@pikku/mongodb 0.12.23 → 0.12.25

package/dist/src/mongodb-deployment-service.js

@@ -1,4 +1,4 @@
-import { buildRemoteHeaders } from '@pikku/core/remote';
+import { buildMeshHeaders } from '@pikku/core/mesh';
 import { getAllFunctionNames } from '@pikku/core/function';
 export class MongoDBDeploymentService {
     db;
@@ -40,7 +40,10 @@ export class MongoDBDeploymentService {
                 createdAt: now,
             },
         }, { upsert: true });
-        this.heartbeatTimer = setInterval(() => this.sendHeartbeat(), this.heartbeatInterval);
+        this.heartbeatTimer = setInterval(() => {
+            // sendHeartbeat catches its own errors; it retries on the next tick
+            void this.sendHeartbeat();
+        }, this.heartbeatInterval);
     }
     async stop() {
         if (this.heartbeatTimer) {
@@ -54,20 +57,20 @@ export class MongoDBDeploymentService {
         }
     }
     async invoke(funcName, data, session, traceId) {
-        const headers = await buildRemoteHeaders(this.jwt, this.secrets, funcName, session, traceId);
+        const headers = await buildMeshHeaders(this.jwt, this.secrets, funcName, session, traceId);
         const cutoff = new Date(Date.now() - this.heartbeatTtl);
         const result = await this.deployments.findOne({ functions: funcName, lastHeartbeat: { $gt: cutoff } }, { sort: { lastHeartbeat: -1 } });
         if (!result) {
             throw new Error(`No deployment found for function '${funcName}'`);
         }
-        const url = `${result.endpoint}/remote/rpc/${encodeURIComponent(funcName)}`;
+        const url = `${result.endpoint}/mesh/rpc/${encodeURIComponent(funcName)}`;
         const response = await fetch(url, {
             method: 'POST',
             headers: { 'Content-Type': 'application/json', ...headers },
             body: JSON.stringify({ data }),
         });
         if (!response.ok) {
-            throw new Error(`Remote RPC call to '${funcName}' failed: ${response.status}`);
+            throw new Error(`Mesh RPC call to '${funcName}' failed: ${response.status}`);
         }
         return response.json();
     }

package/dist/src/mongodb-workflow-run-service.js

@@ -35,11 +35,25 @@ export class MongoDBWorkflowRunService {
             .find({ workflowRunId: runId })
             .sort({ createdAt: 1 })
             .toArray();
+        const history = await this.stepHistory
+            .find({ workflowStepId: { $in: result.map((row) => row._id) } })
+            .sort({ createdAt: 1, attempt: 1 })
+            .toArray();
+        const latest = new Map();
+        for (const row of history)
+            latest.set(row.workflowStepId, row);
         return result.map((row) => ({
             stepId: row._id,
             stepName: row.stepName,
             rpcName: row.rpcName ?? undefined,
             data: row.data ?? undefined,
+            childRunId: row.childRunId ?? undefined,
+            succeededAt: latest.get(row._id)?.succeededAt
+                ? new Date(latest.get(row._id).succeededAt)
+                : undefined,
+            failedAt: latest.get(row._id)?.failedAt
+                ? new Date(latest.get(row._id).failedAt)
+                : undefined,
             status: row.status,
             result: row.result ?? undefined,
             error: row.error ?? undefined,

package/dist/src/mongodb-workflow-service.d.ts

@@ -23,6 +23,11 @@ export declare class MongoDBWorkflowService extends PikkuWorkflowService {
     }, fromStepName?: string): Promise<StepState>;
     getStepState(runId: string, stepName: string): Promise<StepState>;
     private toStepState;
+    getRunSteps(runId: string): Promise<Array<StepState & {
+        stepName: string;
+        rpcName?: string;
+        data?: any;
+    }>>;
     getRunHistory(runId: string): Promise<Array<StepState & {
         stepName: string;
     }>>;

package/dist/src/mongodb-workflow-service.js

@@ -1,5 +1,13 @@
 import { leaseAttemptsExhausted, PikkuWorkflowService, WorkflowStepFunctionMismatchError, WorkflowStepLeaseExpiredError, WorkflowStepSupersededError, } from '@pikku/core/workflow';
 import { MongoDBWorkflowRunService } from './mongodb-workflow-run-service.js';
+const ENCODED_STATE_KEY = '__enc_';
+/** Field names cannot hold `.` or `$`, and step names are free text. */
+const encodeStateKey = (name) => /^[a-zA-Z0-9_]+$/.test(name) && !name.startsWith(ENCODED_STATE_KEY)
+    ? name
+    : ENCODED_STATE_KEY + Buffer.from(name, 'utf8').toString('hex');
+const decodeStateKey = (key) => key.startsWith(ENCODED_STATE_KEY)
+    ? Buffer.from(key.slice(ENCODED_STATE_KEY.length), 'hex').toString('utf8')
+    : key;
 export class MongoDBWorkflowService extends PikkuWorkflowService {
     initialized = false;
     runService;
@@ -123,6 +131,9 @@ export class MongoDBWorkflowService extends PikkuWorkflowService {
             updatedAt: new Date(row.updatedAt),
         };
     }
+    async getRunSteps(runId) {
+        return this.runService.getRunSteps(runId);
+    }
     async getRunHistory(runId) {
         return this.runService.getRunHistory(runId);
     }
@@ -412,12 +423,9 @@ export class MongoDBWorkflowService extends PikkuWorkflowService {
         await this.steps.updateOne({ _id: stepId }, { $set: { branchTaken: branchKey, updatedAt: new Date() } });
     }
     async updateRunStateImpl(runId, name, value) {
-        if (!/^[a-zA-Z0-9_]+$/.test(name)) {
-            throw new Error('Invalid state key name');
-        }
         await this.runs.updateOne({ _id: runId }, {
             $set: {
-                [`state.${name}`]: value,
+                [`state.${encodeStateKey(name)}`]: value,
                 updatedAt: new Date(),
             },
         });
@@ -426,7 +434,10 @@ export class MongoDBWorkflowService extends PikkuWorkflowService {
         const row = await this.runs.findOne({ _id: runId }, { projection: { state: 1 } });
         if (!row)
             return {};
-        return row.state ?? {};
+        return Object.fromEntries(Object.entries(row.state ?? {}).map(([key, value]) => [
+            decodeStateKey(key),
+            value,
+        ]));
     }
     async upsertWorkflowVersionImpl(name, graphHash, graph, source, status) {
         await this.versions.updateOne({ workflowName: name, graphHash }, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/mongodb",
-  "version": "0.12.23",
+  "version": "0.12.25",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/pikkujs/pikku.git",
@@ -15,24 +15,30 @@
   "scripts": {
     "tsc": "tsc",
     "ncu": "npx npm-check-updates",
-    "build": "tsc -b",
+    "build": "bun run clean && tsc -b",
     "test": "bash run-tests.sh",
     "test:watch": "bash run-tests.sh --watch",
     "test:coverage": "bash run-tests.sh --coverage",
     "release": "npm run build && npm test",
-    "prepublishOnly": "bun run build"
+    "prepublishOnly": "bun run build",
+    "clean": "rm -rf dist tsconfig.tsbuildinfo"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.133"
+    "@pikku/core": "^0.12.146"
   },
   "dependencies": {
-    "mongodb": "^7.5.0"
+    "mongodb": "^7.7.0"
   },
   "devDependencies": {
-    "mongodb": "^7.5.0",
-    "mongodb-memory-server": "^11.2.0"
+    "mongodb": "^7.7.0",
+    "mongodb-memory-server": "^11.3.0"
   },
   "exports": {
-    ".": "./dist/src/index.js"
-  }
+    ".": "./dist/src/index.js",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "!dist/**/*.tsbuildinfo"
+  ]
 }

package/CHANGELOG.md

@@ -1,1069 +0,0 @@
-# @pikku/mongodb
-
-## 0.12.23
-
-### Patch Changes
-
-- a16b0ba: `RedisWorkflowService` and `MongoDBWorkflowService` now record a step's lease, so a step whose worker died is claimed again once the lease lapses, as it already was on Kysely. Both fence a step's result, error and lease renewal to the attempt that claimed it: a superseded worker's write throws `WorkflowStepSupersededError` and leaves the newer attempt's state alone. Redis does the check and the write in one Lua script. MongoDB now keeps the attempt number on the step document, advances it in the same guarded update that grants the lease, and tags every history document with the attempt it belongs to.
-- a16b0ba: The workflow run lease takes the app's `leaseService` (`holdLease(leaseService, 'workflow-run:<id>', …)`) in place of `pg_advisory_lock` / `GET_LOCK`, for DSL and graph runs alike. A message for a run already being orchestrated elsewhere wakes the run again a second later instead of failing, so a long pass never spends the retry budget the queue keeps for real failures. An inline run whose lease was lost after its body finished keeps the outcome it wrote. `PgWorkflowQueueOptions` and `RunLockHoldTimeoutError` are removed. `WorkflowService.withRunLock` is renamed `withRunLease`, since what it holds runs out unless renewed; a custom workflow service overriding it renames the method.
