@pikku/addon-graph 0.12.11 → 0.12.13

package/CHANGELOG.md

@@ -0,0 +1,409 @@
+# @pikku/addon-graph
+
+## 0.12.13
+
+### Patch Changes
+
+- 7722ceb: Split the addon leaf so an application cannot shadow a linked addon's own
+
+  An addon authored its services through `#pikku/addon`, and so did an
+  application installing one. Node keeps those apart — `#pikku/*` is a
+  package-private subpath import, resolved against the addon's own
+  `package.json` — but tsconfig `paths` are global to a tsx process, and every
+  runtime template maps `#pikku/*` onto a sibling package. A linked addon's
+  `#pikku/addon` was resolved against the _application's_ leaf, which holds the
+  install half and none of the authoring exports, and every template failed to
+  boot with `does not provide an export named 'pikkuAddonServices'`.
+
+  The authoring half now sits at `#pikku/addon/setup`. An application generates a
+  flat `.pikku/<leaf>`, so there is nothing there for that specifier to match and
+  the resolver falls back to Node, which reads the addon's own imports. Addons
+  declaring themselves import `pikkuAddonConfig`, `pikkuAddonServices` and
+  `pikkuAddonWireServices` from `#pikku/addon/setup`; `wireAddon` and
+  `wireRemoteAddon` stay at `#pikku/addon`.
+
+  `wireAddon` and `wireRemoteAddon` also move off `@pikku/core/rpc` onto
+  `@pikku/core/addon`. Being reached over rpc is how an addon is called rather
+  than what it is, and it put the whole addon surface behind the rpc subpath for
+  consumers that only wanted to install one.
+
+- 266e3bc: One door per name: `@pikku/core/ecosystem/*` and the package root are gone
+
+  `@pikku/core` published every module twice. `ecosystem/http` re-exported
+  `./http`, `ecosystem/services` re-exported `./services`, and a name was
+  reachable through either — so every addition had to be made in two places, and a
+  consumer's import said nothing about what it actually used. The package root was
+  the same problem at a larger scale: a single barrel of 206 names that no bundler
+  could take apart, and the one specifier that revealed nothing at all.
+
+  Both are deleted. Every name now lives on the subpath that owns it, and every
+  import carries that subpath — `@pikku/core/http`, `@pikku/core/services`,
+  `@pikku/core/errors`, `@pikku/core/types`.
+
+  Deleting the facades meant the raw subpaths had to become a superset of them,
+  which they were not: the facade tree had accumulated 25 names with no raw home
+  and about 26 more filed under a different area than the module they came from.
+  Those names moved to the area that owns them, and three areas were published as
+  new entry points rather than left on a root that is going away — `./types` (the
+  shared type surface, the largest single destination), `./state` and
+  `./classification`.
+
+  `./classification` is one door onto one subject: what a value is and how it must
+  be handled. Its three halves would each have been an entry point — the brands
+  and manifest types, the stored-form helpers (`hashToken`, `unsafeAsSealed` and
+  friends), and `SecretValue` — split by whether a name happens to be a type or a
+  value, which is the same defect as the facades. The duration and versioned-id
+  helpers went to `./utils`, which already published, and `PikkuRequest` went to
+  `./function`: it is the transport-agnostic request base, not an HTTP one — HTTP
+  has `PikkuHTTPAbstractRequest`, and the only thing outside core that extends
+  `PikkuRequest` is Azure's timer request.
+
+  `./types` inherited the root barrel's habit before it inherited its contents, so
+  the names with an owner elsewhere were moved off it. The middleware types and the
+  five middleware factories — `pikkuMiddleware`, `pikkuMiddlewareFactory`,
+  `pikkuChannelMiddleware`, `pikkuChannelMiddlewareFactory` and
+  `pikkuAgentMiddleware`, runtime values on a types entry point — are now
+  `@pikku/core/middleware`; the function meta types are `@pikku/core/function`;
+  `SerializedError` is `@pikku/core/errors`; and the generic TypeScript helpers
+  (`MakeRequired`, `PickRequired`, `PickOptional`, `RequireAtLeastOne`,
+  `JSONPrimitive`, `JSONValue`) are `@pikku/core/utils`. What is left on `./types`
+  is the vocabulary the wirings share, which no single module owns.
+
