@pikku/core 0.12.83 → 0.12.86

package/dist/wirings/addon/wire-addon.d.ts

@@ -0,0 +1,80 @@
+import type { CorePikkuMiddleware } from '../../middleware/middleware.types.js';
+export type WireAddonConfig = {
+    name: string;
+    package: string;
+    rpcEndpoint?: string;
+    auth?: boolean;
+    mcp?: boolean;
+    tags?: string[];
+    /** Required of every function in the addon, on top of the function's own. */
+    scopes?: string[];
+    secretOverrides?: Record<string, string>;
+    variableOverrides?: Record<string, string>;
+    credentialOverrides?: Record<string, string>;
+    /**
+     * Secrets this instance may read on top of the ones it declared, named as the
+     * addon reads them — the scope check runs before `secretOverrides` renames
+     * them, so an overridden secret is named here by its addon-side key. Listing
+     * one in `secretOverrides` grants it too.
+     *
+     * For an addon whose secret names come off its input rather than its own
+     * source, this is how the host lends names the addon could not declare.
+     */
+    secretGrants?: string[];
+    /** Credentials this instance may read on top of the ones it declared. */
+    credentialGrants?: string[];
+    /**
+     * Hands this instance the whole `SecretService` instead of one scoped to the
+     * secrets it declared. The value is the reason, recorded in the deploy
+     * manifest — an addon that names secrets at runtime cannot be scoped, and
+     * only the consuming app, never the addon, can grant it.
+     */
+    globalSecrets?: string;
+    /**
+     * Hands this instance the whole `CredentialService` instead of one narrowed
+     * to the credentials it declared. The value is the reason, recorded in the
+     * deploy manifest, and only the consuming app can grant it.
+     */
+    globalCredentials?: string;
+};
+export declare const wireAddon: (config: WireAddonConfig) => void;
+/**
+ * knowledge: decisions/security/addon-scopes-are-resolved-where-the-function-runs.md
+ */
+export declare const resolveAddonScopes: (packageName: string | null, namespace?: string) => string[];
+/**
+ * knowledge: decisions/security/addon-auth-and-tags-only-tighten.md
+ */
+export declare const resolveAddonTags: (packageName: string | null, namespace?: string) => string[];
+/**
+ * True when any governing instance requires a session. `auth: false` is not
+ * honoured here — on a direct wiring it would weaken the wiring's own gate.
+ *
+ * knowledge: decisions/security/addon-auth-and-tags-only-tighten.md
+ */
+export declare const resolveAddonAuth: (packageName: string | null, namespace?: string) => boolean;
+/**
+ * The package a namespaced function id belongs to, and the name that package
+ * publishes it under.
+ *
+ * A wiring that points at an addon function through `ref('ns:fn')` records
+ * `ns:fn` as its own function id — the same id every other wire type records —
+ * but the addon publishes its metadata under the bare `fn`, in its own package
+ * state. Without this the wire finds the function it registered and no metadata
+ * to run it by.
+ *
+ * The wiring itself stays the consuming app's, so `packageName` is the package
+ * the *wire* runs in, not the target's: it is null for a `ref()` the app wired,
+ * and only narrows the lookup when a wire really does run inside the addon.
+ */
+export declare const resolveAddonFunctionTarget: (funcName: string, packageName: string | null) => {
+    packageName: string;
+    localName: string;
+} | null;
+/**
+ * Addon tags name middleware the *consuming app* registered, so they resolve
+ * against the root tag groups rather than the addon package's own.
+ *
+ * knowledge: decisions/security/addon-auth-and-tags-only-tighten.md
+ */
+export declare const resolveAddonTagMiddleware: (packageName: string | null, namespace?: string) => CorePikkuMiddleware[];

