissions: (wireType: PikkuWiringTypes, uid: string, { wiringTags, wiringPermissions, funcTags, funcPermissions, allServices, data, session, }: {
-    wiringTags?: string[];
-    wiringPermissions?: CorePermissionGroup;
-    funcTags?: string[];
-    funcPermissions?: CorePermissionGroup;
+export declare const runPermissions: (wireType: PikkuWiringTypes, uid: string, { wireInheritedPermissions, wirePermissions, funcInheritedPermissions, funcPermissions, allServices, data, session, }: {
+    wireInheritedPermissions?: PermissionMetadata[];
+    wirePermissions?: CorePermissionGroup | CorePikkuPermission[];
+    funcInheritedPermissions?: PermissionMetadata[];
+    funcPermissions?: CorePermissionGroup | CorePikkuPermission[];
     allServices: CoreServices;
     data: any;
     session?: CoreUserSession;

package/dist/permissions.js

@@ -1,6 +1,7 @@
 import { PikkuWiringTypes, } from './types/core.types.js';
 import { pikkuState } from './pikku-state.js';
 import { ForbiddenError } from './errors/errors.js';
+import { freezeDedupe } from './utils.js';
 /**
  * This function validates permissions by iterating over permission groups and executing the corresponding permission functions. If all functions in at least one group return true, the permission is considered valid.
  * @param services - The core services required for permission validation.
@@ -33,36 +34,81 @@ export const verifyPermissions = async (permissions, services, data, session) =>
     }
     return false;
 };
+/**
+ * Registers a single permission function by name in the global permission store.
+ *
+ * This function is used by CLI-generated code to register permission functions
+ * that can be referenced by name in metadata. It stores permissions in a special
+ * namespace to avoid conflicts with tag-based permissions.
+ *
+ * @param {string} name - The unique name (pikkuFuncName) of the permission function.
+ * @param {CorePikkuPermission} permission - The permission function to register.
+ *
+ * @example
+ * ```typescript
+ * // Called by CLI-generated pikku-permissions.gen.ts
+ * registerPermission('adminPermission_src_permissions_ts_10_5', adminPermission)
+ * registerPermission('readPermission_src_permissions_ts_20_10', readPermission)
+ * ```
+ */
+export const registerPermission = (name, permission) => {
+    const permissionStore = pikkuState('misc', 'permissions');
+    permissionStore[name] = [permission];
+};
+/**
+ * Retrieves a registered permission function by its name.
+ *
+ * This function looks up permissions that was registered with registerPermission.
+ * It's used internally by the framework to resolve permission references in metadata.
+ *
+ * @param {string} name - The unique name (pikkuFuncName) of the permission function.
+ * @returns {CorePikkuPermission | undefined} The permission function, or undefined if not found.
+ *
+ * @internal
+ */
+export const getPermissionByName = (name) => {
+    const permissionStore = pikkuState('misc', 'permissions');
+    const permission = permissionStore[name];
+    if (Array.isArray(permission) && permission.length === 1) {
+        return permission[0];
+    }
+    return undefined;
+};
 /**
  * Adds global permissions for a specific tag.
  *
  * This function allows you to register permissions that will be applied to
  * any wiring (HTTP, Channel, Queue, Scheduler, MCP) that includes the matching tag.
  *
+ * For tree-shaking benefits, wrap in a factory function:
+ * `export const x = () => addPermission('tag', [...])`
+ *
  * @param {string} tag - The tag that the permissions should apply to.
  * @param {any[]} permissions - The permissions array to apply for the specified tag.
  *
- * @throws {Error} If permissions for the tag already exist.
+ * @returns {CorePermissionGroup | CorePikkuPermission[]} The permissions (for chaining/wrapping).
