@aiwayds/dsh-mcp-adapter 0.5.1 → 0.6.0

package/lib/jev/client.js

@@ -0,0 +1,288 @@
+/**
+ * System One decision client — direct HTTP with zero dependencies beyond
+ * node:child_process and the global fetch (design 2026-09-25 §3; ADR
+ * proposal: direct HTTP over MCP). Ported from dsh-topics-memory
+ * `src/jev/client.ts`; the ONE structural change is the telemetry sink: the
+ * decisions.jsonl log is injected (see ./log.ts) instead of resolved from a
+ * paths module at call time.
+ *
+ * Semantics (§1/§3.2):
+ *  - one AbortSignal.timeout per request, NO retry — the calling lane's next
+ *    cadence is the natural retry (fail-open hard-coded, red line ②);
+ *  - every failure returns as a structured {ok:false} result, never a throw;
+ *  - the COMPLETE serialized body is gate-scanned before anything leaves the
+ *    process (red line ③, design §3.3).
+ *
+ * @module jev/client
+ */
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { resolveBackend } from "./backends.js";
+import { currentSecrets, scanForSecrets } from "./gate.js";
+/** Guard for non-positive/absent values from bare harnesses. */
+const DEFAULT_TIMEOUT_MS = 3000;
+function isPlainObject(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+/** 'svc' -> {service:'svc'}; 'svc:acct' -> {service:'svc', account:'acct'} */
+export function parseKeychainSpec(spec) {
+    const i = spec.indexOf(':');
+    if (i === -1)
+        return { service: spec };
+    return { service: spec.slice(0, i), account: spec.slice(i + 1) };
+}
+const execFileAsync = promisify(execFile);
+/**
+ * Budget for one `security find-generic-password` call. This lookup is awaited
+ * BEFORE the fetch, so it sits OUTSIDE the caller's jevTimeoutMs — and a
+ * locked keychain makes `security` block indefinitely (it waits for a UI
+ * unlock the user may never see), which parked the model-path seams outright
+ * and, on the background seam, held `suggestInFlight` true forever so every
+ * later 20-call crossing was silently swallowed. 3s is generous for a local
+ * `security` on a loaded machine and short enough that a locked keychain costs
+ * one batch, not the feature.
+ *
+ * A timeout is a MISSING KEY: it returns the same structured `missing_key`
+ * refusal as "no key at all" (fail-open, red line ②) and never throws. That is
+ * the same semantics the lookup already had for "entry not found" — the key
+ * is simply not available, and the lane's own fallback is the answer.
+ */
+export const KEYCHAIN_TIMEOUT_MS = 3000;
+/** Default runner: `security find-generic-password … -w`; errors (missing
+ *  entry, no binary on non-macOS, access denied) surface as rejections. The
+ *  exec-level `timeout` SIGTERMs the child, so nothing is left running after
+ *  the seam has moved on. */
+const securityRunner = async (file, args) => {
+    return (await execFileAsync(file, args, { encoding: 'utf8', timeout: KEYCHAIN_TIMEOUT_MS }));
+};
+/** Runs `security find-generic-password -w`; null on any failure (silent).
+ *
+ *  The seam that must not block is THIS one, so the deadline is enforced here
+ *  rather than trusted to the transport: a runner that ignores its own bound
+ *  (a future transport, a child that traps SIGTERM) still returns null.
+ *  @param spec - keychain service[:account] to read.
+ *  @param runner - injectable transport (tests never touch the real keychain).
+ *  @param timeoutMs - deadline for one lookup; a non-positive/absent value
+ *  falls back to {@link KEYCHAIN_TIMEOUT_MS} rather than disabling the bound.
+ */
+export async function keychainLookup(spec, runner = securityRunner, timeoutMs = KEYCHAIN_TIMEOUT_MS) {
+    const args = ['find-generic-password', '-s', spec.service];
+    if (spec.account !== undefined)
+        args.push('-a', spec.account);
+    const budget = Number(timeoutMs) > 0 ? Number(timeoutMs) : KEYCHAIN_TIMEOUT_MS;
+    let timer;
+    try {
+        // The loser's rejection is absorbed HERE: once the deadline wins, a late
+        // rejection must not surface as an unhandled rejection. The call itself
+        // stays inside the try, so a runner that throws SYNCHRONOUSLY is a lookup
+        // failure like any other rather than an escaping exception.
