@agentic-kit/pi 0.2.0

package/LICENSE

@@ -0,0 +1,23 @@
+The MIT License (MIT)
+
+Copyright (c) 2025 Dan Lynch <pyramation@gmail.com>
+Copyright (c) 2025 Constructive <developers@constructive.io>
+Copyright (c) 2020-present, Interweb, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,126 @@
+# @agentic-kit/pi
+
+<p align="center" width="100%">
+  <img height="250" src="https://raw.githubusercontent.com/constructive-io/constructive/refs/heads/main/assets/outline-logo.svg" />
+</p>
+
+The [pi coding agent](https://github.com/badlogic/pi-mono) adapter for **agentic-kit**: the Constructive typed database tools and the [`@agentic-kit/harness`](https://www.npmjs.com/package/@agentic-kit/harness) confirm gate, packaged as a pi extension any host can register — Constructive Desktop, the [`agent` CLI](https://www.npmjs.com/package/@agentic-kit/cli), or your own pi-based agent.
+
+```bash
+npm install @agentic-kit/pi
+```
+
+## What's inside
+
+- **16 typed db tools** — `provision_database`, `provision_blueprint`, `describe_schema`, `add_relation`, `delete_table`, `create_field` / `update_field` / `delete_field`, `add_policies`, `add_records`, `run_codegen`, and the template suite (`list` / `create` / `apply` / `update` / `delete`). Tool schemas are authored in [zod](https://zod.dev) and emitted as plain JSON Schema at pi's tool boundary.
+- **Confirm gate** — the harness's host-neutral gate wired to pi's `tool_call` events. Hosts with a rich confirm surface (Desktop) expose `confirmTool`/`notifyToolSkipped` on `ctx.ui`; everyone else gets pi's built-in `ui.confirm` dialog.
+- **Host injection** — credentials, backend endpoints, and data-plane tokens come from your host, not from the package:
+
+```ts
+import { Agent } from '@earendil-works/pi-coding-agent';
+import { createDbTools } from '@agentic-kit/pi';
+
+const dbTools = createDbTools({
+  account: () => ({ userId, accessToken }),
+  backendConfig: () => ({ apiEndpoint, modulesEndpoint }),
+  // optional: dataAuthBroker, previewToken(), dataTokenSkewMs
+});
+
+// register like any pi extension
+pi.use(dbTools);
+```
+
+## Host contract
+
+`PiToolsHost` is the only integration surface:
+
+| Member | Purpose |
+| --- | --- |
+| `account()` | signed-in platform account (`userId`, `accessToken`) |
+| `backendConfig()` | env-aware API + modules GraphQL endpoints |
+| `dataAuthBroker?` | remembers per-database end-user tokens across calls |
+| `previewToken?()` | harvest an end-user token from the host's app preview |
+| `dataTokenSkewMs?` | treat tokens expiring within this window as expired |
+
+## Related
+
+- [`@agentic-kit/harness`](https://www.npmjs.com/package/@agentic-kit/harness) — host-neutral skills, gating, and blueprint core
+- [`@agentic-kit/cli`](https://www.npmjs.com/package/@agentic-kit/cli) — `agent`, a local secure-by-default coding agent
+- [`agentic-kit`](https://www.npmjs.com/package/agentic-kit) — the umbrella package
+
+## Credits
+
+Built on the excellent [pi coding agent](https://github.com/badlogic/pi-mono) by Mario Zechner.
+
+---
+
+## Education and Tutorials
+
+ 1. 🚀 [Quickstart: Getting Up and Running](https://constructive.io/learn/quickstart)
+Get started with modular databases in minutes. Install prerequisites and deploy your first module.
+
+ 2. 📦 [Modular PostgreSQL Development with Database Packages](https://constructive.io/learn/modular-postgres)
+Learn to organize PostgreSQL projects with pgpm workspaces and reusable database modules.
+
+ 3. ✏️ [Authoring Database Changes](https://constructive.io/learn/authoring-database-changes)
+Master the workflow for adding, organizing, and managing database changes with pgpm.
+
+ 4. 🧪 [End-to-End PostgreSQL Testing with TypeScript](https://constructive.io/learn/e2e-postgres-testing)
+Master end-to-end PostgreSQL testing with ephemeral databases, RLS testing, and CI/CD automation.
+
+ 5. ⚡ [Supabase Testing](https://constructive.io/learn/supabase)
+Use TypeScript-first tools to test Supabase projects with realistic RLS, policies, and auth contexts.
+
+ 6. 💧 [Drizzle ORM Testing](https://constructive.io/learn/drizzle-testing)