+  `pikku` was itself a root barrel — `export * from '@pikku/core'` — and
+  now exports only the services it bundles.
+
+  One module survives at the old specifier, and only for the bootstrap:
+  `packages/cli` is generated by the _published_ CLI pinned in its `build.sh`, and
+  that CLI still writes a bare `@pikku/core` into the files it generates for the
+  CLI itself. `bootstrap-compat/root.ts` carries the eight types it names, a test
+  in core fails if that list grows, and it goes when the pin moves to a CLI
+  released from this branch. The adapter names the pinned CLI reaches for —
+  `pikkuState` and `CreateWireServices` — are rewritten to `@pikku/core/state` and
+  `@pikku/core/types` by the same `build.sh` patch pass, so no second shim is
+  needed for them.
+
+  A guard test keeps the root shut: it parses imports and rejects a bare
+  `@pikku/core` rather than grepping for it, because several tests hold a user's
+  file as a template literal, where `import … from '@pikku/core'` is fixture text
+  rather than an import this repo makes.
+
+  An agent scaffold a project generated under an older CLI is refreshed rather
+  than left to fail: `pikku all` already deleted one importing an entry point
+  `@pikku/core` no longer publishes, and the `#pikku` hub joins that list.
+  Without it a project that scaffolds the agent endpoint but
+  declares no agents keeps the old file forever — the generator that would rewrite
+  it only runs when agents exist, and the file being present is what stops it
+  being regenerated as missing.
+
+  `pikku new addon` also wrote a tsconfig `paths` map naming only the deleted hub.
+  An addon's `imports` map points into `dist`, so `paths` is what resolves
+  `#pikku/<leaf>` for the addon's own source build — it now names the two leaf
+  patterns, in both the addon and its test harness.
+
+- 6eef0a0: Bump every dependency to its latest compatible minor/patch across the monorepo.
+- 892100b: Make the generated `NodeConfig` narrowing reach the place people write `node:`
+
+  An addon declares its categories in `pikku.config.json`, and the CLI generates a
+  `NodeConfig` whose `category` narrows to that union. It never checked anything:
+  `pikkuFunc`'s config came straight from `CorePikkuFunctionConfig`, whose
+  `node?: CoreNodeConfig` types `category` as `string`. The narrowed type was
+  generated for two sibling barrels — the workflow and scenario configs import it
+  — and for nothing else, so the one position a user writes a `node:` block was
+  typed by core all along. `PikkuFunctionConfig`, `PikkuFunctionSessionlessConfig`
+  and both schema-overload variants now omit core's `node` and re-add it as
+  `NodeConfig`, so an undeclared category is a compile error rather than only a
+  codegen critical.
+
+  Second half of the same bug: the config key that carries those categories moved
+  from a top-level `node` block to `addon` when node was renamed to addon, and
+  eight config files in this repo were never migrated — every e2e addon,
+  `@pikku/addon-graph`, the `function-addon` template and the registry verifier.
+  `addon` accepts `boolean | object` and the stray `node` key was silently
+  ignored, so each of them shipped `"package": {}` in its generated addon
+  metadata: no displayName, no description, no icon, no categories, and
+  `pikkuNodesMeta`'s category validation never ran. They now sit under `addon`.
+
+  With that validation live for the first time, `@pikku/addon-graph`'s `readFile`
+  and `writeFile` turned out to declare a `Files` category the package never
+  listed. `Files` is now declared.
+
+- Updated dependencies [7722ceb]
+- Updated dependencies [375c1ff]
+- Updated dependencies [02a70cd]
+- Updated dependencies [aeef159]
+- Updated dependencies [a281de6]
+- Updated dependencies [266e3bc]
+- Updated dependencies [02a70cd]
+- Updated dependencies [786dae5]
+- Updated dependencies [6eef0a0]
+- Updated dependencies [3561d67]
+- Updated dependencies [a91c433]
+- Updated dependencies [02a70cd]
+- Updated dependencies [9537f74]
+- Updated dependencies [2b57ca8]
+- Updated dependencies [266e3bc]
+- Updated dependencies [9fce0f1]
+- Updated dependencies [83683a0]
+- Updated dependencies [456c88b]
+- Updated dependencies [456c88b]
+- Updated dependencies [c127273]
+  - @pikku/core@0.12.85
+
+## 0.12.12
+
+### Patch Changes
+