-
-  Pass the lease service to the workflow service — `new PgKyselyWorkflowService(db, { leaseService })` — register the same instance as the app's `leaseService`, and migrate `pikku_lease`.
-
-  A step lease is renewed by the same loop as the run lease. A graph node whose worker died is dispatched again once its lease lapses, instead of leaving the run waiting on it. A replayed step on Kysely now sees its lease, as `getStepState` does. The in-memory store refuses a superseded worker's outcome, as the database stores do. The MySQL workflow service can now record a workflow version; it used `ON CONFLICT`, which MySQL does not have.
-
-  `pikku db generate` now writes the `pikku_lease` table for any project that runs workflows, not only one that reaches `leaseService`, since every persistent workflow service holds its runs and steps there.
-
-- a16b0ba: Persistent workflow services take a required `leaseService` (`WorkflowServiceOptions`) and lock runs and steps on it. The Postgres advisory and MySQL `GET_LOCK` step locks, and Redis's own `SET NX` run and step locks, are removed; `RedisWorkflowService` now takes `(connection, { leaseService, keyPrefix? })`.
-- Updated dependencies [a16b0ba]
-- Updated dependencies [21e9c3a]
-- Updated dependencies [a16b0ba]
-- Updated dependencies [a16b0ba]
-  - @pikku/core@0.12.133
-
-## 0.12.22
-
-### Patch Changes
-
-- 4c7a1b5: Run the monorepo's own scripts through bun instead of yarn. What moves is the
-  package manager each package's `prepublishOnly` and build scripts invoke, plus
-  the two manifest fixes bun needs to resolve the tree: `uWebSockets.js` is
-  declared with an explicit `github:` specifier, and `@pikku/uws-handler` marks
-  its `uWebSockets.js` peer optional so a bun install of a consumer that brings
-  its own uWS app does not try to fetch it from the registry.
-
-  Three published behaviours change, all of them cases where an isolated
-  `node_modules` or bun as the runtime had been papered over by yarn's hoisting:
-
-  - `@pikku/migrator-sql` turns foreign keys on when it opens a sqlite database
-    through bun. `node:sqlite` enforces them by default and `bun:sqlite` does not,
-    which silently turned every `ON DELETE CASCADE` into a no-op under
-    `bunx --bun pikku`.
-  - `@pikku/cli` resolves a deploy provider against the project being deployed
-    rather than against wherever the CLI itself is installed, which is what its
-    own "is not installed" error asks the user to arrange.
-  - `@pikku/cli` treats a specifier a runtime hands straight back — bun does this
-    for the modules it implements itself — as not resolved from the project, so
-    it falls back rather than loading the runtime's own copy.
-
-- Updated dependencies [4c7a1b5]
-  - @pikku/core@0.12.108
-
-## 0.12.21
-
-### Patch Changes
-
-- 4450b2a: Name the missing key when a secret is not found.
-
-  Every `SecretService` threw a bare `Requested secret not found`. In a deployed
-  runtime the stack is minified, so the message was the only evidence there was —
-  and it identified neither the key nor the service. Each implementation now names
-  the key it looked for; the better-auth middlewares that skip on an absent secret
-  match the prefix through one shared predicate instead of the whole string.
-
-- Updated dependencies [4058c3a]
-- Updated dependencies [4058c3a]
-- Updated dependencies [4058c3a]
-- Updated dependencies [4058c3a]
-- Updated dependencies [4058c3a]
-- Updated dependencies [4058c3a]
-- Updated dependencies [114c079]
-- Updated dependencies [4450b2a]
-- Updated dependencies [4058c3a]
-- Updated dependencies [4058c3a]
-  - @pikku/core@0.12.93
-
-## 0.12.20
-
-### Patch Changes
-
-- 3c0012c: Gate console agent-thread reads and deletes on thread ownership, claim MongoDB workflow steps atomically, and reach the deployment fallback from `rpcWithWire`
-
-  `getAgentThreadMessages` and `deleteAgentThread` in the console addon took a
-  caller-supplied `threadId` straight to storage, while their siblings
-  `getAgentThreads` and `getAgentThreadRuns` already filtered to what the session
-  owns. Both now carry an `isThreadOwner` permission: an admin reaches any thread,
-  everyone else only their own, and a missing thread is refused rather than 404'd
-  so it is indistinguishable from someone else's.
-
-  `MongoDBWorkflowService` claimed a step by reading its status and then writing
-  it, under a `withStepLock` that is a pass-through — so two dispatches racing for
-  the same step could both proceed and run a side-effecting step twice. The claim
-  is now a single status-guarded update, atomic on one document.
-
-  `rpcWithWire` threw `RPCNotFoundError` for any unresolved namespaced call
-  instead of falling through to the deployment service, so a namespaced RPC that
-  `rpc()` would have dispatched remotely failed when called with an explicit wire.
-
-- Updated dependencies [3c0012c]
-- Updated dependencies [05e47cf]
-- Updated dependencies [cfd364a]
-- Updated dependencies [05e47cf]
-- Updated dependencies [05e47cf]
-- Updated dependencies [05e47cf]
-  - @pikku/core@0.12.90
-
-## 0.12.19
-
-### Patch Changes
-
-- 266e3bc: One door per name: `@pikku/core/ecosystem/*` and the package root are gone
-
-  `@pikku/core` published every module twice. `ecosystem/http` re-exported
-  `./http`, `ecosystem/services` re-exported `./services`, and a name was
-  reachable through either — so every addition had to be made in two places, and a
-  consumer's import said nothing about what it actually used. The package root was
-  the same problem at a larger scale: a single barrel of 206 names that no bundler
-  could take apart, and the one specifier that revealed nothing at all.
-
-  Both are deleted. Every name now lives on the subpath that owns it, and every
-  import carries that subpath — `@pikku/core/http`, `@pikku/core/services`,
-  `@pikku/core/errors`, `@pikku/core/types`.
-
-  Deleting the facades meant the raw subpaths had to become a superset of them,
-  which they were not: the facade tree had accumulated 25 names with no raw home
-  and about 26 more filed under a different area than the module they came from.
-  Those names moved to the area that owns them, and three areas were published as
-  new entry points rather than left on a root that is going away — `./types` (the
-  shared type surface, the largest single destination), `./state` and
-  `./classification`.
-
-  `./classification` is one door onto one subject: what a value is and how it must
-  be handled. Its three halves would each have been an entry point — the brands
-  and manifest types, the stored-form helpers (`hashToken`, `unsafeAsSealed` and
-  friends), and `SecretValue` — split by whether a name happens to be a type or a
-  value, which is the same defect as the facades. The duration and versioned-id
-  helpers went to `./utils`, which already published, and `PikkuRequest` went to
-  `./function`: it is the transport-agnostic request base, not an HTTP one — HTTP
-  has `PikkuHTTPAbstractRequest`, and the only thing outside core that extends
-  `PikkuRequest` is Azure's timer request.
-
-  `./types` inherited the root barrel's habit before it inherited its contents, so
-  the names with an owner elsewhere were moved off it. The middleware types and the
-  five middleware factories — `pikkuMiddleware`, `pikkuMiddlewareFactory`,
-  `pikkuChannelMiddleware`, `pikkuChannelMiddlewareFactory` and
-  `pikkuAgentMiddleware`, runtime values on a types entry point — are now
-  `@pikku/core/middleware`; the function meta types are `@pikku/core/function`;
-  `SerializedError` is `@pikku/core/errors`; and the generic TypeScript helpers
-  (`MakeRequired`, `PickRequired`, `PickOptional`, `RequireAtLeastOne`,
-  `JSONPrimitive`, `JSONValue`) are `@pikku/core/utils`. What is left on `./types`
-  is the vocabulary the wirings share, which no single module owns.
-
-  `pikku` was itself a root barrel — `export * from '@pikku/core'` — and
-  now exports only the services it bundles.
-
-  One module survives at the old specifier, and only for the bootstrap:
-  `packages/cli` is generated by the _published_ CLI pinned in its `build.sh`, and
-  that CLI still writes a bare `@pikku/core` into the files it generates for the
-  CLI itself. `bootstrap-compat/root.ts` carries the eight types it names, a test
-  in core fails if that list grows, and it goes when the pin moves to a CLI
-  released from this branch. The adapter names the pinned CLI reaches for —
-  `pikkuState` and `CreateWireServices` — are rewritten to `@pikku/core/state` and
-  `@pikku/core/types` by the same `build.sh` patch pass, so no second shim is
-  needed for them.
-
-  A guard test keeps the root shut: it parses imports and rejects a bare
-  `@pikku/core` rather than grepping for it, because several tests hold a user's
-  file as a template literal, where `import … from '@pikku/core'` is fixture text
-  rather than an import this repo makes.