package/dist/wirings/addon/wire-addon.js

@@ -0,0 +1,120 @@
+import { pikkuState } from '../../pikku-state.js';
+import { getTagGroups } from '../../utils.js';
+export const wireAddon = (config) => {
+    pikkuState(null, 'addons', 'packages').set(config.name, {
+        package: config.package,
+        rpcEndpoint: config.rpcEndpoint,
+        auth: config.auth,
+        tags: config.tags,
+        ...(config.scopes ? { scopes: config.scopes } : {}),
+        ...(config.secretOverrides
+            ? { secretOverrides: config.secretOverrides }
+            : {}),
+        ...(config.variableOverrides
+            ? { variableOverrides: config.variableOverrides }
+            : {}),
+        ...(config.credentialOverrides
+            ? { credentialOverrides: config.credentialOverrides }
+            : {}),
+        ...(config.secretGrants ? { secretGrants: config.secretGrants } : {}),
+        ...(config.credentialGrants
+            ? { credentialGrants: config.credentialGrants }
+            : {}),
+        ...(config.globalSecrets ? { globalSecrets: config.globalSecrets } : {}),
+        ...(config.globalCredentials
+            ? { globalCredentials: config.globalCredentials }
+            : {}),
+    });
+};
+/**
+ * The addon configs a running function is governed by: the named instance when
+ * the caller resolved one, every instance of the package otherwise.
+ *
+ * knowledge: decisions/security/addon-scopes-are-resolved-where-the-function-runs.md
+ */
+const governingAddonConfigs = (packageName, namespace) => {
+    if (!packageName) {
+        return [];
+    }
+    const addons = pikkuState(null, 'addons', 'packages');
+    if (!addons) {
+        return [];
+    }
+    if (namespace) {
+        const config = addons.get(namespace);
+        if (config?.package === packageName) {
+            return [config];
+        }
+    }
+    return [...addons.values()].filter((config) => config?.package === packageName);
+};
+const unionOf = (packageName, namespace, field) => {
+    const values = new Set();
+    for (const config of governingAddonConfigs(packageName, namespace)) {
+        for (const value of config[field] ?? []) {
+            values.add(value);
+        }
+    }
+    return [...values];
+};
+/**
+ * knowledge: decisions/security/addon-scopes-are-resolved-where-the-function-runs.md
+ */
+export const resolveAddonScopes = (packageName, namespace) => unionOf(packageName, namespace, 'scopes');
+/**
+ * knowledge: decisions/security/addon-auth-and-tags-only-tighten.md
+ */
+export const resolveAddonTags = (packageName, namespace) => unionOf(packageName, namespace, 'tags');
+/**
+ * True when any governing instance requires a session. `auth: false` is not
+ * honoured here — on a direct wiring it would weaken the wiring's own gate.
+ *
+ * knowledge: decisions/security/addon-auth-and-tags-only-tighten.md
+ */
+export const resolveAddonAuth = (packageName, namespace) => governingAddonConfigs(packageName, namespace).some((config) => config.auth === true);
+/**
+ * The package a namespaced function id belongs to, and the name that package
+ * publishes it under.
+ *
+ * A wiring that points at an addon function through `ref('ns:fn')` records
+ * `ns:fn` as its own function id — the same id every other wire type records —
+ * but the addon publishes its metadata under the bare `fn`, in its own package
+ * state. Without this the wire finds the function it registered and no metadata
+ * to run it by.
+ *
+ * The wiring itself stays the consuming app's, so `packageName` is the package
+ * the *wire* runs in, not the target's: it is null for a `ref()` the app wired,
+ * and only narrows the lookup when a wire really does run inside the addon.
+ */
+export const resolveAddonFunctionTarget = (funcName, packageName) => {
+    const separator = funcName.indexOf(':');
+    if (separator === -1) {
+        return null;
+    }
+    const namespace = funcName.slice(0, separator);
+    const config = pikkuState(null, 'addons', 'packages').get(namespace);
+    if (!config) {
+        return null;
+    }
+    if (packageName && config.package !== packageName) {
+        return null;
+    }
+    return {
+        packageName: config.package,
+        localName: funcName.slice(separator + 1),
+    };
+};
+/**
+ * Addon tags name middleware the *consuming app* registered, so they resolve
+ * against the root tag groups rather than the addon package's own.
+ *
+ * knowledge: decisions/security/addon-auth-and-tags-only-tighten.md
+ */
+export const resolveAddonTagMiddleware = (packageName, namespace) => {
+    const tags = resolveAddonTags(packageName, namespace);
+    if (tags.length === 0) {
+        return [];
+    }
+    const tagGroups = pikkuState(null, 'middleware', 'tagGroup');
+    return tags.flatMap((tag) => getTagGroups(tagGroups, tag).flat());
+};

