nexus-ai-pro 2.2.0 → 2.4.0

package/dist-cjs/deep-agent/index.js

@@ -0,0 +1,219 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createDeepAgent = createDeepAgent;
+const create_agent_js_1 = require("../agent/create-agent.js");
+const context_editor_js_1 = require("../agent/middleware/context-editor.js");
+const filesystem_js_1 = require("../agent/middleware/filesystem.js");
+const tool_selector_js_1 = require("../agent/middleware/tool-selector.js");
+const permissions_js_1 = require("../agent/permissions.js");
+const sandbox_js_1 = require("../agent/sandbox.js");
+const tool_js_1 = require("../agent/tool.js");
+const MOUNT = '/workspace';
+const CORE_TOOLS = [
+    'write_todos',
+    'delegate',
+    'load_skill',
+    'read_file',
+    'write_file',
+    'edit_file',
+    'list_files',
+    'run_command',
+];
+function createDeepAgent(options) {
+    const { instructions, sandbox, commands = [], planning = true, subagents = [], skills = [], include = ['AGENTS.md'], offload, contextEditing, toolSelection, permissions, middleware = [], tools: extraTools = [], ...agentOptions } = options;
+    const workspace = sandbox
+        ? [...(0, sandbox_js_1.sandboxTools)(sandbox, { shell: commands.length > 0, mount: MOUNT }), editFileTool(sandbox)]
+        : [];
+    const own = [
+        ...(planning ? [writeTodosTool()] : []),
+        ...(skills.length > 0 ? [loadSkillTool(skills, sandbox)] : []),
+        ...workspace,
+        ...extraTools,
+    ];
+    const helpers = new Map();
+    const approved = new Set(Object.keys(agentOptions.interruptOn ?? {}));
+    const { interruptOn: _approvals, ...helperOptions } = agentOptions;
+    for (const helper of subagents) {
+        const allowed = helper.tools ? new Set(helper.tools) : undefined;
+        helpers.set(helper.name, (0, create_agent_js_1.createAgent)({
+            ...helperOptions,
+            name: `${options.name ?? 'deep-agent'}.${helper.name}`,
+            ...(helper.model ? { model: helper.model } : {}),
+            maxIterations: helper.maxIterations ?? 20,
+            systemPrompt: `${helper.instructions}\n\n${WORKSPACE_NOTE}`,
+            tools: own.filter((candidate) => !approved.has(candidate.name) && (allowed ? allowed.has(candidate.name) : true)),
+            ...(permissions === false ? {} : { permissions: permissions ?? defaultPolicy(commands) }),
+            checkpointer: false,
+        }));
+    }
+    const tools = [...own, ...(helpers.size > 0 ? [delegateTool(subagents, helpers)] : [])];
+    const kit = [
+        ...(sandbox && (include.length > 0 || offload !== false)
+            ? [
+                (0, filesystem_js_1.filesystemContext)({
+                    source: sandbox,
+                    include,
+                    ...(offload === false ? {} : { offload: { overChars: 20_000, ...offload } }),
+                }),
+            ]
+            : []),
+        ...(contextEditing === false
+            ? []
+            : [
+                (0, context_editor_js_1.contextEditor)({
+                    triggerTokens: 60_000,
+                    ...contextEditing,
+                    exclude: ['write_todos', ...(contextEditing?.exclude ?? [])],
+                }),
+            ]),
+        ...(toolSelection
+            ? [(0, tool_selector_js_1.toolSelector)({ ...toolSelection, always: [...CORE_TOOLS, ...(toolSelection.always ?? [])] })]
+            : []),
+    ];
+    return (0, create_agent_js_1.createAgent)({
+        maxIterations: 40,
+        ...agentOptions,
+        systemPrompt: systemPrompt(instructions, { planning, sandbox: Boolean(sandbox), commands, subagents, skills }),
+        tools,
+        middleware: [...kit, ...middleware],
+        ...(permissions === false ? {} : { permissions: permissions ?? defaultPolicy(commands) }),
+    });
+}
+function defaultPolicy(commands) {
+    return (0, permissions_js_1.permissionPolicy)({
+        filesystem: { write: [`${MOUNT}/**`] },
+        shell: { allow: commands },
+        tools: { write_todos: 'allow', delegate: 'allow', load_skill: 'allow' },
+    });
+}
+const WORKSPACE_NOTE = `Files live in ${MOUNT}; paths are relative to it.`;
+function systemPrompt(instructions, parts) {
+    const lines = [];
+    if (instructions)
+        lines.push(instructions, '');
+    lines.push('Work through the task step by step, checking each step before the next.');
+    if (parts.planning) {
+        lines.push('For any task of more than two steps, first record a plan with write_todos, then keep it current: mark a step in_progress when you start it and completed when it is done.');
+    }
+    if (parts.sandbox) {
+        lines.push(`${WORKSPACE_NOTE} Read before you change a file; prefer edit_file to rewriting a whole file. A large result may be saved to a file and shown as a preview: read the file when you need the rest.`);
+        if (parts.commands.length > 0)
+            lines.push(`You may run these commands: ${parts.commands.join(', ')}.`);
+    }
+    if (parts.subagents.length > 0) {
+        lines.push('', 'Delegate a self-contained piece of work with delegate, to one of:');
+        for (const helper of parts.subagents)