-
-  An agent scaffold a project generated under an older CLI is refreshed rather
-  than left to fail: `pikku all` already deleted one importing an entry point
-  `@pikku/core` no longer publishes, and the `#pikku` hub joins that list.
-  Without it a project that scaffolds the agent endpoint but
-  declares no agents keeps the old file forever — the generator that would rewrite
-  it only runs when agents exist, and the file being present is what stops it
-  being regenerated as missing.
-
-  `pikku new addon` also wrote a tsconfig `paths` map naming only the deleted hub.
-  An addon's `imports` map points into `dist`, so `paths` is what resolves
-  `#pikku/<leaf>` for the addon's own source build — it now names the two leaf
-  patterns, in both the addon and its test harness.
-
-- 786dae5: Bump every dependency whose latest release is a major across the monorepo, and
-  port the code the majors broke: `cookie` 2's `parseCookie`/`stringifySetCookie`
-  API in `@pikku/core` and the three runtime HTTP adapters, and assistant-ui 0.15's
-  store client in `@pikku/assistant-ui`.
-- 6eef0a0: Bump every dependency to its latest compatible minor/patch across the monorepo.
-- Updated dependencies [7722ceb]
-- Updated dependencies [375c1ff]
-- Updated dependencies [02a70cd]
-- Updated dependencies [aeef159]
-- Updated dependencies [a281de6]
-- Updated dependencies [266e3bc]
-- Updated dependencies [02a70cd]
-- Updated dependencies [786dae5]
-- Updated dependencies [6eef0a0]
-- Updated dependencies [3561d67]
-- Updated dependencies [a91c433]
-- Updated dependencies [02a70cd]
-- Updated dependencies [9537f74]
-- Updated dependencies [2b57ca8]
-- Updated dependencies [266e3bc]
-- Updated dependencies [9fce0f1]
-- Updated dependencies [83683a0]
-- Updated dependencies [456c88b]
-- Updated dependencies [456c88b]
-- Updated dependencies [c127273]
-  - @pikku/core@0.12.85
-
-## 0.12.18
-
-### Patch Changes
-
-- 7406bfe: Rename the agent runtime from `AI*` to `Agent*` (#596)
-
-  `AI` described the model provider, not the thing being named. Every symbol that
-  belongs to the agent runtime now says `Agent`; the symbols that genuinely wrap a
-  model provider — `AIEmbeddingService`, `AIProviderOptions`, `AIEmbedParams`,
-  `AITranscriptionParams`, `AIGenerateImageParams` and their siblings, and the
-  `@pikku/ai-vercel` / `@pikku/ai-deepinfra` / `@pikku/ai-voice` packages — keep
-  their names.
-
-  **Wiring**
-  - `pikkuAIAgent` → `pikkuAgent`, `pikkuAIScorer` → `pikkuAgentScorer`,
-    `pikkuAIJudge` → `pikkuAgentJudge`
-  - `CoreAIAgent` → `CoreAgent`, `AIAgentInput` → `AgentInput`, `AIAgentStep` →
-    `AgentStep`, `AIMessage` → `AgentMessage`, and the rest of the agent types
-  - `AIAgentRunnerService` → `AgentRunnerService`, `AIStorageService` →
-    `AgentStorageService`, `AIRunStateService` → `AgentRunStateService`
-
-  **Entry points**
-
-  `@pikku/core/agent` → `@pikku/core/agent`, `@pikku/core/agent-scorer` →
-  `@pikku/core/agent-scorer`.
-
-  **Queues**
-
-  The scorer queues are now `agent-score-fast` and `agent-score-slow`. Drain the
-  old `ai-score-fast` / `ai-score-slow` queues before deploying — jobs still
-  sitting on them when the new workers start will never be picked up.
-
-  **Scaffolds**
-
-  The agent scaffold pikku wrote for your project — `<scaffold>/agent/agent.gen.ts`
-  and its schemas file — imports `@pikku/core/ai-agent`, which no longer exists. A
-  scaffold is normally written once and then left alone, so `pikku all` would find
-  it present and leave the broken import in place. It now deletes an agent scaffold
-  importing either removed entry point and regenerates it in the same run. Anything
-  you added to that file goes with it, so move local edits out first.
-
-  **Database**
-
-  The agent tables are renamed: `ai_threads`, `ai_message`, `ai_tool_call`,
-  `ai_working_memory`, `ai_run` and `ai_run_score` become `agent_threads`,
-  `agent_message`, `agent_tool_call`, `agent_working_memory`, `agent_run` and
-  `agent_run_score`, along with their indexes and the `ai_working_memory_pk`
-  constraint. The same rename applies to the MongoDB collections.
-
-  `ensurePikkuSchema` creates tables it cannot find, so an existing database will
-  get empty `agent_*` tables and leave the old data stranded in `ai_*`. Rename
-  them before the first boot on the new version:
-
-  ```sql
-  ALTER TABLE ai_threads        RENAME TO agent_threads;
-  ALTER TABLE ai_message        RENAME TO agent_message;
-  ALTER TABLE ai_tool_call      RENAME TO agent_tool_call;
-  ALTER TABLE ai_working_memory RENAME TO agent_working_memory;
-  ALTER TABLE ai_run            RENAME TO agent_run;
-  ALTER TABLE ai_run_score      RENAME TO agent_run_score;
-  ```
-
-- 6794681: Publish the ecosystem surface as per-area sub-barrels under `@pikku/core/ecosystem/*`, and point generated code, the CLI, the inspector and the runtime adapters at them.
-
-  348 names that only generated code, the toolchain or a runtime adapter ever imports now have a second home on `@pikku/core/ecosystem/<area>` — one sub-barrel per area, matching how core already publishes its entrypoints, so no single barrel grows without bound and a consumer only pulls in the area it uses.
-
-  This step is additive: every name is still exported from the entrypoint it was published from before, so nothing downstream breaks. Removing them from the app-facing barrels is a later change, and needs a release carrying `./ecosystem/*` first.
-
-- Updated dependencies [7406bfe]
-- Updated dependencies [6794681]
-  - @pikku/core@0.12.84
-
-## 0.12.17
-
-### Patch Changes
-
-- fd9d834: Stop publishing internals that only their own package or file used. The declarations stay; only the entrypoint re-export is removed, so nothing that imported a name from where it is declared is affected.
-- Updated dependencies [063f43a]
-- Updated dependencies [ce66bf8]
-- Updated dependencies [d0307a8]
-- Updated dependencies [ce66bf8]
-- Updated dependencies [3ad2131]
-- Updated dependencies [b930dca]
-- Updated dependencies [b95e77d]
-- Updated dependencies [fd9d834]
-- Updated dependencies [8978fbd]
-  - @pikku/core@0.12.82
-
-## 0.12.16
-
-### Patch Changes
-
-- e110c55: Add runtime scoring for AI agents: `pikkuAIScorer` for heuristic grades and
-  `pikkuAIJudge` for LLM-judged ones, graded off the request path on two queue
-  lanes so a slow judge cannot starve the cheap checks. Grades are sampled
-  deterministically per `(run, scorer)` and persisted to `ai_run_score`.
-- Updated dependencies [e110c55]
-- Updated dependencies [e110c55]
-- Updated dependencies [e110c55]
-- Updated dependencies [acc8077]
-- Updated dependencies [905f737]
-- Updated dependencies [3cc6428]
-- Updated dependencies [c524adf]
-- Updated dependencies [e110c55]
-  - @pikku/core@0.12.81
-
-## 0.12.15
-
-### Patch Changes
-
-- 6dada45: fix(workflow,ai-agent): make a run's owner, entry node and step function authoritative
-
-  A graph run may only start at a node the graph declared in `meta.entryNodeIds`, and
-  the generated `POST /workflow/:workflowName/graph/:nodeId` route that let an HTTP
-  caller pick the entry node is gone. `startNode` stays for `PikkuTriggerService`,
-  which names a declared entry node anyway.
-
-  `StepState` now records the `rpcName` the workflow dispatched a step with, and the
-  step claim rejects a queue message naming a different function with
-  `WorkflowStepFunctionMismatchError` before mutating any status — a step runs under
-  the run owner's identity and without the `expose` gate, so the message must not
-  choose what runs.
-
-  `approveStep` takes the caller's session, and the generated status routes and
-  streams assert the same `assertWorkflowRunOwner` check: a run started through a
-  session may only be read and approved by that session's user. A run with no
-  recorded owner (trigger, scheduler, unauthenticated route) has nobody to compare
-  against and is still gated by the entrypoint's own `auth`/`permissions`.
-
-  `AIRunStateService.resolveApproval` is now a compare-and-swap returning whether
-  _this_ caller made the claim, and both agent resume paths run a tool only for the
-  approvals they claimed — concurrent approvals of one tool call no longer all
-  execute it.
