@pikku/mongodb 0.12.14 → 0.12.17

package/CHANGELOG.md

@@ -1,5 +1,83 @@
 # @pikku/mongodb
 
+## 0.12.17
+
+### Patch Changes
+
+- fd9d834: Stop publishing internals that only their own package or file used. The declarations stay; only the entrypoint re-export is removed, so nothing that imported a name from where it is declared is affected.
+- Updated dependencies [063f43a]
+- Updated dependencies [ce66bf8]
+- Updated dependencies [d0307a8]
+- Updated dependencies [ce66bf8]
+- Updated dependencies [3ad2131]
+- Updated dependencies [b930dca]
+- Updated dependencies [b95e77d]
+- Updated dependencies [fd9d834]
+- Updated dependencies [8978fbd]
+  - @pikku/core@0.12.82
+
+## 0.12.16
+
+### Patch Changes
+
+- e110c55: Add runtime scoring for AI agents: `pikkuAIScorer` for heuristic grades and
+  `pikkuAIJudge` for LLM-judged ones, graded off the request path on two queue
+  lanes so a slow judge cannot starve the cheap checks. Grades are sampled
+  deterministically per `(run, scorer)` and persisted to `ai_run_score`.
+- Updated dependencies [e110c55]
+- Updated dependencies [e110c55]
+- Updated dependencies [e110c55]
+- Updated dependencies [acc8077]
+- Updated dependencies [905f737]
+- Updated dependencies [3cc6428]
+- Updated dependencies [c524adf]
+- Updated dependencies [e110c55]
+  - @pikku/core@0.12.81
+
+## 0.12.15
+
+### Patch Changes
+
+- 6dada45: fix(workflow,ai-agent): make a run's owner, entry node and step function authoritative
+
+  A graph run may only start at a node the graph declared in `meta.entryNodeIds`, and
+  the generated `POST /workflow/:workflowName/graph/:nodeId` route that let an HTTP
+  caller pick the entry node is gone. `startNode` stays for `PikkuTriggerService`,
+  which names a declared entry node anyway.
+
+  `StepState` now records the `rpcName` the workflow dispatched a step with, and the
+  step claim rejects a queue message naming a different function with
+  `WorkflowStepFunctionMismatchError` before mutating any status — a step runs under
+  the run owner's identity and without the `expose` gate, so the message must not
+  choose what runs.
+
+  `approveStep` takes the caller's session, and the generated status routes and
+  streams assert the same `assertWorkflowRunOwner` check: a run started through a
+  session may only be read and approved by that session's user. A run with no
+  recorded owner (trigger, scheduler, unauthenticated route) has nobody to compare
+  against and is still gated by the entrypoint's own `auth`/`permissions`.
+
+  `AIRunStateService.resolveApproval` is now a compare-and-swap returning whether
+  _this_ caller made the claim, and both agent resume paths run a tool only for the
+  approvals they claimed — concurrent approvals of one tool call no longer all
+  execute it.
+
+- Updated dependencies [41c1a95]
+- Updated dependencies [ce96383]
+- Updated dependencies [7e60867]
+- Updated dependencies [f8f1244]
+- Updated dependencies [dcf20cb]
+- Updated dependencies [6512384]
+- Updated dependencies [e3b4c14]
+- Updated dependencies [efd0ed1]
+- Updated dependencies [cba98fb]
+- Updated dependencies [ce96383]
+- Updated dependencies [f8f1244]
+- Updated dependencies [f8f1244]
+- Updated dependencies [6e93a35]
+- Updated dependencies [6dada45]
+  - @pikku/core@0.12.80
+
 ## 0.12.14
 
 ### Patch Changes

package/dist/src/index.d.ts

@@ -7,7 +7,6 @@ export { MongoDBDeploymentService } from './mongodb-deployment-service.js';
 export { MongoDBAIStorageService } from './mongodb-ai-storage-service.js';
 export { MongoDBAgentRunService } from './mongodb-agent-run-service.js';
 export { MongoDBSecretService } from './mongodb-secret-service.js';
-export type { MongoDBSecretServiceConfig } from './mongodb-secret-service.js';
 export type { WorkflowRunService } from '@pikku/core/workflow';
 export type { AgentRunService, AgentRunRow } from '@pikku/core/ai-agent';
 export { MongoDBSessionStore } from './mongodb-session-store.js';