package/dist/wirings/addon/wire-remote-addon.d.ts

@@ -0,0 +1,22 @@
+import type { CoreServices, PikkuWire } from '../../types/core.types.js';
+/** Sent as `Authorization: Bearer <token>`; a non-default header is declared by the addon. */
+export type RemoteAddonAuth = {
+    credentialId: string;
+} | {
+    secretId: string;
+} | {
+    resolve: (services: CoreServices, wire: PikkuWire) => string | Promise<string>;
+};
+export type WireRemoteAddonConfig = {
+    /** Consumer-facing namespace, e.g. `registry` → `rpc('registry:getOpenApi')` */
+    name: string;
+    /** Must be installed as a devDependency — `pikku verify` enforces this. */
+    package: string;
+    serverUrl: string | ((services: CoreServices) => string | Promise<string>);
+    /** Omit when the addon declares its remote surface public. */
+    auth?: RemoteAddonAuth;
+    /** Map a consumer-facing fn name → the remote fn name, when they differ (rare). */
+    remoteName?: (fn: string) => string;
+    tags?: string[];
+};
+export declare const wireRemoteAddon: (config: WireRemoteAddonConfig) => void;

package/dist/wirings/addon/wire-remote-addon.js

@@ -0,0 +1,11 @@
+import { pikkuState } from '../../pikku-state.js';
+export const wireRemoteAddon = (config) => {
+    pikkuState(null, 'addons', 'packages').set(config.name, {
+        package: config.package,
+        tags: config.tags,
+        remote: true,
+        serverUrl: config.serverUrl,
+        ...(config.auth ? { remoteAuth: config.auth } : {}),
+        ...(config.remoteName ? { remoteName: config.remoteName } : {}),
+    });
+};

package/dist/wirings/{ai-agent/ai-agent-agui.d.ts → agent/agent-agui.d.ts}

@@ -1,4 +1,4 @@
-import type { AIStreamChannel } from './ai-agent.types.js';
+import type { AgentStreamChannel } from './agent.types.js';
 type AGUIEvent = {
     type: 'TEXT_MESSAGE_START';
     messageId: string;
@@ -76,4 +76,4 @@ export type AGUIChannelOptions = {
     runId?: string;
     getRunId?: () => string | undefined;
 };
-export declare function wrapChannelWithAGUI(inner: AIStreamChannel, options?: AGUIChannelOptions): AIStreamChannel;
+export declare function wrapChannelWithAGUI(inner: AgentStreamChannel, options?: AGUIChannelOptions): AgentStreamChannel;

package/dist/wirings/{ai-agent/ai-agent-agui.js → agent/agent-agui.js}

@@ -1,4 +1,4 @@
-import { randomUUID } from './ai-agent-utils.js';
+import { randomUUID } from './agent-utils.js';
 function resultToString(result) {
     if (typeof result === 'string')
         return result;

package/dist/wirings/{ai-agent/ai-agent-finalize.d.ts → agent/agent-finalize.d.ts}