-
-- Updated dependencies [41c1a95]
-- Updated dependencies [ce96383]
-- Updated dependencies [7e60867]
-- Updated dependencies [f8f1244]
-- Updated dependencies [dcf20cb]
-- Updated dependencies [6512384]
-- Updated dependencies [e3b4c14]
-- Updated dependencies [efd0ed1]
-- Updated dependencies [cba98fb]
-- Updated dependencies [ce96383]
-- Updated dependencies [f8f1244]
-- Updated dependencies [f8f1244]
-- Updated dependencies [6e93a35]
-- Updated dependencies [6dada45]
-  - @pikku/core@0.12.80
-
-## 0.12.14
-
-### Patch Changes
-
-- 78b29f0: `SecretService` now returns a `SecretValue<T>` rather than the bare value, so a
-  vault secret cannot reach a sink by accident.
-
-  `SecretValue` is nominally typed, which means it is not assignable to `string`
-  (or to any other concretely-typed field). Every sink with a real type — a
-  database column, an email body, a session payload — rejects it with no lint
-  rule involved. The sinks typed `any`, `unknown`, or a free generic — the logger,
-  queue payloads, webhook and email inputs, and a function's own output — are
-  guarded with `Safe<T>`, which collapses a `SecretValue` found anywhere inside
-  `T`, however deeply nested, to `never`.
-
-  Unwrap deliberately at the point the secret reaches the wire:
-
-  ```ts
-  const secret = await secrets.getSecret('BETTER_AUTH_SECRET')
-  betterAuth({ secret: secret.reveal() })
-  ```
-
-  Two behaviours cover what types cannot see. Structured serialization redacts —
-  `JSON.stringify` and node's inspect both yield `[secret]`, so an audit or log
-  write stays honest without crashing the request. String coercion throws
-  `SecretCoercionError`, because a template literal is always a leak.
-
-  `AuditLog.write` is guarded the same way as the logger, since an audit event
-  carries `input` and `metadata` as `unknown` and nominality alone cannot stop a
-  secret landing in one.
-
-  `.reveal()` is the deliberate escape hatch, and what it hands back is an
-  ordinary string as far as every sink signature is concerned. **PKU953** closes
-  that gap: under `pikku all --security` the inspector reports a revealed secret
-  that flows into a logger, an audit, a queue, an email or a webhook — `console` included.
-
-  This also fixed a real one: `remote-addon-auth.ts` called `String(token)` on an
-  `unknown` and wrote the result straight into an `Authorization` header.
-
-- Updated dependencies [62ea4cc]
-- Updated dependencies [9dddff8]
-- Updated dependencies [78b29f0]
-  - @pikku/core@0.12.76
-
-## 0.12.13
-
-### Patch Changes
-
-- 6a307f0: Fix four latent correctness bugs in the function, RPC and error runtimes, and
-  remove dead code from the workflow service surface.
-
-  `WorkflowService.getNodesWithoutSteps` is gone. It was declared on the abstract
-  service and implemented by all five storage backends, and nothing ever called
-  it — hence the non-core packages in this changeset, which only lose that method.
-
-  **An RPC could execute twice.** `RPCService.invoke`, its addon path, and
-  `rpcWithWire` each wrapped the _execution_ of a resolved function in a `try`
-  whose `catch` treated `RPCNotFoundError` as "not found locally" and re-dispatched
-  the call through `deploymentService`. A nested `rpc.invoke` to a missing name,
-  raised from inside an already-running function, therefore re-ran that function on
-  a remote instance after its local side effects had already committed. Resolution
-  is now separated from execution on all three paths, so only a genuinely
-  unresolvable name reaches the fallback. What escapes to callers is unchanged.
-
-  **`addonNamespace` leaked between sibling calls.** The function runner's
-  middleware path restored `rpc`, `functionId`, `audit` and `addonNamespace` after
-  an invocation; the non-middleware path restored the first three but not the
-  fourth. A call into an addon function with no middleware left the addon's
-  namespace on the wire, so subsequent sibling calls resolved the wrong
-  per-instance singletons and `credentialOverrides`.
-
-  **Errors registered on a subclass never resolved.** `misc.errors` was typed
-  `Map<PikkuError, ErrorDetails>` — instances — while `addError` stores
-  constructors, a mismatch hidden by its `error: any` parameter. The instance
-  lookup in `getErrorResponse` was consequently dead, and lookup fell through to a
-  scan comparing `constructor.name`, so a subclass of a registered error got no
-  status mapping at all. The map is now typed `Map<PikkuErrorConstructor, …>` and
-  lookup walks the prototype chain first. Name matching is retained, deliberately,
-  as the fallback that keeps error mapping working when two copies of
-  `@pikku/core` are installed.
-
-  **`createWeakUID` collided across instances.** The prefix was
-  `Date.now().toString(36)` evaluated at module load, so any two instances loading
-  the module in the same millisecond emitted identical `channelId` and `requestId`
-  sequences — reproducibly, not just in principle. It is now seeded lazily from
-  `crypto.randomUUID()`.
-
-  Also: `pikkuState` keys its global map with `Symbol.for` rather than `Symbol`, so
-  two copies of the package share registrations instead of silently getting
-  disjoint state; and the local channel upgrade path no longer keys its middleware
-  cache on the raw request path, which grew the cache without bound while the
-  cached value never varied by path.
-
-- afef587: Close eleven security weaknesses found in a review of `@pikku/core`. Most are
-  breaking, and two invalidate data or credentials already in the wild — read the
-  migration notes before upgrading.
-
-  **Breaking: AI agent thread ownership now fails closed.** Reading, listing,
-  resuming or approving an existing thread or run requires a resolved session
-  principal (`userId`, or `orgId` for `sessionScope: 'org'`), regardless of the
-  agent's `auth` setting. Previously a request without a session had no ownership
-  model at all: the caller-supplied `resourceId` was accepted as the ownership
-  key, so any caller could read or resume another party's thread by naming its
-  `resourceId`. Worse, `threadOwnerConstraint` returned `undefined` for a
-  sessionless caller, and `undefined` means _no filter_ rather than _no rows_ —
-  so `getAgentThreads` returned every thread in the deployment. It now returns
-  `string[]`, empty for a sessionless caller, which every storage backend already
-  treats as matching nothing. Sessionless agents still run one-shot conversations,
-  each with a fresh unguessable owner; what they lose is cross-request continuity.
-  Wire a session to restore it.
-
-  **Breaking: stored secrets and credentials must be re-entered.** `deriveKey` ran
-  a single unsalted round of SHA-256 over the passphrase and used the digest
-  directly as the AES-GCM key — roughly one hash per brute-force guess, with one
-  rainbow table working against every deployment. It is now PBKDF2-HMAC-SHA256 at
-  600,000 iterations over a random salt. There is no compatibility path: every
-  value held by the kysely, mongodb and redis secret services and the kysely
-  credential service becomes undecryptable. They fail loud, naming the key and
-  `key_version`, so the app hard-fails on first secret read until each is re-set.
-
-  The KEK salt is scoped to the key version and stored alongside it, rather than
-  per secret, so a bulk read costs one derivation instead of N — `getSecrets` over
-  50 secrets went from ~2.3s to ~48ms, and rotation from ~4.6s to ~94ms. This adds
-  a salt table (kysely), hash field (redis) or collection (mongodb), created
-  automatically on first use.
-
-  **Breaking: `PIKKU_REMOTE_SECRET` must be at least 32 characters.** The
-  remote-RPC session envelope moved from PBKDF2 to HKDF, which expands
-  high-entropy key material rather than stretching a low-entropy passphrase. That
-  took a remote hop from ~269ms to ~0.4ms — PBKDF2 was running twice per request —
-  but HKDF supplies no brute-force resistance, so the secret must carry the
-  entropy itself. A shorter secret now throws `WeakKeyMaterialError` at both ends.
-  Generate one with `openssl rand -base64 32` and roll it out to every service in
-  the mesh together: existing bearer tokens are format-incompatible, so a partial
-  rollout produces 401s until every instance is updated. The Cloudflare, Lambda
-  and Azure deployment services each hand-rolled a copy of `buildRemoteHeaders`
-  and now call the shared one, which is what keeps the two sides in step.
-
-  **Breaking: previously signed content URLs stop verifying.** `LocalContent`
-  signed only `{signedAt, expiresAt, notBefore}`, so a signature proved when a URL
-  was issued but never what it was issued for — any valid token was a skeleton
-  key, and swapping the pathname from a public thumbnail to a private document
-  still verified. The signature now binds the request path. Separately, the
-  verifier returned "valid" when no JWT service was wired, which is how
-  `pikku serve` ran: a forged `?signedAt=0&expiresAt=99999999999999` was accepted.
-  It now rejects with 403, `LocalContent` requires a `JWTService`, and
-  `pikku serve`/`pikku dev` mint an ephemeral per-process signing key so local
-  development works without shipping a fail-open path. In-flight signed URLs must
-  be re-issued.
