@pikku/core 0.12.79 → 0.12.82

package/dist/services/in-memory-ai-run-state-service.js

@@ -1,5 +1,6 @@
 export class InMemoryAIRunStateService {
     runs = new Map();
+    scores = new Map();
     counter = 0;
     async createRun(run) {
         const runId = `run-${++this.counter}-${Date.now()}`;
@@ -25,10 +26,11 @@ export class InMemoryAIRunStateService {
                 if (approval) {
                     run.pendingApprovals = run.pendingApprovals.filter((a) => a.toolCallId !== toolCallId);
                     run.updatedAt = new Date();
-                    return;
+                    return true;
                 }
             }
         }
+        return false;
     }
     async findRunByToolCallId(toolCallId) {
         for (const run of this.runs.values()) {
@@ -41,4 +43,12 @@ export class InMemoryAIRunStateService {
         }
         return null;
     }
+    async saveScore(score) {
+        const existing = this.scores.get(score.runId) ?? [];
+        existing.push({ ...score, createdAt: new Date() });
+        this.scores.set(score.runId, existing);
+    }
+    async getScores(runId) {
+        return [...(this.scores.get(runId) ?? [])];
+    }
 }

package/dist/services/in-memory-workflow-service.js

@@ -74,6 +74,7 @@ export class InMemoryWorkflowService extends PikkuWorkflowService {
         const step = {
             stepId,
             status: 'pending',
+            rpcName,
             attemptCount: 1,
             retries: stepOptions?.retries,
             retryDelay: stepOptions?.retryDelay,
@@ -177,6 +178,7 @@ export class InMemoryWorkflowService extends PikkuWorkflowService {
         const newStep = {
             stepId: newStepId,
             status,
+            rpcName: failedStep.rpcName,
             attemptCount: failedStep.attemptCount + 1,
             retries: failedStep.retries,
             retryDelay: failedStep.retryDelay,