@@ -1,5 +1,5 @@
-import type { AIAgentStep, AIMessage, PikkuAIMiddlewareHooks } from './ai-agent.types.js';
-import type { AIRunStateService } from '../../services/ai-run-state-service.js';
+import type { AgentStep, AgentMessage, PikkuAgentMiddlewareHooks } from './agent.types.js';
+import type { AgentRunStateService } from '../../services/agent-run-state-service.js';
 export type RunUsage = {
     inputTokens: number;
     outputTokens: number;
@@ -19,32 +19,32 @@ export type FinalizedRun = {
     /** The prompt the run answered — what a scorer grades the answer against. */
     input: string;
     text: string;
-    steps: AIAgentStep[];
+    steps: AgentStep[];
     usage: RunUsage;
 };
 /**
  * The prompt a run answered: the most recent user turn, which is what the model
  * was last asked. On a resumed run the earlier turns are context, not the ask.
  */
-export declare const lastUserMessageText: (messages: AIMessage[]) => string;
+export declare const lastUserMessageText: (messages: AgentMessage[]) => string;
 /**
  * Run the `modifyOutput` chain over a finished non-streaming run.
  *
  * Reverse order, matching the input chain: the middleware registered first
  * wraps the others, so it sees the output last.
  */
-export declare const applyOutputMiddleware: (aiMiddlewares: PikkuAIMiddlewareHooks[], singletonServices: any, input: {
+export declare const applyOutputMiddleware: (agentMiddlewares: PikkuAgentMiddlewareHooks[], singletonServices: any, input: {
     text: string;
-    messages: AIMessage[];
-    steps: AIAgentStep[];
+    messages: AgentMessage[];
+    steps: AgentStep[];
     usage: {
         inputTokens: number;
         outputTokens: number;
     };
 }) => Promise<{
     text: string;
-    messages: AIMessage[];
-    steps: AIAgentStep[];
+    messages: AgentMessage[];
+    steps: AgentStep[];
 }>;
 /**
  * The one place a run ends successfully.
@@ -55,4 +55,4 @@ export declare const applyOutputMiddleware: (aiMiddlewares: PikkuAIMiddlewareHoo
  * may rewrite the run: by this point the output middleware has resolved and, on
  * the streaming path, the client already has the reply.
  */
-export declare const finalizeAgentRun: (aiRunState: AIRunStateService, run: FinalizedRun) => Promise<void>;
+export declare const finalizeAgentRun: (agentRunState: AgentRunStateService, run: FinalizedRun) => Promise<void>;

package/dist/wirings/{ai-agent/ai-agent-finalize.js → agent/agent-finalize.js}

@@ -1,6 +1,6 @@
 import { pikkuState } from '../../pikku-state.js';
-import { scoreFinishedRun } from '../ai-scorer/ai-scorer-live.js';
-import { recordScoreSnapshot } from '../ai-scorer/ai-scorer-snapshots.js';
+import { scoreFinishedRun } from '../agent-scorer/agent-scorer-live.js';
+import { recordScoreSnapshot } from '../agent-scorer/agent-scorer-snapshots.js';
 /**
  * The prompt a run answered: the most recent user turn, which is what the model
  * was last asked. On a resumed run the earlier turns are context, not the ask.
@@ -50,13 +50,13 @@ const distributeToolCalls = (steps, toolCalls) => {
  * Reverse order, matching the input chain: the middleware registered first
  * wraps the others, so it sees the output last.
  */
-export const applyOutputMiddleware = async (aiMiddlewares, singletonServices, input) => {
+export const applyOutputMiddleware = async (agentMiddlewares, singletonServices, input) => {
     let text = input.text;
     let messages = input.messages;
     let steps = input.steps;
     let toolCalls = flattenToolCalls(steps);
-    for (let i = aiMiddlewares.length - 1; i >= 0; i--) {
-        const mw = aiMiddlewares[i];
+    for (let i = agentMiddlewares.length - 1; i >= 0; i--) {
+        const mw = agentMiddlewares[i];
         if (!mw.modifyOutput)
             continue;
         const result = await mw.modifyOutput(singletonServices, {
@@ -86,8 +86,8 @@ export const applyOutputMiddleware = async (aiMiddlewares, singletonServices, in
  * may rewrite the run: by this point the output middleware has resolved and, on
  * the streaming path, the client already has the reply.
  */
-export const finalizeAgentRun = async (aiRunState, run) => {
-    await aiRunState.updateRun(run.runId, {
+export const finalizeAgentRun = async (agentRunState, run) => {
+    await agentRunState.updateRun(run.runId, {
         status: 'completed',
         ...(run.usage.model
             ? {

