@pikku/cli 0.12.82 → 0.12.85

package/dist/src/functions/commands/scopes-audit.js

@@ -0,0 +1,37 @@
+import { pikkuSessionlessFunc } from '#pikku';
+import { loadDeclaredScopes, openScopeService, reportStaleScopes, } from './scopes-shared.js';
+export const scopesAudit = pikkuSessionlessFunc({
+    remote: true,
+    func: async ({ logger, config }) => {
+        const declared = await loadDeclaredScopes(config.scopesMetaJsonFile, logger);
+        if (!declared) {
+            throw new Error('scope metadata not found');
+        }
+        const opened = await openScopeService({ config, logger }, declared, 'pikku scopes audit');
+        if (!opened) {
+            return;
+        }
+        try {
+            const stale = await opened.service.findStaleScopes();
+            logger.info(`Scope audit: ${declared.length} scope(s) declared in code`);
+            if (stale.length === 0) {
+                logger.info('  every scope in the database is still declared');
+                return;
+            }
+            logger.info('');
+            logger.info(`${stale.length} scope(s) no longer declared in code:`);
+            reportStaleScopes(stale, logger);
+            const granted = stale.filter((s) => s.roles.length > 0);
+            logger.info('');
+            if (granted.length > 0) {
+                logger.warn(`${granted.length} undeclared scope(s) are still granted by a role. ` +
+                    `They authorize nothing — no function can require a scope that is not declared — ` +
+                    `but the grants persist until removed.`);
+            }
+            logger.info('Run `pikku scopes prune --yes` to remove them.');
+        }
+        finally {
+            await opened.destroy();
+        }
+    },
+});

package/dist/src/functions/commands/scopes-prune.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Removes scopes that are no longer declared in code, cascading them out of
+ * every role that holds them.
+ *
+ * This revokes access, so it never runs implicitly — not at boot, not as part
+ * of `pikku all`. Without `--yes` it only reports the blast radius.
+ */
+export declare const scopesPrune: import("#pikku").PikkuFunctionConfig<{
+    yes?: boolean;
+}, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{
+    yes?: boolean;
+}, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<{
+    yes?: boolean;
+}, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/scopes-prune.js

@@ -0,0 +1,50 @@
+import { pikkuSessionlessFunc } from '#pikku';
+import { loadDeclaredScopes, openScopeService, reportStaleScopes, } from './scopes-shared.js';
+/**
+ * Removes scopes that are no longer declared in code, cascading them out of
+ * every role that holds them.
+ *
+ * This revokes access, so it never runs implicitly — not at boot, not as part
+ * of `pikku all`. Without `--yes` it only reports the blast radius.
+ */
+export const scopesPrune = pikkuSessionlessFunc({
+    remote: true,
+    func: async ({ logger, config }, { yes }) => {
+        const declared = await loadDeclaredScopes(config.scopesMetaJsonFile, logger);
+        if (!declared) {
+            throw new Error('scope metadata not found');
+        }
+        const opened = await openScopeService({ config, logger }, declared, 'pikku scopes prune');
+        if (!opened) {
+            return;
+        }
+        try {
+            const stale = await opened.service.findStaleScopes();
+            if (stale.length === 0) {
+                logger.info('scopes prune: nothing to prune');
+                return;
+            }
+            logger.info(`${stale.length} scope(s) no longer declared in code:`);
+            reportStaleScopes(stale, logger);
+            const granted = stale.filter((s) => s.roles.length > 0);
+            const affectedRoles = new Set(stale.flatMap(({ roles }) => roles));
+            if (!yes) {
+                logger.info('');
+                if (granted.length > 0) {
+                    logger.warn(`Pruning would revoke ${granted.length} scope(s) from the roles above.`);
+                }
+                logger.info('Re-run with --yes to remove them.');
+                return;
+            }
+            const pruned = await opened.service.pruneScopes();
+            logger.info('');
+            logger.info(`scopes prune: removed ${pruned.length} scope(s)`);
+            if (granted.length > 0) {
+                logger.warn(`Revoked from ${affectedRoles.size} role(s). Users holding those roles lose these scopes on their next request.`);
+            }
+        }
+        finally {
+            await opened.destroy();
+        }
+    },
+});