+            lines.push(`- ${helper.name}: ${helper.description}`);
+    }
+    if (parts.skills.length > 0) {
+        lines.push('', 'Skills you can load with load_skill when a task calls for one:');
+        for (const skill of parts.skills)
+            lines.push(`- ${skill.name}: ${skill.description}`);
+    }
+    return lines.join('\n');
+}
+function writeTodosTool() {
+    return (0, tool_js_1.tool)({
+        name: 'write_todos',
+        description: 'Records the plan for this task as a list of steps, each pending, in_progress, or completed. Send the whole list each time.',
+        parameters: {
+            type: 'object',
+            properties: {
+                todos: {
+                    type: 'array',
+                    items: {
+                        type: 'object',
+                        properties: {
+                            content: { type: 'string' },
+                            status: { type: 'string', enum: ['pending', 'in_progress', 'completed'] },
+                        },
+                        required: ['content', 'status'],
+                    },
+                },
+            },
+            required: ['todos'],
+        },
+        capabilities: [],
+        execute: ({ todos }) => {
+            const list = Array.isArray(todos) ? todos : [];
+            const mark = { pending: '[ ]', in_progress: '[~]', completed: '[x]' };
+            const done = list.filter((todo) => todo.status === 'completed').length;
+            return `Plan (${done}/${list.length} done):\n${list.map((todo) => `${mark[todo.status] ?? '[ ]'} ${todo.content}`).join('\n')}`;
+        },
+    });
+}
+function editFileTool(sandbox) {
+    const local = (file) => String(file ?? '')
+        .replace(/\\/g, '/')
+        .replace(new RegExp(`^${MOUNT}/`), '')
+        .replace(/^\/+/, '');
+    return (0, tool_js_1.tool)({
+        name: 'edit_file',
+        description: `Replaces one exact occurrence of old_text with new_text in a file. Paths are relative to ${MOUNT}.`,
+        parameters: {
+            type: 'object',
+            properties: { path: { type: 'string' }, old_text: { type: 'string' }, new_text: { type: 'string' } },
+            required: ['path', 'old_text', 'new_text'],
+        },
+        capabilities: (args) => [`filesystem:write:${MOUNT}/${local(args.path)}`],
+        execute: async ({ path, old_text: oldText, new_text: newText }) => {
+            const file = local(path);
+            const text = await sandbox.readFile(file);
+            const count = text.split(String(oldText)).length - 1;
+            if (count === 0)
+                throw new Error(`old_text was not found in ${file}`);
+            if (count > 1)
+                throw new Error(`old_text appears ${count} times in ${file}; include more context so it appears once`);
+            await sandbox.writeFile(file, text.replace(String(oldText), () => String(newText)));
+            return { edited: file };
+        },
+    });
+}
+function loadSkillTool(skills, sandbox) {
+    const byName = new Map(skills.map((skill) => [skill.name, skill]));
+    return (0, tool_js_1.tool)({
+        name: 'load_skill',
+        description: 'Loads the instructions of a skill by name.',
+        parameters: {
+            type: 'object',
+            properties: { name: { type: 'string', enum: skills.map((skill) => skill.name) } },
+            required: ['name'],
+        },
+        capabilities: [],
+        execute: async ({ name }) => {
+            const skill = byName.get(String(name));
+            if (!skill)
+                throw new Error(`No skill named "${String(name)}"`);
+            if (skill.instructions !== undefined)
+                return skill.instructions;
+            if (skill.file && sandbox)
+                return sandbox.readFile(skill.file);
+            throw new Error(`Skill "${skill.name}" has no instructions`);
+        },
+    });
+}
+function delegateTool(subagents, helpers) {
+    return (0, tool_js_1.tool)({
+        name: 'delegate',
+        description: 'Hands a self-contained task to a helper, which works in a fresh context and returns its answer.',
+        parameters: {
+            type: 'object',
+            properties: {
+                agent: { type: 'string', enum: subagents.map((helper) => helper.name) },
+                task: { type: 'string', description: 'Everything the helper needs to know: it sees nothing else.' },
+            },
+            required: ['agent', 'task'],
+        },
+        capabilities: [],
+        execute: async ({ agent, task }, context) => {
+            const helper = helpers.get(String(agent));
+            if (!helper)
+                throw new Error(`No helper named "${String(agent)}"`);
+            const result = await helper.invoke((0, create_agent_js_1.agentInput)(String(task)), {
+                ...(context.principal ? { principal: context.principal } : {}),
+                ...(context.signal ? { signal: context.signal } : {}),
+            });
+            return (result.state.answer || `The ${String(agent)} helper finished without an answer (${result.state.stopReason}).`);
+        },
+    });
+}