+- 6794681: Publish the ecosystem surface as per-area sub-barrels under `@pikku/core/ecosystem/*`, and point generated code, the CLI, the inspector and the runtime adapters at them.
+
+  348 names that only generated code, the toolchain or a runtime adapter ever imports now have a second home on `@pikku/core/ecosystem/<area>` — one sub-barrel per area, matching how core already publishes its entrypoints, so no single barrel grows without bound and a consumer only pulls in the area it uses.
+
+  This step is additive: every name is still exported from the entrypoint it was published from before, so nothing downstream breaks. Removing them from the app-facing barrels is a later change, and needs a release carrying `./ecosystem/*` first.
+
+- a534a50: Bound two peer ranges that were declared as `*`, and add a check that keeps peer ranges across the monorepo mutually satisfiable.
+
+  `@pikku/addon-graph` declared `@pikku/core` as `*` and `@pikku/next` declared `react-dom` as `*`. A wildcard promises compatibility with majors that do not exist yet, and because it intersects every other range nothing ever flags it. They are now `^0.12.83` (the core version addon-graph is built against) and `^18 || ^19` (matching `@pikku/react`, `@pikku/mantine` and `@pikku/assistant-ui`).
+
+  `scripts/check-peer-dependency-consistency.mjs` runs in CI and in `yarn release`. It does not require every declaration of a peer to be the same string — a range is a constraint, and intersecting constraints is the package manager's job, so `^0.12.44` and `^0.12.83` coexisting is correct and pinning them into lockstep would invent floors nobody verified. It fails only when ranges have no version in common, or when a peer another package bounds is left unbounded.
+
+- Updated dependencies [7406bfe]
+- Updated dependencies [6794681]
+  - @pikku/core@0.12.84
+
+## 0.12.11
+
+### Patch Changes
+
+- 2f15aad: Resolve every entry point under `dist`
+
+  `imports["#pikku"]` named `./.pikku/pikku-types.gen.ts` — a TypeScript file, at
+  runtime, inside `node_modules` — while `files` publishes only `dist`. The
+  generated output under `dist/.pikku` also imports a `types/application-types.d.js`
+  that nothing was copying there, since a hand-written `.d.ts` is an input to
+  `tsc` rather than something it emits.
+
+  Both now point at the built copy. The addon's own build resolves `#pikku`
+  through tsconfig `paths`, so no entry point has to reach into the source tree.
+
+- Updated dependencies [e110c55]
+- Updated dependencies [e110c55]
+- Updated dependencies [e110c55]
+- Updated dependencies [acc8077]
+- Updated dependencies [905f737]
+- Updated dependencies [3cc6428]
+- Updated dependencies [c524adf]
+- Updated dependencies [e110c55]
+  - @pikku/core@0.12.81
+
+## 0.12.10
+
+### Patch Changes
+
+- ae4e898: Carry a secret's `allowedHosts` through code generation, and close three gaps in
+  the SSRF guard.
+
+  `allowedHosts` was declared and enforced but never survived codegen: the
+  inspector did not read the property off the `defineSecret` literal, and the meta
+  builder rebuilt its objects without it. Enforcement in `assertSecretAllowedForHost`
+  then always saw `undefined`, so the egress restriction was a no-op by default —
+  and, with `secrets.requireAllowedHosts` set, threw for every secret including the
+  ones that correctly declared hosts. Both stages now carry the field, and the
+  secrets verifier asserts it against the generated JSON rather than a hand-written
+  meta literal, which is why the existing tests stayed green.
+
+  `isPrivateHost` now checks an explicit CIDR table instead of ad-hoc octet
+  comparisons. It previously missed `100.64.0.0/10` — which contains Alibaba
+  Cloud's `100.100.100.200` metadata endpoint — along with `192.0.0.0/24`,
+  `198.18.0.0/15`, `192.88.99.0/24`, the TEST-NETs, multicast and reserved space.
+  IPv6 gains a real parser, so `fec0::/10`, `ff00::/8`, and NAT64 (`64:ff9b::/96`)
+  and 6to4 (`2002::/16`) forms wrapping an internal IPv4 address are caught.
+
+  `safeFetch` takes an optional `resolveHost`, checked on the initial URL and every
+  redirect hop, so a _public_ hostname pointing at a private address is refused —
+  the `169-254-169-254.nip.io` shape a literal-only check cannot see. Core cannot
+  resolve DNS itself (Workers has no DNS API), so the Node resolver ships as