+        const attempt = runner('security', [...args, '-w']).then(result => ({ result }), () => undefined);
+        const deadline = new Promise(resolve => { timer = setTimeout(() => resolve(undefined), budget); });
+        const winner = await Promise.race([attempt, deadline]);
+        return winner?.result.stdout.trim() || null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    }
+}
+/**
+ * Resolved-key memo, per process. `security` is a fork+exec per seam call:
+ * with zen the default backend (keychainByDefault) and no JEV_ZEN_API_KEY set,
+ * EVERY batch spawned one, so a locked keychain spawned a process per call
+ * too. Only a SUCCESSFUL keychain answer is memoized — a miss must stay a
+ * miss that is re-probed, so unlocking the keychain needs no restart. The
+ * trade-off this buys is that a key ROTATED in the keychain is picked up on
+ * the next dsh start, not sooner; the env path (the documented fix for a
+ * rotated key) is read on every call and is never memoized.
+ */
+const apiKeyMemo = new Map();
+/** Resolve the API key for a backend: env var wins, then the keychain spec
+ *  (explicit JEV_KEYCHAIN, or the backend default for zen only), memoized per
+ *  backend name + resolved spec — JEV_KEYCHAIN is volatile, so repointing it
+ *  must not be answered out of another service's memo entry. */
+export async function resolveApiKey(backend, lookup = keychainLookup) {
+    const envKey = process.env[backend.keyEnv] ?? '';
+    if (envKey !== '')
+        return envKey;
+    const explicit = process.env.JEV_KEYCHAIN?.trim() ?? '';
+    const spec = explicit !== '' ? parseKeychainSpec(explicit) : backend.keychainByDefault ? { service: backend.keychainService } : null;
+    if (spec === null)
+        return '';
+    const memoKey = `${backend.name} ${spec.service} ${spec.account ?? ''}`;
+    const memoized = apiKeyMemo.get(memoKey);
+    if (memoized !== undefined)
+        return memoized;
+    const key = (await lookup(spec)) ?? '';
+    if (key !== '')
+        apiKeyMemo.set(memoKey, key);
+    return key;
+}
+function where(id) {
+    return `questions['${id}']`;
+}
+export function normalizeQuestions(questions, family) {
+    if (!isPlainObject(questions) || Object.keys(questions).length === 0) {
+        return { ok: false, message: "'questions' must be a non-empty object mapping question id -> {type, instructions, criteria?}." };
+    }
+    const systemone = family === 'systemone';
+    const out = {};
+    for (const [id, q] of Object.entries(questions)) {
+        if (!isPlainObject(q))
+            return { ok: false, message: `${where(id)} must be an object.` };
+        if (q.type !== 'noul' && q.type !== 'choice' && q.type !== 'score') {
+            return { ok: false, message: `${where(id)}.type must be 'noul' | 'choice' | 'score'.` };
+        }
+        if (typeof q.instructions !== 'string' || q.instructions === '') {
+            return { ok: false, message: `${where(id)}.instructions must be a non-empty string (the plugin always sends instructions).` };
+        }
+        const wire = { type: q.type, instructions: q.instructions };
+        if (q.type === 'noul') {
+            if (q.criteria === undefined) {
+                wire.criteria = { true: q.instructions, false: `NOT: ${q.instructions}` };
+            }
+            else if (isPlainObject(q.criteria) && q.criteria.true !== undefined && q.criteria.false !== undefined) {
+                if (!systemone && (typeof q.criteria.true !== 'string' || typeof q.criteria.false !== 'string')) {
+                    return { ok: false, message: `${where(id)}: noul criteria must be the two-sided {true: string, false: string} on the decisions protocol.` };
+                }
+                wire.criteria = q.criteria;
+            }
+            else {
+                return { ok: false, message: `${where(id)}: noul criteria, when given, must be the two-sided {true: ..., false: ...}.` };
+            }
+        }
+        else if (q.type === 'choice') {
+            if (!isPlainObject(q.criteria)) {
+                return { ok: false, message: `${where(id)}: choice criteria must be an OBJECT mapping option -> description.` };
+            }
+            wire.criteria = q.criteria;
+        }
+        else {
+            // score: 2-10 ordered levels; strings everywhere (plugin convention);
+            // the systemone protocol additionally tolerates structured levels.
+            if (!Array.isArray(q.criteria) || q.criteria.length < 2 || q.criteria.length > 10) {
+                return { ok: false, message: `${where(id)}: score criteria must be an ARRAY of 2-10 level descriptions.` };
+            }
+            const stringLevels = q.criteria.every((l) => typeof l === 'string' && l.length > 0);
+            if (!stringLevels && !systemone) {
+                return { ok: false, message: `${where(id)}: score levels must be non-empty strings on the decisions protocol.` };
+            }
+            wire.criteria = q.criteria;
+        }
+        out[id] = wire;
+    }
+    return { ok: true, questions: out };
+}
+// ---------------------------------------------------------------------------
+/** Ask the System One decision model. One request for the whole batch;
+ *  resolves to a structured failure (never throws) so the calling lane can
+ *  fail open. Writes the decisions.jsonl call-layer row on EVERY path. */
+export async function jevAsk(args) {
+    // Pace-maker override: a synthetic laya backend (no key — the auth header
+    // carries a placeholder the local server ignores; the secret gate and the
+    // call-layer row still run, tagged backend='laya').
