@pikku/core 0.12.143 → 0.12.145

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (701) hide show
  1. package/dist/analytics/analytics.d.ts +14 -0
  2. package/dist/analytics/analytics.js +14 -0
  3. package/dist/analytics/analytics.types.d.ts +1 -0
  4. package/dist/analytics/anonymous-analytics-identity.d.ts +1 -0
  5. package/dist/analytics/cookie-analytics-identity.d.ts +1 -0
  6. package/dist/analytics/mint-cookie.d.ts +1 -0
  7. package/dist/{wirings/channel/channel-middleware-runner.d.ts → channel-middleware-runner.d.ts} +17 -3
  8. package/dist/{wirings/channel/channel-middleware-runner.js → channel-middleware-runner.js} +24 -8
  9. package/dist/classification/data-classification.d.ts +13 -0
  10. package/dist/classification/secret-value.d.ts +7 -0
  11. package/dist/classification/secret-value.js +7 -0
  12. package/dist/crypto-utils.d.ts +93 -0
  13. package/dist/crypto-utils.js +92 -0
  14. package/dist/dev/hot-reload.d.ts +16 -0
  15. package/dist/dev/hot-reload.js +16 -1
  16. package/dist/dev/module-runner.js +7 -3
  17. package/dist/dev/reload-meta.js +1 -1
  18. package/dist/errors/error-handler.d.ts +9 -0
  19. package/dist/errors/error-handler.js +8 -0
  20. package/dist/errors/errors.d.ts +219 -0
  21. package/dist/errors/errors.js +227 -0
  22. package/dist/errors/serialized-error.d.ts +4 -0
  23. package/dist/function/abort-scope.d.ts +5 -0
  24. package/dist/function/function-meta.types.d.ts +20 -0
  25. package/dist/function/function-runner.d.ts +41 -0
  26. package/dist/function/function-runner.js +57 -11
  27. package/dist/function/functions.types.d.ts +59 -0
  28. package/dist/function/functions.types.js +23 -0
  29. package/dist/function/list.types.d.ts +4 -0
  30. package/dist/lifecycle.d.ts +12 -1
  31. package/dist/lifecycle.js +12 -1
  32. package/dist/middleware/addon-scope-cap.d.ts +4 -0
  33. package/dist/middleware/addon-scope-cap.js +7 -3
  34. package/dist/middleware/auth-apikey.js +3 -3
  35. package/dist/middleware/auth-bearer.js +5 -13
  36. package/dist/middleware/auth-cookie.js +3 -3
  37. package/dist/middleware/middleware-factories.d.ts +17 -0
  38. package/dist/middleware/middleware-factories.js +17 -0
  39. package/dist/middleware/middleware.types.d.ts +23 -0
  40. package/dist/middleware/remote-auth.d.ts +15 -0
  41. package/dist/middleware/remote-auth.js +18 -3
  42. package/dist/middleware/remote-jobs-secret.js +2 -10
  43. package/dist/middleware-runner.d.ts +7 -0
  44. package/dist/middleware-runner.js +23 -7
  45. package/dist/permissions.d.ts +13 -0
  46. package/dist/permissions.js +13 -0
  47. package/dist/pikku-state.d.ts +49 -0
  48. package/dist/pikku-state.js +49 -0
  49. package/dist/remote.js +20 -5
  50. package/dist/schema.d.ts +36 -0
  51. package/dist/schema.js +36 -0
  52. package/dist/services/agent-run-state-service.d.ts +8 -0
  53. package/dist/services/agent-runner-service.d.ts +24 -0
  54. package/dist/services/agent-storage-service.d.ts +8 -0
  55. package/dist/services/ai-embedding-service.d.ts +4 -0
  56. package/dist/services/audit-service.d.ts +48 -0
  57. package/dist/services/audit-service.js +22 -0
  58. package/dist/services/content-service.d.ts +34 -0
  59. package/dist/services/credential-wire-service.d.ts +9 -0
  60. package/dist/services/credential-wire-service.js +9 -0
  61. package/dist/services/deployment-service.d.ts +14 -0
  62. package/dist/services/email-service.d.ts +20 -0
  63. package/dist/services/email-template.d.ts +24 -0
  64. package/dist/services/email-template.js +12 -0
  65. package/dist/services/file-scenario-run-store.d.ts +5 -0
  66. package/dist/services/file-scenario-run-store.js +4 -0
  67. package/dist/services/gateway-service.d.ts +5 -0
  68. package/dist/services/in-memory-agent-run-state-service.d.ts +5 -0
  69. package/dist/services/in-memory-agent-run-state-service.js +5 -0
  70. package/dist/services/in-memory-lease-service.d.ts +5 -0
  71. package/dist/services/in-memory-lease-service.js +5 -0
  72. package/dist/services/in-memory-session-store.d.ts +4 -0
  73. package/dist/services/in-memory-session-store.js +4 -0
  74. package/dist/services/incoming-webhook-queue.d.ts +2 -0
  75. package/dist/services/incoming-webhook-queue.js +2 -0
  76. package/dist/services/incoming-webhook-service.d.ts +9 -1
  77. package/dist/services/incoming-webhook-service.js +1 -1
  78. package/dist/services/index.d.ts +1 -5
  79. package/dist/services/index.js +1 -5
  80. package/dist/services/jwt-service.d.ts +8 -0
  81. package/dist/services/lease-service.d.ts +5 -0
  82. package/dist/services/lease-service.js +1 -0
  83. package/dist/services/local-content-request-handler.d.ts +20 -0
  84. package/dist/services/local-content-request-handler.js +11 -0
  85. package/dist/services/local-content.d.ts +45 -0
  86. package/dist/services/local-content.js +35 -0
  87. package/dist/services/local-credential-service.d.ts +5 -0
  88. package/dist/services/local-credential-service.js +5 -0
  89. package/dist/services/local-email-service.d.ts +7 -0
  90. package/dist/services/local-email-service.js +7 -0
  91. package/dist/services/local-secrets.d.ts +8 -0
  92. package/dist/services/local-secrets.js +8 -0
  93. package/dist/services/local-variables.d.ts +6 -0
  94. package/dist/services/local-variables.js +6 -0
  95. package/dist/services/logger.d.ts +4 -0
  96. package/dist/services/logger.js +4 -0
  97. package/dist/services/meta-service.d.ts +38 -0
  98. package/dist/services/meta-service.js +6 -0
  99. package/dist/services/queue-webhook-service.d.ts +19 -0
  100. package/dist/services/queue-webhook-service.js +19 -0
  101. package/dist/services/remote-jobs.d.ts +8 -13
  102. package/dist/services/remote-jobs.js +3 -54
  103. package/dist/services/scenario-cookie-jar.d.ts +4 -0
  104. package/dist/services/scheduler-service.d.ts +13 -0
  105. package/dist/services/scheduler-service.js +8 -0
  106. package/dist/services/schema-service.d.ts +9 -0
  107. package/dist/services/scope-service.d.ts +10 -0
  108. package/dist/services/scoped-secret-service.d.ts +5 -0
  109. package/dist/services/scoped-secret-service.js +5 -0
  110. package/dist/services/secret-host-binding.d.ts +5 -0
  111. package/dist/services/secret-host-binding.js +5 -0
  112. package/dist/services/secret-service.d.ts +19 -1
  113. package/dist/services/secretless.d.ts +6 -0
  114. package/dist/services/secretless.js +6 -0
  115. package/dist/services/session-store.d.ts +5 -0
  116. package/dist/services/stub-tracker.d.ts +1 -0
  117. package/dist/services/temporary-file-service.d.ts +9 -0
  118. package/dist/services/temporary-file-service.js +9 -0
  119. package/dist/services/trigger-service.d.ts +4 -0
  120. package/dist/services/trigger-source-store.d.ts +13 -0
  121. package/dist/services/trigger-source-store.js +7 -0
  122. package/dist/services/typed-credential-service.d.ts +6 -0
  123. package/dist/services/typed-credential-service.js +5 -0
  124. package/dist/services/typed-secret-service.d.ts +12 -0
  125. package/dist/services/typed-secret-service.js +11 -0
  126. package/dist/services/typed-variables-service.d.ts +1 -0
  127. package/dist/services/user-session-service.d.ts +31 -1
  128. package/dist/services/user-session-service.js +29 -3
  129. package/dist/services/v8-coverage-service.d.ts +27 -0
  130. package/dist/services/v8-coverage-service.js +5 -0
  131. package/dist/services/variables-service.d.ts +8 -0
  132. package/dist/services/virtual-user-sign-in.d.ts +1 -0
  133. package/dist/services/virtual-user-statement.d.ts +8 -0
  134. package/dist/services/virtual-user-statement.js +4 -0
  135. package/dist/services/webhook-service.d.ts +25 -0
  136. package/dist/services/webhook-service.js +15 -0
  137. package/dist/services/workflow-service.d.ts +6 -0
  138. package/dist/test-utils.js +1 -1
  139. package/dist/testing/service-tests.d.ts +4 -0
  140. package/dist/time-utils.d.ts +15 -0
  141. package/dist/time-utils.js +14 -0
  142. package/dist/types/core.types.d.ts +80 -0
  143. package/dist/types/state.types.d.ts +4 -0
  144. package/dist/utils/hmac.d.ts +3 -0
  145. package/dist/utils/safe-fetch.d.ts +14 -0
  146. package/dist/utils/safe-fetch.js +13 -0
  147. package/dist/utils/stable-stringify.d.ts +11 -0
  148. package/dist/utils/stable-stringify.js +33 -0
  149. package/dist/utils.d.ts +28 -0
  150. package/dist/utils.js +22 -0
  151. package/dist/version.d.ts +7 -0
  152. package/dist/version.js +7 -0
  153. package/dist/wirings/addon/define-screens.d.ts +2 -0
  154. package/dist/wirings/addon/remote-addon-auth.d.ts +9 -0
  155. package/dist/wirings/addon/remote-addon-auth.js +5 -0
  156. package/dist/wirings/addon/wire-addon.d.ts +4 -0
  157. package/dist/wirings/addon/wire-remote-addon.d.ts +1 -0
  158. package/dist/wirings/agent/agent-agui.d.ts +14 -5
  159. package/dist/wirings/agent/agent-agui.js +17 -6
  160. package/dist/wirings/agent/agent-helpers.d.ts +61 -1
  161. package/dist/wirings/agent/agent-helpers.js +62 -2
  162. package/dist/wirings/agent/agent-interrupt.d.ts +5 -0
  163. package/dist/wirings/agent/agent-output.d.ts +20 -0
  164. package/dist/wirings/agent/agent-output.js +69 -0
  165. package/dist/wirings/agent/agent-prepare.d.ts +41 -0
  166. package/dist/wirings/agent/agent-prepare.js +38 -2
  167. package/dist/wirings/agent/agent-registry.d.ts +8 -0
  168. package/dist/wirings/agent/agent-registry.js +10 -4
  169. package/dist/wirings/agent/agent-runner.d.ts +33 -0
  170. package/dist/wirings/agent/agent-runner.js +40 -7
  171. package/dist/wirings/agent/agent-stream.d.ts +30 -0
  172. package/dist/wirings/agent/agent-stream.js +33 -11
  173. package/dist/wirings/agent/agent.types.d.ts +43 -0
  174. package/dist/wirings/agent/voice-input.d.ts +12 -0
  175. package/dist/wirings/agent/voice-input.js +12 -0
  176. package/dist/wirings/agent/voice-output.d.ts +14 -0
  177. package/dist/wirings/agent/voice-output.js +10 -0
  178. package/dist/wirings/agent-scorer/agent-scorer-judge.js +1 -2
  179. package/dist/wirings/agent-scorer/agent-scorer-registry.d.ts +10 -0
  180. package/dist/wirings/agent-scorer/agent-scorer-registry.js +10 -0
  181. package/dist/wirings/agent-scorer/agent-scorer-snapshots.d.ts +1 -0
  182. package/dist/wirings/agent-scorer/agent-scorer-snapshots.js +1 -0
  183. package/dist/wirings/agent-scorer/agent-scorer.types.d.ts +7 -0
  184. package/dist/wirings/channel/channel-common.js +1 -1
  185. package/dist/wirings/channel/channel-rpc.types.d.ts +5 -0
  186. package/dist/wirings/channel/channel-runner.d.ts +22 -0
  187. package/dist/wirings/channel/channel-runner.js +22 -0
  188. package/dist/wirings/channel/channel-store.d.ts +8 -0
  189. package/dist/wirings/channel/channel-store.js +7 -0
  190. package/dist/wirings/channel/channel.types.d.ts +18 -0
  191. package/dist/wirings/channel/define-channel-routes.d.ts +5 -0
  192. package/dist/wirings/channel/define-channel-routes.js +5 -0
  193. package/dist/wirings/channel/eventhub-service.d.ts +9 -0
