@aui.io/apollo 0.1.32 → 0.1.34

package/node_modules/@aui.io/apollo-core/dist/src/api/builder-api.d.ts

@@ -0,0 +1,170 @@
+import type { HttpClient } from "./client-types.js";
+/**
+ * builder-api's headless authoring verbs (docs/headless-authoring-design.md):
+ * stateless gate runs over a tree shipped inline — no session, no rows, the
+ * response is the whole product. The gates here run on the SERVICE's engine
+ * (the builder's own wheel), not the checkout's runtime pin: they are the
+ * builder's opinion of the tree, the same one a `/build` turn would hold.
+ */
+/** Certification replays the whole suite offline — slow by design, like a
+ *  message send (REPORTS-27). A floor, not a ceiling: `--timeout` still wins. */
+export declare const CERTIFY_TIMEOUT_MS = 300000;
+/**
+ * `{path: content}` for the whole checkout — `src/**` the program,
+ * `build/**` the proof material. Text rides plain; binary rides `{b64}`.
+ */
+export type BuilderTree = Record<string, string | {
+    b64: string;
+}>;
+export interface BuilderFinding {
+    code: string;
+    message: string;
+}
+/** `runtime.compile.orphans` census, verbatim. Only the fields the console
+ *  renders are named; a tree that failed to parse has `parse_errors` and no
+ *  `rows`. */
+export interface OrphanCensus {
+    rows?: Record<string, {
+        declared: number;
+        consumed: number;
+        excluded: string[];
+        orphans: string[];
+    }>;
+    distinct_orphans?: string[];
+    parse_errors?: unknown[];
+    [key: string]: unknown;
+}
+/** `runtime.compile.era_census` census, verbatim. */
+export interface EraCensus {
+    resolved?: string | null;
+    offenders?: {
+        value?: string | null;
+        refusal?: string;
+    }[];
+    unfenceable?: {
+        value?: string | null;
+        refusal?: string;
+    }[];
+    [key: string]: unknown;
+}
+export interface BuilderValidation {
+    valid: boolean;
+    errors: BuilderFinding[];
+    warnings: BuilderFinding[];
+    /** id / version / config_fingerprint — `{}` when the tree does not load. */
+    program: {
+        id?: string;
+        version?: string;
+        config_fingerprint?: string;
+    };
+    orphans: OrphanCensus;
+    era_census: EraCensus;
+}
+export interface ScenarioFailure {
+    name: string;
+    reasons: string[];
+}
+/** The eval runner's verdict in its own vocabulary. A refusal (misplaced
+ *  suite, red validation, no suite) is a failed report whose `program_errors`
+ *  say why — the shape never changes on the caller. */
+export interface BuilderCertification {
+    passed: boolean;
+    total: number;
+    passed_count: number;
+    failures: ScenarioFailure[];
+    program_errors: string[];
+    uncovered: Record<string, string[]>;
+    routing: Record<string, unknown>;
+    surface: Record<string, unknown>;
+}
+/** One question for the advisor over one tree. `files` rides EVERY call —
+ *  follow-ups included — so the advisor sees the current checkout, never a
+ *  stale pin; `advisor_session_id` (from a prior answer) keeps the thread. */
+export interface AdvisorAsk {
+    instruction: string;
+    files: BuilderTree;
+    /** Extra material for the advisor's workspace (base64; archives extract). */
+    uploads?: {
+        name: string;
+        data: string;
+    }[];
+    model?: string;
+    max_usd?: number;
+    advisor_session_id?: string;
+}
+/** The 202 — the thread to keep and the turn to poll. */
+export interface AdvisorStarted {
+    advisor_session_id: string;
+    turn_id: string;
+}
+/** The poll view. `answer` and `usage` stay null while the turn runs; an
+ *  advisor turn settles as `answered` (a failed turn's answer is the failure
+ *  story). */
+export interface AdvisorView {
+    advisor_session_id: string;
+    turn_id: string;
+    status: string;
+    answer: string | null;
+    usage: Record<string, unknown> | null;
+}
+/** One build over one pushed agent. No files ride in — the service pulls
+ *  the agent's bundle itself; `version_tag` names the base (absent: the
+ *  agent's current pin). */
+export interface BuildRequest {
+    agent_id: string;
+    instruction: string;
+    version_tag?: string;
+    /** The push message — lands on the draft revision like a commit line. */
+    message?: string;
+    model?: string;
