@fastagent-sh/fastagent 0.21.0 → 0.22.0

package/dist/session.js

@@ -1,75 +1,53 @@
 /**
- * Can this id be ADDRESSED by a client? A session id is an opaque Caller string, and the data plane
- * takes any of it — but a control plane carries the id as a URL path segment, and three strings are
- * not path segments: the empty one, `.` and `..`. URL normalisation eats them before any router
- * sees them (`encodeURIComponent` does not help; the spec normalises `%2E` too), so a request for
- * `.` arrives as a request for the collection and answers about something else entirely.
- *
- * The rule lives HERE, in the contract, because both sides enforce it and they must not drift: a
- * transport rejects such an id rather than sending a request that will silently address its
- * neighbour, and an implementation refuses to MINT one (a fork target nothing could open) — while a
- * session a channel already created under one keeps running, and keeps appearing in `list()`, since
- * hiding it would be the silent half of the same problem.
+ * Can this id be ADDRESSED by a client? URL normalisation eats `""`, `.` and `..` before any router sees them, so a
+ * request for `.` would answer about the collection instead. The rule lives in the contract because both sides
+ * enforce it and must not drift: a transport refuses to send such an id, and an implementation refuses to MINT one.
  */
 export function isAddressableSession(session) {
     return session !== "" && session !== "." && session !== "..";
 }
-/** Every field name, as a value — what an implementation checks a patch against, and what a
- *  transport rejects an unknown key by. The `satisfies` anchor keeps it exhaustive: a field added to
- *  {@link SessionUpdate} must be added here too, or this stops compiling. */
+/**
+ * Every field name, as a value — what an implementation checks a patch against, and what a transport rejects an
+ * unknown key by.
+ */
 export const UPDATE_FIELDS = [
     "name",
     "model",
     "thinkingLevel",
     "leafEntryId",
 ];
-/** Stable `SessionResult.error.code` for a call, or an update field, the implementation does not
- *  support — the answer to calling past a {@link SessionCapabilities} gate. */
+/**
+ * Stable `SessionResult.error.code` for a call, or an update field, the implementation does not support — the answer
+ * to calling past a {@link SessionCapabilities} gate.
+ */
 export const UNSUPPORTED_CAPABILITY_CODE = "unsupported_capability";
-/** Stable `SessionResult.error.code` for a run action
- *  (`steer`/`follow_up`/`abort`) called while the session has no active run — and, for `abort`, no
- *  in-flight compaction either (`abort` is also the door out of a `compacting` state; the outcome
- *  then travels as `compaction_finished{aborted}`). `retryable: false` — the same call fails again;
- *  call it after `state()` shows an active run. */
+/**
+ * Stable `SessionResult.error.code` for a run action (`steer`/`follow_up`/`abort`) called while the session has no
+ * active run.
+ */
 export const NO_ACTIVE_RUN_CODE = "no_active_run";
-/** Stable `SessionResult.error.code` for a PAYLOAD that is invalid for this runtime — an unknown
- *  model spec, an unsupported thinking level, an entry id that is not a position, a fork onto an id
- *  another history already holds. Permanent for that payload; a different value may succeed.
- *  Rejected before acceptance. */
+/** Stable `SessionResult.error.code` for a PAYLOAD that is invalid for this runtime. */
 export const INVALID_COMMAND_CODE = "invalid_command";
-/** Stable `SessionResult.error.code` for a write against a session that does not exist. Sessions are
- *  created by the DATA plane (`invoke`) or copied by `fork`, never minted by an update — a write on
- *  an unknown id (a typo, a not-yet-started conversation) must not create a ghost record. Rejected
- *  before acceptance; retry once the session's first turn exists. */