  194. package/dist/wirings/channel/eventhub-store.d.ts +1 -0
  195. package/dist/wirings/channel/eventhub-store.js +1 -0
  196. package/dist/wirings/channel/index.d.ts +1 -1
  197. package/dist/wirings/channel/index.js +1 -1
  198. package/dist/wirings/channel/local/local-channel-handler.d.ts +1 -0
  199. package/dist/wirings/channel/local/local-channel-handler.js +1 -0
  200. package/dist/wirings/channel/local/local-channel-runner.d.ts +13 -0
  201. package/dist/wirings/channel/local/local-channel-runner.js +13 -0
  202. package/dist/wirings/channel/local/local-eventhub-service.d.ts +1 -0
  203. package/dist/wirings/channel/local/local-eventhub-service.js +1 -0
  204. package/dist/wirings/channel/log-channels.d.ts +1 -0
  205. package/dist/wirings/channel/log-channels.js +1 -0
  206. package/dist/wirings/channel/pikku-abstract-channel-handler.d.ts +5 -0
  207. package/dist/wirings/channel/pikku-abstract-channel-handler.js +5 -0
  208. package/dist/wirings/channel/serverless/serverless-channel-runner.d.ts +32 -0
  209. package/dist/wirings/channel/serverless/serverless-channel-runner.js +31 -0
  210. package/dist/wirings/cli/channel/cli-channel-runner.d.ts +8 -0
  211. package/dist/wirings/cli/channel/cli-channel-runner.js +8 -0
  212. package/dist/wirings/cli/channel/cli-raw-channel-runner.d.ts +1 -0
  213. package/dist/wirings/cli/cli-runner.d.ts +43 -0
  214. package/dist/wirings/cli/cli-runner.js +43 -0
  215. package/dist/wirings/cli/cli.types.d.ts +4 -0
  216. package/dist/wirings/cli/command-parser.d.ts +13 -0
  217. package/dist/wirings/cli/command-parser.js +16 -0
  218. package/dist/wirings/credential/credential-overrides.d.ts +1 -0
  219. package/dist/wirings/credential/credential.types.d.ts +7 -0
  220. package/dist/wirings/credential/validate-credential-definitions.d.ts +7 -0
  221. package/dist/wirings/credential/validate-credential-definitions.js +7 -0
  222. package/dist/wirings/flag/cached-flag-source.d.ts +1 -0
  223. package/dist/wirings/flag/flag.types.d.ts +3 -0
  224. package/dist/wirings/gateway/gateway-runner.d.ts +23 -0
  225. package/dist/wirings/gateway/gateway-runner.js +23 -0
  226. package/dist/wirings/gateway/gateway.types.d.ts +3 -0
  227. package/dist/wirings/gateway/local-gateway-service.d.ts +10 -0
  228. package/dist/{services → wirings/gateway}/local-gateway-service.js +6 -2
  229. package/dist/wirings/http/http-routes.d.ts +21 -0
  230. package/dist/wirings/http/http-routes.js +11 -0
  231. package/dist/wirings/http/http-runner.d.ts +71 -0
  232. package/dist/wirings/http/http-runner.js +73 -5
  233. package/dist/wirings/http/http.types.d.ts +27 -0
  234. package/dist/wirings/http/index.d.ts +1 -0
  235. package/dist/wirings/http/index.js +1 -0
  236. package/dist/wirings/http/log-http-routes.d.ts +1 -0
  237. package/dist/wirings/http/log-http-routes.js +1 -0
  238. package/dist/wirings/http/merge-request-data.d.ts +12 -0
  239. package/dist/wirings/http/merge-request-data.js +42 -0
  240. package/dist/wirings/http/pikku-fetch-http-request.d.ts +1 -0
  241. package/dist/wirings/http/pikku-fetch-http-request.js +3 -32
  242. package/dist/wirings/http/pikku-fetch-http-response.d.ts +1 -0
  243. package/dist/wirings/http/pikku-fetch-http-response.js +1 -0
  244. package/dist/wirings/http/routers/http-router.d.ts +6 -0
  245. package/dist/wirings/http/routers/http-router.js +6 -0
  246. package/dist/wirings/http/web-request.d.ts +17 -0
  247. package/dist/wirings/http/web-request.js +17 -0
  248. package/dist/wirings/mcp/mcp-endpoint-registry.d.ts +7 -0
  249. package/dist/wirings/mcp/mcp-endpoint-registry.js +7 -0
  250. package/dist/wirings/mcp/mcp-runner.d.ts +63 -0
  251. package/dist/wirings/mcp/mcp-runner.js +62 -0
  252. package/dist/wirings/mcp/mcp.types.d.ts +12 -0
  253. package/dist/wirings/node/node.types.d.ts +4 -0
  254. package/dist/wirings/oauth2/oauth2.types.d.ts +2 -0
  255. package/dist/{services → wirings/queue}/in-memory-queue-service.d.ts +9 -1
  256. package/dist/{services → wirings/queue}/in-memory-queue-service.js +9 -1
  257. package/dist/wirings/queue/index.d.ts +1 -0
  258. package/dist/wirings/queue/index.js +1 -0
  259. package/dist/wirings/queue/queue-identity.js +2 -14
  260. package/dist/wirings/queue/queue-runner.d.ts +37 -0
  261. package/dist/wirings/queue/queue-runner.js +37 -0
  262. package/dist/wirings/queue/queue.types.d.ts +35 -0
  263. package/dist/wirings/queue/register-queue-helper.d.ts +12 -0
  264. package/dist/wirings/queue/register-queue-helper.js +11 -0
  265. package/dist/wirings/queue/remote-queue-job.d.ts +11 -0
  266. package/dist/wirings/queue/remote-queue-job.js +41 -0
  267. package/dist/wirings/queue/validate-worker-config.d.ts +1 -0
  268. package/dist/wirings/role/role.types.d.ts +3 -0
  269. package/dist/wirings/rpc/rpc-runner.d.ts +24 -0
  270. package/dist/wirings/rpc/rpc-runner.js +37 -2
  271. package/dist/wirings/rpc/rpc-types.d.ts +2 -0
  272. package/dist/wirings/scheduler/index.d.ts +1 -0
  273. package/dist/wirings/scheduler/index.js +1 -0
  274. package/dist/wirings/scheduler/log-schedulers.d.ts +1 -0
  275. package/dist/wirings/scheduler/log-schedulers.js +1 -0
  276. package/dist/wirings/scheduler/remote-scheduled-job.d.ts +11 -0
  277. package/dist/wirings/scheduler/remote-scheduled-job.js +20 -0
  278. package/dist/wirings/scheduler/scheduler-runner.d.ts +29 -0
  279. package/dist/wirings/scheduler/scheduler-runner.js +28 -0
  280. package/dist/wirings/scheduler/scheduler.types.d.ts +3 -0
  281. package/dist/wirings/scope/scope.types.d.ts +5 -0
  282. package/dist/wirings/secret/index.d.ts +2 -2
  283. package/dist/wirings/secret/index.js +1 -1
  284. package/dist/wirings/secret/secret.types.d.ts +26 -1
  285. package/dist/wirings/secret/secret.types.js +1 -0
  286. package/dist/wirings/secret/validate-secret-definitions.d.ts +8 -0
  287. package/dist/wirings/secret/validate-secret-definitions.js +15 -0
  288. package/dist/wirings/trigger/in-memory-trigger-service.d.ts +11 -0
  289. package/dist/{services → wirings/trigger}/in-memory-trigger-service.js +10 -3
  290. package/dist/wirings/trigger/index.d.ts +1 -1
  291. package/dist/wirings/trigger/pikku-trigger-service.d.ts +8 -3
  292. package/dist/wirings/trigger/pikku-trigger-service.js +14 -3
  293. package/dist/wirings/trigger/trigger-runner.d.ts +27 -2
  294. package/dist/wirings/trigger/trigger-runner.js +35 -2
  295. package/dist/wirings/trigger/trigger.types.d.ts +26 -4
  296. package/dist/wirings/trigger/webhook-source-runner.d.ts +24 -0
  297. package/dist/wirings/trigger/webhook-source-runner.js +19 -0
  298. package/dist/wirings/trigger/webhook-source.types.d.ts +12 -2
  299. package/dist/wirings/trigger/webhook-source.types.js +1 -1
  300. package/dist/wirings/variable/validate-variable-definitions.d.ts +7 -0
  301. package/dist/wirings/variable/validate-variable-definitions.js +7 -0
  302. package/dist/wirings/variable/variable.types.d.ts +7 -0
  303. package/dist/wirings/virtual-user/conversation/conversation.types.d.ts +5 -0
  304. package/dist/wirings/virtual-user/conversation/run-conversation.d.ts +6 -0
  305. package/dist/wirings/virtual-user/conversation/run-conversation.js +1 -1
  306. package/dist/{services → wirings/virtual-user}/http-virtual-users.d.ts +4 -3
  307. package/dist/{services → wirings/virtual-user}/http-virtual-users.js +6 -6
  308. package/dist/wirings/virtual-user/index.d.ts +1 -1
  309. package/dist/wirings/virtual-user/index.js +1 -1
  310. package/dist/wirings/virtual-user/run-virtual-user.d.ts +2 -1
  311. package/dist/wirings/virtual-user/run-virtual-user.js +1 -14
  312. package/dist/wirings/virtual-user/virtual-user-declaration.types.d.ts +4 -0
  313. package/dist/wirings/virtual-user/virtual-user-scaffold.d.ts +10 -1
  314. package/dist/wirings/virtual-user/virtual-user-scaffold.js +5 -0
  315. package/dist/wirings/virtual-user/virtual-user-schedule.d.ts +5 -0
  316. package/dist/wirings/virtual-user/virtual-user-schedule.js +1 -0
  317. package/dist/wirings/virtual-user/virtual-user-target.d.ts +1 -0
  318. package/dist/wirings/webhook/define-outgoing-webhook.d.ts +20 -0
  319. package/dist/wirings/webhook/define-outgoing-webhook.js +9 -0
  320. package/dist/wirings/workflow/dsl/workflow-dsl.types.d.ts +8 -4
  321. package/dist/wirings/workflow/dsl/workflow-runner.d.ts +7 -0
  322. package/dist/wirings/workflow/dsl/workflow-runner.js +7 -0
  323. package/dist/wirings/workflow/feature.d.ts +12 -0
  324. package/dist/wirings/workflow/feature.js +12 -0
  325. package/dist/wirings/workflow/graph/graph-node.d.ts +5 -0
  326. package/dist/wirings/workflow/graph/graph-node.js +5 -0
  327. package/dist/wirings/workflow/graph/template.d.ts +6 -0
  328. package/dist/wirings/workflow/graph/template.js +5 -0
  329. package/dist/wirings/workflow/graph/wire-workflow-graph.d.ts +12 -0
  330. package/dist/wirings/workflow/graph/wire-workflow-graph.js +10 -0
  331. package/dist/wirings/workflow/graph/workflow-graph.types.d.ts +11 -0
  332. package/dist/wirings/workflow/graph/workflow-graph.types.js +1 -0
  333. package/dist/{services → wirings/workflow}/in-memory-workflow-service.d.ts +8 -3
  334. package/dist/{services → wirings/workflow}/in-memory-workflow-service.js +9 -4
  335. package/dist/wirings/workflow/pikku-scenario-service.d.ts +1 -1
  336. package/dist/wirings/workflow/pikku-scenario-service.js +2 -2
  337. package/dist/wirings/workflow/pikku-workflow-service.d.ts +1 -0
  338. package/dist/wirings/workflow/pikku-workflow-service.js +1 -0
  339. package/dist/wirings/workflow/run-timeline.d.ts +21 -0
  340. package/dist/wirings/workflow/run-timeline.js +15 -7
  341. package/dist/wirings/workflow/scenario-coverage.d.ts +1 -0
  342. package/dist/wirings/workflow/scenario-poll.d.ts +1 -0
  343. package/dist/wirings/workflow/scenario-prose.d.ts +6 -0
  344. package/dist/wirings/workflow/scenario-prose.js +6 -0
  345. package/dist/wirings/workflow/scenario-run.types.d.ts +3 -0
  346. package/dist/wirings/workflow/scenario-step.types.d.ts +1 -0
  347. package/dist/wirings/workflow/scenario-step.types.js +1 -0
  348. package/dist/wirings/workflow/scenario-surface.js +1 -13
  349. package/dist/wirings/workflow/scenario.types.d.ts +6 -0
  350. package/dist/wirings/workflow/workflow-approval-policy.d.ts +6 -0
  351. package/dist/wirings/workflow/workflow-approval-policy.js +6 -0
  352. package/dist/wirings/workflow/workflow-constants.d.ts +7 -1
  353. package/dist/wirings/workflow/workflow-constants.js +10 -1
  354. package/dist/wirings/workflow/workflow-errors.d.ts +13 -0
  355. package/dist/wirings/workflow/workflow-errors.js +13 -0
  356. package/dist/wirings/workflow/workflow-invocation-id.d.ts +4 -0
  357. package/dist/wirings/workflow/workflow-invocation-id.js +4 -0
  358. package/dist/wirings/workflow/workflow-queue-workers.d.ts +3 -0
  359. package/dist/wirings/workflow/workflow-run-ownership.d.ts +1 -0
  360. package/dist/wirings/workflow/workflow-run-ownership.js +1 -0