package/dist/services/index.d.ts

@@ -1,8 +1,9 @@
 export { LogLevel } from './logger.js';
 export { ScopedSecretService } from './scoped-secret-service.js';
-export { PikkuSessionService, createMiddlewareSessionWireProps, createFunctionSessionWireProps, } from './user-session-service.js';
+export { ScopedCredentialService } from './scoped-credential-service.js';
+export { PikkuSessionService, createMiddlewareSessionWireProps, } from './user-session-service.js';
 export { TypedSecretService } from './typed-secret-service.js';
-export { PikkuCredentialWireService, createMiddlewareCredentialWireProps, createWireServicesCredentialWireProps, } from './credential-wire-service.js';
+export { PikkuCredentialWireService, } from './credential-wire-service.js';
 export { TypedVariablesService } from './typed-variables-service.js';
 export { LocalSecretService } from './local-secrets.js';
 export { LocalEmailService } from './local-email-service.js';
@@ -16,11 +17,11 @@ export { InMemoryTriggerService } from './in-memory-trigger-service.js';
 export { InMemoryAIRunStateService } from './in-memory-ai-run-state-service.js';
 export { LocalGatewayService } from './local-gateway-service.js';
 export type { ContentService, SignContentKeyArgs, SignURLArgs, GetUploadURLArgs, UploadURLResult, BucketKeyArgs, WriteFileArgs, CopyFileArgs, } from './content-service.js';
-export type { ScenarioPersona, ResolvedPersona, ScenarioPersonaOf, ScenarioPersonas, ScenarioInvokeOptions, ScenarioRpcMap, ScenarioHttpResponse, } from './personas-service.js';
+export type { ScenarioPersona, ResolvedPersona, ScenarioPersonas, ScenarioHttpResponse, } from './personas-service.js';
 export type { HttpPersonasConfig } from './http-personas.js';
 export type { JWTService } from './jwt-service.js';
-export type { EmailService, EmailTemplateReference, SendEmailInput, SendEmailResult, SendHTMLEmailInput, SendTemplateEmailInput, SendTextEmailInput, } from './email-service.js';
-export { DEFAULT_WEBHOOK_RETRIES, DEFAULT_WEBHOOK_SIGNATURE_HEADER, PIKKU_OUTGOING_WEBHOOK_QUEUE_NAME, WebhookService, type SendWebhookInput, type SendWebhookResult, type WebhookAttemptRecord, type WebhookAttemptResult, type WebhookDeliveryRecord, type WebhookDeliveryWithAttempts, type WebhookJobData, type WebhookServiceConfig, } from './webhook-service.js';
+export type { EmailService, SendEmailInput, SendEmailResult, SendHTMLEmailInput, SendTemplateEmailInput, SendTextEmailInput, } from './email-service.js';
+export { DEFAULT_WEBHOOK_RETRIES, PIKKU_OUTGOING_WEBHOOK_QUEUE_NAME, WebhookService, type SendWebhookInput, type SendWebhookResult, type WebhookAttemptResult, type WebhookDeliveryRecord, type WebhookDeliveryWithAttempts, type WebhookJobData, type WebhookServiceConfig, } from './webhook-service.js';
 export type { Logger } from './logger.js';
 export type { SecretService, SecretValues } from './secret-service.js';
 export type { VariablesService } from './variables-service.js';
@@ -31,23 +32,22 @@ export type { TriggerService } from './trigger-service.js';
 export type { GatewayService } from './gateway-service.js';
 export type { DeploymentService, DeploymentConfig, DeploymentInfo, DeploymentServiceConfig, } from './deployment-service.js';
 export type { AIStorageService } from './ai-storage-service.js';
-export type { AIAgentRunnerParams, AIAgentRunnerResult, AIAgentStepResult, AIEmbedManyParams, AIEmbedManyResult, AIEmbedParams, AIEmbedResult, AIGenerateImageParams, AIGenerateImagePrompt, AIGenerateImageResult, AIGenerateSpeechParams, AIGenerateSpeechResult, AIProviderOptions, AIRerankParams, AIRerankResult, AITranscriptionParams, AITranscriptionResult, AIAgentRunnerService, } from './ai-agent-runner-service.js';
+export type { AIAgentRunnerParams, AIAgentRunnerResult, AIAgentStepResult, AIAgentRunnerService, } from './ai-agent-runner-service.js';
 export type { AIEmbeddingService } from './ai-embedding-service.js';
-export type { CreateRunInput, AIRunStateService, } from './ai-run-state-service.js';
-export type { CredentialStatus, CredentialMeta, } from './typed-secret-service.js';
+export type { CreateRunInput, SaveScoreInput, AIRunStateService, } from './ai-run-state-service.js';
+export type { CredentialMeta, } from './typed-secret-service.js';
 export type { CredentialService } from './credential-service.js';
 export { TypedCredentialService } from './typed-credential-service.js';
-export type { CredentialStatusInfo, CredentialMetaInfo, } from './typed-credential-service.js';
-export type { VariableStatus, VariableMeta } from './typed-variables-service.js';
+export type { CredentialMetaInfo, } from './typed-credential-service.js';
+export type { VariableMeta } from './typed-variables-service.js';
 export type { MetaService } from './meta-service.js';
 export type { SessionStore } from './session-store.js';
 export type { ScopeService, Role } from './scope-service.js';
-export { assertRoleIsMutable, assertRoleNameAvailable, roleLockReason, } from './system-role-guard.js';
 export type { IsSystemRole } from './system-role-guard.js';
-export { NoopAuditService, createInvocationAudit, resolveAuditConfig, resolveAuditUserIdentityFromWire, } from './audit-service.js';
-export type { AuditConfig, AuditDurability, AuditEvent, AuditEventBatch, AuditLog, AuditLogWriteInput, AuditOutcome, AuditService, AuditSource, AuditUserIdentity, ResolvedAuditConfig, } from './audit-service.js';
+export { NoopAuditService, createInvocationAudit, } from './audit-service.js';
+export type { AuditConfig, AuditDurability, AuditEvent, AuditEventBatch, AuditLog, AuditService, AuditUserIdentity, ResolvedAuditConfig, } from './audit-service.js';
 export { InMemorySessionStore } from './in-memory-session-store.js';
-export type { MCPMeta, RPCMetaRecord, ServiceMeta, ServicesMetaRecord, MiddlewareDefinitionMeta, MiddlewareInstanceMeta, GroupMeta, MiddlewareGroupsMeta, PermissionDefinitionMeta, PermissionsGroupsMeta, FunctionsMeta, FunctionMeta, MiddlewareMeta, PermissionMeta, AgentsMeta, AgentMeta, EmailsMeta, EmailTemplateMeta, EmailTemplateLocaleMeta, EmailTemplateAssets, } from './meta-service.js';
-export type { CoverageService, CoverageSnapshot, LineHits, ScriptCoverage, FunctionCoverage, CoverageRange, CoverageStatus, FunctionCoverageEntry, FunctionCoverageReport, CoverageFunctionMeta, } from './v8-coverage-service.js';
+export type { MCPMeta, RPCMetaRecord, ServiceMeta, ServicesMetaRecord, MiddlewareDefinitionMeta, MiddlewareInstanceMeta, GroupMeta, MiddlewareGroupsMeta, PermissionDefinitionMeta, PermissionsGroupsMeta, FunctionsMeta, FunctionMeta, MiddlewareMeta, PermissionMeta, AgentsMeta, AgentMeta, EmailsMeta, EmailTemplateMeta, } from './meta-service.js';
+export type { CoverageService, ScriptCoverage, FunctionCoverageEntry, FunctionCoverageReport, CoverageFunctionMeta, } from './v8-coverage-service.js';
 export { StubTracker, createStubProxy, getStubTracker, isTestRun, stub, spy, type StubCall, } from './stub-tracker.js';
 export { SecretHostNotAllowedError, assertSecretAllowedForHost, } from './secret-host-binding.js';