+    /** Run the evaluation suite on the settled tree before approving. */
+    evaluate?: boolean;
+    /** Flip the agent's active pointer to the pushed revision. */
+    publish?: boolean;
+    max_usd?: number;
+}
+/** The 202 — `build_id` doubles as the session id, so every session surface
+ *  (diff, events, artifacts) works on it while the build runs and after. */
+export interface BuildStarted {
+    build_id: string;
+    session_id: string;
+    turn_id: string;
+}
+/** The poll view. `status` is the BUILD's verdict — `running` until the
+ *  driver settles it as `completed` (pushed), `refused` (a gate said no) or
+ *  `failed` (infra story in `error`); the step payloads fill in as they land. */
+export interface BuildView {
+    build_id: string;
+    session_id: string;
+    turn_id: string;
+    status: string;
+    phase: string;
+    turn_status: string | null;
+    answer: string | null;
+    findings: BuilderFinding[] | null;
+    certification: BuilderCertification | null;
+    evaluation: {
+        evaluation_id: string;
+        status: string;
+        verdict?: string | null;
+        pass_scenarios?: number | null;
+        total_scenarios?: number | null;
+    } | null;
+    version_tag: string | null;
+    revision_id: string | null;
+    published: Record<string, unknown> | null;
+    error: string | null;
+}
+export declare class BuilderApiClient {
+    private readonly http;
+    constructor(http: HttpClient);
+    validateTree(files: BuilderTree): Promise<BuilderValidation>;
+    certifyTree(files: BuilderTree, scenarios?: Record<string, unknown>[]): Promise<BuilderCertification>;
+    /** Enqueue one advisor turn (202 immediately — the answer comes by poll). */
+    advise(ask: AdvisorAsk): Promise<AdvisorStarted>;
+    adviceView(turnId: string): Promise<AdvisorView>;
+    /** Enqueue one build (202 immediately — the verdict comes by poll). The
+     *  idempotency key makes a network retry the SAME build, not a second one. */
+    startBuild(build: BuildRequest, idempotencyKey: string): Promise<BuildStarted>;
+    buildView(buildId: string): Promise<BuildView>;
+}

package/node_modules/@aui.io/apollo-core/dist/src/api/builder-api.js

@@ -0,0 +1,52 @@
+/**
+ * builder-api's headless authoring verbs (docs/headless-authoring-design.md):
+ * stateless gate runs over a tree shipped inline — no session, no rows, the
+ * response is the whole product. The gates here run on the SERVICE's engine
+ * (the builder's own wheel), not the checkout's runtime pin: they are the
+ * builder's opinion of the tree, the same one a `/build` turn would hold.
+ */
+/** Certification replays the whole suite offline — slow by design, like a
+ *  message send (REPORTS-27). A floor, not a ceiling: `--timeout` still wins. */
+export const CERTIFY_TIMEOUT_MS = 300_000;
+export class BuilderApiClient {
+    http;
+    constructor(http) {
+        this.http = http;
+    }
+    validateTree(files) {
+        return this.http.request("/v1/builder/validate", {
+            method: "POST",
+            body: { files },
+        });
+    }
+    certifyTree(files, scenarios) {
+        return this.http.request("/v1/builder/certify", {
+            method: "POST",
+            body: { files, ...(scenarios ? { scenarios } : {}) },
+            timeoutMs: CERTIFY_TIMEOUT_MS,
+        });
+    }
+    /** Enqueue one advisor turn (202 immediately — the answer comes by poll). */
+    advise(ask) {
+        return this.http.request("/v1/builder/advisor", {
+            method: "POST",
+            body: ask,
+        });
+    }
+    adviceView(turnId) {
+        return this.http.request(`/v1/builder/advisor/${turnId}`);
+    }
+    /** Enqueue one build (202 immediately — the verdict comes by poll). The
+     *  idempotency key makes a network retry the SAME build, not a second one. */
+    startBuild(build, idempotencyKey) {
+        return this.http.request("/v1/builder/build", {
+            method: "POST",
+            body: build,
+            headers: { "Idempotency-Key": idempotencyKey },
+        });
+    }
+    buildView(buildId) {
+        return this.http.request(`/v1/builder/build/${buildId}`);
+    }
+}
+//# sourceMappingURL=builder-api.js.map

