@pikku/kysely 0.13.12 → 0.13.15

package/CHANGELOG.md

@@ -1,3 +1,81 @@
+## 0.13.15
+
+### Patch Changes
+
+- fd9d834: Stop publishing internals that only their own package or file used. The declarations stay; only the entrypoint re-export is removed, so nothing that imported a name from where it is declared is affected.
+- Updated dependencies [063f43a]
+- Updated dependencies [ce66bf8]
+- Updated dependencies [d0307a8]
+- Updated dependencies [ce66bf8]
+- Updated dependencies [3ad2131]
+- Updated dependencies [b930dca]
+- Updated dependencies [b95e77d]
+- Updated dependencies [fd9d834]
+- Updated dependencies [8978fbd]
+  - @pikku/core@0.12.82
+
+## 0.13.14
+
+### Patch Changes
+
+- e110c55: Add runtime scoring for AI agents: `pikkuAIScorer` for heuristic grades and
+  `pikkuAIJudge` for LLM-judged ones, graded off the request path on two queue
+  lanes so a slow judge cannot starve the cheap checks. Grades are sampled
+  deterministically per `(run, scorer)` and persisted to `ai_run_score`.
+- Updated dependencies [e110c55]
+- Updated dependencies [e110c55]
+- Updated dependencies [e110c55]
+- Updated dependencies [acc8077]
+- Updated dependencies [905f737]
+- Updated dependencies [3cc6428]
+- Updated dependencies [c524adf]
+- Updated dependencies [e110c55]
+  - @pikku/core@0.12.81
+
+## 0.13.13
+
+### Patch Changes
+
+- 6dada45: fix(workflow,ai-agent): make a run's owner, entry node and step function authoritative
+
+  A graph run may only start at a node the graph declared in `meta.entryNodeIds`, and
+  the generated `POST /workflow/:workflowName/graph/:nodeId` route that let an HTTP
+  caller pick the entry node is gone. `startNode` stays for `PikkuTriggerService`,
+  which names a declared entry node anyway.
+
+  `StepState` now records the `rpcName` the workflow dispatched a step with, and the
+  step claim rejects a queue message naming a different function with
+  `WorkflowStepFunctionMismatchError` before mutating any status — a step runs under
+  the run owner's identity and without the `expose` gate, so the message must not
+  choose what runs.
+
+  `approveStep` takes the caller's session, and the generated status routes and
+  streams assert the same `assertWorkflowRunOwner` check: a run started through a
+  session may only be read and approved by that session's user. A run with no
+  recorded owner (trigger, scheduler, unauthenticated route) has nobody to compare
+  against and is still gated by the entrypoint's own `auth`/`permissions`.
+
+  `AIRunStateService.resolveApproval` is now a compare-and-swap returning whether
+  _this_ caller made the claim, and both agent resume paths run a tool only for the
+  approvals they claimed — concurrent approvals of one tool call no longer all
+  execute it.
+
+- Updated dependencies [41c1a95]
+- Updated dependencies [ce96383]
+- Updated dependencies [7e60867]
+- Updated dependencies [f8f1244]
+- Updated dependencies [dcf20cb]
+- Updated dependencies [6512384]
+- Updated dependencies [e3b4c14]
+- Updated dependencies [efd0ed1]
+- Updated dependencies [cba98fb]
+- Updated dependencies [ce96383]
+- Updated dependencies [f8f1244]
+- Updated dependencies [f8f1244]
+- Updated dependencies [6e93a35]
+- Updated dependencies [6dada45]
+  - @pikku/core@0.12.80
+
 ## 0.13.12
 