package/dist-cjs/embeddings/adapters.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OllamaEmbeddingProvider = exports.MistralEmbeddingProvider = exports.CohereEmbeddingProvider = exports.GoogleEmbeddingProvider = exports.OpenAIEmbeddingProvider = void 0;
+const base64_js_1 = require("../utils/base64.js");
 const errors_js_1 = require("../providers/errors.js");
 const errors_js_2 = require("./errors.js");
 class HttpEmbeddingProvider {
@@ -34,7 +35,7 @@ class HttpEmbeddingProvider {
     }
 }
 function decodeBase64Vector(value) {
-    const bytes = Buffer.from(value, 'base64');
+    const bytes = (0, base64_js_1.decodeBase64)(value);
     const floats = new Float32Array(bytes.buffer, bytes.byteOffset, Math.floor(bytes.byteLength / 4));
     return Array.from(floats);
 }

package/dist-cjs/evals/judge.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.LLMJudge = void 0;
 exports.createLLMJudgeEval = createLLMJudgeEval;
 exports.parseJudgeResponse = parseJudgeResponse;
-const node_crypto_1 = require("node:crypto");
+const sha256_js_1 = require("../utils/sha256.js");
 const provenance_js_1 = require("../evaluate/provenance.js");
 const DEFAULT_SYSTEM_PROMPT = [
     'You are a careful evaluation judge.',
@@ -69,10 +69,7 @@ class LLMJudge {
             name: options.key ?? 'judge',
             judge: {
                 model: this.options.model,
-                promptVersion: (0, node_crypto_1.createHash)('sha256')
-                    .update(this.options.systemPrompt ?? 'default')
-                    .digest('hex')
-                    .slice(0, 12),
+                promptVersion: (0, sha256_js_1.sha256Hex)(this.options.systemPrompt ?? 'default').slice(0, 12),
                 temperature: this.options.temperature ?? 0,
             },
             ...(this.options.rubric ? { rubric: this.options.rubric } : {}),