  *
  * @example
  * ```typescript
- * // Add admin permissions for admin endpoints
- * addPermission('admin', [adminPermission])
- *
- * // Add authentication permissions for auth endpoints
- * addPermission('auth', [authPermission])
+ * // Recommended: tree-shakeable
+ * export const adminPermissions = () => addPermission('admin', [
+ *   adminPermission,
+ *   rolePermission({ role: 'admin' })
+ * ])
  *
- * // Add read permissions for all API endpoints
- * addPermission('api', [readPermission])
+ * // Also works: no tree-shaking
+ * export const apiPermissions = addPermission('api', [
+ *   readPermission
+ * ])
  * ```
  */
 export const addPermission = (tag, permissions) => {
-    const permissionsStore = pikkuState('misc', 'permissions');
-    // Check if tag already exists
-    if (permissionsStore[tag]) {
+    const tagGroups = pikkuState('permissions', 'tagGroup');
+    if (tagGroups[tag]) {
         throw new Error(`Permissions for tag '${tag}' already exist. Use a different tag or remove the existing permissions first.`);
     }
-    permissionsStore[tag] = permissions;
+    tagGroups[tag] = permissions;
+    return permissions;
 };
 const EMPTY = [];
 /**
@@ -84,7 +130,7 @@ export const getPermissionsForTags = (tags) => {
     if (!tags || tags.length === 0) {
         return EMPTY;
     }
-    const permissionsStore = pikkuState('misc', 'permissions');
+    const permissionsStore = pikkuState('permissions', 'tagGroup');
     const applicablePermissions = [];
     // Collect permissions for all matching tags
     for (const tag of new Set(tags)) {
@@ -100,7 +146,7 @@ export const getPermissionsForTags = (tags) => {
     }
     return applicablePermissions;
 };
-const permissionCache = {
+const combinedPermissionsCache = {
     [PikkuWiringTypes.http]: {},
     [PikkuWiringTypes.rpc]: {},
     [PikkuWiringTypes.channel]: {},
@@ -110,67 +156,134 @@ const permissionCache = {
     [PikkuWiringTypes.cli]: {},
 };
 /**
- * Runs permission checks in the specified order:
- * 1) wiring tag permissions - at least one must pass if any exist
- * 2) wiring permissions - must pass if defined
- * 3) function tag permissions - at least one must pass if any exist
- * 4) function permissions - must pass if defined
+ * Combines wiring-specific permissions with function-level permissions.
+ *
+ * This function resolves permission metadata into actual permission functions and combines them.
+ * It filters out wire permissions without tags from inheritedPermissions to avoid duplication
+ * (those are passed separately as wirePermissions).
+ *
+ * @param {object} options - Configuration object for combining permissions.
+ * @param {PermissionMetadata[] | undefined} options.wireInheritedPermissions - Metadata from wiring (HTTP + tags + wire with tags).
+ * @param {CorePermissionGroup | CorePikkuPermission[] | undefined} options.wirePermissions - Inline wire permissions.
+ * @param {PermissionMetadata[] | undefined} options.funcInheritedPermissions - Function permissions metadata (only tags).
+ * @param {CorePermissionGroup | CorePikkuPermission[] | undefined} options.funcPermissions - Inline function permissions.
+ * @returns {(CorePermissionGroup | CorePikkuPermission)[]} Combined array of resolved permissions.
+ *
+ * @example
+ * ```typescript
+ * const combined = combinePermissions(wireType, wireId, {
+ *   wireInheritedPermissions: meta.permissions,
+ *   wirePermissions: inlinePermissions,
+ *   funcInheritedPermissions: funcMeta.permissions,
+ *   funcPermissions: funcConfig.permissions
+ * })
+ * ```
  */
-export const runPermissions = async (wireType, uid, { wiringTags, wiringPermissions, funcTags, funcPermissions, allServices, data, session, }) => {
-    let cachedPermission = permissionCache[wireType][uid];
-    if (!cachedPermission) {
-        cachedPermission = {
-            wiringTags: getPermissionsForTags(wiringTags),
-            funcTags: getPermissionsForTags(funcTags),
-        };
-        permissionCache[wireType][uid] = cachedPermission;
+export const combinePermissions = (wireType, uid, { wireInheritedPermissions, wirePermissions, funcInheritedPermissions, funcPermissions, } = {}) => {
+    if (combinedPermissionsCache[wireType][uid]) {
+        return combinedPermissionsCache[wireType][uid];
     }
-    let permissioned = true;
-    // 1. Wiring tag permissions - at least one must pass if any exist
-    const wiringTaggedPermissions = cachedPermission.wiringTags;
-    if (wiringTaggedPermissions.length > 0) {
-        permissioned = false; // Start false, need at least one to pass
-        for (const permissions of wiringTaggedPermissions) {
-            const result = await verifyPermissions(typeof permissions === 'function' ? { permissions } : permissions, allServices, data, session);
-            if (result) {
-                permissioned = true;
-                break; // At least one passed, we're good at this level
+    const resolved = [];
+    // 1. Resolve wire inherited permissions (HTTP + tag groups + individual wire permissions)
+    if (wireInheritedPermissions) {
+        for (const meta of wireInheritedPermissions) {
+            if (meta.type === 'http') {
+                // Look up HTTP permission group from pikkuState
+                const group = pikkuState('permissions', 'httpGroup')[meta.route];
+                if (group) {