+    const backend = args.overrides
+        ? {
+            name: 'laya',
+            family: 'systemone',
+            endpoint: args.overrides.endpoint,
+            defaultModel: args.overrides.model,
+            keyEnv: '',
+            keychainService: '',
+            keychainByDefault: false,
+        }
+        : resolveBackend(args.config.jevBackend);
+    // '' is the sentinel; undefined (bare harnesses) resolves to the default too
+    const model = args.overrides ? args.overrides.model : args.config.jevModel ? args.config.jevModel : backend.defaultModel;
+    const fallback = args.fallback === true; // absent => false: the column is call-time-invariant (fail-open = outcome !== ok)
+    const state = typeof args.state === 'string' ? args.state : '';
+    const started = Date.now();
+    async function emit(outcome, usage) {
+        await args.log.logCall({
+            at: new Date().toISOString(),
+            lane: args.lane,
+            backend: backend.name,
+            model,
+            questionCount: isPlainObject(args.questions) ? Object.keys(args.questions).length : 0,
+            stateChars: state.length,
+            latencyMs: Date.now() - started,
+            usage,
+            outcome,
+            fallback,
+        });
+    }
+    const refuse = async (outcome, message) => {
+        await emit(outcome, null);
+        return { ok: false, outcome, message, latencyMs: Date.now() - started };
+    };
+    // 1. Local protocol check — nothing about the request has left the process.
+    const normalized = normalizeQuestions(args.questions, backend.family);
+    if (!normalized.ok)
+        return refuse('invalid_request', normalized.message);
+    const wireQuestions = normalized.questions;
+    // 2. Secret gate over the COMPLETE outbound body — the exact string below
+    //    is what goes on the wire, so the gate sees byte-identical traffic.
+    //    A hit sends NOTHING.
+    const secretFile = args.config.jevSecretFile ?? '';
+    const wire = JSON.stringify({ model, state, questions: wireQuestions });
+    const hit = scanForSecrets(wire, currentSecrets(secretFile, args.logger), secretFile);
+    if (hit !== null) {
+        return refuse('secret_gate_blocked', `outbound payload matched secret pattern '${hit.pattern}' at offset ${hit.offset}; NOTHING was sent. Remove the secret from the request body (model/state/questions).`);
+    }
+    // 3. API key — absent key fails before any network activity. The laya
+    //    pace-maker skips resolution entirely (local, no auth).
+    const key = args.overrides ? 'laya-local' : await resolveApiKey(backend);
+    if (key === '') {
+        const hint = backend.keychainByDefault
+            ? ` (set ${backend.keyEnv}, or store the key in the macOS keychain service '${backend.keychainService}')`
+            : ` (set ${backend.keyEnv}, or JEV_KEYCHAIN='<service>[:<account>]' for a macOS keychain lookup)`;
+        return refuse('missing_key', `no API key for the active backend '${backend.name}'${hint}.`);
+    }
+    // 4. One request, one timeout, NO retry.
+    const timeoutMs = Number(args.config.jevTimeoutMs) > 0 ? Number(args.config.jevTimeoutMs) : DEFAULT_TIMEOUT_MS;
+    let res;
+    try {
+        res = await fetch(backend.endpoint, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', authorization: `Bearer ${key}` },
+            body: wire,
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+    }
+    catch (err) {
+        const outcome = err instanceof Error && (err.name === 'TimeoutError' || err.name === 'AbortError') ? 'timeout' : 'network';
+        return refuse(outcome, `${outcome} error: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (!res.ok) {
+        const text = (await res.text().catch(() => '')).slice(0, 300);
+        const outcome = res.status >= 500 ? 'http_5xx' : 'http_4xx';
+        return refuse(outcome, `${backend.name} responded ${res.status}: ${text}`);
+    }
+    let json;
+    try {
+        json = await res.json();
+    }
+    catch (err) {
+        return refuse('bad_json', `${backend.name} returned non-JSON body: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    // 5. Response shape: answers must be an object covering every question id
+    //    (a half-answered batch is a bad response, not a partial success).