package/dist-cjs/evaluate/cache.d.ts

@@ -42,20 +42,6 @@ export declare class MemoryEvaluationCache implements EvaluationCache {
     /** Drops every output. */
     clear(): void;
 }
-/**
- * Target outputs as JSON files in a directory, one per key, so a CI job keeps them between runs by
- * caching the directory. Writes go through a temporary file and a rename, so a reader never sees half
- * an entry. Outputs must survive `JSON.stringify()`.
- */
-export declare class FileEvaluationCache implements EvaluationCache {
-    private readonly directory;
-    constructor(directory: string);
-    /** The output under a key, or `undefined` when there is none or its file cannot be read. */
-    get(key: string): Promise<CachedOutput | undefined>;
-    /** Writes an output under a key. */
-    set(key: string, value: CachedOutput): Promise<void>;
-    private fileOf;
-}
 /**
  * A fingerprint for whatever decides a target's output — a model name, a prompt version, a
  * temperature, a context bundle version — as `f` and 16 hex digits of a SHA-256 over its canonical

package/dist-cjs/evaluate/cache.js

@@ -1,39 +1,6 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.FileEvaluationCache = exports.MemoryEvaluationCache = void 0;
+exports.MemoryEvaluationCache = void 0;
 exports.fingerprintOf = fingerprintOf;
 exports.evaluationCacheKey = evaluationCacheKey;
 const version_js_1 = require("../prompts/version.js");
@@ -67,37 +34,6 @@ class MemoryEvaluationCache {
     }
 }
 exports.MemoryEvaluationCache = MemoryEvaluationCache;
-class FileEvaluationCache {
-    directory;
-    constructor(directory) {
-        this.directory = directory;
-    }
-    async get(key) {
-        const { readFile } = await Promise.resolve().then(() => __importStar(require('node:fs/promises')));
-        try {
-            return JSON.parse(await readFile(await this.fileOf(key), 'utf8'));
-        }
-        catch {
-            return undefined;
-        }
-    }
-    async set(key, value) {
-        const { mkdir, rename, writeFile } = await Promise.resolve().then(() => __importStar(require('node:fs/promises')));
-        const path = await Promise.resolve().then(() => __importStar(require('node:path')));
-        const file = await this.fileOf(key);
-        await mkdir(path.dirname(file), { recursive: true });
-        const temporary = `${file}.${process.pid}.${Date.now()}.tmp`;
-        await writeFile(temporary, JSON.stringify(value), 'utf8');
-        await rename(temporary, file);
-    }
-    async fileOf(key) {
-        if (!/^[0-9a-f]{16,}$/.test(key))
-            throw new RangeError('An evaluation cache key is a hex string');
-        const path = await Promise.resolve().then(() => __importStar(require('node:path')));
-        return path.join(this.directory, key.slice(0, 2), `${key}.json`);
-    }
-}
-exports.FileEvaluationCache = FileEvaluationCache;
 async function fingerprintOf(value) {
     return `f${(await sha256((0, version_js_1.canonicalJson)(value))).slice(0, 16)}`;
 }

package/dist-cjs/evaluate/file-cache.d.ts

@@ -0,0 +1,15 @@
+import type { CachedOutput, EvaluationCache } from './cache.js';
+/**
+ * Target outputs as JSON files in a directory, one per key, so a CI job keeps them between runs by
+ * caching the directory. Writes go through a temporary file and a rename, so a reader never sees half
+ * an entry. Outputs must survive `JSON.stringify()`.
+ */
+export declare class FileEvaluationCache implements EvaluationCache {
+    private readonly directory;
+    constructor(directory: string);
+    /** The output under a key, or `undefined` when there is none or its file cannot be read. */
+    get(key: string): Promise<CachedOutput | undefined>;
+    /** Writes an output under a key. */
+    set(key: string, value: CachedOutput): Promise<void>;
+    private fileOf;
+}