package/dist/wirings/{ai-agent/ai-agent-helpers.d.ts → agent/agent-helpers.d.ts}

@@ -1,4 +1,4 @@
-import type { AgentInterruptResult } from './ai-agent-interrupt.js';
+import type { AgentInterruptResult } from './agent-interrupt.js';
 export declare function agent<TAgentMap extends Record<string, {
     output: any;
 }>>(agentName: string & keyof TAgentMap): {

package/dist/wirings/{ai-agent/ai-agent-interrupt.d.ts → agent/agent-interrupt.d.ts}

@@ -1,11 +1,11 @@
-import type { AIStorageService } from '../../services/ai-storage-service.js';
+import type { AgentStorageService } from '../../services/agent-storage-service.js';
 /**
  * Why an in-flight agent run was cut short.
  *
  * Deliberately carries no interjection text. A voice interruption is not a
  * cancel button — it is the user starting to talk — but what they said arrives
  * a second later as an ordinary next turn on the same thread, and that turn
- * already has a working path through `streamAIAgent`. The model then sees its
+ * already has a working path through `streamAgent`. The model then sees its
  * own truncated message (marked `interrupted`) followed by the interjection and
  * decides for itself whether to resume, correct itself or drop the thread.
  * Nothing here classifies the interjection; a second delivery path for the same
@@ -95,7 +95,7 @@ export declare const registerInterruptibleRun: (runId: string) => InterruptibleR
  * Stop a run that is generating right now.
  *
  * Plumbing: this performs NO authorization, so anyone holding a runId can stop
- * it. Reach for {@link interruptAIAgent} instead unless the caller has already
+ * it. Reach for {@link interruptAgent} instead unless the caller has already
  * established that the run belongs to the session — which in practice means
  * only the runner itself and code already inside an authorized run.
  *
@@ -143,7 +143,7 @@ export declare const awaitPendingInterruptNote: (threadId: string) => Promise<vo
  * it: an interrupt has to end the reply immediately, and a slow tool must not
  * hold that up.
  */
-export declare const persistOrphanedToolResults: (handle: InterruptibleRunHandle, storage: AIStorageService, threadId: string) => Promise<void>;
+export declare const persistOrphanedToolResults: (handle: InterruptibleRunHandle, storage: AgentStorageService, threadId: string) => Promise<void>;
 /**
  * Whether a thrown value is an abort rather than a failure. The AI SDK
  * surfaces cancellation as a DOMException/Error named `AbortError`, so the

package/dist/wirings/{ai-agent/ai-agent-interrupt.js → agent/agent-interrupt.js}

@@ -1,4 +1,4 @@
-import { randomUUID } from './ai-agent-utils.js';
+import { randomUUID } from './agent-utils.js';
 import { AbandonedError, runInAbortScope, } from '../../function/abort-scope.js';
 /**
  * Thrown out of the step loop when a run is interrupted, so an interruption is
@@ -110,7 +110,7 @@ export const registerInterruptibleRun = (runId) => {
  * Stop a run that is generating right now.
  *
  * Plumbing: this performs NO authorization, so anyone holding a runId can stop
- * it. Reach for {@link interruptAIAgent} instead unless the caller has already
+ * it. Reach for {@link interruptAgent} instead unless the caller has already
  * established that the run belongs to the session — which in practice means
  * only the runner itself and code already inside an authorized run.
  *