+    if (!isPlainObject(json)) {
+        return refuse('bad_json', `${backend.name} returned no answers object.`);
+    }
+    const answers = json.answers;
+    if (!isPlainObject(answers)) {
+        return refuse('bad_json', `${backend.name} returned no answers object.`);
+    }
+    const missing = Object.keys(wireQuestions).filter((id) => answers[id] === undefined);
+    if (missing.length > 0) {
+        return refuse('bad_json', `${backend.name} returned no answer for question id(s): ${missing.join(', ')}.`);
+    }
+    const usage = isPlainObject(json.usage) ? json.usage : null;
+    await emit('ok', usage);
+    return { ok: true, answers: answers, usage, latencyMs: Date.now() - started };
+}
+//# sourceMappingURL=client.js.map

package/lib/jev/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/jev/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAE9C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AA6D1D,gEAAgE;AAChE,MAAM,kBAAkB,GAAG,IAAI,CAAA;AAE/B,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;AACjE,CAAC;AAcD,8EAA8E;AAC9E,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC3B,IAAI,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IACtC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAA;AAClE,CAAC;AAID,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AAEzC;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAA;AAEvC;;;6BAG6B;AAC7B,MAAM,cAAc,GAAmB,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;IAC1D,OAAO,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAuB,CAAA;AACpH,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAkB,EAClB,SAAyB,cAAc,EACvC,YAAoB,mBAAmB;IAEvC,MAAM,IAAI,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;IAC1D,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;IAC7D,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAA;IAC9E,IAAI,KAAgD,CAAA;IACpD,IAAI,CAAC;QACH,yEAAyE;QACzE,wEAAwE;QACxE,0EAA0E;QAC1E,4DAA4D;QAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACjG,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAY,OAAO,CAAC,EAAE,GAAG,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QAC5G,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAA;QACtD,OAAO,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAA;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAA;IAC9C,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAA;AAE5C;;;gEAGgE;AAChE,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAA8F,EAC9F,SAAyD,cAAc;IAEvE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;IAChD,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,MAAM,CAAA;IAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IACvD,MAAM,IAAI,GACR,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IACzH,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,CAAA;IAC5B,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAA;IACvE,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACxC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAA;IAC3C,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;IACtC,IAAI,GAAG,KAAK,EAAE;QAAE,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAC5C,OAAO,GAAG,CAAA;AACZ,CAAC;AAsBD,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,cAAc,EAAE,IAAI,CAAA;AAC7B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,SAAsC,EAAE,MAAiB;IAC1F,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,gGAAgG,EAAE,CAAA;IACjI,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,KAAK,WAAW,CAAA;IACxC,MAAM,GAAG,GAAkB,EAAE,CAAA;IAC7B,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,qBAAqB,EAAE,CAAA;QACvF,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACnE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,4CAA4C,EAAE,CAAA;QACzF,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;YAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,kFAAkF,EAAE,CAAA;QAC/H,CAAC;QACD,MAAM,IAAI,GAA4B,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAA;QACpF,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC7B,IAAI,CAAC,QAAQ,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,YAAY,EAAE,EAAE,CAAA;YAC3E,CAAC;iBAAM,IAAI,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxG,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;oBAChG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,gGAAgG,EAAE,CAAA;gBAC7I,CAAC;gBACD,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAA;YAC5B,CAAC;iBAAM,CAAC;gBACN,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,6EAA6E,EAAE,CAAA;YAC1H,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/B,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,oEAAoE,EAAE,CAAA;YACjH,CAAC;YACD,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAA;QAC5B,CAAC;aAAM,CAAC;YACN,sEAAsE;YACtE,mEAAmE;YACnE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;gBAClF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,+DAA+D,EAAE,CAAA;YAC5G,CAAC;YACD,MAAM,YAAY,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;YACnF,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,qEAAqE,EAAE,CAAA;YAClH,CAAC;YACD,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAA;QAC5B,CAAC;QACD,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAA;IAChB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAA;AACrC,CAAC;AAED,8EAA8E;AAE9E;;0EAE0E;AAC1E,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAgB;IAC3C,0EAA0E;IAC1