+  `@pikku/core/node-host-resolver` and the Node server runtimes install it during
+  `init()`. The connection is not pinned to the address that was checked, so a
+  rebind between check and connect is still possible.
+
+  The graph addon's `httpRequest` node called bare `fetch`, bypassing the guard
+  entirely; it now goes through `safeFetch`.
+
+- Updated dependencies [e848eb2]
+- Updated dependencies [b170489]
+- Updated dependencies [ae4e898]
+  - @pikku/core@0.12.79
+
+## 0.12.9
+
+### Patch Changes
+
+- 78b29f0: `SecretService` now returns a `SecretValue<T>` rather than the bare value, so a
+  vault secret cannot reach a sink by accident.
+
+  `SecretValue` is nominally typed, which means it is not assignable to `string`
+  (or to any other concretely-typed field). Every sink with a real type — a
+  database column, an email body, a session payload — rejects it with no lint
+  rule involved. The sinks typed `any`, `unknown`, or a free generic — the logger,
+  queue payloads, webhook and email inputs, and a function's own output — are
+  guarded with `Safe<T>`, which collapses a `SecretValue` found anywhere inside
+  `T`, however deeply nested, to `never`.
+
+  Unwrap deliberately at the point the secret reaches the wire:
+
+  ```ts
+  const secret = await secrets.getSecret('BETTER_AUTH_SECRET')
+  betterAuth({ secret: secret.reveal() })
+  ```
+
+  Two behaviours cover what types cannot see. Structured serialization redacts —
+  `JSON.stringify` and node's inspect both yield `[secret]`, so an audit or log
+  write stays honest without crashing the request. String coercion throws
+  `SecretCoercionError`, because a template literal is always a leak.
+
+  `AuditLog.write` is guarded the same way as the logger, since an audit event
+  carries `input` and `metadata` as `unknown` and nominality alone cannot stop a
+  secret landing in one.
+
+  `.reveal()` is the deliberate escape hatch, and what it hands back is an
+  ordinary string as far as every sink signature is concerned. **PKU953** closes
+  that gap: under `pikku all --security` the inspector reports a revealed secret
+  that flows into a logger, an audit, a queue, an email or a webhook — `console` included.
+
+  This also fixed a real one: `remote-addon-auth.ts` called `String(token)` on an
+  `unknown` and wrote the result straight into an `Authorization` header.
+
+- Updated dependencies [62ea4cc]
+- Updated dependencies [9dddff8]
+- Updated dependencies [78b29f0]
+  - @pikku/core@0.12.76
+
+## 0.12.8
+
+### Patch Changes
+
+- 8075f6a: Confine `SecretService` to the places an app is wired.
+
+  `secrets` is now omitted from the services every function, AI agent, workflow,
+  permission and wire receives, and the function runner replaces it with a
+  throwing accessor so a cast cannot reach past the type. It stays available in
+  `pikkuServices`, `pikkuWireServices`, addon service factories and middleware —
+  read a secret there, give it to a service, and have the function ask that
+  service.
+
+  Alongside it:
+  - `wireSecret` gains `allowedHosts`, refusing a secret attached to a host it was
+    not declared for. Permissive by default; strict via
+    `config.secrets.requireAllowedHosts`.
+  - `pikku-graph`'s `httpRequest` resolves and attaches its credential inside a new
+    `httpRequester` service instead of holding the plaintext in the function.
+  - New inspector diagnostics: `PKU950` (a `SecretService` exposed under another
+    service name), `PKU951` (a secret read that no `wireSecret` declares) and
+    `PKU952` (a secret read with a non-literal key).
+
+- Updated dependencies [6a307f0]
+- Updated dependencies [afef587]
+- Updated dependencies [8075f6a]
+  - @pikku/core@0.12.74
+
+## 0.12.7
+
+### Patch Changes
+
+- 637e668: State every package's license in the package itself.
+
+  Eight publishable packages had no `license` field, `@pikku/aws-services` said `UNLICENSED` by accident, and no package carried a LICENSE file at all — the grant lived only in the repo root, which npm tarballs never include. Every publishable package now declares its license and ships the matching LICENSE file, and `yarn check:licenses` fails the release if the two ever disagree.
+