-
-  **Request body size limits now apply to every adapter.** The `maxBodySize` cap
-  existed only in `PikkuFetchHTTPRequest`. The real hole was uWebSockets, which
-  drove `res.onData` itself and concatenated every chunk with no bound and nothing
-  downstream able to intervene; it now drops chunks past the limit and replies 413
-  before routing. Fastify delegates to its native `bodyLimit` (set only when
-  `maxBodySize` is configured, so fastify's stricter 1 MB default is never
-  loosened), and `PikkuExpressServer` feeds the limit into its body parsers. Two
-  paths can only reject rather than prevent, and are documented as such:
-  `express-middleware` mounted on your own app receives an already-parsed body, so
-  that deployment must bound its own parser; Next server actions bottom out at
-  `experimental.serverActions.bodySizeLimit`.
-
-  **Breaking: the console addon's privileged functions are gated by default.**
-  `wireAddon` gains a `scopes` option that applies to every function in the
-  addon's namespace, and the console scaffold now generates
-  `wireAddon({ name: 'console', package: '@pikku/addon-console', scopes: ['admin'] })`.
-  Previously the console's entire privileged surface — around 54 functions
-  including `credentialGet`, which returns a resolved OAuth token for an arbitrary
-  `userId`, `updateFunctionBody`, and `installAddon`, which shells out to a
-  package install — was protected only by an optional host-registered
-  `addGlobalPermission`. `resolveGlobalPermissions` returns `[]` when none is
-  registered and permission checking then no-ops, so an app that never registered
-  one served those functions to anyone, and with the template's default
-  `scaffold.rpc: "no-auth"` that meant unauthenticated. All of them now return 403
-  `MissingScopeError` without an `admin`, `admin:*` or `*` scope. **Regenerating
-  is required** — an app holding an old `console.gen.ts` stays open.
-  `installAddon` and `installOpenapiAddon` additionally declare their own
-  `auth: true, scopes: ['admin']`, and `getAgentThreads` now scopes its listing to
-  the session's own threads unless the caller holds admin.
-
-  Addon scopes are enforced in `runPikkuFunc` rather than at the RPC boundary,
-  because a wiring can reference an addon function directly — the inspector
-  records the addon's `packageName` on HTTP, channel, schedule, queue, CLI,
-  trigger, gateway and MCP wirings — and those paths never call `resolveNamespace`.
-  Enforcing at the RPC seam would have covered only the `namespace:function` form
-  while reading as complete.
-
-  **Breaking: `wireAddon`'s `auth` and `tags` now apply on direct wirings too.**
-  Both were read only by `resolveAddonFunction`, so they had exactly the hole
-  scopes had: `wireAddon({ name: 'console', package: '@pikku/addon-console', auth:
-true, tags: ['admin'] })` gated `rpc('console:credentialGet')` and gated nothing
-  at all on an HTTP route wired straight to `credentialGet`. A consumer who
-  reached for the documented way to lock an addon down got a control that was
-  silently inert on every wiring except one. Both now resolve in `runPikkuFunc`.
-  `auth` merges as an OR — `auth: false` from an addon is ignored on a direct
-  wiring, because an addon may require a session the wiring did not but must never
-  waive one it did. Addon tags resolve to concrete middleware against the **root**
-  tag groups before the call rather than being folded into the function's
-  inherited middleware: `addTagMiddleware('admin', …)` is written by the consuming
-  app and registers under the root package, whereas `combineMiddleware` would look
-  the tag up under the addon's own `packageName`, where it does not exist.
-
-  One consequence worth naming: an addon that wires `auth: true` and also runs its
-  own sessionless internal work — a scheduled task or queue worker inside the
-  addon calling a sibling function — is now gated where it previously was not,
-  because a bare `rpc('fn')` from inside the addon reaches `runPikkuFunc` with the
-  addon's `packageName` like any other call. This reverses a decision that
-  deliberately scoped the gate to the namespaced boundary; that reasoning held
-  only while the boundary was real, and a direct wiring can enter an addon without
-  crossing it, so "already inside" is not something the runtime can infer. Such an
-  addon should carry authorization on the function via
-  `pikkuFunc({ permissions })`, which has always been enforced on every path. A
-  follow-up will add execution provenance so an intra-addon call can be
-  distinguished from an external one and skip the addon-level check; that needs a
-  marker no caller outside the process can set, which is its own design problem
-  and does not belong in a security fix.
-
-  **Codegen now warns when an exposed function has no gate (PKU574).** The
-  generated `POST /rpc/:rpcName` dispatcher forwards to `rpc.exposed`, which
-  refuses anything without `expose: true` — but nothing checked whether the
-  target was gated, because a dispatcher cannot know what it dispatches to. The
-  console shipped ~54 privileged functions through that gap and the toolchain was
-  silent. The inspector now reports every function that is exposed, sessionless,
-  and carries no `auth`, `scopes` or `permissions` of its own and none from a
-  governing `wireAddon`. It is a `warn`, not a critical: `expose: true` on an
-  ungated sessionless function is correct for a genuinely public endpoint, so it
-  blocks a build only under `--fail-on-warn`.
-
-  Two pieces of metadata were missing for this to be answerable statically, and
-  both are now recorded. A `pikkuSessionlessFunc`'s own `auth: true` was read at
-  runtime but never written to function meta, so a self-gated function was
-  indistinguishable from an ungated one — `sessionless` carries the baseline, and
-  `auth` now carries the tightening. And `wireAddon`'s `scopes`, `auth` and `tags`
-  were not parsed at all: the inspector recorded the addon's `rpcEndpoint` and its
-  secret, variable and credential overrides, and dropped every one of its gates.
-  An addon whose gates are not statically knowable is treated as gated, because a
-  false positive on a correctly-secured addon costs more than the one case it
-  would catch.
-
-  **Breaking: an application's global permissions now apply inside addons.**
-  `resolveGlobalPermissions` read only the bucket matching the function's own
-  package, but the generated `addGlobalPermission` wrapper takes no package
-  argument and always registers under the root. An app-wide rule like "every
-  request needs a signed-in user" therefore stopped at the addon boundary, and the
-  bucket an addon's functions did read was one no host could write to — which is
-  why the console addon's recommended `addGlobalPermission([isAdmin],
-'@pikku/addon-console')` was never a gate anybody could actually install. A
-  function now resolves the root bucket and its own package's, root first.
-  Unioning is safe in a way nothing else here would be: globals AND, so adding the
-  root ones can only tighten. Package buckets stay one-way — a package's globals
-  never reach root functions, or an installed addon could gate the whole
-  application. Apps with both a root global and addon-provided functions will see
-  those functions gated where they previously were not.
-
-  **Codegen now records whether each HTTP route requires a session, and warns
-  about inert addon tags (PKU575).** Four separate things can demand a session —
-  the function's `sessionless`, its own `auth`, the route's (or its group's)
-  `auth`, and the addon it belongs to — and answering "which routes are open?"
-  meant joining all four by hand and knowing which wins. Each route's meta now
-  carries the resolved `requiresSession` alongside the route's own `auth`. Scopes
-  count as requiring one, since they are matched against the session's and fail
-  closed. Anything not statically knowable resolves to `true`, matching PKU574:
-  a route that looks stricter than it is costs less than one that looks open and
-  isn't. Separately, `wireAddon({ tags: ['admin'] })` reads like a gate and is
-  applied like one right up until no `addTagMiddleware('admin', …)` exists, at
-  which point it resolves to an empty list and gates nothing; that now warns.
-  Only addon tags are reported — a tag on a function is as likely to be
-  organizational, and warning about those would bury the case that matters.
-
-  **Object-shorthand permissions were missing from meta.** The inspector visited
-  `ts.PropertyAssignment` but not `ts.ShorthandPropertyAssignment`, so
-  `permissions: { canAdminOrg }` — enforced identically to the longhand form at
-  runtime, since `verifyPermissions` has a non-array branch — was recorded as _no
-  permissions at all_. That is the most dangerous direction for meta to be wrong
-  in: an audit reading it sees an open door where one is shut. It cost this review
-  a false IDOR report across ~35 billing and org functions before the source
-  contradicted the metadata.
-
-  **Functions that authorize in their own body can say so.** A webhook receiver
-  verifying a signature, or a handler redeeming a signed invite, is genuinely
-  closed while carrying no session, scope or permission — indistinguishable in
-  meta from one nobody remembered to gate, and so warned about forever by PKU574.
-  `selfAuthenticated: true` on the function config records the claim and silences
-  the warning for that function. It is declarative only: nothing at runtime reads
-  it and it grants nothing. Detection was rejected deliberately — inferring it
-  from the body means a function that _looks_ like it checks something silences
-  the warning while checking nothing, and a warning that is usually wrong stops
-  being read.