+/** Stable `SessionResult.error.code` for a write against a session that does not exist. */
 export const NO_SUCH_SESSION_CODE = "no_such_session";
-/** Stable `SessionResult.error.code` for a write rejected BEFORE acceptance with nothing durable
- *  landed — a failed property append, a fork whose copy could not be written, or compact's admission
- *  failing (binding the session, the local preparation). Acceptance sits where the work becomes asynchronous and
- *  expensive: the model call — compact is accept-fast (holding the dispatch open for a full model
- *  call would make acceptance = outcome), and post-acceptance outcomes travel as
- *  `compaction_finished{summary|error|aborted}` events. `retryable: true` throughout: the same
- *  command may succeed on retry (the state-dependent "nothing to compact" has its own code,
- *  {@link NOTHING_TO_COMPACT_CODE}). */
+/** Stable `SessionResult.error.code` for a write rejected BEFORE acceptance with nothing durable landed. */
 export const BOUNDARY_COMMAND_FAILED_CODE = "boundary_command_failed";
-/** Stable `SessionResult.error.code` for `compact` on a session with no compactable history yet —
- *  a no-op, not a failure, rejected before acceptance. The {@link NO_ACTIVE_RUN_CODE} pattern:
- *  `retryable: false` (as-is retry fails now), call it again once the session has grown. */
+/**
+ * Stable `SessionResult.error.code` for `compact` on a session with no compactable history yet — a no-op, not a
+ * failure, rejected before acceptance.
+ */
 export const NOTHING_TO_COMPACT_CODE = "nothing_to_compact";
-/** Stable `SessionResult.error.code` for a run action that reached an active run but could not take
- *  effect because the run raced to settlement (or the engine refused it). Distinct from
- *  {@link NO_ACTIVE_RUN_CODE}: the run existed — and TRANSIENT: the session's next run can be acted
- *  on. Still pre-acceptance — nothing was queued — and `retryable: false`: the same call fails
- *  again. (A run registered without modulation controls is a capability problem, not a run problem,
- *  and rejects with {@link UNSUPPORTED_CAPABILITY_CODE}.) */
+/**
+ * Stable `SessionResult.error.code` for a run action that reached an active run but could not take effect because the
+ * run raced to settlement (or the engine refused it).
+ */
 export const RUN_COMMAND_FAILED_CODE = "run_command_failed";
-/** What {@link SessionCollection.list} rejects with — the only read that can (see it for why). Not a
- *  `SessionResult`: it REJECTS, and a transport carries this code in the error body of a non-2xx
- *  (design §13). `retryable: true` — the condition is the store's availability, not the request. */
+/** What {@link SessionCollection.list} rejects with — the only read that can. `retryable: true`: the condition is
+ *  the store's availability, not the request. */
 export const SESSIONS_UNAVAILABLE_CODE = "sessions_unavailable";
-/** Stable `SessionResult.error.code` for a multi-field {@link Session.update} that wrote some of its
- *  fields and then failed. It exists because {@link BOUNDARY_COMMAND_FAILED_CODE} promises the
- *  opposite — nothing durable landed — and an implementation cannot keep that promise across
- *  properties an engine records as separate journal entries. `retryable: false`: re-sending the same
- *  patch would re-apply what already landed, so a client reads `state()` (or the `state_changed`
- *  this emits first, which reports the record as it now is) and decides what is left to ask for. */
+/**
+ * Stable `SessionResult.error.code` for a multi-field {@link Session.update} that wrote some of its fields and then
+ * failed — the ONE code that reports durable work behind an `ok: false`. The message names what landed, and a
+ * `state_changed` event reporting the record as it now is precedes it.
+ */
 export const PARTIAL_UPDATE_CODE = "partial_update";