E,0EAA0E;IAC1E,oDAAoD;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS;QAC5B,CAAC,CAAE;YACC,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ;YACjC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK;YAClC,MAAM,EAAE,EAAE;YACV,eAAe,EAAE,EAAE;YACnB,iBAAiB,EAAE,KAAK;SACwB;QACpD,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IAC1C,6EAA6E;IAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAA;IACxH,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAA,CAAC,kFAAkF;IAC1H,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAE1B,KAAK,UAAU,IAAI,CAAC,OAAyC,EAAE,KAAsB;QACnF,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YACrB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,OAAO,CAAC,IAAI;YACrB,KAAK;YACL,aAAa,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACrF,UAAU,EAAE,KAAK,CAAC,MAAM;YACxB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAC/B,KAAK;YACL,OAAO;YACP,QAAQ;SACT,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,EAAE,OAAkC,EAAE,OAAe,EAA0B,EAAE;QACnG,MAAM,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAA;IACzE,CAAC,CAAA;IAED,4EAA4E;IAC5E,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;IACrE,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,iBAAiB,EAAE,UAAU,CAAC,OAAO,CAAC,CAAA;IACxE,MAAM,aAAa,GAAG,UAAU,CAAC,SAAS,CAAA;IAE1C,0EAA0E;IAC1E,wEAAwE;IACxE,0BAA0B;IAC1B,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAA;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAA;IACvE,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,CAAA;IACrF,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,OAAO,MAAM,CACX,qBAAqB,EACrB,4CAA4C,GAAG,CAAC,OAAO,eAAe,GAAG,CAAC,MAAM,sFAAsF,CACvK,CAAA;IACH,CAAC;IAED,sEAAsE;IACtE,4DAA4D;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,CAAA;IACxE,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,GACR,OAAO,CAAC,iBAAiB;YACvB,CAAC,CAAC,SAAS,OAAO,CAAC,MAAM,qDAAqD,OAAO,CAAC,eAAe,IAAI;YACzG,CAAC,CAAC,SAAS,OAAO,CAAC,MAAM,wEAAwE,CAAA;QACrG,OAAO,MAAM,CAAC,aAAa,EAAE,sCAAsC,OAAO,CAAC,IAAI,IAAI,IAAI,GAAG,CAAC,CAAA;IAC7F,CAAC;IAED,yCAAyC;IACzC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAA;IAC9G,IAAI,GAAa,CAAA;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE;YAClC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;YAC/E,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACvC,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GACX,GAAG,YAAY,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;QAC5G,OAAO,MAAM,CAAC,OAAO,EAAE,GAAG,OAAO,WAAW,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACjG,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAC7D,MAAM,OAAO,GAA8B,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAA;QACtF,OAAO,MAAM,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,cAAc,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAA;IAC5E,CAAC;IAED,IAAI,IAAa,CAAA;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC1H,CAAC;IAED,0EAA0E;IAC1E,uEAAuE;IACvE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,8BAA8B,CAAC,CAAA;IAC1E,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;IAC5B,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,8BAA8B,CAAC,CAAA;IAC1E,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,SAAS,CAAC,CAAA;IACpF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,2CAA2C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC5G,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAA6B,CAAC,CAAC,CAAC,IAAI,CAAA;IACpF,MAAM,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACvB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAoC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAA;AAC5G,CAAC"}

package/lib/jev/config.d.ts

@@ -0,0 +1,82 @@
+/**
+ * System One (jev) configuration slice — the seven keys, ported from
+ * dsh-topics-memory `src/config.ts` §4 and expressed in this plugin's
+ * schemastery form.
+ *
+ * WHY A SEPARATE MODULE (not a sixth entry in ../index.ts's `Config`):
+ * the adapter's settings schema is the single `z.object({...})` exported as
+ * `Config` from src/index.ts, and this stage forbids touching that file.
+ * So the seven keys live here as a plain field record with two export forms:
+ *
+ *  - {@link JEV_CONFIG_FIELDS} — a plain `Record<key, Schema>`, written to
+ *    be SPREAD into the host schema next stage:
+ *        export const Config = z.object({ ...JEV_CONFIG_FIELDS, ...ownFields }) as unknown as z<AdapterConfig>
+ *    (verified: schemastery `z.object` accepts spread field records and the
+ *    defaults survive);
+ *  - {@link JevConfig} — the same seven keys as a standalone schema, so the
+ *    keys are already runtime-validatable (and tested) before they are wired
+ *    into the settings page.
+ *
+ * Until that wiring lands, nothing reads these values: `src/index.ts` does
+ * not import this module, so the plugin behaves exactly as before.
+ *
+ * All seven are VOLATILE (0.1.7 settings contract: a settings-page write
+ * swaps the value in place without remounting the plugin), so every consumer
+ * must read through the ref per use.
+ *
+ * @module jev/config
+ */
+import z from '@deepseek-ai/schemastery';
+/**
+ * Live-reference shape. Structurally identical to `VolatileRef` in
+ * ../index.ts; redeclared here so this module never imports the plugin
+ * entry (which will import this module once the keys are wired).