+  `@pikku/console` is now explicitly BUSL-1.1 and named in the root LICENSE's Licensed Work alongside `@pikku/cli` and `@pikku/inspector`; the Additional Use Grant still permits production use for any purpose, including in free and open source software. Everything else — runtimes, services, clients, deploy adapters and the agent skills — is MIT, as the root LICENSE already said.
+
+- Updated dependencies [8a2c993]
+- Updated dependencies [a261006]
+- Updated dependencies [09973b9]
+  - @pikku/core@0.12.71
+
+## 0.12.6
+
+### Patch Changes
+
+- cb079cc: `graph:httpRequest` gains an optional `auth` descriptor (bearer/apiKeyHeader/apiKeyQuery/basic) resolved from the `SecretService` at request time; `oauth2` is a guarded not-yet-supported error.
+- cb079cc: Rename the `graph:map` addon function (and its `Map*` types) to `graph:fanout`, which better names invoking a child RPC once per element and collecting ordered results.
+- cb079cc: Map n8n's Aggregate `aggregateAllItemData` mode onto `graph:aggregate` (new additive `includeAllItems` flag), converting ~164 previously-stubbed Aggregate nodes into real graph functions.
+- cb079cc: Map n8n's Merge `append` mode (and mode-less Merge default) onto a new `graph:concat` addon function that flattens all input streams, converting ~103 previously-stubbed Merge nodes.
+- cb079cc: Import n8n RAG flows (v1) — retrieval-as-tool, chainRetrievalQa, and ingestion — as runnable vector-store addon calls driven by a new `rag-map`, plus a new `graph:splitText` builtin.
+- Updated dependencies [7ab5287]
+- Updated dependencies [e86bc17]
+- Updated dependencies [a9b96a0]
+- Updated dependencies [3f7fc54]
+- Updated dependencies [c478794]
+- Updated dependencies [3f04ae4]
+- Updated dependencies [90d9f04]
+- Updated dependencies [cb079cc]
+- Updated dependencies [cb079cc]
+- Updated dependencies [0a7db82]
+- Updated dependencies [981c4db]
+- Updated dependencies [13474a6]
+- Updated dependencies [5a2b0d5]
+- Updated dependencies [13474a6]
+- Updated dependencies [ee040dc]
+- Updated dependencies [cb079cc]
+- Updated dependencies [13474a6]
+- Updated dependencies [9f0d0eb]
+- Updated dependencies [13474a6]
+- Updated dependencies [70fa400]
+- Updated dependencies [7b2ea23]
+- Updated dependencies [1dc77d5]
+- Updated dependencies [416606c]
+- Updated dependencies [d2a6eea]
+- Updated dependencies [30e62ee]
+  - @pikku/core@0.12.64
+
+## 0.12.5
+
+### Patch Changes
+
+- 41ce2cb: Upgrade to TypeScript 6 and raise the minimum Node.js version to 22.
+
+  All packages now build against `typescript@^6.0.3` and declare `engines.node >= 22`. Internal tooling (`ts-json-schema-generator`, `zod-to-ts`) was bumped to TypeScript 6-compatible releases.
+
+- Updated dependencies [41ce2cb]
+  - @pikku/core@0.12.44
+
+## 0.12.4
+
+### Patch Changes
+
+- 0a2af8b: Stop addon packages from rebuilding via the workspace pikku CLI at publish time.
+
+  `npx changeset publish` runs up to 10 `npm publish` processes concurrently, and
+  `@pikku/cli`'s publish build (`build.sh`) starts with `rm -rf -- .pikku dist`.
+  An addon whose `prepublishOnly` ran the workspace CLI (`pikku all`, or a
+  `build.sh` invoking `cli/dist/bin/pikku.js`) could read `packages/cli/dist`
+  mid-wipe and fail with `Cannot find module '.../cli/dist/src/services.js'`,
+  breaking the release. `yarn release` already builds every package before
+  publishing, so the `prepublishOnly` rebuild was redundant; it has been removed
+  from both addons and a `check:no-publish-rebuild` guard now fails CI if any
+  published package reintroduces a publish-time CLI rebuild.
+
+## 0.12.3
+
+### Patch Changes
+
+- 4f8917f: Fix publish builds by falling back to a published CLI when the local workspace CLI binary is unavailable during release packaging.
+
+## 0.12.2
+
+### Patch Changes
+
+- 9060165: Fix `@pikku/addon-graph` package exports so generated bootstrap files can be imported correctly. The Node.js HTTP server adapter is unified across dev, standalone, and container deployments. Next.js gains a worker-RPC transport. Date values in fetch responses now deserialise correctly.
+- Updated dependencies [9060165]
+- Updated dependencies [9060165]
+- Updated dependencies [9060165]
+  - @pikku/core@0.12.21
+
+## 0.0.2
+
+### Patch Changes
+
+- 3e04565: chore: update dependencies to latest minor/patch versions
+- Updated dependencies [cc4c9e9]
+- Updated dependencies [3e04565]
+  - @pikku/core@0.12.2