package/dist/tunnel.d.ts

@@ -1,10 +1,7 @@
 /**
- * `--tunnel`: expose the local dev server on a public HTTPS URL via a Cloudflare quick tunnel, then
- * auto-register the first-party webhook channels against it (Telegram setWebhook; onboarded Slack
- * App Manifest update; Feishu/Lark application-config PATCH; GitHub/manual Slack print URLs). This closes the
- * "local dev → public URL" gap webhooks need.
- *
- * Process orchestration, not assembly — lives outside the engine, beside dev-supervisor.ts.
+ * `--tunnel`: expose the local dev server on a public HTTPS URL via a Cloudflare quick tunnel, then auto-register the
+ * first-party webhook channels against it (Telegram setWebhook; onboarded Slack App Manifest update; Feishu/Lark
+ * application-config PATCH; manual Slack prints the URL).
  */
 import { type ChildProcess } from "node:child_process";
 import type { RegistrationOutcome } from "./channels/registration.ts";
@@ -17,42 +14,17 @@ export interface Tunnel {
 export declare function parseTunnelUrl(chunk: string): string | undefined;
 /** Whether cloudflared's output so far reports an edge connection — see {@link TUNNEL_CONNECTED_RE}. */
 export declare function hasTunnelConnection(output: string): boolean;
-/**
- * How long after that connection to hand the URL over. The one number here that is not observed: 5s
- * covers the widest of the 7 measured gaps (3.9s), all taken over cloudflared's http2 transport
- * because this network blocks its QUIC. Costs a beat of `dev --tunnel` start-up; buys the first
- * registration attempt landing on a name that resolves.
- */
+/** How long after that connection to hand the URL over. */
 export declare const TUNNEL_DNS_LAG_MS = 5000;
 /** How cloudflared is launched; injectable so tests can drive the child without a real process. */
 type SpawnCloudflared = (port: number) => ChildProcess;
 /**
- * Start a Cloudflare quick tunnel to localhost:`port`, resolving once its public URL is assigned AND
- * the tunnel has an edge connection — the URL is printed first and is not usable yet
- * ({@link hasTunnelConnection}). cloudflared sometimes exits before printing a URL (a transient
- * trycloudflare API error), so retry a few times. ALWAYS resolves to undefined WITH an operator log
- * saying why — missing binary, the exit reason, or "gave up after retries" — never silently; serving
- * continues without a tunnel either way. What remains after this is the PLATFORM's own warm-up, which
- * each registrar absorbs by retrying while the platform reports it cannot yet verify the URL.
+ * Start a Cloudflare quick tunnel to localhost:`port`, resolving once its public URL is assigned AND the tunnel has an
+ * edge connection.
  */
 export declare function startCloudflareTunnel(port: number, spawnFn?: SpawnCloudflared, attemptTimeoutMs?: number): Promise<Tunnel | undefined>;
-/**
- * Print the public URL and wire up first-party webhook channels found under `dir` (the agent
- * ROOT): Telegram and Feishu/Lark use runtime credentials; onboarded Slack uses its owner-local config
- * token; GitHub and a manually scaffolded Slack app receive explicit console URLs.
- *
- * Returns what each registrar ANSWERED, because two kinds of caller need different things from a
- * failure. `dev`/`start` are long-running: a webhook that did not register is a logged problem, not
- * a reason to stop serving, and they void this. `deploy … --run` is a command that exits, and an
- * exit 0 there tells its caller the deployment is reachable — so it feeds these through
- * `registrationGate`, exactly as the fly/railway/agentcore runners feed their own registrar calls
- * (docker used to be the one host that could not, because this returned nothing).
- */
-export declare function announceWebhooks(dir: string, baseUrl: string, 
-/** Every declared channel with its ingress. Not a pre-filtered list: this used to accept "the route
- *  channels" and default to every basename in `channels/`, which pointed a webhook at a
- *  long-connection channel whenever a caller forgot to filter. {@link pointChannelsAt} filters. */
-channels: readonly DeclaredChannel[], opts?: {
+/** Print the public URL and wire up first-party webhook channels found under `dir` (the agent ROOT). */
+export declare function announceWebhooks(dir: string, baseUrl: string, channels: readonly DeclaredChannel[], opts?: {
     openUrl?: (url: string) => void;
     stateRoot?: string;
 }): Promise<{