package/dist/services/index.js

@@ -1,8 +1,9 @@
 export { LogLevel } from './logger.js';
 export { ScopedSecretService } from './scoped-secret-service.js';
-export { PikkuSessionService, createMiddlewareSessionWireProps, createFunctionSessionWireProps, } from './user-session-service.js';
+export { ScopedCredentialService } from './scoped-credential-service.js';
+export { PikkuSessionService, createMiddlewareSessionWireProps, } from './user-session-service.js';
 export { TypedSecretService } from './typed-secret-service.js';
-export { PikkuCredentialWireService, createMiddlewareCredentialWireProps, createWireServicesCredentialWireProps, } from './credential-wire-service.js';
+export { PikkuCredentialWireService, } from './credential-wire-service.js';
 export { TypedVariablesService } from './typed-variables-service.js';
 export { LocalSecretService } from './local-secrets.js';
 export { LocalEmailService } from './local-email-service.js';
@@ -15,10 +16,9 @@ export { InMemoryQueueService } from './in-memory-queue-service.js';
 export { InMemoryTriggerService } from './in-memory-trigger-service.js';
 export { InMemoryAIRunStateService } from './in-memory-ai-run-state-service.js';
 export { LocalGatewayService } from './local-gateway-service.js';
-export { DEFAULT_WEBHOOK_RETRIES, DEFAULT_WEBHOOK_SIGNATURE_HEADER, PIKKU_OUTGOING_WEBHOOK_QUEUE_NAME, WebhookService, } from './webhook-service.js';
+export { DEFAULT_WEBHOOK_RETRIES, PIKKU_OUTGOING_WEBHOOK_QUEUE_NAME, WebhookService, } from './webhook-service.js';
 export { TypedCredentialService } from './typed-credential-service.js';
-export { assertRoleIsMutable, assertRoleNameAvailable, roleLockReason, } from './system-role-guard.js';
-export { NoopAuditService, createInvocationAudit, resolveAuditConfig, resolveAuditUserIdentityFromWire, } from './audit-service.js';
+export { NoopAuditService, createInvocationAudit, } from './audit-service.js';
 export { InMemorySessionStore } from './in-memory-session-store.js';
 export { StubTracker, createStubProxy, getStubTracker, isTestRun, stub, spy, } from './stub-tracker.js';
 export { SecretHostNotAllowedError, assertSecretAllowedForHost, } from './secret-host-binding.js';

