@personaai/runtime 0.15.1 → 0.16.0

package/dist/index.d.cts

@@ -185,14 +185,16 @@ type ResolveUser = (request: RuntimeRequest) => string | null | Promise<string |
 /**
  * Every one of these is `false` unless explicitly enabled — always-off by
  * default so upgrading this package never silently exposes new surface to
- * whoever `resolveUser` accepts. These resources are Project-level
- * configuration (LLM provider credentials, skill/knowledge-base/vector-store
- * management, security audit logs, an agent-building co-pilot) rather than
- * things an end user does in a chat session — most hosts should manage them
- * via `@personaai/sdk` directly from their own admin surface and never turn
- * these on. Turn one on only if you specifically want it reachable through
- * whatever `resolveUser` gates (which may not be "any logged-in end user" —
- * that's your call).
+ * whoever `resolveUser` accepts. Most are Project-level configuration (LLM
+ * provider credentials, skill/knowledge-base/vector-store management,
+ * security audit logs, an agent-building co-pilot) rather than things an end
+ * user does in a chat session — most hosts should manage them via
+ * `@personaai/sdk` directly from their own admin surface and never turn
+ * these on. `messages` is a per-request action rather than configuration,
+ * but it's off for the same reason: a send reaches whatever recipient the
+ * caller names. Turn one on only if you specifically want it reachable
+ * through whatever `resolveUser` gates (which may not be "any logged-in end
+ * user" — that's your call).
  */
 interface RuntimeCapabilities {
     /** Full Agent CRUD (create/get/update/delete/bulk-delete) beyond the always-on read-only `GET /agents` list. @default false */
@@ -215,6 +217,13 @@ interface RuntimeCapabilities {
     architect?: boolean;
     /** Full Workflow CRUD, draft authoring, versions, and Mermaid export beyond the always-on execution routes. @default false */
     workflowsWrite?: boolean;
+    /**
+     * Outbound SMS/WhatsApp (`POST /messages`, `POST /messages/agent`). Off by
+     * default because `to` is any E.164 number and every send spends this
+     * Project's Twilio balance — unlike `chat`/`voice` these routes aren't
+     * end-user-scoped. @default false
+     */
+    messages?: boolean;
 }
 /**
  * Serves a list of code-defined REST tools (built with `defineRestTool`
@@ -328,6 +337,6 @@ declare class RuntimeHttpError extends Error {
     constructor(status: number, code: string, message: string);
 }
 
-declare const RUNTIME_VERSION = "0.15.0";
+declare const RUNTIME_VERSION = "0.16.0";
 
 export { type CreateRuntimeOptions, type ErrorContext, type FileUploadContext, type MemoryWriteContext, RUNTIME_VERSION, type RcpManifestOptions, type ResolveUser, type RestToolManifestEntry, type RestToolsManifestOptions, type RunContext, type RunResult, type Runtime, type RuntimeBinaryResponse, type RuntimeBufferedResponse, type RuntimeCapabilities, type RuntimeHooks, RuntimeHttpError, type RuntimeMethod, type RuntimeRequest, type RuntimeResponse, type RuntimeStreamResponse, type RuntimeUploadedFile, type ThreadCreateContext, type ToolCallContext, type VoiceSessionCreateContext, type WorkflowNodeContext, createRuntime };

package/dist/index.d.ts

@@ -185,14 +185,16 @@ type ResolveUser = (request: RuntimeRequest) => string | null | Promise<string |
 /**
  * Every one of these is `false` unless explicitly enabled — always-off by
  * default so upgrading this package never silently exposes new surface to
- * whoever `resolveUser` accepts. These resources are Project-level
- * configuration (LLM provider credentials, skill/knowledge-base/vector-store
- * management, security audit logs, an agent-building co-pilot) rather than
- * things an end user does in a chat session — most hosts should manage them
- * via `@personaai/sdk` directly from their own admin surface and never turn
- * these on. Turn one on only if you specifically want it reachable through
- * whatever `resolveUser` gates (which may not be "any logged-in end user" —
- * that's your call).
+ * whoever `resolveUser` accepts. Most are Project-level configuration (LLM
+ * provider credentials, skill/knowledge-base/vector-store management,
+ * security audit logs, an agent-building co-pilot) rather than things an end
+ * user does in a chat session — most hosts should manage them via
+ * `@personaai/sdk` directly from their own admin surface and never turn
+ * these on. `messages` is a per-request action rather than configuration,
+ * but it's off for the same reason: a send reaches whatever recipient the
+ * caller names. Turn one on only if you specifically want it reachable
+ * through whatever `resolveUser` gates (which may not be "any logged-in end
+ * user" — that's your call).
  */
 interface RuntimeCapabilities {
     /** Full Agent CRUD (create/get/update/delete/bulk-delete) beyond the always-on read-only `GET /agents` list. @default false */
@@ -215,6 +217,13 @@ interface RuntimeCapabilities {
     architect?: boolean;
     /** Full Workflow CRUD, draft authoring, versions, and Mermaid export beyond the always-on execution routes. @default false */
     workflowsWrite?: boolean;
+    /**
+     * Outbound SMS/WhatsApp (`POST /messages`, `POST /messages/agent`). Off by
+     * default because `to` is any E.164 number and every send spends this
+     * Project's Twilio balance — unlike `chat`/`voice` these routes aren't
+     * end-user-scoped. @default false
+     */
+    messages?: boolean;
 }
 /**
  * Serves a list of code-defined REST tools (built with `defineRestTool`
@@ -328,6 +337,6 @@ declare class RuntimeHttpError extends Error {
     constructor(status: number, code: string, message: string);
 }
 