+ */
+export interface JevVolatileRef<T> {
+    get(): T;
+}
+/** Resolved value of the seven keys, as `apply` will read them. */
+export interface JevConfigValue {
+    /** Default-off master switch: false means zero behavior change anywhere —
+     *  no call is made, and the usage stats stop with it. */
+    jevEnabled: JevVolatileRef<boolean>;
+    /** Decision backend: zen (free, opencode.ai) | native (typesafe
+     *  first-party) | openrouter (decisions protocol). */
+    jevBackend: JevVolatileRef<'zen' | 'native' | 'openrouter'>;
+    /** Pinned model id; '' = resolve the backend default at call time
+     *  (distillProvider sentinel pattern): jev-1.13-free / jev-1.13.0 /
+     *  typesafe/jev-1.13 — an upgrade is a deliberate act. */
+    jevModel: JevVolatileRef<string>;
+    /** Single-request timeout in ms (positive integer); one AbortSignal, NO
+     *  retry (the calling lane's next cadence is the natural retry, fail-open
+     *  hard-coded). */
+    jevTimeoutMs: JevVolatileRef<number>;
+    /** External secret list for the outbound secret gate (JEV_SECRET_FILE
+     *  semantics, design §3.3); swapping the path hot reloads the list. */
+    jevSecretFile: JevVolatileRef<string>;
+    /** Local laya pace-maker (design §3.4): fire a parallel laya call on every
+     *  jev request; its verdict is logged for comparison and takes over ONLY
+     *  when the primary backend fails (degraded). Default off — zero extra
+     *  requests, and laya-serve not running costs a refused connection. */
+    jevLayaFallback: JevVolatileRef<boolean>;
+    /** laya-serve systemone endpoint for the pace-maker. */
+    jevLayaUrl: JevVolatileRef<string>;
+}
+/** The seven keys, in settings-page order. */
+export declare const JEV_CONFIG_KEYS: readonly ["jevEnabled", "jevBackend", "jevModel", "jevTimeoutMs", "jevSecretFile", "jevLayaFallback", "jevLayaUrl"];
+export type JevConfigKey = (typeof JEV_CONFIG_KEYS)[number];
+/**
+ * The seven field schemas as a plain record — the wiring form for the host
+ * schema (`z.object({ ...JEV_CONFIG_FIELDS, … })`).
+ */
+export declare const JEV_CONFIG_FIELDS: {
+    readonly jevEnabled: z<boolean, boolean, "volatile-defined">;
+    readonly jevBackend: z<"zen" | "native" | "openrouter", "zen" | "native" | "openrouter", "volatile-defined">;
+    readonly jevModel: z<string, string, "volatile-defined">;
+    readonly jevTimeoutMs: z<number, number, "volatile-defined">;
+    readonly jevSecretFile: z<string, string, "volatile-defined">;
+    readonly jevLayaFallback: z<boolean, boolean, "volatile-defined">;
+    readonly jevLayaUrl: z<string, string, "volatile-defined">;
+};
+/** The same seven keys as a standalone schema (runtime validation today). */
+export declare const JevConfig: z<JevConfigValue>;

package/lib/jev/config.js

@@ -0,0 +1,55 @@
+/**
+ * System One (jev) configuration slice — the seven keys, ported from
+ * dsh-topics-memory `src/config.ts` §4 and expressed in this plugin's
+ * schemastery form.
+ *
+ * WHY A SEPARATE MODULE (not a sixth entry in ../index.ts's `Config`):
+ * the adapter's settings schema is the single `z.object({...})` exported as
+ * `Config` from src/index.ts, and this stage forbids touching that file.
+ * So the seven keys live here as a plain field record with two export forms:
+ *
+ *  - {@link JEV_CONFIG_FIELDS} — a plain `Record<key, Schema>`, written to
+ *    be SPREAD into the host schema next stage:
+ *        export const Config = z.object({ ...JEV_CONFIG_FIELDS, ...ownFields }) as unknown as z<AdapterConfig>
+ *    (verified: schemastery `z.object` accepts spread field records and the
+ *    defaults survive);
+ *  - {@link JevConfig} — the same seven keys as a standalone schema, so the
+ *    keys are already runtime-validatable (and tested) before they are wired
+ *    into the settings page.
+ *
+ * Until that wiring lands, nothing reads these values: `src/index.ts` does
+ * not import this module, so the plugin behaves exactly as before.
+ *
+ * All seven are VOLATILE (0.1.7 settings contract: a settings-page write
+ * swaps the value in place without remounting the plugin), so every consumer
+ * must read through the ref per use.
+ *
+ * @module jev/config
+ */
+import z from '@deepseek-ai/schemastery';
+/** The seven keys, in settings-page order. */
+export const JEV_CONFIG_KEYS = [
+    'jevEnabled',
+    'jevBackend',
+    'jevModel',
+    'jevTimeoutMs',
+    'jevSecretFile',
+    'jevLayaFallback',
+    'jevLayaUrl',
+];
+/**
+ * The seven field schemas as a plain record — the wiring form for the host
+ * schema (`z.object({ ...JEV_CONFIG_FIELDS, … })`).