+Run full-stack tests with Drizzle ORM, including database setup, teardown, and RLS enforcement.
+
+ 7. 🔧 [Troubleshooting](https://constructive.io/learn/troubleshooting)
+Common issues and solutions for pgpm, PostgreSQL, and testing.
+
+## Related Constructive Tooling
+
+### 📦 Package Management
+
+* [pgpm](https://github.com/constructive-io/constructive/tree/main/pgpm/pgpm): **🖥️ PostgreSQL Package Manager** for modular Postgres development. Works with database workspaces, scaffolding, migrations, seeding, and installing database packages.
+
+### 🧪 Testing
+
+* [pgsql-test](https://github.com/constructive-io/constructive/tree/main/postgres/pgsql-test): **📊 Isolated testing environments** with per-test transaction rollbacks—ideal for integration tests, complex migrations, and RLS simulation.
+* [pgsql-seed](https://github.com/constructive-io/constructive/tree/main/postgres/pgsql-seed): **🌱 PostgreSQL seeding utilities** for CSV, JSON, SQL data loading, and pgpm deployment.
+* [supabase-test](https://github.com/constructive-io/constructive/tree/main/postgres/supabase-test): **🧪 Supabase-native test harness** preconfigured for the local Supabase stack—per-test rollbacks, JWT/role context helpers, and CI/GitHub Actions ready.
+* [graphile-test](https://github.com/constructive-io/constructive/tree/main/graphile/graphile-test): **🔐 Authentication mocking** for Graphile-focused test helpers and emulating row-level security contexts.
+* [pg-query-context](https://github.com/constructive-io/constructive/tree/main/postgres/pg-query-context): **🔒 Session context injection** to add session-local context (e.g., `SET LOCAL`) into queries—ideal for setting `role`, `jwt.claims`, and other session settings.
+
+### 🧠 Parsing & AST
+
+* [pgsql-parser](https://www.npmjs.com/package/pgsql-parser): **🔄 SQL conversion engine** that interprets and converts PostgreSQL syntax.
+* [libpg-query-node](https://www.npmjs.com/package/libpg-query): **🌉 Node.js bindings** for `libpg_query`, converting SQL into parse trees.
+* [pg-proto-parser](https://www.npmjs.com/package/pg-proto-parser): **📦 Protobuf parser** for parsing PostgreSQL Protocol Buffers definitions to generate TypeScript interfaces, utility functions, and JSON mappings for enums.
+* [@pgsql/enums](https://www.npmjs.com/package/@pgsql/enums): **🏷️ TypeScript enums** for PostgreSQL AST for safe and ergonomic parsing logic.
+* [@pgsql/types](https://www.npmjs.com/package/@pgsql/types): **📝 Type definitions** for PostgreSQL AST nodes in TypeScript.
+* [@pgsql/utils](https://www.npmjs.com/package/@pgsql/utils): **🛠️ AST utilities** for constructing and transforming PostgreSQL syntax trees.
+
+### 📚 Documentation & Skills
+
+* [constructive-skills](https://github.com/constructive-io/constructive-skills): **📖 Platform documentation and AI agent skills** — feature catalog, blueprint reference, SDK guides (i18n, billing, limits, events, uploads, security, entities, search, AI), and deployment guides.
+
+Install skills for AI coding agents:
+
+```bash
+# All platform skills (security, blueprints, codegen, billing, etc.)
+npx skills add constructive-io/constructive-skills
+
+# Individual repo skills (pgpm, testing, CLI, search, etc.)
+npx skills add https://github.com/constructive-io/constructive --skill pgpm
+npx skills add https://github.com/constructive-io/constructive --skill constructive-testing
+```
+
+## Credits
+
+**🛠 Built by the [Constructive](https://constructive.io) team — creators of modular Postgres tooling for secure, composable backends. If you like our work, contribute on [GitHub](https://github.com/constructive-io).**
+
+## Disclaimer
+
+AS DESCRIBED IN THE LICENSES, THE SOFTWARE IS PROVIDED "AS IS", AT YOUR OWN RISK, AND WITHOUT WARRANTIES OF ANY KIND.
+
+No developer or entity involved in creating this software will be liable for any claims or damages whatsoever associated with your use, inability to use, or your interaction with other users of the code, including any direct, indirect, incidental, special, exemplary, punitive or consequential damages, or loss of profits, cryptocurrencies, tokens, or anything else of value.