 ### Patch Changes

package/dist/src/index.d.ts

@@ -8,18 +8,15 @@ export { KyselyAIStorageService } from './kysely-ai-storage-service.js';
 export { KyselyAgentRunService } from './kysely-ai-agent-run-service.js';
 export { KyselyAIRunStateService } from './kysely-ai-run-state-service.js';
 export { KyselySecretService } from './kysely-secret-service.js';
-export type { KyselySecretServiceConfig } from './kysely-secret-service.js';
 export { KyselyCredentialService } from './kysely-credential-service.js';
-export type { KyselyCredentialServiceConfig } from './kysely-credential-service.js';
 export { KyselySessionStore } from './kysely-session-store.js';
 export { KyselyScopeService } from './kysely-scope-service.js';
 export { KyselyWebhookService } from './kysely-webhook-service.js';
 export { createAuditedKysely, type CreateAuditedKyselyOptions, } from './create-audited-kysely.js';
 export { KyselyAuditService } from './kysely-audit-service.js';
 export { KyselyVirtualUserRunStore } from './kysely-virtual-user-run-store.js';
-export { SerializePlugin, SqliteSerializePlugin, BaseSerializePlugin, defaultSerializer, defaultDeserializer, maybeJson, skipTransform, dateRegex, type Serializer, type Deserializer, type SerializePluginOptions, } from './serialize-plugin.js';
-export { virtualUserSchema } from './schema/virtual-user.schema.js';
-export { auditSchema, pikkuSchemas, applyPikkuSchemas, compilePikkuSchemas, ensurePikkuSchema, type EnsureOutcome, resolveRequirements, unsatisfiedRequirements, rawStatement, requiredType, type PikkuSchema, type RequiredTypes, type SchemaRequirement, type UnmetRequirement, type SchemaStatement, type SchemaStatementFactory, } from './schema/index.js';
+export { SerializePlugin, SqliteSerializePlugin, BaseSerializePlugin, type Serializer, type Deserializer, } from './serialize-plugin.js';
+export { auditSchema, pikkuSchemas, applyPikkuSchemas, compilePikkuSchemas, ensurePikkuSchema, type EnsureOutcome, resolveRequirements, type PikkuSchema, type RequiredTypes, type UnmetRequirement, type SchemaStatementFactory, } from './schema/index.js';
 export type { KyselyPikkuDB } from './kysely-tables.js';
 export type { WorkflowRunService } from '@pikku/core/workflow';
 export type { AgentRunService, AgentRunRow } from '@pikku/core/ai-agent';

package/dist/src/index.js

@@ -15,6 +15,5 @@ export { KyselyWebhookService } from './kysely-webhook-service.js';
 export { createAuditedKysely, } from './create-audited-kysely.js';
 export { KyselyAuditService } from './kysely-audit-service.js';
 export { KyselyVirtualUserRunStore } from './kysely-virtual-user-run-store.js';
-export { SerializePlugin, SqliteSerializePlugin, BaseSerializePlugin, defaultSerializer, defaultDeserializer, maybeJson, skipTransform, dateRegex, } from './serialize-plugin.js';
-export { virtualUserSchema } from './schema/virtual-user.schema.js';
-export { auditSchema, pikkuSchemas, applyPikkuSchemas, compilePikkuSchemas, ensurePikkuSchema, resolveRequirements, unsatisfiedRequirements, rawStatement, requiredType, } from './schema/index.js';
+export { SerializePlugin, SqliteSerializePlugin, BaseSerializePlugin, } from './serialize-plugin.js';
+export { auditSchema, pikkuSchemas, applyPikkuSchemas, compilePikkuSchemas, ensurePikkuSchema, resolveRequirements, } from './schema/index.js';

package/dist/src/kysely-ai-run-scores.d.ts

@@ -0,0 +1,10 @@
+import type { Kysely } from 'kysely';
+import type { KyselyPikkuDB } from './kysely-tables.js';
+import type { SaveScoreInput } from '@pikku/core/services';
+import type { AIRunScore } from '@pikku/core/ai-scorer';
+/**
+ * Shared by the two Kysely services that implement `AIRunStateService` — they
+ * differ in how they store approvals, not in how they store grades.
+ */
+export declare const saveRunScore: (db: Kysely<KyselyPikkuDB>, score: SaveScoreInput) => Promise<void>;
+export declare const getRunScores: (db: Kysely<KyselyPikkuDB>, runId: string) => Promise<AIRunScore[]>;