package/dist-cjs/evaluate/file-cache.js

@@ -0,0 +1,67 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FileEvaluationCache = void 0;
+class FileEvaluationCache {
+    directory;
+    constructor(directory) {
+        this.directory = directory;
+    }
+    async get(key) {
+        const { readFile } = await Promise.resolve().then(() => __importStar(require('node:fs/promises')));
+        try {
+            return JSON.parse(await readFile(await this.fileOf(key), 'utf8'));
+        }
+        catch {
+            return undefined;
+        }
+    }
+    async set(key, value) {
+        const { mkdir, rename, writeFile } = await Promise.resolve().then(() => __importStar(require('node:fs/promises')));
+        const path = await Promise.resolve().then(() => __importStar(require('node:path')));
+        const file = await this.fileOf(key);
+        await mkdir(path.dirname(file), { recursive: true });
+        const temporary = `${file}.${process.pid}.${Date.now()}.tmp`;
+        await writeFile(temporary, JSON.stringify(value), 'utf8');
+        await rename(temporary, file);
+    }
+    async fileOf(key) {
+        if (!/^[0-9a-f]{16,}$/.test(key))
+            throw new RangeError('An evaluation cache key is a hex string');
+        const path = await Promise.resolve().then(() => __importStar(require('node:path')));
+        return path.join(this.directory, key.slice(0, 2), `${key}.json`);
+    }
+}
+exports.FileEvaluationCache = FileEvaluationCache;

package/dist-cjs/evaluate/index.d.ts

@@ -3,6 +3,7 @@ export { contentVersion, createDataset, type CreateDatasetOptions, datasetFromTr
 export { completed, contains, embeddingSimilarity, exactMatch, mustNotMatch, pairwise, passRate, recallAtK, reciprocalRank, type RetrievalEvaluatorOptions, totalCost, trajectory, type TrajectoryOptions, underCost, underLatency, } from './evaluators.js';
 export { AnnotationQueue, type AnnotationQueueOptions, evaluateOnline, type OnlineEvaluationOptions, type OnlineEvaluationReport, type ReviewAnswer, type ReviewItem, type ReviewQuestion, } from './review.js';
 export { evaluate, type EvaluateOptions, type EvaluationTarget, stats, summarize } from './run.js';
-export { type CachedOutput, type EvaluationCache, evaluationCacheKey, FileEvaluationCache, fingerprintOf, MemoryEvaluationCache, type MemoryEvaluationCacheOptions, } from './cache.js';
+export { type CachedOutput, type EvaluationCache, evaluationCacheKey, fingerprintOf, MemoryEvaluationCache, type MemoryEvaluationCacheOptions, } from './cache.js';
+export { FileEvaluationCache } from './file-cache.js';
 export type { Dataset, DatasetExample, DatasetStore, EvaluationContext, EvaluationScore, Evaluator, ExampleResult, Experiment, ExperimentStore, MetricSummary, SummaryEvaluator, } from '../types/evaluate.js';
 export { withProvenance } from './provenance.js';

package/dist-cjs/evaluate/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.withProvenance = exports.MemoryEvaluationCache = exports.fingerprintOf = exports.FileEvaluationCache = exports.evaluationCacheKey = exports.summarize = exports.stats = exports.evaluate = exports.evaluateOnline = exports.AnnotationQueue = exports.underLatency = exports.underCost = exports.trajectory = exports.totalCost = exports.reciprocalRank = exports.recallAtK = exports.passRate = exports.pairwise = exports.mustNotMatch = exports.exactMatch = exports.embeddingSimilarity = exports.contains = exports.completed = exports.splitOf = exports.readExperiment = exports.MemoryExperimentStore = exports.MemoryDatasetStore = exports.FileExperimentStore = exports.FileDatasetStore = exports.datasetFromTraces = exports.createDataset = exports.contentVersion = exports.scoreMap = exports.formatComparison = exports.compareExperiments = void 0;
+exports.withProvenance = exports.FileEvaluationCache = exports.MemoryEvaluationCache = exports.fingerprintOf = exports.evaluationCacheKey = exports.summarize = exports.stats = exports.evaluate = exports.evaluateOnline = exports.AnnotationQueue = exports.underLatency = exports.underCost = exports.trajectory = exports.totalCost = exports.reciprocalRank = exports.recallAtK = exports.passRate = exports.pairwise = exports.mustNotMatch = exports.exactMatch = exports.embeddingSimilarity = exports.contains = exports.completed = exports.splitOf = exports.readExperiment = exports.MemoryExperimentStore = exports.MemoryDatasetStore = exports.FileExperimentStore = exports.FileDatasetStore = exports.datasetFromTraces = exports.createDataset = exports.contentVersion = exports.scoreMap = exports.formatComparison = exports.compareExperiments = void 0;
 var compare_js_1 = require("./compare.js");
 Object.defineProperty(exports, "compareExperiments", { enumerable: true, get: function () { return compare_js_1.compareExperiments; } });
 Object.defineProperty(exports, "formatComparison", { enumerable: true, get: function () { return compare_js_1.formatComparison; } });
@@ -38,8 +38,9 @@ Object.defineProperty(exports, "stats", { enumerable: true, get: function () { r
 Object.defineProperty(exports, "summarize", { enumerable: true, get: function () { return run_js_1.summarize; } });
 var cache_js_1 = require("./cache.js");
 Object.defineProperty(exports, "evaluationCacheKey", { enumerable: true, get: function () { return cache_js_1.evaluationCacheKey; } });
-Object.defineProperty(exports, "FileEvaluationCache", { enumerable: true, get: function () { return cache_js_1.FileEvaluationCache; } });
 Object.defineProperty(exports, "fingerprintOf", { enumerable: true, get: function () { return cache_js_1.fingerprintOf; } });
 Object.defineProperty(exports, "MemoryEvaluationCache", { enumerable: true, get: function () { return cache_js_1.MemoryEvaluationCache; } });
+var file_cache_js_1 = require("./file-cache.js");
+Object.defineProperty(exports, "FileEvaluationCache", { enumerable: true, get: function () { return file_cache_js_1.FileEvaluationCache; } });
 var provenance_js_1 = require("./provenance.js");
 Object.defineProperty(exports, "withProvenance", { enumerable: true, get: function () { return provenance_js_1.withProvenance; } });