package/dist/services/local-content-request-handler.d.ts

@@ -26,4 +26,25 @@ export type LocalContentRequestHandlerOptions = {
      */
     getJWT: () => JWTService | undefined;
 };
+export type SignedContentVerification = {
+    ok: true;
+} | {
+    ok: false;
+    status: number;
+    body: string;
+};
+/**
+ * Verifies a signed content URL — the one function that decides whether a
+ * signed read or a signed upload is genuine.
+ *
+ * Exported and shared so the runtimes that serve content (the core handler here,
+ * the node server, the express adapter) verify identically. They used to each
+ * carry their own copy, which is how the express upload path ended up with no
+ * check at all: one copy can rot or be forgotten in isolation.
+ *
+ * `onMissingJWT` is called at most where the caller wants to log the
+ * misconfiguration once; a signed request with no verifier is treated as
+ * invalid, never as trusted.
+ */
+export declare const verifySignedContentRequest: (requestUrl: URL, jwt: JWTService | undefined, onMissingJWT?: () => void) => Promise<SignedContentVerification>;
 export declare const createLocalContentRequestHandler: ({ content, logger, getJWT, }: LocalContentRequestHandlerOptions) => LocalContentRequestHandler;

package/dist/services/local-content-request-handler.js

@@ -36,69 +36,88 @@ const text = (status, body) => new Response(body, {
     status,
     headers: { 'content-type': 'text/plain; charset=utf-8' },
 });
+/**
+ * Verifies a signed content URL — the one function that decides whether a
+ * signed read or a signed upload is genuine.
+ *
+ * Exported and shared so the runtimes that serve content (the core handler here,
+ * the node server, the express adapter) verify identically. They used to each
+ * carry their own copy, which is how the express upload path ended up with no
+ * check at all: one copy can rot or be forgotten in isolation.
+ *
+ * `onMissingJWT` is called at most where the caller wants to log the
+ * misconfiguration once; a signed request with no verifier is treated as
+ * invalid, never as trusted.
+ */
+export const verifySignedContentRequest = async (requestUrl, jwt, onMissingJWT) => {
+    const signedAtValue = requestUrl.searchParams.get('signedAt');
+    const expiresAtValue = requestUrl.searchParams.get('expiresAt');
+    const notBeforeValue = requestUrl.searchParams.get('notBefore');
+    const signature = requestUrl.searchParams.get('signature');
+    if (!signedAtValue || !expiresAtValue) {
+        return { ok: false, status: 403, body: 'Signed URL required' };
+    }
+    const signedAt = Number(signedAtValue);
+    const expiresAt = Number(expiresAtValue);
+    const notBefore = notBeforeValue == null ? undefined : Number(notBeforeValue);
+    if (!Number.isFinite(signedAt) ||
+        !Number.isFinite(expiresAt) ||
+        (notBefore != null && !Number.isFinite(notBefore))) {
+        return { ok: false, status: 403, body: 'Invalid signed URL' };
+    }
+    const now = Date.now();
+    if (now > expiresAt || (notBefore != null && now < notBefore)) {
+        return { ok: false, status: 403, body: 'Signed URL expired' };
+    }
+    if (!jwt) {
+        onMissingJWT?.();
+        return { ok: false, status: 403, body: 'Invalid signed URL' };
+    }
+    if (!signature) {
+        return { ok: false, status: 403, body: 'Signed URL signature required' };
+    }
+    try {
+        const payload = await jwt.decode(signature);
+        // Every claim is compared, the path included: without it a signature
+        // minted for one asset would read any other.
+        if (payload.signedAt !== signedAt ||
+            payload.expiresAt !== expiresAt ||
+            payload.notBefore !== notBefore ||
+            payload.path !== signedContentPath(requestUrl.pathname)) {
+            return { ok: false, status: 403, body: 'Invalid signed URL' };
+        }
+    }
+    catch {
+        return { ok: false, status: 403, body: 'Invalid signed URL' };
+    }
+    return { ok: true };
+};
 export const createLocalContentRequestHandler = ({ content, logger, getJWT, }) => {
     // Logged at most once. An unverifiable request is attacker-triggerable, so
     // this reports a startup misconfiguration rather than per-request news.
     let loggedMissingJWT = false;
-    const validateSignedAssetRequest = async (requestUrl) => {
-        const signedAtValue = requestUrl.searchParams.get('signedAt');
-        const expiresAtValue = requestUrl.searchParams.get('expiresAt');
-        const notBeforeValue = requestUrl.searchParams.get('notBefore');