package/node_modules/@aui.io/apollo-core/dist/src/api/builder-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"builder-api.js","sourceRoot":"","sources":["../../../src/api/builder-api.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AAEH;iFACiF;AACjF,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAgJ1C,MAAM,OAAO,gBAAgB;IACS;IAApC,YAAoC,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,YAAY,CAAC,KAAkB;QACpC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE;YAC/C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,KAAK,EAAE;SAChB,CAAC,CAAC;IACL,CAAC;IAEM,WAAW,CAChB,KAAkB,EAClB,SAAqC;QAErC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE;YAC9C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YACpD,SAAS,EAAE,kBAAkB;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IACtE,MAAM,CAAC,GAAe;QAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE;YAC9C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG;SACV,CAAC,CAAC;IACL,CAAC;IAEM,UAAU,CAAC,MAAc;QAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,uBAAuB,MAAM,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED;kFAC8E;IACvE,UAAU,CAAC,KAAmB,EAAE,cAAsB;QAC3D,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE;YAC5C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,EAAE,iBAAiB,EAAE,cAAc,EAAE;SAC/C,CAAC,CAAC;IACL,CAAC;IAEM,SAAS,CAAC,OAAe;QAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;CACF"}

package/node_modules/@aui.io/apollo-core/dist/src/api/runtime-api.d.ts

@@ -41,8 +41,7 @@ export interface Thread {
     id: string;
     title?: string | null;
     agent?: AgentOverride;
-    user_ref_id?: string | null;
-    turns?: number | null;
+    created_by: string;
     created_at: string;
     updated_at: string;
     [key: string]: unknown;
@@ -59,6 +58,13 @@ export interface SkillFile {
 }
 export interface AgentsMd {
     content: string;
+    /**
+     * Which page this is — echoed by engines that ship per-audience pages.
+     * Absent on older engines, which ignore the query and always serve the
+     * authoring page; a headless caller MUST check this before trusting the
+     * content.
+     */
+    audience?: string;
 }
 /**
  * A send is synchronous on the wire — the response IS the agent's turn, and
@@ -82,19 +88,24 @@ export declare class RuntimeApiClient {
         environment: string;
     }): Promise<Thread>;
     getThread(threadId: string): Promise<Thread>;
-    listThreads(userId: string, page?: number, size?: number): Promise<Thread[]>;
+    listThreads(userId: string, options?: {
+        size?: number;
+        after?: string;
+        before?: string;
+    }): Promise<Thread[]>;
     /**
      * Threads bound to an agent, newest first — the listing the runtime intends
      * UIs to use (the per-user route above stays for tooling). Filters compose:
-     * owner, version tag, creation window.
+     * owner, version tag, creation window. Keyset: `after`/`before` + `size`.
      */
     listAgentThreads(agentId: string, filters?: {
         userId?: string;
         versionTag?: string;
         startTime?: string;
         endTime?: string;
-        page?: number;
         size?: number;
+        after?: string;
+        before?: string;
     }): Promise<Thread[]>;
     listMessages(threadId: string): Promise<Message[]>;
     threadTrace(threadId: string): Promise<RuntimeTrace[]>;
@@ -103,13 +114,15 @@ export declare class RuntimeApiClient {
     listSkills(): Promise<SkillIndexItem[]>;
     getSkill(skillId: string, file?: string): Promise<SkillFile>;
     /**
-     * The checkout's authoring page — the engine's own lifecycle page, served
-     * by the runtime that defines it (the same bytes the builder appends after
-     * its instructions). Not a skill: it belongs at the checkout root, so it
-     * has its own endpoint rather than a slot in the skills index. Engines
-     * older than the endpoint answer 404.
+     * The checkout's standing page — the engine's own lifecycle page by
+     * default (the same bytes the builder appends after its instructions), or
+     * the self-contained headless brief for `audience: "headless"`. Not a
+     * skill: it belongs at the checkout root, so it has its own endpoint
+     * rather than a slot in the skills index. Engines older than the endpoint
+     * answer 404; engines older than the headless page ignore the query — see
+     * `AgentsMd.audience`.