package/dist/src/mongodb-ai-storage-service.d.ts

@@ -1,5 +1,6 @@
-import type { AIStorageService, AIRunStateService, CreateRunInput } from '@pikku/core/services';
+import type { AIStorageService, AIRunStateService, CreateRunInput, SaveScoreInput } from '@pikku/core/services';
 import type { AIThread, AIMessage, AgentRunState } from '@pikku/core/ai-agent';
+import type { AIRunScore } from '@pikku/core/ai-scorer';
 import type { Db } from 'mongodb';
 export declare class MongoDBAIStorageService implements AIStorageService, AIRunStateService {
     private db;
@@ -9,6 +10,7 @@ export declare class MongoDBAIStorageService implements AIStorageService, AIRunS
     private toolCalls;
     private workingMemory;
     private aiRuns;
+    private aiRunScores;
     constructor(db: Db);
     init(): Promise<void>;
     createThread(resourceId: string, options?: {
@@ -36,6 +38,8 @@ export declare class MongoDBAIStorageService implements AIStorageService, AIRunS
         run: AgentRunState;
         approval: NonNullable<AgentRunState['pendingApprovals']>[number];
     } | null>;
-    resolveApproval(toolCallId: string, status: 'approved' | 'denied'): Promise<void>;
+    resolveApproval(toolCallId: string, status: 'approved' | 'denied'): Promise<boolean>;
+    saveScore(score: SaveScoreInput): Promise<void>;
+    getScores(runId: string): Promise<AIRunScore[]>;
     close(): Promise<void>;
 }

package/dist/src/mongodb-ai-storage-service.js

@@ -6,6 +6,7 @@ export class MongoDBAIStorageService {
     toolCalls;
     workingMemory;
     aiRuns;
+    aiRunScores;
     constructor(db) {
         this.db = db;
     }
@@ -18,12 +19,14 @@ export class MongoDBAIStorageService {
         this.workingMemory =
             this.db.collection('ai_working_memory');
         this.aiRuns = this.db.collection('ai_run');
+        this.aiRunScores = this.db.collection('ai_run_score');
         await this.threads.createIndex({ resourceId: 1 });
         await this.aiMessages.createIndex({ threadId: 1, createdAt: 1 });
         await this.toolCalls.createIndex({ threadId: 1 });
         await this.toolCalls.createIndex({ messageId: 1 });
         await this.workingMemory.createIndex({ id: 1, scope: 1 }, { unique: true });
         await this.aiRuns.createIndex({ threadId: 1, createdAt: 1 });
+        await this.aiRunScores.createIndex({ runId: 1, createdAt: 1 });
         this.initialized = true;
     }
     async createThread(resourceId, options) {
@@ -402,7 +405,34 @@ export class MongoDBAIStorageService {
         return { run, approval };
     }
     async resolveApproval(toolCallId, status) {
-        await this.toolCalls.updateOne({ _id: toolCallId }, { $set: { approvalStatus: status } });
+        // Only the caller that moves the tool call off 'pending' has claimed it.
+        const result = await this.toolCalls.updateOne({ _id: toolCallId, approvalStatus: 'pending' }, { $set: { approvalStatus: status } });
+        return result.modifiedCount > 0;
+    }
+    async saveScore(score) {
+        await this.aiRunScores.insertOne({
+            _id: crypto.randomUUID(),
+            runId: score.runId,
+            scorerName: score.scorerName,
+            score: score.score,
+            reason: score.reason ?? null,
+            metadata: score.metadata ?? null,
+            createdAt: new Date(),
+        });
+    }
+    async getScores(runId) {
+        const rows = await this.aiRunScores
+            .find({ runId })
+            .sort({ createdAt: 1 })
+            .toArray();
+        return rows.map((row) => ({
+            runId: row.runId,
+            scorerName: row.scorerName,
+            score: row.score,
+            reason: row.reason ?? undefined,
+            metadata: row.metadata ?? undefined,
+            createdAt: row.createdAt,
+        }));
     }
     async close() { }
 }

package/dist/src/mongodb-workflow-service.js

@@ -85,6 +85,7 @@ export class MongoDBWorkflowService extends PikkuWorkflowService {
         return {
             stepId,
             status: 'pending',
+            rpcName,
             result: undefined,
             error: undefined,
             attemptCount: 1,
@@ -109,6 +110,7 @@ export class MongoDBWorkflowService extends PikkuWorkflowService {
         return {
             stepId: row._id,
             status: row.status,
+            rpcName: row.rpcName ?? null,
             result: row.result ?? undefined,
             error: row.error ?? undefined,
             attemptCount,
@@ -238,6 +240,7 @@ export class MongoDBWorkflowService extends PikkuWorkflowService {
         return {
             stepId: row._id,
             status: row.status,
+            rpcName: row.rpcName ?? null,
             result: row.result ?? undefined,
             error: row.error ?? undefined,
             attemptCount,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/mongodb",
-  "version": "0.12.14",
+  "version": "0.12.17",
   "description": "MongoDB services for Pikku — workflow state, agent runs, secrets and channel stores",
   "author": "yasser.fadl@gmail.com",
   "license": "MIT",
@@ -18,7 +18,7 @@
     "prepublishOnly": "yarn build"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.76"
+    "@pikku/core": "^0.12.82"
   },
   "dependencies": {
     "mongodb": "^6.12.0"