  361. package/dist/wirings/workflow/workflow-status-stream.d.ts +1 -0
  362. package/dist/wirings/workflow/workflow-unwind-plan.js +2 -7
  363. package/dist/wirings/workflow/workflow.types.d.ts +40 -0
  364. package/package.json +26 -9
  365. package/CHANGELOG.md +0 -6978
  366. package/dist/services/in-memory-trigger-service.d.ts +0 -4
  367. package/dist/services/local-gateway-service.d.ts +0 -6
  368. package/dist/utils/hash.d.ts +0 -2
  369. package/dist/utils/hash.js +0 -23
  370. package/knowledge/decisions/index.md +0 -19
  371. package/knowledge/decisions/internals/a-credential-name-declared-twice-must-agree-on-schema-and-type.md +0 -29
  372. package/knowledge/decisions/internals/a-grant-can-name-a-scope-declared-without-its-addon.md +0 -29
  373. package/knowledge/decisions/internals/a-held-run-is-woken-later-not-retried.md +0 -28
  374. package/knowledge/decisions/internals/a-latency-budget-is-asserted-by-its-cause.md +0 -32
  375. package/knowledge/decisions/internals/a-non-streaming-agent-run-registers-with-agentrunstate-too.md +0 -22
  376. package/knowledge/decisions/internals/a-reset-suite-makes-the-dev-seed-the-fixture.md +0 -50
  377. package/knowledge/decisions/internals/a-resumed-agent-turn-is-as-interruptible-as-the-first.md +0 -20
  378. package/knowledge/decisions/internals/a-scenario-step-template-is-offered-unfilled.md +0 -21
  379. package/knowledge/decisions/internals/a-scheduled-task-writes-its-caller-session-before-it-runs.md +0 -22
  380. package/knowledge/decisions/internals/a-secret-set-in-memory-shadows-the-variable-of-the-same-name.md +0 -28
  381. package/knowledge/decisions/internals/a-secret-that-fails-to-decrypt-fails-the-whole-read.md +0 -49
  382. package/knowledge/decisions/internals/a-virtual-user-acts-through-invokeraw-so-a-refusal-is-data.md +0 -32
  383. package/knowledge/decisions/internals/a-virtual-user-cadence-is-a-row-not-a-timer.md +0 -66
  384. package/knowledge/decisions/internals/a-virtual-user-converse-signs-in-before-its-first-turn.md +0 -24
  385. package/knowledge/decisions/internals/a-virtual-user-decides-whether-to-trust-memory-once-per-turn.md +0 -21
  386. package/knowledge/decisions/internals/a-virtual-user-email-is-computed-with-the-run-id-as-a-sub-address.md +0 -34
  387. package/knowledge/decisions/internals/a-virtual-user-run-is-not-a-workflow-but-it-needs-a-trigger.md +0 -65
  388. package/knowledge/decisions/internals/a-wall-clock-threshold-is-a-load-test-in-disguise.md +0 -49
  389. package/knowledge/decisions/internals/a-workflow-wire-is-built-from-the-run-not-from-the-rpc-service.md +0 -45
  390. package/knowledge/decisions/internals/addon-package-roots-resolve-by-walking-node-module-search-paths.md +0 -26
  391. package/knowledge/decisions/internals/addon-pikku-meta-ships-at-the-package-root-or-under-dist.md +0 -32
  392. package/knowledge/decisions/internals/addon-singleton-services-are-cached-per-namespace-not-per-package.md +0 -33
  393. package/knowledge/decisions/internals/addon-workflow-names-are-prefixed-with-the-consumer-namespace.md +0 -28
  394. package/knowledge/decisions/internals/agent-agui-bridge-obeys-the-client-ordering-contract.md +0 -29
  395. package/knowledge/decisions/internals/agent-audio-chunks-carry-the-format-the-provider-returned.md +0 -20
  396. package/knowledge/decisions/internals/agent-context-waits-for-a-tool-result-still-being-written.md +0 -21
  397. package/knowledge/decisions/internals/agent-credential-suspensions-hide-the-tool-result.md +0 -26
  398. package/knowledge/decisions/internals/agent-delegate-and-supervise-hide-different-text.md +0 -26
  399. package/knowledge/decisions/internals/agent-llm-tool-arguments-have-nulls-stripped.md +0 -23
  400. package/knowledge/decisions/internals/agent-model-config-stays-a-single-resolution-seam.md +0 -25
  401. package/knowledge/decisions/internals/agent-onerror-hooks-cannot-change-the-failure.md +0 -22
  402. package/knowledge/decisions/internals/agent-runner-methods-must-keep-their-receiver.md +0 -22
  403. package/knowledge/decisions/internals/agent-speech-travels-as-a-custom-agui-event.md +0 -22
  404. package/knowledge/decisions/internals/agent-stream-persistence-is-best-effort.md +0 -27
  405. package/knowledge/decisions/internals/agent-sub-agents-inherit-the-parent-context-block.md +0 -26
  406. package/knowledge/decisions/internals/agent-tool-execute-failures-are-logged-unconditionally.md +0 -25
  407. package/knowledge/decisions/internals/agent-voice-input-transcribes-audio-parts-in-place.md +0 -22
  408. package/knowledge/decisions/internals/agent-working-memory-is-persisted-only-when-valid.md +0 -25
  409. package/knowledge/decisions/internals/an-addon-scope-root-loses-to-a-root-the-host-already-declares.md +0 -39
  410. package/knowledge/decisions/internals/an-agent-interrupt-is-not-a-failure.md +0 -23
  411. package/knowledge/decisions/internals/an-agent-is-offered-under-its-registry-key-and-only-within-the-virtual-users-scopes.md +0 -27
  412. package/knowledge/decisions/internals/an-agent-run-owned-by-another-instance-says-so.md +0 -25
  413. package/knowledge/decisions/internals/an-agent-stream-send-must-return-the-inner-sends-promise.md +0 -22
  414. package/knowledge/decisions/internals/an-empty-text-part-is-omitted-from-an-agent-message.md +0 -20
  415. package/knowledge/decisions/internals/an-empty-transcript-is-not-recorded.md +0 -22
  416. package/knowledge/decisions/internals/an-oauth2-credential-implies-an-optional-app-secret.md +0 -26
  417. package/knowledge/decisions/internals/an-unref-d-timer-cannot-be-awaited-under-node-test.md +0 -66
  418. package/knowledge/decisions/internals/analytics-identity-resolvers-run-in-declared-order.md +0 -22
  419. package/knowledge/decisions/internals/channel-message-handlers-accept-three-config-shapes.md +0 -30
  420. package/knowledge/decisions/internals/channel-middleware-caches-only-statically-resolved-middleware.md +0 -31
  421. package/knowledge/decisions/internals/channel-state-accessors-are-unsound-generics-that-every-implementation-asserts.md +0 -33
  422. package/knowledge/decisions/internals/channel-state-is-per-socket-session-state-is-per-user.md +0 -29
  423. package/knowledge/decisions/internals/channel-user-id-is-persisted-after-onconnect-middleware-runs.md +0 -28
  424. package/knowledge/decisions/internals/cli-option-names-are-camelcase-in-state-and-kebab-on-the-command-line.md +0 -27
  425. package/knowledge/decisions/internals/cli-parse-errors-are-routed-by-message-prefix.md +0 -28
  426. package/knowledge/decisions/internals/cli-stdout-is-reserved-for-machine-readable-output.md +0 -34
  427. package/knowledge/decisions/internals/cli-unknown-long-options-warn-instead-of-failing.md +0 -29
  428. package/knowledge/decisions/internals/core-column-form-is-an-axis-of-its-own.md +0 -84
  429. package/knowledge/decisions/internals/core-data-classification-brand-is-an-optional-property.md +0 -41
  430. package/knowledge/decisions/internals/core-function-runner-restores-the-wire-fields-it-overwrites.md +0 -44
  431. package/knowledge/decisions/internals/core-hot-reload-merges-generated-meta-never-replaces-it.md +0 -39
  432. package/knowledge/decisions/internals/core-hot-reload-owns-its-module-registry.md +0 -42
  433. package/knowledge/decisions/internals/core-middleware-order-is-scope-then-priority.md +0 -39
  434. package/knowledge/decisions/internals/core-schema-defaults-apply-on-every-transport.md +0 -43
  435. package/knowledge/decisions/internals/core-scopes-are-an-and-gate-separate-from-permissions.md +0 -38
  436. package/knowledge/decisions/internals/core-state-is-a-global-map-written-only-at-registration-time.md +0 -44
  437. package/knowledge/decisions/internals/email-meta-is-read-uncached-because-codegen-rewrites-it-mid-session.md +0 -27
  438. package/knowledge/decisions/internals/feature-flag-declarations-refuse-an-empty-anyof-and-conflicting-scopes.md +0 -22
  439. package/knowledge/decisions/internals/feature-flags-fail-open-and-never-enforce-access.md +0 -28
  440. package/knowledge/decisions/internals/flag-sync-rewrites-only-the-declared-text.md +0 -24
  441. package/knowledge/decisions/internals/gateway-adapters-resolve-lazily-and-are-promise-cached.md +0 -32
  442. package/knowledge/decisions/internals/gateway-listener-middleware-runs-without-an-rpc-on-the-wire.md +0 -43
  443. package/knowledge/decisions/internals/gateway-webhook-challenges-echo-bytes-not-json.md +0 -28
  444. package/knowledge/decisions/internals/gateway-wiring-is-a-meta-wiring-over-http-and-channels.md +0 -31
  445. package/knowledge/decisions/internals/generated-src-paths-in-pikku-meta-are-absolute.md +0 -26
  446. package/knowledge/decisions/internals/global-middleware-resolves-from-the-root-namespace-too.md +0 -32
  447. package/knowledge/decisions/internals/hot-reload-reads-the-changed-source-never-a-compiled-copy.md +0 -38
  448. package/knowledge/decisions/internals/hot-reload-writes-into-the-function-map-captured-at-startup.md +0 -26
  449. package/knowledge/decisions/internals/http-request-bodies-are-read-once-and-shared.md +0 -32
  450. package/knowledge/decisions/internals/http-route-groups-cascade-config-in-a-fixed-order.md +0 -28
  451. package/knowledge/decisions/internals/http-router-matches-normalized-paths-but-returns-registered-ones.md +0 -30
  452. package/knowledge/decisions/internals/http-runner-logs-through-a-trace-scoped-logger-functions-do-not.md +0 -26
  453. package/knowledge/decisions/internals/http-set-cookie-headers-are-appended-never-joined.md +0 -28
  454. package/knowledge/decisions/internals/http-sse-streams-flush-headers-only-after-middleware.md +0 -32
  455. package/knowledge/decisions/internals/http-wiring-without-metadata-is-skipped-not-fatal.md +0 -26
  456. package/knowledge/decisions/internals/in-a-scenario-a-4xx-is-data-not-an-exception.md +0 -25
  457. package/knowledge/decisions/internals/in-memory-workflow-history-aliases-the-live-step-object.md +0 -26
  458. package/knowledge/decisions/internals/index.md +0 -182
  459. package/knowledge/decisions/internals/istanbul-statement-counts-attach-to-the-start-line-only.md +0 -25
  460. package/knowledge/decisions/internals/local-trigger-and-gateway-services-assume-a-single-process.md +0 -26
  461. package/knowledge/decisions/internals/mcp-wire-names-are-assigned-over-the-whole-registry.md +0 -39
  462. package/knowledge/decisions/internals/node-only-builtins-are-imported-dynamically.md +0 -24
  463. package/knowledge/decisions/internals/one-project-shape-check-two-validators.md +0 -53
  464. package/knowledge/decisions/internals/only-exposed-functions-enter-a-virtual-user-catalogue.md +0 -21
  465. package/knowledge/decisions/internals/queue-group-concurrency-keeps-one-shared-queue-fair.md +0 -28
  466. package/knowledge/decisions/internals/queue-jobs-always-carry-an-explicit-attempts-count.md +0 -27
  467. package/knowledge/decisions/internals/remote-addons-dispatch-over-http-instead-of-local-meta.md +0 -31