package/dist/wirings/{ai-agent/ai-agent-memory.d.ts → agent/agent-memory.d.ts}

@@ -1,22 +1,22 @@
 import type { CoreSingletonServices } from '../../types/core.types.js';
-import type { CoreAIAgent, AIAgentMemoryConfig, AIAgentInput, AIAgentStep, AIMessage } from './ai-agent.types.js';
-import type { AIStorageService } from '../../services/ai-storage-service.js';
+import type { CoreAgent, AgentMemoryConfig, AgentInput, AgentStep, AgentMessage } from './agent.types.js';
+import type { AgentStorageService } from '../../services/agent-storage-service.js';
 import type { Logger } from '../../services/logger.js';
 import type { SchemaService } from '../../services/schema-service.js';
-import type { PikkuAIMiddlewareHooks } from './ai-agent.types.js';
-export declare function resolveMemoryServices(agent: CoreAIAgent, singletonServices: CoreSingletonServices): {
-    storage: AIStorageService | undefined;
+import type { PikkuAgentMiddlewareHooks } from './agent.types.js';
+export declare function resolveMemoryServices(agent: CoreAgent, singletonServices: CoreSingletonServices): {
+    storage: AgentStorageService | undefined;
 };
-export declare function isWorkingMemoryEnabled(memoryConfig: AIAgentMemoryConfig | undefined, storage: AIStorageService | undefined): boolean;
+export declare function isWorkingMemoryEnabled(memoryConfig: AgentMemoryConfig | undefined, storage: AgentStorageService | undefined): boolean;
 export declare function deepMergeWorkingMemory(existing: Record<string, unknown>, updates: Record<string, unknown>): Record<string, unknown>;
 export declare function buildWorkingMemoryPrompt(currentState: Record<string, unknown> | null, jsonSchema?: Record<string, unknown>): string;
-export declare function loadContextMessages(memoryConfig: AIAgentMemoryConfig | undefined, storage: AIStorageService | undefined, input: AIAgentInput, workingMemoryJsonSchema?: Record<string, unknown>): Promise<AIMessage[]>;
-export declare function saveMessages(storage: AIStorageService | undefined, threadId: string, resourceId: string, memoryConfig: AIAgentMemoryConfig | undefined, userMessage: AIMessage | null | undefined, result: {
+export declare function loadContextMessages(memoryConfig: AgentMemoryConfig | undefined, storage: AgentStorageService | undefined, input: AgentInput, workingMemoryJsonSchema?: Record<string, unknown>): Promise<AgentMessage[]>;
+export declare function saveMessages(storage: AgentStorageService | undefined, threadId: string, resourceId: string, memoryConfig: AgentMemoryConfig | undefined, userMessage: AgentMessage | null | undefined, result: {
     text: string;
     uiSpec?: unknown;
-    steps: Pick<AIAgentStep, 'toolCalls'>[];
+    steps: Pick<AgentStep, 'toolCalls'>[];
 }): Promise<string>;
-export declare function trimMessages(messages: AIMessage[], maxTokenBudget?: number): AIMessage[];
+export declare function trimMessages(messages: AgentMessage[], maxTokenBudget?: number): AgentMessage[];
 export declare function parseWorkingMemory(text: string): Record<string, unknown> | null;
 export declare function stripWorkingMemoryTags(text: string): string;
 export declare function extractWorkingMemory(text: string): {
@@ -25,18 +25,18 @@ export declare function extractWorkingMemory(text: string): {
 };
 export declare function stripWorkingMemoryForStreaming(text: string): string;
 export declare function createWorkingMemoryMiddleware(options: {
-    storage?: AIStorageService;
+    storage?: AgentStorageService;
     threadId: string;
     workingMemorySchemaName?: string | null;
     logger?: Logger;
     schemaService?: SchemaService;
-}): PikkuAIMiddlewareHooks<{
+}): PikkuAgentMiddlewareHooks<{
     rawText?: string;
     emittedVisibleText?: string;
 }>;
-export declare function getWorkingMemoryMiddleware(memoryConfig: AIAgentMemoryConfig | undefined, storage: AIStorageService | undefined, options: {
+export declare function getWorkingMemoryMiddleware(memoryConfig: AgentMemoryConfig | undefined, storage: AgentStorageService | undefined, options: {
     threadId: string;
     workingMemorySchemaName?: string | null;
     logger?: Logger;
     schemaService?: SchemaService;
-}): PikkuAIMiddlewareHooks[];
+}): PikkuAgentMiddlewareHooks[];