package/dist/src/kysely-ai-run-scores.js

@@ -0,0 +1,34 @@
+import { parseJson } from './kysely-json.js';
+/**
+ * Shared by the two Kysely services that implement `AIRunStateService` — they
+ * differ in how they store approvals, not in how they store grades.
+ */
+export const saveRunScore = async (db, score) => {
+    await db
+        .insertInto('aiRunScore')
+        .values({
+        id: crypto.randomUUID(),
+        runId: score.runId,
+        scorerName: score.scorerName,
+        score: score.score,
+        reason: score.reason ?? null,
+        metadata: score.metadata ? JSON.stringify(score.metadata) : null,
+    })
+        .execute();
+};
+export const getRunScores = async (db, runId) => {
+    const rows = await db
+        .selectFrom('aiRunScore')
+        .selectAll()
+        .where('runId', '=', runId)
+        .orderBy('createdAt', 'asc')
+        .execute();
+    return rows.map((row) => ({
+        runId: row.runId,
+        scorerName: row.scorerName,
+        score: Number(row.score),
+        reason: row.reason ?? undefined,
+        metadata: parseJson(row.metadata),
+        createdAt: new Date(row.createdAt),
+    }));
+};

package/dist/src/kysely-ai-run-state-service.d.ts

@@ -1,7 +1,8 @@
 import type { Kysely } from 'kysely';
 import type { KyselyPikkuDB } from './kysely-tables.js';
-import type { AIRunStateService, CreateRunInput } from '@pikku/core/services';
+import type { AIRunStateService, CreateRunInput, SaveScoreInput } from '@pikku/core/services';
 import type { AgentRunState, PendingApproval } from '@pikku/core/ai-agent';
+import type { AIRunScore } from '@pikku/core/ai-scorer';
 export declare class KyselyAIRunStateService implements AIRunStateService {
     private db;
     private initialized;
@@ -11,10 +12,12 @@ export declare class KyselyAIRunStateService implements AIRunStateService {
     updateRun(runId: string, updates: Partial<AgentRunState>): Promise<void>;
     getRun(runId: string): Promise<AgentRunState | null>;
     getRunsByThread(threadId: string): Promise<AgentRunState[]>;
-    resolveApproval(toolCallId: string, status: 'approved' | 'denied'): Promise<void>;
+    resolveApproval(toolCallId: string, status: 'approved' | 'denied'): Promise<boolean>;
     findRunByToolCallId(toolCallId: string): Promise<{
         run: AgentRunState;
         approval: PendingApproval;
     } | null>;
+    saveScore(score: SaveScoreInput): Promise<void>;
+    getScores(runId: string): Promise<AIRunScore[]>;
     private toRunState;
 }

package/dist/src/kysely-ai-run-state-service.js

@@ -1,6 +1,7 @@
 import { sql } from 'kysely';
 import { ensurePikkuSchema } from './schema/index.js';
 import { aiSchema } from './schema/ai.schema.js';
+import { getRunScores, saveRunScore } from './kysely-ai-run-scores.js';
 export class KyselyAIRunStateService {
     db;
     initialized = false;
@@ -100,14 +101,19 @@ export class KyselyAIRunStateService {
                 if (filtered.length === 0) {
                     updates.status = status;
                 }
-                await this.db
+                // Compare-and-swap on the list we read: a concurrent approver that got
+                // there first has already rewritten it, and this update matches no row.
+                const result = await this.db
                     .updateTable('aiRun')
                     .set(updates)
                     .where('runId', '=', row.runId)
-                    .execute();
-                return;
+                    .where('status', '=', 'suspended')
+                    .where('pendingApprovals', '=', row.pendingApprovals)
+                    .executeTakeFirst();
+                return Number(result?.numUpdatedRows ?? 0) > 0;
             }
         }
+        return false;
     }
     async findRunByToolCallId(toolCallId) {
         const rows = await this.db
@@ -132,6 +138,12 @@ export class KyselyAIRunStateService {
         }
         return null;
     }
+    async saveScore(score) {
+        await saveRunScore(this.db, score);
+    }
+    async getScores(runId) {
+        return getRunScores(this.db, runId);
+    }
     toRunState(row) {
         return {
             runId: row.runId,