  468. package/knowledge/decisions/internals/role-names-cannot-contain-the-scope-separator.md +0 -30
  469. package/knowledge/decisions/internals/rpc-names-resolve-through-package-scope-before-root.md +0 -32
  470. package/knowledge/decisions/internals/scenario-agent-calls-sign-in-on-401-only.md +0 -31
  471. package/knowledge/decisions/internals/scenario-given-and-when-are-sugar-but-then-is-not.md +0 -24
  472. package/knowledge/decisions/internals/scenario-meta-lives-apart-from-app-meta-but-merges-when-read-off-disk.md +0 -26
  473. package/knowledge/decisions/internals/scenario-steps-return-drained-response-records.md +0 -27
  474. package/knowledge/decisions/internals/scenarios-live-in-files-named-for-them.md +0 -48
  475. package/knowledge/decisions/internals/scope-roots-may-be-co-declared-by-an-addon-and-its-host-app.md +0 -30
  476. package/knowledge/decisions/internals/serverless-channel-disconnect-must-tolerate-a-missing-channel.md +0 -28
  477. package/knowledge/decisions/internals/side-effects-are-an-allowlist-not-a-boolean.md +0 -34
  478. package/knowledge/decisions/internals/speech-synthesis-picks-a-voice-per-sentence-and-warns-once.md +0 -24
  479. package/knowledge/decisions/internals/the-agent-done-event-goes-through-the-middleware-and-is-awaited.md +0 -26
  480. package/knowledge/decisions/internals/the-api-report-pins-members-not-just-names.md +0 -43
  481. package/knowledge/decisions/internals/the-core-scope-validator-refuses-separator-wildcard-and-empty-segments.md +0 -22
  482. package/knowledge/decisions/internals/the-dev-queue-copies-prod-timing-and-serialization-semantics.md +0 -30
  483. package/knowledge/decisions/internals/the-ecosystem-entry-point-carries-the-adapter-surface.md +0 -83
  484. package/knowledge/decisions/internals/the-embedding-model-is-pinned-per-service-and-doc-query-embedding-is-split.md +0 -29
  485. package/knowledge/decisions/internals/the-in-memory-workflow-service-is-inline-only-and-single-process.md +0 -27
  486. package/knowledge/decisions/internals/the-kek-salt-is-scoped-to-the-key-version.md +0 -40
  487. package/knowledge/decisions/internals/the-mcp-handshake-is-challenged-only-when-every-target-is-gated.md +0 -29
  488. package/knowledge/decisions/internals/the-middleware-resolution-cache-is-deliberately-unbounded.md +0 -40
  489. package/knowledge/decisions/internals/the-per-invocation-rpc-view-is-a-class.md +0 -40
  490. package/knowledge/decisions/internals/the-pikku-user-id-resolves-in-a-fixed-order.md +0 -24
  491. package/knowledge/decisions/internals/the-runner-resolves-wire-services-itself.md +0 -31
  492. package/knowledge/decisions/internals/the-schema-service-is-never-stubbed.md +0 -26
  493. package/knowledge/decisions/internals/the-transcript-event-is-sent-ahead-of-the-run.md +0 -25
  494. package/knowledge/decisions/internals/the-virtual-user-catalogue-is-the-only-gate-on-what-may-be-called.md +0 -21
  495. package/knowledge/decisions/internals/the-virtual-user-prompt-says-json-because-of-json-object-mode.md +0 -22
  496. package/knowledge/decisions/internals/the-virtual-user-runtime-is-exported-from-the-virtual-user-entry-point.md +0 -28
  497. package/knowledge/decisions/internals/the-worker-disposition-is-the-one-that-is-not-testing.md +0 -22
  498. package/knowledge/decisions/internals/thread-history-records-the-transcript-not-the-audio.md +0 -25
  499. package/knowledge/decisions/internals/trigger-declaration-is-split-from-trigger-source.md +0 -33
  500. package/knowledge/decisions/internals/typed-secret-service-caches-for-the-process-lifetime.md +0 -26
  501. package/knowledge/decisions/internals/validate-checks-virtual-users-through-a-shared-module.md +0 -43
  502. package/knowledge/decisions/internals/validate-runs-checks-by-precondition.md +0 -115
  503. package/knowledge/decisions/internals/virtual-user-conversation-drives-the-target-through-a-transport-seam.md +0 -24
  504. package/knowledge/decisions/internals/virtual-user-conversation-verdicts-are-llm-self-evaluations.md +0 -25
  505. package/knowledge/decisions/internals/virtual-user-conversations-seed-a-hidden-kickoff-message.md +0 -23
  506. package/knowledge/decisions/internals/virtual-user-step-order-comes-from-insertion-order.md +0 -21
  507. package/knowledge/decisions/internals/virtual-users-are-declared-in-one-definevirtualusers-call-per-codebase.md +0 -30
  508. package/knowledge/decisions/internals/voice-output-speaks-unless-voice-input-explicitly-says-otherwise.md +0 -24
  509. package/knowledge/decisions/internals/webhook-delivery-history-records-every-attempt-best-effort.md +0 -26
  510. package/knowledge/decisions/internals/webhook-service-collaborators-are-constructor-args-not-locator-lookups.md +0 -25
  511. package/knowledge/decisions/internals/whether-a-run-is-inline-is-read-from-the-run-record.md +0 -58
  512. package/knowledge/decisions/internals/wiring-registries-erase-the-generics-their-wire-functions-capture.md +0 -35
  513. package/knowledge/decisions/internals/workflow-approval-expiry-is-decided-from-a-recorded-deadline.md +0 -34
  514. package/knowledge/decisions/internals/workflow-core-never-imports-a-browser-driver.md +0 -42
  515. package/knowledge/decisions/internals/workflow-dsl-meta-separates-runtime-expressions-from-literals.md +0 -38
  516. package/knowledge/decisions/internals/workflow-features-resolve-scenarios-by-object-identity.md +0 -29
  517. package/knowledge/decisions/internals/workflow-graph-inline-and-queued-runs-share-one-planner.md +0 -42
  518. package/knowledge/decisions/internals/workflow-graph-node-notes-are-excluded-from-the-graph-hash.md +0 -25
  519. package/knowledge/decisions/internals/workflow-inline-runs-report-their-run-id-before-they-can-fail.md +0 -29
  520. package/knowledge/decisions/internals/workflow-invocation-id-is-the-dedupe-key-not-step-id.md +0 -43
  521. package/knowledge/decisions/internals/workflow-queued-step-dispatch-requires-an-explicit-opt-in.md +0 -29
  522. package/knowledge/decisions/internals/workflow-queues-are-per-workflow-by-default.md +0 -42
  523. package/knowledge/decisions/internals/workflow-repeated-step-names-get-an-ordinal-suffix.md +0 -33
  524. package/knowledge/decisions/internals/workflow-replay-reads-its-steps-once-and-caches-only-the-immutable-half.md +0 -32
  525. package/knowledge/decisions/internals/workflow-retries-are-owned-by-the-workflow-not-the-queue.md +0 -31
  526. package/knowledge/decisions/internals/workflow-run-capabilities-are-extensions-not-subclasses.md +0 -39
  527. package/knowledge/decisions/internals/workflow-run-mirror-is-never-a-source-of-truth.md +0 -29
  528. package/knowledge/decisions/internals/workflow-run-polling-backs-off-to-the-callers-ceiling.md +0 -33
  529. package/knowledge/decisions/internals/workflow-run-timeline-is-a-pure-fold-over-durable-history.md +0 -37
  530. package/knowledge/decisions/internals/workflow-scenario-assertions-never-retry-and-record-one-step.md +0 -54
  531. package/knowledge/decisions/internals/workflow-scenario-hooks-are-a-scenario-only-affordance.md +0 -43
  532. package/knowledge/decisions/internals/workflow-scenario-prose-is-rendered-from-typed-calls-not-parsed-from-english.md +0 -32
  533. package/knowledge/decisions/internals/workflow-scenario-quarantine-reason-lives-in-code.md +0 -18
  534. package/knowledge/decisions/internals/workflow-scenario-step-targets-are-string-literals-for-the-inspector.md +0 -34
  535. package/knowledge/decisions/internals/workflow-step-compensation-runs-as-its-own-durable-step.md +0 -29
  536. package/knowledge/decisions/internals/workflow-step-dispatch-failure-is-transient-not-a-run-failure.md +0 -33
  537. package/knowledge/decisions/internals/workflow-step-lock-is-held-only-to-claim-the-step.md +0 -34
  538. package/knowledge/decisions/internals/workflow-step-rpc-name-is-provenance-only.md +0 -34
  539. package/knowledge/decisions/internals/workflow-suspend-and-approval-reasons-are-durable-step-identities.md +0 -38
  540. package/knowledge/decisions/internals/workflow-suspended-runs-keep-their-in-process-context.md +0 -30
  541. package/knowledge/decisions/security/a-bearer-token-checked-against-a-secret-reads-it-per-request.md +0 -26
  542. package/knowledge/decisions/security/a-call-without-a-session-raises-missing-session-not-forbidden.md +0 -20
  543. package/knowledge/decisions/security/a-caller-cookie-wins-over-the-jar-for-the-same-name.md +0 -23
  544. package/knowledge/decisions/security/a-channel-lifecycle-acts-as-the-socket-upgrade-session.md +0 -16
  545. package/knowledge/decisions/security/a-channel-requires-a-session-unless-it-says-auth-false.md +0 -26
  546. package/knowledge/decisions/security/a-credential-read-path-follows-its-declared-type-not-absence.md +0 -32
  547. package/knowledge/decisions/security/a-credential-type-is-a-literal-the-inspector-checks-at-declaration.md +0 -27
  548. package/knowledge/decisions/security/a-dropped-audit-write-is-always-logged.md +0 -28
  549. package/knowledge/decisions/security/a-first-party-cookie-is-written-only-after-its-purposes-consent.md +0 -33
  550. package/knowledge/decisions/security/a-function-never-receives-the-secret-service.md +0 -37
  551. package/knowledge/decisions/security/a-graph-run-starts-at-an-entry-node-the-graph-declared.md +0 -33
  552. package/knowledge/decisions/security/a-permission-gets-a-wire-it-cannot-reply-on.md +0 -33
  553. package/knowledge/decisions/security/a-public-function-says-so-with-auth-false.md +0 -34
  554. package/knowledge/decisions/security/a-readonly-session-reaches-only-readonly-functions.md +0 -25
  555. package/knowledge/decisions/security/a-scaffold-flag-says-a-surface-exists-not-who-may-call-it.md +0 -52
  556. package/knowledge/decisions/security/a-scheduled-virtual-user-run-needs-no-admin-at-run-time.md +0 -27
  557. package/knowledge/decisions/security/a-scoped-credential-view-is-limited-to-declared-names.md +0 -26
  558. package/knowledge/decisions/security/a-scoped-secret-view-reads-only-declared-keys-and-never-writes.md +0 -25
  559. package/knowledge/decisions/security/a-secret-is-sent-only-to-the-hosts-it-declares.md +0 -29
  560. package/knowledge/decisions/security/a-step-can-name-an-identity-no-virtual-user-holds-through-per-call-headers.md +0 -25
  561. package/knowledge/decisions/security/a-step-runs-the-function-the-workflow-dispatched-it-with.md +0 -37
  562. package/knowledge/decisions/security/a-stopped-run-by-id-skips-the-ownership-check.md +0 -24
  563. package/knowledge/decisions/security/a-vault-secret-redacts-on-serialization-and-throws-on-coercion.md +0 -29
  564. package/knowledge/decisions/security/a-virtual-user-catalogue-entry-is-filtered-by-scope-and-approval-is-denied-by-default.md +0 -30
  565. package/knowledge/decisions/security/a-virtual-user-environment-fails-closed.md +0 -38
  566. package/knowledge/decisions/security/a-virtual-user-is-never-offered-a-step-that-would-forge-its-own-oracle.md +0 -27