package/dist/.pikku/addon/agent/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * This file was generated by @pikku/cli@0.12.107
+ */
+/**
+ * Subpath entry — `#pikku/agent` resolves here.
+ */
+export * from './pikku-agent-types.gen.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/.pikku/addon/agent/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../.pikku/addon/agent/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;GAEG;AAEH,cAAc,4BAA4B,CAAA"}

package/dist/.pikku/addon/agent/index.js

@@ -0,0 +1,8 @@
+/**
+ * This file was generated by @pikku/cli@0.12.107
+ */
+/**
+ * Subpath entry — `#pikku/agent` resolves here.
+ */
+export * from './pikku-agent-types.gen.js';
+//# sourceMappingURL=index.js.map

package/dist/.pikku/addon/agent/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../.pikku/addon/agent/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;GAEG;AAEH,cAAc,4BAA4B,CAAA"}

package/dist/.pikku/addon/agent/pikku-agent-types.gen.d.ts

@@ -0,0 +1,54 @@
+/**
+ * This file was generated by @pikku/cli@0.12.107
+ */
+import { CoreAgent } from '@pikku/core/agent';
+import { pikkuAgentScorer as corePikkuAgentScorer, pikkuAgentJudge as corePikkuAgentJudge } from '@pikku/core/agent-scorer';
+import type { Services, PikkuFunctionConfig } from '../function/pikku-function-types.gen.js';
+import type { PikkuPermission } from '../auth/pikku-auth-types.gen.js';
+import type { PikkuMiddleware } from '../middleware/pikku-middleware-types.gen.js';
+import type { StandardSchemaV1 } from '@standard-schema/spec';
+import type { AgentMemoryConfig, AgentInput } from '@pikku/core/agent';
+import type { AgentMap } from './pikku-agent-map.gen.d.js';
+import type { ScopeId } from '../scopes/pikku-scopes.gen.js';
+import type { ScorerName } from './pikku-scorer-names.gen.d.js';
+type AgentConfig<InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined> = Omit<CoreAgent<PikkuPermission, PikkuMiddleware, ScopeId, ScorerName>, 'tools' | 'agents' | 'workflows' | 'memory' | 'input' | 'output'> & {
+    input?: InputSchema;
+    output?: OutputSchema;
+    memory?: Omit<AgentMemoryConfig, 'workingMemory'> & {
+        workingMemory?: StandardSchemaV1;
+    };
+    tools?: object[];
+    agents?: AgentConfig<StandardSchemaV1 | undefined, StandardSchemaV1 | undefined>[];
+    workflows?: object[];
+};
+export declare const pikkuAgent: <InputSchema extends StandardSchemaV1 | undefined = undefined, OutputSchema extends StandardSchemaV1 | undefined = undefined>(agent: AgentConfig<InputSchema, OutputSchema>) => AgentConfig<InputSchema, OutputSchema>;
+export declare const pikkuAgentScorer: (config: Parameters<typeof corePikkuAgentScorer<Services>>[0]) => import("@pikku/core/agent-scorer").PikkuAgentScorer<Services>;
+export declare const pikkuAgentJudge: (config: Parameters<typeof corePikkuAgentJudge<Services>>[0]) => import("@pikku/core/agent-scorer").PikkuAgentScorer<Services>;
+export declare const agent: <Name extends keyof AgentMap>(agentName: Name) => PikkuFunctionConfig<AgentInput, {
+    runId: string;
+    result: AgentMap[Name]["output"];
+    usage: {
+        inputTokens: number;
+        outputTokens: number;
+    };
+}, "session" | "rpc">;
+export declare const agentStream: <Name extends keyof AgentMap>(agentName?: Name | undefined) => PikkuFunctionConfig<{
+    agentName?: string;
+    message: string;
+    threadId: string;
+    resourceId: string;
+}, void, "session" | "rpc">;
+export declare const agentResume: () => PikkuFunctionConfig<{
+    runId: string;
+    toolCallId: string;
+    approved: boolean;
+}, void, "session" | "rpc">;
+export declare const agentApprove: <Name extends keyof AgentMap>(agentName: Name) => PikkuFunctionConfig<{
+    runId: string;
+    approvals: {
+        toolCallId: string;
+        approved: boolean;
+    }[];
+}, unknown, "session" | "rpc">;
+export {};
+//# sourceMappingURL=pikku-agent-types.gen.d.ts.map