package/dist/src/kysely-ai-storage-service.d.ts

@@ -1,5 +1,6 @@
-import type { AIStorageService, AIRunStateService, CreateRunInput } from '@pikku/core/services';
+import type { AIStorageService, AIRunStateService, CreateRunInput, SaveScoreInput } from '@pikku/core/services';
 import type { AIThread, AIMessage, AgentRunState } from '@pikku/core/ai-agent';
+import type { AIRunScore } from '@pikku/core/ai-scorer';
 import type { Kysely } from 'kysely';
 import type { KyselyPikkuDB } from './kysely-tables.js';
 export declare class KyselyAIStorageService implements AIStorageService, AIRunStateService {
@@ -32,6 +33,8 @@ export declare class KyselyAIStorageService implements AIStorageService, AIRunSt
         run: AgentRunState;
         approval: NonNullable<AgentRunState['pendingApprovals']>[number];
     } | null>;
-    resolveApproval(toolCallId: string, status: 'approved' | 'denied'): Promise<void>;
+    resolveApproval(toolCallId: string, status: 'approved' | 'denied'): Promise<boolean>;
+    saveScore(score: SaveScoreInput): Promise<void>;
+    getScores(runId: string): Promise<AIRunScore[]>;
     close(): Promise<void>;
 }

package/dist/src/kysely-ai-storage-service.js

@@ -1,4 +1,5 @@
 import { parseJson } from './kysely-json.js';
+import { getRunScores, saveRunScore } from './kysely-ai-run-scores.js';
 import { ensurePikkuSchema } from './schema/index.js';
 import { aiSchema } from './schema/ai.schema.js';
 export class KyselyAIStorageService {
@@ -510,11 +511,20 @@ export class KyselyAIStorageService {
         return { run, approval };
     }
     async resolveApproval(toolCallId, status) {
-        await this.db
+        // Only the caller that moves the tool call off 'pending' has claimed it.
+        const result = await this.db
             .updateTable('aiToolCall')
             .set({ approvalStatus: status })
             .where('id', '=', toolCallId)
-            .execute();
+            .where('approvalStatus', '=', 'pending')
+            .executeTakeFirst();
+        return Number(result?.numUpdatedRows ?? 0) > 0;
+    }
+    async saveScore(score) {
+        await saveRunScore(this.db, score);
+    }
+    async getScores(runId) {
+        return getRunScores(this.db, runId);
     }
     async close() { }
 }

package/dist/src/kysely-tables.d.ts

@@ -133,6 +133,17 @@ export interface AIRunTable {
     createdAt: Generated<Date>;
     updatedAt: Generated<Date>;
 }
+export interface AIRunScoreTable {
+    id: string;
+    runId: string;
+    scorerName: string;
+    /** 0..1, so grades are comparable across scorers. */
+    score: number;
+    reason: string | null;
+    /** JSON-serialized structured detail the scorer returned alongside the score. */
+    metadata: string | null;
+    createdAt: Generated<Date>;
+}
 export interface PikkuDeploymentsTable {
     deploymentId: string;
     endpoint: string;
@@ -295,6 +306,7 @@ export interface KyselyPikkuDB {
     aiToolCall: AIToolCallTable;
     aiWorkingMemory: AIWorkingMemoryTable;
     aiRun: AIRunTable;
+    aiRunScore: AIRunScoreTable;
     pikkuDeployments: PikkuDeploymentsTable;
     pikkuDeploymentFunctions: PikkuDeploymentFunctionsTable;
     secrets: SecretsTable;

package/dist/src/kysely-workflow-service.js

@@ -78,6 +78,7 @@ export class KyselyWorkflowService extends PikkuWorkflowService {
         return {
             stepId,
             status: 'pending',
+            rpcName,
             result: undefined,
             error: undefined,
             attemptCount: 1,
@@ -94,6 +95,7 @@ export class KyselyWorkflowService extends PikkuWorkflowService {
             .select([
             'workflowStepId',
             'status',
+            'rpcName',
             'result',
             'error',
             'retries',
@@ -115,6 +117,7 @@ export class KyselyWorkflowService extends PikkuWorkflowService {
         return {
             stepId: row.workflowStepId,
             status: row.status,
+            rpcName: row.rpcName ?? null,
             result: parseJson(row.result),
             error: parseJson(row.error),
             attemptCount: Number(row.currentAttempt ?? 1),
@@ -331,6 +334,7 @@ export class KyselyWorkflowService extends PikkuWorkflowService {
             .select([
             'workflowStepId',
             'status',
+            'rpcName',
             'result',
             'error',
             'retries',
@@ -345,6 +349,7 @@ export class KyselyWorkflowService extends PikkuWorkflowService {
         return {
             stepId: row.workflowStepId,
             status: row.status,
+            rpcName: row.rpcName ?? null,
             result: parseJson(row.result),
             error: parseJson(row.error),
             attemptCount: Number(row.currentAttempt ?? 1),