package/dist/tunnel.js

@@ -1,10 +1,7 @@
 /**
- * `--tunnel`: expose the local dev server on a public HTTPS URL via a Cloudflare quick tunnel, then
- * auto-register the first-party webhook channels against it (Telegram setWebhook; onboarded Slack
- * App Manifest update; Feishu/Lark application-config PATCH; GitHub/manual Slack print URLs). This closes the
- * "local dev → public URL" gap webhooks need.
- *
- * Process orchestration, not assembly — lives outside the engine, beside dev-supervisor.ts.
+ * `--tunnel`: expose the local dev server on a public HTTPS URL via a Cloudflare quick tunnel, then auto-register the
+ * first-party webhook channels against it (Telegram setWebhook; onboarded Slack App Manifest update; Feishu/Lark
+ * application-config PATCH; manual Slack prints the URL).
  */
 import { spawn } from "node:child_process";
 import { registerFeishuWebhook } from "./channels/feishu/register-webhook.js";
@@ -12,38 +9,25 @@ import { registerSlackWebhook } from "./channels/slack/register-webhook.js";
 import { registerTelegramWebhook } from "./channels/telegram/register-webhook.js";
 import { pointChannelsAt } from "./deploy/channel-ingress.js";
 import { dotEnvPath, loadDotEnv } from "./env.js";
+import { installProxyFetch } from "./proxy.js";
 import { resolveStateRoot } from "./paths.js";
 import { log } from "./log.js";
-// `(?!api\.)`: cloudflared's ERROR lines mention its request endpoint (`https://api.trycloudflare.com/tunnel`,
-// e.g. "failed to request quick Tunnel: Post ... timeout" under a flaky proxy) — without the exclusion a
-// transient error line parses as the assigned URL and the webhook gets registered against Cloudflare's
-// API host instead of the tunnel.
+// `(?!api\.)`: cloudflared's ERROR lines mention its request endpoint (`https://api.trycloudflare.com/tunnel`, e.g.
+// "failed to request quick Tunnel: Post ... timeout" under a flaky proxy) — without the exclusion a transient error
+// line parses as the assigned URL and the webhook gets registered against Cloudflare's API host instead of the
+// tunnel.
 const TUNNEL_URL_RE = /https:\/\/(?!api\.)[a-z0-9-]+\.trycloudflare\.com/i;
 /** Extract a Cloudflare quick-tunnel URL from a chunk of cloudflared output, if present. */
 export function parseTunnelUrl(chunk) {
     return chunk.match(TUNNEL_URL_RE)?.[0];
 }
-/**
- * cloudflared's line for an established edge connection. THIS, not the URL, is when the hostname
- * begins to exist: `*.trycloudflare.com` is no wildcard, and a quick tunnel's record is published
- * once the tunnel registers a connection — so the URL is printed while the name is still NXDOMAIN.
- * A platform told about it inside that window answers "Failed to resolve host" and goes on answering
- * it far longer than any registrar's retry budget (#435); the record going live seconds later does
- * not undo the answer it already gave, which is why more retries were never the fix.
- *
- * Measured over 7 quick tunnels: the URL at +0s, this line at +1.1-1.9s, the record 0.5-3.9s later.
- */
+/** cloudflared's line for an established edge connection. */
 const TUNNEL_CONNECTED_RE = /Registered tunnel connection/i;
 /** Whether cloudflared's output so far reports an edge connection — see {@link TUNNEL_CONNECTED_RE}. */
 export function hasTunnelConnection(output) {
     return TUNNEL_CONNECTED_RE.test(output);
 }
-/**
- * How long after that connection to hand the URL over. The one number here that is not observed: 5s
- * covers the widest of the 7 measured gaps (3.9s), all taken over cloudflared's http2 transport
- * because this network blocks its QUIC. Costs a beat of `dev --tunnel` start-up; buys the first
- * registration attempt landing on a name that resolves.
- */
+/** How long after that connection to hand the URL over. */
 export const TUNNEL_DNS_LAG_MS = 5000;
 /** Global timer (rather than timers/promises) so timeout/retry behavior is deterministic under fake timers. */
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
@@ -53,13 +37,8 @@ const TUNNEL_RETRY_MS = 2000;
 const TUNNEL_START_TIMEOUT_MS = 30_000;
 const spawnCloudflared = (port) => spawn("cloudflared", ["tunnel", "--url", `http://localhost:${port}`], { stdio: ["ignore", "pipe", "pipe"] });
 /**
- * Start a Cloudflare quick tunnel to localhost:`port`, resolving once its public URL is assigned AND
- * the tunnel has an edge connection — the URL is printed first and is not usable yet
- * ({@link hasTunnelConnection}). cloudflared sometimes exits before printing a URL (a transient
- * trycloudflare API error), so retry a few times. ALWAYS resolves to undefined WITH an operator log
- * saying why — missing binary, the exit reason, or "gave up after retries" — never silently; serving
- * continues without a tunnel either way. What remains after this is the PLATFORM's own warm-up, which
- * each registrar absorbs by retrying while the platform reports it cannot yet verify the URL.
+ * Start a Cloudflare quick tunnel to localhost:`port`, resolving once its public URL is assigned AND the tunnel has an
+ * edge connection.
  */
 export async function startCloudflareTunnel(port, spawnFn = spawnCloudflared, attemptTimeoutMs = TUNNEL_START_TIMEOUT_MS) {