package/dist/src/functions/commands/scopes-shared.d.ts

@@ -0,0 +1,39 @@
+import type { FlatScope } from '@pikku/core/scope';
+import { KyselyScopeService } from '@pikku/kysely';
+type Logger = {
+    info: (msg: string) => void;
+    warn: (msg: string) => void;
+    error: (msg: string) => void;
+};
+export declare const loadDeclaredScopes: (scopesMetaJsonFile: string, logger: Logger) => Promise<FlatScope[] | null>;
+export type OpenedScopeService = {
+    service: KyselyScopeService;
+    destroy: () => Promise<void>;
+};
+/**
+ * Opens a ScopeService against the project's configured database and brings the
+ * `declared` marks up to date with the code.
+ *
+ * The sync is deliberate: the marks are otherwise only as fresh as the last app
+ * boot, so an audit run straight after a code change would report stale
+ * answers. It is safe to do here because syncing is purely additive — it
+ * upserts and marks, and never deletes a scope or revokes a grant.
+ */
+export declare const openScopeService: ({ config, logger, }: {
+    config: {
+        rootDir: string;
+        outDir: string;
+        runtimeDir?: string;
+        srcDirectories: string[];
+    };
+    logger: Logger;
+}, declared: FlatScope[], command: string) => Promise<OpenedScopeService | null>;
+/**
+ * Renders undeclared scopes and the roles that would lose them — the blast
+ * radius, shown before anything is deleted.
+ */
+export declare const reportStaleScopes: (stale: Array<{
+    scope: string;
+    roles: string[];
+}>, logger: Logger) => void;
+export {};

package/dist/src/functions/commands/scopes-shared.js

@@ -0,0 +1,83 @@
+import { readFile } from 'node:fs/promises';
+import { flattenScopeDefinitions } from '@pikku/core/scope';
+import { KyselyScopeService } from '@pikku/kysely';
+import { createKysely, resolveDb } from '../db/local-db.js';
+import { loadUserConfigForDb } from './db-shared.js';
+/**
+ * Reads the generated scope metadata and flattens it to the declared scope set.
+ *
+ * Returns `null` — never an empty array — when the file cannot be read, so a
+ * caller can tell "nothing is declared" apart from "we failed to find out".
+ * `prune` deletes everything not in this set, so conflating the two would wipe
+ * every scope in the database.
+ */
+const isScopeDefinitionsMeta = (value) => typeof value === 'object' &&
+    value !== null &&
+    !Array.isArray(value) &&
+    Object.values(value).every((def) => typeof def === 'object' &&
+        def !== null &&
+        !Array.isArray(def) &&
+        typeof def.name === 'string');
+export const loadDeclaredScopes = async (scopesMetaJsonFile, logger) => {
+    let parsed;
+    try {
+        parsed = JSON.parse(await readFile(scopesMetaJsonFile, 'utf8'));
+    }
+    catch {
+        logger.error(`pikku scopes: no scope metadata at ${scopesMetaJsonFile}.\n` +
+            `  Run \`pikku all\` to generate it.`);
+        return null;
+    }
+    if (!isScopeDefinitionsMeta(parsed)) {
+        logger.error(`pikku scopes: the scope metadata at ${scopesMetaJsonFile} is malformed.\n` +
+            `  Run \`pikku all\` to regenerate it.`);
+        return null;
+    }
+    return flattenScopeDefinitions(Object.values(parsed));
+};
+/**
+ * Opens a ScopeService against the project's configured database and brings the
+ * `declared` marks up to date with the code.
+ *
+ * The sync is deliberate: the marks are otherwise only as fresh as the last app
+ * boot, so an audit run straight after a code change would report stale
+ * answers. It is safe to do here because syncing is purely additive — it
+ * upserts and marks, and never deletes a scope or revokes a grant.
+ */
+export const openScopeService = async ({ config, logger, }, declared, command) => {
+    const userConfig = await loadUserConfigForDb({
+        config,
+        logger,
+    });
+    if (!userConfig) {
+        return null;
+    }
+    const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir);
+    if (!resolved) {
+        logger.error(`${command}: no database configured — set sqliteDb or postgresUrl in your createConfig.`);
+        throw new Error('no database configured');
+    }
+    const db = await createKysely(resolved);
+    try {
+        const service = new KyselyScopeService(db);
+        await service.init();
+        await service.syncScopes(declared);
+        return { service, destroy: () => db.destroy() };
+    }
+    catch (e) {
+        await db.destroy();
+        throw e;
+    }
+};
+/**
+ * Renders undeclared scopes and the roles that would lose them — the blast
+ * radius, shown before anything is deleted.
+ */
+export const reportStaleScopes = (stale, logger) => {
+    for (const { scope, roles } of stale) {
+        const held = roles.length > 0
+            ? `held by ${roles.length} role(s): ${roles.join(', ')}`
+            : 'held by no role';
+        logger.info(`  ${scope.padEnd(40)} ${held}`);
+    }
+};