package/dist/src/schema/ai.schema.js

@@ -85,5 +85,18 @@ export const aiSchema = {
             .createIndex('idx_ai_run_thread')
             .on('aiRun')
             .columns(['threadId', 'createdAt']),
+        (db) => db.schema
+            .createTable('aiRunScore')
+            .addColumn('id', 'varchar(36)', (col) => col.primaryKey())
+            .addColumn('runId', 'varchar(36)', (col) => col.notNull().references('aiRun.runId').onDelete('cascade'))
+            .addColumn('scorerName', 'varchar(255)', (col) => col.notNull())
+            .addColumn('score', 'real', (col) => col.notNull())
+            .addColumn('reason', 'text')
+            .addColumn('metadata', 'text')
+            .addColumn('createdAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull()),
+        (db) => db.schema
+            .createIndex('idx_ai_run_score_run')
+            .on('aiRunScore')
+            .columns(['runId', 'createdAt']),
     ],
 };

package/dist/tsconfig.tsbuildinfo

@@ -1 +1 @@
-{"root":["../src/create-audited-kysely.ts","../src/index.ts","../src/kysely-ai-agent-run-service.ts","../src/kysely-ai-run-state-service.ts","../src/kysely-ai-storage-service.ts","../src/kysely-audit-service.ts","../src/kysely-channel-store.ts","../src/kysely-credential-service.ts","../src/kysely-deployment-service.ts","../src/kysely-eventhub-store.ts","../src/kysely-json.ts","../src/kysely-scope-service.ts","../src/kysely-secret-service.ts","../src/kysely-session-store.ts","../src/kysely-tables.ts","../src/kysely-virtual-user-run-store.ts","../src/kysely-webhook-service.ts","../src/kysely-workflow-mirror.ts","../src/kysely-workflow-run-service.ts","../src/kysely-workflow-service.ts","../src/serialize-plugin.ts","../src/schema/ai.schema.ts","../src/schema/audit.schema.ts","../src/schema/channel.schema.ts","../src/schema/credential.schema.ts","../src/schema/deployment.schema.ts","../src/schema/index.ts","../src/schema/pikku-schema.types.ts","../src/schema/scope.schema.ts","../src/schema/secret.schema.ts","../src/schema/session.schema.ts","../src/schema/virtual-user.schema.ts","../src/schema/webhook.schema.ts","../src/schema/workflow.schema.ts","../bin/pikku-kysely-pure.ts"],"version":"6.0.3"}
+{"root":["../src/create-audited-kysely.ts","../src/index.ts","../src/kysely-ai-agent-run-service.ts","../src/kysely-ai-run-scores.ts","../src/kysely-ai-run-state-service.ts","../src/kysely-ai-storage-service.ts","../src/kysely-audit-service.ts","../src/kysely-channel-store.ts","../src/kysely-credential-service.ts","../src/kysely-deployment-service.ts","../src/kysely-eventhub-store.ts","../src/kysely-json.ts","../src/kysely-scope-service.ts","../src/kysely-secret-service.ts","../src/kysely-session-store.ts","../src/kysely-tables.ts","../src/kysely-virtual-user-run-store.ts","../src/kysely-webhook-service.ts","../src/kysely-workflow-mirror.ts","../src/kysely-workflow-run-service.ts","../src/kysely-workflow-service.ts","../src/serialize-plugin.ts","../src/schema/ai.schema.ts","../src/schema/audit.schema.ts","../src/schema/channel.schema.ts","../src/schema/credential.schema.ts","../src/schema/deployment.schema.ts","../src/schema/index.ts","../src/schema/pikku-schema.types.ts","../src/schema/scope.schema.ts","../src/schema/secret.schema.ts","../src/schema/session.schema.ts","../src/schema/virtual-user.schema.ts","../src/schema/webhook.schema.ts","../src/schema/workflow.schema.ts","../bin/pikku-kysely-pure.ts"],"version":"6.0.3"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/kysely",
-  "version": "0.13.12",
+  "version": "0.13.15",
   "description": "Kysely-backed Pikku services — workflow state, secrets, sessions, scopes and audit",
   "author": "yasser.fadl@gmail.com",
   "license": "MIT",
@@ -21,7 +21,7 @@
     "prepublishOnly": "yarn build"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.79"
+    "@pikku/core": "^0.12.82"
   },
   "dependencies": {
     "kysely": "^0.29.0"