     for (let attempt = 1; attempt <= TUNNEL_ATTEMPTS; attempt++) {
@@ -78,8 +57,10 @@ export async function startCloudflareTunnel(port, spawnFn = spawnCloudflared, at
     }
     return undefined;
 }
-/** One cloudflared launch: a Tunnel once its URL is assigned AND the edge connection is up, or a
- *  failure (missing binary / exit before a URL). */
+/**
+ * One cloudflared launch: a Tunnel once its URL is assigned AND the edge connection is up, or a failure (missing
+ * binary / exit before a URL).
+ */
 function spawnTunnelOnce(port, spawnFn, timeoutMs) {
     return new Promise((resolve) => {
         const child = spawnFn(port);
@@ -123,8 +104,7 @@ function spawnTunnelOnce(port, spawnFn, timeoutMs) {
         });
         child.on("exit", () => finish({ fatal: false, detail: lastErrorLine(tail) }));
         timer = setTimeout(() => {
-            // A URL whose tunnel never connected is not worth a fresh one — the next attempt meets the same
-            // network. Serve it and name what is wrong, rather than retrying into the same wall.
+            // A URL whose tunnel never connected is not worth a fresh one — the next attempt meets the same network.
             if (assigned) {
                 log.warn(`[fastagent] --tunnel: cloudflared never reported an edge connection for ${assigned} within ` +
                     `${Math.round(timeoutMs / 1000)}s — serving it anyway. Nothing reaches a tunnel that has not ` +
@@ -146,41 +126,20 @@ function lastErrorLine(tail) {
         .filter(Boolean);
     return ([...lines].reverse().find((l) => /err|error|failed/i.test(l)) ?? lines.at(-1) ?? "").slice(0, 200);
 }
-/**
- * Print the public URL and wire up first-party webhook channels found under `dir` (the agent
- * ROOT): Telegram and Feishu/Lark use runtime credentials; onboarded Slack uses its owner-local config
- * token; GitHub and a manually scaffolded Slack app receive explicit console URLs.
- *
- * Returns what each registrar ANSWERED, because two kinds of caller need different things from a
- * failure. `dev`/`start` are long-running: a webhook that did not register is a logged problem, not
- * a reason to stop serving, and they void this. `deploy … --run` is a command that exits, and an
- * exit 0 there tells its caller the deployment is reachable — so it feeds these through
- * `registrationGate`, exactly as the fly/railway/agentcore runners feed their own registrar calls
- * (docker used to be the one host that could not, because this returned nothing).
- */
-export async function announceWebhooks(dir, baseUrl, 
-/** Every declared channel with its ingress. Not a pre-filtered list: this used to accept "the route
- *  channels" and default to every basename in `channels/`, which pointed a webhook at a
- *  long-connection channel whenever a caller forgot to filter. {@link pointChannelsAt} filters. */
-channels, opts = {}) {
+/** Print the public URL and wire up first-party webhook channels found under `dir` (the agent ROOT). */
+export async function announceWebhooks(dir, baseUrl, channels, opts = {}) {
     log.info(`[fastagent] public URL: ${baseUrl}`);
     try {
         loadDotEnv(dir); // webhook registrars read channel credentials from .env
     }
     catch (error) {
-        // best-effort boundary: a MISSING .env is already tolerated by loadDotEnv; an unreadable one (EACCES,
-        // or .env is a directory) must NOT crash the long-running dev/start server — announceWebhooks is
-        // void-called with no unhandledRejection handler, so a throw here would terminate the process. Warn
-        // (surface it, rule 8) and continue best-effort; each registrar then surfaces its own
-        // missing-credential guidance. loadDotEnv keeps throwing for the synchronous command callers.
+        // best-effort boundary: an unreadable .env (a MISSING one is already tolerated) still leaves registrars that can
+        // report their own missing credentials, so this one names the file instead of aborting the tunnel announcement.
         log.warn(`[fastagent] could not read ${dotEnvPath(dir)}: ${error.message} — continuing without it`);
     }
-    // Readiness is the registrar's job: a fresh quick tunnel returns Cloudflare 530 for ~20-30s before its
-    // origin connects, and each registrar absorbs that by retrying the platform call whose own URL
-    // verification reports it. GitHub needs no wait — the operator adds that webhook by hand.
-    //
-    // The registrars differ from the deploy path's in what they carry, not in which channels they answer
-    // for: this one narrates to the log and opens the console for a manual Feishu step.
+    installProxyFetch(); // the registrars' platform calls follow the proxy that .env may declare
+    // Readiness is the registrar's job: a fresh quick tunnel returns Cloudflare 530 for ~20-30s before its origin
+    // connects, and each registrar absorbs that by retrying the platform call whose own URL verification reports it.
     const feishuOptions = {
         onManualRegistration: ({ consoleUrl }) => opts.openUrl?.(consoleUrl),
     };