-        const signature = requestUrl.searchParams.get('signature');
-        if (!signedAtValue || !expiresAtValue) {
-            return { ok: false, status: 403, body: 'Signed URL required' };
-        }
-        const signedAt = Number(signedAtValue);
-        const expiresAt = Number(expiresAtValue);
-        const notBefore = notBeforeValue == null ? undefined : Number(notBeforeValue);
-        if (!Number.isFinite(signedAt) ||
-            !Number.isFinite(expiresAt) ||
-            (notBefore != null && !Number.isFinite(notBefore))) {
-            return { ok: false, status: 403, body: 'Invalid signed URL' };
-        }
-        const now = Date.now();
-        if (now > expiresAt || (notBefore != null && now < notBefore)) {
-            return { ok: false, status: 403, body: 'Signed URL expired' };
-        }
-        const jwt = getJWT();
-        if (!jwt) {
-            if (!loggedMissingJWT) {
-                loggedMissingJWT = true;
-                logger.error('pikku: refusing signed asset reads — no JWTService is available to verify them. Pass `contentSigningJWT` (the same service LocalContent signs with) or expose it as `singletonServices.jwt`.');
-            }
-            return { ok: false, status: 403, body: 'Invalid signed URL' };
-        }
-        if (!signature) {
-            return { ok: false, status: 403, body: 'Signed URL signature required' };
-        }
-        try {
-            const payload = await jwt.decode(signature);
-            // Every claim is compared, the path included: without it a signature
-            // minted for one asset would read any other.
-            if (payload.signedAt !== signedAt ||
-                payload.expiresAt !== expiresAt ||
-                payload.notBefore !== notBefore ||
-                payload.path !== signedContentPath(requestUrl.pathname)) {
-                return { ok: false, status: 403, body: 'Invalid signed URL' };
-            }
-        }
-        catch {
-            return { ok: false, status: 403, body: 'Invalid signed URL' };
+    const validateSignedAssetRequest = (requestUrl) => verifySignedContentRequest(requestUrl, getJWT(), () => {
+        if (loggedMissingJWT)
+            return;
+        loggedMissingJWT = true;
+        logger.error('pikku: refusing signed asset reads — no JWTService is available to verify them. Pass `contentSigningJWT` (the same service LocalContent signs with) or expose it as `singletonServices.jwt`.');
+    });
+    const handleUpload = async (request, requestUrl, pathname) => {
+        // Uploads are presigned exactly like reads: getUploadURL mints a signed URL
+        // and this verifies it before writing. Without this an unauthenticated PUT
+        // could write arbitrary bytes to any key under the content root — the write
+        // side had none of the signature checking the read side has always had.
+        const signed = await validateSignedAssetRequest(requestUrl);
+        if (!signed.ok) {
+            return text(signed.status, signed.body);
         }
-        return { ok: true };
-    };
-    const handleUpload = async (request, pathname) => {
         const key = contentKey(pathname, content.uploadUrlPrefix);
         const targetPath = toTargetPath(content.localFileUploadPath, key);
         if (!targetPath) {
             return text(400, 'Invalid path');
         }
         const maxBytes = parseSizeLimit(content.sizeLimit ?? '1mb');
-        // Counted as it arrives and abandoned the moment it goes over, so an
-        // oversized upload costs the limit rather than its own size — `arrayBuffer()`
-        // would have to hold all of it first, which hands an unauthenticated caller
-        // a way to spend the server's memory. Mirrors node-http-server's
-        // `readRequestBody`, which aborts the same way.
+        // knowledge: decisions/security/an-upload-is-counted-as-it-arrives-not-buffered-then-measured.md
         const chunks = [];
         let bytesRead = 0;
         const reader = request.body?.getReader();
@@ -165,7 +184,7 @@ export const createLocalContentRequestHandler = ({ content, logger, getJWT, }) =
         const pathname = decodeURIComponent(requestUrl.pathname);
         if (request.method === 'PUT' &&
             matchesPrefix(pathname, content.uploadUrlPrefix)) {
-            return handleUpload(request, pathname);
+            return handleUpload(request, requestUrl, pathname);
         }
         if ((request.method === 'GET' || request.method === 'HEAD') &&
             matchesPrefix(pathname, content.assetUrlPrefix)) {