  567. package/knowledge/decisions/security/a-virtual-user-never-runs-against-production.md +0 -23
  568. package/knowledge/decisions/security/a-virtual-user-reads-its-roles-from-the-apps-own-rpc-before-better-auth.md +0 -27
  569. package/knowledge/decisions/security/a-virtual-user-run-treats-an-unresolved-environment-as-production.md +0 -41
  570. package/knowledge/decisions/security/a-virtual-user-scopes-are-expanded-from-its-roles-once-at-run-preparation.md +0 -25
  571. package/knowledge/decisions/security/a-virtual-user-whose-roles-drift-from-the-declaration-refuses-to-run.md +0 -32
  572. package/knowledge/decisions/security/a-workflow-run-is-read-and-approved-by-its-owner.md +0 -50
  573. package/knowledge/decisions/security/addon-auth-and-tags-only-tighten.md +0 -43
  574. package/knowledge/decisions/security/addon-config-gates-apply-only-at-the-namespaced-rpc-boundary.md +0 -52
  575. package/knowledge/decisions/security/addon-scopes-are-resolved-where-the-function-runs.md +0 -46
  576. package/knowledge/decisions/security/addon-screen-scopes-hide-and-do-not-enforce.md +0 -20
  577. package/knowledge/decisions/security/agent-approval-forwarding-requires-a-symbol-brand.md +0 -27
  578. package/knowledge/decisions/security/agent-credential-requests-are-symbol-branded.md +0 -37
  579. package/knowledge/decisions/security/agent-gate-requires-a-session-only-when-auth-is-true.md +0 -31
  580. package/knowledge/decisions/security/agent-ownership-failures-never-echo-the-resource.md +0 -23
  581. package/knowledge/decisions/security/agent-resume-re-runs-the-authorization-gate.md +0 -22
  582. package/knowledge/decisions/security/agent-sessionless-deployments-have-no-thread-ownership.md +0 -39
  583. package/knowledge/decisions/security/agent-thread-ownership-composes-the-session-principal.md +0 -30
  584. package/knowledge/decisions/security/agent-tool-filtering-reads-the-live-function-config.md +0 -24
  585. package/knowledge/decisions/security/an-addon-header-can-only-narrow-the-session.md +0 -26
  586. package/knowledge/decisions/security/an-addon-instance-reads-only-the-secrets-and-credentials-it-is-named.md +0 -33
  587. package/knowledge/decisions/security/an-addon-may-reach-only-itself-and-the-addons-it-uses.md +0 -16
  588. package/knowledge/decisions/security/an-agent-approval-is-claimed-before-the-tool-runs.md +0 -33
  589. package/knowledge/decisions/security/an-api-key-is-jwt-decoded-into-the-session.md +0 -26
  590. package/knowledge/decisions/security/an-approval-answer-outlives-the-run-it-answered.md +0 -59
  591. package/knowledge/decisions/security/an-empty-owners-constraint-matches-nothing.md +0 -30
  592. package/knowledge/decisions/security/an-exposed-ungated-function-is-a-codegen-warning.md +0 -52
  593. package/knowledge/decisions/security/an-external-virtual-user-caller-presents-one-signed-statement.md +0 -38
  594. package/knowledge/decisions/security/an-inbound-webhook-source-dispatches-only-verified-requests.md +0 -31
  595. package/knowledge/decisions/security/an-mcp-call-with-no-http-request-stays-anonymous.md +0 -18
  596. package/knowledge/decisions/security/an-mcp-refusal-is-decided-before-dispatch.md +0 -48
  597. package/knowledge/decisions/security/an-oauth2-credential-is-read-by-its-account-row.md +0 -40
  598. package/knowledge/decisions/security/an-omitted-user-id-addresses-the-platform-credential.md +0 -32
  599. package/knowledge/decisions/security/an-upload-is-counted-as-it-arrives-not-buffered-then-measured.md +0 -24
  600. package/knowledge/decisions/security/analytics-identity-is-stamped-from-the-session-not-the-event.md +0 -24
  601. package/knowledge/decisions/security/app-access-is-a-scope-tree-synthesised-from-virtual-users.md +0 -26
  602. package/knowledge/decisions/security/approval-policy-decides-who-answers-a-tool-call.md +0 -27
  603. package/knowledge/decisions/security/auth-false-on-a-session-function-warns-and-still-requires-one.md +0 -25
  604. package/knowledge/decisions/security/bearer-token-hashes-are-unpeppered-sha256.md +0 -18
  605. package/knowledge/decisions/security/consent-is-read-from-a-cookie-and-a-recognised-denial-counts-as-refusal.md +0 -29
  606. package/knowledge/decisions/security/console-addon-privileged-functions-gate-themselves.md +0 -84
  607. package/knowledge/decisions/security/core-safe-fetch-blocks-ssrf-by-host-literal-not-dns.md +0 -39
  608. package/knowledge/decisions/security/core-secrets-use-a-per-secret-dek-wrapped-by-a-kek.md +0 -37
  609. package/knowledge/decisions/security/cors-defaults-to-any-origin-and-refuses-the-wildcard-with-credentials.md +0 -22
  610. package/knowledge/decisions/security/credential-backends-share-one-conformance-suite-for-per-user-isolation.md +0 -29
  611. package/knowledge/decisions/security/each-stage-has-one-virtual-user-key-pair.md +0 -27
  612. package/knowledge/decisions/security/gateway-handlers-run-through-the-function-runner-gate.md +0 -41
  613. package/knowledge/decisions/security/gateway-middleware-sessions-must-be-bridged-onto-the-wire.md +0 -30
  614. package/knowledge/decisions/security/global-permissions-and-function-permissions-are-independent-gates.md +0 -40
  615. package/knowledge/decisions/security/hmac-verification-fails-closed-on-empty-inputs.md +0 -25
  616. package/knowledge/decisions/security/http-error-detail-is-withheld-from-clients-in-production.md +0 -33
  617. package/knowledge/decisions/security/http-request-bodies-are-bounded-before-they-are-buffered.md +0 -46
  618. package/knowledge/decisions/security/index.md +0 -135
  619. package/knowledge/decisions/security/local-content-refuses-private-buckets-under-the-public-segment.md +0 -21
  620. package/knowledge/decisions/security/mail-is-allowlisted-before-a-virtual-user-run-sees-it.md +0 -38
  621. package/knowledge/decisions/security/mcp-internal-error-details-are-double-gated-on-production.md +0 -27
  622. package/knowledge/decisions/security/mcp-resources-tools-and-prompts-take-sessionless-functions.md +0 -18
  623. package/knowledge/decisions/security/origin-locked-routes-match-the-origin-exactly.md +0 -22
  624. package/knowledge/decisions/security/oss-auth-works-without-pikku-studio-cloud.md +0 -26
  625. package/knowledge/decisions/security/outbound-webhooks-use-an-allowlist-when-configured.md +0 -24
  626. package/knowledge/decisions/security/passphrases-are-stretched-key-material-is-expanded.md +0 -40
  627. package/knowledge/decisions/security/permission-auth-filtering-requires-live-permission-functions.md +0 -31
  628. package/knowledge/decisions/security/pikku-carries-virtual-user-scopes-as-data-and-the-app-grants-them.md +0 -35
  629. package/knowledge/decisions/security/queue-job-identities-are-signed-at-enqueue.md +0 -69
  630. package/knowledge/decisions/security/queue-jobs-carry-the-producers-pikku-user-id.md +0 -39
  631. package/knowledge/decisions/security/remote-addon-tokens-are-client-credentials-not-mesh-trust.md +0 -34
  632. package/knowledge/decisions/security/scaffold-features-are-authenticated-unless-opted-out.md +0 -55
  633. package/knowledge/decisions/security/scenario-step-functions-are-never-externally-invocable.md +0 -30
  634. package/knowledge/decisions/security/scope-resolution-happens-at-the-session-boundary-and-sync-never-deletes.md +0 -28
  635. package/knowledge/decisions/security/scoped-content-access-is-a-root-folder-with-longest-prefix-grants.md +0 -31
  636. package/knowledge/decisions/security/self-authentication-is-declared-not-detected.md +0 -34
  637. package/knowledge/decisions/security/services-without-secrets-get-a-throwing-secrets-accessor.md +0 -22
  638. package/knowledge/decisions/security/shared-guards-refuse-to-mutate-or-shadow-a-system-role.md +0 -34
  639. package/knowledge/decisions/security/signed-content-urls-bind-the-request-path.md +0 -37
  640. package/knowledge/decisions/security/signed-uploads-are-verified-by-the-same-check-as-signed-reads.md +0 -26
  641. package/knowledge/decisions/security/system-role-scopes-must-be-declared-with-define-scope.md +0 -24
  642. package/knowledge/decisions/security/system-roles-are-additive-and-immutable.md +0 -16
  643. package/knowledge/decisions/security/the-channel-rpc-does-not-send-the-callers-session.md +0 -21
  644. package/knowledge/decisions/security/the-remote-jobs-inbox-fails-closed-without-a-secret.md +0 -24
  645. package/knowledge/decisions/security/the-remote-rpc-gate-fails-closed-and-binds-the-token-to-its-function.md +0 -34
  646. package/knowledge/decisions/security/the-workflow-status-stream-rechecks-ownership-on-every-poll.md +0 -16
  647. package/knowledge/decisions/security/two-credentials-on-one-key-must-share-a-read-mode.md +0 -29
  648. package/knowledge/decisions/security/verified-bearer-claims-are-pass-through-data-that-core-never-fills.md +0 -23
  649. package/knowledge/decisions/security/virtual-user-catalogue-excludes-the-machinery-that-runs-virtual-users.md +0 -25
  650. package/knowledge/decisions/security/virtual-user-conversation-missing-approval-decisions-default-to-denied.md +0 -22
  651. package/knowledge/decisions/security/virtual-user-run-records-are-gated-behind-a-read-scope.md +0 -18
  652. package/knowledge/decisions/security/virtual-user-sign-in-does-not-exist-in-production.md +0 -25
  653. package/knowledge/decisions/security/virtual-user-sign-in-has-one-door.md +0 -42
  654. package/knowledge/decisions/security/virtual-user-sign-in-is-proven-by-set-cookie-not-a-non-empty-jar.md +0 -29
  655. package/knowledge/decisions/security/virtual-user-sign-in-only-works-for-virtual-user-flagged-users.md +0 -29
  656. package/knowledge/decisions/security/webhook-bodies-are-signed-before-they-are-enqueued.md +0 -25
  657. package/knowledge/decisions/security/wire-addon-expose-selects-the-rpc-surface.md +0 -51
  658. package/knowledge/decisions/security/workflow-approval-payloads-are-validated-on-replay-inside-the-workflow.md +0 -40
  659. package/knowledge/decisions/security/workflow-helper-functions-are-sessionless-by-declaration.md +0 -18
  660. package/knowledge/decisions/security/workflow-queued-steps-rehydrate-their-session-from-the-run-wire.md +0 -32
  661. package/knowledge/decisions/security/workflow-scenario-sessions-are-isolated-per-virtual-user-and-per-scenario.md +0 -32
  662. package/knowledge/decisions/security/workflow-scenario-steps-are-never-network-invocable.md +0 -31
  663. package/knowledge/decisions/security/workflow-virtual-user-steps-always-use-the-real-transport.md +0 -34
  664. package/knowledge/decisions/security/writing-a-virtual-user-schedule-is-gated-by-its-own-scope.md +0 -18
  665. package/knowledge/index.md +0 -24
  666. package/knowledge/questions/a-bearer-jwt-with-no-identity-becomes-a-session.md +0 -24
  667. package/knowledge/questions/channel-middleware-accepts-bare-factories-that-nothing-resolves.md +0 -35
  668. package/knowledge/questions/dev-quick-login-as-impersonation.md +0 -25