package/dist/.pikku/addon/agent/pikku-agent-types.gen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pikku-agent-types.gen.d.ts","sourceRoot":"","sources":["../../../../.pikku/addon/agent/pikku-agent-types.gen.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAO7C,OAAO,EACL,gBAAgB,IAAI,oBAAoB,EACxC,eAAe,IAAI,mBAAmB,EACvC,MAAM,0BAA0B,CAAA;AACjC,OAAO,KAAK,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAA;AAC5F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAA;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6CAA6C,CAAA;AAClF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAA;AAC1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,+BAA+B,CAAA;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAA;AAE/D,KAAK,WAAW,CACd,WAAW,SAAS,gBAAgB,GAAG,SAAS,GAAG,SAAS,EAC5D,YAAY,SAAS,gBAAgB,GAAG,SAAS,GAAG,SAAS,IAC3D,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,eAAe,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC,GAAG;IAC7I,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,MAAM,CAAC,EAAE,IAAI,CAAC,iBAAiB,EAAE,eAAe,CAAC,GAAG;QAAE,aAAa,CAAC,EAAE,gBAAgB,CAAA;KAAE,CAAA;IACxF,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB,MAAM,CAAC,EAAE,WAAW,CAAC,gBAAgB,GAAG,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC,EAAE,CAAA;IAClF,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CACrB,CAAA;AAED,eAAO,MAAM,UAAU,GACrB,WAAW,SAAS,gBAAgB,GAAG,SAAS,GAAG,SAAS,EAC5D,YAAY,SAAS,gBAAgB,GAAG,SAAS,GAAG,SAAS,EAE7D,OAAO,WAAW,CAAC,WAAW,EAAE,YAAY,CAAC,2CAG9C,CAAA;AAED,eAAO,MAAM,gBAAgB,GAC3B,QAAQ,UAAU,CAAC,OAAO,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,kEACnB,CAAA;AAE3C,eAAO,MAAM,eAAe,GAC1B,QAAQ,UAAU,CAAC,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,kEACnB,CAAA;AAI1C,eAAO,MAAM,KAAK,GAAI,IAAI,SAAS,MAAM,QAAQ,EAC/C,WAAW,IAAI,KAEqD,mBAAmB,CACrF,UAAU,EACV;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;IAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EACzG,SAAS,GAAG,KAAK,CAEpB,CAAA;AAED,eAAO,MAAM,WAAW,GAAI,IAAI,SAAS,MAAM,QAAQ,EACrD,4BAAgB,KAE0D,mBAAmB,CAC3F;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAC7E,IAAI,EACJ,SAAS,GAAG,KAAK,CAEpB,CAAA;AAED,eAAO,MAAM,WAAW,QACM,mBAAmB,CAC7C;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,EACxD,IAAI,EACJ,SAAS,GAAG,KAAK,CAEpB,CAAA;AAED,eAAO,MAAM,YAAY,GAAI,IAAI,SAAS,MAAM,QAAQ,EACtD,WAAW,IAAI,KAE4D,mBAAmB,CAC5F;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,EAAE,CAAA;CAAE,EACzE,OAAO,EACP,SAAS,GAAG,KAAK,CAEpB,CAAA"}