      */
-    getAgentsMd(): Promise<AgentsMd>;
+    getAgentsMd(audience?: "headless"): Promise<AgentsMd>;
     getProgramSchemas(file?: string): Promise<Record<string, unknown>>;
     validateProgram(bundle: Record<string, unknown>): Promise<{
         valid: boolean;
@@ -125,32 +138,39 @@ export declare class RuntimeApiClient {
             id?: string;
             version?: string;
         };
+        runtime_version?: string;
+        reports?: Record<string, unknown>;
     }>;
-    /** The evaluation gate: run the bundle's own scenario suite offline, graded by
-     *  the runtime floor. A report, never a push gate. */
-    certifyProgram(bundle: Record<string, unknown>): Promise<{
-        ran: boolean;
-        passed: number;
-        total: number;
-        report: string;
-        failures: string[];
-        errors: {
-            code: string;
-            message: string;
-        }[];
-    }>;
-    /** The demand-ledger audit: declared vs served vs dark needs. A report, never
-     *  a push gate. */
+    /** The demand-ledger audit: what callers ask, and what this bundle does about
+     * it. An unserved need is the RESULT, never a 4xx — same posture as validate. */
     needsProgram(bundle: Record<string, unknown>): Promise<{
         measured: boolean;
-        declared: number;
-        served: number;
-        dark: number;
+        declared?: number;
+        served?: number;
+        dark?: number;
         served_ratio?: number | null;
         dark_number?: number | null;
-        report: string;
-        refused: string[];
-        errors: {
+        report?: string;
+        refused?: string[];
+        errors?: {
+            code: string;
+            message: string;
+        }[];
+    }>;
+    /** The behavioural counterpart to validate: run the bundle's own scenario
+     * suite against it, graded by the runtime floor. Read-only on the server. */
+    certifyProgram(bundle: Record<string, unknown>, scenarios?: unknown[]): Promise<{
+        ran: boolean;
+        passed: number;
+        total: number;
+        report?: string;
+        failures?: string[];
+        results?: {
+            name: string;
+            passed: boolean;
+            reasons?: string[];
+        }[];
+        errors?: {
             code: string;
             message: string;
         }[];

package/node_modules/@aui.io/apollo-core/dist/src/api/runtime-api.js

@@ -25,40 +25,47 @@ export class RuntimeApiClient {
         return this.http.request("/api/v1/tasks", {
             method: "POST",
             body: {
-                task_origin: { type: "third-party", environment: input.environment },
+                task_origin: { type: "cli", environment: input.environment },
                 agent: {
                     agent_id: input.agentId,
                     version_id: input.versionId,
                     version_tag: input.versionTag,
                 },
-                user_ref_id: input.userId,
+                created_by: input.userId,
             },
         });
     }
     getThread(threadId) {
         return this.http.request(`/api/v1/tasks/${threadId}`);
     }
-    listThreads(userId, page = 1, size = 25) {
-        return this.http.request(`/api/v1/users/${encodeURIComponent(userId)}/tasks`, {
-            query: { page, size },
+    async listThreads(userId, options = {}) {
+        const listing = await this.http.request(`/api/v1/users/${encodeURIComponent(userId)}/tasks`, {
+            query: {
+                size: options.size ?? 25,
+                ...(options.after ? { after: options.after } : {}),
+                ...(options.before ? { before: options.before } : {}),
+            },
         });
+        return listing.items;
     }
     /**
      * Threads bound to an agent, newest first — the listing the runtime intends
      * UIs to use (the per-user route above stays for tooling). Filters compose:
-     * owner, version tag, creation window.
+     * owner, version tag, creation window. Keyset: `after`/`before` + `size`.