-declare const RUNTIME_VERSION = "0.15.0";
+declare const RUNTIME_VERSION = "0.16.0";
 
 export { type CreateRuntimeOptions, type ErrorContext, type FileUploadContext, type MemoryWriteContext, RUNTIME_VERSION, type RcpManifestOptions, type ResolveUser, type RestToolManifestEntry, type RestToolsManifestOptions, type RunContext, type RunResult, type Runtime, type RuntimeBinaryResponse, type RuntimeBufferedResponse, type RuntimeCapabilities, type RuntimeHooks, RuntimeHttpError, type RuntimeMethod, type RuntimeRequest, type RuntimeResponse, type RuntimeStreamResponse, type RuntimeUploadedFile, type ThreadCreateContext, type ToolCallContext, type VoiceSessionCreateContext, type WorkflowNodeContext, createRuntime };

package/dist/index.js

@@ -131,7 +131,7 @@ function evictStaleRuns(runs, now, graceMs = DEFAULT_RUN_GRACE_MS, maxTracked =
 }
 
 // src/version.ts
-var RUNTIME_VERSION = "0.15.0";
+var RUNTIME_VERSION = "0.16.0";
 
 // src/routes/health.ts
 var alwaysOnCapabilities = {
@@ -850,6 +850,92 @@ var createVoiceSession = async (request, ctx) => {
   return json(201, ticket);
 };
 
+// src/routes/messages.ts
+var MESSAGE_CHANNELS = /* @__PURE__ */ new Set(["sms", "whatsapp"]);
+function optionalChannel(body) {
+  const value = body.channel;
+  if (value === void 0) return void 0;
+  if (typeof value !== "string" || !MESSAGE_CHANNELS.has(value)) {
+    throw new RuntimeHttpError(400, "INVALID_REQUEST", '"channel" must be "sms" or "whatsapp".');
+  }
+  return value;
+}
+function optionalStringField(body, field) {
+  const value = body[field];
+  if (value === void 0) return void 0;
+  if (typeof value !== "string" || value.length === 0) {
+    throw new RuntimeHttpError(400, "INVALID_REQUEST", `"${field}" must be a non-empty string.`);
+  }
+  return value;
+}
+function optionalMediaUrl(body) {
+  const value = body.mediaUrl;
+  if (value === void 0) return void 0;
+  if (typeof value === "string" && value.length > 0) return value;
+  if (Array.isArray(value) && value.every((entry) => typeof entry === "string" && entry.length > 0)) {
+    return value;
+  }
+  throw new RuntimeHttpError(
+    400,
+    "INVALID_REQUEST",
+    '"mediaUrl" must be a string or an array of strings.'
+  );
+}
+function optionalContentVariables(body) {
+  const value = body.contentVariables;
+  if (value === void 0) return void 0;
+  if (typeof value === "string") return value;
+  if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+    return value;
+  }
+  throw new RuntimeHttpError(
+    400,
+    "INVALID_REQUEST",
+    '"contentVariables" must be an object or a JSON string.'
+  );
+}
+var sendMessage = async (request, ctx) => {
+  const body = requireBodyObject(request.body);
+  const to = requireStringField(body, "to");
+  const channel = optionalChannel(body);
+  const text = optionalStringField(body, "body");
+  const mediaUrl = optionalMediaUrl(body);
+  const contentSid = optionalStringField(body, "contentSid");
+  const contentVariables = optionalContentVariables(body);
+  if (text === void 0 && contentSid === void 0) {
+    throw new RuntimeHttpError(
+      400,
+      "INVALID_REQUEST",
+      '"body" is required unless "contentSid" is provided.'
+    );
+  }
+  const delivery = await ctx.client.messages.send({
+    to,
+    ...channel ? { channel } : {},
+    ...text ? { body: text } : {},
+    ...mediaUrl ? { mediaUrl } : {},
+    ...contentSid ? { contentSid } : {},
+    ...contentVariables ? { contentVariables } : {}
+  });
+  return json(200, delivery);
+};
+var sendAgentMessage = async (request, ctx) => {
+  const body = requireBodyObject(request.body);
+  const agentId = requireStringField(body, "agentId");
+  const to = requireStringField(body, "to");
+  const prompt = requireStringField(body, "prompt");
+  const channel = optionalChannel(body);
+  const displayName = optionalStringField(body, "displayName");
+  const delivery = await ctx.client.messages.sendFromAgent({
+    agentId,
+    to,
+    prompt,
+    ...channel ? { channel } : {},
+    ...displayName ? { displayName } : {}
+  });
+  return json(200, delivery);
+};
+
 // src/routes/agents.ts
 var listAgents = async (request, ctx) => {
   const items = await ctx.client.agents.list({
@@ -1579,7 +1665,8 @@ function resolveCapabilities(capabilities) {
     rcpSources: capabilities?.rcpSources ?? false,
     auditLogs: capabilities?.auditLogs ?? false,
     architect: capabilities?.architect ?? false,
-    workflowsWrite: capabilities?.workflowsWrite ?? false
+    workflowsWrite: capabilities?.workflowsWrite ?? false,
+    messages: capabilities?.messages ?? false
   };
 }
 function buildRoutes(capabilities) {
@@ -1670,6 +1757,12 @@ function buildRoutes(capabilities) {
       handler: cancelWorkflowRun
     }
   ];
+  if (capabilities.messages) {
+    routes.push(
+      { method: "POST", pattern: ["messages"], handler: sendMessage },
+      { method: "POST", pattern: ["messages", "agent"], handler: sendAgentMessage }
+    );
+  }
   if (capabilities.agentsWrite) {
     routes.push(
       { method: "POST", pattern: ["agents"], handler: createAgent },