package/app-workspace.d.ts

@@ -0,0 +1,16 @@
+export declare const NATIVE_BUILD_DEPS: string[];
+export declare const IGNORED_BUILDS_RE: RegExp;
+export declare function run(cmd: string, args: string[], cwd: string, env?: Record<string, string>): Promise<{
+    ok: boolean;
+    out: string;
+}>;
+export declare function ensureWorkspaceConfig(cwd: string): Promise<void>;
+export declare function pinCodegenLatest(appDir: string): Promise<void>;
+export declare function ensureAppScaffold(cwd: string): Promise<{
+    ok: boolean;
+    out: string;
+}>;
+export declare function prewarmAppWorkspace(cwd: string): Promise<{
+    ok: boolean;
+    out: string;
+}>;

package/app-workspace.js

@@ -0,0 +1,145 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IGNORED_BUILDS_RE = exports.NATIVE_BUILD_DEPS = void 0;
+exports.run = run;
+exports.ensureWorkspaceConfig = ensureWorkspaceConfig;
+exports.pinCodegenLatest = pinCodegenLatest;
+exports.ensureAppScaffold = ensureAppScaffold;
+exports.prewarmAppWorkspace = prewarmAppWorkspace;
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const promises_1 = require("node:fs/promises");
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_util_1 = require("node:util");
+const execFileAsync = (0, node_util_1.promisify)(node_child_process_1.execFile);
+// pnpm 11.8 no longer reads the `pnpm` field from a non-root package.json, so the
+// template's `pnpm.overrides.graphql` (in packages/app/package.json) is silently
+// ignored. Without that override two graphql versions (16.13.0 + 16.14.0) get
+// installed, which instantiates two copies of `grafast` under DIFFERENT
+// peer-dependency hash contexts. graphile-search then resolves in one context
+// while graphile-connection-filter was linked under the other, so codegen dies
+// with `Cannot find module 'graphile-connection-filter'`. Hoisting the override
+// to the ROOT pnpm-workspace.yaml (which pnpm 11.8 DOES read) collapses graphql —
+// and therefore grafast — to a single version, and the missing module resolves
+// (PNPM-GRAPHQL-OVERRIDE-001). We also strip the nested packages/app
+// pnpm-workspace.yaml the template ships, and keep onlyBuiltDependencies so the
+// native deps build where honored (PNPM-BUILDS-001).
+exports.NATIVE_BUILD_DEPS = ['esbuild', 'sharp', 'unrs-resolver'];
+exports.IGNORED_BUILDS_RE = /ERR_PNPM_IGNORED_BUILDS|Ignored build scripts/;
+const DEFAULT_GRAPHQL_OVERRIDE = '16.14.0';
+const TEMPLATE_REPO = 'https://github.com/constructive-io/sandbox-templates';
+const TEMPLATE_SUBDIR = node_path_1.default.join('nextjs', 'constructive-app');
+async function run(cmd, args, cwd, env) {
+    try {
+        const { stdout, stderr } = await execFileAsync(cmd, args, {
+            cwd,
+            timeout: 5 * 60_000,
+            encoding: 'utf-8',
+            maxBuffer: 32 * 1024 * 1024,
+            env: env ? { ...process.env, ...env } : process.env,
+        });
+        return { ok: true, out: `${stdout}${stderr}`.trim() };
+    }
+    catch (err) {
+        const e = err;
+        return { ok: false, out: `${e.stdout ?? ''}${e.stderr ?? ''}`.trim() || e.message || 'failed' };
+    }
+}
+// Read the graphql pin the template wants from its (now-ignored) pnpm.overrides
+// so we propagate the template's own value instead of hardcoding ours.
+async function templateGraphqlOverride(cwd) {
+    try {
+        const pkg = JSON.parse(await (0, promises_1.readFile)(node_path_1.default.join(cwd, 'packages', 'app', 'package.json'), 'utf8'));
+        const v = pkg?.pnpm?.overrides?.graphql;
+        return typeof v === 'string' && v.length > 0 ? v : DEFAULT_GRAPHQL_OVERRIDE;
+    }
+    catch {
+        return DEFAULT_GRAPHQL_OVERRIDE;
+    }
+}
+async function ensureWorkspaceConfig(cwd) {
+    const nested = node_path_1.default.join(cwd, 'packages', 'app', 'pnpm-workspace.yaml');
+    if ((0, node_fs_1.existsSync)(nested)) {
+        await (0, promises_1.rm)(nested, { force: true });
+    }
+    const graphqlPin = await templateGraphqlOverride(cwd);
+    const builds = exports.NATIVE_BUILD_DEPS.map((d) => `  - ${d}`).join('\n');