  669. package/knowledge/questions/does-a-delayed-rpc-run-as-the-session-it-was-scheduled-with.md +0 -26
  670. package/knowledge/questions/does-a-user-id-with-a-colon-read-another-users-credentials.md +0 -27
  671. package/knowledge/questions/does-a-wirecli-command-need-a-session-by-default.md +0 -26
  672. package/knowledge/questions/does-an-adversarial-in-scope-success-count-as-a-finding.md +0 -26
  673. package/knowledge/questions/does-approve-step-need-the-run-owners-session-or-the-gates-approvers.md +0 -34
  674. package/knowledge/questions/does-cors-origin-true-reflect-any-origin-with-credentials.md +0 -20
  675. package/knowledge/questions/does-skip-user-session-do-anything-on-a-channel.md +0 -24
  676. package/knowledge/questions/does-the-store-session-match-the-other-two.md +0 -19
  677. package/knowledge/questions/index.md +0 -41
  678. package/knowledge/questions/is-the-agent-score-worker-reachable-without-a-session.md +0 -21
  679. package/knowledge/questions/live-scheduled-tests-may-write.md +0 -19
  680. package/knowledge/questions/provision-virtual-users-has-no-caller-in-this-repo.md +0 -23
  681. package/knowledge/questions/remote-secret-refuses-requests-without-a-remote-token-on-every-path.md +0 -32
  682. package/knowledge/questions/should-a-middleware-set-session-persist-to-the-store.md +0 -25
  683. package/knowledge/questions/should-a-scoped-secret-view-throw-from-has-secret-for-a-disallowed-key.md +0 -23
  684. package/knowledge/questions/should-a-wrong-bearer-token-be-anonymous-or-refused.md +0 -35
  685. package/knowledge/questions/should-an-empty-webhook-signing-secret-send-unsigned.md +0 -23
  686. package/knowledge/questions/should-http-virtual-user-sessions-reset-between-scenarios-in-one-run.md +0 -27
  687. package/knowledge/questions/should-the-cookie-jar-scope-cookies-to-the-api-origin.md +0 -26
  688. package/knowledge/questions/should-voice-input-fetch-audio-urls-without-a-host-allowlist.md +0 -20
  689. package/knowledge/questions/staging-impersonation-rules.md +0 -27
  690. package/knowledge/questions/unauthorized-channel-replies-escape-the-declared-out-type.md +0 -44
  691. package/knowledge/questions/virtual-user-keys-on-cloud-stages-are-pikku-studios-to-build.md +0 -33
  692. package/knowledge/questions/virtual-user-statement-replay-is-per-process.md +0 -20
  693. package/knowledge/questions/what-an-impersonated-session-carries.md +0 -22
  694. package/run-tests.sh +0 -68
  695. package/scripts/generate-api-report.d.mts +0 -1
  696. package/scripts/generate-api-report.mjs +0 -96
  697. package/scripts/generate-api-report.mts +0 -333
  698. package/src/public-surface.json +0 -637
  699. package/src/public-surface.json.README +0 -43
  700. /package/dist/{function/compensation-name.d.ts → compensation-name.d.ts} +0 -0
  701. /package/dist/{function/compensation-name.js → compensation-name.js} +0 -0
@@ -5,6 +5,22 @@ import { type AgentInterruption, type AgentInterruptResult } from './agent-inter
5
5
  export declare function checkForApprovals(stepResult: AgentStepResult, tools: AgentRunnerParams['tools']): ToolApprovalRequired[];
6
6
  export declare function checkForCredentialRequests(stepResult: AgentStepResult): ToolCredentialRequired[];
7
7
  export declare function appendStepMessages(runnerParams: AgentRunnerParams, stepResult: AgentStepResult): void;
8
+ /**
9
+ * Runs an agent and streams its progress (text deltas, tool calls, approvals, usage) to `channel`.
10
+ *
11
+ * Authorization and thread partitioning are as for `runAgent`. A tool needing approval or a
12
+ * credential ends the stream with an `approval-request` or `credential-request` event and leaves the run
13
+ * suspended for `resumeAgent`.
14
+ *
15
+ * @param agentName - The agent to run.
16
+ * @param input - The user message, thread and resource ids, and optional model overrides.
17
+ * @param channel - Receives the `AgentStreamEvent`s.
18
+ * @param params - The caller's session and credential access.
19
+ * @param agentSessionMap - Sub-agent session ids, shared across delegated calls in one run.
20
+ * @param options - Approval policy and a run-created callback.
21
+ * @returns The full text of the streamed reply.
22
+ * @throws As `runAgent` does, before the stream starts.
23
+ */
8
24
  export declare function streamAgent(agentName: string, input: {
9
25
  message: string;
10
26
  threadId: string;
@@ -34,6 +50,20 @@ export declare function interruptAgent(input: {
34
50
  runId: string;
35
51
  reason?: AgentInterruption['reason'];
36
52
  }, params: RunAgentParams): Promise<AgentInterruptResult>;
53
+ /**
54
+ * Answers one pending approval on a suspended run and streams the continuation to `channel`.
55
+ * Backs `rpc.agent.resume`.
56
+ *
57
+ * Only the run's owner may resume it, and the agent is re-authorized. The approval is claimed
58
+ * atomically, so a second concurrent resume fails instead of running the tool again.
59
+ *
60
+ * @param input - The run, the tool call being answered and the decision.
61
+ * @param channel - Receives the continuation's `AgentStreamEvent`s.
62
+ * @param params - The caller's session.
63
+ * @param options - Approval policy for the rest of the run.
64
+ * @throws ForbiddenError when the caller does not own the run; Error when the run or its pending
65
+ * approval is missing, or the approval was already resolved.
66
+ */
37
67
  export declare function resumeAgent(input: {
38
68
  runId: string;
39
69
  toolCallId: string;
@@ -1,10 +1,10 @@
1
1
  import { finalizeAgentRun, lastUserMessageText } from './agent-finalize.js';
2
2
  import { pikkuState, getSingletonServices } from '../../pikku-state.js';
3
- import { applyInputMiddleware } from './agent-turn.js';
3
+ import { applyInputMiddleware, describeApprovals } from './agent-turn.js';
4
4
  import { AIProviderNotConfiguredError } from '../../errors/errors.js';
5
5
  import { deniedToolResult, randomUUID } from './agent-utils.js';
6
6
  import { SPOKEN_TRANSCRIPT } from './voice-input.js';
7
- import { combineChannelMiddleware, wrapChannelWithMiddleware, } from '../channel/channel-middleware-runner.js';
7
+ import { combineChannelMiddleware, wrapChannelWithMiddleware, } from '../../channel-middleware-runner.js';
8
8
  import { resolveMemoryServices, loadContextMessages, trimMessages, getWorkingMemoryMiddleware, } from './agent-memory.js';
9
9
  import { prepareAgentRun, resolveAgent, buildInstructions, buildToolDefs, createScopedChannel, resolveOwnerResourceId, agentSessionScope, assertResourceOwner, assertResourcePrincipalOwner, assertAgentAuthorized, ToolApprovalRequired, ToolCredentialRequired, APPROVAL_REQUIRED, CREDENTIAL_REQUIRED, } from './agent-prepare.js';
10
10
  import { resolveModelConfig } from './agent-model-config.js';
@@ -285,15 +285,7 @@ async function runStreamStepLoop(params) {
285
285
  break;
286
286
  const approvalsNeeded = checkForApprovals(stepResult, runnerParams.tools);
287
287
  if (approvalsNeeded.length > 0) {
288
- for (const approval of approvalsNeeded) {
289
- const toolDef = runnerParams.tools.find((t) => t.name === approval.toolName);
290
- if (toolDef?.approvalDescriptionFn && !approval.reason) {
291
- try {
292
- approval.reason = await toolDef.approvalDescriptionFn(approval.args);
293
- }
294
- catch { }
295
- }
296
- }
288
+ await describeApprovals(approvalsNeeded, runnerParams.tools);
297
289
  return { outcome: 'approval', approvals: approvalsNeeded };
298
290
  }
299
291
  const credentialRequests = checkForCredentialRequests(stepResult);
@@ -461,6 +453,22 @@ function handleCredentialRequests(requests, runId, channel, agentRunState, persi
461
453
  await channel.close();
462
454
  })();
463
455
  }
456
+ /**
457
+ * Runs an agent and streams its progress (text deltas, tool calls, approvals, usage) to `channel`.
458
+ *
459
+ * Authorization and thread partitioning are as for `runAgent`. A tool needing approval or a
460
+ * credential ends the stream with an `approval-request` or `credential-request` event and leaves the run
461
+ * suspended for `resumeAgent`.
462
+ *
463
+ * @param agentName - The agent to run.
464
+ * @param input - The user message, thread and resource ids, and optional model overrides.
465
+ * @param channel - Receives the `AgentStreamEvent`s.
466
+ * @param params - The caller's session and credential access.
467
+ * @param agentSessionMap - Sub-agent session ids, shared across delegated calls in one run.
468
+ * @param options - Approval policy and a run-created callback.
469
+ * @returns The full text of the streamed reply.
470
+ * @throws As `runAgent` does, before the stream starts.
471
+ */
464
472
  export async function streamAgent(agentName, input, channel, params, agentSessionMap, options) {
465
473
  const sessionMap = agentSessionMap ?? new Map();
466
474
  const normalizedInput = {
@@ -713,6 +721,20 @@ export async function interruptAgent(input, params) {
713
721
  // model call does nothing to a tool already executing.
714
722
  return { stopped, inFlightTools: getInFlightTools(input.runId) };
715
723
  }
724
+ /**
725
+ * Answers one pending approval on a suspended run and streams the continuation to `channel`.
726
+ * Backs `rpc.agent.resume`.
727
+ *
728
+ * Only the run's owner may resume it, and the agent is re-authorized. The approval is claimed
729
+ * atomically, so a second concurrent resume fails instead of running the tool again.
730
+ *
731
+ * @param input - The run, the tool call being answered and the decision.
732
+ * @param channel - Receives the continuation's `AgentStreamEvent`s.
733
+ * @param params - The caller's session.
734
+ * @param options - Approval policy for the rest of the run.
735
+ * @throws ForbiddenError when the caller does not own the run; Error when the run or its pending
736
+ * approval is missing, or the approval was already resolved.
737
+ */
716
738
  export async function resumeAgent(input, channel, params, options) {
717
739
  const singletonServices = getSingletonServices();
718
740
  const { agentRunState } = singletonServices;
@@ -11,6 +11,10 @@ import type { PikkuRawWire } from '../../types/core.types.js';
11
11
  import type { PikkuRPC } from '../rpc/rpc-types.js';
12
12
  import type { SessionService } from '../../services/user-session-service.js';
13
13
  import type { CoreUserSession } from '../../types/core.types.js';
14
+ /**
15
+ * What `wire.rpc.agent` needs from the invocation: the caller's session service.
16
+ * @internal
17
+ */
14
18
  export type AgentRPCOptions = {
15
19
  sessionService?: SessionService<CoreUserSession>;
16
20
  };
@@ -20,6 +24,10 @@ export type AgentRPCOptions = {
20
24
  * without naming the agent runtime.
21
25
  */
22
26
  export type AgentRPCFactory = (wire: PikkuRawWire, options: AgentRPCOptions) => PikkuRPC['agent'];
27
+ /**
28
+ * A conversation thread. `resourceId` is its owner partition: the session principal, or a
29
+ * `principal:` sub-partition of it.