package/dist/wirings/{ai-agent/ai-agent-memory.js → agent/agent-memory.js}

@@ -5,7 +5,7 @@ export function resolveMemoryServices(agent, singletonServices) {
         ? // The service is named by string in agent config, so the lookup cannot be
             // checked — only the shape it is required to have.
             singletonServices[memoryConfig.storage]
-        : singletonServices.aiStorage;
+        : singletonServices.agentStorage;
     return { storage };
 }
 export function isWorkingMemoryEnabled(memoryConfig, storage) {

package/dist/wirings/{ai-agent/ai-agent-model-config.js → agent/agent-model-config.js}

@@ -1,4 +1,4 @@
-// knowledge: decisions/internals/ai-agent-model-config-stays-a-single-resolution-seam.md
+// knowledge: decisions/internals/agent-model-config-stays-a-single-resolution-seam.md
 import { pikkuState } from '../../pikku-state.js';
 const isProviderQualified = (model) => model.includes('/');
 /** `PIKKU_MODEL_ALIASES=cheap:openai/gpt-5-mini,tool:anthropic/claude-sonnet-5` */

package/dist/wirings/{ai-agent/ai-agent-prepare.d.ts → agent/agent-prepare.d.ts}

@@ -1,18 +1,18 @@
-import type { CoreUserSession } from '../../types/core.types.js';
-import type { CoreAIAgent, AIAgentInput, AIAgentToolDef, AIMessage, AIStreamChannel, PikkuAIMiddlewareHooks, SessionScope } from './ai-agent.types.js';
-import type { AIAgentRunnerParams } from '../../services/ai-agent-runner-service.js';
+import type { CoreUserSession, GetCredential } from '../../types/core.types.js';
+import type { CoreAgent, AgentInput, AgentToolDef, AgentMessage, AgentStreamChannel, PikkuAgentMiddlewareHooks, SessionScope } from './agent.types.js';
+import type { AgentRunnerParams } from '../../services/agent-runner-service.js';
 import { PikkuError } from '../../errors/error-handler.js';
 import type { SessionService } from '../../services/user-session-service.js';
-export type RunAIAgentParams = {
+export type RunAgentParams = {
     sessionService?: SessionService<CoreUserSession>;
     /** Credential accessor for the current request — used to read per-user overrides (e.g. AI_API_KEY). */
-    getCredential?: <T = unknown>(name: string) => T | null | Promise<T | null>;
+    getCredential?: GetCredential;
     /** Ephemeral owner identity minted for a sessionless request; never client-supplied, never reused across requests. */
     anonymousOwnerResourceId?: string;
 };
-export declare function resolveSessionPrincipal(params: RunAIAgentParams, sessionScope: SessionScope | undefined): string | undefined;
-export declare function resolveOwnerResourceId(params: RunAIAgentParams, sessionScope: SessionScope | undefined, requestedResourceId: string): string;
-export declare function assertResourcePrincipalOwner(params: RunAIAgentParams, sessionScope: SessionScope | undefined, storedResourceId: string, kind: 'thread' | 'run'): void;
+export declare function resolveSessionPrincipal(params: RunAgentParams, sessionScope: SessionScope | undefined): string | undefined;
+export declare function resolveOwnerResourceId(params: RunAgentParams, sessionScope: SessionScope | undefined, requestedResourceId: string): string;
+export declare function assertResourcePrincipalOwner(params: RunAgentParams, sessionScope: SessionScope | undefined, storedResourceId: string, kind: 'thread' | 'run'): void;
 export declare function agentSessionScope(agentName: string): SessionScope;
 export declare function assertResourceOwner(ownerResourceId: string, storedResourceId: string, kind: 'thread' | 'run'): void;
 export declare function sessionPrincipals(session: {
@@ -28,7 +28,7 @@ export declare function canAccessThread(storedResourceId: string, session: {
     userId?: string;
     orgId?: string;
 } | undefined): boolean;
-export type StreamAIAgentOptions = {