-
-  **Breaking: `scaffold.<feature>` is now `boolean | { auth?, path? }`, and `true`
-  means authenticated.** The old `'auth' | 'no-auth' | false` read like a
-  starter-file preference while being a live authorization decision, set three
-  directories from the functions it governed — the shape the console incident
-  took. A surface now becomes public only by writing `{ auth: false }`, so
-  omitting a field can never open anything: the failure mode of a forgotten flag
-  is a locked door. `{ path }` additionally overrides where the file is
-  generated, which previously could only be set for all features at once via
-  `pikkuDir`.
-
-  The legacy strings are **refused, not coerced**. `resolveScaffoldFeature` throws
-  naming the key and its replacement (`"rpc": "no-auth"` → `"rpc": { "auth":
-false }`), and it does so at config load, not downstream. An earlier design used
-  a bare `string` for the output path, under which `"no-auth"` would have parsed
-  as a file named `no-auth` and every unmigrated config would have silently
-  produced nonsense; the object form makes any string invalid, so the failure is
-  loud.
-
-  The collapse is deliberately not uniform in effect. For `rpc` the flag was a
-  blanket "no anonymous RPC in this app" set on a dispatcher that cannot know what
-  it dispatches to; for `userAdmin` it was redundant, since the generated
-  functions are already `pikkuFunc` with `scopes: ['admin:users:list']`. But for
-  `agent`, `workflow`, `events` and `scenarios` it is the only gate — those
-  generate real endpoints the app never authors — so `true` keeps them
-  authenticated rather than opening them as a side effect of a config cleanup.
-  `webhook` and `remoteRpc` have no auth dimension at all (`serialize-remote-rpc.ts`
-  hardcodes `auth: false`), so an `{ auth }` on them is ignored. The three
-  configs in this repo are migrated preserving their current behaviour exactly.
-
-  **Queue job identities are signed.** A job carried the producer's `pikkuUserId`
-  as a plain string and the worker resolved a session from it with no
-  verification, so write access to the queue backend was act-as-any-user. The
-  identity is now `pq1.<claim>.<hmac>`, HMAC-SHA256 over the claim and the
-  canonicalized job payload, keyed by HKDF expansion of a new
-  `PIKKU_QUEUE_IDENTITY_SECRET`. Producers opt in by wrapping their queue service
-  with `SignedQueueService`. This fails safe rather than closed: with no secret
-  configured the identity is dropped and jobs still process, warning once per
-  process, so no existing deployment breaks on upgrade — it simply loses queue
-  identity until the secret is set. The payload rather than the job id is bound
-  because SQS, Cloudflare Queues, Azure and the in-memory service all mint ids
-  after `add` returns.
-
-  **Workflow inline state is read from the run record.** `isInline` consulted a
-  process-local `Map`, while `WorkflowRun.inline` is durable. Any instance that
-  did not start a run disagreed with the record, so one instance could dispatch a
-  queued job for a workflow another was already executing in-process. It is now
-  async and resolves through the durable identity, cached only when a context
-  already exists so a passive reader allocates nothing. The same `Map` also leaked:
-  `nextStepKey` fabricated replay state on every step, and `releaseContext`
-  refused to free anything carrying it, so runs whose steps executed outside a
-  `beginReplay` bracket — the step-worker queue path — stranded their context and
-  step state for the process lifetime. Contexts are now released by an explicit
-  execution counter. Step ordinals reset per execution rather than accumulating
-  across step-worker invocations in one process, which makes step naming
-  independent of how work was distributed.
-
-  **Secret reads fail loud in every store.** `MongoDBSecretService.getSecrets`
-  skipped rows that failed to decrypt, and the redis equivalent dropped every
-  rejection via `Promise.allSettled`, including the "No KEK available for
-  key_version N" configuration error. Both now throw, naming the key and its key
-  version, matching the kysely behaviour. This matters most alongside the KEK
-  change above: without it, an upgrade surfaces as a partial secrets map and an
-  opaque downstream failure instead of an error naming the secret to re-enter.
-
-  **A second middleware registration for a pattern no longer erases the first.**
-  `addHTTPMiddleware`, `addTagMiddleware` and `addChannelMiddleware` groups are
-  keyed by pattern or tag and held one source file each, so a second file's call
-  overwrote the first's. Codegen emits its imports from what is stored, so the
-  losing file was never imported and its middleware never registered — the
-  runtime composes repeated registrations for a pattern happily, and only codegen
-  dropped one. Adding an unrelated `addHTTPMiddleware('*', …)` to an app was
-  enough to silently unregister the generated better-auth session bridge, which
-  fails open and gives no sign until a request arrives without a session. A group
-  now carries every registration made for it, and all of them are imported.
-
-- Updated dependencies [6a307f0]
-- Updated dependencies [afef587]
-- Updated dependencies [8075f6a]
-  - @pikku/core@0.12.74
-
-## 0.12.12
-
-### Patch Changes
-
-- 8a2c993: Make the workflow service cheaper to run, and fix two ways it lost state.
-
-  The SQL workflow tables had no indexes at all, so every step read, every
-  history walk and every orchestrator tick was a sequential scan; five indexes
-  now cover the columns the engine actually queries by. A replay used to ask for
-  each step's row individually — O(N) reads per replay, O(N^2) over a run — and
-  now takes one read of the run's steps and serves the walk from it. A step
-  transition wrote the step row and its history row as two separate statements,
-  so a crash between them left a step saying `succeeded` whose history still said
-  `running`; both halves are now one transaction, and the history row is found by
-  attempt number rather than by sorting on `created_at`, which two attempts can
-  share. Resolving a dynamic workflow read and parsed every AI-generated workflow
-  in the deployment to `.find()` one by name; it is a point lookup now.
-
-  Waiting on a run no longer polls at a fixed interval. `pollIntervalMs` became a
-  ceiling rather than a cadence: polling starts at 10ms and widens towards it, so
-  a workflow that finishes in milliseconds is no longer held for a full second,
-  and a long-running one is not read at full rate for its whole life.
-
-  Two backend-specific defects: Redis kept a run's state as one JSON blob and
-  read-modified-wrote it, so parallel branches setting different variables
-  overwrote each other — state is a field per variable now, with the old blob
-  still read underneath so runs in flight keep what they had. Mongo's
-  `setStepScheduled` never wrote history, leaving a queued step reading as never
-  dispatched.
-
-  Also: dispatch no longer JSON round-trips every step payload before handing it
-  to a queue that serialises it anyway — the in-process dev queue, which is the
-  only one that was relying on it, does it itself now.
-
-  Two more defects. A transition whose step had no live attempt wrote its status
-  to the step row and silently nothing to history — the exact divergence the
-  transaction exists to prevent — and now repairs the step and writes the
-  missing row. And resolving a dynamic workflow was non-deterministic on all
-  three backends: a name can hold several active versions, and none of them
-  ordered the candidates, so which one ran could change between two calls
-  reading identical data. The newest version wins, with the graph hash breaking
-  a tie.
-
-  The two attempt columns and the five indexes are declared in the workflow
-  schema, so a fresh database gets them at boot. An existing one gets them from
-  a migration — `pikku db generate` writes the declaration down — rather than
-  from DDL issued at boot.
-
-- a261006: **Breaking:** removed dynamic workflows — runtime-defined workflow graphs stored in the database and resolved by name instead of by codegen.
-
-  The feature was already half-gone. Its authoring surface (`createAgentWorkflow`, `saveAgentWorkflow`, `listAgentWorkflows`, `executeAgentWorkflow`, and the AI-agent instruction builder) was deleted in April 2026 along with its entire e2e suite, and nothing has written a dynamic workflow since. What remained could not execute one either: `executeAgentWorkflow` gated on `pikkuState('workflows', 'meta')`, which only codegen ever populates, so a graph that existed solely in the database was never findable. The two backend families had also drifted onto different `source` sentinels (`'ai-agent'` vs `'dynamic-workflow'`), and the two Redis implementations disagreed on key escaping — so at least one of them matched nothing. Rather than keep shipping plumbing for a path no caller could complete, it is removed until it can be reintroduced deliberately.
-
-  Removed:
-  - `getAIGeneratedWorkflows` from `WorkflowService` and `WorkflowRunService`, and from every backend (in-memory, Redis, MongoDB, Kysely, and the Cloudflare Durable Object service and client — the last two were already a `return []` stub and a rejection).
-  - The database-lookup fallbacks in `startWorkflow` and `runWorkflowJob` that resolved a workflow name against stored graphs when static meta had no match.
-  - `'dynamic-workflow'` from the `WorkflowRuntimeMeta['source']` union.
-  - `validateWorkflowWiring` and `computeEntryNodeIds` from `@pikku/core/workflow`. These validated AI-authored graphs and had no callers in core; the inspector keeps its own private entry-node computation for static graph wiring, which is unaffected.
-  - The `workflow-created` AI stream event and its AG-UI `pikku:workflow-created` custom event. Its only emitter went with the April deletion, so it could never fire.