package/dist/src/functions/commands/serve.d.ts

@@ -4,7 +4,7 @@ export declare const serve: import("#pikku").PikkuFunctionConfig<{
 }, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{
     port?: string;
     console?: boolean;
-}, void, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<{
+}, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<{
     port?: string;
     console?: boolean;
-}, void, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+}, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/serve.js

@@ -1,6 +1,6 @@
 import { join, resolve } from 'path';
 import { pikkuSessionlessFunc } from '#pikku';
-import { ConsoleLogger, LocalEmailService, InMemoryQueueService, InMemoryWorkflowService, InMemoryTriggerService, InMemoryAIRunStateService, } from '@pikku/core/services';
+import { ConsoleLogger, LocalEmailService, InMemoryQueueService, InMemoryWorkflowService, InMemoryTriggerService, InMemoryAIRunStateService, QueueWebhookService, } from '@pikku/core/services';
 import { KyselyAIStorageService, KyselyAIRunStateService, KyselyAgentRunService, } from '@pikku/kysely';
 import { stopSingletonServices } from '@pikku/core';
 import { pikkuState } from '@pikku/core/internal';
@@ -81,13 +81,15 @@ export const serve = pikkuSessionlessFunc({
             })
             : undefined;
         const eventHub = await devServerRunner.createEventHub();
+        const serveQueueService = new InMemoryQueueService();
         const inMemoryServices = {
             logger: devLogger,
             ...(aiAgentRunner ? { aiAgentRunner } : {}),
             emailService: new LocalEmailService(),
             metaService: new LocalMetaService(pikkuDir),
             schedulerService,
-            queueService: new InMemoryQueueService(),
+            queueService: serveQueueService,
+            webhookService: new QueueWebhookService(serveQueueService),
             workflowService,
             workflowRunService: workflowService,
             triggerService: new InMemoryTriggerService(),

package/dist/src/functions/commands/skills.d.ts

@@ -2,9 +2,9 @@ export declare const pikkuSkillsList: import("#pikku").PikkuFunctionConfig<{
     target?: string;
 }, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{
     target?: string;
-}, void, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<{
+}, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<{
     target?: string;
-}, void, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+}, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
 export declare const pikkuSkillsInstall: import("#pikku").PikkuFunctionConfig<{
     agent?: string;
     only?: string;
@@ -17,10 +17,10 @@ export declare const pikkuSkillsInstall: import("#pikku").PikkuFunctionConfig<{
     core?: boolean;
     fabric?: boolean;
     update?: boolean;
-}, void, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<{
+}, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<{
     agent?: string;
     only?: string;
     core?: boolean;
     fabric?: boolean;
     update?: boolean;
-}, void, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+}, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/skills.js