package/src/index.ts

@@ -8,7 +8,6 @@ export { MongoDBDeploymentService } from './mongodb-deployment-service.js'
 export { MongoDBAIStorageService } from './mongodb-ai-storage-service.js'
 export { MongoDBAgentRunService } from './mongodb-agent-run-service.js'
 export { MongoDBSecretService } from './mongodb-secret-service.js'
-export type { MongoDBSecretServiceConfig } from './mongodb-secret-service.js'
 
 export type { WorkflowRunService } from '@pikku/core/workflow'
 export type { AgentRunService, AgentRunRow } from '@pikku/core/ai-agent'

package/src/mongodb-ai-storage-service.ts

@@ -2,8 +2,10 @@ import type {
   AIStorageService,
   AIRunStateService,
   CreateRunInput,
+  SaveScoreInput,
 } from '@pikku/core/services'
 import type { AIThread, AIMessage, AgentRunState } from '@pikku/core/ai-agent'
+import type { AIRunScore } from '@pikku/core/ai-scorer'
 import type { Db, Collection } from 'mongodb'
 
 interface AIThreadDoc {
@@ -46,6 +48,16 @@ interface AIWorkingMemoryDoc {
   updatedAt: Date
 }
 
+interface AIRunScoreDoc {
+  _id: string
+  runId: string
+  scorerName: string
+  score: number
+  reason: string | null
+  metadata: any | null
+  createdAt: Date
+}
+
 interface AIRunDoc {
   _id: string
   agentName: string
@@ -71,6 +83,7 @@ export class MongoDBAIStorageService
   private toolCalls!: Collection<AIToolCallDoc>
   private workingMemory!: Collection<AIWorkingMemoryDoc>
   private aiRuns!: Collection<AIRunDoc>
+  private aiRunScores!: Collection<AIRunScoreDoc>
 
   constructor(private db: Db) {}
 
@@ -83,6 +96,7 @@ export class MongoDBAIStorageService
     this.workingMemory =
       this.db.collection<AIWorkingMemoryDoc>('ai_working_memory')
     this.aiRuns = this.db.collection<AIRunDoc>('ai_run')
+    this.aiRunScores = this.db.collection<AIRunScoreDoc>('ai_run_score')
 
     await this.threads.createIndex({ resourceId: 1 })
 
@@ -95,6 +109,8 @@ export class MongoDBAIStorageService
 
     await this.aiRuns.createIndex({ threadId: 1, createdAt: 1 })
 
+    await this.aiRunScores.createIndex({ runId: 1, createdAt: 1 })
+
     this.initialized = true
   }
 
@@ -565,11 +581,40 @@ export class MongoDBAIStorageService
   async resolveApproval(
     toolCallId: string,
     status: 'approved' | 'denied'
-  ): Promise<void> {
-    await this.toolCalls.updateOne(
-      { _id: toolCallId },
+  ): Promise<boolean> {
+    // Only the caller that moves the tool call off 'pending' has claimed it.
+    const result = await this.toolCalls.updateOne(
+      { _id: toolCallId, approvalStatus: 'pending' },
       { $set: { approvalStatus: status } }
     )
+    return result.modifiedCount > 0
+  }
+
+  async saveScore(score: SaveScoreInput): Promise<void> {
+    await this.aiRunScores.insertOne({
+      _id: crypto.randomUUID(),
+      runId: score.runId,
+      scorerName: score.scorerName,
+      score: score.score,
+      reason: score.reason ?? null,
+      metadata: score.metadata ?? null,
+      createdAt: new Date(),
+    })
+  }
+
+  async getScores(runId: string): Promise<AIRunScore[]> {
+    const rows = await this.aiRunScores
+      .find({ runId })
+      .sort({ createdAt: 1 })
+      .toArray()
+    return rows.map((row) => ({
+      runId: row.runId,
+      scorerName: row.scorerName,
+      score: row.score,
+      reason: row.reason ?? undefined,
+      metadata: row.metadata ?? undefined,
+      createdAt: row.createdAt,
+    }))
   }
 
   public async close(): Promise<void> {}

package/src/mongodb-workflow-service.ts

@@ -203,6 +203,7 @@ export class MongoDBWorkflowService extends PikkuWorkflowService {
     return {
       stepId,
       status: 'pending',
+      rpcName,
       result: undefined,
       error: undefined,
       attemptCount: 1,
@@ -233,6 +234,7 @@ export class MongoDBWorkflowService extends PikkuWorkflowService {
     return {
       stepId: row._id,
       status: row.status as StepState['status'],
+      rpcName: row.rpcName ?? null,
       result: row.result ?? undefined,
       error: row.error ?? undefined,
       attemptCount,
@@ -426,6 +428,7 @@ export class MongoDBWorkflowService extends PikkuWorkflowService {
     return {
       stepId: row._id,
       status: row.status as StepState['status'],
+      rpcName: row.rpcName ?? null,
       result: row.result ?? undefined,
       error: row.error ?? undefined,
       attemptCount,