-  - The console's `console:getAIWorkflows` RPC, the `useAIWorkflows` hook, the "Dynamic" workflow filter and badge, and the trigger-schema scraper that derived an input form from a stored graph's `$ref` bindings.
-
-  Kept, because static graph workflows depend on them and this is not a change to versioning:
-  - `upsertWorkflowVersion`, `getWorkflowVersion`, `updateWorkflowVersionStatus`, and the `workflowVersions` storage in every backend. These back version-mismatch replay: when a deployed graph's hash changes, in-flight runs continue against the exact graph they started on. No schema migration is needed — the table, its columns, and its `(workflowName, graphHash)` upsert key are unchanged.
-  - `generateMermaidDiagram`, which renders any workflow graph and is not specific to dynamic ones.
-
-  Static `pikkuWorkflowGraph` and DSL workflows are entirely unaffected: they resolve from codegen'd meta, which was always the only path that worked.
-
-  To revive this post-MVP, the deleted authoring code is recoverable in full — its prompt engineering (a compact tool table upfront, full schemas with flattened dotted output paths returned only after a validation failure) is worth reading before rewriting:
-
-  ```
-  git show f52f3308b^:packages/core/src/wirings/ai-agent/agent-dynamic-workflow.ts
-  git show f52f3308b^:packages/core/src/wirings/workflow/graph/graph-validation.ts
-  git show f52f3308b --stat   # the April removal, incl. the three e2e feature files
-  ```
-
-  Note that reviving it needs more than restoring those files: the queued-step path (`executeWorkflowStep`), `onError` compensation, and sub-workflow resolution all read static meta only and would need a fallback for a graph that exists solely in the database.
-
-- Updated dependencies [8a2c993]
-- Updated dependencies [a261006]
-- Updated dependencies [09973b9]
-  - @pikku/core@0.12.71
-
-## 0.12.11
-
-### Patch Changes
-
-- e3d4454: Add job groups, so one shared queue can stay fair without splitting into one
-  queue per producer.
-
-  A job may now carry `group: { id, tier }`, and a worker may cap how many jobs
-  of any one group run at once via `groupConcurrency`. On pg-boss this maps to
-  `localGroupConcurrency`, which excludes at-capacity groups from the fetch query
-  itself, so a capped group costs nothing rather than being fetched and restored.
-  BullMQ declares it unsupported (groups are a BullMQ Pro feature) — being
-  push-based, it can simply use a queue per group at no polling cost.
-
-  Workflow services accept a `queueStrategy`. The default `'per-workflow'` is
-  unchanged: every workflow gets its own `wf-orchestrator-*` / `wf-step-*` queue,
-  which is also what lets serverless providers deploy one unit per workflow. The
-  new `'shared-groups'` routes every workflow through the shared
-  orchestrator/step-worker queues and isolates them by group instead, so a
-  monolith runs one set of pollers rather than one per workflow — on a
-  pull-based backend with dozens of workflows that is the difference between
-  hundreds of poll loops and twenty. It is for single-process runtimes only; a
-  per-unit serverless deploy still needs the per-workflow queues to route to its
-  units.
-
-- Updated dependencies [24252b8]
-- Updated dependencies [e3d4454]
-  - @pikku/core@0.12.69
-
-## 0.12.10
-
-### Patch Changes
-
-- 4324652: Scope AI agent thread reads to the calling session.
-
-  The generated thread-management functions (`getAgentThreads`,
-  `getAgentThreadMessages`, `getAgentThreadRuns`, `deleteAgentThread`) keyed purely
-  off a caller-supplied `threadId` and treated `resourceId` as an optional filter,
-  so omitting it enumerated every tenant's threads.
-  - `listThreads` gains an `owners` **authorization constraint** (distinct from the
-    `resourceId` filter): an empty array matches nothing, and it is always derived
-    from the session, never from input. Implemented across the Kysely, Redis and
-    MongoDB agent run services, with LIKE/regex metacharacter escaping so an owner
-    id containing `_` or `%` cannot match a foreign owner.
-  - The three `threadId`-keyed functions are now guarded by an `isThreadOwner`
-    `pikkuPermission` rather than an in-body check. A thread that does not exist is
-    denied rather than 404'd, so it is indistinguishable from one owned by someone
-    else.
-  - New `@pikku/core/ai-agent` helpers: `canAccessThread`, `threadOwnerConstraint`,
-    `sessionPrincipals`, `isOwnedByPrincipal`.
-
-  Services destructured by a wired function are now non-optional inside it.
-
-  The inspector already aggregated the services used by every wired `func`,
-  `permissions` and `middleware` into `RequiredSingletonServices`, but the
-  generated function types defaulted their service parameter to the raw `Services`
-  — so a service declared `foo?: Foo` still arrived as possibly-undefined, forcing
-  `if (!foo) throw new MissingServiceError(...)` guards that could never fire.
-  Generated types now expose `WiredSingletonServices` / `WiredServices`
-  (`RequiredSingletonServices & Services`) and default the `RequiredServices`
-  generic of functions, permissions, middleware, auth and approval-description
-  helpers to them. Optionality now means only what it should: "this service may
-  not be created, because nothing uses it".
-
-- Updated dependencies [5f19016]
-- Updated dependencies [78e4778]
-- Updated dependencies [4324652]
-- Updated dependencies [de044f8]
-- Updated dependencies [cd1a811]
-- Updated dependencies [19fa6f0]
-- Updated dependencies [b501612]
-- Updated dependencies [eb37b1e]
-  - @pikku/core@0.12.66
-
-## 0.12.9
-
-### Patch Changes
-
-- 41ce2cb: Upgrade to TypeScript 6 and raise the minimum Node.js version to 22.
-
-  All packages now build against `typescript@^6.0.3` and declare `engines.node >= 22`. Internal tooling (`ts-json-schema-generator`, `zod-to-ts`) was bumped to TypeScript 6-compatible releases.
-
-- Updated dependencies [41ce2cb]
-  - @pikku/core@0.12.44
-
-## 0.12.8
-
-### Patch Changes
-
-- 72694f6: feat(workflow): expose per-step attempt count + record running/succeeded/failed timestamps
-
-  `getRunStatus` now returns `attempts` (the latest attempt count) per step, so
-  consumers can show retry counts without a second history query. It already
-  computed `duration` from `runningAt`/`succeededAt`, but the kysely and mongodb
-  workflow stores only stamped those timestamps on the _insert_ path — the
-  `running` / `succeeded` / `failed` status transitions updated the history row's
-  status without setting `runningAt` / `succeededAt` / `failedAt`, so `duration`
-  was always undefined. The transitions now stamp the matching timestamp, so step
-  duration is populated for kysely- and mongodb-backed runs. (Redis already
-  stamped on transition.) A shared service-suite test guards both behaviours.
-
-- Updated dependencies [4be205f]
-- Updated dependencies [061c717]
-- Updated dependencies [2c55e13]
-- Updated dependencies [c745c26]
-- Updated dependencies [57900b5]
-- Updated dependencies [72694f6]
-  - @pikku/core@0.12.39
-
-## 0.12.7
-
-### Patch Changes
-
-- 92cd5b1: feat(workflow): workflow-owned step retries + stable invocationId
-
-  The workflow — not the queue — now owns step retry policy, and each step
-  invocation gets a stable idempotency key.
-  - **Default `retries: 5` with exponential backoff.** A step with no `retries`
-    previously inherited the queue's bare default (e.g. pg-boss `retry_limit 2`,
-    no backoff) so retries fired instantly and couldn't outlast a transient
-    outage. Retries now default to 5 with backoff, resolved at the workflow layer.
-  - **`retries: 0` is honored.** Dispatch previously passed `undefined` options
-    for `retries: 0`, letting the queue re-run a non-idempotent step up to its own
-    default. The resolved policy now always sets `attempts` (`retries: 0` →
-    `attempts: 1`), so the queue never second-guesses the workflow. The persisted
-    step retries and the dispatched `attempts` are resolved together so
-    "retries exhausted" and "no more redeliveries" are the same event.
-  - **`workflowStep.invocationId`** — a deterministic, dependency-free
-    `uuidv5(runId:stepName)` handed to every step. Unlike `stepId` (minted per
-    attempt), it is identical across retries, so a step can dedupe on it
-    (`ON CONFLICT (invocationId)`, Stripe idempotency keys, etc.).
-  - **queue-bullmq**: `mapPikkuJobToBull` now maps `backoff` (previously dropped,
-    so a step's backoff silently never applied on Redis), and `registerQueues`
-    throws a clear error when no logger is available (matching queue-pg-boss).