@@ -1,6 +1,6 @@
 import { readdir, readFile, mkdir, writeFile } from 'fs/promises';
 import { existsSync } from 'fs';
-import { join, dirname } from 'path';
+import { join, dirname, sep } from 'path';
 import { fileURLToPath } from 'url';
 import { pikkuSessionlessFunc } from '#pikku';
 /**
@@ -46,6 +46,17 @@ async function copyDir(src, dest) {
         }
     }
 }
+/**
+ * Where each supported agent reads project-local skills from, relative to the
+ * project root. `pi` mirrors pi.dev's own resolution: it scans
+ * `<cwd>/<CONFIG_DIR_NAME>/skills` for project skills, where CONFIG_DIR_NAME
+ * defaults to `.pi`.
+ */
+const AGENT_SKILL_DIRS = {
+    claude: join('.claude', 'skills'),
+    opencode: join('.opencode', 'skills'),
+    pi: join('.pi', 'skills'),
+};
 function parseInstallGroups(frontmatter) {
     const inline = frontmatter.match(/^\s*installGroups\s*:\s*\[([^\]]*)\]/m);
     if (inline) {
@@ -113,10 +124,8 @@ export const pikkuSkillsList = pikkuSessionlessFunc({
             .map((e) => e.name)
             .sort();
         const installed = new Set();
-        for (const dir of [
-            join(process.cwd(), '.claude', 'skills'),
-            join(process.cwd(), '.opencode', 'skills'),
-        ]) {
+        for (const relative of Object.values(AGENT_SKILL_DIRS)) {
+            const dir = join(process.cwd(), relative);
             if (existsSync(dir)) {
                 for (const e of await readdir(dir, { withFileTypes: true })) {
                     if (e.isDirectory() || e.isSymbolicLink())
@@ -133,11 +142,12 @@ export const pikkuSkillsList = pikkuSessionlessFunc({
         console.log('Run `pikku skills install` to copy them into .claude/skills/');
         console.log('Run `pikku skills install --core --fabric` to install the Fabric sandbox skill set.');
         console.log('Run `pikku skills install --agent opencode` to copy them into .opencode/skills/');
+        console.log('Run `pikku skills install --agent pi` to copy them into .pi/skills/');
     },
 });
 export const pikkuSkillsInstall = pikkuSessionlessFunc({
     func: async ({ logger }, { agent = 'claude', only, core = false, fabric = false, update = false }) => {
-        const supportedAgents = ['claude', 'opencode'];
+        const supportedAgents = Object.keys(AGENT_SKILL_DIRS);
         if (!supportedAgents.includes(agent)) {
             logger.error(`Agent "${agent}" is not yet supported. Supported: ${supportedAgents.join(', ')}. ` +
                 `(codex/gemini will emit AGENTS.md/GEMINI.md from the same source — coming soon.)`);
@@ -160,9 +170,7 @@ export const pikkuSkillsInstall = pikkuSessionlessFunc({
             process.exitCode = 1;
             return;
         }
-        const installRoot = agent === 'opencode'
-            ? join(process.cwd(), '.opencode', 'skills')
-            : join(process.cwd(), '.claude', 'skills');
+        const installRoot = join(process.cwd(), AGENT_SKILL_DIRS[agent]);
         await mkdir(installRoot, { recursive: true });
         let installed = 0;
         let skipped = 0;
@@ -176,7 +184,7 @@ export const pikkuSkillsInstall = pikkuSessionlessFunc({
             await copyDir(src, dest);
             installed++;
         }
-        const destLabel = agent === 'opencode' ? '.opencode/skills/' : '.claude/skills/';
+        const destLabel = `${AGENT_SKILL_DIRS[agent].split(sep).join('/')}/`;
         logger.info(`Installed ${installed} skill(s) into ${destLabel}${skipped > 0
             ? ` (skipped ${skipped} already present — pass --update to overwrite)`
             : ''}`);

package/dist/src/functions/commands/versions-check.d.ts

@@ -1 +1 @@
-export declare const pikkuVersionsCheck: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+export declare const pikkuVersionsCheck: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/versions-init.d.ts

@@ -2,6 +2,6 @@ export declare const pikkuVersionsInit: import("#pikku").PikkuFunctionConfig<{
     force?: boolean;
 }, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{
     force?: boolean;
-}, void, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<{
+}, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<{
     force?: boolean;
-}, void, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+}, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/versions-update.d.ts

@@ -1 +1 @@
-export declare const pikkuVersionsUpdate: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+export declare const pikkuVersionsUpdate: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/watch.d.ts