+                    if (Array.isArray(group)) {
+                        resolved.push(...group);
+                    }
+                    else {
+                        resolved.push(group);
+                    }
+                }
+            }
+            else if (meta.type === 'tag') {
+                // Look up tag permission group from pikkuState
+                const group = pikkuState('permissions', 'tagGroup')[meta.tag];
+                if (group) {
+                    if (Array.isArray(group)) {
+                        resolved.push(...group);
+                    }
+                    else {
+                        resolved.push(group);
+                    }
+                }
+            }
+            else if (meta.type === 'wire') {
+                // Individual wire permission (exported, not inline)
+                const permission = getPermissionByName(meta.name);
+                if (permission) {
+                    resolved.push(permission);
+                }
             }
         }
-        if (!permissioned) {
-            allServices.logger.debug('Permission denied - wiring tag permissions');
-            throw new ForbiddenError('Permission denied');
+    }
+    // 2. Add inline wire permissions
+    if (wirePermissions) {
+        if (Array.isArray(wirePermissions)) {
+            resolved.push(...wirePermissions);
+        }
+        else {
+            resolved.push(wirePermissions);
         }
     }
-    // 2. Wiring permissions - must pass if defined
-    if (wiringPermissions) {
-        permissioned = await verifyPermissions(wiringPermissions, allServices, data, session);
-        if (!permissioned) {
-            allServices.logger.debug('Permission denied - wiring permissions');
-            throw new ForbiddenError('Permission denied');
+    // 3. Resolve function inherited permissions (only tags, wire permissions already handled)
+    if (funcInheritedPermissions) {
+        for (const meta of funcInheritedPermissions) {
+            if (meta.type === 'tag') {
+                // Look up tag permission group from pikkuState
+                const group = pikkuState('permissions', 'tagGroup')[meta.tag];
+                if (group) {
+                    if (Array.isArray(group)) {
+                        resolved.push(...group);
+                    }
+                    else {
+                        resolved.push(group);
+                    }
+                }
+            }
+            // Note: wire permissions are already handled in wireInheritedPermissions
+        }
+    }
+    // 4. Add inline function permissions
+    if (funcPermissions) {
+        if (Array.isArray(funcPermissions)) {
+            resolved.push(...funcPermissions);
+        }
+        else {
+            resolved.push(funcPermissions);
         }
     }
-    // 3. Function tag permissions - at least one must pass if any exist
-    const funcTaggedPermissions = cachedPermission.funcTags;
-    if (funcTaggedPermissions.length > 0) {
-        permissioned = false; // Start false, need at least one to pass
-        for (const permissions of funcTaggedPermissions) {
-            const result = await verifyPermissions(typeof permissions === 'function' ? { permissions } : permissions, allServices, data, session);
+    // Deduplicate and freeze
+    combinedPermissionsCache[wireType][uid] = freezeDedupe(resolved);
+    return combinedPermissionsCache[wireType][uid];
+};
+/**
+ * Runs permission checks using combined permissions from all sources.
+ * Combines permissions from wire and function levels, then validates them.
+ */
+export const runPermissions = async (wireType, uid, { wireInheritedPermissions, wirePermissions, funcInheritedPermissions, funcPermissions, allServices, data, session, }) => {
+    // Combine all permissions: wireInheritedPermissions → wirePermissions → funcInheritedPermissions → funcPermissions
+    const allPermissions = combinePermissions(wireType, uid, {
+        wireInheritedPermissions,
+        wirePermissions,
+        funcInheritedPermissions,
+        funcPermissions,
+    });
+    // Check all combined permissions - at least one must pass if any exist
+    if (allPermissions.length > 0) {
+        let permissioned = false;
+        for (const permission of allPermissions) {
+            const result = await verifyPermissions(typeof permission === 'function' ? { permission } : permission, allServices, data, session);
             if (result) {
                 permissioned = true;
-                break; // At least one passed, we're good at this level
+                // Continue executing all permissions (don't break early)
             }
         }
         if (!permissioned) {
-            allServices.logger.debug('Permission denied - function tag permissions');
-            throw new ForbiddenError('Permission denied');
-        }
-    }
-    // 4. Function permissions - must pass if defined
-    if (funcPermissions) {
-        permissioned = await verifyPermissions(funcPermissions, allServices, data, session);
-        if (!permissioned) {
-            allServices.logger.debug('Permission denied - function permissions');
+            allServices.logger.debug('Permission denied - combined permissions');
             throw new ForbiddenError('Permission denied');
         }
     }