-  - **Dispatch failures are recoverable, not fatal.** A step is now marked
-    `scheduled` only _after_ it is successfully handed to its transport (queue or
-    scheduler) — a failed hand-off leaves it `pending` so a replay re-dispatches
-    it, instead of stranding it in `scheduled` (replay would pause forever on a
-    job that was never enqueued). A transport outage (e.g. pg-boss momentarily
-    down) is surfaced as a new `WorkflowDispatchException`, which the orchestrator
-    treats as transient: the run is left running and the orchestrator job is
-    rethrown for redelivery (it replays idempotently from the snapshot) rather
-    than the whole run being marked `failed`. The orchestrator job now also
-    carries its own retry policy, so this holds even when the orchestrator queue
-    is configured `retry_limit 0`. A genuine step error still fails the run.
-  - **Same step name can be invoked multiple times in one run.** Step rows are now
-    keyed per _invocation_: the Nth reach of a step name in a replay resolves to a
-    physical key (`name` for the first, `name#N` for repeats), so a literal
-    duplicate name no longer clobbers the earlier step's state. The first reach
-    keeps the bare name, so existing rows, graph-node matching and `invocationId`s
-    are unchanged. Ordinals are derived deterministically from DSL execution order
-    and reset each replay.
-  - **Step provenance (`fromStepName`) + graph cycles.** Every step now records
-    the predecessor it was scheduled from (`fromStepName`; entry steps have none),
-    persisted on the step row across all stores (in-memory, kysely, redis,
-    mongodb, cloudflare DO) and carried in the queued payload. The DSL wire
-    exposes the derived `fromInvocationId` (`uuidv5(runId:fromStepName)`) so
-    consumers get the stable predecessor key without a second persisted id —
-    `fromStepName` is the source of truth (it is replay-deterministic; `stepId`,
-    minted per row, is not). This makes the walked path reconstructable even when
-    a node is reached more than once: in `a → b → a → c` the second `a` is a
-    distinct ordinal instance (`a#1`) whose `fromStepName` is `b`.
-    The graph runner now supports **cycles**: a forward edge into an
-    already-started node still collapses to a single run (joins/diamonds are
-    unchanged), but a _back-edge_ — one whose target can reach its source — fires
-    a fresh ordinal instance, so a node can loop back to itself. Termination is
-    the graph's responsibility (branch routing must converge); the engine enforces
-    no visit cap.
-
-- Updated dependencies [92cd5b1]
-  - @pikku/core@0.12.38
-
-## 0.12.6
-
-### Patch Changes
-
-- 4b5c75b: feat(auth-js): wire OIDC config (issuer/tenantId) as variables, expand provider registry
-  - Move `issuer` and `tenantId` out of the secret blob for OIDC providers (auth0, okta, azure-ad, keycloak, cognito, microsoft-entra-id) — they are public config URLs, not secrets. Now registered via `wireVariable` and loaded at runtime via `services.variables.get()`.
-  - Expand provider registry from 13 to 31 providers: reddit, notion, instagram, zoom, figma, tiktok, threads, patreon, dropbox, bitbucket, hubspot, salesforce, atlassian, strava, keycloak, cognito, microsoft-entra-id added.
-  - `serialize-auth-gen` emits `wireVariable({...})` declarations and `services.variables.get()` calls in the generated factory for OIDC providers.
-  - Integration verifier exercises real `/auth/providers` endpoint with `LocalSecretService` + `LocalVariablesService`, including a spy test proving `services.variables.get('AUTH0_ISSUER')` is called at request time.
-
-- Updated dependencies [4b5c75b]
-- Updated dependencies [4b5c75b]
-  - @pikku/core@0.12.27
-
-## 0.12.5
-
-### Patch Changes
-
-- b9ed73e: Add deterministic workflow planned-step metadata support and SSE init stream payload generation.
-  - Persist `deterministic` and `plannedSteps` on workflow runs in core and service adapters.
-  - Expose planned-step metadata on workflow run status responses.
-  - Emit an initial `type: 'init'` SSE event for deterministic workflow streams before incremental updates.
-  - Add CLI tests covering serialized stream route output for init/update/done event behavior.
-
-- Updated dependencies [b9ed73e]
-  - @pikku/core@0.12.19
-
-## 0.12.4
-
-### Patch Changes
-
-- 311c0c4: Unify session persistence through SessionStore, remove session blob from ChannelStore
-  - PikkuSessionService now persists sessions via SessionStore on set()/clear() instead of every function call
-  - ChannelStore no longer stores session data — maps channelId to pikkuUserId only
-  - ChannelStore API: setUserSession/getChannelAndSession replaced with setPikkuUserId/getChannel
-  - Serverless channel runner resolves sessions from SessionStore using pikkuUserId from ChannelStore
-
-- Updated dependencies [311c0c4]
-  - @pikku/core@0.12.18
-
-## 0.12.3
-
-### Patch Changes
-
-- a2ee6d0: Replace process.exit(1) with thrown error on MongoDB connection failure to allow graceful error handling.
-- 87433f0: Validate state key names in updateRunState to prevent MongoDB operator injection.
-- Updated dependencies [e412b4d]
-- Updated dependencies [53dc8c8]
-- Updated dependencies [0a1cc51]
-- Updated dependencies [0a1cc51]
-- Updated dependencies [0a1cc51]
-- Updated dependencies [0a1cc51]
-- Updated dependencies [0a1cc51]
-- Updated dependencies [0a1cc51]
-- Updated dependencies [0a1cc51]
-- Updated dependencies [0a1cc51]
-- Updated dependencies [0a1cc51]
-- Updated dependencies [8b9b2e9]
-- Updated dependencies [8b9b2e9]
-- Updated dependencies [b973d44]
-- Updated dependencies [8b9b2e9]
-- Updated dependencies [8b9b2e9]
-  - @pikku/core@0.12.9
-
-## 0.12.2
-
-### Patch Changes
-
-- 3e79248: Add setStepChildRunId to workflow service implementations and auto-bootstrap in pikku all
-- Updated dependencies [bb27710]
-- Updated dependencies [a31bc63]
-- Updated dependencies [3e79248]
-- Updated dependencies [b0a81cc]
-- Updated dependencies [6413df7]
-  - @pikku/core@0.12.6
-
-## 0.12.1
-
-### Patch Changes
-
-- 97bab28: Initial release of @pikku/mongodb — MongoDB-backed service implementations for Pikku, including SecretService, ChannelStore, EventHubStore, DeploymentService, WorkflowService, WorkflowRunService, AIStorageService, AIRunStateService, and AgentRunService.
-- c7ff141: Add WorkflowVersionStatus type with draft→active lifecycle for AI-generated workflows, type all DB status fields with proper unions instead of plain strings
-- Updated dependencies [387b2ee]
-- Updated dependencies [32ed003]
-- Updated dependencies [7d369f3]
-- Updated dependencies [508a796]
-- Updated dependencies [ffe83af]
-- Updated dependencies [c7ff141]
-  - @pikku/core@0.12.3

package/run-tests.sh

@@ -1,68 +0,0 @@
-#!/bin/bash
-
-# Enable nullglob to handle cases where no files match the pattern
-shopt -s nullglob
-
-# Initialize variables for options
-watch_mode=false
-coverage_mode=false
-
-# Parse command-line options
-while [[ $# -gt 0 ]]; do
-  case $1 in
-    --watch)
-      watch_mode=true
-      shift
-      ;;
-    --coverage)
-      coverage_mode=true
-      shift
-      ;;
-    *)
-      echo "Unknown option: $1"
-      exit 1
-      ;;
-  esac
-done
-
-# Define the pattern to match your test files
-pattern="src/*.test.ts"
-
-# Expand the pattern into an array of files
-files=($(find src -type f -name "*.test.ts"))
-
-# Check if any files matched the pattern
-if [ ${#files[@]} -eq 0 ]; then
-  echo "No test files found matching pattern: $pattern"
-  if [ "${STRICT_TEST_DISCOVERY}" = "1" ]; then
-    exit 1
-  fi
-  exit 0
-fi
-
-# Construct the bun command
-#
-# --parallel gives every test file its own worker process, which is what node's
-# `--test` did. Several suites keep module-level caches (a TypeScript program, a
-# temp fixture directory) that a shared process would leak between files.
-#
-# --timeout because bun caps a test at 5s by default where node had no cap, and
-# the suites that build real TypeScript programs run well past that.
-bun_cmd=(bun test --parallel --timeout 120000)
-
-# Append options based on flags
-if [ "$watch_mode" = true ]; then
-  # --watch reruns in one process; parallel workers have nothing to watch.
-  bun_cmd=(bun test --watch --timeout 120000)
-fi
-
-if [ "$coverage_mode" = true ]; then
-  # --coverage-dir=. keeps lcov.info at the package root: CI merges every
-  # package's report by prefixing its SF paths with the file's own directory,
-  # so a nested coverage/ directory would re-root them one level too deep.
-  bun_cmd+=(--coverage --coverage-reporter=lcov --coverage-reporter=text --coverage-dir=.)
-  export PIKKU_TEST_COVERAGE=1
-fi
-
-# Execute the bun command with the expanded list of files
-"${bun_cmd[@]}" "${files[@]}"