+ */
+export const JEV_CONFIG_FIELDS = {
+    jevEnabled: z.boolean().default(false).volatile(),
+    jevBackend: z.union([z.const('zen'), z.const('native'), z.const('openrouter')]).default('zen').volatile(),
+    jevModel: z.string().default('').volatile(),
+    jevTimeoutMs: z.natural().min(1).default(3000).volatile(),
+    jevSecretFile: z.string().default('').volatile(),
+    jevLayaFallback: z.boolean().default(false).volatile(),
+    jevLayaUrl: z.string().default('http://127.0.0.1:8000/v1/systemone').volatile(),
+};
+/** The same seven keys as a standalone schema (runtime validation today). */
+export const JevConfig = z.object(JEV_CONFIG_FIELDS);
+//# sourceMappingURL=config.js.map

package/lib/jev/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/jev/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,CAAC,MAAM,0BAA0B,CAAA;AAuCxC,8CAA8C;AAC9C,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,YAAY;IACZ,YAAY;IACZ,UAAU;IACV,cAAc;IACd,eAAe;IACf,iBAAiB;IACjB,YAAY;CACJ,CAAA;AAIV;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;IACjD,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;IACzG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3C,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IACzD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;IACtD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC,QAAQ,EAAE;CACvE,CAAA;AAEV,6EAA6E;AAC7E,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAiC,CAAA"}

package/lib/jev/dual.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Dual-run pace-maker (design §3.4, added 09-27): fire the configured
+ * backend AND the local laya-serve endpoint in parallel on every jev call.
+ * Ported verbatim from dsh-topics-memory `src/jev/dual.ts` — the wrapper is
+ * business-agnostic.
+ *
+ *  - the PRIMARY answer drives the decision whenever it is ok;
+ *  - the laya answer is always logged (its own call-layer row tagged
+ *    backend='laya' plus verdict rows) — a free, permanently running
+ *    laya-vs-jev comparison on identical questions;
+ *  - when the primary FAILS (cold-start spike, timeout, 5xx…), the laya
+ *    answer — by then already resolved — takes over as DEGRADED: the calling
+ *    seam may only use laya's RELATIVE ranking, never its absolute scores
+ *    against jev-calibrated thresholds (laya's negatives sit in the same band
+ *    as its positives — the 4-way bench, 09-27);
+ *  - laya not running = a refused connection in milliseconds — the switch
+ *    can stay on unconditionally.
+ *
+ * @module jev/dual
+ */
+import type { JevAskArgs, JevAskConfig, JevAskResult } from './client.ts';
+/** Default local laya-serve endpoint (laya repo: `laya[serve]` binds 8000). */
+export declare const DEFAULT_LAYA_URL = "http://127.0.0.1:8000/v1/systemone";
+export interface JevDualConfig extends JevAskConfig {
+    /** Pace-maker switch (default OFF — zero extra requests when false). */
+    jevLayaFallback: boolean;
+    /** Local laya-serve systemone endpoint. */
+    jevLayaUrl: string;
+}
+export interface JevDualArgs extends Omit<JevAskArgs, 'config'> {
+    config: JevDualConfig;
+}
+export type JevDualSource = 'primary' | 'laya';
+export type JevDualResult = JevAskResult & {
+    /** Which answer DRIVES the decision. When 'laya', the calling seam must
+     *  only use RELATIVE ordering (degraded mode — see module doc). */
+    source: JevDualSource;
+    /** The pace-maker's own result when it ran (null when the switch is off),
+     *  always logged by jevAsk via the overrides hook. */
+    layaResult: JevAskResult | null;
+};
+export declare function jevAskDual(args: JevDualArgs): Promise<JevDualResult>;

package/lib/jev/dual.js

@@ -0,0 +1,42 @@
+/**
+ * Dual-run pace-maker (design §3.4, added 09-27): fire the configured
+ * backend AND the local laya-serve endpoint in parallel on every jev call.
+ * Ported verbatim from dsh-topics-memory `src/jev/dual.ts` — the wrapper is
+ * business-agnostic.
+ *
+ *  - the PRIMARY answer drives the decision whenever it is ok;
+ *  - the laya answer is always logged (its own call-layer row tagged
+ *    backend='laya' plus verdict rows) — a free, permanently running
+ *    laya-vs-jev comparison on identical questions;
+ *  - when the primary FAILS (cold-start spike, timeout, 5xx…), the laya
+ *    answer — by then already resolved — takes over as DEGRADED: the calling
+ *    seam may only use laya's RELATIVE ranking, never its absolute scores
+ *    against jev-calibrated thresholds (laya's negatives sit in the same band
+ *    as its positives — the 4-way bench, 09-27);
+ *  - laya not running = a refused connection in milliseconds — the switch
+ *    can stay on unconditionally.