+    const text = `packages:\n  - "packages/*"\n\n` +
+        `overrides:\n  graphql: ${graphqlPin}\n\n` +
+        `onlyBuiltDependencies:\n${builds}\n`;
+    await (0, promises_1.writeFile)(node_path_1.default.join(cwd, 'pnpm-workspace.yaml'), text);
+}
+// Force @constructive-io/graphql-codegen to `latest` in the app package.json
+// before the single install — older 4.9.x throws on PostGraphile `filter` inputs
+// (TS-001).
+async function pinCodegenLatest(appDir) {
+    const pkgPath = node_path_1.default.join(appDir, 'package.json');
+    const pkg = JSON.parse(await (0, promises_1.readFile)(pkgPath, 'utf8'));
+    for (const field of ['devDependencies', 'dependencies']) {
+        if (pkg[field]?.['@constructive-io/graphql-codegen']) {
+            pkg[field]['@constructive-io/graphql-codegen'] = 'latest';
+        }
+    }
+    await (0, promises_1.writeFile)(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
+}
+// The Constructive Next.js app is just the `nextjs/constructive-app` tree from
+// the sandbox-templates repo — it ships no `____VAR____` placeholders, so there
+// is nothing to templatize. `pgpm init` only fetches and copies that tree, but
+// its CLI is unreliable in the non-TTY agent shell, which made the agent thrash
+// for minutes. Materialize `packages/app` deterministically by shallow-cloning
+// the template instead (PGPM-001).
+async function ensureAppScaffold(cwd) {
+    const appDir = node_path_1.default.join(cwd, 'packages', 'app');
+    if ((0, node_fs_1.existsSync)(node_path_1.default.join(appDir, 'package.json'))) {
+        return { ok: true, out: 'packages/app already scaffolded' };
+    }
+    const tmp = node_path_1.default.join(node_os_1.default.tmpdir(), `airpage-app-template-${process.pid}`);
+    await (0, promises_1.rm)(tmp, { recursive: true, force: true });
+    const clone = await run('git', ['clone', '--depth', '1', TEMPLATE_REPO, tmp], cwd);
+    if (!clone.ok) {
+        await (0, promises_1.rm)(tmp, { recursive: true, force: true });
+        return { ok: false, out: `Template clone failed:\n${clone.out}` };
+    }
+    const src = node_path_1.default.join(tmp, TEMPLATE_SUBDIR);
+    if (!(0, node_fs_1.existsSync)(src)) {
+        await (0, promises_1.rm)(tmp, { recursive: true, force: true });
+        return { ok: false, out: `Template subdir ${TEMPLATE_SUBDIR} missing in ${TEMPLATE_REPO}` };
+    }
+    try {
+        await (0, promises_1.mkdir)(node_path_1.default.dirname(appDir), { recursive: true });
+        await (0, promises_1.cp)(src, appDir, { recursive: true });
+    }
+    catch (err) {
+        await (0, promises_1.rm)(tmp, { recursive: true, force: true });
+        return {
+            ok: false,
+            out: `Copying template into packages/app failed: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+    await (0, promises_1.rm)(tmp, { recursive: true, force: true });
+    return { ok: true, out: 'Scaffolded packages/app from the constructive-app template.' };
+}
+// Scaffold packages/app, hoist the workspace config, pin codegen, and run the one
+// clean install. All of this is database-INDEPENDENT, so it can be prewarmed
+// concurrently with the ~90s provision_database backend mutation to keep clone +
+// install off run_codegen's critical path. Best-effort and fully idempotent:
+// run_codegen re-runs the same steps, finding the scaffold present and the install
+// already satisfied (a fast no-op). Errors are swallowed by callers that prewarm —
+// run_codegen surfaces any real failure later.
+async function prewarmAppWorkspace(cwd) {
+    const scaffold = await ensureAppScaffold(cwd);
+    if (!scaffold.ok)
+        return scaffold;
+    const appDir = node_path_1.default.join(cwd, 'packages', 'app');
+    await ensureWorkspaceConfig(cwd);
+    await pinCodegenLatest(appDir);
+    const install = await run('pnpm', ['install', '--no-frozen-lockfile'], cwd);
+    if (!install.ok && !exports.IGNORED_BUILDS_RE.test(install.out)) {
+        return { ok: false, out: `pnpm install failed:\n${install.out}` };
+    }
+    return { ok: true, out: 'Prewarmed packages/app scaffold + install.' };
+}