      */
-    listAgentThreads(agentId, filters = {}) {
-        return this.http.request(`/api/v1/agents/${encodeURIComponent(agentId)}/tasks`, {
+    async listAgentThreads(agentId, filters = {}) {
+        const listing = await this.http.request(`/api/v1/agents/${encodeURIComponent(agentId)}/tasks`, {
             query: {
-                page: filters.page ?? 1,
                 size: filters.size ?? 25,
-                ...(filters.userId ? { user_id: filters.userId } : {}),
+                ...(filters.after ? { after: filters.after } : {}),
+                ...(filters.before ? { before: filters.before } : {}),
+                ...(filters.userId ? { created_by: filters.userId } : {}),
                 ...(filters.versionTag ? { version_tag: filters.versionTag } : {}),
                 ...(filters.startTime ? { start_time: filters.startTime } : {}),
                 ...(filters.endTime ? { end_time: filters.endTime } : {}),
             },
         });
+        return listing.items;
     }
     listMessages(threadId) {
         return this.http.request(`/messaging/v1/threads/${threadId}/messages`);
@@ -81,14 +88,16 @@ export class RuntimeApiClient {
         });
     }
     /**
-     * The checkout's authoring page — the engine's own lifecycle page, served
-     * by the runtime that defines it (the same bytes the builder appends after
-     * its instructions). Not a skill: it belongs at the checkout root, so it
-     * has its own endpoint rather than a slot in the skills index. Engines
-     * older than the endpoint answer 404.
+     * The checkout's standing page — the engine's own lifecycle page by
+     * default (the same bytes the builder appends after its instructions), or
+     * the self-contained headless brief for `audience: "headless"`. Not a
+     * skill: it belongs at the checkout root, so it has its own endpoint
+     * rather than a slot in the skills index. Engines older than the endpoint
+     * answer 404; engines older than the headless page ignore the query — see
+     * `AgentsMd.audience`.
      */
-    getAgentsMd() {
-        return this.http.request("/api/v1/agents-md");
+    getAgentsMd(audience) {
+        return this.http.request("/api/v1/agents-md", { query: { audience } });
     }
     getProgramSchemas(file) {
         return this.http.request("/api/v1/programs/schema", {
@@ -101,20 +110,20 @@ export class RuntimeApiClient {
             body: { bundle },
         });
     }
-    /** The evaluation gate: run the bundle's own scenario suite offline, graded by
-     *  the runtime floor. A report, never a push gate. */
-    certifyProgram(bundle) {
-        return this.http.request("/api/v1/programs/certify", {
+    /** The demand-ledger audit: what callers ask, and what this bundle does about
+     * it. An unserved need is the RESULT, never a 4xx — same posture as validate. */
+    needsProgram(bundle) {
+        return this.http.request("/api/v1/programs/needs", {
             method: "POST",
             body: { bundle },
         });
     }
-    /** The demand-ledger audit: declared vs served vs dark needs. A report, never
-     *  a push gate. */
-    needsProgram(bundle) {
-        return this.http.request("/api/v1/programs/needs", {
+    /** The behavioural counterpart to validate: run the bundle's own scenario
+     * suite against it, graded by the runtime floor. Read-only on the server. */
+    certifyProgram(bundle, scenarios) {
+        return this.http.request("/api/v1/programs/certify", {
             method: "POST",
-            body: { bundle },
+            body: { bundle, ...(scenarios === undefined ? {} : { scenarios }) },
         });
     }
 }