package/src/index.ts

@@ -8,9 +8,7 @@ export { KyselyAIStorageService } from './kysely-ai-storage-service.js'
 export { KyselyAgentRunService } from './kysely-ai-agent-run-service.js'
 export { KyselyAIRunStateService } from './kysely-ai-run-state-service.js'
 export { KyselySecretService } from './kysely-secret-service.js'
-export type { KyselySecretServiceConfig } from './kysely-secret-service.js'
 export { KyselyCredentialService } from './kysely-credential-service.js'
-export type { KyselyCredentialServiceConfig } from './kysely-credential-service.js'
 export { KyselySessionStore } from './kysely-session-store.js'
 export { KyselyScopeService } from './kysely-scope-service.js'
 export { KyselyWebhookService } from './kysely-webhook-service.js'
@@ -25,17 +23,9 @@ export {
   SerializePlugin,
   SqliteSerializePlugin,
   BaseSerializePlugin,
-  defaultSerializer,
-  defaultDeserializer,
-  maybeJson,
-  skipTransform,
-  dateRegex,
   type Serializer,
   type Deserializer,
-  type SerializePluginOptions,
 } from './serialize-plugin.js'
-
-export { virtualUserSchema } from './schema/virtual-user.schema.js'
 export {
   auditSchema,
   pikkuSchemas,
@@ -44,14 +34,9 @@ export {
   ensurePikkuSchema,
   type EnsureOutcome,
   resolveRequirements,
-  unsatisfiedRequirements,
-  rawStatement,
-  requiredType,
   type PikkuSchema,
   type RequiredTypes,
-  type SchemaRequirement,
   type UnmetRequirement,
-  type SchemaStatement,
   type SchemaStatementFactory,
 } from './schema/index.js'
 

package/src/kysely-ai-run-scores.ts

@@ -0,0 +1,47 @@
+import type { Kysely } from 'kysely'
+import type { KyselyPikkuDB } from './kysely-tables.js'
+import type { SaveScoreInput } from '@pikku/core/services'
+import type { AIRunScore } from '@pikku/core/ai-scorer'
+import { parseJson } from './kysely-json.js'
+
+/**
+ * Shared by the two Kysely services that implement `AIRunStateService` — they
+ * differ in how they store approvals, not in how they store grades.
+ */
+export const saveRunScore = async (
+  db: Kysely<KyselyPikkuDB>,
+  score: SaveScoreInput
+): Promise<void> => {
+  await db
+    .insertInto('aiRunScore')
+    .values({
+      id: crypto.randomUUID(),
+      runId: score.runId,
+      scorerName: score.scorerName,
+      score: score.score,
+      reason: score.reason ?? null,
+      metadata: score.metadata ? JSON.stringify(score.metadata) : null,
+    })
+    .execute()
+}
+
+export const getRunScores = async (
+  db: Kysely<KyselyPikkuDB>,
+  runId: string
+): Promise<AIRunScore[]> => {
+  const rows = await db
+    .selectFrom('aiRunScore')
+    .selectAll()
+    .where('runId', '=', runId)
+    .orderBy('createdAt', 'asc')
+    .execute()
+
+  return rows.map((row) => ({
+    runId: row.runId,
+    scorerName: row.scorerName,
+    score: Number(row.score),
+    reason: row.reason ?? undefined,
+    metadata: parseJson(row.metadata),
+    createdAt: new Date(row.createdAt),
+  }))
+}