@@ -2,6 +2,6 @@ export declare const watch: import("#pikku").PikkuFunctionConfig<{
     hmr?: boolean;
 }, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{
     hmr?: boolean;
-}, void, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<{
+}, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<{
     hmr?: boolean;
-}, void, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+}, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/workspace-validate.d.ts

@@ -19,7 +19,7 @@ export declare const workspaceValidate: import("#pikku").PikkuFunctionConfig<Rec
         path: string;
         fixHint: string;
     }[];
-}, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<Record<string, never>, {
+}, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<Record<string, never>, {
     ok: boolean;
     root: string;
     findings: {
@@ -29,5 +29,5 @@ export declare const workspaceValidate: import("#pikku").PikkuFunctionConfig<Rec
         path: string;
         fixHint: string;
     }[];
-}, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+}, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
 export { renderWorkspaceValidate };

package/dist/src/functions/runtimes/fetch/index.d.ts

@@ -1 +1 @@
-export declare const pikkuFetch: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+export declare const pikkuFetch: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/runtimes/nextjs/pikku-command-nextjs.d.ts

@@ -1 +1 @@
-export declare const pikkuNext: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+export declare const pikkuNext: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/runtimes/tanstack-start/pikku-command-tanstack-start.d.ts

@@ -1 +1 @@
-export declare const pikkuTanStackStart: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+export declare const pikkuTanStackStart: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/runtimes/websocket/pikku-command-websocket-typed.d.ts

@@ -1 +1 @@
-export declare const pikkuWebSocketTyped: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+export declare const pikkuWebSocketTyped: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/ai-agent/pikku-command-ai-agent-types.d.ts

@@ -1 +1 @@
-export declare const pikkuAIAgentTypes: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+export declare const pikkuAIAgentTypes: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/ai-agent/pikku-command-ai-agent-types.js

@@ -5,10 +5,11 @@ import { logCommandInfoAndTime } from '../../../middleware/log-command-info-and-
 import { serializeAIAgentTypes } from './serialize-ai-agent-types.js';
 export const pikkuAIAgentTypes = pikkuSessionlessFunc({
     func: async ({ logger, config }) => {
-        const { agentTypesFile, functionTypesFile, agentMapDeclarationFile, packageMappings, } = config;
+        const { agentTypesFile, functionTypesFile, agentMapDeclarationFile, scopesFile, packageMappings, } = config;
         const functionTypesImportPath = getFileImportRelativePath(agentTypesFile, functionTypesFile, packageMappings);
         const agentMapImportPath = getFileImportRelativePath(agentTypesFile, agentMapDeclarationFile, packageMappings);
-        const content = serializeAIAgentTypes(functionTypesImportPath, agentMapImportPath);
+        const scopesImportPath = getFileImportRelativePath(agentTypesFile, scopesFile, packageMappings);
+        const content = serializeAIAgentTypes(functionTypesImportPath, agentMapImportPath, scopesImportPath);
         await writeFileInDir(logger, agentTypesFile, content);
     },
     middleware: [

package/dist/src/functions/wirings/ai-agent/pikku-command-ai-agent.d.ts

@@ -1 +1 @@
-export declare const pikkuAIAgent: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+export declare const pikkuAIAgent: import("#pikku").PikkuFunctionConfig<void, boolean | undefined, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, boolean | undefined, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/ai-agent/pikku-command-public-agent.d.ts

@@ -1 +1 @@
-export declare const pikkuPublicAgent: import("#pikku").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+export declare const pikkuPublicAgent: import("#pikku").PikkuFunctionConfig<void, boolean, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, boolean, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, boolean, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/wirings/ai-agent/serialize-ai-agent-types.d.ts