package/node_modules/@aui.io/apollo-core/dist/src/api/runtime-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-api.js","sourceRoot":"","sources":["../../../src/api/runtime-api.ts"],"names":[],"mappings":"AAkEA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AAEvC,MAAM,OAAO,gBAAgB;IACS;IAApC,YAAoC,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,MAAM;QACX,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAEM,WAAW,CAChB,OAA2B,EAC3B,KAAyB;QAEzB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,IAAI,EAAE,KAAK;YACX,SAAS,EAAE,eAAe;SAC3B,CAAC,CAAC;IACL,CAAC;IAEM,YAAY,CAAC,KAMnB;QACC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE;YACxC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACJ,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;gBACpE,KAAK,EAAE;oBACL,QAAQ,EAAE,KAAK,CAAC,OAAO;oBACvB,UAAU,EAAE,KAAK,CAAC,SAAS;oBAC3B,WAAW,EAAE,KAAK,CAAC,UAAU;iBAC9B;gBACD,WAAW,EAAE,KAAK,CAAC,MAAM;aAC1B;SACF,CAAC,CAAC;IACL,CAAC;IAEM,SAAS,CAAC,QAAgB;QAC/B,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,QAAQ,EAAE,CAAC,CAAC;IACxD,CAAC;IAEM,WAAW,CAAC,MAAc,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,EAAE;QACpD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE;YAC5E,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,gBAAgB,CACrB,OAAe,EACf,UAOI,EAAE;QAEN,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CACtB,kBAAkB,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EACrD;YACE,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC;gBACvB,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE;gBACxB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtD,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D;SACF,CACF,CAAC;IACJ,CAAC;IAEM,YAAY,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,yBAAyB,QAAQ,WAAW,CAAC,CAAC;IACzE,CAAC;IAEM,WAAW,CAAC,QAAgB;QACjC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,yBAAyB,QAAQ,QAAQ,CAAC,CAAC;IACtE,CAAC;IAEM,gBAAgB,CAAC,aAAqB;QAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,8BAA8B,aAAa,QAAQ,CAAC,CAAC;IAChF,CAAC;IAEM,gBAAgB,CAAC,aAAqB;QAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,wBAAwB,aAAa,QAAQ,CAAC,CAAC;IAC1E,CAAC;IAEM,UAAU;QACf,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC7C,CAAC;IAEM,QAAQ,CAAC,OAAe,EAAE,IAAa;QAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,kBAAkB,CAAC,OAAO,CAAC,EAAE,EAAE;YACxE,KAAK,EAAE,EAAE,IAAI,EAAE;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACI,WAAW;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAChD,CAAC;IAEM,iBAAiB,CAAC,IAAa;QACpC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE;YAClD,KAAK,EAAE,EAAE,IAAI,EAAE;SAChB,CAAC,CAAC;IACL,CAAC;IAEM,eAAe,CAAC,MAA+B;QAMpD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,2BAA2B,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,MAAM,EAAE;SACjB,CAAC,CAAC;IACL,CAAC;IAED;0DACsD;IAC/C,cAAc,CAAC,MAA+B;QAQnD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,0BAA0B,EAAE;YACnD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,MAAM,EAAE;SACjB,CAAC,CAAC;IACL,CAAC;IAED;uBACmB;IACZ,YAAY,CAAC,MAA+B;QAWjD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,MAAM,EAAE;SACjB,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"runtime-api.js","sourceRoot":"","sources":["../../../src/api/runtime-api.ts"],"names":[],"mappings":"AAkFA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AAEvC,MAAM,OAAO,gBAAgB;IACS;IAApC,YAAoC,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,MAAM;QACX,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAEM,WAAW,CAChB,OAA2B,EAC3B,KAAyB;QAEzB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,IAAI,EAAE,KAAK;YACX,SAAS,EAAE,eAAe;SAC3B,CAAC,CAAC;IACL,CAAC;IAEM,YAAY,CAAC,KAMnB;QACC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE;YACxC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACJ,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;gBAC5D,KAAK,EAAE;oBACL,QAAQ,EAAE,KAAK,CAAC,OAAO;oBACvB,UAAU,EAAE,KAAK,CAAC,SAAS;oBAC3B,WAAW,EAAE,KAAK,CAAC,UAAU;iBAC9B;gBACD,UAAU,EAAE,KAAK,CAAC,MAAM;aACzB;SACF,CAAC,CAAC;IACL,CAAC;IAEM,SAAS,CAAC,QAAgB;QAC/B,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,QAAQ,EAAE,CAAC,CAAC;IACxD,CAAC;IAEM,KAAK,CAAC,WAAW,CACtB,MAAc,EACd,UAA8D,EAAE;QAEhE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CACrC,iBAAiB,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EACnD;YACE,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE;gBACxB,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtD;SACF,CACF,CAAC;QACF,OAAO,OAAO,CAAC,KAAK,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,gBAAgB,CAC3B,OAAe,EACf,UAQI,EAAE;QAEN,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CACrC,kBAAkB,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