+ *
+ * @module jev/dual
+ */
+import { jevAsk } from "./client.js";
+/** Default local laya-serve endpoint (laya repo: `laya[serve]` binds 8000). */
+export const DEFAULT_LAYA_URL = 'http://127.0.0.1:8000/v1/systemone';
+export async function jevAskDual(args) {
+    if (args.config.jevLayaFallback !== true) {
+        const r = await jevAsk(args);
+        return { ...r, source: 'primary', layaResult: null };
+    }
+    const layaArgs = {
+        ...args,
+        config: { ...args.config, jevModel: 'laya-rl-agent' },
+        overrides: { endpoint: args.config.jevLayaUrl || DEFAULT_LAYA_URL, model: 'laya-rl-agent' },
+    };
+    const [primary, laya] = await Promise.all([jevAsk(args), jevAsk(layaArgs)]);
+    if (primary.ok)
+        return { ...primary, source: 'primary', layaResult: laya };
+    if (laya.ok) {
+        return { ok: true, answers: laya.answers, usage: laya.usage, latencyMs: laya.latencyMs, source: 'laya', layaResult: laya };
+    }
+    return { ...primary, source: 'primary', layaResult: laya };
+}
+//# sourceMappingURL=dual.js.map

package/lib/jev/dual.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dual.js","sourceRoot":"","sources":["../../src/jev/dual.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAGpC,+EAA+E;AAC/E,MAAM,CAAC,MAAM,gBAAgB,GAAG,oCAAoC,CAAA;AAwBpE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAiB;IAChD,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,IAAkB,CAAC,CAAA;QAC1C,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;IACtD,CAAC;IACD,MAAM,QAAQ,GAAe;QAC3B,GAAG,IAAI;QACP,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE;QACrD,SAAS,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,gBAAgB,EAAE,KAAK,EAAE,eAAe,EAAE;KAC5F,CAAA;IACD,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,IAAkB,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;IACzF,IAAI,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;IAC1E,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;IAC5H,CAAC;IACD,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;AAC5D,CAAC"}

package/lib/jev/gate.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Outbound secret gate (design 2026-09-25 §3.3) — ported verbatim from
+ * dsh-topics-memory `src/jev/gate.ts`, a self-contained port of the
+ * dsh-jev-mcp `server.mjs` mechanism. The COMPLETE serialized request body
+ * (model, state, questions — byte-identical to what goes on the wire) is
+ * scanned for credential patterns BEFORE anything leaves the process; a hit
+ * aborts the call with a structured descriptor that never echoes the secret.
+ *
+ * SECURITY INVARIANT: hit descriptors carry static metadata only (pattern
+ * name, offset, ≤10 printable chars before the hit) — never the matched
+ * text, and never text at or after the hit point.
+ *
+ * @module jev/gate
+ */
+export interface SecretGateHit {
+    pattern: string;
+    offset: number;
+    context: string;
+}
+/** Minimal logger surface (both sinks optional — bare harnesses have none);
+ *  the gate only ever warns, and a broken logger must not break the gate. */
+export interface GateLogger {
+    warn?: (m: string) => void;
+}
+export declare const BUILTIN_PATTERNS: ReadonlyArray<{
+    name: string;
+    re: RegExp;
+}>;
+/** Literal secrets from the external list file (JEV_SECRET_FILE semantics:
+ *  one entry per line, ≥8 chars, `#` comments skipped, matched at FULL
+ *  length — a >512-char line warns but is never truncated, or everything
+ *  past char 512 would silently escape the gate). */
+export declare function loadExternalSecrets(file: string, log?: GateLogger): string[];
+export declare function currentSecrets(file: string, log?: GateLogger): string[];
+export declare function reloadSecrets(file: string, log?: GateLogger): string[];
+/**
+ * Redacted context: at most 10 printable chars BEFORE the hit plus an
+ * explicit [REDACTED:<pattern>] marker. Content at or after the hit point is
+ * NEVER shown — when a prefix regex under-matches, the secret tail sits
+ * right there. Belt and suspenders: if the matched text or any known
+ * external secret still appears in the context, the whole context collapses
+ * to '[REDACTED]'.
+ */
+export declare function describeHit(pattern: string, offset: number, matched: string, payload: string, externalSecrets?: readonly string[]): SecretGateHit;
+/**
+ * Scan the serialized outbound payload for secrets.
+ * @param payload JSON.stringify({model, state, questions}) — the exact wire body
+ * @param externalSecrets literal secrets from the external list (cached via currentSecrets)
+ * @param externalSource label for hit descriptors (the list file path)
+ */
+export declare function scanForSecrets(payload: string, externalSecrets?: readonly string[], externalSource?: string): SecretGateHit | null;