package/confirm-gate.d.ts

@@ -0,0 +1,13 @@
+import type { ExtensionContext, ToolCallEvent, ToolCallEventResult } from '@earendil-works/pi-coding-agent';
+import type { resolveDataToken, resolveProjectContext } from './context';
+import type { createTemplatePreviewTables } from './tools/templates';
+export type ConfirmGateDeps = {
+    resolveProjectContext: typeof resolveProjectContext;
+    resolveDataToken: typeof resolveDataToken;
+    createTemplatePreviewTables: typeof createTemplatePreviewTables;
+};
+export type ConfirmGate = {
+    onAgentStart: () => void;
+    onToolCall: (event: ToolCallEvent, ctx: ExtensionContext) => Promise<ToolCallEventResult | undefined>;
+};
+export declare function createConfirmGate(deps: ConfirmGateDeps): ConfirmGate;

package/confirm-gate.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createConfirmGate = createConfirmGate;
+const harness_1 = require("@agentic-kit/harness");
+function createConfirmGate(deps) {
+    const gate = (0, harness_1.createConfirmGate)({
+        isProjectRunnable: async (cwd) => {
+            const resolved = await deps.resolveProjectContext(cwd);
+            return resolved.context !== null;
+        },
+        hasDataToken: async (cwd) => {
+            const resolved = await deps.resolveProjectContext(cwd);
+            if (!resolved.context)
+                return false;
+            const token = await deps.resolveDataToken(resolved.context);
+            return Boolean(token.token);
+        },
+        resolveTemplatePreview: async (cwd, blueprintName, displayName) => {
+            const resolved = await deps.resolveProjectContext(cwd);
+            if (!resolved.context)
+                return undefined;
+            const result = await deps.createTemplatePreviewTables(resolved.context, blueprintName);
+            if (result.tables.length === 0)
+                return undefined;
+            return {
+                kind: 'template',
+                displayName,
+                blueprintName: result.blueprintName || undefined,
+                tables: result.tables,
+            };
+        },
+    });
+    return {
+        onAgentStart: gate.onAgentStart,
+        onToolCall: async (event, ctx) => {
+            const ui = ctx.ui;
+            const host = {
+                hasUI: ctx.hasUI,
+                confirmTool: (toolCallId, title, message, preview) => ui.confirmTool
+                    ? ui.confirmTool(toolCallId, title, message, preview)
+                    : ui.confirm(title, message),
+                notifyToolSkipped: (toolCallId) => ui.notifyToolSkipped?.(toolCallId),
+            };
+            return gate.onToolCall({
+                toolName: event.toolName,
+                toolCallId: event.toolCallId,
+                input: event.input,
+            }, host, ctx.cwd);
+        },
+    };
+}

package/context.d.ts

@@ -0,0 +1,39 @@
+import { api, modules } from '@constructive-io/sdk';
+export type ApiClient = ReturnType<typeof api.createClient>;
+export type ModulesClient = ReturnType<typeof modules.createClient>;
+export type ProjectContext = {
+    api: ApiClient;
+    modules: ModulesClient;
+    databaseId: string;
+    schemaId: string;
+    ownerId: string | undefined;
+    apiEndpoint: string;
+    modulesEndpoint: string;
+    databaseName: string;
+    accessToken: string;
+    dataEndpoint: string;
+};
+export type ProjectContextFailureCode = 'no-env' | 'missing-credentials' | 'db-missing' | 'account-mismatch' | 'backend-unreachable' | 'schema-unresolved';
+export type ResolveResult = {
+    context: ProjectContext | null;
+    reason: string;
+    code?: ProjectContextFailureCode;
+};
+export type ResolveOptions = {
+    /** Which plane the context is for. Ownership gates the control plane only:
+     *  schema editing and provisioning act under the signed-in account, so a
+     *  foreign-owned binding is blocked ('account-mismatch'). The data plane
+     *  (real rows via app end-user tokens) never checks desktop-account
+     *  ownership — a live foreign-owned database serves data fine, exactly as
+     *  the app itself does in the Preview. */
+    plane?: 'control' | 'data';
+};
+export declare function resolveProjectContext(cwd: string, options?: ResolveOptions): Promise<ResolveResult>;
+export type DataTokenResult = {
+    token?: string;
+    userId?: string;
+    reason?: string;
+};
+export declare function resolveDataToken(context: ProjectContext): Promise<DataTokenResult>;
+export declare function deriveSubdomainEndpoint(baseEndpoint: string, firstLabel: string): string;
+export declare function resolveOrgName(ownerId: string): Promise<string | undefined>;