EACrD;YACE,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE;gBACxB,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D;SACF,CACF,CAAC;QACF,OAAO,OAAO,CAAC,KAAK,CAAC;IACvB,CAAC;IAEM,YAAY,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,yBAAyB,QAAQ,WAAW,CAAC,CAAC;IACzE,CAAC;IAEM,WAAW,CAAC,QAAgB;QACjC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,yBAAyB,QAAQ,QAAQ,CAAC,CAAC;IACtE,CAAC;IAEM,gBAAgB,CAAC,aAAqB;QAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,8BAA8B,aAAa,QAAQ,CAAC,CAAC;IAChF,CAAC;IAEM,gBAAgB,CAAC,aAAqB;QAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,wBAAwB,aAAa,QAAQ,CAAC,CAAC;IAC1E,CAAC;IAEM,UAAU;QACf,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC7C,CAAC;IAEM,QAAQ,CAAC,OAAe,EAAE,IAAa;QAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,kBAAkB,CAAC,OAAO,CAAC,EAAE,EAAE;YACxE,KAAK,EAAE,EAAE,IAAI,EAAE;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACI,WAAW,CAAC,QAAqB;QACtC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IACzE,CAAC;IAEM,iBAAiB,CAAC,IAAa;QACpC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE;YAClD,KAAK,EAAE,EAAE,IAAI,EAAE;SAChB,CAAC,CAAC;IACL,CAAC;IAEM,eAAe,CAAC,MAA+B;QAQpD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,2BAA2B,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,MAAM,EAAE;SACjB,CAAC,CAAC;IACL,CAAC;IAED;qFACiF;IAC1E,YAAY,CAAC,MAA+B;QAWjD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,MAAM,EAAE;SACjB,CAAC,CAAC;IACL,CAAC;IAED;iFAC6E;IACtE,cAAc,CACnB,MAA+B,EAC/B,SAAqB;QAUrB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,0BAA0B,EAAE;YACnD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE;SACpE,CAAC,CAAC;IACL,CAAC;CACF"}

package/node_modules/@aui.io/apollo-core/dist/src/api/vault.d.ts

@@ -4,9 +4,10 @@
  * return metadata plus a masked `preview`, never the value. Connections
  * reference them as `{{vault.NAME}}`, resolved server-side at runtime.
  *
- * The legacy wire speaks v1 vocabulary (an agent is a "NETWORK", a project
- * an "ACCOUNT"). That translation lives HERE and only here — everything
- * above this module says agent / project / org.
+ * Agent-owned secrets are keyed by `agent_id` directly — no scope object on
+ * the wire. Only SHARED secrets (project/org) still speak the legacy v1
+ * scope vocabulary (a project is an "ACCOUNT"). That translation lives HERE
+ * and only here — everything above this module says agent / project / org.
  */
 import type { HttpClient } from "./client-types.js";
 /** Console-side scope vocabulary; most specific name wins at resolution. */
@@ -18,21 +19,26 @@ export interface VaultScopeIds {
     projectId?: string;
     orgId?: string;
 }
-/** Wire shape of a secret's scope (v1 vocabulary — do not export wider). */
+/** Wire shape of a SHARED secret's scope (v1 vocabulary — do not export
+ * wider). Writes only ever send ACCOUNT or ORGANIZATION; agent-owned secrets
+ * carry a top-level `agent_id` and no scope at all. Reads on legacy records
+ * may still surface other scope types — treat anything unknown as agent. */
 export interface VaultScope {
-    type: "NETWORK" | "ACCOUNT" | "ORGANIZATION";
-    network_id?: string | null;
+    type: "ACCOUNT" | "ORGANIZATION";
     account_id?: string | null;
     organization_id?: string | null;
 }
 /**
- * Wire scope for a write. Extra ids are harmless — the server keys the
- * secret by `type` plus its matching id. Callers validate that the id
- * matching `level` is present.
+ * Wire scope for a write — `undefined` at the agent level, where the secret
+ * is keyed by top-level `agent_id` instead. Extra ids are harmless — the
+ * server keys the secret by `type` plus its matching id. Callers validate
+ * that the id matching `level` is present.
  */
-export declare function vaultScopeFor(level: VaultScopeLevel, ids: VaultScopeIds): VaultScope;
-/** Console-side level of a wire scope ("agent" / "project" / "org"). */
-export declare function vaultScopeLevelOf(scope: VaultScope): VaultScopeLevel;
+export declare function vaultScopeFor(level: VaultScopeLevel, ids: VaultScopeIds): VaultScope | undefined;
+/** Console-side level of a wire scope ("agent" / "project" / "org").