package/dist/services/local-content.d.ts

@@ -28,6 +28,12 @@ export declare class LocalContent implements ContentService {
     private signParams;
     signURL(args: SignURLArgs): Promise<string>;
     signContentKey(args: SignContentKeyArgs): Promise<string>;
+    /**
+     * Presigned upload, mirroring the read side: the URL carries a short-lived,
+     * path-bound signature that {@link createLocalContentRequestHandler} verifies
+     * before writing. An unsigned upload URL cannot be verified, and the handler
+     * now refuses one — so this must sign, or every upload 403s.
+     */
     getUploadURL(args: GetUploadURLArgs): Promise<UploadURLResult>;
     writeFile(args: WriteFileArgs): Promise<boolean>;
     copyFile(args: CopyFileArgs): Promise<boolean>;

package/dist/services/local-content.js

@@ -27,6 +27,8 @@ export const signedContentPath = (urlOrPath) => {
         return pathname;
     }
 };
+/** How long a presigned upload URL stays valid. Short, like an S3 PUT URL. */
+const UPLOAD_URL_TTL_MS = 15 * 60 * 1000;
 export class LocalContent {
     config;
     logger;
@@ -90,13 +92,24 @@ export class LocalContent {
             dateGreaterThan: args.dateGreaterThan,
         });
     }
+    /**
+     * Presigned upload, mirroring the read side: the URL carries a short-lived,
+     * path-bound signature that {@link createLocalContentRequestHandler} verifies
+     * before writing. An unsigned upload URL cannot be verified, and the handler
+     * now refuses one — so this must sign, or every upload 403s.
+     */
     async getUploadURL(args) {
         void args.visibility;
         const fullKey = this.joinKey(args.bucket, args.fileKey);
         this.logger.debug(`Going to upload with key: ${fullKey}`);
+        const uploadUrl = await this.signURL({
+            url: `${this.config.uploadUrlPrefix}/${fullKey}`,
+            dateLessThan: new Date(Date.now() + UPLOAD_URL_TTL_MS),
+        });
         return {
-            uploadUrl: `${this.config.uploadUrlPrefix}/${fullKey}`,
+            uploadUrl,
             assetKey: fullKey,
+            uploadMethod: 'PUT',
         };
     }
     async writeFile(args) {