package/dist/.pikku/addon/agent/pikku-agent-types.gen.js

@@ -0,0 +1,20 @@
+import { agent as coreAgent, agentStream as coreAgentStream, agentResume as coreAgentResume, agentApprove as coreAgentApprove, } from '@pikku/core/agent';
+import { pikkuAgentScorer as corePikkuAgentScorer, pikkuAgentJudge as corePikkuAgentJudge, } from '@pikku/core/agent-scorer';
+export const pikkuAgent = (agent) => {
+    return agent;
+};
+export const pikkuAgentScorer = (config) => corePikkuAgentScorer(config);
+export const pikkuAgentJudge = (config) => corePikkuAgentJudge(config);
+export const agent = (agentName) => {
+    return coreAgent(agentName);
+};
+export const agentStream = (agentName) => {
+    return coreAgentStream(agentName);
+};
+export const agentResume = () => {
+    return coreAgentResume();
+};
+export const agentApprove = (agentName) => {
+    return coreAgentApprove(agentName);
+};
+//# sourceMappingURL=pikku-agent-types.gen.js.map

package/dist/.pikku/addon/agent/pikku-agent-types.gen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pikku-agent-types.gen.js","sourceRoot":"","sources":["../../../../.pikku/addon/agent/pikku-agent-types.gen.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,KAAK,IAAI,SAAS,EAClB,WAAW,IAAI,eAAe,EAC9B,WAAW,IAAI,eAAe,EAC9B,YAAY,IAAI,gBAAgB,GACjC,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,gBAAgB,IAAI,oBAAoB,EACxC,eAAe,IAAI,mBAAmB,GACvC,MAAM,0BAA0B,CAAA;AAsBjC,MAAM,CAAC,MAAM,UAAU,GAAG,CAIxB,KAA6C,EAC7C,EAAE;IACF,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,MAA4D,EAC5D,EAAE,CAAC,oBAAoB,CAAW,MAAM,CAAC,CAAA;AAE3C,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,MAA2D,EAC3D,EAAE,CAAC,mBAAmB,CAAW,MAAM,CAAC,CAAA;AAI1C,MAAM,CAAC,MAAM,KAAK,GAAG,CACnB,SAAe,EACf,EAAE;IACF,OAAO,SAAS,CAAW,SAAoC,CAI9D,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,SAAgB,EAChB,EAAE;IACF,OAAO,eAAe,CAAW,SAAoC,CAIpE,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,GAAG,EAAE;IAC9B,OAAO,eAAe,EAIrB,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,SAAe,EACf,EAAE;IACF,OAAO,gBAAgB,CAAW,SAAoC,CAIrE,CAAA;AACH,CAAC,CAAA"}

package/dist/.pikku/addon/agent/pikku-model-aliases.gen.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=pikku-model-aliases.gen.d.ts.map

package/dist/.pikku/addon/agent/pikku-model-aliases.gen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pikku-model-aliases.gen.d.ts","sourceRoot":"","sources":["../../../../.pikku/addon/agent/pikku-model-aliases.gen.ts"],"names":[],"mappings":""}

package/dist/.pikku/addon/agent/pikku-model-aliases.gen.js

@@ -0,0 +1,6 @@
+/**
+ * This file was generated by @pikku/cli@0.12.107
+ */
+import { pikkuState } from '@pikku/core/state';
+pikkuState('@pikku/addon-graph', 'agent', 'modelAliases', {});
+//# sourceMappingURL=pikku-model-aliases.gen.js.map

package/dist/.pikku/addon/agent/pikku-model-aliases.gen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pikku-model-aliases.gen.js","sourceRoot":"","sources":["../../../../.pikku/addon/agent/pikku-model-aliases.gen.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAE9C,UAAU,CAAC,oBAAoB,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,CAAC,CAAA"}

package/dist/.pikku/addon/auth/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * This file was generated by @pikku/cli@0.12.107
+ */
+/**
+ * Subpath entry — `#pikku/auth` resolves here.
+ */
+export * from './pikku-auth-types.gen.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/.pikku/addon/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../.pikku/addon/auth/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;GAEG;AAEH,cAAc,2BAA2B,CAAA"}

package/dist/.pikku/addon/auth/index.js

@@ -0,0 +1,8 @@
+/**
+ * This file was generated by @pikku/cli@0.12.107
+ */
+/**
+ * Subpath entry — `#pikku/auth` resolves here.
+ */
+export * from './pikku-auth-types.gen.js';
+//# sourceMappingURL=index.js.map

package/dist/.pikku/addon/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../.pikku/addon/auth/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;GAEG;AAEH,cAAc,2BAA2B,CAAA"}