package/dist/version.d.ts

@@ -1,5 +1,5 @@
 /**
- * This build's own @fastagent-sh/fastagent version. THROWS if unreadable — the version is load-bearing for
- * the scaffolded dependency range (`^${version}`), so init must never scaffold an uninstallable `^0.0.0`.
+ * This build's own @fastagent-sh/fastagent version. THROWS if unreadable — the version is load-bearing for the
+ * scaffolded dependency range (`^${version}`), so `init` must never fall back and scaffold an uninstallable `^0.0.0`.
  */
 export declare function fastagentVersion(): Promise<string>;

package/dist/version.js

@@ -1,8 +1,8 @@
 import { readFile } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 /**
- * This build's own @fastagent-sh/fastagent version. THROWS if unreadable — the version is load-bearing for
- * the scaffolded dependency range (`^${version}`), so init must never scaffold an uninstallable `^0.0.0`.
+ * This build's own @fastagent-sh/fastagent version. THROWS if unreadable — the version is load-bearing for the
+ * scaffolded dependency range (`^${version}`), so `init` must never fall back and scaffold an uninstallable `^0.0.0`.
  */
 export async function fastagentVersion() {
     const pkgPath = fileURLToPath(new URL("../package.json", import.meta.url));

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@fastagent-sh/fastagent",
-  "version": "0.21.0",
-  "description": "Vibe first. Then FastAgent: turn a local agent directory into a live service in your app, on GitHub, Telegram, Slack, or behind any channel.",
+  "version": "0.22.0",
+  "description": "Vibe first. Then FastAgent: turn a local agent directory into a live service in your app, on Telegram, Slack, Feishu, or behind any channel.",
   "keywords": [
     "agent",
     "ai-agent",
@@ -11,7 +11,6 @@
     "agent-serving",
     "telegram",
     "slack",
-    "github",
     "webhook",
     "sse",
     "pi",
@@ -55,10 +54,6 @@
       "types": "./dist/pi.d.ts",
       "default": "./dist/pi.js"
     },
-    "./github": {
-      "types": "./dist/github.d.ts",
-      "default": "./dist/github.js"
-    },
     "./telegram": {
       "types": "./dist/telegram.d.ts",
       "default": "./dist/telegram.js"
@@ -106,16 +101,15 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.6.0",
-    "@earendil-works/pi-agent-core": "^0.85.1",
-    "@earendil-works/pi-ai": "^0.85.1",
-    "@earendil-works/pi-coding-agent": "^0.85.1",
+    "@earendil-works/pi-agent-core": "^0.87.1",
+    "@earendil-works/pi-ai": "^0.87.1",
+    "@earendil-works/pi-coding-agent": "^0.87.1",
     "@hono/node-server": "^2.1.1",
     "@larksuiteoapi/node-sdk": "^1.71.1",
-    "@octokit/webhooks-methods": "^6.0.0",
-    "@octokit/webhooks-types": "^7.6.1",
     "chokidar": "^5.0.0",
     "commander": "^15.0.0",
     "croner": "^10.0.1",
+    "effect": "4.0.0-rc.117",
     "giget": "^3.3.0",
     "ignore": "^7.0.5",
     "proper-lockfile": "^4.1.2",
@@ -123,14 +117,14 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.5.2",
+    "@biomejs/biome": "^2.5.14",
     "@types/express": "^5.0.6",
     "@types/proper-lockfile": "^4.1.4",
     "express": "^5.2.1",
-    "fastify": "^5.12.1",
-    "knip": "^6.29.0",
+    "fastify": "^5.12.5",
+    "knip": "^6.37.0",
     "typescript": "^7.0.2",
-    "vitest": "^4.1.9",
+    "vitest": "^5.0.1",
     "yaml": "^2.9.0"
   }
 }