package/dist-cjs/evaluate/review.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AnnotationQueue = void 0;
 exports.evaluateOnline = evaluateOnline;
-const node_crypto_1 = require("node:crypto");
+const ids_js_1 = require("../utils/ids.js");
 class AnnotationQueue {
     options;
     items = new Map();
@@ -13,7 +13,7 @@ class AnnotationQueue {
     }
     enqueue(subject, metadata) {
         const item = {
-            id: `review-${(0, node_crypto_1.randomBytes)(6).toString('hex')}`,
+            id: `review-${(0, ids_js_1.randomHex)(6)}`,
             subject,
             rubric: this.options.rubric,
             status: 'pending',

package/dist-cjs/evaluate/run.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.evaluate = evaluate;
 exports.summarize = summarize;
 exports.stats = stats;
-const node_crypto_1 = require("node:crypto");
+const ids_js_1 = require("../utils/ids.js");
 const version_js_1 = require("../version.js");
 const cache_js_1 = require("./cache.js");
 const provenance_js_1 = require("./provenance.js");
@@ -34,7 +34,7 @@ async function evaluate(target, dataset, evaluators, options = {}) {
     for (const evaluator of options.summary ?? [])
         summary.push(...(await evaluator(results)));
     const experiment = {
-        id: `exp-${(0, node_crypto_1.randomBytes)(6).toString('hex')}`,
+        id: `exp-${(0, ids_js_1.randomHex)(6)}`,
         name: options.name ?? `${dataset.name} ${startedAt}`,
         dataset: { name: dataset.name, version: dataset.version },
         startedAt,

package/dist-cjs/evaluate/version.js

@@ -1,11 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.contentVersion = contentVersion;
-const node_crypto_1 = require("node:crypto");
+const sha256_js_1 = require("../utils/sha256.js");
 function contentVersion(examples) {
-    const hash = (0, node_crypto_1.createHash)('sha256');
+    const hash = new sha256_js_1.Sha256();
     for (const example of examples) {
         hash.update(JSON.stringify({ id: example.id, inputs: example.inputs, expected: example.expected }));
     }
-    return `v${hash.digest('hex').slice(0, 12)}`;
+    return `v${hash.digest().slice(0, 12)}`;
 }