package/dist/services/scoped-credential-service.d.ts

@@ -0,0 +1,21 @@
+import type { CredentialService } from './credential-service.js';
+/**
+ * A `CredentialService` narrowed to the credentials a package declared.
+ *
+ * Unlike `ScopedSecretService` this stays writable — an addon refreshing its
+ * own OAuth token is the normal case. What it cannot do is reach a credential
+ * it never declared, or enumerate the app's users.
+ */
+export declare class ScopedCredentialService implements CredentialService {
+    private credentials;
+    private allowedNames;
+    constructor(credentials: CredentialService, allowedNames: Set<string>);
+    private assertAllowed;
+    get<T = unknown>(name: string, userId?: string): Promise<T | null>;
+    set(name: string, value: unknown, userId?: string): Promise<void>;
+    delete(name: string, userId?: string): Promise<void>;
+    has(name: string, userId?: string): Promise<boolean>;
+    getAll(userId: string): Promise<Record<string, unknown>>;
+    getUsersWithCredential(name: string): Promise<string[]>;
+    getAllUsers(): Promise<string[]>;
+}

package/dist/services/scoped-credential-service.js

@@ -0,0 +1,53 @@
+/**
+ * A `CredentialService` narrowed to the credentials a package declared.
+ *
+ * Unlike `ScopedSecretService` this stays writable — an addon refreshing its
+ * own OAuth token is the normal case. What it cannot do is reach a credential
+ * it never declared, or enumerate the app's users.
+ */
+export class ScopedCredentialService {
+    credentials;
+    allowedNames;
+    constructor(credentials, allowedNames) {
+        this.credentials = credentials;
+        this.allowedNames = allowedNames;
+    }
+    assertAllowed(name) {
+        if (!this.allowedNames.has(name)) {
+            throw new Error(`Access denied to credential: ${name}`);
+        }
+    }
+    async get(name, userId) {
+        this.assertAllowed(name);
+        return this.credentials.get(name, userId);
+    }
+    async set(name, value, userId) {
+        this.assertAllowed(name);
+        return this.credentials.set(name, value, userId);
+    }
+    async delete(name, userId) {
+        this.assertAllowed(name);
+        return this.credentials.delete(name, userId);
+    }
+    async has(name, userId) {
+        this.assertAllowed(name);
+        return this.credentials.has(name, userId);
+    }
+    async getAll(userId) {
+        const all = await this.credentials.getAll(userId);
+        const scoped = {};
+        for (const name of this.allowedNames) {
+            if (name in all) {
+                scoped[name] = all[name];
+            }
+        }
+        return scoped;
+    }
+    async getUsersWithCredential(name) {
+        this.assertAllowed(name);
+        return this.credentials.getUsersWithCredential(name);
+    }
+    async getAllUsers() {
+        throw new Error('Access denied: enumerating users is not allowed in a scoped credential service');
+    }
+}

package/dist/services/workflow-service.d.ts

@@ -1,4 +1,4 @@
-import type { SerializedError } from '../types/core.types.js';
+import type { CoreUserSession, SerializedError } from '../types/core.types.js';
 import type { WorkflowRun, WorkflowPlannedStep, WorkflowRunWire, WorkflowRunStatus, StepState, WorkflowStatus, WorkflowVersionStatus } from '../wirings/workflow/workflow.types.js';
 import type { RunTimeline, ReconstructedRunState } from '../wirings/workflow/run-timeline.js';
 export interface WorkflowService {
@@ -21,8 +21,10 @@ export interface WorkflowService {
     /**
      * The payload is stored as given and validated on replay inside the workflow
      * body, so an invalid one re-closes the gate rather than failing the run.
+     *
+     * The session must belong to the run's owner — see `assertWorkflowRunOwner`.
      */
-    approveStep(runId: string, reason: string, decision: unknown): Promise<void>;
+    approveStep(runId: string, reason: string, decision: unknown, session?: CoreUserSession): Promise<void>;
     startWorkflow<I>(name: string, input: I, wire: WorkflowRunWire, rpcService: any, options?: {
         inline?: boolean;
         startNode?: string;