+export type StreamAgentOptions = {
     requiresToolApproval?: 'all' | 'explicit' | false;
     onRunCreated?: (runId: string) => void;
 };
@@ -67,20 +67,20 @@ export interface AddonCredentialRequirement {
 }
 export declare function getAddonCredentialRequirements(toolNames: string[]): AddonCredentialRequirement[];
 export type StreamContext = {
-    channel: AIStreamChannel;
-    options?: StreamAIAgentOptions;
+    channel: AgentStreamChannel;
+    options?: StreamAgentOptions;
     delegateState?: {
         delegated: boolean;
     };
 };
 export declare const resolveAgent: (agentName: string) => {
-    agent: CoreAIAgent;
+    agent: CoreAgent;
     packageName: string | null;
     resolvedName: string;
 };
-export declare function assertAgentAuthorized(agent: CoreAIAgent, params: RunAIAgentParams, packageName: string | null): Promise<void>;
+export declare function assertAgentAuthorized(agent: CoreAgent, params: RunAgentParams, packageName: string | null): Promise<void>;
 export declare function buildInstructions(agentName: string, packageName: string | null): Promise<string>;
-export type ScopedChannel = AIStreamChannel & {
+export type ScopedChannel = AgentStreamChannel & {
     approvals: Array<{
         toolCallId: string;
         toolName: string;
@@ -89,27 +89,27 @@ export type ScopedChannel = AIStreamChannel & {
         runId: string;
     }>;
 };
-export declare function createScopedChannel(parent: AIStreamChannel, agentName: string, session: string): ScopedChannel;
+export declare function createScopedChannel(parent: AgentStreamChannel, agentName: string, session: string): ScopedChannel;
 export declare function buildSubAgentRunInput(message: string, threadId: string, resourceId: string, parentContext?: string): {
     message: string;
     threadId: string;
     resourceId: string;
     context?: string;
 };
-export declare function buildToolDefs(params: RunAIAgentParams, agentSessionMap: Map<string, string>, resourceId: string, agentName: string, packageName: string | null, streamContext?: StreamContext, aiMiddlewares?: PikkuAIMiddlewareHooks[], agentMode?: 'delegate' | 'supervise', parentContext?: string): Promise<{
-    tools: AIAgentToolDef[];
+export declare function buildToolDefs(params: RunAgentParams, agentSessionMap: Map<string, string>, resourceId: string, agentName: string, packageName: string | null, streamContext?: StreamContext, agentMiddlewares?: PikkuAgentMiddlewareHooks[], agentMode?: 'delegate' | 'supervise', parentContext?: string): Promise<{
+    tools: AgentToolDef[];
     missingRpcs: string[];
 }>;
-export declare function prepareAgentRun(agentName: string, input: AIAgentInput, params: RunAIAgentParams, agentSessionMap: Map<string, string>, streamContext?: StreamContext): Promise<{
-    agent: CoreAIAgent;
+export declare function prepareAgentRun(agentName: string, input: AgentInput, params: RunAgentParams, agentSessionMap: Map<string, string>, streamContext?: StreamContext): Promise<{
+    agent: CoreAgent;
     packageName: string | null;
     resolvedName: string;
-    agentRunner: import("../../services/ai-agent-runner-service.js").AIAgentRunnerService;
-    storage: import("../../index.js").AIStorageService | undefined;
-    memoryConfig: import("./ai-agent.types.js").AIAgentMemoryConfig | undefined;
+    agentRunner: import("../../services/agent-runner-service.js").AgentRunnerService;
+    storage: import("../../services/agent-storage-service.js").AgentStorageService | undefined;
+    memoryConfig: import("./agent.types.js").AgentMemoryConfig | undefined;
     threadId: string;
-    userMessage: AIMessage;
-    runnerParams: AIAgentRunnerParams;
+    userMessage: AgentMessage;
+    runnerParams: AgentRunnerParams;
     maxSteps: number;
     missingRpcs: string[];
     workingMemoryJsonSchema: any;