package/dist-cjs/graph/functional.d.ts

@@ -1,4 +1,5 @@
 import type { OperationLifecycleLike } from '../types/lifecycle.js';
+import type { Principal } from '../types/principal.js';
 import { GraphError } from './errors.js';
 import type { GraphCheckpoint, GraphCheckpointer, GraphDescription, GraphEvent, GraphStatus, InterruptRequest, PendingInterrupt, RetryPolicy, RunControlLike } from '../types/graph.js';
 import type { Store } from '../types/store.js';
@@ -86,6 +87,8 @@ export interface WorkflowContext {
     readonly threadId: string;
     /** The tenant the run is for, when it has one. */
     readonly tenantId?: string;
+    /** Who the run is for, when it was started with a principal: the caller the server authenticated. */
+    readonly principal?: Readonly<Principal>;
     /** Aborted when the run is cancelled. */
     readonly signal: AbortSignal;
     /** Long-term memory, when the workflow was created with a store. In a tenant's run, the tenant's view of it. */
@@ -162,6 +165,12 @@ export interface WorkflowRunOptions {
      * without one carries on the thread's.
      */
     tenantId?: string;
+    /**
+     * Who the run is for, read as `context.principal`. Its `tenantId` is the run's tenant when
+     * `tenantId` is not given, and a run whose two tenants differ is refused; its `userId` is recorded
+     * on every checkpoint as `metadata.userId`.
+     */
+    principal?: Principal;
 }
 /** One event of a streamed workflow run. */
 export type WorkflowEvent<O = unknown> = {

package/dist-cjs/graph/functional.js

@@ -6,6 +6,7 @@ const checkpointer_js_1 = require("./checkpointer.js");
 const run_js_1 = require("../lifecycle/run.js");
 const checkpoint_migration_js_1 = require("./checkpoint-migration.js");
 const tenant_js_1 = require("../store/tenant.js");
+const tenant_js_2 = require("../utils/tenant.js");
 const errors_js_1 = require("./errors.js");
 class WorkflowStepTimeoutError extends errors_js_1.GraphError {
     stepName;
@@ -57,9 +58,10 @@ class Workflow {
         const threadId = runOptions.threadId ?? generatedId();
         return this.execute(threadId, runOptions, async () => {
             const latest = await this.latest(threadId);
-            if (latest && runOptions.tenantId !== undefined) {
+            const tenantId = runOptions.tenantId ?? runOptions.principal?.tenantId;
+            if (latest && tenantId !== undefined) {
                 const owner = latest.metadata?.tenantId;
-                if (typeof owner === 'string' && owner !== runOptions.tenantId) {
+                if (typeof owner === 'string' && owner !== tenantId) {
                     throw new errors_js_1.GraphError(`Thread "${threadId}" cannot be used by this tenant; choose another id`, 'GRAPH_VALIDATION_ERROR');
                 }
             }
@@ -153,7 +155,21 @@ class Workflow {
     }
     execute(threadId, runOptions, start) {
         const queue = new EventQueue();
-        void (0, run_js_1.withLifecycle)(this.options.lifecycle, { family: 'graph', operation: `workflow.${this.name}`, metadata: { threadId, graph: this.name } }, runOptions.signal ? { signal: runOptions.signal } : {}, () => this.run(threadId, runOptions, start, queue)).then(() => queue.close(), (error) => queue.fail(error));
+        let options;
+        try {
+            options = (0, tenant_js_2.withPrincipal)(runOptions);
+        }
+        catch (error) {
+            queue.fail(error);
+            return queue;
+        }
+        const metadata = {
+            threadId,
+            graph: this.name,
+            ...(options.tenantId !== undefined ? { tenantId: options.tenantId } : {}),
+            ...(options.principal?.userId !== undefined ? { userId: options.principal.userId } : {}),
+        };
+        void (0, run_js_1.withLifecycle)(this.options.lifecycle, { family: 'graph', operation: `workflow.${this.name}`, metadata }, options.signal ? { signal: options.signal } : {}, () => this.run(threadId, options, start, queue)).then(() => queue.close(), (error) => queue.fail(error));
         return queue;
     }
     async run(threadId, runOptions, start, queue) {
@@ -208,6 +224,7 @@ class Workflow {
         const context = {
             threadId,
             ...(tenantId === undefined ? {} : { tenantId }),
+            ...(runOptions.principal ? { principal: runOptions.principal } : {}),
             signal: controller.signal,
             ...(this.options.store
                 ? { store: tenantId === undefined ? this.options.store : (0, tenant_js_1.tenantStore)(this.options.store, tenantId) }