package/dist/testing/service-tests/agent-run-service-tests.d.ts

@@ -0,0 +1,10 @@
+import type { ServiceTestConfig } from '../service-tests.js';
+/** Conformance suite for `agentRunService`. Runs only when a backend supplies one. */
+export declare const defineAgentRunServiceTests: (name: string, agentRunService: NonNullable<ServiceTestConfig["services"]["agentRunService"]>, 
+/**
+ * Thread-ownership is a property of the two services together — the run
+ * service lists what the storage service owns — so that half of the suite
+ * only runs when a backend supplies both. Passed explicitly rather than
+ * closed over, so the dependency is visible in the signature.
+ */
+aiStorageService?: ServiceTestConfig["services"]["aiStorageService"]) => void;

package/dist/testing/service-tests/agent-run-service-tests.js

@@ -0,0 +1,72 @@
+import { describe, test, before } from 'node:test';
+import assert from 'node:assert/strict';
+/** Conformance suite for `agentRunService`. Runs only when a backend supplies one. */
+export const defineAgentRunServiceTests = (name, agentRunService, 
+/**
+ * Thread-ownership is a property of the two services together — the run
+ * service lists what the storage service owns — so that half of the suite
+ * only runs when a backend supplies both. Passed explicitly rather than
+ * closed over, so the dependency is visible in the signature.
+ */
+aiStorageService) => {
+    const factory = agentRunService;
+    describe(`AgentRunService [${name}]`, () => {
+        let agentService;
+        before(async () => {
+            agentService = await factory();
+        });
+        test('listThreads', async () => {
+            const threads = await agentService.listThreads();
+            assert.ok(Array.isArray(threads));
+        });
+        if (aiStorageService) {
+            const storageFactory = aiStorageService;
+            // The `owners` constraint is what keeps the generated thread-management
+            // functions from leaking across tenants: a caller may only list threads
+            // owned by one of their session principals, matching the
+            // `principal:sub-partition` composition resolveOwnerResourceId writes.
+            test('listThreads scopes to the given owners, including sub-partitions', async () => {
+                const storage = await storageFactory();
+                await storage.createThread('owner-alice');
+                await storage.createThread('owner-alice:project-1');
+                await storage.createThread('owner-bob:secret');
+                const threads = await agentService.listThreads({
+                    owners: ['owner-alice'],
+                });
+                const ids = threads.map((t) => t.resourceId);
+                assert.ok(ids.includes('owner-alice'));
+                assert.ok(ids.includes('owner-alice:project-1'));
+                assert.ok(!ids.some((id) => id.startsWith('owner-bob')), "another owner's threads must not be listed");
+            });
+            test('listThreads with an owner does not match a lookalike prefix', async () => {
+                const storage = await storageFactory();
+                await storage.createThread('owner-al');
+                await storage.createThread('owner-alice-evil:p');
+                const threads = await agentService.listThreads({
+                    owners: ['owner-al'],
+                });
+                const ids = threads.map((t) => t.resourceId);
+                assert.ok(ids.includes('owner-al'));
+                assert.ok(!ids.includes('owner-alice-evil:p'));
+            });
+            test('listThreads with an empty owners list returns nothing', async () => {
+                const storage = await storageFactory();
+                await storage.createThread('owner-empty-check');
+                const threads = await agentService.listThreads({ owners: [] });
+                assert.deepEqual(threads, []);
+            });
+        }
+        test('getThread returns null for missing', async () => {
+            const thread = await agentService.getThread('missing-thread');
+            assert.equal(thread, null);
+        });
+        test('getDistinctAgentNames', async () => {
+            const names = await agentService.getDistinctAgentNames();
+            assert.ok(Array.isArray(names));
+        });
+        test('deleteThread returns false for missing', async () => {
+            const result = await agentService.deleteThread('missing-thread');
+            assert.equal(result, false);
+        });
+    });
+};

package/dist/testing/service-tests/ai-storage-service-tests.d.ts

@@ -0,0 +1,3 @@
+import type { ServiceTestConfig } from '../service-tests.js';
+/** Conformance suite for `aiStorageService`. Runs only when a backend supplies one. */
+export declare const defineAiStorageServiceTests: (name: string, aiStorageService: NonNullable<ServiceTestConfig["services"]["aiStorageService"]>) => void;