@@ -1 +1 @@
-export declare const serializeAIAgentTypes: (functionTypesImportPath: string, agentMapImportPath: string) => string;
+export declare const serializeAIAgentTypes: (functionTypesImportPath: string, agentMapImportPath: string, scopesImportPath: string) => string;

package/dist/src/functions/wirings/ai-agent/serialize-ai-agent-types.js

@@ -1,4 +1,4 @@
-export const serializeAIAgentTypes = (functionTypesImportPath, agentMapImportPath) => {
+export const serializeAIAgentTypes = (functionTypesImportPath, agentMapImportPath, scopesImportPath) => {
     return `import {
   CoreAIAgent,
   PikkuAIMiddlewareHooks,
@@ -13,16 +13,18 @@ import type { PikkuPermission, PikkuMiddleware, Services, PikkuFunctionConfig }
 import type { StandardSchemaV1 } from '@standard-schema/spec'
 import type { AIAgentMemoryConfig, AIAgentInput } from '@pikku/core/ai-agent'
 import type { AgentMap } from '${agentMapImportPath}'
+import type { ScopeId } from '${scopesImportPath}'
 
 type AIAgentConfig<
   InputSchema extends StandardSchemaV1 | undefined = undefined,
   OutputSchema extends StandardSchemaV1 | undefined = undefined
-> = Omit<CoreAIAgent<PikkuPermission, PikkuMiddleware>, 'tools' | 'agents' | 'memory' | 'input' | 'output'> & {
+> = Omit<CoreAIAgent<PikkuPermission, PikkuMiddleware, ScopeId>, 'tools' | 'agents' | 'workflows' | 'memory' | 'input' | 'output'> & {
   input?: InputSchema
   output?: OutputSchema
   memory?: Omit<AIAgentMemoryConfig, 'workingMemory'> & { workingMemory?: StandardSchemaV1 }
   tools?: object[]
   agents?: AIAgentConfig<StandardSchemaV1 | undefined, StandardSchemaV1 | undefined>[]
+  workflows?: object[]
 }
 
 export const pikkuAIAgent = <

package/dist/src/functions/wirings/ai-agent/serialize-public-agent.js

@@ -1,12 +1,45 @@
 export const serializePublicAgent = (pathToPikkuTypes, requireAuth = true, globalHTTPPrefix = '') => {
     const authFlag = requireAuth ? 'true' : 'false';
-    return `import { MissingServiceError } from '@pikku/core/errors'
-import { pikkuSessionlessFunc, defineHTTPRoutes, wireHTTPRoutes } from '${pathToPikkuTypes}'
+    // Emitted inline at each call site rather than as a shared named alias: the
+    // schema extractor only reads type literals in the generic position, and
+    // synthesises the schema name from the function name. Behind a named alias it
+    // records an `inputSchemaName` with no schema behind it, and every agent call
+    // then fails at runtime with MissingSchemaError.
+    const callerInput = `{
+    agentName: string
+    message: string
+    threadId: string
+    resourceId: string
+    attachments?: {
+      type: 'image' | 'file'
+      data?: string
+      url?: string
+      mediaType?: string
+      filename?: string
+    }[]
+    model?: string
+    temperature?: number
+    context?: string
+  }`;
+    return `import { canAccessThread, threadOwnerConstraint } from '@pikku/core/ai-agent'
+import { pikkuSessionlessFunc, pikkuPermission, defineHTTPRoutes, wireHTTPRoutes } from '${pathToPikkuTypes}'
 
-export const agentCaller = pikkuSessionlessFunc<
-  { agentName: string; message: string; threadId: string; resourceId: string },
-  unknown
->({
+/**
+ * Thread reads are keyed by a caller-supplied \`threadId\`, so ownership cannot
+ * come from the request — it is derived from the session and checked against
+ * the stored thread's resourceId.
+ */
+export const isThreadOwner = pikkuPermission<{ threadId: string }>(
+  async ({ agentRunService }, { threadId }, { session }) => {
+    const thread = await agentRunService.getThread(threadId)
+    // A missing thread is denied rather than 404'd so it is indistinguishable
+    // from one owned by someone else — no existence oracle.
+    if (!thread) return false
+    return canAccessThread(thread.resourceId, session)
+  }
+)
+
+export const agentCaller = pikkuSessionlessFunc<${callerInput}, unknown>({
   tags: ['pikku'],
   auth: ${authFlag},
   func: async (_services, data, { rpc }) => {
@@ -14,14 +47,15 @@ export const agentCaller = pikkuSessionlessFunc<
       message: data.message,
       threadId: data.threadId,
       resourceId: data.resourceId,
+      ...(data.attachments ? { attachments: data.attachments } : {}),
+      ...(data.model ? { model: data.model } : {}),
+      ...(data.temperature !== undefined ? { temperature: data.temperature } : {}),
+      ...(data.context ? { context: data.context } : {}),
     })
   },
 })
 