package/src/kysely-ai-run-state-service.ts

@@ -1,10 +1,16 @@
 import { sql } from 'kysely'
 import type { Kysely } from 'kysely'
 import type { KyselyPikkuDB } from './kysely-tables.js'
-import type { AIRunStateService, CreateRunInput } from '@pikku/core/services'
+import type {
+  AIRunStateService,
+  CreateRunInput,
+  SaveScoreInput,
+} from '@pikku/core/services'
 import type { AgentRunState, PendingApproval } from '@pikku/core/ai-agent'
+import type { AIRunScore } from '@pikku/core/ai-scorer'
 import { ensurePikkuSchema } from './schema/index.js'
 import { aiSchema } from './schema/ai.schema.js'
+import { getRunScores, saveRunScore } from './kysely-ai-run-scores.js'
 
 export class KyselyAIRunStateService implements AIRunStateService {
   private initialized = false
@@ -89,7 +95,7 @@ export class KyselyAIRunStateService implements AIRunStateService {
   async resolveApproval(
     toolCallId: string,
     status: 'approved' | 'denied'
-  ): Promise<void> {
+  ): Promise<boolean> {
     const rows = await this.db
       .selectFrom('aiRun')
       .select(['runId', 'pendingApprovals'])
@@ -117,14 +123,19 @@ export class KyselyAIRunStateService implements AIRunStateService {
         if (filtered.length === 0) {
           updates.status = status
         }
-        await this.db
+        // Compare-and-swap on the list we read: a concurrent approver that got
+        // there first has already rewritten it, and this update matches no row.
+        const result = await this.db
           .updateTable('aiRun')
           .set(updates as any)
           .where('runId', '=', row.runId)
-          .execute()
-        return
+          .where('status', '=', 'suspended')
+          .where('pendingApprovals', '=', row.pendingApprovals)
+          .executeTakeFirst()
+        return Number(result?.numUpdatedRows ?? 0) > 0
       }
     }
+    return false
   }
 
   async findRunByToolCallId(
@@ -155,6 +166,14 @@ export class KyselyAIRunStateService implements AIRunStateService {
     return null
   }
 
+  async saveScore(score: SaveScoreInput): Promise<void> {
+    await saveRunScore(this.db, score)
+  }
+
+  async getScores(runId: string): Promise<AIRunScore[]> {
+    return getRunScores(this.db, runId)
+  }
+
   private toRunState(row: any): AgentRunState {
     return {
       runId: row.runId,

package/src/kysely-ai-storage-service.ts

@@ -2,11 +2,14 @@ import type {
   AIStorageService,
   AIRunStateService,
   CreateRunInput,
+  SaveScoreInput,
 } from '@pikku/core/services'
 import type { AIThread, AIMessage, AgentRunState } from '@pikku/core/ai-agent'
+import type { AIRunScore } from '@pikku/core/ai-scorer'
 import type { Kysely } from 'kysely'
 import type { KyselyPikkuDB } from './kysely-tables.js'
 import { parseJson } from './kysely-json.js'
+import { getRunScores, saveRunScore } from './kysely-ai-run-scores.js'
 import { ensurePikkuSchema } from './schema/index.js'
 import { aiSchema } from './schema/ai.schema.js'
 
@@ -596,12 +599,23 @@ export class KyselyAIStorageService
   async resolveApproval(
     toolCallId: string,
     status: 'approved' | 'denied'
-  ): Promise<void> {
-    await this.db
+  ): Promise<boolean> {
+    // Only the caller that moves the tool call off 'pending' has claimed it.
+    const result = await this.db
       .updateTable('aiToolCall')
       .set({ approvalStatus: status })
       .where('id', '=', toolCallId)
-      .execute()
+      .where('approvalStatus', '=', 'pending')
+      .executeTakeFirst()
+    return Number(result?.numUpdatedRows ?? 0) > 0
+  }
+
+  async saveScore(score: SaveScoreInput): Promise<void> {
+    await saveRunScore(this.db, score)
+  }
+
+  async getScores(runId: string): Promise<AIRunScore[]> {
+    return getRunScores(this.db, runId)
   }
 
   public async close(): Promise<void> {}

package/src/kysely-services.test.ts

@@ -44,6 +44,7 @@ async function dropAllTables(db: Kysely<KyselyPikkuDB>): Promise<void> {
     'pikku_deployments',
     'ai_tool_call',
     'ai_message',
+    'ai_run_score',
     'ai_run',
     'ai_working_memory',
     'ai_threads',

package/src/kysely-tables.ts

@@ -151,6 +151,18 @@ export interface AIRunTable {
   updatedAt: Generated<Date>
 }
 