+ * Anything that is not a shared ACCOUNT/ORGANIZATION scope — legacy NETWORK
+ * records or scope-less agent-owned secrets — reads as agent-level. */
+export declare function vaultScopeLevelOf(scope: VaultScope | null | undefined): VaultScopeLevel;
 /** Body for `POST /v1/vault/secrets` — create and rotate are one upsert. */
 export interface VaultSecretCreate {
     /** UPPER_SNAKE_CASE reference name (`{{vault.NAME}}`). */
@@ -40,7 +46,10 @@ export interface VaultSecretCreate {
     /** Raw value. Write-only — no read ever returns it. */
     value: string;
     description?: string;
-    scope: VaultScope;
+    /** Owning agent — agent-level secrets send this INSTEAD of a scope. */
+    agent_id?: string;
+    /** Shared-secret scope (project/org). Never sent alongside `agent_id`. */
+    scope?: VaultScope;
     created_by: string;
     updated_by: string;
 }
@@ -50,7 +59,8 @@ export interface VaultSecret {
     name: string;
     preview: string;
     description?: string | null;
-    scope: VaultScope;
+    agent_id?: string | null;
+    scope?: VaultScope | null;
     scope_id?: string | null;
     version: number;
     is_visible: boolean;
@@ -67,8 +77,10 @@ export declare class VaultClient {
     /** Upsert by (name, scope): first call creates, repeats rotate. */
     upsertSecret(body: VaultSecretCreate): Promise<VaultSecret>;
     /**
-     * List secrets visible from a scope chain (masked). The server reduces
-     * to the most specific secret per name across the ids provided.
+     * List secrets visible from the current context (masked). When an agent
+     * is selected, `agent_id` fetches its stamped secrets with one indexed
+     * lookup (the server lets it override the scope filters); otherwise the
+     * project/org ids drive the shared-scope chain view.
      */
     listSecrets(ids: VaultScopeIds): Promise<VaultSecret[]>;
     /** Delete by id — the server answers 409 while connections reference it. */

package/node_modules/@aui.io/apollo-core/dist/src/api/vault.js

@@ -1,18 +1,14 @@
 /** Console-side scope vocabulary; most specific name wins at resolution. */
 export const vaultScopeLevels = ["agent", "project", "org"];
 /**
- * Wire scope for a write. Extra ids are harmless — the server keys the
- * secret by `type` plus its matching id. Callers validate that the id
- * matching `level` is present.
+ * Wire scope for a write — `undefined` at the agent level, where the secret
+ * is keyed by top-level `agent_id` instead. Extra ids are harmless — the
+ * server keys the secret by `type` plus its matching id. Callers validate
+ * that the id matching `level` is present.
  */
 export function vaultScopeFor(level, ids) {
     if (level === "agent") {
-        return {
-            type: "NETWORK",
-            network_id: ids.agentId,
-            ...(ids.projectId ? { account_id: ids.projectId } : {}),
-            ...(ids.orgId ? { organization_id: ids.orgId } : {}),
-        };
+        return undefined;
     }
     if (level === "project") {
         return {
@@ -23,13 +19,15 @@ export function vaultScopeFor(level, ids) {
     }
     return { type: "ORGANIZATION", organization_id: ids.orgId };
 }
-/** Console-side level of a wire scope ("agent" / "project" / "org"). */
+/** Console-side level of a wire scope ("agent" / "project" / "org").
+ * Anything that is not a shared ACCOUNT/ORGANIZATION scope — legacy NETWORK
+ * records or scope-less agent-owned secrets — reads as agent-level. */
 export function vaultScopeLevelOf(scope) {
-    if (scope.type === "NETWORK")
-        return "agent";
-    if (scope.type === "ACCOUNT")
+    if (scope?.type === "ACCOUNT")
         return "project";
-    return "org";
+    if (scope?.type === "ORGANIZATION")
+        return "org";
+    return "agent";
 }
 export class VaultClient {
     http;
@@ -44,13 +42,15 @@ export class VaultClient {
         });
     }
     /**
-     * List secrets visible from a scope chain (masked). The server reduces
-     * to the most specific secret per name across the ids provided.
+     * List secrets visible from the current context (masked). When an agent
+     * is selected, `agent_id` fetches its stamped secrets with one indexed
+     * lookup (the server lets it override the scope filters); otherwise the
+     * project/org ids drive the shared-scope chain view.
      */
     listSecrets(ids) {
         return this.http.request("/v1/vault/secrets", {
             query: {
-                network_id: ids.agentId,
+                agent_id: ids.agentId,
                 account_id: ids.projectId,
                 organization_id: ids.orgId,
             },