30
+ */
23
31
  export interface AgentThread {
24
32
  id: string;
25
33
  resourceId: string;
@@ -28,6 +36,7 @@ export interface AgentThread {
28
36
  createdAt: Date;
29
37
  updatedAt: Date;
30
38
  }
39
+ /** One part of a multi-part message: text, an image, a file (audio included) or named data. */
31
40
  export type AgentContentPart = {
32
41
  type: 'text';
33
42
  text: string;
@@ -67,6 +76,7 @@ export interface AgentToolResult {
67
76
  */
68
77
  error?: string;
69
78
  }
79
+ /** A message on an agent thread, as stored and as sent to the model. */
70
80
  export interface AgentMessage {
71
81
  id: string;
72
82
  role: 'system' | 'user' | 'assistant' | 'tool';
@@ -93,6 +103,7 @@ export interface AgentMessage {
93
103
  undelivered?: boolean;
94
104
  createdAt: Date;
95
105
  }
106
+ /** One model step of a run: its token usage and the tool calls it made. */
96
107
  export interface AgentStep {
97
108
  usage: {
98
109
  inputTokens: number;
@@ -113,6 +124,10 @@ export interface AgentInputAttachment {
113
124
  mediaType?: string;
114
125
  filename?: string;
115
126
  }
127
+ /**
128
+ * What a caller sends to run an agent. `resourceId` is partitioned under the session principal
129
+ * before use, so it cannot address another user's threads.
130
+ */
116
131
  export interface AgentInput {
117
132
  message: string;
118
133
  threadId: string;
@@ -190,6 +205,10 @@ export interface AgentToolDef extends Partial<ApprovalPolicy> {
190
205
  */
191
206
  forwardsApproval?: boolean;
192
207
  }
208
+ /**
209
+ * Hooks an agent middleware can implement: rewrite the model input, observe each step, transform
210
+ * the output stream, or handle errors. Build one with `pikkuAgentMiddleware`.
211
+ */
193
212
  export interface PikkuAgentMiddlewareHooks<State extends Record<string, unknown> = Record<string, unknown>, SingletonServices extends CoreSingletonServices = CoreSingletonServices> {
194
213
  /** Rewrites what the model is about to see — messages and instructions — before each turn. */
195
214
  modifyInput?: (services: SingletonServices, ctx: {
@@ -333,6 +352,10 @@ export interface PikkuAgentMiddlewareHooks<State extends Record<string, unknown>
333
352
  messages: AgentMessage[];
334
353
  }) => Promise<void> | void;
335
354
  }
355
+ /**
356
+ * An agent's memory: which storage, vector store and embedder services to use, how many recent
357
+ * messages to load, and an optional working-memory schema.
358
+ */
336
359
  export type AgentMemoryConfig = {
337
360
  storage?: string;
338
361
  vector?: string;
@@ -340,6 +363,10 @@ export type AgentMemoryConfig = {
340
363
  lastMessages?: number;
341
364
  workingMemory?: unknown;
342
365
  };
366
+ /**
367
+ * The configuration an agent is declared with (`pikkuAgent`): model, instructions, tools,
368
+ * sub-agents, memory, auth and middleware.
369
+ */
343
370
  export type CoreAgent<PikkuPermission = CorePikkuPermission<any, any>, PikkuMiddleware = CorePikkuMiddleware<any>, Scope extends string = string, Scorer extends string = string> = {
344
371
  /** Unique across the project. It is how the agent is invoked and how its runs are grouped. */
345
372
  name: string;
@@ -420,6 +447,10 @@ export type CoreAgent<PikkuPermission = CorePikkuPermission<any, any>, PikkuMidd
420
447
  /** Checks that run before the agent starts. Grouped names OR together, so any one passing admits the caller. */
421
448
  permissions?: CorePermissionGroup<PikkuPermission>;
422
449
  };
450
+ /**
451
+ * An event a streamed agent run sends: step starts, text and reasoning deltas, tool calls and
452
+ * results, approval and credential requests, usage, errors and `done`.
453
+ */
423
454
  export type AgentStreamEvent = {
424
455
  type: 'step-start';
425
456
  stepNumber: number;
@@ -555,8 +586,13 @@ export type AgentStreamEvent = {
555
586
  } | {
556
587
  type: 'done';
557
588
  };
589
+ /** The channel a streamed agent run writes `AgentStreamEvent`s to. */
558
590
  export interface AgentStreamChannel extends PikkuChannel<unknown, AgentStreamEvent> {
559
591
  }
592
+ /**
593
+ * A tool call a suspended run is waiting on: a direct tool call, a sub-agent's call surfaced to
594
+ * the parent, or a missing credential.
595
+ */
560
596
  export type PendingApproval = {
561
597
  type: 'tool-call';
562
598
  toolCallId: string;
@@ -578,6 +614,7 @@ export type PendingApproval = {
578
614
  credentialType: 'oauth2' | 'apikey';
579
615
  connectUrl?: string;
580
616
  };
617
+ /** A run's persisted state: status, why it is suspended, its pending approvals and token usage. */
581
618
  export interface AgentRunState {
582
619
  runId: string;
583
620
  agentName: string;
@@ -596,6 +633,7 @@ export interface AgentRunState {
596
633
  createdAt: Date;
597
634
  updatedAt: Date;
598
635
  }
636
+ /** A run as listed by `AgentRunService`, with usage flattened into columns. */
599
637
  export interface AgentRunRow {
600
638
  runId: string;
601
639
  agentName: string;
@@ -611,6 +649,10 @@ export interface AgentRunRow {
611
649
  createdAt: Date;
612
650
  updatedAt: Date;
613
651
  }
652
+ /**
653
+ * Read and delete access to stored threads, messages and runs, for consoles and thread APIs.
654
+ * Pass `owners` from the session (see `threadOwnerConstraint`) whenever results go back to a client.
655
+ */
614
656
  export interface AgentRunService {
615
657
  listThreads(options?: {
616
658
  agentName?: string;
@@ -635,6 +677,7 @@ export interface AgentRunService {
635
677
  deleteThread(threadId: string): Promise<boolean>;
636
678
  getDistinctAgentNames(): Promise<string[]>;
637
679
  }
680
+ /** Inspector-generated metadata for every agent, keyed by name, without its runtime-only fields. */
638
681
  export type AgentsMeta = Record<string, Omit<CoreAgent, 'input' | 'output' | 'tools' | 'agents' | 'workflows' | 'middleware' | 'channelMiddleware' | 'agentMiddleware' | 'permissions'> & {
639
682
  tools?: string[];
640
683
  agents?: string[];
@@ -54,6 +54,18 @@ export declare const SPOKEN_TURN = "voice:spokenTurn";
54
54
  * bubble followed by an answer to a question they cannot see.
55
55
  */
56
56
  export declare const SPOKEN_TRANSCRIPT = "voice:transcript";
57
+ /**
58
+ * Agent middleware that transcribes audio parts of the user's message before the model sees them,
59
+ * using the `agentRunner`'s transcription support. Records whether the turn was spoken, which
60
+ * `voiceOutput` reads to decide whether to answer aloud.
61
+ *
62
+ * Audio sent by URL is fetched with `safeFetch`: only the `allowedAudioHosts` when given, otherwise
63
+ * any host that is not private or loopback. Audio over the size limit is rejected.
64
+ *
65
+ * @param config - The transcription model (required once audio arrives), language, and hosts audio
66
+ * URLs may be fetched from.
67
+ * @throws Error when audio arrives with no `model` configured, or the audio is too large.
68
+ */
57
69
  export declare const voiceInput: (config?: {
58
70
  language?: string;
59
71
  model?: string;
@@ -78,6 +78,18 @@ export const SPOKEN_TURN = 'voice:spokenTurn';
78
78
  * bubble followed by an answer to a question they cannot see.
79
79
  */
80
80
  export const SPOKEN_TRANSCRIPT = 'voice:transcript';
81
+ /**
82
+ * Agent middleware that transcribes audio parts of the user's message before the model sees them,
83
+ * using the `agentRunner`'s transcription support. Records whether the turn was spoken, which
84
+ * `voiceOutput` reads to decide whether to answer aloud.
85
+ *
86
+ * Audio sent by URL is fetched with `safeFetch`: only the `allowedAudioHosts` when given, otherwise
87
+ * any host that is not private or loopback. Audio over the size limit is rejected.
88
+ *
89
+ * @param config - The transcription model (required once audio arrives), language, and hosts audio
90
+ * URLs may be fetched from.
91
+ * @throws Error when audio arrives with no `model` configured, or the audio is too large.
92
+ */
81
93
  export const voiceInput = (config) => pikkuAgentMiddleware({
82
94
  modifyInput: async (services, { messages, instructions, shared }) => {
83
95
  const agentRunner = services.agentRunner;
@@ -1,3 +1,7 @@
1
+ /**
2
+ * Per-reply state `voiceOutput` keeps while synthesizing: unspoken text and the audio emission chain.
3
+ * @internal
4
+ */
1
5
  export type VoiceOutputState = {
2
6
  textBuffer?: string;
3
7
  /**
@@ -42,6 +46,16 @@ export declare const unspeakableScripts: (text: string, speakable: SpeakableScri
42
46
  * happens to be written in.
43
47
  */
44
48
  export declare const voiceForText: (text: string, speakable: SpeakableScripts, fallback?: string) => string | undefined;
49
+ /**
50
+ * Agent middleware that synthesizes the streamed reply to speech sentence by sentence, using the
51
+ * `agentRunner`'s `generateSpeech`, and sends the audio as it is ready, in order.
52
+ *
53
+ * By default it speaks only replies to spoken turns (see `voiceInput`); set `always` to speak every
54
+ * reply. Text in a script outside `speakableScripts` is left unspoken and reported once.
55
+ *
56
+ * @param config - Speech model, voice, format and the other synthesis options.
57
+ * @throws Error when the `agentRunner` has no `generateSpeech` support.
58
+ */
45
59
  export declare const voiceOutput: (config?: {
46
60
  model?: string;
47
61
  format?: string;
@@ -100,6 +100,16 @@ async function synthesizeAudio(agentRunner, input) {
100
100
  format: result.audio.format || input.format || 'pcm16',
101
101
  };
102
102
  }
103
+ /**
104
+ * Agent middleware that synthesizes the streamed reply to speech sentence by sentence, using the
105
+ * `agentRunner`'s `generateSpeech`, and sends the audio as it is ready, in order.
106
+ *
107
+ * By default it speaks only replies to spoken turns (see `voiceInput`); set `always` to speak every
108
+ * reply. Text in a script outside `speakableScripts` is left unspoken and reported once.
109
+ *
110
+ * @param config - Speech model, voice, format and the other synthesis options.
111
+ * @throws Error when the `agentRunner` has no `generateSpeech` support.
112
+ */
103
113
  export const voiceOutput = (config) => pikkuAgentMiddleware({
104
114
  modifyOutputStream: async (services, { event, state, shared, emit, signal }) => {
105
115
  const { agentRunner, logger } = services;
@@ -1,4 +1,3 @@
1
- import { randomUUID } from '../agent/agent-utils.js';
2
1
  const JUDGE_OUTPUT_SCHEMA = {
3
2
  type: 'object',
4
3
  properties: {
@@ -117,7 +116,7 @@ export const runJudge = async (scorer, input, agentRunner) => {
117
116
  }
118
117
  const messages = [
119
118
  {
120
- id: randomUUID(),
119
+ id: globalThis.crypto.randomUUID(),
121
120
  role: 'user',
122
121
  content: buildJudgePrompt(judge, input),
123
122
  createdAt: new Date(),
@@ -1,6 +1,16 @@
1
1
  import type { PikkuAgentScorer } from './agent-scorer.types.js';
2
+ /**
3
+ * Registers a scorer's runtime config under its name. Called by generated code.
4
+ *
5
+ * Skipped with a warning when the inspector recorded no metadata (scorers must live in a `*.scorer.ts` file).
6
+ *
7
+ * @throws Error when a scorer with the same name is already registered.
8
+ * @internal
9
+ */
2
10
  export declare const addAgentScorer: (scorerName: string, scorer: PikkuAgentScorer<any>, packageName?: string | null) => void;
11
+ /** Every registered scorer, keyed by name. */
3
12
  export declare const getAgentScorers: () => Map<string, PikkuAgentScorer>;
13
+ /** The inspector-generated metadata for every scorer, keyed by name. */
4
14
  export declare const getAgentScorersMeta: () => import("./agent-scorer.types.js").ScorerMeta;
5
15
  /**
6
16
  * Resolve a scorer by name across every registered package, the way an agent's
@@ -1,4 +1,12 @@
1
1
  import { pikkuState } from '../../pikku-state.js';
2
+ /**
3
+ * Registers a scorer's runtime config under its name. Called by generated code.