package/dist/channels/agentcore-state.d.ts

@@ -1,77 +0,0 @@
-/**
- * Cross-deploy durability for the state root on AgentCore.
- *
- * WHY THIS EXISTS: AgentCore's managed SessionStorage — the `/mnt/state` mount — is reset on every
- * runtime VERSION UPDATE, i.e. on EVERY deploy ("On runtime version update: Data wiped — fresh file
- * system on next invoke", AWS file-system configuration docs), and again after 14 idle days. The
- * mount is therefore a fast LOCAL disk, not the source of truth. Without this module a deploy
- * silently resurrects the agent with no sessions, no channel dedup, no pending wake-ups — and the
- * wake ALARM, which lives in the operator's EventBridge and survives independently, still fires into
- * that empty store: a miss with no error anywhere (exactly the silent-failure class the repo's
- * fail-visibly rule exists to prevent).
- *
- * The durable copy is ONE S3 object reached through PRESIGNED URLS minted per-envelope by the
- * forwarder Lambda. The container holds no AWS credentials (the platform injects none — verified on
- * a live deployment) and stays AWS-SDK-free: a snapshot is one `fetch` GET and one `fetch` PUT.
- *
- * Format: gzip(JSON `{ v, files: { relPath: base64 } }`). Deliberately NOT tar — the state root is a
- * handful of small JSON/JSONL files, and a single self-describing object makes restore ATOMIC: a
- * half-applied state root is far worse than a slightly stale one.
- */
-import { Buffer } from "node:buffer";
-import type { StateUrls } from "./agentcore-protocol.ts";
-/** Snapshot envelope version — an unknown version fails the restore loudly (never a silent skip). */
-export declare const SNAPSHOT_VERSION = 1;
-/** Refuse to pack beyond this (before gzip): a runaway state root would OOM the microVM silently. */
-export declare const MAX_SNAPSHOT_BYTES: number;
-/** Pack the whole state root into one gzipped snapshot object.
- *  ponytail: the WHOLE root, every idle edge — O(state size) per settled turn, and session jsonl
- *  grows without bound. Upgrade path when the 16 MiB warning is real for someone: a per-file
- *  manifest with content hashes, uploading only what changed. */
-export declare function packStateRoot(stateRoot: string, maxBytes?: number): Promise<Buffer>;
-/** Apply a snapshot over the state root. Returns how many files were written. */
-export declare function unpackIntoStateRoot(stateRoot: string, packed: Buffer): Promise<number>;
-export interface StateSyncOptions {
-    stateRoot: string;
-    /** Injected in tests. */
-    fetchImpl?: typeof fetch;
-}
-/**
- * The per-process snapshot lifecycle: restore ONCE before anything reads the state root, then push a
- * coalesced snapshot whenever work settles.
- */
-export interface StateSync {
-    /** Remember the newest presigned URLs (each envelope carries a fresh pair). */
-    use(urls: StateUrls): void;
-    /** Resolve once the state root is authoritative. REJECTS if a snapshot exists but cannot be
-     *  restored — the caller must fail the request rather than serve from an empty state root (and a
-     *  failed restore also blocks {@link StateSync.save}, so bad state is never written back).
-     *  Resolves immediately while no URLs are known: a direct programmatic invoke runs in its OWN
-     *  isolated session/storage and must neither read nor overwrite the ingress snapshot. */
-    ready(): Promise<void>;
-    /** Whether snapshotting is active (URLs seen). Lets the caller flag a forwarder envelope that
-     *  arrived WITHOUT them — a topology fault that would otherwise lose state silently. */
-    configured(): boolean;
-    /** Request a snapshot upload; coalesces while one is in flight. Errors are logged, not thrown —
-     *  the next settle retries, and the local mount still holds the data until the version changes. */
-    save(): void;
-    /** Await the in-flight (and any queued) upload — the shutdown/test seam. */
-    flush(): Promise<void>;
-    /**
-     * Push a snapshot NOW and report whether one was actually written — the pre-stop checkpoint
-     * (`--run`, before `stop-runtime-session`). Distinct from {@link StateSync.save} on both counts:
-     * it forces a fresh round rather than joining a coalescing window (the caller is about to lose
-     * this process, so "an upload from a second ago" is not good enough), and it THROWS on failure
-     * instead of logging, because the whole point of the call is to know.
-     *
-     * `written: false` is a legitimate outcome, not an error: a session that never served a forwarder
-     * envelope has no URLs and nothing of the shared state to write. The caller must not report that
-     * as a successful checkpoint — it is exactly the case where an operator would otherwise believe an
-     * in-flight turn had been protected.
-     */
-    checkpoint(): Promise<{
-        written: boolean;
-        reason?: string;
-    }>;
-}
-export declare function createStateSync(options: StateSyncOptions): StateSync;