-export const agentStreamCaller = pikkuSessionlessFunc<
-  { agentName: string; message: string; threadId: string; resourceId: string; context?: string },
-  void
->({
+export const agentStreamCaller = pikkuSessionlessFunc<${callerInput}, void>({
   tags: ['pikku'],
   auth: ${authFlag},
   func: async (_services, data, { rpc }) => {
@@ -29,6 +63,9 @@ export const agentStreamCaller = pikkuSessionlessFunc<
       message: data.message,
       threadId: data.threadId,
       resourceId: data.resourceId,
+      ...(data.attachments ? { attachments: data.attachments } : {}),
+      ...(data.model ? { model: data.model } : {}),
+      ...(data.temperature !== undefined ? { temperature: data.temperature } : {}),
       ...(data.context ? { context: data.context } : {}),
     })
   },
@@ -66,14 +103,16 @@ export const getAgentThreads = pikkuSessionlessFunc<
   tags: ['pikku', 'pikku:agent'],
   title: 'Get Agent Threads',
   description:
-    'Returns a list of AI agent threads from storage. Accepts optional filters: agentName, resourceId, limit, and offset for pagination.',
+    'Returns the caller\\'s AI agent threads from storage. Accepts optional filters: agentName, resourceId, limit, and offset for pagination.',
   expose: true,
   auth: ${authFlag},
-  func: async ({ agentRunService }, input) => {
-    if (!agentRunService) throw new MissingServiceError('agentRunService is not available')
+  func: async ({ agentRunService }, input, { session }) => {
+    // \`owners\` is an authorization constraint derived from the session, never
+    // from input — \`resourceId\` remains a caller-supplied filter within it.
     return await agentRunService.listThreads({
       agentName: input?.agentName,
       resourceId: input?.resourceId,
+      owners: threadOwnerConstraint(session),
       limit: input?.limit,
       offset: input?.offset,
     })
@@ -90,8 +129,8 @@ export const getAgentThreadMessages = pikkuSessionlessFunc<
     'Returns all messages for a given AI agent thread, ordered by creation time.',
   expose: true,
   auth: ${authFlag},
+  permissions: { owner: isThreadOwner },
   func: async ({ agentRunService }, input) => {
-    if (!agentRunService) throw new MissingServiceError('agentRunService is not available')
     return await agentRunService.getThreadMessages(input.threadId)
   },
 })
@@ -106,8 +145,8 @@ export const getAgentThreadRuns = pikkuSessionlessFunc<
     'Returns the run history for a given AI agent thread, ordered by creation time.',
   expose: true,
   auth: ${authFlag},
+  permissions: { owner: isThreadOwner },
   func: async ({ agentRunService }, input) => {
-    if (!agentRunService) throw new MissingServiceError('agentRunService is not available')
     return await agentRunService.getThreadRuns(input.threadId)
   },
 })
@@ -122,8 +161,8 @@ export const deleteAgentThread = pikkuSessionlessFunc<
     'Deletes an AI agent thread and all of its persisted state.',
   expose: true,
   auth: ${authFlag},
+  permissions: { owner: isThreadOwner },
   func: async ({ agentRunService }, input) => {
-    if (!agentRunService) throw new MissingServiceError('agentRunService is not available')
     const deleted = await agentRunService.deleteThread(input.threadId)
     return { deleted }
   },

package/dist/src/functions/wirings/auth/pikku-command-auth.d.ts

@@ -2,6 +2,6 @@ export declare const pikkuAuth: import("#pikku").PikkuFunctionConfig<{
     bootstrap?: boolean;
 }, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{
     bootstrap?: boolean;
-}, void, "rpc" | "session", import("#pikku").Services> | import("#pikku").PikkuFunction<{
+}, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<{
     bootstrap?: boolean;
-}, void, "rpc" | "session", import("#pikku").Services>, undefined, undefined>;
+}, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;