+export interface AIRunScoreTable {
+  id: string
+  runId: string
+  scorerName: string
+  /** 0..1, so grades are comparable across scorers. */
+  score: number
+  reason: string | null
+  /** JSON-serialized structured detail the scorer returned alongside the score. */
+  metadata: string | null
+  createdAt: Generated<Date>
+}
+
 export interface PikkuDeploymentsTable {
   deploymentId: string
   endpoint: string
@@ -329,6 +341,7 @@ export interface KyselyPikkuDB {
   aiToolCall: AIToolCallTable
   aiWorkingMemory: AIWorkingMemoryTable
   aiRun: AIRunTable
+  aiRunScore: AIRunScoreTable
   pikkuDeployments: PikkuDeploymentsTable
   pikkuDeploymentFunctions: PikkuDeploymentFunctionsTable
   secrets: SecretsTable

package/src/kysely-webhook-service.test.ts

@@ -2,7 +2,7 @@ import { describe, test, beforeEach } from 'node:test'
 import assert from 'node:assert/strict'
 import { CamelCasePlugin, Kysely, SqliteDialect } from 'kysely'
 import Database from 'better-sqlite3'
-import { setSingletonServices } from '@pikku/core'
+import { setSingletonServices } from '@pikku/core/ecosystem'
 
 import type { KyselyPikkuDB } from './kysely-tables.js'
 import { SerializePlugin } from './serialize-plugin.js'

package/src/kysely-workflow-service.ts

@@ -123,6 +123,7 @@ export class KyselyWorkflowService extends PikkuWorkflowService {
     return {
       stepId,
       status: 'pending',
+      rpcName,
       result: undefined,
       error: undefined,
       attemptCount: 1,
@@ -140,6 +141,7 @@ export class KyselyWorkflowService extends PikkuWorkflowService {
       .select([
         'workflowStepId',
         'status',
+        'rpcName',
         'result',
         'error',
         'retries',
@@ -165,6 +167,7 @@ export class KyselyWorkflowService extends PikkuWorkflowService {
     return {
       stepId: row.workflowStepId,
       status: row.status as StepState['status'],
+      rpcName: row.rpcName ?? null,
       result: parseJson(row.result),
       error: parseJson(row.error),
       attemptCount: Number(row.currentAttempt ?? 1),
@@ -425,6 +428,7 @@ export class KyselyWorkflowService extends PikkuWorkflowService {
       .select([
         'workflowStepId',
         'status',
+        'rpcName',
         'result',
         'error',
         'retries',
@@ -440,6 +444,7 @@ export class KyselyWorkflowService extends PikkuWorkflowService {
     return {
       stepId: row.workflowStepId,
       status: row.status as StepState['status'],
+      rpcName: row.rpcName ?? null,
       result: parseJson(row.result),
       error: parseJson(row.error),
       attemptCount: Number(row.currentAttempt ?? 1),

package/src/schema/ai.schema.ts

@@ -136,5 +136,26 @@ export const aiSchema: PikkuSchema = {
         .createIndex('idx_ai_run_thread')
         .on('aiRun')
         .columns(['threadId', 'createdAt']),
+
+    (db) =>
+      db.schema
+        .createTable('aiRunScore')
+        .addColumn('id', 'varchar(36)', (col) => col.primaryKey())
+        .addColumn('runId', 'varchar(36)', (col) =>
+          col.notNull().references('aiRun.runId').onDelete('cascade')
+        )
+        .addColumn('scorerName', 'varchar(255)', (col) => col.notNull())
+        .addColumn('score', 'real', (col) => col.notNull())
+        .addColumn('reason', 'text')
+        .addColumn('metadata', 'text')
+        .addColumn('createdAt', 'timestamp', (col) =>
+          col.defaultTo(sql`CURRENT_TIMESTAMP`).notNull()
+        ),
+
+    (db) =>
+      db.schema
+        .createIndex('idx_ai_run_score_run')
+        .on('aiRunScore')
+        .columns(['runId', 'createdAt']),
   ],
 }