4
+ *
5
+ * Skipped with a warning when the inspector recorded no metadata (scorers must live in a `*.scorer.ts` file).
6
+ *
7
+ * @throws Error when a scorer with the same name is already registered.
8
+ * @internal
9
+ */
2
10
  export const addAgentScorer = (scorerName, scorer, packageName = null) => {
3
11
  const scorersMeta = pikkuState(packageName, 'agent', 'scorersMeta');
4
12
  if (!scorersMeta[scorerName]) {
@@ -11,7 +19,9 @@ export const addAgentScorer = (scorerName, scorer, packageName = null) => {
11
19
  }
12
20
  scorers.set(scorerName, scorer);
13
21
  };
22
+ /** Every registered scorer, keyed by name. */
14
23
  export const getAgentScorers = () => pikkuState(null, 'agent', 'scorers');
24
+ /** The inspector-generated metadata for every scorer, keyed by name. */
15
25
  export const getAgentScorersMeta = () => pikkuState(null, 'agent', 'scorersMeta');
16
26
  /**
17
27
  * Resolve a scorer by name across every registered package, the way an agent's
@@ -6,5 +6,6 @@ import type { ScorerInput } from './agent-scorer.types.js';
6
6
  */
7
7
  export declare const enableScoreSnapshots: (maxRuns?: number) => void;
8
8
  export declare const recordScoreSnapshot: (run: ScorerInput) => void;
9
+ /** The scorer input recorded for `runId`, if snapshots are enabled and it has not been evicted. */
9
10
  export declare const getScoreSnapshot: (runId: string) => ScorerInput | undefined;
10
11
  export declare const resetScoreSnapshots: () => void;
@@ -33,6 +33,7 @@ export const recordScoreSnapshot = (run) => {
33
33
  snapshots.delete(oldest);
34
34
  }
35
35
  };
36
+ /** The scorer input recorded for `runId`, if snapshots are enabled and it has not been evicted. */
36
37
  export const getScoreSnapshot = (runId) => snapshots.get(runId);
37
38
  export const resetScoreSnapshots = () => {
38
39
  snapshots.clear();
@@ -30,6 +30,7 @@ export interface ScorerInput {
30
30
  model?: string;
31
31
  };
32
32
  }
33
+ /** What a scorer returns: a 0..1 score, an optional reason and metadata. */
33
34
  export interface ScorerOutput {
34
35
  /** 0..1, so grades are comparable across scorers. */
35
36
  score: number;
@@ -73,6 +74,10 @@ export type ScorerJudgeConfig = {
73
74
  toolCalls: JudgeToolCallDisclosure;
74
75
  prompt?: (input: ScorerInput) => string;
75
76
  };
77
+ /**
78
+ * A scorer: a heuristic `score` function (from `pikkuAgentScorer`) or an LLM `judge`
79
+ * (from `pikkuAgentJudge`), with its lane and live sample rate.
80
+ */
76
81
  export type PikkuAgentScorer<Services = any> = {
77
82
  name: string;
78
83
  description: string;
@@ -87,6 +92,7 @@ export type PikkuAgentScorer<Services = any> = {
87
92
  score?: (input: ScorerInput, services: Services) => ScorerOutput | Promise<ScorerOutput>;
88
93
  judge?: ScorerJudgeConfig;
89
94
  };
95
+ /** Inspector-generated metadata for every scorer, keyed by name. */
90
96
  export type ScorerMeta = Record<string, {
91
97
  name: string;
92
98
  description: string;
@@ -100,6 +106,7 @@ export type ScorerMeta = Record<string, {
100
106
  export type ScoreJob = ScorerInput & {
101
107
  scorerName: string;
102
108
  };
109
+ /** A stored grade of one run by one scorer. */
103
110
  export type AgentRunScore = {
104
111
  runId: string;
105
112
  scorerName: string;
@@ -1,7 +1,7 @@
1
1
  import { combineMiddleware, runMiddleware } from '../../middleware-runner.js';
2
2
  import { runPikkuFunc } from '../../function/function-runner.js';
3
3
  import { createMiddlewareSessionWireProps, } from '../../services/user-session-service.js';
4
- import { combineChannelMiddleware, wrapChannelWithMiddleware, } from './channel-middleware-runner.js';
4
+ import { combineChannelMiddleware, wrapChannelWithMiddleware, } from '../../channel-middleware-runner.js';
5
5
  export const runChannelLifecycleWithMiddleware = async ({ channelConfig, meta, lifecycleConfig, lifecycleType, services, channel, data, channelMiddlewareMeta, userSession, wireServices, }) => {
6
6
  const lifecycleMiddleware = typeof lifecycleConfig === 'object' && 'middleware' in lifecycleConfig
7
7
  ? lifecycleConfig.middleware || []
@@ -6,6 +6,7 @@
6
6
  export declare const CHANNEL_RPC_REQUEST = "pikku-rpc-request";
7
7
  export declare const CHANNEL_RPC_RESPONSE = "pikku-rpc-response";
8
8
  export declare const CHANNEL_RPC_PENDING = "pikku-rpc-pending";
9
+ /** A request frame asking the peer on a channel to run one of its capabilities. */
9
10
  export interface ChannelRPCRequest {
10
11
  action: typeof CHANNEL_RPC_REQUEST;
11
12
  id: string;
@@ -13,6 +14,7 @@ export interface ChannelRPCRequest {
13
14
  data: unknown;
14
15
  traceId?: string;
15
16
  }
17
+ /** The answer to a {@link ChannelRPCRequest} with the same `id`: a result when `ok`, an error name and message otherwise. */
16
18
  export interface ChannelRPCResponse {
17
19
  action: typeof CHANNEL_RPC_RESPONSE;
18
20
  id: string;
@@ -60,6 +62,7 @@ export interface ApprovalPolicy {
60
62
  needsApproval: boolean;
61
63
  approvalDescriptionFn?: (input: unknown) => Promise<string> | string;
62
64
  }
65
+ /** A function one end of a channel offers for the peer to call through `channel.remote`. */
63
66
  export type CapabilityHandler = (data: any) => Promise<unknown> | unknown;
64
67
  /**
65
68
  * `needsApproval` is required here on purpose. On `AgentToolDef` the same
@@ -70,7 +73,9 @@ export type CapabilityHandler = (data: any) => Promise<unknown> | unknown;
70
73
  export interface CapabilityDef extends ApprovalPolicy {
71
74
  execute: CapabilityHandler;
72
75
  }
76
+ /** A capability as registered: a bare handler, which is treated as needing approval, or a {@link CapabilityDef} that says whether it does. */
73
77
  export type Capability = CapabilityHandler | CapabilityDef;
78
+ /** The capabilities one end of a channel answers to, by name. Only names listed here run; anything else the peer asks for is refused. */
74
79
  export type Capabilities = Record<string, Capability>;
75
80
  export declare const isCapabilityDef: (capability: Capability) => capability is CapabilityDef;
76
81
  /**
@@ -1,6 +1,28 @@
1
1
  import type { SessionService } from '../../services/user-session-service.js';
2
2
  import type { ChannelMeta, CoreChannel, RunChannelOptions, RunChannelParams } from './channel.types.js';
3
+ /**
4
+ * Wires a realtime channel (a WebSocket, or a serverless equivalent) to a route.
5
+ *
6
+ * `onConnect` runs once when a client connects, `onDisconnect` once when it
7
+ * leaves, and each message goes to the `onMessageWiring` handler its routing key
8
+ * selects, or to `onMessage` when none matches. A channel requires a session
9
+ * unless it sets `auth: false`. The session is established on connect, by the
10
+ * `middleware` on the channel and the HTTP middleware registered for `'*'`
11
+ * (which runs on the upgrade), and every handler then sees it.
12
+ *
13
+ * Registration needs the metadata `pikku` generates for the channel. When none is
14
+ * found the wiring is skipped with a warning rather than throwing.
15
+ *
16
+ * @param channel - The channel's name, route, lifecycle and message handlers, and middleware.
17
+ *
18
+ * @example snippet: wireChannel
19
+ */
3
20
  export declare const wireChannel: <In, Channel extends string, ChannelConnect, ChannelDisconnect, ChannelFunctionMessage>(channel: CoreChannel<In, Channel, ChannelConnect, ChannelDisconnect, ChannelFunctionMessage>) => void;
21
+ /**
22
+ * Matches a route to a wired channel and validates its opening data against the channel's input schema.
23
+ * @throws {NotFoundError} When no channel is wired at `route`.
24
+ * @internal
25
+ */
4
26
  export declare const openChannel: ({ route, coerceDataFromSchema, request, }: Pick<CoreChannel<unknown, string>, 'route'> & RunChannelParams<unknown> & {
5
27
  userSession: SessionService<any>;
6
28
  } & RunChannelOptions) => Promise<{
@@ -15,6 +15,23 @@ const registeredHandler = (handler) => {
15
15
  ? handler
16
16
  : candidate.func;
17
17
  };
18
+ /**
19
+ * Wires a realtime channel (a WebSocket, or a serverless equivalent) to a route.
20
+ *
21
+ * `onConnect` runs once when a client connects, `onDisconnect` once when it
22
+ * leaves, and each message goes to the `onMessageWiring` handler its routing key
23
+ * selects, or to `onMessage` when none matches. A channel requires a session
24
+ * unless it sets `auth: false`. The session is established on connect, by the
25
+ * `middleware` on the channel and the HTTP middleware registered for `'*'`
26
+ * (which runs on the upgrade), and every handler then sees it.
27
+ *
28
+ * Registration needs the metadata `pikku` generates for the channel. When none is
29
+ * found the wiring is skipped with a warning rather than throwing.
30
+ *
31
+ * @param channel - The channel's name, route, lifecycle and message handlers, and middleware.
32
+ *
33
+ * @example snippet: wireChannel
34
+ */
18
35
  export const wireChannel = (channel) => {
19
36
  const channelsMeta = pikkuState(null, 'channel', 'meta');
20
37
  const channelMeta = channelsMeta[channel.name];
@@ -69,6 +86,11 @@ const getMatchingChannelConfig = (path) => {
69
86
  meta: channelMeta,
70
87
  };
71
88
  };
89
+ /**
90
+ * Matches a route to a wired channel and validates its opening data against the channel's input schema.
91
+ * @throws {NotFoundError} When no channel is wired at `route`.
92
+ * @internal
93
+ */
72
94
  export const openChannel = async ({ route, coerceDataFromSchema = true, request, }) => {
73
95
  const singletonServices = getSingletonServices();
74
96
  const matchingChannel = getMatchingChannelConfig(route);
@@ -1,9 +1,17 @@
1
+ /** A channel as a {@link ChannelStore} persists it between serverless invocations. */
1
2
  export type Channel<ChannelType = unknown, OpeningData = unknown> = {
2
3
  channelId: string;
3
4
  channelName: string;
4
5
  channelObject?: ChannelType;
5
6
  openingData?: OpeningData;
6
7
  };
8
+ /**
9
+ * Persists open channels for serverless runtimes, where each connect, message and disconnect runs in a separate invocation.
10
+ *
11
+ * It keeps the channel's opening data, its state, and the `pikkuUserId` of the
12
+ * session established on connect. The session itself is not stored: each
13
+ * message reloads it from the `sessionStore` by that id.
14
+ */
7
15
  export declare abstract class ChannelStore<ChannelType = unknown, OpeningData = unknown, TypedChannel = Channel<ChannelType, OpeningData>> {
8
16
  abstract addChannel(channel: Channel<ChannelType, OpeningData>): Promise<void> | void;
9
17
  abstract removeChannels(channelId: string[]): Promise<void> | void;
@@ -1,2 +1,9 @@
1
+ /**
2
+ * Persists open channels for serverless runtimes, where each connect, message and disconnect runs in a separate invocation.
3
+ *
4
+ * It keeps the channel's opening data, its state, and the `pikkuUserId` of the
5
+ * session established on connect. The session itself is not stored: each
6
+ * message reloads it from the `sessionStore` by that id.
7
+ */
1
8
  export class ChannelStore {
2
9
  }